pagesight 0.19.0 → 0.20.0

package/src/api/schema.ts

@@ -1,3 +1,6 @@
+import { httpUrl } from "./http-url.js";
+export { httpUrl } from "./http-url.js";
+import { changeRecordSchema } from "./change-record.js";
 import { uiFindingsSchema } from "./ui-findings.js";
 import { z } from "zod";
 import { snapshotEvidenceSchema } from "./evidence-schema.js";
@@ -100,17 +103,6 @@ export const gaRealtimeRequestSchema = z
   .strict();
 export type GaRealtimeRequest = z.infer<typeof gaRealtimeRequestSchema>;
 
-export const httpUrl = z
-  .string()
-  .url()
-  .refine(
-    (v) =>
-      URL.canParse(v) &&
-      ["http:", "https:"].includes(new URL(v).protocol) &&
-      !new URL(v).username &&
-      !new URL(v).password,
-    "Use an HTTP(S) URL without credentials",
-  );
 export const configSchema = z
   .object({
     site: httpUrl,
@@ -154,13 +146,97 @@ export const configSchema = z
     "Select at least one page or provider",
   );
 export type SiteConfig = z.infer<typeof configSchema>;
-const assessedSnapshotSchema = snapshotEvidenceSchema.superRefine((snapshot, ctx) => {
+export const assessedSnapshotSchema = snapshotEvidenceSchema.superRefine((snapshot, ctx) => {
   const config = configSchema.safeParse(snapshot.pages[0].response.context.config);
   if (!config.success)
     for (const issue of config.error.issues)
       ctx.addIssue({ ...issue, path: ["pages", 0, "response", "context", "config", ...issue.path] });
 });
+const renderRequestSchema = z
+  .object({
+    operation: z.literal("page.verify"),
+    url: httpUrl,
+    navigation: z
+      .object({ fromUrl: httpUrl, linkSelector: z.string().min(1).max(500) })
+      .strict()
+      .optional(),
+    settleMs: z.number().int().min(0).max(5000).default(1000),
+    timeoutMs: z.number().int().min(1000).max(60000).default(20000),
+    viewport: z
+      .object({ width: z.number().int().min(320).max(2560), height: z.number().int().min(240).max(2160) })
+      .strict()
+      .default({ width: 1280, height: 800 }),
+  })
+  .strict();
 const operationVariants = z.discriminatedUnion("operation", [
+  renderRequestSchema,
+  z
+    .object({
+      operation: z.literal("change.followup"),
+      experiments: z
+        .array(z.unknown())
+        .min(1)
+        .max(50)
+        .describe(
+          "Entries: {label, record: change record, baseline: configured snapshot, current?: configured snapshot}. Each entry is validated independently; use embedded objects, not filesystem paths.",
+        ),
+      asOf: z.string().datetime().optional(),
+      lagDays: z.number().int().min(1).max(30).default(3),
+    })
+    .strict(),
+
+  z
+    .object({
+      operation: z.literal("cloudflare.audit"),
+      zone: z.string().regex(/^[a-f0-9]{32}$/),
+      hostname: z
+        .string()
+        .min(1)
+        .max(253)
+        .regex(/^[a-zA-Z0-9.-]+$/),
+      startTime: z.string().datetime(),
+      endTime: z.string().datetime(),
+      limit: z.number().int().min(1).max(100).default(50),
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("change.evaluate"),
+      record: changeRecordSchema,
+      baseline: assessedSnapshotSchema,
+      current: assessedSnapshotSchema.optional(),
+      maxRows: z.number().int().min(1).max(100).default(20),
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("crawl"),
+      config: configSchema,
+      maxPages: z.number().int().min(1).max(100).default(20),
+      maxDepth: z.number().int().min(0).max(10).default(3),
+      maxLinks: z.number().int().min(1).max(1000).default(500),
+      includeQuery: z.boolean().default(false),
+      inspectLimit: z.number().int().min(0).max(10).default(3),
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("technical.compare"),
+      baseline: assessedSnapshotSchema.optional(),
+      current: assessedSnapshotSchema,
+    })
+    .strict(),
+  z
+    .object({
+      operation: z.literal("investigate"),
+      config: configSchema,
+      url: httpUrl,
+      startDate: dateSchema,
+      endDate: dateSchema,
+      maxPages: maxPagesSchema.default(1),
+      maxRows: z.number().int().min(1).max(100).default(28),
+    })
+    .strict(),
   z
     .object({
       operation: z.literal("opportunities"),
@@ -264,8 +340,19 @@ const operationVariants = z.discriminatedUnion("operation", [
     })
     .strict(),
 ]);
-export const operationSchema = operationVariants.refine(
-  (op) => op.operation !== "snapshot" || (op.startDate <= op.endDate && op.endDate <= pacificDate()),
-  "Invalid or future snapshot interval",
-);
+export const operationSchema = operationVariants
+  .refine(
+    (op) =>
+      op.operation !== "cloudflare.audit" ||
+      (Date.parse(op.startTime) < Date.parse(op.endTime) &&
+        Date.parse(op.endTime) - Date.parse(op.startTime) <= 86400000 &&
+        Date.parse(op.endTime) <= Date.now()),
+    "Cloudflare requires a past UTC interval of at most 24 hours",
+  )
+  .refine(
+    (op) =>
+      (op.operation !== "snapshot" && op.operation !== "investigate") ||
+      (op.startDate <= op.endDate && op.endDate <= pacificDate()),
+    "Invalid or future reporting interval",
+  );
 export type Operation = z.input<typeof operationSchema>;

package/src/api/technical-changes.ts

@@ -0,0 +1,124 @@
+import { z } from "zod";
+import { capture } from "./evidence.js";
+import type { ImportedSnapshot } from "./evidence-schema.js";
+import { configSchema } from "./schema.js";
+import { canonical } from "./report-table.js";
+const pageSchema = z.object({
+  url: z.string().url(),
+  finalUrl: z.string().url(),
+  status: z.number().int(),
+  canonical: z.string().nullable(),
+  robots: z.array(z.string()),
+  xRobotsTag: z.string().nullable(),
+  title: z.string().nullable(),
+  description: z.string().nullable(),
+  sha256: z.string(),
+  redirects: z.array(z.unknown()),
+});
+
+export function technicalChanges(baseline: ImportedSnapshot | undefined, current: ImportedSnapshot) {
+  const hash = (v: unknown) => Bun.CryptoHasher.hash("sha256", canonical(v), "hex");
+  const before = baseline?.pages[0].response;
+  const after = current.pages[0].response;
+  const sameScope = Boolean(
+    baseline &&
+    baseline.target === current.target &&
+    canonical(before?.context.config) === canonical(after.context.config),
+  );
+  return capture(
+    "pagesight",
+    "technical.compare",
+    current.target,
+    { baselineSha256: baseline ? hash(baseline) : null, currentSha256: hash(current) },
+    async () => {
+      const alerts: Array<{ kind: string; source: string; message: string; before?: unknown; after?: unknown }> = [];
+      for (const url of configSchema.parse(after.context.config).pages) {
+        if (!after.observations.some((o) => o.provider === "web" && o.operation === "page" && o.target === url))
+          alerts.push({
+            kind: "unknown",
+            source: `page:${url}`,
+            message: "Configured page observation is missing; no regression inferred",
+          });
+      }
+      for (const observation of after.observations) {
+        if (observation.status === "error" || observation.error) {
+          alerts.push({
+            kind: "availability",
+            source: observation.name,
+            message: `Observation unavailable/incomplete: ${observation.error?.code ?? observation.status}`,
+          });
+          continue;
+        }
+        if (observation.provider !== "web" || observation.operation !== "page") continue;
+        const parsed = pageSchema.safeParse(observation.pages[0]?.response);
+        const request = observation.pages[0]?.request as { url?: string } | undefined;
+        if (!parsed.success || request?.url !== parsed.data.url || observation.target !== parsed.data.url) {
+          alerts.push({
+            kind: "unknown",
+            source: observation.name,
+            message: "Page response is unavailable or not bound to the requested URL",
+          });
+          continue;
+        }
+        if (parsed.data.status >= 400)
+          alerts.push({
+            kind: "http-error",
+            source: observation.name,
+            message: `HTTP ${parsed.data.status} observed`,
+            after: parsed.data.status,
+          });
+        if (!sameScope) continue;
+        const previous = before?.observations.find(
+          (o) => o.provider === "web" && o.operation === "page" && o.target === observation.target,
+        );
+        const prior = pageSchema.safeParse(previous?.pages[0]?.response);
+        const priorRequest = previous?.pages[0]?.request as { url?: string } | undefined;
+        if (
+          !prior.success ||
+          priorRequest?.url !== parsed.data.url ||
+          prior.data.url !== parsed.data.url ||
+          previous?.status === "error" ||
+          previous?.error
+        ) {
+          alerts.push({
+            kind: "unknown",
+            source: observation.name,
+            message: "No usable matching prior page; no regression inferred",
+          });
+          continue;
+        }
+        for (const field of [
+          "status",
+          "finalUrl",
+          "canonical",
+          "robots",
+          "xRobotsTag",
+          "redirects",
+          "title",
+          "description",
+          "sha256",
+        ] as const) {
+          if (canonical(prior.data[field]) !== canonical(parsed.data[field]))
+            alerts.push({
+              kind: ["title", "description", "sha256"].includes(field) ? "content-change" : "technical-change",
+              source: observation.name,
+              message: `Observed ${field} changed; verify against intended route policy`,
+              before: prior.data[field],
+              after: parsed.data[field],
+            });
+        }
+      }
+      return {
+        comparisonVersion: 1,
+        baselineState: !baseline ? "first-run" : sameScope ? "compatible" : "scope-reset",
+        alerts,
+        limitations: [
+          "Exact common requested URLs and equal configuration only. Added or removed URLs reset the baseline.",
+          "Changes are observations, not automatically defects; noindex and canonical policy may be intentional.",
+          "Daily reporting windows overlap. No traffic deltas, disappearance claims, ranking impact or cross-provider comparisons are calculated.",
+          "HTML only; rendered content and Google's stored indexing state require separate checks.",
+        ],
+      };
+    },
+  );
+}

package/src/api/verify-render.ts

@@ -0,0 +1,134 @@
+import { startRenderNetwork } from "../web/render-network.js";
+import { capture } from "./evidence.js";
+import { fetchText } from "../web/fetch.js";
+import { launchRenderer, parseServer, captureRendered, type RenderOptions } from "../web/render-browser.js";
+import type { SeoDom } from "../web/render-dom.js";
+import { RequestError } from "../shared/http.js";
+
+function compare(a: SeoDom | undefined, b: SeoDom | undefined) {
+  if (!a || !b || a.url !== b.url || a.truncated || b.truncated)
+    return { status: "unavailable", reason: "Both complete captures must identify the same exact final URL." };
+  const fields = ["baseHref", "titles", "descriptions", "canonicals", "robots", "h1", "jsonLd", "links"] as const;
+  const differences = fields
+    .filter((field) => JSON.stringify(a[field]) !== JSON.stringify(b[field]))
+    .map((field) => ({ field, before: a[field], after: b[field] }));
+  return {
+    status: differences.length ? "different" : "equal",
+    scope: "Extracted DOM fields only; HTTP response evidence is compared separately.",
+    differences,
+  };
+}
+export async function verifyRender(options: RenderOptions) {
+  return capture("pagesight", "page.verify", options.url, options, async () => {
+    const network = await startRenderNetwork(options.url);
+    try {
+      const browser = await launchRenderer(network.proxy);
+      try {
+        const server = await capture("web", "server_html", options.url, { url: options.url }, async () => {
+          const { body, finalUrl, response, redirects } = await fetchText(
+            options.url,
+            2_000_000,
+            new URL(options.url).origin,
+            network.proxy,
+          );
+          if (!response.headers.get("content-type")?.includes("text/html"))
+            throw new RequestError("Server response is not HTML.", response.status, "not_html");
+          return {
+            finalUrl,
+            status: response.status,
+            redirects,
+            xRobotsTag: response.headers.get("x-robots-tag"),
+            contentType: response.headers.get("content-type"),
+            sha256: Bun.CryptoHasher.hash("sha256", body, "hex"),
+            bytes: Buffer.byteLength(body),
+            dom: await parseServer(browser, body, finalUrl),
+          };
+        });
+        const direct = await capture("chromium", "direct", options.url, options, () =>
+          captureRendered(browser, options, false),
+        );
+        const navigation = options.navigation
+          ? await capture("chromium", "internal_navigation", options.url, options, () =>
+              captureRendered(browser, options, true),
+            )
+          : null;
+        const getDom = (e: typeof server | null) => (e?.pages[0]?.response as { dom?: SeoDom } | undefined)?.dom;
+        return {
+          verificationVersion: 1,
+          browser: { engine: "chromium", version: browser.version(), viewport: options.viewport },
+          capturePolicy: {
+            waitUntil: "domcontentloaded",
+            settleMs: options.settleMs,
+            timeoutMsPerBrowserPath: options.timeoutMs,
+            anonymousFreshContextPerPath: true,
+            maxRequestsPerPath: 500,
+            allowedMethods: ["GET", "HEAD"],
+            serviceWorkers: "blocked",
+            webSockets: "blocked",
+            topLevelOrigin: new URL(options.url).origin,
+          },
+          network: {
+            blockedRequests: network.blockedRequests,
+            policy:
+              "Public addresses only; an explicitly requested literal private IP permits that exact host and port.",
+          },
+          observations: { server, direct, navigation },
+          documentComparison: (() => {
+            const a = server.pages[0]?.response as { status: number; xRobotsTag: string | null } | undefined;
+            const b = (
+              direct.pages[0]?.response as
+                | { targetDocumentResponse?: { status: number; xRobotsTag: string | null } }
+                | undefined
+            )?.targetDocumentResponse;
+            if (!a || !b)
+              return {
+                status: "unavailable",
+                reason: "Both server and target browser document responses are required.",
+              };
+            const fields = ["status", "xRobotsTag"] as const;
+            return {
+              status: fields.every((f) => a[f] === b[f]) ? "equal" : "different",
+              fields: fields.map((field) => ({ field, server: a[field], browser: b[field] })),
+            };
+          })(),
+          comparisons: {
+            serverToDirect: compare(getDom(server), getDom(direct)),
+            directToNavigation: navigation ? compare(getDom(direct), getDom(navigation)) : { status: "not_requested" },
+          },
+          limitations: [
+            "Bounded anonymous Chromium observation, not Google rendering or indexing evidence.",
+            "A fixed settle interval does not prove hydration or network completion. Captures occur at different times and can see different deployments or personalized content.",
+            "Differences are observations, not automatic SEO defects. Equal extracted fields do not prove visible layout, complete content or functional correctness.",
+            "Only GET/HEAD requests run; service workers and cross-origin top-level navigation are blocked. This may alter application behavior; ordinary page requests can still reach analytics.",
+            "Server HTML is fetched independently with Pagesight's user agent, then parsed inertly in Chromium. A client route may have no target document response; source-document HTTP status is not target status.",
+            "No authenticated profile, storage state, browser actions other than one validated anchor click, or arbitrary evaluation scripts are accepted.",
+          ],
+        };
+      } finally {
+        await browser.close();
+      }
+    } finally {
+      await network.close();
+    }
+  }).then((result) => {
+    const data = result.pages[0]?.response as
+      | {
+          observations: Record<
+            string,
+            { status: string; pages: Array<{ response: { dom?: SeoDom; documentsTruncated?: boolean } }> } | null
+          >;
+          comparisons: Record<string, { status: string }>;
+        }
+      | undefined;
+    if (
+      data &&
+      (Object.values(data.observations).some(
+        (e) =>
+          e && (e.status !== "ok" || e.pages[0]?.response.dom?.truncated || e.pages[0]?.response.documentsTruncated),
+      ) ||
+        Object.values(data.comparisons).some((c) => c.status === "unavailable"))
+    )
+      result.status = "partial";
+    return result;
+  });
+}

package/src/cli.ts

@@ -1,3 +1,6 @@
+import { loadFollowupManifest } from "./followup-manifest.js";
+import { renderFollowup } from "./followup-text.js";
+import { renderInvestigation } from "./investigation-text.js";
 import { renderAssessment } from "./assessment-text.js";
 import { renderOpportunities } from "./opportunities-text.js";
 import { parseArgs } from "node:util";
@@ -10,6 +13,11 @@ export const help = `Pagesight — read-only site evidence
 pagesight                      Show CLI help
 pagesight mcp                  Start MCP explicitly
 pagesight discover --url https://example.com/ [--providers gsc,ga]
+pagesight cloudflare audit --zone ZONE_ID --hostname example.com --start UTC_TIME --end UTC_TIME [--limit 50]
+
+pagesight change followup --manifest experiments.json [--as-of UTC_TIME] [--lag-days 3] [--format text]
+pagesight change evaluate --record change.json --baseline before.json [--current after.json] [--max-rows 20]
+pagesight technical compare --current current.json [--baseline previous.json]
 pagesight doctor --config seo.config.json
 pagesight gsc sites
 pagesight gsc sitemaps --site sc-domain:example.com
@@ -29,11 +37,14 @@ pagesight ga accounts
 pagesight ga property --property 123456
 pagesight ga key-events --property 123456
 pagesight ga report --property 123456 --request report.json [--max-pages 4]
+pagesight render --url URL [--from-url URL --link-selector CSS] [--settle-ms 1000] [--timeout-ms 20000]
 pagesight page --url https://example.com/
 pagesight speed psi --url https://example.com/ [--strategy mobile]
 pagesight speed crux --url https://example.com/ [--origin] [--form-factor PHONE]
 pagesight speed history --url https://example.com/ [--origin]
 pagesight snapshot --config seo.config.json [--start YYYY-MM-DD --end YYYY-MM-DD]
+pagesight crawl --config seo.config.json [--max-pages 20] [--max-depth 3] [--inspect-limit 3]
+pagesight investigate --config seo.config.json --url https://example.com/page [--start YYYY-MM-DD --end YYYY-MM-DD] [--format text]
 pagesight assess --snapshot saved.json [--format text] [--max-rows 10]
 pagesight opportunities --snapshot saved.json [--min-impressions 20] [--max-clicks 2] [--max-rows 10] [--format text]
 pagesight compare --baseline before.json --current after.json [--max-rows 100]
@@ -41,7 +52,7 @@ pagesight evidence import --request findings.json
 pagesight api --request operation.json
 pagesight serve [--port 6095]    Local HTTP API; requires PAGESIGHT_API_TOKEN
 
-Data commands emit JSON by default; assess --format text prints a readable summary. --json is accepted for clarity.
+Data commands emit JSON by default; assess, opportunities, investigate and change followup accept --format text for readable summaries. --json is accepted for clarity.
 --out FILE saves the same evidence locally. Exit: 0 success, 1 provider failure,
 2 invalid input, 3 partial evidence. Snapshot defaults to 28 days ending Pacific
 today minus 3 days; max-pages defaults to 4 (ad hoc reports: 1; maximum: 20).
@@ -49,6 +60,48 @@ Credentials: GSC_* env, PAGESIGHT_GA_CREDENTIALS or GOOGLE_APPLICATION_CREDENTIA
 Requests, property metadata, provider limits and errors are preserved in evidence.
 `;
 
+// Every CLI command and the flags it accepts; surface tests fail when one has no case.
+export const commands: Record<string, string[]> = {
+  render: ["url", "from-url", "link-selector", "settle-ms", "timeout-ms"],
+  "cloudflare.audit": ["zone", "hostname", "start", "end", "limit"],
+  "change.followup": ["manifest", "as-of", "lag-days", "format"],
+  "change.evaluate": ["record", "baseline", "current", "max-rows"],
+  "technical.compare": ["baseline", "current"],
+  "evidence.import": ["request"],
+  crawl: ["config", "max-pages", "max-depth", "max-links", "inspect-limit", "include-query"],
+  investigate: ["config", "url", "start", "end", "max-pages", "max-rows", "format"],
+  assess: ["snapshot", "max-rows", "format"],
+  opportunities: ["snapshot", "max-rows", "format", "min-impressions", "max-clicks"],
+  discover: ["url", "providers"],
+  compare: ["baseline", "current", "max-rows"],
+  "bing.crawl-stats": ["site"],
+  "bing.crawl-issues": ["site"],
+  "bing.url-info": ["site", "url"],
+  "bing.link-counts": ["site", "max-pages"],
+  "bing.url-links": ["site", "url", "max-pages"],
+  "bing.sites": [],
+  "bing.queries": ["site"],
+  "bing.pages": ["site"],
+  "bing.traffic": ["site"],
+  "gsc.sites": [],
+  "gsc.sitemaps": ["site"],
+  "gsc.inspect": ["site", "url"],
+  "gsc.report": ["site", "request", "max-pages"],
+  "ga.realtime": ["property", "request"],
+  "ga.accounts": [],
+  "ga.property": ["property"],
+  "ga.key-events": ["property"],
+  "ga.report": ["property", "request", "max-pages"],
+  page: ["url"],
+  "speed.psi": ["url", "strategy"],
+  "speed.crux": ["url", "origin", "form-factor"],
+  "speed.history": ["url", "origin", "form-factor"],
+  doctor: ["config"],
+  snapshot: ["config", "start", "end", "max-pages"],
+  api: ["request"],
+  serve: ["port"],
+};
+
 async function jsonFile(path: string | undefined, label: string): Promise<unknown> {
   if (!path) throw new RequestError(`Missing --${label}`, null, "invalid_input");
   try {
@@ -65,6 +118,17 @@ export async function runCli(args: string[]): Promise<number> {
       allowPositionals: true,
       strict: true,
       options: {
+        zone: { type: "string" },
+        hostname: { type: "string" },
+        "from-url": { type: "string" },
+        "link-selector": { type: "string" },
+        "settle-ms": { type: "string" },
+        "timeout-ms": { type: "string" },
+        limit: { type: "string" },
+        record: { type: "string" },
+        manifest: { type: "string" },
+        "as-of": { type: "string" },
+        "lag-days": { type: "string" },
         port: { type: "string" },
         help: { type: "boolean", short: "h" },
         json: { type: "boolean" },
@@ -88,6 +152,10 @@ export async function runCli(args: string[]): Promise<number> {
         "max-rows": { type: "string" },
         "min-impressions": { type: "string" },
         "max-clicks": { type: "string" },
+        "max-depth": { type: "string" },
+        "max-links": { type: "string" },
+        "inspect-limit": { type: "string" },
+        "include-query": { type: "boolean" },
       },
     });
     if (args.length === 0 || values.help || positionals[0] === "help") {
@@ -95,45 +163,15 @@ export async function runCli(args: string[]): Promise<number> {
       return 0;
     }
     const [family, action] = positionals;
-    if (positionals.length > (["gsc", "ga", "bing", "speed", "evidence"].includes(family) ? 2 : 1))
+    if (
+      positionals.length >
+      (["gsc", "ga", "bing", "speed", "evidence", "cloudflare", "change", "technical"].includes(family) ? 2 : 1)
+    )
       throw new RequestError("Too many command arguments", null, "invalid_input");
-    const operation = ["gsc", "ga", "bing", "speed", "evidence"].includes(family)
+    const operation = ["gsc", "ga", "bing", "speed", "evidence", "cloudflare", "change", "technical"].includes(family)
       ? `${family}.${action ?? ""}`
       : family;
-    const flags: Record<string, string[]> = {
-      "evidence.import": ["request"],
-      assess: ["snapshot", "max-rows", "format"],
-      opportunities: ["snapshot", "max-rows", "format", "min-impressions", "max-clicks"],
-      discover: ["url", "providers"],
-      compare: ["baseline", "current", "max-rows"],
-      "bing.crawl-stats": ["site"],
-      "bing.crawl-issues": ["site"],
-      "bing.url-info": ["site", "url"],
-      "bing.link-counts": ["site", "max-pages"],
-      "bing.url-links": ["site", "url", "max-pages"],
-      "bing.sites": [],
-      "bing.queries": ["site"],
-      "bing.pages": ["site"],
-      "bing.traffic": ["site"],
-      "gsc.sites": [],
-      "gsc.sitemaps": ["site"],
-      "gsc.inspect": ["site", "url"],
-      "gsc.report": ["site", "request", "max-pages"],
-      "ga.realtime": ["property", "request"],
-      "ga.accounts": [],
-      "ga.property": ["property"],
-      "ga.key-events": ["property"],
-      "ga.report": ["property", "request", "max-pages"],
-      page: ["url"],
-      "speed.psi": ["url", "strategy"],
-      "speed.crux": ["url", "origin", "form-factor"],
-      "speed.history": ["url", "origin", "form-factor"],
-      doctor: ["config"],
-      snapshot: ["config", "start", "end", "max-pages"],
-      api: ["request"],
-      serve: ["port"],
-    };
-    const allowed = [...(flags[operation] ?? []), ...(operation === "serve" ? [] : ["out", "json"])];
+    const allowed = [...(commands[operation] ?? []), ...(operation === "serve" ? [] : ["out", "json"])];
     for (const flag of Object.keys(values))
       if (!allowed.includes(flag))
         throw new RequestError(`--${flag} is not supported for ${operation}`, null, "invalid_input");
@@ -152,8 +190,60 @@ export async function runCli(args: string[]): Promise<number> {
       throw new RequestError("--json and --format text conflict", null, "invalid_input");
     let input: unknown;
     if (operation === "api") input = await jsonFile(values.request, "request");
-    else if (operation === "evidence.import")
+    else if (operation === "render") {
+      if (Boolean(values["from-url"]) !== Boolean(values["link-selector"]))
+        throw new RequestError("Supply both --from-url and --link-selector", null, "invalid_input");
+      input = {
+        operation: "page.verify",
+        url: values.url,
+        ...(values["from-url"]
+          ? { navigation: { fromUrl: values["from-url"], linkSelector: values["link-selector"] } }
+          : {}),
+        settleMs: Number(values["settle-ms"] ?? 1000),
+        timeoutMs: Number(values["timeout-ms"] ?? 20000),
+      };
+    } else if (operation === "evidence.import")
       input = { operation, document: await jsonFile(values.request, "request") };
+    else if (operation === "cloudflare.audit")
+      input = {
+        operation,
+        zone: values.zone,
+        hostname: values.hostname,
+        startTime: values.start,
+        endTime: values.end,
+        limit: Number(values.limit ?? 50),
+      };
+    else if (operation === "change.followup")
+      input = {
+        operation,
+        experiments: await loadFollowupManifest(values.manifest),
+        asOf: values["as-of"],
+        lagDays: Number(values["lag-days"] ?? 3),
+      };
+    else if (operation === "change.evaluate")
+      input = {
+        operation,
+        record: await jsonFile(values.record, "record"),
+        baseline: await jsonFile(values.baseline, "baseline"),
+        ...(values.current ? { current: await jsonFile(values.current, "current") } : {}),
+        maxRows: Number(values["max-rows"] ?? 20),
+      };
+    else if (operation === "crawl")
+      input = {
+        operation,
+        config: await jsonFile(values.config, "config"),
+        maxPages: Number(values["max-pages"] ?? 20),
+        maxDepth: Number(values["max-depth"] ?? 3),
+        maxLinks: Number(values["max-links"] ?? 500),
+        inspectLimit: Number(values["inspect-limit"] ?? 3),
+        includeQuery: values["include-query"] ?? false,
+      };
+    else if (operation === "technical.compare")
+      input = {
+        operation,
+        current: await jsonFile(values.current, "current"),
+        ...(values.baseline ? { baseline: await jsonFile(values.baseline, "baseline") } : {}),
+      };
     else if (operation === "opportunities")
       input = {
         operation,
@@ -175,14 +265,20 @@ export async function runCli(args: string[]): Promise<number> {
         current: await jsonFile(values.current, "current"),
         maxRows: Number(values["max-rows"] ?? 100),
       };
-    else if (operation === "snapshot" || operation === "doctor") {
+    else if (operation === "snapshot" || operation === "doctor" || operation === "investigate") {
       const config = await jsonFile(values.config, "config");
       if (operation === "doctor") input = { operation, config };
       else {
         if (Boolean(values.start) !== Boolean(values.end))
           throw new RequestError("Supply both --start and --end, or neither", null, "invalid_input");
         const dates = values.start ? { startDate: values.start, endDate: values.end } : defaultDates();
-        input = { operation, config, ...dates, maxPages: Number(values["max-pages"] ?? 4) };
+        input = {
+          operation,
+          config,
+          ...dates,
+          maxPages: Number(values["max-pages"] ?? (operation === "investigate" ? 1 : 4)),
+          ...(operation === "investigate" ? { url: values.url, maxRows: Number(values["max-rows"] ?? 28) } : {}),
+        };
       }
     } else {
       input = {
@@ -201,9 +297,13 @@ export async function runCli(args: string[]): Promise<number> {
     const result = await execute(input);
     const output =
       values.format === "text"
-        ? operation === "opportunities"
-          ? renderOpportunities(result)
-          : renderAssessment(result)
+        ? operation === "change.followup"
+          ? renderFollowup(result)
+          : operation === "investigate"
+            ? renderInvestigation(result)
+            : operation === "opportunities"
+              ? renderOpportunities(result)
+              : renderAssessment(result)
         : `${JSON.stringify(result, null, 2)}\n`;
     if (values.out) await Bun.write(values.out, output);
     process.stdout.write(output);