tewip-ai 0.38.0 → 0.40.0

package/README.md

@@ -750,6 +750,26 @@ A source finding is set aside only when the run opened **that same file** and re
 In a React or Vue project that means nothing is set aside — the source and the rendered output are two
 different artefacts, and neither is evidence about the other.
 
+**Already run Lighthouse instead? That works too** (Phase 32, new):
+
+```bash
+tewip access --report lighthouse-report.json
+```
+
+Lighthouse's accessibility audits *are* axe rules — same rule ids — so the same triage applies. Most
+teams have Lighthouse in CI and no separate axe step; they get the whole of the above from a tool they
+already run.
+
+The catch was that a Lighthouse report strips axe's tags, so it says `landmark-one-main` and nothing
+about which WCAG criterion that is, or whether it is one at all. That distinction covers **30 of axe's
+105 rules**, and a remembered table of a hundred mappings is a table with mistakes in it. So the table
+is **generated from axe-core itself** (`scripts/axe-rules.ts`) — 105 rules, 75 carrying a criterion, 30
+best-practice only, none unclassified.
+
+It also surfaces the **ten audits Lighthouse marks `manual`** — logical tab order, focus traps, whether
+visual order follows the DOM. Those become questions, never passes. A page with no failures and ten
+unanswered manual checks has not passed.
+
 ## Teach it your house rules (Phase 27)
 
 ```bash
@@ -816,7 +836,8 @@ That last section is the part no SQL linter does: it searches your own code for
 away. "This drops `users.nickname`, and four files still read it" is a different sentence from "dropping a
 column is risky", and it is the one that stops the outage.
 
-It reads **SQL, Django, Rails and Alembic** migrations, judges **only the forward path** (a rollback step
+It reads **SQL, Django, Rails, Alembic and TypeORM** migrations — which covers Prisma, Drizzle, Flyway
+and golang-migrate too, since those all emit plain `.sql`. It judges **only the forward path** (a rollback step
 contains the mirror image of the change, so reading it says a migration that creates a table destroys
 one), and stays quiet when the team already did the safe thing — `atomic = False`, `algorithm:
 :concurrently`, `NOT VALID`, `postgresql_concurrently=True`. When it cannot read a migration it says so

package/dist/cli/help.js

@@ -130,7 +130,7 @@ Usage:
                                     --record adds a run to the baseline, and is deliberately not
                                     automatic: a regression recorded by accident becomes next week's
                                     normal. It never predicts a duration or a capacity. No cost.
-  tewip access [<file or directory>] [--report axe.json] [--strict] [--out access.md]
+  tewip access [<file or directory>] [--report axe.json|lighthouse.json] [--strict]
                                     Can everybody use this? Reads your markup and names the barriers
                                     that reading alone can prove - a picture with no alt text, a field
                                     with no label, a div only a mouse can use - each against its WCAG
@@ -139,11 +139,13 @@ Usage:
                                     criterion it cannot reach without rendering the page (contrast,
                                     focus order, whether the alt text is any good) is printed every
                                     time. It never says a page is accessible, only what was checked.
-                                    Give it --report with the JSON from an axe run and it reads that
-                                    too: contrast moves out of the unchecked list, axe rules that map
-                                    to no WCAG criterion are reported as advice rather than barriers
-                                    (51 of 174 findings on nine real pages), and what axe could not
-                                    determine becomes a question. No browser, no network, no model.
+                                    Give it --report with the JSON from an axe run or a Lighthouse
+                                    report and it reads that too - Lighthouse runs axe rules, so
+                                    either works. Contrast moves out of the unchecked list, rules
+                                    that map to no WCAG criterion are reported as advice rather than
+                                    barriers (51 of 174 findings on nine real pages), and what the
+                                    tool could not determine becomes a question. Lighthouse's ten
+                                    manual checks are questions too, never passes. No model, no cost.
   tewip standards [--diff main...HEAD] [--strict] [--out standards.md]
                                     Teach Tewip your house rules. Markdown files in
                                     .tewip/standards/ - a forbid or require line is checked and

package/dist/engine/access/access-command.js

@@ -14,9 +14,13 @@ import { sourceFiles } from '../secure/secrets.js';
 import { JS_LIKE, MARKUP, tags } from './markup.js';
 import { checkFile } from './checks.js';
 import { readAxeReport } from './reports.js';
-import { merge, nowChecked, pagesIn, renderBrowserSection, standardOf, stillNotChecked } from './merge.js';
-import { blocks, criterionOf, NOT_CHECKED, RULES } from './wcag.js';
-const ORDER = { blocker: 0, serious: 1, moderate: 2, minor: 3 };
+import { isLighthouseFile, readLighthouse } from '../perf/lighthouse.js';
+import { accessibilityFromLighthouse, criteriaFromLighthouse, rulesRunByLighthouse } from './from-lighthouse.js';
+import { merge, pagesIn } from './merge.js';
+import { renderAccess, worstFirst } from './render.js';
+// Re-exported so callers do not have to know the report moved into its own file.
+export { renderAccess, worstFirst };
+import { blocks } from './wcag.js';
 /** One line per finding a person has already judged: "<rule> <file>:<line> - reason". */
 export function readAccepted(root) {
     const file = join(root, '.tewip', 'access-accepted.txt');
@@ -30,15 +34,6 @@ export function readAccepted(root) {
 export function keyOf(f) {
     return `${f.rule} ${f.file}:${f.line}`;
 }
-export function worstFirst(a, b) {
-    const sa = ORDER[RULES[a.rule]?.severity ?? 'minor'];
-    const sb = ORDER[RULES[b.rule]?.severity ?? 'minor'];
-    if (sa !== sb)
-        return sa - sb;
-    if (a.file !== b.file)
-        return a.file < b.file ? -1 : 1;
-    return a.line - b.line;
-}
 /** Reads every markup file under `root` and returns what the markup alone can settle. */
 /**
  * Markup written to exercise code, not to be used by a person. An `<img>` with no alt in a
@@ -71,119 +66,24 @@ export function findBarriers(root, only) {
     }
     return { findings, filesRead };
 }
-function group(findings) {
-    const by = new Map();
-    for (const f of findings) {
-        const list = by.get(f.rule);
-        if (list)
-            list.push(f);
-        else
-            by.set(f.rule, [f]);
-    }
-    return by;
-}
-function section(title, findings, lines) {
-    if (findings.length === 0)
-        return;
-    lines.push(`## ${title}`, '');
-    for (const [rule, found] of group(findings)) {
-        const meta = RULES[rule];
-        lines.push(`### ${rule} - ${found.length} ${found.length === 1 ? 'place' : 'places'}`, '');
-        lines.push(`${criterionOf(rule)}, ${meta?.severity ?? 'unrated'}.`, '');
-        if (meta)
-            lines.push(`Who it stops: ${meta.stops}.`, '');
-        for (const f of found.slice(0, 20)) {
-            lines.push(`- \`${f.file}:${f.line}\`  ${f.element}`);
-            lines.push(`  - ${f.why}`);
-            lines.push(`  - do this: ${f.next}`);
-        }
-        if (found.length > 20)
-            lines.push(`- ...and ${found.length - 20} more of the same, in the JSON beside this report.`);
-        lines.push('');
-    }
-}
-export function renderAccess(result, scanned) {
-    const { barriers, questions, accepted, filesRead, browser } = result;
-    const lines = ['# Tewip accessibility check', ''];
-    lines.push(`Read ${filesRead} markup ${filesRead === 1 ? 'file' : 'files'} under \`${scanned}\`, without rendering any of them.`, '');
-    if (browser) {
-        lines.push(`Also read an axe run over ${browser.pages.length} rendered ${browser.pages.length === 1 ? 'page' : 'pages'}, ` +
-            'which settles what reading markup cannot.', '');
-    }
-    if (barriers.length === 0 && questions.length === 0 && !browser) {
-        lines.push('No barrier was found that reading the markup can settle, and nothing needs a decision.', '');
-    }
-    else {
-        const stopping = barriers.filter((f) => blocks(f.rule)).length;
-        const counts = [
-            `${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} (${stopping} that stop somebody outright)`,
-            `${questions.length} for a person to settle`,
-        ];
-        if (accepted.length > 0)
-            counts.push(`${accepted.length} already accepted`);
-        if (browser) {
-            counts.unshift(`${browser.barriers.length} barriers the browser run proves`);
-            if (browser.questions.length > 0)
-                counts.push(`${browser.questions.length} the browser could not determine`);
-        }
-        lines.push(`**${counts.join(', ')}.**`, '');
-    }
-    if (browser) {
-        renderBrowserSection('Barriers seen in the browser', browser.barriers, lines);
-        renderBrowserSection('The browser could not determine these', browser.questions, lines);
-    }
-    section('Barriers read from the source', [...barriers].sort(worstFirst), lines);
-    section('Only a person can settle these', [...questions].sort(worstFirst), lines);
-    if (browser && browser.advice.length > 0) {
-        // Kept out of the counts above on purpose. These are axe's own best-practice rules, which test
-        // no standard: on nine real pages they were 51 of 174 findings, outnumbering every real barrier.
-        // Reporting them as equals is how a team learns to ignore the whole report.
-        const rules = [...new Set(browser.advice.map((f) => f.rule))].sort();
-        lines.push('## Advice, not barriers', '');
-        lines.push(`${browser.advice.length} findings come from axe rules that map to no WCAG criterion - ` +
-            `${rules.join(', ')}. They are somebody's good idea rather than a standard, so they are not counted as barriers ` +
-            'and never fail a build. Worth reading once; not worth a release.', '');
-    }
-    if (browser && browser.superseded.length > 0) {
-        lines.push('## Set aside, because the browser run checked them', '');
-        lines.push(`${browser.superseded.length} source ${browser.superseded.length === 1 ? 'finding' : 'findings'} ` +
-            'are not listed above: the axe run checked their criterion on a rendered page, so its answer is the better ' +
-            'one and repeating them here would count the same barrier twice. They are in the JSON beside this report.', '');
-    }
-    if (accepted.length > 0) {
-        lines.push('## Already accepted', '');
-        lines.push(`${accepted.length} ${accepted.length === 1 ? 'finding is' : 'findings are'} listed in \`.tewip/access-accepted.txt\`, so they are not repeated here.`, '');
-    }
-    // Coverage comes from every rule that ran, not from the ones that found something: a contrast
-    // check that ran and passed has still checked contrast.
-    const ran = browser?.rulesRun ?? new Set();
-    const settled = nowChecked(ran);
-    const remaining = stillNotChecked(ran);
-    if (settled.length > 0) {
-        lines.push('## Checked here only because a browser run was given', '');
-        for (const n of settled)
-            lines.push(`- **${n.criterion}** - would otherwise be unreachable: ${n.why}`);
-        lines.push('');
-    }
-    lines.push('## What was not checked', '');
-    lines.push(browser
-        ? 'Even with the browser run, none of the following was tested:'
-        : 'This read the markup. It did not render a page, so none of the following was tested:', '');
-    for (const n of remaining)
-        lines.push(`- **${n.criterion}** - ${n.why}`);
-    if (browser) {
-        lines.push('');
-        lines.push(`The run covered ${browser.pages.length} ${browser.pages.length === 1 ? 'page' : 'pages'}. ` +
-            'Nothing is known about a page it did not open, or about a state it did not reach - a dialog that was never ' +
-            'opened, a form that was never submitted, an error that was never triggered.');
-    }
-    lines.push('');
-    lines.push('A clean result here means these checks found nothing, not that the product is accessible. ' +
-        'Roughly a third of WCAG can be judged by a machine at all' +
-        (browser ? '' : ', and reading source rather than a rendered page reaches less than that') +
-        '. The rest needs a person, ideally one who uses a screen reader.', '');
-    lines.push('To accept a finding, add its key to `.tewip/access-accepted.txt`, one per line, with a reason after ` - `.', '');
-    return lines.join('\n');
+/**
+ * Reads whichever browser evidence the team actually has.
+ *
+ * axe and Lighthouse are the same rules - Lighthouse runs axe - so both become one shape and are
+ * triaged identically. A team with Lighthouse in CI and no separate axe step gets the same answers
+ * without adding a tool (Phase 32).
+ */
+export function readBrowserRun(path) {
+    if (!isLighthouseFile(path))
+        return readAxeReport(path);
+    const report = readLighthouse(path);
+    return {
+        source: 'lighthouse',
+        findings: accessibilityFromLighthouse(report),
+        pages: new Set(report.url === '' ? [] : [report.url]),
+        rulesRun: rulesRunByLighthouse(report),
+        criteriaCovered: criteriaFromLighthouse(report),
+    };
 }
 export function runAccess(cmd) {
     const root = resolve(cmd.root);
@@ -193,7 +93,7 @@ export function runAccess(cmd) {
     const open = findings.filter((f) => !alreadyJudged.has(keyOf(f)));
     // Phase 29: a browser run, where one was given. It is the better witness for every criterion it
     // checked, so the source findings for those criteria are set aside rather than repeated.
-    const run = cmd.report ? readAxeReport(resolve(root, cmd.report)) : undefined;
+    const run = cmd.report ? readBrowserRun(resolve(root, cmd.report)) : undefined;
     const graded = run ? merge(open, run, root) : undefined;
     const kept = graded ? graded.kept : open;
     const barriers = kept.filter((f) => f.confidence === 'barrier');
@@ -206,6 +106,7 @@ export function runAccess(cmd) {
             superseded: graded.superseded,
             pages: pagesIn(run),
             rulesRun: run.rulesRun,
+            tool: run.source,
         }
         : undefined;
     const result = { barriers, questions, accepted, filesRead, ...(browser ? { browser } : {}) };

package/dist/engine/access/axe-rules.js

@@ -0,0 +1,128 @@
+// Phase 32: what each axe rule tests, taken from axe-core itself.
+//
+// Lighthouse's accessibility audits are axe rules - the ids are identical - but a Lighthouse report
+// does not carry axe's tags, so it says "landmark-one-main" and nothing about which criterion that
+// is, or whether it is a criterion at all. Phase 29 needs that to tell a legal failure from somebody's
+// good idea, and 42% of axe's output is the latter.
+//
+// Writing the table by hand was the reason Phase 31 left this undone: a remembered mapping between a
+// hundred rule ids and WCAG numbers is a mapping with mistakes in it, and a wrong criterion beside a
+// finding is worse than no criterion. So the table is **generated**: axe-core is loaded in a browser
+// and asked for its own rule catalogue, and these are its tags, parsed the same way Phase 29 parses
+// the tags on a live run.
+//
+// Generated from axe-core 4.14.0. 105 rules: 75 carry a WCAG criterion,
+// 30 are tagged best-practice only and test no standard at all.
+// Regenerate with: node scripts/axe-rules.ts - never by editing this file.
+export const AXE_CORE_VERSION = '4.14.0';
+export const AXE_RULES = {
+    'accesskeys': { criterion: null, level: null, en301549: null },
+    'area-alt': { criterion: '2.4.4', level: 'A', en301549: '9.2.4.4' },
+    'aria-allowed-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-allowed-role': { criterion: null, level: null, en301549: null },
+    'aria-braille-equivalent': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-command-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-conditional-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-deprecated-role': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-dialog-name': { criterion: null, level: null, en301549: null },
+    'aria-hidden-body': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-hidden-focus': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-input-field-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-meter-name': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'aria-progressbar-name': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'aria-prohibited-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-required-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-required-children': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-required-parent': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'aria-roledescription': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-roles': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-tab-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-text': { criterion: null, level: null, en301549: null },
+    'aria-toggle-field-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-tooltip-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-treeitem-name': { criterion: null, level: null, en301549: null },
+    'aria-valid-attr': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'aria-valid-attr-value': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'audio-caption': { criterion: '1.2.1', level: 'A', en301549: '9.1.2.1' },
+    'autocomplete-valid': { criterion: '1.3.5', level: 'AA', en301549: '9.1.3.5' },
+    'avoid-inline-spacing': { criterion: '1.4.12', level: 'AA', en301549: '9.1.4.12' },
+    'blink': { criterion: '2.2.2', level: 'A', en301549: '9.2.2.2' },
+    'button-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'bypass': { criterion: '2.4.1', level: 'A', en301549: '9.2.4.1' },
+    'color-contrast': { criterion: '1.4.3', level: 'AA', en301549: '9.1.4.3' },
+    'color-contrast-enhanced': { criterion: '1.4.6', level: 'AAA', en301549: null },
+    'css-orientation-lock': { criterion: '1.3.4', level: 'AA', en301549: '9.1.3.4' },
+    'definition-list': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'dlitem': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'document-title': { criterion: '2.4.2', level: 'A', en301549: '9.2.4.2' },
+    'duplicate-id': { criterion: '4.1.1', level: null, en301549: null },
+    'duplicate-id-active': { criterion: '4.1.1', level: null, en301549: null },
+    'duplicate-id-aria': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'empty-heading': { criterion: null, level: null, en301549: null },
+    'empty-table-header': { criterion: null, level: null, en301549: null },
+    'focus-order-semantics': { criterion: null, level: null, en301549: null },
+    'form-field-multiple-labels': { criterion: '3.3.2', level: 'A', en301549: '9.3.3.2' },
+    'frame-focusable-content': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'frame-tested': { criterion: null, level: null, en301549: null },
+    'frame-title': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'frame-title-unique': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'heading-order': { criterion: null, level: null, en301549: null },
+    'hidden-content': { criterion: null, level: null, en301549: null },
+    'html-has-lang': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'html-lang-valid': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'html-xml-lang-mismatch': { criterion: '3.1.1', level: 'A', en301549: '9.3.1.1' },
+    'identical-links-same-purpose': { criterion: '2.4.9', level: 'AAA', en301549: null },
+    'image-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'image-redundant-alt': { criterion: null, level: null, en301549: null },
+    'input-button-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'input-image-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'label': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'label-content-name-mismatch': { criterion: '2.5.3', level: 'A', en301549: '9.2.5.3' },
+    'label-title-only': { criterion: null, level: null, en301549: null },
+    'landmark-banner-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-complementary-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-contentinfo-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-main-is-top-level': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-banner': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-contentinfo': { criterion: null, level: null, en301549: null },
+    'landmark-no-duplicate-main': { criterion: null, level: null, en301549: null },
+    'landmark-one-main': { criterion: null, level: null, en301549: null },
+    'landmark-unique': { criterion: null, level: null, en301549: null },
+    'link-in-text-block': { criterion: '1.4.1', level: 'A', en301549: '9.1.4.1' },
+    'link-name': { criterion: '2.4.4', level: 'A', en301549: '9.2.4.4' },
+    'list': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'listitem': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'marquee': { criterion: '2.2.2', level: 'A', en301549: '9.2.2.2' },
+    'meta-refresh': { criterion: '2.2.1', level: 'A', en301549: '9.2.2.1' },
+    'meta-refresh-no-exceptions': { criterion: '2.2.4', level: 'AAA', en301549: null },
+    'meta-viewport': { criterion: '1.4.4', level: 'AA', en301549: '9.1.4.4' },
+    'meta-viewport-large': { criterion: null, level: null, en301549: null },
+    'nested-interactive': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'no-autoplay-audio': { criterion: '1.4.2', level: 'A', en301549: '9.1.4.2' },
+    'object-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'p-as-heading': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'page-has-heading-one': { criterion: null, level: null, en301549: null },
+    'presentation-role-conflict': { criterion: null, level: null, en301549: null },
+    'region': { criterion: null, level: null, en301549: null },
+    'role-img-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'scope-attr-valid': { criterion: null, level: null, en301549: null },
+    'scrollable-region-focusable': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'select-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'server-side-image-map': { criterion: '2.1.1', level: 'A', en301549: '9.2.1.1' },
+    'skip-link': { criterion: null, level: null, en301549: null },
+    'summary-name': { criterion: '4.1.2', level: 'A', en301549: '9.4.1.2' },
+    'svg-img-alt': { criterion: '1.1.1', level: 'A', en301549: '9.1.1.1' },
+    'tabindex': { criterion: null, level: null, en301549: null },
+    'table-duplicate-name': { criterion: null, level: null, en301549: null },
+    'table-fake-caption': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'target-size': { criterion: '2.5.8', level: 'AA', en301549: '9.2.5.8' },
+    'td-has-header': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'td-headers-attr': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'th-has-data-cells': { criterion: '1.3.1', level: 'A', en301549: '9.1.3.1' },
+    'valid-lang': { criterion: '3.1.2', level: 'AA', en301549: '9.3.1.2' },
+    'video-caption': { criterion: '1.2.2', level: 'A', en301549: '9.1.2.2' },
+};
+/** What a rule tests, or undefined when axe has no rule by that name. */
+export function factsFor(ruleId) {
+    return AXE_RULES[ruleId];
+}

package/dist/engine/access/from-lighthouse.js

@@ -0,0 +1,74 @@
+import { factsFor } from './axe-rules.js';
+/** WCAG's own ordering: level A is the most basic requirement, so its failures come first. */
+const BY_LEVEL = { A: 'blocker', AA: 'serious', AAA: 'moderate' };
+/**
+ * The accessibility half of a Lighthouse report, as findings the Phase 29 report can print.
+ *
+ * Three kinds come out, the same three an axe run produces:
+ *   - a failing audit whose rule tests a WCAG criterion  -> a barrier;
+ *   - a failing audit whose rule tests nobody's standard -> advice;
+ *   - an audit Lighthouse marks `manual`                 -> a question, because Lighthouse itself
+ *     declines to answer it. Those are not passes, and a page with no failures and ten unanswered
+ *     manual checks has not passed.
+ */
+export function accessibilityFromLighthouse(report) {
+    const out = [];
+    const page = report.url;
+    for (const failure of report.accessibilityFailures) {
+        const facts = factsFor(failure.id);
+        const criterion = facts?.criterion ?? null;
+        out.push({
+            rule: failure.id,
+            tool: 'axe',
+            confidence: criterion === null ? 'advice' : 'barrier',
+            criterion,
+            level: facts?.level ?? null,
+            en301549: facts?.en301549 ?? null,
+            severity: criterion === null ? 'minor' : (BY_LEVEL[facts?.level ?? 'A'] ?? 'serious'),
+            html: failure.snippet,
+            selector: failure.selector,
+            page,
+            why: failure.title,
+            next: failure.explanation || failure.title,
+        });
+    }
+    for (const check of report.manual) {
+        const facts = factsFor(check.id);
+        out.push({
+            rule: check.id,
+            tool: 'axe',
+            confidence: 'ask-a-person',
+            criterion: facts?.criterion ?? null,
+            level: facts?.level ?? null,
+            en301549: facts?.en301549 ?? null,
+            severity: 'moderate',
+            html: '',
+            selector: '',
+            page,
+            why: `${check.title}. Lighthouse does not score this one and hands it to a person`,
+            next: 'check it yourself, ideally with a keyboard and a screen reader; it is neither a pass nor a failure until somebody looks',
+        });
+    }
+    return out;
+}
+/**
+ * Which axe rules a Lighthouse run actually exercised.
+ *
+ * Everything in the accessibility category ran, including the audits that passed and the ones that
+ * did not apply to this page - both are evidence the rule was checked. This is what lets a
+ * Lighthouse run move contrast off the "not checked" list, exactly as an axe run does, since
+ * `color-contrast` is one of the rules it runs.
+ */
+export function rulesRunByLighthouse(report) {
+    return new Set(report.accessibilityAuditIds);
+}
+/** The criteria those rules test, for shrinking what the report has to call unchecked. */
+export function criteriaFromLighthouse(report) {
+    const out = new Set();
+    for (const id of report.accessibilityAuditIds) {
+        const criterion = factsFor(id)?.criterion;
+        if (criterion)
+            out.add(criterion);
+    }
+    return out;
+}

package/dist/engine/access/render.js

@@ -0,0 +1,133 @@
+// Phase 28-32: writing the accessibility report.
+//
+// Split out of access-command.ts to keep every file in this project under 300 lines, which the
+// Lighthouse reader pushed it past. The rendering is the part most worth keeping readable: it is
+// where the distinction between a barrier, a question and a piece of advice is actually made
+// visible to a person, and where what was *not* checked gets said.
+import { nowChecked, renderBrowserSection, stillNotChecked } from './merge.js';
+import { blocks, criterionOf, RULES } from './wcag.js';
+const ORDER = { blocker: 0, serious: 1, moderate: 2, minor: 3 };
+export function worstFirst(a, b) {
+    const sa = ORDER[RULES[a.rule]?.severity ?? 'minor'];
+    const sb = ORDER[RULES[b.rule]?.severity ?? 'minor'];
+    if (sa !== sb)
+        return sa - sb;
+    if (a.file !== b.file)
+        return a.file < b.file ? -1 : 1;
+    return a.line - b.line;
+}
+function group(findings) {
+    const by = new Map();
+    for (const f of findings) {
+        const list = by.get(f.rule);
+        if (list)
+            list.push(f);
+        else
+            by.set(f.rule, [f]);
+    }
+    return by;
+}
+function section(title, findings, lines) {
+    if (findings.length === 0)
+        return;
+    lines.push(`## ${title}`, '');
+    for (const [rule, found] of group(findings)) {
+        const meta = RULES[rule];
+        lines.push(`### ${rule} - ${found.length} ${found.length === 1 ? 'place' : 'places'}`, '');
+        lines.push(`${criterionOf(rule)}, ${meta?.severity ?? 'unrated'}.`, '');
+        if (meta)
+            lines.push(`Who it stops: ${meta.stops}.`, '');
+        for (const f of found.slice(0, 20)) {
+            lines.push(`- \`${f.file}:${f.line}\`  ${f.element}`);
+            lines.push(`  - ${f.why}`);
+            lines.push(`  - do this: ${f.next}`);
+        }
+        if (found.length > 20)
+            lines.push(`- ...and ${found.length - 20} more of the same, in the JSON beside this report.`);
+        lines.push('');
+    }
+}
+export function renderAccess(result, scanned) {
+    const { barriers, questions, accepted, filesRead, browser } = result;
+    const lines = ['# Tewip accessibility check', ''];
+    lines.push(`Read ${filesRead} markup ${filesRead === 1 ? 'file' : 'files'} under \`${scanned}\`, without rendering any of them.`, '');
+    if (browser) {
+        lines.push(`Also read a ${browser.tool === 'lighthouse' ? 'Lighthouse' : 'axe'} run over ${browser.pages.length} rendered ` +
+            `${browser.pages.length === 1 ? 'page' : 'pages'}, ` +
+            'which settles what reading markup cannot.', '');
+    }
+    if (barriers.length === 0 && questions.length === 0 && !browser) {
+        lines.push('No barrier was found that reading the markup can settle, and nothing needs a decision.', '');
+    }
+    else {
+        const stopping = barriers.filter((f) => blocks(f.rule)).length;
+        const counts = [
+            `${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} (${stopping} that stop somebody outright)`,
+            `${questions.length} for a person to settle`,
+        ];
+        if (accepted.length > 0)
+            counts.push(`${accepted.length} already accepted`);
+        if (browser) {
+            counts.unshift(`${browser.barriers.length} barriers the browser run proves`);
+            if (browser.questions.length > 0)
+                counts.push(`${browser.questions.length} the browser could not determine`);
+        }
+        lines.push(`**${counts.join(', ')}.**`, '');
+    }
+    if (browser) {
+        renderBrowserSection('Barriers seen in the browser', browser.barriers, lines);
+        renderBrowserSection('The browser could not determine these', browser.questions, lines);
+    }
+    section('Barriers read from the source', [...barriers].sort(worstFirst), lines);
+    section('Only a person can settle these', [...questions].sort(worstFirst), lines);
+    if (browser && browser.advice.length > 0) {
+        // Kept out of the counts above on purpose. These are axe's own best-practice rules, which test
+        // no standard: on nine real pages they were 51 of 174 findings, outnumbering every real barrier.
+        // Reporting them as equals is how a team learns to ignore the whole report.
+        const rules = [...new Set(browser.advice.map((f) => f.rule))].sort();
+        lines.push('## Advice, not barriers', '');
+        lines.push(`${browser.advice.length} ${browser.advice.length === 1 ? 'finding comes' : 'findings come'} from axe rules that map to no WCAG criterion - ` +
+            `${rules.join(', ')}. They are somebody's good idea rather than a standard, so they are not counted as barriers ` +
+            'and never fail a build. Worth reading once; not worth a release.', '');
+    }
+    if (browser && browser.superseded.length > 0) {
+        lines.push('## Set aside, because the browser run checked them', '');
+        lines.push(`${browser.superseded.length} source ${browser.superseded.length === 1 ? 'finding' : 'findings'} ` +
+            'are not listed above: the axe run checked their criterion on a rendered page, so its answer is the better ' +
+            'one and repeating them here would count the same barrier twice. They are in the JSON beside this report.', '');
+    }
+    if (accepted.length > 0) {
+        lines.push('## Already accepted', '');
+        lines.push(`${accepted.length} ${accepted.length === 1 ? 'finding is' : 'findings are'} listed in \`.tewip/access-accepted.txt\`, so they are not repeated here.`, '');
+    }
+    // Coverage comes from every rule that ran, not from the ones that found something: a contrast
+    // check that ran and passed has still checked contrast.
+    const ran = browser?.rulesRun ?? new Set();
+    const settled = nowChecked(ran);
+    const remaining = stillNotChecked(ran);
+    if (settled.length > 0) {
+        lines.push('## Checked here only because a browser run was given', '');
+        for (const n of settled)
+            lines.push(`- **${n.criterion}** - would otherwise be unreachable: ${n.why}`);
+        lines.push('');
+    }
+    lines.push('## What was not checked', '');
+    lines.push(browser
+        ? 'Even with the browser run, none of the following was tested:'
+        : 'This read the markup. It did not render a page, so none of the following was tested:', '');
+    for (const n of remaining)
+        lines.push(`- **${n.criterion}** - ${n.why}`);
+    if (browser) {
+        lines.push('');
+        lines.push(`The run covered ${browser.pages.length} ${browser.pages.length === 1 ? 'page' : 'pages'}. ` +
+            'Nothing is known about a page it did not open, or about a state it did not reach - a dialog that was never ' +
+            'opened, a form that was never submitted, an error that was never triggered.');
+    }
+    lines.push('');
+    lines.push('A clean result here means these checks found nothing, not that the product is accessible. ' +
+        'Roughly a third of WCAG can be judged by a machine at all' +
+        (browser ? '' : ', and reading source rather than a rendered page reaches less than that') +
+        '. The rest needs a person, ideally one who uses a screen reader.', '');
+    lines.push('To accept a finding, add its key to `.tewip/access-accepted.txt`, one per line, with a reason after ` - `.', '');
+    return lines.join('\n');
+}

package/dist/engine/access/reports.js

@@ -145,7 +145,7 @@ export function readAxeReport(path) {
     catch {
         throw new Error(`${path} is not JSON. Tewip reads the JSON an axe run writes.`);
     }
-    const run = { findings: [], pages: new Set(), rulesRun: new Set(), criteriaCovered: new Set() };
+    const run = { source: 'axe', findings: [], pages: new Set(), rulesRun: new Set(), criteriaCovered: new Set() };
     const pageOf = (v, fallback) => text(v.url) || text(v.page) || fallback;
     if (looksLikeAxe(parsed)) {
         fromResult(parsed, pageOf(parsed, path), run);

package/dist/engine/perf/lighthouse.js

@@ -102,12 +102,17 @@ export function readLighthouse(path) {
     }
     const accessibilityFailures = [];
     const manual = [];
+    const accessibilityAuditIds = [];
     const a11yRefs = (categories.accessibility?.auditRefs ?? []);
     for (const ref of a11yRefs) {
         const audit = audits[text(ref.id)];
         if (!audit)
             continue;
         const id = text(audit.id);
+        // Recorded before the outcome is looked at: a rule that passed, or did not apply to this page,
+        // has still been checked, and that is what coverage means.
+        if (id !== '')
+            accessibilityAuditIds.push(id);
         if (audit.scoreDisplayMode === 'manual') {
             manual.push({ id, title: text(audit.title) });
             continue;
@@ -133,6 +138,7 @@ export function readLighthouse(path) {
         categories: Object.fromEntries(Object.entries(categories).map(([k, v]) => [k, num(v?.score)])),
         accessibilityFailures,
         manual,
+        accessibilityAuditIds,
         url: text(o.finalDisplayedUrl) || text(o.finalUrl) || text(o.requestedUrl),
         lighthouseVersion: text(o.lighthouseVersion),
     };

package/dist/engine/schema/frameworks.js

@@ -11,6 +11,12 @@ export function dialectOf(file, text) {
         return 'rails';
     if (/\bop\.(?:drop_column|add_column|create_index|alter_column|drop_table|rename_table|execute)\b/.test(text))
         return 'alembic';
+    // TypeORM writes a migration as a class with up() and down(), and puts the real DDL in template
+    // strings passed to queryRunner.query(). The SQL is right there and perfectly readable; only the
+    // wrapper was unfamiliar, so every TypeORM project was told Tewip could not read its migrations
+    // at all - and on a Node backend that is most of them.
+    if (/\bMigrationInterface\b|\bqueryRunner\.query\s*\(/.test(text))
+        return 'typeorm';
     if (/(^|\/)(migrations?|db\/migrate)\//.test(path))
         return 'unknown';
     return 'unknown';
@@ -157,7 +163,12 @@ const ALEMBIC = [
         table: (m) => m[1],
     },
 ];
-const BY_DIALECT = { django: DJANGO, rails: RAILS, alembic: ALEMBIC };
+// TypeORM has no operations of its own: unlike Django's `RemoveField` or Rails's `remove_column`,
+// a TypeORM migration contains SQL and nothing else, handed to queryRunner.query(). So its list is
+// empty on purpose and every finding comes from reading that SQL, which is the same reader the
+// `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
+// TypeORM migration silently producing no findings at all.
+const BY_DIALECT = { django: DJANGO, rails: RAILS, alembic: ALEMBIC, typeorm: [] };
 /** Findings from a framework migration, with the line each one sits on. */
 export function readFramework(dialect, text) {
     const lines = text.split(String.fromCharCode(10));
@@ -216,7 +227,10 @@ export function forwardOnly(dialect, text) {
         const line = lines[i];
         const down = (dialect === 'rails' && /^\s*def\s+down\b/.test(line)) ||
             (dialect === 'alembic' && /^\s*def\s+downgrade\s*\(/.test(line)) ||
-            (dialect === 'sql' && /^\s*--\s*(?:\+migrate\s+Down|\+goose\s+Down|\/\/@UNDO|Down\b)/i.test(line));
+            (dialect === 'sql' && /^\s*--\s*(?:\+migrate\s+Down|\+goose\s+Down|\/\/@UNDO|Down\b)/i.test(line)) ||
+            // TypeORM's rollback is `public async down(queryRunner: QueryRunner)`. Reading it as part of
+            // the change would report a migration that adds a column as one that drops it.
+            (dialect === 'typeorm' && /^\s*(?:public\s+)?async\s+down\s*\(/.test(line));
         if (down) {
             // To the end of the block: the next line at the same indentation or less that starts something new.
             blankFrom(i, (l, indent) => l.trim() !== '' && indentOf(l) <= indent && !/^\s*(end|\})\s*$/.test(l), indentOf(line));

package/dist/engine/schema/schema-command.js

@@ -17,10 +17,39 @@ const MIGRATION = /(^|\/)(migrations?|db\/migrate|prisma\/migrations|alembic|fly
 const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|db\/migrate)\/.*\.(py|rb|js|ts)$/i;
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
-    const given = cmd.files && cmd.files.length > 0 ? cmd.files : (changeSummary(cmd.root, cmd.diff)?.files ?? []);
+    const named = cmd.files !== undefined && cmd.files.length > 0;
+    const given = named ? cmd.files : (changeSummary(cmd.root, cmd.diff)?.files ?? []);
     return given
         .map((f) => f.split('\\').join('/'))
-        .filter((f) => (SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+        // Asking for a file by name overrides the path filter: the filter exists to find migrations in
+        // a diff of a hundred files, not to argue with somebody who pointed at one. A TypeORM migration
+        // sitting outside a migrations/ directory was being answered with "no migration in this change".
+        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+}
+/**
+ * Tables this migration creates itself.
+ *
+ * A lock is only expensive because of the rows it holds up, and a table created three statements
+ * earlier has none. This matters enormously on the tools that generate their SQL: a Prisma project
+ * emits `CREATE TABLE` followed by an `ADD CONSTRAINT ... FOREIGN KEY` for every relation, so
+ * documenso's 165 real migrations produced 275 "blocks writes while it runs" findings - 1.7 per
+ * migration, nearly all of them about tables that did not exist a moment before. That is the volume
+ * at which a team stops reading the report, which costs more than the warnings are worth.
+ */
+function createdHere(text) {
+    const names = new Set();
+    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?"?([\w$.]+)"?/gi)) {
+        names.add(m[1].toLowerCase().replace(/^.*\./, ''));
+    }
+    return names;
+}
+/** Risks that are only risks because rows already exist. */
+const ONLY_HURTS_EXISTING_ROWS = new Set(['locks-writes', 'slow']);
+export function droppingWhatIsNew(findings, text) {
+    const fresh = createdHere(text);
+    if (fresh.size === 0)
+        return findings;
+    return findings.filter((f) => !(ONLY_HURTS_EXISTING_ROWS.has(f.risk) && fresh.has(f.table.toLowerCase().replace(/^.*\./, ''))));
 }
 export function readMigration(root, file) {
     let text = '';
@@ -35,13 +64,13 @@ export function readMigration(root, file) {
     // part of the change says a migration that creates a table destroys one.
     const forward = forwardOnly(dialect, text);
     if (dialect === 'sql')
-        return { file, dialect, findings: readSql(forward), unread: '', irreversible: false };
+        return { file, dialect, findings: droppingWhatIsNew(readSql(forward), forward), unread: '', irreversible: false };
     if (dialect === 'unknown') {
         return {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails and Alembic migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic and TypeORM migrations',
             irreversible: false,
         };
     }
@@ -49,10 +78,12 @@ export function readMigration(root, file) {
     // A migration that only runs raw SQL through the framework is still readable: the SQL is the migration.
     // Raw SQL, however it reaches the database: through the framework, or through a cursor inside a data
     // migration, which is where most large projects put the dangerous parts.
-    const raw = [...forward.matchAll(/(?:RunSQL|op\.execute|execute|cursor\.execute)\(\s*(?:r?["'`]{1,3})([\s\S]*?)["'`]{1,3}\s*[,)]/g)].map((m) => m[1]).join(';');
+    // `queryRunner.query` is TypeORM's, and is the whole of a TypeORM migration rather than an
+    // escape hatch inside one: the class is a wrapper and every statement arrives this way.
+    const raw = [...forward.matchAll(/(?:RunSQL|op\.execute|queryRunner\.query|execute|cursor\.execute)\(\s*(?:r?["'`]{1,3})([\s\S]*?)["'`]{1,3}\s*[,)]/g)].map((m) => m[1]).join(';');
     if (raw.trim())
         findings.push(...readSql(raw));
-    return { file, dialect, findings, unread: '', irreversible: irreversible(dialect, text) };
+    return { file, dialect, findings: droppingWhatIsNew(findings, forward), unread: '', irreversible: irreversible(dialect, text) };
 }
 /**
  * Code outside the migrations that still names a table or column this change takes away.

package/dist/engine/schema/statements.js

@@ -20,7 +20,12 @@ const RULES = [
         table: (m) => bare(m[1]),
     },
     {
-        find: new RegExp(String.raw `\bALTER\s+TABLE\s+(${NAME})[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?:IF\s+EXISTS\s+)?(${NAME})`, 'i'),
+        // The word COLUMN is optional in SQL, so the name after DROP has to be checked against the
+        // other things an ALTER TABLE can drop. Without the lookahead, Prisma's own
+        // `ALTER TABLE "Share" DROP CONSTRAINT "Share_userId_fkey"` - which every Prisma project is full
+        // of - was read as dropping a column called CONSTRAINT, and reported as breaking the running
+        // version, which dropping a foreign key does not do. Found on documenso's real migrations.
+        find: new RegExp(String.raw `\bALTER\s+TABLE\s+(${NAME})[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?:IF\s+EXISTS\s+)?(?!CONSTRAINT\b|INDEX\b|DEFAULT\b|NOT\s+NULL\b|PRIMARY\b|FOREIGN\b|CHECK\b|UNIQUE\b|PARTITION\b)(${NAME})`, 'i'),
         risk: 'breaks-old-code',
         what: (m) => `drops the column ${bare(m[2])} from ${bare(m[1])}`,
         instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration. During a rolling deploy the old version is still running and will fail on a column that is gone',

package/dist/mcp/tools-prove.js

@@ -131,20 +131,19 @@ export function registerProofTools(server, { answer, readOnly, project }) {
             axeReport: z
                 .string()
                 .optional()
-                .describe('The JSON from an axe run, if the project has one. It settles contrast, which reading markup cannot, and its findings are triaged rather than relayed: axe rules that map to no WCAG criterion are reported as advice, and what axe could not determine becomes a question.'),
+                .describe('The JSON from an axe run OR a Lighthouse report, if the project has either - Lighthouse runs axe rules, so both work. It settles contrast, which reading markup cannot, and its findings are triaged rather than relayed: rules that map to no WCAG criterion are reported as advice, and what the tool could not determine becomes a question.'),
         },
         annotations: readOnly,
     }, ({ project: root, path, axeReport }) => answer(async () => {
         if (!isAbsolute(root) || !existsSync(root))
             throw new Error(`project must be an existing absolute path, got "${root}"`);
         // The pure functions, not runAccess: that one prints, and anything on stdout breaks JSON-RPC.
-        const { findBarriers, keyOf, readAccepted, renderAccess } = await import('../engine/access/access-command.js');
+        const { findBarriers, keyOf, readAccepted, readBrowserRun, renderAccess } = await import('../engine/access/access-command.js');
         const { merge, pagesIn } = await import('../engine/access/merge.js');
-        const { readAxeReport } = await import('../engine/access/reports.js');
         const { findings, filesRead } = findBarriers(root, path);
         const judged = readAccepted(root);
         const open = findings.filter((f) => !judged.has(keyOf(f)));
-        const run = axeReport ? readAxeReport(isAbsolute(axeReport) ? axeReport : `${root}/${axeReport}`) : undefined;
+        const run = axeReport ? readBrowserRun(isAbsolute(axeReport) ? axeReport : `${root}/${axeReport}`) : undefined;
         const graded = run ? merge(open, run, root) : undefined;
         const kept = graded ? graded.kept : open;
         return renderAccess({
@@ -161,6 +160,7 @@ export function registerProofTools(server, { answer, readOnly, project }) {
                         superseded: graded.superseded,
                         pages: pagesIn(run),
                         rulesRun: run.rulesRun,
+                        tool: run.source,
                     },
                 }
                 : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [