@ai-ecoverse/slicc-browsers 1.7.0 → 1.7.1

package/README.md

@@ -270,7 +270,13 @@ of supported names. `capabilities.scope` selects owner-specific rows.
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
 and `client` to origins. Optionally map `plain`, `cross` and `log`; their defaults
 are `ordinary`, `client` and `ordinary`. Origins must preserve the site
-relationships of the data. Tags and cookie names are unique per leg. `variant`
+relationships of the data. Explicitly map an unavailable target to `null`: every
+row needing that origin is reported as `skip` for control, guarded and live, with
+reason `not-applicable:no-<target>-origin`; no substitute origin is used and the
+row never passes. A guard whose whole site is protected, such as the extension
+where every `sliccy.ai` host is protected, passes `ordinary-same-site: null`.
+This also applies to origins referenced in setup, triggers, observations and
+liveness checks, not only the row target. Tags and cookie names are unique per leg. `variant`
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 `log(row)` receives completed rows. A variant supplies the wait before an
 explicit `Target.detachFromTarget` step and for a `settle.variant` step.
@@ -319,7 +325,12 @@ fixture log. A setup beacon on the same origin and tag cannot settle an unfinish
 redirect chain. This does not change the observations used to judge either leg.
 
 The separately exported Node module `@ai-ecoverse/slicc-browsers/fixture` exposes
-`fixtureServer({ host, port })`, defaulting to a random loopback port. It returns
+`fixtureServer({ host, port, tls })`, defaulting to a random loopback port.
+Pass `tls: { key, cert }` to serve HTTPS using Node TLS key and certificate
+values. The returned origin, request logs, redirect URLs and document heartbeats
+use `https://<Host>` with TLS, so `served`, `hops` and `liveCheck` compare against
+the mapped HTTPS origins, including an extension client at `https://*.sliccy.ai`.
+Without `tls`, the server and logged URLs remain HTTP. It returns
 `origin`, `port`, `log()`, `reset()` and `close()`. Log entries contain `url`,
 `method`, `headers` and `time`. Mirror that API when using another fixture.
 The server serves document, frame, redirect, CSP, authentication, data, image,

package/fixture-server.mjs

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { createServer as createSecureServer } from 'node:https';
 
 const tall = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
@@ -75,10 +76,11 @@ function route(req, url, send, html) {
   return send(404, 'missing', 'text/plain');
 }
 
-export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
+export async function fixtureServer({ host = '127.0.0.1', port = 0, tls } = {}) {
   let entries = [];
-  const server = createServer((req, res) => {
-    const url = new URL(req.url, `http://${req.headers.host}`);
+  const scheme = tls ? 'https' : 'http';
+  const handler = (req, res) => {
+    const url = new URL(req.url, `${scheme}://${req.headers.host}`);
     entries.push({
       url: url.href,
       method: req.method,
@@ -104,7 +106,8 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
         headers
       );
     route(req, url, send, html);
-  });
+  };
+  const server = tls ? createSecureServer(tls, handler) : createServer(handler);
   await new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(port, host, resolve);
@@ -112,7 +115,7 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
   const address = server.address();
   return {
     port: address.port,
-    origin: `http://${host}:${address.port}`,
+    origin: `${scheme}://${host}:${address.port}`,
     log: () => structuredClone(entries),
     reset: () => {
       entries = [];

package/guard-runner.mjs

@@ -832,6 +832,18 @@ const inactive = (vector, target, capabilities) =>
   !supported(vector.requires, capabilities) ||
   (vector.scope !== 'any' && vector.scope !== capabilities.scope);
 
+function unavailableOrigin(vector, target, targets = {}) {
+  const defaults = { plain: 'ordinary', cross: 'client', log: 'ordinary', own: 'client' };
+  const references = [target, 'plain', vector.control.origin];
+  for (const match of q([vector.setup, vector.trigger, vector.observe, vector.liveCheck]).matchAll(
+    /\{([A-Za-z][A-Za-z-]*)\}/g
+  ))
+    references.push(match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]);
+  return references
+    .map((name) => (targets[name] === undefined ? (defaults[name] ?? name) : name))
+    .find((name) => targets[name] === null);
+}
+
 function variables(targets, target, side, slot, index) {
   const tag = `guard-${Date.now()}-${slot}-${index}-${side}-${Math.random().toString(36).slice(2)}`;
   const vars = {
@@ -860,6 +872,15 @@ async function executeRow(job, opts, clients, set, slot, index) {
     via: vector.control.via,
     transportVariant: clients.transportVariant === true,
   };
+  const unavailable = unavailableOrigin(vector, target, opts.targets);
+  if (unavailable)
+    return {
+      ...base,
+      control: 'skip',
+      guarded: 'skip',
+      live: 'skip',
+      reason: `not-applicable:no-${unavailable}-origin`,
+    };
   if (vector.kind === 'text')
     return {
       ...base,

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.7.0",
+  "setVersion": "1.7.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -64,12 +64,12 @@
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
-    "test:guard": "node --test test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs && node scripts/test-guards.mjs",
+    "test:guard": "node --test test/integration/guard-fit.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs && node scripts/test-guards.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.17.0",
+    "@ai-ecoverse/slicc-shared-web": "1.19.0",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",