@ia-qa/qa-discovery 0.1.0

package/dist/classificationView.js

@@ -0,0 +1,178 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STALE_CAVEAT = exports.CLASSIFICATION_CAVEAT = void 0;
+exports.classificationPath = classificationPath;
+exports.loadClassification = loadClassification;
+exports.buildClassificationView = buildClassificationView;
+exports.classificationHeadline = classificationHeadline;
+exports.classificationFor = classificationFor;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+const classify_1 = require("./ai/classify");
+/** Where `ia-qa-discover-ai` writes. Never `capture/`: that directory is pages. */
+function classificationPath(cwd = (0, config_1.baseDir)()) {
+    return path.join(cwd, config_1.CONFIG_DIR, classify_1.CLASSIFICATION_FILENAME);
+}
+/**
+ * Read the classification, or null when there is none.
+ *
+ * A file whose `schema` is not the one this build understands is treated as
+ * absent rather than parsed optimistically: a report that renders fields it
+ * guessed at is worse than a report with no classification section.
+ */
+function loadClassification(file = classificationPath()) {
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (parsed?.schema !== classify_1.CLASSIFICATION_SCHEMA || typeof parsed.pages !== 'object' || !parsed.pages)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the page was captured after it was classified. */
+function isStale(page, classifiedAt) {
+    if (!page?.capturedAt)
+        return false;
+    const captured = Date.parse(page.capturedAt);
+    const classified = Date.parse(classifiedAt);
+    if (Number.isNaN(captured) || Number.isNaN(classified))
+        return false;
+    return captured > classified;
+}
+/**
+ * Pair a classification document with the capture the reports are rendering.
+ *
+ * `pages` is the current capture, so every count below is relative to what is on
+ * disk NOW — a classification naming a page that no longer exists is dropped
+ * from the view entirely rather than shown against nothing.
+ */
+function buildClassificationView(doc, pages) {
+    // `entryPointsOf` is the one definition of "this page has something to
+    // classify" — the AI CLI decides what to send with it, so the report must
+    // count what was NOT classified with the same function or the two disagree.
+    const hasEntryPoints = (p) => (0, classify_1.entryPointsOf)(p).length > 0;
+    const byName = new Map(pages.map((p) => [p.page, p]));
+    const out = [];
+    for (const [name, result] of Object.entries(doc.pages)) {
+        if (!byName.has(name))
+            continue;
+        out.push({
+            page: name,
+            kept: result.kept ?? [],
+            refused: result.refused ?? [],
+            dropped: (result.dropped ?? []).length,
+            failed: result.failed?.reason,
+            stale: isStale(byName.get(name), doc.classifiedAt),
+        });
+    }
+    out.sort((a, b) => a.page.localeCompare(b.page));
+    const candidates = pages.filter(hasEntryPoints);
+    const seen = new Set(out.filter((p) => !p.failed).map((p) => p.page));
+    const unclassified = candidates.filter((p) => !seen.has(p.page)).map((p) => p.page).sort();
+    const tools = new Map();
+    for (const p of out) {
+        for (const k of p.kept) {
+            for (const t of k.securityTools ?? []) {
+                if (!tools.has(t.tool))
+                    tools.set(t.tool, new Set());
+                tools.get(t.tool).add(p.page);
+            }
+        }
+    }
+    return {
+        model: doc.model,
+        classifiedAt: doc.classifiedAt,
+        taxonomyVersion: doc.taxonomyVersion,
+        pages: out,
+        unclassified,
+        noEntryPoints: pages.length - candidates.length,
+        staleCount: out.filter((p) => p.stale).length,
+        keptTotal: out.reduce((n, p) => n + p.kept.length, 0),
+        refusedTotal: out.reduce((n, p) => n + p.refused.length, 0),
+        droppedTotal: out.reduce((n, p) => n + p.dropped, 0),
+        securityTools: [...tools.entries()].map(([tool, ps]) => ({ tool, pages: [...ps].sort() })).sort((a, b) => a.tool.localeCompare(b.tool)),
+    };
+}
+/**
+ * The one-line summary both renderers put at the top of the section.
+ *
+ * It leads with what was kept and immediately qualifies it, because a bare
+ * "12 classified" is precisely the confident number this package spends its
+ * design on refusing to print.
+ */
+function classificationHeadline(v) {
+    const bits = [`${v.keptTotal} classified`];
+    if (v.refusedTotal > 0)
+        bits.push(`${v.refusedTotal} refused`);
+    if (v.droppedTotal > 0)
+        bits.push(`${v.droppedTotal} dropped`);
+    if (v.unclassified.length > 0)
+        bits.push(`${v.unclassified.length} page(s) not classified`);
+    if (v.staleCount > 0)
+        bits.push(`${v.staleCount} stale`);
+    return bits.join(' · ');
+}
+/**
+ * The reminder, deliberately softer than the deterministic one.
+ *
+ * The tool already refuses a claim whose citation does not resolve, so telling
+ * the reader to check everything again would be alarm fatigue — a warning that
+ * fires on the good rows too is a warning people learn to skip, and then it is
+ * not there when it matters. So it names the exact residual risk instead: the
+ * check proved the citation, never the reading built on it.
+ */
+exports.CLASSIFICATION_CAVEAT = 'Every line below cites something this tool resolved in the capture and checked — a claim whose ' +
+    'citation did not exist, or did not say what it was claimed to say, was dropped before you saw it. ' +
+    'That proves the premise, not the conclusion: a model can cite a real password field and still be ' +
+    'wrong about what the page is for. Read the `why` and the confidence, not the label alone.';
+/** Why a stale row is not simply out of date. */
+exports.STALE_CAVEAT = 'These pages were re-captured after they were classified, so the reading below describes a version ' +
+    'of the page that is no longer on disk. Re-run `ia-qa-discover-ai classify` before relying on them.';
+/**
+ * The whole read-and-pair step, for a caller that has pages and wants the
+ * section. Returns null when there is no classification — the normal case, and
+ * every renderer must be complete without one.
+ */
+function classificationFor(pages, file = classificationPath()) {
+    const doc = loadClassification(file);
+    return doc ? buildClassificationView(doc, pages) : null;
+}
+//# sourceMappingURL=classificationView.js.map

package/dist/classificationView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classificationView.js","sourceRoot":"","sources":["../src/classificationView.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,gDAEC;AASD,gDASC;AAkBD,0DAgDC;AASD,wDAOC;AA2BD,8CAGC;AAhND,uCAAyB;AACzB,2CAA6B;AAC7B,qCAA+C;AAC/C,4CAAwI;AAwExI,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,MAAc,IAAA,gBAAO,GAAE;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAU,EAAE,kCAAuB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,IAAI,GAAG,kBAAkB,EAAE;IAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAC;QACnF,IAAI,MAAM,EAAE,MAAM,KAAK,gCAAqB,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAS,OAAO,CAAC,IAA6B,EAAE,YAAoB;IAClE,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,QAAQ,GAAG,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,GAA2B,EAAE,KAAoB;IACvF,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,IAAA,wBAAa,EAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM;YAC7B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACrD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,KAAK,EAAE,GAAG;QACV,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;QAC/C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAC7C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KACxI,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,CAAqB;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC5F,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAChC,iGAAiG;IACjG,oGAAoG;IACpG,mGAAmG;IACnG,2FAA2F,CAAC;AAE9F,iDAAiD;AACpC,QAAA,YAAY,GACvB,oGAAoG;IACpG,oGAAoG,CAAC;AAEvG;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,KAAoB,EAAE,IAAI,GAAG,kBAAkB,EAAE;IACjF,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,3 @@
+/** Flag validation for the hand-rolled CLI parser — mirrors `@ia-qa/self-healing`'s `cli/args.ts`. */
+export declare const KNOWN_FLAGS: Record<string, readonly string[]>;
+export declare function rejectUnknownFlags(command: string, args: string[]): void;

package/dist/cli/args.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_FLAGS = void 0;
+exports.rejectUnknownFlags = rejectUnknownFlags;
+/** Flag validation for the hand-rolled CLI parser — mirrors `@ia-qa/self-healing`'s `cli/args.ts`. */
+exports.KNOWN_FLAGS = {
+    scan: [
+        '--depth',
+        '--max',
+        '--no-reveal',
+        '--strict-host',
+        '--session',
+        '--no-network',
+        '--no-sitemap',
+        '--deep',
+        '--deep-budget',
+        '--network-threshold',
+        '--save',
+        '--json',
+        '--report',
+        '--open',
+    ],
+    login: ['--url', '--session'],
+    history: ['--json', '--limit'],
+};
+function rejectUnknownFlags(command, args) {
+    const known = exports.KNOWN_FLAGS[command];
+    if (known === undefined)
+        return;
+    for (const a of args) {
+        if (!a.startsWith('-'))
+            continue;
+        if (known.includes(a))
+            continue;
+        throw new Error(`Unknown flag "${a}" for "ia-qa-discover ${command}". Run \`ia-qa-discover help\` to see its flags.`);
+    }
+}
+//# sourceMappingURL=args.js.map

package/dist/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":";;;AAsBA,gDAQC;AA9BD,sGAAsG;AACzF,QAAA,WAAW,GAAsC;IAC5D,IAAI,EAAE;QACJ,SAAS;QACT,OAAO;QACP,aAAa;QACb,eAAe;QACf,WAAW;QACX,cAAc;QACd,cAAc;QACd,QAAQ;QACR,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,QAAQ;KACT;IACD,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;IAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC/B,CAAC;AAEF,SAAgB,kBAAkB,CAAC,OAAe,EAAE,IAAc;IAChE,MAAM,KAAK,GAAG,mBAAW,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,yBAAyB,OAAO,kDAAkD,CAAC,CAAC;IACxH,CAAC;AACH,CAAC"}

package/dist/cli/history.d.ts

@@ -0,0 +1 @@
+export declare function runHistory(args: string[]): Promise<void>;

package/dist/cli/history.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHistory = runHistory;
+const history_1 = require("../history");
+function intArg(args, flag, fallback, max) {
+    const i = args.indexOf(flag);
+    if (i === -1)
+        return fallback;
+    const raw = args[i + 1];
+    const n = Number(raw);
+    if (!raw || !Number.isInteger(n) || n < 1 || n > max) {
+        throw new Error(`${flag} needs a whole number between 1 and ${max}.`);
+    }
+    return n;
+}
+async function runHistory(args) {
+    const limit = intArg(args, '--limit', history_1.HISTORY_LIMIT, history_1.HISTORY_LIMIT);
+    const entries = (0, history_1.readHistory)(limit);
+    if (args.includes('--json')) {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    if (entries.length === 0) {
+        console.log('No scan history yet — run `ia-qa-discover scan <url>` first.');
+        return;
+    }
+    for (const e of entries) {
+        const churn = e.added.length + e.removed.length + e.changed.length;
+        console.log(`${e.ts}  ${e.pagesCaptured}/${e.pagesFound} pages  ` +
+            `+${e.added.length} -${e.removed.length} ~${e.changed.length}` +
+            (churn === 0 ? '  (no change)' : '') +
+            (e.commit ? `  ${e.commit}${e.branch ? ` (${e.branch})` : ''}` : ''));
+    }
+}
+//# sourceMappingURL=history.js.map

package/dist/cli/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../src/cli/history.ts"],"names":[],"mappings":";;AAaA,gCAuBC;AApCD,wCAAwD;AAExD,SAAS,MAAM,CAAC,IAAc,EAAE,IAAY,EAAE,QAAgB,EAAE,GAAW;IACzE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,GAAG,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,uBAAa,EAAE,uBAAa,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACnE,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,UAAU,UAAU;YACnD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;YAC9D,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+declare const HELP = "ia-qa-discover \u2014 deterministic surface reconnaissance for a web app\n\nF1 of QA Discovery: crawl an app's same-origin pages and capture what each one\nis structurally about \u2014 title, headings, forms, and observed API calls. No\nLLM, no verdict: this is recon, not a gate. Runs entirely on your machine;\nnothing is uploaded anywhere.\n\n[FOR AI AGENTS] You are driving this for a human. Run `scan` to capture the\napp's surface, then read .ia-qa-discovery/capture/surface.json (the index) and\nthe per-page files it points at \u2014 that is the evidence for anything you\nreport about this app. Never assert a page's purpose or risk from the URL\nalone; ground it in the captured meta/headings/forms/apiCalls. Never read a\npage count as coverage: if scan warns that pages still show a login form, you\nmeasured the wall, not the app. You CANNOT run `login` \u2014 it waits for a human\nat a browser; ask them to run it, then scan again.\n\nUsage:\n  ia-qa-discover login                     Open a visible browser, log in by hand, keep the\n                                             session (.ia-qa-discovery/session.json) for scan\n                                             to reuse. The general answer to a login wall: it\n                                             models nothing, so SSO, MFA, a consent screen or\n                                             a magic link all work \u2014 you do them.\n                                             Needs a terminal, refuses under CI. The file holds\n                                             live cookies: gitignored, stays on this machine.\n                                              --url <path>   page to open (default: your baseUrl)\n                                              --session <f>  where to write it\n                                           Already have a storageState (a Playwright globalSetup\n                                           writes one)? Skip this verb: point scan at it with\n                                           --session <file> or \"session\" in config.json.\n  ia-qa-discover scan [url]                Crawl same-origin pages from <url> (or the saved\n                                             baseUrl) and capture each page's structure.\n                                             Writes .ia-qa-discovery/capture/, diffs against\n                                             the previous run, appends history.jsonl.\n                                              --depth <n>              crawl link-depth (default 2)\n                                              --max <n>                page cap (default 60)\n                                              --deep                   also open menus, tabs and dialogs one level\n                                                                       down and capture the fields they reveal. Every\n                                                                       non-GET request is blocked for the duration,\n                                                                       so a click cannot mutate anything server-side.\n                                              --deep-budget <n>        max controls clicked per page (default 60)\n                                              --no-sitemap             do not read sitemap.xml / robots.txt\n                                              --no-reveal              do not open menus/dropdowns for hidden links\n                                              --strict-host            treat www./apex as different hosts\n                                              --session <file>         reuse an existing storageState (login) file\n                                              --no-network             skip API/network-call capture this run\n                                              --network-threshold <n>  shared-call promotion threshold 0-1 (default 0.6)\n                                              --save                   persist this baseUrl to config.json\n                                              --json                   machine-readable summary on stdout\n                                              --report [file.html]     branded ia-qa.com HTML dossier of the\n                                                                       app (default ia-qa-discover-report.html)\n                                              --open                   open that report in the browser\n  ia-qa-discover history                   Recorded scan runs \u2014 pages/forms/API-surface trend.\n                                              --json   --limit <n> (default 500)\n  ia-qa-discover version                   Print the installed version (also --version, -v)\n  ia-qa-discover help                      Show this help\n\nGlobal:\n  --config <dir>                           Resolve .ia-qa-discovery/ under <dir> instead of the\n                                             current directory. Also IAQA_DISCOVERY_CONFIG_DIR=<dir>.\n";
+declare function verbHelp(command: string | undefined): string | null;
+declare function main(): Promise<void>;
+export { HELP, verbHelp, main };

package/dist/cli/index.js

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP = void 0;
+exports.verbHelp = verbHelp;
+exports.main = main;
+const config_1 = require("../config");
+const args_1 = require("./args");
+const scan_1 = require("./scan");
+const login_1 = require("./login");
+const history_1 = require("./history");
+// dist/cli/ → package root; npm ships package.json in every tarball.
+const VERSION = require('../../package.json').version;
+const HELP = `ia-qa-discover — deterministic surface reconnaissance for a web app
+
+F1 of QA Discovery: crawl an app's same-origin pages and capture what each one
+is structurally about — title, headings, forms, and observed API calls. No
+LLM, no verdict: this is recon, not a gate. Runs entirely on your machine;
+nothing is uploaded anywhere.
+
+[FOR AI AGENTS] You are driving this for a human. Run \`scan\` to capture the
+app's surface, then read .ia-qa-discovery/capture/surface.json (the index) and
+the per-page files it points at — that is the evidence for anything you
+report about this app. Never assert a page's purpose or risk from the URL
+alone; ground it in the captured meta/headings/forms/apiCalls. Never read a
+page count as coverage: if scan warns that pages still show a login form, you
+measured the wall, not the app. You CANNOT run \`login\` — it waits for a human
+at a browser; ask them to run it, then scan again.
+
+Usage:
+  ia-qa-discover login                     Open a visible browser, log in by hand, keep the
+                                             session (.ia-qa-discovery/session.json) for scan
+                                             to reuse. The general answer to a login wall: it
+                                             models nothing, so SSO, MFA, a consent screen or
+                                             a magic link all work — you do them.
+                                             Needs a terminal, refuses under CI. The file holds
+                                             live cookies: gitignored, stays on this machine.
+                                              --url <path>   page to open (default: your baseUrl)
+                                              --session <f>  where to write it
+                                           Already have a storageState (a Playwright globalSetup
+                                           writes one)? Skip this verb: point scan at it with
+                                           --session <file> or "session" in config.json.
+  ia-qa-discover scan [url]                Crawl same-origin pages from <url> (or the saved
+                                             baseUrl) and capture each page's structure.
+                                             Writes .ia-qa-discovery/capture/, diffs against
+                                             the previous run, appends history.jsonl.
+                                              --depth <n>              crawl link-depth (default 2)
+                                              --max <n>                page cap (default 60)
+                                              --deep                   also open menus, tabs and dialogs one level
+                                                                       down and capture the fields they reveal. Every
+                                                                       non-GET request is blocked for the duration,
+                                                                       so a click cannot mutate anything server-side.
+                                              --deep-budget <n>        max controls clicked per page (default 60)
+                                              --no-sitemap             do not read sitemap.xml / robots.txt
+                                              --no-reveal              do not open menus/dropdowns for hidden links
+                                              --strict-host            treat www./apex as different hosts
+                                              --session <file>         reuse an existing storageState (login) file
+                                              --no-network             skip API/network-call capture this run
+                                              --network-threshold <n>  shared-call promotion threshold 0-1 (default 0.6)
+                                              --save                   persist this baseUrl to config.json
+                                              --json                   machine-readable summary on stdout
+                                              --report [file.html]     branded ia-qa.com HTML dossier of the
+                                                                       app (default ia-qa-discover-report.html)
+                                              --open                   open that report in the browser
+  ia-qa-discover history                   Recorded scan runs — pages/forms/API-surface trend.
+                                              --json   --limit <n> (default 500)
+  ia-qa-discover version                   Print the installed version (also --version, -v)
+  ia-qa-discover help                      Show this help
+
+Global:
+  --config <dir>                           Resolve .ia-qa-discovery/ under <dir> instead of the
+                                             current directory. Also IAQA_DISCOVERY_CONFIG_DIR=<dir>.
+`;
+exports.HELP = HELP;
+function extractConfigDir(argv) {
+    const rest = [];
+    let dir;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--config') {
+            const next = argv[i + 1];
+            if (next === undefined || next.startsWith('-')) {
+                throw new Error('--config needs a directory argument, e.g. --config apps/xsp.');
+            }
+            dir = next;
+            i++;
+            continue;
+        }
+        if (a.startsWith('--config=')) {
+            dir = a.slice('--config='.length);
+            continue;
+        }
+        rest.push(a);
+    }
+    return { dir, rest };
+}
+function verbHelp(command) {
+    if (!command || command.startsWith('-'))
+        return null;
+    const lines = HELP.split('\n');
+    const start = lines.findIndex((l) => l.startsWith(`  ia-qa-discover ${command} `) || l === `  ia-qa-discover ${command}`);
+    if (start === -1)
+        return null;
+    const block = [lines[start]];
+    for (let i = start + 1; i < lines.length; i++) {
+        const l = lines[i];
+        if (/^\s{4,}\S/.test(l))
+            block.push(l);
+        else
+            break;
+    }
+    const flags = args_1.KNOWN_FLAGS[command];
+    const tail = flags?.length ? `\n\nFlags: ${flags.join(' ')}` : '\n\n(no flags)';
+    return `${block.join('\n')}${tail}\n\nFull help: ia-qa-discover help`;
+}
+async function main() {
+    const { dir: configDir, rest: argv } = extractConfigDir(process.argv.slice(2));
+    if (configDir !== undefined) {
+        if (!configDir)
+            throw new Error('--config needs a directory argument.');
+        (0, config_1.setBaseDir)(configDir);
+    }
+    const [command, ...rest] = argv;
+    if (rest.includes('--help') || rest.includes('-h')) {
+        console.log(verbHelp(command) ?? HELP);
+        return;
+    }
+    if (command !== undefined)
+        (0, args_1.rejectUnknownFlags)(command, rest);
+    switch (command) {
+        case 'scan':
+            await (0, scan_1.runScan)(rest);
+            break;
+        case 'login':
+            await (0, login_1.runLogin)(rest);
+            break;
+        case 'history':
+            await (0, history_1.runHistory)(rest);
+            break;
+        case 'version':
+        case '--version':
+        case '-v':
+            console.log(VERSION);
+            break;
+        case 'help':
+        case '--help':
+        case '-h':
+        case undefined:
+            console.log(HELP);
+            break;
+        default:
+            console.error(`Unknown command "${command}".\n\n${HELP}`);
+            process.exit(1);
+    }
+}
+/**
+ * Only when this file IS the process.
+ *
+ * `main()` reads argv and can `process.exit`, so an unconditional call made
+ * this module impossible to import and therefore impossible to test — and the
+ * verb dispatch is exactly where a CLI/MCP divergence would hide. Same guard,
+ * and same reason, as `@ia-qa/self-healing`'s MCP server.
+ */
+if (require.main === module)
+    run();
+function run() {
+    main().catch((err) => {
+        console.error(`\n❌ ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;;AA0Ke,4BAAQ;AAAE,oBAAI;AAzK7B,sCAAuC;AACvC,iCAAyD;AACzD,iCAAiC;AACjC,mCAAmC;AACnC,uCAAuC;AAEvC,qEAAqE;AACrE,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAiB,CAAC;AAEhE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DZ,CAAC;AAqGO,oBAAI;AAnGb,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,GAAuB,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;YACD,GAAG,GAAG,IAAI,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,OAA2B;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,oBAAoB,OAAO,EAAE,CAC3F,CAAC;IACF,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClC,MAAM;IACb,CAAC;IACD,MAAM,KAAK,GAAG,kBAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAChF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,oCAAoC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACxE,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,IAAA,yBAAkB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAE7D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,MAAM,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC;YACpB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,IAAA,oBAAU,EAAC,IAAI,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,SAAS,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;IAAE,GAAG,EAAE,CAAC;AAEnC,SAAS,GAAG;IACV,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/login.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `ia-qa-discover login` — open a browser, let a human log in, keep the session.
+ *
+ * Same reasoning as `ia-qa-heal login`, and for the same reason: any
+ * declarative `auth` block models ONE shape of login (a username field, a
+ * password field, a submit button), so federated SSO, MFA, a consent screen, a
+ * magic link or a device check are each out of reach of every selector list.
+ * This verb models nothing at all — the human does whatever the app asks — so
+ * it is the general answer to a login wall.
+ *
+ * Measured need: on a real target, an anonymous scan reached 3 of 11 routes;
+ * everything worth discovering was behind the wall, and the app's catch-all
+ * route served the login page at every unknown URL with HTTP 200 — so the scan
+ * reported "3 pages captured" and looked like a success.
+ *
+ * Deliberately not automatic, and never part of a pipeline:
+ *  - The only caller here that opens a VISIBLE browser. Every capture path
+ *    stays headless: a window in CI is a hung build.
+ *  - Refuses without a TTY and under CI — it waits for a person twice over (at
+ *    the browser, then at the keyboard), so a pipeline that runs it just hangs.
+ *    That refusal is aimed squarely at an agent driving this CLI: it cannot
+ *    perform this step, and must ask the human to.
+ *  - What it writes is a SECRET (live cookies). The path and that fact are
+ *    announced BEFORE the browser opens, and `.ia-qa-discovery/.gitignore` is
+ *    written on the way out. Nothing here uploads it.
+ *
+ * Not an MCP tool, on purpose. See `mcp/server.ts`.
+ */
+export declare function runLogin(args: string[]): Promise<void>;