web-agent-bridge 1.1.1 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/LICENSE +21 -21
  2. package/README.ar.md +446 -446
  3. package/README.md +844 -844
  4. package/bin/cli.js +80 -80
  5. package/bin/wab.js +80 -80
  6. package/docs/DEPLOY.md +118 -118
  7. package/docs/SPEC.md +1540 -1540
  8. package/examples/bidi-agent.js +119 -119
  9. package/examples/mcp-agent.js +94 -94
  10. package/examples/puppeteer-agent.js +108 -108
  11. package/examples/vision-agent.js +171 -171
  12. package/package.json +78 -78
  13. package/public/admin/dashboard.html +848 -848
  14. package/public/admin/login.html +84 -84
  15. package/public/cookies.html +208 -208
  16. package/public/css/styles.css +1235 -1235
  17. package/public/dashboard.html +704 -704
  18. package/public/docs.html +585 -585
  19. package/public/index.html +332 -332
  20. package/public/js/auth-nav.js +31 -31
  21. package/public/js/auth-redirect.js +12 -12
  22. package/public/js/cookie-consent.js +56 -56
  23. package/public/js/ws-client.js +74 -74
  24. package/public/login.html +83 -83
  25. package/public/privacy.html +295 -295
  26. package/public/register.html +103 -103
  27. package/public/terms.html +254 -254
  28. package/script/ai-agent-bridge.js +1513 -1513
  29. package/sdk/README.md +55 -55
  30. package/sdk/index.js +203 -203
  31. package/sdk/package.json +14 -14
  32. package/server/config/secrets.js +92 -92
  33. package/server/index.js +181 -181
  34. package/server/middleware/adminAuth.js +30 -30
  35. package/server/middleware/auth.js +41 -41
  36. package/server/middleware/rateLimits.js +24 -24
  37. package/server/migrations/001_add_analytics_indexes.sql +7 -7
  38. package/server/models/adapters/index.js +33 -33
  39. package/server/models/adapters/mysql.js +183 -183
  40. package/server/models/adapters/postgresql.js +172 -172
  41. package/server/models/adapters/sqlite.js +7 -7
  42. package/server/models/db.js +561 -561
  43. package/server/routes/admin.js +247 -247
  44. package/server/routes/api.js +138 -138
  45. package/server/routes/auth.js +51 -51
  46. package/server/routes/billing.js +45 -45
  47. package/server/routes/discovery.js +329 -329
  48. package/server/routes/license.js +240 -240
  49. package/server/routes/noscript.js +543 -543
  50. package/server/routes/wab-api.js +476 -476
  51. package/server/services/email.js +204 -204
  52. package/server/services/fairness.js +420 -420
  53. package/server/services/stripe.js +192 -192
  54. package/server/utils/cache.js +125 -125
  55. package/server/utils/migrate.js +81 -81
  56. package/server/utils/secureFields.js +50 -50
  57. package/server/ws.js +101 -101
  58. package/wab-mcp-adapter/README.md +136 -136
  59. package/wab-mcp-adapter/index.js +555 -555
  60. package/wab-mcp-adapter/package.json +17 -17
  61. package/public/css/premium.css +0 -317
  62. package/public/premium-dashboard.html +0 -2075
  63. package/public/premium.html +0 -791
  64. package/server/migrations/002_premium_features.sql +0 -418
  65. package/server/routes/premium.js +0 -724
  66. package/server/services/premium.js +0 -1680
@@ -1,555 +1,555 @@
1
- /**
2
- * WAB-MCP Adapter
3
- *
4
- * Converts Web Agent Bridge (WAB) capabilities into Model Context Protocol
5
- * (MCP) tools so any MCP-compatible AI agent can interact with WAB-enabled
6
- * websites through a uniform tool interface.
7
- *
8
- * @module wab-mcp-adapter
9
- */
10
-
11
- 'use strict';
12
-
13
- const DISCOVERY_PATHS = ['/agent-bridge.json', '/.well-known/wab.json'];
14
- const DEFAULT_REGISTRY = 'https://webagentbridge.com';
15
- const DEFAULT_TIMEOUT_MS = 15_000;
16
-
17
- // ---------------------------------------------------------------------------
18
- // Helpers
19
- // ---------------------------------------------------------------------------
20
-
21
- /**
22
- * Minimal fetch wrapper with timeout and error normalisation.
23
- * Uses the global `fetch` available in Node 18+.
24
- *
25
- * @param {string} url
26
- * @param {object} [opts] - Standard fetch options
27
- * @param {number} [timeoutMs] - Per-request timeout
28
- * @returns {Promise<object>} - Parsed JSON body
29
- */
30
- async function jsonFetch(url, opts = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
31
- const controller = new AbortController();
32
- const timer = setTimeout(() => controller.abort(), timeoutMs);
33
-
34
- try {
35
- const res = await fetch(url, { ...opts, signal: controller.signal });
36
- if (!res.ok) {
37
- const body = await res.text().catch(() => '');
38
- throw new Error(`HTTP ${res.status} from ${url}: ${body}`);
39
- }
40
- return await res.json();
41
- } finally {
42
- clearTimeout(timer);
43
- }
44
- }
45
-
46
- /** Build a fully-qualified URL, tolerating trailing slashes. */
47
- function resolveUrl(base, path) {
48
- return new URL(path, base.replace(/\/+$/, '') + '/').href;
49
- }
50
-
51
- /**
52
- * Convert a single WAB action descriptor into an MCP tool definition.
53
- *
54
- * @param {object} action
55
- * @returns {object} MCP tool
56
- */
57
- function actionToTool(action) {
58
- const properties = {};
59
- const required = [];
60
-
61
- const fields = action.params || action.fields || [];
62
- for (const f of fields) {
63
- properties[f.name] = {
64
- type: f.type || 'string',
65
- description: f.description || f.label || f.name,
66
- };
67
- if (f.required) required.push(f.name);
68
- }
69
-
70
- return {
71
- name: `wab_${action.name}`,
72
- description: action.description || `Execute WAB action "${action.name}"`,
73
- input_schema: {
74
- type: 'object',
75
- properties,
76
- ...(required.length ? { required } : {}),
77
- },
78
- };
79
- }
80
-
81
- // ---------------------------------------------------------------------------
82
- // Built-in tool definitions (always available regardless of site)
83
- // ---------------------------------------------------------------------------
84
-
85
- const BUILTIN_TOOLS = [
86
- {
87
- name: 'wab_discover',
88
- description: 'Discover a WAB-enabled site — returns the full discovery document including metadata, supported actions and fairness policy.',
89
- input_schema: {
90
- type: 'object',
91
- properties: {
92
- url: { type: 'string', description: 'Site URL to discover (defaults to the configured siteUrl)' },
93
- },
94
- },
95
- },
96
- {
97
- name: 'wab_get_actions',
98
- description: 'List all actions exposed by the connected WAB site, optionally filtered by category.',
99
- input_schema: {
100
- type: 'object',
101
- properties: {
102
- category: { type: 'string', description: 'Optional category filter' },
103
- },
104
- },
105
- },
106
- {
107
- name: 'wab_execute_action',
108
- description: 'Execute any WAB action by name with the supplied parameters.',
109
- input_schema: {
110
- type: 'object',
111
- properties: {
112
- name: { type: 'string', description: 'Action name to execute' },
113
- params: { type: 'object', description: 'Key/value parameters for the action' },
114
- },
115
- required: ['name'],
116
- },
117
- },
118
- {
119
- name: 'wab_read_content',
120
- description: 'Read the text content of a page element identified by a CSS selector.',
121
- input_schema: {
122
- type: 'object',
123
- properties: {
124
- selector: { type: 'string', description: 'CSS selector of the target element' },
125
- },
126
- required: ['selector'],
127
- },
128
- },
129
- {
130
- name: 'wab_get_page_info',
131
- description: 'Return page metadata including title, URL, bridge version and active configuration.',
132
- input_schema: { type: 'object', properties: {} },
133
- },
134
- {
135
- name: 'wab_fairness_search',
136
- description: 'Search the WAB discovery registry for sites matching a query, ranked using the fairness protocol to surface smaller sites equitably.',
137
- input_schema: {
138
- type: 'object',
139
- properties: {
140
- query: { type: 'string', description: 'Search query' },
141
- category: { type: 'string', description: 'Optional category filter' },
142
- limit: { type: 'number', description: 'Maximum results (default 10)' },
143
- },
144
- required: ['query'],
145
- },
146
- },
147
- {
148
- name: 'wab_authenticate',
149
- description: 'Authenticate with the WAB site using an API key and optional agent metadata.',
150
- input_schema: {
151
- type: 'object',
152
- properties: {
153
- apiKey: { type: 'string', description: 'API key for authentication' },
154
- meta: { type: 'object', description: 'Optional agent metadata (name, version, etc.)' },
155
- },
156
- required: ['apiKey'],
157
- },
158
- },
159
- ];
160
-
161
- // ---------------------------------------------------------------------------
162
- // Transport layer
163
- // ---------------------------------------------------------------------------
164
-
165
- class HTTPTransport {
166
- /** @param {string} baseUrl @param {object} headers */
167
- constructor(baseUrl, headers = {}) {
168
- this.baseUrl = baseUrl;
169
- this.headers = headers;
170
- }
171
-
172
- async request(path, body) {
173
- const url = resolveUrl(this.baseUrl, path);
174
- const opts = body
175
- ? { method: 'POST', headers: { 'Content-Type': 'application/json', ...this.headers }, body: JSON.stringify(body) }
176
- : { method: 'GET', headers: this.headers };
177
- return jsonFetch(url, opts);
178
- }
179
- }
180
-
181
- class WebSocketTransport {
182
- /** @param {string} wsUrl @param {object} headers */
183
- constructor(wsUrl, headers = {}) {
184
- this.wsUrl = wsUrl;
185
- this.headers = headers;
186
- this._ws = null;
187
- this._id = 0;
188
- this._pending = new Map();
189
- }
190
-
191
- async connect() {
192
- if (this._ws && this._ws.readyState === 1) return;
193
-
194
- const WebSocket = (await import('ws')).default;
195
- return new Promise((resolve, reject) => {
196
- this._ws = new WebSocket(this.wsUrl, { headers: this.headers });
197
- this._ws.on('open', resolve);
198
- this._ws.on('error', reject);
199
- this._ws.on('message', (raw) => {
200
- try {
201
- const msg = JSON.parse(raw);
202
- const cb = this._pending.get(msg.id);
203
- if (cb) { this._pending.delete(msg.id); cb(msg); }
204
- } catch { /* ignore malformed frames */ }
205
- });
206
- });
207
- }
208
-
209
- async request(_path, body) {
210
- await this.connect();
211
- const id = ++this._id;
212
- return new Promise((resolve, reject) => {
213
- const timer = setTimeout(() => { this._pending.delete(id); reject(new Error('WebSocket request timed out')); }, DEFAULT_TIMEOUT_MS);
214
- this._pending.set(id, (msg) => { clearTimeout(timer); msg.error ? reject(new Error(msg.error)) : resolve(msg.result ?? msg); });
215
- this._ws.send(JSON.stringify({ id, ...body }));
216
- });
217
- }
218
-
219
- close() {
220
- if (this._ws) { this._ws.close(); this._ws = null; }
221
- }
222
- }
223
-
224
- class DirectTransport {
225
- /**
226
- * @param {object} page - Puppeteer / Playwright page handle
227
- */
228
- constructor(page) {
229
- this.page = page;
230
- }
231
-
232
- async request(_path, body) {
233
- if (!body) {
234
- return this.page.evaluate(() => window.AICommands.getPageInfo());
235
- }
236
- const { name, data } = body;
237
- if (name) {
238
- return this.page.evaluate((n, d) => window.AICommands.execute(n, d), name, data ?? {});
239
- }
240
- return this.page.evaluate((b) => window.AICommands.execute(b.method, b.params || {}), body);
241
- }
242
- }
243
-
244
- // ---------------------------------------------------------------------------
245
- // WABMCPAdapter
246
- // ---------------------------------------------------------------------------
247
-
248
- /**
249
- * Main adapter class that connects to a WAB-enabled website and exposes its
250
- * capabilities as MCP tools consumable by any MCP-compatible AI agent.
251
- *
252
- * @example
253
- * const adapter = new WABMCPAdapter({ siteUrl: 'https://example.com' });
254
- * const tools = await adapter.getTools();
255
- * const result = await adapter.executeTool('wab_discover', {});
256
- */
257
- class WABMCPAdapter {
258
- /**
259
- * @param {object} options
260
- * @param {string} [options.siteUrl] - Target WAB site URL
261
- * @param {string} [options.siteId] - WAB site identifier
262
- * @param {string} [options.apiKey] - API key for authenticated requests
263
- * @param {string} [options.transport='http'] - 'http' | 'websocket' | 'direct'
264
- * @param {string} [options.registryUrl] - Custom WAB registry URL
265
- * @param {object} [options.page] - Page handle (required for 'direct' transport)
266
- * @param {string} [options.wsUrl] - WebSocket URL (required for 'websocket' transport)
267
- * @param {number} [options.timeout] - Request timeout in ms
268
- */
269
- constructor(options = {}) {
270
- this.siteUrl = options.siteUrl;
271
- this.siteId = options.siteId || null;
272
- this.apiKey = options.apiKey || null;
273
- this.registryUrl = options.registryUrl || DEFAULT_REGISTRY;
274
- this.timeout = options.timeout || DEFAULT_TIMEOUT_MS;
275
-
276
- this._discovery = null;
277
- this._siteActions = [];
278
- this._sessionToken = null;
279
-
280
- const headers = {};
281
- if (this.apiKey) headers['x-api-key'] = this.apiKey;
282
-
283
- const transport = (options.transport || 'http').toLowerCase();
284
- if (transport === 'websocket') {
285
- const wsUrl = options.wsUrl || (this.siteUrl ? this.siteUrl.replace(/^http/, 'ws') + '/ws' : null);
286
- if (!wsUrl) throw new Error('wsUrl or siteUrl is required for websocket transport');
287
- this._transport = new WebSocketTransport(wsUrl, headers);
288
- } else if (transport === 'direct') {
289
- if (!options.page) throw new Error('page option is required for direct transport');
290
- this._transport = new DirectTransport(options.page);
291
- } else {
292
- if (!this.siteUrl) throw new Error('siteUrl is required for http transport');
293
- this._transport = new HTTPTransport(this.siteUrl, headers);
294
- }
295
- }
296
-
297
- // -----------------------------------------------------------------------
298
- // Discovery
299
- // -----------------------------------------------------------------------
300
-
301
- /**
302
- * Fetch the WAB discovery document from the site, trying multiple
303
- * well-known paths in order.
304
- *
305
- * @param {string} [url] - Override URL to discover
306
- * @returns {Promise<object>}
307
- */
308
- async discover(url) {
309
- const base = url || this.siteUrl;
310
- if (!base) throw new Error('No siteUrl configured and no url argument supplied');
311
-
312
- let lastError;
313
- for (const path of DISCOVERY_PATHS) {
314
- try {
315
- this._discovery = await jsonFetch(resolveUrl(base, path), {}, this.timeout);
316
- this._extractActions(this._discovery);
317
- return this._discovery;
318
- } catch (err) {
319
- lastError = err;
320
- }
321
- }
322
-
323
- if (this.siteId) {
324
- try {
325
- this._discovery = await jsonFetch(
326
- resolveUrl(base, `/api/discovery/${this.siteId}`), {}, this.timeout
327
- );
328
- this._extractActions(this._discovery);
329
- return this._discovery;
330
- } catch (err) { lastError = err; }
331
- }
332
-
333
- try {
334
- this._discovery = await jsonFetch(
335
- resolveUrl(base, '/api/wab/discover'), {}, this.timeout
336
- );
337
- if (this._discovery.result) this._discovery = this._discovery.result;
338
- this._extractActions(this._discovery);
339
- return this._discovery;
340
- } catch (err) { lastError = err; }
341
-
342
- throw new Error(`WAB discovery failed for ${base}: ${lastError?.message}`);
343
- }
344
-
345
- /** @private */
346
- _extractActions(doc) {
347
- const actions = doc.actions || doc.capabilities?.commands || doc.capabilities?.actions || [];
348
- this._siteActions = Array.isArray(actions) ? actions.map(a => {
349
- if (typeof a === 'string') return { name: a, description: `Permission: ${a}`, trigger: 'api' };
350
- return a;
351
- }) : [];
352
- }
353
-
354
- // -----------------------------------------------------------------------
355
- // MCP tool interface
356
- // -----------------------------------------------------------------------
357
-
358
- /**
359
- * Return the full set of MCP tool definitions — built-ins plus any
360
- * site-specific action tools discovered from the WAB document.
361
- *
362
- * @returns {Promise<object[]>}
363
- */
364
- async getTools() {
365
- if (!this._discovery && this.siteUrl) {
366
- try { await this.discover(); } catch { /* built-ins still available */ }
367
- }
368
-
369
- const siteTools = this._siteActions.map(actionToTool);
370
- return [...BUILTIN_TOOLS, ...siteTools];
371
- }
372
-
373
- /**
374
- * Execute a single MCP tool call.
375
- *
376
- * @param {string} toolName - MCP tool name (e.g. 'wab_discover')
377
- * @param {object} input - Tool input parameters
378
- * @returns {Promise<object>}
379
- */
380
- async executeTool(toolName, input = {}) {
381
- try {
382
- const result = await this._dispatch(toolName, input);
383
- return { type: 'tool_result', tool_use_id: toolName, content: result };
384
- } catch (err) {
385
- return { type: 'tool_result', tool_use_id: toolName, is_error: true, content: { error: err.message } };
386
- }
387
- }
388
-
389
- /** @private Route a tool call to the appropriate handler. */
390
- async _dispatch(name, input) {
391
- switch (name) {
392
- case 'wab_discover':
393
- return this.discover(input.url);
394
-
395
- case 'wab_get_actions':
396
- return this._getActions(input.category);
397
-
398
- case 'wab_execute_action':
399
- return this._executeAction(input.name, input.params);
400
-
401
- case 'wab_read_content':
402
- return this._readContent(input.selector);
403
-
404
- case 'wab_get_page_info':
405
- return this._getPageInfo();
406
-
407
- case 'wab_fairness_search':
408
- return this._fairnessSearch(input.query, input.category, input.limit);
409
-
410
- case 'wab_authenticate':
411
- return this._authenticate(input.apiKey, input.meta);
412
-
413
- default:
414
- // Site-specific dynamic tools: strip `wab_` prefix and execute
415
- if (name.startsWith('wab_')) {
416
- const actionName = name.slice(4);
417
- return this._executeAction(actionName, input);
418
- }
419
- throw new Error(`Unknown tool: ${name}`);
420
- }
421
- }
422
-
423
- // -----------------------------------------------------------------------
424
- // Core operations
425
- // -----------------------------------------------------------------------
426
-
427
- /** @private */
428
- async _getActions(category) {
429
- if (!this._discovery) await this.discover();
430
- let actions = this._siteActions;
431
- if (category) {
432
- actions = actions.filter((a) => a.category === category);
433
- }
434
- return { actions };
435
- }
436
-
437
- /** @private */
438
- async _executeAction(name, params) {
439
- if (!name) throw new Error('Action name is required');
440
-
441
- const headers = this._authHeaders();
442
- if (this._transport instanceof HTTPTransport) {
443
- const url = resolveUrl(this.siteUrl, `/api/wab/actions/${encodeURIComponent(name)}`);
444
- return jsonFetch(url, {
445
- method: 'POST',
446
- headers: { 'Content-Type': 'application/json', ...headers },
447
- body: JSON.stringify({ params: params || {} }),
448
- }, this.timeout).then(r => r.result || r);
449
- }
450
-
451
- return this._transport.request(`/api/wab/actions/${name}`, { name, data: params || {} });
452
- }
453
-
454
- /** @private */
455
- async _readContent(selector) {
456
- if (!selector) throw new Error('CSS selector is required');
457
-
458
- if (this._transport instanceof HTTPTransport) {
459
- const url = resolveUrl(this.siteUrl, '/api/wab/read');
460
- return jsonFetch(url, {
461
- method: 'POST',
462
- headers: { 'Content-Type': 'application/json', ...this._authHeaders() },
463
- body: JSON.stringify({ selector }),
464
- }, this.timeout).then(r => r.result || r);
465
- }
466
-
467
- return this._transport.request('/api/wab/read', { selector });
468
- }
469
-
470
- /** @private */
471
- async _getPageInfo() {
472
- if (this._transport instanceof HTTPTransport) {
473
- const siteParam = this.siteId ? `?siteId=${this.siteId}` : '';
474
- return jsonFetch(
475
- resolveUrl(this.siteUrl, `/api/wab/page-info${siteParam}`),
476
- { headers: this._authHeaders() }, this.timeout
477
- ).then(r => r.result || r);
478
- }
479
- return this._transport.request('/api/wab/page-info');
480
- }
481
-
482
- // -----------------------------------------------------------------------
483
- // Fairness registry
484
- // -----------------------------------------------------------------------
485
-
486
- /**
487
- * Search the WAB discovery registry with fairness-weighted ranking so
488
- * smaller and newer sites get equitable visibility alongside large ones.
489
- *
490
- * @param {string} query
491
- * @param {string} [category]
492
- * @param {number} [limit=10]
493
- * @returns {Promise<object>}
494
- */
495
- async _fairnessSearch(query, category, limit = 10) {
496
- const params = new URLSearchParams({ q: query || '', limit: String(limit) });
497
- if (category) params.set('category', category);
498
-
499
- const base = this.siteUrl || this.registryUrl;
500
- const result = await jsonFetch(`${base.replace(/\/+$/, '')}/api/wab/search?${params}`, {}, this.timeout);
501
- return result.result || result;
502
- }
503
-
504
- // -----------------------------------------------------------------------
505
- // Authentication
506
- // -----------------------------------------------------------------------
507
-
508
- /** @private */
509
- async _authenticate(apiKey, meta) {
510
- if (!apiKey) throw new Error('apiKey is required');
511
-
512
- const payload = {
513
- apiKey,
514
- ...(this.siteId ? { siteId: this.siteId } : {}),
515
- ...(meta ? { meta } : {})
516
- };
517
-
518
- if (this._transport instanceof HTTPTransport) {
519
- const result = await jsonFetch(resolveUrl(this.siteUrl, '/api/wab/authenticate'), {
520
- method: 'POST',
521
- headers: { 'Content-Type': 'application/json' },
522
- body: JSON.stringify(payload),
523
- }, this.timeout);
524
- const data = result.result || result;
525
- if (data.token) this._sessionToken = data.token;
526
- return data;
527
- }
528
-
529
- const result = await this._transport.request('/api/wab/authenticate', payload);
530
- const data = result.result || result;
531
- if (data.token) this._sessionToken = data.token;
532
- return data;
533
- }
534
-
535
- /** @private Build auth headers from session token and/or API key. */
536
- _authHeaders() {
537
- const h = {};
538
- if (this._sessionToken) h['Authorization'] = `Bearer ${this._sessionToken}`;
539
- if (this.apiKey) h['x-api-key'] = this.apiKey;
540
- return h;
541
- }
542
-
543
- // -----------------------------------------------------------------------
544
- // Lifecycle
545
- // -----------------------------------------------------------------------
546
-
547
- /** Clean up resources (e.g. open WebSocket connections). */
548
- close() {
549
- if (typeof this._transport.close === 'function') {
550
- this._transport.close();
551
- }
552
- }
553
- }
554
-
555
- module.exports = { WABMCPAdapter, actionToTool, BUILTIN_TOOLS };
1
+ /**
2
+ * WAB-MCP Adapter
3
+ *
4
+ * Converts Web Agent Bridge (WAB) capabilities into Model Context Protocol
5
+ * (MCP) tools so any MCP-compatible AI agent can interact with WAB-enabled
6
+ * websites through a uniform tool interface.
7
+ *
8
+ * @module wab-mcp-adapter
9
+ */
10
+
11
+ 'use strict';
12
+
13
+ const DISCOVERY_PATHS = ['/agent-bridge.json', '/.well-known/wab.json'];
14
+ const DEFAULT_REGISTRY = 'https://webagentbridge.com';
15
+ const DEFAULT_TIMEOUT_MS = 15_000;
16
+
17
+ // ---------------------------------------------------------------------------
18
+ // Helpers
19
+ // ---------------------------------------------------------------------------
20
+
21
+ /**
22
+ * Minimal fetch wrapper with timeout and error normalisation.
23
+ * Uses the global `fetch` available in Node 18+.
24
+ *
25
+ * @param {string} url
26
+ * @param {object} [opts] - Standard fetch options
27
+ * @param {number} [timeoutMs] - Per-request timeout
28
+ * @returns {Promise<object>} - Parsed JSON body
29
+ */
30
+ async function jsonFetch(url, opts = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
31
+ const controller = new AbortController();
32
+ const timer = setTimeout(() => controller.abort(), timeoutMs);
33
+
34
+ try {
35
+ const res = await fetch(url, { ...opts, signal: controller.signal });
36
+ if (!res.ok) {
37
+ const body = await res.text().catch(() => '');
38
+ throw new Error(`HTTP ${res.status} from ${url}: ${body}`);
39
+ }
40
+ return await res.json();
41
+ } finally {
42
+ clearTimeout(timer);
43
+ }
44
+ }
45
+
46
+ /** Build a fully-qualified URL, tolerating trailing slashes. */
47
+ function resolveUrl(base, path) {
48
+ return new URL(path, base.replace(/\/+$/, '') + '/').href;
49
+ }
50
+
51
+ /**
52
+ * Convert a single WAB action descriptor into an MCP tool definition.
53
+ *
54
+ * @param {object} action
55
+ * @returns {object} MCP tool
56
+ */
57
+ function actionToTool(action) {
58
+ const properties = {};
59
+ const required = [];
60
+
61
+ const fields = action.params || action.fields || [];
62
+ for (const f of fields) {
63
+ properties[f.name] = {
64
+ type: f.type || 'string',
65
+ description: f.description || f.label || f.name,
66
+ };
67
+ if (f.required) required.push(f.name);
68
+ }
69
+
70
+ return {
71
+ name: `wab_${action.name}`,
72
+ description: action.description || `Execute WAB action "${action.name}"`,
73
+ input_schema: {
74
+ type: 'object',
75
+ properties,
76
+ ...(required.length ? { required } : {}),
77
+ },
78
+ };
79
+ }
80
+
81
+ // ---------------------------------------------------------------------------
82
+ // Built-in tool definitions (always available regardless of site)
83
+ // ---------------------------------------------------------------------------
84
+
85
+ const BUILTIN_TOOLS = [
86
+ {
87
+ name: 'wab_discover',
88
+ description: 'Discover a WAB-enabled site — returns the full discovery document including metadata, supported actions and fairness policy.',
89
+ input_schema: {
90
+ type: 'object',
91
+ properties: {
92
+ url: { type: 'string', description: 'Site URL to discover (defaults to the configured siteUrl)' },
93
+ },
94
+ },
95
+ },
96
+ {
97
+ name: 'wab_get_actions',
98
+ description: 'List all actions exposed by the connected WAB site, optionally filtered by category.',
99
+ input_schema: {
100
+ type: 'object',
101
+ properties: {
102
+ category: { type: 'string', description: 'Optional category filter' },
103
+ },
104
+ },
105
+ },
106
+ {
107
+ name: 'wab_execute_action',
108
+ description: 'Execute any WAB action by name with the supplied parameters.',
109
+ input_schema: {
110
+ type: 'object',
111
+ properties: {
112
+ name: { type: 'string', description: 'Action name to execute' },
113
+ params: { type: 'object', description: 'Key/value parameters for the action' },
114
+ },
115
+ required: ['name'],
116
+ },
117
+ },
118
+ {
119
+ name: 'wab_read_content',
120
+ description: 'Read the text content of a page element identified by a CSS selector.',
121
+ input_schema: {
122
+ type: 'object',
123
+ properties: {
124
+ selector: { type: 'string', description: 'CSS selector of the target element' },
125
+ },
126
+ required: ['selector'],
127
+ },
128
+ },
129
+ {
130
+ name: 'wab_get_page_info',
131
+ description: 'Return page metadata including title, URL, bridge version and active configuration.',
132
+ input_schema: { type: 'object', properties: {} },
133
+ },
134
+ {
135
+ name: 'wab_fairness_search',
136
+ description: 'Search the WAB discovery registry for sites matching a query, ranked using the fairness protocol to surface smaller sites equitably.',
137
+ input_schema: {
138
+ type: 'object',
139
+ properties: {
140
+ query: { type: 'string', description: 'Search query' },
141
+ category: { type: 'string', description: 'Optional category filter' },
142
+ limit: { type: 'number', description: 'Maximum results (default 10)' },
143
+ },
144
+ required: ['query'],
145
+ },
146
+ },
147
+ {
148
+ name: 'wab_authenticate',
149
+ description: 'Authenticate with the WAB site using an API key and optional agent metadata.',
150
+ input_schema: {
151
+ type: 'object',
152
+ properties: {
153
+ apiKey: { type: 'string', description: 'API key for authentication' },
154
+ meta: { type: 'object', description: 'Optional agent metadata (name, version, etc.)' },
155
+ },
156
+ required: ['apiKey'],
157
+ },
158
+ },
159
+ ];
160
+
161
+ // ---------------------------------------------------------------------------
162
+ // Transport layer
163
+ // ---------------------------------------------------------------------------
164
+
165
+ class HTTPTransport {
166
+ /** @param {string} baseUrl @param {object} headers */
167
+ constructor(baseUrl, headers = {}) {
168
+ this.baseUrl = baseUrl;
169
+ this.headers = headers;
170
+ }
171
+
172
+ async request(path, body) {
173
+ const url = resolveUrl(this.baseUrl, path);
174
+ const opts = body
175
+ ? { method: 'POST', headers: { 'Content-Type': 'application/json', ...this.headers }, body: JSON.stringify(body) }
176
+ : { method: 'GET', headers: this.headers };
177
+ return jsonFetch(url, opts);
178
+ }
179
+ }
180
+
181
+ class WebSocketTransport {
182
+ /** @param {string} wsUrl @param {object} headers */
183
+ constructor(wsUrl, headers = {}) {
184
+ this.wsUrl = wsUrl;
185
+ this.headers = headers;
186
+ this._ws = null;
187
+ this._id = 0;
188
+ this._pending = new Map();
189
+ }
190
+
191
+ async connect() {
192
+ if (this._ws && this._ws.readyState === 1) return;
193
+
194
+ const WebSocket = (await import('ws')).default;
195
+ return new Promise((resolve, reject) => {
196
+ this._ws = new WebSocket(this.wsUrl, { headers: this.headers });
197
+ this._ws.on('open', resolve);
198
+ this._ws.on('error', reject);
199
+ this._ws.on('message', (raw) => {
200
+ try {
201
+ const msg = JSON.parse(raw);
202
+ const cb = this._pending.get(msg.id);
203
+ if (cb) { this._pending.delete(msg.id); cb(msg); }
204
+ } catch { /* ignore malformed frames */ }
205
+ });
206
+ });
207
+ }
208
+
209
+ async request(_path, body) {
210
+ await this.connect();
211
+ const id = ++this._id;
212
+ return new Promise((resolve, reject) => {
213
+ const timer = setTimeout(() => { this._pending.delete(id); reject(new Error('WebSocket request timed out')); }, DEFAULT_TIMEOUT_MS);
214
+ this._pending.set(id, (msg) => { clearTimeout(timer); msg.error ? reject(new Error(msg.error)) : resolve(msg.result ?? msg); });
215
+ this._ws.send(JSON.stringify({ id, ...body }));
216
+ });
217
+ }
218
+
219
+ close() {
220
+ if (this._ws) { this._ws.close(); this._ws = null; }
221
+ }
222
+ }
223
+
224
+ class DirectTransport {
225
+ /**
226
+ * @param {object} page - Puppeteer / Playwright page handle
227
+ */
228
+ constructor(page) {
229
+ this.page = page;
230
+ }
231
+
232
+ async request(_path, body) {
233
+ if (!body) {
234
+ return this.page.evaluate(() => window.AICommands.getPageInfo());
235
+ }
236
+ const { name, data } = body;
237
+ if (name) {
238
+ return this.page.evaluate((n, d) => window.AICommands.execute(n, d), name, data ?? {});
239
+ }
240
+ return this.page.evaluate((b) => window.AICommands.execute(b.method, b.params || {}), body);
241
+ }
242
+ }
243
+
244
+ // ---------------------------------------------------------------------------
245
+ // WABMCPAdapter
246
+ // ---------------------------------------------------------------------------
247
+
248
+ /**
249
+ * Main adapter class that connects to a WAB-enabled website and exposes its
250
+ * capabilities as MCP tools consumable by any MCP-compatible AI agent.
251
+ *
252
+ * @example
253
+ * const adapter = new WABMCPAdapter({ siteUrl: 'https://example.com' });
254
+ * const tools = await adapter.getTools();
255
+ * const result = await adapter.executeTool('wab_discover', {});
256
+ */
257
+ class WABMCPAdapter {
258
+ /**
259
+ * @param {object} options
260
+ * @param {string} [options.siteUrl] - Target WAB site URL
261
+ * @param {string} [options.siteId] - WAB site identifier
262
+ * @param {string} [options.apiKey] - API key for authenticated requests
263
+ * @param {string} [options.transport='http'] - 'http' | 'websocket' | 'direct'
264
+ * @param {string} [options.registryUrl] - Custom WAB registry URL
265
+ * @param {object} [options.page] - Page handle (required for 'direct' transport)
266
+ * @param {string} [options.wsUrl] - WebSocket URL (required for 'websocket' transport)
267
+ * @param {number} [options.timeout] - Request timeout in ms
268
+ */
269
+ constructor(options = {}) {
270
+ this.siteUrl = options.siteUrl;
271
+ this.siteId = options.siteId || null;
272
+ this.apiKey = options.apiKey || null;
273
+ this.registryUrl = options.registryUrl || DEFAULT_REGISTRY;
274
+ this.timeout = options.timeout || DEFAULT_TIMEOUT_MS;
275
+
276
+ this._discovery = null;
277
+ this._siteActions = [];
278
+ this._sessionToken = null;
279
+
280
+ const headers = {};
281
+ if (this.apiKey) headers['x-api-key'] = this.apiKey;
282
+
283
+ const transport = (options.transport || 'http').toLowerCase();
284
+ if (transport === 'websocket') {
285
+ const wsUrl = options.wsUrl || (this.siteUrl ? this.siteUrl.replace(/^http/, 'ws') + '/ws' : null);
286
+ if (!wsUrl) throw new Error('wsUrl or siteUrl is required for websocket transport');
287
+ this._transport = new WebSocketTransport(wsUrl, headers);
288
+ } else if (transport === 'direct') {
289
+ if (!options.page) throw new Error('page option is required for direct transport');
290
+ this._transport = new DirectTransport(options.page);
291
+ } else {
292
+ if (!this.siteUrl) throw new Error('siteUrl is required for http transport');
293
+ this._transport = new HTTPTransport(this.siteUrl, headers);
294
+ }
295
+ }
296
+
297
+ // -----------------------------------------------------------------------
298
+ // Discovery
299
+ // -----------------------------------------------------------------------
300
+
301
+ /**
302
+ * Fetch the WAB discovery document from the site, trying multiple
303
+ * well-known paths in order.
304
+ *
305
+ * @param {string} [url] - Override URL to discover
306
+ * @returns {Promise<object>}
307
+ */
308
+ async discover(url) {
309
+ const base = url || this.siteUrl;
310
+ if (!base) throw new Error('No siteUrl configured and no url argument supplied');
311
+
312
+ let lastError;
313
+ for (const path of DISCOVERY_PATHS) {
314
+ try {
315
+ this._discovery = await jsonFetch(resolveUrl(base, path), {}, this.timeout);
316
+ this._extractActions(this._discovery);
317
+ return this._discovery;
318
+ } catch (err) {
319
+ lastError = err;
320
+ }
321
+ }
322
+
323
+ if (this.siteId) {
324
+ try {
325
+ this._discovery = await jsonFetch(
326
+ resolveUrl(base, `/api/discovery/${this.siteId}`), {}, this.timeout
327
+ );
328
+ this._extractActions(this._discovery);
329
+ return this._discovery;
330
+ } catch (err) { lastError = err; }
331
+ }
332
+
333
+ try {
334
+ this._discovery = await jsonFetch(
335
+ resolveUrl(base, '/api/wab/discover'), {}, this.timeout
336
+ );
337
+ if (this._discovery.result) this._discovery = this._discovery.result;
338
+ this._extractActions(this._discovery);
339
+ return this._discovery;
340
+ } catch (err) { lastError = err; }
341
+
342
+ throw new Error(`WAB discovery failed for ${base}: ${lastError?.message}`);
343
+ }
344
+
345
+ /** @private */
346
+ _extractActions(doc) {
347
+ const actions = doc.actions || doc.capabilities?.commands || doc.capabilities?.actions || [];
348
+ this._siteActions = Array.isArray(actions) ? actions.map(a => {
349
+ if (typeof a === 'string') return { name: a, description: `Permission: ${a}`, trigger: 'api' };
350
+ return a;
351
+ }) : [];
352
+ }
353
+
354
+ // -----------------------------------------------------------------------
355
+ // MCP tool interface
356
+ // -----------------------------------------------------------------------
357
+
358
+ /**
359
+ * Return the full set of MCP tool definitions — built-ins plus any
360
+ * site-specific action tools discovered from the WAB document.
361
+ *
362
+ * @returns {Promise<object[]>}
363
+ */
364
+ async getTools() {
365
+ if (!this._discovery && this.siteUrl) {
366
+ try { await this.discover(); } catch { /* built-ins still available */ }
367
+ }
368
+
369
+ const siteTools = this._siteActions.map(actionToTool);
370
+ return [...BUILTIN_TOOLS, ...siteTools];
371
+ }
372
+
373
+ /**
374
+ * Execute a single MCP tool call.
375
+ *
376
+ * @param {string} toolName - MCP tool name (e.g. 'wab_discover')
377
+ * @param {object} input - Tool input parameters
378
+ * @returns {Promise<object>}
379
+ */
380
+ async executeTool(toolName, input = {}) {
381
+ try {
382
+ const result = await this._dispatch(toolName, input);
383
+ return { type: 'tool_result', tool_use_id: toolName, content: result };
384
+ } catch (err) {
385
+ return { type: 'tool_result', tool_use_id: toolName, is_error: true, content: { error: err.message } };
386
+ }
387
+ }
388
+
389
+ /** @private Route a tool call to the appropriate handler. */
390
+ async _dispatch(name, input) {
391
+ switch (name) {
392
+ case 'wab_discover':
393
+ return this.discover(input.url);
394
+
395
+ case 'wab_get_actions':
396
+ return this._getActions(input.category);
397
+
398
+ case 'wab_execute_action':
399
+ return this._executeAction(input.name, input.params);
400
+
401
+ case 'wab_read_content':
402
+ return this._readContent(input.selector);
403
+
404
+ case 'wab_get_page_info':
405
+ return this._getPageInfo();
406
+
407
+ case 'wab_fairness_search':
408
+ return this._fairnessSearch(input.query, input.category, input.limit);
409
+
410
+ case 'wab_authenticate':
411
+ return this._authenticate(input.apiKey, input.meta);
412
+
413
+ default:
414
+ // Site-specific dynamic tools: strip `wab_` prefix and execute
415
+ if (name.startsWith('wab_')) {
416
+ const actionName = name.slice(4);
417
+ return this._executeAction(actionName, input);
418
+ }
419
+ throw new Error(`Unknown tool: ${name}`);
420
+ }
421
+ }
422
+
423
+ // -----------------------------------------------------------------------
424
+ // Core operations
425
+ // -----------------------------------------------------------------------
426
+
427
+ /** @private */
428
+ async _getActions(category) {
429
+ if (!this._discovery) await this.discover();
430
+ let actions = this._siteActions;
431
+ if (category) {
432
+ actions = actions.filter((a) => a.category === category);
433
+ }
434
+ return { actions };
435
+ }
436
+
437
+ /** @private */
438
+ async _executeAction(name, params) {
439
+ if (!name) throw new Error('Action name is required');
440
+
441
+ const headers = this._authHeaders();
442
+ if (this._transport instanceof HTTPTransport) {
443
+ const url = resolveUrl(this.siteUrl, `/api/wab/actions/${encodeURIComponent(name)}`);
444
+ return jsonFetch(url, {
445
+ method: 'POST',
446
+ headers: { 'Content-Type': 'application/json', ...headers },
447
+ body: JSON.stringify({ params: params || {} }),
448
+ }, this.timeout).then(r => r.result || r);
449
+ }
450
+
451
+ return this._transport.request(`/api/wab/actions/${name}`, { name, data: params || {} });
452
+ }
453
+
454
+ /** @private */
455
+ async _readContent(selector) {
456
+ if (!selector) throw new Error('CSS selector is required');
457
+
458
+ if (this._transport instanceof HTTPTransport) {
459
+ const url = resolveUrl(this.siteUrl, '/api/wab/read');
460
+ return jsonFetch(url, {
461
+ method: 'POST',
462
+ headers: { 'Content-Type': 'application/json', ...this._authHeaders() },
463
+ body: JSON.stringify({ selector }),
464
+ }, this.timeout).then(r => r.result || r);
465
+ }
466
+
467
+ return this._transport.request('/api/wab/read', { selector });
468
+ }
469
+
470
+ /** @private */
471
+ async _getPageInfo() {
472
+ if (this._transport instanceof HTTPTransport) {
473
+ const siteParam = this.siteId ? `?siteId=${this.siteId}` : '';
474
+ return jsonFetch(
475
+ resolveUrl(this.siteUrl, `/api/wab/page-info${siteParam}`),
476
+ { headers: this._authHeaders() }, this.timeout
477
+ ).then(r => r.result || r);
478
+ }
479
+ return this._transport.request('/api/wab/page-info');
480
+ }
481
+
482
+ // -----------------------------------------------------------------------
483
+ // Fairness registry
484
+ // -----------------------------------------------------------------------
485
+
486
+ /**
487
+ * Search the WAB discovery registry with fairness-weighted ranking so
488
+ * smaller and newer sites get equitable visibility alongside large ones.
489
+ *
490
+ * @param {string} query
491
+ * @param {string} [category]
492
+ * @param {number} [limit=10]
493
+ * @returns {Promise<object>}
494
+ */
495
+ async _fairnessSearch(query, category, limit = 10) {
496
+ const params = new URLSearchParams({ q: query || '', limit: String(limit) });
497
+ if (category) params.set('category', category);
498
+
499
+ const base = this.siteUrl || this.registryUrl;
500
+ const result = await jsonFetch(`${base.replace(/\/+$/, '')}/api/wab/search?${params}`, {}, this.timeout);
501
+ return result.result || result;
502
+ }
503
+
504
+ // -----------------------------------------------------------------------
505
+ // Authentication
506
+ // -----------------------------------------------------------------------
507
+
508
+ /** @private */
509
+ async _authenticate(apiKey, meta) {
510
+ if (!apiKey) throw new Error('apiKey is required');
511
+
512
+ const payload = {
513
+ apiKey,
514
+ ...(this.siteId ? { siteId: this.siteId } : {}),
515
+ ...(meta ? { meta } : {})
516
+ };
517
+
518
+ if (this._transport instanceof HTTPTransport) {
519
+ const result = await jsonFetch(resolveUrl(this.siteUrl, '/api/wab/authenticate'), {
520
+ method: 'POST',
521
+ headers: { 'Content-Type': 'application/json' },
522
+ body: JSON.stringify(payload),
523
+ }, this.timeout);
524
+ const data = result.result || result;
525
+ if (data.token) this._sessionToken = data.token;
526
+ return data;
527
+ }
528
+
529
+ const result = await this._transport.request('/api/wab/authenticate', payload);
530
+ const data = result.result || result;
531
+ if (data.token) this._sessionToken = data.token;
532
+ return data;
533
+ }
534
+
535
+ /** @private Build auth headers from session token and/or API key. */
536
+ _authHeaders() {
537
+ const h = {};
538
+ if (this._sessionToken) h['Authorization'] = `Bearer ${this._sessionToken}`;
539
+ if (this.apiKey) h['x-api-key'] = this.apiKey;
540
+ return h;
541
+ }
542
+
543
+ // -----------------------------------------------------------------------
544
+ // Lifecycle
545
+ // -----------------------------------------------------------------------
546
+
547
+ /** Clean up resources (e.g. open WebSocket connections). */
548
+ close() {
549
+ if (typeof this._transport.close === 'function') {
550
+ this._transport.close();
551
+ }
552
+ }
553
+ }
554
+
555
+ module.exports = { WABMCPAdapter, actionToTool, BUILTIN_TOOLS };