@mcpmake/core 0.3.4 → 0.3.5

package/dist/emitter/site-templates/browser-manager.ts.hbs

@@ -28,6 +28,10 @@ const sessionCreations = new Map<string, Promise<{ page: Page; sessionId: string
 // Single-flight the browser launch so concurrent cold starts can't spawn
 // multiple Chromium processes.
 let browserLaunch: Promise<Browser> | undefined;
+// Incremented whenever closeBrowser() begins. A launch captures the current
+// generation and must close itself instead of becoming active if teardown
+// invalidated it while chromium.launch() was still pending.
+let browserGeneration = 0;
 
 const DEFAULT_SESSION = '__default__';
 
@@ -99,13 +103,35 @@ async function getBrowser(): Promise<Browser> {
 
   // Only disable sandbox when running as root in a container.
   const isRoot = process.getuid?.() === 0;
+  const generation = browserGeneration;
   browserLaunch = chromium
     .launch({
       headless: config.headless,
       args: isRoot ? ['--no-sandbox', '--disable-setuid-sandbox'] : [],
     })
-    .then((b) => {
+    .then(async (b) => {
+      // closeBrowser() may have run while Chromium was launching. Never publish
+      // that stale browser into manager state: close it and fail the waiting
+      // creation so no resident process escapes the pool/cap.
+      if (generation !== browserGeneration) {
+        await b.close().catch(() => {});
+        throw new Error('Browser launch aborted: browser manager shut down');
+      }
       browser = b;
+      // If the whole browser process dies, every session's context is dead.
+      // Reclaim them all: emit one session_end each (skipping reserved slots
+      // that never started) and clear the pool + idle timer so occupancy frees
+      // promptly. No-ops for our own browser.close() (the pool is already empty
+      // and `browser` already nulled by then).
+      b.on('disconnected', () => {
+        if (browser !== b) return;
+        browser = undefined;
+        clearIdleTimer();
+        for (const [id, session] of [...sessions]) {
+          sessions.delete(id);
+          if (session.context) telemetry.sessionEnded(id, 'crash');
+        }
+      });
       return b;
     })
     .finally(() => {
@@ -125,20 +151,24 @@ async function getBrowser(): Promise<Browser> {
 export async function getOrCreateSession(sessionId?: string): Promise<{ page: Page; sessionId: string }> {
   const id = sessionId ?? DEFAULT_SESSION;
 
-  // Reuse existing session
+  // Join an in-flight creation for this id FIRST. createSession reserves its slot
+  // synchronously (before its first await), so a concurrent second call that
+  // checked `sessions` first would observe that placeholder and return its
+  // not-yet-assigned (undefined) page. The in-flight promise resolves to the
+  // real page, so coalescing here gives every concurrent caller a usable page
+  // and a single shared context.
+  const inFlight = sessionCreations.get(id);
+  if (inFlight) return inFlight;
+
+  // Reuse a fully-created session (a placeholder reservation has no context yet
+  // and is always covered by the in-flight check above).
   const existing = sessions.get(id);
-  if (existing) {
+  if (existing && existing.context) {
     existing.lastAccessedAt = Date.now();
-    resetIdleTimer();
+    ensureIdleTimer();
     return { page: existing.page, sessionId: id };
   }
 
-  // Coalesce concurrent creations for the same id (notably the default
-  // session) onto one promise so we don't create duplicate contexts or
-  // double-count capacity.
-  const inFlight = sessionCreations.get(id);
-  if (inFlight) return inFlight;
-
   const creation = createSession(id).finally(() => {
     sessionCreations.delete(id);
   });
@@ -153,8 +183,8 @@ async function createSession(id: string): Promise<{ page: Page; sessionId: strin
   const maxSessions = config.maxSessions ?? 10;
   if (sessions.size >= maxSessions) {
     throw new Error(
-      `Session pool at capacity (${maxSessions}). ` +
-      'Close an existing session before creating a new one.'
+      `Browser session limit reached (${maxSessions}). ` +
+      'Close an existing session and retry.'
     );
   }
   const reserved: BrowserSession = {
@@ -164,28 +194,61 @@ async function createSession(id: string): Promise<{ page: Page; sessionId: strin
   };
   sessions.set(id, reserved);
 
+  let context: BrowserContext | undefined;
   try {
     const activeBrowser = await getBrowser();
-    const context = await activeBrowser.newContext({
+    context = await activeBrowser.newContext({
       viewport: config.viewport,
       ...(config.userAgent ? { userAgent: config.userAgent } : {}),
     });
     const page = await context.newPage();
 
+    // If the manager was torn down (shutdown/disconnect) while we awaited the
+    // browser/context/page, our reservation was cleared. Do NOT resurrect it:
+    // bail so the catch below closes this fresh context. Otherwise we would
+    // orphan a live Chromium context outside the pool — escaping the cap, never
+    // reaped, and emitting a session_start AFTER its session_end. There is no
+    // await between here and `return`, so once this check passes the rest of
+    // creation is atomic with respect to teardown.
+    if (sessions.get(id) !== reserved) {
+      throw new Error('Session creation aborted: browser manager shut down');
+    }
+
     reserved.context = context;
     reserved.page = page;
     reserved.lastAccessedAt = Date.now();
 
-    resetIdleTimer();
+    ensureIdleTimer();
 
     // The browser context is now resident — start billing this session (no-op
     // unless the host injected telemetry env).
     telemetry.sessionStarted(id);
 
+    // Reclaim the slot exactly once if this session dies on its own — a Chromium
+    // context close, a renderer (page) crash, or an external close. Every
+    // intentional teardown path deletes the map entry BEFORE closing, so the
+    // `=== reserved` guard makes this a no-op for those and lets it fire only on
+    // an unexpected death, freeing host occupancy promptly instead of waiting
+    // out the idle grace. The guard also dedupes a page crash that then closes
+    // the context (only the first reclaim wins).
+    const reclaim = (reason: string): void => {
+      if (sessions.get(id) !== reserved) return;
+      sessions.delete(id);
+      context?.close().catch(() => {});
+      telemetry.sessionEnded(id, reason);
+      if (sessions.size === 0) void closeBrowser();
+    };
+    context.on('close', () => reclaim('crash'));
+    page.on('crash', () => reclaim('crash'));
+
     return { page, sessionId: id };
   } catch (err) {
-    // Release the reserved slot if context creation failed.
-    sessions.delete(id);
+    // Release the slot AND close any context we created, so a failed or aborted
+    // creation never leaks a live Chromium context or pins the cap slot. Only
+    // delete the entry if it is still ours (a concurrent shutdown may have
+    // already cleared it).
+    if (sessions.get(id) === reserved) sessions.delete(id);
+    await context?.close().catch(() => {});
     throw err;
   }
 }
@@ -198,10 +261,18 @@ export async function closeSession(sessionId?: string): Promise<void> {
   const session = sessions.get(id);
   if (!session) return;
 
-  await session.context?.close().catch(() => {});
+  // Claim the teardown AND emit session_end SYNCHRONOUSLY, before the first
+  // await. Deleting the map entry and removing the telemetry token together,
+  // up front, means: (a) a concurrent idle sweep or second close sees the slot
+  // gone and skips it; and (b) a same-id session re-created during the
+  // context-close await below gets its OWN fresh telemetry token instead of
+  // sharing this one (which would suppress its later session_end). Exactly one
+  // session_end per teardown.
   sessions.delete(id);
   telemetry.sessionEnded(id, 'explicit');
 
+  await session.context?.close().catch(() => {});
+
   // If no sessions remain, close the browser
   if (sessions.size === 0) {
     await closeBrowser();
@@ -213,17 +284,42 @@ export async function closeSession(sessionId?: string): Promise<void> {
  */
 export async function closeBrowser(): Promise<void> {
   clearIdleTimer();
-
-  for (const [id, session] of sessions) {
+  // Invalidate a chromium.launch() already in progress. Its completion handler
+  // will close the resulting process rather than assigning it to `browser`.
+  browserGeneration++;
+  const launching = browserLaunch;
+
+  // Null `browser` synchronously BEFORE awaiting its close. While close() is in
+  // flight the instance still reports isConnected() === true, so without this a
+  // concurrent getOrCreateSession would be handed the dying browser and build a
+  // context on it that dies immediately. Nulling up front forces a relaunch
+  // instead, and single-flights closeBrowser (a second concurrent call sees no
+  // browser and skips the redundant close()).
+  const dying = browser;
+  browser = undefined;
+
+  // Snapshot and clear the pool, then emit every session_end SYNCHRONOUSLY
+  // (before any await) so a same-id session re-created during the context-close
+  // awaits gets its own telemetry token rather than sharing a snapshotted one.
+  // Reserved-but-unstarted slots are skipped: no context to close, and no
+  // session_start to balance (the in-flight createSession aborts itself once it
+  // sees its reservation cleared).
+  const entries = [...sessions];
+  sessions.clear();
+  for (const [id, session] of entries) {
+    if (session.context) telemetry.sessionEnded(id, 'shutdown');
+  }
+  for (const [, session] of entries) {
     await session.context?.close().catch(() => {});
-    sessions.delete(id);
-    telemetry.sessionEnded(id, 'shutdown');
   }
 
-  if (browser) {
-    await browser.close().catch(() => {});
-    browser = undefined;
+  if (dying) {
+    await dying.close().catch(() => {});
   }
+  // Wait for an invalidated launch to finish its self-cleanup. This makes
+  // closeBrowser() a real lifecycle barrier: after it resolves, no Chromium
+  // process from work that began before teardown can still become resident.
+  await launching?.catch(() => {});
 }
 
 /**
@@ -235,7 +331,9 @@ export async function takeScreenshot(
 ): Promise<Buffer> {
   const id = sessionId ?? DEFAULT_SESSION;
   const session = sessions.get(id);
-  if (!session) {
+  // A reserved, mid-creation slot is in the map but has no page yet — treat it
+  // as not-yet-active so callers get the clear error, not a TypeError.
+  if (!session || !session.context) {
     throw new Error(`No active session: ${id}`);
   }
   session.lastAccessedAt = Date.now();
@@ -243,10 +341,13 @@ export async function takeScreenshot(
 }
 
 /**
- * List active session IDs.
+ * List active session IDs. Excludes reserved, mid-creation slots (no page yet)
+ * so a returned id is always usable with takeScreenshot/tool calls.
  */
 export function listSessions(): string[] {
-  return Array.from(sessions.keys());
+  return Array.from(sessions.entries())
+    .filter(([, session]) => session.context !== undefined)
+    .map(([id]) => id);
 }
 
 /**
@@ -258,16 +359,25 @@ export function isBrowserRunning(): boolean {
 
 // ─── Idle Timer ─────────────────────────────────────────────────────
 
-function resetIdleTimer(): void {
-  clearIdleTimer();
+// Start the idle reaper once and let it tick at a FIXED cadence. It must NOT be
+// reset on session access: resetting on every access would let a busy container
+// (one session touched within each interval) starve the reaper so it never
+// fires, leaving genuinely-idle sibling sessions resident forever. Eviction
+// keys off each session's own lastAccessedAt, so a steady tick is sufficient —
+// touching a session keeps only that session alive.
+function ensureIdleTimer(): void {
+  if (idleTimer) return;
   idleTimer = setInterval(() => {
     const now = Date.now();
     // Close idle sessions. Skip slots still being created (no context yet).
     for (const [id, session] of sessions) {
       if (!session.context) continue;
       if (now - session.lastAccessedAt > config.idleTimeoutMs) {
-        session.context.close().catch(() => {});
+        // Delete before closing so the context's own 'close' handler (and any
+        // concurrent teardown) sees the slot already claimed — session_end is
+        // emitted once, here, with reason 'idle'.
         sessions.delete(id);
+        session.context.close().catch(() => {});
         telemetry.sessionEnded(id, 'idle');
       }
     }

package/dist/emitter/site-templates/config.ts.hbs

@@ -16,6 +16,15 @@ const posInt = (v: string | undefined, d: number): number => {
   return Number.isInteger(n) && n > 0 ? n : d;
 };
 
+// Hard ceiling on concurrently-resident browser sessions for THIS container.
+// The cloud host injects MCP_MAX_BROWSER_SESSIONS at container start to pin the
+// owner's per-plan concurrent-browser limit, making the container's hard cap the
+// plan cap. MAX_SESSIONS is the legacy/self-host alias. Either env var, when a
+// valid positive integer, overrides the baked-in default; an unset or invalid
+// value falls through to the next source. DEFAULT_MAX_SESSIONS is the safe
+// fallback. The browser manager refuses to launch a session past this cap.
+const DEFAULT_MAX_SESSIONS = {{#if browserConfig.maxSessions}}{{browserConfig.maxSessions}}{{else}}10{{/if}};
+
 export function loadConfig(): AppConfig {
   return {
     baseUrl: process.env.BASE_URL ?? '{{{baseUrl}}}',
@@ -27,7 +36,10 @@ export function loadConfig(): AppConfig {
         height: posInt(process.env.VIEWPORT_HEIGHT, {{browserConfig.viewport.height}}),
       },
       userAgent: process.env.USER_AGENT || undefined,
-      maxSessions: posInt(process.env.MAX_SESSIONS, {{browserConfig.maxSessions}}),
+      maxSessions: posInt(
+        process.env.MCP_MAX_BROWSER_SESSIONS,
+        posInt(process.env.MAX_SESSIONS, DEFAULT_MAX_SESSIONS),
+      ),
     },
   };
 }

package/dist/emitter/site-templates/env.example.hbs

@@ -10,6 +10,14 @@ VIEWPORT_WIDTH={{browserConfig.viewport.width}}
 VIEWPORT_HEIGHT={{browserConfig.viewport.height}}
 # USER_AGENT=
 
+# Hard cap on concurrently-resident browser sessions (Chromium contexts) this
+# server will hold. A tool call that would open one past the cap is refused with
+# a clear error rather than launching another browser. Managed hosting injects
+# this to enforce the plan's concurrent-browser limit. MAX_SESSIONS is a legacy
+# alias; MCP_MAX_BROWSER_SESSIONS wins when both are set.
+MCP_MAX_BROWSER_SESSIONS={{#if browserConfig.maxSessions}}{{browserConfig.maxSessions}}{{else}}10{{/if}}
+# MAX_SESSIONS={{#if browserConfig.maxSessions}}{{browserConfig.maxSessions}}{{else}}10{{/if}}
+
 # Browser-session telemetry (managed hosting only — leave UNSET to self-host).
 # When the host sets these, the server reports exact browser-session lifetime
 # for metering. It NEVER phones home unless MCPMAKE_TELEMETRY_URL is set.

package/dist/emitter/site-templates/telemetry.ts.hbs

@@ -66,10 +66,16 @@ export function sessionStarted(sessionId: string): void {
   ensureTimer();
 }
 
-/** Record that a browser session was torn down (idle | explicit | shutdown). */
+/** Record that a browser session was torn down (idle | explicit | shutdown |
+ *  crash). Idempotent: emits at most one session_end per session. A second end
+ *  for the same id (e.g. an explicit close that resumes after flushOnShutdown
+ *  already ended it on SIGTERM, or a crash racing a teardown) is a no-op, and an
+ *  end for a session that never started (a reserved-but-unstarted slot) emits
+ *  nothing — so the host's occupancy ledger can never be double-decremented. */
 export function sessionEnded(sessionId: string, reason: string): void {
   if (!ENABLED) return;
-  openSessions.delete(sessionId);
+  // openSessions is the source of truth: only the call that removes the id emits.
+  if (!openSessions.delete(sessionId)) return;
   pushEvent({ type: 'session_end', sessionId, ts: Date.now(), reason });
   // Flush promptly so the host can finalize this session's billing.
   void flush();
@@ -108,6 +114,11 @@ async function flush(): Promise<void> {
 /** Best-effort final flush on shutdown: end every open session and send. */
 export async function flushOnShutdown(reason = 'shutdown'): Promise<void> {
   if (!ENABLED) return;
+  // Stop the heartbeat interval so no flush can fire after this final boundary.
+  if (flushTimer) {
+    clearInterval(flushTimer);
+    flushTimer = undefined;
+  }
   const now = Date.now();
   for (const id of [...openSessions]) {
     openSessions.delete(id);

package/dist/emitter/templates/discovery.ts.hbs

@@ -10,6 +10,7 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { executeRequest } from './http.js';
 import { applyJqFilter } from './response-filter.js';
 import type { AppConfig } from './config.js';
+import type { AuthRequirement } from './auth.js';
 import catalogData from './tool-catalog.json' with { type: 'json' };
 
 interface CatalogParamMapping {
@@ -35,6 +36,10 @@ interface CatalogEntry {
   /** The MCP input key for the request body (`body`, `requestBody`, etc.).
    *  Only present when `hasRequestBody` is true. */
   bodyInputKey?: string;
+  /** Per-operation outbound-auth requirement (D-H2). Forwarded to executeRequest
+   *  so a public operation (`security: []`) sends no auth and a scheme-scoped
+   *  operation sends only its scheme(s). Absent → every configured scheme. */
+  authRequirement?: AuthRequirement;
 }
 
 const catalog: CatalogEntry[] = catalogData as CatalogEntry[];
@@ -169,15 +174,46 @@ export function registerDiscoveryTools(server: McpServer, config: AppConfig): vo
       }
 
       try {
-        // Build URL from path template — read args by inputKey, substitute wireName
-        // into the URL template. Handles parameter name collisions (R14-A).
-        let url = config.baseUrl + tool.path;
+        // Build the path suffix from the template — read args by inputKey,
+        // substitute wireName into the path. Handles parameter name collisions
+        // (R14-A). The leftover-placeholder check (R5-F) runs on the PATH ONLY,
+        // not on config.baseUrl: a base URL may legitimately contain an
+        // unresolved OpenAPI server variable (e.g. `https://api.{region}.x.com`)
+        // that is not a tool path parameter, and scanning it would falsely fail
+        // every call.
+        let pathSuffix = tool.path;
         for (const p of tool.pathParams) {
           if (args[p.inputKey] !== undefined) {
-            url = url.replace(`{${p.wireName}}`, encodeURIComponent(String(args[p.inputKey])));
+            pathSuffix = pathSuffix.replace(
+              `{${p.wireName}}`,
+              encodeURIComponent(String(args[p.inputKey])),
+            );
           }
         }
 
+        // R5-F: refuse to fire a request with unsubstituted path placeholders.
+        // A missing required path parameter leaves a literal `{name}` in the
+        // path, which would otherwise be sent verbatim upstream. Return an MCP
+        // error listing the unfilled parameter(s) instead.
+        const missing = pathSuffix.match(/\{[^}]+\}/g);
+        if (missing && missing.length > 0) {
+          return {
+            content: [
+              {
+                type: 'text' as const,
+                text: `Missing required path parameter(s): ${missing
+                  .map((s) => s.slice(1, -1))
+                  .join(', ')}. Use get_tool_schema to see required inputs.`,
+              },
+            ],
+            isError: true,
+          };
+        }
+
+        // Path is fully substituted — prepend the (possibly server-variable-
+        // bearing) base URL to form the request URL.
+        let url = config.baseUrl + pathSuffix;
+
         // Add query params — read args by inputKey, send upstream under wireName (R14-A).
         const queryParams = new URLSearchParams();
         for (const p of tool.queryParams) {
@@ -198,6 +234,9 @@ export function registerDiscoveryTools(server: McpServer, config: AppConfig): vo
           headers: {},
           config,
           idempotencyKey,
+          // R5-E: scope outbound auth per operation exactly like the static
+          // per-tool handlers. Absent → executeRequest applies every scheme.
+          authRequirement: tool.authRequirement,
         });
 
         const result =

package/dist/emitter/templates/server-main-http.ts.hbs

@@ -174,6 +174,39 @@ if (transportMode === 'http') {
   }
   const allowedOrigin = process.env.ALLOWED_ORIGIN;
   const authToken = process.env.MCP_AUTH_TOKEN;
+{{#if hasOAuth}}
+  /* ── OAuth issuer resolution inputs ──────────────────────────────────────
+   * The unauthenticated /.well-known/oauth-authorization-server endpoint must
+   * not reflect an arbitrary client-controlled Host header into the issuer
+   * (host-header spoofing). Operators pin the issuer with one of:
+   *   - ALLOWED_ORIGIN   (existing; takes precedence)
+   *   - MCP_PUBLIC_URL   (absolute http(s) URL; its origin is used)
+   *   - MCP_ALLOWED_HOSTS (comma/space-separated Host allowlist)
+   * With none set we fall back to the request Host for backward-compat (dev),
+   * after warning once that the issuer is Host-derived. */
+  const mcpPublicOrigin = (() => {
+    const raw = process.env.MCP_PUBLIC_URL;
+    if (!raw) return undefined;
+    try {
+      const u = new URL(raw);
+      if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        log('error', 'MCP_PUBLIC_URL must be an http(s) URL — ignoring', { MCP_PUBLIC_URL: raw });
+        return undefined;
+      }
+      return u.origin;
+    } catch {
+      log('error', 'MCP_PUBLIC_URL is not a valid absolute URL — ignoring', { MCP_PUBLIC_URL: raw });
+      return undefined;
+    }
+  })();
+  const allowedHosts = new Set(
+    (process.env.MCP_ALLOWED_HOSTS ?? '')
+      .split(/[\s,]+/)
+      .map((h) => h.trim().toLowerCase())
+      .filter((h) => h.length > 0),
+  );
+  let warnedHostDerivedIssuer = false;
+{{/if}}
   /* Fail closed: with no MCP_AUTH_TOKEN the server denies every authenticated
    * route (401) unless the operator opted in via MCP_ALLOW_UNAUTHENTICATED=true.
    * Warn loudly, once, when running wide open so it is never a silent default. */
@@ -369,7 +402,52 @@ if (transportMode === 'http') {
           return;
         }
         const proto = req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-        const issuer = allowedOrigin ?? `${proto}://${req.headers.host ?? 'localhost'}`;
+        /* Resolve the OAuth issuer without trusting an arbitrary Host header.
+         * Precedence: ALLOWED_ORIGIN → MCP_PUBLIC_URL → MCP_ALLOWED_HOSTS →
+         * (dev fallback) the request Host, but only when no allowlist/public
+         * URL pins it. When MCP_ALLOWED_HOSTS is configured, a Host outside it
+         * is rejected rather than reflected. */
+        const rawHost = req.headers.host;
+        const host = typeof rawHost === 'string' ? rawHost.toLowerCase() : undefined;
+        // Parse the Host once. `hostname` (no port, no userinfo) drives the
+        // allowlist so a bare-hostname allowlist (MCP_ALLOWED_HOSTS=example.com)
+        // matches `Host: example.com:3000`; `hostPort` (hostname:port, userinfo
+        // STRIPPED) builds the issuer so a `Host: evil@example.com` cannot inject
+        // a userinfo segment into the issued metadata. URL parsing also handles
+        // IPv6 brackets. Falls back to undefined when the Host is malformed.
+        const parsedHost = (() => {
+          if (typeof rawHost !== 'string') return undefined;
+          try {
+            const u = new URL(`http://${rawHost}`);
+            return { hostname: u.hostname.toLowerCase(), hostPort: u.host };
+          } catch {
+            return undefined;
+          }
+        })();
+        const hostNoPort = parsedHost?.hostname ?? host;
+        let issuer: string;
+        if (allowedOrigin) {
+          issuer = allowedOrigin;
+        } else if (mcpPublicOrigin) {
+          issuer = mcpPublicOrigin;
+        } else if (allowedHosts.size > 0) {
+          if (!host || (!allowedHosts.has(host) && !(hostNoPort && allowedHosts.has(hostNoPort)))) {
+            log('error', 'Invalid Host header for OAuth metadata', { host: rawHost });
+            sendJson(res, 400, { error: 'Invalid Host header for OAuth metadata' });
+            return;
+          }
+          // Build from the parsed host:port (userinfo stripped), never raw.
+          issuer = `${proto}://${parsedHost?.hostPort ?? rawHost}`;
+        } else {
+          /* No issuer pinned: reflect the request Host for backward-compat with
+           * proxy deployments that set neither var. Warn once so operators know
+           * to lock it down via MCP_PUBLIC_URL or MCP_ALLOWED_HOSTS. */
+          if (!warnedHostDerivedIssuer) {
+            warnedHostDerivedIssuer = true;
+            log('info', 'OAuth issuer derived from the Host header — set MCP_PUBLIC_URL or MCP_ALLOWED_HOSTS to pin it', { host: rawHost });
+          }
+          issuer = `${proto}://${rawHost ?? 'localhost'}`;
+        }
         sendJson(
           res,
           200,

package/dist/emitter/worker-templates/wrangler.toml.hbs

@@ -7,7 +7,11 @@ compatibility_flags = ["nodejs_compat"]
 
 # Non-secret configuration. Override per-environment as needed.
 [vars]
-BASE_URL = "{{baseUrl}}"
+# {{{json}}} emits a JSON string literal, which is a valid TOML basic string with
+# identical escape semantics. Unlike a raw "{{baseUrl}}" interpolation, this fully
+# escapes backslashes/quotes/newlines so an attacker-controlled URL cannot inject a
+# spurious key or [section] header into the generated wrangler.toml (A4-15).
+BASE_URL = {{{json baseUrl}}}
 MAX_RETRIES = "3"
 REQUEST_INTERVAL_MS = "100"
 # ALLOWED_ORIGIN = "https://your-client.example.com"

package/dist/index.d.ts

@@ -74,6 +74,7 @@ export { fail } from './utils/fail.js';
 export { pathExists } from './utils/fs.js';
 export { confirmOperations } from './utils/interactive.js';
 export { watchFile } from './utils/watcher.js';
+export { loadChromium } from './utils/playwright-loader.js';
 export { FAMILY_A_PRICING, DEFAULT_PRICING_SERVER, fetchPricing, formatPrice } from './pricing.js';
 export type { BillingPeriod, PricePoint } from './pricing.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAK5E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAKhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAK5E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAKhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAK5D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -97,6 +97,7 @@ export { fail } from './utils/fail.js';
 export { pathExists } from './utils/fs.js';
 export { confirmOperations } from './utils/interactive.js';
 export { watchFile } from './utils/watcher.js';
+export { loadChromium } from './utils/playwright-loader.js';
 // ---------------------------------------------------------------------------
 // Pricing
 // ---------------------------------------------------------------------------

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhF,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhF,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE5D,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/parser/har-normalizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"har-normalizer.d.ts","sourceRoot":"","sources":["../../src/parser/har-normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAOxC,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC7C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,eAAe,CAgD5D"}
+{"version":3,"file":"har-normalizer.d.ts","sourceRoot":"","sources":["../../src/parser/har-normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAOxC,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC7C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,eAAe,CAwD5D"}

package/dist/parser/har-normalizer.js

@@ -39,6 +39,12 @@ export function normalizeEntry(entry) {
     const normalizedPath = '/' + normalizedSegments.join('/');
     const queryParams = [];
     for (const qs of entry.request.queryString ?? []) {
+        if (qs === null ||
+            typeof qs !== 'object' ||
+            typeof qs.name !== 'string' ||
+            typeof qs.value !== 'string') {
+            continue;
+        }
         queryParams.push({
             name: qs.name,
             exampleValue: qs.value,
@@ -56,9 +62,28 @@ function deriveParamName(segments, currentIndex, counter) {
     }
     return counter === 0 ? 'id' : `id${counter + 1}`;
 }
+// Version / routing prefixes that look plural-ish or otherwise sneak past the
+// pattern but are never REST collections. `vN` is matched structurally below.
+const NON_COLLECTION_SEGMENTS = new Set(['api', 'rest', 'graphql', 'rpc', 'status']);
 function isCollectionName(segment) {
-    // Common REST patterns: plurals, known resource names
-    return (/^[a-z][a-z0-9_-]*s$/i.test(segment) || ['api', 'v1', 'v2', 'v3'].includes(segment) === false);
+    // Discriminating REST collection heuristic. The previous version returned true
+    // for almost any segment (its second clause was `!['api','v1',...].includes(x)`,
+    // i.e. true for everything except those four), which over-parameterized paths.
+    //
+    // A collection segment is a *plural resource name*: lowercase, alphanumeric
+    // (allowing `_`/`-`), and ending in `s` but not `ss` (e.g. `users`, `posts`,
+    // `items`, `api_keys` — but not `class`, `address`). We additionally exclude
+    // version prefixes (`v1`, `v2`, …) and a small set of routing/non-resource
+    // tokens, so a generic singular segment like `user`, `profile`, or a version
+    // like `v1` is no longer treated as a collection.
+    const s = segment.toLowerCase();
+    if (NON_COLLECTION_SEGMENTS.has(s))
+        return false;
+    if (/^v\d+$/.test(s))
+        return false; // version prefixes: v1, v2, v10, ...
+    // Plural resource: starts with a letter, ends in `s`, but the char before the
+    // trailing `s` is not itself `s` (excludes `class`, `address`, `status`).
+    return /^[a-z][a-z0-9_-]*[^s]s$/.test(s);
 }
 function singularize(word) {
     if (word.endsWith('ies'))