@effect-agent/platform-cloudflare 0.1.0-beta.42 → 0.1.0-beta.45

package/src/layers.ts

@@ -70,7 +70,7 @@ import { cloudflareWakeSchedulerLayer } from "./wake-scheduler.ts";
 
 /**
  * Raw (unvalidated) construction options for `ThreadObject.make`, mirroring
- * `NodeDurableRuntimeOptions`. Optional fields default to the documented production values
+ * `NodeDurableAgentRuntimeOptions`. Optional fields default to the documented production values
  * (`CLOUDFLARE_RUNTIME_DEFAULTS`); everything is schema-decoded into
  * `CloudflareDurableRuntimeConfigValue` before any resource opens (deployment §5 gate 1).
  */
@@ -256,6 +256,7 @@ export const layerConfig = (
       const { ctx } = yield* DurableObjectContext;
       const config = yield* configFromOptions(options);
       const threadId = yield* threadIdFromState(ctx);
+
       const producerId = yield* decodeProducerId(`${config.producerPrefix}:${threadId}`).pipe(
         Effect.mapError((error) =>
           CloudflarePlatformConfigError.make({
@@ -264,6 +265,7 @@ export const layerConfig = (
           }),
         ),
       );
+
       return Layer.mergeAll(
         Layer.succeed(CloudflareDurableRuntimeConfig, config),
         Layer.succeed(ThreadObjectIdentity, { threadId, producerId }),
@@ -328,6 +330,7 @@ export const layerFromBindings = (
       const { ctx } = yield* DurableObjectContext;
       const config = yield* CloudflareDurableRuntimeConfig;
       const { threadId } = yield* ThreadObjectIdentity;
+
       const storageOptions: DoStorageOptions = {
         storage: ctx.storage,
         observationPollInterval: config.observationPollInterval,
@@ -335,6 +338,7 @@ export const layerFromBindings = (
         maxStoredValueBytes: config.maxStoredValueBytes,
         verifyOnOpen: config.verifyOnOpen,
       };
+
       const infrastructure = Layer.mergeAll(
         storageConfigLayer(storageOptions),
         SqliteClient.layer({ storage: ctx.storage }),
@@ -345,27 +349,33 @@ export const layerFromBindings = (
       const localPorts = Layer.mergeAll(threadStoreLayer, submissionLedgerLayer).pipe(
         Layer.provide(infrastructure),
       );
+
       const portsEndpointLayer = Layer.effect(ThreadObjectPorts)(
         Effect.gen(function* () {
           const local = yield* Effect.context<SubmissionLedger | ThreadStore>();
+
           return ThreadObjectPorts.of({
             handle: (request) => executePortRequest(request).pipe(Effect.provide(local)),
           });
         }),
       ).pipe(Layer.provide(localPorts));
+
       const routedPorts = Layer.mergeAll(
         routedSubmissionLedgerLayer({ localThreadId: threadId }),
         routedThreadStoreLayer({ localThreadId: threadId }),
       ).pipe(Layer.provide(localPorts), Layer.provide(threadPortTransportLayer));
+
       const base = Layer.mergeAll(DurableAlarmService.layer, ProgressWaitRegistry.layer);
-      const runtimeStack = DurableAgentRuntime.layerWithServices.pipe(
+
+      const runtimeStack = DurableAgentRuntime.layerWithBindings(bindings).pipe(
         Layer.provideMerge(routedPorts),
         Layer.provideMerge(cloudflareWakeSchedulerLayer),
         Layer.provideMerge(base),
       );
+
       return Layer.mergeAll(
         runtimeStack,
-        ThreadMaintenance.layer(bindings).pipe(Layer.provide(runtimeStack)),
+        ThreadMaintenance.layer.pipe(Layer.provide(runtimeStack)),
         portsEndpointLayer,
       );
     }),

package/src/memory.ts

@@ -69,32 +69,41 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
   const validated = yield* Schema.decodeUnknownEffect(MemoryRpcLimits)(rpcLimits).pipe(
     Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
   );
+
   const bound = yield* Schema.decodeUnknownEffect(MemoryAccess.Wire)(access).pipe(
     Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
   );
+
   principal = yield* Schema.decodeUnknownEffect(Principal)(principal).pipe(
     Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
   );
   const { namespace } = yield* MemoryObjectNamespace;
+
   const call = Effect.fn("CloudflareMemoryClient.call")(function* (request: MemoryOwnerRequest) {
     const decoded = yield* Schema.decodeUnknownEffect(MemoryOwnerRequest)(request).pipe(
       Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
     );
+
     const encoded = yield* encodeMemoryWire(MemoryOwnerRequest, decoded, validated.maxRequestBytes);
+
     const raw = yield* Effect.tryPromise({
       try: () =>
         namespace.get(namespace.idFromName(memoryObjectName(bound.namespace))).memory(encoded),
       catch: () => MemoryRpcError.make({ reason: "unavailable" }),
     });
+
     const response = yield* decodeMemoryWire(MemoryOwnerResponse, raw, validated.maxResponseBytes);
+
     if (response._tag === "Failed") return yield* response.failure;
     if (
       !MemoryNamespace.equals(response.access.namespace, bound.namespace) ||
       response.access.scope !== bound.scope
     )
       return yield* MemoryRpcError.make({ reason: "protocol" });
+
     return response;
   });
+
   const withinDeadline = <A, E, R>(effect: Effect.Effect<A, E, R>, timeoutMillis: number) =>
     effect.pipe(
       Effect.timeoutOrElse({
@@ -102,6 +111,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
         orElse: () => Effect.fail(MemoryRpcError.make({ reason: "timeout" })),
       }),
     );
+
   const revalidate = Effect.fn("CloudflareMemoryClient.revalidate")(function* (
     lookup: MemoryLookup,
     limits: MemoryRecallLimits,
@@ -110,6 +120,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
       Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })),
     );
     const timeoutMillis = Math.min(validated.timeoutMillis, limits.timeoutMillis);
+
     return yield* Effect.gen(function* () {
       const response = yield* call({
         _tag: "Revalidate",
@@ -120,15 +131,19 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
         limits,
         deadlineMillis: (yield* Clock.currentTimeMillis) + timeoutMillis,
       });
+
       if (response._tag !== "Lookup") return yield* MemoryRpcError.make({ reason: "protocol" });
+
       return response.lookup;
     }).pipe((effect) => withinDeadline(effect, timeoutMillis));
   });
+
   const change = Effect.fn("CloudflareMemoryClient.change")(function* (
     write: MemoryWrite<Namespace>,
   ) {
     if (!MemoryNamespace.equals(write.key.namespace, bound.namespace))
       return yield* MemoryRpcError.make({ reason: "denied" });
+
     return yield* Effect.gen(function* () {
       const response = yield* call({
         _tag: "Change",
@@ -138,11 +153,14 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
         write,
         deadlineMillis: (yield* Clock.currentTimeMillis) + validated.timeoutMillis,
       });
+
       if (response._tag !== "Changed" || response.document.key.id !== write.key.id)
         return yield* MemoryRpcError.make({ reason: "protocol" });
+
       return yield* MemoryDocument.restore(access.namespace, response.document);
     }).pipe((effect) => withinDeadline(effect, validated.timeoutMillis));
   });
+
   const revalidateSemantic = Effect.fn("CloudflareMemoryClient.revalidateSemantic")(function* (
     found: MemoryIndexSearch<Namespace>,
     profile: SemanticMemoryProfile,
@@ -159,10 +177,13 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
         limits,
         deadlineMillis: (yield* Clock.currentTimeMillis) + validated.timeoutMillis,
       });
+
       if (response._tag !== "Semantic") return yield* MemoryRpcError.make({ reason: "protocol" });
+
       return response.result;
     }).pipe((effect) => withinDeadline(effect, validated.timeoutMillis));
   });
+
   /**
    * Revalidate in one owner RPC, then render whole passages within the caller's budget.
    * The bound source is essential: unavailable/stale results and matches that cannot fit
@@ -181,6 +202,7 @@ const makeMemoryClient = Effect.fn("CloudflareMemoryClient.make")(function* <
       estimateTokens,
     );
   });
+
   return { recall, revalidate, revalidateSemantic, change };
 });
 
@@ -218,6 +240,7 @@ export const cloudflareMemoryWriterLayer = (
     MemoryWriter,
     Effect.gen(function* () {
       const client = yield* CloudflareMemoryClient.make(access, principal, limits);
+
       return MemoryWriter.fromAdapter({
         change: (write) =>
           client.change(write).pipe(
@@ -243,11 +266,13 @@ export const cloudflareMemoryWriterLayer = (
   );
 
 type OwnerServices = MemoryReader | MemoryWriter | MemoryOwnerAuthorizer | MemoryOwnerIdentity;
+
 export interface MemoryObjectInstance extends InstanceType<
   EffectCfDurableObject.DurableObjectClass<Record<never, never>, OwnerServices>
 > {
   memory(encoded: string): Promise<string>;
 }
+
 export interface MemoryObjectClass {
   new (ctx: globalThis.DurableObjectState, env: Cloudflare.Env): MemoryObjectInstance;
 }
@@ -277,12 +302,15 @@ const makeMemoryObject = <E>(
     MemoryOwnerIdentity,
     Effect.gen(function* () {
       const state = yield* DurableObjectState.DurableObjectState;
+
       const address = yield* Schema.decodeUnknownEffect(MemoryNamespaceAddress)(
         state.raw.id.name,
       ).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "denied" })));
+
       return { namespace: MemoryNamespace.Any.make({ address }) };
     }),
   );
+
   const store = Layer.unwrap(
     Effect.map(DurableObjectState.DurableObjectState, (state) =>
       doMemoryStoreLayerWithFailpoints(
@@ -291,7 +319,9 @@ const makeMemoryObject = <E>(
       ),
     ),
   ).pipe(Layer.provide(options.failpoints ?? MemoryMutationFailpoint.layer));
+
   const application = Layer.merge(store, host).pipe(Layer.provideMerge(identity));
+
   const runtime: Layer.Layer<
     OwnerServices,
     E | MemoryOwnerFailure,
@@ -300,15 +330,24 @@ const makeMemoryObject = <E>(
     Effect.gen(function* () {
       const state = yield* DurableObjectState.DurableObjectState;
       const scope = yield* Effect.scope;
+
       yield* Schema.decodeUnknownEffect(MemoryRpcLimits)(
         options.rpcLimits ?? defaultMemoryRpcLimits,
       ).pipe(Effect.mapError(() => MemoryRpcError.make({ reason: "protocol" })));
+
       return yield* state.blockConcurrencyWhile(Layer.buildWithScope(application, scope));
     }),
   );
-  return EffectCfDurableObject.make(runtime, {
-    rpc: { memory: (encoded: string) => handleMemoryOwnerRequest(encoded, options.rpcLimits) },
-  });
+
+  const rpc = { memory: (encoded: string) => handleMemoryOwnerRequest(encoded, options.rpcLimits) };
+
+  return EffectCfDurableObject.make<
+    OwnerServices,
+    E | MemoryOwnerFailure,
+    never,
+    never,
+    typeof rpc
+  >(runtime, { rpc });
 };
 
 export const MemoryObject = {

package/src/prepared-admission.ts

@@ -26,6 +26,7 @@ export const cloudflarePreparedInputAdmissionLayer: Layer.Layer<
   PreparedInputAdmission,
   Effect.gen(function* () {
     const client = yield* CloudflareThreadClient;
+
     return PreparedInputAdmission.of({
       submit: (envelope) =>
         client

package/src/progress-wait.ts

@@ -31,17 +31,20 @@ export class ProgressWaitRegistry extends Context.Service<
       const remove = (waiterId: string, deferred: Deferred.Deferred<void>) =>
         Ref.update(registrations, (current) => {
           const existing = current.get(waiterId);
+
           if (existing === undefined || existing === "cancelled" || !existing.has(deferred)) {
             return current;
           }
           const next = new Map(current);
           const active = new Set(existing);
+
           active.delete(deferred);
           if (active.size === 0) {
             next.delete(waiterId);
           } else {
             next.set(waiterId, active);
           }
+
           return next;
         });
 
@@ -49,18 +52,24 @@ export class ProgressWaitRegistry extends Context.Service<
         (waiterId: string): Effect.Effect<Effect.Effect<void>, never, Scope.Scope> =>
           Effect.gen(function* () {
             const deferred = yield* Deferred.make<void>();
+
             yield* Effect.addFinalizer(() => remove(waiterId, deferred));
+
             const cancelled = yield* Ref.modify(registrations, (current) => {
               const existing = current.get(waiterId);
               const next = new Map(current);
+
               if (existing === "cancelled") {
                 return [true, current] as const;
               }
               const active = new Set(existing ?? []);
+
               active.add(deferred);
               next.set(waiterId, active);
+
               return [false, next] as const;
             });
+
             return { cancelled, deferred };
           }).pipe(
             Effect.map(({ cancelled, deferred }) =>
@@ -73,9 +82,11 @@ export class ProgressWaitRegistry extends Context.Service<
         const waiters = yield* Ref.modify(registrations, (current) => {
           const existing = current.get(waiterId);
           const next = new Map(current);
+
           if (existing === undefined) {
             next.set(waiterId, "cancelled");
             let tombstones = 0;
+
             for (const registration of next.values()) {
               if (registration === "cancelled") tombstones += 1;
             }
@@ -86,12 +97,15 @@ export class ProgressWaitRegistry extends Context.Service<
                 break;
               }
             }
+
             return [[], next] as const;
           }
           if (existing === "cancelled") return [[], current] as const;
           next.delete(waiterId);
+
           return [[...existing], next] as const;
         });
+
         yield* Effect.forEach(waiters, (waiter) => Deferred.succeed(waiter, undefined), {
           discard: true,
         });

package/src/protected-browser/binding.ts

@@ -0,0 +1,185 @@
+/// <reference types="@cloudflare/workers-types" />
+import puppeteer, { type Browser } from "@cloudflare/puppeteer";
+import { ProtectedBrowserError, type InteractiveBrowserPolicy } from "@effect-agent/sandbox";
+import { Clock, Context, Crypto, Effect, Layer, Redacted, Schema, type Scope } from "effect";
+
+import { BrowserRunSessionLifecycle } from "../browser-session-lifecycle.ts";
+import { makeProtectedNativeTransport, ProtectedNativeSession } from "./native.ts";
+import {
+  BrowserRunProtectedTransport,
+  ProtectedTransportError,
+  type ProtectedBrowserTransport,
+} from "./policy.ts";
+
+/**
+ * Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
+ * documented opt-in semantics are the recording guarantee; no recording-status API exists.
+ * Account operators remain trusted, and must not attach external observers to private passes.
+ */
+export const browserRunProtectedBindingLayer = (options: {
+  readonly browser: Pick<BrowserRun, "fetch">;
+}) =>
+  Layer.effect(BrowserRunProtectedTransport)(
+    Effect.gen(function* () {
+      const lifecycle = yield* BrowserRunSessionLifecycle;
+      const crypto = yield* Crypto.Crypto;
+
+      const open = Effect.fn("BrowserRunProtectedTransport.open")(function* (
+        policy: InteractiveBrowserPolicy,
+      ): Effect.fn.Return<ProtectedBrowserTransport, ProtectedBrowserError, Scope.Scope> {
+        const failure = () =>
+          new ProtectedBrowserError({
+            reason: "provider",
+            dispatch: "not-dispatched",
+            milestone: "none",
+            observation: "closed",
+            cleanup: "unconfirmed",
+          });
+
+        let sessionId: Redacted.Redacted<string> | undefined;
+        let browser: Browser | undefined;
+        let driver: ProtectedBrowserTransport | undefined;
+        let invalid = false;
+        // SDK acquisition may finish after interruption. Its late-reply callback must await cleanup,
+        // using this pass's clock rather than starting an Effect runtime with default services.
+        const runCleanup = Effect.runPromiseWith(Context.make(Clock.Clock, yield* Clock.Clock));
+
+        const terminate = Effect.gen(function* () {
+          invalid = true;
+          driver?.invalidate();
+          if (sessionId === undefined) return "unconfirmed" as const;
+
+          const cleanup = yield* lifecycle.close(sessionId).pipe(
+            Effect.as("confirmed" as const),
+            Effect.catchCause(() => Effect.succeed("unconfirmed" as const)),
+            Effect.interruptible,
+            Effect.timeoutOrElse({
+              duration: "10 seconds",
+              orElse: () => Effect.succeed("unconfirmed" as const),
+            }),
+          );
+
+          // Local disconnect is not remote-closure evidence. Do it even when confirmation fails.
+          const connected = browser;
+
+          if (connected !== undefined)
+            yield* Effect.promise(() => connected.disconnect()).pipe(
+              Effect.catchCause(() => Effect.void),
+              Effect.interruptible,
+              Effect.timeoutOrElse({ duration: "1 second", orElse: () => Effect.void }),
+            );
+
+          return cleanup;
+        });
+
+        const close = yield* Effect.cached(terminate);
+
+        yield* Effect.addFinalizer(() =>
+          close.pipe(
+            Effect.flatMap((state) =>
+              state === "confirmed"
+                ? Effect.void
+                : Effect.logWarning("Protected browser exact-session closure unconfirmed"),
+            ),
+          ),
+        );
+
+        const acquired = yield* Effect.tryPromise({
+          try: async (signal) => {
+            let recordingDisabled = false;
+
+            const binding = {
+              fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
+                const request = new Request(input, init);
+                const url = new URL(request.url);
+
+                if (url.pathname === "/v1/devtools/browser" && request.method === "POST") {
+                  url.searchParams.set("recording", "false");
+                  recordingDisabled = url.searchParams.get("recording") === "false";
+
+                  return options.browser.fetch(new Request(url, request));
+                }
+
+                return options.browser.fetch(request);
+              },
+            };
+
+            const acquired = await puppeteer.acquire(binding, {
+              recording: false,
+              keep_alive: Math.max(10_000, policy.maxElapsedMillis),
+            });
+
+            sessionId = Redacted.make(
+              Schema.decodeUnknownSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId),
+            );
+            if (!recordingDisabled || signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+            // Initial attachment only. No recovery/reconnection path exists.
+            browser = await puppeteer.connect(options.browser, acquired.sessionId);
+            if (signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+            const context = await browser.createBrowserContext();
+            const page = await context.newPage();
+
+            await page.setBypassServiceWorker(true);
+            await page.setRequestInterception(true);
+            page.on("request", (request) => {
+              let allowed = policy.network._tag === "Unrestricted";
+
+              try {
+                const url = new URL(request.url());
+
+                allowed ||=
+                  policy.network._tag === "ExactHosts" &&
+                  url.protocol === "https:" &&
+                  !url.username &&
+                  !url.password &&
+                  policy.network.allowedHosts.includes(url.host);
+              } catch {
+                /* Refuse malformed destinations. */
+              }
+              void (
+                allowed && !invalid ? request.continue() : request.abort("blockedbyclient")
+              ).catch(() => {
+                invalid = true;
+                driver?.invalidate();
+              });
+            });
+            if (signal.aborted || invalid) {
+              await runCleanup(terminate);
+              throw new ProtectedTransportError({ reason: "stale-reference" });
+            }
+
+            return ProtectedNativeSession.of({ browser, page, close });
+          },
+          catch: failure,
+        }).pipe(
+          Effect.timeoutOrElse({
+            duration: Math.min(policy.maxElapsedMillis, 30_000),
+            orElse: () =>
+              Effect.fail(new ProtectedBrowserError({ ...failure(), reason: "timeout" })),
+          }),
+          Effect.catch((error) =>
+            close.pipe(
+              Effect.flatMap((cleanup) =>
+                Effect.fail(new ProtectedBrowserError({ ...error, cleanup })),
+              ),
+            ),
+          ),
+        );
+
+        driver = yield* makeProtectedNativeTransport(policy).pipe(
+          Effect.provideService(ProtectedNativeSession, acquired),
+          Effect.provideService(Crypto.Crypto, crypto),
+        );
+
+        return driver;
+      }, Effect.withTracerEnabled(false));
+
+      return { open };
+    }),
+  );

package/src/protected-browser/inspect-frame.ts

@@ -0,0 +1,82 @@
+// This fixed program runs in an isolated world. Pages cannot replace its native DOM methods.
+// Handles retain actual nodes; a selector is never reconstructed from an opaque reference.
+export const maxAttributeLength = 2048;
+
+export const inspectFrame = `(() => {
+  const doc = document;
+  const forms = [];
+  const elements = [...doc.querySelectorAll('input,select,button,a[href]')].slice(0, 65);
+  const describe = (el) => {
+    if (doc !== document || !el.isConnected || el.ownerDocument !== doc) return null;
+    const form = el.form ?? null;
+    let formIndex = forms.indexOf(form);
+    if (formIndex < 0) { formIndex = forms.length; forms.push(form); }
+    const action = form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
+    const method = form ? (el.hasAttribute('formmethod') ? el.formMethod : form.method) : '';
+    const enctype = form?.enctype ?? '';
+    const name = el.name ?? '';
+    const completion = el.getAttribute('autocomplete') ?? '';
+    const inputType = el.type ?? '';
+    // Reject before parsing, fingerprinting or CDP transfer. Truncation could hide a target change.
+    if ([action, method, enctype, name, completion, inputType].some(value => value.length > ${maxAttributeLength})) return null;
+    const type = inputType.toLowerCase();
+    const autocomplete = completion.trim().toLowerCase().split(/\\s+/).at(-1);
+    const cardRoles = { 'cc-name':'card-name', 'cc-number':'card-number', 'cc-exp':'card-expiry',
+      'cc-exp-month':'card-expiry-month', 'cc-exp-year':'card-expiry-year', 'cc-csc':'card-security-code' };
+    let role = 'unsupported';
+    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement;
+    if (nativeField && form && !['submit','button'].includes(type) && !el.disabled && !el.readOnly && el.getClientRects().length > 0) {
+      if (el instanceof HTMLInputElement && type === 'password') role = 'password';
+      else if (['text','email','tel','number','month',''].includes(type) || el instanceof HTMLSelectElement) {
+        if (cardRoles[autocomplete]) role = cardRoles[autocomplete];
+        else if (autocomplete === 'username' || autocomplete === 'email') role = 'username';
+        else if (['text','email'].includes(type) && form && form.querySelector('input[type="password"]')) role = 'username';
+      }
+    } else if (el instanceof HTMLButtonElement || (el instanceof HTMLInputElement && ['submit','button'].includes(type))) {
+      if (!el.disabled) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
+    } else if (el instanceof HTMLAnchorElement) role = 'link';
+    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type]);
+    return { role, formIndex, action, fingerprint,
+      label: (el.labels?.[0]?.textContent ?? el.getAttribute('aria-label') ?? el.textContent ?? '').slice(0,200) };
+  };
+  const expose = ({role, formIndex, action, label}) => ({role, formIndex, action, label});
+  const original = elements.map(describe);
+  const validate = (index) => {
+    const current = describe(elements[index]);
+    if (!current || !original[index] || current.fingerprint !== original[index].fingerprint ||
+      current.formIndex !== original[index].formIndex) return null;
+    return expose(current);
+  };
+  return {
+    doc, elements, original: original.map(current => current && expose(current)), validate,
+    text: () => {
+      if (doc !== document) return null;
+      const clone = doc.body?.cloneNode(true);
+      clone?.querySelectorAll('input,textarea,select,script,style,noscript,iframe,object,embed').forEach(el => el.remove());
+      return (clone?.textContent ?? '').slice(0,65536);
+    },
+    fill: (index, role, value) => {
+      const current = validate(index);
+      if (!current || current.role !== role) return false;
+      const el = elements[index];
+      let prototype = Object.getPrototypeOf(el);
+      let setter;
+      while (prototype && !setter) { setter = Object.getOwnPropertyDescriptor(prototype,'value')?.set; prototype = Object.getPrototypeOf(prototype); }
+      if (!setter) return false;
+      // Validate and mutate in one isolated-world task, without focusing first and running
+      // page handlers between validation and assignment. Native setters support controlled inputs.
+      setter.call(el, value);
+      if (el.value !== value) return 'unsupported';
+      el.dispatchEvent(new Event('input', {bubbles:true}));
+      el.dispatchEvent(new Event('change', {bubbles:true}));
+      return true;
+    },
+    click: (index) => {
+      const current = validate(index);
+      if (!current || !['button','submit','link'].includes(current.role)) return false;
+      if (current.role === 'submit' && elements[index].form && !elements[index].form.matches(':valid')) return 'needs-attention';
+      elements[index].click();
+      return true;
+    }
+  };
+})()`;