rea-agents 4.0.1 → 5.0.0

package/dist/artifacts/{KeyedArchiveReader.js → apple/KeyedArchiveReader.js}

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { TextDecoder } from "node:util";
-import { parse, parseBinary } from "plist";
+import { parseBinary } from "plist";
 import { z } from "zod";
-import { keyedArchiveInputSchema, keyedArchiveResultSchema, projectKeyedArchive, } from "../domain/keyedArchive.js";
-import { DirectoryArtifactReader } from "./DirectoryArtifactReader.js";
-import { ArtifactReaderFailure } from "./ArtifactReader.js";
+import { projectPlistValue } from "../../domain/apple/plistValue.js";
+import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
+import { keyedArchiveInputSchema, keyedArchiveResultSchema, projectKeyedArchive, } from "../../domain/apple/keyedArchive.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+import { ArtifactReaderFailure } from "../ArtifactReader.js";
 const MAX_BYTES = 64 * 1024 * 1024;
 /** Parse inert plist bytes, preserving data and dates with explicit typed values. */
 export const decodeKeyedArchiveBytes = (bytes, selection) => {
@@ -12,11 +14,18 @@ export const decodeKeyedArchiveBytes = (bytes, selection) => {
         throw new RangeError("Keyed archive exceeds 64 MiB");
     const binary = bytes.subarray(0, 8).toString("ascii") === "bplist00";
     const parsed = binary
-        ? parseBinary(bytes)
-        : parse(decodeXmlPlistText(bytes));
+        ? { value: parseBinary(bytes), omittedPrototypeKeys: 0 }
+        : parseXmlPropertyList(decodeXmlPlistText(bytes));
+    const graph = projectKeyedArchive(normalizePlist(parsed.value), selection);
     return {
         archive_format: binary ? "binary-plist" : "xml-plist",
-        ...projectKeyedArchive(normalizePlist(parsed), selection),
+        ...graph,
+        limitations: [
+            ...graph.limitations,
+            ...(parsed.omittedPrototypeKeys === 0
+                ? []
+                : [omittedPrototypeKeysLimitation(parsed.omittedPrototypeKeys)]),
+        ],
     };
 };
 const decodeXmlPlistText = (bytes) => {
@@ -35,26 +44,11 @@ const decodeXmlPlistText = (bytes) => {
         throw new TypeError("XML encoding declaration disagrees with its bytes");
     return text;
 };
-const normalizePlist = (value, depth = 0) => {
-    if (depth > 128)
-        throw new RangeError("Plist exceeds 128 nesting levels");
-    if (value instanceof Uint8Array)
-        return {
-            $plist_type: "data",
-            base64: Buffer.from(value).toString("base64"),
-        };
-    if (value instanceof Date)
-        return { $plist_type: "date", iso8601: value.toISOString() };
-    if (Array.isArray(value))
-        return value.map((item) => normalizePlist(item, depth + 1));
-    if (value !== null && typeof value === "object")
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-            key,
-            normalizePlist(item, depth + 1),
-        ]));
-    return z
-        .union([z.string(), z.number().finite(), z.boolean(), z.null()])
-        .parse(value);
+const normalizePlist = (value) => {
+    const projected = projectPlistValue(value);
+    if (projected.unknownRealCount > 0)
+        throw new RangeError("Keyed archive contains a non-finite real");
+    return projected.value;
 };
 /** Read exactly one regular, contained bundle entry without following symlinks. */
 export const inspectBundleKeyedArchive = async (input) => {

package/dist/artifacts/{NibArchive.js → apple/NibArchive.js}

@@ -231,8 +231,10 @@ const decodeUtf8 = (bytes, start, end, label) => {
     try {
         return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(start, end));
     }
-    catch {
-        throw new TypeError(`NIBArchive ${label} is not valid UTF-8`);
+    catch (cause) {
+        throw new TypeError(`NIBArchive ${label} is not valid UTF-8`, {
+            cause,
+        });
     }
 };
 const readVarint = (bytes, cursor, end) => {

package/dist/artifacts/apple/NibViewHierarchy.js

@@ -0,0 +1,150 @@
+/** Project encoded view parents; archive owners are not inferred view parents. */
+export const projectNibViewHierarchy = (objects, retainedIds) => {
+    const { parents, involved, invalid } = collectNibParents(objects, retainedIds);
+    if (parents.size === 0)
+        return { hierarchy: null, omitted: invalid };
+    const children = new Map();
+    for (const [child, parent] of parents) {
+        if (!retainedIds.has(parent) || !retainedIds.has(child))
+            continue;
+        const siblings = children.get(parent) ?? [];
+        siblings.push(child);
+        children.set(parent, siblings);
+    }
+    const roots = [];
+    const pending = [];
+    for (const id of involved)
+        if (!parents.has(id))
+            pending.push({ id, depth: 0, output: roots });
+    const visited = new Set();
+    while (pending.length > 0) {
+        const item = pending.pop();
+        if (item === undefined)
+            break;
+        if (visited.has(item.id) || item.depth > 128 || visited.size >= 20_000)
+            continue;
+        visited.add(item.id);
+        const node = { objectID: String(item.id), children: [] };
+        item.output.push(node);
+        for (const child of [...(children.get(item.id) ?? [])].reverse())
+            pending.push({ id: child, depth: item.depth + 1, output: node.children });
+    }
+    return {
+        hierarchy: roots,
+        omitted: involved.size - visited.size + invalid,
+    };
+};
+/** Add encoded parent links once; conflicting legacy parents remain unknown. */
+export const mergeNibHierarchies = (legacy, recovered) => {
+    const existing = new Map();
+    const owners = new Map();
+    const parents = new Map();
+    const pending = legacy.map((node) => ({
+        node,
+        output: legacy,
+        parent: null,
+    }));
+    while (pending.length > 0) {
+        const entry = pending.pop();
+        if (entry === undefined || existing.has(entry.node.objectID))
+            continue;
+        existing.set(entry.node.objectID, entry.node);
+        owners.set(entry.node.objectID, entry.output);
+        if (entry.parent !== null)
+            parents.set(entry.node.objectID, entry.parent);
+        pending.push(...entry.node.children.map((node) => ({
+            node,
+            output: entry.node.children,
+            parent: entry.node.objectID,
+        })));
+    }
+    let omitted = 0;
+    const additions = recovered.map((node) => ({
+        node,
+        output: legacy,
+        parent: null,
+    }));
+    while (additions.length > 0) {
+        const entry = additions.pop();
+        if (entry === undefined)
+            break;
+        let target = existing.get(entry.node.objectID);
+        if (target === undefined) {
+            target = { objectID: entry.node.objectID, children: [] };
+            existing.set(target.objectID, target);
+            entry.output.push(target);
+            owners.set(target.objectID, entry.output);
+            if (entry.parent !== null)
+                parents.set(target.objectID, entry.parent);
+        }
+        else if (entry.parent !== null &&
+            owners.get(target.objectID) !== entry.output) {
+            const owner = owners.get(target.objectID);
+            if (owner !== legacy ||
+                wouldCycle(target.objectID, entry.parent, parents)) {
+                omitted += 1;
+            }
+            else {
+                owner.splice(owner.indexOf(target), 1);
+                entry.output.push(target);
+                owners.set(target.objectID, entry.output);
+                parents.set(target.objectID, entry.parent);
+            }
+        }
+        for (const node of [...entry.node.children].reverse())
+            additions.push({
+                node,
+                output: target.children,
+                parent: target.objectID,
+            });
+    }
+    return { hierarchy: legacy, omitted };
+};
+const wouldCycle = (child, parent, parents) => {
+    const seen = new Set();
+    let current = parent;
+    while (current !== undefined && !seen.has(current)) {
+        if (current === child)
+            return true;
+        seen.add(current);
+        current = parents.get(current);
+    }
+    return false;
+};
+const reference = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    return typeof value.$nib_object_ref === "number"
+        ? value.$nib_object_ref
+        : null;
+};
+const collectNibParents = (objects, retainedIds) => {
+    const parents = new Map();
+    const involved = new Set();
+    let invalid = 0;
+    for (const object of objects) {
+        if (!retainedIds.has(object.id))
+            continue;
+        const child = reference(object.values.NSWindowView);
+        if (object.class_name.replace(/\0+$/u, "") === "NSWindowTemplate" &&
+            invalidReference(object.values.NSWindowView))
+            invalid += 1;
+        if (object.class_name.replace(/\0+$/u, "") === "NSWindowTemplate" &&
+            child !== null) {
+            parents.set(child, object.id);
+            involved.add(object.id);
+            involved.add(child);
+        }
+        const parent = reference(object.values.NSSuperview);
+        if (invalidReference(object.values.NSSuperview))
+            invalid += 1;
+        if (parent === null)
+            continue;
+        parents.set(object.id, parent);
+        involved.add(object.id);
+        if (retainedIds.has(parent))
+            involved.add(parent);
+    }
+    return { parents, involved, invalid };
+};
+const invalidReference = (value) => value !== undefined && value !== null && reference(value) === null;

package/dist/{application → artifacts/javascript}/JavaScriptArtifactFiles.js

@@ -1,11 +1,19 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
-import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
-import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
-import { streamChunkToBuffer } from "../artifacts/StreamBytes.js";
+import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../ArtifactReader.js";
+import { streamChunkToBuffer } from "../StreamBytes.js";
+import { hashReadable } from "../ArtifactHash.js";
 /** Read all relevant textual entries through an already-inventoried reader. */
 export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
+    if (reader instanceof AsarArtifactReader) {
+        const root = snapshot.nodes.find(({ artifact_id }) => artifact_id === snapshot.manifest.root_artifact_id);
+        if (root === undefined)
+            throw new ArtifactReaderFailure("integrity", "Root artifact node is missing");
+        await verifyEntryBytes(reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
+    }
     const inventory = expectedInventory(snapshot);
     const expected = inventory.files;
     const context = {
@@ -57,6 +65,7 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             context.registry.add(path, nestedAsar ? "directory" : entry.kind);
             if (nestedAsar) {
                 const inventory = expectedContainer(path, context);
+                await verifyEntryBytes(await frame.reader.open(entry, context.signal), inventory, context.signal);
                 context.containers.push(inventory);
                 const nested = new AsarArtifactReader(entry.adapterKey);
                 stack.push({
@@ -104,8 +113,10 @@ const expectedContainer = (path, context) => {
     return container;
 };
 const readText = async (context, input) => {
-    if (input.expected.kind === "native-addon")
+    if (input.expected.kind === "native-addon") {
+        await verifyEntryBytes(await input.reader.open(input.entry, context.signal), input.expected, context.signal);
         return { included: false, reason: "not-applicable" };
+    }
     const bytes = await readAll(await input.reader.open(input.entry, context.signal), context.signal);
     const digest = createHash("sha256").update(bytes).digest("hex");
     if (digest !== input.expected.sha256 || bytes.length !== input.expected.bytes)
@@ -117,11 +128,24 @@ const readText = async (context, input) => {
             value: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
         };
     }
-    catch {
+    catch (cause) {
+        // Non-UTF8 bytes are counted; the fixed reason preserves the schema.
+        void cause;
         context.invalidUtf8 += 1;
         return { included: false, reason: "invalid-utf8" };
     }
 };
+const verifyEntryBytes = async (stream, expected, signal) => {
+    try {
+        const digest = await hashReadable(stream, signal);
+        if (digest.sha256 !== expected.sha256 || digest.bytes !== expected.bytes)
+            throw new ArtifactReaderFailure("integrity", `Artifact entry changed after inventory: ${expected.path}`);
+    }
+    catch (cause) {
+        abortIfNeeded(signal);
+        throw cause;
+    }
+};
 const expectedInventory = (snapshot) => {
     const nodes = new Map(snapshot.nodes.map((node) => [node.artifact_id, node]));
     const files = new Map();
@@ -197,4 +221,3 @@ const abortIfNeeded = (signal) => {
     if (signal?.aborted === true)
         throw new ArtifactReaderFailure("cancelled", "JavaScript artifact reconstruction cancelled");
 };
-const compareCodePoints = (left, right) => left < right ? -1 : left > right ? 1 : 0;

package/dist/artifacts/javascript/JavaScriptArtifactReader.js

@@ -0,0 +1,6 @@
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+/** Create the reader for an admitted JavaScript artifact format. */
+export const createJavaScriptArtifactReader = (path, format) => format === "asar"
+    ? new AsarArtifactReader(path)
+    : new DirectoryArtifactReader(path);

package/dist/artifacts/readStableArtifact.js

@@ -0,0 +1,52 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { ArtifactReaderFailure } from "./ArtifactReader.js";
+/** Read one bounded regular file and reject replacement or in-place changes. */
+export const readStableArtifact = async (path, maximumBytes, signal) => {
+    signal?.throwIfAborted();
+    const before = await lstat(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new ArtifactReaderFailure("path", `Expected a regular file without a symlink: ${path}`);
+    if (before.size > BigInt(maximumBytes))
+        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds ${String(maximumBytes)} bytes: ${path}`);
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const initial = await file.stat({ bigint: true });
+        if (!initial.isFile() ||
+            initial.dev !== before.dev ||
+            initial.ino !== before.ino)
+            throw new ArtifactReaderFailure("integrity", `Artifact changed before open: ${path}`);
+        const chunks = [];
+        let count = 0;
+        for await (const chunk of file.createReadStream({
+            autoClose: false,
+            highWaterMark: 65536,
+        })) {
+            signal?.throwIfAborted();
+            const value = chunk;
+            if (!Buffer.isBuffer(value))
+                throw new ArtifactReaderFailure("format", `Artifact stream did not return bytes: ${path}`);
+            const bytes = value;
+            count += bytes.length;
+            if (count > maximumBytes)
+                throw new ArtifactReaderFailure("limit", `Selected artifact grew beyond its byte limit: ${path}`);
+            chunks.push(bytes);
+        }
+        const after = await file.stat({ bigint: true });
+        const current = await lstat(path, { bigint: true });
+        if ([after, current].some((stat) => !stat.isFile() ||
+            stat.dev !== initial.dev ||
+            stat.ino !== initial.ino ||
+            stat.size !== initial.size ||
+            stat.mtimeNs !== initial.mtimeNs ||
+            stat.ctimeNs !== initial.ctimeNs) ||
+            BigInt(count) !== initial.size)
+            throw new ArtifactReaderFailure("integrity", `Artifact changed during read: ${path}`);
+        const bytes = Buffer.concat(chunks, count);
+        return { bytes, sha256: createHash("sha256").update(bytes).digest("hex") };
+    }
+    finally {
+        await file.close();
+    }
+};

package/dist/browser/BrowserProcessStartup.js

@@ -79,7 +79,9 @@ const readDevtoolsPort = async (path) => {
             ? port
             : null;
     }
-    catch {
+    catch (cause) {
+        // Missing or unreadable port files mean the port is unknown.
+        void cause;
         return null;
     }
 };

package/dist/browser/BrowserScenarioSecrets.js

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
 import { sanitizeBrowserUrl, } from "../domain/browserObservation.js";
 const REDACTION_PREFIX = "[REDACTED:";
+const encodedSecretValues = (secret) => new Set([
+    secret,
+    encodeURIComponent(secret),
+    new URLSearchParams([["value", secret]]).toString().slice("value=".length),
+]);
 /** Resolved secret values kept only for one in-memory scenario session. */
 export class BrowserScenarioSecrets {
     values;
@@ -41,6 +46,50 @@ export class BrowserScenarioSecrets {
                 output = output.replaceAll(secret, `${REDACTION_PREFIX}${id}]`);
         return output;
     }
+    /** Replace declared UTF-8, URI/form, and JSON-escaped secrets without decoding binary data. */
+    redactBytes(value) {
+        const candidates = [...this.values]
+            .flatMap(([id, secret]) => {
+            if (secret === "")
+                return [];
+            return [
+                ...new Set([
+                    ...encodedSecretValues(secret),
+                    JSON.stringify(secret).slice(1, -1),
+                ]),
+            ].map((text) => {
+                const needle = Buffer.from(text);
+                return {
+                    id,
+                    needle,
+                    marker: Buffer.from(`${REDACTION_PREFIX}${id}]`),
+                    index: value.indexOf(needle),
+                };
+            });
+        })
+            .sort((left, right) => right.needle.length - left.needle.length ||
+            (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+        const parts = [];
+        let offset = 0;
+        while (true) {
+            let next;
+            for (const candidate of candidates) {
+                if (candidate.index >= 0 && candidate.index < offset)
+                    candidate.index = value.indexOf(candidate.needle, offset);
+                if (candidate.index >= 0 &&
+                    (next === undefined || candidate.index < next.index))
+                    next = candidate;
+            }
+            if (next === undefined)
+                break;
+            parts.push(value.subarray(offset, next.index), next.marker);
+            offset = next.index + next.needle.length;
+        }
+        if (parts.length === 0)
+            return value;
+        parts.push(value.subarray(offset));
+        return Buffer.concat(parts);
+    }
     /** Remove only declared secret values from one URL and report that action. */
     sanitizeUrl(value) {
         let output = value;
@@ -50,14 +99,7 @@ export class BrowserScenarioSecrets {
             if (secret === "")
                 continue;
             const marker = `${REDACTION_PREFIX}${id}]`;
-            const searchParamsValue = new URLSearchParams([["value", secret]])
-                .toString()
-                .slice("value=".length);
-            for (const candidate of new Set([
-                secret,
-                encodeURIComponent(secret),
-                searchParamsValue,
-            ]))
+            for (const candidate of encodedSecretValues(secret))
                 output = output.replaceAll(candidate, marker);
         }
         const sanitized = sanitizeBrowserUrl(output);

package/dist/browser/CdpAuthorizedMainFrame.js

@@ -1,16 +1,16 @@
-import { BrowserObservationError } from "../domain/errors.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { allowedSanitizedUrl, delayWithCancellation, isHttpUrl, } from "./CdpCaptureValues.js";
 /** Wait for the attached target's main frame to enter its approved origin. */
-export const authorizedMainFrame = async ({ connection, sessionId, signal, allowedOrigins, delayOperation, }) => {
+export const authorizedMainFrame = async ({ connection, sessionId, signal, allowedOrigins, operation, }) => {
     for (let attempt = 0; attempt < 80; attempt += 1) {
         const result = await connection.send("Page.getFrameTree", {}, sessionId, signal);
         const url = mainFrameUrl(result);
         if (allowedSanitizedUrl(url, allowedOrigins) !== undefined)
             return result;
         if (isHttpUrl(url))
-            throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-        await delayWithCancellation(25, delayOperation, signal);
+            throw new BrowserObservationError(operation, "target_not_allowed");
+        await delayWithCancellation(25, operation, signal);
     }
-    throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
+    throw new BrowserObservationError(operation, "target_not_allowed");
 };

package/dist/browser/CdpAuthorizedTarget.js

@@ -0,0 +1,22 @@
+import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
+/** Select one page target and derive its origin scope before opening a CDP session. */
+export const authorizeCdpTarget = (discovery, input, operation) => {
+    const target = discovery.targets.find((candidate) => candidate.id === input.target_id);
+    if (target === undefined)
+        throw new BrowserObservationError(operation, "target_not_found", {
+            detail: `Target ${input.target_id} was not found at the selected endpoint.`,
+        });
+    const origin = sanitizeBrowserUrl(target.url).origin;
+    if (target.type !== "page" ||
+        origin === null ||
+        (input.allowed_origins.length > 0 &&
+            !input.allowed_origins.includes(origin)))
+        throw new BrowserObservationError(operation, "target_not_allowed", {
+            detail: `Target ${input.target_id} must be an HTTP(S) page in the selected origin scope.`,
+        });
+    return {
+        target,
+        allowedOrigins: new Set(input.allowed_origins.length > 0 ? input.allowed_origins : [origin]),
+    };
+};

package/dist/browser/CdpBrowserProvider.js

@@ -5,22 +5,23 @@ import { webObservationSessionSchema, } from "../domain/browserSession.js";
 import { webMcpDiscoverySchema, } from "../domain/webMcpDiscovery.js";
 import { browserCaptureComparisonSchema, compareBrowserCaptures, } from "../domain/browserCaptureComparison.js";
 import { webScreenshotDiffSchema, webScreenshotSchema, } from "../domain/webScreenshot.js";
-import { AnalysisError, BrowserObservationError, ProviderAdapterError, } from "../domain/errors.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import {} from "../domain/browserObservationErrors.js";
 import { err, ok } from "../domain/result.js";
 import { discoverCdpEndpoint, hasCdpTargetWebSocket, } from "./CdpEndpoint.js";
 import { closeCdpTargetSession, openCdpTargetSession, } from "./CdpTargetSession.js";
 import { capturePage } from "./CdpPageCapture.js";
 import { fetchWebSourceMaps } from "./WebSourceMapFetcher.js";
+import { authorizeCdpTarget } from "./CdpAuthorizedTarget.js";
 import { observeCdpSession } from "./CdpObservationSession.js";
 import { discoverWebMcp } from "./CdpWebMcpDiscovery.js";
 import { captureCdpScreenshot } from "./CdpScreenshot.js";
 import { comparePngScreenshots } from "./PngVisualDiff.js";
 /** Public identity committed by passive browser observations. */
-export const CDP_BROWSER_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-cdp-browser",
-    name: "REA Chrome DevTools Protocol observation provider",
-    version: "2",
-});
+export { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const IDENTITY = CDP_BROWSER_PROVIDER_IDENTITY;
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"];
 /** Passive browser observation through a selected user-owned CDP endpoint. */
@@ -248,16 +249,7 @@ const selectTargets = (discovery, allowedOrigins) => {
     };
 };
 const authorizeTarget = (discovery, input) => {
-    const target = discovery.targets.find((candidate) => candidate.id === input.target_id);
-    if (target === undefined)
-        throw new BrowserObservationError("inspect_web_page", "target_not_found");
-    const origin = sanitizeBrowserUrl(target.url).origin;
-    if (target.type !== "page" ||
-        origin === null ||
-        (input.allowed_origins.length > 0 &&
-            !input.allowed_origins.includes(origin)))
-        throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-    return target;
+    return authorizeCdpTarget(discovery, input, "inspect_web_page").target;
 };
 const scopeToTargetOrigin = (input, target) => {
     if (input.allowed_origins.length > 0)