rea-agents 4.0.1 → 5.0.0

package/dist/browser/PlaywrightScenarioArtifacts.js

@@ -44,7 +44,8 @@ const captureScreenshot = async (page) => {
             },
         };
     }
-    catch {
+    catch (cause) {
+        void cause;
         return missing("screenshot capture failed");
     }
 };
@@ -53,7 +54,8 @@ const captureDom = async (input) => {
     try {
         return textArtifact(secrets.redact(await page.content()));
     }
-    catch {
+    catch (cause) {
+        void cause;
         return missing("DOM capture failed");
     }
 };
@@ -63,7 +65,8 @@ const captureAccessibility = async (input) => {
         const text = await page.locator("html").ariaSnapshot();
         return textArtifact(secrets.redact(text));
     }
-    catch {
+    catch (cause) {
+        void cause;
         return missing("accessibility capture failed");
     }
 };
@@ -99,7 +102,8 @@ const captureHistory = async (page, secrets) => {
         };
         return { state: "captured", value };
     }
-    catch {
+    catch (cause) {
+        void cause;
         return missing("history capture failed");
     }
 };
@@ -135,7 +139,8 @@ const captureStorage = async (input) => {
         };
         return { state: "captured", value };
     }
-    catch {
+    catch (cause) {
+        void cause;
         return missing("storage capture failed");
     }
 };

package/dist/browser/PlaywrightScenarioBrowser.js

@@ -2,7 +2,7 @@ import { chmod, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { chromium, } from "playwright-core";
-import { BrowserObservationError } from "../domain/errors.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { withPlaywrightExecutionBoundary } from "./PlaywrightExecutionBoundary.js";
 const OPERATION = "capture_browser_scenario";
 const allowedBrowserEnvironment = (environment) => {
@@ -133,6 +133,8 @@ export const closePlaywrightScenarioBrowser = async ({ context, browser, profile
                 await rm(profilePath, { recursive: true, force: true, maxRetries: 3 });
         }
     })();
+    // best-effort cleanup: the bounded execution boundary below observes the
+    // same cleanup promise; this early attachment only prevents unhandled rejection.
     void cleanup.catch(() => undefined);
     // The shared execution boundary rejects cancellation/timeouts instead of
     // returning a successful capture whose browser or profile may still exist.

package/dist/browser/PlaywrightScenarioEvents.js

@@ -1,4 +1,5 @@
 import { browserScenarioEventSchema, } from "../domain/browserScenarioCapture.js";
+import { PlaywrightScenarioNetwork } from "./network/PlaywrightScenarioNetwork.js";
 /** Arrival-ordered Playwright event capture with current-step attribution. */
 export class PlaywrightScenarioEvents {
     items = [];
@@ -9,8 +10,18 @@ export class PlaywrightScenarioEvents {
     ownsContext;
     pages = new Set();
     incompleteFamilies = new Set();
+    network;
+    stopNetwork;
+    sealed = false;
     constructor(options) {
-        this.enabled = options.enabled;
+        const network = options.network ?? {
+            request_body: false,
+            response_body: false,
+            header_values: false,
+        };
+        this.enabled = new Set(options.enabled);
+        if (network.request_body || network.response_body || network.header_values)
+            this.enabled = new Set([...this.enabled, "network"]);
         this.secrets = options.secrets;
         this.ownsContext = options.ownsContext === true;
         this.pages.add(options.page);
@@ -18,30 +29,52 @@ export class PlaywrightScenarioEvents {
             (options.context ?? options.page.context()).on("page", (page) => this.popup(page));
         if (this.enabled.has("network")) {
             const context = options.context ?? options.page.context();
+            const collector = new PlaywrightScenarioNetwork({
+                selection: network,
+                secrets: options.secrets,
+                emit: (event) => this.push(event),
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
+            });
+            this.network = collector;
             const inScope = (request) => {
                 if (this.ownsContext)
                     return true;
                 try {
                     return this.pages.has(request.frame().page());
                 }
-                catch {
+                catch (cause) {
                     // Initial popup navigations can lack a frame. Never guess ownership
                     // from a URL in a shared context; connect captures are attach-limited.
+                    void cause;
                     return false;
                 }
             };
-            context.on("request", (request) => {
+            const onRequest = (request) => {
                 if (inScope(request))
-                    this.request("request", request);
-            });
-            context.on("response", (response) => {
+                    collector.request(request);
+            };
+            const onResponse = (response) => {
                 if (inScope(response.request()))
-                    this.response(response);
-            });
-            context.on("requestfailed", (request) => {
+                    collector.response(response);
+            };
+            const onFailed = (request) => {
                 if (inScope(request))
-                    this.request("request-failed", request);
-            });
+                    collector.failed(request);
+            };
+            const onFinished = (request) => {
+                if (inScope(request))
+                    collector.finished(request);
+            };
+            context.on("request", onRequest);
+            context.on("response", onResponse);
+            context.on("requestfailed", onFailed);
+            context.on("requestfinished", onFinished);
+            this.stopNetwork = () => {
+                context.off("request", onRequest);
+                context.off("response", onResponse);
+                context.off("requestfailed", onFailed);
+                context.off("requestfinished", onFinished);
+            };
         }
         this.observePage(options.page);
     }
@@ -54,15 +87,27 @@ export class PlaywrightScenarioEvents {
     lastSequence() {
         return this.sequence;
     }
+    /** Drain selected network content and freeze the result before browser teardown. */
+    async finish() {
+        this.stopNetwork?.();
+        this.stopNetwork = undefined;
+        try {
+            await this.network?.finish();
+        }
+        finally {
+            this.sealed = true;
+        }
+    }
     /** Report selected popup event families with unrecoverable pre-discovery gaps. */
     limitations() {
         const popupGaps = [...this.incompleteFamilies].map((family) => `Popup ${family} events before Page discovery are unavailable; later events are retained.`);
+        const gaps = [...popupGaps, ...(this.network?.limitations() ?? [])];
         return this.enabled.has("network") && !this.ownsContext
             ? [
                 "Shared-context network capture excludes requests without a known root or descendant Page frame.",
-                ...popupGaps,
+                ...gaps,
             ]
-            : popupGaps;
+            : gaps;
     }
     result() {
         return {
@@ -72,6 +117,8 @@ export class PlaywrightScenarioEvents {
         };
     }
     push(event) {
+        if (this.sealed)
+            return this.sequence;
         this.sequence += 1;
         const parsed = browserScenarioEventSchema.parse({
             ...event,
@@ -79,6 +126,7 @@ export class PlaywrightScenarioEvents {
             step_index: this.stepIndex,
         });
         this.items.push(parsed);
+        return this.sequence;
     }
     observePage(page) {
         if (this.enabled.has("console"))
@@ -119,45 +167,6 @@ export class PlaywrightScenarioEvents {
             url: location.url === "" ? null : this.safeUrl(location.url),
         });
     }
-    request(kind, request) {
-        const observation = {
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(request.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            header_names: Object.keys(request.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-        };
-        if (kind === "request-failed") {
-            this.push({
-                ...observation,
-                kind,
-                status: null,
-                failure: this.secrets.redact(request.failure()?.errorText ?? "unknown"),
-            });
-            return;
-        }
-        this.push({
-            ...observation,
-            kind,
-            status: null,
-            failure: null,
-        });
-    }
-    response(response) {
-        const request = response.request();
-        this.push({
-            kind: "response",
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(response.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            status: response.status(),
-            header_names: Object.keys(response.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-            failure: null,
-        });
-    }
     webSocket(socket) {
         const url = this.safeUrl(socket.url());
         this.push({ kind: "websocket-opened", url });
@@ -236,6 +245,9 @@ export class PlaywrightScenarioEvents {
             suggested_filename: this.secrets.redact(download.suggestedFilename()),
             url: this.safeUrl(download.url()),
         });
-        void download.cancel().catch(() => undefined);
+        void download.cancel().catch((cause) => {
+            // best-effort cleanup: download cancellation must not reject unhandled.
+            void cause;
+        });
     }
 }

package/dist/browser/PlaywrightScenarioSession.js

@@ -1,5 +1,5 @@
 import {} from "playwright-core";
-import { BrowserObservationError } from "../domain/errors.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { BrowserScenarioSecrets } from "./BrowserScenarioSecrets.js";
 import { closePlaywrightScenarioBrowser, openPlaywrightScenarioBrowser, } from "./PlaywrightScenarioBrowser.js";
 import { performPlaywrightScenarioAction } from "./PlaywrightScenarioActions.js";
@@ -95,7 +95,10 @@ export class PlaywrightScenarioSession {
         catch (cause) {
             void opening
                 .then((lateOpened) => closePlaywrightScenarioBrowser(lateOpened, options.signal))
-                .catch(() => undefined);
+                .catch((cause) => {
+                // best-effort cleanup: late-open cleanup must not mask the boundary failure.
+                void cause;
+            });
             throw cause;
         }
         try {
@@ -106,6 +109,8 @@ export class PlaywrightScenarioSession {
                 ownsContext: scenario.browser.mode === "launch",
                 enabled: new Set(scenario.capture.events),
                 secrets,
+                network: scenario.capture.network,
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
             });
             const session = new PlaywrightScenarioSession(opened, {
                 mode: scenario.browser.mode,
@@ -167,7 +172,12 @@ export class PlaywrightScenarioSession {
                 ? "terminated-owned-process"
                 : "disconnected-external";
         this.closed = true;
-        await closePlaywrightScenarioBrowser(this.opened, this.signal);
+        try {
+            await this.eventCapture.finish();
+        }
+        finally {
+            await closePlaywrightScenarioBrowser(this.opened, this.signal);
+        }
         return this.mode === "launch"
             ? "terminated-owned-process"
             : "disconnected-external";

package/dist/browser/WebSourceMapFetcher.js

@@ -1,11 +1,15 @@
 import * as t from "@babel/types";
 import { AnyMap, eachMapping } from "@jridgewell/trace-mapping";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
-import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
-import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { isUrlLikeModuleSpecifier } from "../domain/webBundleAnalyzerAst.js";
+import { analyzeParsedJavaScriptReferences } from "../domain/javascript/javascriptSemanticAnalysis.js";
+import { traverseJavaScriptAst } from "../domain/javascript/javascriptSemanticTraversal.js";
+import { parseJavaScriptSource } from "../domain/javascript/javascriptSourceParser.js";
 import { hasValidSourceMapContents } from "../domain/sourceMapContents.js";
 import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
+import { safeParseJson } from "../domain/safeJson.js";
+import { flattenSourceMapLeaves, isVersion3Map, } from "../domain/sourceMapEnvelope.js";
 /** Fetch and validate approved source maps without browser credentials. */
 export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch: globalThis.fetch }) => {
     const items = [];
@@ -126,7 +130,8 @@ const normalizeSourceMap = (request, text, fetchedUrl) => {
                 limitation: `Module edges are incomplete: ${modules.incomplete.length} of ${originalSources.filter(({ artifact }) => artifact !== null).length} original sources could not be parsed in full (${modules.incomplete.join(", ")}).`,
             };
     }
-    catch {
+    catch (cause) {
+        void cause;
         return emptySourceMapItem(request, "invalid", "Source-map mappings could not be decoded safely.");
     }
 };
@@ -147,65 +152,47 @@ const originalModuleEdges = (sources) => {
         if (parsed.errors.length > 0)
             incomplete.push(source.source);
         let unboundRequires;
-        t.traverseFast(parsed, (node) => {
-            const dependency = originalDependency(node);
-            if (dependency === null)
-                return;
-            const { kind, specifier } = dependency;
-            if (kind === "require" && t.isCallExpression(node)) {
-                unboundRequires ??= new Set(analyzeParsedJavaScriptSemantics(parsed)
-                    .references.filter(({ name, role, resolution }) => name === "require" &&
-                    role === "read" &&
-                    resolution === "unbound")
-                    .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
-                const location = node.callee.loc?.start;
-                if (location === undefined ||
-                    !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
+        traverseJavaScriptAst(parsed, {
+            enter: (node) => {
+                const dependency = originalDependency(node);
+                if (dependency === null)
                     return;
-            }
-            const key = `${source.source}\0${kind}\0${specifier}`;
-            if (seen.has(key))
-                return;
-            seen.add(key);
-            edges.push({
-                from_source: source.source,
-                kind,
-                specifier,
-                resolved_source: resolveOriginalSource(specifier, source.source),
-            });
+                const { kind, specifier } = dependency;
+                if (kind === "require" && t.isCallExpression(node)) {
+                    unboundRequires ??= new Set(analyzeParsedJavaScriptReferences(parsed, "require")
+                        .filter(({ role, resolution }) => role === "read" && resolution === "unbound")
+                        .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
+                    const location = node.callee.loc?.start;
+                    if (location === undefined ||
+                        !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
+                        return;
+                }
+                const key = `${source.source}\0${kind}\0${specifier}`;
+                if (seen.has(key))
+                    return;
+                seen.add(key);
+                edges.push({
+                    from_source: source.source,
+                    kind,
+                    specifier,
+                    resolved_source: resolveOriginalSource(specifier, source.source),
+                });
+            },
         });
     }
     return { edges, incomplete };
 };
 const validSourceMapEnvelope = (text) => {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
+    const parsedResult = safeParseJson(text);
+    if (!parsedResult.ok)
         return false;
-    }
-    if (!isRecord(parsed) || parsed.version !== 3)
-        return false;
-    if (typeof parsed.mappings === "string")
+    const parsed = parsedResult.value;
+    if (isVersion3Map(parsed) && typeof parsed.mappings === "string")
         return validSourceMapLeaf(parsed);
-    if (!Array.isArray(parsed.sections))
+    const leaves = flattenSourceMapLeaves(parsed, { validateOffsets: true });
+    if (leaves === undefined)
         return false;
-    const pending = [...parsed.sections];
-    while (pending.length > 0) {
-        const section = pending.pop();
-        if (!isRecord(section) || !isRecord(section.offset) || !("map" in section))
-            return false;
-        const map = section.map;
-        if (!isRecord(map) || map.version !== 3)
-            return false;
-        if (Array.isArray(map.sections))
-            for (const child of map.sections)
-                pending.push(child);
-        else if (!validSourceMapLeaf(map))
-            return false;
-    }
-    return true;
+    return leaves.every(validSourceMapLeaf);
 };
 const validSourceMapLeaf = (map) => typeof map.mappings === "string" &&
     Array.isArray(map.sources) &&
@@ -219,7 +206,9 @@ const approvedUrl = (value, allowedOrigins) => {
             parsed.password === "" &&
             allowedOrigins.includes(parsed.origin));
     }
-    catch {
+    catch (cause) {
+        // Non-URL input is not an approved source-map URL.
+        void cause;
         return false;
     }
 };
@@ -240,22 +229,30 @@ const sanitizeSource = (value) => {
     try {
         return sanitizeBrowserUrl(new URL(value).href).url;
     }
-    catch {
+    catch (cause) {
+        // Non-URL sources are preserved verbatim.
+        void cause;
         return value;
     }
 };
 const resolveOriginalSource = (specifier, base) => {
+    if (!isUrlLikeModuleSpecifier(specifier))
+        return null;
     try {
         return sanitizeSource(new URL(specifier, base).href);
     }
-    catch {
+    catch (cause) {
+        // Unresolvable source specifiers are represented by null.
+        void cause;
         return null;
     }
 };
-const sourceMediaType = (source) => source?.endsWith(".ts") || source?.endsWith(".tsx")
+const sourceMediaType = (source) => source?.endsWith(".ts") ||
+    source?.endsWith(".tsx") ||
+    source?.endsWith(".mts") ||
+    source?.endsWith(".cts")
     ? "text/typescript"
     : "text/javascript";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const originalDependency = (node) => {
     if (t.isImportDeclaration(node) ||
         t.isExportAllDeclaration(node) ||

package/dist/browser/assets/LocalWebScriptArtifacts.js

@@ -0,0 +1,87 @@
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+import { readStableArtifact } from "../../artifacts/readStableArtifact.js";
+import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { webScriptExportManifestSchema } from "../../domain/webScriptExport.js";
+import { decodeWebArtifact, readWebArtifactJson, webArtifactReadError, WebArtifactFormatFailure, } from "./WebArtifactReads.js";
+/** Read one digest-verified captured source under the manifest's current location. */
+export class LocalWebScriptArtifacts {
+    operation;
+    constructor(operation) {
+        this.operation = operation;
+    }
+    /** Read the selected source; relocated exports retain their reported original root. */
+    async load(input, options) {
+        let field = ["manifest_path"];
+        let targetPath = input.manifest_path;
+        try {
+            const manifestBytes = await readWebArtifactJson(input.manifest_path, 32 * 1024 * 1024, options?.signal);
+            const manifest = webScriptExportManifestSchema.parse(manifestBytes.value);
+            field = ["script_index"];
+            const selected = manifest.scripts[input.script_index];
+            if (selected === undefined)
+                throw new WebArtifactFormatFailure(`No script at index ${String(input.script_index)}; manifest contains ${String(manifest.scripts.length)} scripts.`);
+            if (selected.content.state !== "exported")
+                return err(new AnalysisCapabilityUnavailableError("web-module-artifacts", this.operation, "selected_source_unavailable", {
+                    userMessage: `Selected script ${String(input.script_index)} has unavailable source bytes (${selected.content.reason}): ${selected.content.message} Capture source bytes before tracing this script.`,
+                }));
+            const portable = normalizeArtifactPath(selected.content.relative_path);
+            if (portable !== selected.content.relative_path)
+                throw new ArtifactReaderFailure("path", `Selected source path changes during normalization: ${selected.content.relative_path}`);
+            const root = dirname(input.manifest_path);
+            const sourcePath = join(root, "files", portable);
+            targetPath = sourcePath;
+            await assertContained(root, sourcePath);
+            const sourceBytes = await readStableArtifact(sourcePath, 16 * 1024 * 1024, options?.signal);
+            await assertContained(root, sourcePath);
+            if (sourceBytes.sha256 !== selected.content.sha256 ||
+                sourceBytes.bytes.length !== selected.content.bytes)
+                throw new ArtifactReaderFailure("integrity", `Selected source identity mismatch: ${sourcePath}; expected sha256=${selected.content.sha256}, bytes=${String(selected.content.bytes)}; observed sha256=${sourceBytes.sha256}, bytes=${String(sourceBytes.bytes.length)}.`, undefined, {
+                    logicalPath: selected.content.relative_path,
+                    declaredSha256: selected.content.sha256,
+                    calculatedSha256: sourceBytes.sha256,
+                    unpacked: false,
+                });
+            const source = decodeWebArtifact(sourceBytes.bytes);
+            return ok({
+                manifest,
+                manifestFile: {
+                    path: input.manifest_path,
+                    sha256: manifestBytes.sha256,
+                    bytes: manifestBytes.bytes.length,
+                },
+                sourceFile: {
+                    path: sourcePath,
+                    sha256: sourceBytes.sha256,
+                    bytes: sourceBytes.bytes.length,
+                },
+                source,
+            });
+        }
+        catch (cause) {
+            return err(webArtifactReadError(cause, { operation: this.operation, field, targetPath }, options?.signal));
+        }
+    }
+}
+const assertContained = async (root, path) => {
+    const canonicalRoot = await realpath(root);
+    const canonicalFile = await realpath(path);
+    const fromRoot = relative(canonicalRoot, canonicalFile);
+    if (fromRoot === ".." ||
+        fromRoot.startsWith(`..${sep}`) ||
+        isAbsolute(fromRoot))
+        throw new ArtifactReaderFailure("path", `Selected source escapes its manifest directory: ${path}`);
+    let directory = dirname(path);
+    while (directory !== root) {
+        const stat = await lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new ArtifactReaderFailure("path", `Selected source directory is a symlink or not a directory: ${directory}`);
+        const parent = dirname(directory);
+        if (parent === directory)
+            throw new ArtifactReaderFailure("path", "Selected source has no containing manifest directory.");
+        directory = parent;
+    }
+};

package/dist/browser/assets/PageScriptCapture.js

@@ -0,0 +1,32 @@
+/** Project verified Debugger sources without fetching resource URLs. */
+export const pageScripts = (capture) => capture.scripts.items.map((script) => ({
+    source: {
+        kind: "page-script",
+        script_key: script.script_key,
+        frame_id: script.frame_id,
+        is_module: script.is_module,
+        language: script.language,
+        source_map_url: script.source_map_url,
+    },
+    url: script.url,
+    content: !script.source.included
+        ? {
+            state: "unavailable",
+            reason: "source-not-included",
+            message: script.source.reason || "Debugger source was not included.",
+        }
+        : script.language !== null && script.language !== "JavaScript"
+            ? {
+                state: "unavailable",
+                reason: "unsupported-language",
+                message: `Debugger reported language ${script.language}; JavaScript export was not inferred.`,
+            }
+            : {
+                state: "captured",
+                bytes: Buffer.from(script.source.artifact.text, "utf8"),
+                sha256: script.source.artifact.sha256,
+                media_type: script.source.artifact.media_type,
+                redacted: null,
+                representation: "debugger-source-utf8",
+            },
+}));

package/dist/browser/assets/PublishWebScripts.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import { SafeOutputTree } from "../../artifacts/SafeOutputTree.js";
+import { webScriptExportManifestSchema, webScriptExportResultSchema, } from "../../domain/webScriptExport.js";
+import { planWebScriptExport } from "../../domain/webScriptExportPlan.js";
+import { WebScriptExportError } from "../../domain/webScriptExportError.js";
+const LIMITATIONS = [
+    "Only script bytes retained in this capture are exported. Sources are not refetched or executed, and a response or Debugger source does not prove execution.",
+    "Ordinary unambiguous URL paths preserve relative module layouts by origin. Query variants, collisions, inline sources, and unrepresentable paths are isolated; their browser module relationships remain unknown.",
+    "Local JavaScript analysis does not implement browser import maps, root-relative URL resolution, remote URL loading, or browser runtime behavior. It may strip import queries and fragments; isolated variants are not canonical targets.",
+    "Source-map declarations are retained as metadata. No source maps or missing dependencies are fetched or reconstructed.",
+    "Captured response bytes are browser-decoded bytes; Debugger sources are the exposed text encoded as UTF-8. Redacted bytes are exported exactly as retained, and may no longer parse as JavaScript.",
+];
+/** Exclusively publish verified bytes and a manifest, rolling back partial work. */
+export const publishWebScripts = async (input, capture, captureSha256, signal) => {
+    const planned = planWebScriptExport(capture.scripts);
+    const tree = await SafeOutputTree.create(input.output_directory);
+    try {
+        signal?.throwIfAborted();
+        const records = planned.map(({ record }) => record);
+        const manifest = webScriptExportManifestSchema.parse({
+            capture_path: input.capture_path,
+            capture_sha256: captureSha256,
+            capture_kind: capture.kind,
+            source_evidence_id: capture.sourceEvidenceId,
+            capture_completeness: capture.completeness,
+            output_directory: tree.outputRoot,
+            analysis_input: records.some(({ content }) => content.state === "exported")
+                ? { input_path: join(tree.outputRoot, "files"), format: "directory" }
+                : null,
+            scripts: records,
+            limitations: [
+                ...capture.limitations,
+                ...LIMITATIONS,
+                ...(records.some(({ content }) => content.state === "exported")
+                    ? []
+                    : [
+                        "No script bytes were exportable. Include script sources in inspect_web_page or select response_body in capture_browser_scenario, then capture again.",
+                    ]),
+            ],
+        });
+        const bytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
+        const digest = createHash("sha256").update(bytes).digest("hex");
+        const result = webScriptExportResultSchema.parse({
+            ...manifest,
+            manifest: {
+                path: join(tree.outputRoot, "manifest.json"),
+                sha256: digest,
+                bytes: bytes.length,
+            },
+        });
+        for (const { script, record } of planned) {
+            signal?.throwIfAborted();
+            if (script.content.state === "captured" &&
+                record.content.state === "exported")
+                await tree.write(`files/${record.content.relative_path}`, Readable.from([script.content.bytes]), script.content.sha256, signal);
+        }
+        await tree.write("manifest.json", Readable.from([bytes]), digest, signal);
+        signal?.throwIfAborted();
+        await tree.commit();
+        return result;
+    }
+    catch (cause) {
+        try {
+            await tree.rollback();
+        }
+        catch (cleanupCause) {
+            throw new WebScriptExportError("io", tree.outputRoot, `Publication failed (${message(cause)}); rollback failed (${message(cleanupCause)}). Remove the residual output directory before retrying.`, [tree.outputRoot]);
+        }
+        throw cause;
+    }
+};
+const message = (cause) => cause instanceof Error ? cause.message : "Unknown publication failure";