vskill 1.2.4 → 1.2.7

package/dist/webmcp/args.d.ts

@@ -0,0 +1,34 @@
+import { type Severity } from "./types.js";
+export interface AuditWebmcpRawOptions {
+    urlsFile?: string;
+    json?: boolean;
+    out?: string;
+    concurrency?: string | number;
+    timeout?: string | number;
+    failOn?: string;
+    executablePath?: string;
+}
+export interface AuditWebmcpOptions {
+    urls: string[];
+    json: boolean;
+    out?: string;
+    /** "jsonl" when the run covers more than one URL or --out ends in .jsonl. */
+    outFormat: "json" | "jsonl";
+    concurrency: number;
+    timeoutMs: number;
+    failOn?: Severity;
+    executablePath?: string;
+}
+export declare const DEFAULT_CONCURRENCY = 4;
+export declare const DEFAULT_TIMEOUT_MS = 30000;
+export declare class ArgError extends Error {
+}
+/** One URL per line; blank lines and # comments (whole-line or trailing " #") are ignored. */
+export declare function parseUrlList(text: string): string[];
+/** Accept "example.com" as https://example.com/; reject anything that is not http(s). */
+export declare function normalizeUrl(input: string): string;
+/**
+ * Combine positional URLs and --urls-file contents (already read) into
+ * validated options. Throws ArgError with a user-facing message.
+ */
+export declare function resolveOptions(positional: string[], raw: AuditWebmcpRawOptions, urlsFileText?: string): AuditWebmcpOptions;

package/dist/webmcp/args.js

@@ -0,0 +1,87 @@
+// ---------------------------------------------------------------------------
+// vskill audit-webmcp -- argument parsing (pure, unit-tested).
+// ---------------------------------------------------------------------------
+import { SEVERITIES } from "./types.js";
+export const DEFAULT_CONCURRENCY = 4;
+export const DEFAULT_TIMEOUT_MS = 30_000;
+export class ArgError extends Error {
+}
+/** One URL per line; blank lines and # comments (whole-line or trailing " #") are ignored. */
+export function parseUrlList(text) {
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        let line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const hash = line.search(/\s#/);
+        if (hash !== -1)
+            line = line.slice(0, hash).trim();
+        if (line)
+            out.push(line);
+    }
+    return out;
+}
+/** Accept "example.com" as https://example.com/; reject anything that is not http(s). */
+export function normalizeUrl(input) {
+    const s = input.trim();
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(s) ? s : `https://${s}`;
+    let u;
+    try {
+        u = new URL(withScheme);
+    }
+    catch {
+        throw new ArgError(`Invalid URL: ${input}`);
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:") {
+        throw new ArgError(`Only http(s) URLs can be audited: ${input}`);
+    }
+    if (!u.hostname)
+        throw new ArgError(`Invalid URL: ${input}`);
+    return u.toString();
+}
+function positiveInt(name, v, fallback) {
+    if (v === undefined || v === "")
+        return fallback;
+    const n = typeof v === "number" ? v : Number(v);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new ArgError(`Invalid ${name} value: ${v}. Must be a positive integer.`);
+    return n;
+}
+/**
+ * Combine positional URLs and --urls-file contents (already read) into
+ * validated options. Throws ArgError with a user-facing message.
+ */
+export function resolveOptions(positional, raw, urlsFileText) {
+    const inputs = [...positional, ...(urlsFileText !== undefined ? parseUrlList(urlsFileText) : [])];
+    const urls = [];
+    for (const i of inputs) {
+        const u = normalizeUrl(i);
+        if (!urls.includes(u))
+            urls.push(u);
+    }
+    if (urls.length === 0) {
+        throw new ArgError("No URLs to audit. Pass URLs as arguments or use --urls-file <path>.");
+    }
+    let failOn;
+    if (raw.failOn !== undefined) {
+        const s = raw.failOn.toLowerCase();
+        if (!SEVERITIES.includes(s)) {
+            throw new ArgError(`Invalid --fail-on severity: ${raw.failOn}. Valid: ${SEVERITIES.join(", ")}`);
+        }
+        failOn = s;
+    }
+    const concurrency = positiveInt("--concurrency", raw.concurrency, DEFAULT_CONCURRENCY);
+    const timeoutMs = positiveInt("--timeout", raw.timeout, DEFAULT_TIMEOUT_MS);
+    const outFormat = urls.length > 1 || /\.jsonl$/i.test(raw.out ?? "") ? "jsonl" : "json";
+    return {
+        urls,
+        json: !!raw.json,
+        out: raw.out,
+        outFormat,
+        concurrency: Math.min(concurrency, urls.length),
+        timeoutMs,
+        failOn,
+        executablePath: raw.executablePath,
+    };
+}
+//# sourceMappingURL=args.js.map

package/dist/webmcp/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/webmcp/args.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAiB,MAAM,YAAY,CAAC;AAwBvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,OAAO,QAAS,SAAQ,KAAK;CAAG;AAEtC,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,QAAQ,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,CAA8B,EAAE,QAAgB;IACjF,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAoB,EACpB,GAA0B,EAC1B,YAAqB;IAErB,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,qEAAqE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,MAA4B,CAAC;IACjC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAc,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,+BAA+B,GAAG,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,CAAC,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,EAAE,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAExF,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/C,SAAS;QACT,MAAM;QACN,cAAc,EAAE,GAAG,CAAC,cAAc;KACnC,CAAC;AACJ,CAAC"}

package/dist/webmcp/attribution.d.ts

@@ -0,0 +1,38 @@
+import type { RegistrarKind } from "./types.js";
+/** Platform markers detected in the page (see enumerate.ts detectPlatforms). */
+export type PlatformMarker = "shopify";
+export interface PlatformHost {
+    platform: string;
+    marker: PlatformMarker;
+    host: string;
+    /** Only scripts under this path are the platform's own code. */
+    pathPrefix: string;
+}
+/**
+ * Hosting platforms whose own scripts register WebMCP tools on merchant
+ * pages. Add an entry only after seeing it in a scan, and keep the path
+ * prefix narrow: cdn.shopify.com/extensions/ holds third-party app code and
+ * cdn.shopify.com/s/files/ holds any merchant's uploads.
+ */
+export declare const PLATFORM_HOSTS: PlatformHost[];
+/** Public npm CDNs: the page author picks the package and version. */
+export declare const LIBRARY_CDN_HOSTS: string[];
+export interface Attribution {
+    kind: RegistrarKind;
+    /** Platform name for kind "platform". */
+    platform?: string;
+    /** Package (name@version, or gh/owner/repo@ref) for kind "library", when the URL names one. */
+    package?: string;
+}
+/** The package a public-CDN URL loads, as the URL spells it (e.g. "simple-webmcp@0.3.0"). */
+export declare function libraryPackage(url: string): string | undefined;
+/**
+ * True when a package spec has no exact version (no @version, or a tag such
+ * as @latest). A full commit SHA on a gh/ spec counts as pinned.
+ */
+export declare function isUnpinned(pkg: string): boolean;
+/**
+ * Classify the script that registered a tool. Returns null when the script
+ * URL is unknown or not http(s).
+ */
+export declare function classifyRegistrar(registeredBy: string | undefined | null, pageUrl: string | undefined | null, platforms?: readonly string[]): Attribution | null;

package/dist/webmcp/attribution.js

@@ -0,0 +1,141 @@
+// ---------------------------------------------------------------------------
+// vskill audit-webmcp -- who registered a tool. Pure module: no browser.
+//
+//   first-party  the script is on the page's own site (registrable domain)
+//   platform     the page runs on a hosting platform and the script is that
+//                platform's own code (PLATFORM_HOSTS: host + path prefix,
+//                and only when the page carries the platform's marker)
+//   library      the script comes from a public npm CDN (unpkg, jsDelivr,
+//                esm.sh, cdnjs, jspm, Skypack): a library the page author
+//                chose to load
+//   third-party  any other site. It may still be the site's own asset domain
+//                (assets.targetimg1.com on target.com); we cannot tell.
+// ---------------------------------------------------------------------------
+import { siteOf } from "./score.js";
+/**
+ * Hosting platforms whose own scripts register WebMCP tools on merchant
+ * pages. Add an entry only after seeing it in a scan, and keep the path
+ * prefix narrow: cdn.shopify.com/extensions/ holds third-party app code and
+ * cdn.shopify.com/s/files/ holds any merchant's uploads.
+ */
+export const PLATFORM_HOSTS = [
+    // Shopify storefront WebMCP (seen 2026-10: 92 stores serve it from their own
+    // domain under /cdn/shopifycloud/, cotopaxi.com from cdn.shopify.com).
+    { platform: "Shopify", marker: "shopify", host: "cdn.shopify.com", pathPrefix: "/shopifycloud/" },
+];
+/** Public npm CDNs: the page author picks the package and version. */
+export const LIBRARY_CDN_HOSTS = [
+    "unpkg.com",
+    "cdn.jsdelivr.net",
+    "fastly.jsdelivr.net",
+    "gcore.jsdelivr.net",
+    "esm.sh",
+    "esm.run",
+    "cdnjs.cloudflare.com",
+    "ga.jspm.io",
+    "jspm.dev",
+    "cdn.skypack.dev",
+];
+/** name or name@version from path segments starting at a package name (handles @scope/name). */
+function packageAt(segs, i) {
+    const first = segs[i];
+    if (!first)
+        return undefined;
+    if (first.startsWith("@")) {
+        const second = segs[i + 1];
+        return second ? `${first}/${second}` : undefined;
+    }
+    return first;
+}
+/** The package a public-CDN URL loads, as the URL spells it (e.g. "simple-webmcp@0.3.0"). */
+export function libraryPackage(url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    const host = u.hostname.toLowerCase();
+    const segs = u.pathname.split("/").filter(Boolean).map((s) => {
+        try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            return s;
+        }
+    });
+    if (host.endsWith("jsdelivr.net")) {
+        if (segs[0] === "npm")
+            return packageAt(segs, 1);
+        if (segs[0] === "gh" && segs[1] && segs[2])
+            return `gh/${segs[1]}/${segs[2]}`;
+        return undefined;
+    }
+    if (host === "cdnjs.cloudflare.com") {
+        if (segs[0] === "ajax" && segs[1] === "libs" && segs[2])
+            return segs[3] ? `${segs[2]}@${segs[3]}` : segs[2];
+        return undefined;
+    }
+    if (host === "ga.jspm.io" || host === "jspm.dev") {
+        const s = segs.slice();
+        if (s[0]?.startsWith("npm:"))
+            s[0] = s[0].slice(4);
+        return packageAt(s, 0);
+    }
+    if (host === "esm.sh") {
+        let i = 0;
+        while (segs[i] && (/^v\d+$/.test(segs[i]) || segs[i] === "stable"))
+            i++;
+        if (segs[i] === "gh" && segs[i + 1] && segs[i + 2])
+            return `gh/${segs[i + 1]}/${segs[i + 2]}`;
+        return packageAt(segs, i);
+    }
+    if (host === "cdn.skypack.dev") {
+        // Pinned URLs look like /-/name@v1.2.3-<hash>/dist=es2019/...
+        if (segs[0] === "-") {
+            const p = packageAt(segs, 1);
+            return p?.replace(/@v(\d[^-]*)-[A-Za-z0-9]+$/, "@$1");
+        }
+        return packageAt(segs, 0);
+    }
+    return packageAt(segs, 0);
+}
+/**
+ * True when a package spec has no exact version (no @version, or a tag such
+ * as @latest). A full commit SHA on a gh/ spec counts as pinned.
+ */
+export function isUnpinned(pkg) {
+    const at = pkg.lastIndexOf("@");
+    if (at <= 0)
+        return true;
+    const version = pkg.slice(at + 1);
+    if (pkg.startsWith("gh/") && /^[0-9a-f]{40}$/i.test(version))
+        return false;
+    return !/^\d+\.\d+\.\d+/.test(version);
+}
+/**
+ * Classify the script that registered a tool. Returns null when the script
+ * URL is unknown or not http(s).
+ */
+export function classifyRegistrar(registeredBy, pageUrl, platforms = []) {
+    const regSite = siteOf(registeredBy);
+    if (!registeredBy || !regSite)
+        return null;
+    const pageSite = siteOf(pageUrl);
+    if (!pageSite || regSite === pageSite)
+        return { kind: "first-party" };
+    const u = new URL(registeredBy);
+    const host = u.hostname.toLowerCase();
+    for (const p of PLATFORM_HOSTS) {
+        if (host === p.host && u.pathname.startsWith(p.pathPrefix) && platforms.includes(p.marker)) {
+            return { kind: "platform", platform: p.platform };
+        }
+    }
+    if (LIBRARY_CDN_HOSTS.includes(host)) {
+        const pkg = libraryPackage(registeredBy);
+        return pkg ? { kind: "library", package: pkg } : { kind: "library" };
+    }
+    return { kind: "third-party" };
+}
+//# sourceMappingURL=attribution.js.map

package/dist/webmcp/attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../../src/webmcp/attribution.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,0EAA0E;AAC1E,+BAA+B;AAC/B,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAE9E,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAcpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,6EAA6E;IAC7E,uEAAuE;IACvE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE;CAClG,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW;IACX,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,QAAQ;IACR,SAAS;IACT,sBAAsB;IACtB,YAAY;IACZ,UAAU;IACV,iBAAiB;CAClB,CAAC;AAUF,gGAAgG;AAChG,SAAS,SAAS,CAAC,IAAc,EAAE,CAAS;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAAE,CAAC,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAuC,EACvC,OAAkC,EAClC,YAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAEtE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC"}

package/dist/webmcp/enumerate.d.ts

@@ -0,0 +1,81 @@
+import type { EnumerationResult } from "./types.js";
+/** Playwright always passes CDPScreenshotNewSurface; a second --enable-features would override it. */
+export declare const CHROMIUM_ARGS: string[];
+export declare const UA_SUFFIX = "vskill-audit-webmcp (+https://verified-skill.com)";
+export declare const PROBE_NAME = "vskill-webmcp-probe";
+interface PwResponse {
+    headers(): Record<string, string>;
+}
+interface PwCdpSession {
+    send(method: string, params?: Record<string, unknown>): Promise<unknown>;
+    on(event: string, handler: (params: any) => void): void;
+    detach(): Promise<void>;
+}
+interface PwPage {
+    goto(url: string, opts: {
+        waitUntil: string;
+        timeout: number;
+    }): Promise<PwResponse | null>;
+    url(): string;
+    evaluate<T>(fn: (...args: any[]) => T | Promise<T>, arg?: unknown): Promise<T>;
+    waitForTimeout(ms: number): Promise<void>;
+    on(event: string, handler: (arg: any) => void): void;
+    close(): Promise<void>;
+}
+interface PwContext {
+    newPage(): Promise<PwPage>;
+    newCDPSession(page: PwPage): Promise<PwCdpSession>;
+    addInitScript(script: {
+        content: string;
+    }): Promise<void>;
+    on(event: string, handler: (arg: any) => void): void;
+    close(): Promise<void>;
+}
+export interface PwBrowser {
+    newContext(opts?: Record<string, unknown>): Promise<PwContext>;
+    close(): Promise<void>;
+    version(): string;
+    isConnected(): boolean;
+}
+interface PwChromium {
+    launch(opts: Record<string, unknown>): Promise<PwBrowser>;
+    executablePath(): string;
+}
+/**
+ * Import playwright-core, then playwright: first from vskill's own install,
+ * then from the current project (so `npm i -D playwright-core` works with npx).
+ * Returns null when neither resolves.
+ */
+export declare function loadChromium(cwd?: string): Promise<PwChromium | null>;
+export declare const PLAYWRIGHT_INSTALL_HINT: string;
+/** Newest Chromium (headless shell preferred) in the usual Playwright cache dirs. */
+export declare function findCachedChromium(dirs?: string[]): string | null;
+/**
+ * Resolve the executable: explicit flag, then VSKILL_CHROMIUM, then
+ * Playwright's own pinned build, then the newest cached build.
+ * Returns undefined when Playwright's default should be used.
+ */
+export declare function resolveExecutablePath(chromium: PwChromium, explicit?: string): string | undefined;
+export declare function launchBrowser(opts?: {
+    executablePath?: string;
+}): Promise<PwBrowser>;
+/**
+ * Runs before any page script in every frame. Wraps registerTool to record
+ * the descriptor (minus execute) and the caller's stack. The page's own
+ * registerTool still runs unchanged.
+ */
+export declare const INIT_SCRIPT = "(() => {\n  const KEY = Symbol.for(\"vskill.webmcp\");\n  if (window[KEY]) return;\n  const log = [];\n  try { Object.defineProperty(window, KEY, { value: log, enumerable: false }); } catch (e) { return; }\n  // Crawl safety: the audit loads one page; popups (popunders, auto-opened tabs) never load.\n  try { window.open = function open() { return null; }; } catch (e) {}\n  let proto = null;\n  try {\n    proto = (typeof ModelContext !== \"undefined\" && ModelContext.prototype) ||\n      (document.modelContext && Object.getPrototypeOf(document.modelContext));\n  } catch (e) {}\n  if (!proto || typeof proto.registerTool !== \"function\") return;\n  const safe = (v) => { try { return v === undefined ? undefined : JSON.parse(JSON.stringify(v)); } catch (e) { return undefined; } };\n  const str = (v) => (typeof v === \"string\" ? v : undefined);\n  const orig = proto.registerTool;\n  const wrapped = function registerTool(tool, options) {\n    try {\n      const t = tool || {};\n      const rec = {\n        name: String(t.name == null ? \"\" : t.name),\n        title: str(t.title),\n        description: str(t.description),\n        inputSchema: typeof t.inputSchema === \"string\" ? t.inputSchema : safe(t.inputSchema),\n        annotations: safe(t.annotations),\n        exposedTo: safe((options && options.exposedTo) !== undefined ? options.exposedTo : t.exposedTo),\n        stack: String(new Error().stack || \"\"),\n      };\n      log.push(rec);\n      const signal = options && options.signal;\n      if (signal && typeof signal.addEventListener === \"function\") {\n        signal.addEventListener(\"abort\", () => log.push({ name: rec.name, unregistered: true }), { once: true });\n      }\n    } catch (e) {}\n    return orig.apply(this, arguments);\n  };\n  try { Object.defineProperty(proto, \"registerTool\", { value: wrapped, writable: true, configurable: true }); } catch (e) {}\n  if (typeof proto.unregisterTool === \"function\") {\n    const origUn = proto.unregisterTool;\n    try {\n      Object.defineProperty(proto, \"unregisterTool\", {\n        value: function unregisterTool(name) {\n          try { log.push({ name: String(name), unregistered: true }); } catch (e) {}\n          return origUn.apply(this, arguments);\n        },\n        writable: true,\n        configurable: true,\n      });\n    } catch (e) {}\n  }\n})();\n//# sourceURL=vskill-webmcp-probe.js";
+export interface EnumerateOptions {
+    timeoutMs: number;
+    /** Max wait after load for registrations to stop (default 5000). */
+    settleMs?: number;
+    /** Quiet period that ends the settle wait early (default 1500). */
+    quietMs?: number;
+    userAgent?: string;
+    /** Aborting closes the browser context, which ends any pending page work. */
+    signal?: AbortSignal;
+}
+/** Browser UA with our suffix, read once per browser. */
+export declare function userAgentFor(browser: PwBrowser): Promise<string>;
+export declare function enumerateSite(browser: PwBrowser, url: string, opts: EnumerateOptions): Promise<EnumerationResult>;
+export {};