@@ -38,6 +38,7 @@ import { freshnessLineHtml, freshnessPageHtml, freshnessStats, newEntriesLineHtm
 import { licenceTerms, listStackFiles, owes, parseStack, pickPath } from "./lib/stacks.mjs";
 import { createDistWriter } from "./lib/dist-writer.mjs";
 import { serviceWorkerJs, webManifest } from "./lib/offline.mjs";
+import { auditPageHtml } from "./lib/audit-page.mjs";
 import { ATTRIBUTION_RANK, categoryChipsHtml, guideRowsHtml, headMetaHtml, licenseFamily, notFoundHtml, robotsTxt, stackRowsHtml, starterRowsHtml } from "./lib/home-page.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -573,6 +574,8 @@ function main() {
   writeOut("opensearch.xml", opensearchXml(config.site));
   writeOut("404.html", notFoundHtml(config.site));
   writeOut(path.join("freshness", "index.html"), freshnessPageHtml({ stats: fresh, site: config.site, stamp, total: stats.listed, hasCard }));
+  // Paste a credits file, see what it owes (#187).
+  writeOut(path.join("audit", "index.html"), auditPageHtml({ site: config.site, stamp, total: stats.listed, hasCard }));
 
   const pages = writeEntryPages({ entries, bodies, config, stats, stamp, hasCard, now, usedIn });
   const stackPages = writeStackPages({ stacks, entries, config, stats, stamp, hasCard, now });
 
@@ -0,0 +1,52 @@
+/** The credits audit page, audit/ (#187). The work happens in the browser (audit.js). Pure. */
+import { baseHeadHtml, esc, PAGE_MODULES, siteFooterHtml, siteHeaderHtml } from "./shared.mjs";
+
+export function auditPageUrl(site) {
+  return `${String(site.siteUrl).replace(/\/+$/, "")}/audit/`;
+}
+
+export function auditPageHtml({ site, stamp, total, hasCard }) {
+  const title = `Credits audit | ${site.title}`;
+  const desc = "Paste your credits file or the URLs your game's assets came from, and see what each one owes, in your browser.";
+  const repo = String(site.repo);
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${esc(title)}</title>
+    <meta name="description" content="${esc(desc)}" />
+    ${baseHeadHtml({ site, title, description: desc, url: auditPageUrl(site), hasCard, root: "../", modules: PAGE_MODULES.audit })}
+  </head>
+  <body>
+    <a class="skip-link" href="#content">Skip to the audit</a>
+    ${siteHeaderHtml({ root: "../", repo })}
+    <main class="section entry-page audit-page" id="content">
+      <nav class="breadcrumb" aria-label="Breadcrumb">
+        <a href="../#catalog">Catalog</a> <span aria-hidden="true">/</span>
+        <span aria-current="page">Credits audit</span>
+      </nav>
+      <h1>Credits audit</h1>
+      <div class="entry-lead"><p>Paste a credits file, or one asset URL per line. Each line is matched to the catalog: by the source's URL, by the site it came from, or by the source's name. Nothing leaves your browser.</p></div>
+      <noscript><p>The audit runs in your browser and needs JavaScript. Without it, search the <a href="../#catalog">catalog</a> for each source.</p></noscript>
+      <form class="audit-form" id="audit-form">
+        <label for="audit-input">Credits file or URLs</label>
+        <textarea id="audit-input" rows="12" spellcheck="false" placeholder="https://kenney.nl/assets/ui-pack&#10;Music: Kevin MacLeod (incompetech.com)"></textarea>
+        <p><button type="submit" class="btn">Check what these owe</button></p>
+      </form>
+      <section id="audit-results" aria-live="polite" hidden>
+        <h2>Line by line</h2>
+        <ul class="audit-lines" id="audit-lines"></ul>
+        <h2>What the matched sources owe</h2>
+        <div class="shortlist-owes" id="audit-owes"></div>
+        <p class="shortlist-actions"><button type="button" class="btn-ghost" id="audit-download">Download CREDITS.md</button></p>
+        <p class="filter-note">A line the catalog does not know is not a verdict on it: read its licence yourself, or <a href="${esc(repo)}/issues/new?template=new-source.yml" rel="noopener noreferrer">suggest the source</a>.</p>
+      </section>
+    </main>
+    ${siteFooterHtml({ root: "../", stamp, total, current: "audit" })}
+    <script src="../data.js" defer></script>
+    <script type="module" src="../audit.js"></script>
+  </body>
+</html>
+`;
+}
@@ -0,0 +1,114 @@
+/**
+ * The credits audit (#187): match the lines of a pasted credits file or URL
+ * list to catalog entries, so a developer can see what an existing pile of
+ * assets owes. Pure and browser-safe (served as credits-audit.js).
+ *
+ * A line matches by URL first: the entry whose own url is the longest prefix
+ * of a URL on the line. A URL on a site with catalog entries but no prefix
+ * match lists that site's entries as candidates. A line with no URL matches
+ * an entry whose name it contains as whole words, or else the entries of a
+ * publisher it names (five characters or more, so "Kit" does not match
+ * everything).
+ */
+
+/**
+ * A URL reduced for comparison: host without www., path without a trailing
+ * slash, no fragment. `query` is kept apart: an entry whose url carries one
+ * is a filtered listing (`/assets?series=...`), which matches only itself.
+ */
+export function urlKey(raw) {
+  let u;
+  try {
+    u = new URL(String(raw).trim());
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol)) return null;
+  const host = u.hostname.toLowerCase().replace(/^www\./, "");
+  let path = u.pathname;
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+    // A malformed escape is compared as written.
+  }
+  path = path.replace(/\/+$/, "").toLowerCase();
+  return { host, path, query: u.search, key: `${host}${path}` };
+}
+
+const URL_RE = /https?:\/\/[^\s<>"'`)\]]+/g;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** An index of entries by URL key and by host, built once per audit. */
+export function auditIndex(entries) {
+  const byHost = new Map();
+  const keyed = [];
+  for (const e of entries) {
+    const k = urlKey(e.url);
+    if (!k) continue;
+    keyed.push({ entry: e, ...k });
+    if (!byHost.has(k.host)) byHost.set(k.host, []);
+    byHost.get(k.host).push(e);
+  }
+  // Names and publishers, five characters or more, as whole words.
+  const wordRe = (text) => new RegExp(`(^|[^\\p{L}\\p{N}])${escapeRe(text.trim().toLowerCase())}(?![\\p{L}\\p{N}])`, "u");
+  const named = entries.filter((e) => String(e.name || "").trim().length >= 5).map((e) => ({ entry: e, re: wordRe(e.name) }));
+  const byPublisher = new Map();
+  for (const e of entries) {
+    const p = String(e.publisher || "").trim();
+    if (p.length < 5) continue;
+    if (!byPublisher.has(p)) byPublisher.set(p, []);
+    byPublisher.get(p).push(e);
+  }
+  const publishers = [...byPublisher].map(([name, list]) => ({ entries: list, re: wordRe(name) }));
+  return { keyed, byHost, named, publishers };
+}
+
+/**
+ * One verdict per non-empty line: `{ line, via, entries }` where `via` is
+ * "url" (a confident match), "site" (candidates on the same site), "name",
+ * or "none".
+ */
+export function auditLines(text, index) {
+  const out = [];
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line) continue;
+    const urls = (line.match(URL_RE) || []).map((u) => u.replace(/[.,;:!?]+$/, ""));
+    let verdict = null;
+    for (const u of urls) {
+      const k = urlKey(u);
+      if (!k) continue;
+      const hits = index.keyed.filter((c) =>
+        c.host === k.host && (c.query ? c.path === k.path && c.query === k.query : k.path === c.path || k.path.startsWith(`${c.path}/`) || c.path === "")
+      );
+      if (hits.length) {
+        const best = Math.max(...hits.map((h) => h.path.length));
+        verdict = { line, via: "url", entries: hits.filter((h) => h.path.length === best).map((h) => h.entry) };
+        break;
+      }
+      const site = index.byHost.get(k.host);
+      if (site && !verdict) verdict = { line, via: "site", entries: site };
+    }
+    if (!verdict && !urls.length) {
+      const lower = line.toLowerCase();
+      const hits = index.named.filter((n) => n.re.test(lower)).map((n) => n.entry);
+      if (hits.length) verdict = { line, via: "name", entries: hits };
+      else {
+        // A publisher named on the line: their entries are the candidates.
+        const pubs = (index.publishers || []).filter((p) => p.re.test(lower)).flatMap((p) => p.entries);
+        if (pubs.length) verdict = { line, via: "name", entries: pubs };
+      }
+    }
+    out.push(verdict || { line, via: "none", entries: [] });
+  }
+  return out;
+}
+
+/** The entries an audit settled on (url and name matches, each once), for owes() and CREDITS.md. */
+export function auditedEntries(verdicts) {
+  const seen = new Map();
+  for (const v of verdicts) {
+    if ((v.via === "url" || v.via === "name") && v.entries.length === 1) seen.set(v.entries[0].id, v.entries[0]);
+  }
+  return [...seen.values()];
+}
@@ -44,6 +44,7 @@ export function sitemapXml({ site, entries, stacks = [], stamp, modified = new M
   const urls = [
     url(`${base}/`, stamp),
     url(`${base}/freshness/`, stamp),
+    url(`${base}/audit/`, stamp),
     ...categories.map((c) => url(`${base}/category/${c.id}/`, c.lastmod || stamp)),
     ...guides.map((g) => url(`${base}/guide/${g.id}/`, modified.get(g.path) || stamp)),
     ...stacks.map((s) => url(`${base}/stack/${s.meta.id}/`, latest(s.meta.walked, modified.get(s.rel)))),
 
@@ -2522,6 +2522,57 @@ await section("theme, manifest and offline worker (#111)", async () => {
   has("header: theme toggle, hidden until theme.js runs", siteHeaderHtml({ root: "", repo: "https://g.test/o/r" }), 'id="theme-toggle" hidden');
 });
 
+/* credits audit (#187) ----------------------------------------------------- */
+await section("credits audit (#187)", async () => {
+  const { urlKey, auditIndex, auditLines, auditedEntries } = await import("./credits-audit.mjs");
+  eq("urlKey: www, case, trailing slash and query dropped", urlKey("https://WWW.Kenney.nl/Assets/?x=1#y").key, "kenney.nl/assets");
+  eq("urlKey: not http", urlKey("ftp://x.test/a"), null);
+  eq("urlKey: not a URL", urlKey("nope"), null);
+  const entries = [
+    { id: "kenney", name: "Kenney", url: "https://kenney.nl/assets" },
+    { id: "kenney-ui", name: "Kenney UI Pack", url: "https://kenney.nl/assets/ui-pack" },
+    { id: "incompetech", name: "Incompetech", url: "https://incompetech.com/music/" },
+    { id: "kit", name: "Kit", url: "https://kit.test/" },
+  ];
+  const v = auditLines([
+    "UI: https://www.kenney.nl/assets/ui-pack/download.",
+    "Props https://kenney.nl/assets/other-pack",
+    "Music: Kevin MacLeod (https://incompetech.com/)",
+    "https://kenney.nl/blog/post",
+    "Music by incompetech, licensed CC-BY",
+    "my own sprites, kit included",
+    "https://unknown.test/thing",
+    "",
+  ].join("\n"), auditIndex(entries));
+  eq("audit: empty lines skipped", v.length, 7);
+  eq("audit: the longest URL prefix wins", v[0].entries.map((e) => e.id).join(), "kenney-ui");
+  eq("audit: a deeper URL under an entry's url matches it", `${v[1].via}:${v[1].entries[0].id}`, "url:kenney");
+  eq("audit: a bare site root names the site, not one source", `${v[2].via}:${v[2].entries[0].id}`, "site:incompetech");
+  eq("audit: same site, no prefix: candidates", `${v[3].via}:${v[3].entries.length}`, "site:2");
+  eq("audit: a name without a URL", `${v[4].via}:${v[4].entries[0].id}`, "name:incompetech");
+  eq("audit: short names never match by name", v[5].via, "none");
+  eq("audit: unknown site", v[6].via, "none");
+  eq("audit: settled entries, each once, no candidates", auditedEntries(v).map((e) => e.id).sort().join(), "incompetech,kenney,kenney-ui");
+});
+
+/* credits audit: listings and publishers (#187) ----------------------------- */
+await section("credits audit: listings and publishers (#187)", async () => {
+  const { auditIndex, auditLines } = await import("./credits-audit.mjs");
+  const { creditsFile, owes } = await import("./owes.mjs");
+  const entries = [
+    { id: "lib", name: "Library", url: "https://pub.test" },
+    { id: "series", name: "Series", url: "https://pub.test/assets?series=A" },
+    { id: "pack", name: "Pack One", url: "https://pub.test/assets/pack-one", publisher: "Pubhouse" },
+    { id: "pack2", name: "Pack Two", url: "https://pub.test/assets/pack-two", publisher: "Pubhouse" },
+  ];
+  const v = auditLines("https://pub.test/assets/other\nhttps://pub.test/assets?series=A\nSprites by Pubhouse", auditIndex(entries));
+  eq("audit: a filtered listing is not a prefix of other pages", v[0].entries.map((e) => e.id).join(), "lib");
+  eq("audit: a filtered listing matches itself", v[1].entries.map((e) => e.id).join(), "series");
+  eq("audit: a named publisher lists its entries", `${v[2].via}:${v[2].entries.map((e) => e.id).join("+")}`, "name:pack+pack2");
+  has("credits file: the header says where it came from", creditsFile(owes([]), { madeFrom: "a credits audit" }), "Made from a credits audit on");
+  has("credits file: shortlist by default", creditsFile(owes([])), "Made from a shortlist on");
+});
+
 /* report (keep last) ------------------------------------------------------ */
 if (failures.length) {
   console.error(`lib.test failed (${failures.length}):`);
 
@@ -97,7 +97,7 @@ export function copyAllText(owed) {
  * Every section a stack page shows is here, so nothing owed is dropped on the
  * way from the shortlist to the game's repository.
  */
-export function creditsFile(owed, { format = "md", pageUrl = () => "", date = "", source = "Free Game Dev Assets" } = {}) {
+export function creditsFile(owed, { format = "md", pageUrl = () => "", date = "", source = "Free Game Dev Assets", madeFrom = "a shortlist" } = {}) {
   const md = format === "md";
   const out = [];
   const heading = (text) => {
@@ -112,7 +112,7 @@ export function creditsFile(owed, { format = "md", pageUrl = () => "", date = ""
   out.push(md ? "# Credits" : "CREDITS\n=======");
   out.push(
     "",
-    `Made from a shortlist on ${source}${date ? ` on ${date}` : ""}. Each licence was checked at its source on the date its catalog entry shows. This is the catalog's reading, not legal advice: re-read the source before you ship.`
+    `Made from ${madeFrom} on ${source}${date ? ` on ${date}` : ""}. Each licence was checked at its source on the date its catalog entry shows. This is the catalog's reading, not legal advice: re-read the source before you ship.`
   );
 
   if (owed.credits.length) {
 
@@ -270,6 +270,7 @@ export function siteFooterHtml({ root, stamp, total, credit = true, current = nu
     `<a href="${root}feed.xml">feed</a>`,
     `<a href="${root}guide/data/">Use the data</a>`,
     `<a href="${root}guide/changelog/">Changelog</a>`,
+    current === "audit" ? null : `<a href="${root}audit/">Credits audit</a>`,
   ].filter(Boolean);
   return `<footer class="footer">
       <p>Catalog metadata is CC0. Linked assets keep their own licences. This is the catalog's reading of each licence, not legal advice: re-check the live source before shipping.</p>
@@ -294,6 +295,7 @@ export const BROWSER_MODULES = {
   "shared.mjs": "shared.mjs",
   "client-state.js": "client-state.mjs", // shortlist parsing, escaping and the entry back link
   "exports.js": "exports.mjs", // "Download these" on the catalog: the same CSV as catalog.csv
+  "credits-audit.js": "credits-audit.mjs", // the credits audit page's matcher
 };
 
 /**
@@ -307,6 +309,7 @@ export const PAGE_MODULES = {
   entry: ["shortlist.js", "owes.js", "client-state.js"],
   category: ["category.js", "views.js", "shortlist.js", "owes.js", "client-state.js"],
   notFound: ["not-found.js", "search.js", "shared.mjs"],
+  audit: ["audit.js", "credits-audit.js", "owes.js", "client-state.js"],
 };
 
 /**
 
@@ -0,0 +1,80 @@
+/**
+ * The credits audit page (#187): matches pasted lines to the catalog
+ * (credits-audit.js), shows a verdict per line and what the matched sources
+ * owe (owes.js), and offers the result as CREDITS.md. Everything stays in
+ * the browser.
+ */
+import { auditIndex, auditLines, auditedEntries } from "./credits-audit.js";
+import { creditsFile, owes, owesGroups } from "./owes.js";
+import { escapeHtml } from "./client-state.js";
+
+const run = () => {
+  const data = window.__CATALOG__;
+  const form = document.getElementById("audit-form");
+  if (!data || !form) return;
+  const index = auditIndex(data.entries);
+  const siteUrl = String(data.site?.siteUrl || "").replace(/\/+$/, "");
+  let matched = [];
+
+  const entryLink = (e) => `<a href="../entry/${encodeURIComponent(e.id)}/">${escapeHtml(e.name)}</a>`;
+  const facts = (e) => {
+    const bits = [escapeHtml(e.license)];
+    if (e.attribution_required === true) bits.push(e.attribution_string ? `credit: <code>${escapeHtml(e.attribution_string)}</code>` : "credit required: see the entry");
+    else if (e.attribution_required === false) bits.push("no credit line");
+    if (e.commercial === false) bits.push("<strong>not for commercial use</strong>");
+    if (e.commercial === "varies") bits.push("check each file");
+    if (e.engine_lock) bits.push(`<strong>locked to ${escapeHtml(e.engine_lock)}</strong>`);
+    if (e.status !== "active") bits.push(`<strong>${escapeHtml(e.status)}</strong>${e.review ? `: ${escapeHtml(e.review)}` : ""}`);
+    bits.push(`licence read ${escapeHtml(e.verified || "never")}`);
+    return bits.join(" · ");
+  };
+  const verdictHtml = (v) => {
+    const line = `<code>${escapeHtml(v.line.length > 140 ? `${v.line.slice(0, 140)}…` : v.line)}</code>`;
+    if (v.via === "none") return `<li class="audit-none">${line}<br />Not in the catalog: check this one by hand.</li>`;
+    if (v.via === "site" || v.entries.length > 1) {
+      const n = v.entries.length;
+      const lead = v.via !== "site" ? "More than one source matches:" : n === 1 ? "The catalog has one source on this site; is it this one?" : `The catalog has ${n} sources on this site; which one?`;
+      return `<li class="audit-maybe">${line}<br />${lead} ${v.entries.slice(0, 8).map(entryLink).join(", ")}${n > 8 ? ", …" : ""}</li>`;
+    }
+    const e = v.entries[0];
+    return `<li class="audit-match">${line}<br />${entryLink(e)}${v.via === "name" ? " (matched by name)" : ""}: ${facts(e)}</li>`;
+  };
+
+  form.addEventListener("submit", (event) => {
+    event.preventDefault();
+    const verdicts = auditLines(document.getElementById("audit-input").value, index);
+    matched = auditedEntries(verdicts);
+    document.getElementById("audit-lines").innerHTML = verdicts.map(verdictHtml).join("");
+    document.getElementById("audit-owes").innerHTML = matched.length
+      ? owesGroups(owes(matched.map((entry) => ({ need: "your game", entry }))))
+          .map((g) => `<p><strong>${escapeHtml(g.heading)} (${g.entries.length}):</strong> ${g.entries.map(entryLink).join(", ")}</p>`)
+          .join("")
+      : "<p>No line matched one source for certain.</p>";
+    document.getElementById("audit-download").hidden = !matched.length;
+    const results = document.getElementById("audit-results");
+    results.hidden = false;
+    results.querySelector("h2").focus?.();
+  });
+
+  document.getElementById("audit-download").addEventListener("click", () => {
+    const text = creditsFile(owes(matched.map((entry) => ({ need: "your game", entry }))), {
+      format: "md",
+      pageUrl: (e) => (siteUrl ? `${siteUrl}/entry/${encodeURIComponent(e.id)}/` : ""),
+      date: new Date().toISOString().slice(0, 10),
+      source: data.site?.title || "Free Game Dev Assets",
+      madeFrom: "a credits audit",
+    });
+    const url = URL.createObjectURL(new Blob([text], { type: "text/markdown" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = "CREDITS.md";
+    document.body.append(link);
+    link.click();
+    link.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
+  });
+};
+
+// data.js is deferred, so it has run by DOMContentLoaded; a module runs after it either way.
+if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", run);
+else run();