@wenathlan/saddle 1.8.1 → 1.8.4

package/LICENSE

@@ -198,6 +198,6 @@
 
     You should have received a copy of the Proprietary Source-Available
     License along with this program. If not, see
-    <https://github.com/iakadion/saddle/LICENSE>
+    <https://github.com/wenathlan/saddle/LICENSE>
 
   Also add information on how to contact you by electronic and paper mail.

package/README.md

@@ -7,16 +7,16 @@
 <p align="center">
   <strong>Storage-backed jobs, scraping contracts and portable runners for Node.js.</strong><br/>
   <strong>Binary computing agent, agent browser, computer-use, scraper and packager.</strong><br/>
-  <a href="https://github.com/iakadion/saddle/actions/workflows/ci.yml"><img src="https://github.com/iakadion/saddle/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
-  <a href="https://github.com/iakadion/saddle/releases/tag/v1.8.0"><img src="https://img.shields.io/badge/release-v1.8.0-d35d3d" alt="Release 1.8.0" /></a>
-  <a href="https://github.com/iakadion/saddle/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-GPL--3.0-202a2f" alt="GPL 3.0 license" /></a>
+  <a href="https://github.com/wenathlan/saddle/actions/workflows/ci.yml"><img src="https://github.com/wenathlan/saddle/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="https://github.com/wenathlan/saddle/releases/tag/v1.8.4"><img src="https://img.shields.io/badge/release-v1.8.4-d35d3d" alt="Release 1.8.4" /></a>
+  <a href="https://github.com/wenathlan/saddle/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-GPL--3.0-202a2f" alt="GPL 3.0 license" /></a>
 </p>
 
 > **Core idea:** storage is the durable side of the working set; the runner is replaceable; the artifact is the boundary. **Storage == Compute** — RAM and disk are the same construct, differing only by usage flag.
 
 Saddle is a **JavaScript ESM engine** for jobs that move data between storage, a working set, an injected runner and durable artifacts. It is also a **virtual machine you publish as a package** that runs on other people's computers (GitHub Actions, Forgejo, Gitea, GitLab, Codeberg, free Docker containers) and turns unlimited third-party storage buckets into virtual RAM/GPU/CPU. Nothing runs on the operator's local machine.
 
-Ships as a library, CLI, binary, n8n node, CRX extension, Android/iOS and Tauri desktop app. Package `@wenathlan/saddle` — published to npm, GitHub Packages, Maven, NuGet, RubyGems and GHCR (auto-mirrored to jsDelivr).
+Ships as a library, CLI, binary, n8n node, CRX extension, Android/iOS and Tauri desktop app. The canonical JavaScript package is `@wenathlan/saddle`; GitHub Packages npm, Maven and GHCR use the transferred `wenathlan` owner namespace, while NuGet and RubyGems retain their unscoped ecosystem package names.
 
 ## Start here
 
@@ -109,14 +109,17 @@ The caller still chooses how to provide `fetcher`, browser transport, persistenc
 
 ## Browser extension
 
-Version 1.1 includes a pure JavaScript Manifest V3 reference surface in [`extension/`](extension/). It is deliberately narrow: the user invokes the action, the popup sends a versioned command, the service worker routes it, and an isolated content bridge returns bounded page metadata, visible text or a user initiated action result.
+Version 1.8.4 includes a pure JavaScript Manifest V3 reference surface in [`extension/`](extension/). It is deliberately narrow: the user invokes the action, the popup sends a versioned command, the service worker routes it, and an isolated content bridge returns bounded page metadata, visible text or a user initiated action result. The exported `permissionpolicy` keeps base permissions minimal and makes optional escalation caller-owned.
 
 ```bash
 # load the unpacked extension from chrome://extensions
 ls extension/manifest.json extension/worker.js extension/content.js extension/popup.html
+
+# build an isolated unpacked artifact using the package version
+npm run extension:build -- --output build/extension
 ```
 
-The extension requests `activeTab`, `scripting` and `storage`; it does not request broad host permissions, cookies, `webRequest`, debugger access or arbitrary page code execution. Its public contracts are available from `@wenathlan/saddle/extension`. See [`extension/README.md`](extension/README.md) for the unpacked development flow.
+The extension requests `activeTab`, `scripting` and `storage`; it does not request broad host permissions, cookies, `webRequest`, debugger access or arbitrary page code execution. Its public contracts are available from `@wenathlan/saddle/extension`. Published releases attach `saddle-extension-<version>.zip`; the source manifest remains a stable unpacked reference. See [`extension/README.md`](extension/README.md) for the unpacked and release artifact flows.
 
 ## CLI
 
@@ -142,12 +145,12 @@ saddle mcp
 
 | Registry | Artifact | Workflow | Status |
 | --- | --- | --- | --- |
-| GitHub npm | `@iakadion/saddle@1.8.0` | publishgithubnpm.yml | published |
-| GHCR | `ghcr.io/iakadion/saddle:1.8.0` and `latest` | publishghcr.yml | published |
-| Maven | `io.devthink:saddle:1.8.0` | publishmaven.yml | published after JDK 26 retry |
-| NuGet | `Saddle.1.8.0.nupkg` | publishnuget.yml | published |
-| RubyGems | `saddle 1.8.0` | publishrubygems.yml | published |
-| npmjs | `@wenathlan/saddle@1.8.1` | publishnpmjs.yml | pending follow-up release workflow |
+| GitHub npm | `@wenathlan/saddle@1.8.4` | publishgithubnpm.yml | pending release |
+| GHCR | `ghcr.io/wenathlan/saddle:1.8.4` and `latest` | publishghcr.yml | pending release |
+| Maven | `io.wenathlan:saddle:1.8.4` | publishmaven.yml | pending release |
+| NuGet | `Saddle.1.8.4.nupkg` | publishnuget.yml | pending release |
+| RubyGems | `saddle 1.8.4` | publishrubygems.yml | pending release |
+| npmjs | `@wenathlan/saddle@1.8.4` | publishnpmjs.yml | pending release |
 
 ## Development
 
@@ -185,7 +188,7 @@ Root-based JavaScript ESM layout, no src/ directory, no TypeScript build require
 
 ## Current scope
 
-Version 1.8 establishes the engine contracts, browser snapshot foundation, storage sync primitives, runner recovery contracts, scraping context provenance, API/MCP security contracts, bot integration lifecycle, the first tested extension bridge, desktop/mobile/n8n surface contracts, a framework-neutral operator control boundary and the first cross-runtime import boundary. Native runtimes, n8n host registration, provider credentials, persistent databases and production deployment remain caller-selected adapters. The next improvements should extend these contracts without coupling the core to one forge, registry, browser or storage vendor.
+Version 1.8.4 establishes the engine contracts, browser snapshot foundation, storage sync primitives, runner recovery contracts, scraping context provenance and normalization, API/MCP security contracts, bot integration lifecycle, the tested extension bridge and permission policy, deterministic extension packaging, context-aware replay, Node.js 26.7.0 cross-forge gates, desktop/mobile/n8n surface contracts, a framework-neutral operator control boundary and the first cross-runtime import boundary. Native runtimes, n8n host registration, provider credentials, persistent databases and production deployment remain caller-selected adapters. The next improvements should extend these contracts without coupling the core to one forge, registry, browser or storage vendor.
 
 ## License
 

package/browser/recorder.js

@@ -7,9 +7,15 @@ export function actionrecorder(options = {}) {
   const startedat = Number(options.startedat ?? Date.now());
   const events = [];
   let lastsnapshotid;
-  function snapshot(snapshot) { lastsnapshotid = snapshot?.snapshotid; events.push({ type: "snapshot", t: Date.now() - startedat, snapshotid: lastsnapshotid, tabid: snapshot?.tabid, frameid: snapshot?.frameid }); return snapshot; }
-  function action(input = {}) { const event = { type: "action", t: Date.now() - startedat, action: String(input.action), snapshotid: input.snapshotid ?? lastsnapshotid, tabid: input.tabid, frameid: input.frameid, payload: input.payload ?? {} }; events.push(event); return { ...event }; }
+  function snapshot(snapshot) { lastsnapshotid = snapshot?.snapshotid; const context = recordercontext(snapshot); events.push({ type: "snapshot", t: Date.now() - startedat, snapshotid: lastsnapshotid, tabid: snapshot?.tabid, frameid: snapshot?.frameid, context }); return snapshot; }
+  function action(input = {}) { const context = recordercontext(input.context ?? input); const event = { type: "action", t: Date.now() - startedat, action: String(input.action), snapshotid: input.snapshotid ?? lastsnapshotid, tabid: input.tabid, frameid: input.frameid, windowid: input.windowid, context, payload: input.payload ?? {} }; events.push(event); return { ...event }; }
   function list() { return events.map((event) => ({ ...event, payload: { ...event.payload } })); }
   function manifest() { return { version: 1, startedat, eventcount: events.length, lastsnapshotid, events: list() }; }
   return { snapshot, action, list, manifest };
 }
+
+function recordercontext(value = {}) {
+  const context = {};
+  for (const name of ["windowid", "tabid", "frameid"]) if (value[name] !== undefined) context[name] = String(value[name]);
+  return Object.keys(context).length ? context : undefined;
+}

package/docs/ecosystemplan.md

@@ -25,16 +25,16 @@ The engine owns **contracts, validation, orchestration, recovery and auditabilit
 | Block | Scope | Current state | Exit evidence |
 | --- | --- | --- | --- |
 | 1 | audit and governance | active | gap matrix, sources, claims reconciled |
-| 2 | browser agent foundation | complete | snapshots, refs, stale errors, tabs, frames, action results and replay provenance tests |
+| 2 | browser agent foundation | complete | snapshots, refs, stale errors, tabs, frames, action results and context-aware replay provenance tests |
 | 3 | extension runtime | first slice complete | MV3 unpacked surface, protocol, worker, content bridge and tests |
 | 4 | working set and storage | complete | range chunks, content dedupe, tiered cache, conflict sync and memory capabilities |
 | 5 | runners and execution | complete | provider health, triggers, cancellation, heartbeat and resumable runs |
-| 6 | scraping and context | complete | semantic extraction, crawl budgets, RAG lineage and low-cardinality metrics |
+| 6 | scraping and context | complete | semantic extraction, content-type normalization, crawl budgets, RAG lineage and low-cardinality metrics |
 | 7 | API, MCP and security | complete | request identity, optional auth, secure headers, browser MCP tools and redirect/DNS checks |
 | 8 | bots and integrations | complete | app lifecycle, command scopes, idempotency, delivery retries and dead letters |
-| 9 | packaging and distribution | partial; registry slice verified for 1.7.0 | reproducible extension, desktop, mobile, n8n and binary artifacts |
+| 9 | packaging and distribution | extension zip and registry slice prepared for 1.8.2 | desktop, mobile, n8n and binary artifacts remain caller-owned |
 | 10 | product surfaces and operations | first slice complete | desktop, mobile, n8n and operator control contracts; observability, retention and threat model remain |
-| 11 | cross-runtime compatibility | first slice complete | Node, Bun and Deno root probe; browser worker, extension and package tree-shaking checks remain |
+| 11 | cross-runtime compatibility | transport-neutral graph audit complete | Node, Bun and Deno root probe, browser worker bridge, extension permission/build checks and package graph audit |
 | 12 | release gates | active | deterministic checks, docs, clean diffs and claim/code parity |
 
 ## execution method
@@ -52,7 +52,7 @@ Each block follows the same loop:
 
 ## current implementation
 
-Version 1.7 contains the first bot and integration lifecycle slice after browser, storage, runners, scraping and API hardening. It adds app installation and scope state, command authorization, idempotent bot execution, retryable webhook delivery and dead-letter records. The registry publication slice for 1.7.0 is verified for GitHub npm, GHCR, Maven, NuGet and RubyGems; public npmjs remains blocked because the owner account or scope still rejects the configured publication with HTTP 404. The first product surface slice adds desktop, mobile, n8n, operator control, operational policy and framework-neutral HTTP contracts. The first cross-runtime slice now validates the root on Node, Bun and Deno, while browser worker and extension import checks remain.
+Version 1.8.2 carries the public npm identity migration through the transferred `wenathlan` repository owner, aligns GitHub Packages npm, Maven and GHCR owner metadata, and includes the minimal extension permission policy, deterministic extension zip workflow, context-aware replay, transport-neutral graph audit and bounded content normalization. Registry publication is triggered only after the release tag and independent target checks. The first product surface slice adds desktop, mobile, n8n, operator control, operational policy and framework-neutral HTTP contracts. The first cross-runtime slice validates the root on Node, Bun and Deno, while extension-context and browser bundler checks remain caller-owned.
 
 ## evidence sources
 

package/docs/gapmatrix.md

@@ -18,20 +18,20 @@ This matrix turns the supplied README and conclusions into implementation decisi
 | Root library | Implemented ESM entry point with broad exports | No extension subpath or extension files are shipped | P0 | Add a small `extension/` package surface and export only serializable contracts |
 | Browser agent | Implemented injected action adapter for navigate, click, type, screenshot, DOM, title, scroll and command batches | Vendor-neutral action results and bounded action batches are now public | P1 | Keep the adapter boundary; add vendor adapters without moving browser ownership into the core |
 | Browser snapshots | Implemented public contract | Snapshot ids, bounded elements, stable refs, stale checks and diffs are covered by deterministic tests | P0 | Reuse the contract from MCP and extension transport |
-| Session replay | Partial | Replay and action recording exist with snapshot provenance, but tab/window restoration and frame-aware replay are still absent | P1 | Add context-aware replay after adapter conformance tests |
+| Session replay | Implemented | Replay restores caller-owned window, tab and frame context before actions; context identifiers are validated and counted | P1 | Keep browser selection and restoration in injected adapters |
 | Extension runtime | Surface is only declared in `surfaces/manifest.js` and `surfaces/targets.js` | No Manifest V3 manifest, service worker, content bridge, popup or build artifact | P0 | Implement a pure JavaScript MV3 reference surface with minimal permissions |
 | Extension messaging | Not implemented | No versioned envelope, correlation id, timeout, sender metadata or error response contract | P0 | Add transport-neutral message contracts and Chrome runtime adapter |
-| Service worker resilience | Not implemented | No rehydration or durable state strategy for worker termination | P0 | Persist pending command metadata and session summaries through injected storage |
-| Permissions | Not implemented | No permission policy or optional escalation path | P0 | Start with `storage` and no broad host permissions; make host access caller-configured |
+| Service worker resilience | Implemented contract slice | Pending command envelopes, attempt metadata and snapshot summaries persist through injected storage; resume remains explicit and user-owned | P0 | Rehydrate metadata on startup and never replay a command without an explicit caller action |
+| Permissions | Contract slice | `permissionpolicy` keeps the base permissions minimal and optional escalation caller-owned | P0 | Start with `storage` and no broad host permissions; make host access caller-configured |
 | Content isolation | Not implemented | No isolated-world DOM bridge or page-to-extension boundary | P0 | Add a narrow content script that reports page facts through the message contract |
 | Task agent | Partial | Jobs, workflows and bot commands exist, but no browser task planner or tool registry | P1 | Reuse workflow, trigger and bot contracts; add browser task commands only after snapshots |
 | MCP | Implemented scrape, crawl, batch, extract and serialize tools with JSON-RPC handling | No browser snapshot or browser action MCP tools | P1 | Add browser tools as an optional adapter over the same snapshot/action contracts |
 | API security | Implemented URL protocol and private hostname/IP checks | Request envelopes, optional authorization, security headers, redirect bounds and injected DNS resolution checks are now available | P0 | Keep credentials caller-owned and reject private or rebinding targets before transport |
 | Apps and bots | Implemented platform adapter, commands, bot and webhook signature contracts | App install/suspend/revoke, command scope checks, idempotency and delivery retry/dead-letter records are now available | P1 | Keep platform tokens and OAuth lifecycle caller-owned |
 | Storage | Implemented local, chunked, S3-compatible, GitHub Contents and file hosting adapters | Range reads, content dedupe, tiered cache, capabilities and conflict-aware sync were missing | P1 | Use the new neutral storage helpers and keep extension storage injected |
-| Queue | Implemented in-memory and persistent queue contracts | No worker-aware resume protocol for extension commands | P1 | Add resumable command records and idempotency keys to extension transport |
+| Queue | Implemented in-memory, persistent and extension-resumable command contracts | Browser host still owns long-lived queue workers and cancellation policy | P1 | Keep command records serializable and resume explicit through the extension adapter |
 | Remote execution | Implemented provider, scheduler, health, triggers, heartbeat and resumable run contracts | No permissioned extension-to-runner bridge or forge-specific status adapters for every provider | P1 | Require explicit caller-provided endpoint and auth; no default remote host |
-| Scraping | Implemented robots, cache, HTML extraction, schema extraction and scraper | Semantic headings, landmarks, controls and links are now available; content-type normalization remains partial | P1 | Keep extraction safe and bounded; add adapters for richer document types |
+| Scraping | Implemented robots, cache, HTML extraction, schema extraction, scraper and content normalization | Rich document parsers and binary format adapters remain caller-owned | P1 | Keep extraction safe and bounded; add adapters for richer document types |
 | Crawl | Implemented normalized BFS and persistent frontier | Priority and per-domain budget frontier now exist; sitemap refresh remains absent | P1 | Keep frontier state serializable and caller-persistable |
 | RAG context | Implemented chunk hashes and vector record metadata | Retrieval provenance and merge records now exist; embeddings and indexes remain injected | P1 | Preserve source, document, chunk and score lineage |
 | Observability | Contract slice | Low-cardinality counters and durations are bound to the standard operational metric vocabulary; export and tracing remain caller-owned | P1 | Keep metrics vendor-neutral and bounded |
@@ -40,10 +40,10 @@ This matrix turns the supplied README and conclusions into implementation decisi
 | Auth profiles | Session file and replay contracts exist | No extension profile or consent model | P1 | Defer cookie/profile export; support explicit user-owned session references only |
 | CAPTCHA | Contract, guard and evidence exist | No automatic solver integration | deferred | Keep external/manual solver boundary; do not promise bypass in the extension |
 | Stealth | Fingerprint contract exists | No automatic stealth patching | deferred | Keep opt-in fingerprint metadata; no hidden anti-detection behavior |
-| Packaging | npm, GHCR, Maven, NuGet and RubyGems workflows are live | No extension zip build or release artifact | P1 | Add a deterministic zip/check workflow after the reference surface is tested |
+| Packaging | npm, GHCR, Maven, NuGet, RubyGems and extension zip workflows are live | Desktop, mobile, n8n and binary release artifacts remain caller-owned | P1 | Keep non-JavaScript artifacts in explicit adapters and release jobs |
 | Mobile and desktop apps | Contract slice | Desktop/mobile manifests and caller-owned adapter contracts exist; no native project is bundled | P1 | Keep native projects caller-owned and add runtime conformance tests incrementally |
 | n8n surface | Contract slice | Node metadata, trigger matching and declared action execution exist; no n8n host package is bundled | P1 | Keep node registration and credentials caller-owned |
-| Cross-browser | Target profile declares browser and extension | No Firefox, Edge or Safari manifests/build validation | P2 | Keep WebExtension-compatible contracts and add adapters incrementally |
+| Cross-browser | Target profile declares browser and extension | Firefox, Edge or Safari manifests remain unbundled; transport-neutral export graph is statically audited for Node-only imports | P2 | Keep WebExtension-compatible contracts and add browser adapters incrementally |
 | Storage equals compute | Memory bridge and engine implement storage-to-working-set-to-artifact; sync and capability negotiation now exist | Remote storage is not physical VRAM and has latency | deferred | Document as a working-set model, never as literal remote VRAM |
 | Site/database deployment | Persistence schemas and adapters exist | No hosted site or database is part of the package | deferred | Keep deploy targets caller-owned and outside the library core |
 

package/docs/libraryapi.md

@@ -6,6 +6,7 @@ The public API is designed around injected transports. Consumers can use the sam
 |---|---|
 | `saddleurl` | choose fetch or an injected browser agent |
 | `scrapeurl` | fetch a URL and return extracted content |
+| `detectcontenttype` / `normalizeresult` / `normalizeresponse` | classify and bound JSON, XML, Markdown, text, HTML and binary response content |
 | `scrapehtml` | extract content from an HTML string |
 | `extractcontent` | expose structured extraction directly |
 | `serializeresult` | serialize as JSON, Markdown, text, XML, or Redis payload |
@@ -40,7 +41,7 @@ The public API is designed around injected transports. Consumers can use the sam
 | `nodeserver` | expose a Web Request/Response handler through Node HTTP |
 
 ```js
-import { scrapeurl, formatforagent } from "@devthink/saddle";
+import { scrapeurl, formatforagent } from "@wenathlan/saddle";
 
 const result = await scrapeurl("https://example.com", {
   format: "markdown",

package/docs/modes.md

@@ -13,7 +13,7 @@ The mode resolver keeps execution open. It returns a profile and capability map
 | pair | without, with |
 
 ```js
-import { resolvemode } from "@devthink/saddle/modes";
+import { resolvemode } from "@wenathlan/saddle/modes";
 
 const profile = resolvemode({
   execution: "binary",

package/docs/platformpipelineaudit.md

@@ -0,0 +1,18 @@
+# Platform pipeline audit
+
+This document records the platform facts used by the 1.8.4 pipeline work. The workflows remain caller-configured: repository owners provide runner availability, deployment secrets and target repository names.
+
+## verified platform facts
+
+| Platform | Verified contract | Source |
+| --- | --- | --- |
+| GitHub Pages | A custom workflow uses `actions/configure-pages@v5`, uploads a static artifact with `actions/upload-pages-artifact@v4`, then deploys with `actions/deploy-pages@v4`. The deployment job needs `pages: write` and `id-token: write`, depends on the build job and uses the `github-pages` environment. | [GitHub Pages custom workflows](https://docs.github.com/en/pages/getting-started-with-github-pages/using-custom-workflows-with-github-pages) |
+| Codeberg Pages | Forgejo Actions can deploy with `https://codeberg.org/git-pages/action@v2`, using `site`, `source` and the injected `${{ forge.token }}`. Publishing the repository subdomain should be restricted to the default branch. Codeberg is migrating its legacy Pages v2 flow; custom domains still have separate constraints. | [Codeberg Pages via Forgejo Actions](https://docs.codeberg.org/codeberg-pages/forgejo-actions/), [Codeberg Pages output](https://docs.codeberg.org/codeberg-pages/pushing-output/) |
+| GitLab Pages | A job with `pages: true` publishes the default `public` directory; the job can also use a `pages` hash for a `path_prefix`. Static HTML, CSS and JavaScript are supported through GitLab CI/CD. | [GitLab Pages](https://docs.gitlab.com/user/project/pages/) |
+| Woodpecker CI | A workflow is a serial list of container steps with `image` and `commands`; branch/event filters belong in `when`, and secrets are injected through the pipeline environment rather than committed YAML. | [Woodpecker workflow syntax](https://woodpecker-ci.org/docs/usage/workflow-syntax) |
+| Forgejo Actions | Fully qualified actions are recommended; the official checkout reference is `https://data.forgejo.org/actions/checkout@v6`. Short `actions/checkout@v6` resolves through the instance `DEFAULT_ACTIONS_URL`, which can vary. | [Forgejo Actions: Using Actions](https://forgejo.org/docs/v15.0/user/actions/actions/) |
+| Gitea Actions | Gitea Actions is mostly compatible with GitHub Actions and requires a separately installed Gitea Runner. The official documentation lists `actions/checkout@v4` as a supported action reference and warns that runner trust matters for public instances. | [Gitea Actions overview](https://docs.gitea.com/usage/actions/overview) |
+
+## boundary
+
+GitHub Pages has a first-party artifact/deploy contract. Codeberg Pages has a git-pages Forgejo Action contract. Forgejo, Gitea and GitLab workflow files can build the same static output, but their hosting destination and token names are instance-specific. Woodpecker can build and publish artifacts, but a Pages deploy step requires the target host's configured service or a caller-owned token. No workflow in this release hardcodes credentials, hostnames or a private deployment target.

package/docs/platformpipelines.md

@@ -0,0 +1,13 @@
+# Cross-forge pipelines
+
+The library keeps GitHub Actions as the release-authoritative workflow because its six registry publishers already share the release-tag action and validation action. Forgejo, Gitea, GitLab and Woodpecker now execute the same deterministic gates with Node.js 26.7.0, but they do not assume a shared package registry, release API or secret name.
+
+| Forge | File | Current role | Required caller configuration |
+| --- | --- | --- | --- |
+| GitLab | `.gitlab-ci.yml` | verify and package dry-run | runner, optional package registry credentials and artifact retention |
+| Forgejo | `.forgejo/workflows/saddle.yml` | verify and package dry-run | trusted Forgejo runner and action source policy |
+| Gitea | `.gitea/workflows/saddle.yml` | verify and package dry-run | Gitea Runner and instance action policy |
+| Codeberg | Forgejo workflow files | verify plus optional Codeberg Pages action | Codeberg repository, `forge.token` and default-branch policy |
+| Woodpecker | `.woodpecker/deploy.yml` | verify and package dry-run | trusted agent, image pull policy and optional artifact plugin |
+
+These files intentionally do not invent a cross-forge release token or hardcode a host. A caller can add a publish step for the target forge after configuring its own secret and package endpoint. The public site has its own platform workflow set in the `saddle-pages` repository.

package/docs/productindex.md

@@ -14,7 +14,7 @@ Saddle is the contract layer for a family of caller-owned surfaces. The library
 | cross runtime | `runtimecontract`, `memorystorage` and root ESM import | runtime-specific APIs and package loader behavior |
 | browser worker | `workerbridge` and root-safe contracts | worker lifecycle, message transport and extension permissions |
 | browser | browser agent and snapshot contracts | browser vendor adapter, profile and session ownership |
-| extension | Manifest V3 reference files and serializable protocol | browser permission grant, signing and store submission |
+| extension | Manifest V3 reference files, serializable protocol and `permissionpolicy` | browser permission grant, signing and store submission |
 | web control | API, service, `controlsurface` and `controlservice` contracts | operator UI, authentication, database and hosting |
 
 ## operating boundary

package/docs/registryresearch.md

@@ -20,13 +20,13 @@ The RubyGems workflow must pass the host without a trailing slash, matching the
 
 ## workflow decisions
 
-The repository now uses one release-triggered workflow per destination. `publishgithubnpm.yml` publishes a GitHub Packages npm variant under the repository owner scope, currently `@iakadion/saddle`, with `GITHUB_TOKEN`; the public npm workflow keeps the canonical name `@devthink/saddle`. `publishghcr.yml` publishes `ghcr.io/iakadion/saddle`; `publishmaven.yml`, `publishnuget.yml`, and `publishrubygems.yml` publish minimal ecosystem metadata to the corresponding GitHub Packages registries. Every GitHub Packages job grants only `contents: read` and `packages: write`.
+The repository now uses one release-triggered workflow per destination. After the repository transfer, `publishgithubnpm.yml` derives the GitHub Packages npm scope from `github.repository_owner`, so the v1.8.2 run targets `@wenathlan/saddle` with `GITHUB_TOKEN`; the public npm workflow publishes the same canonical package with `NPM_TOKEN`. `publishghcr.yml` derives `ghcr.io/wenathlan/saddle`; `publishmaven.yml` publishes `io.wenathlan:saddle`; NuGet and RubyGems retain their ecosystem-compatible unscoped package identities. Every GitHub Packages job grants only `contents: read` and `packages: write`.
 
 `publishnpmjs.yml` is intentionally separate from GitHub Packages. It uses Node 26.7.0, disables package-manager caching for the release job, and runs `npm publish --access public` against `https://registry.npmjs.org` with `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}`. The secret name is public by design, but its value must remain owner-managed and absent from logs and source files.
 
 The public npm package must be created under the owner account before the first successful publication. The current path uses the owner-managed `NPM_TOKEN` secret for that bootstrap and subsequent releases. The exposed credential from the prior conversation must never be used.
 
-The GitHub Packages npm workflow must use a package scope authorized for the workflow token. `@devthink` is a GitHub organization namespace, while the selected repository currently belongs to `iakadion`; the first run confirmed that publishing `@devthink/saddle` was rejected with HTTP 403. The workflow now changes only the package metadata in the CI workspace to `@iakadion/saddle` before publishing, while the committed `package.json` and public npm package remain `@devthink/saddle`. The two registries therefore have independent package names and access rules.
+The GitHub Packages npm workflow uses the repository owner scope at runtime. The repository is now owned by `wenathlan`, while the authenticated `iakadion` account retains administrator permission, so the committed package metadata and the GitHub Packages workspace both resolve to `@wenathlan/saddle`. Public npm and GitHub Packages therefore share the canonical JavaScript identity for v1.8.2.
 
 The GHCR package is linked automatically by publishing from this repository and includes the OCI source label in `dockerfile.saddle`. GitHub creates a first container package as private by default, so the owner must change its package visibility to public if public pulls are required. The same visibility review applies to the Maven, NuGet, RubyGems, and GitHub npm packages after their first publication.
 
@@ -44,7 +44,11 @@ The cross-runtime workflow `31552266171` and its manual rerun `31552272176` comp
 
 Release `v1.8.0` was created from commit `9ddfd6c`. GitHub npm run `31556461901`, GHCR run `31556461887`, NuGet run `31556461883` and RubyGems run `31556461991` completed successfully for `1.8.0`. Maven run `31556461885` initially failed because setup-java rejects `latest`; after changing the workflow to JDK 26, manual run `31556549154` completed successfully. Public npmjs run `31556461909` produced the `@devthink/saddle@1.8.0` tarball but the registry rejected the PUT with HTTP 404 `Scope not found`; no public npmjs publication is claimed.
 
-The active package identity on main is now `@wenathlan/saddle`. The existing `v1.8.0` tag intentionally remains historical and still contains the prior package identity; a follow-up tag is required before publishing the renamed package through the normal release workflow.
+The active package identity on main is now `@wenathlan/saddle`. The repository has since transferred to `wenathlan`; the authenticated `iakadion` account retains administrator permission. Release `v1.8.2` is the first release prepared against the transferred repository owner for GitHub Packages npm, Maven and GHCR.
+
+Release `v1.8.1` was created from the identity migration commit `efcbb02`. The npmjs workflow `31557618590` authenticated as `wenathlan`, generated `@wenathlan/saddle@1.8.1`, and ended with npm's `+ @wenathlan/saddle@1.8.1` success line. A later independent `npm view` returned `1.8.1`, and the direct registry metadata endpoint returned HTTP 200 with the same version record, confirming public visibility. The other v1.8.1 registry workflows also completed successfully: GitHub npm `31557618600`, GHCR `31557618571`, Maven `31557618597`, NuGet `31557618573` and RubyGems `31557618575`.
+
+Release `v1.8.2` was created from commit `ac7c355` after the repository transfer to `wenathlan`. All release jobs succeeded: GitHub npm `31559770092` logged the owner-derived `@wenathlan/saddle` package, npmjs `31559770096` published the same public package, GHCR `31559770016` pushed `ghcr.io/wenathlan/saddle:1.8.2` and `latest`, Maven `31559770216` deployed `io.wenathlan:saddle:1.8.2`, NuGet `31559770142` created and pushed `Saddle.1.8.2.nupkg`, RubyGems `31559770023` registered `saddle (1.8.2)`, and extension build `31559769740` attached `saddle-extension-1.8.2.zip`. Release validation `31559770059` also succeeded. Independent checks confirmed npmjs `@wenathlan/saddle@1.8.2` and the GitHub release asset. The GitHub organization package-list API returned 403 for the available integration, while unauthenticated GHCR, Maven and NuGet endpoints returned 401; these protected visibility boundaries do not contradict the successful authenticated workflow logs.
 
 ## sources
 

package/docs/release.md

@@ -1,4 +1,4 @@
-# saddle release 1.8.1
+# saddle release 1.8.4
 
 ## release path
 
@@ -6,12 +6,13 @@ The release path is intentionally split into source validation, package validati
 
 | step | owner | condition |
 |---|---|---|
-| package version | repository | `package.json` is `1.8.1` |
+| package version | repository | `package.json` is `1.8.4` |
 | quality gate | GitHub Actions | `npm run pack:check` passes |
-| tag | repository owner | tag `v1.8.1` points to the validated release commit |
-| GitHub release | repository owner | release `v1.8.1` is created from the validated tag |
+| tag | repository owner | tag `v1.8.4` points to the validated release commit |
+| GitHub release | repository owner | release `v1.8.4` is created from the validated tag |
 | GitHub Packages | GitHub Actions | `publishgithubnpm.yml`, `publishghcr.yml`, `publishmaven.yml`, `publishnuget.yml`, and `publishrubygems.yml` use `GITHUB_TOKEN` |
 | public npmjs | owner-managed GitHub Actions secret | `publishnpmjs.yml` uses `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` and derives the version from the release tag or latest release in manual maintenance runs |
+| extension zip | GitHub Actions | `buildextension.yml` derives the version from the release tag, validates the unpacked artifact and attaches `saddle-extension-<version>.zip` |
 
 ## credential rule
 
@@ -21,8 +22,8 @@ The npm token previously sent in chat is compromised and must not be used. GitHu
 
 ```text
 npm run pack:check
-git tag v1.8.1
-git push origin v1.8.1
+git tag v1.8.2
+git push origin v1.8.2
 ```
 
-The release-created event is the publication trigger for the registry workflows. A dry-run verifies package shape and local tests, but cannot verify registry ownership, Trusted Publisher configuration, package scope authorization, or package visibility; those remain settings controlled by the owner.
+The release-created event is the publication and extension-asset trigger for the release workflows. A dry-run verifies package shape and local tests, but cannot verify registry ownership, Trusted Publisher configuration, package scope authorization, package visibility or browser-store submission; those remain settings controlled by the owner.

package/docs/release181notes.md

@@ -12,4 +12,4 @@ The candidate must pass `npm run check`, `npm run formatcheck`, `npm test`, `npm
 
 ## publication boundary
 
-The release workflows remain separate at the registry job level because each destination requires a different protocol and credential. Shared checkout, Node setup, version resolution and package validation use local actions; incompatible publish commands remain isolated by registry.
+The release workflows remain separate at the registry job level because each destination requires a different protocol and credential. Shared checkout, Node setup, version resolution and package validation use local actions; incompatible publish commands remain isolated by registry. The npmjs job authenticated as `wenathlan` and reported `+ @wenathlan/saddle@1.8.1`; a later independent `npm view` and direct registry metadata lookup both returned `1.8.1`, confirming public visibility.

package/docs/release182notes.md

@@ -0,0 +1,27 @@
+# Saddle 1.8.2
+
+Saddle 1.8.2 is the first release prepared after the repository transfer to `wenathlan`. The authenticated `iakadion` account still has administrator permission on the repository, while `wenathlan` is the repository owner and the canonical public npm owner.
+
+## canonical identities
+
+The JavaScript package is `@wenathlan/saddle` on public npm and GitHub Packages npm. GHCR resolves to `ghcr.io/wenathlan/saddle`, and Maven uses the owner-aligned coordinate `io.wenathlan:saddle`. NuGet keeps the unscoped package id `Saddle`, and RubyGems keeps the unscoped gem name `saddle`, because those registries do not use npm-style owner scopes; their authorship and repository metadata now point to `wenathlan`.
+
+| Destination | 1.8.2 identity | Owner resolution |
+| --- | --- | --- |
+| public npm | `@wenathlan/saddle@1.8.2` | owner-managed `NPM_TOKEN` |
+| GitHub Packages npm | `@wenathlan/saddle@1.8.2` | `${{ github.repository_owner }}` and `GITHUB_TOKEN` |
+| GHCR | `ghcr.io/wenathlan/saddle:1.8.2` | `${{ github.repository_owner }}` and `GITHUB_TOKEN` |
+| Maven | `io.wenathlan:saddle:1.8.2` | transferred GitHub Packages owner path |
+| NuGet | `Saddle 1.8.2` | unscoped NuGet package id with `wenathlan` repository metadata |
+| RubyGems | `saddle 1.8.2` | unscoped gem name with `wenathlan` metadata |
+| extension | `saddle-extension-1.8.2.zip` | release-tag-derived asset |
+
+## included engine changes
+
+This release includes the minimal extension permission policy, deterministic extension packaging, context-aware window/tab/frame replay, the transport-neutral export graph audit, and bounded content-type normalization for JSON, XML, Markdown, text, HTML and binary results. The package remains root-based JavaScript ESM and keeps Node-only adapters in explicit subpaths.
+
+## validation boundary
+
+The release must pass `npm run check`, `npm run formatcheck`, `npm test`, `npm run pack:check` and `git diff --check` before the tag is created. Each registry workflow remains isolated because its package protocol and credential boundary differ. Publication evidence is reported only after the workflow succeeds and the target registry can be queried independently.
+
+The `v1.8.2` release and all publication workflows completed successfully. Public npm and the extension asset were independently visible. GitHub Package registries returned their expected protected-access responses to unauthenticated probes, so their workflow logs remain the authoritative evidence available to the authenticated publisher context.

package/docs/release184notes.md

@@ -0,0 +1,7 @@
+# Saddle 1.8.4
+
+Saddle 1.8.4 updates every active library and forge pipeline to Node.js 26.7.0 and adds deterministic package gates to GitLab, Forgejo, Gitea and Woodpecker workflows. GitHub Actions remains the authoritative multi-registry release path; the other forge files are caller-configured validation and artifact paths because their runners, secrets and package registries differ.
+
+The legacy public Maven package `io.devthink.saddle` was identified under the `wenathlan` organization. Its deletion request was attempted through the GitHub Packages API, but the authenticated GitHub App integration returned HTTP 403 because it lacks package-management deletion permission. The new owner-aligned Maven coordinate is `io.wenathlan:saddle` and must not be removed.
+
+The companion Saddle Pages repository now contains a GitHub Pages workflow using `actions/configure-pages@v5`, `actions/upload-pages-artifact@v4` and `actions/deploy-pages@v4`, plus caller-configured GitLab Pages, Forgejo, Codeberg Pages, Gitea and Woodpecker pipelines. The site builds only `dist/public` with `VITE_BASE_PATH=/saddle-pages/` and uses Node.js 26.7.0.

package/docs/usage.md

@@ -2,7 +2,7 @@
 
 ## install
 
-The canonical public package is `@wenathlan/saddle`. The GitHub Packages npm variant is `@iakadion/saddle`; consumers of that registry must configure npm for the repository owner scope before installing.
+The canonical package is `@wenathlan/saddle` on both public npm and GitHub Packages npm after the repository transfer. Consumers of GitHub Packages must configure the `wenathlan` registry scope and authenticate with a token authorized for that package.
 
 ```bash
 npm install @wenathlan/saddle

package/domain/sessions.js

@@ -30,5 +30,17 @@ function validateevent(value, index) {
   if (value.key !== undefined && typeof value.key !== "string") throw validationerror(`session event ${index} key is invalid`);
   if (value.target !== undefined && typeof value.target !== "string") throw validationerror(`session event ${index} target is invalid`);
   if (value.button !== undefined && !["left", "right"].includes(value.button)) throw validationerror(`session event ${index} button is invalid`);
-  return { ...value };
+  const context = validatecontext(value.context ?? value, index);
+  return context ? { ...value, context } : { ...value };
+}
+
+function validatecontext(value, index) {
+  if (value.context !== undefined && (value.context === null || typeof value.context !== "object" || Array.isArray(value.context))) throw validationerror(`session event ${index} context is invalid`);
+  const source = value.context ?? value;
+  const context = {};
+  for (const name of ["windowid", "tabid", "frameid"]) if (source[name] !== undefined) {
+    if (typeof source[name] !== "string" || !source[name]) throw validationerror(`session event ${index} ${name} is invalid`);
+    context[name] = source[name];
+  }
+  return Object.keys(context).length ? context : undefined;
 }

package/extension/README.md

@@ -14,10 +14,14 @@ The manifest requests only `activeTab`, `scripting` and `storage`. It does not r
 
 ## boundaries
 
-The content bridge runs in Chrome's isolated world. It exposes bounded page metadata, visible text, stable references and user initiated click or fill commands. The service worker forwards versioned messages and stores only the latest snapshot metadata in session storage. No endpoint, credential, remote script or browser profile is embedded.
+The content bridge runs in Chrome's isolated world. It exposes bounded page metadata, visible text, stable references and user initiated click or fill commands. The service worker forwards versioned messages, persists bounded pending command records and stores the latest snapshot metadata in session storage. Rehydration is explicit; startup never replays a command without a caller action. No endpoint, credential, remote script or browser profile is embedded.
 
 `protocol.js` and `serviceworker.js` are reusable ESM contracts. `content.js` is intentionally a classic injected file because programmatic Chrome content scripts are loaded as files; it exposes a small global bridge and avoids arbitrary page JavaScript evaluation.
 
+## deterministic release artifact
+
+The Node-only build adapter creates an isolated unpacked artifact with the release version in its manifest. A caller can run `npm run extension:build -- --version 1.8.2 --output build/extension` and package that directory with the archive tool available in the host environment. The release workflow derives the version from the published tag and attaches `saddle-extension-<version>.zip` without changing the source manifest.
+
 ## next slices
 
-The next extension slices should add snapshot diffing, tab and frame identity, resumable command records, optional host permission escalation, browser action results and a deterministic zip workflow. Browser providers, login profiles, captcha solvers and remote runners remain caller owned adapters.
+The next extension slices should add snapshot diffing, richer tab and frame metadata, optional host permission escalation and browser action results. Browser providers, login profiles, captcha solvers and remote runners remain caller owned adapters.

package/extension/build.js

@@ -0,0 +1,46 @@
+/**
+ * extension build adapter creates a versioned, unpacked Manifest V3 artifact for release packaging.
+ */
+
+import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const rootpath = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const entries = ["manifest.json", "worker.js", "serviceworker.js", "content.js", "popup.js", "popup.html", "popup.css", "protocol.js", "permissions.js"];
+
+function parsearguments(argumentslist) {
+  const options = {};
+  for (let index = 0; index < argumentslist.length; index += 1) {
+    const argument = argumentslist[index];
+    if (argument === "--version") options.version = argumentslist[++index];
+    else if (argument === "--output") options.output = argumentslist[++index];
+    else throw new TypeError(`unsupported extension build argument: ${argument}`);
+  }
+  return options;
+}
+
+function validversion(version) {
+  return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version ?? ""));
+}
+
+/** Builds the extension into an isolated directory and returns its manifest. */
+export async function buildextension(options = {}) {
+  const packagefile = JSON.parse(await readFile(resolve(rootpath, "package.json"), "utf8"));
+  const version = String(options.version ?? packagefile.version);
+  if (!validversion(version)) throw new TypeError(`invalid extension version: ${version}`);
+  const output = resolve(process.cwd(), options.output ?? "build/extension");
+  await rm(output, { force: true, recursive: true });
+  await mkdir(output, { recursive: true });
+  const manifest = JSON.parse(await readFile(resolve(rootpath, "extension/manifest.json"), "utf8"));
+  manifest.version = version;
+  for (const entry of entries) {
+    const source = resolve(rootpath, "extension", entry);
+    const destination = resolve(output, entry);
+    if (entry === "manifest.json") await writeFile(destination, `${JSON.stringify(manifest, null, 2)}\n`);
+    else await cp(source, destination);
+  }
+  return { output, manifest };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) buildextension(parsearguments(process.argv.slice(2))).then(({ output }) => { console.log(`extension artifact: ${output}`); }).catch((error) => { console.error(error.message); process.exitCode = 1; });

package/extension/index.js

@@ -3,3 +3,4 @@
  */
 export * from "./protocol.js";
 export * from "./serviceworker.js";
+export * from "./permissions.js";

package/extension/permissions.js

@@ -0,0 +1,22 @@
+/**
+ * extension permission policies keep the browser capability boundary explicit and caller-owned.
+ */
+
+export const extensionpermissions = Object.freeze(["activeTab", "scripting", "storage"]);
+
+/** Creates a minimal permission policy without requesting broad host access. */
+export function permissionpolicy(options = {}) {
+  const requested = [...new Set((options.requested ?? extensionpermissions).map(String))];
+  const optional = [...new Set((options.optional ?? []).map(String))];
+  const unknown = requested.concat(optional).filter((permission) => !extensionpermissions.includes(permission));
+  if (unknown.length) throw new TypeError(`unsupported extension permission: ${unknown[0]}`);
+  return { version: 1, requested, optional, hostpermissions: [], allows(permission) { return requested.includes(String(permission)); }, missing(permissions = []) { return [...new Set(permissions.map(String))].filter((permission) => !requested.includes(permission)); } };
+}
+
+/** Requests an optional capability through an injected browser permission function. */
+export async function requestpermission(policy, permission, request) {
+  const name = String(permission ?? "");
+  if (!policy?.optional?.includes(name)) throw new TypeError(`permission is not optional: ${name}`);
+  if (typeof request !== "function") throw new TypeError("permission request function is required");
+  try { return { permission: name, granted: Boolean(await request(name)) }; } catch (error) { return { permission: name, granted: false, code: String(error?.code ?? "PERMISSION_REQUEST_FAILED"), message: String(error?.message ?? error) }; }
+}

package/extension/serviceworker.js

@@ -11,7 +11,9 @@ export function createworkerrouter(options = {}) {
   const storage = options.storage;
   const contentfile = options.contentfile ?? "content.js";
   const statekey = options.statekey ?? "saddleextensionstate";
+  const maxpending = options.maxpending ?? 32;
   if (typeof tabs?.sendMessage !== "function") throw new TypeError("extension router requires tabs.sendMessage");
+  if (!Number.isSafeInteger(maxpending) || maxpending < 1) throw new TypeError("extension router maxpending must be a positive safe integer");
 
   async function ensurecontent(tabid) {
     if (!Number.isInteger(tabid)) throw new TypeError("extension command requires a tab id");
@@ -29,15 +31,72 @@ export function createworkerrouter(options = {}) {
     if (typeof storage?.set === "function") await storage.set({ [statekey]: value });
   }
 
+  async function pendingstate() {
+    const value = await readstate();
+    return { ...value, pending: Array.isArray(value.pending) ? value.pending.filter(validpending) : [] };
+  }
+
+  async function enqueue(request, sender) {
+    const state = await pendingstate();
+    const record = pendingrecord(request, sender);
+    const pending = state.pending.filter((item) => item.requestid !== record.requestid);
+    if (pending.length >= maxpending && !state.pending.some((item) => item.requestid === record.requestid)) throw extensionerror("PENDING_LIMIT", "extension pending command limit reached");
+    pending.push(record);
+    await savestate({ ...state, pending });
+    return record;
+  }
+
+  async function complete(requestid, patch = {}) {
+    const state = await pendingstate();
+    await savestate({ ...state, ...patch, pending: state.pending.filter((item) => item.requestid !== requestid) });
+  }
+
+  async function markfailure(requestid, error) {
+    const state = await pendingstate();
+    const pending = state.pending.map((item) => item.requestid === requestid ? { ...item, attempts: item.attempts + 1, lasterror: { code: String(error?.code ?? "extension_error"), message: String(error?.message ?? error) }, updatedat: Date.now() } : item);
+    await savestate({ ...state, pending });
+  }
+
+  async function dispatch(request, sender = {}) {
+    const tabid = request.payload?.tabid ?? sender.tab?.id;
+    await ensurecontent(tabid);
+    return tabs.sendMessage(tabid, request);
+  }
+
   async function handle(message, sender = {}) {
     const request = assertmessage(message);
     if (request.type !== "command") throw new TypeError("extension router accepts commands only");
     const tabid = request.payload?.tabid ?? sender.tab?.id;
-    await ensurecontent(tabid);
-    const response = await tabs.sendMessage(tabid, request);
-    if (response?.type === "response" && response.payload?.snapshotid) await savestate({ tabid, snapshotid: response.payload.snapshotid, updatedat: Date.now() });
+    await enqueue(request, { ...sender, tab: { ...sender.tab, id: tabid } });
+    try {
+      const response = await dispatch(request, { ...sender, tab: { ...sender.tab, id: tabid } });
+      await complete(request.id, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, updatedat: Date.now() } : { updatedat: Date.now() });
+      return response;
+    } catch (error) {
+      await markfailure(request.id, error);
+      throw error;
+    }
+  }
+
+  async function rehydrate() { return pendingstate(); }
+
+  async function resume(requestid, sender = {}) {
+    const state = await pendingstate();
+    const pending = state.pending.find((item) => item.requestid === requestid);
+    if (!pending) throw extensionerror("PENDING_NOT_FOUND", `pending command not found: ${requestid}`);
+    const tabid = pending.tabid ?? sender.tab?.id;
+    const response = await dispatch(pending.message, { ...sender, tab: { ...sender.tab, id: tabid } });
+    await complete(requestid, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, updatedat: Date.now() } : { updatedat: Date.now() });
     return response;
   }
 
-  return { ensurecontent, readstate, savestate, handle };
+  async function cancel(requestid) { const state = await pendingstate(); await savestate({ ...state, pending: state.pending.filter((item) => item.requestid !== requestid) }); }
+
+  return { ensurecontent, readstate, savestate, rehydrate, enqueue, resume, cancel, handle };
 }
+
+function pendingrecord(request, sender = {}) { return { requestid: request.id, command: request.command, message: request, tabid: request.payload?.tabid ?? sender.tab?.id, attempts: 0, createdat: Date.now(), updatedat: Date.now() }; }
+
+function validpending(value) { return Boolean(value && typeof value === "object" && typeof value.requestid === "string" && value.message && value.message.type === "command" && Number.isSafeInteger(value.attempts) && value.attempts >= 0); }
+
+function extensionerror(code, message) { const error = new Error(message); error.code = code; return error; }

package/extension/worker.js

@@ -13,8 +13,10 @@ export function startworker(chromeapi = globalThis.chrome) {
     router.handle(message, sender).then(sendresponse).catch((error) => sendresponse(createerror(message, error)));
     return true;
   };
+  const startup = () => router.rehydrate().catch(() => undefined);
   chromeapi.runtime.onMessage.addListener(listener);
-  return { router, dispose() { chromeapi.runtime.onMessage.removeListener?.(listener); } };
+  chromeapi.runtime.onStartup?.addListener(startup);
+  return { router, dispose() { chromeapi.runtime.onMessage.removeListener?.(listener); chromeapi.runtime.onStartup?.removeListener?.(startup); } };
 }
 
 if (globalThis.chrome?.runtime?.onMessage) startworker();

package/index.js

@@ -77,6 +77,7 @@ export * from "./crawl/normalize.js";
 export * from "./crawl/crawler.js";
 export * from "./crawl/persistent.js";
 export * from "./scrape/schema.js";
+export * from "./scrape/normalize.js";
 export * from "./mcp/server.js";
 export * from "./runtime/detect.js";
 export * from "./runtime/abort.js";

package/library/public.js

@@ -5,6 +5,7 @@ import { crawl } from "../crawl/crawler.js";
 import { chunkmarkdown } from "../ai/chunk.js";
 import { estimatetokens } from "../ai/tokens.js";
 import { extracthtml } from "../scrape/extract.js";
+import { normalizeresponse } from "../scrape/normalize.js";
 import { browseragent } from "../browser/agent.js";
 
 /** Selects the fetch or browser execution path. */
@@ -19,8 +20,9 @@ export async function scrapeurl(url, options = {}) {
   const target = safeurl(url);
   const response = await (options.fetcher ?? fetch)(target, { signal: options.signal, headers: options.headers });
   if (!response.ok) throw new Error(`scrape request failed with ${response.status}`);
-  const html = await response.text();
-  return formatresult(scrapehtml(html, target, options), options);
+  const normalized = await normalizeresponse(response, { url: target, defaultcontenttype: "text/html", maxbytes: options.maxbytes });
+  const result = normalized.kind === "html" ? scrapehtml(normalized.content, target, options) : { content: normalized.content, data: normalized.data, metadata: { url: target, contenttype: normalized.contenttype, size: normalized.size }, bytes: normalized.bytes };
+  return formatresult(result, options);
 }
 
 /** Extracts a serializable result from HTML without network access. */

package/license.md

@@ -198,6 +198,6 @@
 
     You should have received a copy of the Proprietary Source-Available
     License along with this program. If not, see
-    <https://github.com/iakadion/saddle/blob/main/license.txt>
+    <https://github.com/wenathlan/saddle/blob/main/license.txt>
 
   Also add information on how to contact you by electronic and paper mail.

package/license.txt

@@ -198,6 +198,6 @@
 
     You should have received a copy of the Proprietary Source-Available
     License along with this program. If not, see
-    <https://github.com/iakadion/saddle/blob/main/license.txt>
+    <https://github.com/wenathlan/saddle/blob/main/license.txt>
 
   Also add information on how to contact you by electronic and paper mail.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "1.8.1",
+  "version": "1.8.4",
   "description": "binary computing engine that turns distributed storage into a publishable working set",
   "type": "module",
   "license": "GPL-3.0-only",
   "publishConfig": { "access": "public" },
-  "repository": { "type": "git", "url": "https://github.com/iakadion/saddle.git" },
-  "bugs": { "url": "https://github.com/iakadion/saddle/issues" },
-  "homepage": "https://github.com/iakadion/saddle#readme",
+  "repository": { "type": "git", "url": "https://github.com/wenathlan/saddle.git" },
+  "bugs": { "url": "https://github.com/wenathlan/saddle/issues" },
+  "homepage": "https://github.com/wenathlan/saddle#readme",
   "keywords": ["distributed computing", "virtual memory", "runner", "storage", "automation"],
   "engines": { "node": ">=22" },
   "bin": { "saddle": "./cli/main.js" },
@@ -37,10 +37,11 @@
   },
   "files": ["core", "domain", "memory", "runners", "runtime", "storage", "sessions", "modes", "adapters", "persistence", "queue", "dispatch", "scrape", "crawl", "api", "mcp", "browser", "proxy", "captcha", "ai", "webhook", "surfaces", "library", "errors", "retry", "server", "binary", "format", "packager", "bot", "protocol", "workflow", "cli", "extension", "index.js", "docs", "examples", "README.md", "LICENSE"],
   "scripts": {
-    "check": "node --check index.js && node --check runtime/engine.js && node --check cli/main.js && node --check extension/protocol.js && node --check extension/serviceworker.js && node --check extension/worker.js && node --check extension/content.js && node --check extension/popup.js",
+    "check": "node --check index.js && node --check runtime/engine.js && node --check cli/main.js && node --check extension/protocol.js && node --check extension/serviceworker.js && node --check extension/worker.js && node --check extension/content.js && node --check extension/popup.js && node --check extension/permissions.js && node --check extension/build.js && node --check sessions/replay.js && node --check browser/recorder.js && node --check scrape/normalize.js",
     "formatcheck": "node format/check.js",
     "test": "node --test tests/*.test.js",
     "run": "node cli/main.js",
+    "extension:build": "node extension/build.js",
     "pack:check": "npm run check && npm run formatcheck && npm test && npm pack --dry-run",
     "prepublishOnly": "npm run pack:check"
   }

package/packager/manifest.js

@@ -19,7 +19,7 @@ export function binaryplan(manifest, options = {}) {
 }
 
 export function containerplan(manifest, options = {}) {
-  const base = options.base ?? "node:22-alpine";
+  const base = options.base ?? "node:26.7.0-alpine";
   const workdir = options.workdir ?? "/app";
   const command = options.command ?? ["node", manifest.entry];
   const lines = [`from ${base}`, `workdir ${workdir}`, "copy package.json package-lock.json ./", "run npm ci --omit=dev", "copy . .", `cmd ${JSON.stringify(command)}`];

package/readme.txt

@@ -50,27 +50,27 @@
 <p align="center">
   <strong>Storage-backed jobs, scraping contracts and portable runners for Node.js.</strong><br/>
   <strong>Binary computing agent, agent browser, computer-use, scraper and packager.</strong><br/>
-  <a href="https://github.com/iakadion/saddle/actions/workflows/ci.yml"><img src="https://github.com/iakadion/saddle/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
-  <a href="https://github.com/iakadion/saddle/releases/tag/v1.0.0"><img src="https://img.shields.io/badge/release-v1.0.0-d35d3d" alt="Release 1.0.0" /></a>
-  <a href="https://github.com/iakadion/saddle/blob/main/license.md"><img src="https://img.shields.io/badge/license-Proprietary--View--Only-202a2f" alt="Proprietary View Only" /></a>
+  <a href="https://github.com/wenathlan/saddle/actions/workflows/ci.yml"><img src="https://github.com/wenathlan/saddle/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="https://github.com/wenathlan/saddle/releases/tag/v1.8.2"><img src="https://img.shields.io/badge/release-v1.8.2-d35d3d" alt="Release 1.8.2" /></a>
+  <a href="https://github.com/wenathlan/saddle/blob/main/license.md"><img src="https://img.shields.io/badge/license-Proprietary--View--Only-202a2f" alt="Proprietary View Only" /></a>
 </p>
 
 > **Core idea:** storage is the durable side of the working set; the runner is replaceable; the artifact is the boundary. **Storage == Compute** — RAM and disk are the same construct, differing only by usage flag.
 
 Saddle is a **JavaScript ESM engine** for jobs that move data between storage, a working set, an injected runner and durable artifacts. It is also a **virtual machine you publish as a package** that runs on other people's computers (GitHub Actions, Forgejo, Gitea, GitLab, Codeberg, free Docker containers) and turns unlimited third-party storage buckets into virtual RAM/GPU/CPU. Nothing runs on the operator's local machine.
 
-Ships as a library, CLI, binary, n8n node, CRX extension, Android/iOS and Tauri desktop app. Package `@devthink/saddle` — published to npm, GitHub Packages, Maven, NuGet, RubyGems and GHCR (auto-mirrored to jsDelivr).
+Ships as a library, CLI, binary, n8n node, CRX extension, Android/iOS and Tauri desktop app. The canonical JavaScript package is `@wenathlan/saddle`; GitHub Packages npm, Maven and GHCR use the transferred `wenathlan` owner namespace, while NuGet and RubyGems retain their unscoped ecosystem package names.
 
 ## Start here
 
 Saddle requires **Node.js 22 or newer**.
 
 ```bash
-npm install @devthink/saddle
+npm install @wenathlan/saddle
 ```
 
 ```js
-import { scrapeurl, formatforagent } from "@devthink/saddle";
+import { scrapeurl, formatforagent } from "@wenathlan/saddle";
 
 const result = await scrapeurl("https://example.com", { format: "markdown" });
 const context = formatforagent(result, { maxchunksize: 2000, keypoints: 4 });
@@ -130,7 +130,7 @@ Saddle coordinates contracts instead of hiding providers. A repo + CI runner is
 - repository_dispatch = IPC
 
 ```js
-import { engine, eventbus, inprocess, localmemory, localstorage, scheduler } from "@devthink/saddle";
+import { engine, eventbus, inprocess, localmemory, localstorage, scheduler } from "@wenathlan/saddle";
 const events = eventbus();
 const run = engine({
   storage: localstorage("./.saddle-data"),
@@ -160,4 +160,4 @@ saddle deploy --target netlify
 ## Security boundaries
 
 | Boundary | Policy |
-| --- | --- 
+| --- | --- |

package/scrape/normalize.js

@@ -0,0 +1,86 @@
+/**
+ * content normalization classifies bounded response bytes without owning a parser, transport or storage backend.
+ */
+
+const extensions = Object.freeze({
+  ".json": "application/json",
+  ".map": "application/json",
+  ".xml": "application/xml",
+  ".rss": "application/rss+xml",
+  ".atom": "application/atom+xml",
+  ".md": "text/markdown",
+  ".markdown": "text/markdown",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".txt": "text/plain",
+  ".csv": "text/csv"
+});
+
+/** Detects a normalized media type from a header, URL suffix or caller fallback. */
+export function detectcontenttype(header, url, fallback = "application/octet-stream") {
+  const value = String(header ?? "").split(";", 1)[0].trim().toLowerCase();
+  if (value) return value;
+  try {
+    const pathname = new URL(url).pathname.toLowerCase();
+    const suffix = Object.keys(extensions).find((extension) => pathname.endsWith(extension));
+    if (suffix) return extensions[suffix];
+  } catch { /* invalid or absent URLs remain caller-owned metadata */ }
+  return String(fallback).toLowerCase();
+}
+
+/** Normalizes bounded input bytes into a serializable text, JSON or binary result. */
+export function normalizeresult(input, options = {}) {
+  const contenttype = detectcontenttype(options.contenttype, options.url, options.defaultcontenttype ?? "application/octet-stream");
+  const bytes = tobytes(input);
+  const maxbytes = boundedlimit(options.maxbytes, 2_000_000);
+  if (bytes.byteLength > maxbytes) throw normalizationerror("CONTENT_TOO_LARGE", `content exceeds ${maxbytes} bytes`);
+  const kind = contentkind(contenttype);
+  if (kind === "binary") return { contenttype, kind, size: bytes.byteLength, bytes };
+  const text = new TextDecoder(options.charset ?? "utf-8", { fatal: false }).decode(bytes).replaceAll("\r\n", "\n");
+  if (text.length > boundedlimit(options.maxtext, maxbytes)) throw normalizationerror("TEXT_TOO_LARGE", "decoded content exceeds the configured text limit");
+  if (kind === "json") {
+    try { return { contenttype, kind, size: bytes.byteLength, content: text, data: JSON.parse(text) }; } catch (error) { throw normalizationerror("INVALID_JSON", `invalid JSON content: ${error.message}`); }
+  }
+  return { contenttype, kind, size: bytes.byteLength, content: text };
+}
+
+/** Reads a caller-provided response body after checking declared and actual size limits. */
+export async function normalizeresponse(response, options = {}) {
+  if (!response || typeof response !== "object") throw new TypeError("response is required");
+  const headers = response.headers;
+  const header = typeof headers?.get === "function" ? headers.get("content-type") : headers?.["content-type"];
+  const declared = Number(typeof headers?.get === "function" ? headers.get("content-length") : headers?.["content-length"]);
+  const maxbytes = boundedlimit(options.maxbytes, 2_000_000);
+  if (Number.isFinite(declared) && declared > maxbytes) throw normalizationerror("CONTENT_TOO_LARGE", `content exceeds ${maxbytes} bytes`);
+  const body = typeof response.arrayBuffer === "function" ? await response.arrayBuffer() : await response.text();
+  return normalizeresult(body, { ...options, contenttype: header ?? options.contenttype, url: options.url ?? response.url });
+}
+
+function contentkind(contenttype) {
+  if (contenttype === "application/json" || contenttype.endsWith("+json")) return "json";
+  if (contenttype === "text/html" || contenttype === "application/xhtml+xml") return "html";
+  if (contenttype === "application/xml" || contenttype === "text/xml" || contenttype.endsWith("+xml")) return "xml";
+  if (contenttype === "text/markdown") return "markdown";
+  if (contenttype.startsWith("text/")) return "text";
+  return "binary";
+}
+
+function tobytes(input) {
+  if (typeof input === "string") return new TextEncoder().encode(input);
+  if (input instanceof Uint8Array) return input;
+  if (input instanceof ArrayBuffer) return new Uint8Array(input);
+  if (ArrayBuffer.isView(input)) return new Uint8Array(input.buffer, input.byteOffset, input.byteLength);
+  throw new TypeError("content must be a string, ArrayBuffer or typed array");
+}
+
+function boundedlimit(value, fallback) {
+  const limit = Number(value ?? fallback);
+  if (!Number.isSafeInteger(limit) || limit < 1) throw new TypeError("content limit must be a positive safe integer");
+  return limit;
+}
+
+function normalizationerror(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}

package/sessions/replay.js

@@ -5,17 +5,57 @@ export async function replay(session, adapter, options = {}) {
   if (!session?.events || typeof adapter?.move !== "function") throw new TypeError("replay requires session events and browser adapter");
   const speed = options.speed ?? 1;
   let previous = 0;
+  let currentcontext = normalizecontext(options.initialcontext);
+  let contextswitches = 0;
   for (const event of session.events) {
     const wait = Math.max(0, (event.t - previous) / speed);
     if (wait) await delay(wait);
     previous = event.t;
+    const eventcontext = normalizecontext(event.context ?? event);
+    if (eventcontext && contextchanged(currentcontext, eventcontext)) {
+      await restorecontext(adapter, eventcontext, currentcontext);
+      currentcontext = eventcontext;
+      contextswitches += 1;
+    }
     if (event.type === "move") await adapter.move(event);
     else if (event.type === "click") await adapter.click(event);
     else if (event.type === "drag") await adapter.drag(event);
     else if (event.type === "scroll") await adapter.scroll(event);
     else if (event.type === "key") await adapter.key(event);
   }
-  return { events: session.events.length, duration: previous / speed };
+  return { events: session.events.length, duration: previous / speed, contextswitches };
+}
+
+function normalizecontext(value) {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== "object" || Array.isArray(value)) throw new TypeError("replay context must be an object");
+  const context = {};
+  for (const name of ["windowid", "tabid", "frameid"]) if (value[name] !== undefined) {
+    if (typeof value[name] !== "string" || !value[name]) throw new TypeError(`replay ${name} must be a non-empty string`);
+    context[name] = value[name];
+  }
+  return Object.keys(context).length ? context : undefined;
+}
+
+function contextchanged(previous, next) {
+  return ["windowid", "tabid", "frameid"].some((name) => previous?.[name] !== next[name]);
+}
+
+async function restorecontext(adapter, next, previous) {
+  if (typeof adapter.restorecontext === "function") {
+    await adapter.restorecontext({ ...next }, previous ? { ...previous } : undefined);
+    return;
+  }
+  const methods = [["windowid", "selectwindow"], ["tabid", "selecttab"], ["frameid", "selectframe"]];
+  for (const [name, method] of methods) if (next[name] !== undefined && previous?.[name] !== next[name]) {
+    if (typeof adapter[method] !== "function") {
+      const error = new Error(`replay adapter cannot restore ${name}`);
+      error.code = "REPLAY_CONTEXT_UNSUPPORTED";
+      error.context = name;
+      throw error;
+    }
+    await adapter[method](next[name], { ...next });
+  }
 }
 
 function delay(milliseconds) { return new Promise((resolve) => setTimeout(resolve, milliseconds)); }

package/workflow/templates.js

@@ -5,14 +5,14 @@ import { workflowinputs } from "./manifest.js";
 
 export function githubworkflow(manifest) {
   const input = workflowinputs(manifest);
-  return `name: ${manifest.name}\non:\n  workflow_dispatch:\n    inputs:\n      jobid:\n        required: true\n        type: string\n      command:\n        required: true\n        type: string\n        default: ${manifest.command}\n  repository_dispatch:\n    types: [saddle-job]\npermissions:\n  contents: read\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${input.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n      - run: npm ci\n      - run: \${{ github.event.inputs.command || '${manifest.command}' }}\n        env:\n          SBOT_JOB_ID: \${{ github.event.inputs.jobid || github.event.client_payload.jobid }}\n      - uses: actions/upload-artifact@v4\n        with:\n          name: saddle-results\n          path: ${manifest.artifacts.join("\n            ")}\n          if-no-files-found: ignore\n`;
+  return `name: ${manifest.name}\non:\n  workflow_dispatch:\n    inputs:\n      jobid:\n        required: true\n        type: string\n      command:\n        required: true\n        type: string\n        default: ${manifest.command}\n  repository_dispatch:\n    types: [saddle-job]\npermissions:\n  contents: read\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${input.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 26.7.0\n      - run: npm ci\n      - run: \${{ github.event.inputs.command || '${manifest.command}' }}\n        env:\n          SBOT_JOB_ID: \${{ github.event.inputs.jobid || github.event.client_payload.jobid }}\n      - uses: actions/upload-artifact@v4\n        with:\n          name: saddle-results\n          path: ${manifest.artifacts.join("\n            ")}\n          if-no-files-found: ignore\n`;
 }
 
 export function forgejoworkflow(manifest) { return genericworkflow(manifest, "forgejo"); }
 export function giteaworkflow(manifest) { return genericworkflow(manifest, "gitea"); }
-export function woodpeckerworkflow(manifest) { return `when:\n  - event: push\n  - event: manual\nsteps:\n  process:\n    image: node:22\n    commands:\n      - npm ci\n      - ${manifest.command}\n`;
+export function woodpeckerworkflow(manifest) { return `when:\n  - event: push\n  - event: manual\nsteps:\n  process:\n    image: node:26.7.0\n    commands:\n      - npm ci\n      - ${manifest.command}\n`;
 }
-export function gitlabworkflow(manifest) { return `stages:\n  - process\nprocess:\n  stage: process\n  image: node:22\n  script:\n    - npm ci\n    - ${manifest.command}\n  artifacts:\n    when: always\n    paths:\n${manifest.artifacts.map((item) => `      - ${item}`).join("\n")}\n`; }
+export function gitlabworkflow(manifest) { return `stages:\n  - process\nprocess:\n  stage: process\n  image: node:26.7.0\n  script:\n    - npm ci\n    - ${manifest.command}\n  artifacts:\n    when: always\n    paths:\n${manifest.artifacts.map((item) => `      - ${item}`).join("\n")}\n`; }
 
-function genericworkflow(manifest, name) { return `name: ${manifest.name}\non:\n  workflow_dispatch:\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${manifest.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n      - run: npm ci\n      - run: ${manifest.command}\n`;
+function genericworkflow(manifest, name) { return `name: ${manifest.name}\non:\n  workflow_dispatch:\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${manifest.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 26.7.0\n      - run: npm ci\n      - run: ${manifest.command}\n`;
 }