rea-agents 2.4.0 → 3.0.0

package/dist/application/ApplicationWorkflowEvidenceResolver.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
-import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "../contracts/applicationWorkflowInputContracts.js";
+import { compareApplicationVersionsRequestSchema, compareJavaScriptExportShapesRequestSchema, compareSourceToBundleRequestSchema, traceApplicationFeatureRequestSchema, traceJavaScriptSemanticsRequestSchema, } from "../contracts/applicationWorkflowInputContracts.js";
 import { AnalysisInputError } from "../domain/errors.js";
 import { projectInputIssues } from "../domain/inputIssueProjection.js";
 import { compareApplicationVersionsInputSchema } from "../domain/javascriptApplicationVersionComparisonSchemas.js";
 import { compareJavaScriptExportShapesInputSchema } from "../domain/javascriptExportShapeComparisonSchemas.js";
 import { traceApplicationFeatureInputSchema } from "../domain/javascriptFeatureTraceSchemas.js";
 import { traceJavaScriptSemanticsInputSchema } from "../domain/javascriptSemanticTraceSchemas.js";
+import { compareSourceToBundleInputSchema } from "../domain/sourceToBundleComparisonSchemas.js";
 import { err, ok } from "../domain/result.js";
 import { resolveEvidenceReferences, } from "./EvidenceReferenceResolver.js";
 const APPLICATION_GRAPH_IDENTITIES = [
@@ -35,18 +36,14 @@ export const resolveTraceApplicationFeatureRequest = (input, lookup) => {
 };
 /** Resolve a trace request already parsed by the caller-facing contract. */
 export const resolveTraceApplicationFeatureRequestValidated = (input, lookup) => {
-    const application = input.application === undefined
-        ? resolveEvidenceReferences(lookup, input.application_evidence_id === undefined
-            ? []
-            : [input.application_evidence_id], APPLICATION_GRAPH_IDENTITIES)
-        : ok([input.application]);
+    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
     if (!application.ok)
         return application;
     const native = resolveEvidenceReferences(lookup, input.native_observation_evidence_ids);
     if (!native.ok)
         return native;
     const raw = {
-        application: application.value[0],
+        application: application.value,
         native_observations: [...input.native_observations, ...native.value],
         seed: input.seed,
         direction: input.direction,
@@ -66,14 +63,10 @@ export const resolveTraceJavaScriptSemanticsRequest = (input, lookup) => {
 };
 /** Resolve a semantic trace request already parsed by its public contract. */
 export const resolveTraceJavaScriptSemanticsRequestValidated = (input, lookup) => {
-    const application = input.application === undefined
-        ? resolveEvidenceReferences(lookup, input.application_evidence_id === undefined
-            ? []
-            : [input.application_evidence_id], APPLICATION_GRAPH_IDENTITIES)
-        : ok([input.application]);
+    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
     if (!application.ok)
         return application;
-    const raw = { application: application.value[0], query: input.query };
+    const raw = { application: application.value, query: input.query };
     const parsed = traceJavaScriptSemanticsInputSchema.safeParse(raw);
     return parsed.success
         ? ok(parsed.data)
@@ -121,6 +114,31 @@ export const resolveCompareApplicationVersionsRequestValidated = (input, lookup)
         ? ok(parsed.data)
         : invalid("compare_application_versions", parsed.error, raw);
 };
+/** Parse and resolve one historical-source comparison adapter request. */
+export const resolveCompareSourceToBundleRequest = (input, lookup) => {
+    const parsed = compareSourceToBundleRequestSchema.safeParse(input);
+    return parsed.success
+        ? resolveCompareSourceToBundleRequestValidated(parsed.data, lookup)
+        : invalid("compare_source_to_bundle", parsed.error, input);
+};
+/** Resolve a historical-source comparison request parsed by its public contract. */
+export const resolveCompareSourceToBundleRequestValidated = (input, lookup) => {
+    const application = graphEvidence(input.application, input.application_evidence_id, lookup);
+    if (!application.ok)
+        return application;
+    const raw = {
+        reference: input.reference,
+        application: application.value,
+        limits: input.limits,
+        ...(input.unknown_registry_approved === undefined
+            ? {}
+            : { unknown_registry_approved: input.unknown_registry_approved }),
+    };
+    const parsed = compareSourceToBundleInputSchema.safeParse(raw);
+    return parsed.success
+        ? ok(parsed.data)
+        : invalid("compare_source_to_bundle", parsed.error, raw);
+};
 /** Parse and resolve an export-shape adapter request into canonical input. */
 export const resolveCompareJavaScriptExportShapesRequest = (input, lookup) => {
     const parsed = compareJavaScriptExportShapesRequestSchema.safeParse(input);

package/dist/application/ArtifactInventory/scanCanonical.js

@@ -12,7 +12,7 @@ export const scanCanonicalArtifactInventory = async (path, limits, options = {})
     const integrity = options.integrity ?? STRICT_INTEGRITY_POLICY;
     if (integrity.mode === "record-and-continue" &&
         (!integrity.approved || !integrity.enabled))
-        throw new ArtifactReaderFailure("unavailable", "Integrity continuation requires explicit approval and operator policy");
+        throw new ArtifactReaderFailure("policy", "Integrity continuation requires explicit approval and operator policy");
     const metadata = await lstat(path);
     const rootFormat = await classifyRoot(path, metadata.isDirectory());
     const rootDigest = metadata.isDirectory()

package/dist/application/BinarySession.js

@@ -2,14 +2,15 @@ import { randomUUID } from "node:crypto";
 import { analysisProfilesEqual, } from "../domain/analysisProfile.js";
 import { AnalysisCancelledError, ProviderAdapterError, } from "../domain/errors.js";
 import { err, ok } from "../domain/result.js";
-import { enhancedToolNameSchema } from "../contracts/enhancedInputs.js";
-import { OFFICIAL_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { GENERATED_MCP_TOOL_CATALOG } from "../generatedMcpToolCatalog.js";
 import { SessionProviderRouter, } from "./SessionProviderRouter.js";
 import { BinarySessionRecords } from "./BinarySessionRecords.js";
 import { binarySessionStatus } from "./BinarySessionStatus.js";
 import { resolveSessionOpen, } from "./BinarySessionOpen.js";
 import { prepareSessionExecution } from "./BinarySessionExecution.js";
-const OFFICIAL_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name));
+import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
+const OFFICIAL_OPERATIONS = new Set(GENERATED_MCP_TOOL_CATALOG.filter(({ kind }) => kind === "official-proxy").map(({ name }) => name));
+const ENHANCED_OPERATIONS = new Set(GENERATED_MCP_TOOL_CATALOG.filter(({ kind }) => kind === "enhanced").map(({ name }) => name));
 /**
  * Owns the single active target shared by CLI and MCP adapters.
  *
@@ -41,7 +42,7 @@ export class BinarySession extends BinarySessionRecords {
             const exact = route.capabilities?.get(operation)?.provider;
             if (exact !== undefined)
                 selected = exact;
-            else if (enhancedToolNameSchema.safeParse(operation).success) {
+            else if (ENHANCED_OPERATIONS.has(operation)) {
                 const providers = new Map();
                 for (const descriptor of route.capabilities?.values() ?? [])
                     if (descriptor.available &&
@@ -111,12 +112,20 @@ export class BinarySession extends BinarySessionRecords {
                     if (!imported.ok)
                         return imported;
                 }
+                this.resetSnapshotInvalidation();
                 return ok(target);
             }
             await this.#drainCalls();
             const previous = this.#active;
             this.#active = undefined;
-            await previous?.client.close();
+            if (previous !== undefined) {
+                const closed = await closeAnalysisClient(previous.client, previous.route.identity.id);
+                if (!closed.ok) {
+                    this.clearSessionRecords();
+                    this.#clearRuntimeAvailability();
+                    return closed;
+                }
+            }
             const runId = randomUUID();
             const client = route.createClient(target, { runId });
             const started = await client.execute("health", {}, options);
@@ -157,15 +166,17 @@ export class BinarySession extends BinarySessionRecords {
         });
     }
     /** Close the active target, if any. */
-    close() {
+    close(options = {}) {
         return this.#serialize(async () => {
             const previous = this.#active;
             this.#active = undefined;
             await this.#drainCalls();
-            await previous?.client.close();
+            const closed = previous === undefined
+                ? ok(null)
+                : await closeAnalysisClient(previous.client, previous.route.identity.id, options);
             this.clearSessionRecords();
             this.#clearRuntimeAvailability();
-            return ok(null);
+            return closed;
         });
     }
     /** Describe the active binary session. */
@@ -177,6 +188,7 @@ export class BinarySession extends BinarySessionRecords {
             runtimeAvailability: this.#runtimeAvailability,
             runId: this.#active?.runId,
             runtimeLineageSnapshots: this.#active?.client.runtimeLineageSnapshots?.() ?? [],
+            requestActivitySnapshots: this.#active?.client.requestActivitySnapshots?.() ?? [],
         });
     }
     /** Return the immutable artifact identity captured before its provider started. */

package/dist/application/BinarySessionComposition.js

@@ -0,0 +1,21 @@
+import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
+import { BinarySession } from "./BinarySession.js";
+import { SessionProviderRouter } from "./SessionProviderRouter.js";
+const normalizeBinarySessionOptions = (optionsOrResolver) => typeof optionsOrResolver === "function"
+    ? { resolveAnalysisProfile: optionsOrResolver }
+    : (optionsOrResolver ?? {});
+/**
+ * Compose one provider-neutral session from deep-provider selection and
+ * disjoint auxiliary operation families.
+ */
+export const composeBinarySession = (registry, auxiliaryProviders = []) => new BinarySession(registry instanceof SessionProviderRouter
+    ? registry
+    : SessionProviderRouter.selectable(registry, auxiliaryProviders));
+/**
+ * Compose a session through the same internal seam for focused adapter tests.
+ * The constructor remains private to this composition module, so callers test
+ * provider behavior without coupling to BinarySession construction.
+ */
+export const composeBinarySessionFromFactory = (provider, optionsOrResolver) => new BinarySession(provider, normalizeBinarySessionOptions(optionsOrResolver));
+/** Compose a focused session from any provider-shaped test seam. */
+export const composeBinarySessionFromProvider = (provider, optionsOrResolver) => new BinarySession(provider, normalizeBinarySessionOptions(optionsOrResolver));

package/dist/application/BinarySessionRecords.js

@@ -1,24 +1,37 @@
 import { createEvidence } from "../domain/evidence.js";
-import { evidenceBundleForTarget } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import { evidenceBundleForTarget, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
+import { EvidenceIntegrityError, EvidenceLimitError, } from "../domain/errors.js";
 import { parseInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { parseReconstructionCoverageWorkspace, } from "../domain/reconstructionCoverage.js";
-import { err } from "../domain/result.js";
+import { err, ok } from "../domain/result.js";
 import { AnalysisSnapshotCache } from "./AnalysisSnapshotCache.js";
 import { EvidenceLedger } from "./EvidenceLedger.js";
 import { UNKNOWN_REGISTRY_PROVIDER, unknownEvidenceLinks, unknownMutationEvidence, } from "./UnknownEvidence.js";
 /** Owns session evidence, snapshots, workspaces, and residual unknowns. */
 export class BinarySessionRecords {
+    static MAX_RETAINED_BUNDLES = 16;
+    static MAX_RETAINED_BUNDLE_BYTES = 64 * 1024 * 1024;
     #evidence = new EvidenceLedger({
         maxRecords: 10_000,
         maxBytes: 64 * 1024 * 1024,
     });
     #snapshot = new AnalysisSnapshotCache();
+    #retainedBundles = new Map();
+    #retainedBundleBytes = 0;
     #investigationWorkspaces = new Map();
     #coverageWorkspaces = new Map();
     #snapshotInvalidated = false;
+    #snapshotListeners = new Set();
+    /** Observe changes to the mutable current analysis snapshot resource. */
+    onAnalysisSnapshotChanged(listener) {
+        this.#snapshotListeners.add(listener);
+        return () => this.#snapshotListeners.delete(listener);
+    }
     recordEvidence(evidence) {
-        return this.#evidence.record(evidence);
+        const recorded = this.#evidence.record(evidence);
+        if (recorded.ok && recorded.value === "added")
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     hasEvidence(evidenceId) {
         return this.#evidence.has(evidenceId);
@@ -29,8 +42,38 @@ export class BinarySessionRecords {
     exportEvidenceBundle() {
         return this.#evidence.export();
     }
+    snapshotEvidenceBundle() {
+        const bundle = this.#evidence.export();
+        const encoded = serializeEvidenceBundle(bundle);
+        const digest = createHash("sha256").update(encoded).digest("hex");
+        const existing = this.#retainedBundles.get(digest);
+        if (existing === undefined) {
+            if (this.#retainedBundles.size >= BinarySessionRecords.MAX_RETAINED_BUNDLES)
+                return err(new EvidenceLimitError("records", BinarySessionRecords.MAX_RETAINED_BUNDLES));
+            const bytes = Buffer.byteLength(encoded);
+            if (this.#retainedBundleBytes + bytes >
+                BinarySessionRecords.MAX_RETAINED_BUNDLE_BYTES)
+                return err(new EvidenceLimitError("bytes", BinarySessionRecords.MAX_RETAINED_BUNDLE_BYTES));
+            this.#retainedBundles.set(digest, encoded);
+            this.#retainedBundleBytes += bytes;
+        }
+        return ok({
+            bundleDigest: digest,
+            bundleVersion: 2,
+            bytes: Buffer.byteLength(existing ?? encoded),
+            records: bundle.records.length,
+            unknowns: bundle.unknowns.length,
+            uri: `rea://evidence-bundle/${digest}`,
+        });
+    }
+    retainedEvidenceBundle(digest) {
+        return this.#retainedBundles.get(digest);
+    }
     importEvidenceBundle(bundle) {
-        return this.#evidence.import(bundle);
+        const imported = this.#evidence.import(bundle);
+        if (imported.ok && imported.value > 0)
+            this.#emitSnapshotChanged();
+        return imported;
     }
     exportAnalysisSnapshot() {
         const active = this.activeAnalysisBinding();
@@ -48,36 +91,53 @@ export class BinarySessionRecords {
         const active = this.activeAnalysisBinding();
         if (active?.profile === null)
             return err(new EvidenceIntegrityError("Analysis snapshot profile_mismatch: the active target has no concrete analysis profile"));
-        return this.#snapshot.import(snapshot, active === undefined
+        const imported = this.#snapshot.import(snapshot, active === undefined
             ? undefined
             : { target: active.target, profile: active.profile }, (bundle) => this.#evidence.import(bundle));
+        if (imported.ok)
+            this.#emitSnapshotChanged();
+        return imported;
     }
     matchesSnapshot(target, profile) {
         return this.#snapshot.matches(target, profile ?? undefined);
     }
     selectSnapshot(target, profile) {
         this.#snapshot.select(target, profile);
+        this.#emitSnapshotChanged();
     }
     lookupSnapshot(target, profile, operation, parameters) {
         return this.#snapshot.lookup(target, profile, operation, parameters);
     }
     recordSnapshot(input) {
         this.#snapshot.record(input);
+        this.#emitSnapshotChanged();
     }
     invalidateSnapshot() {
         this.#snapshot.clear();
         this.#snapshotInvalidated = true;
+        this.#emitSnapshotChanged();
     }
     resetSnapshotInvalidation() {
+        if (!this.#snapshotInvalidated)
+            return;
         this.#snapshotInvalidated = false;
+        this.#emitSnapshotChanged();
     }
     clearSnapshot() {
         this.#snapshot.clear();
+        this.#emitSnapshotChanged();
     }
     clearSessionRecords() {
         this.#evidence.clear();
         this.#snapshot.clear();
         this.#snapshotInvalidated = false;
+        this.#retainedBundles.clear();
+        this.#retainedBundleBytes = 0;
+        this.#emitSnapshotChanged();
+    }
+    #emitSnapshotChanged() {
+        for (const listener of this.#snapshotListeners)
+            void listener();
     }
     retainInvestigationWorkspace(workspace) {
         const parsed = parseInvestigationWorkspace(workspace);
@@ -111,10 +171,16 @@ export class BinarySessionRecords {
     }
     recordUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
-        return this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
+        const recorded = this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
+        if (recorded.ok)
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     recordEvidenceWithUnknown(evidence, input) {
-        return this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
+        const recorded = this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
+        if (recorded.ok)
+            this.#emitSnapshotChanged();
+        return recorded;
     }
     updateUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
@@ -133,7 +199,10 @@ export class BinarySessionRecords {
                 "Registry mutation evidence records analyst intent, not proof of the answer.",
             ],
         });
-        return this.#evidence.updateUnknown(input, evidence);
+        const updated = this.#evidence.updateUnknown(input, evidence);
+        if (updated.ok)
+            this.#emitSnapshotChanged();
+        return updated;
     }
     listUnknowns(filters = {}) {
         return this.#evidence.listUnknowns(filters);
@@ -147,3 +216,4 @@ const sortedWorkspaces = (workspaces) => [...workspaces]
     .sort((left, right) => left.workspace_id.localeCompare(right.workspace_id) ||
     left.revision - right.revision)
     .map((workspace) => structuredClone(workspace));
+import { createHash } from "node:crypto";

package/dist/application/BinarySessionStatus.js

@@ -1,5 +1,5 @@
 /** Project internal provider routing state into the caller-visible session status. */
-export const binarySessionStatus = ({ target, route, router, runtimeAvailability, runId, runtimeLineageSnapshots, }) => {
+export const binarySessionStatus = ({ target, route, router, runtimeAvailability, runId, runtimeLineageSnapshots, requestActivitySnapshots, }) => {
     const configuredProvider = router.configuredIdentity();
     const provider = providerSummary(configuredProvider);
     const providers = router.providerIdentities(route).map(providerSummary);
@@ -41,6 +41,7 @@ export const binarySessionStatus = ({ target, route, router, runtimeAvailability
                 run_id: runId,
                 process_lineage: processLineageStatus(runtimeLineageSnapshots),
             },
+        analysis_activity: requestActivityStatus(requestActivitySnapshots),
     };
     return target === undefined
         ? { open: false, ...common }
@@ -54,6 +55,35 @@ export const binarySessionStatus = ({ target, route, router, runtimeAvailability
             architecture: target.architecture ?? null,
         };
 };
+const requestActivityStatus = (snapshots) => {
+    const providers = snapshots
+        .slice()
+        .sort((left, right) => left.provider.id.localeCompare(right.provider.id))
+        .map(({ provider, active, queuedRequests }) => ({
+        provider: providerSummary(provider),
+        active: active === null
+            ? null
+            : {
+                request_id: active.requestId,
+                operation: active.operation,
+                elapsed_ms: active.elapsedMs,
+                timeout_ms: active.timeoutMs,
+                caller_state: active.callerState,
+            },
+        queued_requests: queuedRequests,
+    }));
+    const active = snapshots.flatMap((snapshot) => snapshot.active === null ? [] : [snapshot.active]);
+    return {
+        status: snapshots.length === 0
+            ? "not_observed"
+            : active.some(({ callerState }) => callerState === "timed_out")
+                ? "timed_out_busy"
+                : active.length > 0
+                    ? "busy"
+                    : "idle",
+        providers,
+    };
+};
 const providerSummary = ({ id, name, version, }) => ({ id, name, version });
 const processLineageStatus = (snapshots) => snapshots.length === 0
     ? { status: "not_observed" }

package/dist/application/BrowserEvidence.js

@@ -1,5 +1,6 @@
 import { createEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
+import { commitBrowserScenarioNormalization } from "../domain/browserScenarioNormalization.js";
 /** Create Evidence v2 for a policy-scoped external browser observation. */
 export const createBrowserEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
     predicateType: browserPredicate(operation),
@@ -20,6 +21,18 @@ export const createBrowserEvidence = (operation, input, result, provider) => cre
 });
 const browserParameters = (input) => {
     if (!("cdp_endpoint" in input)) {
+        if ("before_scenario" in input &&
+            input.before_scenario !== undefined &&
+            input.after_scenario !== undefined)
+            return {
+                comparison_kind: "browser_scenario",
+                before_browser: input.before_scenario.browser,
+                after_browser: input.after_scenario.browser,
+                before_start_origin: input.before_scenario.scenario.start_origin,
+                after_start_origin: input.after_scenario.scenario.start_origin,
+                max_changes: input.max_changes,
+                normalization_sha256: commitBrowserScenarioNormalization(input.normalization).sha256,
+            };
         if ("max_changes" in input)
             return {
                 before_target_id: input.before.inspection.target.target_id,
@@ -74,6 +87,7 @@ const browserParameters = (input) => {
         include_websocket_shapes: input.include_websocket_shapes,
         include_script_sources: input.include_script_sources,
         include_storage_keys: input.include_storage_keys,
+        include_storage_fingerprints: input.include_storage_fingerprints,
         limits: input.limits,
         ...(input.include_script_sources && "source_capture_approved" in input
             ? {

package/dist/application/BrowserScenarioCapturePort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/BrowserScenarioCaptureService.js

@@ -0,0 +1,53 @@
+import { createBrowserScenarioEvidence } from "./BrowserScenarioEvidence.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+import { AnalysisCapabilityUnavailableError, AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { isLiteralLoopbackHostname } from "../domain/browserObservation.js";
+import { err } from "../domain/result.js";
+const OPERATION = "capture_browser_scenario";
+const PROVIDER_ID = "rea-playwright-browser-scenario";
+const networkScope = (origins) => origins.every((origin) => isLiteralLoopbackHostname(new URL(origin).hostname))
+    ? "loopback"
+    : "external";
+const authorizeScenario = async (authority, scenario) => {
+    if (authority === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "browser scenario permission policy is not configured"));
+    const authorized = await authority.authorize({
+        capability: "browser_automate",
+        roots: [],
+        executables: scenario.browser.mode === "launch"
+            ? [scenario.browser.executable_path]
+            : [],
+        environment_names: scenario.secrets.map(({ environment_variable: name }) => name),
+        origins: [
+            ...(scenario.browser.mode === "connect"
+                ? [scenario.browser.cdp_endpoint]
+                : []),
+            ...scenario.allowed_origins,
+        ],
+        network: networkScope(scenario.allowed_origins),
+        mount: false,
+        operation_identity: `${OPERATION}:${digestJson(scenario)}`,
+    }, "write");
+    if (!authorized.ok)
+        return err(authorized.error instanceof PermissionRequiredError
+            ? authorized.error
+            : new AnalysisProtocolError(authorized.error.message, {
+                cause: authorized.error,
+            }));
+    return { ok: true, value: true };
+};
+/** Authorize and execute one controlled browser scenario. */
+export const captureBrowserScenario = async (provider, authority, scenario, options = {}) => {
+    const authorized = await authorizeScenario(authority, scenario);
+    if (!authorized.ok)
+        return authorized;
+    if (provider === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "browser scenario provider is not configured"));
+    const captured = await provider.captureScenario(scenario, options);
+    return captured.ok
+        ? {
+            ok: true,
+            value: createBrowserScenarioEvidence(scenario, captured.value, provider.identity()),
+        }
+        : captured;
+};

package/dist/application/BrowserScenarioEvidence.js

@@ -0,0 +1,40 @@
+import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { digestJson } from "./JavaScriptReplayPlanning.js";
+const browserScenarioParameters = (scenario) => ({
+    scenario_sha256: digestJson(scenario),
+    browser_mode: scenario.browser.mode,
+    start_url: sanitizeBrowserUrl(scenario.start_url.url),
+    allowed_origins: scenario.allowed_origins,
+    actions: scenario.actions.map(({ step_id, action }) => ({
+        step_id,
+        action,
+    })),
+    secret_declarations: scenario.secrets.map(({ secret_id, environment_variable, purpose, redaction }) => ({
+        secret_id,
+        environment_variable,
+        purpose,
+        redaction,
+    })),
+    capture: scenario.capture,
+    limits: scenario.limits,
+});
+/** Create Evidence v2 without retaining resolved scenario secret values. */
+export const createBrowserScenarioEvidence = (scenario, capture, provider) => createEvidence(undefined, provider, {
+    predicateType: "rea.browser-scenario-capture/v1",
+    operation: "capture_browser_scenario",
+    parameters: browserScenarioParameters(scenario),
+    result: jsonValueSchema.parse(capture),
+    confidence: "observed",
+    authority: "controlled-replay",
+    environment: {
+        id: `${capture.browser.product}@${capture.browser.version}`,
+        platform: process.platform,
+        architecture: process.arch,
+        isolation: capture.browser.process_ownership === "provider-owned"
+            ? "process"
+            : "none",
+    },
+    limitations: capture.limitations,
+});