@apitap/core 1.0.0

package/dist/serve.js

@@ -0,0 +1,149 @@
+// src/serve.ts
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { readSkillFile } from './skill/store.js';
+import { replayEndpoint } from './replay/engine.js';
+import { AuthManager, getMachineId } from './auth/manager.js';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const APITAP_DIR = process.env.APITAP_DIR || join(homedir(), '.apitap');
+/**
+ * Build MCP tool definitions from a skill file's endpoints.
+ * Each endpoint becomes one tool named `domain_endpointId`.
+ */
+export function buildServeTools(skill) {
+    return skill.endpoints.map(ep => {
+        const properties = {};
+        const required = [];
+        // Path params → required
+        const pathParams = ep.path.match(/:([a-zA-Z_]+)/g);
+        if (pathParams) {
+            for (const raw of pathParams) {
+                const name = raw.slice(1);
+                properties[name] = { type: 'string', description: `Path parameter` };
+                required.push(name);
+            }
+        }
+        // Query params → optional with examples
+        for (const [key, val] of Object.entries(ep.queryParams)) {
+            properties[key] = {
+                type: 'string',
+                description: `Query param (example: ${val.example})`,
+            };
+        }
+        // Body variables → optional
+        if (ep.requestBody?.variables) {
+            for (const varPath of ep.requestBody.variables) {
+                properties[varPath] = {
+                    type: 'string',
+                    description: `Body variable`,
+                };
+            }
+        }
+        return {
+            name: `${skill.domain}_${ep.id}`,
+            description: `${ep.method} ${ep.path} on ${skill.domain}`,
+            endpointId: ep.id,
+            inputSchema: {
+                type: 'object',
+                properties,
+                required,
+            },
+        };
+    });
+}
+/**
+ * Create an MCP server that exposes a skill file's endpoints as tools.
+ * Each endpoint becomes a callable tool that delegates to the replay engine.
+ */
+export async function createServeServer(domain, options = {}) {
+    const skill = await readSkillFile(domain, options.skillsDir);
+    if (!skill) {
+        throw new Error(`No skill file found for "${domain}". Run: apitap capture ${domain}`);
+    }
+    if (skill.endpoints.length === 0) {
+        throw new Error(`Skill file for "${domain}" has no endpoints.`);
+    }
+    const tools = buildServeTools(skill);
+    // Load auth manager unless --no-auth
+    let authManager;
+    if (!options.noAuth) {
+        const machineId = await getMachineId();
+        authManager = new AuthManager(APITAP_DIR, machineId);
+    }
+    const server = new McpServer({
+        name: `apitap-serve-${domain}`,
+        version: '1.0.0',
+    });
+    // Register one tool per endpoint
+    for (const tool of tools) {
+        // Build zod schema from tool.inputSchema
+        const shape = {};
+        for (const [key, prop] of Object.entries(tool.inputSchema.properties)) {
+            const field = z.string().describe(prop.description);
+            shape[key] = tool.inputSchema.required.includes(key) ? field : field.optional();
+        }
+        const endpointId = tool.endpointId;
+        server.registerTool(tool.name, {
+            description: tool.description,
+            inputSchema: z.object(shape),
+            annotations: {
+                readOnlyHint: true,
+                openWorldHint: true,
+            },
+        }, async (args) => {
+            const endpoint = skill.endpoints.find(e => e.id === endpointId);
+            const savedHeaders = endpoint.headers;
+            try {
+                // Inject stored auth without mutating the shared skill object
+                if (authManager) {
+                    const hasStoredPlaceholder = Object.values(savedHeaders).some(v => v === '[stored]');
+                    if (hasStoredPlaceholder) {
+                        try {
+                            const storedAuth = await authManager.retrieve(domain);
+                            if (storedAuth) {
+                                endpoint.headers = { ...savedHeaders, [storedAuth.header]: storedAuth.value };
+                            }
+                        }
+                        catch {
+                            // Auth retrieval failed — proceed without
+                        }
+                    }
+                }
+                // Convert args to string params
+                const params = {};
+                for (const [k, v] of Object.entries(args)) {
+                    if (v !== undefined)
+                        params[k] = String(v);
+                }
+                const result = await replayEndpoint(skill, endpointId, {
+                    params,
+                    authManager,
+                    domain,
+                    _skipSsrfCheck: options._skipSsrfCheck,
+                });
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify({ status: result.status, data: result.data }),
+                        }],
+                };
+            }
+            catch (err) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: `Replay failed: ${err.message}`,
+                        }],
+                    isError: true,
+                };
+            }
+            finally {
+                // Restore original headers so [stored] placeholders remain for next call
+                endpoint.headers = savedHeaders;
+            }
+        });
+    }
+    return server;
+}
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,eAAe;AACf,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAaxE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAgB;IAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAC9B,MAAM,UAAU,GAA0D,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,yBAAyB;QACzB,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,UAAU,CAAC,GAAG,CAAC,GAAG;gBAChB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,yBAAyB,GAAG,CAAC,OAAO,GAAG;aACrD,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC/C,UAAU,CAAC,OAAO,CAAC,GAAG;oBACpB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,eAAe;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE;YACzD,UAAU,EAAE,EAAE,CAAC,EAAE;YACjB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,UAAU;gBACV,QAAQ;aACT;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,0BAA0B,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,qBAAqB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAErC,qCAAqC;IACrC,IAAI,WAAoC,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;QACvC,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,gBAAgB,MAAM,EAAE;QAC9B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,iCAAiC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,yCAAyC;QACzC,MAAM,KAAK,GAAiC,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5B,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,IAAI;aACpB;SACF,EACD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAE,CAAC;YACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC;YACtC,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;oBACrF,IAAI,oBAAoB,EAAE,CAAC;wBACzB,IAAI,CAAC;4BACH,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACtD,IAAI,UAAU,EAAE,CAAC;gCACf,QAAQ,CAAC,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;4BAChF,CAAC;wBACH,CAAC;wBAAC,MAAM,CAAC;4BACP,0CAA0C;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,SAAS;wBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE;oBACrD,MAAM;oBACN,WAAW;oBACX,MAAM;oBACN,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;yBACnE,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE;yBACtC,CAAC;oBACF,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,yEAAyE;gBACzE,QAAQ,CAAC,OAAO,GAAG,YAAY,CAAC;YAClC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/skill/generator.d.ts

@@ -0,0 +1,44 @@
+import type { CapturedExchange, SkillEndpoint, SkillFile, StoredAuth, OAuthConfig } from '../types.js';
+export interface GeneratorOptions {
+    enablePreview?: boolean;
+    scrub?: boolean;
+}
+export declare class SkillGenerator {
+    private endpoints;
+    private exchangeBodies;
+    private captureCount;
+    private filteredCount;
+    private baseUrl;
+    private extractedAuthList;
+    private options;
+    private captchaRisk;
+    private oauthConfig;
+    private oauthClientSecret;
+    private totalNetworkBytes;
+    /** Number of unique endpoints captured so far */
+    get endpointCount(): number;
+    constructor(options?: GeneratorOptions);
+    /** Add a captured exchange. Returns the new endpoint if first seen, null if duplicate. */
+    addExchange(exchange: CapturedExchange): SkillEndpoint | null;
+    /** Record a filtered-out request (for metadata tracking). */
+    recordFiltered(): void;
+    /** Get auth credentials extracted during capture. */
+    getExtractedAuth(): StoredAuth[];
+    /** Mark this domain as having captcha risk (detected during capture). */
+    setCaptchaRisk(detected: boolean): void;
+    /** Get detected OAuth configuration (non-secret, for skill file). */
+    getOAuthConfig(): OAuthConfig | null;
+    /** Get the client secret captured from OAuth traffic (for encrypted storage). */
+    getOAuthClientSecret(): string | undefined;
+    /** Check if any endpoint has refreshable tokens. */
+    private hasRefreshableTokens;
+    /** Get total network bytes seen during capture (all responses, before filtering). */
+    getTotalNetworkBytes(): number;
+    /** Add network bytes from a response that was filtered out (not added as exchange). */
+    addNetworkBytes(bytes: number): void;
+    /** Generate the complete skill file for a domain. */
+    toSkillFile(domain: string, options?: {
+        domBytes?: number;
+        totalRequests?: number;
+    }): SkillFile;
+}

package/dist/skill/generator.js

@@ -0,0 +1,419 @@
+import { scrubPII } from '../capture/scrubber.js';
+import { parameterizePath, cleanFrameworkPath } from '../capture/parameterize.js';
+import { detectPagination } from '../capture/pagination.js';
+import { detectBodyVariables } from '../capture/body-variables.js';
+import { isGraphQLEndpoint, parseGraphQLBody, extractOperationName, detectGraphQLVariables } from '../capture/graphql.js';
+import { detectRefreshableTokens } from '../capture/token-detector.js';
+import { isLikelyToken } from '../capture/entropy.js';
+import { isOAuthTokenRequest } from '../capture/oauth-detector.js';
+import { diffBodies } from '../capture/body-diff.js';
+const KEEP_HEADERS = new Set([
+    'authorization',
+    'content-type',
+    'accept',
+    'x-api-key',
+    'x-csrf-token',
+    'x-requested-with',
+]);
+const AUTH_HEADERS = new Set([
+    'authorization',
+    'x-api-key',
+]);
+function filterHeaders(headers) {
+    const filtered = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (KEEP_HEADERS.has(lower) || (lower.startsWith('x-') && !lower.startsWith('x-forwarded'))) {
+            filtered[key] = value;
+        }
+    }
+    return filtered;
+}
+function stripAuth(headers, entropyDetected) {
+    const stripped = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (AUTH_HEADERS.has(lower) || entropyDetected?.has(lower)) {
+            stripped[key] = '[stored]';
+        }
+        else {
+            stripped[key] = value;
+        }
+    }
+    return stripped;
+}
+/**
+ * Extract auth credentials from headers.
+ * Uses name-based matching for known auth headers, plus entropy-based
+ * detection for non-standard headers carrying high-entropy tokens.
+ *
+ * @returns [auth list, set of entropy-detected header names (lowercased)]
+ */
+function extractAuth(headers) {
+    const auth = [];
+    const entropyDetected = new Set();
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (lower === 'authorization' && value) {
+            auth.push({
+                type: value.toLowerCase().startsWith('bearer') ? 'bearer' : 'custom',
+                header: lower,
+                value,
+            });
+        }
+        else if (lower === 'x-api-key' && value) {
+            auth.push({ type: 'api-key', header: lower, value });
+        }
+        else if (!AUTH_HEADERS.has(lower) && value) {
+            // Entropy-based detection for non-standard headers
+            const classification = isLikelyToken(lower, value);
+            if (classification.isToken) {
+                auth.push({ type: 'custom', header: lower, value });
+                entropyDetected.add(lower);
+            }
+        }
+    }
+    return [auth, entropyDetected];
+}
+function generateEndpointId(method, parameterizedPath) {
+    // Clean framework noise for the ID (but not for the stored path)
+    let cleaned = cleanFrameworkPath(parameterizedPath);
+    // Split into segments, remove :param placeholders (they add no info to the ID)
+    const segments = cleaned.split('/').filter(s => s !== '' && !s.startsWith(':'));
+    const slug = segments.join('-').replace(/[^a-z0-9-]/gi, '').toLowerCase() || 'root';
+    return `${method.toLowerCase()}-${slug}`;
+}
+function detectResponseShape(body) {
+    try {
+        const parsed = JSON.parse(body);
+        if (Array.isArray(parsed)) {
+            const first = parsed[0];
+            return {
+                type: 'array',
+                fields: first && typeof first === 'object' && first !== null
+                    ? Object.keys(first)
+                    : undefined,
+            };
+        }
+        if (typeof parsed === 'object' && parsed !== null) {
+            return { type: 'object', fields: Object.keys(parsed) };
+        }
+        return { type: typeof parsed };
+    }
+    catch {
+        return { type: 'unknown' };
+    }
+}
+function truncatePreview(body, maxItems = 2) {
+    try {
+        const parsed = JSON.parse(body);
+        if (Array.isArray(parsed)) {
+            return parsed.slice(0, maxItems);
+        }
+        return parsed;
+    }
+    catch {
+        return body.slice(0, 500);
+    }
+}
+function extractQueryParams(url) {
+    const params = {};
+    for (const [key, value] of url.searchParams) {
+        params[key] = { type: 'string', example: value };
+    }
+    return params;
+}
+function scrubQueryParams(params) {
+    const scrubbed = {};
+    for (const [key, val] of Object.entries(params)) {
+        scrubbed[key] = { type: val.type, example: scrubPII(val.example) };
+    }
+    return scrubbed;
+}
+function scrubBody(body, doScrub) {
+    if (!doScrub)
+        return body;
+    if (typeof body === 'string') {
+        return scrubPII(body);
+    }
+    if (body && typeof body === 'object') {
+        const scrubbed = {};
+        for (const [key, value] of Object.entries(body)) {
+            if (typeof value === 'string') {
+                scrubbed[key] = scrubPII(value);
+            }
+            else if (value && typeof value === 'object') {
+                scrubbed[key] = scrubBody(value, doScrub);
+            }
+            else {
+                scrubbed[key] = value;
+            }
+        }
+        return scrubbed;
+    }
+    return body;
+}
+export class SkillGenerator {
+    endpoints = new Map();
+    exchangeBodies = new Map(); // v1.0: store bodies for cross-request diffing
+    captureCount = 0;
+    filteredCount = 0;
+    baseUrl = null;
+    extractedAuthList = [];
+    options;
+    captchaRisk = false;
+    oauthConfig = null;
+    oauthClientSecret;
+    totalNetworkBytes = 0; // v1.0: accumulate all response sizes
+    /** Number of unique endpoints captured so far */
+    get endpointCount() {
+        return this.endpoints.size;
+    }
+    constructor(options = {}) {
+        this.options = {
+            enablePreview: options.enablePreview ?? false,
+            scrub: options.scrub ?? true,
+        };
+    }
+    /** Add a captured exchange. Returns the new endpoint if first seen, null if duplicate. */
+    addExchange(exchange) {
+        this.captureCount++;
+        const url = new URL(exchange.request.url);
+        const method = exchange.request.method;
+        const contentType = exchange.request.headers['content-type'] ?? '';
+        // Track baseUrl from the first captured exchange
+        if (!this.baseUrl) {
+            this.baseUrl = url.origin;
+        }
+        // Check for GraphQL
+        const isGraphQL = isGraphQLEndpoint(url.pathname, contentType, exchange.request.postData ?? null);
+        let graphqlInfo = null;
+        if (isGraphQL && exchange.request.postData) {
+            const parsed = parseGraphQLBody(exchange.request.postData);
+            if (parsed) {
+                const opName = extractOperationName(parsed.query, parsed.operationName);
+                graphqlInfo = {
+                    operationName: opName,
+                    query: parsed.query,
+                    variables: parsed.variables,
+                };
+            }
+        }
+        // Parameterize path for dedup and storage
+        const paramPath = parameterizePath(url.pathname);
+        // Use framework-cleaned path for dedup key so _next/data routes with different build hashes collapse
+        const dedupPath = cleanFrameworkPath(paramPath);
+        // For GraphQL, dedup by operation name instead of path
+        const key = graphqlInfo
+            ? `${method} graphql:${graphqlInfo.operationName}`
+            : `${method} ${dedupPath}`;
+        // Track response bytes for all exchanges (for browser cost measurement)
+        this.totalNetworkBytes += exchange.response.body.length;
+        if (this.endpoints.has(key)) {
+            // Store duplicate body for cross-request diffing (Strategy 1)
+            if (exchange.request.postData) {
+                const bodies = this.exchangeBodies.get(key);
+                if (bodies)
+                    bodies.push(exchange.request.postData);
+            }
+            return null;
+        }
+        // Detect OAuth token requests from captured traffic
+        const oauthInfo = isOAuthTokenRequest(exchange.request);
+        if (oauthInfo && !this.oauthConfig) {
+            this.oauthConfig = {
+                tokenEndpoint: oauthInfo.tokenEndpoint,
+                clientId: oauthInfo.clientId,
+                grantType: oauthInfo.grantType,
+                ...(oauthInfo.scope ? { scope: oauthInfo.scope } : {}),
+            };
+            this.oauthClientSecret = oauthInfo.clientSecret;
+        }
+        // Extract auth before filtering headers (includes entropy-based detection)
+        const [auth, entropyDetected] = extractAuth(exchange.request.headers);
+        this.extractedAuthList.push(...auth);
+        // Filter headers, then strip auth values (including entropy-detected tokens)
+        const filtered = filterHeaders(exchange.request.headers);
+        const safeHeaders = stripAuth(filtered, entropyDetected);
+        // Build query params, optionally scrub PII
+        let queryParams = extractQueryParams(url);
+        if (this.options.scrub) {
+            queryParams = scrubQueryParams(queryParams);
+        }
+        // Build example URL, optionally scrub PII
+        let exampleUrl = exchange.request.url;
+        if (this.options.scrub) {
+            exampleUrl = scrubPII(exampleUrl);
+        }
+        // Response preview: null by default, populated with --preview
+        let responsePreview = null;
+        if (this.options.enablePreview) {
+            const preview = truncatePreview(exchange.response.body);
+            responsePreview = this.options.scrub && typeof preview === 'string'
+                ? scrubPII(preview)
+                : preview;
+        }
+        // Detect pagination patterns
+        const pagination = detectPagination(queryParams) ?? undefined;
+        // Process request body for POST/PUT/PATCH
+        let requestBody;
+        if (['POST', 'PUT', 'PATCH'].includes(method) && exchange.request.postData) {
+            const bodyContentType = exchange.request.headers['content-type'] ?? 'application/octet-stream';
+            const rawBody = exchange.request.postData;
+            if (bodyContentType.includes('json')) {
+                try {
+                    const parsed = JSON.parse(rawBody);
+                    const scrubbedTemplate = scrubBody(parsed, this.options.scrub);
+                    // For GraphQL, detect variables in the variables object specifically
+                    let variables;
+                    if (graphqlInfo && graphqlInfo.variables) {
+                        variables = detectGraphQLVariables(graphqlInfo.variables, 'variables');
+                    }
+                    else {
+                        variables = detectBodyVariables(parsed);
+                    }
+                    // Detect refreshable tokens (CSRF, nonces) for v0.8 auth refresh
+                    const refreshable = detectRefreshableTokens(parsed);
+                    requestBody = {
+                        contentType: 'application/json',
+                        template: scrubbedTemplate,
+                        ...(variables.length > 0 ? { variables } : {}),
+                        ...(refreshable.length > 0 ? { refreshableTokens: refreshable } : {}),
+                    };
+                }
+                catch {
+                    // Invalid JSON - store as string
+                    requestBody = {
+                        contentType: bodyContentType,
+                        template: this.options.scrub ? scrubPII(rawBody) : rawBody,
+                    };
+                }
+            }
+            else {
+                // Non-JSON body - store as string
+                requestBody = {
+                    contentType: bodyContentType,
+                    template: this.options.scrub ? scrubPII(rawBody) : rawBody,
+                };
+            }
+        }
+        // Generate endpoint ID - use GraphQL operation name if applicable
+        const endpointId = graphqlInfo
+            ? `${method.toLowerCase()}-graphql-${graphqlInfo.operationName}`
+            : generateEndpointId(method, paramPath);
+        const endpoint = {
+            id: endpointId,
+            method: exchange.request.method,
+            path: paramPath,
+            queryParams,
+            headers: safeHeaders,
+            responseShape: detectResponseShape(exchange.response.body),
+            examples: {
+                request: {
+                    url: exampleUrl,
+                    headers: stripAuth(filterHeaders(exchange.request.headers)),
+                },
+                responsePreview,
+            },
+            ...(pagination ? { pagination } : {}),
+            ...(requestBody ? { requestBody } : {}),
+        };
+        // Also strip entropy-detected tokens from example headers
+        if (entropyDetected.size > 0) {
+            endpoint.examples.request.headers = stripAuth(filterHeaders(exchange.request.headers), entropyDetected);
+        }
+        // Store response bytes on endpoint
+        endpoint.responseBytes = exchange.response.body.length;
+        this.endpoints.set(key, endpoint);
+        // Store first body for cross-request diffing
+        if (exchange.request.postData) {
+            this.exchangeBodies.set(key, [exchange.request.postData]);
+        }
+        return endpoint;
+    }
+    /** Record a filtered-out request (for metadata tracking). */
+    recordFiltered() {
+        this.filteredCount++;
+    }
+    /** Get auth credentials extracted during capture. */
+    getExtractedAuth() {
+        return this.extractedAuthList;
+    }
+    /** Mark this domain as having captcha risk (detected during capture). */
+    setCaptchaRisk(detected) {
+        this.captchaRisk = detected;
+    }
+    /** Get detected OAuth configuration (non-secret, for skill file). */
+    getOAuthConfig() {
+        return this.oauthConfig;
+    }
+    /** Get the client secret captured from OAuth traffic (for encrypted storage). */
+    getOAuthClientSecret() {
+        return this.oauthClientSecret;
+    }
+    /** Check if any endpoint has refreshable tokens. */
+    hasRefreshableTokens() {
+        for (const endpoint of this.endpoints.values()) {
+            if (endpoint.requestBody?.refreshableTokens?.length) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Get total network bytes seen during capture (all responses, before filtering). */
+    getTotalNetworkBytes() {
+        return this.totalNetworkBytes;
+    }
+    /** Add network bytes from a response that was filtered out (not added as exchange). */
+    addNetworkBytes(bytes) {
+        this.totalNetworkBytes += bytes;
+    }
+    /** Generate the complete skill file for a domain. */
+    toSkillFile(domain, options) {
+        // Apply cross-request diffing (Strategy 1) to endpoints with multiple bodies
+        for (const [key, bodies] of this.exchangeBodies) {
+            if (bodies.length < 2)
+                continue;
+            const endpoint = this.endpoints.get(key);
+            if (!endpoint?.requestBody)
+                continue;
+            const diffedVars = diffBodies(bodies);
+            if (diffedVars.length > 0) {
+                const existing = new Set(endpoint.requestBody.variables ?? []);
+                for (const v of diffedVars)
+                    existing.add(v);
+                endpoint.requestBody.variables = [...existing];
+            }
+        }
+        const skill = {
+            version: '1.2',
+            domain,
+            capturedAt: new Date().toISOString(),
+            baseUrl: this.baseUrl ?? `https://${domain}`,
+            endpoints: Array.from(this.endpoints.values()),
+            metadata: {
+                captureCount: this.captureCount,
+                filteredCount: this.filteredCount,
+                toolVersion: '1.0.0',
+                ...(options?.domBytes != null ? {
+                    browserCost: {
+                        domBytes: options.domBytes,
+                        totalNetworkBytes: this.totalNetworkBytes,
+                        totalRequests: options.totalRequests ?? this.captureCount + this.filteredCount,
+                    },
+                } : {}),
+            },
+            provenance: 'unsigned',
+        };
+        // Add auth config if captcha risk detected, refreshable tokens present, or OAuth detected
+        if (this.captchaRisk || this.hasRefreshableTokens() || this.oauthConfig) {
+            skill.auth = {
+                browserMode: this.captchaRisk ? 'visible' : 'headless',
+                captchaRisk: this.captchaRisk,
+                ...(this.oauthConfig ? { oauthConfig: this.oauthConfig } : {}),
+            };
+        }
+        return skill;
+    }
+}
+//# sourceMappingURL=generator.js.map

package/dist/skill/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/skill/generator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,cAAc;IACd,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,eAAe;IACf,WAAW;CACZ,CAAC,CAAC;AAOH,SAAS,aAAa,CAAC,OAA+B;IACpD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC5F,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,OAA+B,EAAE,eAA6B;IAC/E,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAA+B;IAClD,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACpE,MAAM,EAAE,KAAK;gBACb,KAAK;aACN,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAC7C,mDAAmD;YACnD,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,iBAAyB;IACnE,iEAAiE;IACjE,IAAI,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAEpD,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC;IACpF,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;oBAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAAQ,GAAG,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAyD;IAEzD,MAAM,QAAQ,GAAsD,EAAE,CAAC;IACvE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,OAAgB;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9C,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC,CAAC,+CAA+C;IAC7F,YAAY,GAAG,CAAC,CAAC;IACjB,aAAa,GAAG,CAAC,CAAC;IAClB,OAAO,GAAkB,IAAI,CAAC;IAC9B,iBAAiB,GAAiB,EAAE,CAAC;IACrC,OAAO,CAA6B;IACpC,WAAW,GAAG,KAAK,CAAC;IACpB,WAAW,GAAuB,IAAI,CAAC;IACvC,iBAAiB,CAAqB;IACtC,iBAAiB,GAAG,CAAC,CAAC,CAAC,sCAAsC;IAErE,iDAAiD;IACjD,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,WAAW,CAAC,QAA0B;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAEnE,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,CAAC;QAED,oBAAoB;QACpB,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QAClG,IAAI,WAAW,GAA+F,IAAI,CAAC;QAEnH,IAAI,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;gBACxE,WAAW,GAAG;oBACZ,aAAa,EAAE,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,qGAAqG;QACrG,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEhD,uDAAuD;QACvD,MAAM,GAAG,GAAG,WAAW;YACrB,CAAC,CAAC,GAAG,MAAM,YAAY,WAAW,CAAC,aAAa,EAAE;YAClD,CAAC,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;QAE7B,wEAAwE;QACxE,IAAI,CAAC,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAExD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG;gBACjB,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAC;QAClD,CAAC;QAED,2EAA2E;QAC3E,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAErC,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEzD,2CAA2C;QAC3C,IAAI,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvB,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,0CAA0C;QAC1C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvB,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,8DAA8D;QAC9D,IAAI,eAAe,GAAY,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,KAAK,QAAQ;gBACjE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnB,CAAC,CAAC,OAAO,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QAE9D,0CAA0C;QAC1C,IAAI,WAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3E,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;YAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAE1C,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACnC,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAA4B,CAAC;oBAE1F,qEAAqE;oBACrE,IAAI,SAAmB,CAAC;oBACxB,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;wBACzC,SAAS,GAAG,sBAAsB,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;oBACzE,CAAC;yBAAM,CAAC;wBACN,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;oBAC1C,CAAC;oBAED,iEAAiE;oBACjE,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;oBAEpD,WAAW,GAAG;wBACZ,WAAW,EAAE,kBAAkB;wBAC/B,QAAQ,EAAE,gBAAgB;wBAC1B,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC9C,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACtE,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;oBACjC,WAAW,GAAG;wBACZ,WAAW,EAAE,eAAe;wBAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;qBAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kCAAkC;gBAClC,WAAW,GAAG;oBACZ,WAAW,EAAE,eAAe;oBAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;iBAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,MAAM,UAAU,GAAG,WAAW;YAC5B,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,YAAY,WAAW,CAAC,aAAa,EAAE;YAChE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAkB;YAC9B,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YAC/B,IAAI,EAAE,SAAS;YACf,WAAW;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC1D,QAAQ,EAAE;gBACR,OAAO,EAAE;oBACP,GAAG,EAAE,UAAU;oBACf,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAC5D;gBACD,eAAe;aAChB;YACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QAEF,0DAA0D;QAC1D,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAC3C,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EACvC,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAEvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAElC,6CAA6C;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,cAAc;QACZ,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,qDAAqD;IACrD,gBAAgB;QACd,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,cAAc,CAAC,QAAiB;QAC9B,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,oDAAoD;IAC5C,oBAAoB;QAC1B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qFAAqF;IACrF,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,uFAAuF;IACvF,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAClC,CAAC;IAED,qDAAqD;IACrD,WAAW,CAAC,MAAc,EAAE,OAAuD;QACjF,6EAA6E;QAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,WAAW;gBAAE,SAAS;YAErC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,MAAM,CAAC,IAAI,UAAU;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC5C,QAAQ,CAAC,WAAW,CAAC,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK;YACd,MAAM;YACN,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,WAAW,MAAM,EAAE;YAC5C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC9C,QAAQ,EAAE;gBACR,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,OAAO;gBACpB,GAAG,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC;oBAC9B,WAAW,EAAE;wBACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;wBACzC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa;qBAC/E;iBACF,CAAC,CAAC,CAAC,EAAE,CAAC;aACR;YACD,UAAU,EAAE,UAAmB;SAChC,CAAC;QAEF,0FAA0F;QAC1F,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxE,KAAK,CAAC,IAAI,GAAG;gBACX,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;gBACtD,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/skill/importer.d.ts

@@ -0,0 +1,26 @@
+import type { SkillFile } from '../types.js';
+export interface ImportValidation {
+    valid: boolean;
+    reason?: string;
+    signatureStatus: 'valid' | 'invalid' | 'unsigned';
+    summary?: {
+        domain: string;
+        endpointCount: number;
+        baseUrl: string;
+    };
+}
+export interface ImportResult {
+    success: boolean;
+    reason?: string;
+    skillFile?: string;
+}
+/**
+ * Validate a skill file for import.
+ * Checks structure, SSRF safety, and signature integrity.
+ */
+export declare function validateImport(skill: SkillFile, localKey?: Buffer): ImportValidation;
+/**
+ * Import a skill file from disk.
+ * Validates, strips foreign signatures, sets provenance to 'imported'.
+ */
+export declare function importSkillFile(filePath: string, skillsDir?: string, localKey?: Buffer): Promise<ImportResult>;