@qa-ai-stlc/explorer 0.1.0

package/README.md

@@ -0,0 +1,9 @@
+# @qa-ai-stlc/explorer
+
+The crawler: route discovery from a start URL, following only in-allowlist links, in safe mode.
+Every non-GET request is intercepted and cancelled before it reaches the network, so a crawl can
+never mutate the application under test. Produces a `RouteMap` and a redactable HAR-shaped
+request log for the engine to register as evidence.
+
+Part of [QA-AI-STLC](https://github.com/Klim-101/QA-AI-STLC). See the repository root for
+license, contributing and security information.

package/dist/allowlist.d.ts

@@ -0,0 +1,5 @@
+/** Checks `url`'s hostname against the configured domain allowlist (development plan section 6.4). */
+export declare function isAllowedUrl(url: string, allowlist: readonly string[]): boolean;
+/** Drops the fragment so `#section` links do not look like distinct routes. */
+export declare function normalizeUrl(url: string): string;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAGA,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAUD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD"}

package/dist/allowlist.js

@@ -0,0 +1,22 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/** Checks `url`'s hostname against the configured domain allowlist (development plan section 6.4). */
+export function isAllowedUrl(url, allowlist) {
+    const hostname = tryHostname(url);
+    return hostname !== undefined && allowlist.includes(hostname);
+}
+function tryHostname(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Drops the fragment so `#section` links do not look like distinct routes. */
+export function normalizeUrl(url) {
+    const parsed = new URL(url);
+    parsed.hash = '';
+    return parsed.toString();
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,SAA4B;IACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/crawl.d.ts

@@ -0,0 +1,34 @@
+import { type BrowserLauncher, type Clock } from '@qa-ai-stlc/core';
+import { type IdentityConfig, type RouteMap } from '@qa-ai-stlc/schemas';
+export interface CrawlIdentity {
+    readonly config: IdentityConfig;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** Required, and only used, when `identity.config.auth` is `"cdp-attach"`. */
+    readonly cdpEndpointUrl?: string;
+}
+export interface CrawlOptions {
+    readonly startUrl: string;
+    /** Hostnames the crawl may navigate to (development plan section 6.4); a link outside it is dropped. */
+    readonly allowlist: readonly string[];
+    readonly browserLauncher: BrowserLauncher;
+    /** Signs in before crawling, reusing `authenticate()` (P1-05). Omit to crawl anonymously. */
+    readonly identity?: CrawlIdentity;
+    /** A safety cap on pages visited, independent of how many links are actually reachable. */
+    readonly maxPages?: number;
+    readonly clock?: Clock;
+}
+export interface CrawlResult {
+    readonly routeMap: RouteMap;
+    /** HAR-shaped, redact before registering as `network-har` evidence (development plan section 6.4). */
+    readonly requestLogHar: string;
+    /** Every non-GET request safe mode intercepted and cancelled; always 0 unless something is broken. */
+    readonly blockedRequestCount: number;
+}
+/**
+ * Crawls from `startUrl` by following in-allowlist links only, in safe mode: every non-GET
+ * request is intercepted and aborted before it reaches the network (development plan section 6.4
+ * — mutation budget zero). Produces a `RouteMap` and a redactable request log, never a live
+ * browser or page the caller has to manage.
+ */
+export declare function crawl(options: CrawlOptions): Promise<CrawlResult>;
+//# sourceMappingURL=crawl.d.ts.map

package/dist/crawl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawl.d.ts","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,KAAK,EAEX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sGAAsG;IACtG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAQD;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCvE"}

package/dist/crawl.js

@@ -0,0 +1,98 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { authenticate, systemClock, } from '@qa-ai-stlc/core';
+import { SCHEMA_VERSION, } from '@qa-ai-stlc/schemas';
+import { isAllowedUrl, normalizeUrl } from './allowlist.js';
+import { extractLinks } from './extract-links.js';
+import { buildRequestLogHar } from './request-log.js';
+import { createSafeModeRouteHandler } from './safe-mode.js';
+const DEFAULT_MAX_PAGES = 50;
+/**
+ * Crawls from `startUrl` by following in-allowlist links only, in safe mode: every non-GET
+ * request is intercepted and aborted before it reaches the network (development plan section 6.4
+ * — mutation budget zero). Produces a `RouteMap` and a redactable request log, never a live
+ * browser or page the caller has to manage.
+ */
+export async function crawl(options) {
+    const clock = options.clock ?? systemClock;
+    const maxPages = options.maxPages ?? DEFAULT_MAX_PAGES;
+    const storageState = await resolveStorageState(options);
+    const browser = await options.browserLauncher.launch();
+    try {
+        const context = await browser.newContext(storageState === undefined ? {} : { storageState });
+        const page = await context.newPage();
+        const logEntries = [];
+        let blockedRequestCount = 0;
+        await page.route('**/*', createSafeModeRouteHandler((entry) => {
+            blockedRequestCount += 1;
+            logEntries.push(entry);
+        }));
+        const routes = await visitAllowedRoutes(page, options, maxPages, logEntries);
+        const routeMap = {
+            schemaVersion: SCHEMA_VERSION,
+            generatedAt: clock.now().toISOString(),
+            startUrl: options.startUrl,
+            routes,
+        };
+        return {
+            routeMap,
+            requestLogHar: buildRequestLogHar(logEntries, routeMap.generatedAt),
+            blockedRequestCount,
+        };
+    }
+    finally {
+        await browser.close();
+    }
+}
+async function resolveStorageState(options) {
+    if (options.identity === undefined) {
+        return undefined;
+    }
+    return authenticate(options.browserLauncher, options.identity.config, options.identity.env, {
+        ...(options.identity.cdpEndpointUrl !== undefined
+            ? { cdpEndpointUrl: options.identity.cdpEndpointUrl }
+            : {}),
+    });
+}
+async function visitAllowedRoutes(page, options, maxPages, logEntries) {
+    const visited = new Set();
+    const routes = [];
+    const queue = [{ url: options.startUrl, discoveredVia: 'link' }];
+    while (queue.length > 0 && visited.size < maxPages) {
+        const next = queue.shift();
+        // The while condition already guarantees an element; noUncheckedIndexedAccess still types
+        // shift()'s result as possibly undefined, so this satisfies the type without being reachable.
+        /* v8 ignore next 3 */
+        if (next === undefined) {
+            break;
+        }
+        const url = normalizeUrl(next.url);
+        if (visited.has(url) || !isAllowedUrl(url, options.allowlist)) {
+            continue;
+        }
+        visited.add(url);
+        const response = await page.goto(url);
+        const httpStatus = response?.status();
+        logEntries.push({
+            method: 'GET',
+            url,
+            blocked: false,
+            ...(httpStatus !== undefined ? { status: httpStatus } : {}),
+        });
+        routes.push({
+            url,
+            discoveredVia: next.discoveredVia,
+            ...(next.discoveredFrom !== undefined ? { discoveredFrom: next.discoveredFrom } : {}),
+            ...(httpStatus !== undefined ? { httpStatus } : {}),
+        });
+        if (httpStatus !== undefined && httpStatus < 400) {
+            for (const link of await extractLinks(page)) {
+                if (isAllowedUrl(link, options.allowlist)) {
+                    queue.push({ url: link, discoveredVia: 'link', discoveredFrom: url });
+                }
+            }
+        }
+    }
+    return routes;
+}
+//# sourceMappingURL=crawl.js.map

package/dist/crawl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawl.js","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EACL,YAAY,EACZ,WAAW,GAKZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAwB,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAmC7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAErC,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CACd,MAAM,EACN,0BAA0B,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,mBAAmB,IAAI,CAAC,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE7E,MAAM,QAAQ,GAAa;YACzB,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;SACP,CAAC;QACF,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC;YACnE,mBAAmB;SACpB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAqB;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QAC1F,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAc,EACd,OAAqB,EACrB,QAAgB,EAChB,UAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,0FAA0F;QAC1F,8FAA8F;QAC9F,sBAAsB;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,KAAK;YACb,GAAG;YACH,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,GAAG;YACH,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/extract-links.d.ts

@@ -0,0 +1,9 @@
+import type { AuthPage } from '@qa-ai-stlc/core';
+/**
+ * Reads every `<a href>` on the current page. The callback runs inside the browser (Playwright
+ * serializes it across the CDP boundary), so it can reference DOM globals unavailable to the rest
+ * of this package; `AuthPage.evaluate` is untyped for exactly that reason, so the result is
+ * narrowed here instead of trusted.
+ */
+export declare function extractLinks(page: AuthPage): Promise<readonly string[]>;
+//# sourceMappingURL=extract-links.d.ts.map

package/dist/extract-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-links.d.ts","sourceRoot":"","sources":["../src/extract-links.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAS7E"}

package/dist/extract-links.js

@@ -0,0 +1,17 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Reads every `<a href>` on the current page. The callback runs inside the browser (Playwright
+ * serializes it across the CDP boundary), so it can reference DOM globals unavailable to the rest
+ * of this package; `AuthPage.evaluate` is untyped for exactly that reason, so the result is
+ * narrowed here instead of trusted.
+ */
+export async function extractLinks(page) {
+    /* v8 ignore next 3 -- runs in the browser's own V8 instance, invisible to Node coverage */
+    const result = await page.evaluate(() => Array.from(document.querySelectorAll('a[href]')).map((anchor) => anchor.href));
+    if (!Array.isArray(result)) {
+        return [];
+    }
+    return result.filter((item) => typeof item === 'string');
+}
+//# sourceMappingURL=extract-links.js.map

package/dist/extract-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-links.js","sourceRoot":"","sources":["../src/extract-links.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAItC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,2FAA2F;IAC3F,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC/C,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAE,MAA4B,CAAC,IAAI,CAAC,CACrG,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './allowlist.js';
+export * from './crawl.js';
+export * from './extract-links.js';
+export * from './request-log.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export * from './allowlist.js';
+export * from './crawl.js';
+export * from './extract-links.js';
+export * from './request-log.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}

package/dist/request-log.d.ts

@@ -0,0 +1,9 @@
+export interface RequestLogEntry {
+    readonly method: string;
+    readonly url: string;
+    /** Absent for a request safe mode blocked before it ever reached the network. */
+    readonly status?: number;
+    readonly blocked: boolean;
+}
+export declare function buildRequestLogHar(entries: readonly RequestLogEntry[], generatedAt: string): string;
+//# sourceMappingURL=request-log.d.ts.map

package/dist/request-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-log.d.ts","sourceRoot":"","sources":["../src/request-log.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAMD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAanG"}

package/dist/request-log.js

@@ -0,0 +1,21 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+// HAR 1.2 shaped so `@qa-ai-stlc/core`'s `redactHar` (development plan section 6.4) can strip
+// authorization headers, cookies and set-cookie headers before this is ever registered as
+// evidence; headers and cookies are always present, even empty, so redaction has something to
+// walk.
+export function buildRequestLogHar(entries, generatedAt) {
+    return JSON.stringify({
+        log: {
+            version: '1.2',
+            creator: { name: 'qa-ai-stlc-explorer', version: '0' },
+            entries: entries.map((entry) => ({
+                startedDateTime: generatedAt,
+                blocked: entry.blocked,
+                request: { method: entry.method, url: entry.url, headers: [], cookies: [] },
+                response: entry.status === undefined ? undefined : { status: entry.status, headers: [], cookies: [] },
+            })),
+        },
+    });
+}
+//# sourceMappingURL=request-log.js.map

package/dist/request-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-log.js","sourceRoot":"","sources":["../src/request-log.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAUtC,8FAA8F;AAC9F,0FAA0F;AAC1F,8FAA8F;AAC9F,QAAQ;AACR,MAAM,UAAU,kBAAkB,CAAC,OAAmC,EAAE,WAAmB;IACzF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,EAAE;YACH,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,EAAE;YACtD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/B,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3E,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACtG,CAAC,CAAC;SACJ;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/safe-mode.d.ts

@@ -0,0 +1,10 @@
+import type { RouteHandler } from '@qa-ai-stlc/core';
+import type { RequestLogEntry } from './request-log.js';
+/**
+ * Safe mode's enforcement point (development plan section 6.4): every non-GET request is
+ * intercepted and aborted before it reaches the network, so a crawl can never mutate the
+ * application under test. `onBlocked` is called once per aborted request, for callers that need
+ * to count or log it.
+ */
+export declare function createSafeModeRouteHandler(onBlocked: (entry: RequestLogEntry) => void): RouteHandler;
+//# sourceMappingURL=safe-mode.d.ts.map

package/dist/safe-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-mode.d.ts","sourceRoot":"","sources":["../src/safe-mode.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,YAAY,CASpG"}

package/dist/safe-mode.js

@@ -0,0 +1,19 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Safe mode's enforcement point (development plan section 6.4): every non-GET request is
+ * intercepted and aborted before it reaches the network, so a crawl can never mutate the
+ * application under test. `onBlocked` is called once per aborted request, for callers that need
+ * to count or log it.
+ */
+export function createSafeModeRouteHandler(onBlocked) {
+    return (route) => {
+        const request = route.request();
+        if (request.method() === 'GET') {
+            return route.continue();
+        }
+        onBlocked({ method: request.method(), url: request.url(), blocked: true });
+        return route.abort();
+    };
+}
+//# sourceMappingURL=safe-mode.js.map

package/dist/safe-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-mode.js","sourceRoot":"","sources":["../src/safe-mode.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAKtC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA2C;IACpF,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QACD,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@qa-ai-stlc/explorer",
+  "version": "0.1.0",
+  "description": "The crawler: route discovery in safe mode, redacted request logging, and the route map every later explorer phase builds on.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Klim-101/QA-AI-STLC/tree/main/packages/explorer#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Klim-101/QA-AI-STLC.git",
+    "directory": "packages/explorer"
+  },
+  "bugs": "https://github.com/Klim-101/QA-AI-STLC/issues",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "scripts": {
+    "pretypecheck": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "typecheck": "tsc --noEmit -p .",
+    "pretest": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "test": "vitest run",
+    "pretest:coverage": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/core --workspace @qa-ai-stlc/test-utils",
+    "test:coverage": "vitest run --coverage",
+    "build": "tsc -b tsconfig.build.json",
+    "clean": "node ../../scripts/clean-dir.mjs dist"
+  },
+  "dependencies": {
+    "@qa-ai-stlc/core": "0.1.0",
+    "@qa-ai-stlc/schemas": "0.1.0"
+  },
+  "devDependencies": {
+    "@qa-ai-stlc/test-utils": "0.0.0"
+  }
+}