scenescout 3.8.0 → 3.10.0

package/dist/engine/lane.js

@@ -135,7 +135,12 @@ export function parseLaneReport(text, expectedLane) {
         const trailing = /after JSON|Unexpected non-whitespace/i.test(message);
         return { ok: false, reason: trailing ? "the reply must be one JSON object, with no text after it" : `not valid JSON: ${message}` };
     }
-    const result = LaneReport.safeParse(raw);
+    // Decoded before the schema, so every cap measures the text the lane wrote.
+    // Only a reply that looks relay-escaped is decoded: one holding a literal
+    // `<` or `>` was not escaped on the way, and its `&amp;` is what the lane
+    // meant (a page that double-escapes its text is a defect a lane can report).
+    const decoded = /[<>]/.test(text) ? { value: raw, count: 0 } : decodeStringValues(raw);
+    const result = LaneReport.safeParse(decoded.value);
     if (!result.success) {
         const issue = result.error.issues[0];
         const at = issue.path.length ? ` at ${issue.path.join(".")}` : "";
@@ -144,7 +149,77 @@ export function parseLaneReport(text, expectedLane) {
     if (expectedLane !== undefined && result.data.lane !== expectedLane) {
         return { ok: false, reason: `the report names lane "${result.data.lane}", but this reply was asked of lane "${expectedLane}"` };
     }
-    return { ok: true, report: result.data, aroundIgnored };
+    return { ok: true, report: result.data, aroundIgnored, entitiesDecoded: decoded.count };
+}
+/**
+ * The HTML character references a relay adds when it escapes text: the five
+ * named ones an escaper emits, and decimal or hex numeric ones. Anything else
+ * that looks like a reference (`&nbsp;`, `&#0;`, a bare `&`) is left as it is.
+ */
+const CHAR_REFERENCE = /&(?:(lt|gt|amp|quot|apos)|#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6}));/g;
+const NAMED_REFERENCES = { lt: "<", gt: ">", amp: "&", quot: '"', apos: "'" };
+/**
+ * One pass over the text, so each reference is decoded exactly once:
+ * `&amp;lt;` becomes `&lt;`, not `<`, because the `&` a match produces is
+ * never scanned again.
+ */
+function decodeReferences(text) {
+    let count = 0;
+    const out = text.replace(CHAR_REFERENCE, (whole, name, dec, hex) => {
+        if (name) {
+            count += 1;
+            return NAMED_REFERENCES[name];
+        }
+        const code = hex !== undefined ? parseInt(hex, 16) : Number(dec);
+        // NUL, surrogates and anything past the last code point are not characters a relay escaped.
+        if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff))
+            return whole;
+        count += 1;
+        return String.fromCodePoint(code);
+    });
+    return { text: out, count };
+}
+/**
+ * A planner relaying a lane's reply often HTML-escapes it, so `->` arrives as
+ * `-&gt;` and no longer matches the finding filed with the same evidence.
+ * Decoded in string VALUES only, after JSON.parse: JSON's own syntax contains
+ * no `<`, `>` or `&`, so an escaper can only have touched it by turning its
+ * quotes into `&quot;`, and that reply does not parse at all; it is refused
+ * as invalid JSON rather than repaired. Keys are a fixed set of plain words
+ * and are left alone.
+ */
+function decodeStringValues(value) {
+    if (typeof value === "string") {
+        const d = decodeReferences(value);
+        return { value: d.text, count: d.count };
+    }
+    if (Array.isArray(value)) {
+        let count = 0;
+        const out = value.map((v) => {
+            const d = decodeStringValues(v);
+            count += d.count;
+            return d.value;
+        });
+        return { value: out, count };
+    }
+    if (value !== null && typeof value === "object") {
+        let count = 0;
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            const d = decodeStringValues(v);
+            count += d.count;
+            out[k] = d.value;
+        }
+        return { value: out, count };
+    }
+    return { value, count: 0 };
+}
+/** The line the fold adds when the parse decoded references, so a reader knows the tool changed the text; empty when it did not. */
+export function decodedEntitiesNote(count) {
+    if (count === 0)
+        return "";
+    const what = count === 1 ? "1 HTML character reference" : `${count} HTML character references`;
+    return `\n(${what} in the report ${count === 1 ? "was" : "were"} decoded once, as a relay that escapes text would have added ${count === 1 ? "it" : "them"}.)`;
 }
 /**
  * The paragraph the planner puts in every lane's prompt. It is generated from
@@ -196,3 +271,105 @@ export function summarizeLaneReport(r) {
         parts.push(`blocked by ${r.blocked_by}`);
     return `${r.lane}: ${parts.join(", ")}`;
 }
+/**
+ * Which sessions are lanes of a parallel run, and whether each one's report
+ * has been folded, so a lane's session is not closed before its decisions
+ * have somewhere to go.
+ *
+ * Folding a report writes its decisions to the lane's own session's project
+ * memory. Closing that session first leaves nothing to write to: a planner
+ * that closes a lane whose fold was just refused (a cap exceeded, say) and
+ * then re-sends the corrected object loses every decision in it.
+ *
+ * A session counts as a lane only when something in this run named it as
+ * one: scout_lane_brief listed it, scout_lane_report issued its instruction,
+ * or a reply was folded (accepted or refused) under its name while that
+ * session was attached. Nothing is inferred from other lanes' activity: the
+ * planner's own session is not a lane, and a single-session run never names
+ * one, so neither is ever refused a close by this. The ledger belongs to one
+ * run: the server clears it when the last session closes, because lane names
+ * are module names and a later run may well attach a role with one of them.
+ */
+export class LaneLedger {
+    named = new Set();
+    refused = new Set();
+    folded = new Set();
+    /** An instruction named this session as a lane. */
+    name(lane) {
+        this.named.add(lane);
+    }
+    /**
+     * A brief's lanes. One whose name is a session already live is skipped:
+     * that session was attached before the split existed, so it is the
+     * planner's own (or another role's), not a lane waiting to report.
+     */
+    nameBriefed(lanes, isLive) {
+        for (const lane of lanes)
+            if (!isLive(lane))
+                this.named.add(lane);
+    }
+    /**
+     * A reply for this lane was refused: it is a lane, and nothing it decided is
+     * kept yet. Only while its session is attached: a reply for a session that
+     * is gone says nothing about a later session given the same name.
+     */
+    refuse(lane, attached) {
+        if (!attached)
+            return;
+        this.named.add(lane);
+        if (!this.folded.has(lane))
+            this.refused.add(lane);
+    }
+    /** A reply for this lane was accepted. Only while its session is attached, for the same reason. */
+    fold(lane, attached) {
+        if (!attached)
+            return;
+        this.named.add(lane);
+        this.folded.add(lane);
+        this.refused.delete(lane);
+    }
+    /** The session closed: a later session with the same name is a fresh lane. */
+    forget(lane) {
+        this.named.delete(lane);
+        this.refused.delete(lane);
+        this.folded.delete(lane);
+    }
+    clear() {
+        this.named.clear();
+        this.refused.clear();
+        this.folded.clear();
+    }
+    state(lane) {
+        if (!this.named.has(lane))
+            return "not-a-lane";
+        if (this.folded.has(lane))
+            return "folded";
+        return this.refused.has(lane) ? "refused" : "unfolded";
+    }
+}
+/**
+ * Whether scout_close may close these sessions. Refused only when one of them
+ * is a lane whose report has not been accepted; `force` closes anyway. The
+ * message names every such lane and the two ways on.
+ */
+export function laneCloseGuard(sessions, ledger, force = false) {
+    if (force)
+        return { ok: true };
+    const pending = sessions.filter((s) => ledger.state(s) === "refused" || ledger.state(s) === "unfolded");
+    if (pending.length === 0)
+        return { ok: true };
+    const one = pending.length === 1;
+    const lines = pending.map((s) => ledger.state(s) === "refused"
+        ? `  · ${JSON.stringify(s)}: its last report was REFUSED and no corrected one has been accepted`
+        : `  · ${JSON.stringify(s)}: no report from it has been accepted yet`);
+    const others = sessions.filter((s) => !pending.includes(s));
+    const message = `Not closed: ${one ? "this session is a lane" : `${pending.length} sessions are lanes`} of a parallel run whose report has not been folded.\n` +
+        lines.join("\n") +
+        `\nFolding keeps a lane's decisions in its own session's project memory and checks its defects were filed; closing the session first loses them. ` +
+        `Fold with scout_lane_report { lane, reply } (for a refused report, the lane's corrected object), then close. ` +
+        `To close anyway and lose ${one ? "that lane's" : "those lanes'"} decisions, pass force: true.` +
+        (others.length > 0
+            ? `\nThe other session(s) can be closed one by one by name meanwhile: ${others.map((s) => `scout_close { session: ${JSON.stringify(s)} }`).join(", ")}.`
+            : "");
+    return { ok: false, unfolded: pending, message };
+}

package/dist/engine/memory.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { normalizePath, shortHash } from "./fingerprint.js";
+import { isFormBookkeeping } from "./forms.js";
 /**
  * The kinds a finding can be. One list: scout_finding's input schema, the lane
  * report a parallel agent hands back, and the skill text all read it from
@@ -282,6 +283,14 @@ function decisionKey(d) {
  * project would otherwise accumulate every decision ever made and re-serialise
  * them on each save, which is what made an old history slow to open.
  */
+/**
+ * Whether a coverage key belongs to a control inside another site's frame:
+ * those keys carry the frame's origin (collector.ts frameElementKey), where
+ * the app's own frames carry a path. Not the app's to cover.
+ */
+export function isEmbedKey(key) {
+    return /^frame:https?:\/\//.test(key);
+}
 export const MAX_LANE_DECISIONS = 1000;
 /**
  * Most options a dropdown may have and still be tracked for unchosen options.
@@ -605,7 +614,7 @@ function liveOwnerPid(dir, isAlive) {
  * Best-effort and idempotent — a read-only checkout must never break attach,
  * and an existing file is left exactly as the user left it.
  */
-function writeSelfIgnore(dir) {
+export function writeSelfIgnore(dir) {
     try {
         const ignorePath = path.join(dir, ".gitignore");
         if (fs.existsSync(ignorePath))
@@ -682,6 +691,7 @@ export class MemoryStore {
         this.injectionsReported.clear();
         this.auditsThisRun = 0;
         this.selectChoices.clear();
+        this.emptySubmits.clear();
     }
     /**
      * Each dropdown's options and the ones chosen in THIS run, by any session,
@@ -720,6 +730,55 @@ export class MemoryStore {
         }
         return out;
     }
+    /**
+     * Each form a session saw this run, by route and identity (forms.ts
+     * formIdentity: its own attributes, else its first submit control's
+     * coverage key), and whether any session has submitted it with every
+     * text field blank (forms.ts has the definition). Per run and shared across
+     * sessions, like the dropdown choices: an earlier run's empty submit says
+     * nothing about this build, and in a parallel run any lane may try it.
+     */
+    emptySubmits = new Map();
+    /**
+     * A form seen on a visited state. Recording it again changes nothing, except
+     * that `guarded` (every submit control disabled while its fields were blank)
+     * takes it off the list for good: the page refuses the empty submit itself,
+     * and no one could clear an entry whose submit cannot be pressed.
+     */
+    recordForm(fingerprint, key, guarded = false) {
+        const entry = this.formEntry(fingerprint, key);
+        if (entry && guarded)
+            entry.guarded = true;
+    }
+    /**
+     * A submit of a form already seen; `empty` when every text field was blank
+     * at the moment it went. It only marks: a submit never puts a form on the
+     * list, since a key read at submit time is the one most likely to be stale.
+     * Returns whether the form was on the list, so a miss can be logged.
+     */
+    recordFormSubmit(fingerprint, key, empty) {
+        const entry = this.formEntry(fingerprint, key, false);
+        if (entry && empty)
+            entry.triedEmpty = true;
+        return entry !== null;
+    }
+    formEntry(fingerprint, key, create = true) {
+        // Another site's frame is not the app's form to probe.
+        if (isEmbedKey(key))
+            return null;
+        const route = fingerprint.split("#")[0];
+        const id = `${route}\u0000${key}`;
+        let entry = this.emptySubmits.get(id) ?? null;
+        if (!entry && create) {
+            entry = { route, key, triedEmpty: false };
+            this.emptySubmits.set(id, entry);
+        }
+        return entry;
+    }
+    /** Forms seen this run that no session has submitted empty, in the order they were first seen. */
+    formsNeverSubmittedEmpty() {
+        return [...this.emptySubmits.values()].filter((f) => !f.triedEmpty && !f.guarded).map(({ route, key }) => ({ route, key }));
+    }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);
         this.legacyDirNote = adoptLegacyMemoryDir(projectDir);
@@ -1339,7 +1398,8 @@ export class MemoryStore {
         // The planner's fold marker is not a step anyone took on a page. Left in,
         // its empty URL read as a route change and cut the trace of a finding filed
         // right after a fold — which is when the fold asks lanes to file.
-        const log = this.actionLog.filter((a) => a.action !== "lane-report");
+        // Nor is the forms bookkeeping (a read that failed, a submit it could not match).
+        const log = this.actionLog.filter((a) => a.action !== "lane-report" && !isFormBookkeeping(a.action));
         let start = Math.max(0, log.length - 12);
         for (let i = log.length - 1; i >= 0 && i >= log.length - 12; i--) {
             if (routeOf(log[i].url) !== routeOf(f.url)) {
@@ -1388,6 +1448,7 @@ export class MemoryStore {
         let elementsTotal = 0;
         let elementsExercised = 0;
         const unexercised = [];
+        const embeds = { total: 0, exercised: 0 };
         for (const [route, elements] of byRoute) {
             const own = [];
             // The route's OWN element count — deduped across states and with shared
@@ -1398,6 +1459,12 @@ export class MemoryStore {
             // untouched route silently drops out of the gap ledger.
             let ownTotal = 0;
             for (const [key, done] of elements) {
+                if (isEmbedKey(key)) {
+                    embeds.total += 1;
+                    if (done)
+                        embeds.exercised += 1;
+                    continue;
+                }
                 if (isChrome(key)) {
                     chrome.set(key, (chrome.get(key) ?? false) || done);
                     continue;
@@ -1424,7 +1491,7 @@ export class MemoryStore {
         if (chromeLeft.length > 0) {
             unexercised.push({ state: SHARED_CHROME_ROUTE, keys: chromeLeft, total: chrome.size });
         }
-        return { states: Object.keys(this.data.states).length, elementsTotal, elementsExercised, unexercised };
+        return { states: Object.keys(this.data.states).length, elementsTotal, elementsExercised, unexercised, embeds };
     }
     /**
      * Remember which styled-element signatures the design audit saw on a route.

package/dist/engine/oracles.js

@@ -1,4 +1,13 @@
 import { redactSecrets } from "./memory.js";
+/** How an HTTP error violation states its request. One formatter, so a reader of the detail (the check) cannot drift from its writer. */
+export function httpErrorDetail(method, url, status) {
+    return `${method} ${url.slice(0, 200)} → HTTP ${status}`;
+}
+/** The status an http_error detail names, or null when the detail is not one. */
+export function httpStatusOf(detail) {
+    const m = /→ HTTP (\d{3})$/.exec(detail.replace(/ \[\d+ secrets? redacted\]$/, ""));
+    return m ? Number(m[1]) : null;
+}
 /** URLs whose failures are noise, not findings (favicons, source maps). */
 const BENIGN_URL_RE = /favicon|\.map($|\?)/i;
 /**
@@ -35,6 +44,68 @@ export function isPolicyInduced(v, msSincePolicyBlock) {
         return false;
     return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed|the server responded with a status of 403\b/i.test(v.detail);
 }
+/**
+ * The request a console message is the browser's own echo of, or null when it
+ * is not one.
+ *
+ * Chromium and WebKit print "Failed to load resource: …" for a subresource
+ * that answered with an error status or got no answer, and give the
+ * resource's address as the message's location (Firefox prints nothing; see
+ * `echoesFailedLoads` in browsers.ts). The line carries no address in its
+ * text, so without this it could only be charged to the page. Returned in the
+ * form `requestKey` gives a request's URL, so the two can be matched.
+ */
+export function failedLoadEchoOf(text, locationUrl, pageUrl) {
+    if (!/^Failed to load resource: /.test(text) || !locationUrl)
+        return null;
+    try {
+        return requestKey(new URL(locationUrl, pageUrl).href);
+    }
+    catch {
+        return null;
+    }
+}
+/** A request's address as the echo lookup keys it: absolute, and without its fragment, which is never sent. */
+export function requestKey(url) {
+    try {
+        const u = new URL(url);
+        u.hash = "";
+        return u.href;
+    }
+    catch {
+        return url;
+    }
+}
+/**
+ * Which recent requests an embed sent, by address, so the browser's echo of
+ * one that failed is charged where the request was.
+ *
+ * Only addresses an embed requested are kept, and the latest request to an
+ * address decides: when the app then requests the same address, its echo is
+ * the app's again. Bounded, dropping the oldest, so a long run does not hold
+ * every address it saw.
+ */
+export class EmbedRequestLog {
+    cap;
+    byKey = new Map();
+    constructor(cap = 500) {
+        this.cap = cap;
+    }
+    note(url, embed) {
+        const key = requestKey(url);
+        this.byKey.delete(key);
+        if (!embed)
+            return;
+        this.byKey.set(key, embed);
+        if (this.byKey.size > this.cap)
+            this.byKey.delete(this.byKey.keys().next().value);
+    }
+    /** The embed whose request a console message echoes, or null when it echoes none of theirs. */
+    embedOfEcho(text, locationUrl, pageUrl) {
+        const key = failedLoadEchoOf(text, locationUrl, pageUrl);
+        return key === null ? null : (this.byKey.get(key) ?? null);
+    }
+}
 /**
  * Invariant oracles: passive listeners that record violations regardless of
  * what the agent is doing. The engine drains the buffer after every action and
@@ -58,8 +129,12 @@ export class OracleMonitor {
                 severity: "high",
                 detail: text.slice(0, 500),
                 url: page.url(),
+                // The one console line that names its request: the browser's echo of an embed's failed load is the embed's too.
+                embed: this.embedRequests.embedOfEcho(text, msg.location().url, page.url()) ?? undefined,
             });
         });
+        // Noted as each request starts, which is always before the browser can echo its failure.
+        page.on("request", (req) => this.embedRequests.note(req.url(), this.embedOfRequest(req)));
         page.on("pageerror", (err) => {
             this.record({
                 kind: "page_error",
@@ -84,6 +159,7 @@ export class OracleMonitor {
                 severity: "medium",
                 detail: `${req.method()} ${req.url().slice(0, 200)} → ${failure}`,
                 url: page.url(),
+                embed: this.embedOfRequest(req) ?? undefined,
             });
         });
         page.on("response", (res) => {
@@ -104,8 +180,9 @@ export class OracleMonitor {
             this.record({
                 kind: "http_error",
                 severity: status >= 500 ? "high" : "medium",
-                detail: `${res.request().method()} ${res.url().slice(0, 200)} → HTTP ${status}`,
+                detail: httpErrorDetail(res.request().method(), res.url(), status),
                 url: page.url(),
+                embed: this.embedOfRequest(res.request()) ?? undefined,
             });
         });
     }
@@ -128,6 +205,19 @@ export class OracleMonitor {
      * errors look the same.
      */
     policyAttributed = 0;
+    embedOfRequest = () => null;
+    embedRequests = new EmbedRequestLog();
+    /**
+     * The engine knows which frame a request came from; a failing request is
+     * attributed to an embed through this. Console and page errors are not
+     * attributed: a console message says where its script was served from, not
+     * which frame ran it, so an SDK the app's page loads from the embed's own
+     * site would be taken for the embed. The exception is the browser's echo of
+     * a failed load, which names its request and goes where the request went.
+     */
+    setEmbedAttribution(ofRequest) {
+        this.embedOfRequest = ofRequest;
+    }
     /** The engine knows exactly which requests its policy stopped; failed requests and stand-in refusals are matched against that, not against wording. */
     setPolicyRefusalCheck(check) {
         this.refusedByPolicy = check;
@@ -158,7 +248,11 @@ export class OracleMonitor {
             this.policyAttributed += 1;
             return;
         }
-        const violation = { ...redactViolation(v), at: new Date().toISOString() };
+        // Another site's frame: its behaviour, reported, but never as the app's high-severity defect.
+        const attributed = v.embed ? { ...v, severity: "medium" } : v;
+        if (!attributed.embed)
+            delete attributed.embed;
+        const violation = { ...redactViolation(attributed), at: new Date().toISOString() };
         this.buffer.push(violation);
         this.all.push(violation);
     }
@@ -179,7 +273,8 @@ export class OracleMonitor {
         for (const v of out) {
             // Same normalization as the report rollup, so "the same violation"
             // means the same thing in tool output and in the final report.
-            const sig = `${v.kind}: ${v.detail
+            // An embed's violation is not the app's: its signature says whose it is.
+            const sig = `${v.embed ? `[${v.embed}] ` : ""}${v.kind}: ${v.detail
                 .replace(/\b\d+\b/g, ":n")
                 .replace(/[0-9a-f]{8,}/gi, ":h")
                 .slice(0, 140)}`;
@@ -205,7 +300,9 @@ export function formatViolations(violations) {
     if (fresh.length === 0) {
         return `\nORACLE: ${repeats} repeat violation(s) of previously reported signatures — nothing new.`;
     }
-    const lines = fresh.slice(0, 10).map((v) => `  ⚠ [${v.severity}] ${v.kind}: ${v.detail}`);
+    const lines = fresh
+        .slice(0, 10)
+        .map((v) => `  ⚠ [${v.severity}] ${v.kind}${v.embed ? ` (in an embed of ${v.embed}: its behaviour, not the app's)` : ""}: ${v.detail}`);
     const more = fresh.length > 10 ? `\n  … and ${fresh.length - 10} more` : "";
     return `\nORACLE VIOLATIONS since last action (${fresh.length} new):\n${lines.join("\n")}${more}${repeatLine}`;
 }

package/dist/engine/pace.js

@@ -1,10 +1,23 @@
+import { FORMS_READ_FAILED, FORMS_SUBMIT_UNMATCHED } from "./forms.js";
 /**
  * Log entries that are not actions: a stated task, an attach, the note that a
  * resource was created. They carry no browser work and take no time, so
  * counting them inflates the action count and drags the median gap toward
  * zero. One real run logged 325 entries of which 107 were stated tasks.
  */
-const MARKER_ACTIONS = new Set(["task", "attach", "close", "lane-report", "created-resource", "journey:start", "journey:end", "record:full", "record:failed"]);
+const MARKER_ACTIONS = new Set([
+    "task",
+    "attach",
+    "close",
+    "lane-report",
+    "created-resource",
+    "journey:start",
+    "journey:end",
+    "record:full",
+    "record:failed",
+    FORMS_READ_FAILED,
+    FORMS_SUBMIT_UNMATCHED,
+]);
 /** Whether a log entry represents work the browser actually did. */
 export function isActing(action) {
     return !MARKER_ACTIONS.has(action);

package/dist/engine/policy.js

@@ -394,6 +394,124 @@ export function allowsForeignWriteOnSignIn(mode, topPageUrl, appUrl) {
     const last = (segments[segments.length - 1] ?? "").replace(/\.[a-z0-9]+$/i, "").replace(/_/g, "-");
     return SIGN_IN_SEGMENT_RE.test(last);
 }
+/**
+ * The embed a failing request is attributed to: the other site whose frame
+ * sent it (`frameSite`, judged on the frame chain), unless the request went to
+ * the app itself — a 500 from the app is the app's to answer, whoever called.
+ */
+export function embedOfRequest(appUrl, requestUrl, frameSite) {
+    if (!frameSite)
+        return null;
+    return foreignFrameOrigin(appUrl, [requestUrl]) === null ? null : frameSite;
+}
+/** The most origins a session may trust with its embeds' writes. */
+export const MAX_TRUSTED_EMBEDS = 10;
+/**
+ * The origins a session was told to trust, normalised, and what was given
+ * that is not one. An entry must be a plain http(s) origin — scheme, host and
+ * port, nothing after — so a path or a wildcard cannot widen it by accident.
+ */
+export function trustedEmbedOrigins(list) {
+    const origins = [];
+    const rejected = [];
+    const overflow = [];
+    for (const raw of list ?? []) {
+        let u;
+        try {
+            u = new URL(raw.trim());
+        }
+        catch {
+            rejected.push(raw);
+            continue;
+        }
+        const bare = u.pathname === "/" && !u.search && !u.hash && !u.username && !u.password;
+        if ((u.protocol !== "http:" && u.protocol !== "https:") || !bare || raw.includes("*")) {
+            rejected.push(raw);
+            continue;
+        }
+        // "pay.example.com." is "pay.example.com": one origin, one slot.
+        const origin = u.origin.replace(/\.(?=(:\d+)?$)/, "");
+        if (origins.includes(origin))
+            continue;
+        if (origins.length < MAX_TRUSTED_EMBEDS)
+            origins.push(origin);
+        else
+            overflow.push(raw);
+    }
+    return { origins, rejected, overflow };
+}
+/**
+ * Whether the writes a frame of `origin` sends outside the app may go out
+ * after all: only for an origin the user named as trusted (a provider in test
+ * mode, say), and only in safe-write — read-only and observe keep their
+ * promise, and destructive allows everything already.
+ */
+export function trustsEmbedWrite(mode, trusted, origin) {
+    return mode === "safe-write" && trusted.has(origin);
+}
+/**
+ * Whether a foreign write may go out because of trust: every other site
+ * involved — each http(s) frame from the sender up to the page, and the
+ * Origin header when it names one — must be trusted, so an untrusted embed
+ * cannot borrow a trusted one it wraps. A page the session never adopted (a
+ * popup) is not a frame, and trust does not reach it.
+ */
+export function trustsForeignWrite(mode, trusted, appUrl, req) {
+    if (mode !== "safe-write" || trusted.size === 0 || req.unadoptedPageUrl)
+        return false;
+    const originOf = (url) => {
+        if (!url)
+            return null;
+        try {
+            const u = new URL(url);
+            return u.protocol === "http:" || u.protocol === "https:" ? u.origin : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const app = originOf(appUrl);
+    const involved = new Set();
+    for (const url of req.frameChain) {
+        // A blank or srcdoc frame is its parent's, and the parent is judged next.
+        // Any other frame with no web address (blob:, data:) could be an untrusted
+        // site that moved itself there to wrap a trusted one: no trust through it.
+        if (/^about:(blank|srcdoc)/i.test(url))
+            continue;
+        const o = originOf(url);
+        if (!o)
+            return false;
+        if (o !== app)
+            involved.add(o);
+    }
+    const header = originOf(req.originHeader);
+    if (header && header !== app)
+        involved.add(header);
+    return involved.size > 0 && [...involved].every((o) => trustsEmbedWrite(mode, trusted, o));
+}
+/** The longest text typed into another site's frame; past it, a value is a fuzzing probe, not a user's input. */
+export const MAX_EMBED_TEXT = 200;
+/**
+ * Why a value must not be typed into another site's frame, or null when it
+ * may be. The tester is authorised to test the app, not the embeds of
+ * others: markup, fuzzing lengths and control characters typed there would
+ * be probing a third party's system without its leave.
+ */
+export function hostileForEmbed(text) {
+    if (/<\s*[a-z!/?]/i.test(text) || /javascript:/i.test(text))
+        return "it is markup";
+    if (text.length > MAX_EMBED_TEXT)
+        return `it is longer than ${MAX_EMBED_TEXT} characters`;
+    if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(text))
+        return "it holds control characters";
+    return null;
+}
+/** The refusal for a probe aimed at another site's frame. */
+export function embedProbeRefusal(what, origin) {
+    return (`REFUSED: ${what} inside a frame of ${origin}, another site embedded in the page. The tester is authorised to test the app, ` +
+        `not the embeds of others, so hostile input, repeated-click probes and file uploads are never sent into one, in any mode. ` +
+        `Ordinary clicks and typing there are allowed; the embed's writes out of the app are refused by the write policy.`);
+}
 /**
  * The sandbox given to every document a frame of another origin loads, outside
  * destructive mode: scripts, forms and its own origin keep working, and no