@ai-digital-factory/lmt-cli 0.1.6 → 1.0.0

package/dist/chunk-AQIOT6YD.js

@@ -0,0 +1,2799 @@
+import {
+  BROWSER_CLIENT_KIND,
+  CONTROLLER_LOGIN_STEP,
+  CONTROLLER_SESSION,
+  CliProfileStore,
+  DEFAULT_CONFIG_PATH,
+  LocalConfigError,
+  SmsReadError,
+  readOperatorLoginCredentials,
+  reportSessionStatus,
+  resolveCliTarget,
+  resolveTargetOrigin
+} from "./chunk-4N3XUBM4.js";
+
+// src/web/index.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createRequire } from "node:module";
+import path4 from "node:path";
+
+// src/web/owners.ts
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat as lstat2, open, readFile, rename, unlink as unlink2 } from "node:fs/promises";
+import path2 from "node:path";
+
+// src/web/session.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmod, lstat, mkdir, unlink } from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { chromium as chromium2 } from "playwright";
+
+// ../../packages/crawler/src/full-content.ts
+async function captureFullContent(browserPage, options) {
+  const page = browserPage;
+  if (!page.evaluate) throw new Error("Full-content capture is unavailable.");
+  try {
+    await page.evaluate(() => {
+      const state = [];
+      window.__lmtCapture = state;
+      const scrolling = Array.from(document.querySelectorAll("body *")).filter((element) => {
+        const style = getComputedStyle(element);
+        if (!/(auto|scroll|hidden|clip)/.test(style.overflowY) || element.scrollHeight <= element.clientHeight) {
+          return false;
+        }
+        if (/(auto|scroll)/.test(style.overflowY)) return true;
+        return element.closest('.op-page[data-operator-page="true"]') !== null;
+      });
+      const expand = /* @__PURE__ */ new Set();
+      for (const element of scrolling) {
+        for (let parent = element; parent; parent = parent.parentElement) expand.add(parent);
+      }
+      for (const element of expand) {
+        state.push({ element, style: element.getAttribute("style"), x: element.scrollLeft, y: element.scrollTop });
+        element.style.setProperty("height", "auto", "important");
+        element.style.setProperty("max-height", "none", "important");
+        element.style.setProperty("overflow", "visible", "important");
+        element.style.setProperty("flex-shrink", "0", "important");
+        element.scrollTop = 0;
+      }
+    });
+    await page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))));
+    const complete = await page.evaluate(() => Array.from(document.querySelectorAll("body *")).every((element) => {
+      const style = getComputedStyle(element);
+      const assistiveText = element.getAttribute("data-lmt-capture") === "assistive-text" && style.position === "absolute" && element.clientWidth <= 1 && element.clientHeight <= 1;
+      return assistiveText || style.display === "none" || element.clientHeight === 0 || !/(auto|scroll|hidden|clip)/.test(style.overflowY) || element.scrollHeight <= element.clientHeight + 1;
+    }));
+    if (!complete) throw new Error("Full-content capture could not expand all clipped content.");
+    return await page.screenshot({ ...options, fullPage: true });
+  } finally {
+    await page.evaluate(() => {
+      const owner = window;
+      for (const { element, style, x, y } of (owner.__lmtCapture ?? []).reverse()) {
+        if (style === null) element.removeAttribute("style");
+        else element.setAttribute("style", style);
+        element.scrollLeft = x;
+        element.scrollTop = y;
+      }
+      delete owner.__lmtCapture;
+    }).catch(() => void 0);
+  }
+}
+
+// ../../packages/crawler/src/controls.ts
+import { createHash, randomBytes } from "node:crypto";
+var ControlError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function sensitiveField(node) {
+  if (node.hasAttribute("data-lmt-sensitive")) return true;
+  if (node.getAttribute("data-lmt-readable") === "ordinary") return false;
+  const description = [
+    node.getAttribute("type"),
+    node.id,
+    node.getAttribute("name"),
+    node.getAttribute("aria-label"),
+    ...Array.from(node.labels ?? []).map((label) => label.textContent)
+  ].join(" ");
+  return /password|credential|secret|token|otp|one.time|username|user.?id|api.?key|pin/i.test(description);
+}
+function secretMetadata(value) {
+  return {
+    present: value.length > 0,
+    length: value.length,
+    fingerprint: value ? createHash("sha256").update(value).digest("hex").slice(0, 12) : null
+  };
+}
+function controlSignature(node) {
+  if (!node.isConnected) return null;
+  return JSON.stringify([
+    node.tagName,
+    node.getAttribute("type"),
+    node.getAttribute("name"),
+    node.getAttribute("aria-label"),
+    node.getAttribute("href"),
+    node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement ? "" : node.textContent
+  ]);
+}
+var PageControls = class {
+  constructor(page, origin) {
+    this.origin = origin;
+    this.page = page;
+  }
+  origin;
+  page;
+  references = /* @__PURE__ */ new Map();
+  secrets = /* @__PURE__ */ new Set();
+  prefix = randomBytes(8).toString("hex");
+  sequence = 0;
+  registerSecrets(...values) {
+    for (const value of values) if (value) this.secrets.add(value);
+  }
+  redact(value) {
+    let result = value;
+    for (const secret of [...this.secrets].sort((a, b) => b.length - a.length)) {
+      result = result.split(secret).join("[redacted]");
+      result = result.split(encodeURIComponent(secret)).join("[redacted]");
+    }
+    return result;
+  }
+  async learnSecrets() {
+    const fields = await this.page.$$("input, textarea, select, [data-lmt-sensitive]");
+    const values = [];
+    for (const field of fields) {
+      try {
+        if (await field.evaluate(sensitiveField)) values.push(await field.evaluate((node) => node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement ? node.value : node.textContent ?? ""));
+      } finally {
+        await field.dispose();
+      }
+    }
+    const textSecrets = await this.page.evaluate(() => Array.from((document.body?.innerText ?? "").matchAll(
+      /(?:access[\s_-]*token|request[\s_-]*token|api[\s_-]*(?:secret|key|token)|password|credential|otp)[\t ]*[:=][\t ]*([^\s,;]+)/gi
+    ), (match) => match[1]).filter(Boolean));
+    values.push(...textSecrets);
+    values.push(...await this.page.evaluate(() => window.__lmtPasteSecrets ?? []));
+    this.registerSecrets(...values);
+  }
+  async screenshotMasks() {
+    const stable = this.page.locator("[data-lmt-sensitive]");
+    await this.learnSecrets();
+    const fields = await this.page.$$("input, textarea, select");
+    for (const field of fields) {
+      try {
+        const value = await field.inputValue();
+        const sensitive = value.length > 0 && (await field.evaluate(sensitiveField) || [...this.secrets].some((secret) => value.includes(secret)));
+        await field.evaluate((node, mask) => node.toggleAttribute("data-lmt-field-mask", mask), sensitive);
+      } finally {
+        await field.dispose();
+      }
+    }
+    await this.page.evaluate((secrets) => {
+      document.querySelectorAll("[data-lmt-secret-mask]").forEach((element) => element.removeAttribute("data-lmt-secret-mask"));
+      if (!secrets.length) return;
+      for (const element of document.querySelectorAll("body *")) {
+        const directText = Array.from(element.childNodes).filter((node) => node.nodeType === Node.TEXT_NODE).map((node) => node.textContent).join("");
+        if (secrets.some((secret) => directText.includes(secret) || (element.textContent ?? "").includes(secret) && !Array.from(element.children).some((child) => (child.textContent ?? "").includes(secret)))) element.setAttribute("data-lmt-secret-mask", "");
+      }
+    }, [...this.secrets]);
+    return [stable, this.page.locator("[data-lmt-field-mask], [data-lmt-secret-mask]")];
+  }
+  async inspect() {
+    await this.learnSecrets();
+    for (const { element } of this.references.values()) await element.dispose().catch(() => void 0);
+    this.references.clear();
+    const controls = [];
+    const elements = await this.page.$$("button, a[href], input, select, textarea, [role=button], [contenteditable=true]");
+    for (const element of elements) {
+      if (controls.length >= 100 || !await element.isVisible()) {
+        await element.dispose();
+        continue;
+      }
+      const description = await element.evaluate((node) => {
+        const labels = Array.from(node.labels ?? []).map((label) => {
+          const copy = label.cloneNode(true);
+          copy.querySelectorAll("input,select,textarea,button").forEach((control) => control.remove());
+          return copy.textContent ?? "";
+        }).join(" ");
+        return {
+          kind: node.getAttribute("role") || node.tagName.toLowerCase(),
+          label: (node.getAttribute("aria-label") || node.getAttribute("title") || labels || node.getAttribute("placeholder") || (node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement ? "" : node.textContent) || "").replace(/\s+/g, " ").trim()
+        };
+      });
+      const reference = `${this.prefix}-${++this.sequence}`;
+      this.references.set(reference, { element, signature: await element.evaluate(controlSignature) });
+      controls.push({ reference, kind: description.kind, label: this.redact(description.label).slice(0, 160) });
+    }
+    return controls;
+  }
+  async resolve(reference) {
+    const saved = this.references.get(reference);
+    const element = saved?.element;
+    if (!element || !saved?.signature || await element.evaluate(controlSignature).catch(() => null) !== saved.signature) {
+      throw new ControlError("stale_reference", "The control reference is missing or stale. Inspect the page for current references.");
+    }
+    if (!await element.isVisible()) throw new ControlError("stale_reference", "The referenced control is no longer visible. Inspect the page again.");
+    return element;
+  }
+  async stopLoading() {
+    const session = await this.page.context().newCDPSession(this.page);
+    try {
+      await session.send("Page.stopLoading");
+    } finally {
+      await session.detach();
+    }
+  }
+  async act(command, timeoutMs, onSubmit = () => void 0) {
+    this.page.setDefaultTimeout(timeoutMs);
+    this.page.setDefaultNavigationTimeout(timeoutMs);
+    if (command.action === "read" || command.action === "check" || command.action === "clipboard-check" || command.action === "clipboard") {
+      await this.learnSecrets();
+      if (command.action === "check") this.registerSecrets(command.expected);
+      try {
+        const field = command.action === "clipboard" ? void 0 : await this.resolve(command.reference);
+        if (field && await field.getAttribute("data-lmt-value-state") === "concealed") {
+          throw new ControlError("value_unreadable", "This field contains a display placeholder. Reveal the value or read the clipboard after Copy.");
+        }
+        if (command.action === "clipboard-check" || command.action === "clipboard") await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+        if (command.action === "clipboard-check") {
+          const matches = await field.evaluate(async (node) => {
+            if (!(node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement)) throw new Error("Unreadable field");
+            return await navigator.clipboard.readText() === node.value;
+          });
+          return { matches };
+        }
+        const value = command.action === "clipboard" ? await this.page.evaluate(() => navigator.clipboard.readText()) : await field.evaluate((node) => {
+          if (!(node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement)) throw new Error("Unreadable field");
+          return node.value;
+        });
+        if (command.action === "check") {
+          this.registerSecrets(value);
+          return { matches: value === command.expected };
+        }
+        const sensitive = field && await field.evaluate(sensitiveField);
+        if (command.action === "clipboard") {
+          const fields = await this.page.$$("input,textarea,select");
+          let ordinary = false;
+          for (const candidate of fields) {
+            try {
+              if (!await candidate.evaluate(sensitiveField) && await candidate.inputValue() === value) ordinary = true;
+            } finally {
+              await candidate.dispose();
+            }
+          }
+          if (!ordinary) {
+            this.registerSecrets(value);
+            return { secret: secretMetadata(value) };
+          }
+        }
+        if (sensitive || [...this.secrets].some((secret) => value.includes(secret))) {
+          this.registerSecrets(value);
+          return { secret: secretMetadata(value) };
+        }
+        return { value };
+      } catch (error) {
+        if (error instanceof ControlError) throw error;
+        throw new ControlError("value_unreadable", "The field or clipboard could not be read. No comparison result is available.");
+      }
+    }
+    if (command.action === "paste") {
+      await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+      const field = await this.resolve(command.reference);
+      if (!await field.evaluate(sensitiveField)) throw new ControlError("protected_target_required", "Paste requires a protected input or textarea.");
+      const editable = await field.evaluate((node) => (node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement) && !node.readOnly && !node.disabled);
+      if (!editable) throw new ControlError("value_unreadable", "The paste target is not editable.");
+      try {
+        const result = await field.evaluate(async (node) => {
+          const input = node;
+          const value = await navigator.clipboard.readText();
+          const owner = window;
+          const protectedValues = owner.__lmtPasteSecrets ??= [];
+          if (value && !protectedValues.includes(value)) protectedValues.push(value);
+          const prototype = input instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+          Object.getOwnPropertyDescriptor(prototype, "value").set.call(input, value);
+          input.dispatchEvent(new Event("input", { bubbles: true }));
+          input.dispatchEvent(new Event("change", { bubbles: true }));
+          await new Promise((resolve) => requestAnimationFrame(() => resolve()));
+          if (!input.isConnected || input.value !== value) return null;
+          const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+          const fingerprint = value ? Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 12) : null;
+          return { present: value.length > 0, length: value.length, fingerprint };
+        });
+        if (!result) throw new ControlError("paste_not_retained", "The field did not retain the pasted value.");
+        await this.learnSecrets();
+        return { secret: result, matches: true };
+      } catch (error) {
+        if (error instanceof ControlError) throw error;
+        throw new ControlError("value_unreadable", "The clipboard could not be pasted into the protected field.");
+      }
+    }
+    if (command.action === "fill") {
+      const element = await this.resolve(command.reference);
+      const sensitive = await element.evaluate(sensitiveField);
+      if (command.secret || sensitive) this.registerSecrets(command.value);
+      await element.fill(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "select") {
+      await (await this.resolve(command.reference)).selectOption(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "click") {
+      await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+      const element = await this.resolve(command.reference);
+      const deadlineAt = Date.now() + timeoutMs;
+      await element.click({ trial: true, timeout: timeoutMs });
+      onSubmit();
+      try {
+        await element.click({ timeout: Math.max(1, deadlineAt - Date.now()) });
+      } catch {
+        throw new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.");
+      }
+      return;
+    }
+    if (command.action === "navigate") {
+      const target = new URL(command.url, this.origin);
+      if (target.origin !== new URL(this.origin).origin || target.username || target.password) {
+        throw new ControlError("invalid_target", "Navigation must use the session's configured Origin.");
+      }
+      await this.page.goto(target.href, { timeout: timeoutMs, waitUntil: "domcontentloaded" });
+      return;
+    }
+    if (command.action === "scroll") {
+      if (!Number.isFinite(command.x) || !Number.isFinite(command.y)) throw new ControlError("invalid_invocation", "Scroll offsets must be finite pixel values.");
+      const element = command.reference ? await this.resolve(command.reference) : void 0;
+      const scroll = await this.page.evaluate(({ element: node, offsets }) => {
+        const scrollable = (item) => {
+          const style = getComputedStyle(item);
+          return /(auto|scroll)/.test(style.overflow + style.overflowY + style.overflowX) && (item.scrollHeight > item.clientHeight || item.scrollWidth > item.clientWidth);
+        };
+        const containers = [];
+        if (node) {
+          for (let parent = node.parentElement; parent; parent = parent.parentElement) if (scrollable(parent)) containers.push(parent);
+          if (document.scrollingElement && !containers.includes(document.scrollingElement)) containers.push(document.scrollingElement);
+        } else {
+          const candidates = Array.from(document.querySelectorAll("body *")).filter(scrollable);
+          const root = document.scrollingElement;
+          if (root && !/(hidden|clip)/.test(getComputedStyle(root).overflowY) && (root.scrollHeight > root.clientHeight || root.scrollWidth > root.clientWidth)) candidates.push(root);
+          candidates.sort((a, b) => b.clientWidth * b.clientHeight - a.clientWidth * a.clientHeight);
+          containers.push(candidates[0] ?? document.scrollingElement);
+        }
+        const positions = () => containers.map((item) => ({ x: item.scrollLeft, y: item.scrollTop }));
+        const before = positions();
+        if (node) node.scrollIntoView({ block: "nearest", inline: "nearest", behavior: "instant" });
+        else containers[0].scrollBy({ left: offsets.x, top: offsets.y, behavior: "instant" });
+        const after = positions();
+        const moved = before.some((position, i) => position.x !== after[i].x || position.y !== after[i].y);
+        if (node) {
+          const rect = node.getBoundingClientRect();
+          let left = Math.max(0, rect.left), right = Math.min(innerWidth, rect.right);
+          let top = Math.max(0, rect.top), bottom = Math.min(innerHeight, rect.bottom);
+          for (let parent = node.parentElement; parent; parent = parent.parentElement) {
+            const style = getComputedStyle(parent), clip = parent.getBoundingClientRect();
+            if (/(auto|scroll|hidden|clip)/.test(style.overflowX)) {
+              left = Math.max(left, clip.left);
+              right = Math.min(right, clip.right);
+            }
+            if (/(auto|scroll|hidden|clip)/.test(style.overflowY)) {
+              top = Math.max(top, clip.top);
+              bottom = Math.min(bottom, clip.bottom);
+            }
+          }
+          if (right <= left || bottom <= top) return null;
+        }
+        return { outcome: moved ? "moved" : node ? "already_visible" : "at_boundary", before, after };
+      }, { element: element ?? null, offsets: command });
+      await this.page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))));
+      if (!scroll) throw new ControlError("target_unreachable", "The referenced control remains outside the visible scroll area.");
+      return { scroll };
+    }
+  }
+};
+
+// ../../packages/crawler/src/index.ts
+import {
+  chromium
+} from "playwright";
+var DEFAULT_BASE_URL = "http://127.0.0.1:5173";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 6e4;
+var OPERATOR_PAGE_SELECTOR = '[data-operator-page="true"]';
+var MARKET_WATCH_SELECTOR = '[data-market-watch="true"]';
+var OPERATOR_LOGIN_GATE_SELECTOR = '[data-operator-login-gate="true"]';
+var OPERATOR_LOGIN_USERNAME_SELECTOR = "[data-operator-login-username]";
+var OPERATOR_LOGIN_PASSWORD_SELECTOR = "[data-operator-login-password]";
+var OPERATOR_LOGIN_CONFIRM_SELECTOR = "[data-operator-login-confirm]";
+var CREDENTIALS_STATUS_SELECTOR = "[data-credentials-status]";
+var ZERODHA_LOGIN_PAGE_SELECTOR = '[data-zerodha-login-page="true"]';
+var OPERATOR_LOGIN_ATTEMPT_SELECTOR = "[data-operator-login-attempt]";
+var OPERATOR_LOGIN_STATUS_ATTRIBUTE = "data-operator-login-status";
+var OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR = '[data-operator-login-message-kind="status"]';
+var OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR = '[data-operator-login-message-kind="error"]';
+var OPERATOR_LOGIN_MESSAGE_ATTRIBUTE = "data-operator-login-message";
+var OPERATOR_LOGIN_OTP_SELECTOR = "[data-operator-login-otp]";
+var OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR = "[data-operator-login-otp-submit]";
+var OPERATOR_LOGIN_CANCEL_SELECTOR = "[data-operator-login-cancel]";
+var AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-authenticated-operator-logout]";
+var UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-unauthenticated-operator-logout]";
+var SETTINGS_SELECTOR = "[data-zc-settings]";
+var OPERATOR_EGRESS_SELECTOR = "[data-operator-egress-value]";
+var PEEK_TIMEOUT_MS = 250;
+var MARKET_WATCH_LIVE_GRACE_MS = 3e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function isAttached(page, selector, attributeName) {
+  if (typeof page.waitForSelector === "function") {
+    try {
+      await page.waitForSelector(selector, { timeout: PEEK_TIMEOUT_MS });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  const value = await peekAttribute(page, selector, attributeName);
+  return value !== null;
+}
+async function peekAttribute(page, selector, name) {
+  try {
+    return await page.locator(selector).getAttribute(name, { timeout: PEEK_TIMEOUT_MS });
+  } catch {
+    return null;
+  }
+}
+function marketWatchRowSelector(sno) {
+  return `[data-market-watch-row="${sno}"]`;
+}
+var MARKET_WATCH_PANEL_SELECTOR = "[data-market-watch-panel]";
+var MARKET_WATCH_ADD_INSTRUMENT_SELECTOR = "[data-market-watch-add-instrument]";
+function marketWatchPanelSelector(sno) {
+  return `[data-market-watch-panel="${sno}"]`;
+}
+function marketWatchExchangeSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-exchange="${sno}"]`;
+}
+function marketWatchTradingSymbolSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-trading-symbol="${sno}"]`;
+}
+function marketWatchApplySelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-apply="${sno}"]`;
+}
+function marketWatchPanelCancelSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-panel-cancel="${sno}"]`;
+}
+function marketWatchDraftErrorSelector(scope, sno) {
+  return `${scope} [data-market-watch-draft-error="${sno}"]`;
+}
+function marketWatchSelectRowSelector(sno) {
+  return `[data-market-watch-row="${sno}"] .op-page-row-toggle`;
+}
+function marketWatchDetailSelector(sno) {
+  return `[data-market-watch-detail="${sno}"]`;
+}
+var MARKET_WATCH_CONFIRM_YES_SELECTOR = "[data-market-watch-confirm-yes]";
+function marketWatchCommittedSelector(sno) {
+  return `[data-market-watch-committed="${sno}"]`;
+}
+function marketWatchQuoteSelector(sno) {
+  return `[data-market-watch-quote="${sno}"]`;
+}
+function marketWatchQuoteFieldSelector(sno, field) {
+  return `${marketWatchQuoteSelector(sno)} [data-market-watch-quote-field="${field}"]`;
+}
+var QUOTE_FIELDS = {
+  ltp: "lastPrice",
+  open: "open",
+  high: "high",
+  low: "low",
+  close: "close",
+  volume: "volume",
+  "percentage-change": "percentageChange"
+};
+function toMarketWatchRowStatus(raw) {
+  switch (raw) {
+    case "Empty":
+      return "empty";
+    case "Validating":
+      return "validating";
+    case "Live":
+      return "live";
+    case "Error":
+      return "error";
+    case "Configured":
+      return "stopped";
+    case null:
+      throw new Error("Market Watch row did not expose a state");
+    default:
+      throw new Error(`Unknown Market Watch row state: ${raw}`);
+  }
+}
+var PlaywrightOperatorPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorInfo() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const root = this.page.locator(OPERATOR_PAGE_SELECTOR);
+    const userId = (await root.getAttribute("data-user-id"))?.trim() ?? "";
+    const userName = (await root.getAttribute("data-user-name"))?.trim() ?? "";
+    if (!userId) {
+      throw new Error("Operator Page did not expose a user id");
+    }
+    return {
+      userId,
+      userName: userName || userId
+    };
+  }
+  async getMarketWatchRowCount() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const raw = await this.page.locator(MARKET_WATCH_SELECTOR).getAttribute("data-market-watch-row-count", { timeout: this.timeoutMs });
+    const rowCount = Number(raw);
+    if (!Number.isInteger(rowCount) || rowCount < 1) {
+      throw new Error(`Market Watch exposed invalid row count: ${String(raw)}`);
+    }
+    return rowCount;
+  }
+  async getMarketWatchRowNumbers() {
+    const rowCount = await this.getMarketWatchRowCount();
+    return Array.from({ length: rowCount }, (_, index) => index + 1);
+  }
+  async getMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    const rowSelector = marketWatchRowSelector(sno);
+    const listed = await isAttached(this.page, rowSelector, "data-market-watch-row-state");
+    const editing = await this.panelTargets(sno);
+    const draftError = (await peekAttribute(
+      this.page,
+      marketWatchDraftErrorSelector(editing ? marketWatchPanelSelector(sno) : rowSelector, sno),
+      "data-market-watch-draft-error-message"
+    ))?.trim();
+    const draft = editing ? {
+      exchange: await this.page.locator(marketWatchExchangeSelector(sno)).inputValue(),
+      tradingSymbol: await this.page.locator(marketWatchTradingSymbolSelector(sno)).inputValue()
+    } : void 0;
+    if (!listed) {
+      return {
+        sno,
+        exchange: draft?.exchange ?? "NSE",
+        tradingSymbol: draft?.tradingSymbol ?? "",
+        status: draftError ? "error" : "empty",
+        ...draftError ? { draftError } : {},
+        failureMarked: Boolean(draftError)
+      };
+    }
+    const row = this.page.locator(rowSelector);
+    const committed = this.page.locator(marketWatchCommittedSelector(sno));
+    const committedAttribute = (name2) => committed.getAttribute(name2, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+    const match = (await committedAttribute("data-market-watch-match"))?.trim();
+    const token = (await committedAttribute("data-market-watch-token"))?.trim();
+    const name = (await committedAttribute("data-market-watch-name"))?.trim();
+    const segment = (await committedAttribute("data-market-watch-segment"))?.trim();
+    const quote = match && token ? await this.readMarketWatchQuote(sno, token) : void 0;
+    const separator = match?.indexOf(":") ?? -1;
+    return {
+      sno,
+      exchange: draft?.exchange ?? (separator > 0 ? match.slice(0, separator) : ""),
+      tradingSymbol: draft?.tradingSymbol ?? (separator > 0 ? match.slice(separator + 1) : ""),
+      status: toMarketWatchRowStatus(
+        await row.getAttribute("data-market-watch-row-state")
+      ),
+      ...draftError ? { draftError } : {},
+      failureMarked: await row.getAttribute("data-market-watch-row-failure") === "true",
+      ...quote ? { quote } : {},
+      ...match && token ? {
+        instrumentInfo: {
+          match,
+          token,
+          name: name ?? "",
+          segment: segment ?? ""
+        },
+        onTick: (listener) => {
+          const unsubscribe = this.subscribeLiveTicks(sno, token, listener);
+          this.registerCleanup(unsubscribe);
+          return unsubscribe;
+        }
+      } : {}
+    };
+  }
+  async setMarketWatchRow(sno, exchange, tradingSymbol) {
+    await this.waitForMarketWatch();
+    let slot = sno;
+    const listed = await isAttached(this.page, marketWatchRowSelector(sno), "data-market-watch-row-state");
+    if (listed) {
+      await this.removeMarketWatchRow(sno);
+    }
+    if (!await this.panelTargets(slot)) {
+      await this.page.locator(MARKET_WATCH_ADD_INSTRUMENT_SELECTOR).click();
+      const target = Number(await this.waitForPanel());
+      if (target !== slot) {
+        if (listed) {
+          slot = target;
+        } else {
+          await this.page.locator(marketWatchPanelCancelSelector(target)).click();
+          throw new Error(`Create Instrument targets slot ${target}, not ${sno}`);
+        }
+      }
+    }
+    await this.page.locator(marketWatchExchangeSelector(slot)).selectOption(exchange.trim().toUpperCase());
+    await this.page.locator(marketWatchTradingSymbolSelector(slot)).fill(tradingSymbol);
+  }
+  async applyMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    await this.page.locator(marketWatchApplySelector(sno)).click();
+    const rowState = () => peekAttribute(this.page, marketWatchRowSelector(sno), "data-market-watch-row-state");
+    const deadline = Date.now() + this.timeoutMs;
+    let configuredSince = null;
+    while (Date.now() < deadline) {
+      if (await isAttached(this.page, marketWatchDraftErrorSelector(marketWatchPanelSelector(sno), sno), "data-market-watch-draft-error-message")) {
+        return;
+      }
+      if (!await this.panelTargets(sno)) {
+        const state = await rowState();
+        if (state === "Live" || state === "Error") return;
+        if (state === "Configured") {
+          configuredSince ??= Date.now();
+          if (Date.now() - configuredSince >= MARKET_WATCH_LIVE_GRACE_MS) return;
+        } else {
+          configuredSince = null;
+        }
+      }
+      await sleep(50);
+    }
+    if (configuredSince !== null && !await this.panelTargets(sno) && await rowState() === "Configured") return;
+    throw new Error(`Timed out waiting for Market Watch row ${sno} state`);
+  }
+  async removeMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    await this.openRowDetails(sno);
+    await this.page.locator(`[data-market-watch-remove="${sno}"]`).click();
+    await this.page.locator(MARKET_WATCH_CONFIRM_YES_SELECTOR).click();
+    await this.waitForAttribute(
+      marketWatchRowSelector(sno),
+      "data-market-watch-row-state",
+      (state) => state === null,
+      `Market Watch row ${sno} to be removed`
+    );
+  }
+  /** @deprecated Operator UI no longer exposes Clear; removal deletes the row. */
+  async clearMarketWatchRow(sno) {
+    await this.removeMarketWatchRow(sno);
+  }
+  /** Market Watch drafts are loaded once the container exposes its row count. */
+  async waitForMarketWatch() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.waitForAttribute(
+      MARKET_WATCH_SELECTOR,
+      "data-market-watch-row-count",
+      (value) => Number(value) >= 1,
+      "Market Watch rows"
+    );
+  }
+  async panelTargets(sno) {
+    return await peekAttribute(this.page, MARKET_WATCH_PANEL_SELECTOR, "data-market-watch-panel") === String(sno);
+  }
+  async waitForPanel() {
+    let target = null;
+    await this.waitForAttribute(
+      MARKET_WATCH_PANEL_SELECTOR,
+      "data-market-watch-panel",
+      (value) => (target = value) !== null,
+      "the Market Watch instrument panel"
+    );
+    return target;
+  }
+  async openRowDetails(sno) {
+    if (!await isAttached(this.page, marketWatchDetailSelector(sno), "data-market-watch-detail")) {
+      await this.page.locator(marketWatchSelectRowSelector(sno)).click();
+    }
+  }
+  async refresh() {
+    await this.page.reload();
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.waitForSelector?.(MARKET_WATCH_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+  }
+  async waitForAttribute(selector, attribute, predicate, description) {
+    const element = this.page.locator(selector);
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const value = await element.getAttribute(attribute, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+      if (predicate(value)) {
+        return;
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async readMarketWatchQuote(sno, fallbackToken) {
+    const root = this.page.locator(marketWatchQuoteSelector(sno));
+    const receivedAt = await root.getAttribute("data-market-watch-quote-received-at", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    if (!receivedAt) return void 0;
+    const receivedOn = new Date(receivedAt);
+    if (Number.isNaN(receivedOn.getTime())) {
+      throw new Error(`Market Watch row ${sno} exposed an invalid quote timestamp`);
+    }
+    const exchangeTimestampRaw = await root.getAttribute("data-market-watch-quote-exchange-time", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+    if (exchangeTimestamp && Number.isNaN(exchangeTimestamp.getTime())) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid exchange tick timestamp`
+      );
+    }
+    const timestampStatusRaw = await root.getAttribute("data-market-watch-quote-timestamp-status", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCountRaw = await root.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const updateTypeRaw = await root.getAttribute("data-market-watch-quote-update-type", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCount = Number(missingTimestampCountRaw);
+    if (missingTimestampCountRaw !== null && (!Number.isInteger(missingTimestampCount) || missingTimestampCount < 0)) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid missing timestamp count`
+      );
+    }
+    return {
+      receivedAt: receivedOn,
+      token: (await root.getAttribute("data-market-watch-quote-token", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || fallbackToken,
+      mode: (await root.getAttribute("data-market-watch-quote-mode", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || "full",
+      ...updateTypeRaw === "liveTick" || updateTypeRaw === "quoteSnapshot" || updateTypeRaw === "reconnectSnapshot" ? { latestUpdateType: updateTypeRaw } : {},
+      ...exchangeTimestamp ? { exchangeTimestamp } : {},
+      ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+      ...missingTimestampCountRaw !== null ? { missingExchangeTimestampCount: missingTimestampCount } : {},
+      fields: await this.readQuoteFields(sno)
+    };
+  }
+  async readQuoteFields(sno) {
+    const fields = {};
+    for (const [domField, property] of Object.entries(QUOTE_FIELDS)) {
+      const raw = await this.page.locator(marketWatchQuoteFieldSelector(sno, domField)).getAttribute("data-market-watch-quote-value", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null);
+      if (raw === null || raw.trim() === "") continue;
+      const value = Number(raw);
+      if (!Number.isFinite(value)) {
+        throw new Error(
+          `Market Watch row ${sno} exposed a non-numeric ${domField} quote value`
+        );
+      }
+      fields[property] = value;
+    }
+    return fields;
+  }
+  subscribeLiveTicks(sno, expectedToken, listener) {
+    let stopped = false;
+    let lastFingerprint = "";
+    const poll = async () => {
+      while (!stopped) {
+        const quoteRoot = this.page.locator(marketWatchQuoteSelector(sno));
+        const receivedOnRaw = await quoteRoot.getAttribute("data-market-watch-quote-received-at", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const token = await quoteRoot.getAttribute("data-market-watch-quote-token", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const mode = await quoteRoot.getAttribute("data-market-watch-quote-mode", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const exchangeTimestampRaw = await quoteRoot.getAttribute("data-market-watch-quote-exchange-time", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const timestampStatusRaw = await quoteRoot.getAttribute("data-market-watch-quote-timestamp-status", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const missingTimestampCountRaw = await quoteRoot.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const updateTypeRaw = await quoteRoot.getAttribute("data-market-watch-quote-update-type", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        if (receivedOnRaw && token === expectedToken) {
+          const actualMode = mode?.trim() || "";
+          const fingerprint = `${receivedOnRaw}|${token}|${actualMode}|${updateTypeRaw ?? ""}|${exchangeTimestampRaw ?? ""}|${timestampStatusRaw ?? ""}`;
+          if (fingerprint !== lastFingerprint) {
+            lastFingerprint = fingerprint;
+            const fields = await this.readQuoteFields(sno);
+            const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+            const missingExchangeTimestampCount = Number(
+              missingTimestampCountRaw
+            );
+            const tick = {
+              receivedOn: new Date(receivedOnRaw),
+              token,
+              mode: actualMode,
+              ...exchangeTimestamp && !Number.isNaN(exchangeTimestamp.getTime()) ? { exchangeTimestamp } : {},
+              ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+              ...Number.isInteger(missingExchangeTimestampCount) && missingExchangeTimestampCount >= 0 ? { missingExchangeTimestampCount } : {},
+              ...fields
+            };
+            if (tick.mode === "full" && updateTypeRaw === "liveTick" && timestampStatusRaw === "available" && tick.exchangeTimestamp && typeof tick.lastPrice === "number" && Number.isFinite(tick.lastPrice) && tick.lastPrice > 0) {
+              listener(tick);
+            }
+          }
+        }
+        await sleep(50);
+      }
+    };
+    void poll();
+    return () => {
+      stopped = true;
+    };
+  }
+  async clickLogoutZerodha(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator("[data-operator-info-toggle]").click();
+    onSubmit();
+    await this.page.locator(AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightZerodhaLoginPage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var LoginAttemptError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var PlaywrightZerodhaLoginPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorEgress() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (!await isAttached(
+      this.page,
+      OPERATOR_EGRESS_SELECTOR,
+      "data-operator-egress-value"
+    )) {
+      await this.page.locator(SETTINGS_SELECTOR).click();
+    }
+    await this.page.waitForSelector?.(OPERATOR_EGRESS_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const field = this.page.locator(OPERATOR_EGRESS_SELECTOR);
+    return {
+      publicIp: await field.inputValue(),
+      readOnly: await field.getAttribute("readonly") !== null
+    };
+  }
+  async peekLoginStatus() {
+    return peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      OPERATOR_LOGIN_STATUS_ATTRIBUTE
+    );
+  }
+  async peekLoginMessage() {
+    return await this.peekLoginStatusMessage() ?? await this.peekLoginErrorMessage();
+  }
+  async peekLoginStatusMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async peekLoginErrorMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async waitForLoginStatus(predicate, description) {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      const status = await this.peekLoginStatus();
+      if (predicate(status)) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (status === "failed" || status === null && message) {
+        throw new Error(message ?? "Zerodha Login Attempt failed.");
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async waitForLoginAttempt() {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(
+        this.page,
+        OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+        "data-operator-login-attempt"
+      )) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (message) {
+        throw new Error(message);
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha Login Attempt");
+  }
+  /** Start Zerodha Login Attempt for this Operator Session (always OTP path). */
+  async clickLoginWithZerodha() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (await isAttached(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      "data-operator-login-attempt"
+    )) {
+      return;
+    }
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    await this.waitForLoginAttempt();
+  }
+  async enterOtp(otp) {
+    await this.clickLoginWithZerodha();
+    await this.waitForLoginStatus(
+      (status) => status === "awaiting_otp",
+      "the Zerodha OTP Challenge"
+    );
+    await this.page.locator(OPERATOR_LOGIN_OTP_SELECTOR).fill(otp);
+  }
+  async submitOtp() {
+    const previousStatusMessage = await this.peekLoginStatusMessage();
+    await this.page.locator(OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR).click();
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(this.page, OPERATOR_PAGE_SELECTOR, "data-operator-page")) {
+        return {
+          status: "SUCCESS",
+          operatorPage: new PlaywrightOperatorPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      const status = await this.peekLoginStatus();
+      const errorMessage = await this.peekLoginErrorMessage();
+      if (errorMessage) {
+        return { status: "FAILED", message: errorMessage };
+      }
+      const statusMessage = await this.peekLoginStatusMessage();
+      if (status === "failed") {
+        return {
+          status: "FAILED",
+          message: statusMessage ?? "Zerodha Login Attempt failed."
+        };
+      }
+      if (statusMessage && statusMessage !== previousStatusMessage) {
+        return { status: "FAILED", message: statusMessage };
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP submission result");
+  }
+  async observeLoginState() {
+    if (!this.page.evaluate) throw new Error("Browser inspection is unavailable.");
+    return this.page.evaluate(() => {
+      const operatorPage = !!document.querySelector('[data-operator-page="true"]');
+      const transitioning = !!document.querySelector('[data-session-loading], [data-zerodha-restoration="pending"]');
+      const attempt = document.querySelector("[data-operator-login-attempt]");
+      const attemptId = attempt?.getAttribute("data-operator-login-attempt-id");
+      return { operatorPage, transitioning, attempt: !attempt || !attemptId ? null : {
+        attemptId,
+        status: attempt.getAttribute("data-operator-login-status") ?? "unavailable",
+        failedOtpAttempts: Number(attempt.getAttribute("data-operator-login-failed-otp-attempts") ?? 0),
+        submitting: attempt.getAttribute("data-operator-login-submitting-otp") === "true",
+        message: document.querySelector('[data-operator-login-message-kind="error"]')?.getAttribute("data-operator-login-message") ?? null
+      } };
+    });
+  }
+  async observeLoginAttempt() {
+    return (await this.observeLoginState()).attempt;
+  }
+  async startLoginAttempt(onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const existing = await this.observeLoginAttempt();
+    let observedId = existing?.attemptId;
+    if (!existing) {
+      await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, { timeout: this.timeoutMs });
+      onSubmit();
+      await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    }
+    while (Date.now() < deadline) {
+      const current = await this.observeLoginAttempt();
+      if (observedId && current?.attemptId !== observedId) throw new LoginAttemptError("attempt_replaced", "The Zerodha Login Attempt was replaced. Inspect the page before starting another attempt.");
+      observedId ??= current?.attemptId;
+      if (current?.status === "awaiting_otp") return current;
+      if (current && !["loading", "awaiting_otp", "succeeded", "failed"].includes(current.status)) throw new LoginAttemptError("attempt_unavailable", "The Zerodha Login Attempt is expired or unavailable. No replacement was started.");
+      if (current?.status === "failed") throw new LoginAttemptError("attempt_failed", "The Zerodha Login Attempt failed. Inspect the visible error before starting another attempt.");
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP Challenge.");
+  }
+  /** Cancels the visible Zerodha Login Attempt through its Cancel login control; a page without one is left unchanged. */
+  async cancelLoginAttempt(onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const existing = await this.observeLoginAttempt();
+    if (!existing) return;
+    if (!this.page.evaluate) throw new Error("Browser inspection is unavailable.");
+    const selector = `${OPERATOR_LOGIN_ATTEMPT_SELECTOR} ${OPERATOR_LOGIN_CANCEL_SELECTOR}`;
+    const cancellable = await this.page.evaluate(() => {
+      const button = document.querySelector("[data-operator-login-attempt] [data-operator-login-cancel]");
+      return !!button && !button.disabled;
+    });
+    if (!cancellable) {
+      throw new LoginAttemptError("attempt_not_cancellable", "The Zerodha Login Attempt has no Cancel login control in its current state. Inspect the page.");
+    }
+    onSubmit();
+    await this.page.locator(selector).click();
+    while (Date.now() < deadline) {
+      const current = await this.observeLoginAttempt();
+      if (current?.attemptId !== existing.attemptId) return;
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha Login Attempt to be cancelled.");
+  }
+  async submitActiveOtp(attemptId, otp, onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const assertActive = async () => {
+      if (Date.now() >= deadline) throw new Error("OTP submission exceeded its deadline before submission.");
+      const current = await this.observeLoginAttempt();
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is unavailable. Inspect the page; no login was started.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The requested OTP Challenge has been replaced. No OTP was submitted.");
+      if (current.status !== "awaiting_otp" || current.submitting) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is expired, failed, or not accepting an OTP.");
+      return current;
+    };
+    const before = await assertActive();
+    const attemptSelector = `[data-operator-login-attempt-id=${JSON.stringify(attemptId)}]`;
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SELECTOR}`).fill(otp);
+    await assertActive();
+    onSubmit();
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR}`).click();
+    while (Date.now() < deadline) {
+      const state = await this.observeLoginState();
+      if (state.operatorPage) {
+        return { status: "SUCCESS", operatorPage: new PlaywrightOperatorPage(this.page, this.timeoutMs) };
+      }
+      const current = state.attempt;
+      if (state.transitioning || current?.status === "succeeded") {
+        await sleep(50);
+        continue;
+      }
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The OTP Challenge disappeared after submission. Inspect the page before taking another action.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The OTP Challenge was replaced after submission. No retry was performed.");
+      if (current.status === "failed") return { status: "FAILED", message: current.message ?? "Zerodha Login Attempt failed." };
+      if (!current.submitting && current.failedOtpAttempts > before.failedOtpAttempts) return { status: "FAILED", message: current.message ?? "OTP rejected." };
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the OTP submission result. No retry was performed.");
+  }
+  async clickLogoutAccount(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    onSubmit();
+    await this.page.locator(UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var PlaywrightHomePage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async enterUsername(username) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_USERNAME_SELECTOR).fill(username);
+  }
+  async enterPassword(password) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_PASSWORD_SELECTOR).fill(password);
+  }
+  async clickConfirm() {
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const credentialsStatus = await peekAttribute(
+        this.page,
+        CREDENTIALS_STATUS_SELECTOR,
+        "data-credentials-status"
+      );
+      if (credentialsStatus === "INCORRECT_CREDENTIALS") {
+        return { status: "INCORRECT_CREDENTIALS" };
+      }
+      if (await isAttached(
+        this.page,
+        ZERODHA_LOGIN_PAGE_SELECTOR,
+        "data-zerodha-login-page"
+      )) {
+        return {
+          status: "SUCCESS",
+          zerodhaLoginPage: new PlaywrightZerodhaLoginPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      await sleep(50);
+    }
+    throw new Error(
+      "Timed out waiting for the Zerodha Login Page after Operator Login confirm"
+    );
+  }
+};
+var PlaywrightCrawler = class {
+  constructor(browser, page, baseUrl, timeoutMs, interactiveLoginTimeoutMs, headless) {
+    this.browser = browser;
+    this.page = page;
+    this.baseUrl = baseUrl;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+  }
+  browser;
+  page;
+  baseUrl;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  cleanups = /* @__PURE__ */ new Set();
+  pageControls;
+  async openHomePage() {
+    await this.page.goto(this.baseUrl);
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      (cleanup) => this.cleanups.add(cleanup)
+    );
+  }
+  controls() {
+    return this.pageControls ??= new PageControls(this.page, this.baseUrl);
+  }
+  getPage() {
+    return this.page;
+  }
+  async close() {
+    for (const cleanup of this.cleanups) {
+      cleanup();
+    }
+    this.cleanups.clear();
+    await this.browser.close();
+  }
+  async forceClose() {
+    if (this.browser.forceClose) {
+      await this.browser.forceClose();
+      return;
+    }
+    await this.browser.close();
+  }
+};
+async function createCrawler(options = {}) {
+  const headless = options.headless ?? true;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const launchTimeoutMs = options.launchTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const interactiveLoginTimeoutMs = options.interactiveLoginTimeoutMs ?? DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS;
+  const browser = await (options.launch ?? (() => chromium.launch({ headless, timeout: launchTimeoutMs })))();
+  const page = await browser.newPage(options.contextOptions);
+  page.setDefaultTimeout?.(timeoutMs);
+  page.setDefaultNavigationTimeout?.(timeoutMs);
+  return new PlaywrightCrawler(
+    browser,
+    page,
+    options.baseUrl ?? DEFAULT_BASE_URL,
+    timeoutMs,
+    interactiveLoginTimeoutMs,
+    headless
+  );
+}
+
+// src/web/protocol.ts
+var RESULT_VERSION = 1;
+function failureResult(action, code, message, sessionId = null) {
+  return {
+    version: RESULT_VERSION,
+    sessionId,
+    action,
+    outcome: "failure",
+    authentication: { status: "unknown" },
+    url: null,
+    visibleState: null,
+    device: null,
+    screenshot: { outcome: "unavailable", reason: "No browser page was available." },
+    error: { code, message }
+  };
+}
+
+// src/web/actions.ts
+var InvocationError = class extends Error {
+  constructor(message, code = "invalid_invocation", action) {
+    super(message);
+    this.code = code;
+    this.action = action;
+  }
+  code;
+  action;
+};
+function required(input, option) {
+  const value = input.values.get(option);
+  if (value === void 0 || option !== "--value" && !value) throw new InvocationError(`${option} is required for this action.`);
+  return value;
+}
+var ACTIONS = {
+  start: { control: false, flags: ["--headed", "--fresh"], values: ["--env", "--device"], build: () => ({ action: "start" }) },
+  inspect: { control: false, flags: [], values: [], build: () => ({ action: "inspect" }) },
+  close: { control: false, flags: [], values: [], build: () => ({ action: "close" }) },
+  stop: { control: false, flags: [], values: [], build: () => ({ action: "stop" }) },
+  "operator-login": { control: false, flags: [], values: [], build: () => ({ action: "operator-login" }) },
+  "operator-logout": { control: false, flags: [], values: [], build: () => ({ action: "operator-logout" }) },
+  "zerodha-login": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-login" }) },
+  "zerodha-cancel": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-cancel" }) },
+  "zerodha-logout": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-logout" }) },
+  "zerodha-otp": {
+    control: false,
+    flags: ["--stdin"],
+    values: ["--attempt"],
+    build: async (input) => {
+      const attemptId = required(input, "--attempt");
+      if (!input.flags.has("--stdin")) throw new InvocationError("zerodha-otp requires --attempt ID and --stdin.");
+      return { action: "zerodha-otp", attemptId, otp: await input.readOtp() };
+    }
+  },
+  read: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "read", reference: required(input, "--ref") }) },
+  clipboard: { control: true, flags: [], values: [], build: () => ({ action: "clipboard" }) },
+  paste: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "paste", reference: required(input, "--ref") }) },
+  check: { control: true, flags: ["--stdin"], values: ["--ref"], build: async (input) => {
+    if (!input.flags.has("--stdin")) throw new InvocationError("check requires --stdin.");
+    return { action: "check", reference: required(input, "--ref"), expected: await input.readInput() };
+  } },
+  "clipboard-check": { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "clipboard-check", reference: required(input, "--ref") }) },
+  click: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "click", reference: required(input, "--ref") }) },
+  fill: {
+    control: true,
+    flags: ["--secret"],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "fill", reference: required(input, "--ref"), value: required(input, "--value"), secret: input.flags.has("--secret") })
+  },
+  select: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "select", reference: required(input, "--ref"), value: required(input, "--value") })
+  },
+  scroll: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--x", "--y"],
+    build: (input) => ({ action: "scroll", reference: input.values.get("--ref"), x: Number(input.values.get("--x") ?? 0), y: Number(input.values.get("--y") ?? 0) })
+  },
+  navigate: { control: true, flags: [], values: ["--url"], build: (input) => ({ action: "navigate", url: required(input, "--url") }) }
+};
+function isAction(value) {
+  return typeof value === "string" && Object.hasOwn(ACTIONS, value);
+}
+function isControlAction(action) {
+  return ACTIONS[action.action].control;
+}
+
+// src/web/operator.ts
+var OperatorActionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+async function operatorLogin(input) {
+  const deadlineAt = Date.now() + input.timeoutMs;
+  const remaining = () => {
+    const timeout = deadlineAt - Date.now();
+    if (timeout < 1) throw new Error("Operator login exceeded its deadline before submission.");
+    return timeout;
+  };
+  let target;
+  try {
+    target = resolveCliTarget({ LMT_ENV: input.environment });
+    if (target.origin !== input.origin) throw new Error("The configured Web URL changed. Start a new browser session.");
+  } catch {
+    throw new OperatorActionError("invalid_sms_configuration", "Check smsEndpoint, Gate scope, and OPERATOR_1 in the selected Web configuration, then start a fresh session.");
+  }
+  let credential;
+  try {
+    credential = await new CliProfileStore().getSmsCredential();
+  } catch {
+    throw new OperatorActionError("sms_credential_unavailable", "Could not read protected SMS storage. Provision the SMS read credential again.");
+  }
+  if (!credential) throw new OperatorActionError("sms_credential_missing", "Provision the SMS read credential with `lmt credential provision` before Operator login.");
+  input.registerSecrets(credential);
+  let credentials;
+  try {
+    credentials = await readOperatorLoginCredentials({
+      operatorId: target.operatorId,
+      gateScope: target.gateScope,
+      smsEndpoint: target.smsEndpoint,
+      smsCredential: credential,
+      timeoutMs: remaining(),
+      ...process.env.LMT_WEB_SMS_COMMAND ? { command: process.env.LMT_WEB_SMS_COMMAND } : {}
+    });
+  } catch (error) {
+    throw new OperatorActionError(error instanceof SmsReadError ? error.code : "sms_unavailable", "Could not load Operator credentials from the selected Gate SMS scope. Check provisioning and SMS reachability.");
+  }
+  input.registerSecrets(credentials.username, credentials.password);
+  const home = new PlaywrightHomePage(input.page, remaining());
+  await home.enterUsername(credentials.username);
+  await home.enterPassword(credentials.password);
+  remaining();
+  input.onSubmit?.();
+  const result = await home.clickConfirm();
+  if (result.status !== "SUCCESS") throw new OperatorActionError("incorrect_credentials", "The Home Page rejected the configured Operator credentials. Check the selected Gate Operator Directory.");
+}
+async function operatorLogout(page, timeoutMs, onSubmit = () => void 0) {
+  const isOperatorPage = await page.evaluate?.(() => !!document.querySelector('[data-operator-page="true"]'));
+  if (isOperatorPage) {
+    await new PlaywrightOperatorPage(page, timeoutMs).clickLogoutZerodha(onSubmit);
+  }
+  await new PlaywrightZerodhaLoginPage(page, timeoutMs).clickLogoutAccount(onSubmit);
+}
+
+// src/web/session.ts
+var SESSION_DIRECTORY = path.join(os.tmpdir(), `lmt-web-${process.getuid?.() ?? "user"}`);
+var SESSION_ID_PATTERN = /^[a-f0-9]{32}$/;
+var OWNER_RESPONSE_GRACE_MS = 1e3;
+var OWNER_CLEANUP_GRACE_MS = 2e3;
+var IPHONE_13_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1";
+function createSessionId() {
+  return randomBytes2(16).toString("hex");
+}
+function isSessionId(value) {
+  return !!value && SESSION_ID_PATTERN.test(value);
+}
+async function ensureSessionDirectory() {
+  if (process.platform === "win32") {
+    throw new Error("lmt web session sockets are supported on macOS and Linux.");
+  }
+  await mkdir(SESSION_DIRECTORY, { recursive: true, mode: 448 });
+  await chmod(SESSION_DIRECTORY, 448);
+  const directory = await lstat(SESSION_DIRECTORY);
+  const uid = process.getuid?.();
+  if (!directory.isDirectory() || uid !== void 0 && directory.uid !== uid) {
+    throw new Error("The lmt web session directory is not owned by the invoking user.");
+  }
+}
+function socketPathFor(sessionId) {
+  return path.join(SESSION_DIRECTORY, `${sessionId}.sock`);
+}
+function artifactsDirectory(sessionId) {
+  return path.join(SESSION_DIRECTORY, "artifacts", sessionId);
+}
+function sanitizeUrls(value) {
+  return value.replace(/https?:\/\/[^\s)'"<>]+/gi, (candidate) => safeUrl(candidate) ?? "[url]");
+}
+function safeUrl(value) {
+  try {
+    const url = new URL(value);
+    if (!/^https?:$/.test(url.protocol) || url.origin === "null") return null;
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return null;
+  }
+}
+function failureCode(error) {
+  if (error instanceof ControlError) return error.code;
+  const message = error instanceof Error ? error.message : "";
+  if (/timed out|timeout|deadline/i.test(message)) return "deadline_exceeded";
+  if (/executable doesn't exist|browser.*not.*installed|could not find.*browser/i.test(message)) {
+    return "browser_unavailable";
+  }
+  if (/net::ERR_(?:CONNECTION_REFUSED|CONNECTION_TIMED_OUT|NAME_NOT_RESOLVED|ADDRESS_UNREACHABLE|INTERNET_DISCONNECTED|EMPTY_RESPONSE)/i.test(message)) {
+    return "service_unavailable";
+  }
+  return "action_failed";
+}
+function messageFor(error) {
+  const message = error instanceof Error ? error.message : "The browser action failed.";
+  return sanitizeUrls(message).slice(0, 500);
+}
+function deviceContext(mode) {
+  if (mode === "mobile") {
+    return {
+      name: "iPhone 13",
+      contextOptions: {
+        viewport: { width: 390, height: 844 },
+        deviceScaleFactor: 3,
+        isMobile: true,
+        hasTouch: true,
+        userAgent: IPHONE_13_USER_AGENT
+      }
+    };
+  }
+  return {
+    name: "Desktop",
+    contextOptions: {
+      viewport: { width: 1440, height: 900 },
+      deviceScaleFactor: 1,
+      isMobile: false,
+      hasTouch: false
+    }
+  };
+}
+async function launchSessionBrowser(headless, deadlineAt, onServerReady, onBrowserClosed) {
+  const browserServer = await chromium2.launchServer({
+    headless,
+    timeout: Math.max(1, deadlineAt - Date.now())
+  });
+  let forceClosePromise;
+  const forceClose = () => {
+    forceClosePromise ??= browserServer.kill();
+    return forceClosePromise;
+  };
+  onServerReady(forceClose);
+  try {
+    const connectTimeoutMs = Math.max(1, deadlineAt - Date.now());
+    if (deadlineAt <= Date.now()) throw new Error("The browser action exceeded its deadline.");
+    const browser = await chromium2.connect(browserServer.wsEndpoint(), { timeout: connectTimeoutMs });
+    browser.once("disconnected", onBrowserClosed);
+    let closePromise;
+    return {
+      newPage: async (options) => {
+        const page = await browser.newPage(options);
+        page.once("close", onBrowserClosed);
+        return page;
+      },
+      close: () => {
+        closePromise ??= (async () => {
+          let closeError;
+          try {
+            await browser.close();
+          } catch (error) {
+            closeError = error;
+          }
+          try {
+            await browserServer.close();
+          } catch (error) {
+            closeError ??= error;
+          }
+          if (closeError) throw closeError;
+        })();
+        return closePromise;
+      },
+      forceClose
+    };
+  } catch (error) {
+    await forceClose().catch(() => void 0);
+    throw error;
+  }
+}
+var pendingDataRequests = /* @__PURE__ */ new WeakMap();
+var DATA_REQUEST_WAIT_MS = 1e4;
+function trackDataRequests(page, context) {
+  const started = /* @__PURE__ */ new Map();
+  context.on("request", (request) => {
+    if (request.resourceType() === "fetch" || request.resourceType() === "xhr") started.set(request, Date.now());
+  });
+  const done = (request) => {
+    started.delete(request);
+  };
+  context.on("requestfinished", done);
+  context.on("requestfailed", done);
+  pendingDataRequests.set(page, () => {
+    let count = 0;
+    for (const [request, at] of started) {
+      if (Date.now() - at < DATA_REQUEST_WAIT_MS) count++;
+      else started.delete(request);
+    }
+    return count;
+  });
+}
+async function waitForRenderedPage(page) {
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  const pending = pendingDataRequests.get(page) ?? (() => 0);
+  let settled = false;
+  while (true) {
+    const ready = await page.evaluate(() => {
+      const visible = (element) => {
+        const rect = element.getBoundingClientRect();
+        const style = getComputedStyle(element);
+        return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+      };
+      const loading = Array.from(document.querySelectorAll('[data-session-loading], [aria-busy="true"]')).some(visible);
+      const animating = document.getAnimations().some(
+        (animation) => (animation.pending || animation.playState === "running") && Number.isFinite(Number(animation.effect?.getComputedTiming().endTime))
+      );
+      const imagesPending = Array.from(document.images).some((image) => visible(image) && !image.complete);
+      const hasContent = !!document.body?.innerText.trim() || Array.from(
+        document.querySelectorAll('button, a[href], input:not([type="hidden"]), select, textarea, canvas, svg, img, video, iframe')
+      ).some(visible);
+      return document.readyState === "complete" && document.fonts.status === "loaded" && hasContent && !loading && !animating && !imagesPending;
+    });
+    const idle = ready && pending() === 0;
+    if (idle && settled) return;
+    settled = idle;
+    await wait(50);
+  }
+}
+async function inspectPage(page, mode, crawler) {
+  await waitForRenderedPage(page);
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  const result = await page.evaluate(() => {
+    const visible = (element) => {
+      const rect = element.getBoundingClientRect();
+      const style = getComputedStyle(element);
+      return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+    };
+    const hasVisible = (selector) => Array.from(document.querySelectorAll(selector)).some(visible);
+    const operatorLogin2 = hasVisible('[data-operator-login-gate="true"]');
+    const zerodhaLogin = hasVisible('[data-zerodha-login-page="true"]');
+    const operatorPage = hasVisible('[data-operator-page="true"]');
+    const restoring = hasVisible('[data-zerodha-restoration="pending"]');
+    let authentication = { status: "unknown" };
+    if (Number(operatorLogin2) + Number(zerodhaLogin) + Number(operatorPage) + Number(restoring) === 1 && !hasVisible('[data-session-loading], [aria-busy="true"]')) {
+      if (operatorLogin2) authentication = { status: "operator_login_required", nextAction: "operator-login" };
+      if (operatorPage) authentication = { status: "authenticated" };
+      if (restoring) authentication = { status: "zerodha_session_restoring" };
+      if (zerodhaLogin) {
+        authentication = { status: "zerodha_login_required" };
+        const attempt = document.querySelector('[data-zerodha-login-page="true"] [data-operator-login-attempt]');
+        if (!attempt) authentication = { status: "zerodha_login_required", nextAction: "zerodha-login" };
+        else if (visible(attempt) && attempt.getAttribute("data-operator-login-status") === "awaiting_otp" && attempt.getAttribute("data-operator-login-submitting-otp") !== "true") {
+          const attemptId = attempt.getAttribute("data-operator-login-attempt-id");
+          if (attemptId) authentication = { status: "zerodha_login_required", nextAction: "zerodha-otp", attemptId };
+        }
+      }
+    }
+    const controls2 = Array.from(
+      document.querySelectorAll("button, a[href], input, select, textarea, [role=button]")
+    ).filter(visible).slice(0, 100).map((element, index) => {
+      const labels = element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement ? Array.from(element.labels ?? []).map((item) => item.innerText).join(" ") : "";
+      const label = element.getAttribute("aria-label") || element.getAttribute("title") || labels || (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement ? element.placeholder : "") || (element instanceof HTMLSelectElement ? element.selectedOptions[0]?.innerText : "") || element.textContent || "";
+      const kind = element.getAttribute("role") || element.tagName.toLowerCase();
+      return {
+        reference: `control-${index + 1}`,
+        kind,
+        label: label.replace(/\s+/g, " ").trim().slice(0, 160)
+      };
+    });
+    return {
+      authentication,
+      title: document.title,
+      text: document.body?.innerText ?? "",
+      controls: controls2,
+      viewport: { width: window.innerWidth, height: window.innerHeight },
+      deviceScaleFactor: window.devicePixelRatio,
+      hasTouch: navigator.maxTouchPoints > 0,
+      userAgent: navigator.userAgent
+    };
+  });
+  const controls = crawler ? await crawler.controls().inspect() : result.controls;
+  const redact = (value) => sanitizeUrls(crawler?.controls().redact(value) ?? value);
+  const viewport = page.viewportSize?.() ?? result.viewport;
+  return {
+    authentication: "attemptId" in result.authentication ? { ...result.authentication, attemptId: redact(result.authentication.attemptId) } : result.authentication,
+    url: safeUrl(redact(page.url())),
+    visibleState: {
+      title: redact(result.title).slice(0, 300),
+      text: redact(result.text).slice(0, 4e3),
+      controls: controls.map((control) => ({ ...control, label: redact(control.label) }))
+    },
+    device: {
+      name: deviceContext(mode).name,
+      mode,
+      viewport,
+      deviceScaleFactor: result.deviceScaleFactor,
+      hasTouch: result.hasTouch,
+      userAgent: sanitizeUrls(result.userAgent).slice(0, 300)
+    }
+  };
+}
+var ACCESS_TOKEN_SCREENSHOT_MASK = '[data-lmt-sensitive="zerodha-access-token"]';
+async function screenshotMaskOptions(page) {
+  const playwrightPage = page;
+  const locator = playwrightPage.locator(ACCESS_TOKEN_SCREENSHOT_MASK);
+  if (!await locator.count()) return {};
+  return { mask: [locator], maskColor: "#000000" };
+}
+async function captureScreenshot(page, sessionId, action, fullPage, timeoutMs, onTimeout, crawler) {
+  if (!page) return { outcome: "unavailable", reason: "No browser page was available." };
+  if (!page.screenshot) return { outcome: "failed", error: "The browser does not support screenshots." };
+  const directory = artifactsDirectory(sessionId);
+  const filename = `${Date.now()}-${action}-${randomBytes2(4).toString("hex")}.png`;
+  const screenshotPath = path.resolve(directory, filename);
+  if (timeoutMs < 1) {
+    return { outcome: "failed", error: "The action deadline elapsed before screenshot capture." };
+  }
+  try {
+    await mkdir(directory, { recursive: true, mode: 448 });
+    await chmod(directory, 448);
+    await withDeadline(
+      (async () => {
+        await waitForRenderedPage(page);
+        const maskOptions = crawler ? { mask: await crawler.controls().screenshotMasks(), maskColor: "#000000" } : await screenshotMaskOptions(page);
+        const options = {
+          path: screenshotPath,
+          fullPage,
+          animations: "disabled",
+          timeout: timeoutMs,
+          ...maskOptions
+        };
+        return fullPage ? captureFullContent(page, options) : page.screenshot(options);
+      })(),
+      timeoutMs,
+      onTimeout
+    );
+    await chmod(screenshotPath, 384);
+    return { outcome: "captured", path: screenshotPath, fullPage };
+  } catch (error) {
+    await unlink(screenshotPath).catch(() => void 0);
+    return { outcome: "failed", error: messageFor(error) };
+  }
+}
+function remainingMs(deadlineAt) {
+  return Math.max(0, deadlineAt - Date.now());
+}
+function withDeadline(promise, timeoutMs, onTimeout) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      callback();
+    };
+    const timeout = setTimeout(() => {
+      onTimeout?.();
+      finish(() => reject(new Error("The browser action exceeded its deadline.")));
+    }, Math.max(1, timeoutMs));
+    promise.then(
+      (value) => finish(() => resolve(value)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+var LOGIN_ACTIONS = /* @__PURE__ */ new Set(["operator-login", "operator-logout", "zerodha-login", "zerodha-otp", "zerodha-cancel", "zerodha-logout"]);
+var FRESH_SESSION_REQUIRED = "Browser login commands run only in a fresh session: use `lmt web start --fresh` to test the login screens, or `lmt` and `lmt logout` to log the Controller Session in or out.";
+async function runSessionOwner(options) {
+  await ensureSessionDirectory();
+  const socketPath = socketPathFor(options.sessionId);
+  const device = deviceContext(options.mode);
+  const controllerTarget = { environment: options.environment ?? "local", origin: options.origin, operatorId: "OPERATOR_1" };
+  const controllerStore = options.controller ? new CliProfileStore() : void 0;
+  let controllerCookies;
+  let checkpointQueue = Promise.resolve();
+  function checkpoint() {
+    if (!controllerStore || !controllerCookies || !page) return Promise.resolve();
+    const context = page.context?.();
+    if (!context) return Promise.resolve();
+    const save = async () => {
+      const cookies = await context.cookies(options.origin);
+      const value = (name) => {
+        const cookie = cookies.find((candidate) => candidate.name === name);
+        return cookie ? `${cookie.name}=${cookie.value}` : void 0;
+      };
+      const operatorSessionCookie = value("lmt_operator_session");
+      if (!operatorSessionCookie || operatorSessionCookie === controllerCookies.operatorSessionCookie) return;
+      const clientIdentityCookie = value("lmt_client_id") ?? controllerCookies.clientIdentityCookie;
+      const next = { operatorSessionCookie, ...clientIdentityCookie ? { clientIdentityCookie } : {} };
+      await controllerStore.saveSession(CONTROLLER_SESSION, controllerTarget, next);
+      controllerCookies = next;
+    };
+    checkpointQueue = checkpointQueue.then(save, save).catch(() => void 0);
+    return checkpointQueue;
+  }
+  let crawler;
+  let page;
+  let startupError;
+  let startComplete = false;
+  let closing = false;
+  let abortOnShutdown = false;
+  let operationQueue = Promise.resolve();
+  let shutdownPromise;
+  let initializationPromise;
+  let startupLease;
+  let crawlerClosePromise;
+  let expirationCleanup;
+  let forceClosePendingBrowser;
+  let pendingBrowserForceClosePromise;
+  const sockets = /* @__PURE__ */ new Set();
+  function closeCrawler() {
+    if (!crawler) return Promise.resolve();
+    crawlerClosePromise ??= crawler.close();
+    return crawlerClosePromise;
+  }
+  function forceCloseBrowser() {
+    if (crawler?.forceClose) return crawler.forceClose();
+    if (!forceClosePendingBrowser) return Promise.resolve();
+    pendingBrowserForceClosePromise ??= forceClosePendingBrowser();
+    return pendingBrowserForceClosePromise;
+  }
+  function expireSession() {
+    closing = true;
+    abortOnShutdown = true;
+    expirationCleanup ??= (async () => {
+      if (initializationPromise) {
+        await Promise.race([
+          initializationPromise,
+          wait(OWNER_CLEANUP_GRACE_MS)
+        ]).catch(() => void 0);
+      }
+      if (crawler) await closeCrawler();
+      else await forceCloseBrowser();
+    })();
+    void expirationCleanup.catch(() => void 0);
+  }
+  const server = net.createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    let payload = "";
+    let handled = false;
+    socket.on("data", (chunk) => {
+      if (handled) return;
+      payload += chunk.toString("utf8");
+      const newline = payload.indexOf("\n");
+      if (newline < 0) return;
+      handled = true;
+      const line = payload.slice(0, newline);
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        socket.end(`${JSON.stringify(failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId))}
+`);
+        return;
+      }
+      const run = async () => {
+        let response;
+        try {
+          response = await handleRequest(request);
+        } catch (error) {
+          response = failureResult(request.action, "action_failed", "The browser action could not complete safely. Inspect before retrying.", options.sessionId);
+        }
+        if (isAction(request.action) && isControlAction(request)) {
+          response.audit = { outcome: "unavailable" };
+          if (page?.evaluate && new URL(page.url()).origin === options.origin) {
+            try {
+              const recorded = await withDeadline(page.evaluate(async (event) => {
+                const response2 = await fetch("/api/journey-records", {
+                  method: "POST",
+                  headers: { "content-type": "application/json" },
+                  body: JSON.stringify({ records: [{
+                    eventType: "journey_step",
+                    eventValue: `Web CLI ${event.action}`,
+                    session: event.session,
+                    eventMeta: {
+                      step: `Web CLI ${event.action}`,
+                      outcome: event.outcome === "success" ? "success" : "failure",
+                      ...event.outcome === "success" ? {} : { error_code: event.outcome === "uncertain" ? "action_uncertain" : "browser_action_failed" },
+                      web_visit: event.session,
+                      journey_id: event.session,
+                      client_kind: "cli",
+                      client_profile: event.profile,
+                      action_outcome: event.outcome,
+                      screenshot_outcome: event.screenshot
+                    }
+                  }] }),
+                  signal: AbortSignal.timeout(500)
+                });
+                return response2.status === 202;
+              }, { action: request.action, session: options.sessionId, profile: `web-cli-${options.mode}`, outcome: response.outcome, screenshot: response.screenshot.outcome }), 750);
+              response.audit = { outcome: recorded ? "recorded" : "failed" };
+            } catch {
+              response.audit = { outcome: "failed" };
+            }
+          }
+        }
+        socket.end(`${JSON.stringify({ ...response, origin: options.origin })}
+`);
+        if (closing) socket.once("close", () => void shutdown());
+      };
+      operationQueue = operationQueue.then(run, run).catch(() => void 0);
+    });
+  });
+  async function initialize(deadlineAt) {
+    try {
+      crawler = await createCrawler({
+        baseUrl: options.origin,
+        headless: options.headless,
+        timeoutMs: Math.min(options.timeoutMs, Math.max(1, remainingMs(deadlineAt))),
+        contextOptions: device.contextOptions,
+        launch: () => {
+          const onServerReady = (forceClose) => {
+            forceClosePendingBrowser = forceClose;
+            if (abortOnShutdown) void forceCloseBrowser().catch(() => void 0);
+          };
+          return options.launch ? options.launch(deadlineAt, onServerReady) : launchSessionBrowser(options.headless, deadlineAt, onServerReady, () => {
+            if (closing) return;
+            closing = true;
+            abortOnShutdown = true;
+            void shutdown();
+          });
+        }
+      });
+      page = crawler.getPage();
+      const browserContext = page.context?.();
+      if (browserContext) trackDataRequests(page, browserContext);
+      if (browserContext?.route) await browserContext.route("**/*", async (route) => {
+        const request = route.request();
+        if (new URL(request.url()).origin !== options.origin) return route.continue();
+        await route.continue({ headers: { ...request.headers(), "x-lmt-client-kind": BROWSER_CLIENT_KIND, "x-lmt-client-profile": `web-cli-${options.mode}` } });
+      });
+      if (controllerStore) {
+        controllerCookies = await controllerStore.getSession(CONTROLLER_SESSION, controllerTarget);
+        if (!controllerCookies?.operatorSessionCookie) throw new Error("The Controller Session is not authenticated. Run `lmt` in a terminal to log in.");
+        await browserContext?.addCookies?.([controllerCookies.operatorSessionCookie, controllerCookies.clientIdentityCookie].filter((cookie) => !!cookie).map((cookie) => {
+          const separator = cookie.indexOf("=");
+          return { name: cookie.slice(0, separator), value: cookie.slice(separator + 1), url: options.origin, httpOnly: true, sameSite: "Lax" };
+        }));
+        browserContext?.on?.("requestfinished", (request) => {
+          if (new URL(request.url()).origin !== options.origin) return;
+          void request.response().then(async (response) => {
+            const headers = await response?.allHeaders();
+            if (headers?.["set-cookie"] && !closing) await checkpoint();
+          }).catch(() => void 0);
+        });
+      }
+      if (closing) {
+        await closeCrawler();
+        return;
+      }
+      await crawler.openHomePage();
+      await withDeadline(checkpoint(), remainingMs(deadlineAt), expireSession);
+    } catch (error) {
+      startupError = error;
+    }
+  }
+  async function handleRequest(request) {
+    if (!request || request.sessionId !== options.sessionId || !isAction(request.action) || !Number.isFinite(request.timeoutMs) || request.timeoutMs < 1 || !Number.isFinite(request.deadlineAt)) {
+      return failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId);
+    }
+    if (closing) return failureResult(request.action, "session_unavailable", "The browser owner is closing. Start a new session.", options.sessionId);
+    if (LOGIN_ACTIONS.has(request.action) && options.controller) {
+      return failureResult(request.action, "fresh_session_required", FRESH_SESSION_REQUIRED, options.sessionId);
+    }
+    const deadlineAt = request.deadlineAt;
+    if (remainingMs(deadlineAt) === 0) {
+      return failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", options.sessionId);
+    }
+    if (request.action === "start" && startComplete) {
+      return { ...await handleRequest({ ...request, action: "inspect" }), action: "start" };
+    }
+    if (request.action === "stop") {
+      await withDeadline(checkpoint(), Math.min(500, Math.max(1, remainingMs(deadlineAt)))).catch(() => void 0);
+      closing = true;
+      abortOnShutdown = true;
+      try {
+        crawlerClosePromise = forceCloseBrowser();
+        await withDeadline(crawlerClosePromise, remainingMs(deadlineAt), expireSession);
+        return {
+          version: RESULT_VERSION,
+          sessionId: options.sessionId,
+          action: "stop",
+          outcome: "success",
+          authentication: { status: "unknown" },
+          url: null,
+          visibleState: null,
+          device: null,
+          screenshot: { outcome: "unavailable", reason: "Stop terminates the browser without capturing a screenshot." }
+        };
+      } catch (error2) {
+        return failureResult("stop", failureCode(error2), messageFor(error2), options.sessionId);
+      }
+    }
+    if (!startComplete && request.action !== "start") {
+      return failureResult(request.action, "session_starting", "The browser session is not ready yet.", options.sessionId);
+    }
+    if (!startComplete) {
+      clearTimeout(startupLease);
+      initializationPromise ??= initialize(deadlineAt);
+      try {
+        await withDeadline(initializationPromise, remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        startupError = error2;
+      }
+    }
+    if (request.action === "start") {
+      startComplete = true;
+      let inspectionError;
+      const inspected2 = page && !startupError && remainingMs(deadlineAt) > 0 ? await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession).catch((error2) => {
+        inspectionError = error2;
+        return null;
+      }) : null;
+      const screenshot2 = startupError || inspectionError ? { outcome: "unavailable", reason: "The page did not finish loading and inspection." } : await captureScreenshot(
+        page,
+        options.sessionId,
+        "start",
+        false,
+        remainingMs(deadlineAt),
+        expireSession,
+        crawler
+      );
+      const actionError2 = startupError ?? inspectionError;
+      const result = {
+        version: RESULT_VERSION,
+        sessionId: options.sessionId,
+        action: "start",
+        outcome: actionError2 ? "failure" : "success",
+        authentication: inspected2?.authentication ?? { status: "unknown" },
+        url: inspected2?.url ?? (startupError ? safeUrl(options.origin) : page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+        visibleState: inspected2?.visibleState ?? null,
+        device: inspected2?.device ?? null,
+        screenshot: screenshot2,
+        ...startupError ? {
+          error: {
+            code: failureCode(startupError),
+            message: page ? failureCode(startupError) === "service_unavailable" ? "Could not load the configured Web URL. Confirm that the selected service is running and reachable." : failureCode(startupError) === "deadline_exceeded" ? "Opening the Home Page exceeded its deadline. Start a fresh session and retry." : messageFor(startupError) : failureCode(startupError) === "browser_unavailable" ? "Could not launch the browser. Install its Chromium runtime with `lmt web install-browser` and retry." : messageFor(startupError)
+          }
+        } : inspectionError ? {
+          error: {
+            code: failureCode(inspectionError),
+            message: "The Home Page loaded but its visible state could not be inspected."
+          }
+        } : {}
+      };
+      if (startupError) {
+        closing = true;
+      }
+      return result;
+    }
+    if (startupError || !crawler || !page) {
+      return failureResult(request.action, "session_unavailable", "The browser session is no longer available. Start a new session.", options.sessionId);
+    }
+    let guidedError;
+    let submitted = false;
+    const actionDeadlineAt = deadlineAt - Math.min(1500, Math.floor(remainingMs(deadlineAt) / 2));
+    const pendingActions = /* @__PURE__ */ new Set();
+    const runAction = (operation, timeoutMs) => {
+      pendingActions.add(operation);
+      operation.then(() => pendingActions.delete(operation), () => pendingActions.delete(operation));
+      return withDeadline(operation, timeoutMs);
+    };
+    const actionTimeout = () => Math.max(1, remainingMs(actionDeadlineAt));
+    page.setDefaultTimeout?.(actionTimeout());
+    page.setDefaultNavigationTimeout?.(actionTimeout());
+    let loginAttempt;
+    const onSubmit = () => {
+      submitted = true;
+    };
+    const zerodha = new PlaywrightZerodhaLoginPage(page, actionTimeout());
+    try {
+      if (request.action === "operator-login") await runAction(operatorLogin({ page, environment: options.environment ?? "local", origin: options.origin, timeoutMs: actionTimeout(), onSubmit, registerSecrets: (...values) => crawler.controls().registerSecrets(...values) }), actionTimeout());
+      if (request.action === "operator-logout") await runAction(operatorLogout(page, actionTimeout(), onSubmit), actionTimeout());
+      if (request.action === "zerodha-login") loginAttempt = await runAction(zerodha.startLoginAttempt(onSubmit), actionTimeout());
+      if (request.action === "zerodha-cancel") await runAction(zerodha.cancelLoginAttempt(onSubmit), actionTimeout());
+      if (request.action === "zerodha-otp") {
+        if (!request.attemptId || !request.otp || !/^\d{6}$/.test(request.otp)) throw new OperatorActionError("invalid_otp", "Supply a six-digit OTP and the attempt ID returned by zerodha-login.");
+        crawler.controls().registerSecrets(request.otp);
+        const result = await runAction(zerodha.submitActiveOtp(request.attemptId, request.otp, onSubmit), actionTimeout());
+        if (result.status !== "SUCCESS") throw new OperatorActionError("otp_rejected", result.message);
+      }
+      if (request.action === "zerodha-logout") await runAction(new PlaywrightOperatorPage(page, actionTimeout()).clickLogoutZerodha(onSubmit), actionTimeout());
+    } catch (error2) {
+      guidedError = error2;
+    }
+    let inspected = null;
+    let controlResult;
+    let actionError;
+    try {
+      if (isControlAction(request)) {
+        const budget = Math.max(1, remainingMs(deadlineAt) - Math.min(2e3, request.timeoutMs / 4));
+        controlResult = await runAction(crawler.controls().act(request, budget, () => {
+          submitted = true;
+        }), budget);
+      }
+    } catch (error2) {
+      actionError = request.action === "click" && submitted && failureCode(error2) === "deadline_exceeded" ? new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.") : error2;
+      if (request.action === "click" && failureCode(actionError) === "action_uncertain") {
+        await withDeadline(crawler.controls().stopLoading(), Math.min(500, remainingMs(deadlineAt))).catch(() => void 0);
+      }
+    }
+    if (pendingActions.size || failureCode(actionError ?? guidedError) === "deadline_exceeded") {
+      try {
+        await withDeadline((async () => {
+          await crawler.controls().stopLoading();
+          await Promise.allSettled([...pendingActions]);
+          await page.evaluate?.(() => document.readyState);
+        })(), Math.min(500, Math.max(1, remainingMs(deadlineAt))), expireSession);
+      } catch {
+        expireSession();
+        return { ...failureResult(request.action, submitted ? "action_uncertain" : "deadline_exceeded", "The browser could not safely recover from the action deadline. Start a new session; do not replay an uncertain action.", options.sessionId), outcome: submitted ? "uncertain" : "failure" };
+      }
+    }
+    if (controllerStore) await withDeadline(checkpoint(), Math.max(1, remainingMs(deadlineAt))).catch(() => void 0);
+    try {
+      inspected = await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession);
+    } catch (error2) {
+      actionError ??= error2;
+    }
+    const screenshot = await captureScreenshot(
+      page,
+      options.sessionId,
+      request.action,
+      request.fullPage === true,
+      remainingMs(deadlineAt),
+      expireSession,
+      crawler
+    );
+    let closeError;
+    if (request.action === "close") {
+      closing = true;
+      try {
+        await withDeadline(closeCrawler(), remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        closeError = error2;
+        if (!abortOnShutdown) {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      }
+    }
+    const error = guidedError ?? actionError ?? closeError;
+    return {
+      version: RESULT_VERSION,
+      sessionId: options.sessionId,
+      action: request.action,
+      outcome: error instanceof ControlError && error.code === "action_uncertain" ? "uncertain" : error ? submitted && !(error instanceof OperatorActionError) && !(error instanceof LoginAttemptError) ? "uncertain" : "failure" : "success",
+      authentication: inspected?.authentication ?? { status: "unknown" },
+      ...!actionError ? controlResult : {},
+      ...loginAttempt ? { loginAttempt: { attemptId: loginAttempt.attemptId, status: loginAttempt.status } } : {},
+      url: inspected?.url ?? (page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+      visibleState: inspected?.visibleState ?? null,
+      device: inspected?.device ?? null,
+      screenshot,
+      ...error ? { error: { code: error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.code : failureCode(error), message: crawler.controls().redact(error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.message : messageFor(error)) } } : {}
+    };
+  }
+  function shutdown() {
+    if (!closing) return Promise.resolve();
+    if (shutdownPromise) return shutdownPromise;
+    clearTimeout(startupLease);
+    shutdownPromise = (async () => {
+      for (const socket of sockets) socket.destroy();
+      await unlink(socketPath).catch(() => void 0);
+      server.close();
+      if (abortOnShutdown) {
+        const cleanup = crawler ? closeCrawler() : forceClosePendingBrowser ? forceCloseBrowser() : expirationCleanup ?? Promise.resolve();
+        let cleanupFinished = false;
+        let cleanupFailed = false;
+        const observedCleanup = cleanup.then(
+          () => {
+            cleanupFinished = true;
+          },
+          () => {
+            cleanupFinished = true;
+            cleanupFailed = true;
+          }
+        );
+        await Promise.race([observedCleanup, wait(OWNER_CLEANUP_GRACE_MS)]);
+        if (!cleanupFinished || cleanupFailed) {
+          await forceCloseBrowser().catch(() => void 0);
+        }
+        (options.exit ?? process.exit)(0);
+        return;
+      }
+      if (crawler) {
+        try {
+          await withDeadline(checkpoint(), OWNER_CLEANUP_GRACE_MS);
+          await closeCrawler();
+        } catch {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      } else if (forceClosePendingBrowser) {
+        await forceCloseBrowser().catch(() => void 0);
+      }
+      await withDeadline(checkpointQueue, OWNER_CLEANUP_GRACE_MS).catch(() => void 0);
+      process.removeListener("SIGTERM", onSignal);
+      process.removeListener("SIGINT", onSignal);
+    })();
+    return shutdownPromise;
+  }
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.removeListener("error", reject);
+      void chmod(socketPath, 384).then(resolve, reject);
+    });
+  });
+  startupLease = setTimeout(() => {
+    if (initializationPromise) return;
+    expireSession();
+    void shutdown();
+  }, options.timeoutMs);
+  const onSignal = () => {
+    closing = true;
+    void shutdown();
+  };
+  process.once("SIGTERM", onSignal);
+  process.once("SIGINT", onSignal);
+}
+async function wait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function assertOwnedSocket(socketPath) {
+  return lstat(socketPath).then((entry) => {
+    const uid = process.getuid?.();
+    if (!entry.isSocket() || uid !== void 0 && entry.uid !== uid) {
+      throw new Error("The lmt web session socket is not owned by the invoking user.");
+    }
+  });
+}
+async function requestSession(request, options = {}) {
+  if (!isSessionId(request.sessionId)) {
+    return failureResult(request.action, "invalid_session_id", "A valid session ID is required.", request.sessionId || null);
+  }
+  const socketPath = socketPathFor(request.sessionId);
+  const deadlineAt = Date.now() + request.timeoutMs;
+  const wireRequest = { ...request, deadlineAt };
+  if (options.waitForSocket) {
+    let ready = false;
+    while (Date.now() < deadlineAt) {
+      try {
+        await assertOwnedSocket(socketPath);
+        ready = true;
+        break;
+      } catch {
+        if (options.ownerAlive && !options.ownerAlive()) {
+          return failureResult(request.action, "browser_start_failed", "The browser session owner exited before it became ready.", request.sessionId);
+        }
+        await wait(40);
+      }
+    }
+    if (!ready) {
+      return failureResult(request.action, "deadline_exceeded", "The browser session did not become ready before its deadline.", request.sessionId);
+    }
+  }
+  try {
+    await assertOwnedSocket(socketPath);
+  } catch {
+    return failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId);
+  }
+  return new Promise((resolve) => {
+    const socket = net.createConnection(socketPath);
+    let received = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      finish(failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", request.sessionId));
+    }, Math.max(1, deadlineAt + OWNER_RESPONSE_GRACE_MS - Date.now()));
+    socket.once("connect", () => socket.write(`${JSON.stringify(wireRequest)}
+`));
+    socket.on("data", (chunk) => {
+      received += chunk.toString("utf8");
+      const newline = received.indexOf("\n");
+      if (newline < 0) return;
+      try {
+        finish(JSON.parse(received.slice(0, newline)));
+      } catch {
+        finish(failureResult(request.action, "invalid_response", "The browser session returned an invalid result.", request.sessionId));
+      }
+    });
+    socket.once("error", () => {
+      finish(failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId));
+    });
+    socket.once("close", () => {
+      if (!settled) {
+        finish(failureResult(request.action, "session_not_found", "The browser session closed before returning a result.", request.sessionId));
+      }
+    });
+  });
+}
+
+// src/web/owners.ts
+var REGISTRY = path2.join(SESSION_DIRECTORY, "owners.json");
+var LOCK = `${REGISTRY}.lock`;
+var OwnerRegistryError = class extends Error {
+  constructor() {
+    super(`Could not access the live browser owner registry ${REGISTRY}. Check its ownership and permissions, or remove it.`);
+  }
+};
+function sameKey(record, key) {
+  return record.environment === key.environment && record.origin === key.origin && record.mode === key.mode;
+}
+function isOwnerRecord(value) {
+  const record = value;
+  return !!record && typeof record === "object" && (record.environment === "local" || record.environment === "dev") && typeof record.origin === "string" && (record.mode === "mobile" || record.mode === "desktop") && typeof record.sessionId === "string" && /^[a-f0-9]{32}$/.test(record.sessionId) && Number.isSafeInteger(record.pid) && record.pid > 0 && typeof record.headless === "boolean" && typeof record.socket === "string" && typeof record.processStartedAt === "string";
+}
+function processStartedAt(pid) {
+  try {
+    const startedAt = execFileSync("ps", ["-p", String(pid), "-o", "lstart="], {
+      encoding: "utf8",
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, LC_ALL: "C", TZ: "UTC" }
+    }).trim();
+    return startedAt || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch (error) {
+    if (error.code === "ESRCH") return false;
+  }
+  return true;
+}
+function alive(record) {
+  return processExists(record.pid) && processStartedAt(record.pid) === record.processStartedAt;
+}
+async function assertPrivateFile(filename) {
+  const entry = await lstat2(filename);
+  if (!entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.() || (entry.mode & 511) !== 384) {
+    throw new OwnerRegistryError();
+  }
+}
+async function readRecords() {
+  let raw;
+  try {
+    await assertPrivateFile(REGISTRY);
+    raw = await readFile(REGISTRY, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw new OwnerRegistryError();
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version === 1 && Array.isArray(parsed.owners) && parsed.owners.every(isOwnerRecord)) return parsed.owners;
+  } catch {
+  }
+  throw new OwnerRegistryError();
+}
+async function writeRecords(records) {
+  const temporary = `${REGISTRY}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    const handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({ version: 1, owners: records }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temporary, REGISTRY);
+  } catch {
+    await unlink2(temporary).catch(() => void 0);
+    throw new OwnerRegistryError();
+  }
+}
+async function acquireLock(deadlineAt) {
+  while (true) {
+    try {
+      const handle = await open(LOCK, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
+      try {
+        await handle.writeFile(`${process.pid}
+`);
+      } finally {
+        await handle.close();
+      }
+      return;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw new OwnerRegistryError();
+    }
+    const holder = Number((await readFile(LOCK, "utf8").catch(() => "")).trim());
+    if (Number.isSafeInteger(holder) && holder > 0 && !processExists(holder)) {
+      await unlink2(LOCK).catch(() => void 0);
+      continue;
+    }
+    if (Date.now() >= deadlineAt) throw new OwnerRegistryError();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+}
+async function listLiveOwners() {
+  return (await readRecords()).filter(alive).map(({ environment, origin, mode, sessionId, pid, headless }) => ({ environment, origin, mode, sessionId, pid, headless }));
+}
+async function reserveOwner(key, deadlineAt, action) {
+  await acquireLock(deadlineAt);
+  try {
+    const records = await readRecords();
+    const live = records.filter(alive);
+    let changed = live.length !== records.length;
+    const result = action({
+      owner() {
+        const record = live.find((candidate) => sameKey(candidate, key));
+        return record ? { sessionId: record.sessionId, pid: record.pid, headless: record.headless } : void 0;
+      },
+      setOwner(owner) {
+        const startedAt = processStartedAt(owner.pid);
+        if (!startedAt) throw new OwnerRegistryError();
+        const index = live.findIndex((candidate) => sameKey(candidate, key));
+        if (index >= 0) live.splice(index, 1);
+        live.push({ ...key, ...owner, socket: socketPathFor(owner.sessionId), processStartedAt: startedAt });
+        changed = true;
+      }
+    });
+    if (changed) await writeRecords(live);
+    return result;
+  } finally {
+    await unlink2(LOCK).catch(() => void 0);
+  }
+}
+
+// src/web/start.ts
+import { spawn } from "node:child_process";
+import path3 from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/web/config.ts
+import { readFileSync } from "node:fs";
+function resolveWebTarget(environmentValue, workingDirectory = process.cwd()) {
+  const environment = environmentValue?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("lmt web supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(DEFAULT_CONFIG_PATH, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt.config.json does not contain the ${environment} environment.`);
+  }
+  return { environment, origin: resolveTargetOrigin(environment, selected.origin, workingDirectory) };
+}
+
+// src/web/start.ts
+function invalidTarget(error) {
+  if (error instanceof LocalConfigError) return new InvocationError(error.message, error.code);
+  return new InvocationError(error instanceof Error ? error.message : "The selected target is invalid.", "invalid_target");
+}
+async function controllerSessionProblem(target, deadlineAt) {
+  const timeoutMs = Math.max(1, deadlineAt - Date.now());
+  const { report, exitCode } = await reportSessionStatus({
+    target,
+    owner: CONTROLLER_SESSION,
+    store: new CliProfileStore(),
+    timeoutMs,
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (exitCode === 0) return void 0;
+  const controllerSession = { smsCredential: report.smsCredential, operatorSession: report.operatorSession, zerodha: report.zerodha };
+  if (report.outcome === "blocked") {
+    return {
+      ...failureResult("start", "controller_session_unauthenticated", `The ${target.environment} Controller Session is not authenticated, so no browser was opened.`),
+      outcome: "blocked",
+      origin: target.origin,
+      controllerSession,
+      ...report.nextStep ? { nextStep: report.nextStep } : {}
+    };
+  }
+  return { ...failureResult("start", report.error?.code ?? "action_failed", report.error?.message ?? "Could not check the Controller Session."), origin: target.origin, controllerSession };
+}
+async function startSession(command) {
+  const deadlineAt = Date.now() + command.timeoutMs;
+  const resolved = (resolve) => {
+    try {
+      return resolve();
+    } catch (error) {
+      throw invalidTarget(error);
+    }
+  };
+  let target;
+  if (command.fresh) target = resolved(() => resolveWebTarget(command.environment));
+  else {
+    const controllerTarget = resolved(() => resolveCliTarget({ LMT_ENV: command.environment }));
+    const problem = await controllerSessionProblem(controllerTarget, deadlineAt);
+    if (problem) return { result: problem, startedOwner: false };
+    target = controllerTarget;
+  }
+  await ensureSessionDirectory();
+  const key = { environment: target.environment, origin: target.origin, mode: command.mode };
+  let spawned;
+  let spawnedSessionId;
+  try {
+    const spawnOwner = () => {
+      const sessionId = createSessionId();
+      const scriptPath = path3.resolve(command.ownerScript ?? (process.argv[1] || fileURLToPath(import.meta.url)));
+      const child = spawn(process.execPath, [
+        scriptPath,
+        "web",
+        "__owner",
+        sessionId,
+        target.origin,
+        command.mode,
+        command.headless ? "headless" : "headed",
+        String(command.timeoutMs),
+        target.environment,
+        command.fresh ? "fresh" : "controller"
+      ], { detached: true, stdio: "ignore" });
+      spawned = child;
+      spawnedSessionId = sessionId;
+      child.on("error", () => void 0);
+      child.unref();
+      if (!child.pid) throw new Error("Could not start the browser owner.");
+      return { sessionId, pid: child.pid, headless: command.headless };
+    };
+    const selectOwner = () => command.fresh ? spawnOwner() : reserveOwner(key, deadlineAt, (registry) => {
+      const existing = registry.owner();
+      if (existing) {
+        if (existing.headless !== command.headless) throw new InvocationError("The session is already live with different visibility. Close it before changing --headed, or use --fresh.");
+        return existing;
+      }
+      const owner = spawnOwner();
+      registry.setOwner(owner);
+      return owner;
+    });
+    while (Date.now() < deadlineAt) {
+      const owner = await selectOwner();
+      const result = await requestSession({ sessionId: owner.sessionId, action: "start", timeoutMs: Math.max(1, deadlineAt - Date.now()) }, {
+        waitForSocket: true,
+        ownerAlive: () => processExists(owner.pid)
+      });
+      if (command.fresh || !["session_not_found", "session_unavailable", "browser_start_failed"].includes(result.error?.code ?? "")) {
+        return { result: { ...result, origin: target.origin }, startedOwner: spawnedSessionId !== void 0 && result.sessionId === spawnedSessionId };
+      }
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+    return { result: { ...failureResult("start", "deadline_exceeded", "The browser owner did not become available before the deadline."), origin: target.origin }, startedOwner: false };
+  } catch (error) {
+    if (spawned?.pid) {
+      try {
+        process.kill(spawned.pid, "SIGTERM");
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+
+// src/web/index.ts
+var DEFAULT_TIMEOUT_MS2 = 3e4;
+var MAX_TIMEOUT_MS = 10 * 6e4;
+var HELP = `lmt web \u2014 browser interaction with Live Market Terminal Web
+
+Usage:
+  lmt web install-browser [--with-deps] [--dry-run]
+  lmt web start --env local|dev [--device mobile|desktop] [--headed] [--fresh] [--timeout 30s]
+  lmt web inspect --session ID [--full-page] [--timeout 30s]
+  lmt web click --session ID --ref REF
+  lmt web fill --session ID --ref REF --value TEXT [--secret]
+  lmt web read --session ID --ref REF
+  lmt web clipboard --session ID
+  lmt web paste --session ID --ref REF
+  lmt web check --session ID --ref REF --stdin
+  lmt web clipboard-check --session ID --ref REF
+  lmt web select --session ID --ref REF --value OPTION
+  lmt web scroll --session ID [--ref REF] [--x PIXELS] [--y PIXELS]
+  lmt web navigate --session ID --url PATH_OR_URL
+  lmt web zerodha-login --session ID [--timeout 30s]
+  lmt web zerodha-otp --session ID --attempt ID --stdin [--timeout 30s]
+  lmt web zerodha-cancel --session ID [--timeout 30s]
+  lmt web zerodha-logout --session ID [--timeout 30s]
+  lmt web operator-login --session ID [--timeout 30s]
+  lmt web operator-logout --session ID [--timeout 30s]
+  lmt web close --session ID [--full-page] [--timeout 30s]
+  lmt web stop --session ID [--timeout 30s]
+
+Start opens the browser already authenticated by the environment's Controller Session, or reuses
+its live browser; desktop and mobile share the one Controller Session. Log it in with \`lmt\` (or
+\`lmt login\` and \`lmt zerodha login\`/\`otp\`); when it is not authenticated start is blocked
+(exit 4) and opens no browser. --fresh starts a temporary, isolated browser that never reads or
+writes the Controller Session; the operator-* and zerodha-* login commands run only in --fresh sessions.
+Mobile emulation and headless mode are the defaults. Inspect and close require the returned session ID.
+Stop terminates the session's browser and owner without capturing a final screenshot.
+Each command writes one versioned JSON result to stdout; diagnostics go to stderr.
+Secret reads and clipboard observations return only present, length and a 12-hex SHA-256 fingerprint.
+Paste transfers clipboard content into a protected browser field without printing it or submitting the form.
+Fresh Operator login reads the SMS read credential from ~/.lmt; provision it once with \`lmt credential provision\`.
+`;
+function parseTimeout(value) {
+  const match = /^(\d+)(ms|s|m)?$/i.exec(value);
+  if (!match) throw new InvocationError("--timeout must be a positive duration such as 30s, 500ms, or 2m.");
+  const number = Number(match[1]);
+  const multiplier = match[2]?.toLowerCase() === "m" ? 6e4 : match[2]?.toLowerCase() === "s" ? 1e3 : 1;
+  const timeoutMs = number * multiplier;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_TIMEOUT_MS) {
+    throw new InvocationError("--timeout must be between 1ms and 10m.");
+  }
+  return timeoutMs;
+}
+async function parseCommand(argv) {
+  const valueOptions = /* @__PURE__ */ new Set(["--timeout", "--session", ...Object.values(ACTIONS).flatMap((definition2) => definition2.values)]);
+  const flagOptions = /* @__PURE__ */ new Set(["--full-page", ...Object.values(ACTIONS).flatMap((definition2) => definition2.flags)]);
+  let actionIndex = 0;
+  while (argv[actionIndex]?.startsWith("--")) {
+    const option = argv[actionIndex];
+    if (flagOptions.has(option)) {
+      actionIndex += 1;
+    } else if (valueOptions.has(option)) {
+      const value = argv[actionIndex + 1];
+      if (value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires a value.`);
+      actionIndex += 2;
+    } else {
+      throw new InvocationError(`Unknown option: ${option}`);
+    }
+  }
+  const action = argv[actionIndex];
+  if (!isAction(action)) throw new InvocationError("Choose a supported browser command. Run `lmt web --help` for usage.");
+  const rest = [...argv.slice(0, actionIndex), ...argv.slice(actionIndex + 1)];
+  const definition = ACTIONS[action];
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const allowedFlags = /* @__PURE__ */ new Set([...action === "start" || action === "stop" ? [] : ["--full-page"], ...definition.flags]);
+  const allowedValues = /* @__PURE__ */ new Set(["--timeout", ...action === "start" ? [] : ["--session"], ...definition.values]);
+  for (let index = 0; index < rest.length; index += 1) {
+    const option = rest[index];
+    if (!option.startsWith("--")) throw new InvocationError("Unexpected positional argument.");
+    if (allowedFlags.has(option)) {
+      if (flags.has(option)) throw new InvocationError(`${option} may only be supplied once.`);
+      flags.add(option);
+      continue;
+    }
+    if (!allowedValues.has(option)) throw new InvocationError(`Unknown option: ${option}`);
+    if (values.has(option)) throw new InvocationError(`${option} may only be supplied once.`);
+    const value = rest[index + 1];
+    if (value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires a value.`);
+    values.set(option, value);
+    index += 1;
+  }
+  const timeoutMs = values.has("--timeout") ? parseTimeout(values.get("--timeout")) : DEFAULT_TIMEOUT_MS2;
+  if (action === "start") {
+    const mode = values.get("--device") ?? "mobile";
+    if (mode !== "mobile" && mode !== "desktop") {
+      throw new InvocationError("--device must be mobile or desktop.");
+    }
+    return {
+      action,
+      environment: values.get("--env") ?? "",
+      mode,
+      headless: !flags.has("--headed"),
+      fresh: flags.has("--fresh"),
+      timeoutMs
+    };
+  }
+  const sessionId = values.get("--session");
+  if (!isSessionId(sessionId)) {
+    throw new InvocationError("--session requires the 32-character session ID returned by start.", "invalid_session_id");
+  }
+  let payload;
+  try {
+    payload = await definition.build({ values, flags, readOtp: () => readOtp(timeoutMs), readInput: () => readInput(timeoutMs) });
+  } catch (error) {
+    throw new InvocationError(error instanceof Error ? error.message : "The action input could not be read.", error instanceof InvocationError ? error.code : "action_failed", action);
+  }
+  if (payload.action === "start") throw new InvocationError("Start requires an environment.");
+  return { ...payload, sessionId, fullPage: flags.has("--full-page"), timeoutMs };
+}
+function webCommand(name) {
+  return `web ${name}`;
+}
+function writeResult(result, command) {
+  const { version, action, ...fields } = result;
+  process.stdout.write(`${JSON.stringify({ version, command: command ?? (action ? webCommand(action) : "web"), ...fields })}
+`);
+}
+function emit(result, diagnostic, command) {
+  writeResult(result, command);
+  if (diagnostic) process.stderr.write(`${diagnostic}
+`);
+}
+async function readInput(timeoutMs) {
+  if (process.stdin.isTTY) throw new InvocationError("Pipe the expected value on stdin.");
+  let input = "";
+  const timer = setTimeout(() => process.stdin.destroy(new Error("Input deadline exceeded.")), timeoutMs);
+  try {
+    for await (const chunk of process.stdin) {
+      input += chunk.toString();
+      if (Buffer.byteLength(input) > 16384) throw new InvocationError("Expected value is too large.");
+    }
+    return input.replace(/\r?\n$/, "");
+  } catch {
+    throw new InvocationError("Expected value could not be read from stdin.");
+  } finally {
+    input = "";
+    clearTimeout(timer);
+  }
+}
+async function readOtp(timeoutMs) {
+  let input = "";
+  const timer = setTimeout(() => process.stdin.destroy(new Error("OTP input exceeded its deadline.")), timeoutMs);
+  try {
+    for await (const chunk of process.stdin) {
+      input += chunk.toString();
+      if (input.length > 64) throw new InvocationError("OTP must contain six digits.");
+    }
+    const otp = input.trim();
+    if (!/^\d{6}$/.test(otp)) throw new InvocationError("OTP must contain six digits.");
+    return otp;
+  } finally {
+    input = "";
+    clearTimeout(timer);
+  }
+}
+async function runOwner(argv) {
+  const [sessionId, origin, modeValue, headlessValue, timeoutValue, environment, authentication] = argv;
+  if (!isSessionId(sessionId) || !origin || modeValue !== "mobile" && modeValue !== "desktop" || headlessValue !== "headless" && headlessValue !== "headed" || !timeoutValue || !/^\d+$/.test(timeoutValue)) {
+    process.exitCode = 2;
+    return;
+  }
+  await runSessionOwner({
+    sessionId,
+    origin,
+    environment: environment === "dev" ? "dev" : "local",
+    mode: modeValue,
+    headless: headlessValue === "headless",
+    timeoutMs: Math.min(Number(timeoutValue), MAX_TIMEOUT_MS),
+    controller: authentication === "controller"
+  });
+}
+async function installChromium(options, progress) {
+  const require2 = createRequire(import.meta.url);
+  const browserCli = path4.join(path4.dirname(require2.resolve("playwright/package.json")), "cli.js");
+  return new Promise((resolve, reject) => {
+    const child = spawn2(process.execPath, [browserCli, "install", ...options, "chromium"], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout.pipe(progress, { end: false });
+    child.stderr.pipe(progress, { end: false });
+    child.once("error", reject);
+    child.once("close", (status) => resolve(status ?? 1));
+  });
+}
+async function installBrowser(options) {
+  const allowed = /* @__PURE__ */ new Set(["--with-deps", "--dry-run"]);
+  if (options.some((option) => !allowed.has(option)) || new Set(options).size !== options.length) {
+    writeResult({ version: 1, action: "install-browser", outcome: "failure", error: { code: "invalid_invocation", message: "Use install-browser [--with-deps] [--dry-run]." } });
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    const code = await installChromium(options, process.stderr);
+    writeResult({ version: 1, action: "install-browser", outcome: code === 0 ? "success" : "failure", ...code === 0 ? {} : { error: { code: "browser_install_failed", message: "Chromium setup failed. Review stderr and retry install-browser." } } });
+    process.exitCode = code;
+  } catch {
+    writeResult({ version: 1, action: "install-browser", outcome: "failure", error: { code: "browser_install_failed", message: "Could not run the installed Playwright runtime. Reinstall lmt and retry." } });
+    process.exitCode = 1;
+  }
+}
+async function runWebCli(argv) {
+  if (argv.length === 0 || argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(HELP);
+    return;
+  }
+  if (argv[0] === "install-browser" && !argv.includes("--help") && !argv.includes("-h")) {
+    await installBrowser(argv.slice(1));
+    return;
+  }
+  if (argv[0] === "credential") {
+    const message = "lmt web no longer stores credentials. Provision the SMS read credential with `lmt credential provision`.";
+    writeResult({ version: 1, outcome: "failure", error: { code: "invalid_invocation", message } }, "web credential");
+    process.stderr.write(`invalid_invocation: ${message}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  if (argv[0] === "__owner") {
+    await runOwner(argv.slice(1));
+    return;
+  }
+  if (argv[0] === "interactive") {
+    const message = `lmt web interactive is no longer available. ${CONTROLLER_LOGIN_STEP}; \`lmt web start\` then opens an authenticated browser.`;
+    writeResult({ version: 1, outcome: "failure", error: { code: "invalid_invocation", message } }, "web interactive");
+    process.stderr.write(`invalid_invocation: ${message}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  let command;
+  try {
+    command = await parseCommand(argv);
+    let result;
+    if (command.action === "start") {
+      ({ result } = await startSession(command));
+    } else {
+      result = await requestSession(command);
+    }
+    emit(result, result.error ? `${result.error.code}: ${result.error.message}` : void 0);
+    if (result.outcome !== "success") {
+      process.exitCode = result.outcome === "blocked" ? 4 : ["invalid_target", "invalid_invocation", "fresh_session_required"].includes(result.error?.code ?? "") ? 2 : 1;
+    }
+  } catch (error) {
+    const action = command?.action ?? (error instanceof InvocationError ? error.action : void 0) ?? (isAction(argv[0]) ? argv[0] : void 0);
+    const code = error instanceof OwnerRegistryError ? "owner_registry_unavailable" : error instanceof InvocationError ? error.code : "action_failed";
+    const message = error instanceof Error ? error.message : "The lmt web command failed.";
+    const result = failureResult(action ?? "start", code, message);
+    emit(result, `${code}: ${message}`, action ? void 0 : "web");
+    process.exitCode = error instanceof InvocationError && error.code !== "action_failed" ? 2 : 1;
+    return;
+  }
+}
+
+export {
+  socketPathFor,
+  requestSession,
+  listLiveOwners,
+  startSession,
+  installChromium,
+  runWebCli
+};