@theaiplatform/miniapp-sdk 0.3.1 → 0.3.3

package/README.md

@@ -25,12 +25,13 @@ Start with the [Miniapp SDK documentation](https://docs.theaiplatform.app/miniap
 - `@theaiplatform/miniapp-sdk/ui/tailwind.css`
 - `@theaiplatform/miniapp-sdk/ui-components.json`
 - `@theaiplatform/miniapp-sdk/surface`
+- `@theaiplatform/miniapp-sdk/vscode-webview`
 - `@theaiplatform/miniapp-sdk/config`
 - `@theaiplatform/miniapp-sdk/rspack`
 - `@theaiplatform/miniapp-sdk/testing/rstest`
 - `@theaiplatform/miniapp-sdk/config-schema.json`
 
-## In-app E2E testing in 0.3.1
+## In-app E2E testing
 
 The `/testing/rstest` entry point extends Rstest's Playwright fixtures with a
 host-provided miniapp surface and exact TAP session provenance. Tests can assert
@@ -60,6 +61,32 @@ requests through host consent instead of browser `fetch`, and
 secrets remain in the host vault and are injected only by the native request
 authority.
 
+## Converted VS Code webviews in 0.3.3
+
+The `/vscode-webview` entry point mounts a converted, static VS Code webview in
+a sandboxed iframe while keeping platform authority in the outer federated
+surface. Declarative message bindings persist document data through
+`sdk.storage`; the synchronous `localStorage` compatibility facade is backed by
+`sdk.session`, so standalone and channel surfaces share sign-in only for the
+same account, workspace, installation, and package; and exact HTTPS origins are
+mediated through `sdk.http`. The bridge does not expose the host transport, and
+undeclared origins fail closed.
+
+Conversion tools should emit `tapVsCodeWebviewRuntimeSource` beside the imported
+assets and call `mountVsCodeWebview` from the generated surface. The SDK owns
+this compatibility boundary so conversion recipes describe mappings rather
+than introducing a second miniapp data plane. TAP's package CSP permits only
+same-origin external scripts and forbids `<base>`, so converters must
+externalize executable inline scripts. The bridge resolves document resource
+URLs against the original entry before mounting and exposes the immutable
+`window.__TAP_VSCODE_WEBVIEW_ASSET_BASE_URL__` value for reviewed replacements
+of extension-specific asset-root placeholders.
+
+In Surface Test Lab runs, `sdk.http` uses the run's exact-origin policy and the
+same bounded native transport, while stored credentials remain unavailable.
+That origin list governs host-mediated SDK requests; it is not a browser-wide
+network sandbox for trusted Playwright test code.
+
 `sdk.printing` is an optional desktop-only receipt printer API. It discovers
 bounded machine-local printer metadata and host-supported 58 mm and 80 mm paper
 profiles, then accepts only bounded semantic version-1 receipt rows with

package/dist/index.d.ts

@@ -348,6 +348,7 @@ export declare type MiniAppPlatformApi = {
     };
     chat: MiniAppChatApi;
     storage: MiniAppStorageApi;
+    session: MiniAppSessionApi;
     presence: MiniAppPresenceApi;
     /** Desktop host capability; feature-detect before use on portable targets. */
     http?: MiniAppHttpApi;
@@ -507,6 +508,31 @@ export declare type MiniAppReceiptTextAlignment = 'left' | 'center' | 'right';
 
 export declare type MiniAppReceiptTextWeight = 'normal' | 'bold';
 
+/**
+ * Secure session storage backed by the operating system credential store.
+ *
+ * The host derives the signed-in TAP account, active workspace, installation,
+ * and package from the authenticated frame. Channel, surface, document, and
+ * release are deliberately excluded, so every surface of one installed
+ * miniapp shares the same session only within a workspace and package updates
+ * retain it. Unlike host-managed HTTP credentials, values returned here enter
+ * miniapp JavaScript.
+ */
+export declare type MiniAppSessionApi = {
+    get(): MiniAppMaybePromise<MiniAppSessionEntry>;
+    set(value: MiniAppSessionValue): MiniAppMaybePromise<void>;
+    clear(): MiniAppMaybePromise<void>;
+};
+
+export declare type MiniAppSessionEntry = {
+    /** Null means that no session value currently exists for this installation. */
+    value: MiniAppSessionValue | null;
+};
+
+export declare type MiniAppSessionValue = {
+    [key: string]: MiniAppJsonValue;
+};
+
 export declare type MiniAppSpecialistApi = {
     joinToChannel(channelId: string, specialistId: string): MiniAppMaybePromise<string>;
     listWorkspace(workspaceId: string): MiniAppMaybePromise<MiniAppSpecialistSummary[]>;

package/dist/rspack/index.d.ts

@@ -1,3 +1,4 @@
+import type { Format } from 'ajv';
 import type { LibConfig } from '@rslib/core';
 import { ModuleFederationOptions } from '@module-federation/rsbuild-plugin';
 import { RsbuildPlugin } from '@rsbuild/core';
@@ -29,8 +30,15 @@ declare type Config = {
 
 export declare const pluginTap: (options?: Config) => RsbuildPlugin;
 
+/** Registers the canonical JSON Schema formats used by TAP manifests. */
+export declare const registerTapManifestAjvFormats: <Registry extends TapManifestAjvFormatRegistry>(ajv: Registry) => Registry;
+
 export declare const tapLib: (options?: Config) => LibConfig;
 
+declare interface TapManifestAjvFormatRegistry {
+    addFormat(name: string, format: Format): unknown;
+}
+
 /** Emitted-package scan used to reject machine-local build artifacts. */
 export declare type TapPackageArtifactPortabilityOptions = {
     output: string;

package/dist/rspack/index.js

@@ -320,7 +320,7 @@ const TAP_FEDERATED_SURFACE_HTML = `<!doctype html>
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width,initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'none'">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; form-action 'none'">
     <title>TAP mini app</title>
     <style>html,body,#tap-root{height:100%;width:100%;margin:0}body{overflow:hidden;background:transparent}#tap-error{box-sizing:border-box;display:none;min-height:100%;padding:24px;font:14px/1.5 system-ui,sans-serif;color:#b42318;background:#fff}</style>
   </head>
@@ -452,6 +452,7 @@ const MAX_CHECKPOINT_JSON_BYTES = 32 * 1024;
 const MAX_STORAGE_NAMESPACE_CHARS = 128;
 const MAX_STORAGE_KEY_CHARS = 512;
 const MAX_STORAGE_JSON_BYTES = 5 * 1024 * 1024;
+const MAX_SESSION_JSON_BYTES = 1_800;
 const MAX_PRESENCE_ROOM_CHARS = 256;
 const MAX_PRESENCE_JSON_BYTES = 16 * 1024;
 const MAX_HTTP_REQUEST_JSON_BYTES = 11 * 1024 * 1024;
@@ -736,6 +737,26 @@ const storage = Object.freeze({
     return invokeSdkHostAction('tap.platform.storage.delete', options, 'app.storage.delete');
   },
 });
+const session = Object.freeze({
+  get() {
+    return invokeSdkHostAction('tap.platform.session.get', {}, 'app.session.get');
+  },
+  set(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      throw new Error('app.session.set requires a JSON object.');
+    }
+    checkedPlatformJson(value, MAX_SESSION_JSON_BYTES, 'app.session.set value');
+    return invokeSdkHostAction(
+      'tap.platform.session.set',
+      { value },
+      'app.session.set',
+      12000,
+    );
+  },
+  clear() {
+    return invokeSdkHostAction('tap.platform.session.clear', {}, 'app.session.clear');
+  },
+});
 const checkedPresenceAddress = (options, label) => {
   requireOptionsObject(options, label);
   if (!validPlatformPartition(options.namespace, MAX_STORAGE_NAMESPACE_CHARS)) {
@@ -1692,6 +1713,7 @@ const miniappSdk = Object.freeze({
   navigation,
   chat: miniappChat,
   storage,
+  session,
   presence,
   http,
   credentials,
@@ -1994,27 +2016,30 @@ const isUrl = (value)=>{
         return false;
     }
 };
+const registerTapManifestAjvFormats = (ajv)=>{
+    ajv.addFormat('uri', {
+        type: 'string',
+        validate: isUrl
+    });
+    ajv.addFormat('uint8', {
+        type: 'number',
+        validate: (value)=>Number.isInteger(value) && value >= 0 && value <= 255
+    });
+    ajv.addFormat('uint16', {
+        type: 'number',
+        validate: (value)=>Number.isInteger(value) && value >= 0 && value <= 65535
+    });
+    ajv.addFormat('uint64', {
+        type: 'number',
+        validate: (value)=>Number.isSafeInteger(value) && value >= 0
+    });
+    return ajv;
+};
 const getSchemaValidator = async ()=>{
     if (!schemaValidator) {
-        const ajv = new __rspack_external_ajv_dist_2020_js_e85899db["default"]({
+        const ajv = registerTapManifestAjvFormats(new __rspack_external_ajv_dist_2020_js_e85899db["default"]({
             allErrors: true
-        });
-        ajv.addFormat('uri', {
-            type: 'string',
-            validate: isUrl
-        });
-        ajv.addFormat('uint8', {
-            type: 'number',
-            validate: (value)=>Number.isInteger(value) && value >= 0 && value <= 255
-        });
-        ajv.addFormat('uint16', {
-            type: 'number',
-            validate: (value)=>Number.isInteger(value) && value >= 0 && value <= 65535
-        });
-        ajv.addFormat('uint64', {
-            type: 'number',
-            validate: (value)=>Number.isSafeInteger(value) && value >= 0
-        });
+        }));
         schemaValidator = ajv.compile(config_schema_namespaceObject);
     }
     return schemaValidator;
@@ -3512,4 +3537,4 @@ const tapLib = (options = {})=>{
         ]
     };
 };
-export { assembleTapPackage, assertPortableTapPackageArtifacts, pluginTap, tapLib };
+export { assembleTapPackage, assertPortableTapPackageArtifacts, pluginTap, registerTapManifestAjvFormats, tapLib };

package/dist/sdk.d.ts

@@ -319,6 +319,7 @@ export declare type MiniAppPlatformApi = {
     };
     chat: MiniAppChatApi;
     storage: MiniAppStorageApi;
+    session: MiniAppSessionApi;
     presence: MiniAppPresenceApi;
     /** Desktop host capability; feature-detect before use on portable targets. */
     http?: MiniAppHttpApi;
@@ -478,6 +479,31 @@ export declare type MiniAppReceiptTextAlignment = 'left' | 'center' | 'right';
 
 export declare type MiniAppReceiptTextWeight = 'normal' | 'bold';
 
+/**
+ * Secure session storage backed by the operating system credential store.
+ *
+ * The host derives the signed-in TAP account, active workspace, installation,
+ * and package from the authenticated frame. Channel, surface, document, and
+ * release are deliberately excluded, so every surface of one installed
+ * miniapp shares the same session only within a workspace and package updates
+ * retain it. Unlike host-managed HTTP credentials, values returned here enter
+ * miniapp JavaScript.
+ */
+export declare type MiniAppSessionApi = {
+    get(): MiniAppMaybePromise<MiniAppSessionEntry>;
+    set(value: MiniAppSessionValue): MiniAppMaybePromise<void>;
+    clear(): MiniAppMaybePromise<void>;
+};
+
+export declare type MiniAppSessionEntry = {
+    /** Null means that no session value currently exists for this installation. */
+    value: MiniAppSessionValue | null;
+};
+
+export declare type MiniAppSessionValue = {
+    [key: string]: MiniAppJsonValue;
+};
+
 export declare type MiniAppSpecialistApi = {
     joinToChannel(channelId: string, specialistId: string): MiniAppMaybePromise<string>;
     listWorkspace(workspaceId: string): MiniAppMaybePromise<MiniAppSpecialistSummary[]>;

package/dist/testing/rstest.d.ts

@@ -1,31 +1,33 @@
 import { afterAll } from '@rstest/playwright';
-import { afterEach } from '@rstest/playwright';
-import { APIRequestContext } from 'playwright';
 import { beforeAll } from '@rstest/playwright';
-import { beforeEach } from '@rstest/playwright';
 import type { Browser } from 'playwright';
 import type { BrowserContext } from 'playwright';
 import { describe } from '@rstest/playwright';
 import { expect } from '@rstest/playwright';
 import type { FrameLocator } from 'playwright';
 import type { Page } from 'playwright';
-import { PlaywrightOptions } from '@rstest/playwright';
-import { PlaywrightServe } from '@rstest/playwright';
-import { PlaywrightTest } from '@rstest/playwright';
+import type { PlaywrightFixtures } from '@rstest/playwright';
+import type { PlaywrightTest } from '@rstest/playwright';
+import type { TestContext } from '@rstest/core';
+import type { TestOptions } from '@rstest/core';
 import { z } from 'zod';
 
 export { afterAll }
 
-export { afterEach }
+export declare const afterEach: TapAfterEachHook;
 
 export { beforeAll }
 
-export { beforeEach }
+export declare const beforeEach: TapBeforeEachHook;
 
 export { describe }
 
 export { expect }
 
+declare type MergeContext<ExtraContext, FixturesContext> = {
+    [Key in keyof FixturesContext | keyof ExtraContext]: Key extends keyof FixturesContext ? FixturesContext[Key] : Key extends keyof ExtraContext ? ExtraContext[Key] : never;
+};
+
 /** Validate a driver session before any endpoint or provenance field is used. */
 export declare function parseTapMiniappTestSession(value: unknown): TapMiniappTestSession;
 
@@ -60,6 +62,16 @@ declare const sessionSchema: z.ZodObject<{
     testBundleDigest: z.ZodString;
 }, z.core.$strip>;
 
+declare type TapAfterEachCallback<ExtraContext> = (context: TapHookContext<ExtraContext>) => void | Promise<void>;
+
+declare type TapAfterEachHook<ExtraContext = TapRstestFixtures> = (callback: TapAfterEachCallback<ExtraContext>, timeout?: number) => void;
+
+declare type TapBeforeEachCallback<ExtraContext> = (context: TapHookContext<ExtraContext>) => void | TapAfterEachCallback<ExtraContext> | Promise<void | TapAfterEachCallback<ExtraContext>>;
+
+declare type TapBeforeEachHook<ExtraContext = TapRstestFixtures> = (callback: TapBeforeEachCallback<ExtraContext>, timeout?: number) => void;
+
+declare type TapHookContext<ExtraContext> = TestContext & ExtraContext;
+
 export declare type TapMiniappTestControl = {
     /** Restore the run's declared fixture and permission scenario. */
     reset: () => Promise<void>;
@@ -68,6 +80,7 @@ export declare type TapMiniappTestControl = {
 };
 
 export declare type TapMiniappTestFixture = Readonly<Pick<TapMiniappTestSession, 'channelId' | 'dataScope' | 'installationId' | 'localGeneration' | 'mode' | 'packageId' | 'permissionScenario' | 'releaseDigest' | 'runId' | 'sourceDigest' | 'surfaceId' | 'surfaceAssetOrigin' | 'testBundleDigest' | 'workspaceId'> & {
+    /** Origins authorized for host-mediated SDK HTTP, not browser-wide egress. */
     readonly allowedNetworkOrigins: readonly string[];
     readonly credentialAliases: readonly string[];
     control: TapMiniappTestControl;
@@ -85,47 +98,22 @@ export declare type TapRstestFixtures = {
     tap: TapMiniappTestFixture;
 };
 
+declare type TapRstestTest<ExtraContext = TapRstestFixtures> = Omit<PlaywrightTest<ExtraContext>, 'afterEach' | 'beforeEach' | 'extend'> & {
+    (description: string, callback?: (context: TapHookContext<ExtraContext>) => void | Promise<void>, timeout?: number): void;
+    (description: string, options: TestOptions, callback?: (context: TapHookContext<ExtraContext>) => void | Promise<void>): void;
+    afterEach: TapAfterEachHook<ExtraContext>;
+    beforeEach: TapBeforeEachHook<ExtraContext>;
+    extend: <FixturesContext extends Record<string, unknown> = Record<never, never>>(fixtures: PlaywrightFixtures<FixturesContext, ExtraContext>) => TapRstestTest<MergeContext<ExtraContext, FixturesContext>>;
+};
+
+/** Rstest's per-test context plus TAP's authorized browser and run fixtures. */
+export declare type TapTestContext = TestContext & TapRstestFixtures;
+
 /**
  * Rstest's Playwright test API with TAP-owned browser, page, iframe, and run
  * fixtures. The upstream runner still owns scheduling, assertions, hooks, and
  * reporting; TAP owns the privileged browser/session boundary.
  */
-export declare const test: PlaywrightTest<    {
-browser: Browser;
-context: BrowserContext;
-request: APIRequestContext;
-surface: FrameLocator;
-page: Page;
-tap: Readonly<Pick<{
-schemaVersion: 1;
-runId: string;
-workspaceId: string;
-channelId: string;
-packageId: string;
-installationId: string;
-mode: "surface" | "live-tap";
-dataScope: "fixture" | "selected-channel";
-permissionScenario: string;
-surfaceId: string;
-surfaceSelector: string;
-surfaceAssetOrigin: string;
-pageUrlPrefix: string;
-cdpEndpoint: string;
-cdpAuthorization: string;
-artifactDirectory: string;
-allowedNetworkOrigins: string[];
-credentialAliases: string[];
-sourceDigest: string;
-testBundleDigest: string;
-releaseDigest?: string | undefined;
-localGeneration?: number | undefined;
-}, "packageId" | "installationId" | "workspaceId" | "channelId" | "mode" | "runId" | "dataScope" | "permissionScenario" | "surfaceId" | "surfaceAssetOrigin" | "releaseDigest" | "localGeneration" | "sourceDigest" | "testBundleDigest"> & {
-readonly allowedNetworkOrigins: readonly string[];
-readonly credentialAliases: readonly string[];
-control: TapMiniappTestControl;
-}>;
-playwright: PlaywrightOptions;
-serve: PlaywrightServe;
-}>;
+export declare const test: TapRstestTest;
 
 export { }

package/dist/testing/rstest.js

@@ -114,6 +114,97 @@ function fixtureMetadata(session, page) {
 function safeArtifactSegment(value) {
     return value.replaceAll(/[^a-zA-Z0-9._-]/g, '-').slice(0, 160);
 }
+const HTTP_PROTOCOLS = new Set([
+    'http:',
+    'https:'
+]);
+const SAFE_INTERNAL_PROTOCOLS = new Set([
+    'about:',
+    'blob:',
+    'data:'
+]);
+function explicitHttpOrigin(value, label) {
+    const url = new URL(value);
+    if (!HTTP_PROTOCOLS.has(url.protocol)) throw new Error(`${label} must use HTTP or HTTPS.`);
+    return url.origin;
+}
+function allowedHttpOrigins(session) {
+    return new Set([
+        explicitHttpOrigin(session.pageUrlPrefix, 'TAP host page URL prefix'),
+        explicitHttpOrigin(session.surfaceAssetOrigin, 'Surface asset origin'),
+        ...session.allowedNetworkOrigins.map((value)=>explicitHttpOrigin(value, 'Allowed network origin'))
+    ]);
+}
+function classifyRequestUrl(value, allowedOrigins) {
+    let url;
+    try {
+        url = new URL(value);
+    } catch  {
+        return {
+            action: 'abort',
+            reason: 'malformed-url'
+        };
+    }
+    if (SAFE_INTERNAL_PROTOCOLS.has(url.protocol)) return {
+        action: 'continue',
+        reason: 'safe-internal'
+    };
+    if ('file:' === url.protocol) return {
+        action: 'abort',
+        reason: 'file-scheme',
+        target: 'file:'
+    };
+    if (!HTTP_PROTOCOLS.has(url.protocol)) return {
+        action: 'abort',
+        reason: 'unsupported-scheme',
+        target: url.protocol.slice(0, 32)
+    };
+    if (!allowedOrigins.has(url.origin)) return {
+        action: 'abort',
+        reason: 'origin-not-allowed',
+        target: url.origin.slice(0, 256)
+    };
+    return {
+        action: 'continue',
+        reason: 'explicit-http-origin'
+    };
+}
+function classifyWebSocketUrl(value, allowedOrigins) {
+    let url;
+    try {
+        url = new URL(value);
+    } catch  {
+        return {
+            action: 'abort',
+            reason: 'malformed-url'
+        };
+    }
+    if ('ws:' !== url.protocol && 'wss:' !== url.protocol) return {
+        action: 'abort',
+        reason: 'file:' === url.protocol ? 'file-scheme' : 'unsupported-scheme',
+        target: url.protocol.slice(0, 32)
+    };
+    const diagnosticOrigin = url.origin.slice(0, 256);
+    url.protocol = 'ws:' === url.protocol ? 'http:' : 'https:';
+    if (!allowedOrigins.has(url.origin)) return {
+        action: 'abort',
+        reason: 'origin-not-allowed',
+        target: diagnosticOrigin
+    };
+    return {
+        action: 'continue',
+        reason: 'explicit-http-origin'
+    };
+}
+function reportUnexpectedWebSocket(webSocket, allowedOrigins) {
+    const decision = classifyWebSocketUrl(webSocket.url(), allowedOrigins);
+    if ('continue' === decision.action) return;
+    const target = decision.target ? ` (${decision.target})` : '';
+    process.emitWarning(`TAP Test Lab observed a WebSocket outside the run's SDK HTTP origin set: ${decision.reason}${target}. This check is diagnostic only; TAP does not yet provide native browser-wide egress enforcement.`, {
+        code: 'TAP_MINIAPP_TEST_NETWORK_DIAGNOSTIC',
+        type: 'Warning'
+    });
+}
 const test = __rspack_external__rstest_playwright_5734ff29.test.extend({
     browser: async (_context, use)=>{
         const session = await loadSession();
@@ -132,70 +223,80 @@ const test = __rspack_external__rstest_playwright_5734ff29.test.extend({
         const context = contexts[0];
         if (!context) throw new Error('TAP Browser Driver context selection failed');
         const hostPage = selectPage(context, session);
-        const runtimeOrigins = new Set(hostPage.frames().map((frame)=>originOf(frame.url())).filter((origin)=>void 0 !== origin));
-        const allowedOrigins = new Set([
-            ...runtimeOrigins,
-            new URL(session.surfaceAssetOrigin).origin,
-            ...session.allowedNetworkOrigins.map((value)=>new URL(value).origin)
-        ]);
-        const enforceNetworkPolicy = async (route)=>{
-            const url = route.request().url();
-            const origin = originOf(url);
-            if (void 0 === origin || allowedOrigins.has(origin)) return void await route.continue();
+        const allowedOrigins = allowedHttpOrigins(session);
+        const enforceDiagnosticNetworkPolicy = async (route)=>{
+            const decision = classifyRequestUrl(route.request().url(), allowedOrigins);
+            if ('continue' === decision.action) return void await route.continue();
             await route.abort('blockedbyclient');
         };
-        await context.route('**/*', enforceNetworkPolicy);
-        const traceDirectory = (0, __rspack_external_node_path_806ed179.join)(session.artifactDirectory, 'traces', safeArtifactSegment(task.id));
-        await (0, __rspack_external_node_fs_promises_3b710708.mkdir)(traceDirectory, {
-            recursive: true
-        });
-        await context.tracing.start({
-            screenshots: true,
-            snapshots: true,
-            sources: true
-        });
+        const diagnoseWebSocket = (webSocket)=>reportUnexpectedWebSocket(webSocket, allowedOrigins);
+        await context.route('**/*', enforceDiagnosticNetworkPolicy);
+        hostPage.on('websocket', diagnoseWebSocket);
         try {
-            await use(context);
-        } finally{
-            await context.tracing.stop({
-                path: (0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'trace.zip')
+            const traceDirectory = (0, __rspack_external_node_path_806ed179.join)(session.artifactDirectory, 'traces', safeArtifactSegment(task.id));
+            await (0, __rspack_external_node_fs_promises_3b710708.mkdir)(traceDirectory, {
+                recursive: true
             });
-            const traceSummary = {
-                schemaVersion: 1,
-                runId: session.runId,
-                taskId: task.id,
-                mode: session.mode,
-                dataScope: session.dataScope,
-                packageId: session.packageId,
-                surfaceId: session.surfaceId,
-                sourceDigest: session.sourceDigest,
-                testBundleDigest: session.testBundleDigest,
-                tracePath: 'trace.zip',
-                redactions: [
-                    'authorization headers',
-                    'cookies',
-                    'credential values',
-                    'network bodies'
-                ]
-            };
-            await Promise.all([
-                (0, __rspack_external_node_fs_promises_3b710708.writeFile)((0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'trace-summary.json'), `${JSON.stringify(traceSummary, void 0, 2)}\n`, 'utf8'),
-                (0, __rspack_external_node_fs_promises_3b710708.writeFile)((0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'debug.md'), [
-                    '# Miniapp test trace',
-                    '',
-                    `- Run: \`${session.runId}\``,
-                    `- Rstest task: \`${task.id}\``,
-                    `- Mode: \`${session.mode}\``,
-                    `- Data scope: \`${session.dataScope}\``,
-                    `- Surface: \`${session.surfaceId}\``,
-                    `- Source digest: \`${session.sourceDigest}\``,
-                    `- Test bundle digest: \`${session.testBundleDigest}\``,
-                    '',
-                    'Open `trace.zip` from The AI Platform Test Lab for the DOM, screenshots, console, and network timeline. The final assertion outcome is authoritative in `report.json` and `report.md`.',
-                    ''
-                ].join('\n'), 'utf8')
-            ]);
-            await context.unroute('**/*', enforceNetworkPolicy);
+            await context.tracing.start({
+                screenshots: true,
+                snapshots: true,
+                sources: true
+            });
+            try {
+                await use(context);
+            } finally{
+                await context.tracing.stop({
+                    path: (0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'trace.zip')
+                });
+                const traceSummary = {
+                    schemaVersion: 2,
+                    runId: session.runId,
+                    taskId: task.id,
+                    mode: session.mode,
+                    dataScope: session.dataScope,
+                    packageId: session.packageId,
+                    surfaceId: session.surfaceId,
+                    sourceDigest: session.sourceDigest,
+                    testBundleDigest: session.testBundleDigest,
+                    networkPolicyRole: 'diagnostic-only',
+                    tracePath: 'trace.zip',
+                    traceRedacted: false,
+                    traceSensitivity: 'raw-sensitive',
+                    traceAccessScope: 'channel-only',
+                    traceMayContain: [
+                        'authorization headers',
+                        'cookies',
+                        'credential values',
+                        'network request and response bodies',
+                        'DOM snapshots',
+                        'screenshots',
+                        'test sources'
+                    ]
+                };
+                await Promise.all([
+                    (0, __rspack_external_node_fs_promises_3b710708.writeFile)((0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'trace-summary.json'), `${JSON.stringify(traceSummary, void 0, 2)}\n`, 'utf8'),
+                    (0, __rspack_external_node_fs_promises_3b710708.writeFile)((0, __rspack_external_node_path_806ed179.join)(traceDirectory, 'debug.md'), [
+                        '# Miniapp test trace',
+                        '',
+                        `- Run: \`${session.runId}\``,
+                        `- Rstest task: \`${task.id}\``,
+                        `- Mode: \`${session.mode}\``,
+                        `- Data scope: \`${session.dataScope}\``,
+                        `- Surface: \`${session.surfaceId}\``,
+                        `- Source digest: \`${session.sourceDigest}\``,
+                        `- Test bundle digest: \`${session.testBundleDigest}\``,
+                        '- Browser network routing: diagnostic-only; not native egress enforcement',
+                        '',
+                        '`trace.zip` is raw, sensitive, channel-only evidence. It is not redacted and may contain authorization headers, cookies, credential values, network bodies, DOM snapshots, screenshots, and test source.',
+                        '',
+                        'Open the trace from The AI Platform Test Lab for debugging. Do not publish it or attach it to specialist context. The final assertion outcome is authoritative in `report.json` and `report.md`.',
+                        ''
+                    ].join('\n'), 'utf8')
+                ]);
+            }
+        } finally{
+            hostPage.removeListener('websocket', diagnoseWebSocket);
+            await context.unroute('**/*', enforceDiagnosticNetworkPolicy);
         }
     },
     page: async ({ context }, use)=>{
@@ -214,28 +315,10 @@ const test = __rspack_external__rstest_playwright_5734ff29.test.extend({
         await use(fixtureMetadata(await loadSession(), page));
     }
 });
-function originOf(value) {
-    try {
-        const url = new URL(value);
-        if (matchesNonNetworkScheme(url.protocol)) return;
-        return url.origin;
-    } catch  {
-        return;
-    }
-}
-function matchesNonNetworkScheme(protocol) {
-    return NON_NETWORK_PROTOCOLS.has(protocol);
-}
-const NON_NETWORK_PROTOCOLS = new Set([
-    'about:',
-    'blob:',
-    'data:',
-    'file:'
-]);
+const afterEach = __rspack_external__rstest_playwright_5734ff29.afterEach;
+const beforeEach = __rspack_external__rstest_playwright_5734ff29.beforeEach;
 var afterAll = __rspack_external__rstest_playwright_5734ff29.afterAll;
-var afterEach = __rspack_external__rstest_playwright_5734ff29.afterEach;
 var beforeAll = __rspack_external__rstest_playwright_5734ff29.beforeAll;
-var beforeEach = __rspack_external__rstest_playwright_5734ff29.beforeEach;
 var describe = __rspack_external__rstest_playwright_5734ff29.describe;
 var expect = __rspack_external__rstest_playwright_5734ff29.expect;
 export { afterAll, afterEach, beforeAll, beforeEach, describe, expect, parseTapMiniappTestSession, test };