@ai-ecoverse/slicc-browsers 1.2.0 → 1.4.0

package/README.md

@@ -4,6 +4,8 @@ The browser catalog, JSON schemas and conformance corpus shared by the two progr
 - `slicc browsers` and `slicc launch` in [slicc-cli](https://github.com/ai-ecoverse/slicc-cli) (Go, `CGO_ENABLED=0`);
 - `playwright-cli list` and `open` in [slicc-cdp](https://github.com/ai-ecoverse/slicc-cdp) (Rust, also built for `wasm32-wasip1`).
 
+It also holds the [protected origins](#protected-origins): the origins browser control must never reach, which slicc-agent checks too.
+
 They can't share code, so they share data. Three packages wrap the same files, at one version:
 
 | package | what it gives you |
@@ -20,6 +22,8 @@ They can't share code, so they share data. Three packages wrap the same files, a
 | `schema/corpus.schema.json` | JSON Schema for `corpus.json` |
 | `corpus/<case>/case.json`, `corpus/<case>/expected.json` | the conformance cases |
 | `corpus.json` | every case in one file, generated from `corpus/` by `npm run corpus` |
+| `protected.json`, `schema/protected.schema.json` | the protected-origin test vectors and their schema |
+| `protected.mjs` | the reference protected-origin matcher, in JavaScript (npm only) |
 
 ## Go
 
@@ -32,7 +36,8 @@ b, ok := c.Browser("chrome")
 
 - `Default() *Catalog` parses the embedded `catalog.json` once and panics if it doesn't parse (CI makes sure it does). `Load() (*Catalog, error)` is the same without the panic. Treat the result as read-only. `Parse([]byte)` parses another copy and rejects a `schema` other than 1.
 - `(*Catalog).Browser(id)` and `(*Catalog).Priority(id)`, the index in `browsers` (its length for an unknown id).
-- `CatalogJSON()`, `CatalogSchemaJSON()`, `BrowsersSchemaJSON()` and `CorpusJSON()` return copies of the embedded files.
+- `CatalogJSON()`, `CatalogSchemaJSON()`, `BrowsersSchemaJSON()`, `CorpusJSON()`, `ProtectedJSON()` and `ProtectedSchemaJSON()` return copies of the embedded files.
+- `(*Catalog).ProtectedOrigins` is `catalog.json`'s `protectedOrigins`. `Protected() (*ProtectedVectors, error)` parses `protected.json` (`Origins`, `URLs`, `Targets`, `CookieDomains`, `StorageKeys`; a target's `Opener` is `""`, `OpenerProtected`, `OpenerUnprotected` or `OpenerUnknown`).
 - `Corpus() ([]Case, error)` returns the cases. See [Running the corpus](#running-the-corpus) for the helpers.
 
 ## Rust
@@ -45,15 +50,17 @@ slicc-browsers = "1"
 slicc-browsers = { version = "1", features = ["corpus"] }
 ```
 
-- Always: `CATALOG`, `CATALOG_SCHEMA`, `BROWSERS_SCHEMA` and `CORPUS_SCHEMA`, each the file's text via `include_str!`, and `SCHEMA` (1). No dependencies.
-- Feature `serde`: `Catalog` and the other types, `Catalog::parse(&str)`, `catalog()` (parses `CATALOG`), `Catalog::browser` and `Catalog::priority`. It pulls in `serde` and `serde_json`.
-- Feature `corpus` (implies `serde`): `CORPUS`, the text of `corpus.json`, and the module `corpus` with `corpus()`, `Case`, `Layout` and the helpers below. Use it from `[dev-dependencies]` only; with resolver 2 it stays out of normal builds.
+- Always: `CATALOG`, `CATALOG_SCHEMA`, `BROWSERS_SCHEMA`, `CORPUS_SCHEMA` and `PROTECTED_SCHEMA`, each the file's text via `include_str!`, and `SCHEMA` (1). No dependencies.
+- Feature `serde`: `Catalog` and the other types (`protected_origins` is a `ProtectedOrigins`), `Catalog::parse(&str)`, `catalog()` (parses `CATALOG`), `Catalog::browser` and `Catalog::priority`. It pulls in `serde` and `serde_json`.
+- Feature `corpus` (implies `serde`): `CORPUS` and `PROTECTED`, the text of `corpus.json` and `protected.json`; the module `corpus` with `corpus()`, `Case`, `Layout` and the helpers below; and the module `protected` with `vectors()`, `Vectors` and the `OPENER_*` constants. Use it from `[dev-dependencies]` only; with resolver 2 it stays out of normal builds.
 
 Every feature builds for `wasm32-wasip1`.
 
 ## npm
 
-`import catalog from '@ai-ecoverse/slicc-browsers' with { type: 'json' }`. The exports are `.` (`catalog.json`), `./catalog.json`, `./corpus.json`, `./schema/catalog.schema.json`, `./schema/browsers.schema.json` and `./schema/corpus.schema.json`.
+`import catalog from '@ai-ecoverse/slicc-browsers' with { type: 'json' }`. The exports are `.` (`catalog.json`), `./catalog.json`, `./corpus.json`, `./protected.json`, `./protected.mjs`, `./schema/catalog.schema.json`, `./schema/browsers.schema.json`, `./schema/corpus.schema.json` and `./schema/protected.schema.json`.
+
+`protected.mjs` is the reference matcher for [protected origins](#protected-origins): `import { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs'`, then `protectedOrigins(catalog.protectedOrigins, extraOrigins)` returns `{ url(text), target({ url, previous, opener }), cookieDomain(domain), storageKey(key) }`, each a boolean. It needs only the WHATWG `URL`, so it runs in Node and in a browser.
 
 ## `catalog.json`
 
@@ -82,6 +89,7 @@ Every feature builds for `wasm32-wasip1`.
   - `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
   - `cleanExit`: values that mark the last exit clean;
   - `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
+- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
 - `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
   - `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
   - `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
@@ -89,6 +97,32 @@ Every feature builds for `wasm32-wasip1`.
 - `launch`: `chromiumArgs` (with `{profile}` for the profile dir), then the seven flags, then `headless` with `--headless`. Electron apps get `electron.portFlag` with the first free port from `electron.minPort` up that isn't in `electron.reservedPorts`.
 - `platforms`: the config dir per OS, the Windows roots, and the Windows registry keys. A location is the environment variable `env` when it's set (on Linux only an absolute path counts), else `absolute`, else `home` under the home dir. `registry`: under each of `hives`, every subkey of each `startMenuInternet` key, with its `openCommand` default value, and the default value of `appPaths\<name>` for each of `appPathNames`.
 
+## Protected origins
+
+Browser control must never navigate to, open or attach to a target on seven's own origin, or read or write its cookies or storage: not slicc-cli's `cdp` relay, not slicc-cdp's `playwright-cli`, not slicc-agent. `protectedOrigins` in `catalog.json` says what is protected, and every implementation runs the vectors in `protected.json`.
+
+**URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL that doesn't parse isn't protected; the browser doesn't load it either. Then:
+1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`.
+2. A scheme in `anySchemes` is protected whatever follows: a DevTools front end (`devtools://`) can be inspecting seven.
+3. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
+4. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
+
+This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out `www`). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
+
+**The vault.** `vault.sliccy.ai` is in `hosts` by name. `sliccy.ai` already covers it, but it must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
+
+**Targets.** A target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
+
+A same-site frame shares its parent's process and has no target of its own. Every `sliccy.ai` host is protected, and site isolation gives a seven frame inside any other site its own target, so this only matters for an extra origin whose site has other origins (another port of `127.0.0.1`, say).
+
+**Cookies.** A cookie domain, lower-cased and without a leading or trailing dot, is protected when it is one of `domains` or under one, or when it is one of `hosts`, the host of a protected domain or an extra origin, or a parent of one: a cookie on `.example.test` reaches `https://seven.example.test`.
+
+**Storage keys** (`Storage`, `IndexedDB`, `CacheStorage` and `FileSystem` in CDP): a key is protected when its origin (up to the first `^`) or its top-level site (a part after `^0`) is a protected URL.
+
+**Refusals** carry the text in `refusal`, `slicc: refused: target is on seven's origin`.
+
+**`protected.json`** (schema `schema/protected.schema.json`): `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
+
 ## The process source
 
 The process scan finds browsers started with a debugging port by something else:
@@ -198,7 +232,7 @@ for case in corpus().cases {
 
 Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run corpus` regenerates `corpus.json` from `corpus/`; the pre-commit hook and CI fail when it's stale.
-- `npm run validate` checks `catalog.json` and `corpus.json` against the schemas, plus what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
+- `npm run validate` checks `catalog.json`, `corpus.json` and `protected.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
 - `npm test`: `validate`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.

package/catalog.json

@@ -701,6 +701,15 @@
       }
     ]
   },
+  "protectedOrigins": {
+    "domains": ["sliccy.ai"],
+    "hosts": ["vault.sliccy.ai"],
+    "schemes": ["https", "http"],
+    "innerSchemes": ["blob", "filesystem", "view-source"],
+    "anySchemes": ["devtools"],
+    "inheriting": ["about:blank", "about:srcdoc"],
+    "refusal": "slicc: refused: target is on seven's origin"
+  },
   "profiles": {
     "root": ["slicc", "seven-profiles"],
     "snapRoot": ["slicc", "seven-profiles"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -25,14 +25,19 @@
     ".": "./catalog.json",
     "./catalog.json": "./catalog.json",
     "./corpus.json": "./corpus.json",
+    "./protected.json": "./protected.json",
+    "./protected.mjs": "./protected.mjs",
     "./schema/catalog.schema.json": "./schema/catalog.schema.json",
     "./schema/browsers.schema.json": "./schema/browsers.schema.json",
     "./schema/corpus.schema.json": "./schema/corpus.schema.json",
+    "./schema/protected.schema.json": "./schema/protected.schema.json",
     "./package.json": "./package.json"
   },
   "files": [
     "catalog.json",
     "corpus.json",
+    "protected.json",
+    "protected.mjs",
     "schema"
   ],
   "scripts": {
@@ -49,11 +54,11 @@
     "release": "semantic-release"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.12.3",
+    "@ai-ecoverse/slicc-shared-web": "1.13.0",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "lefthook": "2.1.16",
+    "lefthook": "2.1.17",
     "semantic-release": "25.0.9"
   }
 }

package/protected.json

@@ -0,0 +1,151 @@
+{
+  "schema": 1,
+  "origins": ["http://127.0.0.1:5710", "https://seven.example.test"],
+  "urls": [
+    { "url": "https://seven.sliccy.ai/", "protected": true },
+    { "url": "https://seven.sliccy.ai", "protected": true },
+    { "url": "https://seven.sliccy.ai/index.html?x=1#y", "protected": true },
+    { "url": "https://SEVEN.SLICCY.AI/", "protected": true },
+    { "url": "https://seven.sliccy.ai:443/", "protected": true },
+    { "url": "https://seven.sliccy.ai:8443/", "protected": true },
+    { "url": "http://seven.sliccy.ai/", "protected": true },
+    { "url": "https://main--seven.sliccy.ai/", "protected": true },
+    { "url": "https://www.sliccy.ai/", "protected": true },
+    { "url": "https://vault.sliccy.ai/", "protected": true },
+    { "url": "https://VAULT.sliccy.ai:443/unlock?x=1", "protected": true },
+    { "url": "http://vault.sliccy.ai./", "protected": true },
+    { "url": "blob:https://vault.sliccy.ai/0b9e0f6c", "protected": true },
+    { "url": "https://vault.sliccy.ai.example/", "protected": false },
+    { "url": "https://vault-sliccy.ai/", "protected": false },
+    { "url": "https://sliccy.ai/", "protected": true },
+    { "url": "https://a.b.sliccy.ai/", "protected": true },
+    { "url": "https://seven.sliccy.ai./", "protected": true },
+    { "url": "https://user:secret@seven.sliccy.ai/", "protected": true },
+    { "url": "https:\\\\seven.sliccy.ai\\x", "protected": true },
+    { "url": "  https://seven.sliccy.ai/  ", "protected": true },
+    { "url": "ht\ttps://seven.sli\nccy.ai/", "protected": true },
+    { "url": "https:seven.sliccy.ai", "protected": true },
+    { "url": "https:///seven.sliccy.ai/", "protected": true },
+    { "url": "https://seven%2Esliccy%2Eai/", "protected": true },
+    { "url": "https://seven\u3002sliccy\u3002ai/", "protected": true },
+    { "url": "https://\uff53\uff45\uff56\uff45\uff4e.sliccy.ai/", "protected": true },
+    { "url": "https://se\u00adven.sliccy.ai/", "protected": true },
+    {
+      "url": "blob:https://seven.sliccy.ai/0b9e0f6c-1f0e-4c1a-9a43-5d3f6e2c7a10",
+      "protected": true
+    },
+    { "url": "filesystem:https://seven.sliccy.ai/temporary/notes.txt", "protected": true },
+    { "url": "view-source:https://seven.sliccy.ai/", "protected": true },
+    { "url": "view-source:blob:https://seven.sliccy.ai/0b9e0f6c", "protected": true },
+    {
+      "url": "devtools://devtools/bundled/inspector.html?ws=127.0.0.1:5711/devtools/page/AB12",
+      "protected": true
+    },
+    { "url": "http://127.0.0.1:5710/", "protected": true },
+    { "url": "http://127.0.0.1:5710", "protected": true },
+    { "url": "http://2130706433:5710/", "protected": true },
+    { "url": "http://0x7f.1:5710/", "protected": true },
+    { "url": "blob:http://127.0.0.1:5710/0b9e0f6c", "protected": true },
+    { "url": "https://seven.example.test/", "protected": true },
+    { "url": "https://SEVEN.example.test:443/x", "protected": true },
+    { "url": "https://seven.example.test./", "protected": true },
+    { "url": "http://localhost:5710/", "protected": false },
+    { "url": "http://127.0.0.1:5711/", "protected": false },
+    { "url": "https://127.0.0.1:5710/", "protected": false },
+    { "url": "http://127.0.0.1/", "protected": false },
+    { "url": "http://seven.example.test/", "protected": false },
+    { "url": "https://seven.example.test:8443/", "protected": false },
+    { "url": "https://x.seven.example.test/", "protected": false },
+    { "url": "https://example.test/", "protected": false },
+    { "url": "https://sliccy.ai.example.com/", "protected": false },
+    { "url": "https://notsliccy.ai/", "protected": false },
+    { "url": "https://seven.sliccy.ai.example/", "protected": false },
+    { "url": "https://sliccy.aix/", "protected": false },
+    { "url": "https://sliccy-ai.example/", "protected": false },
+    { "url": "https://example.com/?next=https://seven.sliccy.ai/", "protected": false },
+    { "url": "https://example.com/#https://seven.sliccy.ai/", "protected": false },
+    { "url": "https://seven.sliccy.ai@example.com/", "protected": false },
+    { "url": "wss://seven.sliccy.ai/", "protected": false },
+    { "url": "ftp://seven.sliccy.ai/", "protected": false },
+    { "url": "http://5173.kernel.localhost/", "protected": false },
+    { "url": "http://seven.sliccy.ai.kernel.localhost/", "protected": false },
+    { "url": "https://example.com/", "protected": false },
+    { "url": "about:blank", "protected": false },
+    { "url": "about:srcdoc", "protected": false },
+    { "url": "data:text/html,<a href=https://seven.sliccy.ai/>x</a>", "protected": false },
+    { "url": "blob:null/0b9e0f6c", "protected": false },
+    { "url": "blob:https://example.com/0b9e0f6c", "protected": false },
+    { "url": "filesystem:https://example.com/temporary/x", "protected": false },
+    { "url": "view-source:https://example.com/", "protected": false },
+    { "url": "javascript:location='https://seven.sliccy.ai/'", "protected": false },
+    { "url": "chrome://version/", "protected": false },
+    { "url": "chrome-extension://abcdefghijklmnopabcdefghijklmnop/page.html", "protected": false },
+    { "url": "file:///tmp/seven.sliccy.ai/index.html", "protected": false },
+    { "url": "", "protected": false },
+    { "url": "https://", "protected": false },
+    { "url": "seven.sliccy.ai", "protected": false },
+    { "url": "not a url", "protected": false }
+  ],
+  "targets": [
+    { "url": "https://seven.sliccy.ai/", "protected": true },
+    { "url": "https://vault.sliccy.ai/", "protected": true },
+    { "url": "about:blank", "opener": "protected", "protected": true },
+    { "url": "https://example.com/", "protected": false },
+    { "url": "https://example.com/", "previous": true, "protected": false },
+    { "url": "https://example.com/", "opener": "protected", "protected": false },
+    { "url": "about:blank", "protected": false },
+    { "url": "about:blank", "opener": "unprotected", "protected": false },
+    { "url": "about:blank", "opener": "protected", "protected": true },
+    { "url": "about:blank", "opener": "unknown", "protected": true },
+    { "url": "about:blank", "previous": true, "protected": true },
+    { "url": "about:blank", "previous": true, "opener": "unprotected", "protected": true },
+    { "url": "about:blank#top", "previous": true, "protected": true },
+    { "url": "about:blank?x=1", "opener": "protected", "protected": true },
+    { "url": "about:srcdoc", "previous": true, "protected": true },
+    { "url": "about:srcdoc", "opener": "unprotected", "protected": false },
+    { "url": "", "opener": "protected", "protected": true },
+    { "url": "", "protected": false },
+    { "url": "about:version", "previous": true, "protected": false },
+    { "url": "data:text/html,x", "previous": true, "protected": false },
+    { "url": "blob:https://seven.sliccy.ai/0b9e0f6c", "protected": true },
+    { "url": "devtools://devtools/bundled/devtools_app.html", "protected": true },
+    { "url": "http://127.0.0.1:5710/index.html", "protected": true },
+    { "url": "http://127.0.0.1:5711/index.html", "previous": true, "protected": false }
+  ],
+  "cookieDomains": [
+    { "domain": "sliccy.ai", "protected": true },
+    { "domain": ".sliccy.ai", "protected": true },
+    { "domain": "seven.sliccy.ai", "protected": true },
+    { "domain": "vault.sliccy.ai", "protected": true },
+    { "domain": ".www.sliccy.ai", "protected": true },
+    { "domain": "SLICCY.AI", "protected": true },
+    { "domain": "sliccy.ai.", "protected": true },
+    { "domain": "a.b.sliccy.ai", "protected": true },
+    { "domain": "127.0.0.1", "protected": true },
+    { "domain": "seven.example.test", "protected": true },
+    { "domain": ".example.test", "protected": true },
+    { "domain": "x.seven.example.test", "protected": false },
+    { "domain": "other.example.test", "protected": false },
+    { "domain": "notsliccy.ai", "protected": false },
+    { "domain": "sliccy.ai.example", "protected": false },
+    { "domain": "localhost", "protected": false },
+    { "domain": "5173.kernel.localhost", "protected": false },
+    { "domain": "example.com", "protected": false },
+    { "domain": "", "protected": false },
+    { "domain": ".", "protected": false }
+  ],
+  "storageKeys": [
+    { "key": "https://seven.sliccy.ai/", "protected": true },
+    { "key": "https://sliccy.ai/", "protected": true },
+    { "key": "https://vault.sliccy.ai/", "protected": true },
+    { "key": "http://127.0.0.1:5710/", "protected": true },
+    { "key": "https://widget.example/^0https://sliccy.ai", "protected": true },
+    { "key": "https://seven.sliccy.ai/^31", "protected": true },
+    { "key": "https://seven.sliccy.ai/^112345^267890", "protected": true },
+    { "key": "https://example.com/", "protected": false },
+    { "key": "https://example.com/^0https://example.org", "protected": false },
+    { "key": "https://example.com/^112345^2https://sliccy.ai", "protected": false },
+    { "key": "http://127.0.0.1:5711/", "protected": false },
+    { "key": "", "protected": false }
+  ]
+}

package/protected.mjs

@@ -0,0 +1,78 @@
+const parse = (text) => {
+  try {
+    return new URL(text);
+  } catch {
+    return null;
+  }
+};
+
+const scheme = (u) => u.protocol.slice(0, -1);
+
+const hostOf = (u) => {
+  const h = u.hostname.toLowerCase();
+  return h.endsWith('.') ? h.slice(0, -1) : h;
+};
+
+const originOf = (u) => {
+  if (!u?.host) return null;
+  return `${scheme(u)}://${hostOf(u)}${u.port ? `:${u.port}` : ''}`;
+};
+
+const under = (host, domain) => host === domain || host.endsWith(`.${domain}`);
+
+export function protectedOrigins(rules, extraOrigins = []) {
+  const extra = extraOrigins.map((o) => originOf(parse(o))).filter(Boolean);
+  const extraHosts = extraOrigins
+    .map((o) => parse(o))
+    .filter((u) => u?.host)
+    .map(hostOf);
+
+  const unwrap = (u) => {
+    for (let i = 0; u && rules.innerSchemes.includes(scheme(u)) && i < 8; i += 1) {
+      u = parse(u.href.slice(u.protocol.length));
+    }
+    return u;
+  };
+
+  const url = (text) => {
+    const u = unwrap(parse(text));
+    if (!u) return false;
+    const s = scheme(u);
+    if (rules.anySchemes.includes(s)) return true;
+    if (rules.schemes.includes(s) && rules.hosts.includes(hostOf(u))) return true;
+    if (rules.schemes.includes(s) && rules.domains.some((d) => under(hostOf(u), d))) return true;
+    const o = originOf(u);
+    return o !== null && extra.includes(o);
+  };
+
+  const inheriting = (text) => {
+    if (text === '') return true;
+    const u = parse(text);
+    return (
+      u !== null &&
+      scheme(u) === 'about' &&
+      rules.inheriting.includes(`about:${u.pathname.toLowerCase()}`)
+    );
+  };
+
+  const target = ({ url: text, previous = false, opener }) => {
+    if (inheriting(text)) return previous || opener === 'protected' || opener === 'unknown';
+    return url(text);
+  };
+
+  const cookieDomain = (domain) => {
+    let d = domain.toLowerCase();
+    if (d.startsWith('.')) d = d.slice(1);
+    if (d.endsWith('.')) d = d.slice(0, -1);
+    if (d === '') return false;
+    if (rules.domains.some((x) => under(d, x))) return true;
+    return [...rules.domains, ...rules.hosts, ...extraHosts].some((h) => under(h, d));
+  };
+
+  const storageKey = (key) => {
+    const [first, ...rest] = key.split('^');
+    return [first, ...rest.filter((p) => p.startsWith('0')).map((p) => p.slice(1))].some(url);
+  };
+
+  return { url, target, cookieDomain, storageKey };
+}

package/schema/catalog.schema.json

@@ -12,6 +12,7 @@
     "rank",
     "discovery",
     "seven",
+    "protectedOrigins",
     "profiles",
     "launch",
     "platforms"
@@ -169,6 +170,47 @@
         "cleanExit": { "type": "array", "items": { "$ref": "#/$defs/pref" } }
       }
     },
+    "protectedOrigins": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "domains",
+        "hosts",
+        "schemes",
+        "innerSchemes",
+        "anySchemes",
+        "inheriting",
+        "refusal"
+      ],
+      "properties": {
+        "domains": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+          }
+        },
+        "hosts": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+          }
+        },
+        "schemes": { "$ref": "#/$defs/schemes", "type": "array", "minItems": 1 },
+        "innerSchemes": { "$ref": "#/$defs/schemes" },
+        "anySchemes": { "$ref": "#/$defs/schemes" },
+        "inheriting": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^about:[a-z]+$" }
+        },
+        "refusal": { "$ref": "#/$defs/name" }
+      }
+    },
     "profiles": {
       "type": "object",
       "additionalProperties": false,
@@ -267,6 +309,11 @@
   "$defs": {
     "name": { "type": "string", "minLength": 1 },
     "names": { "type": "array", "items": { "$ref": "#/$defs/name" } },
+    "schemes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^[a-z][a-z0-9+.-]*$" }
+    },
     "id": { "type": "string", "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$" },
     "segments": {
       "description": "A relative path, one segment per item.",

package/schema/protected.schema.json

@@ -0,0 +1,62 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ai-ecoverse/slicc-browsers/schema/protected.schema.json",
+  "title": "slicc-browsers protected-origin test vectors, schema 1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "origins", "urls", "targets", "cookieDomains", "storageKeys"],
+  "properties": {
+    "schema": { "const": 1 },
+    "origins": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "urls": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["url", "protected"],
+        "properties": {
+          "url": { "type": "string" },
+          "protected": { "type": "boolean" }
+        }
+      }
+    },
+    "targets": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["url", "protected"],
+        "properties": {
+          "url": { "type": "string" },
+          "previous": { "type": "boolean" },
+          "opener": { "enum": ["protected", "unprotected", "unknown"] },
+          "protected": { "type": "boolean" }
+        }
+      }
+    },
+    "cookieDomains": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["domain", "protected"],
+        "properties": {
+          "domain": { "type": "string" },
+          "protected": { "type": "boolean" }
+        }
+      }
+    },
+    "storageKeys": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["key", "protected"],
+        "properties": {
+          "key": { "type": "string" },
+          "protected": { "type": "boolean" }
+        }
+      }
+    }
+  }
+}