@detiq/crawler 0.1.3

package/dist/custom-js-injector.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Custom JS injector — run user-provided JavaScript in the context of each crawled page.
+ *
+ * Use cases:
+ * - Extract custom data points not captured by standard extractors
+ * - Set localStorage/sessionStorage values before crawl
+ * - Override fetch() to intercept API calls
+ * - Simulate user events (keydown, focus, etc.)
+ * - Bypass specific anti-bot checks
+ *
+ * Security: scripts run in the page context (sandboxed by Chromium's renderer).
+ * They cannot access the Node.js process or file system.
+ * ZeTa validates scripts are strings before injection.
+ */
+import type { Page } from 'playwright';
+export interface JsInjectionOpts {
+    /** Script to run on every page BEFORE navigation (via page.addInitScript) */
+    initScript?: string;
+    /** Script to run on every page AFTER navigation completes (via page.evaluate) */
+    postLoadScript?: string;
+    /** Key-value pairs to set in localStorage before page load */
+    localStorage?: Record<string, string>;
+    /** Key-value pairs to set in sessionStorage before page load */
+    sessionStorage?: Record<string, string>;
+    /** Cookie key-value pairs to add before page load */
+    cookies?: Array<{
+        name: string;
+        value: string;
+        domain?: string;
+        path?: string;
+    }>;
+}
+export interface JsInjectionResult {
+    initScriptApplied: boolean;
+    postLoadResult: unknown;
+    storageSet: boolean;
+    cookiesSet: number;
+    error?: string;
+}
+export declare function injectCustomJs(page: Page, opts: JsInjectionOpts): Promise<JsInjectionResult>;
+/** Safe string validator — ensures script is a string, not an object/function reference */
+export declare function validateScript(script: unknown): string;

package/dist/custom-js-injector.js

@@ -0,0 +1,50 @@
+async function injectCustomJs(page, opts) {
+  const result = {
+    initScriptApplied: false,
+    postLoadResult: null,
+    storageSet: false,
+    cookiesSet: 0
+  };
+  if (opts.cookies?.length) {
+    try {
+      await page.context().addCookies(
+        opts.cookies.map((c) => ({ name: c.name, value: c.value, domain: c.domain ?? "", path: c.path ?? "/", url: page.url() || void 0 }))
+      );
+      result.cookiesSet = opts.cookies.length;
+    } catch (e) {
+      result.error = `Cookie injection failed: ${e.message}`;
+    }
+  }
+  if (opts.initScript || opts.localStorage || opts.sessionStorage) {
+    const storageSetup = [
+      opts.localStorage ? `Object.entries(${JSON.stringify(opts.localStorage)}).forEach(([k,v])=>localStorage.setItem(k,v));` : "",
+      opts.sessionStorage ? `Object.entries(${JSON.stringify(opts.sessionStorage)}).forEach(([k,v])=>sessionStorage.setItem(k,v));` : ""
+    ].filter(Boolean).join("\n");
+    const combinedInit = [storageSetup, opts.initScript ?? ""].filter(Boolean).join("\n");
+    try {
+      await page.addInitScript(combinedInit);
+      result.initScriptApplied = true;
+      result.storageSet = !!(opts.localStorage || opts.sessionStorage);
+    } catch (e) {
+      result.error = `Init script failed: ${e.message}`;
+    }
+  }
+  if (opts.postLoadScript) {
+    try {
+      result.postLoadResult = await page.evaluate(opts.postLoadScript);
+    } catch (e) {
+      result.error = `Post-load script failed: ${e.message}`;
+    }
+  }
+  return result;
+}
+function validateScript(script) {
+  if (typeof script !== "string") throw new Error("Script must be a string");
+  if (script.length > 5e4) throw new Error("Script too large (>50KB)");
+  return script;
+}
+export {
+  injectCustomJs,
+  validateScript
+};
+//# sourceMappingURL=custom-js-injector.js.map

package/dist/custom-js-injector.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/custom-js-injector.ts"],
+  "sourcesContent": ["/**\n * Custom JS injector \u2014 run user-provided JavaScript in the context of each crawled page.\n *\n * Use cases:\n * - Extract custom data points not captured by standard extractors\n * - Set localStorage/sessionStorage values before crawl\n * - Override fetch() to intercept API calls\n * - Simulate user events (keydown, focus, etc.)\n * - Bypass specific anti-bot checks\n *\n * Security: scripts run in the page context (sandboxed by Chromium's renderer).\n * They cannot access the Node.js process or file system.\n * ZeTa validates scripts are strings before injection.\n */\n\nimport type { Page } from 'playwright';\n\nexport interface JsInjectionOpts {\n  /** Script to run on every page BEFORE navigation (via page.addInitScript) */\n  initScript?: string;\n  /** Script to run on every page AFTER navigation completes (via page.evaluate) */\n  postLoadScript?: string;\n  /** Key-value pairs to set in localStorage before page load */\n  localStorage?: Record<string, string>;\n  /** Key-value pairs to set in sessionStorage before page load */\n  sessionStorage?: Record<string, string>;\n  /** Cookie key-value pairs to add before page load */\n  cookies?: Array<{ name: string; value: string; domain?: string; path?: string }>;\n}\n\nexport interface JsInjectionResult {\n  initScriptApplied: boolean;\n  postLoadResult: unknown;\n  storageSet: boolean;\n  cookiesSet: number;\n  error?: string;\n}\n\nexport async function injectCustomJs(page: Page, opts: JsInjectionOpts): Promise<JsInjectionResult> {\n  const result: JsInjectionResult = {\n    initScriptApplied: false,\n    postLoadResult: null,\n    storageSet: false,\n    cookiesSet: 0,\n  };\n\n  // Set cookies via Playwright context\n  if (opts.cookies?.length) {\n    try {\n      await page.context().addCookies(\n        opts.cookies.map(c => ({ name: c.name, value: c.value, domain: c.domain ?? '', path: c.path ?? '/', url: page.url() || undefined }))\n      );\n      result.cookiesSet = opts.cookies.length;\n    } catch (e: any) {\n      result.error = `Cookie injection failed: ${e.message}`;\n    }\n  }\n\n  // Init script (runs before page load on every navigation)\n  if (opts.initScript || opts.localStorage || opts.sessionStorage) {\n    const storageSetup = [\n      opts.localStorage ? `Object.entries(${JSON.stringify(opts.localStorage)}).forEach(([k,v])=>localStorage.setItem(k,v));` : '',\n      opts.sessionStorage ? `Object.entries(${JSON.stringify(opts.sessionStorage)}).forEach(([k,v])=>sessionStorage.setItem(k,v));` : '',\n    ].filter(Boolean).join('\\n');\n\n    const combinedInit = [storageSetup, opts.initScript ?? ''].filter(Boolean).join('\\n');\n    try {\n      await page.addInitScript(combinedInit);\n      result.initScriptApplied = true;\n      result.storageSet = !!(opts.localStorage || opts.sessionStorage);\n    } catch (e: any) {\n      result.error = `Init script failed: ${e.message}`;\n    }\n  }\n\n  // Post-load script (runs after navigation)\n  if (opts.postLoadScript) {\n    try {\n      result.postLoadResult = await page.evaluate(opts.postLoadScript);\n    } catch (e: any) {\n      result.error = `Post-load script failed: ${e.message}`;\n    }\n  }\n\n  return result;\n}\n\n/** Safe string validator \u2014 ensures script is a string, not an object/function reference */\nexport function validateScript(script: unknown): string {\n  if (typeof script !== 'string') throw new Error('Script must be a string');\n  if (script.length > 50_000) throw new Error('Script too large (>50KB)');\n  return script;\n}\n"],
+  "mappings": "AAsCA,eAAsB,eAAe,MAAY,MAAmD;AAClG,QAAM,SAA4B;AAAA,IAChC,mBAAmB;AAAA,IACnB,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AAGA,MAAI,KAAK,SAAS,QAAQ;AACxB,QAAI;AACF,YAAM,KAAK,QAAQ,EAAE;AAAA,QACnB,KAAK,QAAQ,IAAI,QAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,QAAQ,EAAE,UAAU,IAAI,MAAM,EAAE,QAAQ,KAAK,KAAK,KAAK,IAAI,KAAK,OAAU,EAAE;AAAA,MACrI;AACA,aAAO,aAAa,KAAK,QAAQ;AAAA,IACnC,SAAS,GAAQ;AACf,aAAO,QAAQ,4BAA4B,EAAE,OAAO;AAAA,IACtD;AAAA,EACF;AAGA,MAAI,KAAK,cAAc,KAAK,gBAAgB,KAAK,gBAAgB;AAC/D,UAAM,eAAe;AAAA,MACnB,KAAK,eAAe,kBAAkB,KAAK,UAAU,KAAK,YAAY,CAAC,mDAAmD;AAAA,MAC1H,KAAK,iBAAiB,kBAAkB,KAAK,UAAU,KAAK,cAAc,CAAC,qDAAqD;AAAA,IAClI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAE3B,UAAM,eAAe,CAAC,cAAc,KAAK,cAAc,EAAE,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACpF,QAAI;AACF,YAAM,KAAK,cAAc,YAAY;AACrC,aAAO,oBAAoB;AAC3B,aAAO,aAAa,CAAC,EAAE,KAAK,gBAAgB,KAAK;AAAA,IACnD,SAAS,GAAQ;AACf,aAAO,QAAQ,uBAAuB,EAAE,OAAO;AAAA,IACjD;AAAA,EACF;AAGA,MAAI,KAAK,gBAAgB;AACvB,QAAI;AACF,aAAO,iBAAiB,MAAM,KAAK,SAAS,KAAK,cAAc;AAAA,IACjE,SAAS,GAAQ;AACf,aAAO,QAAQ,4BAA4B,EAAE,OAAO;AAAA,IACtD;AAAA,EACF;AAEA,SAAO;AACT;AAGO,SAAS,eAAe,QAAyB;AACtD,MAAI,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,yBAAyB;AACzE,MAAI,OAAO,SAAS,IAAQ,OAAM,IAAI,MAAM,0BAA0B;AACtE,SAAO;AACT;",
+  "names": []
+}

package/dist/dark-mode-capture.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dark mode capture — screenshot pages in both light and dark color schemes.
+ *
+ * Uses Playwright's page.emulateMedia({ colorScheme: 'dark' }) to force dark mode,
+ * then captures a screenshot. Compares with light mode to determine if dark mode
+ * is supported (significant visual difference).
+ *
+ * Also detects prefers-color-scheme media query support in CSS.
+ */
+import type { Page } from 'playwright';
+export interface DarkModeCapture {
+    url: string;
+    lightScreenshot?: Buffer;
+    darkScreenshot?: Buffer;
+    hasDarkMode: boolean;
+    hasCssDarkMode: boolean;
+    backgroundColorLight?: string;
+    backgroundColorDark?: string;
+    capturedAt: string;
+}
+export declare function captureDarkMode(page: Page, url: string, opts?: {
+    takeScreenshots?: boolean;
+}): Promise<DarkModeCapture>;

package/dist/dark-mode-capture.js

@@ -0,0 +1,75 @@
+async function getBackgroundColor(page) {
+  try {
+    return await page.evaluate(() => {
+      const body = document.body;
+      return window.getComputedStyle(body).backgroundColor;
+    });
+  } catch {
+    return "unknown";
+  }
+}
+function colorsAreDifferent(a, b) {
+  if (a === b) return false;
+  if (a === "unknown" || b === "unknown") return false;
+  const parse = (c) => {
+    const m = c.match(/\d+/g);
+    return m ? m.map(Number) : [0, 0, 0];
+  };
+  const [ar, ag, ab] = parse(a);
+  const [br, bg, bb] = parse(b);
+  const lumA = 0.299 * ar + 0.587 * ag + 0.114 * ab;
+  const lumB = 0.299 * br + 0.587 * bg + 0.114 * bb;
+  return Math.abs(lumA - lumB) > 30;
+}
+async function hasCssDarkModeSupport(page) {
+  try {
+    return await page.evaluate(() => {
+      const sheets = Array.from(document.styleSheets);
+      for (const sheet of sheets) {
+        try {
+          const rules = Array.from(sheet.cssRules ?? []);
+          for (const rule of rules) {
+            if (rule instanceof CSSMediaRule && rule.conditionText?.includes("prefers-color-scheme")) {
+              return true;
+            }
+          }
+        } catch {
+        }
+      }
+      return false;
+    });
+  } catch {
+    return false;
+  }
+}
+async function captureDarkMode(page, url, opts = {}) {
+  const capturedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const { takeScreenshots = false } = opts;
+  await page.emulateMedia({ colorScheme: "light" }).catch(() => {
+  });
+  const backgroundColorLight = await getBackgroundColor(page);
+  const hasCssDark = await hasCssDarkModeSupport(page);
+  const lightScreenshot = takeScreenshots ? await page.screenshot({ type: "jpeg", quality: 60 }).catch(() => void 0) : void 0;
+  await page.emulateMedia({ colorScheme: "dark" }).catch(() => {
+  });
+  await page.waitForTimeout(300);
+  const backgroundColorDark = await getBackgroundColor(page);
+  const darkScreenshot = takeScreenshots ? await page.screenshot({ type: "jpeg", quality: 60 }).catch(() => void 0) : void 0;
+  await page.emulateMedia({ colorScheme: "light" }).catch(() => {
+  });
+  const hasDarkMode = colorsAreDifferent(backgroundColorLight, backgroundColorDark) || hasCssDark;
+  return {
+    url,
+    lightScreenshot,
+    darkScreenshot,
+    hasDarkMode,
+    hasCssDarkMode: hasCssDark,
+    backgroundColorLight,
+    backgroundColorDark,
+    capturedAt
+  };
+}
+export {
+  captureDarkMode
+};
+//# sourceMappingURL=dark-mode-capture.js.map

package/dist/dark-mode-capture.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/dark-mode-capture.ts"],
+  "sourcesContent": ["/**\n * Dark mode capture \u2014 screenshot pages in both light and dark color schemes.\n *\n * Uses Playwright's page.emulateMedia({ colorScheme: 'dark' }) to force dark mode,\n * then captures a screenshot. Compares with light mode to determine if dark mode\n * is supported (significant visual difference).\n *\n * Also detects prefers-color-scheme media query support in CSS.\n */\n\nimport type { Page } from 'playwright';\n\nexport interface DarkModeCapture {\n  url: string;\n  lightScreenshot?: Buffer;\n  darkScreenshot?: Buffer;\n  hasDarkMode: boolean;\n  hasCssDarkMode: boolean; // @media (prefers-color-scheme: dark) detected in stylesheets\n  backgroundColorLight?: string;\n  backgroundColorDark?: string;\n  capturedAt: string;\n}\n\nasync function getBackgroundColor(page: Page): Promise<string> {\n  try {\n    return await page.evaluate(() => {\n      const body = document.body;\n      return window.getComputedStyle(body).backgroundColor;\n    });\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction colorsAreDifferent(a: string, b: string): boolean {\n  if (a === b) return false;\n  if (a === 'unknown' || b === 'unknown') return false;\n  // Parse rgb(r, g, b) and compare luminance\n  const parse = (c: string) => {\n    const m = c.match(/\\d+/g);\n    return m ? m.map(Number) : [0, 0, 0];\n  };\n  const [ar, ag, ab] = parse(a);\n  const [br, bg, bb] = parse(b);\n  const lumA = 0.299 * ar + 0.587 * ag + 0.114 * ab;\n  const lumB = 0.299 * br + 0.587 * bg + 0.114 * bb;\n  return Math.abs(lumA - lumB) > 30; // significant luminance difference\n}\n\nasync function hasCssDarkModeSupport(page: Page): Promise<boolean> {\n  try {\n    return await page.evaluate(() => {\n      const sheets = Array.from(document.styleSheets);\n      for (const sheet of sheets) {\n        try {\n          const rules = Array.from(sheet.cssRules ?? []);\n          for (const rule of rules) {\n            if (rule instanceof CSSMediaRule && rule.conditionText?.includes('prefers-color-scheme')) {\n              return true;\n            }\n          }\n        } catch { /* cross-origin stylesheet \u2014 skip */ }\n      }\n      return false;\n    });\n  } catch {\n    return false;\n  }\n}\n\nexport async function captureDarkMode(\n  page: Page,\n  url: string,\n  opts: { takeScreenshots?: boolean } = {},\n): Promise<DarkModeCapture> {\n  const capturedAt = new Date().toISOString();\n  const { takeScreenshots = false } = opts;\n\n  // Light mode\n  await page.emulateMedia({ colorScheme: 'light' }).catch(() => {});\n  const backgroundColorLight = await getBackgroundColor(page);\n  const hasCssDark = await hasCssDarkModeSupport(page);\n  const lightScreenshot = takeScreenshots\n    ? await page.screenshot({ type: 'jpeg', quality: 60 }).catch(() => undefined)\n    : undefined;\n\n  // Dark mode\n  await page.emulateMedia({ colorScheme: 'dark' }).catch(() => {});\n  await page.waitForTimeout(300); // allow CSS transitions\n  const backgroundColorDark = await getBackgroundColor(page);\n  const darkScreenshot = takeScreenshots\n    ? await page.screenshot({ type: 'jpeg', quality: 60 }).catch(() => undefined)\n    : undefined;\n\n  // Restore light mode\n  await page.emulateMedia({ colorScheme: 'light' }).catch(() => {});\n\n  const hasDarkMode = colorsAreDifferent(backgroundColorLight, backgroundColorDark) || hasCssDark;\n\n  return {\n    url,\n    lightScreenshot,\n    darkScreenshot,\n    hasDarkMode,\n    hasCssDarkMode: hasCssDark,\n    backgroundColorLight,\n    backgroundColorDark,\n    capturedAt,\n  };\n}\n"],
+  "mappings": "AAuBA,eAAe,mBAAmB,MAA6B;AAC7D,MAAI;AACF,WAAO,MAAM,KAAK,SAAS,MAAM;AAC/B,YAAM,OAAO,SAAS;AACtB,aAAO,OAAO,iBAAiB,IAAI,EAAE;AAAA,IACvC,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,GAAW,GAAoB;AACzD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM,aAAa,MAAM,UAAW,QAAO;AAE/C,QAAM,QAAQ,CAAC,MAAc;AAC3B,UAAM,IAAI,EAAE,MAAM,MAAM;AACxB,WAAO,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC;AAAA,EACrC;AACA,QAAM,CAAC,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC;AAC5B,QAAM,CAAC,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC;AAC5B,QAAM,OAAO,QAAQ,KAAK,QAAQ,KAAK,QAAQ;AAC/C,QAAM,OAAO,QAAQ,KAAK,QAAQ,KAAK,QAAQ;AAC/C,SAAO,KAAK,IAAI,OAAO,IAAI,IAAI;AACjC;AAEA,eAAe,sBAAsB,MAA8B;AACjE,MAAI;AACF,WAAO,MAAM,KAAK,SAAS,MAAM;AAC/B,YAAM,SAAS,MAAM,KAAK,SAAS,WAAW;AAC9C,iBAAW,SAAS,QAAQ;AAC1B,YAAI;AACF,gBAAM,QAAQ,MAAM,KAAK,MAAM,YAAY,CAAC,CAAC;AAC7C,qBAAW,QAAQ,OAAO;AACxB,gBAAI,gBAAgB,gBAAgB,KAAK,eAAe,SAAS,sBAAsB,GAAG;AACxF,qBAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAAuC;AAAA,MACjD;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,gBACpB,MACA,KACA,OAAsC,CAAC,GACb;AAC1B,QAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,QAAM,EAAE,kBAAkB,MAAM,IAAI;AAGpC,QAAM,KAAK,aAAa,EAAE,aAAa,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAChE,QAAM,uBAAuB,MAAM,mBAAmB,IAAI;AAC1D,QAAM,aAAa,MAAM,sBAAsB,IAAI;AACnD,QAAM,kBAAkB,kBACpB,MAAM,KAAK,WAAW,EAAE,MAAM,QAAQ,SAAS,GAAG,CAAC,EAAE,MAAM,MAAM,MAAS,IAC1E;AAGJ,QAAM,KAAK,aAAa,EAAE,aAAa,OAAO,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAC/D,QAAM,KAAK,eAAe,GAAG;AAC7B,QAAM,sBAAsB,MAAM,mBAAmB,IAAI;AACzD,QAAM,iBAAiB,kBACnB,MAAM,KAAK,WAAW,EAAE,MAAM,QAAQ,SAAS,GAAG,CAAC,EAAE,MAAM,MAAM,MAAS,IAC1E;AAGJ,QAAM,KAAK,aAAa,EAAE,aAAa,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAEhE,QAAM,cAAc,mBAAmB,sBAAsB,mBAAmB,KAAK;AAErF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/dead-link-detector.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Dead link detector — tracks broken links discovered during crawl.
+ *
+ * A "dead link" is a URL that:
+ * - Returns 404, 410, or other 4xx/5xx responses
+ * - Times out after maxRetries
+ * - Redirects to an error page (detected by title heuristic)
+ *
+ * Results: list of broken links with source page, status code, and anchor text.
+ * Used for: SEO audit export, test report enrichment.
+ */
+export interface DeadLink {
+    url: string;
+    statusCode: number;
+    sourceUrl?: string;
+    anchorText?: string;
+    checkedAt: string;
+    reason: 'http-error' | 'timeout' | 'dns-error';
+}
+export declare class DeadLinkTracker {
+    private deadLinks;
+    private checked;
+    record(url: string, statusCode: number, source?: {
+        sourceUrl?: string;
+        anchorText?: string;
+    }): void;
+    recordTimeout(url: string, sourceUrl?: string): void;
+    getDeadLinks(): DeadLink[];
+    isKnownBroken(url: string): boolean;
+    stats(): {
+        total: number;
+        by404: number;
+        by5xx: number;
+        byTimeout: number;
+    };
+    toCsv(): string;
+}

package/dist/dead-link-detector.js

@@ -0,0 +1,50 @@
+class DeadLinkTracker {
+  deadLinks = [];
+  checked = /* @__PURE__ */ new Map();
+  // url → statusCode
+  record(url, statusCode, source) {
+    if (this.checked.has(url)) return;
+    this.checked.set(url, statusCode);
+    if (statusCode >= 400) {
+      this.deadLinks.push({
+        url,
+        statusCode,
+        sourceUrl: source?.sourceUrl,
+        anchorText: source?.anchorText,
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        reason: statusCode === 0 ? "timeout" : "http-error"
+      });
+    }
+  }
+  recordTimeout(url, sourceUrl) {
+    if (this.checked.has(url)) return;
+    this.checked.set(url, 0);
+    this.deadLinks.push({ url, statusCode: 0, sourceUrl, checkedAt: (/* @__PURE__ */ new Date()).toISOString(), reason: "timeout" });
+  }
+  getDeadLinks() {
+    return [...this.deadLinks];
+  }
+  isKnownBroken(url) {
+    const code = this.checked.get(url);
+    return code !== void 0 && code >= 400;
+  }
+  stats() {
+    return {
+      total: this.deadLinks.length,
+      by404: this.deadLinks.filter((l) => l.statusCode === 404).length,
+      by5xx: this.deadLinks.filter((l) => l.statusCode >= 500).length,
+      byTimeout: this.deadLinks.filter((l) => l.reason === "timeout").length
+    };
+  }
+  toCsv() {
+    const rows = [["URL", "Status", "Source URL", "Anchor Text", "Checked At"]];
+    for (const l of this.deadLinks) {
+      rows.push([l.url, String(l.statusCode), l.sourceUrl ?? "", l.anchorText ?? "", l.checkedAt]);
+    }
+    return rows.map((r) => r.map((c) => `"${c.replace(/"/g, '""')}"`).join(",")).join("\n");
+  }
+}
+export {
+  DeadLinkTracker
+};
+//# sourceMappingURL=dead-link-detector.js.map

package/dist/dead-link-detector.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/dead-link-detector.ts"],
+  "sourcesContent": ["/**\n * Dead link detector \u2014 tracks broken links discovered during crawl.\n *\n * A \"dead link\" is a URL that:\n * - Returns 404, 410, or other 4xx/5xx responses\n * - Times out after maxRetries\n * - Redirects to an error page (detected by title heuristic)\n *\n * Results: list of broken links with source page, status code, and anchor text.\n * Used for: SEO audit export, test report enrichment.\n */\n\nexport interface DeadLink {\n  url: string;\n  statusCode: number;\n  sourceUrl?: string;\n  anchorText?: string;\n  checkedAt: string;\n  reason: 'http-error' | 'timeout' | 'dns-error';\n}\n\nexport class DeadLinkTracker {\n  private deadLinks: DeadLink[] = [];\n  private checked = new Map<string, number>(); // url \u2192 statusCode\n\n  record(\n    url: string,\n    statusCode: number,\n    source?: { sourceUrl?: string; anchorText?: string },\n  ): void {\n    if (this.checked.has(url)) return;\n    this.checked.set(url, statusCode);\n    if (statusCode >= 400) {\n      this.deadLinks.push({\n        url,\n        statusCode,\n        sourceUrl: source?.sourceUrl,\n        anchorText: source?.anchorText,\n        checkedAt: new Date().toISOString(),\n        reason: statusCode === 0 ? 'timeout' : 'http-error',\n      });\n    }\n  }\n\n  recordTimeout(url: string, sourceUrl?: string): void {\n    if (this.checked.has(url)) return;\n    this.checked.set(url, 0);\n    this.deadLinks.push({ url, statusCode: 0, sourceUrl, checkedAt: new Date().toISOString(), reason: 'timeout' });\n  }\n\n  getDeadLinks(): DeadLink[] {\n    return [...this.deadLinks];\n  }\n\n  isKnownBroken(url: string): boolean {\n    const code = this.checked.get(url);\n    return code !== undefined && code >= 400;\n  }\n\n  stats(): { total: number; by404: number; by5xx: number; byTimeout: number } {\n    return {\n      total: this.deadLinks.length,\n      by404: this.deadLinks.filter(l => l.statusCode === 404).length,\n      by5xx: this.deadLinks.filter(l => l.statusCode >= 500).length,\n      byTimeout: this.deadLinks.filter(l => l.reason === 'timeout').length,\n    };\n  }\n\n  toCsv(): string {\n    const rows = [['URL', 'Status', 'Source URL', 'Anchor Text', 'Checked At']];\n    for (const l of this.deadLinks) {\n      rows.push([l.url, String(l.statusCode), l.sourceUrl ?? '', l.anchorText ?? '', l.checkedAt]);\n    }\n    return rows.map(r => r.map(c => `\"${c.replace(/\"/g, '\"\"')}\"`).join(',')).join('\\n');\n  }\n}\n"],
+  "mappings": "AAqBO,MAAM,gBAAgB;AAAA,EACnB,YAAwB,CAAC;AAAA,EACzB,UAAU,oBAAI,IAAoB;AAAA;AAAA,EAE1C,OACE,KACA,YACA,QACM;AACN,QAAI,KAAK,QAAQ,IAAI,GAAG,EAAG;AAC3B,SAAK,QAAQ,IAAI,KAAK,UAAU;AAChC,QAAI,cAAc,KAAK;AACrB,WAAK,UAAU,KAAK;AAAA,QAClB;AAAA,QACA;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,YAAY,QAAQ;AAAA,QACpB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,QAAQ,eAAe,IAAI,YAAY;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,cAAc,KAAa,WAA0B;AACnD,QAAI,KAAK,QAAQ,IAAI,GAAG,EAAG;AAC3B,SAAK,QAAQ,IAAI,KAAK,CAAC;AACvB,SAAK,UAAU,KAAK,EAAE,KAAK,YAAY,GAAG,WAAW,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,QAAQ,UAAU,CAAC;AAAA,EAC/G;AAAA,EAEA,eAA2B;AACzB,WAAO,CAAC,GAAG,KAAK,SAAS;AAAA,EAC3B;AAAA,EAEA,cAAc,KAAsB;AAClC,UAAM,OAAO,KAAK,QAAQ,IAAI,GAAG;AACjC,WAAO,SAAS,UAAa,QAAQ;AAAA,EACvC;AAAA,EAEA,QAA4E;AAC1E,WAAO;AAAA,MACL,OAAO,KAAK,UAAU;AAAA,MACtB,OAAO,KAAK,UAAU,OAAO,OAAK,EAAE,eAAe,GAAG,EAAE;AAAA,MACxD,OAAO,KAAK,UAAU,OAAO,OAAK,EAAE,cAAc,GAAG,EAAE;AAAA,MACvD,WAAW,KAAK,UAAU,OAAO,OAAK,EAAE,WAAW,SAAS,EAAE;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,QAAgB;AACd,UAAM,OAAO,CAAC,CAAC,OAAO,UAAU,cAAc,eAAe,YAAY,CAAC;AAC1E,eAAW,KAAK,KAAK,WAAW;AAC9B,WAAK,KAAK,CAAC,EAAE,KAAK,OAAO,EAAE,UAAU,GAAG,EAAE,aAAa,IAAI,EAAE,cAAc,IAAI,EAAE,SAAS,CAAC;AAAA,IAC7F;AACA,WAAO,KAAK,IAAI,OAAK,EAAE,IAAI,OAAK,IAAI,EAAE,QAAQ,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,EACpF;AACF;",
+  "names": []
+}

package/dist/element-hash.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Compute a stable fingerprint of a screen's element set.
+ * Sorted so insertion-order changes (React re-renders) don't produce false positives.
+ * Returns first 16 hex chars of SHA-256.
+ */
+export declare function computeElementHash(elements: Array<{
+    role: string;
+    meaning: string;
+}>): string;

package/dist/element-hash.js

@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+function computeElementHash(elements) {
+  const pairs = elements.map((e) => `${e.role.toLowerCase()}:${e.meaning.toLowerCase().trim()}`).sort().join("|");
+  return createHash("sha256").update(pairs).digest("hex").slice(0, 16);
+}
+export {
+  computeElementHash
+};
+//# sourceMappingURL=element-hash.js.map

package/dist/element-hash.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/element-hash.ts"],
+  "sourcesContent": ["import { createHash } from 'node:crypto';\n\n/**\n * Compute a stable fingerprint of a screen's element set.\n * Sorted so insertion-order changes (React re-renders) don't produce false positives.\n * Returns first 16 hex chars of SHA-256.\n */\nexport function computeElementHash(\n  elements: Array<{ role: string; meaning: string }>,\n): string {\n  const pairs = elements\n    .map((e) => `${e.role.toLowerCase()}:${e.meaning.toLowerCase().trim()}`)\n    .sort()\n    .join('|');\n  return createHash('sha256').update(pairs).digest('hex').slice(0, 16);\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAOpB,SAAS,mBACd,UACQ;AACR,QAAM,QAAQ,SACX,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,YAAY,CAAC,IAAI,EAAE,QAAQ,YAAY,EAAE,KAAK,CAAC,EAAE,EACtE,KAAK,EACL,KAAK,GAAG;AACX,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrE;",
+  "names": []
+}

package/dist/email-otp.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Email OTP retrieval — supports 3 providers:
+ *   mailslurp  — managed SaaS (existing, no self-hosting)
+ *   imap       — any real IMAP mailbox (Gmail, Outlook, custom domain catch-all)
+ *   mailpit    — self-hosted SMTP trap (dev/staging only)
+ *
+ * Use mailslurp or imap for production apps.
+ * Use mailpit only when you can point the app's SMTP at the trap server.
+ */
+export type EmailOTPProvider = 'mailslurp' | 'imap' | 'mailpit';
+export interface EmailContent {
+    /** 4-8 digit OTP code, if found. */
+    otp?: string;
+    /** Magic link URL to navigate to, if found. */
+    magicLink?: string;
+}
+export interface EmailOTPConfig {
+    provider: EmailOTPProvider;
+    apiKey?: string;
+    inboxId?: string;
+    imapHost?: string;
+    imapPort?: number;
+    imapUser?: string;
+    imapPass?: string;
+    imapTls?: boolean;
+    mailpitBaseUrl?: string;
+}
+/**
+ * Wait for an email and return its OTP code or magic link URL.
+ * Prefer this over waitForEmailOTP when the app may send passwordless magic links.
+ */
+export declare function waitForEmailContent(config: EmailOTPConfig, since: string | Date): Promise<EmailContent | null>;
+/**
+ * Wait for an OTP email and extract the code.
+ * @deprecated Use waitForEmailContent which also handles magic links.
+ */
+export declare function waitForEmailOTP(config: EmailOTPConfig, since: string | Date): Promise<string | null>;
+/**
+ * Get the email address for a MailSlurp inbox (used to display in UI).
+ * Returns null for IMAP/Mailpit providers — use imapUser directly.
+ */
+export declare function getInboxEmail(configOrApiKey: EmailOTPConfig | string, inboxId?: string): Promise<string | null>;

package/dist/email-otp.js

@@ -0,0 +1,177 @@
+const POLL_INTERVAL_MS = 2e3;
+const MAX_WAIT_MS = 6e4;
+function extractOTP(text) {
+  const m6 = text.match(/\b(\d{6})\b/);
+  if (m6) return m6[1];
+  const m48 = text.match(/\b(\d{4,8})\b/);
+  if (m48) return m48[1];
+  const magic = text.match(/\b([A-Z0-9]{6,10})\b/);
+  if (magic) return magic[1];
+  return null;
+}
+function extractMagicLink(text) {
+  const magicPath = /\/(verify|magic|login|auth|confirm|sign-in)[/?#]/i;
+  const magicQuery = /[?&](token|magic_token|login_token|auth_token|key)=/i;
+  const urlMatches = text.match(/https:\/\/[^\s<>"')\]]+/g);
+  if (!urlMatches) return null;
+  for (const raw of urlMatches) {
+    try {
+      const u = new URL(raw.replace(/[>'")\].,]+$/, ""));
+      if (magicPath.test(u.pathname) || magicQuery.test(u.search)) return u.toString();
+    } catch {
+    }
+  }
+  return null;
+}
+function parseEmailContent(text) {
+  const magicLink = extractMagicLink(text);
+  if (magicLink) return { magicLink };
+  const otp = extractOTP(text);
+  if (otp) return { otp };
+  return {};
+}
+const MAILSLURP_BASE = "https://api.mailslurp.com";
+async function waitForContentMailSlurp(apiKey, inboxId, since) {
+  const deadline = Date.now() + MAX_WAIT_MS;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const listRes = await fetch(
+        `${MAILSLURP_BASE}/inboxes/${inboxId}/emails?sort=DESC&limit=5&since=${encodeURIComponent(since)}`,
+        { headers: { "x-api-key": apiKey } }
+      );
+      if (!listRes.ok) continue;
+      const emails = await listRes.json();
+      if (!emails.length) continue;
+      const bodyRes = await fetch(`${MAILSLURP_BASE}/emails/${emails[0].id}`, { headers: { "x-api-key": apiKey } });
+      if (!bodyRes.ok) continue;
+      const email = await bodyRes.json();
+      const content = parseEmailContent((email.body ?? "") + " " + (email.subject ?? ""));
+      if (content.otp || content.magicLink) return content;
+    } catch {
+    }
+  }
+  return null;
+}
+async function getInboxEmailMailSlurp(apiKey, inboxId) {
+  try {
+    const res = await fetch(`${MAILSLURP_BASE}/inboxes/${inboxId}`, { headers: { "x-api-key": apiKey } });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.emailAddress ?? null;
+  } catch {
+    return null;
+  }
+}
+async function waitForContentMailpit(baseUrl, since) {
+  const deadline = Date.now() + MAX_WAIT_MS;
+  const sinceMs = since.getTime();
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const res = await fetch(`${baseUrl}/api/v1/messages?limit=10`);
+      if (!res.ok) continue;
+      const data = await res.json();
+      const recent = (data.messages ?? []).filter((m) => new Date(m.Created).getTime() > sinceMs);
+      for (const msg of recent) {
+        const snippet = parseEmailContent(msg.Snippet + " " + msg.Subject);
+        if (snippet.otp || snippet.magicLink) return snippet;
+        const bodyRes = await fetch(`${baseUrl}/api/v1/message/${msg.ID}`);
+        if (!bodyRes.ok) continue;
+        const body = await bodyRes.json();
+        const full = parseEmailContent((body.Text?.Body ?? "") + " " + (body.Subject ?? ""));
+        if (full.otp || full.magicLink) return full;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function waitForContentImap(cfg, since) {
+  let ImapFlow;
+  try {
+    const mod = await import("imapflow");
+    ImapFlow = mod.ImapFlow;
+  } catch {
+    throw new Error("IMAP provider requires imapflow package. Add it to dependencies.");
+  }
+  const client = new ImapFlow({
+    host: cfg.host,
+    port: cfg.port,
+    secure: cfg.tls,
+    auth: { user: cfg.user, pass: cfg.pass },
+    logger: false
+  });
+  try {
+    await client.connect();
+    const lock = await client.getMailboxLock("INBOX");
+    try {
+      const deadline = Date.now() + MAX_WAIT_MS;
+      while (Date.now() < deadline) {
+        const uids = await client.search({ seen: false, since });
+        if (uids.length) {
+          for await (const msg of client.fetch(uids.slice(-5), { source: true })) {
+            const { simpleParser } = await import("mailparser");
+            const parsed = await simpleParser(msg.source);
+            const text = (parsed.text ?? "") + " " + (parsed.subject ?? "");
+            const content = parseEmailContent(text);
+            if (content.otp || content.magicLink) return content;
+          }
+        }
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+      }
+      return null;
+    } finally {
+      lock.release();
+    }
+  } finally {
+    await client.logout().catch(() => {
+    });
+  }
+}
+async function waitForEmailContent(config, since) {
+  const sinceStr = typeof since === "string" ? since : since.toISOString();
+  const sinceDate = typeof since === "string" ? new Date(since) : since;
+  switch (config.provider) {
+    case "mailslurp":
+      if (!config.apiKey || !config.inboxId) throw new Error("mailslurp requires apiKey + inboxId");
+      return waitForContentMailSlurp(config.apiKey, config.inboxId, sinceStr);
+    case "mailpit":
+      return waitForContentMailpit(config.mailpitBaseUrl ?? "http://mailpit:8025", sinceDate);
+    case "imap":
+      if (!config.imapHost || !config.imapUser || !config.imapPass) {
+        throw new Error("imap requires imapHost, imapUser, imapPass");
+      }
+      return waitForContentImap({
+        host: config.imapHost,
+        port: config.imapPort ?? 993,
+        user: config.imapUser,
+        pass: config.imapPass,
+        tls: config.imapTls !== false
+      }, sinceDate);
+    default:
+      return null;
+  }
+}
+async function waitForEmailOTP(config, since) {
+  const content = await waitForEmailContent(config, since);
+  return content?.otp ?? null;
+}
+async function getInboxEmail(configOrApiKey, inboxId) {
+  if (typeof configOrApiKey === "string") {
+    return getInboxEmailMailSlurp(configOrApiKey, inboxId ?? "");
+  }
+  if (configOrApiKey.provider === "mailslurp" && configOrApiKey.apiKey && configOrApiKey.inboxId) {
+    return getInboxEmailMailSlurp(configOrApiKey.apiKey, configOrApiKey.inboxId);
+  }
+  if (configOrApiKey.provider === "imap") {
+    return configOrApiKey.imapUser ?? null;
+  }
+  return null;
+}
+export {
+  getInboxEmail,
+  waitForEmailContent,
+  waitForEmailOTP
+};
+//# sourceMappingURL=email-otp.js.map

package/dist/email-otp.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/email-otp.ts"],
+  "sourcesContent": ["/**\n * Email OTP retrieval \u2014 supports 3 providers:\n *   mailslurp  \u2014 managed SaaS (existing, no self-hosting)\n *   imap       \u2014 any real IMAP mailbox (Gmail, Outlook, custom domain catch-all)\n *   mailpit    \u2014 self-hosted SMTP trap (dev/staging only)\n *\n * Use mailslurp or imap for production apps.\n * Use mailpit only when you can point the app's SMTP at the trap server.\n */\n\nexport type EmailOTPProvider = 'mailslurp' | 'imap' | 'mailpit';\n\nexport interface EmailContent {\n  /** 4-8 digit OTP code, if found. */\n  otp?: string;\n  /** Magic link URL to navigate to, if found. */\n  magicLink?: string;\n}\n\nexport interface EmailOTPConfig {\n  provider: EmailOTPProvider;\n  // MailSlurp\n  apiKey?: string;\n  inboxId?: string;\n  // IMAP (Gmail app-password, Outlook, custom IMAP)\n  imapHost?: string;\n  imapPort?: number;\n  imapUser?: string;\n  imapPass?: string;\n  imapTls?: boolean;\n  // Mailpit (REST API at baseUrl)\n  mailpitBaseUrl?: string;\n}\n\nconst POLL_INTERVAL_MS = 2_000;\nconst MAX_WAIT_MS = 60_000;\n\n/** Extract OTP code from email body text. Prefers 6-digit, falls back to 4-8 digit. */\nfunction extractOTP(text: string): string | null {\n  const m6 = text.match(/\\b(\\d{6})\\b/);\n  if (m6) return m6[1];\n  const m48 = text.match(/\\b(\\d{4,8})\\b/);\n  if (m48) return m48[1];\n  const magic = text.match(/\\b([A-Z0-9]{6,10})\\b/);\n  if (magic) return magic[1];\n  return null;\n}\n\n/** Extract a magic-link URL from email body text. Matches /verify, /magic, /auth/callback, ?token= etc. */\nfunction extractMagicLink(text: string): string | null {\n  const magicPath = /\\/(verify|magic|login|auth|confirm|sign-in)[/?#]/i;\n  const magicQuery = /[?&](token|magic_token|login_token|auth_token|key)=/i;\n  const urlMatches = text.match(/https:\\/\\/[^\\s<>\"')\\]]+/g);\n  if (!urlMatches) return null;\n  for (const raw of urlMatches) {\n    try {\n      const u = new URL(raw.replace(/[>'\")\\].,]+$/, ''));\n      if (magicPath.test(u.pathname) || magicQuery.test(u.search)) return u.toString();\n    } catch { /* skip malformed URLs */ }\n  }\n  return null;\n}\n\nfunction parseEmailContent(text: string): EmailContent {\n  const magicLink = extractMagicLink(text);\n  if (magicLink) return { magicLink };\n  const otp = extractOTP(text);\n  if (otp) return { otp };\n  return {};\n}\n\n// \u2500\u2500 MailSlurp \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst MAILSLURP_BASE = 'https://api.mailslurp.com';\n\nasync function waitForContentMailSlurp(apiKey: string, inboxId: string, since: string): Promise<EmailContent | null> {\n  const deadline = Date.now() + MAX_WAIT_MS;\n  while (Date.now() < deadline) {\n    await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));\n    try {\n      const listRes = await fetch(\n        `${MAILSLURP_BASE}/inboxes/${inboxId}/emails?sort=DESC&limit=5&since=${encodeURIComponent(since)}`,\n        { headers: { 'x-api-key': apiKey } }\n      );\n      if (!listRes.ok) continue;\n      const emails = await listRes.json() as Array<{ id: string }>;\n      if (!emails.length) continue;\n      const bodyRes = await fetch(`${MAILSLURP_BASE}/emails/${emails[0].id}`, { headers: { 'x-api-key': apiKey } });\n      if (!bodyRes.ok) continue;\n      const email = await bodyRes.json() as { body?: string; subject?: string };\n      const content = parseEmailContent((email.body ?? '') + ' ' + (email.subject ?? ''));\n      if (content.otp || content.magicLink) return content;\n    } catch { /* retry */ }\n  }\n  return null;\n}\n\nasync function getInboxEmailMailSlurp(apiKey: string, inboxId: string): Promise<string | null> {\n  try {\n    const res = await fetch(`${MAILSLURP_BASE}/inboxes/${inboxId}`, { headers: { 'x-api-key': apiKey } });\n    if (!res.ok) return null;\n    const data = await res.json() as { emailAddress?: string };\n    return data.emailAddress ?? null;\n  } catch { return null; }\n}\n\n// \u2500\u2500 Mailpit (SMTP trap REST API) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function waitForContentMailpit(baseUrl: string, since: Date): Promise<EmailContent | null> {\n  const deadline = Date.now() + MAX_WAIT_MS;\n  const sinceMs = since.getTime();\n  while (Date.now() < deadline) {\n    await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));\n    try {\n      const res = await fetch(`${baseUrl}/api/v1/messages?limit=10`);\n      if (!res.ok) continue;\n      const data = await res.json() as { messages?: Array<{ ID: string; Created: string; Snippet: string; Subject: string }> };\n      const recent = (data.messages ?? []).filter(m => new Date(m.Created).getTime() > sinceMs);\n      for (const msg of recent) {\n        const snippet = parseEmailContent(msg.Snippet + ' ' + msg.Subject);\n        if (snippet.otp || snippet.magicLink) return snippet;\n        // Fetch full body \u2014 snippet may truncate the magic link\n        const bodyRes = await fetch(`${baseUrl}/api/v1/message/${msg.ID}`);\n        if (!bodyRes.ok) continue;\n        const body = await bodyRes.json() as { Text?: { Body?: string }; Subject?: string };\n        const full = parseEmailContent((body.Text?.Body ?? '') + ' ' + (body.Subject ?? ''));\n        if (full.otp || full.magicLink) return full;\n      }\n    } catch { /* retry */ }\n  }\n  return null;\n}\n\n// \u2500\u2500 IMAP (any mailbox) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function waitForContentImap(\n  cfg: { host: string; port: number; user: string; pass: string; tls: boolean },\n  since: Date\n): Promise<EmailContent | null> {\n  let ImapFlow: any;\n  try {\n    const mod = await import('imapflow');\n    ImapFlow = mod.ImapFlow;\n  } catch {\n    throw new Error('IMAP provider requires imapflow package. Add it to dependencies.');\n  }\n\n  const client = new ImapFlow({\n    host: cfg.host,\n    port: cfg.port,\n    secure: cfg.tls,\n    auth: { user: cfg.user, pass: cfg.pass },\n    logger: false,\n  });\n\n  try {\n    await client.connect();\n    const lock = await client.getMailboxLock('INBOX');\n    try {\n      const deadline = Date.now() + MAX_WAIT_MS;\n      while (Date.now() < deadline) {\n        const uids = await client.search({ seen: false, since });\n        if (uids.length) {\n          for await (const msg of client.fetch(uids.slice(-5), { source: true })) {\n            const { simpleParser } = await import('mailparser');\n            const parsed = await simpleParser(msg.source);\n            const text = (parsed.text ?? '') + ' ' + (parsed.subject ?? '');\n            const content = parseEmailContent(text);\n            if (content.otp || content.magicLink) return content;\n          }\n        }\n        await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));\n      }\n      return null;\n    } finally {\n      lock.release();\n    }\n  } finally {\n    await client.logout().catch(() => {});\n  }\n}\n\n// \u2500\u2500 Public API \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Wait for an email and return its OTP code or magic link URL.\n * Prefer this over waitForEmailOTP when the app may send passwordless magic links.\n */\nexport async function waitForEmailContent(\n  config: EmailOTPConfig,\n  since: string | Date\n): Promise<EmailContent | null> {\n  const sinceStr = typeof since === 'string' ? since : since.toISOString();\n  const sinceDate = typeof since === 'string' ? new Date(since) : since;\n\n  switch (config.provider) {\n    case 'mailslurp':\n      if (!config.apiKey || !config.inboxId) throw new Error('mailslurp requires apiKey + inboxId');\n      return waitForContentMailSlurp(config.apiKey, config.inboxId, sinceStr);\n\n    case 'mailpit':\n      return waitForContentMailpit(config.mailpitBaseUrl ?? 'http://mailpit:8025', sinceDate);\n\n    case 'imap':\n      if (!config.imapHost || !config.imapUser || !config.imapPass) {\n        throw new Error('imap requires imapHost, imapUser, imapPass');\n      }\n      return waitForContentImap({\n        host: config.imapHost,\n        port: config.imapPort ?? 993,\n        user: config.imapUser,\n        pass: config.imapPass,\n        tls: config.imapTls !== false,\n      }, sinceDate);\n\n    default:\n      return null;\n  }\n}\n\n/**\n * Wait for an OTP email and extract the code.\n * @deprecated Use waitForEmailContent which also handles magic links.\n */\nexport async function waitForEmailOTP(\n  config: EmailOTPConfig,\n  since: string | Date\n): Promise<string | null> {\n  const content = await waitForEmailContent(config, since);\n  return content?.otp ?? null;\n}\n\n/**\n * Get the email address for a MailSlurp inbox (used to display in UI).\n * Returns null for IMAP/Mailpit providers \u2014 use imapUser directly.\n */\nexport async function getInboxEmail(\n  configOrApiKey: EmailOTPConfig | string,\n  inboxId?: string\n): Promise<string | null> {\n  // Legacy call: getInboxEmail(apiKey, inboxId)\n  if (typeof configOrApiKey === 'string') {\n    return getInboxEmailMailSlurp(configOrApiKey, inboxId ?? '');\n  }\n  if (configOrApiKey.provider === 'mailslurp' && configOrApiKey.apiKey && configOrApiKey.inboxId) {\n    return getInboxEmailMailSlurp(configOrApiKey.apiKey, configOrApiKey.inboxId);\n  }\n  if (configOrApiKey.provider === 'imap') {\n    return configOrApiKey.imapUser ?? null;\n  }\n  return null;\n}\n"],
+  "mappings": "AAkCA,MAAM,mBAAmB;AACzB,MAAM,cAAc;AAGpB,SAAS,WAAW,MAA6B;AAC/C,QAAM,KAAK,KAAK,MAAM,aAAa;AACnC,MAAI,GAAI,QAAO,GAAG,CAAC;AACnB,QAAM,MAAM,KAAK,MAAM,eAAe;AACtC,MAAI,IAAK,QAAO,IAAI,CAAC;AACrB,QAAM,QAAQ,KAAK,MAAM,sBAAsB;AAC/C,MAAI,MAAO,QAAO,MAAM,CAAC;AACzB,SAAO;AACT;AAGA,SAAS,iBAAiB,MAA6B;AACrD,QAAM,YAAY;AAClB,QAAM,aAAa;AACnB,QAAM,aAAa,KAAK,MAAM,0BAA0B;AACxD,MAAI,CAAC,WAAY,QAAO;AACxB,aAAW,OAAO,YAAY;AAC5B,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,IAAI,QAAQ,gBAAgB,EAAE,CAAC;AACjD,UAAI,UAAU,KAAK,EAAE,QAAQ,KAAK,WAAW,KAAK,EAAE,MAAM,EAAG,QAAO,EAAE,SAAS;AAAA,IACjF,QAAQ;AAAA,IAA4B;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA4B;AACrD,QAAM,YAAY,iBAAiB,IAAI;AACvC,MAAI,UAAW,QAAO,EAAE,UAAU;AAClC,QAAM,MAAM,WAAW,IAAI;AAC3B,MAAI,IAAK,QAAO,EAAE,IAAI;AACtB,SAAO,CAAC;AACV;AAIA,MAAM,iBAAiB;AAEvB,eAAe,wBAAwB,QAAgB,SAAiB,OAA6C;AACnH,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,gBAAgB,CAAC;AACtD,QAAI;AACF,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,cAAc,YAAY,OAAO,mCAAmC,mBAAmB,KAAK,CAAC;AAAA,QAChG,EAAE,SAAS,EAAE,aAAa,OAAO,EAAE;AAAA,MACrC;AACA,UAAI,CAAC,QAAQ,GAAI;AACjB,YAAM,SAAS,MAAM,QAAQ,KAAK;AAClC,UAAI,CAAC,OAAO,OAAQ;AACpB,YAAM,UAAU,MAAM,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,OAAO,EAAE,CAAC;AAC5G,UAAI,CAAC,QAAQ,GAAI;AACjB,YAAM,QAAQ,MAAM,QAAQ,KAAK;AACjC,YAAM,UAAU,mBAAmB,MAAM,QAAQ,MAAM,OAAO,MAAM,WAAW,GAAG;AAClF,UAAI,QAAQ,OAAO,QAAQ,UAAW,QAAO;AAAA,IAC/C,QAAQ;AAAA,IAAc;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAe,uBAAuB,QAAgB,SAAyC;AAC7F,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,cAAc,YAAY,OAAO,IAAI,EAAE,SAAS,EAAE,aAAa,OAAO,EAAE,CAAC;AACpG,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,gBAAgB;AAAA,EAC9B,QAAQ;AAAE,WAAO;AAAA,EAAM;AACzB;AAIA,eAAe,sBAAsB,SAAiB,OAA2C;AAC/F,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,QAAM,UAAU,MAAM,QAAQ;AAC9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,gBAAgB,CAAC;AACtD,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,OAAO,2BAA2B;AAC7D,UAAI,CAAC,IAAI,GAAI;AACb,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,UAAU,KAAK,YAAY,CAAC,GAAG,OAAO,OAAK,IAAI,KAAK,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO;AACxF,iBAAW,OAAO,QAAQ;AACxB,cAAM,UAAU,kBAAkB,IAAI,UAAU,MAAM,IAAI,OAAO;AACjE,YAAI,QAAQ,OAAO,QAAQ,UAAW,QAAO;AAE7C,cAAM,UAAU,MAAM,MAAM,GAAG,OAAO,mBAAmB,IAAI,EAAE,EAAE;AACjE,YAAI,CAAC,QAAQ,GAAI;AACjB,cAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,cAAM,OAAO,mBAAmB,KAAK,MAAM,QAAQ,MAAM,OAAO,KAAK,WAAW,GAAG;AACnF,YAAI,KAAK,OAAO,KAAK,UAAW,QAAO;AAAA,MACzC;AAAA,IACF,QAAQ;AAAA,IAAc;AAAA,EACxB;AACA,SAAO;AACT;AAIA,eAAe,mBACb,KACA,OAC8B;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,UAAU;AACnC,eAAW,IAAI;AAAA,EACjB,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AAEA,QAAM,SAAS,IAAI,SAAS;AAAA,IAC1B,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,QAAQ,IAAI;AAAA,IACZ,MAAM,EAAE,MAAM,IAAI,MAAM,MAAM,IAAI,KAAK;AAAA,IACvC,QAAQ;AAAA,EACV,CAAC;AAED,MAAI;AACF,UAAM,OAAO,QAAQ;AACrB,UAAM,OAAO,MAAM,OAAO,eAAe,OAAO;AAChD,QAAI;AACF,YAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,cAAM,OAAO,MAAM,OAAO,OAAO,EAAE,MAAM,OAAO,MAAM,CAAC;AACvD,YAAI,KAAK,QAAQ;AACf,2BAAiB,OAAO,OAAO,MAAM,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC,GAAG;AACtE,kBAAM,EAAE,aAAa,IAAI,MAAM,OAAO,YAAY;AAClD,kBAAM,SAAS,MAAM,aAAa,IAAI,MAAM;AAC5C,kBAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO,OAAO,WAAW;AAC5D,kBAAM,UAAU,kBAAkB,IAAI;AACtC,gBAAI,QAAQ,OAAO,QAAQ,UAAW,QAAO;AAAA,UAC/C;AAAA,QACF;AACA,cAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,gBAAgB,CAAC;AAAA,MACxD;AACA,aAAO;AAAA,IACT,UAAE;AACA,WAAK,QAAQ;AAAA,IACf;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACtC;AACF;AAQA,eAAsB,oBACpB,QACA,OAC8B;AAC9B,QAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM,YAAY;AACvE,QAAM,YAAY,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAEhE,UAAQ,OAAO,UAAU;AAAA,IACvB,KAAK;AACH,UAAI,CAAC,OAAO,UAAU,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,qCAAqC;AAC5F,aAAO,wBAAwB,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,IAExE,KAAK;AACH,aAAO,sBAAsB,OAAO,kBAAkB,uBAAuB,SAAS;AAAA,IAExF,KAAK;AACH,UAAI,CAAC,OAAO,YAAY,CAAC,OAAO,YAAY,CAAC,OAAO,UAAU;AAC5D,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAC9D;AACA,aAAO,mBAAmB;AAAA,QACxB,MAAM,OAAO;AAAA,QACb,MAAM,OAAO,YAAY;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,QACb,KAAK,OAAO,YAAY;AAAA,MAC1B,GAAG,SAAS;AAAA,IAEd;AACE,aAAO;AAAA,EACX;AACF;AAMA,eAAsB,gBACpB,QACA,OACwB;AACxB,QAAM,UAAU,MAAM,oBAAoB,QAAQ,KAAK;AACvD,SAAO,SAAS,OAAO;AACzB;AAMA,eAAsB,cACpB,gBACA,SACwB;AAExB,MAAI,OAAO,mBAAmB,UAAU;AACtC,WAAO,uBAAuB,gBAAgB,WAAW,EAAE;AAAA,EAC7D;AACA,MAAI,eAAe,aAAa,eAAe,eAAe,UAAU,eAAe,SAAS;AAC9F,WAAO,uBAAuB,eAAe,QAAQ,eAAe,OAAO;AAAA,EAC7E;AACA,MAAI,eAAe,aAAa,QAAQ;AACtC,WAAO,eAAe,YAAY;AAAA,EACpC;AACA,SAAO;AACT;",
+  "names": []
+}