# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [1.12.2] — 2026-05-20 ### Fixed - **Git-site file links were broken.** The per-site report's File name link (and the CSV Public URL) for the static git sites — the ARI Summits, vpp, ilheals, sfs — built `publicUrlBase + path` and **dropped the site's path prefix**. Those sites deploy files under `/static/…`, so the link was missing that segment and landed on the site's SPA catch-all (the homepage) instead of the file. `buildPublicUrl` (`html.js` + `csv.js`) now applies the site's `pathPrefix`, and `runReport` injects it from web-rollup (the scanned inventory header doesn't carry it). It also **percent-encodes each path segment**, so pre-CMS filenames containing spaces (e.g. `Agenda_ARI_AllSites_Summit _2017_FINAL.pdf`) produce valid `%20` URLs. - **Cross-server duplicate detection missed space/underscore pairs.** `normalizeStrapiFilename` only stripped the Strapi upload hash — it didn't treat a space and an underscore as equivalent. A pre-CMS file `Some File.pdf` and its Strapi-sanitised twin `Some_File.pdf` were keyed differently and never grouped, so the duplicate was missed entirely. The normaliser now folds runs of spaces and underscores to a single underscore. ### Changed - **Fleet-index default sort is now "Most recently added"** (was alphabetical) — newer sites lead, and the oldest (the ARI Summits) sit at the bottom. - **HTML report tables default to 25 rows per page** (was 50). - **"Coming soon" section refreshed** — it now previews the two upcoming features (the Page view and fuzzy search) instead of the already-shipped reference-discovery work. ### Tests 687 passing (+2 — pathPrefix + percent-encoding in the File name link, and space/underscore folding in `normalizeStrapiFilename`). ## [1.12.1] — 2026-05-20 ### Changed - **Orphaned-files report — paginated.** The orphan table (thousands of rows) is now paged (25 / 50 / 100 rows per page, default 50) with Prev / numbered / Next controls and a "Showing X–Y of N orphans" readout. The column sort and the filter box still work — they drive the matching set and the paginator shows the current slice. - **Fleet-index duplicates table — paginated, column-trimmed, drag removed.** The cross-server duplicates table is paged the same way. Its HTML columns are trimmed to the four a manager acts on — **Filename**, **Match** (exact/variant), **Sites**, **Copies**; the "Newest → oldest" and "Total size" columns move to CSV-only (`audit-file-duplicates.csv` keeps the full per-occurrence detail). The click-and-drag pan handler is removed — a 4-column table fits without horizontal panning. The Remediable / Reference / All kind-filter is now JS-driven (was CSS `display:none` rules) so it composes with the paginator's row show/hide. ### Tests 684 passing (+9 — new `report-orphans-html` suite, plus duplicates-table paginator + trimmed-column cases in `index-page`). ## [1.12.0] — 2026-05-20 ### Changed - **HTML report table redesigned for managers.** The per-site / by-type inventory table now shows only the six columns a manager acts on — **File name** (linked to the file), **File type**, **Audit Score**, **Page References**, **Duplicate of**, **Date published**. Consolidated multi-site reports prepend a **Website** column so each row's site stays identifiable. The forensic columns (server, IP, source/relative/absolute paths, extension, size, content hash, public URL) are unchanged in the CSV — the CSV stays the full 18-column record; the HTML is now a focused projection of it. - **Paginator replaces click-and-drag panning.** The table is paged (25 / 50 / 100 rows per page, default 50) with Prev / numbered / Next controls and a "Showing X–Y of N files" readout. Sorting, the filter chips, and search still work — they operate on the full matching set and the paginator shows the current slice. Diagnostic finding behind the change: the old click-and-drag pan handler occasionally swallowed a link click as the start of a drag, and a 16-column table forced horizontal panning to reach the Audit Score / Page References columns. A 6-column table fits without panning, so the drag handler — and the intermittent dead-click — are gone. - **Column-resize and drag-to-pan handlers removed.** With a six-column table there is nothing to resize or pan; the ``, the per-`` resize handles, and both pointer-drag handlers (~150 lines of client JS) are deleted. Native wheel / scrollbar / touch scrolling is unaffected. ### Added - **Orphaned-files report — lifecycle explainer.** The `audit-orphaned-files.html` detail page now opens with a "Why orphan files exist (and why some rate is normal)" section: a five-row lifecycle table (stale Strapi revision, replaced agenda/attachment, deleted entry, manual version naming, genuinely-unlinked upload) with "what it looks like" + "disposition" columns, plus a confidence-tier action guide (≥85% safe-to-delete, 60–84% verify, 0–59% manual review). Gives a non-technical reader the context to read the orphan table without assuming every orphan is a mistake. ### Tests 675 passing — the `report-html` suite was updated for the trimmed 6-column table, the paginator markup, the File-name → public-URL link, and the consolidated-report Website column. ## [1.11.1] — 2026-05-19 ### Changed - **`normalizeStem` now strips consecutive trailing Strapi hashes**, not just one. Confirmed pattern on agency.icjia-api.cloud: re-uploading a file whose original name already ends in a Strapi hash produces a new file whose name ends in BOTH hashes (the old one becomes a stem-suffix, then Strapi appends a fresh hash). Example: `Traffic_Data_Agenda_NEW_07_24_24_df57bde328_5bb02ff5b1.pdf` → orphan revision of `Traffic_Data_Agenda_NEW_07_24_24_df57bde328.pdf`. Without multi-strip, the two would land in different fuzzy groups and the stale-revision detection misses. `stripped.priorHashes` exposes the inner hashes for forensic traceability. ## [1.11.0] — 2026-05-19 ### Added - **Orphaned-files report.** New `audit-orphaned-files.html` + `audit-orphaned-files.csv` sit alongside the existing master CSV in every fleet bundle. Lists every file with `references: []` after cross-reference resolution, fuzzy-matched against same-stem siblings to identify likely upgrade-replaced revisions vs. genuinely orphan content. Each row carries a 0-95% `replaceabilityConfidence` score (the likelihood the orphan is a stale older copy whose current version is still referenced). - **Per-site orphan-rate breakdown** in the report — sortable table of every site's total resolved files, orphan count, orphan %, plus split between stale-revision and truly-unreferenced. Lets you spot which site is dragging the fleet-wide orphan rate (e.g. our intranet at 73% vs. 12% benchmark = extraction gap, not real orphans). - **Fuzzy-match algorithm** in `src/report/orphans.js` — deterministic, no Levenshtein. Strips Strapi 10-char hex hash suffix (`_[a-f0-9]{10}` before extension), explicit version markers (`_vN`, `-vN`, ` (N)`, ` copy [N]`), then lowercase + collapse whitespace. Groups by `(normalized stem, extension)`. Confidence factors: base 70 → +20 for ≥30-day age gap vs. the referenced sibling → +5 for hash-only difference → −25 for same-batch (within 7 days). Capped at 95 (never claim certainty). Floored at 0 for newer-than-live anomalies or truly-orphan singletons. - **Reason flags** per orphan: `strapi-hash-variant` (sibling is same name with different Strapi hash), `newer-than-live` (orphan is newer than the referenced sibling — anomaly worth investigating), `same-batch` (uploaded within 7 days of the referenced sibling), `older-than-1yr` (likely deprecated content). - **Explainer block** at the top of the HTML report — five most-common reasons a file ends up orphan, plus how to use the report (sort by Confidence % desc; ≥85% is safe-to-delete; 0% needs human eyes). ### Tests 671 passing (+28 from new `report-orphans.test.js`). ## [1.10.2] — 2026-05-19 ### Changed - **`Referenced` column relabeled to `Page References`** in CSV + HTML. Same data; clearer manager-facing wording. - **`Audit Score` + `Audit Report` columns merged into a single `Audit Score` column.** Matches the multi-line cell pattern of `Page References` — score chip + report link read as one signal, not two adjacent cells. HTML: grade chip, score in muted text, "Open report" anchor inline. CSV: grade and score on line 1, audit.icjia.app report URL on line 2 of the same multi-line cell. - **Page-audit grade chips now carry an `axe-core` attribution** in tiny muted italic text after each chip. Hover tooltip explains: "Page accessibility graded by axe-core, run server-side via headless Chromium on audit.icjia.app". Distinguishes the page-grading methodology (axe-core) from the file-grading methodology (WCAG 2.1 AA + IITAA §E205.4 strict profile). ### Tests 643 passing (down 1 from 644 — the removed "seventh column is Audit Report" assertion, replaced with the merged-column expectations). ## [1.10.1] — 2026-05-19 ### Changed - `buildPageAuditChip` (in `src/report/html.js`) now renders the page-audit grade as a plain non-clickable `` instead of an anchor to `audit.icjia.app/page-report/`. The audit.icjia.app `/page-report/` Nuxt viewer was scoped out of the 1.10.0 audit-tool release — the API persists the JSON but no Nuxt route serves it, so clicks landed on 404s. The chip itself is the whole intended signal next to each "Page N" anchor: the grade letter (A through F) answers the manager question "is that page accessible too?" inline. PDFs still get a separate clickable `Open report` link in the Audit Report column. - The `reportUrl` field on `entry.references[].pageAudit` is still emitted by the audits step (no orchestrator change) so the data is available for any future viewer; it's just not exposed in the HTML chip. ## [1.10.0] — 2026-05-19 **Page accessibility scoring.** The third and final layer of the three-layer accessibility story manager-friendly audit reports tell — alongside the PDF audit (1.9.0) and the cross-site references (1.8.0): - Layer 1 — **Is the file accessible?** (PDF audit, 1.9.0) - Layer 2 — **Where on our site is it linked from?** (Cross-references, 1.8.0) - Layer 3 — **Is that page itself accessible?** (this release) ### Added - `filecap audits` now scores every URL in `entry.references[]` via audit.icjia.app's new **`POST /api/audit-url-page`** endpoint (headless Chromium + `@axe-core/puppeteer` + persisted as a shareable shared_reports row). Each reference object in the augmented inventory gets a `pageAudit = { score, grade, violationCount, bySeverity, reportUrl, reportId, reportExpiresAt, pageTitle, audited, checkedAt, cached }` field attached. ON by default; opt out with `--skip-pages`. - **Page-grade chips in the HTML report.** Tiny parenthesised letter chip (`(B)`) rendered next to each `Page N` anchor in the Referenced column. Same colour register as the file-audit chips so the eye reads file accessibility + page accessibility as the same metric kind. Chip is itself a clickable anchor → audit.icjia.app/page-report/ for the per-violation deep-dive. - **`src/audits/page-scorer.js`** — POST /api/audit-url-page wrapper, mirrors `score-fetcher.js`. Same error semantics (5xx + 504 → null for graceful skip; 4xx → throws). - **Page cache at `~/.filecap/page-audit-cache.json`** — URL-keyed (pages don't have content hashes the way files do — same URL with rendered content vs SSR shell), separate file from the PDF cache. Default 14-day TTL (pages change more than file content). audit.icjia.app also dedups by `sha256(url)` server-side; the local cache lets us skip the HTTP round-trip entirely. ### Operator notes - audit.icjia.app's `/api/audit-url-page` endpoint launches headless Chromium (~5–15 s per page render + axe analysis). On first deploy the audit.icjia.app server needs Chromium's runtime libraries installed: ```bash sudo apt install -y libatk1.0-0t64 libatk-bridge2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libexpat1 libfontconfig1 libgbm1 libglib2.0-0t64 libgtk-3-0t64 libnspr4 libnss3 libpango-1.0-0 libpangocairo-1.0-0 libx11-6 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 libxkbcommon0 libatspi2.0-0t64 libasound2t64 fonts-liberation xdg-utils ``` - The audit-url-page endpoint reuses the existing `analyzeLimiter` rate-limit budget (default 35/hour; the fleet flow assumes the operator bumped this to 5000 already for the PDF pass). The `global` rate limiter (default 100/min per IP) also applies — if you see batches of `Unavailable` cells in the deployed bundle, bump it to 1000. - audit-fleet-auto.sh's Stage 3.5 now runs page audits by default in addition to PDF audits. `SKIP_AUDITS=1` opts out of both. Use `--skip-pages` on a direct `filecap audits` call to score PDFs but skip pages. ### Verified End-to-end on dvfr-strapi-prod: 62 PDFs audited (B/C/F grades), 32 unique pages audited (24 A, 8 B), every reference now carries both a file-audit grade and a page-audit grade. Sample meeting-minutes PDF row in the deployed report: - File audit: **B (84)** — clickable to per-file violation list - Referenced on: dvfr.illinois.gov/meetings/...may-21-2024/ - Page audit: **A (100)** 0 violations — clickable to per-issue page audit ### Tests 644 passing (same as 1.9.0; the 1.10.0 page-scorer + cache + orchestrator-extension test infrastructure was scaffolded in 1.9.0-alpha.1 with the preview flag off, and the orchestrator tests gate on `skipPages` so flipping the default doesn't break them). [1.10.0]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.10.0 ## [1.9.0] — 2026-05-19 **Stable.** Consolidates `1.9.0-alpha.1` + `1.9.0-alpha.2` into a single shipped release. PDF accessibility scoring is now live on the `latest` npm dist-tag so `audit-fleet-auto.sh` (which calls `@icjia/filecap@latest`) picks it up by default. ### Headline For every PDF in a filecap fleet inventory: an **accessibility score (0–100, letter grade A–F) + a stable link to the per-file audit report** on audit.icjia.app. Two new columns on every CSV and HTML view: - **`Audit Score`** at position 6 — coloured grade chip + numeric score - **`Audit Report`** at position 7 — "Open report" anchor to audit.icjia.app/report/... Non-PDF rows (docx, xlsx, pptx, image) render empty in these columns. Those formats have their own checkers inside their authoring tools. ### Pipeline ``` scan → references → cross-references → audits → web-rollup ^^^^^^ new ``` `filecap audits ` walks the augmented inventory, scores every PDF via `POST https://audit.icjia.app/api/audit-url`, writes `inventory.audited.ndjson` with `entry.audit = { score, grade, reportUrl, reportId, reportExpiresAt, audited, checkedAt, cached }` populated. `audit-fleet-auto.sh` runs it automatically as Stage 3.5 (between cross-references and web-rollup). `SKIP_AUDITS=1` opts out. ### Local cache `~/.filecap/audit-cache.json` (mode 0600, atomic write, default 30-day TTL), keyed by SHA-256 of the PDF content. audit.icjia.app dedups server-side too, but cached responses still go through the rate-limiter middleware before the cache lookup — the local cache lets us skip the HTTP call entirely for recently-seen hashes. First full fleet pass is the only heavy one; subsequent refreshes hit cache for ~all unchanged PDFs. ### Bounded concurrency Default 2 parallel requests — respects audit.icjia.app's `pdfAnalyzer` 2-at-a-time semaphore and the global 100-per-minute IP rate limit. ### Fleet-index accessibility band New teal band on the deployed bundle's `index.html`, below the cross-site reference coverage band. Surfaces fleet-wide average grade + average score + count of audited PDFs + pending/error counts. Distinct from the amber audit-count hero and the blue references band so the eye reads each as its own metric. ### sites.json: `pathPrefix` field Optional string per site entry. Set on the four ARI Summit 2017–2023 sites — old vue-cli (not Nuxt) builds where the repo's `static/` folder deploys to `/static/` on the URL (vue-cli preserves the directory segment; Nuxt collapses it). Strapi + Nuxt sites leave it unset. `filecap audits` reads sites.json, matches the inventory header's serverName against the site entry, and prepends `pathPrefix` to the URL it sends to audit.icjia.app. Master CSV's Public URL column also picks it up via the `consolidatedSources` plumbing. ### Auth-fetcher forward-compat Sends `Authorization: Bearer ` when `credentials.audit-icjia-app.bearerToken` is set in `~/.filecap/secrets.json`. audit.icjia.app currently runs with `AUTH.REQUIRE_LOGIN=false` (anonymous), so no token is needed today; the code path is in place for when auth flips on. ### Operator notes - audit.icjia.app's `RATE_LIMITS.analyze.max` defaults to **35 per hour** out-of-the-box. For a full fleet pass against ~2,200 PDFs, bump it to ~5000 in `audit.config.ts` once before the first run. Cache makes subsequent runs essentially free. - Old Vue 2 git sites (ARI Summit 2017–2023) need `pathPrefix: "/static"` in sites.json for their PDFs to audit correctly; without it, the audit endpoint fetches the Netlify SPA catch-all HTML and returns 422. The four ari-summit entries in the ICJIA fleet bundle ship with this set. ### Preview behind a flag A page-audit code path (target 1.10.0) is included in this release but **defaults to OFF** (`skipPages: true` on `runAudits`). When 1.10.0 ships, the default flips and `audit-fleet-auto.sh` will also score every URL in `entry.references[]` via audit.icjia.app's `/api/audit-url-page` (axe-core via Puppeteer) so each referenced page in the report carries an accessibility grade chip alongside the PDF score. The endpoint code is on the audit.icjia.app `feat/audit-url-page` PR; deployment + filecap-side wiring lands in 1.10.0. ### Tests **644 passing** (up from 602 at 1.8.0; +42 across the score-fetcher, cache, orchestrator, page-scorer scaffolding, schema additions, and column-position assertions). [1.9.0]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.9.0 ## [1.9.0-alpha.2] — 2026-05-19 ### Added - **`pathPrefix` field on `sites.json` site entries** (optional string). Set on the four ARI Summit 2017–2023 sites, which are old Vue 2 (non-Nuxt) vue-cli builds where the repo's `static/` folder deploys to `/static/` on the URL — vue-cli preserves the directory segment, unlike Nuxt which collapses it. Strapi + Nuxt sites leave it unset. - `filecap audits` reads `~/.filecap/sites.json`, matches the inventory header's serverName against the site's entry, and prepends `pathPrefix` to the URL it sends to audit.icjia.app. ARI Summit PDFs now audit correctly (previously got 422 because audit.icjia.app fetched the Netlify SPA catch-all HTML instead of the real PDF). - Master CSV's Public URL column also picks up `pathPrefix` for consolidated rollups (via the existing `consolidatedSources` plumbing). Per-site report Public URL column behavior unchanged from 1.8.0 — that fix needs the inventory header to carry `pathPrefix`, which the scan step doesn't write today. ### Verified - ari-summit-2018-git audits: 14 PDFs scored, 0 errors. Sample: `Bloomington State Rate Hotels.pdf` → **32 (F)**, stable report URL on audit.icjia.app. ### Tests 634 passing (same as alpha.1; this release only adds runtime config plumbing). [1.9.0-alpha.2]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.9.0-alpha.2 ## [1.9.0-alpha.1] — 2026-05-19 Phase 1.9.0 — PDF accessibility scoring via audit.icjia.app. ### Added - **`filecap audits ` subcommand** — walks an inventory NDJSON, scores every PDF via `POST https://audit.icjia.app/api/audit-url`, writes an augmented `inventory.audited.ndjson` with `entry.audit = { score, grade, reportUrl, reportId, reportExpiresAt, audited, checkedAt, cached }` populated for each PDF. Non-PDF entries (docx, xlsx, pptx, image) pass through unchanged — they have their own remediation checkers inside Word / Excel / PowerPoint and aren't in scope for this scorer. - **Local SHA-256-keyed cache** at `~/.filecap/audit-cache.json` (mode 0600, atomic write, default 30-day TTL). audit.icjia.app already dedups server-side by content hash, but cached responses still go through its rate-limiter middleware — the local cache lets us skip the HTTP call entirely for files whose hash we've seen recently. First full fleet pass is the only expensive one; subsequent refreshes hit cache for ~all unchanged files. - **Bounded-concurrency request pool** (default 2 parallel requests) — respects audit.icjia.app's `pdfAnalyzer` 2-at-a-time semaphore and the global 100-per-minute IP rate limit. - **Auth-fetcher forward-compat** — sends `Authorization: Bearer ` when `credentials.audit-icjia-app.bearerToken` is set in `~/.filecap/secrets.json`. audit.icjia.app currently runs with `AUTH.REQUIRE_LOGIN=false` (anonymous), so no token is needed today; the path is in place for when auth flips on. - **`Audit Score` + `Audit Report` columns** in CSV + HTML, slotted at positions 6 + 7 (immediately after `Referenced`). HTML renders the score as a colour-coded grade chip (A green → F red) plus the numeric score in muted text; the report column is a "Open report" anchor opening the persisted audit.icjia.app report in a new tab. Errors render as a muted "Unavailable" chip. Non-PDF rows render empty cells. - **Fleet-index accessibility band** on the deployed bundle's `index.html`. Sits below the cross-site reference coverage band, surfaces the fleet-wide average grade + score + count of audited PDFs + pending/error counts. Teal/green colour register distinguishes it from the amber audit-count hero and the blue references band. - **`audit-fleet-auto.sh` stage 3.5** — the full-pipeline wrapper now runs `filecap audits` between cross-references and web-rollup. `SKIP_AUDITS=1` opts out. - **Augmented-inventory chain in web-rollup** — loader now prefers `inventory.audited.ndjson` → `inventory.cross-ref.ndjson` → `inventory.ndjson` so partial-pipeline runs still produce a sensible bundle. ### Notes - `audit.icjia.app`'s default `RATE_LIMITS.analyze.max` is **35 per hour**, well below what a first-time full fleet audit (~2,200 PDFs) needs. Bump it to ~5000/hour in `audit.config.ts` before the first big run; revert once the cache is warm if you want to tighten back down. - Old Vue 2 non-Nuxt git sites (the ARI Summit 2017–2023 archive) deploy to Netlify with an SPA catch-all `_redirects` that returns HTML for unmatched URLs. audit.icjia.app's magic-bytes check correctly identifies this as not-a-PDF and returns 422 — the cell renders "Unavailable", which is the honest output. Strapi-hosted PDFs (the bulk of the fleet) audit cleanly. ### Tests **634 passing** (up from 602 at 1.8.0; +32 across the score-fetcher, cache, orchestrator, and column-position assertions). [1.9.0-alpha.1]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.9.0-alpha.1 ## [1.8.0] — 2026-05-19 **Stable.** Consolidates the seven pre-releases (alpha.1 + beta.1–beta.6) into a single shipped release. No code changes vs `1.8.0-beta.6`; this entry is the stable summary. Pre-release notes below remain as the version-by-version history. ### Headline A new **`Referenced` column** sits at CSV/HTML position 5 (immediately after `Public URL`) on every per-site report. For every PDF, Word doc, spreadsheet, or other audited file, the column lists the page URLs that link to it — the inflection point for the delete-vs-keep decision managers make on every audit. The column is populated by two new pipeline steps that slot between the existing `scan` and `web-rollup`: ``` scan (per server) → per-server inventory NDJSON ↓ references → per-site references sidecar (queries the site's CMS, extracts file URLs, resolves deployed page URLs) ↓ cross-references → augmented inventory with entry.references[] populated (fleet-wide URL → referrers index, with domain-alias resolution) ↓ web-rollup → Netlify bundle with the Referenced column live ``` ### Capabilities - **Strapi v3 adapter** — schema-driven content-type discovery via GraphQL introspection; field classification (URL string, body markdown, single UploadFile, list UploadFile, relation, other); REST pagination; irregular-plural detection via `*Connection` paginator; kebab-case REST path conversion for camelCase content types. Covers `icjia-agency-prod`, `spac-prod`, `researchhub-prod`, `ari-api-prod`, `ilfvcc-api-prod`, `intranet-api-prod`. - **Strapi v4 adapter** — parallel module for the v4-shaped fleet (`dvfr-strapi-prod`, `r3-strapi-prod`, `i2i-strapi-prod`, `infonet-strapi-prod`). Handles the `/api/` REST path, `pagination[limit/start]` syntax, wrapping `{data: [{id, attributes: {…}}]}` envelope, and typed media wrappers `UploadFileEntityResponse` / `UploadFileRelationResponseCollection`. Includes a kebab-case fallback for sites where the per-content-type `pluralName` diverges from the GraphQL plural. - **Git-repo adapter** — shallow-clones each `type:"git"` Nuxt static-site, walks `content/*.md`, extracts file URLs via regex, derives deployed page URLs from Nuxt Content routing convention (`content/.md → /`, `index.md → /`). - **Bearer-token + auto-refresh login** — Strapi sites that gate content (the ICJIA intranet) can declare `credentials..bearerLogin = { url, identifier, password }` in `~/.filecap/secrets.json` (mode 0600). On a 401, the references command POSTs to `/auth/local`, captures the fresh JWT, persists it back to `credentials..bearerToken`, and retries. Falls back to a TTY paste-prompt when no `bearerLogin` is configured. Non-interactive runs fail loudly. - **Cross-site reverse-index resolver** — reads every site's sidecar, builds a `Map>`, walks each scan inventory and attaches `entry.references[]` to every file via canonical-URL match. Domain-alias resolution collapses backend hosts onto canonical fronts (e.g. `archive.icjia-api.cloud` → `archive.icjia.cloud`) so cross-site references match correctly. - **`Referenced` column in the report** — column 5 on CSV and HTML. Cell semantics: undefined → empty cell (cross-references not run); empty array → muted "No references found" chip; populated → anchor chips (HTML) or newline-joined URLs (CSV). Refs whose `pageUrl` couldn't be resolved render as a clearly-labeled `no page URL` non-link chip with a tooltip identifying the source (site / contentType / entryId). - **Fleet-index coverage band** — new strip below the audit-count hero on `index.html` shows "X have known referrers (Y%) / Z have no known referrers — deletion candidates / N awaiting references run". The denominator excludes sites the references pipeline hasn't been run for, so the percentage isn't dragged down by sites we haven't extended to yet. - **Vertical click-and-drag pan** — the table-pan handler now scrolls both axes simultaneously; touch panning was already native via `overflow:auto` + `touch-action:pan-x pan-y`. ### Coverage at ship | Site | Entries | With cross-site references | | --- | --- | --- | | researchhub-prod | 428 | 358 (83%) | | dvfr-strapi-prod | 107 | 65 (60%) | | archive-prod | 1,889 | 941 (49%) | | icjia-agency-prod | 3,170 | 1,416 (44%) | | ilheals-git | 78 | 32 (41%) | | intranet-api-prod | 708 | 193 (27%) | | ari-api-prod | 555 | 152 (27%) | | ilfvcc-api-prod | 420 | 112 (26%) | | infonet-strapi-prod | 536 | 103 (19%) | | spac-prod | 502 | 62 (12%) | | i2i-strapi-prod | 393 | 50 (12%) | | r3-strapi-prod | 338 | 20 (5%) | | vpp-git | 54 | 0 (Vue templates, not yet walked) | | sfs-git | 72 | 0 | | ari-summit-2017/18/19/23-git | 158 | 0 | | **Total** | **9,408** | **3,504 (37%)** | ### Security Two red/blue team audits this release. Three findings, one Moderate + one Low + one Note. Both Moderate and Low fixed in-release: | # | Severity | Finding | Status | | --- | --- | --- | --- | | FC-2026-030 | Moderate | `references.graphqlEndpoint` / `restApiBase` accepted any string (SSRF / MITM risk via crafted sites.json) | Fixed: Zod refinement rejects non-`http(s):` URLs at schema load | | FC-2026-031 | Low | Pagination loops had no outer page-count cap (OOM risk on misbehaving sites) | Fixed: `maxPages` option, default 10,000 | | FC-2026-032 | Note | Sidecar NDJSON files trusted under same-UID model | Accepted (documented) | Full audit: [`docs/security/audit-2026-05-19.md`](docs/security/audit-2026-05-19.md). ### Tests **602 passing** (up from 441 at v1.7.40). Coverage spans the six new `src/references/` modules (url-canonical, extract-urls, domain-filter, field-classifier, strapi-v3, strapi-v4, git-repo, cross-resolver, auth-fetcher), the extended `secrets.json` schema with credentials/bearerLogin, the new `Referenced` column in CSV+HTML, and the URL-scheme + maxPages security guards. ### sites.json schema additions Three new optional fields per site entry: ```jsonc { "name": "icjia-agency-prod", // ... existing fields ... "domainAliases": ["archive.icjia-api.cloud"], // optional: extra fleet hosts "references": { // optional: enables references step "strategy": "strapi-v3" | "strapi-v4" | "git-repo", "graphqlEndpoint": "https://api.example.com/graphql", // strapi only "restApiBase": "https://api.example.com", // strapi only "siteFrontendUrl": "https://example.illinois.gov", "sitemapUrl": "https://example.illinois.gov/sitemap.xml", "contentTypeRoutes": { "post": "/news/:slug/", "grant": "/grants/funding/:slug/", // ... per-content-type → deployed-route map } } } ``` ### Deferred to future releases - Vue/HTML template walker for the 6 git Nuxt sites still at 0% coverage (their file references live in `.vue` templates, not `content/` markdown). Coverage gain likely modest since most file references on these sites point to external archives. - PDF→PDF references (extract PDF body text via `pdfjs-dist`, regex over it, attach). Adds processing cost; uncommon enough that we deferred. - `audit-fleet-auto.sh` integration so a single fleet refresh runs scan → references → cross-references → rollup → deploy in one command. Shipping alongside 1.8.0 stable as a small follow-up. [1.8.0]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0 ## [1.8.0-beta.6] — 2026-05-19 Big batch — five user-requested items (A, B, C, D, E) shipped together: ### Added - **Git-repo references adapter** (`src/references/git-repo.js`) for the 7 `type:"git"` Nuxt static sites: vpp, ilheals, sfs, ari-summits 2017–2023. Shallow-clones each repo, walks `content/*.md`, extracts file URLs via the same regex used by the Strapi adapters, derives the deployed page URL from Nuxt Content's default routing convention (`content/.md → /`, `index.md → /`). Strategy enum on `sites.json` references blocks now accepts `"git-repo"` alongside `"strapi-v3"` / `"strapi-v4"`; the orchestrator branches before the GraphQL dispatch. Tests cover the URL derivation rules (root, nested, `_hidden` directories, Windows-style backslashes) and the walker (markdown only, deduped URLs, missing-content dir tolerated). End-to-end fleet run: ilheals jumped from 0% to 41% coverage (32 of 78 files) via its content-markdown links to archive.icjia-api.cloud. - **Bearer-token references with auto-refresh login** (`src/references/auth-fetcher.js` + extended `src/config/secrets.js`). Adds optional `credentials..bearerLogin = { url, identifier, password }` to `~/.filecap/secrets.json`. On a 401 the auth-fetcher POSTs identifier+password to the configured `/auth/local` endpoint, captures the fresh JWT from the response, persists it back to `credentials..bearerToken` (atomic write, mode 0600 enforced), and retries the failed request — no manual token-paste required. If `bearerLogin` isn't set and the operator is on a TTY, falls back to an interactive paste prompt. Non-interactive runs (CI) without credentials fail loudly with a clear "configure bearerLogin or re-run interactively" message. 403 is never retried (auth refusal, not expiry). Tests cover the full state matrix (8 cases). Tradeoff documented: storing the password forfeits JWT rotation; the file's mode-0600 + same-UID trust model already governs comparable secrets like `secrets.json`'s legacy `tokens` map. - **Cross-site reference coverage band on the fleet index hero** (`src/web/index-page.js` + `src/commands/web-rollup.js`). New compact strip below the audit-count hero surfaces the manager-headline number: "X have known referrers (Y%) / Z have no known referrers — deletion candidates / N awaiting references run (git/intranet sites)". The denominator is `withRefs + withoutRefs` so the percentage isn't dragged down by sites whose references pipeline hasn't run; the explicit "awaiting" count tells the manager when that's happening. Blue accent register (distinct from the existing amber audit-count) so the eye reads it as supporting data, not as the primary metric. ### Changed - **`contentTypeRoutes` fixes for 3 sites** (audited the other 8 Strapi sites' routes vs their sitemaps, same approach as icjia-agency-prod in beta.5): - `ilfvcc-api-prod`: corrected `council` route from `/ifvcc/councils/:slug/` → `/ifvcc/circuits/:slug/` (24 entries land on `/ifvcc/circuits/` per the sitemap). - `r3-strapi-prod`: added `resource` → `/resources/:slug` (4 entries). - `infonet-strapi-prod`: added `tab` → `/tabs/:slug` (6 entries). - 5 sites had no missing routes (spac, researchhub, ari, dvfr, i2i). - **Intranet `references` block added to sites.json** with `requiresBearerToken: true` and `contentTypeRoutes` for the visible Vue SPA routes (post, biography, document, event, form, unit, page). The actual references run requires `credentials.intranet-api-prod.bearerLogin` in secrets.json — see the auto-refresh design above. ### Verified - **"No references found" cases sampled and confirmed as legitimate orphans** (not extraction bugs). Concrete example: 4 PDFs in icjia-agency-prod with stem `ICJIA_Budget_Committee_Meeting_Agenda_040926_*` — only the `_da501c9b93` hash is attached to the meeting record; the other 3 are superseded versions left on the file server. Across icjia, 179 of 3,110 PDFs (5.7%) currently sit with no references — these are the audit's deletion candidates. - Attachments capture verified for every Strapi content type that has an `attachments` field (grants 100%, publications 99.8%, meetings 99%, posts 91%, programs 92%; jobs 0% because they rarely populate attachments — matches user expectation). ### Tests - **602 passing** (up from 579 at beta.5; +23 across the git-repo module, the auth-fetcher, the extended secrets schema, and the route-position assertions). [1.8.0-beta.6]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.6 ## [1.8.0-beta.5] — 2026-05-19 ### Changed - **`Referenced` column moved to position 5 in the CSV/HTML report**, immediately after `Public URL`. Pre-beta.5 the column sat at position 15 (between `Duplicate of` and `Delete?`), forcing managers to scroll right to see "where is this file linked from?" — the question the column exists to answer. The two URLs that matter most for the delete-or-keep decision (the file's own URL and the list of pages that link to it) now sit side-by-side. - **Unresolved-reference chips no longer pretend to be a `Page N` link.** When the cross-resolver finds a reference but the deployed page URL couldn't be computed (no `contentTypeRoutes` mapping for the entry's content type, missing slug, or unsafe scheme), the chip now reads `no page URL` (italic, non-link) with a `title` tooltip identifying the source (`Reference from # — deployed page URL could not be resolved`). The red-styled `Page N` label that looked like a broken link is gone. - **CSV cells for unresolved references render `(no page URL)` as a placeholder line** instead of silently dropping the reference. Previously a reference with `pageUrl: null` was filtered out of the cell, which made it impossible to distinguish "no references found" from "references exist but no page URLs." The cell's line count now matches the actual reference count. ### Routes added to `~/.filecap/sites.json` for `icjia-agency-prod` Derived empirically from `icjia.illinois.gov/sitemap.xml`. Added or corrected five `contentTypeRoutes`: | Content type | Route | Why it matters | | --- | --- | --- | | `meeting` | `/news/meetings/:slug/` | Meeting agendas + minutes carry legal hosting requirements; managers must see they're referenced before deleting | | `program` | `/grants/programs/:slug/` | 60 of 65 programs have attachments | | `job` | `/about/employment/:slug/` | (No job attachments in current fleet, but route enables future) | | `unit` | `/about/units/:slug/` | Org-unit pages | | `publication` | `/about/publications/:slug/` (corrected, was `/researchhub/articles/:slug/`) | 1,107 publications — the corrected route is the canonical /about/publications/ path, also mirrored at /researchhub/articles/ on the live site | End-to-end re-run of the references step against `icjia-agency-prod` after the route additions resolved deployed page URLs for 2,127 of 2,198 sidecar records (97%). The 71 remaining unresolved records belong to admin content types (`tag`, `requiredForm`, `policy`, `rule`, `regulation`, `config`) that don't have user-facing pages. The icjia per-site detail page in the bundle went from 884 red `Page N` chips down to 30 "no page URL" chips; working anchor count: 1,349. ### Verified attachments capture The user-reinforced check: every Strapi content type with an `attachments` field is captured by the v3 extractor's `upload-file-list` path. Per-content-type tally on `icjia-agency-prod`: | Content type | Entries | With attachments | | --- | --- | --- | | grant | 106 | 106 (100%) | | publication | 1,107 | 1,105 (99.8%) | | meeting | 285 | 281 (99%) | | post (news) | 188 | 171 (91%) | | program | 65 | 60 (92%) | | job | 219 | 0 (rarely filled, per user expectation) | [1.8.0-beta.5]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.5 ## [1.8.0-beta.4] — 2026-05-19 ### Added - **`web-rollup` now consumes the augmented inventory.** When `filecap cross-references` has been run for a site, it writes the augmented NDJSON to `/latest/inventory.cross-ref.ndjson`. `web-rollup` previously read only `inventory.ndjson` (the raw scan output), so the populated `entry.references[]` was invisible in the bundle's CSV/HTML — managers saw an empty `Referenced` column. The loader now prefers the `.cross-ref.ndjson` companion when present and falls back to the raw inventory when absent. ### End-to-end fleet audit deployed The full pipeline (`scan → references → cross-references → web-rollup --deploy`) ran against all 18 fleet sites and pushed the resulting bundle to https://icjia-fleet-audit.netlify.app: | Site | Entries | With cross-site refs | | --- | --- | --- | | archive-prod | 1,849 | 909 (49%) | | icjia-agency-prod | 3,110 | 1,379 (44%) | | researchhub-prod | 315 | 250 (**79%**) | | dvfr-strapi-prod | 102 | 61 (**60%**) | | ari-api-prod | 553 | 150 (27%) | | ilfvcc-api-prod | 420 | 112 (27%) | | infonet-strapi-prod | 534 | 101 (19%) | | spac-prod | 501 | 61 (12%) | | i2i-strapi-prod | 393 | 50 (13%) | | r3-strapi-prod | 337 | 19 (6%) | | 7× git-type Nuxt sites | 362 | 0 (extractor TBD) | | intranet-api-prod | 706 | 0 (bearer-token TBD) | | **Total** | **9,484** | **3,092 (33%)** | The Referenced column appears as column 15 of every per-site CSV (between `Duplicate of` and `Delete?`) and as anchor chips in the per-site HTML view. Of 9,398 master-CSV rows, 2,095 carry at least one referenced page URL. [1.8.0-beta.4]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.4 ## [1.8.0-beta.3] — 2026-05-19 ### Added - **Vertical click-and-drag pan on report tables.** The pre-1.8.0 pan handler tracked only horizontal scroll (`scrollLeft`); mouse users with no scrollwheel access had no way to navigate the vertical content of a 75-vh-bounded file table. The handler now tracks both axes — `start.x` / `start.y` / `start.scrollLeft` / `start.scrollTop` — and pans both `wrap.scrollLeft` and `wrap.scrollTop` simultaneously. Threshold is `Math.hypot(dx, dy) ≥ 5px` so diagonal drags trip the gesture and a purely vertical drag pans the table down without first nudging horizontally. Touch panning was already handled natively via `overflow: auto` + `touch-action: pan-x pan-y` — unchanged. One new test pins the rendered-HTML assertion. ### Security A fresh red/blue team pass against the 1.8.0 references code paths produced **three findings — one Moderate, one Low, one Note. Both Moderate / Low fixed in this release.** Full audit detail in [`docs/security/audit-2026-05-19.md`](docs/security/audit-2026-05-19.md). | # | Severity | Finding | Status | | --- | --- | --- | --- | | FC-2026-030 | Moderate | `references.graphqlEndpoint` / `restApiBase` in sites.json accepted any string — no URL scheme validation. A malicious `sites.json` bundle could redirect `filecap references` at SSRF targets (loopback, link-local, cloud-metadata) or `http://` MITM-vulnerable endpoints. | **Fixed in 1.8.0-beta.3** — Zod refinement rejects non-`http:`/`https:` URLs (`file://`, `javascript:`, bare hosts, `ws://`, malformed strings) at schema load time. | | FC-2026-031 | Low | `fetchAllEntries` paginators (v3 + v4) had no outer page-count cap. A misbehaving or hostile site that returned a full page indefinitely would loop until the operator's process OOM'd. | **Fixed in 1.8.0-beta.3** — both adapters accept `options.maxPages` (default 10,000 → 1M-entry ceiling at default `limit=100`); the loop throws if the cap is hit so the orchestrator logs a WARN and moves on. | | FC-2026-032 | Note | Sidecar NDJSON inputs to `cross-references` trusted under the standard same-UID model — write access to the sidecar would let a local attacker inject false references. | Accepted (documented). Same threat model as `~/.filecap/secrets.json` and `sites.json`. | Tests: **576 passing** (up from 565 at beta.2; +11 new across the URL-scheme validation, the maxPages cap, and the rendered-HTML vertical-pan assertion). ### Notes - `siteEntrySchema` is now an exported binding from `src/commands/web-rollup.js` so the schema can be exercised in unit tests without round-tripping through a sites.json file. - The audit doc replaces the previously-pointed-at-but-missing `docs/security/audit-2026-05-13.md` reference in the README; the 2026-05-13 per-finding detail now lives only in the README + CHANGELOG (one source of truth) and the new 2026-05-19 doc covers the 1.8.0 surface from scratch. [1.8.0-beta.3]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.3 ## [1.8.0-beta.2] — 2026-05-19 ### Added - **Strapi v4 references adapter** (`src/references/strapi-v4.js`) extending the references pipeline to the four v4 sites in the fleet: dvfr-strapi-prod, r3-strapi-prod, i2i-strapi-prod, infonet-strapi-prod. Strapi v4 has a fundamentally different REST shape than v3 — `/api/` paths instead of `/`, `pagination[limit]=N&pagination[start]=N` query syntax instead of `_limit`/`_start`, and a wrapping `{data: [{id, attributes: {…}}]}` envelope around every entry, every relation, and every media item — so it required a parallel adapter rather than a tweak to the v3 module. With this release **9 of 9 (100%) of the Strapi sites in the audit fleet now contribute to the cross-site references index.** - **Field classifier extended to recognize v4 typed-media envelopes.** Strapi v4 wraps single-media references in `UploadFileEntityResponse` (`{data: {id, attributes: {url}}}`) and list-media references in `UploadFileRelationResponseCollection` (`{data: [{id, attributes: {url}}, …]}`). The shared classifier maps both new GraphQL type names back to the existing `upload-file` / `upload-file-list` kinds, so the same field-classification logic serves both v3 and v4; the v4 extractor peels the `.data.attributes.url` wrapper at extraction time. - **Kebab-case REST path fallback for Strapi v4** (`weeklyFaqs` → `/api/weekly-faqs` retry on 404). Strapi v4's REST `pluralName` is configured per content-type in `schema.json` and is not deterministically derivable from the GraphQL query name. Observed in the r3 fleet: `weeklyFaqs` 404s but `weekly-faqs` 200s, while sibling `v2Weeklyfaqs` works camelCase and 404s kebab. The v4 adapter now retries the very first request with the kebab-cased plural on 404 and pins whichever form works for subsequent paginated calls. 403 (Public-role permissions) is intentionally not retried — kebab won't change auth. - **Per-site `references` blocks added to sites.json** for the four v4 sites (graphqlEndpoint, restApiBase, siteFrontendUrl, sitemapUrl, contentTypeRoutes). Routes derived empirically from each site's `sitemap.xml`: - **dvfr.illinois.gov**: 23 `/meetings//`, 6 `/publications//`, plus posts, pages, faq. - **r3.illinois.gov**: news, faqs, page routes flat-rooted (no trailing slash, matches deployed Nuxt). - **i2i.illinois.gov**: announcements, biographies, cohorts, graduations, spotlights, pages — all with trailing slashes. - **infonet.icjia.illinois.gov**: news, faqs, resources, pages. ### v4 fleet extraction this release | Site | Content types | Records | With refs | | --- | --- | --- | --- | | dvfr-strapi-prod | 5 | 54 | 31 | | r3-strapi-prod | 7 (1× 403 forms) | 21 | ~10 | | i2i-strapi-prod | 7 (1× 403 forms) | 26 | ~12 | | infonet-strapi-prod | 5 (1× 403 forms) | 173 | varies | | **Total** | | **274** | | The 403s on `forms` content types across r3/i2i/infonet are Public-role permission denials and don't affect user-visible references — `form` content rarely carries PDF attachments. ### Strategy dispatch in references command `src/commands/references.js` now dispatches on `references.strategy` to either the v3 or v4 adapter via a small `STRATEGIES` map. Each adapter exposes the same four-function interface (`introspectContentTypes`, `introspectTypeFields`, `fetchAllEntries`, `extractEntryUrls`); `introspectTypeFields` is shared verbatim because the GraphQL `__type` introspection shape is identical between v3 and v4 (only the media envelope type names differ, and the classifier already understands both). Slug lookup is strategy-aware — v3 stores `entry.slug` flat, v4 nests it under `entry.attributes.slug`. ### Deferred to 1.8.0-beta.3 / stable - **Bearer-token auth for intranet-api-prod** — the only remaining Strapi backend that needs auth to read content. - **Git-repo extraction strategy** for the 7 `type:"git"` Nuxt static sites (vpp, ilheals, sfs, ari-summits 2017–2023). - **README pipeline section** for the new `scan → references → cross-references → rollup` flow. ### Verification - **564 tests passing** (up from 541 at beta.1; +23 new tests across v4 module, classifier extension, kebab fallback). - All 4 v4 sites extract end-to-end with kebab-case REST path fallback for irregular pluralName configurations. [1.8.0-beta.2]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.2 ## [1.8.0-beta.1] — 2026-05-19 ### Added - **Strapi-v3 references extraction extended to four more sites: spac-prod, researchhub-prod, ari-api-prod, ilfvcc-api-prod.** Combined with icjia-agency-prod (shipped in alpha.1) that's **5 of 9** Strapi sites in the audit fleet now contributing to the cross-site references index. The four added sites collectively emit ~1,300 sidecar records spanning publications, meetings, posts, biographies, councils, counties, events, programs, sections, articles, datasets, apps, and other content types. - **Schema-driven plural detection** for content types with irregular English plurals (`county → counties`, `policy → policies`, `biography → biographies`). Previously the orchestrator naively appended `s` to the singular form, which 404'd on irregular plurals and silently dropped the content type. The new implementation derives each plural from the schema's `*Connection` paginator field (Strapi exposes `xs` + `xsConnection` for every content type, so the plural is always discoverable), then pairs it back to a singular by reversing common pluralization rules. This pickup recovered **102 county entries** on ilfvcc-api-prod and dozens of policies / biographies on icjia-agency-prod that prior versions silently dropped. - **Kebab-case REST URL conversion** for camelCase content type names (e.g. `requiredForm` → `/required-forms`). Strapi v3's GraphQL keeps the field name camelCase but the REST endpoint kebab-cases it; without the conversion `requiredForms` 404'd. Fix recovered 21 RequiredForm entries on icjia-agency-prod. - **Per-site `references` blocks added to sites.json** for spac-prod, researchhub-prod, ari-api-prod, ilfvcc-api-prod (graphqlEndpoint, restApiBase, siteFrontendUrl, sitemapUrl, contentTypeRoutes). Each site's `contentTypeRoutes` was derived empirically by sampling the site's own `sitemap.xml` and matching slug patterns to content-type counts: - **spac.illinois.gov**: 191 `/publications/`, 43 `/meetings/`, 29 `/news/`, 3 `/about/` - **icjia.illinois.gov/researchhub/**: 249 `/articles/`, 5 `/datasets/`, 5 `/apps/` (legacy Research Hub backend feeds the same `/researchhub/` paths icjia-agency-prod publishes to) - **icjia.illinois.gov/adultredeploy/**: 125 `/about/`, 69 `/news/`, 56 `/resources/`, 25 `/sites/` (ARI sub-path served by its own backend) - **icjia.illinois.gov/ifvcc/**: 101 `/news/`, 100 `/counties/`, 24 `/circuits/` (Family Violence Coordinating Council) ### Cross-site coverage from this release's fleet run | Site | Entries augmented | With references | % | | --- | --- | --- | --- | | archive-prod | 1,849 | 909 | 49% | | icjia-agency-prod | 3,110 | 1,379 | 44% | | spac-prod | 501 | 61 | 12% | | **researchhub-prod** | 315 | **250** | **79%** | | ari-api-prod | 553 | 150 | 27% | | ilfvcc-api-prod | 420 | 112 | 27% | | **Total** | **6,748** | **2,861** | **42%** | researchhub-prod's 79% reflects its role as a file storage backend for icjia.illinois.gov publications — nearly four out of five files there are linked from a content page elsewhere in the fleet. ari-api-prod and ilfvcc-api-prod's 27% rates suggest the audit is surfacing many orphaned PDFs in those backends that staff can review for deletion. ### Deferred to 1.8.0-beta.2 / beta.3 - **Strapi v4 adapter for dvfr, r3, i2i, infonet** — these backends are Strapi v4, which has a fundamentally different REST shape (`/api/` paths, `pagination[limit]` syntax, and a wrapping `{data: [{id, attributes: {…}}]}` envelope around every entry, every relation, and every media item). The existing `strapi-v3.js` will not work on them; a parallel `strapi-v4.js` module is required. - **Bearer-token auth for intranet-api-prod** — extractor needs to inject `Authorization: Bearer ` reading from `~/.filecap/secrets.json` (the existing convention used by the scan step). - **Git-repo extraction strategy** for the 7 type:"git" Nuxt static sites (vpp, ilheals, sfs, ari-summits 2017–2023). Same URL-regex approach over markdown files in the cloned `/content/` directory. ### Verification - 541 tests passing (up from 539 at alpha.1). 2 new tests for irregular-plural detection. - End-to-end fleet run verified — 6 inventories augmented with cross-site references, no errors mid-run other than the pre-existing 403s on Strapi auth-restricted content types (build/form/test entries that the Public role isn't permitted to read; these are intentional and don't carry user-visible references). [1.8.0-beta.1]: https://github.com/ICJIA/filecap-cli/releases/tag/v1.8.0-beta.1 ## [1.8.0-alpha.1] — 2026-05-19 ### Added - **`Referenced` column on the per-file CSV and HTML reports.** Answers the single most frequent manager question — "Where is this PDF referenced on the site?" — without leaving the audit. Managers use the column as the inflection point for the delete-vs-keep decision: if a file has no known referrers, it can be removed; if it's linked from one or more live pages, the URL of each linking page surfaces directly in the cell. HTML view renders "Page 1, Page 2, …" anchor chips (URLs in hover-titles, opens in new tab). CSV view renders one full URL per line within a single multi-line cell so Excel/Google Sheets auto-hyperlink each row. - Cell semantics: `entry.references` undefined → empty cell (cross-references step not run); `[]` → muted "No references found" chip; populated → anchor chips. The empty-array state explicitly distinguishes "we looked and found none" from "we haven't looked yet." - **`filecap references ` subcommand.** Per-site reference extractor. For Strapi v3 sites it introspects the GraphQL schema to discover every content type, classifies each type's fields automatically (URL-suffix strings, body-style markdown strings, and `UploadFile` typed media), then paginates through every published entry via REST and extracts the union of file URLs found in those fields. Writes an NDJSON sidecar with one record per content entry. Schema-driven, so new content types added to a Strapi site are picked up by introspection without code changes. - **`filecap cross-references --sidecar ` subcommand.** Fleet-wide reverse-index resolver. Reads every site's sidecar into one URL → referrers map and walks an inventory NDJSON to attach `entry.references[]` to each file via canonical-URL match. This is what makes the archive site's report useful: archive files don't know their own referrers, but pages on icjia.illinois.gov, dvfr.illinois.gov, etc. point at them, and the resolver back-links those pages onto the archive's rows. - **Domain-alias resolution for the cross-site index.** Each site in sites.json can declare `domainAliases: ["backend.example.com"]` to cover alternate hosts that serve the same content as its `publicUrlBase`. The resolver collapses alias hosts onto the primary so a URL that appears as `archive.icjia-api.cloud/files/X.pdf` in CMS content matches the archive's inventory entry at `archive.icjia.cloud/files/X.pdf`. Without this, ~99% of archive-PDF references would silently fail to match because ICJIA's content overwhelmingly cites the backend host. - **`references` block on sites.json site entries** (`strategy`, `graphqlEndpoint`, `restApiBase`, `siteFrontendUrl`, `sitemapUrl`, `contentTypeRoutes`). Configured for `icjia-agency-prod` in this release; the eight other Strapi sites in the fleet (dvfr, r3, i2i, ari, spac, infonet, intranet, ilfvcc, researchhub) are planned for v1.8.0-beta. ### Design notes & verification - **Verified architecture, not speculative.** Before writing the extractor we probed `agency.icjia-api.cloud` against the live SPA at icjia.illinois.gov to confirm the approach. Two findings drove the design: - On a grant page (`2020-casa`), the rendered SPA's three file hrefs equalled exactly the three URLs extracted from the Strapi entry's `body` markdown via URL regex — perfect 1:1 match. Confirms body-field markdown extraction captures everything the rendered page links to. - On a publication page (`2025-ifvcc-strategic-plan-summary`), the rendered SPA had zero `` anchors — the download is driven by a Vuetify `