brave-mcp 0.1.0

package/build/src/telemetry/watchdog/ClearcutSender.js

@@ -0,0 +1,203 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import crypto from 'node:crypto';
+import { logger } from '../../logger.js';
+const MAX_BUFFER_SIZE = 1000;
+const DEFAULT_CLEARCUT_ENDPOINT = 'https://play.googleapis.com/log?format=json_proto';
+const DEFAULT_FLUSH_INTERVAL_MS = 15 * 60 * 1000;
+const LOG_SOURCE = 2839;
+const CLIENT_TYPE = 47;
+const MIN_RATE_LIMIT_WAIT_MS = 30_000;
+const REQUEST_TIMEOUT_MS = 30_000;
+const SHUTDOWN_TIMEOUT_MS = 5_000;
+const SESSION_ROTATION_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export class ClearcutSender {
+    #appVersion;
+    #osType;
+    #clearcutEndpoint;
+    #flushIntervalMs;
+    #includePidHeader;
+    #sessionId;
+    #sessionCreated;
+    #buffer = [];
+    #flushTimer = null;
+    #isFlushing = false;
+    #timerStarted = false;
+    constructor(config) {
+        this.#appVersion = config.appVersion;
+        this.#osType = config.osType;
+        this.#clearcutEndpoint =
+            config.clearcutEndpoint ?? DEFAULT_CLEARCUT_ENDPOINT;
+        this.#flushIntervalMs =
+            config.forceFlushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS;
+        this.#includePidHeader = config.includePidHeader ?? false;
+        this.#sessionId = crypto.randomUUID();
+        this.#sessionCreated = Date.now();
+    }
+    enqueueEvent(event) {
+        if (Date.now() - this.#sessionCreated > SESSION_ROTATION_INTERVAL_MS) {
+            this.#sessionId = crypto.randomUUID();
+            this.#sessionCreated = Date.now();
+        }
+        logger('Enqueing telemetry event', JSON.stringify(event, null, 2));
+        this.#addToBuffer({
+            ...event,
+            session_id: this.#sessionId,
+            app_version: this.#appVersion,
+            os_type: this.#osType,
+        });
+        if (!this.#timerStarted) {
+            this.#timerStarted = true;
+            this.#scheduleFlush(this.#flushIntervalMs);
+        }
+    }
+    async sendShutdownEvent() {
+        if (this.#flushTimer) {
+            clearTimeout(this.#flushTimer);
+            this.#flushTimer = null;
+        }
+        const shutdownEvent = {
+            server_shutdown: {},
+        };
+        this.enqueueEvent(shutdownEvent);
+        try {
+            await Promise.race([
+                this.#finalFlush(),
+                new Promise(resolve => setTimeout(resolve, SHUTDOWN_TIMEOUT_MS)),
+            ]);
+            logger('Final flush completed');
+        }
+        catch (error) {
+            logger('Final flush failed:', error);
+        }
+    }
+    async #flush() {
+        if (this.#isFlushing) {
+            return;
+        }
+        if (this.#buffer.length === 0) {
+            this.#scheduleFlush(this.#flushIntervalMs);
+            return;
+        }
+        this.#isFlushing = true;
+        let nextDelayMs = this.#flushIntervalMs;
+        // Optimistically remove events from buffer before sending.
+        // This prevents race conditions where a simultaneous #finalFlush would include these same events.
+        const eventsToSend = [...this.#buffer];
+        this.#buffer = [];
+        try {
+            const result = await this.#sendBatch(eventsToSend);
+            if (result.success) {
+                if (result.nextRequestWaitMs !== undefined) {
+                    nextDelayMs = Math.max(result.nextRequestWaitMs, MIN_RATE_LIMIT_WAIT_MS);
+                }
+            }
+            else if (result.isPermanentError) {
+                logger('Permanent error, dropped batch of', eventsToSend.length, 'events');
+            }
+            else {
+                // Transient error: Requeue events at the front of the buffer
+                // to maintain order and retry them later.
+                this.#buffer = [...eventsToSend, ...this.#buffer];
+            }
+        }
+        catch (error) {
+            // Safety catch for unexpected errors, requeue events
+            this.#buffer = [...eventsToSend, ...this.#buffer];
+            logger('Flush failed unexpectedly:', error);
+        }
+        finally {
+            this.#isFlushing = false;
+            this.#scheduleFlush(nextDelayMs);
+        }
+    }
+    #addToBuffer(event) {
+        if (this.#buffer.length >= MAX_BUFFER_SIZE) {
+            this.#buffer.shift();
+            logger('Telemetry buffer overflow: dropped oldest event');
+        }
+        this.#buffer.push({
+            event,
+            timestamp: Date.now(),
+        });
+    }
+    #scheduleFlush(delayMs) {
+        logger(`Scheduling flush in ${delayMs}`);
+        if (this.#flushTimer) {
+            clearTimeout(this.#flushTimer);
+        }
+        this.#flushTimer = setTimeout(() => {
+            this.#flush().catch(err => {
+                logger('Flush error:', err);
+            });
+        }, delayMs);
+    }
+    async #sendBatch(events) {
+        logger(`Sending batch of ${events.length}`);
+        const requestBody = {
+            log_source: LOG_SOURCE,
+            request_time_ms: Date.now().toString(),
+            client_info: {
+                client_type: CLIENT_TYPE,
+            },
+            log_event: events.map(({ event, timestamp }) => ({
+                event_time_ms: timestamp.toString(),
+                source_extension_json: JSON.stringify(event),
+            })),
+        };
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+        try {
+            const response = await fetch(this.#clearcutEndpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    // Used in E2E tests to confirm that the watchdog process is killed
+                    ...(this.#includePidHeader
+                        ? { 'X-Watchdog-Pid': process.pid.toString() }
+                        : {}),
+                },
+                body: JSON.stringify(requestBody),
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            if (response.ok) {
+                const data = (await response.json());
+                return {
+                    success: true,
+                    nextRequestWaitMs: data.next_request_wait_millis,
+                };
+            }
+            const status = response.status;
+            if (status >= 500 || status === 429) {
+                return { success: false };
+            }
+            logger('Telemetry permanent error:', status);
+            return { success: false, isPermanentError: true };
+        }
+        catch {
+            clearTimeout(timeoutId);
+            return { success: false };
+        }
+    }
+    async #finalFlush() {
+        if (this.#buffer.length === 0) {
+            return;
+        }
+        const eventsToSend = [...this.#buffer];
+        await this.#sendBatch(eventsToSend);
+    }
+    stopForTesting() {
+        if (this.#flushTimer) {
+            clearTimeout(this.#flushTimer);
+            this.#flushTimer = null;
+        }
+        this.#timerStarted = false;
+    }
+    get bufferSizeForTesting() {
+        return this.#buffer.length;
+    }
+}

package/build/src/telemetry/watchdog/main.js

@@ -0,0 +1,127 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import process from 'node:process';
+import readline from 'node:readline';
+import { parseArgs } from 'node:util';
+import { logger, flushLogs, saveLogsToFile } from '../../logger.js';
+import { WatchdogMessageType } from '../types.js';
+import { ClearcutSender } from './ClearcutSender.js';
+function parseWatchdogArgs() {
+    const { values } = parseArgs({
+        options: {
+            'parent-pid': { type: 'string' },
+            'app-version': { type: 'string' },
+            'os-type': { type: 'string' },
+            'log-file': { type: 'string' },
+            'clearcut-endpoint': { type: 'string' },
+            'clearcut-force-flush-interval-ms': { type: 'string' },
+            'clearcut-include-pid-header': { type: 'boolean' },
+        },
+        strict: true,
+    });
+    // Verify required arguments
+    const parentPid = parseInt(values['parent-pid'] ?? '', 10);
+    const appVersion = values['app-version'];
+    const osType = parseInt(values['os-type'] ?? '', 10);
+    if (isNaN(parentPid) || !appVersion || isNaN(osType)) {
+        console.error('Invalid arguments provided for watchdog process: ', JSON.stringify({ parentPid, appVersion, osType }));
+        process.exit(1);
+    }
+    // Parse Optional Arguments
+    const logFile = values['log-file'];
+    const clearcutEndpoint = values['clearcut-endpoint'];
+    const clearcutIncludePidHeader = values['clearcut-include-pid-header'];
+    let clearcutForceFlushIntervalMs;
+    if (values['clearcut-force-flush-interval-ms']) {
+        const parsed = parseInt(values['clearcut-force-flush-interval-ms'], 10);
+        if (!isNaN(parsed)) {
+            clearcutForceFlushIntervalMs = parsed;
+        }
+    }
+    return {
+        parentPid,
+        appVersion,
+        osType,
+        logFile,
+        clearcutEndpoint,
+        clearcutForceFlushIntervalMs,
+        clearcutIncludePidHeader,
+    };
+}
+function main() {
+    const { parentPid, appVersion, osType, logFile, clearcutEndpoint, clearcutForceFlushIntervalMs, clearcutIncludePidHeader, } = parseWatchdogArgs();
+    let logStream;
+    if (logFile) {
+        logStream = saveLogsToFile(logFile);
+    }
+    const exit = (code) => {
+        if (!logStream) {
+            process.exit(code);
+        }
+        void flushLogs(logStream).finally(() => {
+            process.exit(code);
+        });
+    };
+    logger('Watchdog started', JSON.stringify({
+        pid: process.pid,
+        parentPid,
+        version: appVersion,
+        osType,
+    }, null, 2));
+    const sender = new ClearcutSender({
+        appVersion,
+        osType: osType,
+        clearcutEndpoint,
+        forceFlushIntervalMs: clearcutForceFlushIntervalMs,
+        includePidHeader: clearcutIncludePidHeader,
+    });
+    let isShuttingDown = false;
+    function onParentDeath(reason) {
+        if (isShuttingDown) {
+            return;
+        }
+        isShuttingDown = true;
+        logger(`Parent death detected (${reason}). Sending shutdown event...`);
+        sender
+            .sendShutdownEvent()
+            .then(() => {
+            logger('Shutdown event sent. Exiting.');
+            exit(0);
+        })
+            .catch(err => {
+            logger('Failed to send shutdown event', err);
+            exit(1);
+        });
+    }
+    process.stdin.on('end', () => onParentDeath('stdin end'));
+    process.stdin.on('close', () => onParentDeath('stdin close'));
+    process.on('disconnect', () => onParentDeath('ipc disconnect'));
+    const rl = readline.createInterface({
+        input: process.stdin,
+        terminal: false,
+    });
+    rl.on('line', line => {
+        try {
+            if (!line.trim()) {
+                return;
+            }
+            const msg = JSON.parse(line);
+            if (msg.type === WatchdogMessageType.LOG_EVENT && msg.payload) {
+                sender.enqueueEvent(msg.payload);
+            }
+        }
+        catch (err) {
+            logger('Failed to parse IPC message', err);
+        }
+    });
+}
+try {
+    main();
+}
+catch (err) {
+    console.error('Watchdog fatal error:', err);
+    process.exit(1);
+}

package/build/src/third_party/devtools-formatter-worker.js

@@ -0,0 +1,7 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// eslint-disable-next-line no-restricted-imports
+import '../../node_modules/chrome-devtools-frontend/front_end/entrypoints/formatter_worker/formatter_worker-entrypoint.js';

package/build/src/third_party/index.js

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import 'core-js/modules/es.promise.with-resolvers.js';
+import 'core-js/modules/es.set.union.v2.js';
+import 'core-js/proposals/iterator-helpers.js';
+export { default as yargs } from 'yargs';
+export { hideBin } from 'yargs/helpers';
+export { default as debug } from 'debug';
+export { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+export { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+export { Client } from '@modelcontextprotocol/sdk/client/index.js';
+export { SetLevelRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+export { z as zod } from 'zod';
+export { default as ajv } from 'ajv';
+export { Locator, PredefinedNetworkConditions, KnownDevices, CDPSessionEvent, } from 'puppeteer-core';
+export { default as puppeteer } from 'puppeteer-core';
+export { PipeTransport } from 'puppeteer-core/internal/node/PipeTransport.js';
+export { resolveDefaultUserDataDir, detectBrowserPlatform, Browser as BrowserEnum, } from '@puppeteer/browsers';
+import { snapshot as snapshotImpl, navigation as navigationImpl, generateReport as generateReportImpl, } from './lighthouse-devtools-mcp-bundle.js';
+export const snapshot = snapshotImpl;
+export const navigation = navigationImpl;
+export const generateReport = generateReportImpl;
+import * as DevTools_1 from '../../node_modules/chrome-devtools-frontend/mcp/mcp.js';
+export { DevTools_1 as DevTools };

package/build/src/third_party/issue-descriptions/CoepCoopSandboxedIframeCannotNavigateToCoopPage.md

@@ -0,0 +1,4 @@
+# An iframe navigation to a document with a Cross-Origin Opener Policy was blocked
+
+A document with a Cross-Origin Opener Policy (COOP) was blocked from loading in an iframe, because the iframe specifies a sandbox attribute.
+This protects COOP-enabled documents from inheriting properties from its opener.

package/build/src/third_party/issue-descriptions/CoepCorpNotSameOrigin.md

@@ -0,0 +1,8 @@
+# Specify a more permissive Cross-Origin Resource Policy to prevent a resource from being blocked
+
+Your site tries to access an external resource that only allows same-origin usage.
+This behavior prevents a document from loading any non-same-origin resources which don’t explicitly grant permission to be loaded.
+
+To solve this, add the following to the resource’s HTML response header:
+* `Cross-Origin-Resource-Policy: same-site` if the resource and your site are served from the same site.
+* `Cross-Origin-Resource-Policy: cross-origin` if the resource is served from another location than your website. ⚠️If you set this header, any website can embed this resource.

package/build/src/third_party/issue-descriptions/CoepCorpNotSameOriginAfterDefaultedToSameOriginByCoep.md

@@ -0,0 +1,18 @@
+# Specify a Cross-Origin Resource Policy to prevent a resource from being blocked
+
+Because your site has the Cross-Origin Embedder Policy (COEP) enabled, each
+resource must specify a suitable Cross-Origin Resource Policy (CORP). This
+behavior prevents a document from loading cross-origin resources which don’t
+explicitly grant permission to be loaded.
+
+To solve this, add the following to the resource’ response header:
+* `Cross-Origin-Resource-Policy: same-site` if the resource and your site are
+  served from the same site.
+* `Cross-Origin-Resource-Policy: cross-origin` if the resource is served from
+  another location than your website. ⚠️If you set this header, any website can
+  embed this resource.
+
+Alternatively, the document can use the variant: `Cross-Origin-Embedder-Policy:
+credentialless` instead of `require-corp`. It allows loading the resource,
+despite the missing CORP header, at the cost of requesting it without
+credentials like Cookies.

package/build/src/third_party/issue-descriptions/CoepCorpNotSameSite.md

@@ -0,0 +1,7 @@
+# Specify a more permissive Cross-Origin Resource Policy to prevent a resource from being blocked
+
+Your site tries to access an external resource that only allows same-site usage.
+This behavior prevents a document from loading any non-same-site resources which don’t explicitly grant permission to be loaded.
+
+To solve this, add the following to the resource’s HTML response header: `Cross-Origin-Resource-Policy: cross-origin`
+⚠️If you set this header, any website can embed this resource.

package/build/src/third_party/issue-descriptions/CoepFrameResourceNeedsCoepHeader.md

@@ -0,0 +1,10 @@
+# Specify a Cross-Origin Embedder Policy to prevent this frame from being blocked
+
+Because your site has the Cross-Origin Embedder Policy (COEP) enabled, each
+embedded iframe must also specify this policy. This behavior protects private
+data from being exposed to untrusted third party sites.
+
+To solve this, add one of following to the embedded frame’s HTML response
+header:
+* `Cross-Origin-Embedder-Policy: require-corp`
+* `Cross-Origin-Embedder-Policy: credentialless` (Chrome > 96)

package/build/src/third_party/issue-descriptions/CompatibilityModeQuirks.md

@@ -0,0 +1,5 @@
+# Page layout may be unexpected due to Quirks Mode
+
+One or more documents in this page is in Quirks Mode, which will render the affected document(s) with quirks incompatible with the current HTML and CSS specifications.
+
+Quirks Mode exists mostly due to historical reasons. If this is not intentional, you can [add or modify the DOCTYPE to be `<!DOCTYPE html>`](issueQuirksModeDoctype) to render the page in No Quirks Mode.

package/build/src/third_party/issue-descriptions/CookieAttributeValueExceedsMaxSize.md

@@ -0,0 +1,5 @@
+# Ensure cookie attribute values don’t exceed 1024 characters
+
+Cookie attribute values exceeding 1024 characters in size will result in the attribute being ignored. This could lead to unexpected behavior since the cookie will be processed as if the offending attribute / attribute value pair were not present.
+
+Resolve this issue by ensuring that cookie attribute values don’t exceed 1024 characters.

package/build/src/third_party/issue-descriptions/LowTextContrast.md

@@ -0,0 +1,5 @@
+# Users may have difficulties reading text content due to insufficient color contrast
+
+Low-contrast text is difficult or impossible for users to read. A [minimum contrast ratio (AA) of 4.5](issuesContrastWCAG21AA) is recommended for all text. Since font size and weight affect color perception, an exception is made for very large or bold text — in this case, a contrast ratio of 3.0 is allowed. The [enhanced conformance level (AAA)](issuesContrastWCAG21AAA) requires the contrast ratio to be above 7.0 for regular text and 4.5 for large text.
+
+Update colors or change the font size or weight to achieve sufficient contrast. You can use the [“Suggest color” feature](issuesContrastSuggestColor) in the DevTools color picker to automatically select a better text color.

package/build/src/third_party/issue-descriptions/SameSiteExcludeContextDowngradeRead.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to have cookies sent to same-site subresources
+
+A cookie was not sent to {PLACEHOLDER_destination} origin from {PLACEHOLDER_origin} context.
+Because this cookie would have been sent across schemes on the same site, it was not sent.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/SameSiteExcludeContextDowngradeSet.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to allow cookies to be set by same-site subresources
+
+A cookie was not set by {PLACEHOLDER_origin} origin in {PLACEHOLDER_destination} context.
+Because this cookie would have been set across schemes on the same site, it was blocked.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/SameSiteExcludeNavigationContextDowngrade.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to have cookies sent on same-site requests
+
+A cookie was not sent to {PLACEHOLDER_destination} origin from {PLACEHOLDER_origin} context on a navigation.
+Because this cookie would have been sent across schemes on the same site, it was not sent.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureErrorRead.md

@@ -0,0 +1,8 @@
+# Mark cross-site cookies as Secure to allow them to be sent in cross-site requests
+
+Cookies marked with `SameSite=None` must also be marked with `Secure` to get sent in cross-site requests.
+This behavior protects user data from being sent over an insecure connection.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureErrorSet.md

@@ -0,0 +1,8 @@
+# Mark cross-site cookies as Secure to allow setting them in cross-site contexts
+
+Cookies marked with `SameSite=None` must also be marked with `Secure` to allow setting them in a cross-site context.
+This behavior protects user data from being sent over an insecure connection.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureWarnRead.md

@@ -0,0 +1,8 @@
+# Mark cross-site cookies as Secure to allow them to be sent in cross-site requests
+
+In a future version of the browser, cookies marked with `SameSite=None` must also be marked with `Secure` to get sent in cross-site requests.
+This behavior protects user data from being sent over an insecure connection.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteNoneInsecureWarnSet.md

@@ -0,0 +1,8 @@
+# Mark cross-site cookies as Secure to allow setting them in cross-site contexts
+
+In a future version of the browser, cookies marked with `SameSite=None` must also be marked with `Secure` to allow setting them in a cross-site context.
+This behavior protects user data from being sent over an insecure connection.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteUnspecifiedLaxAllowUnsafeRead.md

@@ -0,0 +1,9 @@
+# Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute
+
+Because a cookie’s `SameSite` attribute was not set or is invalid, it defaults to `SameSite=Lax`,
+which will prevent the cookie from being sent in a cross-site request in a future version of the browser.
+This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie should be sent in cross-site requests. This enables third-party use.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be sent in cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteUnspecifiedLaxAllowUnsafeSet.md

@@ -0,0 +1,9 @@
+# Indicate whether a cookie is intended to be set in cross-site context by specifying its SameSite attribute
+
+Because a cookie’s `SameSite` attribute was not set or is invalid, it defaults to `SameSite=Lax`,
+which will prevents the cookie from being set in a cross-site context in a future version of the browser.
+This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.
+
+Resolve this issue by updating the attributes of the cookie:
+* Specify `SameSite=None` and `Secure` if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use the `Secure` attribute.
+* Specify `SameSite=Strict` or `SameSite=Lax` if the cookie should not be set by cross-site requests.

package/build/src/third_party/issue-descriptions/SameSiteWarnCrossDowngradeRead.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to continue having cookies sent to same-site subresources
+
+A cookie is being sent to {PLACEHOLDER_destination} origin from {PLACEHOLDER_origin} context.
+Because this cookie is being sent across schemes on the same site, it will not be sent in a future version of Chrome.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/SameSiteWarnCrossDowngradeSet.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to continue allowing cookies to be set by same-site subresources
+
+A cookie is being set by {PLACEHOLDER_origin} origin in {PLACEHOLDER_destination} context.
+Because this cookie is being set across schemes on the same site, it will be blocked in a future version of Chrome.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/SameSiteWarnStrictLaxDowngradeStrict.md

@@ -0,0 +1,8 @@
+# Migrate entirely to HTTPS to continue having cookies sent on same-site requests
+
+A cookie is being sent to {PLACEHOLDER_destination} origin from {PLACEHOLDER_origin} context on a navigation.
+Because this cookie is being sent across schemes on the same site, it will not be sent in a future version of Chrome.
+This behavior enhances the `SameSite` attribute’s protection of user data from request forgery by network attackers.
+
+Resolve this issue by migrating your site (as defined by the eTLD+1) entirely to HTTPS.
+It is also recommended to mark the cookie with the `Secure` attribute if that is not already the case.

package/build/src/third_party/issue-descriptions/arInsecureContext.md

@@ -0,0 +1,7 @@
+# Ensure that the attribution registration context is secure
+
+This page tried to register a source or trigger using the Attribution Reporting
+API but failed because the page that initiated the registration was not secure.
+
+The registration context must use HTTPS unless it is `localhost` or
+`127.0.0.1`.

package/build/src/third_party/issue-descriptions/arInvalidInfoHeader.md

@@ -0,0 +1,5 @@
+# Ensure that the `Attribution-Reporting-Info` header is valid
+
+This page tried to register a source or trigger using the Attribution Reporting
+API but failed because an `Attribution-Reporting-Info` response header was
+invalid.

package/build/src/third_party/issue-descriptions/arInvalidRegisterOsSourceHeader.md

@@ -0,0 +1,5 @@
+# Ensure that the `Attribution-Reporting-Register-OS-Source` header is valid
+
+This page tried to register an OS source using the Attribution Reporting API
+but failed because an `Attribution-Reporting-Register-OS-Source` response
+header was invalid.

package/build/src/third_party/issue-descriptions/arInvalidRegisterOsTriggerHeader.md

@@ -0,0 +1,5 @@
+# Ensure that the `Attribution-Reporting-Register-OS-Trigger` header is valid
+
+This page tried to register an OS trigger using the Attribution Reporting API
+but failed because an `Attribution-Reporting-Register-OS-Trigger` response
+header was invalid.

package/build/src/third_party/issue-descriptions/arInvalidRegisterSourceHeader.md

@@ -0,0 +1,5 @@
+# Ensure that the `Attribution-Reporting-Register-Source` header is valid
+
+This page tried to register a source using the Attribution Reporting API but
+failed because an `Attribution-Reporting-Register-Source` response header was
+invalid.

package/build/src/third_party/issue-descriptions/arInvalidRegisterTriggerHeader.md

@@ -0,0 +1,5 @@
+# Ensure that the `Attribution-Reporting-Register-Trigger` header is valid
+
+This page tried to register a trigger using the Attribution Reporting API but
+failed because an `Attribution-Reporting-Register-Trigger` response header was
+invalid.

package/build/src/third_party/issue-descriptions/arNavigationRegistrationUniqueScopeAlreadySet.md

@@ -0,0 +1,5 @@
+# Ensure that multiple sources associated with the same navigation have the same attribution scopes
+
+The page tried to register a source using Attribution Reporting API, but the
+source was rejected because a previous source associated with the same
+navigation and reporting origin used a different set of attribution scopes.

package/build/src/third_party/issue-descriptions/arNavigationRegistrationWithoutTransientUserActivation.md

@@ -0,0 +1,6 @@
+# Ensure that navigation-source registrations are initiated by a user gesture
+
+This page tried to register a navigation source using the Attribution Reporting
+API but failed because the navigation was not initiated by a user gesture.
+Compared to event sources, navigation sources can release more cross-site
+information, and are therefore subject to this additional privacy control.

package/build/src/third_party/issue-descriptions/arNoRegisterOsSourceHeader.md

@@ -0,0 +1,5 @@
+# OS attribution source expected but corresponding header not found
+
+The page indicated, via the `Attribution-Reporting-Info` header, that it
+intended to register an OS source using the Attribution Reporting API, but the
+corresponding `Attribution-Reporting-Register-OS-Source` header was missing.

package/build/src/third_party/issue-descriptions/arNoRegisterOsTriggerHeader.md

@@ -0,0 +1,5 @@
+# OS attribution trigger expected but corresponding header not found
+
+The page indicated, via the `Attribution-Reporting-Info` header, that it
+intended to register an OS trigger using the Attribution Reporting API, but the
+corresponding `Attribution-Reporting-Register-OS-Trigger` header was missing.

package/build/src/third_party/issue-descriptions/arNoRegisterSourceHeader.md

@@ -0,0 +1,5 @@
+# Web attribution source expected but corresponding header not found
+
+The page indicated, via the `Attribution-Reporting-Info` header, that it
+intended to register a web source using the Attribution Reporting API, but the
+corresponding `Attribution-Reporting-Register-Source` header was missing.