@rubytech/create-maxy-code 0.1.109 → 0.1.111

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.ts

@@ -1,715 +0,0 @@
-// Raw CDP scrape of the operator's Cloudflare dashboard to discover the
-// domains attached to the logged-in account. Output on stdout is a JSON
-// `string[]`, sorted and deduped. Every failure mode exits non-zero with
-// a `reason=<enum>` token on stderr tagged [list-cf-domains].
-//
-// Why raw CDP, not playwright:
-//   - `/json/new?about:blank` + WebSocket to the returned `webSocketDebuggerUrl`
-//     is ~120 LOC including retries and state machine.
-//   - Adds zero npm deps (Node 22 ships global `WebSocket`; no `ws`/`playwright`).
-//   - CDP is already bound to 127.0.0.1 by vnc.sh; the runtime surface is
-//     the same one setup-tunnel.sh uses for browser drive.
-//
-// Why URL-pattern extraction, not CSS selectors:
-//   - Cloudflare's SPA uses hashed, version-churning class names — a selector
-//     written today drifts within a dashboard redesign window.
-//   - The `/<accountId>/<domain>` URL shape is load-bearing for CF's own
-//     routing and cannot drift without breaking their entire dashboard; it
-//     is the most stable surface to key off.
-//
-// Why href-only (no page-text fallback): an earlier
-// <main>-wide FQDN text walker ("Source B") was removed after a reproduction returned
-// `count=1` with a bogus string (`leg.interest` — a static footer FQDN-shape
-// that hit the regex). The walker's non-empty result short-circuited the
-// poll-to-success branch before zones hydrated 500 ms later, silently
-// returning wrong data with `reason=ok`. The walker's intended role —
-// "defend against CF redesign removing href links" — is already served by
-// the existing `empty-or-drift` body-dump branch when href scraping returns
-// nothing; a silent fallback that produces wrong answers is strictly worse
-// than a loud drift signal with a snapshotted HTML dump for diagnosis.
-//
-// Why poll-to-stable: the CF dashboard lazy-loads its zone list after the
-// initial document-ready signal. A naive "return on first non-empty poll"
-// can race into a partial result (e.g. first zone rendered at t=500 ms, all
-// zones at t=1000 ms). The `scrapeDomains` poll waits for the observed count
-// to stabilise across two consecutive iterations before returning.
-//
-// Contract with the caller (the agent invokes list-cf-domains.sh via Bash):
-//   stdout on exit 0: JSON `string[]`  (empty array means signed-in-but-empty)
-//   stderr on any path: `[list-cf-domains] …` phase lines
-//   exit 1: `reason=<enum>` on stderr; scrape-empty-but-no-error is exit 0
-//            with body dump (the enum exists so the operator/agent can
-//            distinguish "selector drift" from "empty account" — both
-//            shapes arrive via stdout).
-
-import { readFileSync } from "node:fs";
-import { writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { homedir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-// CDP endpoint is resolved lazily inside `main()` so importing this module
-// for in-process tests (`scrapeCurrentPage` / `scrapeDomains` under JSDOM)
-// does not require an installed brand on disk.
-//
-// source-of-truth contract:
-//   Runtime: brand.json `cdpPort` at `${MAXY_PLATFORM_ROOT}/config/brand.json`
-//     is authoritative. Wrapper exports MAXY_PLATFORM_ROOT and BRAND. Missing
-//     env / file / field → loud-fail with one of three named reasons. A
-//     silent CDP-port default would make every non-default brand fail
-//     `cdp-unreachable`; runtime config never falls back silently
-//     (NEO4J_URI sets the same precedent).
-//
-//   Test overrides: when BOTH `LIST_CF_DOMAINS_CDP_HOST` and
-//     `LIST_CF_DOMAINS_CDP_PORT` are set, they win over brand.json. The
-//     existing ECONNREFUSED vitest forces `127.0.0.1:1` (RFC 6335-reserved)
-//     this way without an installed brand. Production never sets these.
-
-// Phase budgets total 30s (enforced by the shell wrapper's `timeout`).
-// Individual steps get sub-budgets so an early stall does not eat the
-// whole envelope silently.
-const CONNECT_TIMEOUT_MS = 2_000;
-const NAVIGATE_TIMEOUT_MS = 15_000;
-const SIGNED_IN_POLL_MS = 10_000;
-const SCRAPE_POLL_MS = 10_000;
-const POLL_INTERVAL_MS = 500;
-
-type Reason =
-  | "cdp-unreachable"
-  | "target-create-failed"
-  | "ws-connect-failed"
-  | "not-signed-in"
-  | "navigate-failed"
-  | "table-wait-timeout"
-  | "runtime-error"
-  // config-class failures. The first three short-circuit before
-  // any CDP work begins; the route maps them to `field='config'` so the
-  // form renders a config-card naming the brand + path instead of a Retry
-  // button (retrying re-fires the same wrongly-resolved spawn
-  // pattern).
-  | "brand-config-missing"
-  | "cdp-port-unresolved";
-
-function logPhase(line: string): void {
-  // Stderr: the agent-via-Bash invocation streams the script's stderr into
-  // the PTY chat verbatim, so phase lines land in the operator's view
-  // alongside any other script output.
-  process.stderr.write(`[list-cf-domains] ${line}\n`);
-}
-
-function die(reason: Reason, detail = ""): never {
-  logPhase(`phase=error reason=${reason}${detail ? ` detail="${detail.replace(/"/g, "'").slice(0, 300)}"` : ""}`);
-  process.exit(1);
-}
-
-interface CdpEndpoint {
-  host: string;
-  port: number;
-  source: "env-override" | "brand.json";
-}
-
-// single source of truth for the CDP endpoint. Called once from
-// `main()` so the JSDOM scrape test (which imports `scrapeCurrentPage`
-// directly without invoking `main`) does not need an installed brand.
-function resolveCdpEndpoint(): CdpEndpoint {
-  const envHost = process.env.LIST_CF_DOMAINS_CDP_HOST;
-  const envPortRaw = process.env.LIST_CF_DOMAINS_CDP_PORT;
-  if (envHost !== undefined && envPortRaw !== undefined) {
-    const envPort = Number(envPortRaw);
-    if (!Number.isInteger(envPort) || envPort <= 0 || envPort > 65535) {
-      die(
-        "cdp-port-unresolved",
-        `LIST_CF_DOMAINS_CDP_PORT="${envPortRaw}" is not a valid integer port`,
-      );
-    }
-    return { host: envHost, port: envPort, source: "env-override" };
-  }
-
-  const brand = process.env.BRAND;
-  if (!brand) {
-    die(
-      "brand-config-missing",
-      "BRAND env var not set by wrapper — refusing to guess brand identity",
-    );
-  }
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot) {
-    die(
-      "brand-config-missing",
-      "MAXY_PLATFORM_ROOT env var not set — wrapper must export it before spawn",
-    );
-  }
-  const brandPath = resolve(platformRoot, "config", "brand.json");
-  let raw: string;
-  try {
-    raw = readFileSync(brandPath, "utf-8");
-  } catch (err) {
-    // Distinct emission (not via `die`) so the path is named on the same line
-    // — config-card rendering on the route side keys off it.
-    logPhase(
-      `phase=error reason=brand-config-missing path=${brandPath} detail="${(err instanceof Error ? err.message : String(err)).replace(/"/g, "'").slice(0, 200)}"`,
-    );
-    process.exit(1);
-  }
-  let parsed: Record<string, unknown>;
-  try {
-    parsed = JSON.parse(raw) as Record<string, unknown>;
-  } catch (err) {
-    logPhase(
-      `phase=error reason=brand-config-missing path=${brandPath} detail="parse failed: ${(err instanceof Error ? err.message : String(err)).replace(/"/g, "'").slice(0, 160)}"`,
-    );
-    process.exit(1);
-  }
-  const cdpPort = parsed.cdpPort;
-  if (typeof cdpPort !== "number" || !Number.isInteger(cdpPort) || cdpPort <= 0 || cdpPort > 65535) {
-    // Names the keys actually present so a schema-drift incident surfaces
-    // immediately ("oh, brand.json renamed `cdpPort` to `cdp_port` in r123").
-    const keys = Object.keys(parsed).join(",");
-    logPhase(
-      `phase=error reason=cdp-port-unresolved brand=${brand} json_keys=${keys}`,
-    );
-    process.exit(1);
-  }
-  // Host stays 127.0.0.1 on the runtime path — vnc.sh binds Chromium's CDP
-  // server to localhost only, by construction. brand.json carries the port,
-  // not the host, because the host has never varied across brands.
-  return { host: "127.0.0.1", port: cdpPort, source: "brand.json" };
-}
-
-async function cdpVersion(host: string, port: number): Promise<void> {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), CONNECT_TIMEOUT_MS);
-  try {
-    const res = await fetch(`http://${host}:${port}/json/version`, { signal: controller.signal });
-    if (!res.ok) die("cdp-unreachable", `HTTP ${res.status}`);
-  } catch (err) {
-    die("cdp-unreachable", err instanceof Error ? err.message : String(err));
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-interface CdpTarget {
-  id: string;
-  webSocketDebuggerUrl: string;
-}
-
-async function createTarget(host: string, port: number): Promise<CdpTarget> {
-  // `PUT /json/new?<url>` returns JSON describing the target. The URL goes
-  // as a query-string argument (not a ?url= key), matching Chromium's CDP
-  // server. about:blank avoids a wasted navigation — the real navigate
-  // happens over WS after we attach.
-  const endpoint = `http://${host}:${port}/json/new?about:blank`;
-  let res: Response;
-  try {
-    res = await fetch(endpoint, { method: "PUT", signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS) });
-  } catch (err) {
-    die("target-create-failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!res.ok) die("target-create-failed", `HTTP ${res.status}`);
-  const target = (await res.json()) as Partial<CdpTarget>;
-  if (!target.id || !target.webSocketDebuggerUrl) {
-    die("target-create-failed", "response missing id or webSocketDebuggerUrl");
-  }
-  return target as CdpTarget;
-}
-
-async function closeTarget(host: string, port: number, id: string): Promise<void> {
-  try {
-    await fetch(`http://${host}:${port}/json/close/${id}`, {
-      signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS),
-    });
-  } catch {
-    // Best-effort on cleanup — a leaked target is recovered by the next vnc.sh
-    // restart; surfacing it as a failure would mask the real scrape error.
-  }
-}
-
-// Minimal CDP WebSocket client. We only need three commands: Page.enable,
-// Runtime.enable, Page.navigate, Runtime.evaluate. A full client would
-// manage sessions / targets / events — we just need request/response with
-// per-id correlation and an optional event stream for Page.frameNavigated
-// (which we do not actually need because Runtime.evaluate on location.href
-// is the authoritative signal).
-class CdpClient {
-  private ws: WebSocket;
-  private nextId = 1;
-  private pending = new Map<number, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
-
-  private constructor(ws: WebSocket) {
-    this.ws = ws;
-    this.ws.addEventListener("message", (ev) => this.onMessage(ev.data as string));
-    this.ws.addEventListener("error", () => {
-      for (const { reject } of this.pending.values()) reject(new Error("WebSocket error"));
-      this.pending.clear();
-    });
-    this.ws.addEventListener("close", () => {
-      for (const { reject } of this.pending.values()) reject(new Error("WebSocket closed"));
-      this.pending.clear();
-    });
-  }
-
-  static async connect(url: string): Promise<CdpClient> {
-    const ws = new WebSocket(url);
-    return await new Promise((resolvePromise, rejectPromise) => {
-      const timer = setTimeout(() => {
-        ws.close();
-        rejectPromise(new Error(`WebSocket connect timeout (${CONNECT_TIMEOUT_MS}ms)`));
-      }, CONNECT_TIMEOUT_MS);
-      ws.addEventListener("open", () => {
-        clearTimeout(timer);
-        resolvePromise(new CdpClient(ws));
-      }, { once: true });
-      ws.addEventListener("error", (ev) => {
-        clearTimeout(timer);
-        rejectPromise(new Error(`WebSocket error: ${(ev as ErrorEvent).message ?? "unknown"}`));
-      }, { once: true });
-    });
-  }
-
-  private onMessage(raw: string): void {
-    let msg: { id?: number; result?: unknown; error?: { message?: string } };
-    try {
-      msg = JSON.parse(raw);
-    } catch {
-      return;
-    }
-    if (typeof msg.id !== "number") return;
-    const waiter = this.pending.get(msg.id);
-    if (!waiter) return;
-    this.pending.delete(msg.id);
-    if (msg.error) {
-      waiter.reject(new Error(msg.error.message ?? "CDP error"));
-    } else {
-      waiter.resolve(msg.result);
-    }
-  }
-
-  send<T = unknown>(method: string, params: Record<string, unknown> = {}): Promise<T> {
-    const id = this.nextId++;
-    return new Promise<T>((resolvePromise, rejectPromise) => {
-      this.pending.set(id, {
-        resolve: resolvePromise as (v: unknown) => void,
-        reject: rejectPromise,
-      });
-      this.ws.send(JSON.stringify({ id, method, params }));
-    });
-  }
-
-  close(): void {
-    try { this.ws.close(); } catch { /* ws may already be closing */ }
-  }
-}
-
-interface EvaluateResult {
-  result: { type: string; value?: unknown; description?: string };
-  exceptionDetails?: { text?: string; exception?: { description?: string } };
-}
-
-async function evaluate<T = unknown>(cdp: CdpClient, expression: string): Promise<T> {
-  const res = await cdp.send<EvaluateResult>("Runtime.evaluate", {
-    expression,
-    returnByValue: true,
-    awaitPromise: false,
-  });
-  if (res.exceptionDetails) {
-    throw new Error(res.exceptionDetails.exception?.description ?? res.exceptionDetails.text ?? "evaluate threw");
-  }
-  return res.result.value as T;
-}
-
-// Detect whether the dashboard has redirected to a signed-in account path
-// (URL like `/<32-hex-accountId>/…`) or the unsigned-in `/login` flow.
-// Returns the accountId if signed in, null if still loading, false if
-// definitively signed-out.
-const ACCOUNT_ID_REGEX = /^\/([a-f0-9]{32})(?:\/|$)/;
-
-async function readAccountId(cdp: CdpClient): Promise<string | null | false> {
-  const pathname = await evaluate<string>(cdp, "location.pathname");
-  if (typeof pathname !== "string") return null;
-  if (pathname.startsWith("/login") || pathname.startsWith("/sign-in")) return false;
-  const match = pathname.match(ACCOUNT_ID_REGEX);
-  return match ? match[1] : null;
-}
-
-async function waitForSignedIn(cdp: CdpClient): Promise<string> {
-  const deadline = Date.now() + SIGNED_IN_POLL_MS;
-  while (Date.now() < deadline) {
-    const state = await readAccountId(cdp);
-    if (state === false) die("not-signed-in", "dashboard redirected to login");
-    if (typeof state === "string") {
-      logPhase(`phase=dashboard-nav-complete accountId=${state.slice(0, 8)}…`);
-      return state;
-    }
-    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-  }
-  // Timed out without seeing either pattern — treat as not-signed-in to
-  // prompt `tunnel-login`; a genuinely-slow dashboard that later resolves
-  // would be a false-negative we accept in exchange for deterministic UX.
-  die("not-signed-in", "no /<accountId>/… path reached within budget");
-}
-
-export interface ScrapeOutcome {
-  reason: "ok" | "no-account-id";
-  domains: string[];
-}
-
-// Pure scrape logic — extracts the zones on the current Cloudflare dashboard
-// page by matching `<a href="/<accountId>/<zone>…">` links. Exported for
-// direct in-process testing under JSDOM (see `list-cf-domains-scrape.test.ts`),
-// and serialised into `SCRAPE_EXPRESSION` below for execution inside the
-// operator's VNC Chromium via CDP `Runtime.evaluate`. The function takes its
-// document and location as arguments (rather than reading globals) so the
-// JSDOM test can pass in its window's document+location directly — test and
-// prod share the same implementation, with no duplication and no eval.
-//
-// Note: this function body is serialised via `Function.prototype.toString()`,
-// so it must be fully self-contained — no imports, no captures from outer
-// scope. Node-side helpers belong outside.
-export function scrapeCurrentPage(
-  document: Document,
-  location: Location,
-): ScrapeOutcome {
-  const accountIdMatch = location.pathname.match(/^\/([a-f0-9]{32})/);
-  if (!accountIdMatch) return { reason: "no-account-id", domains: [] };
-  const accountId = accountIdMatch[1];
-
-  const out = new Set<string>();
-  const pushIfDomain = (s: unknown): void => {
-    if (typeof s !== "string") return;
-    const t = s.trim().toLowerCase();
-    if (
-      !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(
-        t,
-      )
-    )
-      return;
-    if (t.endsWith(".cloudflare.com") || t === "cloudflare.com") return;
-    out.add(t);
-  };
-
-  // The only scrape source: `/<accountId>/<host>` hrefs — the canonical CF
-  // routing pattern the overview page uses to link each zone to its
-  // management screens. The full-<main> FQDN text walker was removed
-  // after it returned a bogus FQDN-shaped string from static page copy
-  // (see module header). When this source returns empty, the caller's
-  // `empty-or-drift` branch snapshots the page HTML for diagnosis — loud
-  // drift signal, not silent wrong data.
-  const hrefPrefix = "/" + accountId + "/";
-  for (const a of document.querySelectorAll("a[href]")) {
-    const href = a.getAttribute("href") || "";
-    if (!href.startsWith(hrefPrefix)) continue;
-    const tail = href.slice(hrefPrefix.length).split("?")[0].split("#")[0];
-    const firstSegment = tail.split("/")[0];
-    pushIfDomain(firstSegment);
-  }
-
-  return { reason: "ok", domains: Array.from(out).sort() };
-}
-
-// The serialised form the CDP Runtime.evaluate executes inside the operator's
-// VNC Chromium. Deriving it from `scrapeCurrentPage.toString()` means the
-// browser-side and the test-side share one implementation — drift between
-// them is impossible by construction.
-export const SCRAPE_EXPRESSION = `(${scrapeCurrentPage.toString()})(document, location)`;
-
-// Minimum surface `scrapeDomains` needs from the CDP client: execute a JS
-// expression in the target page and return the serialised value. Typing the
-// dependency at this width lets the vitest regression inject a mock without
-// constructing a full CdpClient + WebSocket.
-export type CdpEvaluator = (expression: string) => Promise<unknown>;
-
-// Trailing-run length (consecutive polls at `max_count`) the complete-line
-// asserts before it declares `unstable=false`. Two iterations at 500 ms each
-// = 1 s of continuous observation at the high-water mark. removed
-// the early-exit on this threshold (it shortcuts multi-zone accounts where
-// the first zone hydrates one poll ahead of the second — the plateau at the
-// intermediate count trips the threshold before the final zone arrives);
-// the threshold now only labels the exit, it does not gate it.
-const STABLE_POLL_THRESHOLD = 2;
-
-// Cap on `document.documentElement.outerHTML` captured into the dump file.
-// The observed Cloudflare dashboard outerHTML is ~1 MB; 5 MB is 5× headroom
-// and still fits comfortably in one `writeFile` syscall on the Pi. An earlier
-// 100 KB cap truncated the dump mid-`<head>` CSS on every scrape,
-// rendering the forensic artifact silently broken: the
-// zone table lived past the cutoff and `grep <zone-host> <dump>` always
-// returned nothing, forcing re-scrapes to answer post-hoc questions.
-const OUTER_HTML_CAPTURE_MAX_CHARS = 5_000_000;
-
-// Cap the `domains=[…]` payload on per-poll and complete phase lines. The
-// extractor already implicitly bounds the list via the FQDN regex + Set
-// dedupe, but a pathological CF redesign could emit thousands of href
-// matches; the cap keeps the stream log readable without masking the real
-// capture size (the `count=` field carries the exact n).
-const DOMAINS_PAYLOAD_MAX_CHARS = 1000;
-
-function formatDomains(domains: string[]): string {
-  const joined = domains.join(",");
-  return joined.length > DOMAINS_PAYLOAD_MAX_CHARS
-    ? joined.slice(0, DOMAINS_PAYLOAD_MAX_CHARS - 3) + "..."
-    : joined;
-}
-
-type DumpMode = "stable" | "unstable" | "empty-or-drift";
-type DumpResult = { path: string; truncated: boolean } | { err: string };
-
-// Snapshot the operator's current dashboard HTML so post-hoc diagnosis of a
-// partial, unstable, or empty scrape has the exact DOM the scrape observed
-// at exit. Called on all three `scrapeDomains` exit paths — the filename's
-// `mode` field names which path fired, and the `pid<pid>` suffix prevents
-// collision if two invocations land in the same millisecond. Loud-fail
-// preserved: on any throw (evaluator rejected, CONFIG_DIR unset, writeFile
-// ENOENT), return `{err}` so the caller emits a separate
-// `phase=dump-write-failed` line and the complete line carries
-// `dump=failed`. The scrape's real signal must never be masked.
-async function dumpHtml(
-  evaluator: CdpEvaluator,
-  count: number,
-  mode: DumpMode,
-): Promise<DumpResult> {
-  try {
-    const html = (await evaluator(
-      `document.documentElement.outerHTML.slice(0, ${OUTER_HTML_CAPTURE_MAX_CHARS})`,
-    )) as string;
-    // CONFIG_DIR is set by list-cf-domains.sh before the spawn. A silent
-    // fallback would dump logs into the wrong brand's directory on a Real
-    // Agent install — a silent-miswrite masking the wrapper-side break it
-    // came from. doctrine: loud-fail on absent runtime-derived
-    // values.
-    const configDir = process.env.CONFIG_DIR;
-    if (!configDir) {
-      throw new Error(
-        "CONFIG_DIR env var not set by wrapper — refusing to guess brand log directory",
-      );
-    }
-    const logDir = resolve(homedir(), configDir, "logs");
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const dumpPath = resolve(
-      logDir,
-      `list-cf-domains-${ts}-count${count}-${mode}-pid${process.pid}.html`,
-    );
-    const htmlStr = typeof html === "string" ? html : String(html);
-    await writeFile(dumpPath, htmlStr, "utf-8");
-    // Heuristic: if the slice returned exactly OUTER_HTML_CAPTURE_MAX_CHARS,
-    // the source outerHTML almost certainly exceeded the cap and we
-    // truncated mid-document. The false positive (outerHTML exactly at the
-    // ceiling) is a rounding coincidence on the order of 1-in-5M and is
-    // acceptable — a loud truncation signal with a ~10^-7 false-positive
-    // rate is strictly better than silent truncation. A downstream
-    // investigator seeing `truncated=true` can re-scrape with a larger
-    // cap or `outerHTML` unsliced.
-    const truncated = htmlStr.length >= OUTER_HTML_CAPTURE_MAX_CHARS;
-    return { path: dumpPath, truncated };
-  } catch (err) {
-    return {
-      err: (err instanceof Error ? err.message : String(err)).slice(0, 120),
-    };
-  }
-}
-
-// Render the `dump=<path>` field for a complete-line, and emit a separate
-// loud-fail `phase=dump-write-failed` line on failure. Keeps the on-success
-// complete line terse and routes every failure through the same observation
-// primitive so investigators have one grep pattern for all dump write errors.
-function dumpField(result: DumpResult, mode: DumpMode): string {
-  if ("path" in result) {
-    if (result.truncated) {
-      // Loud separate phase line — an investigator grepping for truncation
-      // incidents across the stream log has one exact pattern to match.
-      logPhase(
-        `phase=dump-truncated mode=${mode} path=${result.path} captured_bytes=${OUTER_HTML_CAPTURE_MAX_CHARS}`,
-      );
-      return `dump=${result.path} dump_truncated=true`;
-    }
-    return `dump=${result.path}`;
-  }
-  logPhase(
-    `phase=dump-write-failed mode=${mode} detail="${result.err.replace(/"/g, "'")}"`,
-  );
-  return "dump=failed";
-}
-
-export async function scrapeDomains(evaluator: CdpEvaluator): Promise<string[]> {
-  const deadline = Date.now() + SCRAPE_POLL_MS;
-  // pure poll-to-deadline. The earlier "first N stable polls wins"
-  // heuristic short-circuited on the first plateau a multi-zone dashboard
-  // rendered — a 2-zone account whose second zone hydrates one poll later
-  // than the first would lock `count=1` before the second zone arrived.
-  // Removing early-exit entirely is the only formulation that eliminates the
-  // class: any "N-consec-at-max wins" variant still fires on the intermediate
-  // plateau (`[] [] [a] [a] [a,b] …` → threshold met at poll 4 before zone B
-  // observed). The cost is ~9 s of happy-path latency under the 10 s budget
-  // (still within onboarding tolerance). `max_count` tracks the high-water
-  // count; `consecutiveAtMax` tracks the trailing run at that water-mark;
-  // `seenDecrease` tracks any mid-trajectory count drop. `unstable=false`
-  // requires reaching max, ending at max, at least STABLE_POLL_THRESHOLD
-  // consecutive trailing polls at max, and no mid-trajectory decrease — so a
-  // trajectory like `[a][a][a][a,b]{never reaches 2 consecutive}` correctly
-  // reports `unstable=true` even though `final_count === max_count`.
-  let lastOutcome: ScrapeOutcome | null = null;
-  let maxCount = 0;
-  // Snapshot of the domains array at the most-recent observation of
-  // `maxCount`. Updated on every `>=` poll so it always reflects the latest
-  // capture at the high-water mark; returned at deadline when `maxCount > 0`.
-  let maxDomains: string[] = [];
-  let finalCount = 0;
-  let consecutiveAtMax = 0;
-  let seenDecrease = false;
-  let polls = 0;
-
-  while (Date.now() < deadline) {
-    polls += 1;
-    try {
-      const outcome = (await evaluator(SCRAPE_EXPRESSION)) as ScrapeOutcome;
-      lastOutcome = outcome;
-      const count = outcome.domains.length;
-
-      logPhase(
-        `phase=dom-scrape-poll n=${polls} count=${count} domains=[${formatDomains(outcome.domains)}]`,
-      );
-
-      if (outcome.reason === "ok" && count > 0) {
-        if (count > maxCount) {
-          // New high-water mark. Post-stable increases reset the run counter —
-          // the new stable window must also satisfy the threshold to qualify
-          // as `unstable=false`.
-          maxCount = count;
-          maxDomains = outcome.domains;
-          consecutiveAtMax = 1;
-        } else if (count === maxCount) {
-          maxDomains = outcome.domains;
-          consecutiveAtMax += 1;
-        } else {
-          // count > 0 && count < maxCount — the page shrunk mid-poll
-          // (virtual-scroll pagination, zone deletion concurrent with scrape,
-          // SPA re-render collapsing rows). Preserve the high-water snapshot;
-          // flag the trajectory as unstable.
-          seenDecrease = true;
-          consecutiveAtMax = 0;
-        }
-        finalCount = count;
-      } else {
-        // Empty poll or non-ok reason (no-account-id — SPA mid-navigation):
-        // the page momentarily showed no zones, breaking any trailing at-max
-        // run. Don't flip `seenDecrease` — treating a hydration gap as a
-        // "shrink" would be a false positive on the leading empty polls of
-        // every scrape. `finalCount` reflects the last poll's observed count
-        // (always 0 in this branch, since `scrapeCurrentPage` returns empty
-        // domains on any non-ok reason), so the stream log's `final_count`
-        // field accurately names what the last poll saw, not a stale value
-        // from an earlier successful observation.
-        consecutiveAtMax = 0;
-        finalCount = count;
-      }
-    } catch (err) {
-      logPhase(
-        `phase=scrape-retry n=${polls} err="${(err instanceof Error ? err.message : String(err)).slice(0, 120)}"`,
-      );
-    }
-    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-  }
-
-  // Deadline reached. Two branches:
-  //
-  // (i) We observed at least one non-empty poll. Return the max-count
-  //     snapshot (which, when `finalCount === maxCount`, is also the last
-  //     non-empty observation). `unstable=true` whenever any signal suggests
-  //     the page wasn't settled: shrinkage, end-below-max, or fewer than
-  //     STABLE_POLL_THRESHOLD consecutive trailing polls at max.
-  //
-  // (ii) Every poll was empty — either a genuinely empty account OR CF
-  //      drifted the href shape. The `empty-or-drift` dump is the operator's
-  //      single-artifact signal for distinguishing the two.
-  if (maxCount > 0) {
-    const unstable =
-      seenDecrease ||
-      finalCount !== maxCount ||
-      consecutiveAtMax < STABLE_POLL_THRESHOLD;
-    const mode: DumpMode = unstable ? "unstable" : "stable";
-    const dump = await dumpHtml(evaluator, maxCount, mode);
-    logPhase(
-      `phase=dom-scrape-complete result=ok count=${maxCount} total_polls=${polls} max_count=${maxCount} final_count=${finalCount} stable_polls=${consecutiveAtMax} unstable=${unstable} domains=[${formatDomains(maxDomains)}] ${dumpField(dump, mode)}`,
-    );
-    return maxDomains;
-  }
-
-  const dump = await dumpHtml(evaluator, 0, "empty-or-drift");
-  logPhase(
-    `phase=dom-scrape-complete result=empty-or-drift count=0 total_polls=${polls} max_count=0 final_count=0 stable_polls=0 lastReason=${lastOutcome?.reason ?? "unknown"} ${dumpField(dump, "empty-or-drift")}`,
-  );
-  return [];
-}
-
-async function navigate(cdp: CdpClient, url: string): Promise<void> {
-  const result = await cdp.send<{ errorText?: string }>("Page.navigate", { url });
-  if (result?.errorText) die("navigate-failed", `Page.navigate errorText="${result.errorText}"`);
-}
-
-async function waitForDocumentReady(cdp: CdpClient): Promise<void> {
-  const deadline = Date.now() + NAVIGATE_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    const state = await evaluate<string>(cdp, "document.readyState");
-    if (state === "complete" || state === "interactive") return;
-    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-  }
-  die("navigate-failed", "document.readyState did not reach complete/interactive");
-}
-
-async function main(): Promise<void> {
-  const endpoint = resolveCdpEndpoint();
-  logPhase(`phase=script-start cdp=${endpoint.host}:${endpoint.port} source=${endpoint.source}`);
-
-  await cdpVersion(endpoint.host, endpoint.port);
-  logPhase(`phase=cdp-connect result=ok`);
-
-  const target = await createTarget(endpoint.host, endpoint.port);
-  logPhase(`phase=target-created targetId=${target.id.slice(0, 8)}…`);
-
-  let cdp: CdpClient;
-  try {
-    cdp = await CdpClient.connect(target.webSocketDebuggerUrl);
-  } catch (err) {
-    await closeTarget(endpoint.host, endpoint.port, target.id);
-    die("ws-connect-failed", err instanceof Error ? err.message : String(err));
-  }
-
-  try {
-    await cdp.send("Page.enable");
-    await cdp.send("Runtime.enable");
-
-    logPhase(`phase=dashboard-nav-start url=https://dash.cloudflare.com/`);
-    await navigate(cdp, "https://dash.cloudflare.com/");
-    await waitForDocumentReady(cdp);
-
-    const accountId = await waitForSignedIn(cdp);
-
-    const overviewUrl = `https://dash.cloudflare.com/${accountId}/domains/overview`;
-    logPhase(`phase=table-wait url=${overviewUrl}`);
-    await navigate(cdp, overviewUrl);
-    await waitForDocumentReady(cdp);
-
-    const domains = await scrapeDomains((expr) => evaluate(cdp, expr));
-
-    logPhase(`phase=target-closed`);
-    process.stdout.write(JSON.stringify(domains) + "\n");
-    logPhase(`phase=script-exit code=0 count=${domains.length}`);
-  } catch (err) {
-    // Only runtime errors that escaped the typed-reason paths land here.
-    die("runtime-error", err instanceof Error ? err.message : String(err));
-  } finally {
-    cdp.close();
-    await closeTarget(endpoint.host, endpoint.port, target.id);
-  }
-}
-
-// Entry-point gate: only run `main()` when this module is the script Node was
-// invoked with, not when imported by the vitest regressions that exercise
-// `scrapeCurrentPage` / `scrapeDomains` directly. Without the gate, importing
-// this module would trigger a live CDP connection attempt and process.exit(1)
-// inside the test process.
-if (process.argv[1] && process.argv[1] === fileURLToPath(import.meta.url)) {
-  main().catch((err: unknown) => {
-    die("runtime-error", err instanceof Error ? err.message : String(err));
-  });
-}