@zenalexa/unicli 0.210.0 → 0.212.1

package/dist/engine/yaml-runner.d.ts

@@ -16,11 +16,12 @@
  */
 import type { PipelineStep } from "../types.js";
 import type { BrowserPage } from "../browser/page.js";
+import { type WebsocketStepConfig } from "./websocket.js";
 export interface PipelineOptions {
     site?: string;
     strategy?: string;
 }
-type PipelineContext = {
+export type PipelineContext = {
     data: unknown;
     args: Record<string, unknown>;
     vars: Record<string, unknown>;
@@ -80,8 +81,85 @@ export declare class PipelineError extends Error {
         adapter: string | undefined;
     };
 }
+/**
+ * SSRF defence — reject request URLs that point at non-http(s) schemes or
+ * reserved local address ranges before we issue the fetch.
+ *
+ * The attack shape this blocks: a YAML adapter takes `${{ args.query }}`
+ * and interpolates it into the request URL. An attacker (or a careless
+ * template author) feeds a payload like `http://169.254.169.254/latest/meta-data/`
+ * (AWS IMDS) or `http://127.0.0.1:19825/internal` (Uni-CLI daemon). Without
+ * this guard the runner happily fetches it and returns the response —
+ * leaking credentials or driving the daemon.
+ *
+ * The check is intentionally conservative: only http/https, and no loopback
+ * / link-local / private metadata addresses. Set `UNICLI_ALLOW_LOCAL=1` to
+ * bypass — useful for local dev / testing where a developer intentionally
+ * targets `127.0.0.1` or a docker compose stack on a private subnet.
+ */
+export declare function assertSafeRequestUrl(raw: string): void;
+/** Exposed for tests — reset the shared bus between runs. */
+export declare function __resetTransportBusForTests(): void;
 export declare function runPipeline(steps: PipelineStep[], args: Record<string, unknown>, base?: string, options?: PipelineOptions): Promise<unknown[]>;
+export interface AssertConfig {
+    url?: string;
+    selector?: string;
+    text?: string;
+    condition?: string;
+    message?: string;
+}
+export declare function stepAssert(ctx: PipelineContext, config: AssertConfig, stepIndex: number): Promise<PipelineContext>;
+export interface FetchConfig {
+    url: string;
+    method?: string;
+    params?: Record<string, unknown>;
+    headers?: Record<string, string>;
+    body?: unknown;
+    retry?: number;
+    backoff?: number;
+    cache?: number;
+}
+export declare function stepFetch(ctx: PipelineContext, config: FetchConfig): Promise<PipelineContext>;
+export declare function stepSelect(ctx: PipelineContext, path: string, stepIndex: number): PipelineContext;
+export declare function stepMap(ctx: PipelineContext, template: Record<string, string>): PipelineContext;
+export declare function stepFilter(ctx: PipelineContext, expr: string): PipelineContext;
+export declare function stepLimit(ctx: PipelineContext, config: unknown): PipelineContext;
+export declare function stepFetchText(ctx: PipelineContext, config: FetchConfig): Promise<PipelineContext>;
+export interface RssConfig {
+    fields?: Record<string, string>;
+}
+export declare function stepParseRss(ctx: PipelineContext, config: RssConfig | undefined): PipelineContext;
+export interface SortConfig {
+    by: string;
+    order?: "asc" | "desc";
+}
+export declare function stepSort(ctx: PipelineContext, config: SortConfig): PipelineContext;
+export interface ExecConfig {
+    command: string;
+    args?: string[];
+    parse?: "lines" | "json" | "csv" | "text";
+    timeout?: number;
+    stdin?: string;
+    env?: Record<string, string>;
+    output_file?: string;
+}
+export declare function stepExec(ctx: PipelineContext, config: ExecConfig): Promise<PipelineContext>;
+export declare function stepHtmlToMd(ctx: PipelineContext): PipelineContext;
 declare function buildScope(ctx: PipelineContext): Record<string, unknown>;
+export declare function stepSet(ctx: PipelineContext, config: Record<string, unknown>): PipelineContext;
+export declare function stepAppend(ctx: PipelineContext, key: string): PipelineContext;
+export declare function stepIf(ctx: PipelineContext, config: {
+    if: string;
+    then?: PipelineStep[];
+    else?: PipelineStep[];
+}, stepIndex: number, depth?: number): Promise<PipelineContext>;
+export interface EachConfig {
+    max?: number;
+    do: PipelineStep[];
+    until?: string;
+}
+export declare function stepEach(ctx: PipelineContext, config: EachConfig, stepIndex: number, depth: number): Promise<PipelineContext>;
+export declare function stepParallel(ctx: PipelineContext, branches: PipelineStep[], merge: string, stepIndex: number, depth: number): Promise<PipelineContext>;
 /**
  * Built-in pipe filters — used in template expressions like:
  *   ${{ item.tags | join(', ') }}
@@ -98,5 +176,85 @@ declare const PIPE_FILTERS: Record<string, (...args: unknown[]) => unknown>;
  * Supports pipe filters: ${{ expr | join(', ') | slice(0, 100) }}
  */
 declare function evalExpression(expr: string, scope: Record<string, unknown>): unknown;
+export interface WriteTempConfig {
+    filename: string;
+    content: string;
+}
+export declare function stepWriteTemp(ctx: PipelineContext, config: WriteTempConfig): PipelineContext;
+export interface NavigateConfig {
+    url: string;
+    settleMs?: number;
+    waitUntil?: "load" | "domcontentloaded" | "networkidle" | "commit";
+}
+export declare function stepNavigate(ctx: PipelineContext, config: NavigateConfig): Promise<PipelineContext>;
+export interface EvaluateConfig {
+    expression: string;
+}
+export declare function stepEvaluate(ctx: PipelineContext, config: EvaluateConfig | string): Promise<PipelineContext>;
+export interface ClickConfig {
+    selector?: string;
+    x?: number;
+    y?: number;
+    quads?: boolean;
+}
+export declare function stepClick(ctx: PipelineContext, config: ClickConfig | string): Promise<PipelineContext>;
+export interface TypeConfig {
+    text: string;
+    selector?: string;
+    submit?: boolean;
+}
+export declare function stepType(ctx: PipelineContext, config: TypeConfig): Promise<PipelineContext>;
+export interface WaitBrowserConfig {
+    ms?: number;
+    selector?: string;
+    timeout?: number;
+}
+export declare function stepWaitBrowser(ctx: PipelineContext, config: WaitBrowserConfig | number): Promise<PipelineContext>;
+export interface InterceptConfig {
+    trigger: string;
+    capture: string;
+    select?: string;
+    timeout?: number;
+    regex?: boolean;
+    all?: boolean;
+    captureText?: boolean;
+}
+export declare function stepIntercept(ctx: PipelineContext, config: InterceptConfig): Promise<PipelineContext>;
+export declare function stepPress(ctx: PipelineContext, config: unknown): Promise<PipelineContext>;
+export declare function stepScroll(ctx: PipelineContext, config: unknown): Promise<PipelineContext>;
+export declare function stepSnapshot(ctx: PipelineContext, config: unknown): Promise<PipelineContext>;
+export interface TapConfig {
+    store: string;
+    action: string;
+    capture: string;
+    timeout?: number;
+    select?: string;
+    framework?: "pinia" | "vuex" | "auto";
+    args?: unknown[];
+}
+export declare function stepTap(ctx: PipelineContext, config: TapConfig): Promise<PipelineContext>;
+export interface DownloadStepConfig {
+    url: string;
+    dir?: string;
+    filename?: string;
+    concurrency?: number;
+    skip_existing?: boolean;
+    use_ytdlp?: boolean;
+    type?: "auto" | "image" | "video" | "document";
+    content?: string;
+}
+export declare function stepDownload(ctx: PipelineContext, config: DownloadStepConfig): Promise<PipelineContext>;
+export declare function stepWebsocket(ctx: PipelineContext, config: WebsocketStepConfig): Promise<PipelineContext>;
+interface FieldDef {
+    selector: string;
+    type?: "text" | "number" | "html" | "attribute";
+    attribute?: string;
+    pattern?: string;
+}
+export interface ExtractConfig {
+    from: string;
+    fields: Record<string, FieldDef>;
+}
+export declare function stepExtract(ctx: PipelineContext, config: ExtractConfig): Promise<PipelineContext>;
 export { PIPE_FILTERS, evalExpression, buildScope };
 //# sourceMappingURL=yaml-runner.d.ts.map

package/dist/engine/yaml-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml-runner.d.ts","sourceRoot":"","sources":["../../src/engine/yaml-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkBH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,KAAK,eAAe,GAAG;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EACL,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,+FAA+F;QAC/F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;gBArBD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EACL,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,+FAA+F;QAC/F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;IAMH,4EAA4E;IAC5E,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM;;;cA1BtB,MAAM;gBACJ,MAAM;gBACN,OAAO;mBAEX,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB;cAChB,MAAM;qBACC,MAAM;0BACD,MAAM;oBACZ,MAAM;;;;CAqBvB;AAmID,wBAAsB,WAAW,CAC/B,KAAK,EAAE,YAAY,EAAE,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA2PpB;AA+yBD,iBAAS,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBjE;AA8OD;;;;;GAKG;AACH,QAAA,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAyFjE,CAAC;AA0GF;;;;;;;GAOG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA6D7E;AA6wBD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"yaml-runner.d.ts","sourceRoot":"","sources":["../../src/engine/yaml-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkBH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AActD,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAmB5E,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EACL,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,+FAA+F;QAC/F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;gBArBD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EACL,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,+FAA+F;QAC/F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;IAMH,4EAA4E;IAC5E,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM;;;cA1BtB,MAAM;gBACJ,MAAM;gBACN,OAAO;mBAEX,YAAY,GACZ,eAAe,GACf,cAAc,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,kBAAkB;cAChB,MAAM;qBACC,MAAM;0BACD,MAAM;oBACZ,MAAM;;;;CAqBvB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA+CtD;AAmCD,6DAA6D;AAC7D,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAwKD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,YAAY,EAAE,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC,CA2PpB;AAkCD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAsE1B;AAqBD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAmE1B;AA4ID,wBAAgB,UAAU,CACxB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,eAAe,CAkBjB;AAED,wBAAgB,OAAO,CACrB,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,eAAe,CAgBjB;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,eAAe,CAUjB;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,OAAO,GACd,eAAe,CAYjB;AAID,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAsD1B;AAID,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAC5B,eAAe,CAkDjB;AAiBD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,wBAAgB,QAAQ,CACtB,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,UAAU,GACjB,eAAe,CAejB;AAID,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,eAAe,CAAC,CAqL1B;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,eAAe,CAQlE;AAsBD,iBAAS,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBjE;AAID,wBAAgB,OAAO,CACrB,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,eAAe,CAQjB;AAID,wBAAgB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAc7E;AAID,wBAAsB,MAAM,CAC1B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAA;CAAE,EACpE,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAU,GAChB,OAAO,CAAC,eAAe,CAAC,CAuC1B;AAID,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,YAAY,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,YAAY,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CA6D1B;AAuBD;;;;;GAKG;AACH,QAAA,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAyFjE,CAAC;AA0GF;;;;;;;GAOG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA6D7E;AAkDD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,eAAe,GACtB,eAAe,CAejB;AAsED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,aAAa,GAAG,QAAQ,CAAC;CACpE;AA8BD,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,cAAc,GAAG,MAAM,GAC9B,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,WAAW,GAAG,MAAM,GAC3B,OAAO,CAAC,eAAe,CAAC,CAoC1B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,iBAAiB,GAAG,MAAM,GACjC,OAAO,CAAC,eAAe,CAAC,CAU1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CA0E1B;AAID,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,eAAe,CAAC,CAc1B;AAID,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAID,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,wBAAsB,OAAO,CAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,CAiH1B;AA8BD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,eAAe,CAAC,CAwD1B;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAID,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAClC;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAGD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}

package/dist/engine/yaml-runner.js

@@ -30,6 +30,16 @@ import { generateInterceptorJs, generateReadInterceptedJs, } from "./interceptor
 import { httpDownload, ytdlpDownload, requiresYtdlp, sanitizeFilename, generateFilename, mapConcurrent, } from "./download.js";
 import { executeWebsocket } from "./websocket.js";
 import { getProxyAgent } from "./proxy.js";
+import { createTransportBus } from "../transport/bus.js";
+import { CuaTransport } from "../transport/adapters/cua.js";
+import { DesktopAxTransport } from "../transport/adapters/desktop-ax.js";
+import { DesktopUiaTransport } from "../transport/adapters/desktop-uia.js";
+import { DesktopAtspiTransport } from "../transport/adapters/desktop-atspi.js";
+import { HttpTransport } from "../transport/adapters/http.js";
+import { SubprocessTransport } from "../transport/adapters/subprocess.js";
+import { CdpBrowserTransport } from "../transport/adapters/cdp-browser.js";
+import { CUA_STEP_HANDLERS } from "./steps/cua.js";
+import { DESKTOP_AX_STEP_HANDLERS, } from "./steps/desktop-ax.js";
 const execFileAsync = promisify(execFile);
 /**
  * Structured pipeline error — designed for AI agent consumption.
@@ -63,6 +73,116 @@ const SIBLING_KEYS = new Set([
     "retry",
     "backoff",
 ]);
+/**
+ * SSRF defence — reject request URLs that point at non-http(s) schemes or
+ * reserved local address ranges before we issue the fetch.
+ *
+ * The attack shape this blocks: a YAML adapter takes `${{ args.query }}`
+ * and interpolates it into the request URL. An attacker (or a careless
+ * template author) feeds a payload like `http://169.254.169.254/latest/meta-data/`
+ * (AWS IMDS) or `http://127.0.0.1:19825/internal` (Uni-CLI daemon). Without
+ * this guard the runner happily fetches it and returns the response —
+ * leaking credentials or driving the daemon.
+ *
+ * The check is intentionally conservative: only http/https, and no loopback
+ * / link-local / private metadata addresses. Set `UNICLI_ALLOW_LOCAL=1` to
+ * bypass — useful for local dev / testing where a developer intentionally
+ * targets `127.0.0.1` or a docker compose stack on a private subnet.
+ */
+export function assertSafeRequestUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw new Error(`invalid URL for pipeline fetch: ${raw.slice(0, 120)}`);
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:") {
+        throw new Error(`disallowed URL scheme for pipeline fetch: ${u.protocol} (only http/https)`);
+    }
+    if (process.env.UNICLI_ALLOW_LOCAL === "1")
+        return;
+    // Node's URL.hostname keeps the IPv6 brackets (`[::1]`) around the
+    // zero-compressed literal; strip them before comparing. This is load-
+    // bearing — a missing strip means `[::1]` and `[fe80::...]` slip past
+    // the check.
+    const hostnameLower = u.hostname.toLowerCase();
+    const host = hostnameLower.startsWith("[") && hostnameLower.endsWith("]")
+        ? hostnameLower.slice(1, -1)
+        : hostnameLower;
+    // Literal loopback / unspecified / link-local / cloud metadata
+    if (host === "localhost" ||
+        host === "0.0.0.0" ||
+        host === "::" ||
+        host === "::1" ||
+        host === "metadata.google.internal" ||
+        host === "metadata" ||
+        // IPv6 link-local (fe80::/10) and unique-local (fc00::/7 → fc/fd prefix)
+        host.startsWith("fe80:") ||
+        host.startsWith("fc") ||
+        host.startsWith("fd") ||
+        // IPv4 CIDR check — crude but covers the most common SSRF vectors.
+        // Full RFC-6890 enumeration is overkill for adapter fetches; if you
+        // need to target those ranges, set UNICLI_ALLOW_LOCAL=1.
+        host.startsWith("127.") ||
+        host.startsWith("10.") ||
+        host.startsWith("169.254.") ||
+        host.startsWith("192.168.") ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(host)) {
+        throw new Error(`blocked fetch to reserved/local address ${host} — set UNICLI_ALLOW_LOCAL=1 to override`);
+    }
+}
+/**
+ * Lazily-created transport bus — the capability registry for the runner.
+ *
+ * All seven v0.212 transports are registered so `bus.require(step)` gives
+ * an honest answer for every pipeline step name in the capability matrix.
+ * The legacy step executors (stepFetch / stepExec / browser ops) still run
+ * their own code paths for v0.212 compatibility — registering the HTTP,
+ * subprocess, and CDP transports here does NOT eagerly open Chrome or
+ * spawn a process; `open()` is only called when a handler dispatches
+ * through the bus (currently only the `cua_*` and `ax_*` step families).
+ *
+ * This is deliberately lightweight: the bus is the single source of truth
+ * for capability declarations; full execution routing through the bus is
+ * the v0.213 destination.
+ */
+let sharedBus;
+function getBus() {
+    if (sharedBus)
+        return sharedBus;
+    const bus = createTransportBus();
+    // Order matters only for fallback lookup — register in the canonical
+    // order from src/transport/capability.ts:TRANSPORT_KINDS.
+    bus.register(new HttpTransport());
+    bus.register(new CdpBrowserTransport());
+    bus.register(new SubprocessTransport());
+    bus.register(new DesktopAxTransport());
+    bus.register(new DesktopUiaTransport());
+    bus.register(new DesktopAtspiTransport());
+    bus.register(new CuaTransport());
+    sharedBus = bus;
+    return bus;
+}
+/** Exposed for tests — reset the shared bus between runs. */
+export function __resetTransportBusForTests() {
+    sharedBus = undefined;
+}
+function buildTransportCtx(ctx) {
+    return {
+        cwd: process.cwd(),
+        env: process.env,
+        cookieHeader: ctx.cookieHeader,
+        vars: ctx.vars,
+        bus: getBus(),
+    };
+}
+function isCuaStep(action) {
+    return action in CUA_STEP_HANDLERS;
+}
+function isDesktopAxStep(action) {
+    return action in DESKTOP_AX_STEP_HANDLERS;
+}
 function getActionEntry(step) {
     const entries = Object.entries(step);
     return (entries.find(([k]) => !SIBLING_KEYS.has(k)) ?? entries[0]);
@@ -141,6 +261,26 @@ async function executeStep(ctx, action, config, stepIndex, fullStep, depth) {
         case "extract":
             return stepExtract(ctx, config);
         default: {
+            // CUA family + macOS AX family dispatch through the transport bus.
+            // `action()` never throws — envelopes surface via ctx.vars.lastEnvelope.
+            if (isCuaStep(action)) {
+                const handler = CUA_STEP_HANDLERS[action];
+                const params = config && typeof config === "object" && !Array.isArray(config)
+                    ? config
+                    : {};
+                const envelope = await handler({ bus: getBus(), transportCtx: buildTransportCtx(ctx) }, params);
+                ctx.vars["lastEnvelope"] = envelope;
+                return { ...ctx, data: envelope.ok ? envelope.data : envelope };
+            }
+            if (isDesktopAxStep(action)) {
+                const handler = DESKTOP_AX_STEP_HANDLERS[action];
+                const params = config && typeof config === "object" && !Array.isArray(config)
+                    ? config
+                    : {};
+                const envelope = await handler({ bus: getBus(), transportCtx: buildTransportCtx(ctx) }, params);
+                ctx.vars["lastEnvelope"] = envelope;
+                return { ...ctx, data: envelope.ok ? envelope.data : envelope };
+            }
             // Check plugin custom step registry before giving up
             const { getCustomStep } = await import("../plugin/step-registry.js");
             const customHandler = getCustomStep(action);
@@ -423,7 +563,7 @@ function getBackoffMs(step, config) {
     }
     return 1000;
 }
-async function stepAssert(ctx, config, stepIndex) {
+export async function stepAssert(ctx, config, stepIndex) {
     const page = ctx.page ? ctx.page : undefined;
     // URL assertion
     if (config.url) {
@@ -480,8 +620,9 @@ function assertionError(message, config, stepIndex) {
         alternatives: [],
     });
 }
-async function stepFetch(ctx, config) {
+export async function stepFetch(ctx, config) {
     let url = evalTemplate(config.url, ctx);
+    assertSafeRequestUrl(url);
     // If data is an array of items with IDs, fetch each one (fan-out with concurrency limit)
     if (Array.isArray(ctx.data)) {
         const items = ctx.data;
@@ -492,6 +633,7 @@ async function stepFetch(ctx, config) {
         const results = await mapConcurrent(items, concurrency, async (item) => {
             const itemCtx = { ...ctx, data: item };
             const itemUrl = evalTemplate(config.url, itemCtx);
+            assertSafeRequestUrl(itemUrl);
             const resolvedConfig = config.body
                 ? { ...config, body: resolveTemplateDeep(config.body, itemCtx) }
                 : config;
@@ -657,7 +799,7 @@ async function fetchJson(url, config, cookieHeader) {
     // Unreachable — loop always returns or throws — but satisfies TypeScript
     throw new Error("fetchJson: unreachable");
 }
-function stepSelect(ctx, path, stepIndex) {
+export function stepSelect(ctx, path, stepIndex) {
     const resolved = evalTemplate(path, ctx);
     const data = getNestedValue(ctx.data, resolved);
     if (data === undefined || data === null) {
@@ -673,7 +815,7 @@ function stepSelect(ctx, path, stepIndex) {
     }
     return { ...ctx, data };
 }
-function stepMap(ctx, template) {
+export function stepMap(ctx, template) {
     if (!Array.isArray(ctx.data))
         return ctx;
     const items = ctx.data;
@@ -689,7 +831,7 @@ function stepMap(ctx, template) {
     });
     return { ...ctx, data: mapped };
 }
-function stepFilter(ctx, expr) {
+export function stepFilter(ctx, expr) {
     if (!Array.isArray(ctx.data))
         return ctx;
     const items = ctx.data;
@@ -699,7 +841,7 @@ function stepFilter(ctx, expr) {
     });
     return { ...ctx, data: filtered };
 }
-function stepLimit(ctx, config) {
+export function stepLimit(ctx, config) {
     if (!Array.isArray(ctx.data))
         return ctx;
     let n;
@@ -713,8 +855,9 @@ function stepLimit(ctx, config) {
     return { ...ctx, data: ctx.data.slice(0, n) };
 }
 // --- fetch_text: like fetch but returns raw text (for XML/RSS/HTML) ---
-async function stepFetchText(ctx, config) {
+export async function stepFetchText(ctx, config) {
     let url = evalTemplate(config.url, ctx);
+    assertSafeRequestUrl(url);
     if (config.params) {
         const params = new URLSearchParams();
         for (const [k, v] of Object.entries(config.params)) {
@@ -757,7 +900,7 @@ async function stepFetchText(ctx, config) {
     const text = await resp.text();
     return { ...ctx, data: text };
 }
-function stepParseRss(ctx, config) {
+export function stepParseRss(ctx, config) {
     const xml = String(ctx.data ?? "");
     const items = [];
     // Support both RSS 2.0 (<item>) and Atom (<entry>) formats
@@ -812,7 +955,7 @@ function extractXmlTag(xml, tag) {
     const m = xml.match(new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}>`));
     return m ? m[1].trim() : "";
 }
-function stepSort(ctx, config) {
+export function stepSort(ctx, config) {
     if (!Array.isArray(ctx.data))
         return ctx;
     const items = [...ctx.data];
@@ -830,7 +973,7 @@ function stepSort(ctx, config) {
     });
     return { ...ctx, data: items };
 }
-async function stepExec(ctx, config) {
+export async function stepExec(ctx, config) {
     const cmd = evalTemplate(config.command, ctx);
     const execArgs = (config.args ?? []).map((a) => evalTemplate(String(a), ctx));
     const timeout = config.timeout ?? 30000;
@@ -995,7 +1138,7 @@ async function stepExec(ctx, config) {
     }
 }
 // --- HTML to Markdown ---
-function stepHtmlToMd(ctx) {
+export function stepHtmlToMd(ctx) {
     const html = String(ctx.data ?? "");
     const turndown = new TurndownService({
         headingStyle: "atx",
@@ -1041,7 +1184,7 @@ function buildScope(ctx) {
     return scope;
 }
 // --- Set step (store pipeline variables) ---
-function stepSet(ctx, config) {
+export function stepSet(ctx, config) {
     if (!config || typeof config !== "object" || Array.isArray(config))
         return ctx;
     const resolved = {};
@@ -1051,7 +1194,7 @@ function stepSet(ctx, config) {
     return { ...ctx, vars: { ...ctx.vars, ...resolved } };
 }
 // --- Append step (accumulate data into vars array) ---
-function stepAppend(ctx, key) {
+export function stepAppend(ctx, key) {
     if (typeof key !== "string" || !key)
         return ctx;
     const existing = ctx.vars[key];
@@ -1069,7 +1212,7 @@ function stepAppend(ctx, key) {
     return { ...ctx, vars: { ...ctx.vars, [key]: arr } };
 }
 // --- If/else step (conditional branching) ---
-async function stepIf(ctx, config, stepIndex, depth = 0) {
+export async function stepIf(ctx, config, stepIndex, depth = 0) {
     if (depth > 10) {
         throw new PipelineError("if step recursion depth exceeded (max 10)", {
             step: stepIndex,
@@ -1097,7 +1240,7 @@ async function stepIf(ctx, config, stepIndex, depth = 0) {
     }
     return ctx;
 }
-async function stepEach(ctx, config, stepIndex, depth) {
+export async function stepEach(ctx, config, stepIndex, depth) {
     if (depth > 10) {
         throw new PipelineError("each step recursion depth exceeded (max 10)", {
             step: stepIndex,
@@ -1139,7 +1282,7 @@ async function stepEach(ctx, config, stepIndex, depth) {
     return ctx;
 }
 // --- Parallel step (concurrent branch execution with merge strategies) ---
-async function stepParallel(ctx, branches, merge, stepIndex, depth) {
+export async function stepParallel(ctx, branches, merge, stepIndex, depth) {
     if (!Array.isArray(branches) || branches.length === 0)
         return ctx;
     if (depth > 10) {
@@ -1153,7 +1296,12 @@ async function stepParallel(ctx, branches, merge, stepIndex, depth) {
             alternatives: [],
         });
     }
-    const results = await Promise.all(branches.map(async (branch) => {
+    // Parallel concurrency cap — bound simultaneous branch execution so a
+    // pipeline with 100 parallel `fetch` steps doesn't exhaust the socket
+    // pool or trip per-host rate limiters. Default 5 mirrors `stepFetch`
+    // fan-out; overridable via `concurrency:` on the parallel step config
+    // (read when the runner dispatches; plumbing goes through executeStep).
+    const results = await mapConcurrent(branches, 5, async (branch) => {
         const branchCtx = {
             ...ctx,
             vars: { ...ctx.vars },
@@ -1161,7 +1309,7 @@ async function stepParallel(ctx, branches, merge, stepIndex, depth) {
         const [action, config] = getActionEntry(branch);
         const result = await executeStep(branchCtx, action, config, stepIndex, branch, depth + 1);
         return result.data;
-    }));
+    });
     let merged;
     switch (merge) {
         case "zip": {
@@ -1495,7 +1643,7 @@ function resolveFilterArg(a, scope) {
         return a;
     }
 }
-function stepWriteTemp(ctx, config) {
+export function stepWriteTemp(ctx, config) {
     const td = ctx.tempDir ?? join(tmpdir(), `unicli-${randomBytes(6).toString("hex")}`);
     mkdirSync(td, { recursive: true });
     const filename = evalTemplate(config.filename, ctx);
@@ -1594,7 +1742,7 @@ async function waitForNetworkIdle(page, maxMs = 5000, quietMs = 500) {
         await page.waitFor(100);
     }
 }
-async function stepNavigate(ctx, config) {
+export async function stepNavigate(ctx, config) {
     const page = await acquirePage(ctx);
     const url = evalTemplate(config.url, ctx);
     const settleMs = config.settleMs ?? 0;
@@ -1604,7 +1752,7 @@ async function stepNavigate(ctx, config) {
     }
     return { ...ctx, page };
 }
-async function stepEvaluate(ctx, config) {
+export async function stepEvaluate(ctx, config) {
     const page = await acquirePage(ctx);
     const expr = typeof config === "string"
         ? evalTemplate(config, ctx)
@@ -1612,7 +1760,7 @@ async function stepEvaluate(ctx, config) {
     const result = await page.evaluate(expr);
     return { ...ctx, data: result, page };
 }
-async function stepClick(ctx, config) {
+export async function stepClick(ctx, config) {
     const page = await acquirePage(ctx);
     // String shorthand: just a CSS selector
     if (typeof config === "string") {
@@ -1641,7 +1789,7 @@ async function stepClick(ctx, config) {
         alternatives: [],
     });
 }
-async function stepType(ctx, config) {
+export async function stepType(ctx, config) {
     const page = await acquirePage(ctx);
     const text = evalTemplate(config.text, ctx);
     if (config.selector) {
@@ -1656,7 +1804,7 @@ async function stepType(ctx, config) {
         await page.press("Enter");
     return { ...ctx, page };
 }
-async function stepWaitBrowser(ctx, config) {
+export async function stepWaitBrowser(ctx, config) {
     const page = await acquirePage(ctx);
     if (typeof config === "number") {
         await page.waitFor(config);
@@ -1669,7 +1817,7 @@ async function stepWaitBrowser(ctx, config) {
     }
     return { ...ctx, page };
 }
-async function stepIntercept(ctx, config) {
+export async function stepIntercept(ctx, config) {
     const page = await acquirePage(ctx);
     const capturePattern = evalTemplate(config.capture, ctx);
     const timeout = config.timeout ?? 10000;
@@ -1734,7 +1882,7 @@ async function stepIntercept(ctx, config) {
     return { ...ctx, data, page };
 }
 // --- press: keyboard event dispatch ---
-async function stepPress(ctx, config) {
+export async function stepPress(ctx, config) {
     const page = await acquirePage(ctx);
     if (typeof config === "string") {
         await page.press(evalTemplate(config, ctx));
@@ -1752,7 +1900,7 @@ async function stepPress(ctx, config) {
     return { ...ctx, page };
 }
 // --- scroll: page scrolling ---
-async function stepScroll(ctx, config) {
+export async function stepScroll(ctx, config) {
     const page = await acquirePage(ctx);
     if (typeof config === "string") {
         await page.scroll(config);
@@ -1774,7 +1922,7 @@ async function stepScroll(ctx, config) {
     return { ...ctx, page };
 }
 // --- snapshot: DOM accessibility tree ---
-async function stepSnapshot(ctx, config) {
+export async function stepSnapshot(ctx, config) {
     const page = await acquirePage(ctx);
     const opts = typeof config === "object" && config !== null
         ? config
@@ -1789,7 +1937,7 @@ async function stepSnapshot(ctx, config) {
     const result = await page.snapshot(normalizedOpts);
     return { ...ctx, data: result, page };
 }
-async function stepTap(ctx, config) {
+export async function stepTap(ctx, config) {
     const page = await acquirePage(ctx);
     const { generateTapInterceptorJs } = await import("./interceptor.js");
     const capturePattern = evalTemplate(config.capture, ctx);
@@ -1917,7 +2065,7 @@ function getNestedValue(obj, path) {
     }
     return current;
 }
-async function stepDownload(ctx, config) {
+export async function stepDownload(ctx, config) {
     const dir = resolve(config.dir ?? "./downloads");
     mkdirSync(dir, { recursive: true });
     const concurrency = config.concurrency ?? 3;
@@ -1968,7 +2116,7 @@ async function stepDownload(ctx, config) {
         return { ...ctx, data: [result] };
     }
 }
-async function stepWebsocket(ctx, config) {
+export async function stepWebsocket(ctx, config) {
     const resolvedConfig = {
         ...config,
         url: evalTemplate(config.url, ctx),
@@ -1977,7 +2125,7 @@ async function stepWebsocket(ctx, config) {
     const data = await executeWebsocket(resolvedConfig);
     return { ...ctx, data };
 }
-async function stepExtract(ctx, config) {
+export async function stepExtract(ctx, config) {
     const page = await acquirePage(ctx);
     const containerSelector = evalTemplate(config.from, ctx);
     // Build a JS expression that extracts structured data