rea-agents 4.1.0 → 6.0.0

package/dist/artifacts/apple/NibViewHierarchy.js

@@ -0,0 +1,150 @@
+/** Project encoded view parents; archive owners are not inferred view parents. */
+export const projectNibViewHierarchy = (objects, retainedIds) => {
+    const { parents, involved, invalid } = collectNibParents(objects, retainedIds);
+    if (parents.size === 0)
+        return { hierarchy: null, omitted: invalid };
+    const children = new Map();
+    for (const [child, parent] of parents) {
+        if (!retainedIds.has(parent) || !retainedIds.has(child))
+            continue;
+        const siblings = children.get(parent) ?? [];
+        siblings.push(child);
+        children.set(parent, siblings);
+    }
+    const roots = [];
+    const pending = [];
+    for (const id of involved)
+        if (!parents.has(id))
+            pending.push({ id, depth: 0, output: roots });
+    const visited = new Set();
+    while (pending.length > 0) {
+        const item = pending.pop();
+        if (item === undefined)
+            break;
+        if (visited.has(item.id) || item.depth > 128 || visited.size >= 20_000)
+            continue;
+        visited.add(item.id);
+        const node = { objectID: String(item.id), children: [] };
+        item.output.push(node);
+        for (const child of [...(children.get(item.id) ?? [])].reverse())
+            pending.push({ id: child, depth: item.depth + 1, output: node.children });
+    }
+    return {
+        hierarchy: roots,
+        omitted: involved.size - visited.size + invalid,
+    };
+};
+/** Add encoded parent links once; conflicting legacy parents remain unknown. */
+export const mergeNibHierarchies = (legacy, recovered) => {
+    const existing = new Map();
+    const owners = new Map();
+    const parents = new Map();
+    const pending = legacy.map((node) => ({
+        node,
+        output: legacy,
+        parent: null,
+    }));
+    while (pending.length > 0) {
+        const entry = pending.pop();
+        if (entry === undefined || existing.has(entry.node.objectID))
+            continue;
+        existing.set(entry.node.objectID, entry.node);
+        owners.set(entry.node.objectID, entry.output);
+        if (entry.parent !== null)
+            parents.set(entry.node.objectID, entry.parent);
+        pending.push(...entry.node.children.map((node) => ({
+            node,
+            output: entry.node.children,
+            parent: entry.node.objectID,
+        })));
+    }
+    let omitted = 0;
+    const additions = recovered.map((node) => ({
+        node,
+        output: legacy,
+        parent: null,
+    }));
+    while (additions.length > 0) {
+        const entry = additions.pop();
+        if (entry === undefined)
+            break;
+        let target = existing.get(entry.node.objectID);
+        if (target === undefined) {
+            target = { objectID: entry.node.objectID, children: [] };
+            existing.set(target.objectID, target);
+            entry.output.push(target);
+            owners.set(target.objectID, entry.output);
+            if (entry.parent !== null)
+                parents.set(target.objectID, entry.parent);
+        }
+        else if (entry.parent !== null &&
+            owners.get(target.objectID) !== entry.output) {
+            const owner = owners.get(target.objectID);
+            if (owner !== legacy ||
+                wouldCycle(target.objectID, entry.parent, parents)) {
+                omitted += 1;
+            }
+            else {
+                owner.splice(owner.indexOf(target), 1);
+                entry.output.push(target);
+                owners.set(target.objectID, entry.output);
+                parents.set(target.objectID, entry.parent);
+            }
+        }
+        for (const node of [...entry.node.children].reverse())
+            additions.push({
+                node,
+                output: target.children,
+                parent: target.objectID,
+            });
+    }
+    return { hierarchy: legacy, omitted };
+};
+const wouldCycle = (child, parent, parents) => {
+    const seen = new Set();
+    let current = parent;
+    while (current !== undefined && !seen.has(current)) {
+        if (current === child)
+            return true;
+        seen.add(current);
+        current = parents.get(current);
+    }
+    return false;
+};
+const reference = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    return typeof value.$nib_object_ref === "number"
+        ? value.$nib_object_ref
+        : null;
+};
+const collectNibParents = (objects, retainedIds) => {
+    const parents = new Map();
+    const involved = new Set();
+    let invalid = 0;
+    for (const object of objects) {
+        if (!retainedIds.has(object.id))
+            continue;
+        const child = reference(object.values.NSWindowView);
+        if (object.class_name.replace(/\0+$/u, "") === "NSWindowTemplate" &&
+            invalidReference(object.values.NSWindowView))
+            invalid += 1;
+        if (object.class_name.replace(/\0+$/u, "") === "NSWindowTemplate" &&
+            child !== null) {
+            parents.set(child, object.id);
+            involved.add(object.id);
+            involved.add(child);
+        }
+        const parent = reference(object.values.NSSuperview);
+        if (invalidReference(object.values.NSSuperview))
+            invalid += 1;
+        if (parent === null)
+            continue;
+        parents.set(object.id, parent);
+        involved.add(object.id);
+        if (retainedIds.has(parent))
+            involved.add(parent);
+    }
+    return { parents, involved, invalid };
+};
+const invalidReference = (value) => value !== undefined && value !== null && reference(value) === null;

package/dist/{application → artifacts/extraction}/ArtifactExtraction.js

@@ -1,14 +1,14 @@
 import { lstat, realpath } from "node:fs/promises";
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
-import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
-import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
-import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
-import { DirectoryArtifactReader } from "../artifacts/DirectoryArtifactReader.js";
-import { SafeOutputTree } from "../artifacts/SafeOutputTree.js";
-import { ZipArtifactReader } from "../artifacts/ZipArtifactReader.js";
-import { MachOSliceArtifactReader } from "../artifacts/MachOSliceArtifactReader.js";
-import { artifactExtractionResultSchema, } from "../domain/artifactGraph.js";
-import { scanArtifactInventory } from "./ArtifactInventory.js";
+import { canonicalDigest } from "../../domain/comparisonSemantics.js";
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../ArtifactReader.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+import { SafeOutputTree } from "../SafeOutputTree.js";
+import { ZipArtifactReader } from "../ZipArtifactReader.js";
+import { MachOSliceArtifactReader } from "../MachOSliceArtifactReader.js";
+import { artifactExtractionResultSchema, } from "../../domain/artifactGraph.js";
+import { scanArtifactInventory } from "../inventory/ArtifactInventory.js";
 /** Extract every regular inventory occurrence into an exclusively owned absent root. */
 export const extractArtifact = async (input, signal) => {
     const sourcePath = await realpath(input.inputPath);

package/dist/{application → artifacts/inventory}/ArtifactGraphConstruction.js

@@ -1,6 +1,6 @@
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
-import { zipPackageFormatForPath } from "../domain/zipPackageFormat.js";
-import { mzWindowsHeaderOffset, parseDosMzHeader } from "../domain/dosMz.js";
+import { canonicalDigest } from "../../domain/comparisonSemantics.js";
+import { zipPackageFormatForPath } from "../../domain/zipPackageFormat.js";
+import { mzWindowsHeaderOffset, parseDosMzHeader } from "../../domain/dosMz.js";
 /** Index the first occurrence for each canonical logical path. */
 export const indexOccurrencesByPath = (occurrences) => {
     const byPath = new Map();

package/dist/{application → artifacts/inventory}/ArtifactInventory.js

@@ -1,8 +1,8 @@
 import { realpath } from "node:fs/promises";
-import { artifactInventoryResultSchema, } from "../domain/artifactGraph.js";
-import { abortIfNeeded } from "./ArtifactInventory/hash.js";
-import { scanCanonicalArtifactInventory } from "./ArtifactInventory/scanCanonical.js";
-export { scanCanonicalArtifactInventory } from "./ArtifactInventory/scanCanonical.js";
+import { artifactInventoryResultSchema, } from "../../domain/artifactGraph.js";
+import { abortIfNeeded } from "../ArtifactHash.js";
+import { scanCanonicalArtifactInventory } from "./scanCanonical.js";
+export { scanCanonicalArtifactInventory } from "./scanCanonical.js";
 /** Inventory one local artifact and return every graph collection inline. */
 export const inventoryArtifact = async (inputPath, options = {}) => {
     const snapshot = await scanArtifactInventory(inputPath, options);

package/dist/{application/ArtifactInventory → artifacts/inventory}/classify.js

@@ -1,6 +1,6 @@
 import { open } from "node:fs/promises";
-import { classifyArtifactContent } from "../ArtifactGraphConstruction.js";
-import { ARTIFACT_CLASSIFICATION_PREFIX_BYTES } from "./hash.js";
+import { classifyArtifactContent } from "./ArtifactGraphConstruction.js";
+import { ARTIFACT_CLASSIFICATION_PREFIX_BYTES } from "../ArtifactHash.js";
 import { hasZipSignature, zipPackageFormatForPath, } from "../../domain/zipPackageFormat.js";
 const classifyContainerExtension = (path) => {
     const lower = path.toLowerCase();

package/dist/{application/ArtifactInventory → artifacts/inventory}/reader.js

@@ -1,8 +1,8 @@
-import { AsarArtifactReader } from "../../artifacts/AsarArtifactReader.js";
-import { DirectoryArtifactReader } from "../../artifacts/DirectoryArtifactReader.js";
-import { MachOSliceArtifactReader } from "../../artifacts/MachOSliceArtifactReader.js";
-import { NativeDmgArtifactReader } from "../../artifacts/NativeDmgArtifactReader.js";
-import { ZipArtifactReader } from "../../artifacts/ZipArtifactReader.js";
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+import { MachOSliceArtifactReader } from "../MachOSliceArtifactReader.js";
+import { NativeDmgArtifactReader } from "../NativeDmgArtifactReader.js";
+import { ZipArtifactReader } from "../ZipArtifactReader.js";
 export const createReader = async (path, format, signal) => {
     switch (format) {
         case "directory":

package/dist/{application/ArtifactInventory → artifacts/inventory}/scanCanonical.js

@@ -1,11 +1,11 @@
 import { createReadStream } from "node:fs";
 import { lstat } from "node:fs/promises";
-import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
+import { ArtifactReaderFailure, } from "../ArtifactReader.js";
 import { artifactInventoryResultSchema, } from "../../domain/artifactGraph.js";
-import { createArtifactEdges, createRootNode, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "../ArtifactGraphConstruction.js";
+import { createArtifactEdges, createRootNode, indexOccurrencesByPath, materializeDirectoryNodes, rekeyOccurrences, rootOccurrenceFor, } from "./ArtifactGraphConstruction.js";
 import { canonicalDigest } from "../../domain/comparisonSemantics.js";
 import { classifyRoot } from "./classify.js";
-import { hashReadable } from "./hash.js";
+import { hashReadable } from "../ArtifactHash.js";
 import { createReader, inventoryLimitations } from "./reader.js";
 import { scanReader, } from "./scanReader.js";
 import { STRICT_INTEGRITY_POLICY, } from "./types.js";

package/dist/{application/ArtifactInventory → artifacts/inventory}/scanReader.js

@@ -1,10 +1,10 @@
 import { isAbsolute } from "node:path";
-import { ArtifactPathRegistry, normalizeArtifactPath, } from "../../artifacts/ArtifactPaths.js";
-import { ArtifactReaderFailure, } from "../../artifacts/ArtifactReader.js";
-import { AsarArtifactReader } from "../../artifacts/AsarArtifactReader.js";
-import { classifyArtifactContent, createArtifactNode, createOccurrence, nearestParent, } from "../ArtifactGraphConstruction.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../ArtifactReader.js";
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { classifyArtifactContent, createArtifactNode, createOccurrence, nearestParent, } from "./ArtifactGraphConstruction.js";
 import { STRICT_INTEGRITY_POLICY, } from "./types.js";
-import { hashReadable } from "./hash.js";
+import { hashReadable } from "../ArtifactHash.js";
 const UNAVAILABLE_UNPACKED_LIMITATION = "ASAR unpacked companion bytes were unavailable; no content hash or child artifact was produced.";
 const emptyScan = () => ({ nodes: new Map(), occurrences: [], pendingContradictions: [] });
 export const scanReader = async (reader, signal, integrity = STRICT_INTEGRITY_POLICY) => {

package/dist/{application → artifacts/javascript}/JavaScriptArtifactFiles.js

@@ -1,12 +1,19 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { compareCodePoints } from "../domain/canonicalOrdering.js";
-import { AsarArtifactReader } from "../artifacts/AsarArtifactReader.js";
-import { ArtifactPathRegistry, normalizeArtifactPath, } from "../artifacts/ArtifactPaths.js";
-import { ArtifactReaderFailure, } from "../artifacts/ArtifactReader.js";
-import { streamChunkToBuffer } from "../artifacts/StreamBytes.js";
+import { compareCodePoints } from "../../domain/canonicalOrdering.js";
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { ArtifactPathRegistry, normalizeArtifactPath, } from "../ArtifactPaths.js";
+import { ArtifactReaderFailure, } from "../ArtifactReader.js";
+import { streamChunkToBuffer } from "../StreamBytes.js";
+import { hashReadable } from "../ArtifactHash.js";
 /** Read all relevant textual entries through an already-inventoried reader. */
 export const readJavaScriptArtifactFiles = async (reader, snapshot, signal) => {
+    if (reader instanceof AsarArtifactReader) {
+        const root = snapshot.nodes.find(({ artifact_id }) => artifact_id === snapshot.manifest.root_artifact_id);
+        if (root === undefined)
+            throw new ArtifactReaderFailure("integrity", "Root artifact node is missing");
+        await verifyEntryBytes(reader.openContainer(signal), { path: ".", sha256: root.sha256, bytes: root.size }, signal);
+    }
     const inventory = expectedInventory(snapshot);
     const expected = inventory.files;
     const context = {
@@ -58,6 +65,7 @@ const visitReader = async (reader, prefix, containerSha256, context) => {
             context.registry.add(path, nestedAsar ? "directory" : entry.kind);
             if (nestedAsar) {
                 const inventory = expectedContainer(path, context);
+                await verifyEntryBytes(await frame.reader.open(entry, context.signal), inventory, context.signal);
                 context.containers.push(inventory);
                 const nested = new AsarArtifactReader(entry.adapterKey);
                 stack.push({
@@ -105,8 +113,10 @@ const expectedContainer = (path, context) => {
     return container;
 };
 const readText = async (context, input) => {
-    if (input.expected.kind === "native-addon")
+    if (input.expected.kind === "native-addon") {
+        await verifyEntryBytes(await input.reader.open(input.entry, context.signal), input.expected, context.signal);
         return { included: false, reason: "not-applicable" };
+    }
     const bytes = await readAll(await input.reader.open(input.entry, context.signal), context.signal);
     const digest = createHash("sha256").update(bytes).digest("hex");
     if (digest !== input.expected.sha256 || bytes.length !== input.expected.bytes)
@@ -125,6 +135,17 @@ const readText = async (context, input) => {
         return { included: false, reason: "invalid-utf8" };
     }
 };
+const verifyEntryBytes = async (stream, expected, signal) => {
+    try {
+        const digest = await hashReadable(stream, signal);
+        if (digest.sha256 !== expected.sha256 || digest.bytes !== expected.bytes)
+            throw new ArtifactReaderFailure("integrity", `Artifact entry changed after inventory: ${expected.path}`);
+    }
+    catch (cause) {
+        abortIfNeeded(signal);
+        throw cause;
+    }
+};
 const expectedInventory = (snapshot) => {
     const nodes = new Map(snapshot.nodes.map((node) => [node.artifact_id, node]));
     const files = new Map();

package/dist/artifacts/javascript/JavaScriptArtifactReader.js

@@ -0,0 +1,6 @@
+import { AsarArtifactReader } from "../AsarArtifactReader.js";
+import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
+/** Create the reader for an admitted JavaScript artifact format. */
+export const createJavaScriptArtifactReader = (path, format) => format === "asar"
+    ? new AsarArtifactReader(path)
+    : new DirectoryArtifactReader(path);

package/dist/artifacts/readStableArtifact.js

@@ -0,0 +1,68 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { ArtifactReaderFailure } from "./ArtifactReader.js";
+const FILE_SYSTEM = {
+    lstat: (path) => lstat(path, { bigint: true }),
+    open,
+};
+const afterValidation = async (path, stage, read) => {
+    try {
+        return await read();
+    }
+    catch (cause) {
+        if (cause instanceof Error &&
+            "code" in cause &&
+            ["ENOENT", "ENOTDIR", "ELOOP"].includes(String(cause.code)))
+            throw new ArtifactReaderFailure("integrity", `Artifact changed ${stage}: ${path}`, { cause });
+        throw cause;
+    }
+};
+/** Read one bounded regular file and reject replacement or in-place changes. */
+export const readStableArtifact = async (path, maximumBytes, signal, fileSystem = FILE_SYSTEM) => {
+    signal?.throwIfAborted();
+    const before = await fileSystem.lstat(path);
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new ArtifactReaderFailure("path", `Expected a regular file without a symlink: ${path}`);
+    if (before.size > BigInt(maximumBytes))
+        throw new ArtifactReaderFailure("limit", `Selected artifact exceeds ${String(maximumBytes)} bytes: ${path}`);
+    const file = await afterValidation(path, "before open", () => fileSystem.open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK));
+    try {
+        const initial = await file.stat({ bigint: true });
+        if (!initial.isFile() ||
+            initial.dev !== before.dev ||
+            initial.ino !== before.ino)
+            throw new ArtifactReaderFailure("integrity", `Artifact changed before open: ${path}`);
+        const chunks = [];
+        let count = 0;
+        for await (const chunk of file.createReadStream({
+            autoClose: false,
+            highWaterMark: 65536,
+        })) {
+            signal?.throwIfAborted();
+            const value = chunk;
+            if (!Buffer.isBuffer(value))
+                throw new ArtifactReaderFailure("format", `Artifact stream did not return bytes: ${path}`);
+            const bytes = value;
+            count += bytes.length;
+            if (count > maximumBytes)
+                throw new ArtifactReaderFailure("limit", `Selected artifact grew beyond its byte limit: ${path}`);
+            chunks.push(bytes);
+        }
+        const after = await file.stat({ bigint: true });
+        const current = await afterValidation(path, "during read", () => fileSystem.lstat(path));
+        if ([after, current].some((stat) => !stat.isFile() ||
+            stat.dev !== initial.dev ||
+            stat.ino !== initial.ino ||
+            stat.size !== initial.size ||
+            stat.mtimeNs !== initial.mtimeNs ||
+            stat.ctimeNs !== initial.ctimeNs) ||
+            BigInt(count) !== initial.size)
+            throw new ArtifactReaderFailure("integrity", `Artifact changed during read: ${path}`);
+        const bytes = Buffer.concat(chunks, count);
+        return { bytes, sha256: createHash("sha256").update(bytes).digest("hex") };
+    }
+    finally {
+        await file.close();
+    }
+};

package/dist/browser/BrowserScenarioSecrets.js

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
 import { sanitizeBrowserUrl, } from "../domain/browserObservation.js";
 const REDACTION_PREFIX = "[REDACTED:";
+const encodedSecretValues = (secret) => new Set([
+    secret,
+    encodeURIComponent(secret),
+    new URLSearchParams([["value", secret]]).toString().slice("value=".length),
+]);
 /** Resolved secret values kept only for one in-memory scenario session. */
 export class BrowserScenarioSecrets {
     values;
@@ -41,6 +46,50 @@ export class BrowserScenarioSecrets {
                 output = output.replaceAll(secret, `${REDACTION_PREFIX}${id}]`);
         return output;
     }
+    /** Replace declared UTF-8, URI/form, and JSON-escaped secrets without decoding binary data. */
+    redactBytes(value) {
+        const candidates = [...this.values]
+            .flatMap(([id, secret]) => {
+            if (secret === "")
+                return [];
+            return [
+                ...new Set([
+                    ...encodedSecretValues(secret),
+                    JSON.stringify(secret).slice(1, -1),
+                ]),
+            ].map((text) => {
+                const needle = Buffer.from(text);
+                return {
+                    id,
+                    needle,
+                    marker: Buffer.from(`${REDACTION_PREFIX}${id}]`),
+                    index: value.indexOf(needle),
+                };
+            });
+        })
+            .sort((left, right) => right.needle.length - left.needle.length ||
+            (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+        const parts = [];
+        let offset = 0;
+        while (true) {
+            let next;
+            for (const candidate of candidates) {
+                if (candidate.index >= 0 && candidate.index < offset)
+                    candidate.index = value.indexOf(candidate.needle, offset);
+                if (candidate.index >= 0 &&
+                    (next === undefined || candidate.index < next.index))
+                    next = candidate;
+            }
+            if (next === undefined)
+                break;
+            parts.push(value.subarray(offset, next.index), next.marker);
+            offset = next.index + next.needle.length;
+        }
+        if (parts.length === 0)
+            return value;
+        parts.push(value.subarray(offset));
+        return Buffer.concat(parts);
+    }
     /** Remove only declared secret values from one URL and report that action. */
     sanitizeUrl(value) {
         let output = value;
@@ -50,14 +99,7 @@ export class BrowserScenarioSecrets {
             if (secret === "")
                 continue;
             const marker = `${REDACTION_PREFIX}${id}]`;
-            const searchParamsValue = new URLSearchParams([["value", secret]])
-                .toString()
-                .slice("value=".length);
-            for (const candidate of new Set([
-                secret,
-                encodeURIComponent(secret),
-                searchParamsValue,
-            ]))
+            for (const candidate of encodedSecretValues(secret))
                 output = output.replaceAll(candidate, marker);
         }
         const sanitized = sanitizeBrowserUrl(output);

package/dist/browser/CdpAuthorizedMainFrame.js

@@ -2,15 +2,15 @@ import { BrowserObservationError } from "../domain/browserObservationError.js";
 import { mainFrameUrl } from "./CdpCaptureDocuments.js";
 import { allowedSanitizedUrl, delayWithCancellation, isHttpUrl, } from "./CdpCaptureValues.js";
 /** Wait for the attached target's main frame to enter its approved origin. */
-export const authorizedMainFrame = async ({ connection, sessionId, signal, allowedOrigins, delayOperation, }) => {
+export const authorizedMainFrame = async ({ connection, sessionId, signal, allowedOrigins, operation, }) => {
     for (let attempt = 0; attempt < 80; attempt += 1) {
         const result = await connection.send("Page.getFrameTree", {}, sessionId, signal);
         const url = mainFrameUrl(result);
         if (allowedSanitizedUrl(url, allowedOrigins) !== undefined)
             return result;
         if (isHttpUrl(url))
-            throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-        await delayWithCancellation(25, delayOperation, signal);
+            throw new BrowserObservationError(operation, "target_not_allowed");
+        await delayWithCancellation(25, operation, signal);
     }
-    throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
+    throw new BrowserObservationError(operation, "target_not_allowed");
 };

package/dist/browser/CdpAuthorizedTarget.js

@@ -0,0 +1,22 @@
+import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { BrowserObservationError } from "../domain/browserObservationError.js";
+/** Select one page target and derive its origin scope before opening a CDP session. */
+export const authorizeCdpTarget = (discovery, input, operation) => {
+    const target = discovery.targets.find((candidate) => candidate.id === input.target_id);
+    if (target === undefined)
+        throw new BrowserObservationError(operation, "target_not_found", {
+            detail: `Target ${input.target_id} was not found at the selected endpoint.`,
+        });
+    const origin = sanitizeBrowserUrl(target.url).origin;
+    if (target.type !== "page" ||
+        origin === null ||
+        (input.allowed_origins.length > 0 &&
+            !input.allowed_origins.includes(origin)))
+        throw new BrowserObservationError(operation, "target_not_allowed", {
+            detail: `Target ${input.target_id} must be an HTTP(S) page in the selected origin scope.`,
+        });
+    return {
+        target,
+        allowedOrigins: new Set(input.allowed_origins.length > 0 ? input.allowed_origins : [origin]),
+    };
+};

package/dist/browser/CdpBrowserProvider.js

@@ -14,16 +14,14 @@ import { discoverCdpEndpoint, hasCdpTargetWebSocket, } from "./CdpEndpoint.js";
 import { closeCdpTargetSession, openCdpTargetSession, } from "./CdpTargetSession.js";
 import { capturePage } from "./CdpPageCapture.js";
 import { fetchWebSourceMaps } from "./WebSourceMapFetcher.js";
+import { authorizeCdpTarget } from "./CdpAuthorizedTarget.js";
 import { observeCdpSession } from "./CdpObservationSession.js";
 import { discoverWebMcp } from "./CdpWebMcpDiscovery.js";
 import { captureCdpScreenshot } from "./CdpScreenshot.js";
 import { comparePngScreenshots } from "./PngVisualDiff.js";
 /** Public identity committed by passive browser observations. */
-export const CDP_BROWSER_PROVIDER_IDENTITY = Object.freeze({
-    id: "rea-cdp-browser",
-    name: "REA Chrome DevTools Protocol observation provider",
-    version: "2",
-});
+export { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
+import { CDP_BROWSER_PROVIDER_IDENTITY } from "./providerIdentities.js";
 const IDENTITY = CDP_BROWSER_PROVIDER_IDENTITY;
 const CLEANUP_DOMAINS = ["Network", "Debugger", "Runtime", "Page"];
 /** Passive browser observation through a selected user-owned CDP endpoint. */
@@ -251,16 +249,7 @@ const selectTargets = (discovery, allowedOrigins) => {
     };
 };
 const authorizeTarget = (discovery, input) => {
-    const target = discovery.targets.find((candidate) => candidate.id === input.target_id);
-    if (target === undefined)
-        throw new BrowserObservationError("inspect_web_page", "target_not_found");
-    const origin = sanitizeBrowserUrl(target.url).origin;
-    if (target.type !== "page" ||
-        origin === null ||
-        (input.allowed_origins.length > 0 &&
-            !input.allowed_origins.includes(origin)))
-        throw new BrowserObservationError("inspect_web_page", "target_not_allowed");
-    return target;
+    return authorizeCdpTarget(discovery, input, "inspect_web_page").target;
 };
 const scopeToTargetOrigin = (input, target) => {
     if (input.allowed_origins.length > 0)