@opentabs-dev/mcp-server 0.0.19

package/dist/audit-disk.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persistent audit log — appends tool invocations to ~/.opentabs/audit.log as NDJSON.
+ *
+ * Each line is a self-contained JSON object matching the AuditEntry interface.
+ * The file is created with 0600 permissions on first write and rotated when
+ * it exceeds 10 MB (audit.log → audit.log.1, keeping at most 1 rotated file).
+ *
+ * Disk writes are fire-and-forget: errors are logged but never block tool dispatch.
+ */
+import type { AuditEntry } from './state.js';
+/** Get the path to the audit log file */
+declare const getAuditLogPath: () => string;
+/**
+ * Append an audit entry to the disk-based audit log.
+ *
+ * Fire-and-forget: errors are caught and logged, never thrown.
+ * Rotation is checked before each write for simplicity.
+ */
+declare const appendAuditEntryToDisk: (entry: AuditEntry) => Promise<void>;
+/** Reset initialized state (for testing) */
+declare const _resetInitialized: () => void;
+export { appendAuditEntryToDisk, getAuditLogPath, _resetInitialized };
+//# sourceMappingURL=audit-disk.d.ts.map

package/dist/audit-disk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-disk.d.ts","sourceRoot":"","sources":["../src/audit-disk.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAiC7C,yCAAyC;AACzC,QAAA,MAAM,eAAe,QAAO,MAA2C,CAAC;AAExE;;;;;GAKG;AACH,QAAA,MAAM,sBAAsB,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,IAAI,CAuBrE,CAAC;AAEF,4CAA4C;AAC5C,QAAA,MAAM,iBAAiB,QAAO,IAE7B,CAAC;AAEF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/audit-disk.js

@@ -0,0 +1,74 @@
+/**
+ * Persistent audit log — appends tool invocations to ~/.opentabs/audit.log as NDJSON.
+ *
+ * Each line is a self-contained JSON object matching the AuditEntry interface.
+ * The file is created with 0600 permissions on first write and rotated when
+ * it exceeds 10 MB (audit.log → audit.log.1, keeping at most 1 rotated file).
+ *
+ * Disk writes are fire-and-forget: errors are logged but never block tool dispatch.
+ */
+import { getConfigDir } from './config.js';
+import { log } from './logger.js';
+import { appendFile, chmod, rename, stat, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Maximum audit.log size before rotation (10 MB) */
+const MAX_AUDIT_FILE_SIZE = 10 * 1024 * 1024;
+/** Whether the audit file has been initialized this session (permissions set) */
+let initialized = false;
+/**
+ * Rotate the audit log if it exceeds MAX_AUDIT_FILE_SIZE.
+ * Renames audit.log → audit.log.1, deleting any existing audit.log.1 first.
+ */
+const rotateIfNeeded = async (auditPath) => {
+    try {
+        const stats = await stat(auditPath);
+        if (stats.size < MAX_AUDIT_FILE_SIZE)
+            return;
+        const rotatedPath = auditPath + '.1';
+        // Delete any existing rotated file
+        await unlink(rotatedPath).catch(() => { });
+        // Rename current → rotated
+        await rename(auditPath, rotatedPath);
+        log.info(`Rotated audit log (${(stats.size / 1024 / 1024).toFixed(1)} MB) → audit.log.1`);
+    }
+    catch (err) {
+        // File doesn't exist yet or stat failed — no rotation needed
+        if (err.code === 'ENOENT')
+            return;
+        log.warn(`Audit log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+};
+/** Get the path to the audit log file */
+const getAuditLogPath = () => join(getConfigDir(), 'audit.log');
+/**
+ * Append an audit entry to the disk-based audit log.
+ *
+ * Fire-and-forget: errors are caught and logged, never thrown.
+ * Rotation is checked before each write for simplicity.
+ */
+const appendAuditEntryToDisk = async (entry) => {
+    try {
+        const auditPath = getAuditLogPath();
+        const line = JSON.stringify(entry) + '\n';
+        // Rotate if the file exceeds the size limit
+        await rotateIfNeeded(auditPath);
+        // Append the entry
+        await appendFile(auditPath, line, { mode: 0o600 });
+        // Set permissions on first write this session
+        if (!initialized) {
+            await chmod(auditPath, 0o600).catch((err) => {
+                log.warn(`Warning: Could not set file permissions on ${auditPath}: ${err instanceof Error ? err.message : String(err)}. The audit file may be readable by other users.`);
+            });
+            initialized = true;
+        }
+    }
+    catch (err) {
+        log.warn(`Failed to write audit entry to disk: ${err instanceof Error ? err.message : String(err)}`);
+    }
+};
+/** Reset initialized state (for testing) */
+const _resetInitialized = () => {
+    initialized = false;
+};
+export { appendAuditEntryToDisk, getAuditLogPath, _resetInitialized };
+//# sourceMappingURL=audit-disk.js.map

package/dist/audit-disk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-disk.js","sourceRoot":"","sources":["../src/audit-disk.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,qDAAqD;AACrD,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,iFAAiF;AACjF,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,cAAc,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,GAAG,mBAAmB;YAAE,OAAO;QAE7C,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QAErC,mCAAmC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE1C,2BAA2B;QAC3B,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAErC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC;AAEF,yCAAyC;AACzC,MAAM,eAAe,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAiB,EAAiB,EAAE;IACxE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAE1C,4CAA4C;QAC5C,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAEhC,mBAAmB;QACnB,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnD,8CAA8C;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACnD,GAAG,CAAC,IAAI,CACN,8CAA8C,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAC/J,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG,GAAS,EAAE;IACnC,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC,CAAC;AAEF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/browser-tools/analyze-site/detect-apis.d.ts

@@ -0,0 +1,36 @@
+/**
+ * API pattern detection module for the site analyzer.
+ *
+ * Pure analysis function: takes captured network requests (the format returned
+ * by browser_get_network_requests), classifies by protocol, groups by base
+ * path, and filters noise. Does not call browser tools directly.
+ */
+import type { NetworkRequest } from './detect-auth.js';
+/** Supported API protocol classifications for captured network requests. */
+type ApiProtocol = 'rest' | 'graphql' | 'grpc-web' | 'jsonrpc' | 'trpc' | 'websocket' | 'sse' | 'form-submission';
+/** A single detected API endpoint with its protocol, auth info, and call frequency. */
+interface ApiEndpoint {
+    url: string;
+    method: string;
+    contentType: string | undefined;
+    protocol: ApiProtocol;
+    authHeader: string | undefined;
+    requestBodySample: string | undefined;
+    responseStatus: number | undefined;
+    callCount: number;
+}
+/** Result of API pattern detection: classified endpoints and the primary API base URL. */
+interface ApiAnalysis {
+    endpoints: ApiEndpoint[];
+    primaryApiBaseUrl: string | undefined;
+}
+/**
+ * Analyze captured network requests and detect API patterns.
+ *
+ * This is a pure function: takes an array of captured network requests,
+ * classifies by protocol, groups by endpoint, and filters noise.
+ */
+declare const detectApis: (requests: NetworkRequest[]) => ApiAnalysis;
+export { detectApis };
+export type { ApiProtocol, ApiEndpoint, ApiAnalysis };
+//# sourceMappingURL=detect-apis.d.ts.map

package/dist/browser-tools/analyze-site/detect-apis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-apis.d.ts","sourceRoot":"","sources":["../../../src/browser-tools/analyze-site/detect-apis.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,4EAA4E;AAC5E,KAAK,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAElH,uFAAuF;AACvF,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0FAA0F;AAC1F,UAAU,WAAW;IACnB,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAkVD;;;;;GAKG;AACH,QAAA,MAAM,UAAU,GAAI,UAAU,cAAc,EAAE,KAAG,WAyDhD,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/browser-tools/analyze-site/detect-apis.js

@@ -0,0 +1,383 @@
+/**
+ * API pattern detection module for the site analyzer.
+ *
+ * Pure analysis function: takes captured network requests (the format returned
+ * by browser_get_network_requests), classifies by protocol, groups by base
+ * path, and filters noise. Does not call browser tools directly.
+ */
+// ---------------------------------------------------------------------------
+// Noise filtering
+// ---------------------------------------------------------------------------
+/** File extensions for static assets that are never API calls. */
+const STATIC_ASSET_EXTENSIONS = new Set([
+    '.js',
+    '.mjs',
+    '.cjs',
+    '.css',
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.svg',
+    '.ico',
+    '.woff',
+    '.woff2',
+    '.ttf',
+    '.eot',
+    '.otf',
+    '.map',
+    '.webp',
+    '.avif',
+    '.mp4',
+    '.webm',
+    '.mp3',
+    '.wav',
+    '.pdf',
+]);
+/** Known analytics/tracking domains to ignore. */
+const ANALYTICS_DOMAINS = new Set([
+    'google-analytics.com',
+    'www.google-analytics.com',
+    'analytics.google.com',
+    'googletagmanager.com',
+    'www.googletagmanager.com',
+    'segment.io',
+    'api.segment.io',
+    'cdn.segment.com',
+    'mixpanel.com',
+    'api.mixpanel.com',
+    'api-js.mixpanel.com',
+    'sentry.io',
+    'o0.ingest.sentry.io',
+    'hotjar.com',
+    'script.hotjar.com',
+    'static.hotjar.com',
+    'fullstory.com',
+    'rs.fullstory.com',
+    'amplitude.com',
+    'api.amplitude.com',
+    'cdn.amplitude.com',
+    'heap.io',
+    'heapanalytics.com',
+    'cdn.heapanalytics.com',
+    'intercom.io',
+    'api-iam.intercom.io',
+    'widget.intercom.io',
+    'px.ads.linkedin.com',
+    'facebook.com',
+    'connect.facebook.net',
+    'graph.facebook.com',
+    'bat.bing.com',
+    'clarity.ms',
+    'newrelic.com',
+    'bam.nr-data.net',
+    'js-agent.newrelic.com',
+    'datadog.com',
+    'browser-intake-datadoghq.com',
+    'rum.browser-intake-datadoghq.com',
+    'plausible.io',
+    'stats.wp.com',
+]);
+/** Returns true if the URL points to a static asset based on file extension. */
+const isStaticAsset = (url) => {
+    try {
+        const pathname = new URL(url).pathname;
+        const lastSegment = pathname.split('/').pop() ?? '';
+        const dotIndex = lastSegment.lastIndexOf('.');
+        if (dotIndex === -1)
+            return false;
+        return STATIC_ASSET_EXTENSIONS.has(lastSegment.slice(dotIndex).toLowerCase());
+    }
+    catch {
+        return false;
+    }
+};
+/** Returns true if the URL belongs to a known analytics/tracking domain. */
+const isAnalyticsDomain = (url) => {
+    try {
+        const hostname = new URL(url).hostname;
+        // Check exact match and parent domain match
+        if (ANALYTICS_DOMAINS.has(hostname))
+            return true;
+        // Check if any analytics domain is a suffix of the hostname
+        for (const domain of ANALYTICS_DOMAINS) {
+            if (hostname.endsWith(`.${domain}`))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+};
+/** Returns true if the URL looks like a browser extension request. */
+const isExtensionRequest = (url) => url.startsWith('chrome-extension://') || url.startsWith('moz-extension://');
+/** Returns true if the request should be filtered out as noise. */
+const isNoise = (req) => {
+    if (isExtensionRequest(req.url))
+        return true;
+    if (isAnalyticsDomain(req.url))
+        return true;
+    if (isStaticAsset(req.url))
+        return true;
+    // Tracking pixels: GET requests for 1x1 images or /pixel paths
+    if (req.method === 'GET') {
+        try {
+            const pathname = new URL(req.url).pathname;
+            if (pathname.includes('/pixel') || pathname.includes('/track') || pathname.includes('/beacon'))
+                return true;
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    return false;
+};
+// ---------------------------------------------------------------------------
+// Protocol classification
+// ---------------------------------------------------------------------------
+/** Case-insensitive header value lookup. */
+const getHeaderValue = (headers, name) => {
+    const lower = name.toLowerCase();
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() === lower)
+            return v;
+    }
+    return undefined;
+};
+/** Detect the auth header name used on a request (for reporting). */
+const detectAuthHeader = (headers) => {
+    if (!headers)
+        return undefined;
+    for (const key of Object.keys(headers)) {
+        const lower = key.toLowerCase();
+        if (lower === 'authorization')
+            return key;
+        if (lower === 'x-api-key' || lower === 'api-key' || lower === 'apikey')
+            return key;
+    }
+    return undefined;
+};
+/** Classify the protocol of a network request. */
+const classifyProtocol = (req) => {
+    const contentType = (req.mimeType ?? getHeaderValue(req.requestHeaders ?? {}, 'content-type') ?? '').toLowerCase();
+    const url = req.url.toLowerCase();
+    // gRPC-Web: check content type
+    if (contentType.includes('application/grpc-web'))
+        return 'grpc-web';
+    // SSE: text/event-stream response
+    if (req.responseHeaders) {
+        const responseContentType = getHeaderValue(req.responseHeaders, 'content-type') ?? '';
+        if (responseContentType.toLowerCase().includes('text/event-stream'))
+            return 'sse';
+    }
+    // WebSocket: upgrade requests
+    if (req.requestHeaders) {
+        const upgrade = getHeaderValue(req.requestHeaders, 'upgrade');
+        if (upgrade && upgrade.toLowerCase() === 'websocket')
+            return 'websocket';
+    }
+    // Also detect WebSocket from URL scheme
+    if (url.startsWith('wss://') || url.startsWith('ws://'))
+        return 'websocket';
+    // tRPC: requests to /api/trpc/ or /trpc/ paths
+    try {
+        const pathname = new URL(req.url).pathname;
+        if (/\/(api\/)?trpc\//i.test(pathname))
+            return 'trpc';
+    }
+    catch {
+        // Ignore parse errors
+    }
+    // GraphQL: POST to /graphql path with query field in body
+    if (req.method === 'POST') {
+        try {
+            const pathname = new URL(req.url).pathname;
+            if (pathname.endsWith('/graphql') || pathname.endsWith('/graphql/')) {
+                return 'graphql';
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+        // Also check request body for GraphQL queries
+        if (req.requestBody) {
+            try {
+                const body = JSON.parse(req.requestBody);
+                if ('query' in body && typeof body.query === 'string') {
+                    return 'graphql';
+                }
+            }
+            catch {
+                // Not JSON
+            }
+        }
+    }
+    // JSON-RPC: body with jsonrpc field
+    if (req.method === 'POST' && req.requestBody) {
+        try {
+            const body = JSON.parse(req.requestBody);
+            if (body.jsonrpc === '2.0') {
+                return 'jsonrpc';
+            }
+        }
+        catch {
+            // Not JSON
+        }
+    }
+    // Form submission: POST with form content type
+    if (req.method === 'POST' &&
+        (contentType.includes('application/x-www-form-urlencoded') || contentType.includes('multipart/form-data'))) {
+        return 'form-submission';
+    }
+    // REST: JSON content type or standard HTTP methods with JSON-like responses
+    if (contentType.includes('application/json') || contentType.includes('text/json')) {
+        return 'rest';
+    }
+    // Check response content type for JSON
+    if (req.responseHeaders) {
+        const responseContentType = getHeaderValue(req.responseHeaders, 'content-type') ?? '';
+        if (responseContentType.toLowerCase().includes('application/json'))
+            return 'rest';
+    }
+    // Remaining XHR/fetch requests that don't match a specific protocol
+    // Only classify if it looks like an API call (not a page navigation)
+    if (['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+        try {
+            const pathname = new URL(req.url).pathname;
+            if (pathname.includes('/api/') ||
+                pathname.includes('/v1/') ||
+                pathname.includes('/v2/') ||
+                pathname.includes('/v3/')) {
+                return 'rest';
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    return undefined;
+};
+// ---------------------------------------------------------------------------
+// Grouping
+// ---------------------------------------------------------------------------
+/** Generate a grouping key for deduplication: method + normalized URL path. */
+const groupKey = (req) => {
+    try {
+        const parsed = new URL(req.url);
+        // Remove query params and fragments for grouping
+        return `${req.method} ${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return `${req.method} ${req.url}`;
+    }
+};
+/** Truncate a request body to a maximum length for sampling. */
+const truncateBody = (body, maxLen) => {
+    if (!body)
+        return undefined;
+    if (body.length <= maxLen)
+        return body;
+    return body.slice(0, maxLen) + '...';
+};
+// ---------------------------------------------------------------------------
+// Primary API base URL detection
+// ---------------------------------------------------------------------------
+/** Find the most common origin+path prefix among classified API requests. */
+const detectPrimaryApiBaseUrl = (endpoints) => {
+    if (endpoints.length === 0)
+        return undefined;
+    // Collect all origin+path prefixes at varying depths (1 segment, 2 segments, etc.)
+    // and find the deepest prefix shared by the most endpoints.
+    const prefixCounts = new Map();
+    for (const endpoint of endpoints) {
+        try {
+            const parsed = new URL(endpoint.url);
+            const pathSegments = parsed.pathname.split('/').filter(Boolean);
+            // Register origin alone and each incremental path prefix
+            prefixCounts.set(parsed.origin, (prefixCounts.get(parsed.origin) ?? 0) + endpoint.callCount);
+            for (let depth = 1; depth <= Math.min(pathSegments.length, 3); depth++) {
+                const prefix = `${parsed.origin}/${pathSegments.slice(0, depth).join('/')}`;
+                prefixCounts.set(prefix, (prefixCounts.get(prefix) ?? 0) + endpoint.callCount);
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    if (prefixCounts.size === 0)
+        return undefined;
+    // Find the deepest prefix that is shared by at least 2 endpoints (or all if only 1)
+    const totalEndpoints = endpoints.reduce((sum, e) => sum + e.callCount, 0);
+    const minCount = totalEndpoints > 1 ? 2 : 1;
+    let bestPrefix;
+    let bestDepth = -1;
+    let bestCount = 0;
+    for (const [prefix, count] of prefixCounts) {
+        if (count < minCount)
+            continue;
+        const depth = prefix.split('/').length;
+        // Prefer deeper prefixes with sufficient coverage, break ties by count
+        if (depth > bestDepth || (depth === bestDepth && count > bestCount)) {
+            bestDepth = depth;
+            bestCount = count;
+            bestPrefix = prefix;
+        }
+    }
+    return bestPrefix;
+};
+// ---------------------------------------------------------------------------
+// Main export
+// ---------------------------------------------------------------------------
+const MAX_BODY_SAMPLE_LENGTH = 500;
+/**
+ * Analyze captured network requests and detect API patterns.
+ *
+ * This is a pure function: takes an array of captured network requests,
+ * classifies by protocol, groups by endpoint, and filters noise.
+ */
+const detectApis = (requests) => {
+    // Phase 1: Filter noise
+    const apiRequests = requests.filter(req => !isNoise(req));
+    // Phase 2: Classify and group
+    const groups = new Map();
+    for (const req of apiRequests) {
+        const protocol = classifyProtocol(req);
+        if (!protocol)
+            continue;
+        const key = groupKey(req);
+        const existing = groups.get(key);
+        if (existing) {
+            existing.callCount += 1;
+            // Keep the first response status and body sample
+        }
+        else {
+            const contentType = req.mimeType ?? getHeaderValue(req.requestHeaders ?? {}, 'content-type') ?? undefined;
+            groups.set(key, {
+                url: (() => {
+                    try {
+                        const parsed = new URL(req.url);
+                        return `${parsed.origin}${parsed.pathname}`;
+                    }
+                    catch {
+                        return req.url;
+                    }
+                })(),
+                method: req.method,
+                contentType,
+                protocol,
+                authHeader: detectAuthHeader(req.requestHeaders),
+                requestBodySample: truncateBody(req.requestBody, MAX_BODY_SAMPLE_LENGTH),
+                responseStatus: req.status,
+                callCount: 1,
+            });
+        }
+    }
+    const endpoints = [...groups.values()];
+    return {
+        endpoints,
+        primaryApiBaseUrl: detectPrimaryApiBaseUrl(endpoints),
+    };
+};
+export { detectApis };
+//# sourceMappingURL=detect-apis.js.map

package/dist/browser-tools/analyze-site/detect-apis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-apis.js","sourceRoot":"","sources":["../../../src/browser-tools/analyze-site/detect-apis.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,sBAAsB;IACtB,sBAAsB;IACtB,0BAA0B;IAC1B,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,mBAAmB;IACnB,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,SAAS;IACT,mBAAmB;IACnB,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,cAAc;IACd,sBAAsB;IACtB,oBAAoB;IACpB,cAAc;IACd,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,aAAa;IACb,8BAA8B;IAC9B,kCAAkC;IAClC,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAW,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,4CAA4C;QAC5C,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,4DAA4D;QAC5D,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAW,EAAE,CAClD,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAE9E,mEAAmE;AACnE,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAW,EAAE;IAC/C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,+DAA+D;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,4CAA4C;AAC5C,MAAM,cAAc,GAAG,CAAC,OAA+B,EAAE,IAAY,EAAsB,EAAE;IAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,CAAC,OAA2C,EAAsB,EAAE;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,eAAe;YAAE,OAAO,GAAG,CAAC;QAC1C,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,CAAC,GAAmB,EAA2B,EAAE;IACxE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnH,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAElC,+BAA+B;IAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,UAAU,CAAC;IAEpE,kCAAkC;IAClC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,mBAAmB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,CAAC;IAED,8BAA8B;IAC9B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;IAC3E,CAAC;IACD,wCAAwC;IACxC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAE5E,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,0DAA0D;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,8CAA8C;QAC9C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA4B,CAAC;gBACpE,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACtD,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA4B,CAAC;YACpE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,CAAC,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EAC1G,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uCAAuC;IACvC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,mBAAmB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,OAAO,MAAM,CAAC;IACpF,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC3C,IACE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzB,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAU,EAAE;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,iDAAiD;QACjD,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;AACH,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,YAAY,GAAG,CAAC,IAAwB,EAAE,MAAc,EAAsB,EAAE;IACpF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AACvC,CAAC,CAAC;AAEF,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,CAAC,SAAwB,EAAsB,EAAE;IAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,mFAAmF;IACnF,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChE,yDAAyD;YACzD,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5E,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,oFAAoF;IACpF,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5C,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,QAAQ;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACvC,uEAAuE;QACvE,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC;YACpE,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS,GAAG,KAAK,CAAC;YAClB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAC,QAA0B,EAAe,EAAE;IAC7D,wBAAwB;IACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,8BAA8B;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAYnB,CAAC;IAEJ,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;YACxB,iDAAiD;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,cAAc,CAAC,IAAI,SAAS,CAAC;YAC1G,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,GAAG,EAAE,CAAC,GAAG,EAAE;oBACT,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAChC,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC9C,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,GAAG,CAAC,GAAG,CAAC;oBACjB,CAAC;gBACH,CAAC,CAAC,EAAE;gBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW;gBACX,QAAQ;gBACR,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC;gBAChD,iBAAiB,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC;gBACxE,cAAc,EAAE,GAAG,CAAC,MAAM;gBAC1B,SAAS,EAAE,CAAC;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvC,OAAO;QACL,SAAS;QACT,iBAAiB,EAAE,uBAAuB,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/browser-tools/analyze-site/detect-auth.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Authentication detection module for the site analyzer.
+ *
+ * Pure analysis function: takes captured network requests and page execution
+ * results, returns structured auth analysis. Does not call browser tools
+ * directly — the orchestrator (analyze-site/index.ts) collects data and
+ * passes it here.
+ */
+/** Captured network request (subset of CapturedRequest from browser-extension). */
+interface NetworkRequest {
+    url: string;
+    method: string;
+    status?: number;
+    requestHeaders?: Record<string, string>;
+    responseHeaders?: Record<string, string>;
+    requestBody?: string;
+    mimeType?: string;
+}
+/** A cookie visible from the page context, with name and value. */
+interface CookieEntry {
+    name: string;
+    value: string;
+}
+/** A key-value entry from localStorage or sessionStorage. */
+interface StorageEntry {
+    key: string;
+    value: string;
+}
+/** A window global with its dot-notation path and runtime value. */
+interface GlobalEntry {
+    path: string;
+    value: unknown;
+}
+/** A CSRF token found in the DOM via a meta tag or hidden input field. */
+interface CsrfDomToken {
+    source: 'meta' | 'hidden-input';
+    name: string;
+    value: string;
+}
+/** Data collected by the orchestrator and passed to detectAuth. */
+interface AuthDetectionInput {
+    cookies: CookieEntry[];
+    localStorageEntries: StorageEntry[];
+    sessionStorageEntries: StorageEntry[];
+    networkRequests: NetworkRequest[];
+    csrfDomTokens: CsrfDomToken[];
+    windowGlobals: GlobalEntry[];
+}
+/** Discriminator for the kind of authentication mechanism detected on a page. */
+type AuthMethodType = 'cookie-session' | 'jwt-localstorage' | 'jwt-sessionstorage' | 'bearer-header' | 'api-key-header' | 'csrf-token' | 'basic-auth' | 'custom-auth-header' | 'auth-global';
+/** A single detected authentication method with a description and extraction hint for plugin authors. */
+interface AuthMethod {
+    type: AuthMethodType;
+    details: string;
+    extractionHint: string;
+}
+/** Result of authentication detection: whether the page is authenticated and which methods were found. */
+interface AuthAnalysis {
+    authenticated: boolean;
+    methods: AuthMethod[];
+}
+/**
+ * Analyze collected page data and detect authentication methods.
+ *
+ * This is a pure function: takes data in, returns structured results.
+ * The orchestrator (US-005) collects the data via browser tools and
+ * passes it here.
+ */
+declare const detectAuth: (input: AuthDetectionInput) => AuthAnalysis;
+export { detectAuth };
+export type { AuthDetectionInput, AuthAnalysis, AuthMethod, AuthMethodType, NetworkRequest, CookieEntry, StorageEntry, GlobalEntry, CsrfDomToken, };
+//# sourceMappingURL=detect-auth.d.ts.map

package/dist/browser-tools/analyze-site/detect-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-auth.d.ts","sourceRoot":"","sources":["../../../src/browser-tools/analyze-site/detect-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,mFAAmF;AACnF,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,UAAU,YAAY;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oEAAoE;AACpE,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,0EAA0E;AAC1E,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,UAAU,kBAAkB;IAC1B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,mBAAmB,EAAE,YAAY,EAAE,CAAC;IACpC,qBAAqB,EAAE,YAAY,EAAE,CAAC;IACtC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE,WAAW,EAAE,CAAC;CAC9B;AAMD,iFAAiF;AACjF,KAAK,cAAc,GACf,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,eAAe,GACf,gBAAgB,GAChB,YAAY,GACZ,YAAY,GACZ,oBAAoB,GACpB,aAAa,CAAC;AAElB,yGAAyG;AACzG,UAAU,UAAU;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,0GAA0G;AAC1G,UAAU,YAAY;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAuXD;;;;;;GAMG;AACH,QAAA,MAAM,UAAU,GAAI,OAAO,kBAAkB,KAAG,YAqC/C,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,GACb,CAAC"}