@ai-digital-factory/lmt-web-cli 0.1.3 → 0.1.5

package/dist/chunk-G5T7UDIK.js

@@ -0,0 +1,3094 @@
+// ../cli/src/profile-store.ts
+import { randomUUID } from "node:crypto";
+import {
+  chmod,
+  constants,
+  lstat,
+  mkdir,
+  open,
+  rename,
+  unlink
+} from "node:fs/promises";
+import path from "node:path";
+
+// ../cli/src/profile-name.ts
+var CLIENT_PROFILE_NAME_ERROR = "Profile must be 1\u201364 letters, digits, dots, underscores, or hyphens, starting with a letter or digit.";
+var clientProfilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function assertClientProfileName(profile) {
+  if (!clientProfilePattern.test(profile)) throw new Error(CLIENT_PROFILE_NAME_ERROR);
+}
+
+// ../cli/src/profile-store.ts
+var FILE_NAME = "secrets.pem";
+var OWNER_ONLY_DIRECTORY = 448;
+var OWNER_ONLY_FILE = 384;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 20;
+function emptyRecord() {
+  return { version: 2, profiles: {} };
+}
+function targetsEqual(left, right) {
+  return left.environment === right.environment && left.origin === right.origin && left.operatorId === right.operatorId;
+}
+function assertCookie(value, name) {
+  if (value !== void 0 && !new RegExp(`^${name}=[A-Za-z0-9._~-]+$`).test(value)) {
+    throw new Error(`The ${name} cookie is not valid.`);
+  }
+}
+function ownerId() {
+  return typeof process.getuid === "function" ? process.getuid() : void 0;
+}
+async function ensureOwnerOnly(pathname, kind) {
+  let info;
+  try {
+    info = await lstat(pathname);
+  } catch (error) {
+    if (error.code === "ENOENT") throw error;
+    throw new Error("Could not inspect the protected CLI profile storage.");
+  }
+  if (info.isSymbolicLink() || (kind === "directory" ? !info.isDirectory() : !info.isFile())) {
+    throw new Error(`The protected CLI profile ${kind} must be a regular ${kind}.`);
+  }
+  const uid = ownerId();
+  if (uid !== void 0 && info.uid !== uid) {
+    throw new Error(`The protected CLI profile ${kind} must be owned by the current user.`);
+  }
+  const expectedMode = kind === "directory" ? OWNER_ONLY_DIRECTORY : OWNER_ONLY_FILE;
+  if ((info.mode & 511) === expectedMode) return;
+  try {
+    await chmod(pathname, expectedMode);
+  } catch {
+    throw new Error(`Could not set protected CLI profile ${kind} permissions.`);
+  }
+  const updated = await lstat(pathname);
+  if ((updated.mode & 511) !== expectedMode) {
+    const mode = expectedMode.toString(8).padStart(4, "0");
+    throw new Error(`The protected CLI profile ${kind} must have mode ${mode}.`);
+  }
+}
+function parseLegacyTargetKey(key) {
+  try {
+    const parsed = JSON.parse(key);
+    if (!Array.isArray(parsed) || parsed.length !== 3) return void 0;
+    const [environment, origin, operatorId] = parsed;
+    if (environment !== "local" && environment !== "dev") return void 0;
+    if (typeof origin !== "string" || !origin.trim()) return void 0;
+    if (operatorId !== "OPERATOR_1") return void 0;
+    return { environment, origin: origin.trim(), operatorId };
+  } catch {
+    return void 0;
+  }
+}
+function migrateLegacyRecord(record) {
+  const migrated = emptyRecord();
+  if (record.smsCredential?.trim()) migrated.smsCredential = record.smsCredential;
+  for (const [profileName, profileRecord] of Object.entries(record.profiles ?? {})) {
+    const sessions = [];
+    for (const [targetKey, stored] of Object.entries(profileRecord.targets ?? {})) {
+      const target = parseLegacyTargetKey(targetKey);
+      if (!target) continue;
+      sessions.push({
+        ...target,
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {},
+        updatedAt: stored.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    if (sessions.length > 0) migrated.profiles[profileName] = { sessions };
+  }
+  return migrated;
+}
+function normalizeSession(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const session = value;
+  if (session.environment !== "local" && session.environment !== "dev") return void 0;
+  if (typeof session.origin !== "string" || !session.origin.trim()) return void 0;
+  if (session.operatorId !== "OPERATOR_1") return void 0;
+  if (typeof session.updatedAt !== "string" || !session.updatedAt.trim()) return void 0;
+  if (session.operatorSessionCookie !== void 0 && typeof session.operatorSessionCookie !== "string") return void 0;
+  if (session.clientIdentityCookie !== void 0 && typeof session.clientIdentityCookie !== "string") return void 0;
+  return {
+    environment: session.environment,
+    origin: session.origin.trim(),
+    operatorId: session.operatorId,
+    updatedAt: session.updatedAt,
+    ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
+  };
+}
+function parseRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("The protected CLI profile file is not valid JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("The protected CLI profile file has an unsupported format.");
+  }
+  const record = parsed;
+  if (record.version === 1) {
+    return migrateLegacyRecord(parsed);
+  }
+  if (record.version !== 2 || !record.profiles || typeof record.profiles !== "object" || Array.isArray(record.profiles)) {
+    throw new Error("The protected CLI profile file has an unsupported version or format.");
+  }
+  if (record.smsCredential !== void 0 && (typeof record.smsCredential !== "string" || !record.smsCredential.trim())) {
+    throw new Error("The protected CLI profile file has an invalid SMS credential record.");
+  }
+  const profiles = {};
+  for (const [profileName, profileValue] of Object.entries(record.profiles)) {
+    if (!profileValue || typeof profileValue !== "object" || Array.isArray(profileValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessionsValue = profileValue.sessions;
+    if (!Array.isArray(sessionsValue)) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    const sessions = sessionsValue.map(normalizeSession).filter((session) => session !== void 0);
+    if (sessions.length !== sessionsValue.length) {
+      throw new Error("The protected CLI profile file has an unsupported version or format.");
+    }
+    if (sessions.length > 0) profiles[profileName] = { sessions };
+  }
+  return {
+    version: 2,
+    ...typeof record.smsCredential === "string" && record.smsCredential.trim() ? { smsCredential: record.smsCredential } : {},
+    profiles
+  };
+}
+function findSessionIndex(sessions, target) {
+  return sessions.findIndex((session) => targetsEqual(session, target));
+}
+function sessionHasCookies(session) {
+  return Boolean(session.operatorSessionCookie || session.clientIdentityCookie);
+}
+var CliProfileStore = class {
+  constructor(homeDirectory = process.env.HOME ?? process.env.USERPROFILE ?? process.cwd(), lockWaitMs = LOCK_WAIT_MS, directoryName = ".lmt") {
+    this.lockWaitMs = lockWaitMs;
+    this.directory = path.join(homeDirectory, directoryName);
+    this.filePath = path.join(this.directory, FILE_NAME);
+    this.lockPath = path.join(this.directory, `${FILE_NAME}.lock`);
+  }
+  lockWaitMs;
+  directory;
+  filePath;
+  lockPath;
+  async getSmsCredential() {
+    return this.withLock(async () => (await this.readRecord()).smsCredential);
+  }
+  async saveSmsCredential(credential) {
+    if (!credential.trim() || /[\r\n]/.test(credential)) throw new Error("SMS credential input must be a non-empty single line.");
+    await this.withLock(async () => {
+      const record = await this.readRecordForSmsCredentialUpdate();
+      record.smsCredential = credential;
+      await this.writeRecord(record);
+    });
+  }
+  async getSession(profile, target) {
+    assertClientProfileName(profile);
+    return this.withLock(async () => {
+      const stored = (await this.readRecord()).profiles[profile]?.sessions.find((session) => targetsEqual(session, target));
+      if (!stored) return void 0;
+      return {
+        ...stored.operatorSessionCookie ? { operatorSessionCookie: stored.operatorSessionCookie } : {},
+        ...stored.clientIdentityCookie ? { clientIdentityCookie: stored.clientIdentityCookie } : {}
+      };
+    });
+  }
+  async saveSession(profile, target, cookies) {
+    assertClientProfileName(profile);
+    assertCookie(cookies.operatorSessionCookie, "lmt_operator_session");
+    assertCookie(cookies.clientIdentityCookie, "lmt_client_id");
+    if (!cookies.operatorSessionCookie && !cookies.clientIdentityCookie) return;
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile] ?? { sessions: [] };
+      const index = findSessionIndex(profileRecord.sessions, target);
+      const next = {
+        ...target,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
+        ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
+      };
+      if (!sessionHasCookies(next)) {
+        if (index >= 0) profileRecord.sessions.splice(index, 1);
+      } else if (index >= 0) {
+        profileRecord.sessions[index] = next;
+      } else {
+        profileRecord.sessions.push(next);
+      }
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+      else record.profiles[profile] = profileRecord;
+    });
+  }
+  async clearOperatorSession(profile, target) {
+    assertClientProfileName(profile);
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile];
+      if (!profileRecord) return;
+      const index = findSessionIndex(profileRecord.sessions, target);
+      if (index < 0) return;
+      const stored = profileRecord.sessions[index];
+      delete stored.operatorSessionCookie;
+      stored.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.cleanEmptySession(profileRecord, index);
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+    });
+  }
+  async removeTarget(profile, target) {
+    assertClientProfileName(profile);
+    await this.update((record) => {
+      const profileRecord = record.profiles[profile];
+      if (!profileRecord) return;
+      profileRecord.sessions = profileRecord.sessions.filter((session) => !targetsEqual(session, target));
+      if (profileRecord.sessions.length === 0) delete record.profiles[profile];
+    });
+  }
+  cleanEmptySession(profileRecord, index) {
+    const stored = profileRecord.sessions[index];
+    if (stored && !sessionHasCookies(stored)) profileRecord.sessions.splice(index, 1);
+  }
+  async update(mutator) {
+    await this.withLock(async () => {
+      const record = await this.readRecord();
+      mutator(record);
+      await this.writeRecord(record);
+    });
+  }
+  async withLock(operation) {
+    await this.ensureDirectory();
+    const started = Date.now();
+    let lock;
+    while (!lock) {
+      try {
+        lock = await open(this.lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+        await lock.chmod(OWNER_ONLY_FILE);
+        await lock.writeFile(`${process.pid}
+`);
+        await lock.sync();
+      } catch (error) {
+        if (error.code !== "EEXIST") {
+          throw new Error("Could not acquire the protected CLI profile storage lock.");
+        }
+        try {
+          await ensureOwnerOnly(this.lockPath, "file");
+        } catch (lockError) {
+          if (lockError.code === "ENOENT") continue;
+          throw lockError;
+        }
+        if (Date.now() - started >= this.lockWaitMs) {
+          throw new Error("Timed out waiting for the protected CLI profile storage lock.");
+        }
+        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await operation();
+    } finally {
+      await lock.close().catch(() => void 0);
+      await unlink(this.lockPath).catch(() => void 0);
+    }
+  }
+  async ensureDirectory() {
+    let created = false;
+    try {
+      await mkdir(this.directory, { mode: OWNER_ONLY_DIRECTORY });
+      created = true;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new Error("Could not create the protected CLI profile directory.");
+      }
+    }
+    if (created) {
+      try {
+        await chmod(this.directory, OWNER_ONLY_DIRECTORY);
+      } catch {
+        throw new Error("Could not set protected CLI profile directory permissions.");
+      }
+    }
+    await ensureOwnerOnly(this.directory, "directory");
+  }
+  isRecoverableStoreFormatError(error) {
+    if (!(error instanceof Error)) return false;
+    return error.message === "The protected CLI profile file is not valid JSON." || error.message === "The protected CLI profile file has an unsupported format." || error.message === "The protected CLI profile file has an unsupported version or format." || error.message === "The protected CLI profile file has an invalid SMS credential record.";
+  }
+  async archiveUnreadableStoreFile() {
+    const backupPath = `${this.filePath}.corrupt.${Date.now()}.bak`;
+    try {
+      await rename(this.filePath, backupPath);
+    } catch {
+      throw new Error("Could not repair the protected CLI profile file.");
+    }
+  }
+  async readRecordForSmsCredentialUpdate() {
+    try {
+      return await this.readRecord();
+    } catch (error) {
+      if (!this.isRecoverableStoreFormatError(error)) throw error;
+      await this.archiveUnreadableStoreFile();
+      return emptyRecord();
+    }
+  }
+  async readRecord() {
+    try {
+      const info = await lstat(this.filePath);
+      if (info.isSymbolicLink() || !info.isFile()) {
+        throw new Error("The protected CLI profile file must be a regular file.");
+      }
+      await ensureOwnerOnly(this.filePath, "file");
+      const handle = await open(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      try {
+        return parseRecord(await handle.readFile("utf8"));
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") return emptyRecord();
+      if (error instanceof Error && error.message.startsWith("The protected CLI profile")) throw error;
+      throw new Error("Could not read the protected CLI profile file.");
+    }
+  }
+  async writeRecord(record) {
+    const normalized = {
+      version: 2,
+      ...record.smsCredential ? { smsCredential: record.smsCredential } : {},
+      profiles: Object.fromEntries(
+        Object.entries(record.profiles).map(([profileName, profileRecord]) => [
+          profileName,
+          {
+            sessions: profileRecord.sessions.map((session) => ({
+              environment: session.environment,
+              origin: session.origin,
+              operatorId: session.operatorId,
+              ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
+              ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
+              updatedAt: session.updatedAt
+            }))
+          }
+        ])
+      )
+    };
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const content = `${JSON.stringify(normalized, null, 2)}
+`;
+    let handle;
+    try {
+      handle = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), OWNER_ONLY_FILE);
+      await handle.chmod(OWNER_ONLY_FILE);
+      await handle.writeFile(content, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      await rename(temporaryPath, this.filePath);
+      const directoryHandle = await open(this.directory, constants.O_RDONLY);
+      try {
+        await directoryHandle.sync();
+      } finally {
+        await directoryHandle.close();
+      }
+    } catch {
+      if (handle) await handle.close().catch(() => void 0);
+      await unlink(temporaryPath).catch(() => void 0);
+      throw new Error("Could not atomically update the protected CLI profile file.");
+    }
+  }
+};
+
+// ../cli/src/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+var repoRoot = path2.resolve(
+  path2.dirname(fileURLToPath(import.meta.url)),
+  "../../../../"
+);
+var packagedConfigPath = fileURLToPath(new URL("../lmt.config.json", import.meta.url));
+var DEFAULT_CONFIG_PATH = existsSync(packagedConfigPath) ? packagedConfigPath : path2.join(repoRoot, "lmt.config.json");
+function resolveCanonicalOrigin(value, environment) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`lmt.config.json does not contain the ${environment} Origin.`);
+  }
+  let origin;
+  try {
+    origin = new URL(value.trim());
+  } catch {
+    throw new Error(`${environment} Origin must be an absolute HTTP URL.`);
+  }
+  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
+    throw new Error(
+      `${environment} Origin must be an HTTP URL without credentials or a fragment.`
+    );
+  }
+  if (origin.pathname !== "/" || origin.search) {
+    throw new Error(`${environment} Origin must not include a path or query string.`);
+  }
+  return origin.origin;
+}
+function resolveCliTarget(env = process.env, configPath = DEFAULT_CONFIG_PATH) {
+  const environment = env.LMT_ENV?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("The CLI supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt.config.json does not contain the ${environment} environment.`);
+  }
+  const origin = resolveCanonicalOrigin(selected.origin, environment);
+  const smsEndpoint = typeof config.smsEndpoint === "string" ? config.smsEndpoint.trim() : "";
+  if (!smsEndpoint) throw new Error("lmt.config.json does not contain smsEndpoint.");
+  const gateScope = typeof selected.gateScope === "string" ? selected.gateScope.trim() : "";
+  if (!gateScope) throw new Error(`lmt.config.json does not contain the ${environment} Gate scope.`);
+  const operators = selected.brokerOperatorIds;
+  if (!Array.isArray(operators) || operators.length !== 1 || operators[0] !== "OPERATOR_1") {
+    throw new Error(`${environment} must have exactly one configured Operator: OPERATOR_1.`);
+  }
+  let smsUrl;
+  try {
+    smsUrl = new URL(smsEndpoint);
+  } catch {
+    throw new Error("smsEndpoint must be an absolute HTTP URL.");
+  }
+  if (!/^https?:$/.test(smsUrl.protocol) || smsUrl.username || smsUrl.password || smsUrl.hash) {
+    throw new Error("smsEndpoint must be an HTTP URL without credentials or a fragment.");
+  }
+  return {
+    environment,
+    origin,
+    gateScope,
+    smsEndpoint: smsUrl.origin,
+    operatorId: "OPERATOR_1"
+  };
+}
+
+// src/saved-session.ts
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, mkdir as mkdir2, open as open2 } from "node:fs/promises";
+import os from "node:os";
+import path3 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var SavedSessionError = class extends Error {
+  constructor() {
+    super("Could not access protected Web CLI session storage. Check its ownership, permissions, and integrity.");
+  }
+};
+async function assertPrivate(filename, directory) {
+  const entry = await lstat2(filename);
+  if ((directory ? !entry.isDirectory() : !entry.isFile()) || entry.isSymbolicLink() || entry.uid !== process.getuid?.() || (entry.mode & 511) !== (directory ? 448 : 384)) {
+    throw new SavedSessionError();
+  }
+}
+var SavedSession = class _SavedSession {
+  constructor(database, target) {
+    this.database = database;
+    this.target = target;
+  }
+  database;
+  target;
+  static async open(target) {
+    let database;
+    try {
+      const root = process.env.LMT_WEB_STATE_DIRECTORY || path3.join(os.homedir(), ".lmt-web");
+      await mkdir2(root, { recursive: true, mode: 448 });
+      await assertPrivate(root, true);
+      const directory = path3.join(root, "sessions");
+      await mkdir2(directory, { mode: 448 }).catch((error) => {
+        if (error.code !== "EEXIST") throw error;
+      });
+      await assertPrivate(directory, true);
+      const key = createHash("sha256").update(JSON.stringify([target.environment, target.origin, target.mode])).digest("hex");
+      const filename = path3.join(directory, `${key}.sqlite`);
+      const file = await open2(filename, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | constants2.O_NOFOLLOW, 384).catch((error) => {
+        if (error.code !== "EEXIST") throw error;
+      });
+      await file?.close();
+      await assertPrivate(filename, false);
+      database = new DatabaseSync(filename);
+      database.exec("PRAGMA busy_timeout = 25; PRAGMA secure_delete = ON;");
+      const store = new _SavedSession(database, target);
+      await store.reserve(Date.now() + 5e3, () => {
+        database.exec("CREATE TABLE IF NOT EXISTS session (id INTEGER PRIMARY KEY CHECK(id=1), state TEXT, owner TEXT)");
+        database.exec("INSERT OR IGNORE INTO session VALUES (1, NULL, NULL)");
+      });
+      return store;
+    } catch {
+      database?.close();
+      throw new SavedSessionError();
+    }
+  }
+  async reserve(deadlineAt, action) {
+    while (true) {
+      try {
+        this.database.exec("BEGIN IMMEDIATE");
+        break;
+      } catch (error) {
+        if (!/locked|busy/i.test(String(error)) || Date.now() >= deadlineAt) throw new SavedSessionError();
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+    }
+    try {
+      const result = action();
+      this.database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      this.database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  owner() {
+    try {
+      const row = this.database.prepare("SELECT owner FROM session WHERE id=1").get();
+      if (!row?.owner) return void 0;
+      const owner = JSON.parse(String(row.owner));
+      if (!/^[a-f0-9]{32}$/.test(owner.sessionId) || !Number.isSafeInteger(owner.pid) || owner.pid < 1 || typeof owner.headless !== "boolean" || typeof owner.processStartedAt !== "string") throw new SavedSessionError();
+      try {
+        process.kill(owner.pid, 0);
+      } catch (error) {
+        if (error.code !== "ESRCH") throw error;
+        return void 0;
+      }
+      try {
+        return this.processStartedAt(owner.pid) === owner.processStartedAt ? owner : void 0;
+      } catch {
+        try {
+          process.kill(owner.pid, 0);
+        } catch (error) {
+          if (error.code === "ESRCH") return void 0;
+        }
+        throw new SavedSessionError();
+      }
+    } catch {
+      throw new SavedSessionError();
+    }
+  }
+  processStartedAt(pid) {
+    const startedAt = execFileSync("ps", ["-p", String(pid), "-o", "lstart="], {
+      encoding: "utf8",
+      timeout: 1e3,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, LC_ALL: "C", TZ: "UTC" }
+    }).trim();
+    if (!startedAt) throw new SavedSessionError();
+    return startedAt;
+  }
+  setOwner(owner) {
+    this.database.prepare("UPDATE session SET owner=? WHERE id=1").run(JSON.stringify({ ...owner, processStartedAt: this.processStartedAt(owner.pid) }));
+  }
+  load() {
+    try {
+      const row = this.database.prepare("SELECT state FROM session WHERE id=1").get();
+      if (!row?.state) return void 0;
+      const state = JSON.parse(String(row.state));
+      if (!Array.isArray(state.cookies) || !Array.isArray(state.origins)) throw new Error();
+      return state;
+    } catch {
+      throw new SavedSessionError();
+    }
+  }
+  async save(state) {
+    const hostname = new URL(this.target.origin).hostname;
+    const scoped = {
+      cookies: state.cookies.filter((cookie) => cookie.domain === hostname || cookie.domain === `.${hostname}`),
+      origins: state.origins.filter((origin) => origin.origin === this.target.origin)
+    };
+    await this.reserve(Date.now() + 2e3, () => {
+      this.database.prepare("UPDATE session SET state=? WHERE id=1").run(JSON.stringify(scoped));
+    });
+  }
+  close() {
+    this.database.close();
+  }
+};
+
+// src/actions.ts
+var InvocationError = class extends Error {
+  constructor(message, code = "invalid_invocation", action) {
+    super(message);
+    this.code = code;
+    this.action = action;
+  }
+  code;
+  action;
+};
+function required(input, option) {
+  const value = input.values.get(option);
+  if (value === void 0 || option !== "--value" && !value) throw new InvocationError(`${option} is required for this action.`);
+  return value;
+}
+var ACTIONS = {
+  start: { control: false, flags: ["--headed", "--fresh"], values: ["--env", "--device"], build: () => ({ action: "start" }) },
+  inspect: { control: false, flags: [], values: [], build: () => ({ action: "inspect" }) },
+  close: { control: false, flags: [], values: [], build: () => ({ action: "close" }) },
+  stop: { control: false, flags: [], values: [], build: () => ({ action: "stop" }) },
+  "operator-login": { control: false, flags: [], values: [], build: () => ({ action: "operator-login" }) },
+  "operator-logout": { control: false, flags: [], values: [], build: () => ({ action: "operator-logout" }) },
+  "zerodha-login": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-login" }) },
+  "zerodha-cancel": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-cancel" }) },
+  "zerodha-logout": { control: false, flags: [], values: [], build: () => ({ action: "zerodha-logout" }) },
+  "zerodha-otp": {
+    control: false,
+    flags: ["--stdin"],
+    values: ["--attempt"],
+    build: async (input) => {
+      const attemptId = required(input, "--attempt");
+      if (!input.flags.has("--stdin")) throw new InvocationError("zerodha-otp requires --attempt ID and --stdin.");
+      return { action: "zerodha-otp", attemptId, otp: await input.readOtp() };
+    }
+  },
+  read: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "read", reference: required(input, "--ref") }) },
+  clipboard: { control: true, flags: [], values: [], build: () => ({ action: "clipboard" }) },
+  paste: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "paste", reference: required(input, "--ref") }) },
+  check: { control: true, flags: ["--stdin"], values: ["--ref"], build: async (input) => {
+    if (!input.flags.has("--stdin")) throw new InvocationError("check requires --stdin.");
+    return { action: "check", reference: required(input, "--ref"), expected: await input.readInput() };
+  } },
+  "clipboard-check": { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "clipboard-check", reference: required(input, "--ref") }) },
+  click: { control: true, flags: [], values: ["--ref"], build: (input) => ({ action: "click", reference: required(input, "--ref") }) },
+  fill: {
+    control: true,
+    flags: ["--secret"],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "fill", reference: required(input, "--ref"), value: required(input, "--value"), secret: input.flags.has("--secret") })
+  },
+  select: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--value"],
+    build: (input) => ({ action: "select", reference: required(input, "--ref"), value: required(input, "--value") })
+  },
+  scroll: {
+    control: true,
+    flags: [],
+    values: ["--ref", "--x", "--y"],
+    build: (input) => ({ action: "scroll", reference: input.values.get("--ref"), x: Number(input.values.get("--x") ?? 0), y: Number(input.values.get("--y") ?? 0) })
+  },
+  navigate: { control: true, flags: [], values: ["--url"], build: (input) => ({ action: "navigate", url: required(input, "--url") }) }
+};
+function isAction(value) {
+  return typeof value === "string" && Object.hasOwn(ACTIONS, value);
+}
+function isControlAction(action) {
+  return ACTIONS[action.action].control;
+}
+
+// src/config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import path4 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var repositoryRoot = path4.resolve(
+  path4.dirname(fileURLToPath2(import.meta.url)),
+  "../../../../"
+);
+var packagedConfig = fileURLToPath2(new URL("../lmt-web.config.json", import.meta.url));
+var DEFAULT_CONFIG_PATH2 = existsSync2(packagedConfig) ? packagedConfig : path4.join(repositoryRoot, "lmt.config.json");
+function canonicalOrigin(value, environment) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`lmt-web.config.json does not contain the ${environment} Web URL.`);
+  }
+  let origin;
+  try {
+    origin = new URL(value.trim());
+  } catch {
+    throw new Error(`${environment} Web URL must be an absolute HTTP URL.`);
+  }
+  if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.hash) {
+    throw new Error(
+      `${environment} Web URL must be an HTTP URL without credentials or a fragment.`
+    );
+  }
+  if (origin.pathname !== "/" || origin.search) {
+    throw new Error(`${environment} Web URL must not include a path or query string.`);
+  }
+  return origin.origin;
+}
+function resolveWebTarget(environmentValue, configPath = process.env.LMT_WEB_CONFIG_PATH || DEFAULT_CONFIG_PATH2) {
+  const environment = environmentValue?.trim();
+  if (environment !== "local" && environment !== "dev") {
+    if (environment === "prod") {
+      throw new Error("lmt-web supports local or dev targets only; prod is not permitted.");
+    }
+    throw new Error("Target must explicitly select --env local or --env dev; prod is not permitted.");
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync2(configPath, "utf8"));
+  } catch {
+    throw new Error("Could not read the deployment configuration lmt-web.config.json.");
+  }
+  const selected = config.environments?.[environment];
+  if (!selected) {
+    throw new Error(`lmt-web.config.json does not contain the ${environment} environment.`);
+  }
+  return { environment, origin: canonicalOrigin(selected.origin, environment) };
+}
+
+// src/protocol.ts
+var RESULT_VERSION = 1;
+function failureResult(action, code, message, sessionId = null) {
+  return {
+    version: RESULT_VERSION,
+    sessionId,
+    action,
+    outcome: "failure",
+    authentication: { status: "unknown" },
+    url: null,
+    visibleState: null,
+    device: null,
+    screenshot: { outcome: "unavailable", reason: "No browser page was available." },
+    error: { code, message }
+  };
+}
+
+// src/session.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmod as chmod2, lstat as lstat3, mkdir as mkdir3, unlink as unlink2 } from "node:fs/promises";
+import net from "node:net";
+import os2 from "node:os";
+import path5 from "node:path";
+import { chromium as chromium2 } from "playwright";
+
+// ../../packages/crawler/src/full-content.ts
+async function captureFullContent(browserPage, options) {
+  const page = browserPage;
+  if (!page.evaluate) throw new Error("Full-content capture is unavailable.");
+  try {
+    await page.evaluate(() => {
+      const state = [];
+      window.__lmtCapture = state;
+      const scrolling = Array.from(document.querySelectorAll("body *")).filter((element) => {
+        const style = getComputedStyle(element);
+        return /(auto|scroll)/.test(style.overflowY) && element.scrollHeight > element.clientHeight;
+      });
+      const expand = /* @__PURE__ */ new Set();
+      for (const element of scrolling) {
+        for (let parent = element; parent; parent = parent.parentElement) expand.add(parent);
+      }
+      for (const element of expand) {
+        state.push({ element, style: element.getAttribute("style"), x: element.scrollLeft, y: element.scrollTop });
+        element.style.setProperty("height", "auto", "important");
+        element.style.setProperty("max-height", "none", "important");
+        element.style.setProperty("overflow", "visible", "important");
+        element.style.setProperty("flex-shrink", "0", "important");
+        element.scrollTop = 0;
+      }
+    });
+    await page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))));
+    const complete = await page.evaluate(() => Array.from(document.querySelectorAll("body *")).every((element) => {
+      const style = getComputedStyle(element);
+      const assistiveText = element.getAttribute("data-lmt-capture") === "assistive-text" && style.position === "absolute" && element.clientWidth <= 1 && element.clientHeight <= 1;
+      return assistiveText || style.display === "none" || element.clientHeight === 0 || !/(auto|scroll|hidden|clip)/.test(style.overflowY) || element.scrollHeight <= element.clientHeight + 1;
+    }));
+    if (!complete) throw new Error("Full-content capture could not expand all clipped content.");
+    return await page.screenshot({ ...options, fullPage: true });
+  } finally {
+    await page.evaluate(() => {
+      const owner = window;
+      for (const { element, style, x, y } of (owner.__lmtCapture ?? []).reverse()) {
+        if (style === null) element.removeAttribute("style");
+        else element.setAttribute("style", style);
+        element.scrollLeft = x;
+        element.scrollTop = y;
+      }
+      delete owner.__lmtCapture;
+    }).catch(() => void 0);
+  }
+}
+
+// ../../packages/crawler/src/controls.ts
+import { createHash as createHash2, randomBytes } from "node:crypto";
+var ControlError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function sensitiveField(node) {
+  if (node.hasAttribute("data-lmt-sensitive")) return true;
+  if (node.getAttribute("data-lmt-readable") === "ordinary") return false;
+  const description = [
+    node.getAttribute("type"),
+    node.id,
+    node.getAttribute("name"),
+    node.getAttribute("aria-label"),
+    ...Array.from(node.labels ?? []).map((label) => label.textContent)
+  ].join(" ");
+  return /password|credential|secret|token|otp|one.time|username|user.?id|api.?key|pin/i.test(description);
+}
+function secretMetadata(value) {
+  return {
+    present: value.length > 0,
+    length: value.length,
+    fingerprint: value ? createHash2("sha256").update(value).digest("hex").slice(0, 12) : null
+  };
+}
+function controlSignature(node) {
+  if (!node.isConnected) return null;
+  return JSON.stringify([
+    node.tagName,
+    node.getAttribute("type"),
+    node.getAttribute("name"),
+    node.getAttribute("aria-label"),
+    node.getAttribute("href"),
+    node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement ? "" : node.textContent
+  ]);
+}
+var PageControls = class {
+  constructor(page, origin) {
+    this.origin = origin;
+    this.page = page;
+  }
+  origin;
+  page;
+  references = /* @__PURE__ */ new Map();
+  secrets = /* @__PURE__ */ new Set();
+  prefix = randomBytes(8).toString("hex");
+  sequence = 0;
+  registerSecrets(...values) {
+    for (const value of values) if (value) this.secrets.add(value);
+  }
+  redact(value) {
+    let result = value;
+    for (const secret of [...this.secrets].sort((a, b) => b.length - a.length)) {
+      result = result.split(secret).join("[redacted]");
+      result = result.split(encodeURIComponent(secret)).join("[redacted]");
+    }
+    return result;
+  }
+  async learnSecrets() {
+    const fields = await this.page.$$("input, textarea, select, [data-lmt-sensitive]");
+    const values = [];
+    for (const field of fields) {
+      try {
+        if (await field.evaluate(sensitiveField)) values.push(await field.evaluate((node) => node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement ? node.value : node.textContent ?? ""));
+      } finally {
+        await field.dispose();
+      }
+    }
+    const textSecrets = await this.page.evaluate(() => Array.from((document.body?.innerText ?? "").matchAll(
+      /(?:access[\s_-]*token|request[\s_-]*token|api[\s_-]*(?:secret|key|token)|password|credential|otp)[\t ]*[:=][\t ]*([^\s,;]+)/gi
+    ), (match) => match[1]).filter(Boolean));
+    values.push(...textSecrets);
+    values.push(...await this.page.evaluate(() => window.__lmtPasteSecrets ?? []));
+    this.registerSecrets(...values);
+  }
+  async screenshotMasks() {
+    const stable = this.page.locator("[data-lmt-sensitive]");
+    await this.learnSecrets();
+    const fields = await this.page.$$("input, textarea, select");
+    for (const field of fields) {
+      try {
+        const value = await field.inputValue();
+        const sensitive = value.length > 0 && (await field.evaluate(sensitiveField) || [...this.secrets].some((secret) => value.includes(secret)));
+        await field.evaluate((node, mask) => node.toggleAttribute("data-lmt-field-mask", mask), sensitive);
+      } finally {
+        await field.dispose();
+      }
+    }
+    await this.page.evaluate((secrets) => {
+      document.querySelectorAll("[data-lmt-secret-mask]").forEach((element) => element.removeAttribute("data-lmt-secret-mask"));
+      if (!secrets.length) return;
+      for (const element of document.querySelectorAll("body *")) {
+        const directText = Array.from(element.childNodes).filter((node) => node.nodeType === Node.TEXT_NODE).map((node) => node.textContent).join("");
+        if (secrets.some((secret) => directText.includes(secret) || (element.textContent ?? "").includes(secret) && !Array.from(element.children).some((child) => (child.textContent ?? "").includes(secret)))) element.setAttribute("data-lmt-secret-mask", "");
+      }
+    }, [...this.secrets]);
+    return [stable, this.page.locator("[data-lmt-field-mask], [data-lmt-secret-mask]")];
+  }
+  async inspect() {
+    await this.learnSecrets();
+    for (const { element } of this.references.values()) await element.dispose().catch(() => void 0);
+    this.references.clear();
+    const controls = [];
+    const elements = await this.page.$$("button, a[href], input, select, textarea, [role=button], [contenteditable=true]");
+    for (const element of elements) {
+      if (controls.length >= 100 || !await element.isVisible()) {
+        await element.dispose();
+        continue;
+      }
+      const description = await element.evaluate((node) => {
+        const labels = Array.from(node.labels ?? []).map((label) => {
+          const copy = label.cloneNode(true);
+          copy.querySelectorAll("input,select,textarea,button").forEach((control) => control.remove());
+          return copy.textContent ?? "";
+        }).join(" ");
+        return {
+          kind: node.getAttribute("role") || node.tagName.toLowerCase(),
+          label: (node.getAttribute("aria-label") || node.getAttribute("title") || labels || node.getAttribute("placeholder") || (node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement ? "" : node.textContent) || "").replace(/\s+/g, " ").trim()
+        };
+      });
+      const reference = `${this.prefix}-${++this.sequence}`;
+      this.references.set(reference, { element, signature: await element.evaluate(controlSignature) });
+      controls.push({ reference, kind: description.kind, label: this.redact(description.label).slice(0, 160) });
+    }
+    return controls;
+  }
+  async resolve(reference) {
+    const saved = this.references.get(reference);
+    const element = saved?.element;
+    if (!element || !saved?.signature || await element.evaluate(controlSignature).catch(() => null) !== saved.signature) {
+      throw new ControlError("stale_reference", "The control reference is missing or stale. Inspect the page for current references.");
+    }
+    if (!await element.isVisible()) throw new ControlError("stale_reference", "The referenced control is no longer visible. Inspect the page again.");
+    return element;
+  }
+  async stopLoading() {
+    const session = await this.page.context().newCDPSession(this.page);
+    try {
+      await session.send("Page.stopLoading");
+    } finally {
+      await session.detach();
+    }
+  }
+  async act(command, timeoutMs, onSubmit = () => void 0) {
+    this.page.setDefaultTimeout(timeoutMs);
+    this.page.setDefaultNavigationTimeout(timeoutMs);
+    if (command.action === "read" || command.action === "check" || command.action === "clipboard-check" || command.action === "clipboard") {
+      await this.learnSecrets();
+      if (command.action === "check") this.registerSecrets(command.expected);
+      try {
+        const field = command.action === "clipboard" ? void 0 : await this.resolve(command.reference);
+        if (field && await field.getAttribute("data-lmt-value-state") === "concealed") {
+          throw new ControlError("value_unreadable", "This field contains a display placeholder. Reveal the value or read the clipboard after Copy.");
+        }
+        if (command.action === "clipboard-check" || command.action === "clipboard") await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+        if (command.action === "clipboard-check") {
+          const matches = await field.evaluate(async (node) => {
+            if (!(node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement)) throw new Error("Unreadable field");
+            return await navigator.clipboard.readText() === node.value;
+          });
+          return { matches };
+        }
+        const value = command.action === "clipboard" ? await this.page.evaluate(() => navigator.clipboard.readText()) : await field.evaluate((node) => {
+          if (!(node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement || node instanceof HTMLSelectElement)) throw new Error("Unreadable field");
+          return node.value;
+        });
+        if (command.action === "check") {
+          this.registerSecrets(value);
+          return { matches: value === command.expected };
+        }
+        const sensitive = field && await field.evaluate(sensitiveField);
+        if (command.action === "clipboard") {
+          const fields = await this.page.$$("input,textarea,select");
+          let ordinary = false;
+          for (const candidate of fields) {
+            try {
+              if (!await candidate.evaluate(sensitiveField) && await candidate.inputValue() === value) ordinary = true;
+            } finally {
+              await candidate.dispose();
+            }
+          }
+          if (!ordinary) {
+            this.registerSecrets(value);
+            return { secret: secretMetadata(value) };
+          }
+        }
+        if (sensitive || [...this.secrets].some((secret) => value.includes(secret))) {
+          this.registerSecrets(value);
+          return { secret: secretMetadata(value) };
+        }
+        return { value };
+      } catch (error) {
+        if (error instanceof ControlError) throw error;
+        throw new ControlError("value_unreadable", "The field or clipboard could not be read. No comparison result is available.");
+      }
+    }
+    if (command.action === "paste") {
+      await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+      const field = await this.resolve(command.reference);
+      if (!await field.evaluate(sensitiveField)) throw new ControlError("protected_target_required", "Paste requires a protected input or textarea.");
+      const editable = await field.evaluate((node) => (node instanceof HTMLInputElement || node instanceof HTMLTextAreaElement) && !node.readOnly && !node.disabled);
+      if (!editable) throw new ControlError("value_unreadable", "The paste target is not editable.");
+      try {
+        const result = await field.evaluate(async (node) => {
+          const input = node;
+          const value = await navigator.clipboard.readText();
+          const owner = window;
+          const protectedValues = owner.__lmtPasteSecrets ??= [];
+          if (value && !protectedValues.includes(value)) protectedValues.push(value);
+          const prototype = input instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+          Object.getOwnPropertyDescriptor(prototype, "value").set.call(input, value);
+          input.dispatchEvent(new Event("input", { bubbles: true }));
+          input.dispatchEvent(new Event("change", { bubbles: true }));
+          await new Promise((resolve) => requestAnimationFrame(() => resolve()));
+          if (!input.isConnected || input.value !== value) return null;
+          const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+          const fingerprint = value ? Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 12) : null;
+          return { present: value.length > 0, length: value.length, fingerprint };
+        });
+        if (!result) throw new ControlError("paste_not_retained", "The field did not retain the pasted value.");
+        await this.learnSecrets();
+        return { secret: result, matches: true };
+      } catch (error) {
+        if (error instanceof ControlError) throw error;
+        throw new ControlError("value_unreadable", "The clipboard could not be pasted into the protected field.");
+      }
+    }
+    if (command.action === "fill") {
+      const element = await this.resolve(command.reference);
+      const sensitive = await element.evaluate(sensitiveField);
+      if (command.secret || sensitive) this.registerSecrets(command.value);
+      await element.fill(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "select") {
+      await (await this.resolve(command.reference)).selectOption(command.value, { timeout: timeoutMs });
+      return;
+    }
+    if (command.action === "click") {
+      await this.page.context().grantPermissions(["clipboard-read", "clipboard-write"], { origin: this.origin });
+      const element = await this.resolve(command.reference);
+      const deadlineAt = Date.now() + timeoutMs;
+      await element.click({ trial: true, timeout: timeoutMs });
+      onSubmit();
+      try {
+        await element.click({ timeout: Math.max(1, deadlineAt - Date.now()) });
+      } catch {
+        throw new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.");
+      }
+      return;
+    }
+    if (command.action === "navigate") {
+      const target = new URL(command.url, this.origin);
+      if (target.origin !== new URL(this.origin).origin || target.username || target.password) {
+        throw new ControlError("invalid_target", "Navigation must use the session's configured Origin.");
+      }
+      await this.page.goto(target.href, { timeout: timeoutMs, waitUntil: "domcontentloaded" });
+      return;
+    }
+    if (command.action === "scroll") {
+      if (!Number.isFinite(command.x) || !Number.isFinite(command.y)) throw new ControlError("invalid_invocation", "Scroll offsets must be finite pixel values.");
+      const element = command.reference ? await this.resolve(command.reference) : void 0;
+      const scroll = await this.page.evaluate(({ element: node, offsets }) => {
+        const scrollable = (item) => {
+          const style = getComputedStyle(item);
+          return /(auto|scroll)/.test(style.overflow + style.overflowY + style.overflowX) && (item.scrollHeight > item.clientHeight || item.scrollWidth > item.clientWidth);
+        };
+        const containers = [];
+        if (node) {
+          for (let parent = node.parentElement; parent; parent = parent.parentElement) if (scrollable(parent)) containers.push(parent);
+          if (document.scrollingElement && !containers.includes(document.scrollingElement)) containers.push(document.scrollingElement);
+        } else {
+          const candidates = Array.from(document.querySelectorAll("body *")).filter(scrollable);
+          const root = document.scrollingElement;
+          if (root && !/(hidden|clip)/.test(getComputedStyle(root).overflowY) && (root.scrollHeight > root.clientHeight || root.scrollWidth > root.clientWidth)) candidates.push(root);
+          candidates.sort((a, b) => b.clientWidth * b.clientHeight - a.clientWidth * a.clientHeight);
+          containers.push(candidates[0] ?? document.scrollingElement);
+        }
+        const positions = () => containers.map((item) => ({ x: item.scrollLeft, y: item.scrollTop }));
+        const before = positions();
+        if (node) node.scrollIntoView({ block: "nearest", inline: "nearest", behavior: "instant" });
+        else containers[0].scrollBy({ left: offsets.x, top: offsets.y, behavior: "instant" });
+        const after = positions();
+        const moved = before.some((position, i) => position.x !== after[i].x || position.y !== after[i].y);
+        if (node) {
+          const rect = node.getBoundingClientRect();
+          let left = Math.max(0, rect.left), right = Math.min(innerWidth, rect.right);
+          let top = Math.max(0, rect.top), bottom = Math.min(innerHeight, rect.bottom);
+          for (let parent = node.parentElement; parent; parent = parent.parentElement) {
+            const style = getComputedStyle(parent), clip = parent.getBoundingClientRect();
+            if (/(auto|scroll|hidden|clip)/.test(style.overflowX)) {
+              left = Math.max(left, clip.left);
+              right = Math.min(right, clip.right);
+            }
+            if (/(auto|scroll|hidden|clip)/.test(style.overflowY)) {
+              top = Math.max(top, clip.top);
+              bottom = Math.min(bottom, clip.bottom);
+            }
+          }
+          if (right <= left || bottom <= top) return null;
+        }
+        return { outcome: moved ? "moved" : node ? "already_visible" : "at_boundary", before, after };
+      }, { element: element ?? null, offsets: command });
+      await this.page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))));
+      if (!scroll) throw new ControlError("target_unreachable", "The referenced control remains outside the visible scroll area.");
+      return { scroll };
+    }
+  }
+};
+
+// ../../packages/crawler/src/index.ts
+import {
+  chromium
+} from "playwright";
+var DEFAULT_BASE_URL = "http://127.0.0.1:5173";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 6e4;
+var OPERATOR_PAGE_SELECTOR = '[data-operator-page="true"]';
+var MARKET_WATCH_SELECTOR = '[data-market-watch="true"]';
+var OPERATOR_LOGIN_GATE_SELECTOR = '[data-operator-login-gate="true"]';
+var OPERATOR_LOGIN_USERNAME_SELECTOR = "[data-operator-login-username]";
+var OPERATOR_LOGIN_PASSWORD_SELECTOR = "[data-operator-login-password]";
+var OPERATOR_LOGIN_CONFIRM_SELECTOR = "[data-operator-login-confirm]";
+var CREDENTIALS_STATUS_SELECTOR = "[data-credentials-status]";
+var ZERODHA_LOGIN_PAGE_SELECTOR = '[data-zerodha-login-page="true"]';
+var OPERATOR_LOGIN_ATTEMPT_SELECTOR = "[data-operator-login-attempt]";
+var OPERATOR_LOGIN_STATUS_ATTRIBUTE = "data-operator-login-status";
+var OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR = '[data-operator-login-message-kind="status"]';
+var OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR = '[data-operator-login-message-kind="error"]';
+var OPERATOR_LOGIN_MESSAGE_ATTRIBUTE = "data-operator-login-message";
+var OPERATOR_LOGIN_OTP_SELECTOR = "[data-operator-login-otp]";
+var OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR = "[data-operator-login-otp-submit]";
+var OPERATOR_LOGIN_CANCEL_SELECTOR = "[data-operator-login-cancel]";
+var AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-authenticated-operator-logout]";
+var UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR = "[data-unauthenticated-operator-logout]";
+var SETTINGS_SELECTOR = "[data-zc-settings]";
+var OPERATOR_EGRESS_SELECTOR = "[data-operator-egress-value]";
+var PEEK_TIMEOUT_MS = 250;
+var MARKET_WATCH_LIVE_GRACE_MS = 3e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function isAttached(page, selector, attributeName) {
+  if (typeof page.waitForSelector === "function") {
+    try {
+      await page.waitForSelector(selector, { timeout: PEEK_TIMEOUT_MS });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  const value = await peekAttribute(page, selector, attributeName);
+  return value !== null;
+}
+async function peekAttribute(page, selector, name) {
+  try {
+    return await page.locator(selector).getAttribute(name, { timeout: PEEK_TIMEOUT_MS });
+  } catch {
+    return null;
+  }
+}
+function marketWatchRowSelector(sno) {
+  return `[data-market-watch-row="${sno}"]`;
+}
+var MARKET_WATCH_PANEL_SELECTOR = "[data-market-watch-panel]";
+var MARKET_WATCH_ADD_INSTRUMENT_SELECTOR = "[data-market-watch-add-instrument]";
+function marketWatchPanelSelector(sno) {
+  return `[data-market-watch-panel="${sno}"]`;
+}
+function marketWatchExchangeSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-exchange="${sno}"]`;
+}
+function marketWatchTradingSymbolSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-trading-symbol="${sno}"]`;
+}
+function marketWatchApplySelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-apply="${sno}"]`;
+}
+function marketWatchPanelCancelSelector(sno) {
+  return `${marketWatchPanelSelector(sno)} [data-market-watch-panel-cancel="${sno}"]`;
+}
+function marketWatchDraftErrorSelector(scope, sno) {
+  return `${scope} [data-market-watch-draft-error="${sno}"]`;
+}
+function marketWatchMenuSelector(sno) {
+  return `[data-market-watch-menu="${sno}"]`;
+}
+function marketWatchMenuListSelector(sno) {
+  return `[data-market-watch-menu-list="${sno}"]`;
+}
+function marketWatchChangeSelector(sno) {
+  return `[data-market-watch-change="${sno}"]`;
+}
+function marketWatchClearSelector(sno) {
+  return `[data-market-watch-clear="${sno}"]`;
+}
+function marketWatchCommittedSelector(sno) {
+  return `[data-market-watch-committed="${sno}"]`;
+}
+function marketWatchQuoteSelector(sno) {
+  return `[data-market-watch-quote="${sno}"]`;
+}
+function marketWatchQuoteFieldSelector(sno, field) {
+  return `${marketWatchQuoteSelector(sno)} [data-market-watch-quote-field="${field}"]`;
+}
+var QUOTE_FIELDS = {
+  ltp: "lastPrice",
+  open: "open",
+  high: "high",
+  low: "low",
+  close: "close",
+  volume: "volume",
+  "percentage-change": "percentageChange"
+};
+function toMarketWatchRowStatus(raw) {
+  switch (raw) {
+    case "Empty":
+      return "empty";
+    case "Validating":
+      return "validating";
+    case "Live":
+      return "live";
+    case "Error":
+      return "error";
+    case "Configured":
+      return "stopped";
+    case null:
+      throw new Error("Market Watch row did not expose a state");
+    default:
+      throw new Error(`Unknown Market Watch row state: ${raw}`);
+  }
+}
+var PlaywrightOperatorPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorInfo() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const root = this.page.locator(OPERATOR_PAGE_SELECTOR);
+    const userId = (await root.getAttribute("data-user-id"))?.trim() ?? "";
+    const userName = (await root.getAttribute("data-user-name"))?.trim() ?? "";
+    if (!userId) {
+      throw new Error("Operator Page did not expose a user id");
+    }
+    return {
+      userId,
+      userName: userName || userId
+    };
+  }
+  async getMarketWatchRowCount() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const raw = await this.page.locator(MARKET_WATCH_SELECTOR).getAttribute("data-market-watch-row-count", { timeout: this.timeoutMs });
+    const rowCount = Number(raw);
+    if (!Number.isInteger(rowCount) || rowCount < 1) {
+      throw new Error(`Market Watch exposed invalid row count: ${String(raw)}`);
+    }
+    return rowCount;
+  }
+  async getMarketWatchRowNumbers() {
+    const rowCount = await this.getMarketWatchRowCount();
+    return Array.from({ length: rowCount }, (_, index) => index + 1);
+  }
+  async getMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    const rowSelector = marketWatchRowSelector(sno);
+    const listed = await isAttached(this.page, rowSelector, "data-market-watch-row-state");
+    const editing = await this.panelTargets(sno);
+    const draftError = (await peekAttribute(
+      this.page,
+      marketWatchDraftErrorSelector(editing ? marketWatchPanelSelector(sno) : rowSelector, sno),
+      "data-market-watch-draft-error-message"
+    ))?.trim();
+    const draft = editing ? {
+      exchange: await this.page.locator(marketWatchExchangeSelector(sno)).inputValue(),
+      tradingSymbol: await this.page.locator(marketWatchTradingSymbolSelector(sno)).inputValue()
+    } : void 0;
+    if (!listed) {
+      return {
+        sno,
+        exchange: draft?.exchange ?? "NSE",
+        tradingSymbol: draft?.tradingSymbol ?? "",
+        status: draftError ? "error" : "empty",
+        ...draftError ? { draftError } : {},
+        failureMarked: Boolean(draftError)
+      };
+    }
+    const row = this.page.locator(rowSelector);
+    const committed = this.page.locator(marketWatchCommittedSelector(sno));
+    const committedAttribute = (name2) => committed.getAttribute(name2, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+    const match = (await committedAttribute("data-market-watch-match"))?.trim();
+    const token = (await committedAttribute("data-market-watch-token"))?.trim();
+    const name = (await committedAttribute("data-market-watch-name"))?.trim();
+    const segment = (await committedAttribute("data-market-watch-segment"))?.trim();
+    const quote = match && token ? await this.readMarketWatchQuote(sno, token) : void 0;
+    const separator = match?.indexOf(":") ?? -1;
+    return {
+      sno,
+      exchange: draft?.exchange ?? (separator > 0 ? match.slice(0, separator) : ""),
+      tradingSymbol: draft?.tradingSymbol ?? (separator > 0 ? match.slice(separator + 1) : ""),
+      status: toMarketWatchRowStatus(
+        await row.getAttribute("data-market-watch-row-state")
+      ),
+      ...draftError ? { draftError } : {},
+      failureMarked: await row.getAttribute("data-market-watch-row-failure") === "true",
+      ...quote ? { quote } : {},
+      ...match && token ? {
+        instrumentInfo: {
+          match,
+          token,
+          name: name ?? "",
+          segment: segment ?? ""
+        },
+        onTick: (listener) => {
+          const unsubscribe = this.subscribeLiveTicks(sno, token, listener);
+          this.registerCleanup(unsubscribe);
+          return unsubscribe;
+        }
+      } : {}
+    };
+  }
+  async setMarketWatchRow(sno, exchange, tradingSymbol) {
+    await this.waitForMarketWatch();
+    if (!await this.panelTargets(sno)) {
+      if (await isAttached(this.page, marketWatchRowSelector(sno), "data-market-watch-row-state")) {
+        await this.openRowMenu(sno);
+        await this.page.locator(marketWatchChangeSelector(sno)).click();
+      } else {
+        await this.page.locator(MARKET_WATCH_ADD_INSTRUMENT_SELECTOR).click();
+      }
+      const target = await this.waitForPanel();
+      if (target !== String(sno)) {
+        await this.page.locator(marketWatchPanelCancelSelector(Number(target))).click();
+        throw new Error(`Add Instrument targets slot ${target}, not ${sno}`);
+      }
+    }
+    await this.page.locator(marketWatchExchangeSelector(sno)).selectOption(exchange.trim().toUpperCase());
+    await this.page.locator(marketWatchTradingSymbolSelector(sno)).fill(tradingSymbol);
+  }
+  async applyMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    await this.page.locator(marketWatchApplySelector(sno)).click();
+    const rowState = () => peekAttribute(this.page, marketWatchRowSelector(sno), "data-market-watch-row-state");
+    const deadline = Date.now() + this.timeoutMs;
+    let configuredSince = null;
+    while (Date.now() < deadline) {
+      if (await isAttached(this.page, marketWatchDraftErrorSelector(marketWatchPanelSelector(sno), sno), "data-market-watch-draft-error-message")) {
+        return;
+      }
+      if (!await this.panelTargets(sno)) {
+        const state = await rowState();
+        if (state === "Live" || state === "Error") return;
+        if (state === "Configured") {
+          configuredSince ??= Date.now();
+          if (Date.now() - configuredSince >= MARKET_WATCH_LIVE_GRACE_MS) return;
+        } else {
+          configuredSince = null;
+        }
+      }
+      await sleep(50);
+    }
+    if (configuredSince !== null && !await this.panelTargets(sno) && await rowState() === "Configured") return;
+    throw new Error(`Timed out waiting for Market Watch row ${sno} state`);
+  }
+  async clearMarketWatchRow(sno) {
+    await this.waitForMarketWatch();
+    await this.openRowMenu(sno);
+    await this.page.locator(marketWatchClearSelector(sno)).click();
+    await this.waitForAttribute(
+      marketWatchRowSelector(sno),
+      "data-market-watch-row-state",
+      (state) => state === null,
+      `Market Watch row ${sno} to be cleared`
+    );
+  }
+  /** Market Watch drafts are loaded once the container exposes its row count. */
+  async waitForMarketWatch() {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.waitForAttribute(
+      MARKET_WATCH_SELECTOR,
+      "data-market-watch-row-count",
+      (value) => Number(value) >= 1,
+      "Market Watch rows"
+    );
+  }
+  async panelTargets(sno) {
+    return await peekAttribute(this.page, MARKET_WATCH_PANEL_SELECTOR, "data-market-watch-panel") === String(sno);
+  }
+  async waitForPanel() {
+    let target = null;
+    await this.waitForAttribute(
+      MARKET_WATCH_PANEL_SELECTOR,
+      "data-market-watch-panel",
+      (value) => (target = value) !== null,
+      "the Market Watch instrument panel"
+    );
+    return target;
+  }
+  async openRowMenu(sno) {
+    if (!await isAttached(this.page, marketWatchMenuListSelector(sno), "data-market-watch-menu-list")) {
+      await this.page.locator(marketWatchMenuSelector(sno)).click();
+    }
+  }
+  async refresh() {
+    await this.page.reload();
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.waitForSelector?.(MARKET_WATCH_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+  }
+  async waitForAttribute(selector, attribute, predicate, description) {
+    const element = this.page.locator(selector);
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const value = await element.getAttribute(attribute, { timeout: PEEK_TIMEOUT_MS }).catch(() => null);
+      if (predicate(value)) {
+        return;
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async readMarketWatchQuote(sno, fallbackToken) {
+    const root = this.page.locator(marketWatchQuoteSelector(sno));
+    const receivedAt = await root.getAttribute("data-market-watch-quote-received-at", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    if (!receivedAt) return void 0;
+    const receivedOn = new Date(receivedAt);
+    if (Number.isNaN(receivedOn.getTime())) {
+      throw new Error(`Market Watch row ${sno} exposed an invalid quote timestamp`);
+    }
+    const exchangeTimestampRaw = await root.getAttribute("data-market-watch-quote-exchange-time", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+    if (exchangeTimestamp && Number.isNaN(exchangeTimestamp.getTime())) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid exchange tick timestamp`
+      );
+    }
+    const timestampStatusRaw = await root.getAttribute("data-market-watch-quote-timestamp-status", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCountRaw = await root.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const updateTypeRaw = await root.getAttribute("data-market-watch-quote-update-type", {
+      timeout: PEEK_TIMEOUT_MS
+    }).catch(() => null);
+    const missingTimestampCount = Number(missingTimestampCountRaw);
+    if (missingTimestampCountRaw !== null && (!Number.isInteger(missingTimestampCount) || missingTimestampCount < 0)) {
+      throw new Error(
+        `Market Watch row ${sno} exposed an invalid missing timestamp count`
+      );
+    }
+    return {
+      receivedAt: receivedOn,
+      token: (await root.getAttribute("data-market-watch-quote-token", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || fallbackToken,
+      mode: (await root.getAttribute("data-market-watch-quote-mode", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null))?.trim() || "full",
+      ...updateTypeRaw === "liveTick" || updateTypeRaw === "quoteSnapshot" || updateTypeRaw === "reconnectSnapshot" ? { latestUpdateType: updateTypeRaw } : {},
+      ...exchangeTimestamp ? { exchangeTimestamp } : {},
+      ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+      ...missingTimestampCountRaw !== null ? { missingExchangeTimestampCount: missingTimestampCount } : {},
+      fields: await this.readQuoteFields(sno)
+    };
+  }
+  async readQuoteFields(sno) {
+    const fields = {};
+    for (const [domField, property] of Object.entries(QUOTE_FIELDS)) {
+      const raw = await this.page.locator(marketWatchQuoteFieldSelector(sno, domField)).getAttribute("data-market-watch-quote-value", {
+        timeout: PEEK_TIMEOUT_MS
+      }).catch(() => null);
+      if (raw === null || raw.trim() === "") continue;
+      const value = Number(raw);
+      if (!Number.isFinite(value)) {
+        throw new Error(
+          `Market Watch row ${sno} exposed a non-numeric ${domField} quote value`
+        );
+      }
+      fields[property] = value;
+    }
+    return fields;
+  }
+  subscribeLiveTicks(sno, expectedToken, listener) {
+    let stopped = false;
+    let lastFingerprint = "";
+    const poll = async () => {
+      while (!stopped) {
+        const quoteRoot = this.page.locator(marketWatchQuoteSelector(sno));
+        const receivedOnRaw = await quoteRoot.getAttribute("data-market-watch-quote-received-at", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const token = await quoteRoot.getAttribute("data-market-watch-quote-token", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const mode = await quoteRoot.getAttribute("data-market-watch-quote-mode", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const exchangeTimestampRaw = await quoteRoot.getAttribute("data-market-watch-quote-exchange-time", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const timestampStatusRaw = await quoteRoot.getAttribute("data-market-watch-quote-timestamp-status", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const missingTimestampCountRaw = await quoteRoot.getAttribute("data-market-watch-quote-missing-timestamp-count", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        const updateTypeRaw = await quoteRoot.getAttribute("data-market-watch-quote-update-type", {
+          timeout: PEEK_TIMEOUT_MS
+        }).catch(() => null);
+        if (receivedOnRaw && token === expectedToken) {
+          const actualMode = mode?.trim() || "";
+          const fingerprint = `${receivedOnRaw}|${token}|${actualMode}|${updateTypeRaw ?? ""}|${exchangeTimestampRaw ?? ""}|${timestampStatusRaw ?? ""}`;
+          if (fingerprint !== lastFingerprint) {
+            lastFingerprint = fingerprint;
+            const fields = await this.readQuoteFields(sno);
+            const exchangeTimestamp = exchangeTimestampRaw ? new Date(exchangeTimestampRaw) : void 0;
+            const missingExchangeTimestampCount = Number(
+              missingTimestampCountRaw
+            );
+            const tick = {
+              receivedOn: new Date(receivedOnRaw),
+              token,
+              mode: actualMode,
+              ...exchangeTimestamp && !Number.isNaN(exchangeTimestamp.getTime()) ? { exchangeTimestamp } : {},
+              ...timestampStatusRaw === "available" || timestampStatusRaw === "missing" || timestampStatusRaw === "invalid" ? { exchangeTimestampStatus: timestampStatusRaw } : {},
+              ...Number.isInteger(missingExchangeTimestampCount) && missingExchangeTimestampCount >= 0 ? { missingExchangeTimestampCount } : {},
+              ...fields
+            };
+            if (tick.mode === "full" && updateTypeRaw === "liveTick" && timestampStatusRaw === "available" && tick.exchangeTimestamp && typeof tick.lastPrice === "number" && Number.isFinite(tick.lastPrice) && tick.lastPrice > 0) {
+              listener(tick);
+            }
+          }
+        }
+        await sleep(50);
+      }
+    };
+    void poll();
+    return () => {
+      stopped = true;
+    };
+  }
+  async clickLogoutZerodha(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(OPERATOR_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator("[data-operator-info-toggle]").click();
+    onSubmit();
+    await this.page.locator(AUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightZerodhaLoginPage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var LoginAttemptError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var PlaywrightZerodhaLoginPage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async getOperatorEgress() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (!await isAttached(
+      this.page,
+      OPERATOR_EGRESS_SELECTOR,
+      "data-operator-egress-value"
+    )) {
+      await this.page.locator(SETTINGS_SELECTOR).click();
+    }
+    await this.page.waitForSelector?.(OPERATOR_EGRESS_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    const field = this.page.locator(OPERATOR_EGRESS_SELECTOR);
+    return {
+      publicIp: await field.inputValue(),
+      readOnly: await field.getAttribute("readonly") !== null
+    };
+  }
+  async peekLoginStatus() {
+    return peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      OPERATOR_LOGIN_STATUS_ATTRIBUTE
+    );
+  }
+  async peekLoginMessage() {
+    return await this.peekLoginStatusMessage() ?? await this.peekLoginErrorMessage();
+  }
+  async peekLoginStatusMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_STATUS_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async peekLoginErrorMessage() {
+    const message = await peekAttribute(
+      this.page,
+      OPERATOR_LOGIN_ERROR_MESSAGE_SELECTOR,
+      OPERATOR_LOGIN_MESSAGE_ATTRIBUTE
+    );
+    return message?.trim() || null;
+  }
+  async waitForLoginStatus(predicate, description) {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      const status = await this.peekLoginStatus();
+      if (predicate(status)) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (status === "failed" || status === null && message) {
+        throw new Error(message ?? "Zerodha Login Attempt failed.");
+      }
+      await sleep(50);
+    }
+    throw new Error(`Timed out waiting for ${description}`);
+  }
+  async waitForLoginAttempt() {
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(
+        this.page,
+        OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+        "data-operator-login-attempt"
+      )) {
+        return;
+      }
+      const message = await this.peekLoginMessage();
+      if (message) {
+        throw new Error(message);
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha Login Attempt");
+  }
+  /** Start Zerodha Login Attempt for this Operator Session (always OTP path). */
+  async clickLoginWithZerodha() {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    if (await isAttached(
+      this.page,
+      OPERATOR_LOGIN_ATTEMPT_SELECTOR,
+      "data-operator-login-attempt"
+    )) {
+      return;
+    }
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    await this.waitForLoginAttempt();
+  }
+  async enterOtp(otp) {
+    await this.clickLoginWithZerodha();
+    await this.waitForLoginStatus(
+      (status) => status === "awaiting_otp",
+      "the Zerodha OTP Challenge"
+    );
+    await this.page.locator(OPERATOR_LOGIN_OTP_SELECTOR).fill(otp);
+  }
+  async submitOtp() {
+    const previousStatusMessage = await this.peekLoginStatusMessage();
+    await this.page.locator(OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR).click();
+    const deadline = Date.now() + this.interactiveLoginTimeoutMs;
+    while (Date.now() < deadline) {
+      if (await isAttached(this.page, OPERATOR_PAGE_SELECTOR, "data-operator-page")) {
+        return {
+          status: "SUCCESS",
+          operatorPage: new PlaywrightOperatorPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      const status = await this.peekLoginStatus();
+      const errorMessage = await this.peekLoginErrorMessage();
+      if (errorMessage) {
+        return { status: "FAILED", message: errorMessage };
+      }
+      const statusMessage = await this.peekLoginStatusMessage();
+      if (status === "failed") {
+        return {
+          status: "FAILED",
+          message: statusMessage ?? "Zerodha Login Attempt failed."
+        };
+      }
+      if (statusMessage && statusMessage !== previousStatusMessage) {
+        return { status: "FAILED", message: statusMessage };
+      }
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP submission result");
+  }
+  async observeLoginState() {
+    if (!this.page.evaluate) throw new Error("Browser inspection is unavailable.");
+    return this.page.evaluate(() => {
+      const operatorPage = !!document.querySelector('[data-operator-page="true"]');
+      const transitioning = !!document.querySelector('[data-session-loading], [data-zerodha-restoration="pending"]');
+      const attempt = document.querySelector("[data-operator-login-attempt]");
+      const attemptId = attempt?.getAttribute("data-operator-login-attempt-id");
+      return { operatorPage, transitioning, attempt: !attempt || !attemptId ? null : {
+        attemptId,
+        status: attempt.getAttribute("data-operator-login-status") ?? "unavailable",
+        failedOtpAttempts: Number(attempt.getAttribute("data-operator-login-failed-otp-attempts") ?? 0),
+        submitting: attempt.getAttribute("data-operator-login-submitting-otp") === "true",
+        message: document.querySelector('[data-operator-login-message-kind="error"]')?.getAttribute("data-operator-login-message") ?? null
+      } };
+    });
+  }
+  async observeLoginAttempt() {
+    return (await this.observeLoginState()).attempt;
+  }
+  async startLoginAttempt(onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const existing = await this.observeLoginAttempt();
+    let observedId = existing?.attemptId;
+    if (!existing) {
+      await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, { timeout: this.timeoutMs });
+      onSubmit();
+      await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    }
+    while (Date.now() < deadline) {
+      const current = await this.observeLoginAttempt();
+      if (observedId && current?.attemptId !== observedId) throw new LoginAttemptError("attempt_replaced", "The Zerodha Login Attempt was replaced. Inspect the page before starting another attempt.");
+      observedId ??= current?.attemptId;
+      if (current?.status === "awaiting_otp") return current;
+      if (current && !["loading", "awaiting_otp", "succeeded", "failed"].includes(current.status)) throw new LoginAttemptError("attempt_unavailable", "The Zerodha Login Attempt is expired or unavailable. No replacement was started.");
+      if (current?.status === "failed") throw new LoginAttemptError("attempt_failed", "The Zerodha Login Attempt failed. Inspect the visible error before starting another attempt.");
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha OTP Challenge.");
+  }
+  /** Cancels the visible Zerodha Login Attempt through its Cancel login control; a page without one is left unchanged. */
+  async cancelLoginAttempt(onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const existing = await this.observeLoginAttempt();
+    if (!existing) return;
+    if (!this.page.evaluate) throw new Error("Browser inspection is unavailable.");
+    const selector = `${OPERATOR_LOGIN_ATTEMPT_SELECTOR} ${OPERATOR_LOGIN_CANCEL_SELECTOR}`;
+    const cancellable = await this.page.evaluate(() => {
+      const button = document.querySelector("[data-operator-login-attempt] [data-operator-login-cancel]");
+      return !!button && !button.disabled;
+    });
+    if (!cancellable) {
+      throw new LoginAttemptError("attempt_not_cancellable", "The Zerodha Login Attempt has no Cancel login control in its current state. Inspect the page.");
+    }
+    onSubmit();
+    await this.page.locator(selector).click();
+    while (Date.now() < deadline) {
+      const current = await this.observeLoginAttempt();
+      if (current?.attemptId !== existing.attemptId) return;
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the Zerodha Login Attempt to be cancelled.");
+  }
+  async submitActiveOtp(attemptId, otp, onSubmit = () => void 0) {
+    const deadline = Date.now() + this.timeoutMs;
+    const assertActive = async () => {
+      if (Date.now() >= deadline) throw new Error("OTP submission exceeded its deadline before submission.");
+      const current = await this.observeLoginAttempt();
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is unavailable. Inspect the page; no login was started.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The requested OTP Challenge has been replaced. No OTP was submitted.");
+      if (current.status !== "awaiting_otp" || current.submitting) throw new LoginAttemptError("attempt_unavailable", "The requested OTP Challenge is expired, failed, or not accepting an OTP.");
+      return current;
+    };
+    const before = await assertActive();
+    const attemptSelector = `[data-operator-login-attempt-id=${JSON.stringify(attemptId)}]`;
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SELECTOR}`).fill(otp);
+    await assertActive();
+    onSubmit();
+    await this.page.locator(`${attemptSelector} ${OPERATOR_LOGIN_OTP_SUBMIT_SELECTOR}`).click();
+    while (Date.now() < deadline) {
+      const state = await this.observeLoginState();
+      if (state.operatorPage) {
+        return { status: "SUCCESS", operatorPage: new PlaywrightOperatorPage(this.page, this.timeoutMs) };
+      }
+      const current = state.attempt;
+      if (state.transitioning || current?.status === "succeeded") {
+        await sleep(50);
+        continue;
+      }
+      if (!current) throw new LoginAttemptError("attempt_unavailable", "The OTP Challenge disappeared after submission. Inspect the page before taking another action.");
+      if (current.attemptId !== attemptId) throw new LoginAttemptError("attempt_replaced", "The OTP Challenge was replaced after submission. No retry was performed.");
+      if (current.status === "failed") return { status: "FAILED", message: current.message ?? "Zerodha Login Attempt failed." };
+      if (!current.submitting && current.failedOtpAttempts > before.failedOtpAttempts) return { status: "FAILED", message: current.message ?? "OTP rejected." };
+      await sleep(50);
+    }
+    throw new Error("Timed out waiting for the OTP submission result. No retry was performed.");
+  }
+  async clickLogoutAccount(onSubmit = () => void 0) {
+    await this.page.waitForSelector?.(ZERODHA_LOGIN_PAGE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    onSubmit();
+    await this.page.locator(UNAUTHENTICATED_OPERATOR_LOGOUT_SELECTOR).click();
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      this.registerCleanup
+    );
+  }
+};
+var PlaywrightHomePage = class {
+  constructor(page, timeoutMs = DEFAULT_TIMEOUT_MS, interactiveLoginTimeoutMs = DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS, headless = true, registerCleanup = () => void 0) {
+    this.page = page;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+    this.registerCleanup = registerCleanup;
+  }
+  page;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  registerCleanup;
+  async enterUsername(username) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_USERNAME_SELECTOR).fill(username);
+  }
+  async enterPassword(password) {
+    await this.page.waitForSelector?.(OPERATOR_LOGIN_GATE_SELECTOR, {
+      timeout: this.timeoutMs
+    });
+    await this.page.locator(OPERATOR_LOGIN_PASSWORD_SELECTOR).fill(password);
+  }
+  async clickConfirm() {
+    await this.page.locator(OPERATOR_LOGIN_CONFIRM_SELECTOR).click();
+    const deadline = Date.now() + this.timeoutMs;
+    while (Date.now() < deadline) {
+      const credentialsStatus = await peekAttribute(
+        this.page,
+        CREDENTIALS_STATUS_SELECTOR,
+        "data-credentials-status"
+      );
+      if (credentialsStatus === "INCORRECT_CREDENTIALS") {
+        return { status: "INCORRECT_CREDENTIALS" };
+      }
+      if (await isAttached(
+        this.page,
+        ZERODHA_LOGIN_PAGE_SELECTOR,
+        "data-zerodha-login-page"
+      )) {
+        return {
+          status: "SUCCESS",
+          zerodhaLoginPage: new PlaywrightZerodhaLoginPage(
+            this.page,
+            this.timeoutMs,
+            this.interactiveLoginTimeoutMs,
+            this.headless,
+            this.registerCleanup
+          )
+        };
+      }
+      await sleep(50);
+    }
+    throw new Error(
+      "Timed out waiting for the Zerodha Login Page after Operator Login confirm"
+    );
+  }
+};
+var PlaywrightCrawler = class {
+  constructor(browser, page, baseUrl, timeoutMs, interactiveLoginTimeoutMs, headless) {
+    this.browser = browser;
+    this.page = page;
+    this.baseUrl = baseUrl;
+    this.timeoutMs = timeoutMs;
+    this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+    this.headless = headless;
+  }
+  browser;
+  page;
+  baseUrl;
+  timeoutMs;
+  interactiveLoginTimeoutMs;
+  headless;
+  cleanups = /* @__PURE__ */ new Set();
+  pageControls;
+  async openHomePage() {
+    await this.page.goto(this.baseUrl);
+    return new PlaywrightHomePage(
+      this.page,
+      this.timeoutMs,
+      this.interactiveLoginTimeoutMs,
+      this.headless,
+      (cleanup) => this.cleanups.add(cleanup)
+    );
+  }
+  controls() {
+    return this.pageControls ??= new PageControls(this.page, this.baseUrl);
+  }
+  getPage() {
+    return this.page;
+  }
+  async close() {
+    for (const cleanup of this.cleanups) {
+      cleanup();
+    }
+    this.cleanups.clear();
+    await this.browser.close();
+  }
+  async forceClose() {
+    if (this.browser.forceClose) {
+      await this.browser.forceClose();
+      return;
+    }
+    await this.browser.close();
+  }
+};
+async function createCrawler(options = {}) {
+  const headless = options.headless ?? true;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const launchTimeoutMs = options.launchTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const interactiveLoginTimeoutMs = options.interactiveLoginTimeoutMs ?? DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS;
+  const browser = await (options.launch ?? (() => chromium.launch({ headless, timeout: launchTimeoutMs })))();
+  const page = await browser.newPage(options.contextOptions);
+  page.setDefaultTimeout?.(timeoutMs);
+  page.setDefaultNavigationTimeout?.(timeoutMs);
+  return new PlaywrightCrawler(
+    browser,
+    page,
+    options.baseUrl ?? DEFAULT_BASE_URL,
+    timeoutMs,
+    interactiveLoginTimeoutMs,
+    headless
+  );
+}
+
+// ../cli/src/sms.ts
+import { spawn } from "node:child_process";
+var SmsReadError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SmsReadError";
+  }
+  code;
+};
+async function readSmsSecret(options) {
+  if (!options.credential.trim()) {
+    throw new SmsReadError("sms_credential_missing", "No protected SMS credential has been provisioned.");
+  }
+  if (!options.name.trim() || !options.scope.trim() || !options.endpoint.trim()) {
+    throw new SmsReadError("sms_unavailable", "SMS configuration is incomplete.");
+  }
+  if (options.signal?.aborted) throw new SmsReadError("sms_unavailable", "SMS access was cancelled.");
+  const command = options.command ?? "npx";
+  const args = options.command ? ["read", options.name] : ["--yes", "--package=@ai-digital-factory/sms-cli@0.1.2", "sms", "read", options.name];
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(command, args, {
+        env: {
+          ...process.env,
+          SMS_ENDPOINT: options.endpoint,
+          SMS_CREDENTIAL: options.credential,
+          SMS_SCOPE: options.scope
+        },
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      reject(new SmsReadError("sms_unavailable", "SMS access is unavailable."));
+      return;
+    }
+    const chunks = [];
+    let length = 0;
+    let settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve(result ?? "");
+    };
+    const onAbort = () => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new SmsReadError("sms_unavailable", "SMS access exceeded the action deadline."));
+    }, options.timeoutMs ?? 3e4);
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.on("data", (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += buffer.length;
+      if (length > 1048576) {
+        child.kill("SIGTERM");
+        finish(new SmsReadError("sms_unavailable", "SMS returned an oversized secret record."));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    child.on("error", () => finish(new SmsReadError("sms_unavailable", "SMS access is unavailable.")));
+    child.on("close", (code) => {
+      if (code !== 0) {
+        finish(new SmsReadError("sms_unavailable", "SMS access is unavailable for the selected Gate scope."));
+        return;
+      }
+      const value = Buffer.concat(chunks).toString("utf8").trimEnd();
+      if (!value.trim()) {
+        finish(new SmsReadError("sms_unavailable", "SMS returned an empty secret record."));
+        return;
+      }
+      finish(void 0, value);
+    });
+  });
+}
+async function readOperatorLoginCredentials(input) {
+  let raw;
+  try {
+    raw = await (input.secretReader ?? readSmsSecret)({
+      name: "live-market-terminal-operator-directory",
+      scope: input.gateScope,
+      endpoint: input.smsEndpoint,
+      credential: input.smsCredential,
+      ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+      ...input.signal ? { signal: input.signal } : {},
+      ...input.command ? { command: input.command } : {}
+    });
+  } catch (error) {
+    if (error instanceof SmsReadError) throw error;
+    throw new SmsReadError("sms_unavailable", "Operator Directory is unavailable from the selected Gate scope.");
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !("operators" in parsed) || !Array.isArray(parsed.operators)) {
+      throw new Error();
+    }
+    const matches = parsed.operators.filter(
+      (entry2) => entry2 && typeof entry2 === "object" && "operatorId" in entry2 && entry2.operatorId === input.operatorId
+    );
+    if (matches.length !== 1) throw new Error();
+    const entry = matches[0];
+    if (typeof entry.loginUsername !== "string" || !entry.loginUsername.trim() || typeof entry.loginPassword !== "string" || !entry.loginPassword.trim()) throw new Error();
+    return { username: entry.loginUsername.trim(), password: entry.loginPassword };
+  } catch {
+    throw new SmsReadError("invalid_operator_directory", "The selected Gate Operator Directory is invalid or does not contain exactly one configured Operator.");
+  }
+}
+
+// src/operator.ts
+var OperatorActionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+async function operatorLogin(input) {
+  const deadlineAt = Date.now() + input.timeoutMs;
+  const remaining = () => {
+    const timeout = deadlineAt - Date.now();
+    if (timeout < 1) throw new Error("Operator login exceeded its deadline before submission.");
+    return timeout;
+  };
+  let target;
+  try {
+    target = resolveCliTarget({ LMT_ENV: input.environment }, process.env.LMT_WEB_CONFIG_PATH || DEFAULT_CONFIG_PATH2);
+    if (target.origin !== input.origin) throw new Error("The configured Web URL changed. Start a new browser session.");
+  } catch {
+    throw new OperatorActionError("invalid_sms_configuration", "Check smsEndpoint, Gate scope, and OPERATOR_1 in the selected Web configuration, then start a fresh session.");
+  }
+  let credential;
+  try {
+    credential = await new CliProfileStore(void 0, void 0, ".lmt-web").getSmsCredential();
+  } catch {
+    throw new OperatorActionError("sms_credential_unavailable", "Could not read protected SMS storage. Provision the SMS read credential again.");
+  }
+  if (!credential) throw new OperatorActionError("sms_credential_missing", `Provision the SMS read credential with \`lmt-web credential provision --env ${input.environment} --credential-stdin\` before Operator login.`);
+  input.registerSecrets(credential);
+  let credentials;
+  try {
+    credentials = await readOperatorLoginCredentials({
+      operatorId: target.operatorId,
+      gateScope: target.gateScope,
+      smsEndpoint: target.smsEndpoint,
+      smsCredential: credential,
+      timeoutMs: remaining(),
+      ...process.env.LMT_WEB_SMS_COMMAND ? { command: process.env.LMT_WEB_SMS_COMMAND } : {}
+    });
+  } catch (error) {
+    throw new OperatorActionError(error instanceof SmsReadError ? error.code : "sms_unavailable", "Could not load Operator credentials from the selected Gate SMS scope. Check provisioning and SMS reachability.");
+  }
+  input.registerSecrets(credentials.username, credentials.password);
+  const home = new PlaywrightHomePage(input.page, remaining());
+  await home.enterUsername(credentials.username);
+  await home.enterPassword(credentials.password);
+  remaining();
+  input.onSubmit?.();
+  const result = await home.clickConfirm();
+  if (result.status !== "SUCCESS") throw new OperatorActionError("incorrect_credentials", "The Home Page rejected the configured Operator credentials. Check the selected Gate Operator Directory.");
+}
+async function operatorLogout(page, timeoutMs, onSubmit = () => void 0) {
+  const isOperatorPage = await page.evaluate?.(() => !!document.querySelector('[data-operator-page="true"]'));
+  if (isOperatorPage) {
+    await new PlaywrightOperatorPage(page, timeoutMs).clickLogoutZerodha(onSubmit);
+  }
+  await new PlaywrightZerodhaLoginPage(page, timeoutMs).clickLogoutAccount(onSubmit);
+}
+
+// src/session.ts
+var SOCKET_DIRECTORY = path5.join(os2.tmpdir(), `lmt-web-${process.getuid?.() ?? "user"}`);
+var SESSION_ID_PATTERN = /^[a-f0-9]{32}$/;
+var OWNER_RESPONSE_GRACE_MS = 1e3;
+var OWNER_CLEANUP_GRACE_MS = 2e3;
+var IPHONE_13_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1";
+function createSessionId() {
+  return randomBytes2(16).toString("hex");
+}
+function isSessionId(value) {
+  return !!value && SESSION_ID_PATTERN.test(value);
+}
+async function ensureSessionDirectory() {
+  if (process.platform === "win32") {
+    throw new Error("lmt-web session sockets are supported on macOS and Linux.");
+  }
+  await mkdir3(SOCKET_DIRECTORY, { recursive: true, mode: 448 });
+  await chmod2(SOCKET_DIRECTORY, 448);
+  const directory = await lstat3(SOCKET_DIRECTORY);
+  const uid = process.getuid?.();
+  if (!directory.isDirectory() || uid !== void 0 && directory.uid !== uid) {
+    throw new Error("The lmt-web session directory is not owned by the invoking user.");
+  }
+}
+function socketPathFor(sessionId) {
+  return path5.join(SOCKET_DIRECTORY, `${sessionId}.sock`);
+}
+function artifactsDirectory(sessionId) {
+  return path5.join(SOCKET_DIRECTORY, "artifacts", sessionId);
+}
+function sanitizeUrls(value) {
+  return value.replace(/https?:\/\/[^\s)'"<>]+/gi, (candidate) => safeUrl(candidate) ?? "[url]");
+}
+function safeUrl(value) {
+  try {
+    const url = new URL(value);
+    if (!/^https?:$/.test(url.protocol) || url.origin === "null") return null;
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return null;
+  }
+}
+function failureCode(error) {
+  if (error instanceof SavedSessionError) return "saved_session_unavailable";
+  if (error instanceof ControlError) return error.code;
+  const message = error instanceof Error ? error.message : "";
+  if (/timed out|timeout|deadline/i.test(message)) return "deadline_exceeded";
+  if (/executable doesn't exist|browser.*not.*installed|could not find.*browser/i.test(message)) {
+    return "browser_unavailable";
+  }
+  if (/net::ERR_(?:CONNECTION_REFUSED|CONNECTION_TIMED_OUT|NAME_NOT_RESOLVED|ADDRESS_UNREACHABLE|INTERNET_DISCONNECTED|EMPTY_RESPONSE)/i.test(message)) {
+    return "service_unavailable";
+  }
+  return "action_failed";
+}
+function messageFor(error) {
+  const message = error instanceof Error ? error.message : "The browser action failed.";
+  return sanitizeUrls(message).slice(0, 500);
+}
+function deviceContext(mode) {
+  if (mode === "mobile") {
+    return {
+      name: "iPhone 13",
+      contextOptions: {
+        viewport: { width: 390, height: 844 },
+        deviceScaleFactor: 3,
+        isMobile: true,
+        hasTouch: true,
+        userAgent: IPHONE_13_USER_AGENT
+      }
+    };
+  }
+  return {
+    name: "Desktop",
+    contextOptions: {
+      viewport: { width: 1440, height: 900 },
+      deviceScaleFactor: 1,
+      isMobile: false,
+      hasTouch: false
+    }
+  };
+}
+async function launchSessionBrowser(headless, deadlineAt, onServerReady, onBrowserClosed) {
+  const browserServer = await chromium2.launchServer({
+    headless,
+    timeout: Math.max(1, deadlineAt - Date.now())
+  });
+  let forceClosePromise;
+  const forceClose = () => {
+    forceClosePromise ??= browserServer.kill();
+    return forceClosePromise;
+  };
+  onServerReady(forceClose);
+  try {
+    const connectTimeoutMs = Math.max(1, deadlineAt - Date.now());
+    if (deadlineAt <= Date.now()) throw new Error("The browser action exceeded its deadline.");
+    const browser = await chromium2.connect(browserServer.wsEndpoint(), { timeout: connectTimeoutMs });
+    browser.once("disconnected", onBrowserClosed);
+    let closePromise;
+    return {
+      newPage: async (options) => {
+        const page = await browser.newPage(options);
+        page.once("close", onBrowserClosed);
+        return page;
+      },
+      close: () => {
+        closePromise ??= (async () => {
+          let closeError;
+          try {
+            await browser.close();
+          } catch (error) {
+            closeError = error;
+          }
+          try {
+            await browserServer.close();
+          } catch (error) {
+            closeError ??= error;
+          }
+          if (closeError) throw closeError;
+        })();
+        return closePromise;
+      },
+      forceClose
+    };
+  } catch (error) {
+    await forceClose().catch(() => void 0);
+    throw error;
+  }
+}
+async function waitForRenderedPage(page) {
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  let settled = false;
+  while (true) {
+    const ready = await page.evaluate(() => {
+      const visible = (element) => {
+        const rect = element.getBoundingClientRect();
+        const style = getComputedStyle(element);
+        return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+      };
+      const loading = Array.from(document.querySelectorAll('[data-session-loading], [aria-busy="true"]')).some(visible);
+      const animating = document.getAnimations().some(
+        (animation) => (animation.pending || animation.playState === "running") && Number.isFinite(Number(animation.effect?.getComputedTiming().endTime))
+      );
+      const imagesPending = Array.from(document.images).some((image) => visible(image) && !image.complete);
+      const hasContent = !!document.body?.innerText.trim() || Array.from(
+        document.querySelectorAll('button, a[href], input:not([type="hidden"]), select, textarea, canvas, svg, img, video, iframe')
+      ).some(visible);
+      return document.readyState === "complete" && document.fonts.status === "loaded" && hasContent && !loading && !animating && !imagesPending;
+    });
+    if (ready && settled) return;
+    settled = ready;
+    await wait(50);
+  }
+}
+async function inspectPage(page, mode, crawler) {
+  await waitForRenderedPage(page);
+  if (!page.evaluate) throw new Error("The browser page does not support inspection.");
+  const result = await page.evaluate(() => {
+    const visible = (element) => {
+      const rect = element.getBoundingClientRect();
+      const style = getComputedStyle(element);
+      return rect.width > 0 && rect.height > 0 && style.visibility !== "hidden" && style.display !== "none";
+    };
+    const hasVisible = (selector) => Array.from(document.querySelectorAll(selector)).some(visible);
+    const operatorLogin2 = hasVisible('[data-operator-login-gate="true"]');
+    const zerodhaLogin = hasVisible('[data-zerodha-login-page="true"]');
+    const operatorPage = hasVisible('[data-operator-page="true"]');
+    const restoring = hasVisible('[data-zerodha-restoration="pending"]');
+    let authentication = { status: "unknown" };
+    if (Number(operatorLogin2) + Number(zerodhaLogin) + Number(operatorPage) + Number(restoring) === 1 && !hasVisible('[data-session-loading], [aria-busy="true"]')) {
+      if (operatorLogin2) authentication = { status: "operator_login_required", nextAction: "operator-login" };
+      if (operatorPage) authentication = { status: "authenticated" };
+      if (restoring) authentication = { status: "zerodha_session_restoring" };
+      if (zerodhaLogin) {
+        authentication = { status: "zerodha_login_required" };
+        const attempt = document.querySelector('[data-zerodha-login-page="true"] [data-operator-login-attempt]');
+        if (!attempt) authentication = { status: "zerodha_login_required", nextAction: "zerodha-login" };
+        else if (visible(attempt) && attempt.getAttribute("data-operator-login-status") === "awaiting_otp" && attempt.getAttribute("data-operator-login-submitting-otp") !== "true") {
+          const attemptId = attempt.getAttribute("data-operator-login-attempt-id");
+          if (attemptId) authentication = { status: "zerodha_login_required", nextAction: "zerodha-otp", attemptId };
+        }
+      }
+    }
+    const controls2 = Array.from(
+      document.querySelectorAll("button, a[href], input, select, textarea, [role=button]")
+    ).filter(visible).slice(0, 100).map((element, index) => {
+      const labels = element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement || element instanceof HTMLSelectElement ? Array.from(element.labels ?? []).map((item) => item.innerText).join(" ") : "";
+      const label = element.getAttribute("aria-label") || element.getAttribute("title") || labels || (element instanceof HTMLInputElement || element instanceof HTMLTextAreaElement ? element.placeholder : "") || (element instanceof HTMLSelectElement ? element.selectedOptions[0]?.innerText : "") || element.textContent || "";
+      const kind = element.getAttribute("role") || element.tagName.toLowerCase();
+      return {
+        reference: `control-${index + 1}`,
+        kind,
+        label: label.replace(/\s+/g, " ").trim().slice(0, 160)
+      };
+    });
+    return {
+      authentication,
+      title: document.title,
+      text: document.body?.innerText ?? "",
+      controls: controls2,
+      viewport: { width: window.innerWidth, height: window.innerHeight },
+      deviceScaleFactor: window.devicePixelRatio,
+      hasTouch: navigator.maxTouchPoints > 0,
+      userAgent: navigator.userAgent
+    };
+  });
+  const controls = crawler ? await crawler.controls().inspect() : result.controls;
+  const redact = (value) => sanitizeUrls(crawler?.controls().redact(value) ?? value);
+  const viewport = page.viewportSize?.() ?? result.viewport;
+  return {
+    authentication: "attemptId" in result.authentication ? { ...result.authentication, attemptId: redact(result.authentication.attemptId) } : result.authentication,
+    url: safeUrl(redact(page.url())),
+    visibleState: {
+      title: redact(result.title).slice(0, 300),
+      text: redact(result.text).slice(0, 4e3),
+      controls: controls.map((control) => ({ ...control, label: redact(control.label) }))
+    },
+    device: {
+      name: deviceContext(mode).name,
+      mode,
+      viewport,
+      deviceScaleFactor: result.deviceScaleFactor,
+      hasTouch: result.hasTouch,
+      userAgent: sanitizeUrls(result.userAgent).slice(0, 300)
+    }
+  };
+}
+var ACCESS_TOKEN_SCREENSHOT_MASK = '[data-lmt-sensitive="zerodha-access-token"]';
+async function screenshotMaskOptions(page) {
+  const playwrightPage = page;
+  const locator = playwrightPage.locator(ACCESS_TOKEN_SCREENSHOT_MASK);
+  if (!await locator.count()) return {};
+  return { mask: [locator], maskColor: "#000000" };
+}
+async function captureScreenshot(page, sessionId, action, fullPage, timeoutMs, onTimeout, crawler) {
+  if (!page) return { outcome: "unavailable", reason: "No browser page was available." };
+  if (!page.screenshot) return { outcome: "failed", error: "The browser does not support screenshots." };
+  const directory = artifactsDirectory(sessionId);
+  const filename = `${Date.now()}-${action}-${randomBytes2(4).toString("hex")}.png`;
+  const screenshotPath = path5.resolve(directory, filename);
+  if (timeoutMs < 1) {
+    return { outcome: "failed", error: "The action deadline elapsed before screenshot capture." };
+  }
+  try {
+    await mkdir3(directory, { recursive: true, mode: 448 });
+    await chmod2(directory, 448);
+    await withDeadline(
+      (async () => {
+        await waitForRenderedPage(page);
+        const maskOptions = crawler ? { mask: await crawler.controls().screenshotMasks(), maskColor: "#000000" } : await screenshotMaskOptions(page);
+        const options = {
+          path: screenshotPath,
+          fullPage,
+          animations: "disabled",
+          timeout: timeoutMs,
+          ...maskOptions
+        };
+        return fullPage ? captureFullContent(page, options) : page.screenshot(options);
+      })(),
+      timeoutMs,
+      onTimeout
+    );
+    await chmod2(screenshotPath, 384);
+    return { outcome: "captured", path: screenshotPath, fullPage };
+  } catch (error) {
+    await unlink2(screenshotPath).catch(() => void 0);
+    return { outcome: "failed", error: messageFor(error) };
+  }
+}
+function remainingMs(deadlineAt) {
+  return Math.max(0, deadlineAt - Date.now());
+}
+function withDeadline(promise, timeoutMs, onTimeout) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      callback();
+    };
+    const timeout = setTimeout(() => {
+      onTimeout?.();
+      finish(() => reject(new Error("The browser action exceeded its deadline.")));
+    }, Math.max(1, timeoutMs));
+    promise.then(
+      (value) => finish(() => resolve(value)),
+      (error) => finish(() => reject(error))
+    );
+  });
+}
+async function runSessionOwner(options) {
+  await ensureSessionDirectory();
+  const socketPath = socketPathFor(options.sessionId);
+  const device = deviceContext(options.mode);
+  const saved = options.persist ? await SavedSession.open({ environment: options.environment ?? "local", origin: options.origin, mode: options.mode }) : void 0;
+  const storageState = saved?.load();
+  let checkpointQueue = Promise.resolve();
+  let checkpointError;
+  function checkpoint() {
+    if (!saved || !page) return Promise.resolve();
+    const context = page.context();
+    const save = async () => {
+      const cookies = await context.cookies(options.origin);
+      await saved.save({ cookies, origins: [] });
+    };
+    checkpointQueue = checkpointQueue.then(save, save);
+    checkpointQueue.catch(() => {
+      checkpointError = new SavedSessionError();
+    });
+    return checkpointQueue;
+  }
+  let crawler;
+  let page;
+  let startupError;
+  let startComplete = false;
+  let closing = false;
+  let abortOnShutdown = false;
+  let operationQueue = Promise.resolve();
+  let shutdownPromise;
+  let initializationPromise;
+  let startupLease;
+  let crawlerClosePromise;
+  let expirationCleanup;
+  let forceClosePendingBrowser;
+  let pendingBrowserForceClosePromise;
+  const sockets = /* @__PURE__ */ new Set();
+  function closeCrawler() {
+    if (!crawler) return Promise.resolve();
+    crawlerClosePromise ??= crawler.close();
+    return crawlerClosePromise;
+  }
+  function forceCloseBrowser() {
+    if (crawler?.forceClose) return crawler.forceClose();
+    if (!forceClosePendingBrowser) return Promise.resolve();
+    pendingBrowserForceClosePromise ??= forceClosePendingBrowser();
+    return pendingBrowserForceClosePromise;
+  }
+  function expireSession() {
+    closing = true;
+    abortOnShutdown = true;
+    expirationCleanup ??= (async () => {
+      if (initializationPromise) {
+        await Promise.race([
+          initializationPromise,
+          wait(OWNER_CLEANUP_GRACE_MS)
+        ]).catch(() => void 0);
+      }
+      if (crawler) await closeCrawler();
+      else await forceCloseBrowser();
+    })();
+    void expirationCleanup.catch(() => void 0);
+  }
+  const server = net.createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    let payload = "";
+    let handled = false;
+    socket.on("data", (chunk) => {
+      if (handled) return;
+      payload += chunk.toString("utf8");
+      const newline = payload.indexOf("\n");
+      if (newline < 0) return;
+      handled = true;
+      const line = payload.slice(0, newline);
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        socket.end(`${JSON.stringify(failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId))}
+`);
+        return;
+      }
+      const run = async () => {
+        let response;
+        try {
+          response = await handleRequest(request);
+        } catch (error) {
+          response = failureResult(request.action, error instanceof SavedSessionError ? "saved_session_unavailable" : "action_failed", "The browser action could not complete safely. Inspect before retrying.", options.sessionId);
+        }
+        if (isAction(request.action) && isControlAction(request)) {
+          response.audit = { outcome: "unavailable" };
+          if (page?.evaluate && new URL(page.url()).origin === options.origin) {
+            try {
+              const recorded = await withDeadline(page.evaluate(async (event) => {
+                const response2 = await fetch("/api/journey-records", {
+                  method: "POST",
+                  headers: { "content-type": "application/json" },
+                  body: JSON.stringify({ records: [{
+                    eventType: "journey_step",
+                    eventValue: `Web CLI ${event.action}`,
+                    session: event.session,
+                    eventMeta: {
+                      step: `Web CLI ${event.action}`,
+                      outcome: event.outcome === "success" ? "success" : "failure",
+                      ...event.outcome === "success" ? {} : { error_code: event.outcome === "uncertain" ? "action_uncertain" : "browser_action_failed" },
+                      web_visit: event.session,
+                      journey_id: event.session,
+                      client_kind: "cli",
+                      client_profile: event.profile,
+                      action_outcome: event.outcome,
+                      screenshot_outcome: event.screenshot
+                    }
+                  }] }),
+                  signal: AbortSignal.timeout(500)
+                });
+                return response2.status === 202;
+              }, { action: request.action, session: options.sessionId, profile: `web-cli-${options.mode}`, outcome: response.outcome, screenshot: response.screenshot.outcome }), 750);
+              response.audit = { outcome: recorded ? "recorded" : "failed" };
+            } catch {
+              response.audit = { outcome: "failed" };
+            }
+          }
+        }
+        socket.end(`${JSON.stringify(response)}
+`);
+        if (closing) socket.once("close", () => void shutdown());
+      };
+      operationQueue = operationQueue.then(run, run).catch(() => void 0);
+    });
+  });
+  async function initialize(deadlineAt) {
+    try {
+      crawler = await createCrawler({
+        baseUrl: options.origin,
+        headless: options.headless,
+        timeoutMs: Math.min(options.timeoutMs, Math.max(1, remainingMs(deadlineAt))),
+        contextOptions: { ...device.contextOptions, ...storageState ? { storageState } : {} },
+        launch: () => {
+          const onServerReady = (forceClose) => {
+            forceClosePendingBrowser = forceClose;
+            if (abortOnShutdown) void forceCloseBrowser().catch(() => void 0);
+          };
+          return options.launch ? options.launch(deadlineAt, onServerReady) : launchSessionBrowser(options.headless, deadlineAt, onServerReady, () => {
+            if (closing) return;
+            closing = true;
+            abortOnShutdown = true;
+            void shutdown();
+          });
+        }
+      });
+      page = crawler.getPage();
+      const browserContext = page.context?.();
+      if (browserContext?.route) await browserContext.route("**/*", async (route) => {
+        const request = route.request();
+        if (new URL(request.url()).origin !== options.origin) return route.continue();
+        await route.continue({ headers: { ...request.headers(), "x-lmt-client-kind": "cli", "x-lmt-client-profile": `web-cli-${options.mode}` } });
+      });
+      if (saved) {
+        page.context().on("requestfinished", (request) => {
+          if (new URL(request.url()).origin !== options.origin) return;
+          void request.response().then(async (response) => {
+            const headers = await response?.allHeaders();
+            if (headers?.["set-cookie"] && !closing) await checkpoint();
+          }).catch(() => {
+            checkpointError = new SavedSessionError();
+          });
+        });
+      }
+      if (closing) {
+        await closeCrawler();
+        return;
+      }
+      await crawler.openHomePage();
+      await withDeadline(checkpoint(), remainingMs(deadlineAt), expireSession);
+    } catch (error) {
+      startupError = error;
+    }
+  }
+  async function handleRequest(request) {
+    if (!request || request.sessionId !== options.sessionId || !isAction(request.action) || !Number.isFinite(request.timeoutMs) || request.timeoutMs < 1 || !Number.isFinite(request.deadlineAt)) {
+      return failureResult("inspect", "invalid_request", "The session request was invalid.", options.sessionId);
+    }
+    if (closing) return failureResult(request.action, "session_unavailable", "The browser owner is closing. Start to restore the saved session.", options.sessionId);
+    const deadlineAt = request.deadlineAt;
+    if (remainingMs(deadlineAt) === 0) {
+      return failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", options.sessionId);
+    }
+    if (request.action === "start" && startComplete) {
+      return { ...await handleRequest({ ...request, action: "inspect" }), action: "start" };
+    }
+    if (request.action === "stop") {
+      await withDeadline(checkpoint(), Math.min(500, Math.max(1, remainingMs(deadlineAt)))).catch(() => void 0);
+      closing = true;
+      abortOnShutdown = true;
+      try {
+        crawlerClosePromise = forceCloseBrowser();
+        await withDeadline(crawlerClosePromise, remainingMs(deadlineAt), expireSession);
+        return {
+          version: RESULT_VERSION,
+          sessionId: options.sessionId,
+          action: "stop",
+          outcome: "success",
+          authentication: { status: "unknown" },
+          url: null,
+          visibleState: null,
+          device: null,
+          screenshot: { outcome: "unavailable", reason: "Stop terminates the browser without capturing a screenshot." }
+        };
+      } catch (error2) {
+        return failureResult("stop", failureCode(error2), messageFor(error2), options.sessionId);
+      }
+    }
+    if (!startComplete && request.action !== "start") {
+      return failureResult(request.action, "session_starting", "The browser session is not ready yet.", options.sessionId);
+    }
+    if (checkpointError) throw checkpointError;
+    if (!startComplete) {
+      clearTimeout(startupLease);
+      initializationPromise ??= initialize(deadlineAt);
+      try {
+        await withDeadline(initializationPromise, remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        startupError = error2;
+      }
+    }
+    if (request.action === "start") {
+      startComplete = true;
+      let inspectionError;
+      const inspected2 = page && !startupError && remainingMs(deadlineAt) > 0 ? await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession).catch((error2) => {
+        inspectionError = error2;
+        return null;
+      }) : null;
+      const screenshot2 = startupError || inspectionError ? { outcome: "unavailable", reason: "The page did not finish loading and inspection." } : await captureScreenshot(
+        page,
+        options.sessionId,
+        "start",
+        false,
+        remainingMs(deadlineAt),
+        expireSession,
+        crawler
+      );
+      const actionError2 = startupError ?? inspectionError;
+      const result = {
+        version: RESULT_VERSION,
+        sessionId: options.sessionId,
+        action: "start",
+        outcome: actionError2 ? "failure" : "success",
+        authentication: inspected2?.authentication ?? { status: "unknown" },
+        url: inspected2?.url ?? (startupError ? safeUrl(options.origin) : page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+        visibleState: inspected2?.visibleState ?? null,
+        device: inspected2?.device ?? null,
+        screenshot: screenshot2,
+        ...startupError ? {
+          error: {
+            code: failureCode(startupError),
+            message: page ? failureCode(startupError) === "service_unavailable" ? "Could not load the configured Web URL. Confirm that the selected service is running and reachable." : failureCode(startupError) === "deadline_exceeded" ? "Opening the Home Page exceeded its deadline. Start a fresh session and retry." : messageFor(startupError) : failureCode(startupError) === "browser_unavailable" ? "Could not launch the browser. Install its Chromium runtime with `lmt-web install-browser` and retry." : messageFor(startupError)
+          }
+        } : inspectionError ? {
+          error: {
+            code: failureCode(inspectionError),
+            message: "The Home Page loaded but its visible state could not be inspected."
+          }
+        } : {}
+      };
+      if (startupError) {
+        closing = true;
+      }
+      return result;
+    }
+    if (startupError || !crawler || !page) {
+      return failureResult(request.action, "session_unavailable", "The browser session is no longer available. Start a new session.", options.sessionId);
+    }
+    let guidedError;
+    let submitted = false;
+    const actionDeadlineAt = deadlineAt - Math.min(1500, Math.floor(remainingMs(deadlineAt) / 2));
+    const pendingActions = /* @__PURE__ */ new Set();
+    const runAction = (operation, timeoutMs) => {
+      pendingActions.add(operation);
+      operation.then(() => pendingActions.delete(operation), () => pendingActions.delete(operation));
+      return withDeadline(operation, timeoutMs);
+    };
+    const actionTimeout = () => Math.max(1, remainingMs(actionDeadlineAt));
+    page.setDefaultTimeout?.(actionTimeout());
+    page.setDefaultNavigationTimeout?.(actionTimeout());
+    let loginAttempt;
+    const onSubmit = () => {
+      submitted = true;
+    };
+    const zerodha = new PlaywrightZerodhaLoginPage(page, actionTimeout());
+    try {
+      if (request.action === "operator-login") await runAction(operatorLogin({ page, environment: options.environment ?? "local", origin: options.origin, timeoutMs: actionTimeout(), onSubmit, registerSecrets: (...values) => crawler.controls().registerSecrets(...values) }), actionTimeout());
+      if (request.action === "operator-logout") await runAction(operatorLogout(page, actionTimeout(), onSubmit), actionTimeout());
+      if (request.action === "zerodha-login") loginAttempt = await runAction(zerodha.startLoginAttempt(onSubmit), actionTimeout());
+      if (request.action === "zerodha-cancel") await runAction(zerodha.cancelLoginAttempt(onSubmit), actionTimeout());
+      if (request.action === "zerodha-otp") {
+        if (!request.attemptId || !request.otp || !/^\d{6}$/.test(request.otp)) throw new OperatorActionError("invalid_otp", "Supply a six-digit OTP and the attempt ID returned by zerodha-login.");
+        crawler.controls().registerSecrets(request.otp);
+        const result = await runAction(zerodha.submitActiveOtp(request.attemptId, request.otp, onSubmit), actionTimeout());
+        if (result.status !== "SUCCESS") throw new OperatorActionError("otp_rejected", result.message);
+      }
+      if (request.action === "zerodha-logout") await runAction(new PlaywrightOperatorPage(page, actionTimeout()).clickLogoutZerodha(onSubmit), actionTimeout());
+    } catch (error2) {
+      guidedError = error2;
+    }
+    let inspected = null;
+    let controlResult;
+    let actionError;
+    try {
+      if (isControlAction(request)) {
+        const budget = Math.max(1, remainingMs(deadlineAt) - Math.min(2e3, request.timeoutMs / 4));
+        controlResult = await runAction(crawler.controls().act(request, budget, () => {
+          submitted = true;
+        }), budget);
+      }
+    } catch (error2) {
+      actionError = request.action === "click" && submitted && failureCode(error2) === "deadline_exceeded" ? new ControlError("action_uncertain", "The click may have been submitted but its completion was not confirmed. Inspect before deciding whether to retry.") : error2;
+      if (request.action === "click" && failureCode(actionError) === "action_uncertain") {
+        await withDeadline(crawler.controls().stopLoading(), Math.min(500, remainingMs(deadlineAt))).catch(() => void 0);
+      }
+    }
+    if (pendingActions.size || failureCode(actionError ?? guidedError) === "deadline_exceeded") {
+      try {
+        await withDeadline((async () => {
+          await crawler.controls().stopLoading();
+          await Promise.allSettled([...pendingActions]);
+          await page.evaluate?.(() => document.readyState);
+        })(), Math.min(500, Math.max(1, remainingMs(deadlineAt))), expireSession);
+      } catch {
+        expireSession();
+        return { ...failureResult(request.action, submitted ? "action_uncertain" : "deadline_exceeded", "The browser could not safely recover from the action deadline. Start to restore the saved session; do not replay an uncertain action.", options.sessionId), outcome: submitted ? "uncertain" : "failure" };
+      }
+    }
+    if (saved) {
+      try {
+        await withDeadline(checkpoint(), Math.max(1, remainingMs(deadlineAt)), expireSession);
+      } catch (error2) {
+        actionError ??= error2;
+      }
+    }
+    try {
+      inspected = await withDeadline(inspectPage(page, options.mode, crawler), remainingMs(deadlineAt), expireSession);
+    } catch (error2) {
+      actionError ??= error2;
+    }
+    const screenshot = await captureScreenshot(
+      page,
+      options.sessionId,
+      request.action,
+      request.fullPage === true,
+      remainingMs(deadlineAt),
+      expireSession,
+      crawler
+    );
+    let closeError;
+    if (request.action === "close") {
+      closing = true;
+      try {
+        await withDeadline(closeCrawler(), remainingMs(deadlineAt), expireSession);
+      } catch (error2) {
+        closeError = error2;
+        if (!abortOnShutdown) {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      }
+    }
+    const error = guidedError ?? actionError ?? closeError;
+    return {
+      version: RESULT_VERSION,
+      sessionId: options.sessionId,
+      action: request.action,
+      outcome: error instanceof ControlError && error.code === "action_uncertain" ? "uncertain" : error ? submitted && !(error instanceof OperatorActionError) && !(error instanceof LoginAttemptError) ? "uncertain" : "failure" : "success",
+      authentication: inspected?.authentication ?? { status: "unknown" },
+      ...!actionError ? controlResult : {},
+      ...loginAttempt ? { loginAttempt: { attemptId: loginAttempt.attemptId, status: loginAttempt.status } } : {},
+      url: inspected?.url ?? (page ? safeUrl(crawler?.controls().redact(page.url()) ?? page.url()) : null),
+      visibleState: inspected?.visibleState ?? null,
+      device: inspected?.device ?? null,
+      screenshot,
+      ...error ? { error: { code: error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.code : failureCode(error), message: crawler.controls().redact(error instanceof OperatorActionError || error instanceof LoginAttemptError ? error.message : messageFor(error)) } } : {}
+    };
+  }
+  function shutdown() {
+    if (!closing) return Promise.resolve();
+    if (shutdownPromise) return shutdownPromise;
+    clearTimeout(startupLease);
+    shutdownPromise = (async () => {
+      for (const socket of sockets) socket.destroy();
+      await unlink2(socketPath).catch(() => void 0);
+      server.close();
+      if (abortOnShutdown) {
+        const cleanup = crawler ? closeCrawler() : forceClosePendingBrowser ? forceCloseBrowser() : expirationCleanup ?? Promise.resolve();
+        let cleanupFinished = false;
+        let cleanupFailed = false;
+        const observedCleanup = cleanup.then(
+          () => {
+            cleanupFinished = true;
+          },
+          () => {
+            cleanupFinished = true;
+            cleanupFailed = true;
+          }
+        );
+        await Promise.race([observedCleanup, wait(OWNER_CLEANUP_GRACE_MS)]);
+        if (!cleanupFinished || cleanupFailed) {
+          await forceCloseBrowser().catch(() => void 0);
+        }
+        (options.exit ?? process.exit)(0);
+        return;
+      }
+      if (crawler) {
+        try {
+          await withDeadline(checkpoint(), OWNER_CLEANUP_GRACE_MS);
+          await closeCrawler();
+        } catch {
+          await crawler.forceClose?.().catch(() => void 0);
+        }
+      } else if (forceClosePendingBrowser) {
+        await forceCloseBrowser().catch(() => void 0);
+      }
+      await withDeadline(checkpointQueue, OWNER_CLEANUP_GRACE_MS).catch(() => void 0);
+      saved?.close();
+      process.removeListener("SIGTERM", onSignal);
+      process.removeListener("SIGINT", onSignal);
+    })();
+    return shutdownPromise;
+  }
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.removeListener("error", reject);
+      void chmod2(socketPath, 384).then(resolve, reject);
+    });
+  });
+  startupLease = setTimeout(() => {
+    if (initializationPromise) return;
+    expireSession();
+    void shutdown();
+  }, options.timeoutMs);
+  const onSignal = () => {
+    closing = true;
+    void shutdown();
+  };
+  process.once("SIGTERM", onSignal);
+  process.once("SIGINT", onSignal);
+}
+async function wait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function assertOwnedSocket(socketPath) {
+  return lstat3(socketPath).then((entry) => {
+    const uid = process.getuid?.();
+    if (!entry.isSocket() || uid !== void 0 && entry.uid !== uid) {
+      throw new Error("The lmt-web session socket is not owned by the invoking user.");
+    }
+  });
+}
+async function requestSession(request, options = {}) {
+  if (!isSessionId(request.sessionId)) {
+    return failureResult(request.action, "invalid_session_id", "A valid session ID is required.", request.sessionId || null);
+  }
+  const socketPath = socketPathFor(request.sessionId);
+  const deadlineAt = Date.now() + request.timeoutMs;
+  const wireRequest = { ...request, deadlineAt };
+  if (options.waitForSocket) {
+    let ready = false;
+    while (Date.now() < deadlineAt) {
+      try {
+        await assertOwnedSocket(socketPath);
+        ready = true;
+        break;
+      } catch {
+        if (options.ownerAlive && !options.ownerAlive()) {
+          return failureResult(request.action, "browser_start_failed", "The browser session owner exited before it became ready.", request.sessionId);
+        }
+        await wait(40);
+      }
+    }
+    if (!ready) {
+      return failureResult(request.action, "deadline_exceeded", "The browser session did not become ready before its deadline.", request.sessionId);
+    }
+  }
+  try {
+    await assertOwnedSocket(socketPath);
+  } catch {
+    return failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId);
+  }
+  return new Promise((resolve) => {
+    const socket = net.createConnection(socketPath);
+    let received = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => {
+      finish(failureResult(request.action, "deadline_exceeded", "The browser action exceeded its deadline.", request.sessionId));
+    }, Math.max(1, deadlineAt + OWNER_RESPONSE_GRACE_MS - Date.now()));
+    socket.once("connect", () => socket.write(`${JSON.stringify(wireRequest)}
+`));
+    socket.on("data", (chunk) => {
+      received += chunk.toString("utf8");
+      const newline = received.indexOf("\n");
+      if (newline < 0) return;
+      try {
+        finish(JSON.parse(received.slice(0, newline)));
+      } catch {
+        finish(failureResult(request.action, "invalid_response", "The browser session returned an invalid result.", request.sessionId));
+      }
+    });
+    socket.once("error", () => {
+      finish(failureResult(request.action, "session_not_found", "The browser session is not live. Start a new session.", request.sessionId));
+    });
+    socket.once("close", () => {
+      if (!settled) {
+        finish(failureResult(request.action, "session_not_found", "The browser session closed before returning a result.", request.sessionId));
+      }
+    });
+  });
+}
+
+// src/start.ts
+import { spawn as spawn2 } from "node:child_process";
+import path6 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+async function startSession(command) {
+  let target;
+  try {
+    target = resolveWebTarget(command.environment);
+  } catch (error) {
+    throw new InvocationError(error instanceof Error ? error.message : "The selected target is invalid.", "invalid_target");
+  }
+  await ensureSessionDirectory();
+  const deadlineAt = Date.now() + command.timeoutMs;
+  const store = command.fresh ? void 0 : await SavedSession.open({ ...target, mode: command.mode });
+  let spawned;
+  let spawnedSessionId;
+  try {
+    store?.load();
+    const selectOwner = () => {
+      const existing = store?.owner();
+      if (existing) {
+        if (existing.headless !== command.headless) throw new InvocationError("The saved session is already live with different visibility. Close it before changing --headed, or use --fresh.");
+        return existing;
+      }
+      const sessionId = createSessionId();
+      const scriptPath = path6.resolve(process.argv[1] || fileURLToPath3(import.meta.url));
+      const child = spawn2(process.execPath, [
+        scriptPath,
+        "__owner",
+        sessionId,
+        target.origin,
+        command.mode,
+        command.headless ? "headless" : "headed",
+        String(command.timeoutMs),
+        target.environment,
+        command.fresh ? "fresh" : "saved"
+      ], { detached: true, stdio: "ignore" });
+      spawned = child;
+      spawnedSessionId = sessionId;
+      child.on("error", () => void 0);
+      child.unref();
+      if (!child.pid) throw new Error("Could not start the browser owner.");
+      const owner = { sessionId, pid: child.pid, headless: command.headless };
+      store?.setOwner(owner);
+      return owner;
+    };
+    while (Date.now() < deadlineAt) {
+      const owner = store ? await store.reserve(deadlineAt, selectOwner) : selectOwner();
+      const result = await requestSession({ sessionId: owner.sessionId, action: "start", timeoutMs: Math.max(1, deadlineAt - Date.now()) }, {
+        waitForSocket: true,
+        ownerAlive: () => {
+          try {
+            process.kill(owner.pid, 0);
+            return true;
+          } catch {
+            return false;
+          }
+        }
+      });
+      if (!store || !["session_not_found", "session_unavailable", "browser_start_failed"].includes(result.error?.code ?? "")) {
+        return { result, startedOwner: spawnedSessionId !== void 0 && result.sessionId === spawnedSessionId };
+      }
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+    return { result: failureResult("start", "deadline_exceeded", "The saved browser owner did not become available before the deadline."), startedOwner: false };
+  } catch (error) {
+    if (spawned?.pid) {
+      try {
+        process.kill(spawned.pid, "SIGTERM");
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    store?.close();
+  }
+}
+
+// src/interactive.ts
+function isInteractiveInvocation(argv) {
+  return argv.length === 0 || argv[0] === "interactive";
+}
+function parseInteractiveArguments(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const options = argv[0] === "interactive" ? argv.slice(1) : argv;
+  for (let index = 0; index < options.length; index += 2) {
+    const option = options[index];
+    const value = options[index + 1];
+    if (option !== "--env" && option !== "--device") throw new InvocationError(`Interactive mode accepts only --env local|dev and --device mobile|desktop, not ${option}.`);
+    if (values.has(option)) throw new InvocationError(`${option} may only be supplied once.`);
+    if (value === void 0 || value.startsWith("--")) throw new InvocationError(`${option} requires a value.`);
+    values.set(option, value);
+  }
+  const environment = values.get("--env") ?? "dev";
+  const device = values.get("--device") ?? "desktop";
+  if (environment !== "local" && environment !== "dev") throw new InvocationError("--env must be local or dev.");
+  if (device !== "mobile" && device !== "desktop") throw new InvocationError("--device must be mobile or desktop.");
+  return { environment, device };
+}
+
+export {
+  CliProfileStore,
+  resolveCliTarget,
+  SavedSessionError,
+  InvocationError,
+  ACTIONS,
+  isAction,
+  DEFAULT_CONFIG_PATH2 as DEFAULT_CONFIG_PATH,
+  failureResult,
+  isSessionId,
+  runSessionOwner,
+  requestSession,
+  startSession,
+  isInteractiveInvocation,
+  parseInteractiveArguments
+};