@wenathlan/saddle 1.8.5 → 1.8.7

package/extension/content.js

@@ -6,12 +6,14 @@
 (function installglobalbridge(global) {
   const installedkey = "__saddlecontentbridge";
   const protocolversion = 1;
-  const commands = ["snapshot", "readpage", "clickref", "fillref"];
+  const commands = ["snapshot", "readpage", "pagefacts", "clickref", "fillref"];
+  const pagechannelname = "saddle.pagefacts.v1";
 
-  function createbridge(documentref, now = () => Date.now()) {
+  function createbridge(documentref, now = () => Date.now(), options = {}) {
     let snapshotid = null;
     let sequence = 0;
     const references = new Map();
+    const pagechannel = options.pagechannel ?? (typeof global.addEventListener === "function" && typeof global.postMessage === "function" ? createpagechannel(global, now, options.timeout) : null);
 
     function snapshotpage() {
       const nextid = `snap${++sequence}${now()}`;
@@ -45,6 +47,10 @@
       const payload = request.payload ?? {};
       if (request.command === "snapshot") return snapshotpage();
       if (request.command === "readpage") return readpage();
+      if (request.command === "pagefacts") {
+        if (!pagechannel) throw failure("page_bridge_unavailable", "page bridge is not available");
+        return pagechannel.readpage();
+      }
       const element = resolve(payload.ref, payload.snapshotid);
       if (request.command === "clickref") { element.click?.(); return { ref: payload.ref, clicked: true, snapshotid }; }
       if (!isfillable(element)) throw failure("not_fillable", `element is not fillable: ${payload.ref}`);
@@ -52,7 +58,43 @@
       return { ref: payload.ref, filled: true, snapshotid };
     }
 
-    return { handle, snapshotpage, readpage };
+    return { handle, snapshotpage, readpage, pagechannel };
+  }
+
+  function createpagechannel(globalref = global, now = () => Date.now(), timeout = 1500) {
+    if (typeof globalref.addEventListener !== "function" || typeof globalref.postMessage !== "function") throw new TypeError("page channel requires window messaging APIs");
+    if (!Number.isSafeInteger(timeout) || timeout < 1) throw new TypeError("page channel timeout must be a positive safe integer");
+    const pending = new Map();
+    let sequence = 0;
+    const token = `token${now()}${Math.random().toString(16).slice(2)}`;
+
+    function listener(event) {
+      const response = event?.data;
+      if (event?.source && event.source !== globalref) return;
+      if (response?.channel !== pagechannelname || response.type !== "response" || response.token !== token) return;
+      const request = pending.get(response.requestid);
+      if (!request) return;
+      pending.delete(response.requestid);
+      globalref.clearTimeout?.(request.timer);
+      request.resolve(response.payload ?? {});
+    }
+
+    function readpage() {
+      const requestid = `page${now()}${++sequence}`;
+      return new Promise((resolve, reject) => {
+        const timer = globalref.setTimeout(() => {
+          pending.delete(requestid);
+          const error = new Error("page bridge response timed out");
+          error.code = "page_bridge_timeout";
+          reject(error);
+        }, timeout);
+        pending.set(requestid, { resolve, timer });
+        globalref.postMessage({ channel: pagechannelname, version: 1, type: "request", requestid, token }, "*");
+      });
+    }
+
+    globalref.addEventListener("message", listener);
+    return { readpage, dispose() { globalref.removeEventListener?.("message", listener); for (const request of pending.values()) globalref.clearTimeout?.(request.timer); pending.clear(); } };
   }
 
   function install(runtime = global.chrome?.runtime, documentref = global.document) {
@@ -80,6 +122,6 @@
   function setvalue(element, value) { element.value = String(value ?? ""); element.dispatchEvent?.(new Event("input", { bubbles: true })); element.dispatchEvent?.(new Event("change", { bubbles: true })); }
   function failure(code, message) { const error = new Error(message); error.code = code; return error; }
 
-  global.saddlecontent = { createbridge, install };
+  global.saddlecontent = { createbridge, createpagechannel, install };
   if (global.chrome?.runtime?.onMessage && global.document) install();
 })(globalThis);

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Saddle browser bridge",
-  "version": "1.1.0",
+  "version": "1.8.7",
   "description": "User initiated page snapshots through the Saddle browser contract.",
   "minimum_chrome_version": "110",
   "permissions": ["activeTab", "scripting", "storage"],

package/extension/pagebridge.js

@@ -0,0 +1,41 @@
+/**
+ * page bridge exposes bounded, read-only page facts to the isolated content world.
+ * It never executes page supplied commands and never forwards extension credentials.
+ */
+
+(function installpagebridge(global) {
+  const channel = "saddle.pagefacts.v1";
+  const installedkey = "__saddlepagebridge";
+
+  function createpagebridge(globalref = global) {
+    function readpage() {
+      const documentref = globalref.document;
+      return {
+        url: String(documentref?.location?.href ?? ""),
+        title: String(documentref?.title ?? "").slice(0, 500),
+        text: String(documentref?.body?.innerText ?? "").slice(0, 100000)
+      };
+    }
+
+    function listener(event) {
+      const request = event?.data;
+      if (event?.source && event.source !== globalref) return;
+      if (request?.channel !== channel || request.type !== "request" || typeof request.requestid !== "string" || typeof request.token !== "string") return;
+      globalref.postMessage({ channel, version: 1, type: "response", requestid: request.requestid, token: request.token, payload: readpage() }, "*");
+    }
+
+    return { channel, listener, readpage };
+  }
+
+  function install(globalref = global) {
+    if (typeof globalref?.addEventListener !== "function" || !globalref.document) throw new TypeError("page bridge requires a window and document");
+    if (globalref[installedkey]) return globalref[installedkey];
+    const bridge = createpagebridge(globalref);
+    globalref.addEventListener("message", bridge.listener);
+    globalref[installedkey] = { ...bridge, dispose() { globalref.removeEventListener?.("message", bridge.listener); delete globalref[installedkey]; } };
+    return globalref[installedkey];
+  }
+
+  global.saddlepagebridge = { channel, createpagebridge, install };
+  if (global.document && typeof global.addEventListener === "function") install(global);
+})(globalThis);

package/extension/protocol.js

@@ -3,7 +3,7 @@
  */
 
 export const protocolversion = 1;
-export const extensioncommands = Object.freeze(["snapshot", "readpage", "clickref", "fillref"]);
+export const extensioncommands = Object.freeze(["snapshot", "readpage", "pagefacts", "clickref", "fillref"]);
 
 /** Creates a compact identifier without embedding a host, port or credential. */
 export function createid(prefix = "msg", source) {
@@ -59,10 +59,13 @@ export function createsnapshot(input = {}) {
     version: protocolversion,
     snapshotid: String(input.snapshotid ?? createid("snap")),
     createdat: Number(input.createdat ?? Date.now()),
+    windowid: input.windowid === undefined ? undefined : String(input.windowid),
+    tabid: input.tabid === undefined ? undefined : String(input.tabid),
+    frameid: input.frameid === undefined ? undefined : String(input.frameid),
     url: String(input.url ?? ""),
     title: String(input.title ?? ""),
     text: String(input.text ?? ""),
-    elements: Array.isArray(input.elements) ? input.elements.map((element) => ({ ref: String(element.ref), role: String(element.role ?? "generic"), name: String(element.name ?? "") })) : []
+    elements: Array.isArray(input.elements) ? input.elements.map((element) => ({ ref: String(element.ref), role: String(element.role ?? "generic"), name: String(element.name ?? ""), value: element.value === undefined ? undefined : String(element.value), disabled: Boolean(element.disabled) })) : []
   };
   assertserializable(snapshot);
   return snapshot;
@@ -71,6 +74,22 @@ export function createsnapshot(input = {}) {
 /** Returns whether a reference still belongs to the current page snapshot. */
 export function isfreshsnapshot(snapshotid, currentid) { return Boolean(snapshotid && currentid && snapshotid === currentid); }
 
+/** Computes bounded additions, removals and changed elements between extension snapshots. */
+export function snapshotdiff(previous, current) {
+  const before = createsnapshot(previous);
+  const after = createsnapshot(current);
+  const oldmap = new Map(before.elements.map((element) => [element.ref, element]));
+  const newmap = new Map(after.elements.map((element) => [element.ref, element]));
+  return {
+    from: before.snapshotid,
+    to: after.snapshotid,
+    contextchanged: before.windowid !== after.windowid || before.tabid !== after.tabid || before.frameid !== after.frameid,
+    added: after.elements.filter((element) => !oldmap.has(element.ref)),
+    removed: before.elements.filter((element) => !newmap.has(element.ref)),
+    changed: after.elements.filter((element) => oldmap.has(element.ref) && JSON.stringify(oldmap.get(element.ref)) !== JSON.stringify(element))
+  };
+}
+
 function assertserializable(value) {
   try { JSON.stringify(value); } catch (error) { throw new TypeError(`extension message is not serializable: ${error.message}`); }
 }

package/extension/serviceworker.js

@@ -60,7 +60,8 @@ export function createworkerrouter(options = {}) {
   async function dispatch(request, sender = {}) {
     const tabid = request.payload?.tabid ?? sender.tab?.id;
     await ensurecontent(tabid);
-    return tabs.sendMessage(tabid, request);
+    const response = await tabs.sendMessage(tabid, request);
+    return decorate(response, sender, tabid);
   }
 
   async function handle(message, sender = {}) {
@@ -70,7 +71,7 @@ export function createworkerrouter(options = {}) {
     await enqueue(request, { ...sender, tab: { ...sender.tab, id: tabid } });
     try {
       const response = await dispatch(request, { ...sender, tab: { ...sender.tab, id: tabid } });
-      await complete(request.id, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, updatedat: Date.now() } : { updatedat: Date.now() });
+    await complete(request.id, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, frameid: response.payload.frameid, windowid: response.payload.windowid, updatedat: Date.now() } : { updatedat: Date.now() });
       return response;
     } catch (error) {
       await markfailure(request.id, error);
@@ -85,8 +86,8 @@ export function createworkerrouter(options = {}) {
     const pending = state.pending.find((item) => item.requestid === requestid);
     if (!pending) throw extensionerror("PENDING_NOT_FOUND", `pending command not found: ${requestid}`);
     const tabid = pending.tabid ?? sender.tab?.id;
-    const response = await dispatch(pending.message, { ...sender, tab: { ...sender.tab, id: tabid } });
-    await complete(requestid, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, updatedat: Date.now() } : { updatedat: Date.now() });
+    const response = await dispatch(pending.message, { ...sender, frameId: pending.frameid ?? sender.frameId, tab: { ...sender.tab, id: tabid, windowId: pending.windowid ?? sender.tab?.windowId } });
+    await complete(requestid, response?.type === "response" && response.payload?.snapshotid ? { tabid, snapshotid: response.payload.snapshotid, frameid: response.payload.frameid, windowid: response.payload.windowid, updatedat: Date.now() } : { updatedat: Date.now() });
     return response;
   }
 
@@ -95,7 +96,13 @@ export function createworkerrouter(options = {}) {
   return { ensurecontent, readstate, savestate, rehydrate, enqueue, resume, cancel, handle };
 }
 
-function pendingrecord(request, sender = {}) { return { requestid: request.id, command: request.command, message: request, tabid: request.payload?.tabid ?? sender.tab?.id, attempts: 0, createdat: Date.now(), updatedat: Date.now() }; }
+function pendingrecord(request, sender = {}) { return { requestid: request.id, command: request.command, message: request, tabid: request.payload?.tabid ?? sender.tab?.id, frameid: request.payload?.frameid ?? sender.frameId, windowid: request.payload?.windowid ?? sender.tab?.windowId, attempts: 0, createdat: Date.now(), updatedat: Date.now() }; }
+
+function decorate(response, sender, tabid) {
+  if (response?.type !== "response" || !response.payload || typeof response.payload !== "object" || !response.payload.snapshotid) return response;
+  const payload = { ...response.payload, tabid: response.payload.tabid ?? (tabid === undefined ? undefined : String(tabid)), frameid: response.payload.frameid ?? (sender.frameId === undefined ? undefined : String(sender.frameId)), windowid: response.payload.windowid ?? (sender.tab?.windowId === undefined ? undefined : String(sender.tab.windowId)) };
+  return { ...response, payload };
+}
 
 function validpending(value) { return Boolean(value && typeof value === "object" && typeof value.requestid === "string" && value.message && value.message.type === "command" && Number.isSafeInteger(value.attempts) && value.attempts >= 0); }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "description": "binary computing engine that turns distributed storage into a publishable working set",
   "type": "module",
   "private": false,
@@ -11,15 +11,39 @@
   "module": "./index.js",
   "browser": "./index.js",
   "packageManager": "npm@12.0.2",
-  "publishConfig": { "access": "public" },
-  "repository": { "type": "git", "url": "https://github.com/wenathlan/saddle.git" },
-  "bugs": { "url": "https://github.com/wenathlan/saddle/issues" },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/wenathlan/saddle.git"
+  },
+  "bugs": {
+    "url": "https://github.com/wenathlan/saddle/issues"
+  },
   "homepage": "https://github.com/wenathlan/saddle#readme",
-  "keywords": ["distributed computing", "virtual memory", "runner", "storage", "automation"],
-  "engines": { "node": ">=26.7.0", "npm": ">=10.9.2" },
-  "peerDependencies": { "playwright": "^1.62.1" },
-  "peerDependenciesMeta": { "playwright": { "optional": true } },
-  "bin": { "saddle": "./cli/main.js" },
+  "keywords": [
+    "distributed computing",
+    "virtual memory",
+    "runner",
+    "storage",
+    "automation"
+  ],
+  "engines": {
+    "node": ">=26.7.0",
+    "npm": ">=10.9.2"
+  },
+  "peerDependencies": {
+    "playwright": "^1.62.1"
+  },
+  "peerDependenciesMeta": {
+    "playwright": {
+      "optional": true
+    }
+  },
+  "bin": {
+    "saddle": "./cli/main.js"
+  },
   "exports": {
     ".": "./index.js",
     "./memory": "./memory/bridge.js",
@@ -43,16 +67,136 @@
     "./queue-persistent": "./queue/persistent.js",
     "./captcha-evidence": "./captcha/evidence.js",
     "./hash": "./core/hash.js",
+    "./release-assets": "./release/assets.js",
     "./worker": "./runtime/worker.js"
   },
-  "files": ["core", "domain", "memory", "runners", "runtime", "storage", "sessions", "modes", "adapters", "persistence", "queue", "dispatch", "scrape", "crawl", "api", "mcp", "browser", "proxy", "captcha", "ai", "webhook", "surfaces", "library", "errors", "retry", "server", "binary", "format", "packager", "bot", "protocol", "workflow", "cli", "extension", "index.js", "docs", "examples", "README.md", "LICENSE"],
+  "files": [
+    "core",
+    "domain",
+    "memory",
+    "runners",
+    "runtime",
+    "storage",
+    "sessions",
+    "modes",
+    "adapters",
+    "persistence",
+    "queue",
+    "dispatch",
+    "scrape",
+    "crawl",
+    "api",
+    "mcp",
+    "browser",
+    "proxy",
+    "captcha",
+    "ai",
+    "webhook",
+    "surfaces",
+    "library",
+    "errors",
+    "retry",
+    "server",
+    "binary",
+    "format",
+    "packager",
+    "bot",
+    "protocol",
+    "workflow",
+    "cli",
+    "extension",
+    "release",
+    "index.js",
+    "docs",
+    "examples",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
-    "check": "node --check index.js && node --check runtime/engine.js && node --check cli/main.js && node --check extension/protocol.js && node --check extension/serviceworker.js && node --check extension/worker.js && node --check extension/content.js && node --check extension/popup.js && node --check extension/permissions.js && node --check extension/build.js && node --check sessions/replay.js && node --check browser/recorder.js && node --check scrape/normalize.js",
+    "check": "node --check index.js && node --check runtime/engine.js && node --check cli/main.js && node --check extension/protocol.js && node --check extension/serviceworker.js && node --check extension/worker.js && node --check extension/content.js && node --check extension/pagebridge.js && node --check extension/popup.js && node --check extension/permissions.js && node --check extension/build.js && node --check release/assets.js && node --check sessions/replay.js && node --check browser/recorder.js && node --check scrape/normalize.js",
     "formatcheck": "node format/check.js",
     "test": "node --test tests/*.test.js",
     "run": "node cli/main.js",
     "extension:build": "node extension/build.js",
+    "release:assets": "node release/assets.js",
     "pack:check": "npm run check && npm run formatcheck && npm test && npm pack --dry-run",
-    "prepublishOnly": "npm run pack:check"
+    "prepublishOnly": "npm run pack:check",
+    "web:dev": "vite --config web/vite.config.ts --host",
+    "web:check": "tsc --project web/tsconfig.json --noEmit",
+    "web:build": "vite build --config web/vite.config.ts",
+    "web:build:pages": "vite build --config web/vite.config.ts"
+  },
+  "devDependencies": {
+    "@hookform/resolvers": "^5.2.2",
+    "@radix-ui/react-accordion": "^1.2.12",
+    "@radix-ui/react-alert-dialog": "^1.1.15",
+    "@radix-ui/react-aspect-ratio": "^1.1.7",
+    "@radix-ui/react-avatar": "^1.1.10",
+    "@radix-ui/react-checkbox": "^1.3.3",
+    "@radix-ui/react-collapsible": "^1.1.12",
+    "@radix-ui/react-context-menu": "^2.2.16",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-hover-card": "^1.1.15",
+    "@radix-ui/react-label": "^2.1.7",
+    "@radix-ui/react-menubar": "^1.1.16",
+    "@radix-ui/react-navigation-menu": "^1.2.14",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-progress": "^1.1.7",
+    "@radix-ui/react-radio-group": "^1.3.8",
+    "@radix-ui/react-scroll-area": "^1.2.10",
+    "@radix-ui/react-select": "^2.2.6",
+    "@radix-ui/react-separator": "^1.1.7",
+    "@radix-ui/react-slider": "^1.3.6",
+    "@radix-ui/react-slot": "^1.2.3",
+    "@radix-ui/react-switch": "^1.2.6",
+    "@radix-ui/react-tabs": "^1.1.13",
+    "@radix-ui/react-toggle": "^1.1.10",
+    "@radix-ui/react-toggle-group": "^1.1.11",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "axios": "^1.12.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "embla-carousel-react": "^8.6.0",
+    "express": "^4.21.2",
+    "framer-motion": "^12.23.22",
+    "input-otp": "^1.4.2",
+    "lucide-react": "^0.453.0",
+    "nanoid": "^5.1.5",
+    "next-themes": "^0.4.6",
+    "react": "^19.2.1",
+    "react-day-picker": "^9.11.1",
+    "react-dom": "^19.2.1",
+    "react-hook-form": "^7.64.0",
+    "react-resizable-panels": "^3.0.6",
+    "recharts": "^2.15.2",
+    "sonner": "^2.0.7",
+    "streamdown": "^1.4.0",
+    "tailwind-merge": "^3.3.1",
+    "tailwindcss-animate": "^1.0.7",
+    "vaul": "^1.1.2",
+    "wouter": "^3.3.5",
+    "zod": "^4.1.12",
+    "@tailwindcss/typography": "^0.5.15",
+    "@tailwindcss/vite": "^4.1.3",
+    "@types/express": "4.17.21",
+    "@types/google.maps": "^3.58.1",
+    "@types/node": "^24.7.0",
+    "@types/react": "^19.2.1",
+    "@types/react-dom": "^19.2.1",
+    "@vitejs/plugin-react": "^5.0.4",
+    "add": "^2.0.6",
+    "autoprefixer": "^10.4.20",
+    "esbuild": "^0.25.0",
+    "postcss": "^8.4.47",
+    "prettier": "^3.6.2",
+    "tailwindcss": "^4.1.14",
+    "tsx": "^4.19.1",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "5.6.3",
+    "vite": "^7.1.7",
+    "vite-plugin-manus-runtime": "^0.0.58",
+    "vitest": "^4.1.10"
   }
 }

package/release/assets.js

@@ -0,0 +1,70 @@
+/**
+ * release assets create deterministic checksums, SBOM data and provenance statements.
+ * The adapter reads caller-selected artifacts and never publishes or handles credentials.
+ */
+
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const rootpath = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/** Builds deterministic release metadata files for caller-selected artifacts. */
+export async function createassets(options = {}) {
+  const packagefile = resolve(options.packagefile ?? join(rootpath, "package.json"));
+  const lockfile = resolve(options.lockfile ?? join(rootpath, "package-lock.json"));
+  const output = resolve(options.output ?? join(rootpath, "build", "release"));
+  const artifactroot = resolve(options.artifactroot ?? rootpath);
+  const packagejson = JSON.parse(await readFile(packagefile, "utf8"));
+  const lockjson = JSON.parse(await readFile(lockfile, "utf8"));
+  const artifacts = [...new Set((options.artifacts ?? []).map((artifact) => resolve(String(artifact))))].sort();
+  const subjects = await Promise.all(artifacts.map(async (artifact) => ({ name: relative(artifactroot, artifact).replaceAll("\\", "/"), digest: await sha256(artifact) })));
+  await mkdir(output, { recursive: true });
+  const checksums = `${subjects.map((subject) => `${subject.digest}  ${subject.name}`).join("\n")}${subjects.length ? "\n" : ""}`;
+  const sbom = createsbom(packagejson, lockjson);
+  const provenance = createprovenance(packagejson, subjects, options);
+  const files = { checksums: join(output, "SHA256SUMS"), sbom: join(output, "sbom.cdx.json"), provenance: join(output, "provenance.intoto.jsonl") };
+  await writeFile(files.checksums, checksums);
+  await writeFile(files.sbom, `${JSON.stringify(sbom, null, 2)}\n`);
+  await writeFile(files.provenance, `${JSON.stringify(provenance)}\n`);
+  return { output, files, subjects, sbom, provenance };
+}
+
+/** Creates a compact CycloneDX component list from the root lockfile dependencies. */
+export function createsbom(packagejson, lockjson = {}) {
+  const root = lockjson.packages?.[""] ?? {};
+  const dependencies = { ...(root.dependencies ?? {}), ...(root.devDependencies ?? {}) };
+  const components = Object.keys(dependencies).map((name) => {
+    const entry = lockjson.packages?.[`node_modules/${name}`] ?? {};
+    const version = String(entry.version ?? dependencies[name]).replace(/^[^0-9]*/, "");
+    return { "bom-ref": `pkg:npm/${name}@${version}`, name, version, purl: `pkg:npm/${name}@${version}`, scope: root.devDependencies?.[name] ? "optional" : "required", type: "library" };
+  }).sort((left, right) => left.name.localeCompare(right.name));
+  return { bomFormat: "CycloneDX", specVersion: "1.5", serialNumber: `urn:uuid:${stableuuid(`${packagejson.name}@${packagejson.version}`)}`, version: 1, metadata: { component: { type: "application", name: String(packagejson.name), version: String(packagejson.version) } }, components };
+}
+
+/** Creates an in-toto statement whose subjects are the caller-selected release artifacts. */
+export function createprovenance(packagejson, subjects = [], options = {}) {
+  const normalized = subjects.map((subject) => ({ name: String(subject.name), digest: { sha256: String(subject.digest) } })).sort((left, right) => left.name.localeCompare(right.name));
+  return { _type: "https://in-toto.io/Statement/v1", subject: normalized, predicateType: "https://slsa.dev/provenance/v1", predicate: { buildDefinition: { buildType: String(options.buildtype ?? "caller-defined"), externalParameters: { package: String(packagejson.name), version: String(options.version ?? packagejson.version) }, internalParameters: {} }, runDetails: { builder: { id: String(options.builder ?? "caller-defined") }, metadata: { invocationId: stableuuid(`${packagejson.name}@${options.version ?? packagejson.version}:${normalized.map((subject) => subject.name).join(",")}`) } } } };
+}
+
+async function sha256(path) { const hash = createHash("sha256"); hash.update(await readFile(path)); return hash.digest("hex"); }
+
+function stableuuid(value) { const hex = createHash("sha256").update(String(value)).digest("hex").slice(0, 32); return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${(8 + (Number.parseInt(hex.slice(16, 17), 16) % 4).toString(16))}${hex.slice(17, 20)}-${hex.slice(20)}`; }
+
+function parsearguments(argumentslist) {
+  const options = { artifacts: [] };
+  for (let index = 0; index < argumentslist.length; index += 1) {
+    const argument = argumentslist[index];
+    if (argument === "--output") options.output = argumentslist[++index];
+    else if (argument === "--version") options.version = argumentslist[++index];
+    else if (argument === "--artifact") options.artifacts.push(argumentslist[++index]);
+    else if (argument === "--build-type") options.buildtype = argumentslist[++index];
+    else if (argument === "--builder") options.builder = argumentslist[++index];
+    else throw new TypeError(`unsupported release asset argument: ${argument}`);
+  }
+  return options;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) createassets(parsearguments(process.argv.slice(2))).then(({ output }) => { console.log(`release assets: ${output}`); }).catch((error) => { console.error(error.message); process.exitCode = 1; });

package/readme.txt

@@ -1,163 +0,0 @@
-                    SADDLE - README
-                       Version 1.0, August 2026
-
- Copyright (C) August 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris
- Everyone is permitted to view this document, but changing it
- is not allowed. This document is part of Project saddle.
-
-                            Preamble
-
-  Project saddle unifies both README sources.
-
-  Saddle is a JavaScript ESM engine for jobs that move data between storage,
-  a working set, an injected runner and durable artifacts. It includes
-  contracts for scraping, crawling, browser agents, queues, persistence,
-  MCP transport, webhooks and package delivery.
-
-  Core thesis: storage bytes and compute-memory bytes are the same bytes.
-  A Node.js framework runs on other people's runners, loading storage
-  buckets as virtual RAM/GPU via storage->RAM bridge.
-
-  This README is the single source of truth combining Foundation, Engine,
-  and Productization sections from both original READMEs.
-
-                       TERMS AND CONDITIONS
-
-  0. Overview.
-
-  See full readme.md for complete documentation, API, execution model,
-  CLI, security boundaries, package surfaces, development, and repository
-  map.
-
-  1. What is Included.
-
-  Jobs, Storage, Working set, Scraping, Crawl, Browser, Operations,
-  Protocols, Delivery, Agent Browser, Compute Backends, Storage Backends.
-
-  2. License.
-
-  Proprietary - View Only. See license.txt.
-
-                     END OF TERMS AND CONDITIONS
-
-
-# Saddle
-
-<p align="center">
-  <img src="docs/assets/saddlemark.svg" alt="Saddle" width="720" />
-</p>
-
-<p align="center">
-  <strong>Storage-backed jobs, scraping contracts and portable runners for Node.js.</strong><br/>
-  <strong>Binary computing agent, agent browser, computer-use, scraper and packager.</strong><br/>
-  <a href="https://github.com/wenathlan/saddle/actions/workflows/ci.yml"><img src="https://github.com/wenathlan/saddle/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
-  <a href="https://github.com/wenathlan/saddle/releases/tag/v1.8.2"><img src="https://img.shields.io/badge/release-v1.8.2-d35d3d" alt="Release 1.8.2" /></a>
-  <a href="https://github.com/wenathlan/saddle/blob/main/license.md"><img src="https://img.shields.io/badge/license-Proprietary--View--Only-202a2f" alt="Proprietary View Only" /></a>
-</p>
-
-> **Core idea:** storage is the durable side of the working set; the runner is replaceable; the artifact is the boundary. **Storage == Compute** — RAM and disk are the same construct, differing only by usage flag.
-
-Saddle is a **JavaScript ESM engine** for jobs that move data between storage, a working set, an injected runner and durable artifacts. It is also a **virtual machine you publish as a package** that runs on other people's computers (GitHub Actions, Forgejo, Gitea, GitLab, Codeberg, free Docker containers) and turns unlimited third-party storage buckets into virtual RAM/GPU/CPU. Nothing runs on the operator's local machine.
-
-Ships as a library, CLI, binary, n8n node, CRX extension, Android/iOS and Tauri desktop app. The canonical JavaScript package is `@wenathlan/saddle`; GitHub Packages npm, Maven and GHCR use the transferred `wenathlan` owner namespace, while NuGet and RubyGems retain their unscoped ecosystem package names.
-
-## Start here
-
-Saddle requires **Node.js 22 or newer**.
-
-```bash
-npm install @wenathlan/saddle
-```
-
-```js
-import { scrapeurl, formatforagent } from "@wenathlan/saddle";
-
-const result = await scrapeurl("https://example.com", { format: "markdown" });
-const context = formatforagent(result, { maxchunksize: 2000, keypoints: 4 });
-
-console.log(context.summary);
-```
-
-Deterministic example with no network:
-
-```bash
-node examples/publicapi.js
-```
-
-## What is included
-
-| Area | Contract | Result |
-| --- | --- | --- |
-| Jobs | `engine`, `scheduler`, `inprocess` | `prepare → process → sync → cleanup` |
-| Storage | local, chunked, S3-compatible, GitHub Contents, file hosting | durable objects and chunks |
-| Working set | memory bridge, modes, objects, transforms | storage-to-compute and compute-to-storage |
-| Scraping | robots, cache, extraction, schema, scraper | text, metadata, links and structured output |
-| Crawl | normalization, BFS crawler, persistent frontier | bounded domain-aware crawling |
-| Browser | fingerprint, session, replay and injected agent | browser actions without vendor lock-in |
-| Operations | queues, idempotency, saga, retry, circuit breaker | controlled execution and recovery |
-| Protocols | JSON, NDJSON, SSE, blocks and MCP | transport-neutral messages |
-| Delivery | manifests, workflow registry, binary/container plans | package and runner surfaces |
-| Agent Browser | capture & replay, stealth, fingerprint | Brave capture, movement replay, session recording |
-| Compute Backends | github-actions, huggingface, gitlab-ci, kaggle, oracle-cloud | free runners chain |
-| Storage Backends | HF, Kaggle, Terabox, R2, Telegram, Discord via rclone | unlimited disk as RAM |
-
-## Public API
-
-| Export | Purpose |
-| --- | --- |
-| `saddleurl` | choose fetch or injected browser path |
-| `scrapeurl` | fetch one URL and extract |
-| `scrapehtml` | extract from HTML without network |
-| `extractcontent` | structured extraction |
-| `serializeresult` | serialize as JSON, Markdown, XML |
-| `formatforagent` | summary, chunks, token count |
-| `batchscrape` | bounded URL groups |
-| `crawlurl` | crawl contract |
-| `browseragent` | navigation, click, type, screenshot |
-| `mcpserver` / `mcptransport` | MCP tools over JSONL/HTTP |
-| `nodeserver` | Web Request/Response handler |
-
-Complete API: `docs/libraryapi.md`
-
-## The execution model
-
-Saddle coordinates contracts instead of hiding providers. A repo + CI runner is a virtual processor:
-
-- Repo = Disk (persistent state)
-- CI = CPU (workflow_dispatch = function call)
-- Pages = Bus + CDN
-- Static site = BIOS
-- repository_dispatch = IPC
-
-```js
-import { engine, eventbus, inprocess, localmemory, localstorage, scheduler } from "@wenathlan/saddle";
-const events = eventbus();
-const run = engine({
-  storage: localstorage("./.saddle-data"),
-  memory: localmemory(),
-  scheduler: scheduler([inprocess()]),
-  events
-});
-const result = await run.run(
-  { name: "example", input: { value: 42 } },
-  ({ job }) => ({ jobid: job.id, ok: true })
-);
-```
-
-## CLI
-
-```bash
-saddle help
-saddle modes
-saddle runexample
-saddle mcp
-saddle capture --url <url>
-saddle bot --platform github --token $SBOT_TOKEN
-saddle memory --load repo://owner/repo/path/file.json
-saddle deploy --target netlify
-```
-
-## Security boundaries
-
-| Boundary | Policy |
-| --- | --- |