reverseport 0.0.0-stage → 1.2.0

package/dist/application/BinaryTargetResolver.js

@@ -0,0 +1,356 @@
+import { constants } from "node:fs";
+import { createHash } from "node:crypto";
+import { access, lstat, realpath, stat, } from "node:fs/promises";
+import { extname, isAbsolute, resolve } from "node:path";
+import { BinaryTargetError } from "../domain/configurationErrors.js";
+import { openRegularFile, sameRegularFileState, } from "../filesystem/RegularFile.js";
+import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
+import { err, ok } from "../domain/result.js";
+import { readMipsElfMetadata } from "./MipsElfMetadata.js";
+import { resolveAppBundleExecutable, } from "./AppBundleExecutable.js";
+import { validateDosComLength, } from "../domain/dosCom.js";
+import { admitRawBinary, rawBinarySelectionError, } from "../domain/rawBinary.js";
+import { mzWindowsHeaderOffset } from "../domain/dosMz.js";
+import { hasZipSignature, isZipPackageFormat, zipPackageFormatForPath, } from "../domain/zipPackageFormat.js";
+import { parseExecutableHeader, parsePeRecord, } from "../domain/binaryTarget.js";
+/**
+ * Resolve and classify a readable local target before a provider is selected.
+ * FAT Mach-O inputs select only a host-compatible architecture so setup remains
+ * non-interactive; unsupported or ambiguous inputs are returned as typed errors.
+ */
+export const parseBinaryTarget = async (input, options = {}) => {
+    const cwd = options.cwd ?? process.cwd();
+    const hostArchitecture = options.hostArchitecture ?? process.arch;
+    const { targetKind, formatHint, signal, architecture, entryPoint } = options;
+    const candidate = isAbsolute(input) ? input : resolve(cwd, input);
+    try {
+        throwIfTargetResolutionCancelled(signal);
+        await access(candidate, constants.R_OK);
+        throwIfTargetResolutionCancelled(signal);
+        const canonical = await realpath(candidate);
+        throwIfTargetResolutionCancelled(signal);
+        const resolved = await resolveAppBundle(canonical);
+        throwIfTargetResolutionCancelled(signal);
+        if (!resolved.ok)
+            return err(resolved.error);
+        const { executable: path, infoPlist } = resolved.value;
+        const bundle = infoPlist === undefined ? {} : { bundleInfoPlist: infoPlist };
+        const handle = await openRegularFile(path, {
+            symlinks: "reject",
+            signal,
+        });
+        try {
+            throwIfTargetResolutionCancelled(signal);
+            const metadata = await handle.stat();
+            throwIfTargetResolutionCancelled(signal);
+            if (formatHint === "raw-binary") {
+                if (targetKind !== undefined && targetKind !== "executable")
+                    return err(new BinaryTargetError(path, "raw-binary format requires an executable target kind", { constraint: "load_selection_rejected" }));
+                const admitted = admitRawBinary({
+                    architecture,
+                    entryPoint,
+                    fileBytes: metadata.size,
+                });
+                if (!admitted.ok)
+                    return err(new BinaryTargetError(path, admitted.error.reason, {
+                        constraint: admitted.error.constraint,
+                    }));
+                return ok({
+                    path,
+                    sourcePath: canonical,
+                    sha256: await sha256Handle(handle, path, metadata, signal),
+                    kind: "executable",
+                    format: "raw-binary",
+                    architecture: admitted.value.architecture,
+                    availableArchitectures: [admitted.value.architecture],
+                    entryPoint: admitted.value.entryPoint,
+                    entryPointSource: admitted.value.entryPointSource,
+                });
+            }
+            const pairing = rawBinarySelectionError({
+                ...(formatHint === undefined ? {} : { format: formatHint }),
+                architecture,
+                entryPoint,
+            });
+            if (pairing !== undefined)
+                return err(new BinaryTargetError(path, pairing, {
+                    constraint: "load_selection_rejected",
+                }));
+            if (formatHint === "dos-com") {
+                if (targetKind !== undefined && targetKind !== "executable")
+                    return err(new BinaryTargetError(path, "DOS COM format requires an executable target kind", { constraint: "load_selection_rejected" }));
+                const length = validateDosComLength(metadata.size);
+                if (!length.ok)
+                    return err(new BinaryTargetError(path, length.error, {
+                        constraint: "file_format_rejected",
+                    }));
+                return ok({
+                    path,
+                    sourcePath: canonical,
+                    sha256: await sha256Handle(handle, path, metadata, signal),
+                    kind: "executable",
+                    format: "dos-com",
+                    architecture: "x86",
+                    availableArchitectures: ["x86"],
+                });
+            }
+            if (targetKind === "database" ||
+                (targetKind === undefined && path.toLowerCase().endsWith(".hop")))
+                return ok({
+                    path,
+                    sourcePath: process.platform === "win32" ? candidate : canonical,
+                    sha256: await sha256Handle(handle, path, metadata, signal),
+                    kind: "database",
+                    format: "analysis-database",
+                });
+            const artifactFormat = await detectArtifactFormat(path, handle, signal);
+            if (artifactFormat !== undefined) {
+                const identity = {
+                    path,
+                    sourcePath: process.platform === "win32" ? candidate : canonical,
+                    sha256: await sha256Handle(handle, path, metadata, signal),
+                };
+                return isArchiveFormat(artifactFormat)
+                    ? ok({ ...identity, kind: "archive", format: artifactFormat })
+                    : ok({ ...identity, kind: "artifact", format: artifactFormat });
+            }
+            const detected = await readExecutableMetadata(handle, hostArchitecture, signal);
+            if (!detected.ok)
+                return err(new BinaryTargetError(path, detected.error, {
+                    constraint: "file_format_rejected",
+                }));
+            return ok({
+                path,
+                sourcePath: process.platform === "win32" ? candidate : canonical,
+                ...bundle,
+                sha256: await sha256Handle(handle, path, metadata, signal),
+                kind: "executable",
+                ...detected.value,
+            });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (cause) {
+        if (cause instanceof AnalysisCancelledError)
+            return err(cause);
+        if (cause instanceof BinaryTargetError)
+            return err(cause);
+        if (!(cause instanceof Error))
+            throw cause;
+        const failure = classifyBinaryTargetFilesystemFailure(candidate, cause);
+        if (failure === undefined)
+            throw cause;
+        return err(failure);
+    }
+};
+/** Classify a filesystem failure while reading a previously selected target. */
+export const classifyBinaryTargetFilesystemFailure = (path, cause) => {
+    if (!(cause instanceof Error))
+        return undefined;
+    const code = filesystemErrorCode(cause);
+    return code === undefined
+        ? undefined
+        : new BinaryTargetError(path, targetFailureReason(code, cause.message), {
+            cause,
+        });
+};
+const filesystemErrorCode = (cause) => {
+    const code = Reflect.get(cause, "code");
+    return typeof code === "string" ? code : undefined;
+};
+const targetFailureReason = (code, detail) => {
+    switch (code) {
+        case "ENOENT":
+        case "ENOTDIR":
+            return `target does not exist or a path component is not a directory: ${detail}`;
+        case "EACCES":
+        case "EPERM":
+            return `permission denied while reading target: ${detail}`;
+        case "EISDIR":
+            return `target is a directory, not a readable file: ${detail}`;
+        case "ENOTFILE":
+            return "target is not a regular file";
+        case "ELOOP":
+            return `target changed while being opened: ${detail}`;
+        default:
+            return `target could not be read (${code}): ${detail}`;
+    }
+};
+const throwIfTargetResolutionCancelled = (signal) => {
+    if (signal?.aborted === true)
+        throw new AnalysisCancelledError("resolve_binary_target");
+};
+const detectArtifactFormat = async (path, handle, signal) => {
+    throwIfTargetResolutionCancelled(signal);
+    const lower = path.toLowerCase();
+    const magic = Buffer.alloc(8);
+    const observed = await handle.read(magic, 0, magic.length, 0);
+    throwIfTargetResolutionCancelled(signal);
+    if (observed.bytesRead === 8 &&
+        magic.equals(Buffer.from([0, 0x61, 0x73, 0x6d, 1, 0, 0, 0])))
+        throw new BinaryTargetError(path, "WebAssembly v1 artifacts are not supported by the native opening route", { constraint: "wasm_requires_static_inspection" });
+    if (hasZipSignature(magic.subarray(0, observed.bytesRead))) {
+        // The HarmonyOS App Pack suffix `.app` is a root-input concept; a nested
+        // ZIP member ending in `.app` keeps the generic zip classification.
+        if (lower.endsWith(".app"))
+            return "app-pack";
+        return zipPackageFormatForPath(lower) ?? "zip";
+    }
+    // Binary plists, including keyed archives, often use other extensions.
+    if (observed.bytesRead === 8 && magic.equals(Buffer.from("bplist00")))
+        return "plist";
+    const named = namedArtifactFormat(lower);
+    if (named !== undefined)
+        return named;
+    if (lower.endsWith(".pkg") &&
+        observed.bytesRead >= 4 &&
+        magic.subarray(0, 4).equals(Buffer.from("xar!")))
+        return "pkg";
+    if (lower.endsWith(".dmg")) {
+        throwIfTargetResolutionCancelled(signal);
+        const size = (await handle.stat()).size;
+        throwIfTargetResolutionCancelled(signal);
+        if (size >= 512) {
+            const trailer = Buffer.alloc(4);
+            const read = await handle.read(trailer, 0, trailer.length, size - 512);
+            throwIfTargetResolutionCancelled(signal);
+            if (read.bytesRead === 4 && trailer.equals(Buffer.from("koly")))
+                return "dmg";
+        }
+    }
+    return undefined;
+};
+const namedArtifactFormat = (lowerPath) => {
+    if (lowerPath.endsWith(".asar"))
+        return "asar";
+    if (lowerPath.endsWith(".plist"))
+        return "plist";
+    if (lowerPath.endsWith(".map"))
+        return "source-map";
+    return /\.(?:m?js|cjs)$/u.test(lowerPath) ? "javascript" : undefined;
+};
+const isArchiveFormat = (format) => isZipPackageFormat(format) || ["asar", "dmg", "pkg"].includes(format);
+const sha256Handle = async (handle, path, initial, signal) => {
+    const hash = createHash("sha256");
+    const chunk = Buffer.allocUnsafe(64 * 1024);
+    let position = 0;
+    while (true) {
+        throwIfTargetResolutionCancelled(signal);
+        const observed = await handle.read(chunk, 0, Math.min(chunk.length, initial.size - position + 1), position);
+        throwIfTargetResolutionCancelled(signal);
+        if (observed.bytesRead === 0)
+            break;
+        hash.update(chunk.subarray(0, observed.bytesRead));
+        position += observed.bytesRead;
+        if (position > initial.size)
+            throw new BinaryTargetError(path, "target grew while being read");
+    }
+    throwIfTargetResolutionCancelled(signal);
+    const [opened, currentPath] = await Promise.all([handle.stat(), lstat(path)]);
+    if (!sameRegularFileState(initial, opened) ||
+        !sameRegularFileState(initial, currentPath) ||
+        position !== initial.size)
+        throw new BinaryTargetError(path, "target changed while being read");
+    return hash.digest("hex");
+};
+const resolveAppBundle = async (path) => {
+    const metadata = await stat(path);
+    if (!metadata.isDirectory())
+        return ok({ executable: path });
+    if (extname(path).toLowerCase() !== ".app")
+        return err(new BinaryTargetError(path, "this opening route requires a file or app bundle", {
+            constraint: "directory_requires_file",
+        }));
+    return resolveAppBundleExecutable(path);
+};
+const readExecutableMetadata = async (handle, hostArchitecture, signal) => {
+    throwIfTargetResolutionCancelled(signal);
+    const prefix = Buffer.alloc(4096);
+    const prefixRead = await handle.read(prefix, 0, prefix.length, 0);
+    throwIfTargetResolutionCancelled(signal);
+    const bytes = prefix.subarray(0, prefixRead.bytesRead);
+    // Header commitments such as Mach-O load commands and FAT slices are
+    // checked against the whole file, not the probed prefix.
+    const fileSize = (await handle.stat()).size;
+    throwIfTargetResolutionCancelled(signal);
+    if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a) {
+        const offset = mzWindowsHeaderOffset(bytes);
+        if (offset !== null) {
+            if (offset < 64)
+                return err("invalid Windows new-header offset in MZ image");
+            return readPeMetadata(handle, offset, signal);
+        }
+        // MZ relocation records may extend past the initial probe; their format
+        // bounds are at most 65535 records inside a 65535-paragraph header.
+        const tableEnd = bytes.length >= 28
+            ? bytes.readUInt16LE(24) + bytes.readUInt16LE(6) * 4
+            : 0;
+        const headerBytes = bytes.length >= 28 ? bytes.readUInt16LE(8) * 16 : 0;
+        if (tableEnd > bytes.length &&
+            tableEnd <= headerBytes &&
+            tableEnd <= fileSize) {
+            const table = Buffer.alloc(tableEnd);
+            const observed = await handle.read(table, 0, table.length, 0);
+            throwIfTargetResolutionCancelled(signal);
+            return parseExecutableHeader(table.subarray(0, observed.bytesRead), hostArchitecture, fileSize);
+        }
+        return parseExecutableHeader(bytes, hostArchitecture, fileSize);
+    }
+    if (bytes.length >= 8) {
+        const magic = bytes.readUInt32BE(0);
+        if ([0xcafebabf, 0xbfbafeca].includes(magic)) {
+            const little = magic === 0xbfbafeca;
+            const count = little ? bytes.readUInt32LE(4) : bytes.readUInt32BE(4);
+            const required = 8 + count * 32;
+            if (count <= 128 && required > bytes.length) {
+                const header = Buffer.alloc(required);
+                const headerRead = await handle.read(header, 0, header.length, 0);
+                throwIfTargetResolutionCancelled(signal);
+                return parseExecutableHeader(header.subarray(0, headerRead.bytesRead), hostArchitecture, fileSize);
+            }
+        }
+    }
+    const parsed = parseExecutableHeader(bytes, hostArchitecture, fileSize);
+    if (!parsed.ok ||
+        parsed.value.architecture !== "mips" ||
+        parsed.value.mips.elfClass !== 32)
+        return parsed;
+    const declarations = await readMipsElfMetadata(handle, parsed.value.mips, () => throwIfTargetResolutionCancelled(signal));
+    if (!declarations.ok)
+        return declarations;
+    return ok({
+        ...parsed.value,
+        mips: {
+            ...parsed.value.mips,
+            abiFlags: declarations.value.abiFlags,
+            ...(declarations.value.sharedLoad === undefined
+                ? {}
+                : { sharedLoad: declarations.value.sharedLoad }),
+            ...(declarations.value.limitations.length === 0
+                ? {}
+                : { limitations: declarations.value.limitations }),
+        },
+    });
+};
+const readPeMetadata = async (handle, offset, signal) => {
+    throwIfTargetResolutionCancelled(signal);
+    const fileHeader = Buffer.alloc(24);
+    const fileHeaderRead = await handle.read(fileHeader, 0, fileHeader.length, offset);
+    throwIfTargetResolutionCancelled(signal);
+    if (fileHeaderRead.bytesRead !== fileHeader.length)
+        return err("invalid or truncated PE header");
+    const signature = fileHeader.toString("ascii", 0, 2);
+    if (["NE", "LE", "LX"].includes(signature))
+        return err(`unsupported ${signature} executable in MZ image`);
+    const optionalHeaderSize = fileHeader.readUInt16LE(20);
+    if (optionalHeaderSize > 4096)
+        return err("invalid PE optional header size");
+    const record = Buffer.alloc(24 + optionalHeaderSize);
+    const recordRead = await handle.read(record, 0, record.length, offset);
+    throwIfTargetResolutionCancelled(signal);
+    return recordRead.bytesRead === record.length
+        ? parsePeRecord(record)
+        : err("invalid or truncated PE header");
+};

package/dist/application/BrowserEvidence.js

@@ -0,0 +1,127 @@
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import { sanitizeBrowserUrl } from "../domain/browserObservation.js";
+import { commitBrowserScenarioNormalization } from "../domain/browserScenarioNormalization.js";
+/** Create Evidence for one request-scoped external browser observation. */
+export const createBrowserEvidence = (operation, input, result, provider) => createEvidence(undefined, provider, {
+    predicateType: browserPredicate(operation),
+    operation,
+    parameters: browserParameters(input, result),
+    result: jsonValueSchema.parse(result),
+    confidence: "observed",
+    authority: "external-service",
+    environment: "browser" in result
+        ? {
+            id: `${result.browser.product}@${result.browser.revision}`,
+            platform: "unknown",
+            architecture: "unknown",
+            isolation: "none",
+        }
+        : null,
+    limitations: [
+        ...result.limitations,
+        ...("browser" in result
+            ? ["Browser host platform and architecture were not observed."]
+            : []),
+    ],
+});
+const browserParameters = (input, result) => {
+    if (!("cdp_endpoint" in input)) {
+        if ("before_scenario" in input)
+            return {
+                comparison_kind: "browser_scenario",
+                before_browser: input.before_scenario.browser,
+                after_browser: input.after_scenario.browser,
+                before_start_origin: input.before_scenario.scenario.start_origin,
+                after_start_origin: input.after_scenario.scenario.start_origin,
+                normalization_sha256: commitBrowserScenarioNormalization(input.normalization).sha256,
+            };
+        if ("inspection" in input.before && "inspection" in input.after)
+            return {
+                before_target_id: input.before.inspection.target.target_id,
+                before_capture_ended_at: input.before.inspection.capture_window.ended_at,
+                after_target_id: input.after.inspection.target.target_id,
+                after_capture_ended_at: input.after.inspection.capture_window.ended_at,
+            };
+        if (isScreenshotComparison(input))
+            return {
+                before_artifact_sha256: input.before.sha256,
+                after_artifact_sha256: input.after.sha256,
+                channel_threshold: input.channel_threshold,
+            };
+        throw new Error("Browser comparison input did not match a comparison type");
+    }
+    const observedOrigin = browserResultTargetOrigin(result);
+    const scope = {
+        cdp_endpoint: input.cdp_endpoint,
+        allowed_origins: input.allowed_origins.length > 0
+            ? input.allowed_origins
+            : "target_id" in input && observedOrigin !== undefined
+                ? [observedOrigin]
+                : [],
+    };
+    if (!("target_id" in input))
+        return scope;
+    return {
+        ...scope,
+        target_id: input.target_id,
+        ...("observation_ms" in input
+            ? { observation_ms: input.observation_ms }
+            : {}),
+        ...("include_accessibility_text" in input
+            ? {
+                include_accessibility_text: input.include_accessibility_text,
+                include_console_text: input.include_console_text,
+                include_json_body_shapes: input.include_json_body_shapes,
+                include_websocket_shapes: input.include_websocket_shapes,
+                include_storage_keys: input.include_storage_keys,
+                include_storage_fingerprints: input.include_storage_fingerprints,
+                ...("include_script_sources" in input
+                    ? { include_script_sources: input.include_script_sources }
+                    : {}),
+            }
+            : {}),
+        ...("fetch_source_maps" in input
+            ? { fetch_source_maps: input.fetch_source_maps }
+            : {}),
+    };
+};
+const browserResultTargetOrigin = (result) => {
+    if ("inspection" in result &&
+        typeof result.inspection === "object" &&
+        result.inspection !== null &&
+        "target" in result.inspection &&
+        typeof result.inspection.target === "object" &&
+        result.inspection.target !== null &&
+        "origin" in result.inspection.target &&
+        typeof result.inspection.target.origin === "string")
+        return result.inspection.target.origin;
+    if (!("target" in result))
+        return undefined;
+    if ("origin" in result.target)
+        return result.target.origin;
+    if ("initial_url" in result.target)
+        return sanitizeBrowserUrl(result.target.initial_url).origin ?? undefined;
+    return undefined;
+};
+const isScreenshotComparison = (input) => "channel_threshold" in input;
+const browserPredicate = (operation) => {
+    switch (operation) {
+        case "list_browser_targets":
+            return "rea.browser-target-list";
+        case "inspect_web_page":
+            return "rea.web-page-inspection";
+        case "analyze_web_bundle":
+            return "rea.web-bundle-analysis";
+        case "observe_web_session":
+            return "rea.web-observation-session";
+        case "discover_webmcp_tools":
+            return "rea.webmcp-discovery";
+        case "compare_web_captures":
+            return "rea.web-capture-diff";
+        case "capture_web_screenshot":
+            return "rea.web-screenshot";
+        case "compare_web_screenshots":
+            return "rea.web-screenshot-diff";
+    }
+};

package/dist/application/BrowserObservationPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/BrowserObservationService.js

@@ -0,0 +1,86 @@
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import { err, ok } from "../domain/result.js";
+import { createBrowserEvidence } from "./BrowserEvidence.js";
+/** List browser targets within the endpoint and origin scope in the request. */
+export const listBrowserTargets = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "list_browser_targets");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.listTargets(input, options);
+    return result.ok
+        ? ok(createBrowserEvidence("list_browser_targets", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Inspect one page within the endpoint and origin scope in the request. */
+export const inspectWebPage = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "inspect_web_page");
+    if (!ready.ok)
+        return ready;
+    const result = await ready.value.inspectPage(input, options);
+    return result.ok
+        ? ok(createBrowserEvidence("inspect_web_page", input, result.value, ready.value.identity()))
+        : result;
+};
+/** Capture requested sources and derive static web-bundle evidence. */
+export const analyzeWebBundle = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "analyze_web_bundle");
+    if (!ready.ok)
+        return ready;
+    const analyzed = await ready.value.analyzeBundle(input, options);
+    if (!analyzed.ok)
+        return analyzed;
+    return ok(createBrowserEvidence("analyze_web_bundle", input, analyzed.value, ready.value.identity()));
+};
+/** Observe navigation caused by external user actions during one armed window. */
+export const observeWebSession = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "observe_web_session");
+    if (!ready.ok)
+        return ready;
+    const observed = await ready.value.observeSession(input, options);
+    return observed.ok
+        ? ok(createBrowserEvidence("observe_web_session", input, observed.value, ready.value.identity()))
+        : observed;
+};
+/** Discover WebMCP declarations without exposing an invocation surface. */
+export const discoverWebMcpTools = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "discover_webmcp_tools");
+    if (!ready.ok)
+        return ready;
+    const discovered = await ready.value.discoverWebMcpTools(input, options);
+    return discovered.ok
+        ? ok(createBrowserEvidence("discover_webmcp_tools", input, discovered.value, ready.value.identity()))
+        : discovered;
+};
+/** Compare two already-normalized web captures without external access. */
+export const compareWebCaptureEvidence = async (browser, input) => {
+    const ready = requireBrowser(browser, "compare_web_captures");
+    if (!ready.ok)
+        return ready;
+    const compared = await ready.value.compareCaptures(input);
+    return compared.ok
+        ? ok(createBrowserEvidence("compare_web_captures", input, compared.value, ready.value.identity()))
+        : compared;
+};
+/** Capture one visible-viewport screenshot for the requested target. */
+export const captureWebScreenshot = async (browser, input, options = {}) => {
+    const ready = requireBrowser(browser, "capture_web_screenshot");
+    if (!ready.ok)
+        return ready;
+    const captured = await ready.value.captureScreenshot(input, options);
+    return captured.ok
+        ? ok(createBrowserEvidence("capture_web_screenshot", input, captured.value, ready.value.identity()))
+        : captured;
+};
+/** Compare two self-verifying PNG artifacts without external access. */
+export const compareWebScreenshotEvidence = async (browser, input) => {
+    const ready = requireBrowser(browser, "compare_web_screenshots");
+    if (!ready.ok)
+        return ready;
+    const compared = await ready.value.compareScreenshots(input);
+    return compared.ok
+        ? ok(createBrowserEvidence("compare_web_screenshots", input, compared.value, ready.value.identity()))
+        : compared;
+};
+const requireBrowser = (browser, operation) => browser === undefined
+    ? err(new AnalysisCapabilityUnavailableError("rea-cdp-browser", operation, "browser observation provider is not configured"))
+    : ok(browser);

package/dist/application/BrowserScenarioCapturePort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/BrowserScenarioCaptureService.js

@@ -0,0 +1,17 @@
+import { createBrowserScenarioEvidence } from "./BrowserScenarioEvidence.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import { err } from "../domain/result.js";
+const OPERATION = "capture_browser_scenario";
+const PROVIDER_ID = "rea-playwright-browser-scenario";
+/** Execute one controlled browser scenario using its explicit request scope. */
+export const captureBrowserScenario = async (provider, scenario, options = {}) => {
+    if (provider === undefined)
+        return err(new AnalysisCapabilityUnavailableError(PROVIDER_ID, OPERATION, "browser scenario provider is not configured"));
+    const captured = await provider.captureScenario(scenario, options);
+    return captured.ok
+        ? {
+            ok: true,
+            value: createBrowserScenarioEvidence(scenario, captured.value, provider.identity()),
+        }
+        : captured;
+};

package/dist/application/BrowserScenarioEvidence.js

@@ -0,0 +1,28 @@
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
+import { createEvidence, } from "../domain/evidence.js";
+import { jsonObjectSchema, jsonValueSchema } from "../domain/jsonValue.js";
+const browserScenarioParameters = (scenario) => ({
+    ...jsonObjectSchema.parse(scenario),
+    scenario_sha256: digestCanonicalValue(scenario, "Browser scenario"),
+});
+/** Create Evidence without retaining resolved scenario secret values. */
+export const createBrowserScenarioEvidence = (scenario, capture, provider) => createEvidence(undefined, provider, {
+    predicateType: "rea.browser-scenario-capture",
+    operation: "capture_browser_scenario",
+    parameters: browserScenarioParameters(scenario),
+    result: jsonValueSchema.parse(capture),
+    confidence: "observed",
+    authority: "controlled-replay",
+    environment: {
+        id: `${capture.browser.product}@${capture.browser.version}`,
+        platform: "unknown",
+        architecture: "unknown",
+        isolation: capture.browser.process_ownership === "provider-owned"
+            ? "process"
+            : "none",
+    },
+    limitations: [
+        ...capture.limitations,
+        "Browser host platform and architecture were not observed.",
+    ],
+});