@zenalexa/unicli 0.207.1

package/dist/engine/endpoint-scorer.js

@@ -0,0 +1,148 @@
+/**
+ * Endpoint Scorer — thin facade over src/engine/analysis.ts.
+ *
+ * The numeric scoring approach has been replaced with composable boolean
+ * predicates and a tuple sort key from analysis.ts. This file re-exports
+ * those functions and provides deduplication and annotation utilities.
+ *
+ * Used by `unicli explore`, `unicli synthesize`, and `unicli generate`.
+ */
+import { isNoiseUrl, isStaticResource, isUsefulEndpoint, endpointSortKey, detectCapability as _detectCapability, } from "./analysis.js";
+// Re-export analysis functions for consumers that import from endpoint-scorer
+export { isNoiseUrl, isStaticResource, isUsefulEndpoint, endpointSortKey, detectCapability, } from "./analysis.js";
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function urlPath(url) {
+    try {
+        const u = new URL(url);
+        return u.origin + u.pathname;
+    }
+    catch {
+        return url;
+    }
+}
+function extractFields(parsed) {
+    if (Array.isArray(parsed)) {
+        if (parsed.length > 0 &&
+            typeof parsed[0] === "object" &&
+            parsed[0] !== null) {
+            return Object.keys(parsed[0]);
+        }
+        return [];
+    }
+    if (typeof parsed === "object" && parsed !== null) {
+        return Object.keys(parsed);
+    }
+    return [];
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Annotate an EndpointEntry with detected fields and capability label.
+ * Replaces the old numeric scoreEndpoint() function.
+ */
+export function annotateEndpoint(entry) {
+    let parsed;
+    if (entry.responseBody) {
+        try {
+            parsed = JSON.parse(entry.responseBody);
+        }
+        catch {
+            // malformed JSON — skip body analysis
+        }
+    }
+    const detectedFields = parsed !== undefined ? extractFields(parsed) : [];
+    const capabilityResult = _detectCapability(entry.url, parsed);
+    return {
+        ...entry,
+        detectedFields,
+        ...(capabilityResult != null ? { capability: capabilityResult } : {}),
+    };
+}
+/**
+ * Deduplicate a list of endpoint entries, keeping one entry per URL path
+ * (origin + pathname, ignoring query string and fragment).
+ *
+ * When multiple entries share the same path, preference is given to entries
+ * with a JSON content-type, a 200 status, and a larger response body.
+ */
+export function deduplicateEndpoints(entries) {
+    const preference = (e) => {
+        let p = 0;
+        if (e.contentType.toLowerCase().includes("json"))
+            p += 10;
+        if (e.status === 200)
+            p += 5;
+        p += Math.min(e.size / 100, 5); // up to +5 for size
+        return p;
+    };
+    const best = new Map();
+    for (const entry of entries) {
+        const path = urlPath(entry.url);
+        const existing = best.get(path);
+        if (!existing || preference(entry) > preference(existing)) {
+            best.set(path, entry);
+        }
+    }
+    return Array.from(best.values());
+}
+/**
+ * Filter, sort, annotate, and deduplicate a list of raw endpoint entries.
+ *
+ * Filter: removes noise URLs and static resources.
+ * Sort: uses endpointSortKey (4-tuple: itemCount, fieldCount, isApiPath, hasParams).
+ * Annotate: adds detectedFields and capability to each entry.
+ * Deduplicate: keeps one entry per URL path.
+ */
+export function processEndpoints(entries) {
+    // Parse bodies once for reuse in filtering and sorting
+    const withParsed = entries.map((entry) => {
+        let parsed;
+        if (entry.responseBody) {
+            try {
+                parsed = JSON.parse(entry.responseBody);
+            }
+            catch {
+                // ignore
+            }
+        }
+        return { entry, parsed };
+    });
+    // Filter out noise and static resources; keep only useful endpoints
+    const filtered = withParsed.filter(({ entry, parsed }) => {
+        if (isNoiseUrl(entry.url))
+            return false;
+        if (isStaticResource(entry.url, entry.contentType))
+            return false;
+        return isUsefulEndpoint({
+            url: entry.url,
+            status: entry.status,
+            contentType: entry.contentType,
+            body: parsed,
+        });
+    });
+    // Sort by endpointSortKey descending
+    filtered.sort((a, b) => {
+        const ka = endpointSortKey({ url: a.entry.url, body: a.parsed });
+        const kb = endpointSortKey({ url: b.entry.url, body: b.parsed });
+        for (let i = 0; i < 4; i++) {
+            if (kb[i] !== ka[i])
+                return kb[i] - ka[i];
+        }
+        return 0;
+    });
+    // Annotate and deduplicate
+    const seen = new Set();
+    const results = [];
+    for (const { entry } of filtered) {
+        const path = urlPath(entry.url);
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        results.push(annotateEndpoint(entry));
+    }
+    return results;
+}
+//# sourceMappingURL=endpoint-scorer.js.map

package/dist/engine/endpoint-scorer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-scorer.js","sourceRoot":"","sources":["../../src/engine/endpoint-scorer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,eAAe,CAAC;AAEvB,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAwBvB,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IACE,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;YAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9D,OAAO;QACL,GAAG,KAAK;QACR,cAAc;QACd,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAwB;IAExB,MAAM,UAAU,GAAG,CAAC,CAAgB,EAAU,EAAE;QAC9C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB;QACpD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,uDAAuD;IACvD,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,IAAI,MAAe,CAAC;QACpB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,oEAAoE;IACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACvD,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/engine/interceptor.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Interceptor Module — Dual fetch + XHR injection with anti-detection stealth.
+ *
+ * Generates JavaScript strings for injecting into browser page context to
+ * intercept both window.fetch and XMLHttpRequest network requests.
+ *
+ * Anti-detection techniques:
+ *   - WeakMap-based toString disguise (prevents Function.prototype.toString detection)
+ *   - enumerable: false on all injected properties
+ *   - Idempotency guard to prevent double-patching
+ */
+/**
+ * Options for interceptor generation.
+ */
+export interface InterceptorOptions {
+    /** Treat pattern as regex, or auto-detect if pattern is wrapped in /slashes/ */
+    regex?: boolean;
+    /** Capture all matching responses (embedded as flag for consumer use) */
+    captureAll?: boolean;
+    /** Capture non-JSON responses as text when JSON parse fails */
+    captureText?: boolean;
+}
+/**
+ * Generate a persistent global interceptor IIFE.
+ *
+ * Patches window.fetch and XMLHttpRequest to capture responses whose
+ * URL matches `pattern` (substring or regex). Results accumulate in
+ * window.__unicli_intercepted. Safe to inject multiple times —
+ * idempotency guard prevents double-patching.
+ */
+export declare function generateInterceptorJs(pattern: string, options?: InterceptorOptions): string;
+/**
+ * Result type for generateTapInterceptorJs — code snippets for the tap step.
+ */
+export interface TapInterceptorSnippets {
+    /** Variable declarations: let __captured, __captureResolve, __capturePromise */
+    setupVar: string;
+    /** Name of the captured variable: "__captured" */
+    capturedVar: string;
+    /** Name of the promise variable: "__capturePromise" */
+    promiseVar: string;
+    /** Name of the resolve variable: "__captureResolve" */
+    resolveVar: string;
+    /** fetch patch snippet (saves origFetch, installs capturing wrapper) */
+    fetchPatch: string;
+    /** XHR patch snippet (saves origXhrOpen/Send, installs capturing wrapper) */
+    xhrPatch: string;
+    /** Restore snippet (restores all originals) */
+    restorePatch: string;
+}
+/**
+ * Generate self-contained code snippets for the tap step.
+ *
+ * Returns individual snippets (not a full IIFE) that can be composed by the
+ * tap step logic. First capture immediately calls __captureResolve() for
+ * Promise.race patterns.
+ */
+export declare function generateTapInterceptorJs(pattern: string, options?: InterceptorOptions): TapInterceptorSnippets;
+/**
+ * Generate JS that reads and clears the intercepted array, returning JSON.
+ *
+ * @param arrayName - window property name (default: "__unicli_intercepted")
+ */
+export declare function generateReadInterceptedJs(arrayName?: string): string;
+//# sourceMappingURL=interceptor.d.ts.map

package/dist/engine/interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../../src/engine/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAsBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,MAAM,CAwHR;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,sBAAsB,CAsFxB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,SAAyB,GACjC,MAAM,CAOR"}

package/dist/engine/interceptor.js

@@ -0,0 +1,256 @@
+/**
+ * Interceptor Module — Dual fetch + XHR injection with anti-detection stealth.
+ *
+ * Generates JavaScript strings for injecting into browser page context to
+ * intercept both window.fetch and XMLHttpRequest network requests.
+ *
+ * Anti-detection techniques:
+ *   - WeakMap-based toString disguise (prevents Function.prototype.toString detection)
+ *   - enumerable: false on all injected properties
+ *   - Idempotency guard to prevent double-patching
+ */
+/**
+ * Determine whether to use regex matching and prepare the pattern.
+ *
+ * Auto-detects /pattern/ syntax. Returns the raw regex source (no slashes)
+ * when regex mode is active.
+ */
+function resolvePatternMode(pattern, options) {
+    if (options?.regex) {
+        return { useRegex: true, cleanPattern: pattern };
+    }
+    // Auto-detect /pattern/ syntax
+    if (pattern.startsWith("/") && pattern.endsWith("/") && pattern.length > 2) {
+        return { useRegex: true, cleanPattern: pattern.slice(1, -1) };
+    }
+    return { useRegex: false, cleanPattern: pattern };
+}
+/**
+ * Generate a persistent global interceptor IIFE.
+ *
+ * Patches window.fetch and XMLHttpRequest to capture responses whose
+ * URL matches `pattern` (substring or regex). Results accumulate in
+ * window.__unicli_intercepted. Safe to inject multiple times —
+ * idempotency guard prevents double-patching.
+ */
+export function generateInterceptorJs(pattern, options) {
+    const { useRegex, cleanPattern } = resolvePatternMode(pattern, options);
+    const patternJson = JSON.stringify(cleanPattern);
+    const captureText = options?.captureText ?? false;
+    const captureAll = options?.captureAll ?? false;
+    return `(function() {
+  if (window.__unicli_interceptor_patched) return;
+  window.__unicli_interceptor_patched = true;
+
+  window.__unicli_intercepted = [];
+
+  // WeakMap for toString disguise — maps patched fn -> original fn
+  if (!window.__dFns) {
+    window.__dFns = new WeakMap();
+    var _origToString = Function.prototype.toString;
+    Object.defineProperty(Function.prototype, 'toString', {
+      value: function() {
+        var orig = window.__dFns.get(this);
+        return orig ? _origToString.call(orig) : _origToString.call(this);
+      },
+      enumerable: false,
+      writable: true,
+      configurable: true
+    });
+  }
+
+  function __defHidden(obj, key, val) {
+    Object.defineProperty(obj, key, {
+      value: val,
+      enumerable: false,
+      writable: true,
+      configurable: true
+    });
+  }
+
+  function __disguise(fn, original) {
+    window.__dFns.set(fn, original);
+    return fn;
+  }
+
+  var __isRegex = ${String(useRegex)};
+  var __captureText = ${String(captureText)};
+  var __captureAll = ${String(captureAll)};
+  var __pattern = __isRegex ? new RegExp(${patternJson}) : ${patternJson};
+
+  function __urlMatches(url) {
+    return __isRegex ? __pattern.test(url) : url.includes(__pattern);
+  }
+
+  // --- Patch window.fetch ---
+  var __origFetch = window.fetch;
+  __defHidden(window, '__unicli_origFetch', __origFetch);
+  var __patchedFetch = __disguise(async function() {
+    var resp = await __origFetch.apply(this, arguments);
+    var url = '';
+    var method = 'GET';
+    var reqBody = undefined;
+    var firstArg = arguments[0];
+    if (typeof firstArg === 'string') {
+      url = firstArg;
+      if (arguments[1]) {
+        if (arguments[1].method) method = arguments[1].method;
+        if (arguments[1].body) { try { reqBody = JSON.parse(arguments[1].body); } catch(_) {} }
+      }
+    } else if (firstArg && typeof firstArg === 'object') {
+      url = firstArg.url || '';
+      method = firstArg.method || 'GET';
+      if (arguments[1] && arguments[1].method) method = arguments[1].method;
+      if (arguments[1] && arguments[1].body) { try { reqBody = JSON.parse(arguments[1].body); } catch(_) {} }
+    }
+    method = method.toUpperCase();
+    if (__urlMatches(url)) {
+      try {
+        var clone = resp.clone();
+        try {
+          var json = await clone.json();
+          window.__unicli_intercepted.push({ url: url, data: json, ts: Date.now(), type: 'json', method: method, status: resp.status, requestBody: reqBody });
+        } catch (_jsonErr) {
+          if (__captureText) {
+            var text = await resp.clone().text();
+            window.__unicli_intercepted.push({ url: url, data: text, ts: Date.now(), type: 'text', method: method, status: resp.status, requestBody: reqBody });
+          }
+        }
+      } catch (_e) {}
+    }
+    return resp;
+  }, __origFetch);
+  __defHidden(window, 'fetch', __patchedFetch);
+
+  // --- Patch XMLHttpRequest ---
+  var __origOpen = XMLHttpRequest.prototype.open;
+  var __origSend = XMLHttpRequest.prototype.send;
+
+  XMLHttpRequest.prototype.open = __disguise(function(method, url) {
+    __defHidden(this, '__unicli_url', typeof url === 'string' ? url : String(url));
+    __defHidden(this, '__unicli_method', (typeof method === 'string' ? method : 'GET').toUpperCase());
+    return __origOpen.apply(this, arguments);
+  }, __origOpen);
+
+  XMLHttpRequest.prototype.send = __disguise(function(body) {
+    var xhr = this;
+    var captureUrl = xhr.__unicli_url || '';
+    var reqBody = undefined;
+    if (body) { try { reqBody = JSON.parse(body); } catch(_) {} }
+    if (__urlMatches(captureUrl)) {
+      xhr.addEventListener('load', function() {
+        try {
+          var json = JSON.parse(xhr.responseText);
+          window.__unicli_intercepted.push({ url: captureUrl, data: json, ts: Date.now(), type: 'json', method: xhr.__unicli_method || 'GET', status: xhr.status, requestBody: reqBody });
+        } catch (_jsonErr) {
+          if (__captureText) {
+            window.__unicli_intercepted.push({ url: captureUrl, data: xhr.responseText, ts: Date.now(), type: 'text', method: xhr.__unicli_method || 'GET', status: xhr.status, requestBody: reqBody });
+          }
+        }
+      });
+    }
+    return __origSend.apply(this, arguments);
+  }, __origSend);
+})();`;
+}
+/**
+ * Generate self-contained code snippets for the tap step.
+ *
+ * Returns individual snippets (not a full IIFE) that can be composed by the
+ * tap step logic. First capture immediately calls __captureResolve() for
+ * Promise.race patterns.
+ */
+export function generateTapInterceptorJs(pattern, options) {
+    const { useRegex, cleanPattern } = resolvePatternMode(pattern, options);
+    const patternJson = JSON.stringify(cleanPattern);
+    const captureText = options?.captureText ?? false;
+    const matchSetup = useRegex
+        ? `var __tapIsRegex = true;\nvar __tapPattern = new RegExp(${patternJson});\nvar __tapCaptureText = ${String(captureText)};`
+        : `var __tapIsRegex = false;\nvar __tapPattern = ${patternJson};\nvar __tapCaptureText = ${String(captureText)};`;
+    const matchExpr = `__tapIsRegex ? __tapPattern.test(url) : url.includes(__tapPattern)`;
+    const matchExprCapture = `__tapIsRegex ? __tapPattern.test(captureUrl) : captureUrl.includes(__tapPattern)`;
+    const setupVar = `
+var __captured = null;
+var __captureResolve;
+var __capturePromise = new Promise(function(resolve) { __captureResolve = resolve; });
+${matchSetup}
+`.trim();
+    const fetchPatch = `
+var origFetch = window.fetch;
+window.fetch = async function() {
+  var resp = await origFetch.apply(this, arguments);
+  var url = '';
+  var firstArg = arguments[0];
+  if (typeof firstArg === 'string') { url = firstArg; }
+  else if (firstArg && typeof firstArg === 'object' && firstArg.url) { url = firstArg.url; }
+  if (${matchExpr}) {
+    try {
+      var clone = resp.clone();
+      try {
+        var json = await clone.json();
+        if (!__captured) { __captured = { url: url, data: json, ts: Date.now(), type: 'json' }; __captureResolve(__captured); }
+      } catch (_jsonErr) {
+        if (__tapCaptureText) {
+          var text = await resp.clone().text();
+          if (!__captured) { __captured = { url: url, data: text, ts: Date.now(), type: 'text' }; __captureResolve(__captured); }
+        }
+      }
+    } catch (_e) {}
+  }
+  return resp;
+};
+`.trim();
+    const xhrPatch = `
+var origXhrOpen = XMLHttpRequest.prototype.open;
+var origXhrSend = XMLHttpRequest.prototype.send;
+XMLHttpRequest.prototype.open = function(method, url) {
+  Object.defineProperty(this, '__tap_url', { value: typeof url === 'string' ? url : String(url), enumerable: false, writable: true, configurable: true });
+  return origXhrOpen.apply(this, arguments);
+};
+XMLHttpRequest.prototype.send = function() {
+  var xhr = this;
+  var captureUrl = xhr.__tap_url || '';
+  if (${matchExprCapture}) {
+    xhr.addEventListener('load', function() {
+      try {
+        var json = JSON.parse(xhr.responseText);
+        if (!__captured) { __captured = { url: captureUrl, data: json, ts: Date.now(), type: 'json' }; __captureResolve(__captured); }
+      } catch (_jsonErr) {
+        if (__tapCaptureText) {
+          if (!__captured) { __captured = { url: captureUrl, data: xhr.responseText, ts: Date.now(), type: 'text' }; __captureResolve(__captured); }
+        }
+      }
+    });
+  }
+  return origXhrSend.apply(this, arguments);
+};
+`.trim();
+    const restorePatch = `
+window.fetch = origFetch;
+XMLHttpRequest.prototype.open = origXhrOpen;
+XMLHttpRequest.prototype.send = origXhrSend;
+`.trim();
+    return {
+        setupVar,
+        capturedVar: "__captured",
+        promiseVar: "__capturePromise",
+        resolveVar: "__captureResolve",
+        fetchPatch,
+        xhrPatch,
+        restorePatch,
+    };
+}
+/**
+ * Generate JS that reads and clears the intercepted array, returning JSON.
+ *
+ * @param arrayName - window property name (default: "__unicli_intercepted")
+ */
+export function generateReadInterceptedJs(arrayName = "__unicli_intercepted") {
+    const nameJson = JSON.stringify(arrayName);
+    return `(function() {
+  var data = window[${nameJson}] || [];
+  window[${nameJson}] = [];
+  return JSON.stringify(data);
+})()`;
+}
+//# sourceMappingURL=interceptor.js.map

package/dist/engine/interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../../src/engine/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAcH;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,OAAe,EACf,OAA4B;IAE5B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IACD,+BAA+B;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC;IAClD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,KAAK,CAAC;IAEhD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmCW,MAAM,CAAC,QAAQ,CAAC;wBACZ,MAAM,CAAC,WAAW,CAAC;uBACpB,MAAM,CAAC,UAAU,CAAC;2CACE,WAAW,OAAO,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA2ElE,CAAC;AACP,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,OAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC;IAElD,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,2DAA2D,WAAW,8BAA8B,MAAM,CAAC,WAAW,CAAC,GAAG;QAC5H,CAAC,CAAC,iDAAiD,WAAW,6BAA6B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;IAEpH,MAAM,SAAS,GAAG,oEAAoE,CAAC;IACvF,MAAM,gBAAgB,GAAG,kFAAkF,CAAC;IAE5G,MAAM,QAAQ,GAAG;;;;EAIjB,UAAU;CACX,CAAC,IAAI,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG;;;;;;;;QAQb,SAAS;;;;;;;;;;;;;;;;CAgBhB,CAAC,IAAI,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG;;;;;;;;;;QAUX,gBAAgB;;;;;;;;;;;;;;CAcvB,CAAC,IAAI,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG;;;;CAItB,CAAC,IAAI,EAAE,CAAC;IAEP,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,YAAY;QACzB,UAAU,EAAE,kBAAkB;QAC9B,UAAU,EAAE,kBAAkB;QAC9B,UAAU;QACV,QAAQ;QACR,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAS,GAAG,sBAAsB;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO;sBACa,QAAQ;WACnB,QAAQ;;KAEd,CAAC;AACN,CAAC"}

package/dist/engine/proxy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * HTTP proxy support via undici EnvHttpProxyAgent.
+ * Respects http_proxy, https_proxy, HTTP_PROXY, HTTPS_PROXY, no_proxy, NO_PROXY.
+ */
+import { EnvHttpProxyAgent } from "undici";
+/**
+ * Get a shared EnvHttpProxyAgent that respects proxy environment variables.
+ * Returns undefined if no proxy env vars are set (use default fetch behavior).
+ */
+export declare function getProxyAgent(): EnvHttpProxyAgent | undefined;
+/**
+ * Check if proxy environment is configured.
+ */
+export declare function hasProxyConfig(): boolean;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/engine/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/engine/proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAI3C;;;GAGG;AACH,wBAAgB,aAAa,IAAI,iBAAiB,GAAG,SAAS,CAY7D;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAOxC"}

package/dist/engine/proxy.js

@@ -0,0 +1,32 @@
+/**
+ * HTTP proxy support via undici EnvHttpProxyAgent.
+ * Respects http_proxy, https_proxy, HTTP_PROXY, HTTPS_PROXY, no_proxy, NO_PROXY.
+ */
+import { EnvHttpProxyAgent } from "undici";
+let _agent;
+/**
+ * Get a shared EnvHttpProxyAgent that respects proxy environment variables.
+ * Returns undefined if no proxy env vars are set (use default fetch behavior).
+ */
+export function getProxyAgent() {
+    const proxyUrl = process.env.http_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTPS_PROXY;
+    if (!proxyUrl)
+        return undefined;
+    if (!_agent) {
+        _agent = new EnvHttpProxyAgent();
+    }
+    return _agent;
+}
+/**
+ * Check if proxy environment is configured.
+ */
+export function hasProxyConfig() {
+    return !!(process.env.http_proxy ||
+        process.env.HTTP_PROXY ||
+        process.env.https_proxy ||
+        process.env.HTTPS_PROXY);
+}
+//# sourceMappingURL=proxy.js.map

package/dist/engine/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/engine/proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAE3C,IAAI,MAAqC,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC1B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,CAAC,CACP,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW,CACxB,CAAC;AACJ,CAAC"}

package/dist/engine/rate-limiter.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Token bucket rate limiter — per-domain request throttling.
+ * Shared across pipeline executions within the same process.
+ */
+export declare function waitForToken(domain: string, rpm: number): Promise<void>;
+export declare function clearBuckets(): void;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/engine/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/engine/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB7E;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}

package/dist/engine/rate-limiter.js

@@ -0,0 +1,31 @@
+/**
+ * Token bucket rate limiter — per-domain request throttling.
+ * Shared across pipeline executions within the same process.
+ */
+const buckets = new Map();
+export async function waitForToken(domain, rpm) {
+    const now = Date.now();
+    let bucket = buckets.get(domain);
+    if (!bucket) {
+        bucket = { tokens: rpm, lastRefill: now, rpm };
+        buckets.set(domain, bucket);
+    }
+    // Refill tokens based on elapsed time
+    const elapsed = now - bucket.lastRefill;
+    const tokensToAdd = (elapsed / 60000) * bucket.rpm;
+    bucket.tokens = Math.min(bucket.rpm, bucket.tokens + tokensToAdd);
+    bucket.lastRefill = now;
+    if (bucket.tokens >= 1) {
+        bucket.tokens -= 1;
+        return;
+    }
+    // Wait for next token
+    const waitMs = ((1 - bucket.tokens) / bucket.rpm) * 60000;
+    await new Promise((r) => setTimeout(r, waitMs));
+    bucket.tokens = 0;
+    bucket.lastRefill = Date.now();
+}
+export function clearBuckets() {
+    buckets.clear();
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/engine/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/engine/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;IACnD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;IAClE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/dist/engine/repair/config.d.ts

@@ -0,0 +1,24 @@
+/**
+ * RepairConfig — configuration types and defaults for the self-repair loop.
+ */
+export type MetricDirection = "higher" | "lower";
+export interface RepairConfig {
+    site: string;
+    command?: string;
+    maxIterations: number;
+    timeout: number;
+    direction: MetricDirection;
+    metricPattern: RegExp;
+    scope: string[];
+    verify: string;
+    guard?: string;
+    minDelta: number;
+}
+/**
+ * Extract metric value from command stdout using the configured pattern.
+ * For SCORE=N/M, returns N (the numerator).
+ * Returns null if no match found.
+ */
+export declare function extractMetric(stdout: string, pattern: RegExp): number | null;
+export declare function buildDefaultConfig(site: string, command?: string): RepairConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/engine/repair/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/engine/repair/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5E;AAOD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,YAAY,CA0Bd"}

package/dist/engine/repair/config.js

@@ -0,0 +1,46 @@
+/**
+ * RepairConfig — configuration types and defaults for the self-repair loop.
+ */
+/**
+ * Extract metric value from command stdout using the configured pattern.
+ * For SCORE=N/M, returns N (the numerator).
+ * Returns null if no match found.
+ */
+export function extractMetric(stdout, pattern) {
+    pattern.lastIndex = 0; // Reset for stateful (global/sticky) regexes
+    const match = pattern.exec(stdout);
+    if (!match || match[1] === undefined)
+        return null;
+    const value = Number(match[1]);
+    return Number.isNaN(value) ? null : value;
+}
+/**
+ * Build sensible defaults for a repair config targeting a site (and optional command).
+ */
+const SAFE_NAME = /^[a-z0-9][a-z0-9._-]*$/i;
+export function buildDefaultConfig(site, command) {
+    if (!SAFE_NAME.test(site))
+        throw new Error(`Invalid site name: ${site}`);
+    if (command && !SAFE_NAME.test(command))
+        throw new Error(`Invalid command name: ${command}`);
+    const scope = [
+        `src/adapters/${site}/**/*.yaml`,
+        `src/adapters/${site}/**/*.ts`,
+    ];
+    const verify = command
+        ? `npx unicli test ${site} ${command}`
+        : `npx unicli test ${site}`;
+    return {
+        site,
+        command,
+        maxIterations: 20,
+        timeout: 90_000,
+        direction: "higher",
+        metricPattern: /SCORE=(\d+)\/(\d+)/,
+        scope,
+        verify,
+        guard: undefined,
+        minDelta: 0,
+    };
+}
+//# sourceMappingURL=config.js.map