rea-agents 4.1.0 → 5.0.0

package/dist/browser/CdpWebMcpDiscovery.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { inferJsonShape } from "../domain/jsonShape.js";
 import { CdpCaptureCompleteness } from "./CdpCaptureCompleteness.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
-import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, stringValue, } from "./CdpCaptureValues.js";
+import { allowedSanitizedUrl, delayWithCancellation, numberValue, recordValue, recordsValue, cdpStringValue, } from "./CdpCaptureValues.js";
 import { captureFrames, mainFrameUrl, walkFrameTrees, } from "./CdpCaptureDocuments.js";
 import { optionalCdpCommand } from "./CdpOptionalCommand.js";
 /** Discover WebMCP registrations without evaluating or invoking page code. */
@@ -96,10 +96,13 @@ const initialFrameScope = (frameTree, frames, completeness) => {
         return scoped;
     for (const tree of walkFrameTrees(root, () => completeness.exclude("webmcp_tools", "invalid_protocol_value"))) {
         const frame = recordValue(tree.frame);
-        const frameId = stringValue(frame?.id);
+        const frameId = cdpStringValue(frame?.id);
         const prior = frameId === undefined ? undefined : scoped.get(frameId);
         if (frameId !== undefined && prior !== undefined)
-            scoped.set(frameId, { ...prior, loaderId: stringValue(frame?.loaderId) });
+            scoped.set(frameId, {
+                ...prior,
+                loaderId: cdpStringValue(frame?.loaderId),
+            });
     }
     return scoped;
 };
@@ -119,7 +122,7 @@ const ingestFrameScopeEvent = (event, state) => {
     }
 };
 const handleFrameDetached = (params, state) => {
-    const frameId = stringValue(params.frameId);
+    const frameId = cdpStringValue(params.frameId);
     if (frameId === undefined) {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
@@ -134,12 +137,12 @@ const handleFrameUpdate = (frame, state, documentCommitted) => {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
     }
-    const frameId = stringValue(frame?.id) ?? stringValue(frame?.frameId);
+    const frameId = cdpStringValue(frame?.id) ?? cdpStringValue(frame?.frameId);
     if (frameId === undefined) {
         state.completeness.exclude("webmcp_tools", "invalid_protocol_value");
         return true;
     }
-    const rawUrl = stringValue(frame?.url);
+    const rawUrl = cdpStringValue(frame?.url);
     // Chromium can briefly commit an inherited, empty document while replacing
     // a subframe. That intermediate URL says nothing about the frame's eventual
     // scope or its registered tools; wait for the next committed URL (or the
@@ -164,7 +167,7 @@ const updateFrameScope = (frame, frameId, state, documentCommitted) => {
         return;
     }
     const previous = state.frames.get(frameId);
-    const loaderId = stringValue(frame?.loaderId);
+    const loaderId = cdpStringValue(frame?.loaderId);
     if (hasNewDocument(documentCommitted, previous, url.url, loaderId))
         removeFrameTools(frameId, state.tools);
     if (documentCommitted && state.transientFrames.has(frameId))
@@ -173,7 +176,7 @@ const updateFrameScope = (frame, frameId, state, documentCommitted) => {
         url: url.url,
         origin: url.origin,
         ...(loaderId === undefined ? {} : { loaderId }),
-        parentFrameId: (stringValue(frame?.parentId) ??
+        parentFrameId: (cdpStringValue(frame?.parentId) ??
             state.frames.get(frameId)?.parentFrameId ??
             "") ||
             null,
@@ -223,8 +226,8 @@ const ingestWebMcpEvent = (options) => {
         return;
     if (event.method === "WebMCP.toolsRemoved") {
         for (const removed of recordsValue(params.tools)) {
-            const name = stringValue(removed.name);
-            const frameId = stringValue(removed.frameId);
+            const name = cdpStringValue(removed.name);
+            const frameId = cdpStringValue(removed.frameId);
             if (name === undefined || frameId === undefined)
                 continue;
             for (const [key, tool] of tools)
@@ -236,7 +239,7 @@ const ingestWebMcpEvent = (options) => {
     if (event.method !== "WebMCP.toolsAdded")
         return;
     for (const declared of recordsValue(params.tools)) {
-        const frameId = stringValue(declared.frameId);
+        const frameId = cdpStringValue(declared.frameId);
         if (frameId !== undefined && transientFrames.has(frameId)) {
             if (!resolvedTransientFrames.has(frameId))
                 continue;
@@ -250,8 +253,8 @@ const ingestWebMcpEvent = (options) => {
     }
 };
 const normalizeTool = (value, input, frames, completeness) => {
-    const frameId = stringValue(value.frameId);
-    const name = stringValue(value.name);
+    const frameId = cdpStringValue(value.frameId);
+    const name = cdpStringValue(value.name);
     const frame = frameId === undefined ? undefined : frames.get(frameId);
     if (frameId === undefined ||
         name === undefined ||
@@ -260,10 +263,10 @@ const normalizeTool = (value, input, frames, completeness) => {
         completeness.exclude("webmcp_tools", "out_of_target_scope");
         return undefined;
     }
-    const description = stringValue(value.description) ?? "";
+    const description = cdpStringValue(value.description) ?? "";
     const annotations = recordValue(value.annotations);
     return {
-        tool_key: toolKey(frame.url, name),
+        tool_key: toolKey(frame.url, frameId, name),
         name,
         description,
         frame_id: frameId,
@@ -322,7 +325,10 @@ const buildWebMcpResult = (options) => {
         limitations,
     };
 };
-const toolKey = (frameUrl, name) => `webmcp_${createHash("sha256").update(`${frameUrl}\0${name}`).digest("hex")}`;
+const toolKey = (frameUrl, frameId, name) => 
+// Registrations without a known admitted frame are excluded above, so the
+// frame ID here always distinguishes owners and keys cannot collapse.
+`webmcp_${createHash("sha256").update(`${frameUrl}\0${frameId}\0${name}`).digest("hex")}`;
 const booleanOrNull = (value) => typeof value === "boolean" ? value : null;
 const integerOrNull = (value) => {
     const number = numberValue(value);

package/dist/browser/PlaywrightBrowserScenarioProvider.js

@@ -11,11 +11,8 @@ const lazyPlaywrightFactory = {
         return (await defaultFactory).open(scenario, options);
     },
 };
-export const PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-playwright-browser-scenario",
-    name: "REA Playwright browser scenario capture provider",
-    version: "1",
-});
+export { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { PLAYWRIGHT_BROWSER_SCENARIO_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const SNAPSHOT_KINDS = [
     "screenshot",
     "dom",
@@ -189,6 +186,7 @@ const runScenario = async (factory, scenario, options) => {
             start_origin: new URL(scenario.start_url.url).origin,
             action_count: scenario.actions.length,
             secret_references: scenario.secrets.map(({ secret_id: id }) => id).sort(),
+            network_content: scenario.capture.network,
         },
         duration_ms: Date.now() - startedAt,
         steps,
@@ -196,7 +194,10 @@ const runScenario = async (factory, scenario, options) => {
         completeness,
         limitations: [
             "Event sequence records provider receipt order; simultaneous browser causality is not inferred.",
-            "Response bodies are not retained.",
+            "Network content is retained only when selected; response bytes are browser-decoded, not compressed wire bytes.",
+            "Request bytes are limited to what Playwright exposes; not_exposed does not establish body absence or multipart file coverage.",
+            "Network content reads settle within 5 seconds each and never wait for unfinished responses or refetch them.",
+            "Playwright scenario events do not expose request initiator stacks; receipt order does not prove causality.",
             "Storage values are hashed only after declared-secret redaction.",
             ...(session.eventLimitations?.() ?? []),
             ...(session.mode === "connect"

package/dist/browser/PlaywrightElectronActiveProvider.js

@@ -3,7 +3,7 @@ import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { _electron as electron } from "playwright-core";
-import { electronActiveObservationResultSchema, } from "../domain/electronActiveObservation.js";
+import { electronActiveObservationResultSchema, } from "../domain/javascript/electronActiveObservation.js";
 import { AnalysisError } from "../domain/analysisErrorBase.js";
 import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { ProviderAdapterError } from "../domain/providerAdapterError.js";
@@ -15,11 +15,8 @@ import { runElectronActions, readApplicationState, runWithExecutionLimits, } fro
 const OPERATION = "capture_electron_scenario";
 const STARTUP_TIMEOUT_MS = 60_000;
 /** Public identity for provider-owned Electron runtime experiments. */
-export const PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-playwright-electron-active",
-    name: "REA Playwright active Electron observation provider",
-    version: "1",
-});
+export { PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { PLAYWRIGHT_ELECTRON_ACTIVE_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const hookPath = fileURLToPath(new URL("../../scripts/electron-active-hook.cjs", import.meta.url));
 const observableEventFamilies = [
     "app-lifecycle",

package/dist/browser/PlaywrightScenarioEvents.js

@@ -1,4 +1,5 @@
 import { browserScenarioEventSchema, } from "../domain/browserScenarioCapture.js";
+import { PlaywrightScenarioNetwork } from "./network/PlaywrightScenarioNetwork.js";
 /** Arrival-ordered Playwright event capture with current-step attribution. */
 export class PlaywrightScenarioEvents {
     items = [];
@@ -9,8 +10,18 @@ export class PlaywrightScenarioEvents {
     ownsContext;
     pages = new Set();
     incompleteFamilies = new Set();
+    network;
+    stopNetwork;
+    sealed = false;
     constructor(options) {
-        this.enabled = options.enabled;
+        const network = options.network ?? {
+            request_body: false,
+            response_body: false,
+            header_values: false,
+        };
+        this.enabled = new Set(options.enabled);
+        if (network.request_body || network.response_body || network.header_values)
+            this.enabled = new Set([...this.enabled, "network"]);
         this.secrets = options.secrets;
         this.ownsContext = options.ownsContext === true;
         this.pages.add(options.page);
@@ -18,6 +29,13 @@ export class PlaywrightScenarioEvents {
             (options.context ?? options.page.context()).on("page", (page) => this.popup(page));
         if (this.enabled.has("network")) {
             const context = options.context ?? options.page.context();
+            const collector = new PlaywrightScenarioNetwork({
+                selection: network,
+                secrets: options.secrets,
+                emit: (event) => this.push(event),
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
+            });
+            this.network = collector;
             const inScope = (request) => {
                 if (this.ownsContext)
                     return true;
@@ -31,18 +49,32 @@ export class PlaywrightScenarioEvents {
                     return false;
                 }
             };
-            context.on("request", (request) => {
+            const onRequest = (request) => {
                 if (inScope(request))
-                    this.request("request", request);
-            });
-            context.on("response", (response) => {
+                    collector.request(request);
+            };
+            const onResponse = (response) => {
                 if (inScope(response.request()))
-                    this.response(response);
-            });
-            context.on("requestfailed", (request) => {
+                    collector.response(response);
+            };
+            const onFailed = (request) => {
                 if (inScope(request))
-                    this.request("request-failed", request);
-            });
+                    collector.failed(request);
+            };
+            const onFinished = (request) => {
+                if (inScope(request))
+                    collector.finished(request);
+            };
+            context.on("request", onRequest);
+            context.on("response", onResponse);
+            context.on("requestfailed", onFailed);
+            context.on("requestfinished", onFinished);
+            this.stopNetwork = () => {
+                context.off("request", onRequest);
+                context.off("response", onResponse);
+                context.off("requestfailed", onFailed);
+                context.off("requestfinished", onFinished);
+            };
         }
         this.observePage(options.page);
     }
@@ -55,15 +87,27 @@ export class PlaywrightScenarioEvents {
     lastSequence() {
         return this.sequence;
     }
+    /** Drain selected network content and freeze the result before browser teardown. */
+    async finish() {
+        this.stopNetwork?.();
+        this.stopNetwork = undefined;
+        try {
+            await this.network?.finish();
+        }
+        finally {
+            this.sealed = true;
+        }
+    }
     /** Report selected popup event families with unrecoverable pre-discovery gaps. */
     limitations() {
         const popupGaps = [...this.incompleteFamilies].map((family) => `Popup ${family} events before Page discovery are unavailable; later events are retained.`);
+        const gaps = [...popupGaps, ...(this.network?.limitations() ?? [])];
         return this.enabled.has("network") && !this.ownsContext
             ? [
                 "Shared-context network capture excludes requests without a known root or descendant Page frame.",
-                ...popupGaps,
+                ...gaps,
             ]
-            : popupGaps;
+            : gaps;
     }
     result() {
         return {
@@ -73,6 +117,8 @@ export class PlaywrightScenarioEvents {
         };
     }
     push(event) {
+        if (this.sealed)
+            return this.sequence;
         this.sequence += 1;
         const parsed = browserScenarioEventSchema.parse({
             ...event,
@@ -80,6 +126,7 @@ export class PlaywrightScenarioEvents {
             step_index: this.stepIndex,
         });
         this.items.push(parsed);
+        return this.sequence;
     }
     observePage(page) {
         if (this.enabled.has("console"))
@@ -120,45 +167,6 @@ export class PlaywrightScenarioEvents {
             url: location.url === "" ? null : this.safeUrl(location.url),
         });
     }
-    request(kind, request) {
-        const observation = {
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(request.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            header_names: Object.keys(request.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-        };
-        if (kind === "request-failed") {
-            this.push({
-                ...observation,
-                kind,
-                status: null,
-                failure: this.secrets.redact(request.failure()?.errorText ?? "unknown"),
-            });
-            return;
-        }
-        this.push({
-            ...observation,
-            kind,
-            status: null,
-            failure: null,
-        });
-    }
-    response(response) {
-        const request = response.request();
-        this.push({
-            kind: "response",
-            method: this.secrets.redact(request.method()),
-            url: this.safeUrl(response.url()),
-            resource_type: this.secrets.redact(request.resourceType()),
-            status: response.status(),
-            header_names: Object.keys(response.headers())
-                .map((name) => this.secrets.redact(name))
-                .sort(),
-            failure: null,
-        });
-    }
     webSocket(socket) {
         const url = this.safeUrl(socket.url());
         this.push({ kind: "websocket-opened", url });

package/dist/browser/PlaywrightScenarioSession.js

@@ -109,6 +109,8 @@ export class PlaywrightScenarioSession {
                 ownsContext: scenario.browser.mode === "launch",
                 enabled: new Set(scenario.capture.events),
                 secrets,
+                network: scenario.capture.network,
+                ...(options.signal === undefined ? {} : { signal: options.signal }),
             });
             const session = new PlaywrightScenarioSession(opened, {
                 mode: scenario.browser.mode,
@@ -170,7 +172,12 @@ export class PlaywrightScenarioSession {
                 ? "terminated-owned-process"
                 : "disconnected-external";
         this.closed = true;
-        await closePlaywrightScenarioBrowser(this.opened, this.signal);
+        try {
+            await this.eventCapture.finish();
+        }
+        finally {
+            await closePlaywrightScenarioBrowser(this.opened, this.signal);
+        }
         return this.mode === "launch"
             ? "terminated-owned-process"
             : "disconnected-external";

package/dist/browser/WebSourceMapFetcher.js

@@ -2,12 +2,14 @@ import * as t from "@babel/types";
 import { AnyMap, eachMapping } from "@jridgewell/trace-mapping";
 import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
 import { isUrlLikeModuleSpecifier } from "../domain/webBundleAnalyzerAst.js";
-import { analyzeParsedJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
-import { parseJavaScriptSource } from "../domain/javascriptSourceParser.js";
+import { analyzeParsedJavaScriptReferences } from "../domain/javascript/javascriptSemanticAnalysis.js";
+import { traverseJavaScriptAst } from "../domain/javascript/javascriptSemanticTraversal.js";
+import { parseJavaScriptSource } from "../domain/javascript/javascriptSourceParser.js";
 import { hasValidSourceMapContents } from "../domain/sourceMapContents.js";
 import { webSourceMapsSchema } from "../domain/webBundleAnalysis.js";
 import { createWebTextArtifact } from "../domain/webContentArtifact.js";
 import { safeParseJson } from "../domain/safeJson.js";
+import { flattenSourceMapLeaves, isVersion3Map, } from "../domain/sourceMapEnvelope.js";
 /** Fetch and validate approved source maps without browser credentials. */
 export const fetchWebSourceMaps = async (requests, input, signal, host = { fetch: globalThis.fetch }) => {
     const items = [];
@@ -150,32 +152,32 @@ const originalModuleEdges = (sources) => {
         if (parsed.errors.length > 0)
             incomplete.push(source.source);
         let unboundRequires;
-        t.traverseFast(parsed, (node) => {
-            const dependency = originalDependency(node);
-            if (dependency === null)
-                return;
-            const { kind, specifier } = dependency;
-            if (kind === "require" && t.isCallExpression(node)) {
-                unboundRequires ??= new Set(analyzeParsedJavaScriptSemantics(parsed)
-                    .references.filter(({ name, role, resolution }) => name === "require" &&
-                    role === "read" &&
-                    resolution === "unbound")
-                    .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
-                const location = node.callee.loc?.start;
-                if (location === undefined ||
-                    !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
+        traverseJavaScriptAst(parsed, {
+            enter: (node) => {
+                const dependency = originalDependency(node);
+                if (dependency === null)
                     return;
-            }
-            const key = `${source.source}\0${kind}\0${specifier}`;
-            if (seen.has(key))
-                return;
-            seen.add(key);
-            edges.push({
-                from_source: source.source,
-                kind,
-                specifier,
-                resolved_source: resolveOriginalSource(specifier, source.source),
-            });
+                const { kind, specifier } = dependency;
+                if (kind === "require" && t.isCallExpression(node)) {
+                    unboundRequires ??= new Set(analyzeParsedJavaScriptReferences(parsed, "require")
+                        .filter(({ role, resolution }) => role === "read" && resolution === "unbound")
+                        .map(({ location }) => `${String(location.start.line)}:${String(location.start.column)}`));
+                    const location = node.callee.loc?.start;
+                    if (location === undefined ||
+                        !unboundRequires.has(`${String(location.line)}:${String(location.column)}`))
+                        return;
+                }
+                const key = `${source.source}\0${kind}\0${specifier}`;
+                if (seen.has(key))
+                    return;
+                seen.add(key);
+                edges.push({
+                    from_source: source.source,
+                    kind,
+                    specifier,
+                    resolved_source: resolveOriginalSource(specifier, source.source),
+                });
+            },
         });
     }
     return { edges, incomplete };
@@ -185,33 +187,13 @@ const validSourceMapEnvelope = (text) => {
     if (!parsedResult.ok)
         return false;
     const parsed = parsedResult.value;
-    if (!isRecord(parsed) || parsed.version !== 3)
-        return false;
-    if (typeof parsed.mappings === "string")
+    if (isVersion3Map(parsed) && typeof parsed.mappings === "string")
         return validSourceMapLeaf(parsed);
-    if (!Array.isArray(parsed.sections))
+    const leaves = flattenSourceMapLeaves(parsed, { validateOffsets: true });
+    if (leaves === undefined)
         return false;
-    const pending = [...parsed.sections];
-    while (pending.length > 0) {
-        const section = pending.pop();
-        if (!isRecord(section) ||
-            !isRecord(section.offset) ||
-            !validSourceMapOffset(section.offset.line) ||
-            !validSourceMapOffset(section.offset.column) ||
-            !("map" in section))
-            return false;
-        const map = section.map;
-        if (!isRecord(map) || map.version !== 3)
-            return false;
-        if (Array.isArray(map.sections))
-            for (const child of map.sections)
-                pending.push(child);
-        else if (!validSourceMapLeaf(map))
-            return false;
-    }
-    return true;
+    return leaves.every(validSourceMapLeaf);
 };
-const validSourceMapOffset = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 const validSourceMapLeaf = (map) => typeof map.mappings === "string" &&
     Array.isArray(map.sources) &&
     Array.isArray(map.names) &&
@@ -265,10 +247,12 @@ const resolveOriginalSource = (specifier, base) => {
         return null;
     }
 };
-const sourceMediaType = (source) => source?.endsWith(".ts") || source?.endsWith(".tsx")
+const sourceMediaType = (source) => source?.endsWith(".ts") ||
+    source?.endsWith(".tsx") ||
+    source?.endsWith(".mts") ||
+    source?.endsWith(".cts")
     ? "text/typescript"
     : "text/javascript";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const originalDependency = (node) => {
     if (t.isImportDeclaration(node) ||
         t.isExportAllDeclaration(node) ||

package/dist/browser/assets/LocalWebScriptArtifacts.js

@@ -0,0 +1,87 @@
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { ArtifactReaderFailure } from "../../artifacts/ArtifactReader.js";
+import { readStableArtifact } from "../../artifacts/readStableArtifact.js";
+import { normalizeArtifactPath } from "../../artifacts/ArtifactPaths.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
+import { webScriptExportManifestSchema } from "../../domain/webScriptExport.js";
+import { decodeWebArtifact, readWebArtifactJson, webArtifactReadError, WebArtifactFormatFailure, } from "./WebArtifactReads.js";
+/** Read one digest-verified captured source under the manifest's current location. */
+export class LocalWebScriptArtifacts {
+    operation;
+    constructor(operation) {
+        this.operation = operation;
+    }
+    /** Read the selected source; relocated exports retain their reported original root. */
+    async load(input, options) {
+        let field = ["manifest_path"];
+        let targetPath = input.manifest_path;
+        try {
+            const manifestBytes = await readWebArtifactJson(input.manifest_path, 32 * 1024 * 1024, options?.signal);
+            const manifest = webScriptExportManifestSchema.parse(manifestBytes.value);
+            field = ["script_index"];
+            const selected = manifest.scripts[input.script_index];
+            if (selected === undefined)
+                throw new WebArtifactFormatFailure(`No script at index ${String(input.script_index)}; manifest contains ${String(manifest.scripts.length)} scripts.`);
+            if (selected.content.state !== "exported")
+                return err(new AnalysisCapabilityUnavailableError("web-module-artifacts", this.operation, "selected_source_unavailable", {
+                    userMessage: `Selected script ${String(input.script_index)} has unavailable source bytes (${selected.content.reason}): ${selected.content.message} Capture source bytes before tracing this script.`,
+                }));
+            const portable = normalizeArtifactPath(selected.content.relative_path);
+            if (portable !== selected.content.relative_path)
+                throw new ArtifactReaderFailure("path", `Selected source path changes during normalization: ${selected.content.relative_path}`);
+            const root = dirname(input.manifest_path);
+            const sourcePath = join(root, "files", portable);
+            targetPath = sourcePath;
+            await assertContained(root, sourcePath);
+            const sourceBytes = await readStableArtifact(sourcePath, 16 * 1024 * 1024, options?.signal);
+            await assertContained(root, sourcePath);
+            if (sourceBytes.sha256 !== selected.content.sha256 ||
+                sourceBytes.bytes.length !== selected.content.bytes)
+                throw new ArtifactReaderFailure("integrity", `Selected source identity mismatch: ${sourcePath}; expected sha256=${selected.content.sha256}, bytes=${String(selected.content.bytes)}; observed sha256=${sourceBytes.sha256}, bytes=${String(sourceBytes.bytes.length)}.`, undefined, {
+                    logicalPath: selected.content.relative_path,
+                    declaredSha256: selected.content.sha256,
+                    calculatedSha256: sourceBytes.sha256,
+                    unpacked: false,
+                });
+            const source = decodeWebArtifact(sourceBytes.bytes);
+            return ok({
+                manifest,
+                manifestFile: {
+                    path: input.manifest_path,
+                    sha256: manifestBytes.sha256,
+                    bytes: manifestBytes.bytes.length,
+                },
+                sourceFile: {
+                    path: sourcePath,
+                    sha256: sourceBytes.sha256,
+                    bytes: sourceBytes.bytes.length,
+                },
+                source,
+            });
+        }
+        catch (cause) {
+            return err(webArtifactReadError(cause, { operation: this.operation, field, targetPath }, options?.signal));
+        }
+    }
+}
+const assertContained = async (root, path) => {
+    const canonicalRoot = await realpath(root);
+    const canonicalFile = await realpath(path);
+    const fromRoot = relative(canonicalRoot, canonicalFile);
+    if (fromRoot === ".." ||
+        fromRoot.startsWith(`..${sep}`) ||
+        isAbsolute(fromRoot))
+        throw new ArtifactReaderFailure("path", `Selected source escapes its manifest directory: ${path}`);
+    let directory = dirname(path);
+    while (directory !== root) {
+        const stat = await lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new ArtifactReaderFailure("path", `Selected source directory is a symlink or not a directory: ${directory}`);
+        const parent = dirname(directory);
+        if (parent === directory)
+            throw new ArtifactReaderFailure("path", "Selected source has no containing manifest directory.");
+        directory = parent;
+    }
+};

package/dist/browser/assets/PageScriptCapture.js

@@ -0,0 +1,32 @@
+/** Project verified Debugger sources without fetching resource URLs. */
+export const pageScripts = (capture) => capture.scripts.items.map((script) => ({
+    source: {
+        kind: "page-script",
+        script_key: script.script_key,
+        frame_id: script.frame_id,
+        is_module: script.is_module,
+        language: script.language,
+        source_map_url: script.source_map_url,
+    },
+    url: script.url,
+    content: !script.source.included
+        ? {
+            state: "unavailable",
+            reason: "source-not-included",
+            message: script.source.reason || "Debugger source was not included.",
+        }
+        : script.language !== null && script.language !== "JavaScript"
+            ? {
+                state: "unavailable",
+                reason: "unsupported-language",
+                message: `Debugger reported language ${script.language}; JavaScript export was not inferred.`,
+            }
+            : {
+                state: "captured",
+                bytes: Buffer.from(script.source.artifact.text, "utf8"),
+                sha256: script.source.artifact.sha256,
+                media_type: script.source.artifact.media_type,
+                redacted: null,
+                representation: "debugger-source-utf8",
+            },
+}));