@ia-qa/qa-discovery 0.1.0

package/dist/history.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HISTORY_LIMIT = void 0;
+exports.historyPath = historyPath;
+exports.appendHistory = appendHistory;
+exports.readHistory = readHistory;
+exports.gitStamp = gitStamp;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+/**
+ * Append-only run history — `.ia-qa-discovery/history.jsonl`. Mirrors
+ * `@ia-qa/self-healing`'s `history.ts`: small, deterministic, safe to commit,
+ * never influences anything (F1 produces no verdict to influence), a write
+ * failure is swallowed (a full disk must not crash a `scan`).
+ */
+exports.HISTORY_LIMIT = 500;
+function historyPath(cwd = (0, config_1.baseDir)()) {
+    return path.join(cwd, config_1.CONFIG_DIR, config_1.HISTORY_FILENAME);
+}
+function appendHistory(entry) {
+    const file = historyPath();
+    const full = { ts: entry.ts ?? new Date().toISOString(), ...entry };
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.appendFileSync(file, JSON.stringify(full) + '\n', 'utf8');
+        truncate(file);
+    }
+    catch {
+        /* history is a courtesy, never a gate */
+    }
+}
+function truncate(file) {
+    try {
+        const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+        if (lines.length <= exports.HISTORY_LIMIT + 100)
+            return;
+        fs.writeFileSync(file, lines.slice(-exports.HISTORY_LIMIT).join('\n') + '\n', 'utf8');
+    }
+    catch {
+        /* as above */
+    }
+}
+/** Read the history, oldest first. A malformed line is skipped, not fatal. */
+function readHistory(limit = exports.HISTORY_LIMIT, cwd) {
+    const file = cwd ? path.join(cwd, config_1.CONFIG_DIR, config_1.HISTORY_FILENAME) : historyPath();
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (parsed && typeof parsed.ts === 'string' && parsed.verb === 'scan')
+                out.push(parsed);
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return out.slice(-limit);
+}
+/**
+ * Best-effort git stamp — never throws, never blocks. No git, no repo,
+ * detached HEAD: the entry is written without it.
+ */
+function gitStamp() {
+    const { execFileSync } = require('child_process');
+    const run = (args) => {
+        try {
+            const out = execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 });
+            const v = out.trim();
+            return v === '' ? undefined : v;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return { commit: run(['rev-parse', '--short', 'HEAD']), branch: run(['rev-parse', '--abbrev-ref', 'HEAD']) };
+}
+//# sourceMappingURL=history.js.map

package/dist/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../src/history.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,kCAEC;AAED,sCAUC;AAaD,kCAmBC;AAMD,4BAYC;AA/FD,uCAAyB;AACzB,2CAA6B;AAC7B,qCAAiE;AAEjE;;;;;GAKG;AAEU,QAAA,aAAa,GAAG,GAAG,CAAC;AAoBjC,SAAgB,WAAW,CAAC,MAAc,IAAA,gBAAO,GAAE;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAU,EAAE,yBAAgB,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,KAAqD;IACjF,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAsB,CAAC;IAC1G,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAa,GAAG,GAAG;YAAE,OAAO;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,qBAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAgB,WAAW,CAAC,KAAK,GAAG,qBAAa,EAAE,GAAY;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAU,EAAE,yBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;YACpD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ;IACtB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAmC,CAAC;IACpF,MAAM,GAAG,GAAG,CAAC,IAAc,EAAsB,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAChH,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC"}

package/dist/htmlReport.d.ts

@@ -0,0 +1,2 @@
+import type { OverviewInput } from './overview';
+export declare function renderScanReport(input: OverviewInput): string;

package/dist/htmlReport.js

@@ -0,0 +1,371 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderScanReport = renderScanReport;
+const classificationView_1 = require("./classificationView");
+/**
+ * A branded, self-contained HTML report for one discovery scan.
+ *
+ * Adapted from `@ia-qa/self-healing`'s report, NOT copied: that one is built
+ * around a verdict (PASS/FIX/BLOCK) and rows waiting on a human decision.
+ * Discovery produces no verdict — it is reconnaissance — so the shape here is
+ * an **app dossier**: what was reached, what was NOT reached (first, because a
+ * page count is not coverage), the entry points, the API surface, and the
+ * testability of what a suite would have to locate.
+ *
+ * Zero-dependency, pure string: no browser, no network, nothing leaves the
+ * machine. CSS and links are inline, so the file is shareable as-is.
+ */
+const BRAND = {
+    home: 'https://www.ia-qa.com',
+    method: 'https://www.ia-qa.com/method',
+    tools: 'https://www.ia-qa.com/all-tools',
+};
+function esc(s) {
+    return String(s == null ? '' : s)
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+function submitTarget(form) {
+    if (form.action === null && form.method === null)
+        return 'not stated — JS-handled submit';
+    const method = form.method ? form.method.toUpperCase() : 'GET (default)';
+    const action = form.action ? `<code>${esc(form.action)}</code>` : 'the page itself';
+    return `${method} → ${action}`;
+}
+const REPORT_CSS = `
+  :root{--bg:#09090b;--surface:#18181b;--surface2:#111113;--border:#27272a;--text:#e4e4e7;--muted:#a1a1aa;
+    --orange:#f97316;--orange2:#fb923c;--pass:#10b981;--fail:#ef4444;--warn:#f59e0b;--info:#8b5cf6;}
+  *,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+  body{background:var(--bg);color:var(--text);font-family:'Inter',system-ui,-apple-system,sans-serif;line-height:1.5;min-height:100vh;display:flex;flex-direction:column}
+  a{color:var(--orange2);text-decoration:none}a:hover{text-decoration:underline}
+  code{font-family:'JetBrains Mono','Fira Code',ui-monospace,monospace;font-size:12px}
+  .wrap{width:100%;max-width:980px;margin:0 auto;padding:0 20px}
+  header{background:linear-gradient(135deg,#7c2d12 0%,#ea580c 55%,#f97316 100%);padding:28px 0 26px;border-bottom:1px solid var(--border)}
+  .brand{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:14px}
+  .logo{display:inline-flex;align-items:center;gap:9px;font-weight:800;letter-spacing:.02em;font-size:19px;color:#fff}
+  .logo .mark{background:#fff;color:#ea580c;border-radius:8px;padding:3px 9px;font-size:15px;letter-spacing:.08em}
+  .logo:hover{text-decoration:none;opacity:.92}
+  .cta{background:rgba(255,255,255,.16);border:1px solid rgba(255,255,255,.35);color:#fff;padding:8px 15px;border-radius:99px;font-size:13px;font-weight:600}
+  .cta:hover{background:rgba(255,255,255,.26);text-decoration:none}
+  .title{color:#fff;margin-top:20px}
+  .title h1{font-size:24px;font-weight:700}
+  .title .meta{color:rgba(255,255,255,.85);font-size:12.5px;margin-top:8px}
+  .title .meta code{color:#fff;background:rgba(0,0,0,.28);padding:1px 7px;border-radius:6px}
+  main{flex:1;padding:28px 0 40px}
+  section{background:var(--surface);border:1px solid var(--border);border-radius:14px;padding:20px;margin-bottom:18px}
+  section>h2{font-size:12px;text-transform:uppercase;letter-spacing:.08em;color:var(--muted);margin-bottom:14px;font-weight:700}
+  .hero{border-left:3px solid var(--orange);display:flex;flex-direction:column;gap:14px}
+  .lede{color:var(--muted);font-size:13.5px;line-height:1.6;max-width:78ch}
+  .lede code{background:var(--surface2);border:1px solid var(--border);border-radius:6px;padding:1px 6px;color:var(--orange2)}
+  .stats{display:flex;flex-wrap:wrap;gap:10px}
+  .stat{background:var(--surface2);border:1px solid var(--border);border-radius:10px;padding:10px 14px;min-width:112px}
+  .stat .n{font-size:21px;font-weight:700;line-height:1.2}
+  .stat .l{font-size:10.5px;text-transform:uppercase;letter-spacing:.07em;color:var(--muted);margin-top:3px;font-weight:600}
+  .callout{background:var(--surface2);border:1px solid var(--border);border-left:3px solid var(--warn);border-radius:10px;padding:14px 16px;font-size:13.5px;line-height:1.65;max-width:82ch}
+  .callout.bad{border-left-color:var(--fail)}
+  .callout .cl-label{display:block;font-size:10.5px;text-transform:uppercase;letter-spacing:.08em;color:var(--warn);font-weight:700;margin-bottom:6px}
+  .callout.bad .cl-label{color:var(--fail)}
+  .callout code{background:var(--bg);border:1px solid var(--border);border-radius:6px;padding:1px 6px;color:var(--orange2)}
+  .ok-note{color:var(--pass);font-size:13px}
+  table{width:100%;border-collapse:collapse;font-size:13px}
+  th{text-align:left;font-size:10.5px;text-transform:uppercase;letter-spacing:.07em;color:var(--muted);font-weight:700;padding:7px 10px;border-bottom:1px solid var(--border)}
+  td{padding:8px 10px;border-bottom:1px solid var(--surface2);vertical-align:top}
+  tr:last-child td{border-bottom:none}
+  .scroll{overflow-x:auto}
+  .pill{display:inline-block;padding:1px 8px;border-radius:99px;font-size:11px;font-weight:700;border:1px solid}
+  .pill.pass{color:var(--pass);border-color:rgba(16,185,129,.4);background:rgba(16,185,129,.1)}
+  .pill.warn{color:var(--warn);border-color:rgba(245,158,11,.4);background:rgba(245,158,11,.1)}
+  .pill.fail{color:var(--fail);border-color:rgba(239,68,68,.4);background:rgba(239,68,68,.1)}
+  .pill.info{color:var(--info);border-color:rgba(139,92,246,.4);background:rgba(139,92,246,.1)}
+  .muted{color:var(--muted)}
+  .form-card{background:var(--surface2);border:1px solid var(--border);border-radius:10px;padding:14px 16px;margin-bottom:12px}
+  .form-card h3{font-size:14px;font-weight:700;margin-bottom:6px}
+  .form-card .fmeta{font-size:12.5px;color:var(--muted);margin-bottom:10px}
+  .note{font-size:12.5px;color:var(--muted);line-height:1.6;margin-top:10px;max-width:82ch}
+  footer{border-top:1px solid var(--border);padding:18px 0 26px;color:var(--muted);font-size:12px}
+  footer a{color:var(--orange2)}
+`;
+function renderScanReport(input) {
+    const { manifest, pages, shared, loginWall, session, hrefBlind, droppedByCap, sitemapDeclared, classification } = input;
+    const formCount = pages.reduce((n, p) => n + p.forms.length, 0);
+    const fields = pages.flatMap((p) => [...p.forms.flatMap((f) => f.fields), ...p.looseFields]);
+    const unstable = fields.filter((f) => !f.stableSelector);
+    const pageCalls = pages.reduce((n, p) => n + p.apiCalls.length, 0);
+    const parts = [];
+    parts.push(`<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Discovery — ${esc(manifest.baseUrl)}</title>
+<style>${REPORT_CSS}</style></head><body>`);
+    parts.push(`<header><div class="wrap">
+  <div class="brand">
+    <a class="logo" href="${BRAND.home}"><span class="mark">IA-QA</span> qa-discovery</a>
+    <a class="cta" href="${BRAND.method}">Testing methods →</a>
+  </div>
+  <div class="title">
+    <h1>App surface — ${esc(manifest.baseUrl)}</h1>
+    <div class="meta">Captured <code>${esc(manifest.capturedAt)}</code>${session ? ' · with a saved session' : ' · anonymous'}</div>
+  </div>
+</div></header><main><div class="wrap">`);
+    // ── Hero: what this is, and the coverage caveat FIRST ────────────────────
+    parts.push(`<section class="hero">
+  <div class="lede">This is <strong>reconnaissance, not a test plan and not a verdict</strong>. Every figure below traces to
+  something observed in the DOM or on the network by a local headless browser — nothing was inferred, and nothing
+  left this machine. Regenerate with <code>ia-qa-discover scan</code>.</div>
+  <div class="stats">
+    <div class="stat"><div class="n">${manifest.pagesCaptured}</div><div class="l">Pages captured</div></div>
+    <div class="stat"><div class="n">${formCount}</div><div class="l">Forms</div></div>
+    <div class="stat"><div class="n">${fields.length}</div><div class="l">Input fields</div></div>
+    <div class="stat"><div class="n">${pageCalls + shared.calls.length}</div><div class="l">API calls</div></div>
+    <div class="stat"><div class="n">${manifest.origins.length}</div><div class="l">Origins called</div></div>
+  </div>`);
+    const openable = pages.reduce((n, p) => n + (p.exploration?.openable ?? 0), 0);
+    const explored = pages.some((p) => p.exploration?.explored);
+    const revealedTotal = pages.reduce((n, p) => n + (p.exploration?.revealed ?? 0), 0);
+    const collidedTotal = pages.reduce((n, p) => n + (p.exploration?.collided ?? 0), 0);
+    if (!explored && openable > 0) {
+        parts.push(`<div class="callout"><span class="cl-label">Coverage — the loaded state only</span>
+    These pages carry <strong>${openable} control(s) that can reveal more</strong> — menus, tabs, accordions, a button that
+    opens a dialog. Only what the page shows on load was captured, so the ${fields.length} field(s) counted above are the
+    input surface <em>at rest</em>, not the whole one. On one measured app a single page had 64 such controls and 2
+    visible fields.<br>
+    Run <code>ia-qa-discover scan --deep</code> to open them and capture what they reveal.</div>`);
+    }
+    else if (explored) {
+        parts.push(`<div class="ok-note">🔍 <code>--deep</code> opened ${openable} control(s) and found <strong>${revealedTotal}
+    field(s) not visible at load</strong>${collidedTotal > 0 ? ` · ⚠ ${collidedTotal} reached but not captured (their selector already named another element in a different state)` : ''}.</div>`);
+    }
+    if (droppedByCap && droppedByCap > 0) {
+        parts.push(`<div class="callout"><span class="cl-label">Coverage — the page cap was reached</span>
+    <strong>${droppedByCap} more page(s) were known and not visited</strong>, because <code>--max</code> stopped the run at
+    ${manifest.pagesCaptured}.${sitemapDeclared ? ` The sitemap alone declared ${sitemapDeclared}.` : ''}
+    The count above is a budget, not a census — raise <code>--max</code> to cover more.</div>`);
+    }
+    if (hrefBlind) {
+        parts.push(`<div class="callout bad"><span class="cl-label">Coverage — discovery could not see past the entry URL</span>
+    <strong>No internal links were found.</strong> Discovery follows <code>&lt;a href&gt;</code>; an app that navigates
+    programmatically — React Router's <code>useNavigate()</code>, a button with an onClick handler — exposes no href for a
+    crawl to follow. So “${manifest.pagesCaptured} of ${manifest.pagesFound} found” above describes <strong>one page</strong>,
+    not the application: the denominator is what the crawl could reach, not what exists.<br>
+    Declare the routes you know in <code>.ia-qa-discovery/config.json</code> → <code>"pages"</code>, then scan again.</div>`);
+    }
+    else if (loginWall.length > 1) {
+        parts.push(`<div class="callout bad"><span class="cl-label">Coverage — you are probably looking at the login wall</span>
+    ${loginWall.length} of ${manifest.pagesCaptured} captured pages still show a login form
+    (${loginWall.map((p) => `<code>${esc(p)}</code>`).join(', ')}). An app whose catch-all route renders the login page
+    answers HTTP&nbsp;200 at <em>every</em> URL, so the page count above looks like success while the same wall was
+    captured several times. <strong>A page count is not coverage.</strong><br>
+    ${session
+            ? 'The saved session did not get past it — it may have expired. Re-run <code>ia-qa-discover login</code>.'
+            : 'Run <code>ia-qa-discover login</code> to log in by hand once, then scan again.'}</div>`);
+    }
+    else if (loginWall.length === 1 && !session) {
+        parts.push(`<div class="callout"><span class="cl-label">Coverage — public surface only</span>
+    This app has a login (<code>${esc(loginWall[0])}</code>) and no session was used, so whatever is behind it was
+    never reached. What follows describes the <strong>public surface</strong>.<br>
+    Run <code>ia-qa-discover login</code> to log in by hand once, then scan again.</div>`);
+    }
+    else if (session) {
+        parts.push(`<div class="ok-note">🔓 Scanned with a saved session — authenticated pages were reachable.</div>`);
+    }
+    if (manifest.pagesFailed > 0) {
+        parts.push(`<div class="callout"><span class="cl-label">Incomplete</span>
+    ${manifest.pagesFailed} page(s) could not be captured, so this describes ${manifest.pagesCaptured} of
+    ${manifest.pagesFound} pages found.</div>`);
+    }
+    parts.push(`</section>`);
+    // ── Pages ────────────────────────────────────────────────────────────────
+    parts.push(`<section><h2>Pages (${pages.length})</h2><div class="scroll"><table>
+  <thead><tr><th>Page</th><th>Path</th><th>Title</th><th>Headings</th><th>Forms</th><th>Fields</th><th>API calls</th></tr></thead><tbody>`);
+    for (const p of pages) {
+        let pathname = p.url;
+        try {
+            pathname = new URL(p.url).pathname;
+        }
+        catch { /* keep raw */ }
+        const formed = p.forms.reduce((n, f) => n + f.fields.length, 0);
+        const fieldCell = formed + p.looseFields.length + (p.looseFields.length > 0 ? ` <span class="muted">(${p.looseFields.length} loose)</span>` : '');
+        parts.push(`<tr><td><strong>${esc(p.page)}</strong></td><td><code>${esc(pathname)}</code></td>
+    <td>${esc(p.meta.title || '—')}</td><td>${p.headings.length}</td><td>${p.forms.length}</td><td>${fieldCell}</td><td>${p.apiCalls.length}</td></tr>`);
+    }
+    parts.push(`</tbody></table></div>`);
+    const distinctTitles = new Set(pages.map((p) => p.meta.title).filter(Boolean));
+    if (pages.length > 2 && distinctTitles.size === 1) {
+        parts.push(`<div class="callout"><span class="cl-label">All ${pages.length} pages share one title</span>
+    Every captured page reports <code>${esc([...distinctTitles][0])}</code>. The browser tab, the history entry and a
+    screen reader announcing a route change cannot tell these pages apart.</div>`);
+    }
+    parts.push(`</section>`);
+    // ── Forms ────────────────────────────────────────────────────────────────
+    if (formCount > 0) {
+        parts.push(`<section><h2>Entry points — forms (${formCount})</h2>
+    <div class="note">Where this app takes input: where a suite starts, and where validation, auth and payment
+    behaviour live. <strong>Locatable</strong> says whether a test could target the field reliably — it is a fact
+    about the app, not about this scan.</div>`);
+        for (const p of pages) {
+            for (const form of p.forms) {
+                const required = form.fields.filter((f) => f.required).length;
+                parts.push(`<div class="form-card">
+        <h3>${esc(p.page)} <span class="muted">— ${form.fields.length} field${form.fields.length === 1 ? '' : 's'}${required > 0 ? `, ${required} required` : ''}</span></h3>
+        <div class="fmeta">Selector <code>${esc(form.selector)}</code> · Submits to ${submitTarget(form)} ·
+        Submit control ${form.hasSubmit ? 'present' : '<strong>absent</strong>'}</div>`);
+                if (form.fields.length > 0) {
+                    parts.push(`<div class="scroll"><table><thead><tr><th>Field</th><th>Type</th><th>Required</th><th>Selector</th><th>Locatable</th></tr></thead><tbody>`);
+                    for (const f of form.fields) {
+                        const pill = f.ambiguousSelector
+                            ? '<span class="pill fail">ambiguous</span>'
+                            : f.stableSelector
+                                ? '<span class="pill pass">stable</span>'
+                                : '<span class="pill warn">positional</span>';
+                        parts.push(`<tr><td>${esc(f.name || '(unnamed)')}</td><td>${esc(f.type)}</td>
+            <td>${f.required ? 'yes' : 'no'}</td><td><code>${esc(f.selector)}</code></td><td>${pill}</td></tr>`);
+                    }
+                    parts.push(`</tbody></table></div>`);
+                }
+                parts.push(`</div>`);
+            }
+        }
+        parts.push(`</section>`);
+    }
+    // ── Loose fields ─────────────────────────────────────────────────────────
+    const looseTotal = pages.reduce((n, p) => n + p.looseFields.length, 0);
+    if (looseTotal > 0) {
+        parts.push(`<section><h2>Input fields outside a form (${looseTotal})</h2>
+    <div class="note">Inputs this app takes <strong>without</strong> a <code>&lt;form&gt;</code> wrapper — submission is handled
+    in JS. They are entry points all the same, and for most React/Vue apps they are the <em>only</em> ones.</div>`);
+        for (const p of pages) {
+            if (p.looseFields.length === 0)
+                continue;
+            parts.push(`<div class="form-card">
+      <h3>${esc(p.page)} <span class="muted">— ${p.looseFields.length} field${p.looseFields.length === 1 ? '' : 's'}</span></h3>
+      <div class="scroll"><table><thead><tr><th>Field</th><th>Type</th><th>Required</th><th>Where / how to reach</th><th>Selector</th><th>Locatable</th></tr></thead><tbody>`);
+            for (const f of p.looseFields) {
+                const pill = f.ambiguousSelector
+                    ? '<span class="pill fail">ambiguous</span>'
+                    : f.stableSelector
+                        ? '<span class="pill pass">stable</span>'
+                        : '<span class="pill warn">positional</span>';
+                parts.push(`<tr><td>${esc(f.name || '(unnamed)')}</td><td>${esc(f.type)}</td><td>${f.required ? 'yes' : 'no'}</td>
+        <td>${f.via?.length ? `🔍 click ${f.via.map((v) => `“${esc(v)}”`).join(' › ')}` : esc(f.context || '—')}</td><td><code>${esc(f.selector)}</code></td><td>${pill}</td></tr>`);
+            }
+            parts.push(`</tbody></table></div></div>`);
+        }
+        parts.push(`</section>`);
+    }
+    // ── API surface ──────────────────────────────────────────────────────────
+    parts.push(`<section><h2>API surface</h2>`);
+    if (manifest.origins.length === 0) {
+        parts.push(`<div class="note">No XHR/fetch traffic was observed — either the app makes none, or this scan ran with <code>--no-network</code>.</div>`);
+    }
+    else {
+        parts.push(`<div class="scroll"><table><thead><tr><th>Origin</th><th>Calls</th><th>Pages</th><th>Same-origin as the app</th></tr></thead><tbody>`);
+        for (const o of manifest.origins) {
+            parts.push(`<tr><td><code>${esc(o.origin)}</code></td><td>${o.calls}</td><td>${o.pages}</td>
+      <td>${o.sameOrigin ? '<span class="pill pass">yes</span>' : '<span class="pill info">no</span>'}</td></tr>`);
+        }
+        parts.push(`</tbody></table></div>
+    <div class="note"><strong>“Same-origin: no” is not the same as third-party.</strong> An app whose API lives on its
+    own separate host (an <code>api.*</code> subdomain, a platform backend) has every one of its <em>own</em> calls listed
+    here as cross-origin, right next to any analytics or ad host. Deciding which of these are first-party is a judgment
+    this stage does not make — nothing in the DOM states it.</div>`);
+    }
+    if (shared.calls.length > 0) {
+        const minPages = Math.max(2, Math.ceil(shared.threshold * shared.sourcePages));
+        parts.push(`<h2 style="margin-top:22px">Shared calls — on ≥ ${minPages} of ${shared.sourcePages} pages</h2>
+    <div class="note">Cross-cutting traffic: session refresh, telemetry, feature flags. Promoted out of the per-page
+    captures so one analytics beacon does not read as N page-specific calls.</div>
+    <div class="scroll"><table><thead><tr><th>Method</th><th>URL</th><th>Status</th><th>Pages</th></tr></thead><tbody>`);
+        for (const c of shared.calls) {
+            parts.push(`<tr><td>${esc(c.method)}</td><td><code>${esc(c.urlPattern)}</code></td><td>${c.status}</td><td>${c.count}</td></tr>`);
+        }
+        parts.push(`</tbody></table></div>`);
+    }
+    const perPage = pages.filter((p) => p.apiCalls.length > 0);
+    if (perPage.length > 0) {
+        parts.push(`<h2 style="margin-top:22px">Page-specific calls</h2><div class="scroll"><table>
+    <thead><tr><th>Page</th><th>Method</th><th>URL</th><th>Status</th></tr></thead><tbody>`);
+        for (const p of perPage) {
+            for (const c of p.apiCalls) {
+                parts.push(`<tr><td>${esc(p.page)}</td><td>${esc(c.method)}</td><td><code>${esc(c.urlPattern)}</code></td><td>${c.status}</td></tr>`);
+            }
+        }
+        parts.push(`</tbody></table></div>`);
+    }
+    parts.push(`</section>`);
+    // ── Model-classified entry points ────────────────────────────────────────
+    // Its own section, its own label, its own ink. Everything above is a literal
+    // observation; this is a reading of one, and a shared table would lend it a
+    // credibility it has not earned.
+    if (classification) {
+        const c = classification;
+        parts.push(`<section><h2>🤖 What these entry points are FOR <span class="pill info">model-classified</span></h2>
+    <div class="meta">${esc((0, classificationView_1.classificationHeadline)(c))} · <code>${esc(c.model)}</code> · <code>${esc(c.taxonomyVersion)}</code> · classified <code>${esc(c.classifiedAt)}</code></div>
+    <div class="note">${esc(classificationView_1.CLASSIFICATION_CAVEAT)}</div>`);
+        if (c.staleCount > 0) {
+            parts.push(`<div class="callout"><span class="cl-label">${c.staleCount} page${c.staleCount === 1 ? '' : 's'} below ${c.staleCount === 1 ? 'is' : 'are'} stale</span>${esc(classificationView_1.STALE_CAVEAT)}</div>`);
+        }
+        for (const p of c.pages) {
+            if (p.failed) {
+                parts.push(`<h3 style="margin-top:22px"><code>${esc(p.page)}</code> <span class="pill warn">not classified</span></h3>
+        <div class="note">The model call did not succeed: ${esc(p.failed)} Nothing is wrong with this page.</div>`);
+                continue;
+            }
+            if (p.kept.length === 0 && p.refused.length === 0)
+                continue;
+            parts.push(`<h3 style="margin-top:22px"><code>${esc(p.page)}</code>${p.stale ? ' <span class="pill warn">stale</span>' : ''}</h3>
+      <div class="scroll"><table><thead><tr><th>Entry point</th><th>Intent</th><th>Handles</th><th>Confidence</th><th>Why</th></tr></thead><tbody>`);
+            for (const k of p.kept) {
+                parts.push(`<tr><td><code>${esc(k.entryPoint.split('#')[1] ?? k.entryPoint)}</code></td><td><strong>${esc(k.intent)}</strong></td><td>${esc(k.sensitivity)}</td><td>${k.confidence.toFixed(2)}</td><td>${esc(k.why)}</td></tr>`);
+            }
+            // A refusal is an answer, shown as one — never dropped, never styled as a failure.
+            for (const r of p.refused) {
+                parts.push(`<tr><td><code>${esc(r.entryPoint.split('#')[1] ?? r.entryPoint)}</code></td><td class="muted"><em>declined</em></td><td class="muted">—</td><td>${r.confidence.toFixed(2)}</td><td>${esc(r.why)}</td></tr>`);
+            }
+            parts.push(`</tbody></table></div>`);
+            if (p.dropped > 0) {
+                parts.push(`<div class="note">${p.dropped} classification${p.dropped === 1 ? '' : 's'} on this page ${p.dropped === 1 ? 'was' : 'were'} dropped: the evidence did not check out. See <code>classification.json</code>.</div>`);
+            }
+        }
+        if (c.securityTools.length > 0) {
+            parts.push(`<h3 style="margin-top:22px">Security checks this selects</h3>
+      <div class="note">Chosen deterministically by the taxonomy from the intent above — never by the model. Available on the ia-qa.com MCP server.</div>
+      <div class="scroll"><table><thead><tr><th>Tool</th><th>For</th></tr></thead><tbody>`);
+            for (const t of c.securityTools) {
+                parts.push(`<tr><td><code>${esc(t.tool)}</code></td><td>${t.pages.map((p) => `<code>${esc(p)}</code>`).join(' ')}</td></tr>`);
+            }
+            parts.push(`</tbody></table></div>`);
+        }
+        // The honesty counter, in the same place the deterministic sections put theirs.
+        if (c.unclassified.length > 0) {
+            parts.push(`<div class="callout"><span class="cl-label">${c.unclassified.length} page${c.unclassified.length === 1 ? '' : 's'} with entry points carry no classification</span>
+      Either they were not sent, or their call failed: ${c.unclassified.map((p) => `<code>${esc(p)}</code>`).join(' ')}. The counts above describe what was classified, not the app.</div>`);
+        }
+        if (c.noEntryPoints > 0) {
+            parts.push(`<div class="note">${c.noEntryPoints} captured page${c.noEntryPoints === 1 ? '' : 's'} take no input at all, so there was nothing on them to classify.</div>`);
+        }
+        parts.push(`</section>`);
+    }
+    // ── Testability ──────────────────────────────────────────────────────────
+    if (unstable.length > 0) {
+        parts.push(`<section><h2>Testability</h2>
+    <div class="callout"><span class="cl-label">${unstable.length} of ${fields.length} field${fields.length === 1 ? '' : 's'} cannot be located durably</span>
+    They carry no <code>data-testid</code>, no <code>id</code> and no <code>name</code>, so the selectors above for them are
+    positional: they resolve today and break the moment a field is inserted above them. Adding a
+    <code>data-testid</code> to each is the cheapest durable fix — and it is worth doing <em>before</em> a suite is written
+    against them, not after.</div></section>`);
+    }
+    parts.push(`</div></main><footer><div class="wrap">
+  Generated by <a href="${BRAND.home}">IA-QA</a> <code>qa-discovery</code> — ${
+    // "no LLM" is true of the capture and false of this document the moment a
+    // classification section is in it. A footer that keeps saying it either way
+    // is the smallest possible version of the lie this package is built against.
+    classification
+        ? `capture deterministic and local; the classified section came from <code>${esc(classification.model)}</code>.`
+        : 'deterministic, local, no LLM.'}
+  · <a href="${BRAND.method}">Methods</a> · <a href="${BRAND.tools}">Tools</a>
+</div></footer></body></html>`);
+    return parts.join('\n');
+}
+//# sourceMappingURL=htmlReport.js.map

package/dist/htmlReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"htmlReport.js","sourceRoot":"","sources":["../src/htmlReport.ts"],"names":[],"mappings":";;AA8FA,4CAwSC;AArYD,6DAAmG;AAGnG;;;;;;;;;;;;GAYG;AAEH,MAAM,KAAK,GAAG;IACZ,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,8BAA8B;IACtC,KAAK,EAAE,iCAAiC;CACzC,CAAC;AAEF,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAkB;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,gCAAgC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACpF,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDlB,CAAC;AAEF,SAAgB,gBAAgB,CAAC,KAAoB;IACnD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAExH,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC;;qBAEQ,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;SACjC,UAAU,uBAAuB,CAAC,CAAC;IAE1C,KAAK,CAAC,IAAI,CAAC;;4BAEe,KAAK,CAAC,IAAI;2BACX,KAAK,CAAC,MAAM;;;wBAGf,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;uCACN,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,cAAc;;wCAErF,CAAC,CAAC;IAExC,4EAA4E;IAC5E,KAAK,CAAC,IAAI,CAAC;;;;;uCAK0B,QAAQ,CAAC,aAAa;uCACtB,SAAS;uCACT,MAAM,CAAC,MAAM;uCACb,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;uCAC/B,QAAQ,CAAC,OAAO,CAAC,MAAM;SACrD,CAAC,CAAC;IAET,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,CAAC,QAAQ,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC;gCACiB,QAAQ;4EACoC,MAAM,CAAC,MAAM;;;iGAGQ,CAAC,CAAC;IACjG,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,sDAAsD,QAAQ,iCAAiC,aAAa;2CAChF,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAa,+FAA+F,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACjM,CAAC;IAED,IAAI,YAAY,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC;cACD,YAAY;MACpB,QAAQ,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC,CAAC,+BAA+B,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE;8FACV,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC;;;2BAGY,QAAQ,CAAC,aAAa,OAAO,QAAQ,CAAC,UAAU;;4HAEiD,CAAC,CAAC;IAC5H,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC;MACT,SAAS,CAAC,MAAM,OAAO,QAAQ,CAAC,aAAa;OAC5C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;MAG1D,OAAO;YACP,CAAC,CAAC,wGAAwG;YAC1G,CAAC,CAAC,gFAAgF,QAAQ,CAAC,CAAC;IAChG,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC;kCACmB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;;yFAEsC,CAAC,CAAC;IACzF,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC;MACT,QAAQ,CAAC,WAAW,qDAAqD,QAAQ,CAAC,aAAa;MAC/F,QAAQ,CAAC,UAAU,qBAAqB,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzB,4EAA4E;IAC5E,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,MAAM;0IAC0F,CAAC,CAAC;IAC1I,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GACb,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClI,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,QAAQ,CAAC;UAC3E,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,SAAS,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAErC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,mDAAmD,KAAK,CAAC,MAAM;wCACtC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;iFACc,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzB,4EAA4E;IAC5E,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,sCAAsC,SAAS;;;8CAGhB,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC;cACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,MAAM,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,WAAW,CAAC,CAAC,CAAC,EAAE;4CACpH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,YAAY,CAAC,IAAI,CAAC;yBAC/E,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,QAAQ,CAAC,CAAC;gBACjF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC,2IAA2I,CAAC,CAAC;oBACxJ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB;4BAC9B,CAAC,CAAC,0CAA0C;4BAC5C,CAAC,CAAC,CAAC,CAAC,cAAc;gCAChB,CAAC,CAAC,uCAAuC;gCACzC,CAAC,CAAC,2CAA2C,CAAC;wBAClD,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;kBACjE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC;oBACvG,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,6CAA6C,UAAU;;kHAE4C,CAAC,CAAC;QAChH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACzC,KAAK,CAAC,IAAI,CAAC;YACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;6KAC0D,CAAC,CAAC;YACzK,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,iBAAiB;oBAC9B,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,CAAC,CAAC,cAAc;wBAChB,CAAC,CAAC,uCAAuC;wBACzC,CAAC,CAAC,2CAA2C,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;cACtG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC;YAC/K,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACxJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,sIAAsI,CAAC,CAAC;QACnJ,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK;YAChF,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,mCAAmC,YAAY,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;;;;mEAIoD,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,mDAAmD,QAAQ,OAAO,MAAM,CAAC,WAAW;;;uHAGoB,CAAC,CAAC;QACrH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;QACpI,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;2FAC4E,CAAC,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC;YACxI,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzB,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,iCAAiC;IACjC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,cAAc,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC;wBACS,GAAG,CAAC,IAAA,2CAAsB,EAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;wBAChJ,GAAG,CAAC,0CAAqB,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,GAAG,CAAC,iCAAY,CAAC,QAAQ,CAAC,CAAC;QACnM,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;4DACP,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBAC5G,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC5D,KAAK,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE;mJACkB,CAAC,CAAC;YAC/I,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACnO,CAAC;YACD,mFAAmF;YACnF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mFAAmF,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3N,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,kBAAkB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,uFAAuF,CAAC,CAAC;YACjO,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC;;0FAEyE,CAAC,CAAC;YACtF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChI,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvC,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,YAAY,CAAC,MAAM,QAAQ,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;yDAC1E,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACzL,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,aAAa,iBAAiB,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wEAAwE,CAAC,CAAC;QAC5K,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC;kDACmC,QAAQ,CAAC,MAAM,OAAO,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;;;;6CAI/E,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;0BACa,KAAK,CAAC,IAAI,2CAA2C;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,cAAc;QACZ,CAAC,CAAC,2EAA2E,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU;QAChH,CAAC,CAAC,+BACN;eACa,KAAK,CAAC,MAAM,4BAA4B,KAAK,CAAC,KAAK;8BACpC,CAAC,CAAC;IAE9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+export { scanApp } from './scan';
+export type { ScanOptions, ScanResult, SurfaceManifest } from './scan';
+export { SURFACE_SCHEMA } from './scan';
+export { readHistory, appendHistory, historyPath, HISTORY_LIMIT } from './history';
+export type { ScanHistoryEntry } from './history';
+export { capturePage, PAGE_CAPTURE_SCHEMA } from './capture/page';
+export type { PageCapture, PageMeta, Heading, CapturedForm, FormField } from './capture/page';
+export { SHARED_CALLS_SCHEMA } from './sharedCalls';
+export type { SharedCallsFile } from './sharedCalls';
+export { compareCaptures } from './diff';
+export type { CaptureDiff } from './diff';
+export { renderOverview, OVERVIEW_FILENAME } from './overview';
+export type { OverviewInput } from './overview';
+export { renderScanReport } from './htmlReport';
+export { loadConfig, saveConfig, configExists, baseDir, setBaseDir, captureDir, configPath, sessionPath, sessionTarget, resolveSession, CONFIG_DIR, SESSION_FILENAME, } from './config';
+export type { DiscoveryConfig, CaptureConfig, SessionChoice, SessionSource } from './config';
+export { normalizeApiUrl, apiCallFingerprint, DEFAULT_SAFE_QUERY_PARAMS } from './network';
+export type { ApiCall } from './network';
+export { verifyCitation, verifyClaim, loadCaptureIndex, SHARED_REF } from './citations';
+export type { Citation, CitationVerdict, CitationFailure, CaptureIndex, VerifiedClaim } from './citations';
+export { INTENTS, SENSITIVITIES, INTENT_IDS, SENSITIVITY_IDS, UNKNOWN_INTENT, TAXONOMY_VERSION, isIntent, isSensitivity, securityToolsFor, taxonomyForPrompt } from './taxonomy';
+export type { IntentDef, SensitivityDef, ToolTrigger } from './taxonomy';
+export { classifyPage, entryPointsOf, buildPrompt, parseClassifications, validate, collect } from './ai/classify';
+export type { ClassifyOptions, ClassifyResult, Classification, DroppedClassification, EntryPoint } from './ai/classify';