@natchs/browser-mcp 2.0.0

package/README.md

@@ -0,0 +1,141 @@
+# Browser MCP
+
+Reverse engineering ve web scraping odaklı, Cloudflare engelleri haricinde tam otonom çalışabilen bir browser MCP (Model Context Protocol) sunucusu.
+
+## Özellikler
+
+- **Phased Architecture**: 11 faz, 40+ tool, production-grade
+- **Rate Limiting**: Token bucket algoritması, global + per-tool limit
+- **Cache**: LRU cache + TTL, SHA-256 hash ile cache key
+- **Security**: SSRF koruması, path traversal engelleme, input sanitizasyonu
+- **Observability**: Structured JSON logging, tool metrikleri
+- **Session Management**: Session TTL, otomatik cleanup, çoklu session desteği
+
+## Gereksinimler
+
+- Node.js >= 18
+- npm veya yarn
+
+## Kurulum
+
+```bash
+git clone <repo-url>
+cd browser-mcp
+npm ci
+npx playwright install chromium
+```
+
+## Kullanım
+
+```bash
+# Geliştirme
+npx tsx src/index.ts
+
+# Production build
+npm run build
+node dist/index.js
+```
+
+## MCP Client Entegrasyonu
+
+```json
+{
+  "mcpServers": {
+    "browser-mcp": {
+      "command": "node",
+      "args": ["path/to/browser-mcp/dist/index.js"]
+    }
+  }
+}
+```
+
+## Docker
+
+```bash
+docker build -t browser-mcp .
+docker run --rm -i browser-mcp
+```
+
+## Ortam Değişkenleri
+
+| Değişken | Varsayılan | Açıklama |
+|----------|-----------|----------|
+| `BROWSER_HEADLESS` | `true` | Headless mod |
+| `BROWSER_TIMEOUT` | `30000` | Sayfa timeout (ms) |
+| `BROWSER_VIEWPORT_WIDTH` | `1280` | Viewport genişlik |
+| `BROWSER_VIEWPORT_HEIGHT` | `720` | Viewport yükseklik |
+| `RATE_LIMIT_ENABLED` | `true` | Rate limit aktif |
+| `RATE_LIMIT_GLOBAL_RPM` | `120` | Global istek/dakika limiti |
+| `RATE_LIMIT_PER_TOOL_RPM` | `30` | Tool başına istek/dakika limiti |
+| `CACHE_MAX_ENTRIES` | `100` | Maksimum cache kaydı |
+| `CACHE_TTL_SECONDS` | `300` | Cache TTL (saniye) |
+| `SECURITY_ALLOWED_DIRS` | `[]` | İzin verilen dizinler (JSON array) |
+| `SECURITY_MAX_MEMORY_MB` | `512` | Maksimum bellek (MB) |
+
+## Tool Listesi
+
+### Navigation (5)
+`browser_navigate`, `browser_go_back`, `browser_go_forward`, `browser_refresh`, `browser_wait_for`
+
+### Interaction (8)
+`browser_click`, `browser_fill`, `browser_select`, `browser_hover`, `browser_drag`, `browser_type`, `browser_press_key`, `browser_file_upload`
+
+### Extraction (4+)
+`browser_extract_html`, `browser_extract_markdown`, `browser_extract_text`, `browser_extract_with_css`, `browser_extract_table`, `browser_extract_schema_org`, `browser_extract_open_graph`
+
+### Network (5)
+`browser_network_requests`, `browser_network_response`, `browser_get_console`, `browser_handle_dialog`, `browser_wait_for_navigation`
+
+### Browser Control (7)
+`browser_screenshot`, `browser_page_info`, `browser_get_cookies`, `browser_set_cookie`, `browser_delete_cookie`, `browser_evaluate`, `browser_pdf`
+
+### Session Management (3)
+`browser_open_session`, `browser_close_session`, `browser_list_sessions`
+
+### Admin (3)
+`browser_server_status`, `browser_cache_stats`, `browser_clear_cache`
+
+### RE Tools (4)
+`browser_js_beautify`, `browser_js_deobfuscate`, `browser_api_discover`, `browser_auth_analyze`
+
+### Stealth (2)
+`browser_fingerprint`, `browser_human_behavior`
+
+**Toplam**: 40+ tool, 9 kategori
+
+## Geliştirme
+
+```bash
+# Test
+npm test
+npm run test:coverage
+
+# Type check
+npm run lint
+
+# Build
+npm run build
+```
+
+## Mimari
+
+```
+src/
+  core/           # Config, rate-limit, cache, session, sandbox, logger, metrics
+  tools/          # Tool implementasyonları (kategori bazlı)
+    navigation/   # Sayfa navigasyonu
+    interaction/  # Kullanıcı etkileşimi
+    extraction/   # Veri çıkarma
+    network/      # Network izleme
+    browser/      # Browser kontrol
+    session/      # Session yönetimi
+    admin/        # Server yönetimi
+    re/           # Reverse engineering
+    stealth/      # Anti-detection
+  prompts/        # Prompt şablonları
+  index.ts        # Entry point
+```
+
+## Lisans
+
+MIT

package/dist/core/auth.d.ts

@@ -0,0 +1,7 @@
+import type { Middleware } from './pipeline.js';
+/**
+ * Creates an auth middleware that checks apiKey.
+ * If apiKey is not set, the middleware passes through (no auth).
+ */
+export declare function createAuthMiddleware(apiKey?: string): Middleware;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAiBhE"}

package/dist/core/auth.js

@@ -0,0 +1,23 @@
+/**
+ * Creates an auth middleware that checks apiKey.
+ * If apiKey is not set, the middleware passes through (no auth).
+ */
+export function createAuthMiddleware(apiKey) {
+    return async (pc, next) => {
+        if (apiKey) {
+            if (!pc.args.api_key || pc.args.api_key !== apiKey) {
+                return {
+                    ...pc,
+                    response: {
+                        content: [{
+                                type: 'text',
+                                text: JSON.stringify({ ok: false, error: { code: 'UNAUTHORIZED', message: 'Invalid or missing API key' } }),
+                            }],
+                    },
+                };
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBACnD,OAAO;oBACL,GAAG,EAAE;oBACL,QAAQ,EAAE;wBACR,OAAO,EAAE,CAAC;gCACR,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,CAAC;6BAC5G,CAAC;qBACH;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/cache.d.ts

@@ -0,0 +1,24 @@
+export interface CacheConfig {
+    maxEntries: number;
+    ttlMs: number;
+}
+export declare class ResultCache<V = unknown> {
+    private readonly config;
+    private cache;
+    private hits;
+    private misses;
+    constructor(config: CacheConfig);
+    get size(): number;
+    get(key: string): V | undefined;
+    put(key: string, value: V): void;
+    invalidate(key: string): void;
+    clear(): void;
+    stats(): {
+        size: number;
+        hits: number;
+        misses: number;
+        maxEntries: number;
+    };
+    makeKey(toolName: string, args: Record<string, unknown>): string;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/core/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/core/cache.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAOD,qBAAa,WAAW,CAAC,CAAC,GAAG,OAAO;IAKtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,MAAM,CAAK;gBAEU,MAAM,EAAE,WAAW;IAEhD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAkB/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAgBhC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,KAAK,IAAI,IAAI;IAIb,KAAK,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAS3E,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;CAMjE"}

package/dist/core/cache.js

@@ -0,0 +1,67 @@
+import { createHash } from 'node:crypto';
+export class ResultCache {
+    config;
+    cache = new Map();
+    hits = 0;
+    misses = 0;
+    constructor(config) {
+        this.config = config;
+    }
+    get size() {
+        return this.cache.size;
+    }
+    get(key) {
+        const entry = this.cache.get(key);
+        if (!entry) {
+            this.misses++;
+            return undefined;
+        }
+        if (Date.now() > entry.expiresAt) {
+            this.cache.delete(key);
+            this.misses++;
+            return undefined;
+        }
+        // Move to end (most recently used) by deleting and re-setting
+        this.cache.delete(key);
+        this.cache.set(key, entry);
+        this.hits++;
+        return entry.value;
+    }
+    put(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.config.maxEntries) {
+            // Evict LRU (first entry in insertion order)
+            const lruKey = this.cache.keys().next().value;
+            if (lruKey !== undefined) {
+                this.cache.delete(lruKey);
+            }
+        }
+        this.cache.set(key, {
+            value,
+            expiresAt: Date.now() + this.config.ttlMs,
+        });
+    }
+    invalidate(key) {
+        this.cache.delete(key);
+    }
+    clear() {
+        this.cache.clear();
+    }
+    stats() {
+        return {
+            size: this.cache.size,
+            hits: this.hits,
+            misses: this.misses,
+            maxEntries: this.config.maxEntries,
+        };
+    }
+    makeKey(toolName, args) {
+        const hash = createHash('sha256');
+        hash.update(toolName);
+        hash.update(JSON.stringify(args, Object.keys(args).sort()));
+        return hash.digest('hex');
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/core/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/core/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC,MAAM,OAAO,WAAW;IAKO;IAJrB,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IACzC,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IAEnB,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACrD,6CAA6C;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK;QACH,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,IAA6B;QACrD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/core/config.d.ts

@@ -0,0 +1,362 @@
+import { z } from 'zod';
+declare const ViewportSchema: z.ZodObject<{
+    width: z.ZodDefault<z.ZodNumber>;
+    height: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    width: number;
+    height: number;
+}, {
+    width?: number | undefined;
+    height?: number | undefined;
+}>;
+export type ViewportConfig = z.infer<typeof ViewportSchema>;
+declare const BrowserConfigSchema: z.ZodObject<{
+    headless: z.ZodDefault<z.ZodBoolean>;
+    viewport: z.ZodDefault<z.ZodObject<{
+        width: z.ZodDefault<z.ZodNumber>;
+        height: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        width: number;
+        height: number;
+    }, {
+        width?: number | undefined;
+        height?: number | undefined;
+    }>>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    headless: boolean;
+    viewport: {
+        width: number;
+        height: number;
+    };
+    timeout: number;
+    userAgent?: string | undefined;
+    locale?: string | undefined;
+}, {
+    headless?: boolean | undefined;
+    viewport?: {
+        width?: number | undefined;
+        height?: number | undefined;
+    } | undefined;
+    userAgent?: string | undefined;
+    locale?: string | undefined;
+    timeout?: number | undefined;
+}>;
+export type BrowserConfig = z.infer<typeof BrowserConfigSchema>;
+declare const RateLimitConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    globalRpm: z.ZodDefault<z.ZodNumber>;
+    perToolRpm: z.ZodDefault<z.ZodNumber>;
+    burstSize: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    globalRpm: number;
+    perToolRpm: number;
+    burstSize: number;
+}, {
+    enabled?: boolean | undefined;
+    globalRpm?: number | undefined;
+    perToolRpm?: number | undefined;
+    burstSize?: number | undefined;
+}>;
+export type RateLimitConfig = z.infer<typeof RateLimitConfigSchema>;
+declare const CacheConfigSchema: z.ZodObject<{
+    maxEntries: z.ZodDefault<z.ZodNumber>;
+    ttlSeconds: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    maxEntries: number;
+    ttlSeconds: number;
+}, {
+    maxEntries?: number | undefined;
+    ttlSeconds?: number | undefined;
+}>;
+export type CacheConfig = z.infer<typeof CacheConfigSchema>;
+declare const NetworkConfigSchema: z.ZodObject<{
+    maxEntries: z.ZodDefault<z.ZodNumber>;
+    maxResponseBodySize: z.ZodDefault<z.ZodNumber>;
+    storeResponseBodies: z.ZodDefault<z.ZodBoolean>;
+    excludeBodyTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    exportDir: z.ZodDefault<z.ZodString>;
+    captureFailed: z.ZodDefault<z.ZodBoolean>;
+    captureWebSocket: z.ZodDefault<z.ZodBoolean>;
+    websocketMaxFrames: z.ZodDefault<z.ZodNumber>;
+    websocketMaxFramePayloadSize: z.ZodDefault<z.ZodNumber>;
+    maxMemoryBudgetMb: z.ZodDefault<z.ZodNumber>;
+    captureRequestBody: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    maxEntries: number;
+    maxResponseBodySize: number;
+    storeResponseBodies: boolean;
+    excludeBodyTypes: string[];
+    exportDir: string;
+    captureFailed: boolean;
+    captureWebSocket: boolean;
+    websocketMaxFrames: number;
+    websocketMaxFramePayloadSize: number;
+    maxMemoryBudgetMb: number;
+    captureRequestBody: boolean;
+}, {
+    maxEntries?: number | undefined;
+    maxResponseBodySize?: number | undefined;
+    storeResponseBodies?: boolean | undefined;
+    excludeBodyTypes?: string[] | undefined;
+    exportDir?: string | undefined;
+    captureFailed?: boolean | undefined;
+    captureWebSocket?: boolean | undefined;
+    websocketMaxFrames?: number | undefined;
+    websocketMaxFramePayloadSize?: number | undefined;
+    maxMemoryBudgetMb?: number | undefined;
+    captureRequestBody?: boolean | undefined;
+}>;
+export type NetworkConfig = z.infer<typeof NetworkConfigSchema>;
+export { NetworkConfigSchema };
+declare const SecurityConfigSchema: z.ZodObject<{
+    allowedDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    maxMemoryMb: z.ZodDefault<z.ZodNumber>;
+    defaultTimeout: z.ZodDefault<z.ZodNumber>;
+    maxTimeout: z.ZodDefault<z.ZodNumber>;
+    apiKey: z.ZodDefault<z.ZodString>;
+    maxSessions: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    allowedDirs: string[];
+    maxMemoryMb: number;
+    defaultTimeout: number;
+    maxTimeout: number;
+    apiKey: string;
+    maxSessions: number;
+}, {
+    allowedDirs?: string[] | undefined;
+    maxMemoryMb?: number | undefined;
+    defaultTimeout?: number | undefined;
+    maxTimeout?: number | undefined;
+    apiKey?: string | undefined;
+    maxSessions?: number | undefined;
+}>;
+export type SecurityConfig = z.infer<typeof SecurityConfigSchema>;
+declare const ServerConfigSchema: z.ZodObject<{
+    browser: z.ZodDefault<z.ZodObject<{
+        headless: z.ZodDefault<z.ZodBoolean>;
+        viewport: z.ZodDefault<z.ZodObject<{
+            width: z.ZodDefault<z.ZodNumber>;
+            height: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            width: number;
+            height: number;
+        }, {
+            width?: number | undefined;
+            height?: number | undefined;
+        }>>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        headless: boolean;
+        viewport: {
+            width: number;
+            height: number;
+        };
+        timeout: number;
+        userAgent?: string | undefined;
+        locale?: string | undefined;
+    }, {
+        headless?: boolean | undefined;
+        viewport?: {
+            width?: number | undefined;
+            height?: number | undefined;
+        } | undefined;
+        userAgent?: string | undefined;
+        locale?: string | undefined;
+        timeout?: number | undefined;
+    }>>;
+    rateLimit: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        globalRpm: z.ZodDefault<z.ZodNumber>;
+        perToolRpm: z.ZodDefault<z.ZodNumber>;
+        burstSize: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        globalRpm: number;
+        perToolRpm: number;
+        burstSize: number;
+    }, {
+        enabled?: boolean | undefined;
+        globalRpm?: number | undefined;
+        perToolRpm?: number | undefined;
+        burstSize?: number | undefined;
+    }>>;
+    cache: z.ZodDefault<z.ZodObject<{
+        maxEntries: z.ZodDefault<z.ZodNumber>;
+        ttlSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxEntries: number;
+        ttlSeconds: number;
+    }, {
+        maxEntries?: number | undefined;
+        ttlSeconds?: number | undefined;
+    }>>;
+    security: z.ZodDefault<z.ZodObject<{
+        allowedDirs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        maxMemoryMb: z.ZodDefault<z.ZodNumber>;
+        defaultTimeout: z.ZodDefault<z.ZodNumber>;
+        maxTimeout: z.ZodDefault<z.ZodNumber>;
+        apiKey: z.ZodDefault<z.ZodString>;
+        maxSessions: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        allowedDirs: string[];
+        maxMemoryMb: number;
+        defaultTimeout: number;
+        maxTimeout: number;
+        apiKey: string;
+        maxSessions: number;
+    }, {
+        allowedDirs?: string[] | undefined;
+        maxMemoryMb?: number | undefined;
+        defaultTimeout?: number | undefined;
+        maxTimeout?: number | undefined;
+        apiKey?: string | undefined;
+        maxSessions?: number | undefined;
+    }>>;
+    network: z.ZodDefault<z.ZodObject<{
+        maxEntries: z.ZodDefault<z.ZodNumber>;
+        maxResponseBodySize: z.ZodDefault<z.ZodNumber>;
+        storeResponseBodies: z.ZodDefault<z.ZodBoolean>;
+        excludeBodyTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        exportDir: z.ZodDefault<z.ZodString>;
+        captureFailed: z.ZodDefault<z.ZodBoolean>;
+        captureWebSocket: z.ZodDefault<z.ZodBoolean>;
+        websocketMaxFrames: z.ZodDefault<z.ZodNumber>;
+        websocketMaxFramePayloadSize: z.ZodDefault<z.ZodNumber>;
+        maxMemoryBudgetMb: z.ZodDefault<z.ZodNumber>;
+        captureRequestBody: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        maxEntries: number;
+        maxResponseBodySize: number;
+        storeResponseBodies: boolean;
+        excludeBodyTypes: string[];
+        exportDir: string;
+        captureFailed: boolean;
+        captureWebSocket: boolean;
+        websocketMaxFrames: number;
+        websocketMaxFramePayloadSize: number;
+        maxMemoryBudgetMb: number;
+        captureRequestBody: boolean;
+    }, {
+        maxEntries?: number | undefined;
+        maxResponseBodySize?: number | undefined;
+        storeResponseBodies?: boolean | undefined;
+        excludeBodyTypes?: string[] | undefined;
+        exportDir?: string | undefined;
+        captureFailed?: boolean | undefined;
+        captureWebSocket?: boolean | undefined;
+        websocketMaxFrames?: number | undefined;
+        websocketMaxFramePayloadSize?: number | undefined;
+        maxMemoryBudgetMb?: number | undefined;
+        captureRequestBody?: boolean | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    browser: {
+        headless: boolean;
+        viewport: {
+            width: number;
+            height: number;
+        };
+        timeout: number;
+        userAgent?: string | undefined;
+        locale?: string | undefined;
+    };
+    rateLimit: {
+        enabled: boolean;
+        globalRpm: number;
+        perToolRpm: number;
+        burstSize: number;
+    };
+    cache: {
+        maxEntries: number;
+        ttlSeconds: number;
+    };
+    security: {
+        allowedDirs: string[];
+        maxMemoryMb: number;
+        defaultTimeout: number;
+        maxTimeout: number;
+        apiKey: string;
+        maxSessions: number;
+    };
+    network: {
+        maxEntries: number;
+        maxResponseBodySize: number;
+        storeResponseBodies: boolean;
+        excludeBodyTypes: string[];
+        exportDir: string;
+        captureFailed: boolean;
+        captureWebSocket: boolean;
+        websocketMaxFrames: number;
+        websocketMaxFramePayloadSize: number;
+        maxMemoryBudgetMb: number;
+        captureRequestBody: boolean;
+    };
+}, {
+    browser?: {
+        headless?: boolean | undefined;
+        viewport?: {
+            width?: number | undefined;
+            height?: number | undefined;
+        } | undefined;
+        userAgent?: string | undefined;
+        locale?: string | undefined;
+        timeout?: number | undefined;
+    } | undefined;
+    rateLimit?: {
+        enabled?: boolean | undefined;
+        globalRpm?: number | undefined;
+        perToolRpm?: number | undefined;
+        burstSize?: number | undefined;
+    } | undefined;
+    cache?: {
+        maxEntries?: number | undefined;
+        ttlSeconds?: number | undefined;
+    } | undefined;
+    security?: {
+        allowedDirs?: string[] | undefined;
+        maxMemoryMb?: number | undefined;
+        defaultTimeout?: number | undefined;
+        maxTimeout?: number | undefined;
+        apiKey?: string | undefined;
+        maxSessions?: number | undefined;
+    } | undefined;
+    network?: {
+        maxEntries?: number | undefined;
+        maxResponseBodySize?: number | undefined;
+        storeResponseBodies?: boolean | undefined;
+        excludeBodyTypes?: string[] | undefined;
+        exportDir?: string | undefined;
+        captureFailed?: boolean | undefined;
+        captureWebSocket?: boolean | undefined;
+        websocketMaxFrames?: number | undefined;
+        websocketMaxFramePayloadSize?: number | undefined;
+        maxMemoryBudgetMb?: number | undefined;
+        captureRequestBody?: boolean | undefined;
+    } | undefined;
+}>;
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+export type ConfigSource = 'default' | 'file' | 'env' | 'cli';
+export interface ConfigEntry<T> {
+    value: T;
+    source: ConfigSource;
+}
+export declare function loadConfigFile(filePath: string): Partial<ServerConfig>;
+export declare function discoverConfigFile(): string | null;
+export declare function mergeConfigs(fileConfig: Partial<ServerConfig>, envConfig: {
+    browser: Partial<BrowserConfig>;
+    rateLimit: Partial<RateLimitConfig>;
+    cache: Partial<CacheConfig>;
+    security: Partial<SecurityConfig>;
+    network: Partial<NetworkConfig>;
+}, defaults: ServerConfig): ServerConfig;
+export declare function loadConfig(): ServerConfig;
+export declare function getConfig(): ServerConfig;
+/** @internal */
+export declare function reloadConfig(): ServerConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,QAAA,MAAM,cAAc;;;;;;;;;EAGlB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAG5D,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAGpE,QAAA,MAAM,iBAAiB;;;;;;;;;EAGrB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYvB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAOxB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AAE9D,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAqKD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAItE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CA8BlD;AAED,wBAAgB,YAAY,CAC1B,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EACjC,SAAS,EAAE;IACT,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CACjC,EACD,QAAQ,EAAE,YAAY,GACrB,YAAY,CAQd;AAED,wBAAgB,UAAU,IAAI,YAAY,CAezC;AAED,wBAAgB,SAAS,IAAI,YAAY,CAKxC;AAED,gBAAgB;AAChB,wBAAgB,YAAY,IAAI,YAAY,CAG3C"}