rea-agents 4.0.1 → 5.0.0

package/dist/domain/webModuleImports.js

@@ -0,0 +1,104 @@
+import { isStringLiteral, isTemplateLiteral } from "@babel/types";
+import { traverseJavaScriptAst } from "./javascript/javascriptSemanticTraversal.js";
+import { parseJavaScriptSource } from "./javascript/javascriptSourceParser.js";
+/** Collect native import syntax, excluding erased type-only references. */
+export const collectWebModuleImports = (source) => {
+    const ast = parseJavaScriptSource(source);
+    if (ast === null)
+        return {
+            imports: [],
+            state: "unparseable",
+            diagnostics: ["Source could not be parsed; imports are unknown."],
+        };
+    const imports = [];
+    const add = (kind, expression) => {
+        if (expression.start === null ||
+            expression.start === undefined ||
+            expression.end === null ||
+            expression.end === undefined ||
+            expression.loc === null ||
+            expression.loc === undefined)
+            return;
+        const specifier = isStringLiteral(expression)
+            ? expression.value
+            : isTemplateLiteral(expression) && expression.expressions.length === 0
+                ? (expression.quasis[0]?.value.cooked ?? null)
+                : null;
+        imports.push({
+            kind,
+            specifier,
+            expression: source.slice(expression.start, expression.end),
+            start: {
+                offset: expression.start,
+                line: expression.loc.start.line,
+                column: expression.loc.start.column,
+            },
+            end: {
+                offset: expression.end,
+                line: expression.loc.end.line,
+                column: expression.loc.end.column,
+            },
+        });
+    };
+    traverseJavaScriptAst(ast, {
+        enter: (node) => {
+            if (node.type === "ImportDeclaration") {
+                if (node.importKind === "type" || node.importKind === "typeof")
+                    return;
+                if (node.specifiers.length > 0 &&
+                    node.specifiers.every((s) => s.type === "ImportSpecifier" &&
+                        (s.importKind === "type" || s.importKind === "typeof")))
+                    return;
+                add("static-import", node.source);
+            }
+            else if (node.type === "ExportAllDeclaration" ||
+                node.type === "ExportNamedDeclaration") {
+                if (node.exportKind === "type" ||
+                    node.source === null ||
+                    node.source === undefined)
+                    return;
+                if (node.type === "ExportNamedDeclaration" &&
+                    node.specifiers.length > 0 &&
+                    node.specifiers.every((s) => s.type === "ExportSpecifier" && s.exportKind === "type"))
+                    return;
+                add("re-export", node.source);
+            }
+            else if (node.type === "ImportExpression")
+                add("dynamic-import", node.source);
+            else if (node.type === "CallExpression" &&
+                node.callee.type === "Import" &&
+                node.arguments[0] !== undefined)
+                add("dynamic-import", node.arguments[0]);
+        },
+    });
+    imports.sort((a, b) => a.start.offset - b.start.offset);
+    return {
+        imports,
+        state: "parsed",
+        diagnostics: ast.errors?.map((error) => error.message) ?? [],
+    };
+};
+/** Match reported URLs without collapsing query or module fragment identity. */
+export const matchCapturedModules = (url, scripts) => {
+    const candidates = [];
+    scripts.forEach((script, script_index) => {
+        if (script.url === url)
+            candidates.push({ script_index, match: "exact-reported-url", script });
+        else if (script.source.kind === "scenario-response") {
+            try {
+                const transport = new URL(url);
+                transport.hash = "";
+                if (transport.href === script.url)
+                    candidates.push({
+                        script_index,
+                        match: "response-url-without-fragment",
+                        script,
+                    });
+            }
+            catch (cause) {
+                void cause;
+            }
+        }
+    });
+    return candidates;
+};

package/dist/domain/webModuleTrace.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { digestSchema } from "./digests.js";
+import { exportedWebScriptSchema, webScriptExportManifestSchema, } from "./webScriptExport.js";
+/** Inspect one captured script's native ES module relationships. */
+export const webModuleTraceInputSchema = z.strictObject({
+    manifest_path: z
+        .string()
+        .min(1)
+        .describe("Absolute path to an export_web_scripts manifest"),
+    script_index: z
+        .number()
+        .int()
+        .min(0)
+        .describe("Zero-based index in manifest.scripts"),
+    importer_url: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Explicit HTTP(S) module URL; useful when captured inline/base context is unknown"),
+    import_map: z
+        .strictObject({
+        path: z
+            .string()
+            .min(1)
+            .describe("Absolute local import-map JSON path; no fetch"),
+        base_url: z
+            .string()
+            .min(1)
+            .describe("Explicit HTTP(S) base for the selected map"),
+    })
+        .optional(),
+});
+/** Byte identity of one selected local artifact. */
+export const webModuleFileSchema = z.strictObject({
+    path: z.string().min(1),
+    sha256: digestSchema,
+    bytes: z.number().int().min(0),
+});
+const positionSchema = z.strictObject({
+    offset: z.number().int().min(0),
+    line: z.number().int().min(1),
+    column: z.number().int().min(0),
+});
+/** Parser observations do not assert that a dependency was loaded. */
+export const webModuleImportSchema = z.strictObject({
+    kind: z.enum(["static-import", "re-export", "dynamic-import"]),
+    specifier: z.string().nullable(),
+    expression: z.string(),
+    start: positionSchema,
+    end: positionSchema,
+});
+/** Native resolver output, including the engine's exact failure text. */
+export const webModuleResolutionSchema = z.discriminatedUnion("state", [
+    z.strictObject({ state: z.literal("resolved"), url: z.string().min(1) }),
+    z.strictObject({ state: z.literal("rejected"), message: z.string() }),
+]);
+const candidateSchema = z.strictObject({
+    script_index: z.number().int().min(0),
+    match: z.enum(["exact-reported-url", "response-url-without-fragment"]),
+    script: exportedWebScriptSchema,
+});
+/** Complete outgoing imports with captured candidates and explicit unknowns. */
+export const webModuleTraceResultSchema = z.strictObject({
+    manifest: webModuleFileSchema.extend({
+        reported_output_directory: z.string(),
+        ...webScriptExportManifestSchema.pick({
+            capture_path: true,
+            capture_sha256: true,
+            capture_kind: true,
+            capture_completeness: true,
+            source_evidence_id: true,
+        }).shape,
+    }),
+    source: webModuleFileSchema.extend({
+        script_index: z.number().int().min(0),
+        script: exportedWebScriptSchema,
+    }),
+    importer: z.strictObject({
+        url: z.string().min(1),
+        basis: z.enum(["caller-selected", "reported-source-url"]),
+    }),
+    import_map: webModuleFileSchema
+        .extend({ base_url: z.string().min(1) })
+        .nullable(),
+    parser: z.strictObject({
+        state: z.enum(["parsed", "unparseable"]),
+        diagnostics: z.array(z.string()),
+        location_units: z.literal("UTF-16 offsets and columns; one-based lines"),
+    }),
+    engine: z
+        .strictObject({ id: z.string().min(1), version: z.string().min(1) })
+        .nullable(),
+    imports: z.array(webModuleImportSchema.extend({
+        resolution: z.union([
+            webModuleResolutionSchema,
+            z.strictObject({
+                state: z.literal("unknown"),
+                reason: z.literal("computed-specifier"),
+            }),
+        ]),
+        captured_candidates: z.array(candidateSchema),
+        execution: z.literal("unknown"),
+    })),
+    diagnostics: z.array(z.string()),
+    limitations: z.array(z.string()),
+});

package/dist/domain/webRuntime.js

@@ -0,0 +1,69 @@
+import { z } from "zod";
+import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
+import { jsonObjectSchema } from "./jsonValue.js";
+/** Scope for one externally owned page; omitted origins select its current origin. */
+export const webRuntimeScopeSchema = z.strictObject({
+    cdp_endpoint: browserEndpointSchema,
+    allowed_origins: browserAllowedOriginsSchema,
+    target_id: z.string().min(1),
+});
+/** Source evidence is bound by the selected CDP session's script ID, never URL equality. */
+export const webRuntimeSourceSchema = z.object({
+    script_id: z.string().min(1),
+    url: z.string(),
+    execution_context_id: z.number().int().nullable(),
+    reported_execution_context: jsonObjectSchema.nullable(),
+    reported_script_context_aux_data: jsonObjectSchema.nullable(),
+    frame_id: z.string().nullable(),
+    producer_hash: z.string().nullable(),
+    source_map_url: z.string().nullable(),
+    has_source_url: z.boolean().nullable(),
+    language: z.string().nullable(),
+    resource_start: z
+        .object({
+        line_number: z.number().int().min(0),
+        column_number: z.number().int().min(0),
+    })
+        .nullable(),
+    source: z.discriminatedUnion("state", [
+        z.object({
+            state: z.literal("captured"),
+            text: z.string(),
+            sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+            utf8_bytes: z.number().int().min(0),
+            utf16_units: z.number().int().min(0),
+        }),
+        z.object({
+            state: z.enum(["unavailable", "excluded"]),
+            reason: z.string().min(1),
+        }),
+    ]),
+});
+/** Producer callsite coordinates are zero-based resource lines and UTF-16 columns. */
+export const webRuntimeLocationSchema = z.object({
+    script_id: z.string(),
+    url: z.string().nullable(),
+    line_number: z.number().int().min(0),
+    column_number: z.number().int().min(0).nullable(),
+    function_name: z.string().nullable(),
+    source_association: z.enum(["script_id", "unknown"]),
+});
+/** Common identity for a selected live page document. */
+export const webRuntimeTargetSchema = z.object({
+    target_id: z.string().min(1),
+    origin: z.string().min(1),
+    initial_url: z.string(),
+    frame_id: z.string().min(1),
+    loader_id: z.string().nullable(),
+});
+/** Producer product identity is observed separately from the unknown host platform. */
+export const webRuntimeBrowserSchema = browserVersionSchema;
+/** Complete runtime evidence has explicit byte budgets rather than silent item truncation. */
+export const WEB_RUNTIME_LIMITS = {
+    protocolBytes: 64 * 1024 * 1024,
+    retainedEventBytes: 8 * 1024 * 1024,
+    sourceBytes: 32 * 1024 * 1024,
+    commandTimeoutMs: 20_000,
+    cleanupTimeoutMs: 5_000,
+};

package/dist/domain/webScreenshot.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Self-verifying inline PNG artifact for CLI/MCP parity. */
 export const webScreenshotArtifactSchema = z
     .object({
@@ -29,13 +30,6 @@ export const captureWebScreenshotInputSchema = z.strictObject({
     allowed_origins: browserAllowedOriginsSchema,
     target_id: z.string().trim().min(1),
 });
-const browserVersionSchema = z.object({
-    product: z.string(),
-    protocol_version: z.string(),
-    revision: z.string(),
-    user_agent: z.string(),
-    js_version: z.string(),
-});
 /** Screenshot observation with embedded immutable artifact bytes. */
 export const webScreenshotSchema = z.object({
     browser: browserVersionSchema,

package/dist/domain/webScriptArtifacts.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { digestSchema } from "./digests.js";
+import { webScriptExportManifestSchema } from "./webScriptExport.js";
+/** Select one source from an existing captured-script export. */
+export const selectedWebScriptInputSchema = z.strictObject({
+    manifest_path: z
+        .string()
+        .min(1)
+        .describe("Absolute export_web_scripts manifest path"),
+    script_index: z
+        .number()
+        .int()
+        .min(0)
+        .describe("Zero-based index in manifest.scripts"),
+});
+/** Exact identity of one local file, independently read as bytes. */
+export const webArtifactFileSchema = z.strictObject({
+    path: z.string().min(1),
+    sha256: digestSchema,
+    bytes: z.number().int().min(0),
+});
+/** Artifact-port report shared by capture-derived analyses. */
+export const selectedWebScriptArtifactsSchema = z.strictObject({
+    manifest: webScriptExportManifestSchema,
+    manifestFile: webArtifactFileSchema,
+    sourceFile: webArtifactFileSchema,
+    source: z.string(),
+});
+/** Preserve original capture authority and completeness alongside the actual manifest identity. */
+export const capturedWebManifestIdentitySchema = webArtifactFileSchema.extend({
+    reported_output_directory: z.string(),
+    ...webScriptExportManifestSchema.pick({
+        capture_path: true,
+        capture_sha256: true,
+        capture_kind: true,
+        capture_completeness: true,
+        source_evidence_id: true,
+    }).shape,
+});

package/dist/domain/webScriptExport.js

@@ -0,0 +1,86 @@
+import { z } from "zod";
+import { browserCompletenessSchema } from "./browserCompleteness.js";
+import { browserScenarioCompletenessSchema } from "./browserScenarioCaptureValues.js";
+import { digestSchema, prefixedDigestSchema } from "./digests.js";
+/** Export already captured scripts into one absent, caller-selected directory. */
+export const exportWebScriptsInputSchema = z.strictObject({
+    capture_path: z
+        .string()
+        .min(1)
+        .describe("Absolute filesystem path to saved inspect_web_page or capture_browser_scenario JSON, normalized result or complete Evidence"),
+    output_directory: z
+        .string()
+        .min(1)
+        .describe("Absolute absent filesystem directory for verified scripts and manifest; parent directory must exist"),
+});
+const sourceSchema = z.discriminatedUnion("kind", [
+    z.strictObject({
+        kind: z.literal("page-script"),
+        script_key: z.string().min(1),
+        frame_id: z.string().nullable(),
+        is_module: z.boolean(),
+        language: z.string().nullable(),
+        source_map_url: z.string().nullable(),
+    }),
+    z.strictObject({
+        kind: z.literal("scenario-response"),
+        transaction_id: z.string().nullable(),
+        request_sequence: z.number().int().min(1),
+        response_sequence: z.number().int().min(1).nullable(),
+        status: z.number().nullable(),
+    }),
+]);
+/** Exact retained-source identity and publication outcome. */
+export const exportedWebScriptSchema = z.strictObject({
+    source: sourceSchema,
+    url: z.string(),
+    content: z.discriminatedUnion("state", [
+        z.strictObject({
+            state: z.literal("exported"),
+            relative_path: z.string().min(1),
+            layout: z.enum(["url-path", "isolated"]),
+            layout_reason: z.string().nullable(),
+            sha256: digestSchema,
+            bytes: z.number().int().min(0),
+            media_type: z.string().nullable(),
+            redacted: z.boolean().nullable(),
+            representation: z.enum([
+                "debugger-source-utf8",
+                "browser-decoded-response-bytes",
+            ]),
+        }),
+        z.strictObject({
+            state: z.literal("unavailable"),
+            reason: z.string().min(1),
+            message: z.string().min(1),
+        }),
+    ]),
+});
+/** Persisted manifest, also returned inline without duplicating script bytes. */
+export const webScriptExportManifestSchema = z.strictObject({
+    capture_path: z.string().min(1),
+    capture_sha256: digestSchema,
+    capture_kind: z.enum(["page-inspection", "browser-scenario"]),
+    source_evidence_id: prefixedDigestSchema("ev").nullable(),
+    capture_completeness: z.union([
+        browserCompletenessSchema,
+        browserScenarioCompletenessSchema,
+    ]),
+    output_directory: z.string().min(1),
+    analysis_input: z
+        .strictObject({
+        input_path: z.string().min(1),
+        format: z.literal("directory"),
+    })
+        .nullable(),
+    scripts: z.array(exportedWebScriptSchema),
+    limitations: z.array(z.string()),
+});
+/** Verified publication including the digest of the persisted manifest. */
+export const webScriptExportResultSchema = webScriptExportManifestSchema.extend({
+    manifest: z.strictObject({
+        path: z.string().min(1),
+        sha256: digestSchema,
+        bytes: z.number().int().min(0),
+    }),
+});

package/dist/domain/webScriptExportError.js

@@ -0,0 +1,13 @@
+import { ArtifactOperationError } from "./artifactOperationError.js";
+/** Publication failure retaining its input/output target and cleanup state. */
+export class WebScriptExportError extends ArtifactOperationError {
+    userMessage;
+    cleanupIncomplete;
+    cleanupResources;
+    constructor(reason, target, diagnostic, residualPaths = []) {
+        super("export_web_scripts", reason);
+        this.userMessage = `Script export failed for ${target}: ${diagnostic}`;
+        this.cleanupResources = residualPaths;
+        this.cleanupIncomplete = residualPaths.length > 0;
+    }
+}

package/dist/domain/webScriptExportPlan.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+const PORTABLE_SEGMENT = /^[A-Za-z0-9_~.-]+$/u;
+const RESERVED_SEGMENT = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu;
+/** Preserve safe URL layouts only when every captured path is unambiguous. */
+export const planWebScriptExport = (scripts) => {
+    const candidates = scripts.map(candidatePath);
+    const conflicts = conflictingPaths(candidates);
+    return scripts.map((script, index) => {
+        if (script.content.state === "unavailable")
+            return {
+                script,
+                record: {
+                    source: script.source,
+                    url: script.url,
+                    content: script.content,
+                },
+            };
+        const candidate = candidates[index];
+        const reason = conflicts.has(index)
+            ? "Captured paths collide by content version, case, or file/directory prefix."
+            : (candidate?.reason ?? null);
+        const path = reason === null ? candidate?.path : undefined;
+        return {
+            script,
+            record: {
+                source: script.source,
+                url: script.url,
+                content: {
+                    state: "exported",
+                    relative_path: path ??
+                        `isolated/source-${index + 1}-${hash(JSON.stringify(script.source))}.js`,
+                    layout: path === undefined ? "isolated" : "url-path",
+                    layout_reason: reason,
+                    sha256: script.content.sha256,
+                    bytes: script.content.bytes.length,
+                    media_type: script.content.media_type,
+                    redacted: script.content.redacted,
+                    representation: script.content.representation,
+                },
+            },
+        };
+    });
+};
+const candidatePath = (script) => {
+    let url;
+    try {
+        url = new URL(script.url);
+    }
+    catch {
+        return {
+            reason: "Source has no absolute HTTP URL (for example an inline script).",
+        };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return { reason: "Source URL scheme has no local module layout mapping." };
+    const parts = url.pathname.slice(1).split("/");
+    if (!/\.(?:js|mjs|cjs)$/u.test(url.pathname) ||
+        parts.some((part) => !PORTABLE_SEGMENT.test(part) ||
+            part === "." ||
+            part === ".." ||
+            part.endsWith(".") ||
+            RESERVED_SEGMENT.test(part)))
+        return {
+            reason: "URL path is not an ordinary portable JavaScript module path.",
+        };
+    return {
+        path: `origins/${hash(url.origin)}/${parts.join("/")}`,
+        reason: url.search !== "" ||
+            url.hash !== "" ||
+            url.username !== "" ||
+            url.password !== ""
+            ? "URL query, fragment, or credentials cannot select a canonical local module."
+            : null,
+    };
+};
+// Register every prefix so case collisions in parent directories and a file
+// conflicting with a directory isolate all affected sources, not just the last.
+const conflictingPaths = (candidates) => {
+    const prefixes = new Map();
+    candidates.forEach(({ path }, index) => {
+        if (path === undefined)
+            return;
+        const parts = path.split("/");
+        parts.forEach((_, position) => {
+            const spelling = parts.slice(0, position + 1).join("/");
+            const key = spelling.toLowerCase();
+            const entry = prefixes.get(key) ?? {
+                spellings: new Set(),
+                indices: [],
+                files: [],
+            };
+            entry.spellings.add(spelling);
+            entry.indices.push(index);
+            if (position === parts.length - 1)
+                entry.files.push(index);
+            prefixes.set(key, entry);
+        });
+    });
+    const conflicts = new Set();
+    for (const entry of prefixes.values())
+        if (entry.spellings.size > 1 ||
+            entry.files.length > 1 ||
+            (entry.files.length > 0 && entry.indices.length > entry.files.length))
+            for (const index of entry.indices)
+                conflicts.add(index);
+    return conflicts;
+};

package/dist/domain/webSourceLocation.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { digestSchema } from "./digests.js";
+import { exportedWebScriptSchema } from "./webScriptExport.js";
+import { capturedWebManifestIdentitySchema, selectedWebScriptInputSchema, webArtifactFileSchema, } from "./webScriptArtifacts.js";
+/** JavaScript source-map positions use UTF-16 columns and one-based lines. */
+export const webSourcePositionSchema = z.strictObject({
+    line: z.number().int().min(1),
+    column: z.number().int().min(0),
+});
+/** Trace one explicit generated position through an explicitly paired local map. */
+export const webSourceLocationInputSchema = selectedWebScriptInputSchema.extend({
+    source_map: z.strictObject({
+        path: z
+            .string()
+            .min(1)
+            .describe("Absolute local source-map path; no fetch"),
+        url: z
+            .string()
+            .min(1)
+            .describe("Explicit source-map URL context used to resolve original source names"),
+    }),
+    generated_position: webSourcePositionSchema,
+});
+const originalContentSchema = z.discriminatedUnion("state", [
+    z.strictObject({
+        state: z.literal("embedded"),
+        text: z.string(),
+        utf8_sha256: digestSchema,
+        utf8_bytes: z.number().int().min(0),
+        representation: z.literal("UTF-8 encoding of decoded sourcesContent text"),
+    }),
+    z.strictObject({
+        state: z.literal("unavailable"),
+        reason: z.literal("sourcesContent-not-retained"),
+    }),
+]);
+/** Keep every matching segment, including anonymous mappings and duplicate URLs. */
+export const webSourceMapMatchSchema = z.discriminatedUnion("state", [
+    z.strictObject({ state: z.literal("generated-only") }),
+    z.strictObject({
+        state: z.literal("mapped"),
+        flattened_source_index: z.number().int().min(0),
+        section_path: z.array(z.number().int().min(0)),
+        source_index: z.number().int().min(0),
+        reported_source: z.string().nullable(),
+        reported_source_root: z.string().nullable(),
+        resolved_url: z.string().nullable(),
+        ignored: z.boolean(),
+        content: originalContentSchema,
+        original_position: webSourcePositionSchema.extend({
+            offset: z.number().int().min(0).nullable(),
+            content_position: z.enum([
+                "verified-in-embedded-text",
+                "outside-embedded-text",
+                "content-unavailable",
+            ]),
+        }),
+        name: z.string().nullable(),
+    }),
+]);
+/** Codec observations; map association and deployment authenticity remain selected context. */
+export const webSourceMapReportSchema = z.strictObject({
+    source_map_sha256: digestSchema,
+    url_context: z.string().min(1),
+    engine: z.strictObject({ id: z.string().min(1), version: z.string().min(1) }),
+    runtime: z.strictObject({
+        id: z.string().min(1),
+        version: z.string().min(1),
+        v8_heap_limit_bytes: z.number().int().min(1),
+    }),
+    format: z.enum(["regular", "indexed"]),
+    reported_file: z.string().nullable(),
+    lookup: z.strictObject({
+        requested: webSourcePositionSchema,
+        matched_generated_position: webSourcePositionSchema.nullable(),
+        semantics: z.literal("greatest generated position <= requested, across lines; all equal-position segments"),
+        location_units: z.literal("one-based lines; zero-based UTF-16 columns"),
+    }),
+    matches: z.array(webSourceMapMatchSchema),
+    diagnostics: z.array(z.string()),
+});
+/** Bounds for complete source-map evidence and upstream decoded layouts. */
+export const WEB_SOURCE_MAP_LIMITS = {
+    mapBytes: 4 * 1024 * 1024,
+    outputBytes: 32 * 1024 * 1024,
+    decodedRows: 262144,
+    decodedSegments: 262144,
+    sectionDepth: 64,
+    decodeTimeoutMs: 20000,
+};
+/** Selected capture/map byte identities and complete point attribution inline. */
+export const webSourceLocationResultSchema = webSourceMapReportSchema.extend({
+    manifest: capturedWebManifestIdentitySchema,
+    source: webArtifactFileSchema.extend({
+        script_index: z.number().int().min(0),
+        script: exportedWebScriptSchema,
+    }),
+    source_map: webArtifactFileSchema.extend({
+        url: z.string().min(1),
+        association: z.literal("caller-selected"),
+    }),
+    generated_offset: z.number().int().min(0),
+    source_authenticity: z.literal("unknown"),
+    execution: z.literal("unknown"),
+    limitations: z.array(z.string()),
+});

package/dist/domain/webSourcePosition.js

@@ -0,0 +1,21 @@
+/** Verify a selected position against actual text without splitting the whole source. */
+export const webSourceOffset = (text, position) => {
+    if (!Number.isSafeInteger(position.line) ||
+        position.line < 1 ||
+        !Number.isSafeInteger(position.column) ||
+        position.column < 0)
+        return undefined;
+    let line = 1;
+    let start = 0;
+    for (const boundary of text.matchAll(/\r\n?|\n|\u2028|\u2029/gu)) {
+        if (line === position.line)
+            return position.column <= boundary.index - start
+                ? start + position.column
+                : undefined;
+        line += 1;
+        start = boundary.index + boundary[0].length;
+    }
+    return line === position.line && position.column <= text.length - start
+        ? start + position.column
+        : undefined;
+};