rea-agents 4.1.0 → 5.0.0

package/dist/browser/CdpElectronInspection.js

@@ -1,7 +1,7 @@
 import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { delayWithCancellation, numberValue, recordValue, recordsValue, requiredRecord, stringValue, } from "./CdpCaptureValues.js";
+import { delayWithCancellation, numberValue, recordValue, recordsValue, requiredRecord, cdpStringValue, } from "./CdpCaptureValues.js";
 import { walkFrameTrees } from "./CdpCaptureDocuments.js";
 import { ingestElectronScriptEvent, } from "./CdpElectronScriptEvents.js";
 import { captureElectronScripts } from "./CdpElectronScripts.js";
@@ -124,9 +124,9 @@ const navigatedFrameId = (event) => {
     if (params === undefined)
         return undefined;
     if (event.method === "Page.frameNavigated")
-        return stringValue(recordValue(params.frame)?.id);
+        return cdpStringValue(recordValue(params.frame)?.id);
     if (event.method === "Page.navigatedWithinDocument")
-        return stringValue(params.frameId);
+        return cdpStringValue(params.frameId);
     return undefined;
 };
 const captureFrames = async (result, completeness) => {
@@ -136,15 +136,15 @@ const captureFrames = async (result, completeness) => {
     const frames = [];
     for (const tree of walkFrameTrees(frameTree, () => completeness.exclude("frames", "invalid_protocol_value"))) {
         const frame = recordValue(tree.frame);
-        const frameId = stringValue(frame?.id);
-        const path = await authorizedElectronFile(stringValue(frame?.url) ?? "");
+        const frameId = cdpStringValue(frame?.id);
+        const path = await authorizedElectronFile(cdpStringValue(frame?.url) ?? "");
         if (frameId === undefined || path === undefined) {
             completeness.exclude("frames", "out_of_target_scope");
             continue;
         }
         frames.push({
             frame_id: frameId,
-            parent_frame_id: stringValue(frame?.parentId) ?? null,
+            parent_frame_id: cdpStringValue(frame?.parentId) ?? null,
             file_path: path,
         });
     }
@@ -163,15 +163,15 @@ const captureResources = async (context, completeness) => {
         if (tree === undefined)
             break;
         for (const resource of recordsValue(tree.resources)) {
-            const path = await authorizedElectronFile(stringValue(resource.url) ?? "");
+            const path = await authorizedElectronFile(cdpStringValue(resource.url) ?? "");
             if (path === undefined) {
                 completeness.exclude("resources", "out_of_target_scope");
                 continue;
             }
             const item = {
                 file_path: path,
-                type: stringValue(resource.type) ?? "Other",
-                mime_type: stringValue(resource.mimeType) ?? "",
+                type: cdpStringValue(resource.type) ?? "Other",
+                mime_type: cdpStringValue(resource.mimeType) ?? "",
                 content_size: numberValue(resource.contentSize) === undefined
                     ? null
                     : Math.max(0, numberValue(resource.contentSize) ?? 0),
@@ -230,7 +230,7 @@ const captureDom = async (context, completeness) => {
 const mainFilePath = async (result) => {
     const frameTree = recordValue(requiredRecord(result).frameTree);
     const frame = recordValue(frameTree?.frame);
-    return await authorizedElectronFile(stringValue(frame?.url) ?? "");
+    return await authorizedElectronFile(cdpStringValue(frame?.url) ?? "");
 };
 const arrayValue = (value) => Array.isArray(value) ? value : [];
 const stringAt = (strings, value) => strings[integer(value, -1)] ?? "";

package/dist/browser/CdpElectronProvider.js

@@ -1,4 +1,4 @@
-import { electronPageInspectionSchema, electronTargetListSchema, } from "../domain/electronObservation.js";
+import { electronPageInspectionSchema, electronTargetListSchema, } from "../domain/javascript/electronObservation.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
@@ -9,11 +9,8 @@ import { closeCdpTargetSession, openCdpTargetSession, } from "./CdpTargetSession
 import { inspectCdpElectronPage } from "./CdpElectronInspection.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
 /** Public identity committed by passive Electron observations. */
-export const CDP_ELECTRON_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-cdp-electron",
-    name: "REA Electron file-page CDP observation provider",
-    version: "1",
-});
+export { CDP_ELECTRON_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { CDP_ELECTRON_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const IDENTITY = CDP_ELECTRON_PROVIDER_IDENTITY;
 /** Passive Electron provider for local file pages exposed by loopback CDP. */
 export class CdpElectronProvider {

package/dist/browser/CdpElectronScriptEvents.js

@@ -1,5 +1,5 @@
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { numberValue, recordValue, stringValue } from "./CdpCaptureValues.js";
+import { numberValue, recordValue, cdpStringValue, } from "./CdpCaptureValues.js";
 /** Retain script/frame metadata from passive Electron events. */
 export const ingestElectronScriptEvent = (input) => {
     if (input.event.method === "Runtime.executionContextsCleared") {
@@ -20,8 +20,8 @@ export const ingestElectronScriptEvent = (input) => {
     if (input.event.method !== "Debugger.scriptParsed")
         return;
     const value = recordValue(input.event.params);
-    const scriptId = stringValue(value?.scriptId);
-    const rawUrl = stringValue(value?.url);
+    const scriptId = cdpStringValue(value?.scriptId);
+    const rawUrl = cdpStringValue(value?.url);
     if (scriptId === undefined) {
         input.completeness.exclude("scripts", "invalid_protocol_value");
         return;
@@ -33,10 +33,10 @@ export const ingestElectronScriptEvent = (input) => {
     input.scripts.push({
         scriptId,
         rawUrl,
-        hash: stringValue(value?.hash) ?? "",
+        hash: cdpStringValue(value?.hash) ?? "",
         length: nonnegativeInteger(value?.length),
         isModule: value?.isModule === true,
-        language: stringValue(value?.scriptLanguage) ?? null,
+        language: cdpStringValue(value?.scriptLanguage) ?? null,
         executionContextKey: executionContextKey(value?.executionContextId),
     });
 };
@@ -44,7 +44,7 @@ const retainExecutionContext = (event, frames) => {
     const parameters = recordValue(event.params);
     const runtimeContext = recordValue(parameters?.context);
     const contextKey = executionContextKey(runtimeContext?.id);
-    const frameId = stringValue(recordValue(runtimeContext?.auxData)?.frameId);
+    const frameId = cdpStringValue(recordValue(runtimeContext?.auxData)?.frameId);
     if (contextKey === null || frameId === undefined)
         return;
     frames.set(contextKey, frameId);

package/dist/browser/CdpElectronScripts.js

@@ -1,7 +1,7 @@
 import { canonicalDigest } from "../domain/comparisonSemantics.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { requiredRecord, stringValue } from "./CdpCaptureValues.js";
+import { requiredRecord, cdpStringValue } from "./CdpCaptureValues.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
 /** Normalize local script metadata and optionally approved source. */
 export const captureElectronScripts = async (input) => {
@@ -55,7 +55,7 @@ const captureScriptSource = async (input, script) => {
             },
         };
     const result = requiredRecord(await input.connection.send("Debugger.getScriptSource", { scriptId: script.scriptId }, input.sessionId, input.signal));
-    const text = stringValue(result.scriptSource) ?? "";
+    const text = cdpStringValue(result.scriptSource) ?? "";
     return {
         source: {
             included: true,

package/dist/browser/CdpElectronWorkers.js

@@ -1,5 +1,5 @@
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
-import { recordValue, recordsValue, stringValue } from "./CdpCaptureValues.js";
+import { recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 import { authorizedElectronFile } from "./ElectronFileScope.js";
 /** Inventory local worker targets without attaching to them. */
@@ -15,7 +15,7 @@ export const captureElectronWorkers = async (input) => {
     }
     const workers = [];
     for (const target of recordsValue(recordValue(result)?.targetInfos)) {
-        const type = stringValue(target.type) ?? "";
+        const type = cdpStringValue(target.type) ?? "";
         if (!type.includes("worker"))
             continue;
         const openerTargetId = boundedTargetField(target.openerId);
@@ -25,7 +25,7 @@ export const captureElectronWorkers = async (input) => {
             input.completeness.exclude("workers", "out_of_target_scope");
             continue;
         }
-        const path = await authorizedElectronFile(stringValue(target.url) ?? "");
+        const path = await authorizedElectronFile(cdpStringValue(target.url) ?? "");
         if (path === undefined) {
             input.completeness.exclude("workers", "out_of_target_scope");
             continue;
@@ -47,6 +47,6 @@ export const captureElectronWorkers = async (input) => {
     return workers.sort((left, right) => left.target_id.localeCompare(right.target_id));
 };
 const boundedTargetField = (value) => {
-    const field = stringValue(value);
+    const field = cdpStringValue(value);
     return field === undefined || field === "" ? null : field;
 };

package/dist/browser/CdpObservationSession.js

@@ -3,9 +3,10 @@ import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { authorizedMainFrame } from "./CdpAuthorizedMainFrame.js";
-import { allowedSanitizedUrl, isHttpUrl, numberValue, recordValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, isHttpUrl, numberValue, recordValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { isMainFrameNavigation } from "./CdpCaptureEventHelpers.js";
+import { cdpTargetEventMatches } from "./CdpTargetEvents.js";
 /** Observe external user actions without rejecting approved same-origin navigation. */
 export const observeCdpSession = async (context) => {
     const allowedOrigins = new Set(context.input.allowed_origins);
@@ -14,7 +15,7 @@ export const observeCdpSession = async (context) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: "observe_web_session",
+        operation: "observe_web_session",
     });
     const initialUrl = mainFrameUrl(initial) ?? "";
     const mainFrameId = frameId(initial);
@@ -22,7 +23,7 @@ export const observeCdpSession = async (context) => {
         throw new BrowserObservationError("inspect_web_page", "protocol_error");
     const capture = new TimelineCapture(allowedOrigins, mainFrameId, initialUrl);
     const removeListener = context.connection.onEvent((event) => {
-        if (observationEventMatches(event, context.sessionId))
+        if (cdpTargetEventMatches(event, context.sessionId))
             capture.ingest(event);
     });
     const removeDisconnectListener = context.connection.onDisconnect(() => capture.targetTerminated());
@@ -160,7 +161,7 @@ class TimelineCapture {
         this.#add({
             type: "navigation_requested",
             params,
-            rawUrl: stringValue(params.url) ?? null,
+            rawUrl: cdpStringValue(params.url) ?? null,
             requestId: null,
             detail: reason,
         });
@@ -169,7 +170,7 @@ class TimelineCapture {
         const frame = recordValue(params.frame);
         if (!isMainFrameNavigation(event, this.mainFrameId))
             return;
-        const rawUrl = stringValue(frame?.url);
+        const rawUrl = cdpStringValue(frame?.url);
         const destination = scopedUrl(rawUrl, this.allowedOrigins);
         this.#add({
             type: this.#pendingReload ? "same_origin_reload" : "navigation_committed",
@@ -190,7 +191,7 @@ class TimelineCapture {
     #sameDocument(event, params) {
         if (!isMainFrameNavigation(event, this.mainFrameId))
             return;
-        const rawUrl = stringValue(params.url);
+        const rawUrl = cdpStringValue(params.url);
         const destination = scopedUrl(rawUrl, this.allowedOrigins);
         this.#add({
             type: "same_document_navigation",
@@ -208,20 +209,20 @@ class TimelineCapture {
         }
     }
     #redirect(params) {
-        const resourceType = stringValue(params.type);
+        const resourceType = cdpStringValue(params.type);
         if (resourceType !== undefined && resourceType !== "Document")
             return;
-        if (stringValue(params.frameId) !== this.mainFrameId ||
+        if (cdpStringValue(params.frameId) !== this.mainFrameId ||
             recordValue(params.redirectResponse) === undefined)
             return;
         const request = recordValue(params.request);
-        const rawUrl = stringValue(request?.url);
+        const rawUrl = cdpStringValue(request?.url);
         const destination = scopedUrl(rawUrl, this.allowedOrigins);
         this.#add({
             type: "redirect",
             params,
             rawUrl: rawUrl ?? null,
-            requestId: stringValue(params.requestId) ?? null,
+            requestId: cdpStringValue(params.requestId) ?? null,
             detail: null,
         });
         if (destination.scope !== "approved") {
@@ -230,19 +231,19 @@ class TimelineCapture {
         }
     }
     #loadingFailed(params) {
-        const frame = stringValue(params.frameId);
+        const frame = cdpStringValue(params.frameId);
         if (frame !== undefined && frame !== this.mainFrameId)
             return;
         this.#add({
             type: "load_failed",
             params,
             rawUrl: null,
-            requestId: stringValue(params.requestId) ?? null,
+            requestId: cdpStringValue(params.requestId) ?? null,
             detail: safeNetworkError(params.errorText),
         });
     }
     #lifecycle(params) {
-        if (stringValue(params.frameId) !== this.mainFrameId)
+        if (cdpStringValue(params.frameId) !== this.mainFrameId)
             return;
         this.#add({
             type: "lifecycle",
@@ -269,12 +270,6 @@ class TimelineCapture {
         });
     }
 }
-const observationEventMatches = (event, sessionId) => {
-    if (event.method !== "Target.detachedFromTarget")
-        return event.sessionId === sessionId;
-    return (sessionId !== undefined &&
-        stringValue(recordValue(event.params)?.sessionId) === sessionId);
-};
 const waitForWindow = async (durationMs, capture, signal) => await new Promise((resolve, reject) => {
     let settled = false;
     let removeEnd = () => { };
@@ -313,7 +308,7 @@ const captureFinalUrl = async (context, capture, allowedOrigins) => {
     capture.completeness.exclude("timeline", url === undefined ? "invalid_protocol_value" : "out_of_target_scope");
     return "target_left_scope";
 };
-const frameId = (result) => stringValue(recordValue(recordValue(recordValue(result)?.frameTree)?.frame)?.id);
+const frameId = (result) => cdpStringValue(recordValue(recordValue(recordValue(result)?.frameTree)?.frame)?.id);
 const scopedUrl = (value, allowedOrigins) => {
     const allowed = allowedSanitizedUrl(value, allowedOrigins);
     if (allowed !== undefined)
@@ -322,15 +317,15 @@ const scopedUrl = (value, allowedOrigins) => {
         ? { url: null, scope: "outside_policy" }
         : { url: null, scope: "unsupported" };
 };
-const boundedId = (value) => stringValue(value) ?? null;
+const boundedId = (value) => cdpStringValue(value) ?? null;
 const safeDetail = (value) => {
-    const detail = stringValue(value)?.toLowerCase();
+    const detail = cdpStringValue(value)?.toLowerCase();
     return detail !== undefined && /^[a-z0-9_.:-]{1,100}$/u.test(detail)
         ? detail
         : null;
 };
 const safeNetworkError = (value) => {
-    const error = stringValue(value);
+    const error = cdpStringValue(value);
     return error !== undefined && /^net::ERR_[A-Z0-9_]{1,100}$/u.test(error)
         ? error
         : null;

package/dist/browser/CdpPageCapture.js

@@ -48,7 +48,7 @@ const captureAuthorizedPage = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const attachedUrl = mainFrameUrl(frameResult) ?? "";
     const frameCapture = captureFrames(frameResult, allowedOrigins, undefined, state.events.completeness);
@@ -69,7 +69,7 @@ const captureAuthorizedPage = async (state) => {
         frameIds: new Set(frames.map((frame) => frame.frame_id)),
     });
     const workers = await captureWorkers({ context, allowedOrigins, limitations, events: state.events }, new Set(frames.map((frame) => frame.frame_id)));
-    const storageCapture = await captureStorage(context, frames[0]?.origin ?? new URL(attachedUrl).origin, limitations);
+    const storageCapture = await captureStorage(context, attachedUrl, limitations);
     if (!input.include_storage_keys)
         state.events.completeness.exclude("storage_keys", "not_approved", null);
     const completedFrameResult = await authorizedMainFrame({
@@ -77,7 +77,7 @@ const captureAuthorizedPage = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const completedUrl = mainFrameUrl(completedFrameResult) ?? "";
     if (state.events.originViolation)
@@ -125,7 +125,7 @@ const authorizeObservationWindow = async (state) => {
         sessionId: context.sessionId,
         signal: context.signal,
         allowedOrigins,
-        delayOperation: context.operation,
+        operation: context.operation,
     });
     const mainFrame = captureFrames(initialFrameResult, allowedOrigins).items[0];
     if (mainFrame === undefined)

package/dist/browser/CdpPageCaptureScripts.js

@@ -1,5 +1,5 @@
 import { reconcileCapturedWebScript, stableWebScriptKey, } from "../domain/webInventory.js";
-import { requiredRecord, sourceExcluded, sourceResult, stringValue, } from "./CdpCaptureValues.js";
+import { requiredRecord, sourceExcluded, sourceResult, cdpStringValue, } from "./CdpCaptureValues.js";
 export const captureScripts = async (options) => {
     const { context, events, rawResources, resources, frameIds } = options;
     const state = {
@@ -43,7 +43,7 @@ const buildScriptDraft = async (script, state) => {
 const captureScriptSource = async (script, state) => {
     const { context } = state;
     const result = requiredRecord(await context.connection.send("Debugger.getScriptSource", { scriptId: script.scriptId }, context.sessionId, context.signal));
-    const content = stringValue(result.scriptSource) ?? "";
+    const content = cdpStringValue(result.scriptSource) ?? "";
     return sourceResult(content);
 };
 const keyAndBuildInventory = (drafts, scriptCount) => {

package/dist/browser/CdpPageCaptureWorkers.js

@@ -1,4 +1,4 @@
-import { allowedSanitizedUrl, isHttpUrl, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, isHttpUrl, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 export const captureWorkers = async (input, frameIds) => {
     const { context, allowedOrigins, limitations, events } = input;
@@ -8,11 +8,11 @@ export const captureWorkers = async (input, frameIds) => {
     if (result === undefined)
         completeness.unavailable("workers");
     for (const target of recordsValue(recordValue(result)?.targetInfos)) {
-        const type = stringValue(target.type) ?? "";
+        const type = cdpStringValue(target.type) ?? "";
         const url = allowedSanitizedUrl(target.url, allowedOrigins);
-        const relatedToPage = stringValue(target.openerId) === context.target.id ||
-            (stringValue(target.parentFrameId) !== undefined &&
-                frameIds.has(stringValue(target.parentFrameId) ?? ""));
+        const relatedToPage = cdpStringValue(target.openerId) === context.target.id ||
+            (cdpStringValue(target.parentFrameId) !== undefined &&
+                frameIds.has(cdpStringValue(target.parentFrameId) ?? ""));
         if (!type.includes("worker"))
             continue;
         if (!relatedToPage) {
@@ -20,7 +20,7 @@ export const captureWorkers = async (input, frameIds) => {
             continue;
         }
         if (url === undefined) {
-            const rawUrl = stringValue(target.url);
+            const rawUrl = cdpStringValue(target.url);
             completeness.exclude("workers", rawUrl === undefined || rawUrl === ""
                 ? "unattributed_origin"
                 : isHttpUrl(rawUrl)
@@ -29,13 +29,13 @@ export const captureWorkers = async (input, frameIds) => {
             continue;
         }
         items.push({
-            target_id: stringValue(target.targetId) ?? "",
+            target_id: cdpStringValue(target.targetId) ?? "",
             type,
             url: url.url,
             origin: url.origin,
             attached: target.attached === true,
-            opener_target_id: stringValue(target.openerId) ?? null,
-            parent_frame_id: stringValue(target.parentFrameId) ?? null,
+            opener_target_id: cdpStringValue(target.openerId) ?? null,
+            parent_frame_id: cdpStringValue(target.parentFrameId) ?? null,
         });
     }
     return items;

package/dist/browser/CdpSafeMetadata.js

@@ -1,5 +1,5 @@
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
-import { numberValue, stringValue, } from "./CdpCaptureValues.js";
+import { numberValue, cdpStringValue, } from "./CdpCaptureValues.js";
 /** Normalize an allowlisted subset of response metadata and discard raw headers. */
 export const safeResponseMetadata = (requestId, url, response, allowedOrigins) => {
     const headers = normalizedHeaders(response.headers);
@@ -16,7 +16,7 @@ export const safeResponseMetadata = (requestId, url, response, allowedOrigins) =
         response: {
             request_id: requestId,
             url,
-            mime_type: boundedHeader(stringValue(response.mimeType)),
+            mime_type: boundedHeader(cdpStringValue(response.mimeType)),
             content_length: nonnegativeInteger(headers.get("content-length")),
             content_encoding: boundedHeader(headers.get("content-encoding")),
             csp,
@@ -25,7 +25,7 @@ export const safeResponseMetadata = (requestId, url, response, allowedOrigins) =
                 coop: policyToken(headers.get("cross-origin-opener-policy")),
                 coep: policyToken(headers.get("cross-origin-embedder-policy")),
                 corp: policyToken(headers.get("cross-origin-resource-policy")),
-                referrer_policy: policyToken(headers.get("referrer-policy")),
+                referrer_policy: referrerPolicy(headers.get("referrer-policy")),
                 x_content_type_options: policyToken(headers.get("x-content-type-options")),
                 permissions_policy_features: permissionFeatures(headers.get("permissions-policy")),
             },
@@ -156,25 +156,40 @@ const parseLinks = (value, baseUrl, allowedOrigins) => {
     }
     return links;
 };
-const splitLinkHeader = (value) => {
+const splitLinkHeader = (value, delimiter = ",") => {
     const entries = [];
     let start = 0;
     let quoted = false;
+    let escaped = false;
+    let target = false;
     for (let index = 0; index < value.length; index += 1) {
         const character = value[index];
-        if (character === '"' && value[index - 1] !== "\\")
-            quoted = !quoted;
-        if (character !== "," || quoted)
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (character === "\\")
+                escaped = true;
+            else if (character === '"')
+                quoted = false;
             continue;
-        entries.push(value.slice(start, index));
-        start = index + 1;
+        }
+        if (character === '"' && !target)
+            quoted = true;
+        else if (delimiter === "," && character === "<")
+            target = true;
+        else if (delimiter === "," && character === ">")
+            target = false;
+        else if (character === delimiter && !target) {
+            entries.push(value.slice(start, index));
+            start = index + 1;
+        }
     }
     entries.push(value.slice(start));
     return entries;
 };
 const linkParameters = (value) => {
     const parameters = new Map();
-    for (const raw of value.split(";").slice(1)) {
+    for (const raw of splitLinkHeader(value, ";").slice(1)) {
         const separator = raw.indexOf("=");
         const name = (separator < 0 ? raw : raw.slice(0, separator))
             .trim()
@@ -228,6 +243,29 @@ const agentHint = (mechanism, declaration, url) => ({
     trust: "page-declared-untrusted",
 });
 const isAgentRel = (value) => ["mcp", "model-context", "ai-plugin", "service-desc"].includes(value);
+const referrerPolicies = new Set([
+    "no-referrer",
+    "no-referrer-when-downgrade",
+    "same-origin",
+    "origin",
+    "strict-origin",
+    "origin-when-cross-origin",
+    "strict-origin-when-cross-origin",
+    "unsafe-url",
+]);
+const referrerPolicy = (value) => {
+    let policy = null;
+    for (const raw of (value ?? "").split(",")) {
+        const token = raw.trim().toLowerCase();
+        if (token === "")
+            continue;
+        if (!/^[a-z-]+$/u.test(token))
+            return null;
+        if (referrerPolicies.has(token))
+            policy = token;
+    }
+    return policy;
+};
 const policyToken = (value) => {
     const token = (value ?? "").trim().toLowerCase();
     return /^[a-z][a-z0-9_.-]*$/u.test(token) ? token : null;

package/dist/browser/CdpScreenshot.js

@@ -1,7 +1,7 @@
 import { createWebScreenshotArtifact } from "../domain/webScreenshot.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { isMainFrameNavigation } from "./CdpCaptureEventHelpers.js";
-import { allowedSanitizedUrl, recordValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, recordValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { captureFrames } from "./CdpCaptureDocuments.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
@@ -27,7 +27,7 @@ export const captureCdpScreenshot = async (context) => {
         changed: false,
         leftScope: false,
         url: beforeUrl,
-        loaderId: stringValue(initialFrame?.loaderId),
+        loaderId: cdpStringValue(initialFrame?.loaderId),
     };
     const removeListener = context.connection.onEvent((event) => {
         if (event.sessionId !== context.sessionId)
@@ -43,7 +43,7 @@ export const captureCdpScreenshot = async (context) => {
     finally {
         removeListener();
     }
-    const encoded = stringValue(result?.data);
+    const encoded = cdpStringValue(result?.data);
     const bytes = encoded === undefined ? undefined : decodeCanonicalBase64(encoded);
     if (bytes === undefined)
         throw new BrowserObservationError("inspect_web_page", "payload_limit");
@@ -89,8 +89,8 @@ const observeScreenshotNavigation = (event, mainFrameId, origins, state) => {
     if (event.method === "Page.frameNavigated" &&
         state.loaderId !== undefined &&
         state.loaderId !== "" &&
-        stringValue(frame?.loaderId) === state.loaderId &&
-        stringValue(frame?.url) === state.url)
+        cdpStringValue(frame?.loaderId) === state.loaderId &&
+        cdpStringValue(frame?.url) === state.url)
         return;
     state.changed = true;
     if (allowedSanitizedUrl(frame?.url, origins) === undefined)

package/dist/browser/CdpTargetEvents.js

@@ -0,0 +1,8 @@
+import { cdpStringValue, recordValue } from "./CdpCaptureValues.js";
+/** Match ordinary session envelopes and root detachment's parameter-scoped session identity. */
+export const cdpTargetEventMatches = (event, sessionId) => {
+    if (event.method !== "Target.detachedFromTarget")
+        return event.sessionId === sessionId;
+    return (sessionId !== undefined &&
+        cdpStringValue(recordValue(event.params)?.sessionId) === sessionId);
+};

package/dist/browser/CdpTargetSession.js

@@ -3,9 +3,9 @@ import {} from "../domain/browserObservationErrors.js";
 import { CdpConnection } from "./CdpConnection.js";
 import { cdpTargetWebSocket, } from "./CdpEndpoint.js";
 /** Open one authorized target through its supported browser or page transport. */
-export const openCdpTargetSession = async (discovery, target, operation, signal) => {
+export const openCdpTargetSession = async (discovery, target, operation, signal, limits) => {
     const webSocket = cdpTargetWebSocket(discovery, target, operation);
-    const connection = await CdpConnection.connect(webSocket.url, operation, signal);
+    const connection = await CdpConnection.connect(webSocket.url, operation, signal, limits);
     if (webSocket.scope === "page")
         return { connection, sessionId: undefined };
     try {