@ai-digital-factory/lmt-web-cli 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,2686 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createRequire } from "node:module";
+import path5 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// ../cli/src/profile-store.ts
+import { randomUUID } from "node:crypto";
+import {
+  chmod,
+  constants,
+  lstat,
+  mkdir,
+  open,
+  rename,
+  unlink
+} from "node:fs/promises";
+import path from "node:path";
+
+// ../cli/src/profile-name.ts
+var CLIENT_PROFILE_NAME_ERROR = "Profile must be 1\u201364 letters, digits, dots, underscores, or hyphens, starting with a letter or digit.";
+var clientProfilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function assertClientProfileName(profile) {
+  if (!clientProfilePattern.test(profile)) throw new Error(CLIENT_PROFILE_NAME_ERROR);
+}
+
+// ../cli/src/profile-store.ts
+var FILE_NAME = "secrets.pem";
+var OWNER_ONLY_DIRECTORY = 448;
+var OWNER_ONLY_FILE = 384;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 20;
+function emptyRecord() {
+  return { version: 2, profiles: {} };
+}
+function targetsEqual(left, right) {
+  return left.environment === right.environment && left.origin === right.origin && left.operatorId === right.operatorId;
+}
+function assertCookie(value, name) {
+  if (value !== void 0 && !new RegExp(`^${name}=[A-Za-z0-9._~-]+$`).test(value)) {
+    throw new Error(`The ${name} cookie is not valid.`);
+  }
+}
+function ownerId() {
+  return typeof process.getuid === "function" ? process.getuid() : void 0;
+}
+async function ensureOwnerOnly(pathname, kind) {
+  let info;
+  try {
+    info = await lstat(pathname);
+  } catch (error) {
+    if (error.code === "ENOENT") throw error;
+    throw new Error("Could not inspect the protected CLI profile storage.");
+  }
+  if (info.isSymbolicLink() || (kind === "directory" ? !info.isDirectory() : !info.isFile())) {
+    throw new Error(`The protected CLI profile ${kind} must be a regular ${kind}.`);
+  }
+  const uid = ownerId();
+  if (uid !== void 0 && info.uid !== uid) {
+    throw new Error(`The protected CLI profile ${kind} must be owned by the current user.`);
+  }
+  const expectedMode = kind === "directory" ? OWNER_ONLY_DIRECTORY : OWNER_ONLY_FILE;
+  if ((info.mode & 511) === expectedMode) return;
+  try {
+    await chmod(pathname, expectedMode);
+  } catch {
+    throw new Error(`Could not set protected CLI profile ${kind} permissions.`);
+  }
+  const updated = await lstat(pathname);
+  if ((updated.mode & 511) !== expectedMode) {
+    const mode = expectedMode.toString(8).padStart(4, "0");
+    throw new Error(`The protected CLI profile ${kind} must have mode ${mode}.`);
+  }
+}
+function parseLegacyTargetKey(key) {
+  try {
+    const parsed = JSON.parse(key);
+    if (!Array.isArray(parsed) || parsed.length !== 3) return void 0;
+    const [environment, origin, operatorId] = parsed;
+    if (environment !== "local" && environment !== "dev") return void 0;
+    if (typeof origin !== "string" || !origin.trim()) return void 0;
+    if (operatorId !== "OPERATOR_1") return void 0;
+    return { environment, origin: origin.trim(), operatorId };
+  } catch {
+    return void 0;
+  }
+}
+function migrateLegacyRecord(record) {
+  const migrated = emptyRecord();
+  if (record.smsCredential?.trim()) migrated.smsCredential = record.smsCredential;
+  for (const [profileName, profileRecord] of Object.entries(record.profiles ?? {})) {
+    const sessions = [];
+    for (const [targetKey, stored] of Object.entries(profileRecord.targets ?? {})) {
+      const target = parseLegacyTargetKey(targetKey);
+      if (!target) continue;
+      sessions.push({
+        ...target,
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {},
+        updatedAt: stored.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    if (sessions.length > 0) migrated.profiles[profileName] = { sessions };
+  }
+  return migrated;
+}
+function normalizeSession(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const session = value;
+  if (session.environment !== "local" && session.environment !== "dev") return void 0;
+  if (typeof session.origin !== "string" || !session.origin.trim()) return void 0;
+  if (session.operatorId !== "OPERATOR_1") return void 0;
+  if (typeof session.updatedAt !== "string" || !session.updatedAt.trim()) return void 0;
+  if (session.operatorSessionCookie !== void 0 && typeof session.operatorSessionCookie !== "string") return void 0;
+  if (session.clientIdentityCookie !== void 0 && typeof session.clientIdentityCookie !== "string") return void 0;
+  return {
+    environment: session.environment,
+    origin: session.origin.trim(),
+    operatorId: session.operatorId,
+    updatedAt: session.updatedAt,
+    ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
+  };
+}
+function parseRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("The protected CLI profile file is not valid JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("The protected CLI profile file has an unsupported format.");
+  }
+  const record = parsed;
+  if (record.version === 1) {
+    return migrateLegacyRecord(parsed);
+  }
+  if (record.version !== 2 || !record.profiles || typeof record.profiles !== "object" || Array.isArray(record.profiles)) {
+    throw new Error("The protected CLI profile file has an unsupported version or format.");
+  }
+  if (record.smsCredential !== void 0 && (typeof record.smsCredential !== "string" || !record.smsCredential.trim())) {
+    throw new Error("The protected CLI profile file has an invalid SMS credential record.");
+  }
+  const profiles = {};
+  for (const [profileName, profileValue] of Object.entries(record.profiles)) {
+    if (!profileValue || typeof profileValue !== "object" || Array.isArray(profileValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessionsValue = profileValue.sessions;
+    if (!Array.isArray(sessionsValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessions = sessionsValue.map(normalizeSession).filter((session) => session !== void 0);
+    if (sessions.length !== sessionsValue.length) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    if (sessions.length > 0) profiles[profileName] = { sessions };
+  }
+  return {
+    version: 2,
+    ...typeof record.smsCredential === "string" && record.smsCredential.trim() ? { smsCredential: record.smsCredential } : {},
+    profiles
+  };
+}
+function findSessionIndex(sessions, target) {
+  return sessions.findIndex((session) => targetsEqual(session, target));
+}
+function sessionHasCookies(session) {
+  return Boolean(session.operatorSessionCookie || session.clientIdentityCookie);
+}
+var CliProfileStore = class {
+  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS, directoryName = ".lmt") {
+    this.lockWaitMs = lockWaitMs;
+    this.directory = path.join(homeDirectory, directoryName);
+    this.filePath = path.join(this.directory, FILE_NAME);
+    this.lockPath = path.join(this.directory, `${FILE_NAME}.lock`);
+  }
+  lockWaitMs;
+  directory;
+  filePath;
+  lockPath;
+  async getSmsCredential() {
+    return this.withLock(async () => (await this.readRecord()).smsCredential);
+  }
+  async saveSmsCredential(credential) {
+    if (!credential.trim() || /[\r\n]/.test(credential)) throw new Error("SMS credential input must be a non-empty single line.");
+    await this.withLock(async () => {
+      const record = await this.readRecordForSmsCredentialUpdate();
+      record.smsCredential = credential;
+      await this.writeRecord(record);
+    });
+  }
+  async getSession(profile, target) {
+    assertClientProfileName(profile);
+    return this.withLock(async () => {
+      const stored = (await this.readRecord()).profiles[profile]?.sessions.find((session) => targetsEqual(session, target));
+      if (!stored) return void 0;
+      return {
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {}
+      };
+    });
+  }
+  async saveSession(profile, target, cookies) {
+    assertClientProfileName(profile);
+    assertCookie(cookies.operatorSessionCookie, "lmt_operator_session");
+    assertCookie(cookies.clientIdentityCookie, "lmt_client_id");
+    if (!cookies.operatorSessionCookie && !cookies.clientIdentityCookie) return;
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile] ?? { sessions: [] };
+      const index = findSessionIndex(profileRecord.sessions, target);
+      const next = {
+        ...target,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
+        ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
+      };
+      if (!sessionHasCookies(next)) {
+        if (index >= 0) profileRecord.sessions.splice(index, 1);
+      } else if (index >= 0) {
+        profileRecord.sessions[index] = next;
+      } else {
+        profileRecord.sessions.push(next);
+      }
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+      else record.profiles[profile] = profileRecord;
+    });
+  }
+  async clearOperatorSession(profile, target) {
+    assertClientProfileName(profile);
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile];
+      if (!profileRecord) return;
+      const index = findSessionIndex(profileRecord.sessions, target);
+      if (index < 0) return;
+      const stored = profileRecord.sessions[index];
+      delete stored.operatorSessionCookie;
+      stored.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.cleanEmptySession(profileRecord, index);
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+    });
+  }
+  async removeTarget(profile, target) {
+    assertClientProfileName(profile);
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile];
+      if (!profileRecord) return;
+      profileRecord.sessions = profileRecord.sessions.filter((session) => !targetsEqual(session, target));
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+    });
+  }
+  cleanEmptySession(profileRecord, index) {
+    const stored = profileRecord.sessions[index];
+    if (stored && !sessionHasCookies(stored)) profileRecord.sessions.splice(index, 1);
+  }
+  async update(mutator) {
+    await this.withLock(async () => {
+      const record = await this.readRecord();
+      mutator(record);
+      await this.writeRecord(record);
+    });
+  }
+  async withLock(operation) {
+    await this.ensureDirectory();
+    const started = Date.now();
+    let lock;
+    while (!lock) {
+      try {
+        lock = await open(this.lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+        await lock.chmod(OWNER_ONLY_FILE);
+        await lock.writeFile(`${process.pid}
+`);
+        await lock.sync();
+      } catch (error) {
+        if (error.code !== "EEXIST") {
+          throw new Error("Could not acquire the protected CLI profile storage lock.");
+        }
+        try {
+          await ensureOwnerOnly(this.lockPath, "file");
+        } catch (lockError) {
+          if (lockError.code === "ENOENT") continue;
+          throw lockError;
+        }
+        if (Date.now() - started >= this.lockWaitMs) {
+          throw new Error("Timed out waiting for the protected CLI profile storage lock.");
+        }
+        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await operation();
+    } finally {
+      await lock.close().catch(() => void 0);
+      await unlink(this.lockPath).catch(() => void 0);
+    }
+  }
+  async ensureDirectory() {
+    let created = false;
+    try {
+      await mkdir(this.directory, { mode: OWNER_ONLY_DIRECTORY });
+      created = true;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new Error("Could not create the protected CLI profile directory.");
+      }
+    }
+    if (created) {
+      try {
+        await chmod(this.directory, OWNER_ONLY_DIRECTORY);
+      } catch {
+        throw new Error("Could not set protected CLI profile directory permissions.");
+      }
+    }
+    await ensureOwnerOnly(this.directory, "directory");
+  }
+  isRecoverableStoreFormatError(error) {
+    if (!(error instanceof Error)) return false;
+    return error.message === "The protected CLI profile file is not valid JSON." || error.message === "The protected CLI profile file has an unsupported format." || error.message === "The protected CLI profile file has an unsupported version or format." || error.message === "The protected CLI profile file has an invalid SMS credential record.";
+  }
+  async archiveUnreadableStoreFile() {
+    const backupPath = `${this.filePath}.corrupt.${Date.now()}.bak`;
+    try {
+      await rename(this.filePath, backupPath);
+    } catch {
+      throw new Error("Could not repair the protected CLI profile file.");
+    }
+  }
+  async readRecordForSmsCredentialUpdate() {
+    try {
+      return await this.readRecord();
+    } catch (error) {
+      if (!this.isRecoverableStoreFormatError(error)) throw error;
+      await this.archiveUnreadableStoreFile();
+      return emptyRecord();
+    }
+  }
+  async readRecord() {
+    try {
+      const info = await lstat(this.filePath);
+      if (info.isSymbolicLink() || !info.isFile()) {
+        throw new Error("The protected CLI profile file must be a regular file.");
+      }
+      await ensureOwnerOnly(this.filePath, "file");
+      const handle = await open(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      try {
+        return parseRecord(await handle.readFile("utf8"));
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") return emptyRecord();
+      if (error instanceof Error && error.message.startsWith("The protected CLI profile")) throw error;
+      throw new Error("Could not read the protected CLI profile file.");
+    }
+  }
+  async writeRecord(record) {
+    const normalized = {
+      version: 2,
+      ...record.smsCredential ? { smsCredential: record.smsCredential } : {},
+      profiles: Object.fromEntries(
+        Object.entries(record.profiles).map(([profileName, profileRecord]) => [
+          profileName,
+          {
+            sessions: profileRecord.sessions.map((session) => ({
+              environment: session.environment,
+              origin: session.origin,
+              operatorId: session.operatorId,
+              ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+              ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
+              updatedAt: session.updatedAt
+            }))
+          }
+        ])
+      )
+    };
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const content = `${JSON.stringify(normalized, null, 2)}
+`;
+    let handle;
+    try {
+      handle = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+      await handle.chmod(OWNER_ONLY_FILE);
+      await handle.writeFile(content, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      await rename(temporaryPath, this.filePath);
+      const directoryHandle = await open(this.directory, constants.O_RDONLY);
+      try {
+        await directoryHandle.sync();
+      } finally {
+        await directoryHandle.close();
+      }
+    } catch {
+      if (handle) await handle.close().catch(() => void 0);
+      await unlink(temporaryPath).catch(() => void 0);
+      throw new Error("Could not atomically update the protected CLI profile file.");
+    }
+  }
+};
+
+// ../cli/src/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+var repoRoot = path2.resolve(
+  path2.dirname(fileURLToPath(import.meta.url)),
+  "../../../../"
+);
+var packagedConfigPath = fileURLToPath(new URL("../lmt.config.json", import.meta.url));
+var DEFAULT_CONFIG_PATH = existsSync(packagedConfigPath) ? packagedConfigPath : path2.join(repoRoot, "lmt.config.json");
+function resolveCanonicalOrigin(value, environment) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`lmt.config.json does not contain the ${environment} Origin.`);
+  }
+  let origin;
+  try {
+    origin = new URL(value.trim());
+  } catch {
+    throw new Error(`${environment} Origin must be an absolute HTTP URL.`);
+  }
+  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
+    throw new Error(
+      `${environment} Origin must be an HTTP URL without credentials or a fragment.`
+    );
+  }
+  if (origin.pathname !== "/" || origin.search) {
+    throw new Error(`${environment} Origin must not include a path or query string.`);
+  }
+  return origin.origin;
+}
+function resolveCliTarget(env = process.env, configPath = DEFAULT_CONFIG_PATH) {
+  const environment = env.LMT_ENV?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("The CLI supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt.config.json does not contain the ${environment} environment.`);
+  }
+  const origin = resolveCanonicalOrigin(selected.origin, environment);
+  const smsEndpoint = typeof config.smsEndpoint === "string" ? config.smsEndpoint.trim() : "";
+  if (!smsEndpoint) throw new Error("lmt.config.json does not contain smsEndpoint.");
+  const gateScope = typeof selected.gateScope === "string" ? selected.gateScope.trim() : "";
+  if (!gateScope) throw new Error(`lmt.config.json does not contain the ${environment} Gate scope.`);
+  const operators = selected.brokerOperatorIds;
+  if (!Array.isArray(operators) || operators.length !== 1 || operators[0] !== "OPERATOR_1") {
+    throw new Error(`${environment} must have exactly one configured Operator: OPERATOR_1.`);
+  }
+  let smsUrl;
+  try {
+    smsUrl = new URL(smsEndpoint);
+  } catch {
+    throw new Error("smsEndpoint must be an absolute HTTP URL.");
+  }
+  if (!/^https?:$/.test(smsUrl.protocol) || smsUrl.username || smsUrl.password || smsUrl.hash) {
+    throw new Error("smsEndpoint must be an HTTP URL without credentials or a fragment.");
+  }
+  return {
+    environment,
+    origin,
+    gateScope,
+    smsEndpoint: smsUrl.origin,
+    operatorId: "OPERATOR_1"
+  };
+}
+
+// src/actions.ts
+var InvocationError = class extends Error {
+  constructor(message, code = "invalid_invocation", action) {
+    super(message);
+    this.code = code;
+    this.action = action;
+  }
+  code;
+  action;
+};
+function required(input, option) {
+  const value = input.values.get(option);
+  if (value === void 0 || option !== "--value" && !value) throw new InvocationError(`${option} is required for this action.`);
+  return value;
+}
+var ACTIONS = {
+  start: { control: false, flags: ["--headed"], values: ["--env", "--device"], build: () => ({ action: "start" }) },
+  inspect: { control: false, flags: [], values: [], build: () => ({ action: "inspect" }) },
+  close: { control: false, flags: [], values: [], build: () => ({ action: "close" }) },
+  stop: { control: false, flags: [], values: [], build: () => ({ action: "stop" }) },
+  "operator-login": { control: false, flags: [], values: [], build: () => ({ action: "operator-login" }) },
+  "operator-logout": { control: false, flags: [], values: [], build: () => ({ action: "operator-logout" }) },
+  "zerodha-login": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-login" }) },
+  "zerodha-logout": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-logout" }) },
+  "zerodha-otp": {
+    control: false,
+    flags: ["--stdin"],
+    values: ["--attempt"],
+    build: async (input) => {
+      const attemptId = required(input, "--attempt");
+      if (!input.flags.has("--stdin")) throw new InvocationError("zerodha-otp requires --attempt ID and --stdin.");
+      return { action: "zerodha-otp", attemptId, otp: await input.readOtp() };
+    }
+  },
+  click: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "click", reference: required(input, "--ref") }) },
+  fill: {
+    control: true,
+    flags: ["--secret"],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "fill", reference: required(input, "--ref"), value: required(input, "--value"), secret: input.flags.has("--secret") })
+  },
+  select: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "select", reference: required(input, "--ref"), value: required(input, "--value") })
+  },
+  scroll: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--x", "--y"],
+    build: (input) => ({ action: "scroll", reference: input.values.get("--ref"), x: Number(input.values.get("--x") ?? 0), y: Number(input.values.get("--y") ?? 0) })
+  },
+  navigate: { control: true, flags: [], values: ["--url"], build: (input) => ({ action: "navigate", url: required(input, "--url") }) }
+};
+function isAction(value) {
+  return typeof value === "string" && Object.hasOwn(ACTIONS, value);
+}
+function isControlAction(action) {
+  return ACTIONS[action.action].control;
+}
+
+// src/config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import path3 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var repositoryRoot = path3.resolve(
+  path3.dirname(fileURLToPath2(import.meta.url)),
+  "../../../../"
+);
+var packagedConfig = fileURLToPath2(new URL("../lmt-web.config.json", import.meta.url));
+var DEFAULT_CONFIG_PATH2 = existsSync2(packagedConfig) ? packagedConfig : path3.join(repositoryRoot, "lmt.config.json");
+function canonicalOrigin(value, environment) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`lmt-web.config.json does not contain the ${environment} Web URL.`);
+  }
+  let origin;
+  try {
+    origin = new URL(value.trim());
+  } catch {
+    throw new Error(`${environment} Web URL must be an absolute HTTP URL.`);
+  }
+  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
+    throw new Error(
+      `${environment} Web URL must be an HTTP URL without credentials or a fragment.`
+    );
+  }
+  if (origin.pathname !== "/" || origin.search) {
+    throw new Error(`${environment} Web URL must not include a path or query string.`);
+  }
+  return origin.origin;
+}
+function resolveWebTarget(environmentValue, configPath = process.env.LMT_WEB_CONFIG_PATH || DEFAULT_CONFIG_PATH2) {
+  const environment = environmentValue?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("lmt-web supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync2(configPath, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt-web.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt-web.config.json does not contain the ${environment} environment.`);
+  }
+  return { environment, origin: canonicalOrigin(selected.origin, environment) };
+}
+
+// src/protocol.ts
+var RESULT_VERSION = 1;
+function failureResult(action, code, message, sessionId = null) {
+  return {
+    version: RESULT_VERSION,
+    sessionId,
+    action,
+    outcome: "failure",
+    url: null,
+    visibleState: null,
+    device: null,
+    screenshot: { outcome: "unavailable", reason: "No browser page was available." },
+    error: { code, message }
+  };
+}
+
+// src/session.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmod as chmod2, lstat as lstat2, mkdir as mkdir2, unlink as unlink2 } from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path4 from "node:path";
+import { chromium as chromium2 } from "playwright";
+
+// ../../packages/crawler/src/controls.ts
+import { randomBytes } from "node:crypto";
+var ControlError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function controlSignature(node) {
+  if (!node.isConnected) return null;
+  return JSON.stringify([
+    node.tagName,
+    node.getAttribute("type"),
+    node.getAttribute("name"),
+    node.getAttribute("aria-label"),
+    node.getAttribute("href"),
+    node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement ? "" : node.textContent
+  ]);
+}
+var PageControls = class {
+  constructor(page, origin) {
+    this.origin = origin;
+    this.page = page;
+  }
+  origin;
+  page;
+  references = /* @__PURE__ */ new Map();
+  secrets = /* @__PURE__ */ new Set();
+  prefix = randomBytes(8).toString("hex");
+  sequence = 0;
+  registerSecrets(...values) {
+    for (const value of values) if (value) this.secrets.add(value);
+  }
+  redact(value) {
+    let result = value;
+    for (const secret of [...this.secrets].sort((a, b) => b.length - a.length)) {
+      result = result.split(secret).join("[redacted]");
+      result = result.split(encodeURIComponent(secret)).join("[redacted]");
+    }
+    return result;
+  }
+  async learnSecrets() {
+    const values = await this.page.evaluate(() => {
+      const sensitive = /password|credential|secret|token|otp|one.time|username|user.?id|api.?key|pin/i;
+      const found = Array.from(document.querySelectorAll("input, textarea")).filter((element) => sensitive.test([
+        element.outerHTML.replace(/value=("[^"]*"|'[^']*')/g, ""),
+        ...Array.from(element.labels ?? []).map((label) => label.innerText)
+      ].join(" "))).map((element) => element.value).filter(Boolean);
+      for (const match of (document.body?.innerText ?? "").matchAll(/(?:access[\s_-]*token|request[\s_-]*token|api[\s_-]*(?:secret|key|token)|password|credential|otp)(?:\s*[:=]\s*|\s*\n\s*)([^\s,;]+)/gi)) {
+        if (match[1]) found.push(match[1]);
+      }
+      return found;
+    });
+    this.registerSecrets(...values);
+  }
+  async screenshotMasks() {
+    try {
+      await this.learnSecrets();
+    } catch (error) {
+      if (this.secrets.size) throw error;
+      else return [];
+    }
+    await this.page.evaluate((secrets) => {
+      document.querySelectorAll("[data-lmt-secret-mask]").forEach((element) => element.removeAttribute("data-lmt-secret-mask"));
+      if (!secrets.length) return;
+      for (const element of document.querySelectorAll("body *")) {
+        const directText = Array.from(element.childNodes).filter((node) => node.nodeType === Node.TEXT_NODE).map((node) => node.textContent).join("");
+        if (secrets.some((secret) => directText.includes(secret) || (element.textContent ?? "").includes(secret) && !Array.from(element.children).some((child) => (child.textContent ?? "").includes(secret)))) element.setAttribute("data-lmt-secret-mask", "");
+      }
+    }, [...this.secrets]);
+    return [this.page.locator("[data-lmt-secret-mask]")];
+  }
+  async inspect() {
+    await this.learnSecrets();
+    for (const { element } of this.references.values()) await element.dispose().catch(() => void 0);
+    this.references.clear();
+    const controls = [];
+    const elements = await this.page.$$("button, a[href], input, select, textarea, [role=button], [contenteditable=true]");
+    for (const element of elements) {
+      if (controls.length >= 100 || !await element.isVisible()) {
+        await element.dispose();
+        continue;
+      }
+      const description = await element.evaluate((node) => {
+        const labels = Array.from(node.labels ?? []).map((label) => {
+          const copy = label.cloneNode(true);
+          copy.querySelectorAll("input,select,textarea,button").forEach((control) => control.remove());
+          return copy.textContent ?? "";
+        }).join(" ");
+        return {
+          kind: node.getAttribute("role") || node.tagName.toLowerCase(),
+          label: (node.getAttribute("aria-label") || node.getAttribute("title") || labels || node.getAttribute("placeholder") || (node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement ? "" : node.textContent) || "").replace(/\s+/g, " ").trim()
+        };
+      });
+      const reference = `${this.prefix}-${++this.sequence}`;
+      this.references.set(reference, { element, signature: await element.evaluate(controlSignature) });
+      controls.push({ reference, kind: description.kind, label: this.redact(description.label).slice(0, 160) });
+    }
+    return controls;
+  }
+  async resolve(reference) {
+    const saved = this.references.get(reference);
+    const element = saved?.element;
+    if (!element || !saved?.signature || await element.evaluate(controlSignature).catch(() => null) !== saved.signature) {
+      throw new ControlError("stale_reference", "The control reference is missing or stale. Inspect the page for current references.");
+    }
+    if (!await element.isVisible()) throw new ControlError("stale_reference", "The referenced control is no longer visible. Inspect the page again.");
+    return element;
+  }
+  async stopLoading() {
+    const session = await this.page.context().newCDPSession(this.page);
+    try {
+      await session.send("Page.stopLoading");
+    } finally {
+      await session.detach();
+    }
+  }
+  async act(command, timeoutMs, onSubmit = () => void 0) {
+    this.page.setDefaultTimeout(timeoutMs);
+    this.page.setDefaultNavigationTimeout(timeoutMs);
+    if (command.action === "fill") {
+      const element = await this.resolve(command.reference);
+      const sensitive = await element.evaluate((node) => /password|credential|secret|token|otp|one.time|username|user.?id|api.?key|pin/i.test(node.outerHTML + Array.from(node.labels ?? []).map((label) => label.innerText).join(" ")));
+      if (command.secret || sensitive) this.registerSecrets(command.value);
+      await element.fill(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "select") {
+      await (await this.resolve(command.reference)).selectOption(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "click") {
+      const element = await this.resolve(command.reference);
+      const deadlineAt = Date.now() + timeoutMs;
+      await element.click({ trial: true, timeout: timeoutMs });
+      onSubmit();
+      try {
+        await element.click({ timeout: Math.max(1, deadlineAt - Date.now()) });
+      } catch {
+        throw new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.");
+      }
+      return;
+    }
+    if (command.action === "navigate") {
+      const target = new URL(command.url, this.origin);
+      if (target.origin !== new URL(this.origin).origin || target.username || target.password) {
+        throw new ControlError("invalid_target", "Navigation must use the session's configured Origin.");
+      }
+      await this.page.goto(target.href, { timeout: timeoutMs, waitUntil: "domcontentloaded" });
+      return;
+    }
+    if (command.action === "scroll") {
+      if (!Number.isFinite(command.x) || !Number.isFinite(command.y)) throw new ControlError("invalid_invocation", "Scroll offsets must be finite pixel values.");
+      if (command.reference) {
+        await (await this.resolve(command.reference)).evaluate((node, offsets) => node.scrollBy({ left: offsets.x, top: offsets.y, behavior: "instant" }), command);
+      } else {
+        await this.page.evaluate((offsets) => window.scrollBy({ left: offsets.x, top: offsets.y, behavior: "instant" }), command);
+      }
+      await this.page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))));
+    }
+  }
+};
+
+// ../../packages/crawler/src/index.ts
+import {
+  chromium
+} from "playwright";
+var DEFAULT_BASE_URL = "http://127.0.0.1:5173";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 6e4;
+var OPERATOR_PAGE_SELECTOR = '[data-operator-page="true"]';
+var MARKET_WATCH_SELECTOR = '[data-market-watch="true"]';
+var OPERATOR_LOGIN_GATE_SELECTOR = '[data-operator-login-gate="true"]';
+var OPERATOR_LOGIN_USERNAME_SELECTOR = "[data-operator-login-username]";
+var OPERATOR_LOGIN_PASSWORD_SELECTOR = "[data-operator-login-password]";
+var OPERATOR_LOGIN_CONFIRM_SELECTOR = "[data-operator-login-confirm]";
+var CREDENTIALS_STATUS_SELECTOR = "[data-credentials-status]";
+var ZERODHA_LOGIN_PAGE_SELECTOR = '[data-zerodha-login-page="true"]';
+var OPERATOR_LOGIN_ATTEMPT_SELECTOR = "[data-operator-login-attempt]";
+var OPERATOR_LOGIN_STATUS_ATTRIBUTE = "data-operator-login-status";
+var OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR = '[data-operator-login-message-kind="status"]';
+var OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR = '[data-operator-login-message-kind="error"]';
+var OPERATOR_LOGIN_MESSAGE_ATTRIBUTE = "data-operator-login-message";
+var OPERATOR_LOGIN_OTP_SELECTOR = "[data-operator-login-otp]";
+var OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR = "[data-operator-login-otp-submit]";
+var AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-authenticated-operator-logout]";
+var UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-unauthenticated-operator-logout]";
+var SETTINGS_SELECTOR = "[data-zc-settings]";
+var OPERATOR_EGRESS_SELECTOR = "[data-operator-egress-value]";
+var PEEK_TIMEOUT_MS = 250;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function isAttached(page, selector, attributeName) {
+  if (typeof page.waitForSelector === "function") {
+    try {
+      await page.waitForSelector(selector, { timeout: PEEK_TIMEOUT_MS });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  const value = await peekAttribute(page, selector, attributeName);
+  return value !== null;
+}
+async function peekAttribute(page, selector, name) {
+  try {
+    return await page.locator(selector).getAttribute(name, { timeout: PEEK_TIMEOUT_MS });
+  } catch {
+    return null;
+  }
+}
+function marketWatchRowSelector(sno) {
+  return `[data-market-watch-row="${sno}"]`;
+}
+function marketWatchExchangeSelector(sno) {
+  return `[data-market-watch-exchange="${sno}"]`;
+}
+function marketWatchTradingSymbolSelector(sno) {
+  return `[data-market-watch-trading-symbol="${sno}"]`;
+}
+function marketWatchApplySelector(sno) {
+  return `[data-market-watch-apply="${sno}"]`;
+}
+function marketWatchClearSelector(sno) {
+  return `[data-market-watch-clear="${sno}"]`;
+}
+function marketWatchCommittedSelector(sno) {
+  return `[data-market-watch-committed="${sno}"]`;
+}
+function marketWatchQuoteSelector(sno) {
+  return `[data-market-watch-quote="${sno}"]`;
+}
+function marketWatchQuoteFieldSelector(sno, field) {
+  return `${marketWatchQuoteSelector(sno)} [data-market-watch-quote-field="${field}"]`;
+}
+var QUOTE_FIELDS = {
+  ltp: "lastPrice",
+  open: "open",
+  high: "high",
+  low: "low",
+  close: "close",
+  volume: "volume",
+  "percentage-change": "percentageChange"
+};
+function toMarketWatchRowStatus(raw) {
+  switch (raw) {
+    case "Empty":
+      return "empty";
+    case "Validating":
+      return "validating";
+    case "Live":
+      return "live";
+    case "Error":
+      return "error";
+    case "Configured":
+      return "stopped";
+    case null:
+      throw new Error("Market Watch row did not expose a state");
+    default:
+      throw new Error(`Unknown Market Watch row state: ${raw}`);
+  }
+}
+var PlaywrightOperatorPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorInfo() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const root = this.page.locator(OPERATOR_PAGE_SELECTOR);
+    const userId = (await root.getAttribute("data-user-id"))?.trim() ?? "";
+    const userName = (await root.getAttribute("data-user-name"))?.trim() ?? "";
+    if (!userId) {
+      throw new Error("Operator Page did not expose a user id");
+    }
+    return {
+      userId,
+      userName: userName || userId
+    };
+  }
+  async getMarketWatchRowCount() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const raw = await this.page.locator(MARKET_WATCH_SELECTOR).getAttribute("data-market-watch-row-count", { timeout: this.timeoutMs });
+    const rowCount = Number(raw);
+    if (!Number.isInteger(rowCount) || rowCount < 1) {
+      throw new Error(`Market Watch exposed invalid row count: ${String(raw)}`);
+    }
+    return rowCount;
+  }
+  async getMarketWatchRowNumbers() {
+    const rowCount = await this.getMarketWatchRowCount();
+    const rowNumbers = Array.from({ length: rowCount }, (_, index) => index + 1);
+    for (const sno of rowNumbers) {
+      await this.page.waitForSelector?.(marketWatchRowSelector(sno), {
+        timeout: this.timeoutMs
+      });
+    }
+    return rowNumbers;
+  }
+  async getMarketWatchRow(sno) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const row = this.page.locator(marketWatchRowSelector(sno));
+    await this.page.waitForSelector?.(marketWatchRowSelector(sno), {
+      timeout: this.timeoutMs
+    });
+    const committed = this.page.locator(marketWatchCommittedSelector(sno));
+    const committedAttribute = (name2) => committed.getAttribute(name2, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+    const match = (await committedAttribute("data-market-watch-match"))?.trim();
+    const token = (await committedAttribute("data-market-watch-token"))?.trim();
+    const name = (await committedAttribute("data-market-watch-name"))?.trim();
+    const segment = (await committedAttribute("data-market-watch-segment"))?.trim();
+    const draftError = (await this.page.locator(`[data-market-watch-draft-error="${sno}"]`).getAttribute("data-market-watch-draft-error-message", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null))?.trim();
+    const quote = match && token ? await this.readMarketWatchQuote(sno, token) : void 0;
+    return {
+      sno,
+      exchange: await this.page.locator(marketWatchExchangeSelector(sno)).inputValue(),
+      tradingSymbol: await this.page.locator(marketWatchTradingSymbolSelector(sno)).inputValue(),
+      status: toMarketWatchRowStatus(
+        await row.getAttribute("data-market-watch-row-state")
+      ),
+      ...draftError ? { draftError } : {},
+      failureMarked: await row.getAttribute("data-market-watch-row-failure") === "true",
+      ...quote ? { quote } : {},
+      ...match && token ? {
+        instrumentInfo: {
+          match,
+          token,
+          name: name ?? "",
+          segment: segment ?? ""
+        },
+        onTick: (listener) => {
+          const unsubscribe = this.subscribeLiveTicks(sno, token, listener);
+          this.registerCleanup(unsubscribe);
+          return unsubscribe;
+        }
+      } : {}
+    };
+  }
+  async setMarketWatchRow(sno, exchange, tradingSymbol) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(marketWatchExchangeSelector(sno)).selectOption(exchange.trim().toUpperCase());
+    await this.page.locator(marketWatchTradingSymbolSelector(sno)).fill(tradingSymbol);
+  }
+  async applyMarketWatchRow(sno) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(marketWatchApplySelector(sno)).click();
+    await this.waitForMarketWatchRowState(
+      sno,
+      (state) => state === "Error" || state === "Live"
+    );
+  }
+  async clearMarketWatchRow(sno) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(marketWatchClearSelector(sno)).click();
+    await this.waitForMarketWatchRowState(sno, (state) => state === "Empty");
+  }
+  async refresh() {
+    await this.page.reload();
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.waitForSelector?.(MARKET_WATCH_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+  }
+  async waitForAttribute(selector, attribute, predicate, description) {
+    const element = this.page.locator(selector);
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const value = await element.getAttribute(attribute, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+      if (predicate(value)) {
+        return;
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async waitForMarketWatchRowState(sno, predicate) {
+    await this.waitForAttribute(
+      marketWatchRowSelector(sno),
+      "data-market-watch-row-state",
+      predicate,
+      `Market Watch row ${sno} state`
+    );
+  }
+  async readMarketWatchQuote(sno, fallbackToken) {
+    const root = this.page.locator(marketWatchQuoteSelector(sno));
+    const receivedAt = await root.getAttribute("data-market-watch-quote-received-at", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    if (!receivedAt) return void 0;
+    const receivedOn = new Date(receivedAt);
+    if (Number.isNaN(receivedOn.getTime())) {
+      throw new Error(`Market Watch row ${sno} exposed an invalid quote timestamp`);
+    }
+    const exchangeTimestampRaw = await root.getAttribute("data-market-watch-quote-exchange-time", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+    if (exchangeTimestamp && Number.isNaN(exchangeTimestamp.getTime())) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid exchange tick timestamp`
+      );
+    }
+    const timestampStatusRaw = await root.getAttribute("data-market-watch-quote-timestamp-status", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCountRaw = await root.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const updateTypeRaw = await root.getAttribute("data-market-watch-quote-update-type", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCount = Number(missingTimestampCountRaw);
+    if (missingTimestampCountRaw !== null && (!Number.isInteger(missingTimestampCount) || missingTimestampCount < 0)) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid missing timestamp count`
+      );
+    }
+    return {
+      receivedAt: receivedOn,
+      token: (await root.getAttribute("data-market-watch-quote-token", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || fallbackToken,
+      mode: (await root.getAttribute("data-market-watch-quote-mode", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || "full",
+      ...updateTypeRaw === "liveTick" || updateTypeRaw === "quoteSnapshot" || updateTypeRaw === "reconnectSnapshot" ? { latestUpdateType: updateTypeRaw } : {},
+      ...exchangeTimestamp ? { exchangeTimestamp } : {},
+      ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+      ...missingTimestampCountRaw !== null ? { missingExchangeTimestampCount: missingTimestampCount } : {},
+      fields: await this.readQuoteFields(sno)
+    };
+  }
+  async readQuoteFields(sno) {
+    const fields = {};
+    for (const [domField, property] of Object.entries(QUOTE_FIELDS)) {
+      const raw = await this.page.locator(marketWatchQuoteFieldSelector(sno, domField)).getAttribute("data-market-watch-quote-value", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null);
+      if (raw === null || raw.trim() === "") continue;
+      const value = Number(raw);
+      if (!Number.isFinite(value)) {
+        throw new Error(
+          `Market Watch row ${sno} exposed a non-numeric ${domField} quote value`
+        );
+      }
+      fields[property] = value;
+    }
+    return fields;
+  }
+  subscribeLiveTicks(sno, expectedToken, listener) {
+    let stopped = false;
+    let lastFingerprint = "";
+    const poll = async () => {
+      while (!stopped) {
+        const quoteRoot = this.page.locator(marketWatchQuoteSelector(sno));
+        const receivedOnRaw = await quoteRoot.getAttribute("data-market-watch-quote-received-at", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const token = await quoteRoot.getAttribute("data-market-watch-quote-token", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const mode = await quoteRoot.getAttribute("data-market-watch-quote-mode", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const exchangeTimestampRaw = await quoteRoot.getAttribute("data-market-watch-quote-exchange-time", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const timestampStatusRaw = await quoteRoot.getAttribute("data-market-watch-quote-timestamp-status", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const missingTimestampCountRaw = await quoteRoot.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const updateTypeRaw = await quoteRoot.getAttribute("data-market-watch-quote-update-type", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        if (receivedOnRaw && token === expectedToken) {
+          const actualMode = mode?.trim() || "";
+          const fingerprint = `${receivedOnRaw}|${token}|${actualMode}|${updateTypeRaw ?? ""}|${exchangeTimestampRaw ?? ""}|${timestampStatusRaw ?? ""}`;
+          if (fingerprint !== lastFingerprint) {
+            lastFingerprint = fingerprint;
+            const fields = await this.readQuoteFields(sno);
+            const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+            const missingExchangeTimestampCount = Number(
+              missingTimestampCountRaw
+            );
+            const tick = {
+              receivedOn: new Date(receivedOnRaw),
+              token,
+              mode: actualMode,
+              ...exchangeTimestamp && !Number.isNaN(exchangeTimestamp.getTime()) ? { exchangeTimestamp } : {},
+              ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+              ...Number.isInteger(missingExchangeTimestampCount) && missingExchangeTimestampCount >= 0 ? { missingExchangeTimestampCount } : {},
+              ...fields
+            };
+            if (tick.mode === "full" && updateTypeRaw === "liveTick" && timestampStatusRaw === "available" && tick.exchangeTimestamp && typeof tick.lastPrice === "number" && Number.isFinite(tick.lastPrice) && tick.lastPrice > 0) {
+              listener(tick);
+            }
+          }
+        }
+        await sleep(50);
+      }
+    };
+    void poll();
+    return () => {
+      stopped = true;
+    };
+  }
+  async clickLogoutZerodha(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator("[data-operator-info-toggle]").click();
+    onSubmit();
+    await this.page.locator(AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightZerodhaLoginPage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var LoginAttemptError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var PlaywrightZerodhaLoginPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorEgress() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (!await isAttached(
+      this.page,
+      OPERATOR_EGRESS_SELECTOR,
+      "data-operator-egress-value"
+    )) {
+      await this.page.locator(SETTINGS_SELECTOR).click();
+    }
+    await this.page.waitForSelector?.(OPERATOR_EGRESS_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const field = this.page.locator(OPERATOR_EGRESS_SELECTOR);
+    return {
+      publicIp: await field.inputValue(),
+      readOnly: await field.getAttribute("readonly") !== null
+    };
+  }
+  async peekLoginStatus() {
+    return peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      OPERATOR_LOGIN_STATUS_ATTRIBUTE
+    );
+  }
+  async peekLoginMessage() {
+    return await this.peekLoginStatusMessage() ?? await this.peekLoginErrorMessage();
+  }
+  async peekLoginStatusMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async peekLoginErrorMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async waitForLoginStatus(predicate, description) {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      const status = await this.peekLoginStatus();
+      if (predicate(status)) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (status === "failed" || status === null && message) {
+        throw new Error(message ?? "Zerodha Login Attempt failed.");
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async waitForLoginAttempt() {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(
+        this.page,
+        OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+        "data-operator-login-attempt"
+      )) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (message) {
+        throw new Error(message);
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha Login Attempt");
+  }
+  /** Start Zerodha Login Attempt for this Operator Session (always OTP path). */
+  async clickLoginWithZerodha() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (await isAttached(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      "data-operator-login-attempt"
+    )) {
+      return;
+    }
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    await this.waitForLoginAttempt();
+  }
+  async enterOtp(otp) {
+    await this.clickLoginWithZerodha();
+    await this.waitForLoginStatus(
+      (status) => status === "awaiting_otp",
+      "the Zerodha OTP Challenge"
+    );
+    await this.page.locator(OPERATOR_LOGIN_OTP_SELECTOR).fill(otp);
+  }
+  async submitOtp() {
+    const previousStatusMessage = await this.peekLoginStatusMessage();
+    await this.page.locator(OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR).click();
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(this.page, OPERATOR_PAGE_SELECTOR, "data-operator-page")) {
+        return {
+          status: "SUCCESS",
+          operatorPage: new PlaywrightOperatorPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      const status = await this.peekLoginStatus();
+      const errorMessage = await this.peekLoginErrorMessage();
+      if (errorMessage) {
+        return { status: "FAILED", message: errorMessage };
+      }
+      const statusMessage = await this.peekLoginStatusMessage();
+      if (status === "failed") {
+        return {
+          status: "FAILED",
+          message: statusMessage ?? "Zerodha Login Attempt failed."
+        };
+      }
+      if (statusMessage && statusMessage !== previousStatusMessage) {
+        return { status: "FAILED", message: statusMessage };
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP submission result");
+  }
+  async observeLoginAttempt() {
+    if (!this.page.evaluate) throw new Error("Browser inspection is unavailable.");
+    return this.page.evaluate(() => {
+      const attempt = document.querySelector("[data-operator-login-attempt]");
+      const attemptId = attempt?.getAttribute("data-operator-login-attempt-id");
+      if (!attempt || !attemptId) return null;
+      return {
+        attemptId,
+        status: attempt.getAttribute("data-operator-login-status") ?? "unavailable",
+        failedOtpAttempts: Number(attempt.getAttribute("data-operator-login-failed-otp-attempts") ?? 0),
+        submitting: attempt.getAttribute("data-operator-login-submitting-otp") === "true",
+        message: document.querySelector('[data-operator-login-message-kind="error"]')?.getAttribute("data-operator-login-message") ?? null
+      };
+    });
+  }
+  async startLoginAttempt(onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const existing = await this.observeLoginAttempt();
+    let observedId = existing?.attemptId;
+    if (!existing) {
+      await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, { timeout: this.timeoutMs });
+      onSubmit();
+      await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    }
+    while (Date.now() < deadline) {
+      const current = await this.observeLoginAttempt();
+      if (observedId && current?.attemptId !== observedId) throw new LoginAttemptError("attempt_replaced", "The Zerodha Login Attempt was replaced. Inspect the page before starting another attempt.");
+      observedId ??= current?.attemptId;
+      if (current?.status === "awaiting_otp") return current;
+      if (current && !["loading", "awaiting_otp", "succeeded", "failed"].includes(current.status)) throw new LoginAttemptError("attempt_unavailable", "The Zerodha Login Attempt is expired or unavailable. No replacement was started.");
+      if (current?.status === "failed") throw new LoginAttemptError("attempt_failed", "The Zerodha Login Attempt failed. Inspect the visible error before starting another attempt.");
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP Challenge.");
+  }
+  async submitActiveOtp(attemptId, otp, onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const assertActive = async () => {
+      if (Date.now() >= deadline) throw new Error("OTP submission exceeded its deadline before submission.");
+      const current = await this.observeLoginAttempt();
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is unavailable. Inspect the page; no login was started.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The requested OTP Challenge has been replaced. No OTP was submitted.");
+      if (current.status !== "awaiting_otp" || current.submitting) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is expired, failed, or not accepting an OTP.");
+      return current;
+    };
+    const before = await assertActive();
+    const attemptSelector = `[data-operator-login-attempt-id=${JSON.stringify(attemptId)}]`;
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SELECTOR}`).fill(otp);
+    await assertActive();
+    onSubmit();
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR}`).click();
+    while (Date.now() < deadline) {
+      if (await this.page.evaluate?.(() => !!document.querySelector('[data-operator-page="true"]'))) {
+        return { status: "SUCCESS", operatorPage: new PlaywrightOperatorPage(this.page, this.timeoutMs) };
+      }
+      const current = await this.observeLoginAttempt();
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The OTP Challenge disappeared after submission. Inspect the page before taking another action.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The OTP Challenge was replaced after submission. No retry was performed.");
+      if (current.status === "failed") return { status: "FAILED", message: current.message ?? "Zerodha Login Attempt failed." };
+      if (!current.submitting && current.failedOtpAttempts > before.failedOtpAttempts) return { status: "FAILED", message: current.message ?? "OTP rejected." };
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the OTP submission result. No retry was performed.");
+  }
+  async clickLogoutAccount(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    onSubmit();
+    await this.page.locator(UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var PlaywrightHomePage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async enterUsername(username) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_USERNAME_SELECTOR).fill(username);
+  }
+  async enterPassword(password) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_PASSWORD_SELECTOR).fill(password);
+  }
+  async clickConfirm() {
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const credentialsStatus = await peekAttribute(
+        this.page,
+        CREDENTIALS_STATUS_SELECTOR,
+        "data-credentials-status"
+      );
+      if (credentialsStatus === "INCORRECT_CREDENTIALS") {
+        return { status: "INCORRECT_CREDENTIALS" };
+      }
+      if (await isAttached(
+        this.page,
+        ZERODHA_LOGIN_PAGE_SELECTOR,
+        "data-zerodha-login-page"
+      )) {
+        return {
+          status: "SUCCESS",
+          zerodhaLoginPage: new PlaywrightZerodhaLoginPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      await sleep(50);
+    }
+    throw new Error(
+      "Timed out waiting for the Zerodha Login Page after Operator Login confirm"
+    );
+  }
+};
+var PlaywrightCrawler = class {
+  constructor(browser, page, baseUrl, timeoutMs, interactiveLoginTimeoutMs, headless) {
+    this.browser = browser;
+    this.page = page;
+    this.baseUrl = baseUrl;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+  }
+  browser;
+  page;
+  baseUrl;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  cleanups = /* @__PURE__ */ new Set();
+  pageControls;
+  async openHomePage() {
+    await this.page.goto(this.baseUrl);
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      (cleanup) => this.cleanups.add(cleanup)
+    );
+  }
+  controls() {
+    return this.pageControls ??= new PageControls(this.page, this.baseUrl);
+  }
+  getPage() {
+    return this.page;
+  }
+  async close() {
+    for (const cleanup of this.cleanups) {
+      cleanup();
+    }
+    this.cleanups.clear();
+    await this.browser.close();
+  }
+  async forceClose() {
+    if (this.browser.forceClose) {
+      await this.browser.forceClose();
+      return;
+    }
+    await this.browser.close();
+  }
+};
+async function createCrawler(options = {}) {
+  const headless = options.headless ?? true;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const launchTimeoutMs = options.launchTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const interactiveLoginTimeoutMs = options.interactiveLoginTimeoutMs ?? DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS;
+  const browser = await (options.launch ?? (() => chromium.launch({ headless, timeout: launchTimeoutMs })))();
+  const page = await browser.newPage(options.contextOptions);
+  page.setDefaultTimeout?.(timeoutMs);
+  page.setDefaultNavigationTimeout?.(timeoutMs);
+  return new PlaywrightCrawler(
+    browser,
+    page,
+    options.baseUrl ?? DEFAULT_BASE_URL,
+    timeoutMs,
+    interactiveLoginTimeoutMs,
+    headless
+  );
+}
+
+// ../cli/src/sms.ts
+import { spawn } from "node:child_process";
+var SmsReadError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SmsReadError";
+  }
+  code;
+};
+async function readSmsSecret(options) {
+  if (!options.credential.trim()) {
+    throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
+  }
+  if (!options.name.trim() || !options.scope.trim() || !options.endpoint.trim()) {
+    throw new SmsReadError("sms_unavailable", "SMS configuration is incomplete.");
+  }
+  if (options.signal?.aborted) throw new SmsReadError("sms_unavailable", "SMS access was cancelled.");
+  const command = options.command ?? "npx";
+  const args = options.command ? ["read", options.name] : ["--yes", "--package=@ai-digital-factory/sms-cli@0.1.2", "sms", "read", options.name];
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(command, args, {
+        env: {
+          ...process.env,
+          SMS_ENDPOINT: options.endpoint,
+          SMS_CREDENTIAL: options.credential,
+          SMS_SCOPE: options.scope
+        },
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      reject(new SmsReadError("sms_unavailable", "SMS access is unavailable."));
+      return;
+    }
+    const chunks = [];
+    let length = 0;
+    let settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve(result ?? "");
+    };
+    const onAbort = () => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    }, options.timeoutMs ?? 3e4);
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.on("data", (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += buffer.length;
+      if (length > 1048576) {
+        child.kill("SIGTERM");
+        finish(new SmsReadError("sms_unavailable", "SMS returned an oversized secret record."));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    child.on("error", () => finish(new SmsReadError("sms_unavailable", "SMS access is unavailable.")));
+    child.on("close", (code) => {
+      if (code !== 0) {
+        finish(new SmsReadError("sms_unavailable", "SMS access is unavailable for the selected Gate scope."));
+        return;
+      }
+      const value = Buffer.concat(chunks).toString("utf8").trimEnd();
+      if (!value.trim()) {
+        finish(new SmsReadError("sms_unavailable", "SMS returned an empty secret record."));
+        return;
+      }
+      finish(void 0, value);
+    });
+  });
+}
+async function readOperatorLoginCredentials(input) {
+  let raw;
+  try {
+    raw = await (input.secretReader ?? readSmsSecret)({
+      name: "live-market-terminal-operator-directory",
+      scope: input.gateScope,
+      endpoint: input.smsEndpoint,
+      credential: input.smsCredential,
+      ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+      ...input.signal ? { signal: input.signal } : {},
+      ...input.command ? { command: input.command } : {}
+    });
+  } catch (error) {
+    if (error instanceof SmsReadError) throw error;
+    throw new SmsReadError("sms_unavailable", "Operator Directory is unavailable from the selected Gate scope.");
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !("operators" in parsed) || !Array.isArray(parsed.operators)) {
+      throw new Error();
+    }
+    const matches = parsed.operators.filter(
+      (entry2) => entry2 && typeof entry2 === "object" && "operatorId" in entry2 && entry2.operatorId === input.operatorId
+    );
+    if (matches.length !== 1) throw new Error();
+    const entry = matches[0];
+    if (typeof entry.loginUsername !== "string" || !entry.loginUsername.trim() || typeof entry.loginPassword !== "string" || !entry.loginPassword.trim()) throw new Error();
+    return { username: entry.loginUsername.trim(), password: entry.loginPassword };
+  } catch {
+    throw new SmsReadError("invalid_operator_directory", "The selected Gate Operator Directory is invalid or does not contain exactly one configured Operator.");
+  }
+}
+
+// src/operator.ts
+var OperatorActionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+async function operatorLogin(input) {
+  const deadlineAt = Date.now() + input.timeoutMs;
+  const remaining = () => {
+    const timeout = deadlineAt - Date.now();
+    if (timeout < 1) throw new Error("Operator login exceeded its deadline before submission.");
+    return timeout;
+  };
+  let target;
+  try {
+    target = resolveCliTarget({ LMT_ENV: input.environment }, process.env.LMT_WEB_CONFIG_PATH || DEFAULT_CONFIG_PATH2);
+    if (target.origin !== input.origin) throw new Error("The configured Web URL changed. Start a new browser session.");
+  } catch {
+    throw new OperatorActionError("invalid_sms_configuration", "Check smsEndpoint, Gate scope, and OPERATOR_1 in the selected Web configuration, then start a fresh session.");
+  }
+  let credential;
+  try {
+    credential = await new CliProfileStore(void 0, void 0, ".lmt-web").getSmsCredential();
+  } catch {
+    throw new OperatorActionError("sms_credential_unavailable", "Could not read protected SMS storage. Provision the SMS read credential again.");
+  }
+  if (!credential) throw new OperatorActionError("sms_credential_missing", `Provision the SMS read credential with \`lmt-web credential provision --env ${input.environment} --credential-stdin\` before Operator login.`);
+  input.registerSecrets(credential);
+  let credentials;
+  try {
+    credentials = await readOperatorLoginCredentials({
+      operatorId: target.operatorId,
+      gateScope: target.gateScope,
+      smsEndpoint: target.smsEndpoint,
+      smsCredential: credential,
+      timeoutMs: remaining(),
+      ...process.env.LMT_WEB_SMS_COMMAND ? { command: process.env.LMT_WEB_SMS_COMMAND } : {}
+    });
+  } catch (error) {
+    throw new OperatorActionError(error instanceof SmsReadError ? error.code : "sms_unavailable", "Could not load Operator credentials from the selected Gate SMS scope. Check provisioning and SMS reachability.");
+  }
+  input.registerSecrets(credentials.username, credentials.password);
+  const home = new PlaywrightHomePage(input.page, remaining());
+  await home.enterUsername(credentials.username);
+  await home.enterPassword(credentials.password);
+  remaining();
+  input.onSubmit?.();
+  const result = await home.clickConfirm();
+  if (result.status !== "SUCCESS") throw new OperatorActionError("incorrect_credentials", "The Home Page rejected the configured Operator credentials. Check the selected Gate Operator Directory.");
+}
+async function operatorLogout(page, timeoutMs, onSubmit = () => void 0) {
+  const isOperatorPage = await page.evaluate?.(() => !!document.querySelector('[data-operator-page="true"]'));
+  if (isOperatorPage) {
+    await new PlaywrightOperatorPage(page, timeoutMs).clickLogoutZerodha(onSubmit);
+  }
+  await new PlaywrightZerodhaLoginPage(page, timeoutMs).clickLogoutAccount(onSubmit);
+}
+
+// src/session.ts
+var SOCKET_DIRECTORY = path4.join(os.tmpdir(), `lmt-web-${process.getuid?.() ?? "user"}`);
+var SESSION_ID_PATTERN = /^[a-f0-9]{32}$/;
+var OWNER_RESPONSE_GRACE_MS = 1e3;
+var OWNER_CLEANUP_GRACE_MS = 2e3;
+var IPHONE_13_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1";
+function createSessionId() {
+  return randomBytes2(16).toString("hex");
+}
+function isSessionId(value) {
+  return !!value && SESSION_ID_PATTERN.test(value);
+}
+async function ensureSessionDirectory() {
+  if (process.platform === "win32") {
+    throw new Error("lmt-web session sockets are supported on macOS and Linux.");
+  }
+  await mkdir2(SOCKET_DIRECTORY, { recursive: true, mode: 448 });
+  await chmod2(SOCKET_DIRECTORY, 448);
+  const directory = await lstat2(SOCKET_DIRECTORY);
+  const uid = process.getuid?.();
+  if (!directory.isDirectory() || uid !== void 0 && directory.uid !== uid) {
+    throw new Error("The lmt-web session directory is not owned by the invoking user.");
+  }
+}
+function socketPathFor(sessionId) {
+  return path4.join(SOCKET_DIRECTORY, `${sessionId}.sock`);
+}
+function artifactsDirectory(sessionId) {
+  return path4.join(SOCKET_DIRECTORY, "artifacts", sessionId);
+}
+function redactSecrets(value) {
+  return value.replace(
+    /(access[\s_-]*token|request[\s_-]*token|api[\s_-]*(?:secret|key|token)|password|credential|(?:one[-\s]?time[-\s]?password)|otp)(?:\s*[:=]\s*|\s*\n\s*)([^\s,;]+)/gi,
+    "$1: [redacted]"
+  ).replace(/https?:\/\/[^\s)'"<>]+/gi, (candidate) => safeUrl(candidate) ?? "[url]");
+}
+function safeUrl(value) {
+  try {
+    const url = new URL(value);
+    if (!/^https?:$/.test(url.protocol) || url.origin === "null") return null;
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return null;
+  }
+}
+function failureCode(error) {
+  if (error instanceof ControlError) return error.code;
+  const message = error instanceof Error ? error.message : "";
+  if (/timed out|timeout|deadline/i.test(message)) return "deadline_exceeded";
+  if (/executable doesn't exist|browser.*not.*installed|could not find.*browser/i.test(message)) {
+    return "browser_unavailable";
+  }
+  if (/net::ERR_(?:CONNECTION_REFUSED|CONNECTION_TIMED_OUT|NAME_NOT_RESOLVED|ADDRESS_UNREACHABLE|INTERNET_DISCONNECTED|EMPTY_RESPONSE)/i.test(message)) {
+    return "service_unavailable";
+  }
+  return "action_failed";
+}
+function messageFor(error) {
+  const message = error instanceof Error ? error.message : "The browser action failed.";
+  return redactSecrets(message).slice(0, 500);
+}
+function deviceContext(mode) {
+  if (mode === "mobile") {
+    return {
+      name: "iPhone 13",
+      contextOptions: {
+        viewport: { width: 390, height: 844 },
+        deviceScaleFactor: 3,
+        isMobile: true,
+        hasTouch: true,
+        userAgent: IPHONE_13_USER_AGENT
+      }
+    };
+  }
+  return {
+    name: "Desktop",
+    contextOptions: {
+      viewport: { width: 1440, height: 900 },
+      deviceScaleFactor: 1,
+      isMobile: false,
+      hasTouch: false
+    }
+  };
+}
+async function launchSessionBrowser(headless, deadlineAt, onServerReady, onBrowserClosed) {
+  const browserServer = await chromium2.launchServer({
+    headless,
+    timeout: Math.max(1, deadlineAt - Date.now())
+  });
+  let forceClosePromise;
+  const forceClose = () => {
+    forceClosePromise ??= browserServer.kill();
+    return forceClosePromise;
+  };
+  onServerReady(forceClose);
+  try {
+    const connectTimeoutMs = Math.max(1, deadlineAt - Date.now());
+    if (deadlineAt <= Date.now()) throw new Error("The browser action exceeded its deadline.");
+    const browser = await chromium2.connect(browserServer.wsEndpoint(), { timeout: connectTimeoutMs });
+    browser.once("disconnected", onBrowserClosed);
+    let closePromise;
+    return {
+      newPage: async (options) => {
+        const page = await browser.newPage(options);
+        page.once("close", onBrowserClosed);
+        return page;
+      },
+      close: () => {
+        closePromise ??= (async () => {
+          let closeError;
+          try {
+            await browser.close();
+          } catch (error) {
+            closeError = error;
+          }
+          try {
+            await browserServer.close();
+          } catch (error) {
+            closeError ??= error;
+          }
+          if (closeError) throw closeError;
+        })();
+        return closePromise;
+      },
+      forceClose
+    };
+  } catch (error) {
+    await forceClose().catch(() => void 0);
+    throw error;
+  }
+}
+async function waitForRenderedPage(page) {
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  let settled = false;
+  while (true) {
+    const ready = await page.evaluate(() => {
+      const visible = (element) => {
+        const rect = element.getBoundingClientRect();
+        const style = getComputedStyle(element);
+        return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+      };
+      const loading = Array.from(document.querySelectorAll('[data-session-loading], [aria-busy="true"]')).some(visible);
+      const animating = document.getAnimations().some(
+        (animation) => (animation.pending || animation.playState === "running") && Number.isFinite(Number(animation.effect?.getComputedTiming().endTime))
+      );
+      const imagesPending = Array.from(document.images).some((image) => visible(image) && !image.complete);
+      return document.readyState === "complete" && document.fonts.status === "loaded" && !!document.body && !loading && !animating && !imagesPending;
+    });
+    if (ready && settled) return;
+    settled = ready;
+    await wait(50);
+  }
+}
+async function inspectPage(page, mode, crawler) {
+  await waitForRenderedPage(page);
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  const result = await page.evaluate(() => {
+    const visible = (element) => {
+      const rect = element.getBoundingClientRect();
+      const style = getComputedStyle(element);
+      return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+    };
+    const controls2 = Array.from(
+      document.querySelectorAll("button, a[href], input, select, textarea, [role=button]")
+    ).filter(visible).slice(0, 100).map((element, index) => {
+      const labels = element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement ? Array.from(element.labels ?? []).map((item) => item.innerText).join(" ") : "";
+      const label = element.getAttribute("aria-label") || element.getAttribute("title") || labels || (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement ? element.placeholder : "") || (element instanceof HTMLSelectElement ? element.selectedOptions[0]?.innerText : "") || element.textContent || "";
+      const kind = element.getAttribute("role") || element.tagName.toLowerCase();
+      return {
+        reference: `control-${index + 1}`,
+        kind,
+        label: label.replace(/\s+/g, " ").trim().slice(0, 160)
+      };
+    });
+    return {
+      title: document.title,
+      text: document.body?.innerText ?? "",
+      controls: controls2,
+      viewport: { width: window.innerWidth, height: window.innerHeight },
+      deviceScaleFactor: window.devicePixelRatio,
+      hasTouch: navigator.maxTouchPoints > 0,
+      userAgent: navigator.userAgent
+    };
+  });
+  const controls = crawler ? await crawler.controls().inspect() : result.controls;
+  const redact = (value) => redactSecrets(crawler?.controls().redact(value) ?? value);
+  const viewport = page.viewportSize?.() ?? result.viewport;
+  return {
+    url: safeUrl(redact(page.url())),
+    visibleState: {
+      title: redact(result.title).slice(0, 300),
+      text: redact(result.text).slice(0, 4e3),
+      controls: controls.map((control) => ({ ...control, label: redact(control.label) }))
+    },
+    device: {
+      name: deviceContext(mode).name,
+      mode,
+      viewport,
+      deviceScaleFactor: result.deviceScaleFactor,
+      hasTouch: result.hasTouch,
+      userAgent: redactSecrets(result.userAgent).slice(0, 300)
+    }
+  };
+}
+async function captureScreenshot(page, sessionId, action, fullPage, timeoutMs, onTimeout) {
+  if (!page) return { outcome: "unavailable", reason: "No browser page was available." };
+  if (!page.screenshot) return { outcome: "failed", error: "The browser does not support screenshots." };
+  const directory = artifactsDirectory(sessionId);
+  const filename = `${Date.now()}-${action}-${randomBytes2(4).toString("hex")}.png`;
+  const screenshotPath = path4.resolve(directory, filename);
+  if (timeoutMs < 1) {
+    return { outcome: "failed", error: "The action deadline elapsed before screenshot capture." };
+  }
+  try {
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    await chmod2(directory, 448);
+    await withDeadline(
+      (async () => {
+        await waitForRenderedPage(page);
+        return page.screenshot({
+          path: screenshotPath,
+          fullPage,
+          animations: "disabled",
+          timeout: timeoutMs
+        });
+      })(),
+      timeoutMs,
+      onTimeout
+    );
+    await chmod2(screenshotPath, 384);
+    return { outcome: "captured", path: screenshotPath, fullPage };
+  } catch (error) {
+    await unlink2(screenshotPath).catch(() => void 0);
+    return { outcome: "failed", error: messageFor(error) };
+  }
+}
+function remainingMs(deadlineAt) {
+  return Math.max(0, deadlineAt - Date.now());
+}
+function withDeadline(promise, timeoutMs, onTimeout) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      callback();
+    };
+    const timeout = setTimeout(() => {
+      onTimeout?.();
+      finish(() => reject(new Error("The browser action exceeded its deadline.")));
+    }, Math.max(1, timeoutMs));
+    promise.then(
+      (value) => finish(() => resolve(value)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+async function runSessionOwner(options) {
+  await ensureSessionDirectory();
+  const socketPath = socketPathFor(options.sessionId);
+  const device = deviceContext(options.mode);
+  let crawler;
+  let page;
+  let startupError;
+  let startComplete = false;
+  let closing = false;
+  let abortOnShutdown = false;
+  let operationQueue = Promise.resolve();
+  let shutdownPromise;
+  let initializationPromise;
+  let crawlerClosePromise;
+  let expirationCleanup;
+  let forceClosePendingBrowser;
+  let pendingBrowserForceClosePromise;
+  const sockets = /* @__PURE__ */ new Set();
+  function closeCrawler() {
+    if (!crawler) return Promise.resolve();
+    crawlerClosePromise ??= crawler.close();
+    return crawlerClosePromise;
+  }
+  function forceCloseBrowser() {
+    if (crawler?.forceClose) return crawler.forceClose();
+    if (!forceClosePendingBrowser) return Promise.resolve();
+    pendingBrowserForceClosePromise ??= forceClosePendingBrowser();
+    return pendingBrowserForceClosePromise;
+  }
+  function expireSession() {
+    closing = true;
+    abortOnShutdown = true;
+    expirationCleanup ??= (async () => {
+      if (initializationPromise) {
+        await Promise.race([
+          initializationPromise,
+          wait(OWNER_CLEANUP_GRACE_MS)
+        ]).catch(() => void 0);
+      }
+      if (crawler) await closeCrawler();
+      else await forceCloseBrowser();
+    })();
+    void expirationCleanup.catch(() => void 0);
+  }
+  const server = net.createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    let payload = "";
+    let handled = false;
+    socket.on("data", (chunk) => {
+      if (handled) return;
+      payload += chunk.toString("utf8");
+      const newline = payload.indexOf("\n");
+      if (newline < 0) return;
+      handled = true;
+      const line = payload.slice(0, newline);
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        socket.end(`${JSON.stringify(failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId))}
+`);
+        return;
+      }
+      const run = async () => {
+        const response = await handleRequest(request);
+        socket.end(`${JSON.stringify(response)}
+`);
+        if (closing) socket.once("close", () => void shutdown());
+      };
+      operationQueue = operationQueue.then(run, run).catch(() => void 0);
+    });
+  });
+  async function initialize(deadlineAt) {
+    try {
+      crawler = await createCrawler({
+        baseUrl: options.origin,
+        headless: options.headless,
+        timeoutMs: Math.min(options.timeoutMs, Math.max(1, remainingMs(deadlineAt))),
+        contextOptions: device.contextOptions,
+        launch: () => {
+          const onServerReady = (forceClose) => {
+            forceClosePendingBrowser = forceClose;
+            if (abortOnShutdown) void forceCloseBrowser().catch(() => void 0);
+          };
+          return options.launch ? options.launch(deadlineAt, onServerReady) : launchSessionBrowser(options.headless, deadlineAt, onServerReady, () => {
+            if (closing) return;
+            closing = true;
+            abortOnShutdown = true;
+            void shutdown();
+          });
+        }
+      });
+      page = crawler.getPage();
+      if (closing) {
+        await closeCrawler();
+        return;
+      }
+      await crawler.openHomePage();
+    } catch (error) {
+      startupError = error;
+    }
+  }
+  async function handleRequest(request) {
+    if (!request || request.sessionId !== options.sessionId || !isAction(request.action) || !Number.isFinite(request.timeoutMs) || request.timeoutMs < 1 || !Number.isFinite(request.deadlineAt)) {
+      return failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId);
+    }
+    const deadlineAt = request.deadlineAt;
+    if (remainingMs(deadlineAt) === 0) {
+      return failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", options.sessionId);
+    }
+    if (request.action === "start" && startComplete) {
+      return failureResult("start", "session_already_started", "This browser session has already started.", options.sessionId);
+    }
+    if (!startComplete && request.action !== "start") {
+      return failureResult(request.action, "session_starting", "The browser session is not ready yet.", options.sessionId);
+    }
+    if (request.action === "stop") {
+      closing = true;
+      abortOnShutdown = true;
+      try {
+        crawlerClosePromise = forceCloseBrowser();
+        await withDeadline(crawlerClosePromise, remainingMs(deadlineAt), expireSession);
+        return {
+          version: RESULT_VERSION,
+          sessionId: options.sessionId,
+          action: "stop",
+          outcome: "success",
+          url: null,
+          visibleState: null,
+          device: null,
+          screenshot: { outcome: "unavailable", reason: "Stop terminates the browser without capturing a screenshot." }
+        };
+      } catch (error2) {
+        return failureResult("stop", failureCode(error2), messageFor(error2), options.sessionId);
+      }
+    }
+    if (!startComplete) {
+      initializationPromise ??= initialize(deadlineAt);
+      try {
+        await withDeadline(initializationPromise, remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        startupError = error2;
+      }
+    }
+    if (request.action === "start") {
+      startComplete = true;
+      let inspectionError;
+      const inspected2 = page && !startupError && remainingMs(deadlineAt) > 0 ? await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession).catch((error2) => {
+        inspectionError = error2;
+        return null;
+      }) : null;
+      const screenshot2 = startupError || inspectionError ? { outcome: "unavailable", reason: "The page did not finish loading and inspection." } : await captureScreenshot(
+        page,
+        options.sessionId,
+        "start",
+        false,
+        remainingMs(deadlineAt),
+        expireSession
+      );
+      const actionError2 = startupError ?? inspectionError;
+      const result = {
+        version: RESULT_VERSION,
+        sessionId: options.sessionId,
+        action: "start",
+        outcome: actionError2 ? "failure" : "success",
+        url: inspected2?.url ?? (startupError ? safeUrl(options.origin) : page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+        visibleState: inspected2?.visibleState ?? null,
+        device: inspected2?.device ?? null,
+        screenshot: screenshot2,
+        ...startupError ? {
+          error: {
+            code: failureCode(startupError),
+            message: page ? failureCode(startupError) === "service_unavailable" ? "Could not load the configured Web URL. Confirm that the selected service is running and reachable." : failureCode(startupError) === "deadline_exceeded" ? "Opening the Home Page exceeded its deadline. Start a fresh session and retry." : messageFor(startupError) : failureCode(startupError) === "browser_unavailable" ? "Could not launch the browser. Install its Chromium runtime with `lmt-web install-browser` and retry." : messageFor(startupError)
+          }
+        } : inspectionError ? {
+          error: {
+            code: failureCode(inspectionError),
+            message: "The Home Page loaded but its visible state could not be inspected."
+          }
+        } : {}
+      };
+      if (startupError) {
+        closing = true;
+      }
+      return result;
+    }
+    if (startupError || !crawler || !page) {
+      return failureResult(request.action, "session_unavailable", "The browser session is no longer available. Start a new session.", options.sessionId);
+    }
+    let guidedError;
+    let submitted = false;
+    const actionDeadlineAt = deadlineAt - Math.min(1500, Math.floor(remainingMs(deadlineAt) / 4));
+    let actionTimedOut = false;
+    const actionTimeout = () => Math.max(1, remainingMs(actionDeadlineAt));
+    const actionExpired = () => {
+      actionTimedOut = true;
+    };
+    page.setDefaultTimeout?.(actionTimeout());
+    page.setDefaultNavigationTimeout?.(actionTimeout());
+    let loginAttempt;
+    const onSubmit = () => {
+      submitted = true;
+    };
+    const zerodha = new PlaywrightZerodhaLoginPage(page, actionTimeout());
+    try {
+      if (request.action === "operator-login") await withDeadline(operatorLogin({ page, environment: options.environment ?? "local", origin: options.origin, timeoutMs: actionTimeout(), onSubmit, registerSecrets: (...values) => crawler.controls().registerSecrets(...values) }), actionTimeout(), actionExpired);
+      if (request.action === "operator-logout") await withDeadline(operatorLogout(page, actionTimeout(), onSubmit), actionTimeout(), actionExpired);
+      if (request.action === "zerodha-login") loginAttempt = await withDeadline(zerodha.startLoginAttempt(onSubmit), actionTimeout(), actionExpired);
+      if (request.action === "zerodha-otp") {
+        if (!request.attemptId || !request.otp || !/^\d{6}$/.test(request.otp)) throw new OperatorActionError("invalid_otp", "Supply a six-digit OTP and the attempt ID returned by zerodha-login.");
+        crawler.controls().registerSecrets(request.otp);
+        const result = await withDeadline(zerodha.submitActiveOtp(request.attemptId, request.otp, onSubmit), actionTimeout(), actionExpired);
+        if (result.status !== "SUCCESS") throw new OperatorActionError("otp_rejected", result.message);
+      }
+      if (request.action === "zerodha-logout") await withDeadline(new PlaywrightOperatorPage(page, actionTimeout()).clickLogoutZerodha(onSubmit), actionTimeout(), actionExpired);
+    } catch (error2) {
+      guidedError = error2;
+    }
+    let inspected = null;
+    let actionError;
+    try {
+      if (isControlAction(request)) {
+        const budget = Math.max(1, remainingMs(deadlineAt) - Math.min(2e3, request.timeoutMs / 4));
+        await withDeadline(crawler.controls().act(request, budget, () => {
+          submitted = true;
+        }), budget, () => void 0);
+      }
+    } catch (error2) {
+      actionError = request.action === "click" && submitted && failureCode(error2) === "deadline_exceeded" ? new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.") : error2;
+      if (request.action === "click" && failureCode(actionError) === "action_uncertain") {
+        await withDeadline(crawler.controls().stopLoading(), Math.min(500, remainingMs(deadlineAt))).catch(() => void 0);
+      }
+    }
+    try {
+      inspected = await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession);
+    } catch (error2) {
+      actionError ??= error2;
+    }
+    const screenshot = await captureScreenshot(
+      page,
+      options.sessionId,
+      request.action,
+      request.fullPage === true,
+      remainingMs(deadlineAt),
+      expireSession
+    );
+    let closeError;
+    if (request.action === "close") {
+      closing = true;
+      try {
+        await withDeadline(closeCrawler(), remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        closeError = error2;
+        if (!abortOnShutdown) {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      }
+    }
+    if (actionTimedOut) closing = true;
+    const error = guidedError ?? actionError ?? closeError;
+    return {
+      version: RESULT_VERSION,
+      sessionId: options.sessionId,
+      action: request.action,
+      outcome: error instanceof ControlError && error.code === "action_uncertain" ? "uncertain" : error ? submitted && !(error instanceof OperatorActionError) && !(error instanceof LoginAttemptError) ? "uncertain" : "failure" : "success",
+      ...loginAttempt ? { loginAttempt: { attemptId: loginAttempt.attemptId, status: loginAttempt.status } } : {},
+      url: inspected?.url ?? (page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+      visibleState: inspected?.visibleState ?? null,
+      device: inspected?.device ?? null,
+      screenshot,
+      ...error ? { error: { code: error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.code : failureCode(error), message: crawler.controls().redact(error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.message : messageFor(error)) } } : {}
+    };
+  }
+  function shutdown() {
+    if (!closing) return Promise.resolve();
+    if (shutdownPromise) return shutdownPromise;
+    shutdownPromise = (async () => {
+      for (const socket of sockets) socket.destroy();
+      await unlink2(socketPath).catch(() => void 0);
+      server.close();
+      if (abortOnShutdown) {
+        const cleanup = crawler ? closeCrawler() : forceClosePendingBrowser ? forceCloseBrowser() : expirationCleanup ?? Promise.resolve();
+        let cleanupFinished = false;
+        let cleanupFailed = false;
+        const observedCleanup = cleanup.then(
+          () => {
+            cleanupFinished = true;
+          },
+          () => {
+            cleanupFinished = true;
+            cleanupFailed = true;
+          }
+        );
+        await Promise.race([observedCleanup, wait(OWNER_CLEANUP_GRACE_MS)]);
+        if (!cleanupFinished || cleanupFailed) {
+          await forceCloseBrowser().catch(() => void 0);
+        }
+        (options.exit ?? process.exit)(0);
+        return;
+      }
+      if (crawler) {
+        try {
+          await closeCrawler();
+        } catch {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      } else if (forceClosePendingBrowser) {
+        await forceCloseBrowser().catch(() => void 0);
+      }
+      process.removeListener("SIGTERM", onSignal);
+      process.removeListener("SIGINT", onSignal);
+    })();
+    return shutdownPromise;
+  }
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.removeListener("error", reject);
+      void chmod2(socketPath, 384).then(resolve, reject);
+    });
+  });
+  const onSignal = () => {
+    closing = true;
+    void shutdown();
+  };
+  process.once("SIGTERM", onSignal);
+  process.once("SIGINT", onSignal);
+}
+async function wait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function assertOwnedSocket(socketPath) {
+  return lstat2(socketPath).then((entry) => {
+    const uid = process.getuid?.();
+    if (!entry.isSocket() || uid !== void 0 && entry.uid !== uid) {
+      throw new Error("The lmt-web session socket is not owned by the invoking user.");
+    }
+  });
+}
+async function requestSession(request, options = {}) {
+  if (!isSessionId(request.sessionId)) {
+    return failureResult(request.action, "invalid_session_id", "A valid session ID is required.", request.sessionId || null);
+  }
+  const socketPath = socketPathFor(request.sessionId);
+  const deadlineAt = Date.now() + request.timeoutMs;
+  const wireRequest = { ...request, deadlineAt };
+  if (options.waitForSocket) {
+    let ready = false;
+    while (Date.now() < deadlineAt) {
+      try {
+        await assertOwnedSocket(socketPath);
+        ready = true;
+        break;
+      } catch {
+        if (options.ownerAlive && !options.ownerAlive()) {
+          return failureResult(request.action, "browser_start_failed", "The browser session owner exited before it became ready.", request.sessionId);
+        }
+        await wait(40);
+      }
+    }
+    if (!ready) {
+      return failureResult(request.action, "deadline_exceeded", "The browser session did not become ready before its deadline.", request.sessionId);
+    }
+  }
+  try {
+    await assertOwnedSocket(socketPath);
+  } catch {
+    return failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId);
+  }
+  return new Promise((resolve) => {
+    const socket = net.createConnection(socketPath);
+    let received = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      finish(failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", request.sessionId));
+    }, Math.max(1, deadlineAt + OWNER_RESPONSE_GRACE_MS - Date.now()));
+    socket.once("connect", () => socket.write(`${JSON.stringify(wireRequest)}
+`));
+    socket.on("data", (chunk) => {
+      received += chunk.toString("utf8");
+      const newline = received.indexOf("\n");
+      if (newline < 0) return;
+      try {
+        finish(JSON.parse(received.slice(0, newline)));
+      } catch {
+        finish(failureResult(request.action, "invalid_response", "The browser session returned an invalid result.", request.sessionId));
+      }
+    });
+    socket.once("error", () => {
+      finish(failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId));
+    });
+    socket.once("close", () => {
+      if (!settled) {
+        finish(failureResult(request.action, "session_not_found", "The browser session closed before returning a result.", request.sessionId));
+      }
+    });
+  });
+}
+
+// src/index.ts
+var DEFAULT_TIMEOUT_MS2 = 3e4;
+var MAX_TIMEOUT_MS = 10 * 6e4;
+var HELP = `lmt-web \u2014 browser interaction with Live Market Terminal Web
+
+Usage:
+  lmt-web install-browser [--with-deps] [--dry-run]
+  lmt-web start --env local|dev [--device mobile|desktop] [--headed] [--timeout 30s]
+  lmt-web inspect --session ID [--full-page] [--timeout 30s]
+  lmt-web click --session ID --ref REF
+  lmt-web fill --session ID --ref REF --value TEXT [--secret]
+  lmt-web select --session ID --ref REF --value OPTION
+  lmt-web scroll --session ID [--ref REF] [--x PIXELS] [--y PIXELS]
+  lmt-web navigate --session ID --url PATH_OR_URL
+  lmt-web zerodha-login --session ID [--timeout 30s]
+  lmt-web zerodha-otp --session ID --attempt ID --stdin [--timeout 30s]
+  lmt-web zerodha-logout --session ID [--timeout 30s]
+  lmt-web operator-login --session ID [--timeout 30s]
+  lmt-web operator-logout --session ID [--timeout 30s]
+  lmt-web credential provision --env local|dev --credential-stdin
+  lmt-web close --session ID [--full-page] [--timeout 30s]
+  lmt-web stop --session ID [--timeout 30s]
+
+Start opens the configured Home Page in a fresh browser session. Mobile emulation
+and headless mode are the defaults. Inspect and close require the returned session ID.
+Stop terminates the session's browser and owner without capturing a final screenshot.
+Each command writes one versioned JSON result to stdout; diagnostics go to stderr.
+`;
+function parseTimeout(value) {
+  const match = /^(\d+)(ms|s|m)?$/i.exec(value);
+  if (!match) throw new InvocationError("--timeout must be a positive duration such as 30s, 500ms, or 2m.");
+  const number = Number(match[1]);
+  const multiplier = match[2]?.toLowerCase() === "m" ? 6e4 : match[2]?.toLowerCase() === "s" ? 1e3 : 1;
+  const timeoutMs = number * multiplier;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_TIMEOUT_MS) {
+    throw new InvocationError("--timeout must be between 1ms and 10m.");
+  }
+  return timeoutMs;
+}
+async function parseCommand(argv) {
+  const valueOptions = /* @__PURE__ */ new Set(["--timeout", "--session", ...Object.values(ACTIONS).flatMap((definition2) => definition2.values)]);
+  const flagOptions = /* @__PURE__ */ new Set(["--full-page", ...Object.values(ACTIONS).flatMap((definition2) => definition2.flags)]);
+  let actionIndex = 0;
+  while (argv[actionIndex]?.startsWith("--")) {
+    const option = argv[actionIndex];
+    if (flagOptions.has(option)) {
+      actionIndex += 1;
+    } else if (valueOptions.has(option)) {
+      const value = argv[actionIndex + 1];
+      if (value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires a value.`);
+      actionIndex += 2;
+    } else {
+      throw new InvocationError(`Unknown option: ${option}`);
+    }
+  }
+  const action = argv[actionIndex];
+  if (!isAction(action)) throw new InvocationError("Choose a supported browser command. Run `lmt-web --help` for usage.");
+  const rest = [...argv.slice(0, actionIndex), ...argv.slice(actionIndex + 1)];
+  const definition = ACTIONS[action];
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const allowedFlags = /* @__PURE__ */ new Set([...action === "start" || action === "stop" ? [] : ["--full-page"], ...definition.flags]);
+  const allowedValues = /* @__PURE__ */ new Set(["--timeout", ...action === "start" ? [] : ["--session"], ...definition.values]);
+  for (let index = 0; index < rest.length; index += 1) {
+    const option = rest[index];
+    if (!option.startsWith("--")) throw new InvocationError("Unexpected positional argument.");
+    if (allowedFlags.has(option)) {
+      if (flags.has(option)) throw new InvocationError(`${option} may only be supplied once.`);
+      flags.add(option);
+      continue;
+    }
+    if (!allowedValues.has(option)) throw new InvocationError(`Unknown option: ${option}`);
+    if (values.has(option)) throw new InvocationError(`${option} may only be supplied once.`);
+    const value = rest[index + 1];
+    if (value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires a value.`);
+    values.set(option, value);
+    index += 1;
+  }
+  const timeoutMs = values.has("--timeout") ? parseTimeout(values.get("--timeout")) : DEFAULT_TIMEOUT_MS2;
+  if (action === "start") {
+    const mode = values.get("--device") ?? "mobile";
+    if (mode !== "mobile" && mode !== "desktop") {
+      throw new InvocationError("--device must be mobile or desktop.");
+    }
+    return {
+      action,
+      environment: values.get("--env") ?? "",
+      mode,
+      headless: !flags.has("--headed"),
+      timeoutMs
+    };
+  }
+  const sessionId = values.get("--session");
+  if (!isSessionId(sessionId)) {
+    throw new InvocationError("--session requires the 32-character session ID returned by start.", "invalid_session_id");
+  }
+  let payload;
+  try {
+    payload = await definition.build({ values, flags, readOtp: () => readOtp(timeoutMs) });
+  } catch (error) {
+    throw new InvocationError(error instanceof Error ? error.message : "The action input could not be read.", error instanceof InvocationError ? error.code : "action_failed", action);
+  }
+  if (payload.action === "start") throw new InvocationError("Start requires an environment.");
+  return { ...payload, sessionId, fullPage: flags.has("--full-page"), timeoutMs };
+}
+function emit(result, diagnostic) {
+  process.stdout.write(`${JSON.stringify(result)}
+`);
+  if (diagnostic) process.stderr.write(`${diagnostic}
+`);
+}
+async function readOtp(timeoutMs) {
+  let input = "";
+  const timer = setTimeout(() => process.stdin.destroy(new Error("OTP input exceeded its deadline.")), timeoutMs);
+  try {
+    for await (const chunk of process.stdin) {
+      input += chunk.toString();
+      if (input.length > 64) throw new InvocationError("OTP must contain six digits.");
+    }
+    const otp = input.trim();
+    if (!/^\d{6}$/.test(otp)) throw new InvocationError("OTP must contain six digits.");
+    return otp;
+  } finally {
+    input = "";
+    clearTimeout(timer);
+  }
+}
+async function startSession(command) {
+  let target;
+  try {
+    target = resolveWebTarget(command.environment);
+  } catch (error) {
+    throw new InvocationError(error instanceof Error ? error.message : "The selected target is invalid.", "invalid_target");
+  }
+  await ensureSessionDirectory();
+  const sessionId = createSessionId();
+  const scriptPath = path5.resolve(process.argv[1] || fileURLToPath3(import.meta.url));
+  const child = spawn2(
+    process.execPath,
+    [
+      scriptPath,
+      "__owner",
+      sessionId,
+      target.origin,
+      command.mode,
+      command.headless ? "headless" : "headed",
+      String(command.timeoutMs),
+      target.environment
+    ],
+    {
+      detached: true,
+      stdio: "ignore"
+    }
+  );
+  let ownerAlive = true;
+  child.once("error", () => {
+    ownerAlive = false;
+  });
+  child.once("exit", () => {
+    ownerAlive = false;
+  });
+  child.unref();
+  const result = await requestSession({ sessionId, action: "start", timeoutMs: command.timeoutMs }, {
+    waitForSocket: true,
+    ownerAlive: () => ownerAlive
+  });
+  if (result.outcome === "failure" && result.error?.code === "deadline_exceeded") {
+    try {
+      process.kill(child.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  return result;
+}
+async function runOwner(argv) {
+  const [sessionId, origin, modeValue, headlessValue, timeoutValue, environment] = argv;
+  if (!isSessionId(sessionId) || !origin || modeValue !== "mobile" && modeValue !== "desktop" || headlessValue !== "headless" && headlessValue !== "headed" || !timeoutValue || !/^\d+$/.test(timeoutValue)) {
+    process.exitCode = 2;
+    return;
+  }
+  await runSessionOwner({
+    sessionId,
+    origin,
+    environment: environment === "dev" ? "dev" : "local",
+    mode: modeValue,
+    headless: headlessValue === "headless",
+    timeoutMs: Math.min(Number(timeoutValue), MAX_TIMEOUT_MS)
+  });
+}
+async function installBrowser(options) {
+  const allowed = /* @__PURE__ */ new Set(["--with-deps", "--dry-run"]);
+  if (options.some((option) => !allowed.has(option)) || new Set(options).size !== options.length) {
+    process.stdout.write(`${JSON.stringify({ version: 1, action: "install-browser", outcome: "failure", error: { code: "invalid_invocation", message: "Use install-browser [--with-deps] [--dry-run]." } })}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    const require2 = createRequire(import.meta.url);
+    const browserCli = path5.join(path5.dirname(require2.resolve("playwright/package.json")), "cli.js");
+    const code = await new Promise((resolve, reject) => {
+      const child = spawn2(process.execPath, [browserCli, "install", ...options, "chromium"], {
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      child.stdout.pipe(process.stderr);
+      child.stderr.pipe(process.stderr);
+      child.once("error", reject);
+      child.once("close", (status) => resolve(status ?? 1));
+    });
+    process.stdout.write(`${JSON.stringify({ version: 1, action: "install-browser", outcome: code === 0 ? "success" : "failure", ...code === 0 ? {} : { error: { code: "browser_install_failed", message: "Chromium setup failed. Review stderr and retry install-browser." } } })}
+`);
+    process.exitCode = code;
+  } catch {
+    process.stdout.write(`${JSON.stringify({ version: 1, action: "install-browser", outcome: "failure", error: { code: "browser_install_failed", message: "Could not run the installed Playwright runtime. Reinstall lmt-web and retry." } })}
+`);
+    process.exitCode = 1;
+  }
+}
+async function runCli(argv) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(HELP);
+    return;
+  }
+  if (argv[0] === "install-browser" && !argv.includes("--help") && !argv.includes("-h")) {
+    await installBrowser(argv.slice(1));
+    return;
+  }
+  if (argv[0] === "credential" && argv[1] === "provision") {
+    let credential = "";
+    const timer = setTimeout(() => process.stdin.destroy(new Error("Credential input exceeded its deadline.")), DEFAULT_TIMEOUT_MS2);
+    try {
+      const values = /* @__PURE__ */ new Map();
+      let credentialStdin = false;
+      const legacyStdin = argv.length === 3 && argv[2] === "--stdin";
+      if (!legacyStdin) {
+        for (let index = 2; index < argv.length; index += 1) {
+          const option = argv[index];
+          if (option === "--credential-stdin") {
+            if (credentialStdin) throw new InvocationError("--credential-stdin may only be supplied once.");
+            credentialStdin = true;
+          } else if (option === "--env") {
+            const value = argv[index + 1];
+            if (values.has(option) || value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires exactly one value.`);
+            values.set(option, value);
+            index += 1;
+          } else throw new InvocationError("Use credential provision --env local|dev --credential-stdin. Web CLI does not support profiles.");
+        }
+        if (!credentialStdin || !values.get("--env")) throw new InvocationError("Credential provision requires --env local|dev and --credential-stdin.");
+        try {
+          resolveCliTarget({ LMT_ENV: values.get("--env") }, process.env.LMT_WEB_CONFIG_PATH || DEFAULT_CONFIG_PATH2);
+        } catch {
+          throw new InvocationError("Choose a configured local or dev environment.", "invalid_target");
+        }
+      }
+      if (process.stdin.isTTY) throw new InvocationError("Pipe the SMS credential on standard input.");
+      for await (const chunk of process.stdin) {
+        credential += chunk.toString();
+        if (credential.length > 16384) throw new Error("SMS credential input is too long.");
+      }
+      await new CliProfileStore(void 0, void 0, ".lmt-web").saveSmsCredential(credential.replace(/\r?\n$/, ""));
+      process.stdout.write(`${JSON.stringify({ version: 1, action: "credential-provision", outcome: "success", ...legacyStdin ? {} : { environment: values.get("--env") } })}
+`);
+    } catch (error) {
+      const code = error instanceof InvocationError ? error.code : "credential_provision_failed";
+      const message = error instanceof InvocationError ? error.message : "Could not save the SMS read credential. Supply one non-empty line on stdin and check protected storage permissions.";
+      process.stdout.write(`${JSON.stringify({ version: 1, action: "credential-provision", outcome: "failure", error: { code, message } })}
+`);
+      process.stderr.write(`${code}: ${message}
+`);
+      process.exitCode = error instanceof InvocationError ? 2 : 1;
+    } finally {
+      credential = "";
+      clearTimeout(timer);
+    }
+    return;
+  }
+  if (argv[0] === "__owner") {
+    await runOwner(argv.slice(1));
+    return;
+  }
+  let command;
+  try {
+    command = await parseCommand(argv);
+    let result;
+    if (command.action === "start") {
+      result = await startSession(command);
+    } else {
+      result = await requestSession(command);
+    }
+    emit(result, result.error ? `${result.error.code}: ${result.error.message}` : void 0);
+    if (result.outcome !== "success") {
+      process.exitCode = result.error?.code === "invalid_target" || result.error?.code === "invalid_invocation" ? 2 : 1;
+    }
+  } catch (error) {
+    const action = command?.action ?? (error instanceof InvocationError ? error.action : void 0) ?? (argv[0] === "inspect" || argv[0] === "close" ? argv[0] : "start");
+    const code = error instanceof InvocationError ? error.code : "action_failed";
+    const message = error instanceof Error ? error.message : "The lmt-web command failed.";
+    const result = failureResult(action, code, message);
+    emit(result, `${code}: ${message}`);
+    process.exitCode = error instanceof InvocationError && error.code !== "action_failed" ? 2 : 1;
+    return;
+  }
+}
+var arguments_ = process.argv.slice(2);
+void runCli(arguments_).then(() => {
+}).catch((error) => {
+  const message = error instanceof Error ? error.message : "The lmt-web owner failed.";
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+});