@dreamdata_io/verify-tracking 0.1.0

package/dist/report/store.js

@@ -0,0 +1,139 @@
+/**
+ * Where reports live on disk, and how to find one by slug.
+ *
+ * Runs have not stayed flat: the golden set accumulated into dated subfolders
+ * (`phase_1/`, `new_script/`), and a replayed run files itself under
+ * `local_ai/` rather than beside the baseline it was replayed from. A slug
+ * naming a report in one of those is exactly as valid as one at the top
+ * level, so every reader walks the tree — and they all walk it the same way,
+ * here, rather than each growing its own copy.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { outputRoot } from "../config/user-config.js";
+/**
+ * Functions, not constants: the root they sit under is overridable via the
+ * user config, which is loaded inside main() — after this module's imports
+ * have already been evaluated. A `const` here would capture the default and
+ * make the override silently do nothing.
+ */
+export function reportsDir() {
+    return join(outputRoot(), "reports");
+}
+export function evidenceDir() {
+    return join(outputRoot(), "evidence");
+}
+const REPORT_SUFFIX = "_report.json";
+function reportsRoot() {
+    return resolve(process.cwd(), reportsDir());
+}
+function walk(dir) {
+    if (!existsSync(dir))
+        return [];
+    const found = [];
+    const stack = [dir];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const full = join(current, entry.name);
+            if (entry.isDirectory())
+                stack.push(full);
+            else if (entry.name.endsWith(REPORT_SUFFIX))
+                found.push(full);
+        }
+    }
+    return found;
+}
+/**
+ * Every file that could answer to `slug`, the canonical one first.
+ *
+ * A run written straight to `verification/reports/` outranks any subfolder
+ * copy of the same slug: the subfolders hold archived golden-set runs and
+ * replayed (`local_ai/`) ones, and neither should shadow the current
+ * ground-truth report just by being newer.
+ */
+function copiesOf(slug, all) {
+    const flat = join(reportsRoot(), `${slug}${REPORT_SUFFIX}`);
+    const others = all.filter((path) => path !== flat).sort();
+    return existsSync(flat) ? [flat, ...others] : others;
+}
+/** The report for `slug`, repo-relative, preferring the flat path over any subfolder copy. */
+export function findReportPath(slug) {
+    const matches = walk(reportsRoot()).filter((path) => path.endsWith(`/${slug}${REPORT_SUFFIX}`));
+    const [canonical] = copiesOf(slug, matches);
+    return canonical ? relative(process.cwd(), canonical) : undefined;
+}
+/**
+ * One entry per slug — the same file `findReportPath` would open, so the two
+ * can never name different files for the same slug — newest first.
+ */
+export function listReports() {
+    const bySlug = new Map();
+    for (const path of walk(reportsRoot())) {
+        const slug = path.slice(0, -REPORT_SUFFIX.length).split("/").pop();
+        bySlug.set(slug, [...(bySlug.get(slug) ?? []), path]);
+    }
+    return [...bySlug.entries()]
+        .map(([slug, matches]) => {
+        const [canonical, ...others] = copiesOf(slug, matches);
+        return {
+            slug,
+            path: relative(process.cwd(), canonical),
+            modifiedAt: statSync(canonical).mtime.toISOString(),
+            otherCopies: others.map((path) => relative(process.cwd(), path)),
+        };
+    })
+        .sort((a, b) => b.modifiedAt.localeCompare(a.modifiedAt));
+}
+/**
+ * The untrimmed evidence each run archives beside its report.
+ *
+ * A report has the request bodies and cookie values taken back out of it
+ * (projectReport), and those are not decoration: `page-view-counted-once`
+ * reads the page events out of the bodies, so re-analysing a report reaches a
+ * different verdict than the run did. Anything replaying a run wants this
+ * file, and the report only as a fallback.
+ */
+export function findEvidencePath(slug) {
+    const path = join(resolve(process.cwd(), evidenceDir()), `${slug}_evidence.json`);
+    return existsSync(path) ? relative(process.cwd(), path) : undefined;
+}
+export async function readReport(path) {
+    return JSON.parse(await readFile(path, "utf-8"));
+}
+/**
+ * The value at a dotted/bracketed path, e.g. `grant.network.normalRequestCount`,
+ * `phases[0].script.present`, or `deployment.checks[page-view-counted-once].status`.
+ *
+ * That last form — a bracket holding a name rather than an index — is how both
+ * the model and applyDeterministicChecks cite a cross-phase check, and the
+ * checks are an array, so the name is matched against each element's `id`.
+ * Without it such a citation resolves to the whole array, which technically
+ * "exists" while telling a reader nothing about the check that was named.
+ *
+ * Returns undefined for a path that does not resolve — which is the answer a
+ * caller asking "does the model's quoted field actually exist?" needs, so a
+ * miss is not an error.
+ */
+export function valueAtPath(root, path) {
+    if (!path)
+        return undefined;
+    // `[0]`, `[some-id]` and `['some-id']` all become one path segment; the
+    // quotes are how a model tends to write a name-keyed citation.
+    const keys = path.replace(/\[['"]?([^\]'"]+)['"]?\]/g, ".$1").split(".");
+    let current = root;
+    for (const key of keys) {
+        if (current === null || current === undefined || typeof current !== "object")
+            return undefined;
+        if (Array.isArray(current) && !/^\d+$/.test(key)) {
+            current = current.find((item) => item?.id === key);
+            if (current === undefined)
+                return undefined;
+            continue;
+        }
+        current = current[key];
+    }
+    return current;
+}
+//# sourceMappingURL=store.js.map

package/dist/report/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/report/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AACD,MAAM,aAAa,GAAG,cAAc,CAAC;AAiBrC,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACrC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAU,CAAC;YACzC,UAAU,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;YACpD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAClF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,IAAY;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAgC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;YAChF,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/run/verify.js

@@ -0,0 +1,77 @@
+/**
+ * One verification run, without a terminal around it.
+ *
+ * cli.ts owns flags, a spinner and the exit code; the MCP server owns a tool
+ * schema and a JSON reply. Between the two sits the same three steps in the
+ * same order — collect the evidence, analyse it deterministically, then ask
+ * the model — and that middle is what lives here, so neither caller can drift
+ * from the other on what a run actually is.
+ */
+import { analyzeDeployment } from "../analysis/deployment.js";
+import { checkWithAI } from "../ai/checker.js";
+import { BATCH_FLUSH_WAIT_MS } from "../config/env.js";
+import { collectEvidence } from "../evidence/collect.js";
+import { evidenceDir, reportsDir } from "../report/store.js";
+import { serializeEvidenceToJson, serializeToJson } from "../report/serializers.js";
+import { appendRunTimings } from "../utils/runTimingsLog.js";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+/** Every output path this CLI writes may name a directory that isn't there yet. */
+export async function writeEnsuringDir(path, contents) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, contents, "utf-8");
+}
+export async function runVerification(options, onProgress) {
+    const runStart = Date.now();
+    const collectEvidenceStart = Date.now();
+    const evidence = await collectEvidence({
+        url: options.url,
+        headless: options.headless,
+        timeoutMs: options.timeoutMs,
+        batchFlushWaitMs: BATCH_FLUSH_WAIT_MS,
+        trackingHosts: options.trackingHosts,
+        phases: options.phases,
+        scanTagManager: options.scanTagManager,
+        probeSecondPage: options.probeSecondPage,
+        probeOverHttp: options.probeOverHttp,
+    }, (phase, index, total) => onProgress?.({ step: "collect", phase, index, total }));
+    const collectEvidenceMs = Date.now() - collectEvidenceStart;
+    onProgress?.({ step: "analyze" });
+    const analyzeDeploymentStart = Date.now();
+    const analysis = analyzeDeployment(evidence, options.phases);
+    const analyzeDeploymentMs = Date.now() - analyzeDeploymentStart;
+    onProgress?.({ step: "ai-check" });
+    const checkWithAIStart = Date.now();
+    const result = await checkWithAI(evidence, analysis, options.backend);
+    const checkWithAIMs = Date.now() - checkWithAIStart;
+    const timings = {
+        collectEvidenceMs,
+        analyzeDeploymentMs,
+        checkWithAIMs,
+        totalMs: Date.now() - runStart,
+    };
+    await appendRunTimings({
+        timestamp: new Date().toISOString(),
+        kind: "run",
+        model: options.backend.model,
+        url: options.url,
+        slug: options.slug,
+        phases: options.phases,
+        durationsMs: timings,
+    });
+    return { evidence, analysis, result, timings };
+}
+/**
+ * The default two-file write: the trimmed report a human (or the review
+ * dashboard) reads, and the untrimmed evidence archive beside it. `--out`
+ * takes a run out of this layout and is handled by the caller that offers it.
+ */
+export async function writeDefaultArtifacts(run, slug) {
+    const reportPath = `${reportsDir()}/${slug}_report.json`;
+    const evidencePath = `${evidenceDir()}/${slug}_evidence.json`;
+    const meta = { slug, timings: run.timings };
+    await writeEnsuringDir(reportPath, serializeToJson(run.evidence, run.analysis, run.result, meta));
+    await writeEnsuringDir(evidencePath, serializeEvidenceToJson(run.evidence, run.analysis, run.result, meta));
+    return { reportPath, evidencePath };
+}
+//# sourceMappingURL=verify.js.map

package/dist/run/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/run/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAA2B,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsCpC,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB,EACtB,UAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5B,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC;QACE,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,gBAAgB,EAAE,mBAAmB;QACrC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAChF,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IAE5D,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAClC,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;IAEhE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;IAEpD,MAAM,OAAO,GAAe;QAC1B,iBAAiB;QACjB,mBAAmB;QACnB,aAAa;QACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;KAC/B,CAAC;IACF,MAAM,gBAAgB,CAAC;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAoB,EAAE,IAAY;IAC5E,MAAM,UAAU,GAAG,GAAG,UAAU,EAAE,IAAI,IAAI,cAAc,CAAC;IACzD,MAAM,YAAY,GAAG,GAAG,WAAW,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC9D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,gBAAgB,CAAC,YAAY,EAAE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC"}

package/dist/utils/duration.js

@@ -0,0 +1,10 @@
+/** `90000` -> `"1m 30s"`. Always shows both units so a report never implies a step ran in under a minute when it didn't. */
+export function formatDuration(ms) {
+    if (ms === null)
+        return "not run (replayed from an archive)";
+    const totalSeconds = Math.round(ms / 1000);
+    const minutes = Math.floor(totalSeconds / 60);
+    const seconds = totalSeconds % 60;
+    return `${minutes}m ${seconds}s`;
+}
+//# sourceMappingURL=duration.js.map

package/dist/utils/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/utils/duration.ts"],"names":[],"mappings":"AAcA,4HAA4H;AAC5H,MAAM,UAAU,cAAc,CAAC,EAAiB;IAC9C,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,oCAAoC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,GAAG,EAAE,CAAC;IAClC,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,CAAC;AACnC,CAAC"}

package/dist/utils/errors.js

@@ -0,0 +1,17 @@
+export class EvidenceCollectionError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "EvidenceCollectionError";
+    }
+}
+export class AIError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "AIError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/utils/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACV;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACM;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/utils/logger.js

@@ -0,0 +1,59 @@
+const SECRET_KEY_PATTERN = /api[-_]?key|authorization|bearer/i;
+function redact(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value))
+        return value.map(redact);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, val]) => SECRET_KEY_PATTERN.test(key) ? [key, "[redacted]"] : [key, redact(val)]));
+    }
+    return value;
+}
+/**
+ * Where `info` goes.
+ *
+ * A terminal wants it on stdout next to the report. The MCP server cannot
+ * have it there at all: stdout is the JSON-RPC channel, and one stray line of
+ * prose in it is a protocol parse error, not a cosmetic problem. Everything
+ * the collector logs mid-run (`logger.info`, `warn`, `debug`) would land in
+ * that channel, so the server flips this once at startup and every existing
+ * call site follows without knowing about it. `warn` and `error` are already
+ * safe (console.warn/error are stderr), but `debug` is not — console.debug is
+ * an alias for console.log, i.e. stdout — so it is switched here as well.
+ */
+let infoStream = "stdout";
+/** Send `logger.info` to stderr — for any caller that owns stdout itself. */
+export function sendLogsToStderr() {
+    infoStream = "stderr";
+}
+function write(message) {
+    if (infoStream === "stderr")
+        console.error(message);
+    else
+        console.log(message);
+}
+export const logger = {
+    debugEnabled: process.env.DEBUG === "1" || process.env.DEBUG === "true",
+    info(message) {
+        write(message);
+    },
+    warn(message) {
+        console.warn(message);
+    },
+    error(message, cause) {
+        console.error(message);
+        if (cause instanceof Error) {
+            console.error(cause.message);
+        }
+    },
+    debug(message, data) {
+        if (!this.debugEnabled)
+            return;
+        if (data === undefined) {
+            write(`[debug] ${message}`);
+            return;
+        }
+        write(`[debug] ${message} ${JSON.stringify(redact(data))}`);
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAE/D,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAClE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CACxE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,IAAI,UAAU,GAAwB,QAAQ,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,UAAU,GAAG,QAAQ,CAAC;AACxB,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM;IAEvE,IAAI,CAAC,OAAe;QAClB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,KAAe;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAAc;QACnC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,KAAK,CAAC,WAAW,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC"}

package/dist/utils/runTimingsLog.js

@@ -0,0 +1,27 @@
+import { mkdir, appendFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { outputRoot } from "../config/user-config.js";
+/**
+ * One line per run, appended and never rewritten — so a failure mid-run can
+ * never lose an earlier run's timing, and the file never needs to be read back
+ * in just to add to it. JSON Lines rather than a single JSON array for exactly
+ * that reason: an array would require reading and rewriting the whole file on
+ * every run.
+ *
+ * It sits under the same root as the reports rather than in the working
+ * directory. This is a development record with no reader outside the repo, and
+ * an installed CLI is run from wherever its operator happens to be — dropping
+ * a stray file there alongside the report directory is one piece of litter
+ * too many, and one setting should govern everything a run writes.
+ */
+function runTimingsPath() {
+    return join(outputRoot(), "run-timings.jsonl");
+}
+export async function appendRunTimings(record) {
+    // The root may not exist yet: a run that saves no report writes this and
+    // nothing else, so it cannot rely on the report writer having made it.
+    const path = runTimingsPath();
+    await mkdir(dirname(path), { recursive: true });
+    await appendFile(path, `${JSON.stringify(record)}\n`, "utf-8");
+}
+//# sourceMappingURL=runTimingsLog.js.map

package/dist/utils/runTimingsLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runTimingsLog.js","sourceRoot":"","sources":["../../src/utils/runTimingsLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAGtD;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACjD,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB;IAC7D,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC"}

package/dist/utils/slug.js

@@ -0,0 +1,27 @@
+/**
+ * The account slug: what a run is filed under, and — because it goes straight
+ * into a report path — the one caller-supplied string that could climb out of
+ * `verification/reports/`. Both the CLI and the MCP server take a slug from
+ * outside, so the rule lives here rather than in either one of them.
+ */
+/** Matches the `<domain-with-underscores>` convention `verification/slugs.txt` already uses. */
+export const SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?$/i;
+/**
+ * Anything that could escape the reports directory — a separator, a leading
+ * dot — is rejected rather than sanitised: silently rewriting it would file
+ * the report under a name the caller never asked for and cannot predict.
+ */
+export function isSafeSlug(slug) {
+    return SLUG_PATTERN.test(slug);
+}
+export function slugFromUrl(url) {
+    let hostname;
+    try {
+        hostname = new URL(url).hostname;
+    }
+    catch {
+        hostname = url;
+    }
+    return hostname.replace(/^www\./, "").replace(/\./g, "_");
+}
+//# sourceMappingURL=slug.js.map

package/dist/utils/slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.js","sourceRoot":"","sources":["../../src/utils/slug.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gGAAgG;AAChG,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAElE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/version.js

@@ -0,0 +1,10 @@
+/**
+ * The published version, in one place.
+ *
+ * Not read from package.json at run time: `rootDir: src` keeps it out of the
+ * compiled tree, and counting directories back up to it from dist/mcp/server.js
+ * breaks the moment the output layout changes. A literal that the release
+ * workflow checks against the git tag is the cheaper guarantee.
+ */
+export const VERSION = "0.1.0";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@dreamdata_io/verify-tracking",
+  "version": "0.1.0",
+  "description": "Scrapes a live website with Playwright and asks an AI model whether the Dreamdata Analytics Script is correctly installed.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dreamdata-io/tracking-verification-cli.git"
+  },
+  "keywords": [
+    "dreamdata",
+    "analytics",
+    "tracking",
+    "verification",
+    "consent-mode",
+    "playwright"
+  ],
+  "bin": {
+    "verify-tracking": "./dist/cli.js",
+    "verify-tracking-mcp": "./dist/mcp/server.js"
+  },
+  "files": [
+    "dist",
+    "scripts/install.sh",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.check.json",
+    "cli": "bun run src/cli.ts",
+    "test": "bun test",
+    "test:watch": "bun test --watch",
+    "mcp": "bun run src/mcp/server.ts",
+    "prepublishOnly": "bun run build && bun run typecheck && bun test"
+  },
+  "engines": {
+    "node": ">=20",
+    "bun": ">=1.4.0"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.9.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "openai": "^4.77.0",
+    "playwright": "^1.49.1",
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "bun-types": "^1.4.0",
+    "typescript": "^5.7.3"
+  }
+}