@siteoshq/cli 2.3.0 → 2.3.1

package/README.md

@@ -311,6 +311,9 @@ when requested with `npx playwright@1.61.1 install chromium` or `npx playwright@
 The check opens fresh contexts, exercises the public consent API and reports request origins and
 storage names without values, query strings, request bodies or authenticated sessions. These are
 real visits; normal installation/aggregate signals may be recorded. Reports remain local.
+CLI 2.3.1 distinguishes the `/gtm.js` container bootstrap from `/gtag/js` and recognizes
+regional GA4 `/g/collect` endpoints. Loading GTM to run the consent manager is not itself
+evidence that an Analytics tag ran; a GA4 request after withdrawal remains a failure in Basic mode.
 
 A report records the revision, runtime, observed Edge location, scenario scope and 24-hour expiry.
 `passed` exits 0; `needs-review` and `failed` exit 1. Unknown origins/storage require classification.

package/dist/cli.js

@@ -38,8 +38,12 @@ function assessCookieObservations(input) {
   const unknownStorage = /* @__PURE__ */ new Set();
   const services = input.envelope.config.services;
   for (const request of input.requests) {
+    if (request.origin === "https://www.googletagmanager.com" && request.path === "/gtm.js" && request.type === "script")
+      continue;
     const matches = services.filter(
-      (service) => service.lifecycle && [
+      (service) => service.key === "google-analytics" && /^https:\/\/(?:www\.|region\d+\.)?google-analytics\.com$/u.test(
+        request.origin
+      ) && request.path === "/g/collect" || service.lifecycle && [
         ...service.lifecycle.scriptOrigins,
         ...service.lifecycle.iframeOrigins,
         ...service.lifecycle.pixelOrigins
@@ -157,6 +161,7 @@ async function verifyCookieWebsite(input) {
         }
         requests.push({
           origin: new URL(request.url()).origin,
+          path: new URL(request.url()).pathname,
           type: request.resourceType(),
           scenario
         });