@siteoshq/cli 2.3.0 → 2.4.0

package/README.md

@@ -1,7 +1,7 @@
 # SiteOS CLI
 
 `@siteoshq/cli` exposes one `siteos` binary for Auth, common Projects, Pulse, Cookie, Forms,
-Search, Trace, SEO/GEO and Integrations. This source is version 2.2.0; source changes require a separate release to reach npm.
+Search, Trace, SEO/GEO and Integrations. This source is version 2.4.0; source changes require a separate release to reach npm.
 
 CLI 2 requires `siteos project use <id-or-slug> --environment <slug>` once per repository.
 It stores only the common selection in private `projects.json`; older service bindings are not
@@ -230,6 +230,11 @@ siteos seo gsc export --dataset queries --format csv --output ./gsc-queries.csv
 
 Run `siteos seo --help` for request JSON, limits, saved inputs, cancellation and GSC settings.
 Research supports keywords, Domain Overview (`domain`), rankings, backlinks, brand and AI visibility without GSC.
+AI Visibility category history uses `--kind ai-rankings`; Prompt checks stays separate under
+`--kind ai-visibility`. Category requests use `kind: ai-visibility` with a `category-aeo-v2`
+category. Reports and exports preserve AEO scores, recommendation roles, first choices, objections,
+model settings and the exact supporting answers. See the SEO skill's AI visibility reference for
+the versioned request and scoring method; historical v1 reports remain readable without inferred scores.
 Domain Overview collects domain totals, up to 100 ranking keywords, pages and competitors for a market.
 `--kind domain` includes legacy `competitors` history; existing `competitors` inputs keep their original two-part plan.
 New request example: `{"kind":"domain","target":"example.com","country":"US","language":"en"}`.
@@ -311,6 +316,9 @@ when requested with `npx playwright@1.61.1 install chromium` or `npx playwright@
 The check opens fresh contexts, exercises the public consent API and reports request origins and
 storage names without values, query strings, request bodies or authenticated sessions. These are
 real visits; normal installation/aggregate signals may be recorded. Reports remain local.
+CLI 2.3.1 distinguishes the `/gtm.js` container bootstrap from `/gtag/js` and recognizes
+regional GA4 `/g/collect` endpoints. Loading GTM to run the consent manager is not itself
+evidence that an Analytics tag ran; a GA4 request after withdrawal remains a failure in Basic mode.
 
 A report records the revision, runtime, observed Edge location, scenario scope and 24-hour expiry.
 `passed` exits 0; `needs-review` and `failed` exit 1. Unknown origins/storage require classification.

package/dist/cli.js

@@ -38,8 +38,12 @@ function assessCookieObservations(input) {
   const unknownStorage = /* @__PURE__ */ new Set();
   const services = input.envelope.config.services;
   for (const request of input.requests) {
+    if (request.origin === "https://www.googletagmanager.com" && request.path === "/gtm.js" && request.type === "script")
+      continue;
     const matches = services.filter(
-      (service) => service.lifecycle && [
+      (service) => service.key === "google-analytics" && /^https:\/\/(?:www\.|region\d+\.)?google-analytics\.com$/u.test(
+        request.origin
+      ) && request.path === "/g/collect" || service.lifecycle && [
         ...service.lifecycle.scriptOrigins,
         ...service.lifecycle.iframeOrigins,
         ...service.lifecycle.pixelOrigins
@@ -157,6 +161,7 @@ async function verifyCookieWebsite(input) {
         }
         requests.push({
           origin: new URL(request.url()).origin,
+          path: new URL(request.url()).pathname,
           type: request.resourceType(),
           scenario
         });
@@ -9007,17 +9012,19 @@ var RESEARCH_HELP = `
   siteos seo research saved save --input <request.json> --name <name> [--id <saved-id>] [--environment <slug>] [--json]
   siteos seo research saved remove <saved-id> [--environment <slug>] [--json]
 
-Research kinds: keywords, domain, rankings, backlinks, brand, ai-visibility.
+Research request kinds: keywords, domain, rankings, backlinks, brand, ai-visibility.
+Read sections also accept --kind ai-rankings for category comparisons; --kind ai-visibility selects Prompt checks.
+Category run/plan inputs use kind ai-visibility with category-aeo-v2; both sections share AI request execution.
 Domain Overview: {"kind":"domain","target":"example.com","country":"US","language":"en"}.
 Domain collects summary, ranking keywords, top pages and competitors. The legacy competitors kind retains its two-part plan; domain history includes those reports.
 Request JSON: {"kind":"keywords","target":"example.com","keywords":["website analytics"],"country":"US","language":"en"}.
-Rankings accepts up to 10 keywords and 5 competitors. AI visibility requires brand, prompt and platforms.
+Rankings accepts up to 10 keywords and 5 competitors. AI visibility accepts brand, platforms and either prompt or a category-aeo-v2 category with products and questions.
 Markets: US, GB, ES, DE, FR, CA, AU. Languages: en, es, de, fr, pt, it, nl, ru.
 Platforms: chat_gpt, claude, gemini, perplexity. Brand lookup uses brandPlatform chat_gpt|google and brandMatch domain|brand.
 Plan validates the request and shows planned parts and available research credits without enqueueing work.
 Run consumes Organization research credits through the same worker as the interface. Preserve the retry key after an uncertain response.
 SERP ensure collects one saved organic snapshot for a keyword returned by the selected completed Keyword Research report. It uses research credits once; repeating the same report/word returns the saved job, including failures. Show/wait/export only read and never spend. New reports can collect fresh snapshots.
-History returns the latest 30 checks per kind; show/export can address older retained run IDs. Saved checks are limited to 100 per resource.
+History returns the latest 30 checks per section; show/export can address older retained run IDs. Saved checks are limited to 100 per resource.
 Wait defaults to 120 seconds (maximum 900); exit 3 means still pending, exit 4 means failed or cancelled. Partial evidence stays accessible.
 Exports preserve scope, dates and partial state. CSV stores one dataset row as JSON per row, including failed parts; it never converts missing metrics to zero.
 `;
@@ -9029,6 +9036,8 @@ var kinds = [
   "brand",
   "ai-visibility"
 ];
+var sections = [...kinds, "ai-rankings"];
+var sectionOf = (request) => request.kind === "ai-visibility" && request.category ? "ai-rankings" : request.kind;
 var requestSchema = z17.object({
   kind: z17.enum(["domain", ...kinds]).transform((kind) => kind === "domain" ? "competitors" : kind),
   target: z17.string().min(1).max(253)
@@ -9099,7 +9108,7 @@ async function runSeoResearchCommand(options) {
         "Provide --keyword with 1 to 200 characters from the selected keyword report."
       );
     if (values.kind === "domain") values.kind = "competitors";
-    if (operation.flags.includes("kind") && !kinds.includes(values.kind))
+    if (operation.flags.includes("kind") && !sections.includes(values.kind))
       throw new Error("Choose a documented --kind.");
     if (operation.flags.includes("input") && !values.input)
       throw new Error("Provide --input with a research request JSON file.");
@@ -9307,7 +9316,7 @@ async function runSeoResearchCommand(options) {
     } else if (action === "summary") {
       record = await get("/summary");
       resourceSchema.parse(record.resource);
-      z17.array(z17.object({ kind: z17.enum(kinds), summary: z17.unknown() })).parse(
+      z17.array(z17.object({ kind: z17.enum(sections), summary: z17.unknown() })).parse(
         record.checks
       );
     } else if (["status", "history", "saved list"].includes(action)) {
@@ -9321,13 +9330,13 @@ async function runSeoResearchCommand(options) {
           request: requestSchema
         }).passthrough()
       ).parse(view.saved);
-      if (runs.some((r) => r.request.kind !== values.kind) || saved.some((r) => r.request.kind !== values.kind))
+      if (runs.some((r) => sectionOf(r.request) !== values.kind) || saved.some((r) => sectionOf(r.request) !== values.kind))
         throw new Error(
           "The response does not match the requested research kind."
         );
       if (view.run != null) {
         const selected = runSchema.parse(view.run);
-        if (selected.request.kind !== values.kind)
+        if (sectionOf(selected.request) !== values.kind)
           throw new Error("The selected report has a different research kind.");
       }
       record = {
@@ -9390,6 +9399,25 @@ async function runSeoResearchCommand(options) {
             row
           ]);
         });
+        if (run.categoryReport) {
+          rows.push([
+            run.id,
+            run.websiteUrl,
+            run.request.kind,
+            run.request.target,
+            run.createdAt,
+            run.state,
+            run.error,
+            null,
+            null,
+            null,
+            null,
+            "category-report",
+            run.request,
+            { version: run.categoryReport.version },
+            run.categoryReport
+          ]);
+        }
         const content = values.format === "json" ? JSON.stringify(record, null, 2) : [
           [
             "run_id",
@@ -9883,7 +9911,7 @@ var SEO_HELP = `SEO/GEO: audit your website and research search-engine and AI vi
 
 Site Audit checks public HTML, canonical, robots.txt, sitemap and technical GEO signals.
 Performance measures selected pages with Lighthouse and compares response/rendered HTML.
-Research covers keywords, rankings, competitors, backlinks, Brand lookup and Prompt checks.
+Research covers keywords, rankings, competitors, backlinks, Brand lookup and AI visibility.
 GSC Insights reads your connected property's Google Search Console data; other research needs no GSC.
 Technical GEO checks crawler policies, content, snippets and structured-data syntax/shape.
 These checks do not measure autonomous agent journeys or guarantee AI inclusion or citations.