The interception overlay

The overlay is the floor the whole product stands on. It is a small set of generated files written over a mirrored copy of the app, and its job is one sentence: every request that leaves the app is refused and recorded unless it goes to loopback.

You can read the exact files for your own repo without writing anything:

hiiu overlay ./path/to/app

Default deny, not best effort #

The rule is deny-by-default and the consequence is the useful part. A request hiiu was not expecting does not get guessed at, and does not quietly reach a real host. It is refused, and the refusal is written down.

That turns the hard problem into a measurable one. An app that talks to something unusual does not produce a page that is subtly wrong; it produces a gap list naming the host it wanted. Every build emits its own, which is what makes the long tail of backend coupling something you can count rather than something you discover in a design partner's session.

It cannot add a dependency #

The app's lockfile is frozen. The overlay is generated ESM that imports nothing but Node builtins and its own sibling files, because installing a package to make interception work would change the dependency graph of the thing hiiu is supposed to be reproducing faithfully.

That constraint shapes the implementation more than any other. Each artifact is a pure function returning source text, computed in the core library and written by the CLI, which is what makes the generator testable without a filesystem and the writer testable without a generator.

What it wraps #

The pieces differ per framework, but the shape does not: a shared allow-deny-record core, plus whichever hook the framework offers for running a module before application code. For Next that is the instrumentation wrapper; for Vite, a config wrapper and a browser patch.

It prints, and never writes #

hiiu overlay is a reader. It shows you the files; hiiu build is the command that writes them, and it writes them into a base under your cache directory, never into your repository. Two runs of one input produce byte-identical output.

Read next: bases, which is where the overlay lands.