@modelprofile.com/browser-runtime 1.0.1 → 2.1.0

package/ts/classes.artifactstore.ts

@@ -2,6 +2,7 @@ import * as plugins from './plugins.js';
 import type {
   IBrowserArtifactMetadata,
   IBrowserArtifactStoreOptions,
+  IBrowserResourceKey,
 } from './interfaces.js';
 import { BrowserRuntimeError } from './errors.js';
 import {
@@ -16,15 +17,25 @@ interface IStoredArtifact {
   digest: string;
 }
 
-interface IProjectArtifacts {
+interface IResourceArtifacts {
+  browserResourceId: string;
   directoryName: string;
   totalBytes: number;
   artifacts: Map<string, IStoredArtifact>;
 }
 
+interface IProjectArtifacts {
+  directoryName: string;
+  totalBytes: number;
+  totalArtifacts: number;
+  resources: Map<string, IResourceArtifacts>;
+}
+
 export class BrowserArtifactStore {
   private readonly rootDirectory: string;
   private readonly maxFileBytes: number;
+  private readonly maxArtifactsPerResource: number;
+  private readonly maxResourceBytes: number;
   private readonly maxArtifactsPerProject: number;
   private readonly maxProjectBytes: number;
   private readonly maxProjects: number;
@@ -55,38 +66,46 @@ export class BrowserArtifactStore {
       64 * 1024 * 1024,
       8 * 1024 * 1024,
     );
-    this.maxArtifactsPerProject = validateOptionalInteger(
-      options.maxArtifactsPerProject,
-      'maxArtifactsPerProject',
+    this.maxArtifactsPerResource = validateOptionalInteger(
+      options.maxArtifactsPerResource,
+      'maxArtifactsPerResource',
       1,
       4096,
       256,
     );
-    this.maxProjectBytes = validateOptionalInteger(
-      options.maxProjectBytes,
-      'maxProjectBytes',
+    this.maxResourceBytes = validateOptionalInteger(
+      options.maxResourceBytes,
+      'maxResourceBytes',
       this.maxFileBytes,
       1024 * 1024 * 1024,
       64 * 1024 * 1024,
     );
-    this.maxProjects = validateOptionalInteger(
-      options.maxProjects,
-      'maxProjects',
-      1,
-      256,
-      32,
+    this.maxArtifactsPerProject = validateOptionalInteger(
+      options.maxArtifactsPerProject,
+      'maxArtifactsPerProject',
+      this.maxArtifactsPerResource,
+      65_536,
+      Math.max(1024, this.maxArtifactsPerResource),
     );
+    this.maxProjectBytes = validateOptionalInteger(
+      options.maxProjectBytes,
+      'maxProjectBytes',
+      this.maxResourceBytes,
+      8 * 1024 * 1024 * 1024,
+      Math.max(256 * 1024 * 1024, this.maxResourceBytes),
+    );
+    this.maxProjects = validateOptionalInteger(options.maxProjects, 'maxProjects', 1, 256, 32);
     this.maxTotalArtifacts = validateOptionalInteger(
       options.maxTotalArtifacts,
       'maxTotalArtifacts',
-      this.maxArtifactsPerProject,
+      1,
       65_536,
       Math.max(4096, this.maxArtifactsPerProject),
     );
     this.maxTotalBytes = validateOptionalInteger(
       options.maxTotalBytes,
       'maxTotalBytes',
-      this.maxProjectBytes,
+      this.maxFileBytes,
       8 * 1024 * 1024 * 1024,
       Math.max(512 * 1024 * 1024, this.maxProjectBytes),
     );
@@ -104,9 +123,7 @@ export class BrowserArtifactStore {
   public start(): Promise<void> {
     if (this.started) return Promise.resolve();
     if (this.startPromise) return this.startPromise;
-    this.startPromise = this.startInternal().finally(() => {
-      this.startPromise = undefined;
-    });
+    this.startPromise = this.startInternal().finally(() => { this.startPromise = undefined; });
     return this.startPromise;
   }
 
@@ -127,19 +144,19 @@ export class BrowserArtifactStore {
       } finally {
         release();
       }
-    })().finally(() => {
-      this.stopPromise = undefined;
-    });
+    })().finally(() => { this.stopPromise = undefined; });
     return this.stopPromise;
   }
 
   public async store(
     projectIdArg: string,
+    browserResourceIdArg: string,
     mimeTypeArg: string,
     data: Uint8Array,
   ): Promise<IBrowserArtifactMetadata> {
     this.requireStarted();
-    const projectId = validateBoundedString(projectIdArg, 'projectId', 1, 128);
+    const projectId = this.validateProjectId(projectIdArg);
+    const browserResourceId = this.validateResourceId(browserResourceIdArg);
     const mimeType = validateBoundedString(mimeTypeArg, 'mimeType', 1, 128);
     if (!(data instanceof Uint8Array)) {
       throw new BrowserRuntimeError('INVALID_INPUT', 'data must be Uint8Array');
@@ -149,7 +166,7 @@ export class BrowserArtifactStore {
     const release = await this.mutex.acquire();
     try {
       this.requireStarted();
-      await this.purgeExpiredInternal(projectId);
+      await this.purgeExpiredInternal({ projectId, browserResourceId });
       const existingProject = this.projects.get(projectId);
       if (!existingProject && this.projects.size >= this.maxProjects) {
         throw new BrowserRuntimeError('QUOTA_EXCEEDED');
@@ -160,15 +177,22 @@ export class BrowserArtifactStore {
       ) throw new BrowserRuntimeError('QUOTA_EXCEEDED');
       const project = existingProject ?? await this.createProject(projectId);
       if (
-        project.artifacts.size >= this.maxArtifactsPerProject
+        project.totalArtifacts >= this.maxArtifactsPerProject
         || project.totalBytes + bytes.byteLength > this.maxProjectBytes
       ) throw new BrowserRuntimeError('QUOTA_EXCEEDED');
+      const resource = project.resources.get(browserResourceId)
+        ?? await this.createResource(project, projectId, browserResourceId);
+      if (
+        resource.artifacts.size >= this.maxArtifactsPerResource
+        || resource.totalBytes + bytes.byteLength > this.maxResourceBytes
+      ) throw new BrowserRuntimeError('QUOTA_EXCEEDED');
 
       const artifactId = randomId();
       const createdAt = this.now();
       const metadata: IBrowserArtifactMetadata = {
         artifactId,
         projectId,
+        browserResourceId,
         mimeType,
         size: bytes.byteLength,
         createdAt,
@@ -178,9 +202,9 @@ export class BrowserArtifactStore {
         metadata,
         digest: plugins.crypto.createHash('sha256').update(bytes).digest('hex'),
       };
-      const projectDirectory = plugins.path.join(this.rootDirectory, project.directoryName);
-      const finalPath = plugins.path.join(projectDirectory, artifactId);
-      const temporaryPath = plugins.path.join(projectDirectory, `.${randomId(12)}.tmp`);
+      const resourceDirectory = this.resourcePath(project, resource);
+      const finalPath = plugins.path.join(resourceDirectory, artifactId);
+      const temporaryPath = plugins.path.join(resourceDirectory, `.${randomId(12)}.tmp`);
       let handle: plugins.fsPromises.FileHandle | undefined;
       let renamed = false;
       try {
@@ -192,7 +216,9 @@ export class BrowserArtifactStore {
         await plugins.fsPromises.rename(temporaryPath, finalPath);
         renamed = true;
         await plugins.fsPromises.chmod(finalPath, 0o600);
-        project.artifacts.set(artifactId, stored);
+        resource.artifacts.set(artifactId, stored);
+        resource.totalBytes += bytes.byteLength;
+        project.totalArtifacts += 1;
         project.totalBytes += bytes.byteLength;
         this.totalArtifacts += 1;
         this.totalBytes += bytes.byteLength;
@@ -201,7 +227,9 @@ export class BrowserArtifactStore {
         await handle?.close().catch(() => undefined);
         await plugins.fsPromises.rm(temporaryPath, { force: true }).catch(() => undefined);
         if (renamed) await plugins.fsPromises.rm(finalPath, { force: true }).catch(() => undefined);
-        if (project.artifacts.size === 0) await this.removeEmptyProject(projectId, project);
+        if (resource.artifacts.size === 0) {
+          await this.removeEmptyResource(projectId, project, browserResourceId, resource);
+        }
         throw error;
       }
     } finally {
@@ -209,27 +237,36 @@ export class BrowserArtifactStore {
     }
   }
 
-  public async read(projectIdArg: string, artifactIdArg: string): Promise<Uint8Array> {
+  public async read(
+    projectIdArg: string,
+    browserResourceIdArg: string,
+    artifactIdArg: string,
+  ): Promise<Uint8Array> {
     this.requireStarted();
-    const projectId = validateBoundedString(projectIdArg, 'projectId', 1, 128);
-    const artifactId = validateBoundedString(artifactIdArg, 'artifactId', 1, 128);
+    const projectId = this.validateProjectId(projectIdArg);
+    const browserResourceId = this.validateResourceId(browserResourceIdArg);
+    const artifactId = this.validateArtifactId(artifactIdArg);
     const release = await this.mutex.acquire();
     let handle: plugins.fsPromises.FileHandle | undefined;
     try {
-      const { project, stored, filePath } = this.resolveArtifact(projectId, artifactId);
-      if (stored.metadata.expiresAt <= this.now()) {
-        await this.deleteArtifact(projectId, project, stored, filePath);
+      const resolved = this.resolveArtifact(projectId, browserResourceId, artifactId);
+      if (resolved.stored.metadata.expiresAt <= this.now()) {
+        await this.deleteArtifact(projectId, browserResourceId, resolved);
         throw new BrowserRuntimeError('INVALID_INPUT', 'artifact is unavailable');
       }
       handle = await plugins.fsPromises.open(
-        filePath,
+        resolved.filePath,
         plugins.fs.constants.O_RDONLY | plugins.fs.constants.O_NOFOLLOW,
       );
       const stat = await handle.stat();
-      if (!stat.isFile() || stat.size !== stored.metadata.size || stat.size > this.maxFileBytes) {
+      if (
+        !stat.isFile()
+        || stat.size !== resolved.stored.metadata.size
+        || stat.size > this.maxFileBytes
+      ) {
         await handle.close();
         handle = undefined;
-        await this.deleteArtifact(projectId, project, stored, filePath);
+        await this.deleteArtifact(projectId, browserResourceId, resolved);
         throw new BrowserRuntimeError('FENCED', 'artifact integrity check failed');
       }
       const data = plugins.Buffer.allocUnsafe(stat.size);
@@ -237,8 +274,8 @@ export class BrowserArtifactStore {
       await handle.close();
       handle = undefined;
       const digest = plugins.crypto.createHash('sha256').update(data).digest('hex');
-      if (bytesRead !== stat.size || digest !== stored.digest) {
-        await this.deleteArtifact(projectId, project, stored, filePath);
+      if (bytesRead !== stat.size || digest !== resolved.stored.digest) {
+        await this.deleteArtifact(projectId, browserResourceId, resolved);
         throw new BrowserRuntimeError('FENCED', 'artifact integrity check failed');
       }
       return new Uint8Array(data);
@@ -248,72 +285,90 @@ export class BrowserArtifactStore {
     }
   }
 
-  public async delete(projectIdArg: string, artifactIdArg: string): Promise<void> {
+  public async delete(
+    projectIdArg: string,
+    browserResourceIdArg: string,
+    artifactIdArg: string,
+  ): Promise<void> {
     this.requireStarted();
-    const projectId = validateBoundedString(projectIdArg, 'projectId', 1, 128);
-    const artifactId = validateBoundedString(artifactIdArg, 'artifactId', 1, 128);
+    const projectId = this.validateProjectId(projectIdArg);
+    const browserResourceId = this.validateResourceId(browserResourceIdArg);
+    const artifactId = this.validateArtifactId(artifactIdArg);
     const release = await this.mutex.acquire();
     try {
-      const { project, stored, filePath } = this.resolveArtifact(projectId, artifactId);
-      await this.deleteArtifact(projectId, project, stored, filePath);
+      await this.deleteArtifact(
+        projectId,
+        browserResourceId,
+        this.resolveArtifact(projectId, browserResourceId, artifactId),
+      );
     } finally {
       release();
     }
   }
 
-  public async purgeExpired(projectIdArg?: string): Promise<number> {
+  public async purgeExpired(resource?: IBrowserResourceKey): Promise<number> {
     this.requireStarted();
-    const projectId = projectIdArg === undefined
-      ? undefined
-      : validateBoundedString(projectIdArg, 'projectId', 1, 128);
+    const validated = resource === undefined ? undefined : {
+      projectId: this.validateProjectId(resource.projectId),
+      browserResourceId: this.validateResourceId(resource.browserResourceId),
+    };
     const release = await this.mutex.acquire();
     try {
-      return await this.purgeExpiredInternal(projectId);
+      return await this.purgeExpiredInternal(validated);
     } finally {
       release();
     }
   }
 
-  public async purgeProject(projectIdArg: string): Promise<void> {
+  public async purgeResource(projectIdArg: string, browserResourceIdArg: string): Promise<void> {
     this.requireStarted();
-    const projectId = validateBoundedString(projectIdArg, 'projectId', 1, 128);
+    const projectId = this.validateProjectId(projectIdArg);
+    const browserResourceId = this.validateResourceId(browserResourceIdArg);
     const release = await this.mutex.acquire();
     try {
       const project = this.projects.get(projectId);
-      if (!project) return;
-      await plugins.fsPromises.rm(
-        plugins.path.join(this.rootDirectory, project.directoryName),
-        { recursive: true, force: true },
-      );
-      this.totalArtifacts -= project.artifacts.size;
-      this.totalBytes -= project.totalBytes;
-      this.projects.delete(projectId);
+      const resource = project?.resources.get(browserResourceId);
+      if (!project || !resource) return;
+      await plugins.fsPromises.rm(this.resourcePath(project, resource), {
+        recursive: true,
+        force: true,
+      });
+      project.totalArtifacts -= resource.artifacts.size;
+      project.totalBytes -= resource.totalBytes;
+      this.totalArtifacts -= resource.artifacts.size;
+      this.totalBytes -= resource.totalBytes;
+      project.resources.delete(browserResourceId);
+      await this.removeEmptyProject(projectId, project);
     } finally {
       release();
     }
   }
 
-  public getMetadata(projectIdArg: string, artifactIdArg: string): IBrowserArtifactMetadata {
+  public getMetadata(
+    projectIdArg: string,
+    browserResourceIdArg: string,
+    artifactIdArg: string,
+  ): IBrowserArtifactMetadata {
     this.requireStarted();
-    const projectId = validateBoundedString(projectIdArg, 'projectId', 1, 128);
-    const artifactId = validateBoundedString(artifactIdArg, 'artifactId', 1, 128);
-    const project = this.projects.get(projectId);
-    const stored = project?.artifacts.get(artifactId);
-    if (!stored || stored.metadata.expiresAt <= this.now()) {
+    const projectId = this.validateProjectId(projectIdArg);
+    const browserResourceId = this.validateResourceId(browserResourceIdArg);
+    const artifactId = this.validateArtifactId(artifactIdArg);
+    const resolved = this.resolveArtifact(projectId, browserResourceId, artifactId);
+    if (resolved.stored.metadata.expiresAt <= this.now()) {
       throw new BrowserRuntimeError('INVALID_INPUT', 'artifact is unavailable');
     }
     try {
-      const stat = plugins.fs.lstatSync(
-        plugins.path.join(this.rootDirectory, project!.directoryName, artifactId),
-      );
-      if (stat.isSymbolicLink() || !stat.isFile() || stat.size !== stored.metadata.size) {
-        throw new BrowserRuntimeError('FENCED', 'artifact integrity check failed');
-      }
+      const stat = plugins.fs.lstatSync(resolved.filePath);
+      if (
+        stat.isSymbolicLink()
+        || !stat.isFile()
+        || stat.size !== resolved.stored.metadata.size
+      ) throw new BrowserRuntimeError('FENCED', 'artifact integrity check failed');
     } catch (error) {
       if (error instanceof BrowserRuntimeError) throw error;
       throw new BrowserRuntimeError('FENCED', 'artifact integrity check failed');
     }
-    return { ...stored.metadata };
+    return { ...resolved.stored.metadata };
   }
 
   private async startInternal(): Promise<void> {
@@ -337,8 +392,6 @@ export class BrowserArtifactStore {
       || (uid !== undefined && stat.uid !== uid)
       || (stat.mode & 0o777) !== 0o700
     ) throw new BrowserRuntimeError('FENCED', 'artifact root is not private');
-    const entries = await plugins.fsPromises.readdir(this.rootDirectory);
-    if (entries.length > 0) throw new BrowserRuntimeError('FENCED', 'artifact root is not empty');
     await plugins.fsPromises.chmod(this.rootDirectory, 0o700);
     this.started = true;
     const sweepIntervalMs = Math.min(60_000, Math.max(1000, Math.floor(this.artifactTtlMs / 2)));
@@ -357,32 +410,63 @@ export class BrowserArtifactStore {
   }
 
   private async createProject(projectId: string): Promise<IProjectArtifacts> {
-    const directoryName = plugins.crypto
-      .createHmac('sha256', this.directoryKey)
-      .update(projectId, 'utf8')
-      .digest('hex');
-    const projectDirectory = plugins.path.join(this.rootDirectory, directoryName);
-    await plugins.fsPromises.mkdir(projectDirectory, { recursive: false, mode: 0o700 });
-    const project = { directoryName, totalBytes: 0, artifacts: new Map() };
+    const directoryName = this.digestDirectory(`project\0${projectId}`);
+    await plugins.fsPromises.mkdir(plugins.path.join(this.rootDirectory, directoryName), {
+      recursive: false,
+      mode: 0o700,
+    });
+    const project: IProjectArtifacts = {
+      directoryName,
+      totalBytes: 0,
+      totalArtifacts: 0,
+      resources: new Map(),
+    };
     this.projects.set(projectId, project);
     return project;
   }
 
-  private async purgeExpiredInternal(projectId?: string): Promise<number> {
-    const projectIds = projectId === undefined ? [...this.projects.keys()] : [projectId];
+  private async createResource(
+    project: IProjectArtifacts,
+    projectId: string,
+    browserResourceId: string,
+  ): Promise<IResourceArtifacts> {
+    const directoryName = this.digestDirectory(`resource\0${projectId}\0${browserResourceId}`);
+    await plugins.fsPromises.mkdir(
+      plugins.path.join(this.rootDirectory, project.directoryName, directoryName),
+      { recursive: false, mode: 0o700 },
+    );
+    const resource: IResourceArtifacts = {
+      browserResourceId,
+      directoryName,
+      totalBytes: 0,
+      artifacts: new Map(),
+    };
+    project.resources.set(browserResourceId, resource);
+    return resource;
+  }
+
+  private async purgeExpiredInternal(resourceKey?: IBrowserResourceKey): Promise<number> {
+    const projectEntries = resourceKey
+      ? [[resourceKey.projectId, this.projects.get(resourceKey.projectId)] as const]
+      : [...this.projects.entries()];
     let purged = 0;
-    for (const currentProjectId of projectIds) {
-      const project = this.projects.get(currentProjectId);
+    for (const [projectId, project] of projectEntries) {
       if (!project) continue;
-      for (const stored of [...project.artifacts.values()]) {
-        if (stored.metadata.expiresAt <= this.now()) {
-          const filePath = plugins.path.join(
-            this.rootDirectory,
-            project.directoryName,
-            stored.metadata.artifactId,
-          );
-          await this.deleteArtifact(currentProjectId, project, stored, filePath);
-          purged += 1;
+      const resourceEntries = resourceKey
+        ? [[resourceKey.browserResourceId, project.resources.get(resourceKey.browserResourceId)] as const]
+        : [...project.resources.entries()];
+      for (const [browserResourceId, resource] of resourceEntries) {
+        if (!resource) continue;
+        for (const stored of [...resource.artifacts.values()]) {
+          if (stored.metadata.expiresAt <= this.now()) {
+            await this.deleteArtifact(projectId, browserResourceId, {
+              project,
+              resource,
+              stored,
+              filePath: plugins.path.join(this.resourcePath(project, resource), stored.metadata.artifactId),
+            });
+            purged += 1;
+          }
         }
       }
     }
@@ -391,21 +475,46 @@ export class BrowserArtifactStore {
 
   private async deleteArtifact(
     projectId: string,
-    project: IProjectArtifacts,
-    stored: IStoredArtifact,
-    filePath: string,
+    browserResourceId: string,
+    resolved: ReturnType<BrowserArtifactStore['resolveArtifact']>,
   ): Promise<void> {
-    await plugins.fsPromises.rm(filePath, { force: true });
-    if (project.artifacts.delete(stored.metadata.artifactId)) {
-      project.totalBytes = Math.max(0, project.totalBytes - stored.metadata.size);
+    await plugins.fsPromises.rm(resolved.filePath, { force: true });
+    if (resolved.resource.artifacts.delete(resolved.stored.metadata.artifactId)) {
+      const size = resolved.stored.metadata.size;
+      resolved.resource.totalBytes = Math.max(0, resolved.resource.totalBytes - size);
+      resolved.project.totalArtifacts = Math.max(0, resolved.project.totalArtifacts - 1);
+      resolved.project.totalBytes = Math.max(0, resolved.project.totalBytes - size);
       this.totalArtifacts = Math.max(0, this.totalArtifacts - 1);
-      this.totalBytes = Math.max(0, this.totalBytes - stored.metadata.size);
+      this.totalBytes = Math.max(0, this.totalBytes - size);
     }
+    await this.removeEmptyResource(
+      projectId,
+      resolved.project,
+      browserResourceId,
+      resolved.resource,
+    );
+  }
+
+  private async removeEmptyResource(
+    projectId: string,
+    project: IProjectArtifacts,
+    browserResourceId: string,
+    resource: IResourceArtifacts,
+  ): Promise<void> {
+    if (
+      resource.artifacts.size > 0
+      || project.resources.get(browserResourceId) !== resource
+    ) return;
+    await plugins.fsPromises.rm(this.resourcePath(project, resource), {
+      recursive: true,
+      force: true,
+    });
+    project.resources.delete(browserResourceId);
     await this.removeEmptyProject(projectId, project);
   }
 
   private async removeEmptyProject(projectId: string, project: IProjectArtifacts): Promise<void> {
-    if (project.artifacts.size > 0 || this.projects.get(projectId) !== project) return;
+    if (project.resources.size > 0 || this.projects.get(projectId) !== project) return;
     await plugins.fsPromises.rm(
       plugins.path.join(this.rootDirectory, project.directoryName),
       { recursive: true, force: true },
@@ -413,20 +522,43 @@ export class BrowserArtifactStore {
     this.projects.delete(projectId);
   }
 
-  private resolveArtifact(projectId: string, artifactId: string): {
+  private resolveArtifact(projectId: string, browserResourceId: string, artifactId: string): {
     project: IProjectArtifacts;
+    resource: IResourceArtifacts;
     stored: IStoredArtifact;
     filePath: string;
   } {
     const project = this.projects.get(projectId);
-    const stored = project?.artifacts.get(artifactId);
-    if (!project || !stored) {
+    const resource = project?.resources.get(browserResourceId);
+    const stored = resource?.artifacts.get(artifactId);
+    if (!project || !resource || !stored) {
       throw new BrowserRuntimeError('INVALID_INPUT', 'artifact is unavailable');
     }
     return {
       project,
+      resource,
       stored,
-      filePath: plugins.path.join(this.rootDirectory, project.directoryName, artifactId),
+      filePath: plugins.path.join(this.resourcePath(project, resource), artifactId),
     };
   }
+
+  private resourcePath(project: IProjectArtifacts, resource: IResourceArtifacts): string {
+    return plugins.path.join(this.rootDirectory, project.directoryName, resource.directoryName);
+  }
+
+  private digestDirectory(value: string): string {
+    return plugins.crypto.createHmac('sha256', this.directoryKey).update(value, 'utf8').digest('hex');
+  }
+
+  private validateProjectId(value: unknown): string {
+    return validateBoundedString(value, 'projectId', 1, 256);
+  }
+
+  private validateResourceId(value: unknown): string {
+    return validateBoundedString(value, 'browserResourceId', 16, 256);
+  }
+
+  private validateArtifactId(value: unknown): string {
+    return validateBoundedString(value, 'artifactId', 1, 128);
+  }
 }

package/ts/classes.egressproxy.ts

@@ -38,6 +38,7 @@ const hopByHopHeaders = new Set([
 
 export class BrowserEgressProxy {
   private readonly projectId: string;
+  private readonly browserResourceIdValue: string;
   private readonly allowedPorts: ReadonlySet<number>;
   private readonly maxConnections: number;
   private readonly maxActiveRequests: number;
@@ -69,7 +70,13 @@ export class BrowserEgressProxy {
   private rejectedRequests = 0;
 
   constructor(options: IBrowserEgressProxyOptions) {
-    this.projectId = validateBoundedString(options.projectId, 'projectId', 1, 128);
+    this.projectId = validateBoundedString(options.projectId, 'projectId', 1, 256);
+    this.browserResourceIdValue = validateBoundedString(
+      options.browserResourceId,
+      'browserResourceId',
+      16,
+      256,
+    );
     const ports = options.allowedPorts ?? [80, 443];
     if (!Array.isArray(ports) || ports.length < 1 || ports.length > 32) {
       throw new BrowserRuntimeError('INVALID_INPUT', 'allowedPorts must contain 1 to 32 ports');
@@ -178,6 +185,10 @@ export class BrowserEgressProxy {
     return this.projectId;
   }
 
+  public get browserResourceId(): string {
+    return this.browserResourceIdValue;
+  }
+
   public get allowedTargetPorts(): number[] {
     return [...this.allowedPorts];
   }

package/ts/classes.flexprovider.ts

@@ -36,7 +36,11 @@ implements plugins.flexharness.IFlexToolProvider<TScope> {
     this.state = 'provisioning';
     const scopeId = validateBoundedString(context.scopeId, 'scopeId', 1, 128);
     const sessionId = validateBoundedString(context.sessionId, 'sessionId', 1, 128);
-    if (this.client.scopeId !== scopeId || this.client.sessionId !== sessionId) {
+    if (
+      this.client.scopeId !== scopeId
+      || this.client.sessionId.harnessId !== 'flex'
+      || this.client.sessionId.nativeId !== sessionId
+    ) {
       this.state = 'closed';
       throw new BrowserRuntimeError('CAPABILITY_INVALID');
     }