Discovery Engine — Phase 3: OpenAPI/Swagger + GraphQL spec discovery

[badchars]

Part of the Discovery Engine epic #125.

Scope — declared API endpoints via specs (browser-fetch)

Endpoints declared in an API spec are never reached by clicking. Fetch/parse them through the authenticated browser and feed them to testing.

• openapi detector: detect swagger-ui / spec URLs (/openapi.json, /v3/api-docs, /swagger.json, swagger-ui init) → browser-fetch the spec (auth + proxy-aware) → parse paths (method + path + params) → emit endpoints → ingest.
• graphql detector: detect /graphql (or introspection-enabled endpoint) → introspection query → emit operations as endpoints.

Why browser-fetch (not a separate client)

The spec may be auth-gated and the network may be behind a corporate SSL-inspection proxy. Fetching via page.evaluate(fetch(...)) reuses the logged-in session + proxy trust — a separate HTTP client would 401 / hit TLS errors.

Constraints

• Endpoints → ingest → proxy-agents (http_replay) test them; no browser navigation needed for non-GET/non-page endpoints.
• In-scope filtering; dedup against already-captured endpoints.

Commits (granular)

swagger-ui/spec-URL detection → spec browser-fetch → OpenAPI v3 path parse → v2 fallback → param/method extraction → endpoint→ingest emit → graphql detection → introspection parse → scope/dedup → tests.