zerocheck 0.1.7 → 0.1.9

package/README.md

@@ -1,180 +1,124 @@
 # Zerocheck
 
-Zerocheck turns your team’s manual release checklist into repeatable browser tests.
+**Repeatable browser tests from your release checklist**
 
-Paste a checklist, review one drafted check and browser verification result per actionable item, then save readable YAML in your repository. Run those same files locally, in GitHub Actions, or in a hosted browser. Results, recordings, attempts and healing history are available in the web app, with a summary and an authenticated evidence link in your pull request.
+Zerocheck turns your team's manual release checklist into saved end-to-end browser tests. Start with the important user journeys, review the test definitions and browser results, and rerun the checks as your app changes.
 
-## Setup
+This is the Zerocheck CLI. Use it for repository tests on your laptop or in CI, or connect a coding agent through MCP.
 
-Requires Node.js 20.19 or newer and a Zerocheck project/account. Create a project in the web app’s Settings, then authorize a device or create a project token.
+**New to Zerocheck? [Request pilot access](https://tryzerocheck.com/demo/).** We provision a customer instance and help you configure your first handful of tests during hands-on onboarding.
 
-```sh
-npm install --save-dev --save-exact zerocheck@0.1.7
-export ZEROCHECK_API=https://your-instance.example.com
-npx zerocheck login
-npx zerocheck init --project your-project-id --url http://localhost:3000
-npx zerocheck install
-```
+**Already onboarded?** [Run your saved tests](#run-your-saved-tests), or open the instance URL supplied during onboarding to use the web app.
 
-`install` downloads Chromium for local execution. Linux CI can use `zerocheck install --with-deps`. Hosted execution does not require a browser on your machine, but still uses the CLI and your Zerocheck account.
+## Before you start
 
-Set `ZEROCHECK_API` to your customer instance before login; there is no default public service. Device login stores that instance with its token in `~/.zerocheck/config.json` (mode 0600). A different destination is rejected before any token is sent. Legacy unbound device tokens require logout and a new login. For unattended use, explicitly set both `ZEROCHECK_TOKEN` and `ZEROCHECK_API`; CI never borrows a saved device destination. Instance URLs must be HTTPS origins (HTTP localhost is permitted for development); API redirects are rejected. Never commit tokens or resolved test credentials.
+Test execution requires a Zerocheck account, a provisioned customer instance and a project in that instance. **There is no default public service.**
 
-## Import your release checklist
-
-```sh
-npx zerocheck import release-checklist.md --env dev
-cat release-checklist.md | npx zerocheck import - --env staging
-npx zerocheck import --env dev
-```
+For the CLI, have these ready:
 
-The last command accepts an interactive paste; finish with Ctrl+D on a new line. Import supports text and Markdown. Each item retains its source line and one of these states:
+- **Node.js 20.19 or newer.**
+- **Your instance URL** and account access, supplied during onboarding.
+- **Your project files:** `zerocheck.yaml` with the correct project, environment and app URL, plus at least one saved YAML test in its configured test directory. We set up these files with you during onboarding.
+- **A running app** reachable from your machine, with the test accounts, fixtures and credential variables your checks need.
 
-- **Verified passing:** the exact draft completed in a browser and its expected outcome passed.
-- **Check failed:** the requested outcome failed. Review the check and captured result; this alone does not diagnose a product bug.
-- **Needs input:** an essential outcome, account, route or fixture is missing, or the item still needs a browser-executable interpretation.
-- **Could not run:** execution could not complete; inspect the recorded reason.
+Local execution uses Zerocheck's AI service and uploads selected test definitions, page context and run evidence. It requires network access and authentication even though the browser runs on your machine.
 
-Headings, notes, duplicates and unsupported items remain visible. Import does not silently discard difficult items or weaken a failed expectation.
+## Run your saved tests
 
-The command prints the exact YAML for review. Save it with the single adoption command displayed at the end, or use `--save` when you want the import to save its displayed drafts immediately:
+Run from the app repository containing the project files above. Replace the instance URL with the one you received during onboarding.
 
-```sh
-npx zerocheck import --draft IMPORT_ID
-npx zerocheck import release-checklist.md --env dev --save
+```bash
+npm install --save-dev --save-exact zerocheck@0.1.9
+export ZEROCHECK_API="https://your-instance.example.com"
+npx zerocheck login
+npx zerocheck install
+npx zerocheck validate
+npx zerocheck run --json .zerocheck/latest-run.json
 ```
 
-The same `--draft` command adopts a reviewed import from the web app. Drafted checks are saved in a unique import folder beneath the configured test directory. Their YAML bytes and revision are preserved. Existing conflicting files are never overwritten. Partial imports may be saved, but unresolved/failed items remain in the import report and the command exits nonzero.
+`login` prints a URL and code for you to approve in your browser. `install` downloads Chromium for local runs. `validate` checks the saved YAML without running a browser.
 
-Answer missing inputs together in a JSON file keyed by the displayed item IDs:
+`run` executes the saved tests in the configured test directory, using `default_environment` from `zerocheck.yaml`. Confirm that environment points to the app you intend to test. When a results link is printed, open it to inspect outcomes, failed steps and screenshots after signing in. The JSON file also retains the run details. If publication fails, follow the upload-retry command printed by the CLI.
 
-```json
-{"item-3":"Use the existing demo product with SKU DEMO-1; expect a total of $12.00."}
-```
+To run just one test, use its actual repository path:
 
-```sh
-npx zerocheck import --draft IMPORT_ID --answers answers.json
+```bash
+npx zerocheck run zerocheck/tests/your-test.yaml
 ```
 
-Only the answered unresolved items are drafted/verified again. To retry a failed item that has no drafted definition, use an empty answer, for example `{"item-3":""}`. Already completed definitions and unselected items are preserved. An existing executable draft is verified unchanged rather than regenerated; missing credentials and configuration or ambiguous-step errors show their respective remedies. Edit a drafted test’s expected behavior as a reviewed YAML change; changed YAML needs a new verification.
+### Starting from the web app
 
-## One repository format, named environments
+Open your provisioned instance, choose a saved test and run it against the intended environment. You can use the web app without installing this package.
 
-`zerocheck.yaml` configures the project. It is separate from the readable check files:
+To bring an individual web test into your repository, use **Download YAML** and put that file in the configured test directory. This creates an independent copy. Web tests are edited in the web app; repository tests are edited in their files. The CLI does not automatically download your saved web tests.
 
-```yaml
-project: your-project-id
-default_environment: dev
-test_directory: zerocheck/tests
-environments:
-  dev:
-    url: http://localhost:3000
-  staging:
-    url: https://staging.example.com
-    secrets:
-      EMAIL: ${ZEROCHECK_EMAIL}
-      PASSWORD: ${ZEROCHECK_PASSWORD}
-    login_steps:
-      - Navigate to /login
-      - Enter "${EMAIL}" into the Email field
-      - Enter "${PASSWORD}" into the Password field
-      - Click the Sign in button
-      - Verify the dashboard is visible
-  production:
-    url: https://example.com
-execution:
-```
-
-Only explicitly referenced secret variables are read for execution. Missing variables fail clearly. Listing, reading, saving and validating checks do not require execution secrets.
+For a reviewed checklist import, the CLI can save its drafted tests with `import --draft IMPORT_ID`, as shown below. An import ID is different from an individual saved-test ID or run ID.
 
-Ordinary HTTP(S) redirects and embedded checkout flows need no domain list. A nonempty environment `allowed_origins` list is an optional exact-origin restriction: only your app origin and its listed origins can be interacted with. Omit it or leave it empty for unrestricted browsing; list only your app origin for app-only browsing. Credentials remain restricted separately: `secret_origins` grants each configured credential exact additional destinations during login steps only. If a browser restriction is set, it must also include those login destinations. Hosted private-network protections remain in effect.
+<details>
+<summary><strong>Need to create the project files first?</strong></summary>
 
-Each check is one `zerocheck/v1` YAML file:
+After installing and logging in, replace the project ID and app URL, then initialize a new configuration:
 
-```yaml
-version: zerocheck/v1
-name: Release notes are available
-blocks_merge: true
-steps:
-  - Navigate to /releases
-  - Verify the Release notes heading is visible
+```bash
+npx zerocheck init --project "YOUR_PROJECT_ID" --env dev --url "http://localhost:3000"
 ```
 
-Repository files are authoritative for CLI-managed tests; tests created and saved in the web app are edited there. Sync cannot overwrite a web-managed definition with different contents. A CLI run uses the selected files’ current contents, and each saved result retains its exact revisions. Empty, missing, duplicate or invalid selections fail before execution; diagnostics list all selected path and YAML errors together. Correct the entire selection before running. Explicit authoring/save supplies an omitted `version`; reading or running an existing file never rewrites it. `run` never invents starter checks.
+`init` creates `zerocheck.yaml` and an empty test directory. If the configuration already exists, edit that file to change its project or environments.
 
-Checks may end with `Verify` or a condition-based `Wait for`; timed waits cannot supply the outcome. `zerocheck validate` prints parsed steps and effective negative defaults without starting a browser. Quote an entire YAML step containing a literal `#`; plain step comments are rejected in test files and `zerocheck.yaml` login steps.
+Add your onboarding-provided test YAML, download an agreed web test, or draft tests from a real release checklist:
 
-Negative quoted-text Verify defaults to bounded phrase matching and a 3-second observation window. `Paid` does not match `Unpaid`; explicit `exact text`, credential comparisons and `for N seconds` retain their precise meaning. New authoring writes defaults explicitly; existing saved bytes/history remain unchanged. Results and PR comments report actual observation mode/window. Unsupported semantic negatives need a quoted-text correction, and visible unreadable frames cannot prove absence. Positive text/URL/request Wait conditions use deterministic checks; semantic Wait still uses AI and supplies no independent target evidence.
+```bash
+npx zerocheck install
+npx zerocheck import release-checklist.md --env dev
+```
 
-## Run and inspect
+Import drafts and runs checks immediately. Review the displayed YAML and browser results before saving. Resolve missing inputs and inspect failed or incomplete checks. Replace `IMPORT_ID` with the import identifier printed by the command:
 
-```sh
+```bash
+npx zerocheck import --draft IMPORT_ID
 npx zerocheck validate
 npx zerocheck run --env dev
-npx zerocheck run zerocheck/tests/release.yaml --env staging --runner hosted
-npx zerocheck run --env production --runner local --fail-on-flaky
-npx zerocheck run --env staging --json .zerocheck/latest-run.json --junit .zerocheck/junit.xml
-npx zerocheck results RUN_ID
-npx zerocheck doctor --env staging
 ```
 
-`local` is the default runner and can reach localhost and private networks available to your machine/CI job. `hosted` uses Zerocheck’s existing hosted browser and can reach targets available to that worker; it cannot reach your laptop’s localhost, and Zerocheck does not create a network tunnel. Runner location, environment and trigger are independent. Local CLI/MCP requires a trusted single-user OS, Actions an isolated job, and hosted pilots a dedicated OS/container boundary without untrusted co-tenants; the browser control endpoint is local but not authenticated. Hosted interruptions produce an explicit error and require a new user-triggered run.
+Saving a draft does not change a failed result into a pass. Keep the expected outcome when investigating a failure.
 
-Each selected check executes once in its own browser and retains its step trace. After a stuck browser is confirmed dead, the next independent check can start; whole-job cancellation or unconfirmed termination stops the selection. Historical records retain every older attempt. A transient grounding failure recovered within a check is reported as **passed after recovery** and marked flaky, even when CI succeeds. Step recovery details remain visible. `--fail-on-flaky` makes blocking flaky checks fail CI. `blocks_merge: false` explicitly makes a check non-blocking; setup errors and incomplete execution still fail the command.
+</details>
 
-Exit codes: **0** completed within the selected merge policy; **1** blocking test failure (or strict flaky result); **2** setup, incomplete execution, infrastructure or result-publication error. A failed upload, including HTTP 401/409, preserves the local browser verdict and evidence, records the publication error separately, and adds a JUnit publication error. It never repeats the browser actions. Import exits nonzero while any actionable item remains unverified.
+## What a test looks like
 
-Learned targets persist in `.zerocheck/cache`. Local CLI and MCP share this cache; hosted execution uses its own persistent cache. A healed target is separate from a retry, and the result records target changes and their validation. Forms and login do not block target repairs. The engine saves only independently validated targets after a complete unchanged check; model-only evidence leaves the particular repair pending. A different independently proven input can still become reusable when the test also contains a semantic assertion. It never reruns a submission solely to validate healing. Recovery before dispatch stays in the current browser. The runner never restarts a whole check automatically. Provider transport failures can retry once within the remaining deadline; auth/configuration errors and failed expectations do not. Legacy `retries: 0` disables transient grounding retries; pre-dispatch target recovery remains available. Include `.zerocheck/` in `.gitignore`; `init` adds it.
-
-## GitHub Actions and PR comments
-
-```sh
-npx zerocheck init --github-actions
-```
+Each repository test is a readable YAML file. Adapt this example to a route and outcome that exist in your app:
 
-The generated `.github/workflows/zerocheck.yml` pins the CLI version, restores the local target cache, runs staging checks, and runs the reporter and artifact upload even if checks fail. Set the repository secret `ZEROCHECK_TOKEN` and repository variable `ZEROCHECK_API` to the same customer instance, configure staging in `zerocheck.yaml`, and add only the test-secret variables referenced there. For localhost testing, add your app startup and fixture setup before the run step.
-
-The workflow uses `pull_request`, not `pull_request_target`. It grants `contents: read` and `pull-requests: write`; it does not execute fork code with elevated secrets. Fork or read-only-token jobs keep their job summary and explain why a PR comment could not be posted.
-
-The comment contains pass/fail/flaky results, failing steps, environment, commit and a link to authenticated full results and private evidence. One Zerocheck bot comment is updated per PR. Results from older commits cannot replace the current comment. Neither report adapter publishes screenshots or recordings. Public artifact links, including old links, are disabled; private evidence is retained. Offline summaries still work when instance setup failed.
-
-```sh
-npx zerocheck report --file .zerocheck/latest-run.json
+```yaml
+version: zerocheck/v1
+name: Release notes are available
+blocks_merge: true
+steps:
+  - Navigate to /releases
+  - Verify the Release notes heading is visible
 ```
 
-`GITHUB_TOKEN`, `GITHUB_EVENT_PATH` and `GITHUB_STEP_SUMMARY` come from Actions. Outside Actions, supply `--repo owner/repository --pr NUMBER` and `GITHUB_TOKEN`. Without PR context the same formatter produces a job summary.
+## Coding agents and other runners
 
-The template also supports a manual choice of runner and environment. Uncomment its schedule to run the same checks against staging on weekdays, or edit that explicit environment for a production schedule. Schedules do not enable a separate monitoring product.
+After completing project setup, a compatible coding agent can use the same CLI through its local stdio MCP server:
 
-## MCP for coding agents
-
-Use the installed CLI as a stdio MCP server, with an explicit project directory:
-
-```json
-{
-  "mcpServers": {
-    "zerocheck": {
-      "command": "npx",
-      "args": ["--yes", "zerocheck@0.1.7", "mcp", "--project-dir", "/absolute/path/to/project"]
-    }
-  }
-}
+```bash
+npx zerocheck mcp --project-dir "/absolute/path/to/your/app"
 ```
 
-Authenticate with `zerocheck login` first or provide both `ZEROCHECK_TOKEN` and `ZEROCHECK_API` through the MCP host’s environment/secret settings. stdout contains only MCP protocol messages; diagnostics use stderr.
-
-Tools: `list_checks`, `read_check`, `save_check`, `import_checklist`, `answer_import`, `adopt_import`, `verify_check`, `run_checks`, `get_results`, and `cancel`. Existing check replacements require their current `expectedRevision`. File operations stay within the configured project, including symbolic-link checks.
-
-Browser operations return job handles. Poll `get_results` with `kind: "job"` and `waitMs` up to 30000; inspect the returned run/draft ID for durable retrieval. `kind: "run"` reads a saved run after process restart; `kind: "import"` reads an uploaded import. Cancel with the job ID. Each MCP process permits one active browser job. Closing it cancels that job; cancellation cannot undo actions already performed.
-
-## Data sent to Zerocheck
+Configure the process in your MCP client using the [MCP guide](https://tryzerocheck.com/docs/mcp/). Device sign-in needs your approval. The MCP tools can inspect, draft, save and run tests, then read their results.
 
-Local execution sends selected check YAML, the page context needed for AI (including screenshots/accessibility content), and run results/artifacts to Zerocheck. The browser still runs on your machine. Hosted execution additionally sends the URL, login steps and explicitly configured test secrets needed to run the check. The CLI never uploads your entire process environment. Browser screenshots may contain visible application data. `report` links to authenticated evidence without creating public artifact URLs. Hosted server-owned credential references must use `ZEROCHECK_TEST_*`; locally resolved references may use other explicitly chosen test-variable names.
+For hosted execution, add `--runner hosted` to `run`; Chromium installation on your machine is unnecessary for that runner. The hosted browser must be able to reach the configured app URL. It cannot automatically reach your laptop's localhost. Hosted CLI runs still use repository configuration and test files.
 
-## Repository development
+## When a run needs attention
 
-The CLI bundles the shared engine source into `dist/index.js`; it has no unpublished engine-package dependency. From this repository, run `npm run build`, `npm run check`, and `npm test` in `packages/cli`. Tests include a real MCP client communicating with the bundled CLI over stdio. The generated workflow and documentation use version `0.1.7`; update that pin together with the package version for a release.
+| Situation | Next step |
+| --- | --- |
+| No instance configured | Set `ZEROCHECK_API` to your customer instance before login. |
+| No configuration or tests found | Add the project configuration and saved YAML tests. `init` creates an empty test directory. |
+| Missing test credentials | Supply the variables referenced by your configured environment. |
+| A test fails or cannot complete | Open the result and inspect the failed step and evidence. |
+| Result publication fails | Follow the upload-retry command printed by the CLI. |
 
-Hosted runs and imports return a queued handle when browsers are occupied; CLI and MCP keep polling until they finish. The queue holds 20 waiting jobs for up to five minutes and never automatically resumes interrupted jobs after restart. Recent drafts is available in the web app’s Checks page.
+Exit codes: **0** means the run completed within the configured merge policy; **1** means a blocking failure; **2** means a setup, incomplete-execution, infrastructure or result-publication error.
 
-If a local run finishes but its private upload fails, keep its ID and retry only publication with `zerocheck results <id> --upload`. For a saved local import use `zerocheck import --upload <id>`. These commands preserve the browser verdict and evidence and do not execute tests. They require the original configured instance and project. Reconcile an unresolved hosted run with `zerocheck results <id>` before starting another; for an import use `zerocheck import --status <id>`. These reads do not adopt tests. A lost response is not permission to replay a checkout.
+[Request pilot access](https://tryzerocheck.com/demo/) · [Developer resources](https://tryzerocheck.com/developers/) · [CLI guide](https://tryzerocheck.com/cli/) · [Web app guide](https://tryzerocheck.com/docs/web-app/) · [Results](https://tryzerocheck.com/docs/results/)

package/dist/index.js

@@ -7006,7 +7006,7 @@ async function loginCommand() {
   let device;
   try {
     device = await apiRequest("/v1/cli/auth/device", {
-      body: { device_name: deviceName, client_version: "0.1.7" },
+      body: { device_name: deviceName, client_version: "0.1.9" },
       authed: false
     });
   } catch (err) {
@@ -7761,6 +7761,32 @@ import { selectors } from "playwright";
 
 // ../../src/agent/dom-operations.ts
 var facts = {
+  /** Bounded observation preparation, not an authored action. Never scroll a
+   * hidden/clip axis: scrollIntoView would expose intentionally hidden content. */
+  revealForObservation: (target) => {
+    if (!target.isConnected) throw new Error("Text target detached during observation.");
+    const win = target.ownerDocument.defaultView;
+    const ancestors = [];
+    for (let node = target; node; node = node.parentElement ?? node.getRootNode()?.host) {
+      const style = win.getComputedStyle(node);
+      if (style.display === "none" || style.visibility !== "visible" || Number(style.opacity) === 0 || style.contentVisibility === "hidden") return false;
+      ancestors.push(node);
+    }
+    let moved = false;
+    for (const node of ancestors.slice(1)) {
+      if (["HTML", "BODY"].includes(node.tagName)) continue;
+      const style = win.getComputedStyle(node), box = node.getBoundingClientRect(), rect = target.getBoundingClientRect();
+      const left = box.left + node.clientLeft, top = box.top + node.clientTop;
+      const x = rect.left < left ? rect.left - left : Math.max(0, rect.right - left - node.clientWidth);
+      const y = rect.top < top ? rect.top - top : Math.max(0, rect.bottom - top - node.clientHeight);
+      const beforeX = node.scrollLeft, beforeY = node.scrollTop;
+      const scrollX = /^(auto|scroll)$/.test(style.overflowX) && node.scrollWidth > node.clientWidth;
+      const scrollY = /^(auto|scroll)$/.test(style.overflowY) && node.scrollHeight > node.clientHeight;
+      if (scrollX && x || scrollY && y) node.scrollTo({ left: beforeX + (scrollX ? x : 0), top: beforeY + (scrollY ? y : 0), behavior: "instant" });
+      moved ||= node.scrollLeft !== beforeX || node.scrollTop !== beforeY;
+    }
+    return moved;
+  },
   /** Native geometry shared by text and embedded-frame observations. Partial
    * clipping cannot establish a complete text node or a frame's contents. */
   perceptibleBounds: (node, suppliedRect) => {
@@ -7820,7 +7846,20 @@ var facts = {
           const range = doc.createRange();
           range.selectNodeContents(node);
           const rects = Array.from(range.getClientRects());
-          const states = rects.map((rect) => nativeFacts.perceptibleBounds(node.parentElement, rect));
+          const parent = node.parentElement, style = win.getComputedStyle(parent);
+          const lineHeight = parseFloat(style.lineHeight), fontSize = parseFloat(style.fontSize);
+          let plain = rects.length === 1 && parent.childElementCount === 0 && style.writingMode === "horizontal-tb" && style.clip === "auto" && style.clipPath === "none" && lineHeight >= fontSize;
+          for (let owner = parent; plain && owner; owner = owner.parentElement ?? owner.getRootNode()?.host) {
+            const outer = win.getComputedStyle(owner);
+            if (outer.transform !== "none" || outer.zoom !== "1") plain = false;
+          }
+          const box = parent.getBoundingClientRect();
+          const contentTop = box.top + parent.clientTop + parseFloat(style.paddingTop);
+          const contentHeight = parent.clientHeight - parseFloat(style.paddingTop) - parseFloat(style.paddingBottom);
+          const states = rects.map((rect) => nativeFacts.perceptibleBounds(
+            parent,
+            plain && contentHeight >= lineHeight && rect.height >= lineHeight ? { left: rect.left, right: rect.right, top: Math.max(rect.top, contentTop), bottom: Math.min(rect.bottom, contentTop + contentHeight) } : rect
+          ));
           if (states.includes("partial") || states.includes("visible") && states.includes("hidden")) throw new Error("Partly clipped text is inconclusive.");
           if (states.length && states.every((state) => state === "visible")) parts.push(node.textContent);
           return;
@@ -8070,6 +8109,7 @@ var facts = {
     }
     return "";
   },
+  focusWrapper: (element) => element.hasAttribute("tabindex") && !element.isContentEditable && !element.matches('button,a[href],input,select,textarea,summary,[role="button"],[role="link"],[role="checkbox"],[role="radio"],[role="switch"],[role="tab"],[role="menuitem"],[role="menuitemcheckbox"],[role="menuitemradio"],[role="option"],[role="combobox"],[role="textbox"],[role="searchbox"],[role="spinbutton"]') && !element.hasAttribute("onclick"),
   decorations: (element) => {
     const el = element;
     const values = [];
@@ -8135,6 +8175,13 @@ var facts = {
       mutationPossible: false
     };
   },
+  ordinalCollectionLabel: (element) => {
+    const item = element.closest('li,[role="listitem"],tr,[role="row"],[role="option"],[role="treeitem"]');
+    const collection = item?.parentElement?.closest('ol,ul,table,[role="list"],[role="grid"],[role="table"],[role="listbox"],[role="tree"]');
+    if (!collection) return "";
+    const ids = String(collection.getAttribute("aria-labelledby") || "").trim().split(/\s+/).filter(Boolean);
+    return (ids.length ? ids.map((id) => collection.ownerDocument.getElementById(id)?.textContent || "").join(" ") : collection.getAttribute("aria-label") || "").replace(/\s+/g, " ").trim();
+  },
   progressState: (element) => {
     const el = element;
     return {
@@ -8148,30 +8195,70 @@ var facts = {
   progressBoundary: (element) => element.matches('form,article,aside,nav,header,footer,tr,li,[role="form"],[role="dialog"],[role="region"],[role="row"],[role="listitem"],[role="complementary"],[role="navigation"],[role="banner"],[role="contentinfo"],[data-record-id],[data-row-id],[data-entity-id],[data-item-id],[aria-label],[aria-labelledby]'),
   progressView: (scope, _input, nativeFacts) => {
     if (!scope.isConnected) throw new Error("The active view detached during progress observation.");
-    const controls = [];
-    for (const node of scope.querySelectorAll('input:not([type="hidden"],[type="submit"],[type="button"],[type="reset"]),select,textarea,[role="textbox"],[role="combobox"],[role="checkbox"],[role="radio"],[role="switch"]')) {
-      let foreignOwner = false;
+    const unknown2 = { fields: [], fieldless: false, ready: false };
+    const owner = nativeFacts.readiness(scope, { ownSelectAX: false });
+    if (!owner.active || owner.moving) return unknown2;
+    const ownership = { owns(node) {
       for (let parent = node.parentElement; parent && parent !== scope; parent = parent.parentElement) {
-        if (nativeFacts.progressBoundary(parent)) {
-          foreignOwner = true;
-          break;
-        }
+        if (nativeFacts.progressBoundary(parent)) return false;
       }
-      if (foreignOwner) continue;
+      return scope.contains(node);
+    } };
+    const fields = [];
+    let fieldCount = 0;
+    for (const node of scope.querySelectorAll('input:not([type="hidden"],[type="submit"],[type="button"],[type="reset"]),select,textarea,[contenteditable=""],[contenteditable="true" i],[contenteditable="plaintext-only" i],[role="textbox"],[role="searchbox"],[role="spinbutton"],[role="combobox"],[role="checkbox"],[role="radio"],[role="switch"]')) {
+      if (!ownership.owns(node)) continue;
       const readiness = nativeFacts.readiness(node, { ownSelectAX: false });
-      if (readiness.moving) return [];
+      if (readiness.moving) return unknown2;
       if (!readiness.active) continue;
       const visibility = nativeFacts.perceptibleBounds(node);
-      if (visibility === "partial") return [];
+      if (visibility === "partial") return unknown2;
       if (visibility !== "visible") continue;
+      fieldCount++;
       const identity = nativeFacts.identity(node);
-      if (!identity || !identity.name) continue;
-      controls.push(JSON.stringify([identity.role, identity.name.replace(/\s+/g, " ").trim(), identity.inputType]));
+      if (identity?.name) fields.push(JSON.stringify([identity.role, identity.name.replace(/\s+/g, " ").trim(), identity.inputType]));
+    }
+    const headings = [];
+    const status = '[role="alert"],[role="status"],[role="log"],[role="timer"],[role="marquee"],[aria-live]:not([aria-live="off"])';
+    for (const node of scope.querySelectorAll('h1,h2,h3,h4,h5,h6,[role="heading"]')) {
+      if (!ownership.owns(node) || node.parentElement?.closest(status)) continue;
+      const readiness = nativeFacts.readiness(node, { ownSelectAX: false });
+      if (!readiness.active && !readiness.moving) continue;
+      const visibility = nativeFacts.perceptibleBounds(node);
+      if (visibility === "hidden" && !readiness.moving) continue;
+      const eligible = !node.matches(status) && !node.querySelector(status);
+      let text = "", ready = !readiness.moving && visibility === "visible";
+      if (eligible && ready) {
+        try {
+          text = nativeFacts.perceptibleText(node, void 0, nativeFacts).replace(/\s+/g, " ").trim();
+        } catch (error2) {
+          if (error2 instanceof Error && /clipp/.test(error2.message)) ready = false;
+          else throw error2;
+        }
+      }
+      headings.push({ node, level: Number(node.getAttribute("aria-level") || node.localName.match(/^h([1-6])$/)?.[1] || 2), text, eligible, ready });
     }
-    return controls;
+    const labelled = String(scope.getAttribute("aria-labelledby") || "").split(/\s+/).filter(Boolean);
+    const explicit = headings.filter((heading) => labelled.includes(heading.node.id));
+    const principal = labelled.length ? explicit : headings.filter((heading) => heading.level === Math.min(...headings.map((candidate) => candidate.level)));
+    const chosen = principal.length === 1 && principal[0].eligible ? principal[0] : void 0;
+    return { fields, fieldless: fieldCount === 0, ready: chosen?.ready ?? true, ...chosen?.ready && chosen.text ? { heading: chosen.text, headingLevel: chosen.level } : {} };
   }
 };
 var elements = {
+  actionDescendants: (element) => Array.from(element.querySelectorAll('button,a[href],input,select,textarea,summary,[contenteditable],[role="button"],[role="link"],[role="checkbox"],[role="radio"],[role="switch"],[role="tab"],[role="menuitem"],[role="menuitemcheckbox"],[role="menuitemradio"],[role="option"],[role="combobox"],[role="textbox"],[role="searchbox"],[role="spinbutton"],[tabindex],[onclick]')),
+  ordinalItems: (element) => {
+    const itemSelector = 'li,[role="listitem"],tr,[role="row"],[role="option"],[role="treeitem"]';
+    const collectionSelector = 'ol,ul,table,[role="list"],[role="grid"],[role="table"],[role="listbox"],[role="tree"]';
+    const item = element.closest(itemSelector);
+    const collection = item?.parentElement?.closest(collectionSelector);
+    if (!collection) return [];
+    return Array.from(collection.querySelectorAll(itemSelector)).filter((node) => {
+      if (node.parentElement?.closest(collectionSelector) !== collection) return false;
+      for (let parent = node.parentElement; parent && parent !== collection; parent = parent.parentElement) if (parent.matches(itemSelector)) return false;
+      return true;
+    });
+  },
   containingLabel: (control) => control.isConnected ? control.closest("label") : null,
   selects: (root) => {
     if (root.localName === "form") return Array.from(root.elements).filter((node) => node.localName === "select");
@@ -8245,7 +8332,7 @@ var elements = {
     const root = el.getRootNode();
     return form ? Array.from((root.documentElement ?? root).querySelectorAll("button,input")).find((control) => control.form === form && ["submit", "image"].includes(control.type)) ?? null : null;
   },
-  progressScope: (element) => {
+  progressScope: (element, _input, nativeFacts) => {
     if (element.form && !element.form.contains(element)) return element.form;
     let fieldScope = null;
     for (let node = element.parentElement; node && !["BODY", "HTML"].includes(node.tagName); node = node.parentElement) {
@@ -8253,6 +8340,10 @@ var elements = {
       if (node.hasAttribute("aria-label") || node.hasAttribute("aria-labelledby")) return fieldScope ?? node;
       if (node.querySelector(':scope > h1,:scope > h2,:scope > h3,:scope > h4,:scope > [role="heading"],:scope > header > h1,:scope > header > h2,:scope > header > h3')) return fieldScope ?? node;
       if (!fieldScope && node.querySelector('input,select,textarea,[role="textbox"],[role="combobox"],[role="checkbox"],[role="radio"]')) fieldScope = node;
+      if (Array.from(node.querySelectorAll('h1,h2,h3,h4,h5,h6,[role="heading"]')).some((heading) => {
+        for (let parent = heading.parentElement; parent && parent !== node; parent = parent.parentElement) if (nativeFacts.progressBoundary(parent)) return false;
+        return true;
+      })) return fieldScope ?? node;
     }
     return fieldScope;
   },
@@ -8600,7 +8691,11 @@ var TargetProgress = class {
       if (await read(() => signature(handle)) !== prior.signature) return;
       if (prior.scope && await read(() => readDOM(prior.scope, "connected"))) {
         const current = await read(() => readDOM(prior.scope, "progressView"));
-        if (prior.view.some((control) => !current.includes(control)) && current.some((control) => !prior.view.includes(control))) return;
+        if (prior.view.ready && current.ready) {
+          const fieldsChanged = prior.view.fields.some((control) => !current.fields.includes(control)) && current.fields.some((control) => !prior.view.fields.includes(control));
+          const fieldlessTransition = (prior.view.fieldless || current.fieldless) && prior.view.heading && current.heading && prior.view.headingLevel === current.headingLevel && prior.view.heading !== current.heading;
+          if (fieldsChanged || fieldlessTransition) return;
+        }
       }
       await delay(Math.min(50, Math.max(1, deadline - Date.now())), void 0, { signal });
     }
@@ -8611,7 +8706,7 @@ var TargetProgress = class {
     try {
       const scopeValue = await selectDOM(handle, "progressScope");
       scope = scopeValue ?? void 0;
-      return { handle: duplicate, ...scope ? { scope } : {}, signature: await signature(handle), view: scope ? await readDOM(scope, "progressView") : [], lineNumber, entity };
+      return { handle: duplicate, ...scope ? { scope } : {}, signature: await signature(handle), view: scope ? await readDOM(scope, "progressView") : { fields: [], fieldless: false, ready: false }, lineNumber, entity };
     } catch (error2) {
       await duplicate.dispose();
       await scope?.dispose();
@@ -16993,6 +17088,7 @@ async function waitForVisibleText(page, assertion, timeoutMs, signal, targetPoli
           for (let current = frame; current.parentFrame(); current = current.parentFrame()) {
             const owner = await read(() => current.frameElement());
             try {
+              await read(() => readDOM(owner, "revealForObservation"));
               const state = await read(() => readDOM(owner, "perceptibleBounds"));
               if (state === "hidden") {
                 hiddenOwner = true;
@@ -17015,6 +17111,7 @@ async function waitForVisibleText(page, assertion, timeoutMs, signal, targetPoli
             const handle = await read(() => locator.nth(index).elementHandle());
             if (!handle) throw new Error("Text target detached during observation.");
             try {
+              await read(() => readDOM(handle, "revealForObservation"));
               const text = await read(() => readDOM(handle, "perceptibleText"));
               if (assertion.match === "phrase" ? phrasePattern(assertion.text).test(text) : text === assertion.text.replace(/\s+/g, " ").trim()) {
                 found = true;
@@ -17927,7 +18024,13 @@ async function bindIntendedTarget(handle, step, identity, policy) {
   if (!frame) throw new TargetChangedError("Target detached before authored binding.");
   const authored = targetInstruction(step);
   const explicitSelector = explicitRoleTarget(authored.replace(/^(["'])(.*)\1$/, "$2"));
-  const instruction = explicitSelector ? JSON.stringify(explicitSelector.name) : authored;
+  let instruction = explicitSelector ? JSON.stringify(explicitSelector.name) : authored;
+  let tiers;
+  if (hasAuthoredOrdinal(instruction) && literalTargetName(instruction) === void 0) {
+    tiers = await bindingFrames(frame, policy);
+    const whole = normalizeTargetName(instruction);
+    if (await observedLiteralName(tiers, whole, step)) instruction = JSON.stringify(whole);
+  }
   const fullName = normalizeTargetName(instruction);
   const localName = !identity.name && identity.textEntry ? await readDOM(handle, "localLabel") : "";
   const name = (identity.name || localName).trim().replace(/\s+/g, " ").toLowerCase();
@@ -17946,12 +18049,20 @@ async function bindIntendedTarget(handle, step, identity, policy) {
   const role = ["field", "input", "box"].includes(authoredRole ?? "") ? "textbox" : authoredRole === "dropdown" ? "combobox" : authoredRole ?? (step.keyword === "enter" ? "textbox" : step.keyword === "select" ? "combobox" : void 0);
   const clickFamily = !explicitSelector && step.keyword === "click" && ["button", "link"].includes(role ?? "");
   if (!targetRolesMatch(role, identity, clickFamily)) throw new SelectedTargetMismatchError("Ambiguous target: the authored control role does not match.");
-  const authoredName = anchored?.name ?? literalTargetName(qualifier?.rawControl ?? instruction);
+  let authoredName = anchored?.name ?? literalTargetName(qualifier?.rawControl ?? instruction);
+  if (ordinal && authoredName === void 0) {
+    tiers ??= await bindingFrames(frame, policy);
+    if (await observedLiteralName(tiers, control, step, role)) authoredName = control;
+  }
   const literal3 = authoredName !== void 0 || control === name;
-  if (ordinal && !literal3) throw new SelectedTargetMismatchError("The authored ordinal control name does not match.");
+  if (ordinal && !literal3) await assertDescriptiveOrder(handle, ordinal, identity.role, control);
   const controlName = roleOnly ? void 0 : authoredName;
   if (!literal3 && !roleOnly && step.keyword !== "act" && scanQuotedText(instruction).spans.length > 0) throw new SelectedTargetMismatchError("Ambiguous target: the authored control name does not match.");
-  if (!literal3 && !roleOnly && !qualifier) return identity;
+  if (!literal3 && !roleOnly && !qualifier) {
+    const unbound = { ...identity };
+    delete unbound.binding;
+    return unbound;
+  }
   const observedName = authoredName ?? (identity.name.includes("[redacted]") ? (await readTargetIdentity(handle, [], Number.MAX_SAFE_INTEGER)).name : identity.name || localName);
   const escapedName = observedName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const queryName = new RegExp(`^[\\s\uE000-\uF8FF\u2190-\u21FF\u27F0-\u27FF\u2900-\u297F]*${escapedName}[\\s\uE000-\uF8FF\u2190-\u21FF\u27F0-\u27FF\u2900-\u297F]*$`, "i");
@@ -17961,28 +18072,7 @@ async function bindIntendedTarget(handle, step, identity, policy) {
   let selected = false;
   let rejected = false;
   let ordered = 0;
-  const primary = [], embedded = [];
-  const requiredFrames = [];
-  for (let current = frame; current; current = current.parentFrame()) requiredFrames.push(current);
-  const topOrigin = policy ? await frameOrigin(frame.page().mainFrame()) : void 0;
-  for (const candidateFrame of policy || anchored ? frame.page().frames() : [frame]) {
-    try {
-      if (!await isFrameVisible(candidateFrame)) continue;
-    } catch (error2) {
-      if (!(error2 instanceof NativeFrameDetachedError)) throw error2;
-      if (requiredFrames.some((required) => required.isDetached())) throw new TargetChangedError("The selected target frame detached before authored binding.");
-      continue;
-    }
-    if (policy && (await blockedFrameOrigins(candidateFrame, policy)).length) continue;
-    let sameChain = true;
-    if (policy) {
-      for (let ancestor = candidateFrame; ancestor; ancestor = ancestor.parentFrame()) if (await frameOrigin(ancestor) !== topOrigin) {
-        sameChain = false;
-        break;
-      }
-    }
-    (sameChain ? primary : embedded).push(candidateFrame);
-  }
+  const [primary, embedded] = tiers ?? await bindingFrames(frame, policy, Boolean(anchored));
   for (const tier of [primary, embedded]) {
     for (const candidateFrame of tier) {
       const nativeRole = ["button", "link", "textbox", "combobox", "checkbox", "radio", "switch", "tab", "menuitem", "menuitemcheckbox", "menuitemradio", "option", "searchbox", "spinbutton", "img"].includes(identity.role);
@@ -18018,6 +18108,7 @@ async function bindIntendedTarget(handle, step, identity, policy) {
           const isSelected = candidateFrame === frame && await candidate.evaluate((element, original) => element === original, handle);
           if (match === "conflict" && !isSelected) continue;
           if (literal3 && !roleOnly && !await nativeNameMatches(candidate, observedName, identity.role, Boolean(identity.textEntry))) continue;
+          if (literal3 && step.keyword === "click" && await isDuplicateFocusWrapper(candidate, observedName)) continue;
           if (match === "conflict") {
             rejected = true;
             continue;
@@ -18076,6 +18167,96 @@ async function nativeNameMatches(handle, expected, role, textEntry) {
   }
   return normalize(name) === normalize(expected);
 }
+async function observedLiteralName(tiers, name, step, role) {
+  if (!name) return false;
+  for (const tier of tiers) for (const frame of tier) {
+    const candidates = await frame.locator('button,a[href],input,select,textarea,summary,[contenteditable],[role="button"],[role="link"],[role="checkbox"],[role="radio"],[role="switch"],[role="tab"],[role="menuitem"],[role="menuitemcheckbox"],[role="menuitemradio"],[role="option"],[role="combobox"],[role="textbox"],[role="searchbox"],[role="spinbutton"],[tabindex],[onclick]').elementHandles();
+    try {
+      for (const candidate of candidates) {
+        if (!(await targetReadiness(candidate)).active) continue;
+        const identity = await readTargetIdentity(candidate);
+        if (step.keyword === "click" && !identity.interactive || step.keyword === "enter" && !identity.textEntry || step.keyword === "select" && identity.role !== "combobox") continue;
+        if (!targetRolesMatch(role, identity, step.keyword === "click" && ["button", "link"].includes(role ?? ""))) continue;
+        if (await nativeNameMatches(candidate, name, identity.role, Boolean(identity.textEntry)) && !await isDuplicateFocusWrapper(candidate, name)) return true;
+      }
+    } finally {
+      await Promise.all(candidates.map((candidate) => candidate.dispose()));
+    }
+  }
+  return false;
+}
+async function focusWrapperWithoutDeclaredActivation(handle) {
+  return await readDOM(handle, "focusWrapper") && !await handle.evaluate((element) => typeof element.onclick === "function");
+}
+async function isDuplicateFocusWrapper(handle, name) {
+  if (!await focusWrapperWithoutDeclaredActivation(handle)) return false;
+  const descendants = await selectAllDOM(handle, "actionDescendants");
+  let matches = 0;
+  try {
+    for (const child of descendants) {
+      if (!(await targetReadiness(child)).active || await focusWrapperWithoutDeclaredActivation(child)) continue;
+      const identity = await readTargetIdentity(child);
+      if (identity.interactive && await nativeNameMatches(child, name, identity.role, Boolean(identity.textEntry))) matches++;
+    }
+    return matches === 1;
+  } finally {
+    await Promise.all(descendants.map((child) => child.dispose()));
+  }
+}
+async function assertDescriptiveOrder(handle, ordinal, role, description) {
+  const label = await readDOM(handle, "ordinalCollectionLabel");
+  if (!label || label.trim().replace(/\s+/g, " ").toLowerCase() !== description) return;
+  const items = await selectAllDOM(handle, "ordinalItems");
+  let count = 0;
+  let selected = 0;
+  try {
+    for (const item of items) {
+      if (!(await targetReadiness(item)).active) continue;
+      const descendants = await selectAllDOM(item, "actionDescendants");
+      const matches = [];
+      try {
+        for (const candidate of [item, ...descendants]) {
+          if (!(await targetReadiness(candidate)).active || await focusWrapperWithoutDeclaredActivation(candidate)) continue;
+          const identity = await readTargetIdentity(candidate);
+          if (identity.role === role && identity.interactive) matches.push(candidate);
+        }
+        if (matches.length !== 1) return;
+        count++;
+        if (await sameDOMNode(matches[0], handle)) selected = count;
+      } finally {
+        await Promise.all(descendants.map((candidate) => candidate.dispose()));
+      }
+    }
+    if (selected && selected !== ordinal) throw new SelectedTargetMismatchError("Ambiguous target: the selected control contradicts the authored ordinal in its collection.");
+  } finally {
+    await Promise.all(items.map((item) => item.dispose()));
+  }
+}
+async function bindingFrames(frame, policy, acrossFrames = false) {
+  const primary = [], embedded = [];
+  const requiredFrames = [];
+  for (let current = frame; current; current = current.parentFrame()) requiredFrames.push(current);
+  const topOrigin = policy ? await frameOrigin(frame.page().mainFrame()) : void 0;
+  for (const candidateFrame of policy || acrossFrames ? frame.page().frames() : [frame]) {
+    try {
+      if (!await isFrameVisible(candidateFrame)) continue;
+    } catch (error2) {
+      if (!(error2 instanceof NativeFrameDetachedError)) throw error2;
+      if (requiredFrames.some((required) => required.isDetached())) throw new TargetChangedError("The selected target frame detached before authored binding.");
+      continue;
+    }
+    if (policy && (await blockedFrameOrigins(candidateFrame, policy)).length) continue;
+    let sameChain = true;
+    if (policy) {
+      for (let ancestor = candidateFrame; ancestor; ancestor = ancestor.parentFrame()) if (await frameOrigin(ancestor) !== topOrigin) {
+        sameChain = false;
+        break;
+      }
+    }
+    (sameChain ? primary : embedded).push(candidateFrame);
+  }
+  return [primary, embedded];
+}
 
 // ../../src/policy/action-safety.ts
 function evaluateActionSafety(input) {
@@ -20924,7 +21105,12 @@ async function draftItem(item, request, options, draftId, earlier = []) {
       const aligned = assertionIndices.length === explicit.length && explicit.every((outcome, index) => {
         const at = assertionIndices[index];
         const proposed = parseStep(steps[at], at + 1);
-        return proposed.keyword === outcome.keyword && equivalentOutcome(normalizeAuthoredOutcome(outcome.argument, outcome.before, steps.slice(0, at)), proposed.argument, outcome.keyword === "wait_for") && (outcome.source.final ? at === steps.length - 1 : checkpointAligned(outcome, steps, at));
+        try {
+          validateOutcomeStep(outcome);
+        } catch {
+          return false;
+        }
+        return proposed.keyword === outcome.keyword && (outcome.source.final ? at === steps.length - 1 : checkpointAligned(outcome, steps, at));
       });
       if (aligned) {
         explicit.forEach((outcome, index) => {
@@ -21017,15 +21203,6 @@ function sourceClauses(text) {
     return { start, boundary, end, raw };
   });
 }
-function equivalentOutcome(expected, proposed, bareText = false) {
-  try {
-    const a = parseVisibleTextAssertion(expected, bareText), b = parseVisibleTextAssertion(proposed, bareText);
-    if (a && b) return JSON.stringify(a) === JSON.stringify(b);
-  } catch {
-    return false;
-  }
-  return expected.replace(/\s+/g, " ").replace(/[.!]$/, "").trim() === proposed.replace(/\s+/g, " ").replace(/[.!]$/, "").trim();
-}
 function actionIdentity(raw) {
   const step = parseStep(raw.replace(/[.!]$/, ""), 0);
   if (step.keyword === "act" || isOutcomeStep(step)) return void 0;
@@ -22243,7 +22420,7 @@ jobs:
           node-version: '22'
       - name: Install Zerocheck
         run: |
-          npm install --prefix "$RUNNER_TEMP/zerocheck-cli" --no-save --package-lock=false zerocheck@0.1.7
+          npm install --prefix "$RUNNER_TEMP/zerocheck-cli" --no-save --package-lock=false zerocheck@0.1.9
           echo "$RUNNER_TEMP/zerocheck-cli/node_modules/.bin" >> "$GITHUB_PATH"
       - name: Restore learned targets
         uses: actions/cache@v4
@@ -28263,7 +28440,7 @@ var runner = z2.enum(["local", "hosted"]).default("local").describe("Local brows
 var output = (value) => ({ content: [{ type: "text", text: JSON.stringify(value) }], structuredContent: { result: value } });
 var error = (value) => ({ isError: true, content: [{ type: "text", text: JSON.stringify({ error: "operation_failed", message: value instanceof Error ? value.message : String(value) }) }] });
 function createMcpServer(services) {
-  const server = new McpServer({ name: "zerocheck", version: "0.1.7" });
+  const server = new McpServer({ name: "zerocheck", version: "0.1.9" });
   server.registerTool("list_checks", {
     description: "List the repository YAML checks, IDs, exact contents and revisions. Does not execute them.",
     inputSchema: { paths: z2.array(z2.string()).optional(), environment },
@@ -28403,7 +28580,7 @@ async function mcpCommand(options) {
 }
 
 // src/index.ts
-var program = new Command().name("zerocheck").version("0.1.7").description("Turn your team\u2019s manual release checklist into repeatable browser tests.");
+var program = new Command().name("zerocheck").version("0.1.9").description("Turn your team\u2019s manual release checklist into repeatable browser tests.");
 var directory = (command) => command.option("--project-dir <path>", "Repository project directory", process.cwd());
 var environment2 = (command) => directory(command).addOption(new Option("--env <environment>", "Named project environment").choices(["dev", "staging", "production"]));
 var execution = (command) => environment2(command).addOption(new Option("--runner <runner>", "Browser execution location").choices(["local", "hosted"]).default("local"));

package/package.json

@@ -1,7 +1,27 @@
 {
   "name": "zerocheck",
-  "version": "0.1.7",
-  "description": "Turn manual release checklists into repeatable browser tests locally, in CI, or hosted.",
+  "version": "0.1.9",
+  "description": "Turn release checklists into repeatable browser tests. Run with the Zerocheck CLI, CI or web app and inspect the evidence.",
+  "keywords": [
+    "qa-agent",
+    "ai-testing",
+    "agentic-testing",
+    "zerocheck",
+    "testing",
+    "qa",
+    "e2e",
+    "end-to-end",
+    "browser-testing",
+    "test-automation",
+    "release-checklist",
+    "plain-english",
+    "playwright",
+    "cli",
+    "mcp",
+    "ci"
+  ],
+  "homepage": "https://tryzerocheck.com/",
+  "license": "MIT",
   "type": "module",
   "repository": {
     "type": "git",