rea-agents 4.0.1 → 5.0.0

package/dist/domain/artifactInventoryEvidence.js

@@ -1,8 +1,8 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { artifactInventoryResultSchema, } from "./artifactGraph.js";
+import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
 import { parseEvidence } from "./evidence.js";
 import { artifactInspectionResultSchema } from "./artifactInspection.js";
+import { err, ok } from "./result.js";
 /** Parse, merge, and verify inventory Evidence pages. */
 export const parseArtifactInventoryEvidence = (input) => assembleInventorySet((Array.isArray(input) ? input : [input]).map((value) => {
     const evidence = parseEvidence(value);
@@ -29,25 +29,36 @@ const validateInventoryPage = (inventory) => {
     assertUnique(inventory.occurrences.map(({ logical_path: path }) => path), "logical path");
     assertUnique(inventory.edges.map(({ edge_id: id }) => id), "edge ID");
     for (const node of inventory.nodes)
-        if (node.artifact_id !== `art_${digestCanonical({ sha256: node.sha256 })}`)
+        if (node.artifact_id !==
+            `art_${canonicalDigest({ sha256: node.sha256 }, "Artifact inventory")}`)
             throw new TypeError("Artifact node ID is not content-addressed");
 };
+/**
+ * Result-returning seam for the empty-pages leaf. Other assembly failures
+ * still throw TypeError (migration in progress); parseArtifactInventoryEvidence
+ * keeps its throwing contract until callers switch.
+ */
+export const tryAssembleInventorySet = (pages) => pages.length === 0
+    ? err({
+        code: "empty",
+        message: "Artifact inventory requires Evidence pages",
+    })
+    : ok(assembleInventorySet(pages));
 const assembleInventorySet = (pages) => {
-    if (pages.length === 0)
-        throw new TypeError("Artifact inventory requires Evidence pages");
     const first = pages[0];
     if (first === undefined)
         throw new TypeError("Artifact inventory requires Evidence pages");
-    const manifestJson = canonicalJson(first.inventory.manifest);
+    const manifestJson = canonicalJson(first.inventory.manifest, "Artifact inventory");
     const nodes = new Map();
     const occurrences = new Map();
     const paths = new Map();
     const edges = new Map();
     for (const page of pages) {
-        if (canonicalJson(page.inventory.manifest) !== manifestJson)
+        if (canonicalJson(page.inventory.manifest, "Artifact inventory") !==
+            manifestJson)
             throw new TypeError("Artifact inventory pages do not share one manifest");
-        if (canonicalJson(page.inventory.integrity_contradictions) !==
-            canonicalJson(first.inventory.integrity_contradictions))
+        if (canonicalJson(page.inventory.integrity_contradictions, "Artifact inventory") !==
+            canonicalJson(first.inventory.integrity_contradictions, "Artifact inventory"))
             throw new TypeError("Artifact inventory pages do not share integrity contradictions");
         for (const node of page.inventory.nodes)
             mergeExact(nodes, node.artifact_id, node, "node");
@@ -99,27 +110,27 @@ const validateCompleteInventory = (inventory) => {
         if (!nodeIds.has(contradiction.parent_artifact_id) ||
             !occurrenceIds.has(contradiction.occurrence_id))
             throw new TypeError("Integrity contradiction references a missing graph member");
-        const expectedId = `ic_${digestCanonical({
+        const expectedId = `ic_${canonicalDigest({
             root_artifact_id: inventory.manifest.root_artifact_id,
             logical_path: contradiction.logical_path,
             declared_sha256: contradiction.declared_sha256,
             observed_sha256: contradiction.observed_sha256,
-        })}`;
+        }, "Artifact inventory")}`;
         if (contradiction.contradiction_id !== expectedId)
             throw new TypeError("Integrity contradiction ID does not match its identity");
     }
-    const graphSha256 = digestCanonical({
+    const graphSha256 = canonicalDigest({
         nodes: inventory.nodes,
         occurrences: inventory.occurrences,
         edges: inventory.edges,
         integrity_contradictions: inventory.integrityContradictions,
-    });
+    }, "Artifact inventory");
     if (graphSha256 !== inventory.manifest.graph_sha256)
         throw new TypeError("Artifact graph commitment does not match its members");
-    const manifestId = `agm_${digestCanonical({
+    const manifestId = `agm_${canonicalDigest({
         root_artifact_id: inventory.manifest.root_artifact_id,
         graph_sha256: graphSha256,
-    })}`;
+    }, "Artifact inventory")}`;
     if (manifestId !== inventory.manifest.manifest_id)
         throw new TypeError("Artifact manifest ID does not match its commitment");
 };
@@ -130,12 +141,12 @@ const validateOccurrence = (occurrence, inventory, nodeIds, occurrenceIds) => {
         !occurrenceIds.has(occurrence.parent_occurrence_id))
         throw new TypeError("Artifact occurrence references a missing parent");
     const expectedId = occurrence.logical_path === "."
-        ? `occ_${digestCanonical({ root: inventory.manifest.root_artifact_id })}`
-        : `occ_${digestCanonical({
+        ? `occ_${canonicalDigest({ root: inventory.manifest.root_artifact_id }, "Artifact inventory")}`
+        : `occ_${canonicalDigest({
             root_artifact_id: inventory.manifest.root_artifact_id,
             logical_path: occurrence.logical_path,
             entry_kind: occurrence.entry_kind,
-        })}`;
+        }, "Artifact inventory")}`;
     if (occurrence.occurrence_id !== expectedId)
         throw new TypeError("Artifact occurrence ID does not match its identity");
 };
@@ -151,13 +162,14 @@ const validateEdge = (edge, nodeIds, occurrenceIds) => {
         occurrence_id: edge.occurrence_id,
         logical_path: edge.logical_path,
     };
-    if (edge.edge_id !== `edge_${digestCanonical(semantic)}`)
+    if (edge.edge_id !== `edge_${canonicalDigest(semantic, "Artifact inventory")}`)
         throw new TypeError("Artifact edge ID does not match its identity");
 };
 const mergeExact = (output, key, value, label) => {
     const previous = output.get(key);
     if (previous !== undefined &&
-        canonicalJson(previous) !== canonicalJson(value))
+        canonicalJson(previous, "Artifact inventory") !==
+            canonicalJson(value, "Artifact inventory"))
         throw new TypeError(`Artifact inventory has conflicting ${label} pages`);
     output.set(key, value);
 };
@@ -165,10 +177,3 @@ const assertUnique = (values, label) => {
     if (new Set(values).size !== values.length)
         throw new TypeError(`Artifact inventory contains a duplicate ${label}`);
 };
-const digestCanonical = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
-const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Artifact inventory could not canonicalize graph data");
-    return encoded;
-};

package/dist/domain/artifactInventorySnapshot.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/artifactOperationError.js

@@ -0,0 +1,20 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+/** Artifact inventory or extraction failed a typed safety boundary. */
+export class ArtifactOperationError extends AnalysisError {
+    operation;
+    reason;
+    artifactDetails;
+    detail;
+    _tag = "ArtifactOperationError";
+    constructor(operation, reason, artifactDetails, 
+    /** The specific constraint that failed, such as the colliding path. */
+    detail) {
+        super(artifactDetails === undefined
+            ? `Artifact ${operation} failed: ${reason}`
+            : `Artifact ${operation} failed: ${reason} at ${artifactDetails.logicalPath} (declared_sha256=${artifactDetails.declaredSha256 ?? "unavailable"}, calculated_sha256=${artifactDetails.calculatedSha256 ?? "unavailable"}, unpacked=${String(artifactDetails.unpacked)})`);
+        this.operation = operation;
+        this.reason = reason;
+        this.artifactDetails = artifactDetails;
+        this.detail = detail;
+    }
+}

package/dist/domain/artifactPathSyntax.js

@@ -0,0 +1,26 @@
+/**
+ * Pure string predicates for artifact path syntax. The local artifact
+ * resolver, the Electron native specifier check, and (by reference) the
+ * live-DOM and source-map URL handling share these character-level rules.
+ *
+ * Policy divergence (deliberate, not yet unified):
+ * - Local artifact paths resolve against an inventoried container root and
+ *   report rejected | external | not-found. Confinement is lexical
+ *   (posix.normalize must stay inside the root).
+ * - Live DOM destinations resolve against the document base URL and report
+ *   approved | outside_policy | unsupported against allowedOrigins
+ *   (see CdpCaptureDocuments.domDestination).
+ * - Source-map fetches require exact-origin http(s) without credentials
+ *   (see WebSourceMapFetcher.approvedUrl).
+ * Unifying those outcome vocabularies is a separate, observable change.
+ */
+/** Whether a reference carries a URI scheme (`https:`, `file:`, …). */
+export const hasScheme = (value) => /^[A-Za-z][A-Za-z+.-]*:/u.test(value);
+/** Whether a reference is scheme-qualified or protocol-relative. */
+export const looksExternal = (value) => hasScheme(value) || value.startsWith("//");
+/** Drop any query string and fragment from a declared reference. */
+export const stripQueryAndFragment = (value) => value.split("#", 1)[0]?.split("?", 1)[0] ?? "";
+/** Path syntax admitted for a canonical artifact path. */
+export const admitsCanonicalPathSyntax = (value) => !value.includes("\0") &&
+    !value.includes("\\") &&
+    !/%(?:2e|2f|5c)/iu.test(value);

package/dist/domain/browserNetworkEvidence.js

@@ -0,0 +1,82 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+/** Caller-selected network content; omission retains metadata alone. */
+export const browserNetworkContentSelectionValuesSchema = z.strictObject({
+    request_body: z.boolean().default(false),
+    response_body: z.boolean().default(false),
+    header_values: z.boolean().default(false),
+});
+/** Input omission selects metadata without defaulting legacy capture coverage. */
+export const browserNetworkContentSelectionSchema = browserNetworkContentSelectionValuesSchema.default({
+    request_body: false,
+    response_body: false,
+    header_values: false,
+});
+/** Self-verifying retained bytes, after any declared-secret redaction. */
+export const browserNetworkBodySchema = z.union([
+    z.strictObject({ state: z.literal("not_requested") }),
+    z.strictObject({ state: z.literal("not_exposed") }),
+    z.strictObject({
+        state: z.literal("unavailable"),
+        reason: z.enum([
+            "request-failed",
+            "response-unfinished",
+            "body-read-failed",
+            "body-read-timeout",
+            "cancelled",
+            "capture-ended",
+        ]),
+        message: z.string().min(1),
+    }),
+    z
+        .strictObject({
+        state: z.literal("captured"),
+        representation: z.enum([
+            "browser-exposed-request-bytes",
+            "browser-decoded-response-bytes",
+        ]),
+        encoding: z.literal("base64"),
+        content: z.string(),
+        bytes: z.number().int().min(0),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+        media_type: z.string().nullable(),
+        redacted: z.boolean(),
+    })
+        .superRefine((artifact, context) => {
+        const bytes = Buffer.from(artifact.content, "base64");
+        if (bytes.toString("base64") !== artifact.content)
+            context.addIssue({
+                code: "custom",
+                path: ["content"],
+                message: "Network body must use canonical base64",
+            });
+        if (bytes.length !== artifact.bytes)
+            context.addIssue({
+                code: "custom",
+                path: ["bytes"],
+                message: "Network body byte count disagrees with retained bytes",
+            });
+        if (createHash("sha256").update(bytes).digest("hex") !== artifact.sha256)
+            context.addIssue({
+                code: "custom",
+                path: ["sha256"],
+                message: "Network body digest disagrees with retained bytes",
+            });
+    }),
+]);
+/** Headers retain producer order and duplicates, with credential values removed. */
+export const browserNetworkHeadersSchema = z.union([
+    z.strictObject({ state: z.literal("not_requested") }),
+    z.strictObject({
+        state: z.literal("unavailable"),
+        message: z.string().min(1),
+    }),
+    z.strictObject({
+        state: z.literal("captured"),
+        items: z.array(z.strictObject({
+            name: z.string().min(1),
+            value: z.string().nullable(),
+            redacted: z.boolean(),
+        })),
+    }),
+]);

package/dist/domain/browserObservation.js

@@ -5,7 +5,9 @@ const parseExactOrigin = (value) => {
     try {
         url = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is represented by the undefined return.
+        void cause;
         return undefined;
     }
     if ((url.protocol !== "http:" && url.protocol !== "https:") ||
@@ -44,7 +46,9 @@ export const browserEndpointSchema = z
     try {
         url = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is reported through the zod issue.
+        void cause;
         context.addIssue({ code: "custom", message: "Invalid CDP endpoint URL" });
         return z.NEVER;
     }
@@ -122,7 +126,9 @@ export const sanitizeBrowserUrl = (value) => {
     try {
         parsed = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Unparseable input is preserved verbatim in the sanitized result.
+        void cause;
         return {
             url: value,
             origin: null,
@@ -165,7 +171,9 @@ const removeUrlUserInfo = (value, parsed) => {
             ? candidate
             : credentialFreeHref(parsed);
     }
-    catch {
+    catch (cause) {
+        // Fallback to the already-sanitized href when the candidate is invalid.
+        void cause;
         return credentialFreeHref(parsed);
     }
 };

package/dist/domain/browserObservationError.js

@@ -0,0 +1,25 @@
+import { AnalysisError } from "./analysisErrorBase.js";
+import { AnalysisCancelledError } from "./analysisErrorCore.js";
+/** A bounded passive browser observation failed at its CDP boundary. */
+export class BrowserObservationError extends AnalysisError {
+    operation;
+    reason;
+    _tag = "BrowserObservationError";
+    cleanupIncomplete;
+    cleanupResources;
+    userCategory;
+    userMessage;
+    constructor(operation, reason, options) {
+        super(`Browser observation ${operation} failed: ${reason}`, options);
+        this.operation = operation;
+        this.reason = reason;
+        this.userMessage = options?.detail;
+        this.cleanupIncomplete = reason === "cleanup_failed";
+        this.cleanupResources =
+            reason === "cleanup_failed" ? ["browser_transport"] : [];
+        this.userCategory =
+            reason === "cancelled" || options?.cause instanceof AnalysisCancelledError
+                ? "cancelled"
+                : undefined;
+    }
+}

package/dist/domain/browserObservationSchemas.js

@@ -3,7 +3,8 @@ import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
 import { jsonShapeSchema } from "./jsonShape.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const browserVersionSchema = z.object({
+/** Shared CDP/browser version identity carried on observation Evidence. */
+export const browserVersionSchema = z.object({
     product: z.string(),
     protocol_version: z.string(),
     revision: z.string(),

package/dist/domain/browserScenario.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { browserScenarioActionSchema, browserScenarioBrowserSchema, browserScenarioCaptureSchema, browserScenarioEnvironmentSchema, browserScenarioSecretSchema, browserScenarioStorageSchema, browserScenarioUrlSchema, } from "./browserScenarioValues.js";
-export { browserScenarioActionSchema, browserScenarioUrlSchema, browserScenarioValueSchema, } from "./browserScenarioValues.js";
+export {} from "./browserScenarioValues.js";
 export const browserScenarioInputSchema = z.strictObject({
     browser: browserScenarioBrowserSchema.describe("Required launch/connect selection. Launch uses the selected executable and an owned temporary profile; connect uses one loopback CDP endpoint and target."),
     start_url: browserScenarioUrlSchema.describe("Required initial HTTP(S) URL. Query values must be declared separately as public literals or secret references."),

package/dist/domain/browserScenarioCapture.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
+import { browserNetworkContentSelectionValuesSchema } from "./browserNetworkEvidence.js";
 import { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, } from "./browserScenarioCaptureValues.js";
-export { classifyBrowserScenarioCompleteness, browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, captureStateSchema, } from "./browserScenarioCaptureValues.js";
+export { classifyBrowserScenarioCompleteness, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, } from "./browserScenarioCaptureValues.js";
 /** Step-indexed browser scenario observation. */
 export const browserScenarioCaptureSchema = z
     .strictObject({
@@ -15,6 +16,7 @@ export const browserScenarioCaptureSchema = z
         start_origin: z.string().min(1),
         action_count: z.number().int().min(1),
         secret_references: z.array(z.string().min(1)),
+        network_content: browserNetworkContentSelectionValuesSchema.optional(),
     }),
     duration_ms: z.number().int().min(0),
     steps: z.array(browserScenarioStepSchema).min(1),
@@ -27,6 +29,26 @@ export const browserScenarioCaptureSchema = z
     limitations: z.array(z.string().min(1)),
 })
     .superRefine((capture, context) => {
+    const bySequence = new Map(capture.events.items.map((event) => [event.sequence, event]));
+    if (bySequence.size !== capture.events.items.length)
+        context.addIssue({
+            code: "custom",
+            path: ["events", "items"],
+            message: "Event sequence numbers must be unique",
+        });
+    for (const [index, event] of capture.events.items.entries()) {
+        if (event.kind !== "network-content")
+            continue;
+        const source = bySequence.get(event.source_event_sequence);
+        if (source?.kind !== event.phase ||
+            source.transaction_id !== event.transaction_id ||
+            source.sequence >= event.sequence)
+            context.addIssue({
+                code: "custom",
+                path: ["events", "items", index, "source_event_sequence"],
+                message: "Network content must reference an earlier matching transaction phase",
+            });
+    }
     if (capture.events.retained !== capture.events.items.length)
         context.addIssue({
             code: "custom",

package/dist/domain/browserScenarioCaptureValues.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { emptyArraySchema } from "./emptyArraySchema.js";
+import { browserNetworkBodySchema, browserNetworkHeadersSchema, } from "./browserNetworkEvidence.js";
 import { sanitizedBrowserUrlSchema } from "./browserObservation.js";
 import { webScreenshotArtifactSchema } from "./webScreenshot.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -102,6 +103,8 @@ const eventBase = {
 const eventUrl = sanitizedBrowserUrlSchema.nullable();
 const networkEventShape = {
     ...eventBase,
+    transaction_id: z.string().min(1).optional(),
+    redirected_from_transaction_id: z.string().min(1).nullable().optional(),
     method: z.string().min(1),
     url: sanitizedBrowserUrlSchema,
     resource_type: z.string().min(1),
@@ -146,6 +149,28 @@ export const browserScenarioEventSchema = z.union([
         status: z.null(),
         failure: z.string().min(1),
     }),
+    z.strictObject({
+        ...networkEventShape,
+        kind: z.literal("request-finished"),
+        status: z.null(),
+        failure: z.null(),
+    }),
+    z.strictObject({
+        ...networkEventShape,
+        kind: z.literal("request-unfinished"),
+        status: z.null(),
+        failure: z.null(),
+        reason: z.enum(["capture-ended", "cancelled"]),
+    }),
+    z.strictObject({
+        ...eventBase,
+        kind: z.literal("network-content"),
+        transaction_id: z.string().min(1),
+        source_event_sequence: z.number().int().min(1),
+        phase: z.enum(["request", "response"]),
+        headers: browserNetworkHeadersSchema,
+        body: browserNetworkBodySchema,
+    }),
     z.strictObject({
         ...eventBase,
         kind: z.enum(["websocket-opened", "websocket-closed"]),

package/dist/domain/browserScenarioDiff.js

@@ -1,7 +1,7 @@
 import {} from "./browserScenarioCapture.js";
-import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
+import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, networkContentCoverageReason, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
 import { browserScenarioDiffSchema, } from "./browserScenarioDiffValues.js";
-import { commitBrowserScenarioNormalization, digestCanonicalJson, digestNormalizedScenarioValue, } from "./browserScenarioNormalization.js";
+import { commitBrowserScenarioNormalization, digestNormalizedScenarioValue, } from "./browserScenarioNormalization.js";
 export { browserScenarioDiffSchema, compareBrowserScenariosInputSchema, } from "./browserScenarioDiffValues.js";
 /** Compare scenario steps by stable step ID and apply only committed literal rules. */
 export const compareBrowserScenarios = (input) => {
@@ -213,6 +213,7 @@ const compareStepArtifacts = (input) => {
             after: captured(eventsFor(input.afterCapture, input.afterStep.step_index)),
             beforeState: eventEvidenceState(input.beforeCapture, input.beforeStep),
             afterState: eventEvidenceState(input.afterCapture, input.afterStep),
+            incomparableReason: networkContentCoverageReason(input.beforeCapture, input.afterCapture),
         }),
     ];
 };
@@ -231,7 +232,8 @@ const compareCapturedValues = (input) => {
     if (beforeState !== "captured" ||
         afterState !== "captured" ||
         before.state !== "captured" ||
-        after.state !== "captured")
+        after.state !== "captured" ||
+        input.incomparableReason !== undefined)
         return {
             artifact,
             status: "unknown",
@@ -242,7 +244,8 @@ const compareCapturedValues = (input) => {
                 after_state: afterState,
                 before_sha256: beforeSha256,
                 after_sha256: afterSha256,
-                reason: `Artifact coverage is not comparable (${beforeState} before, ${afterState} after).`,
+                reason: input.incomparableReason ??
+                    `Artifact coverage is not comparable (${beforeState} before, ${afterState} after).`,
             },
         };
     if (beforeSha256 === null || afterSha256 === null)

package/dist/domain/browserScenarioDiffEvidence.js

@@ -37,7 +37,41 @@ export const actionState = (step) => ({
     error: step.error,
 });
 /** Select events attributed to one scenario step without sequence metadata. */
-export const eventsFor = (capture, stepIndex) => capture.events.items.flatMap(({ sequence: _sequence, step_index: eventStepIndex, ...event }) => eventStepIndex === stepIndex ? [event] : []);
+export const eventsFor = (capture, stepIndex) => {
+    const sourceSteps = new Map(capture.events.items.map(({ sequence, step_index }) => [
+        sequence,
+        step_index,
+    ]));
+    return capture.events.items.flatMap(({ sequence: _sequence, step_index: eventStepIndex, ...event }) => {
+        if (event.kind === "network-content") {
+            const { source_event_sequence: sourceSequence, ...content } = event;
+            return sourceSteps.get(sourceSequence) === stepIndex ? [content] : [];
+        }
+        return eventStepIndex === stepIndex ? [event] : [];
+    });
+};
+/** Different content selection is missing comparability, not an observed website change. */
+export const networkContentCoverageReason = (before, after) => {
+    const left = before.scenario.network_content;
+    const right = after.scenario.network_content;
+    if (left === undefined || right === undefined) {
+        const events = [...before.events.items, ...after.events.items];
+        if (events.some((event) => event.kind === "network-content") ||
+            ((left === undefined) !== (right === undefined) &&
+                events.some((event) => event.kind === "request" ||
+                    event.kind === "response" ||
+                    event.kind === "request-failed" ||
+                    event.kind === "request-finished" ||
+                    event.kind === "request-unfinished")))
+            return "Network content selection is unknown in a legacy capture; capture both sides with matching content selection.";
+        return undefined;
+    }
+    return left.request_body !== right.request_body ||
+        left.response_body !== right.response_body ||
+        left.header_values !== right.header_values
+        ? "Network content selections differ; capture both sides with matching content selection before comparing network evidence."
+        : undefined;
+};
 /** Wrap one value as captured comparison evidence. */
 export const captured = (value) => ({
     state: "captured",

package/dist/domain/browserScenarioNormalization.js

@@ -1,5 +1,4 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
+import { canonicalDigest } from "./comparisonSemantics.js";
 const BUILT_IN_RULES = [
     "ignore_step_elapsed_ms",
     "ignore_event_sequence",
@@ -16,17 +15,13 @@ export const commitBrowserScenarioNormalization = (input) => {
     }))
         .sort((left, right) => left.rule_id < right.rule_id ? -1 : left.rule_id > right.rule_id ? 1 : 0);
     const commitment = { built_in_rules: [...BUILT_IN_RULES], rules };
-    return { ...commitment, sha256: digestCanonicalJson(commitment) };
+    return {
+        ...commitment,
+        sha256: canonicalDigest(commitment, "Browser scenario"),
+    };
 };
 /** Digest one artifact after applying committed exact-literal rules. */
-export const digestNormalizedScenarioValue = (value, artifact, rules) => digestCanonicalJson(normalize(value, artifact, rules));
-/** Compute a canonical SHA-256 commitment for JSON-compatible domain data. */
-export const digestCanonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Expected canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};
+export const digestNormalizedScenarioValue = (value, artifact, rules) => canonicalDigest(normalize(value, artifact, rules), "Browser scenario");
 const normalize = (value, artifact, rules) => {
     if (artifact === "screenshot")
         return value;

package/dist/domain/browserScenarioValues.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z
     .string()
@@ -12,7 +13,9 @@ const browserScenarioBaseUrlSchema = z
     try {
         url = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is reported through the zod issue.
+        void cause;
         context.addIssue({ code: "custom", message: "Invalid browser URL" });
         return z.NEVER;
     }
@@ -247,6 +250,16 @@ export const browserScenarioCaptureSchema = z
         "downloads",
     ]))
         .default([]),
+    network: browserNetworkContentSelectionSchema,
+})
+    .default({
+    after_each_step: [],
+    at_end: ["url"],
+    events: [],
+    network: {
+        request_body: false,
+        response_body: false,
+        header_values: false,
+    },
 })
-    .default({ after_each_step: [], at_end: ["url"], events: [] })
     .describe("Optional retained artifacts and event families. Defaults to only a final sanitized URL; request screenshots, DOM, accessibility, history, storage, and event capture explicitly.");

package/dist/domain/browserSession.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Input for a navigation-aware browser observation window. */
 export const observeWebSessionInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
@@ -32,13 +33,7 @@ const timelineEventSchema = z.object({
 });
 /** Navigation-aware session result for external user actions. */
 export const webObservationSessionSchema = z.object({
-    browser: z.object({
-        product: z.string(),
-        protocol_version: z.string(),
-        revision: z.string(),
-        user_agent: z.string(),
-        js_version: z.string(),
-    }),
+    browser: browserVersionSchema,
     target: z.object({
         target_id: z.string(),
         initial_url: z.string(),

package/dist/domain/bundleComparison.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { comparisonStatusSchema } from "./comparisonStatus.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const classificationSchema = z.enum([
     "added",
@@ -40,7 +41,7 @@ const bundleChangeSchema = z.object({
 });
 /** Deterministic classified delta between two canonical Evidence bundles. */
 export const bundleComparisonResultSchema = z.object({
-    status: z.enum(["unchanged", "changed", "unknown"]),
+    status: comparisonStatusSchema,
     left_bundle_sha256: digestSchema,
     right_bundle_sha256: digestSchema,
     summary: z.object({