@effect-agent/platform-cloudflare 0.1.0-beta.8 → 0.1.0-beta.81

package/dist/ProtectedBrowser.mjs

@@ -0,0 +1,859 @@
+import { n as BrowserRunSessionLifecycle } from "./browser-session-lifecycle-CUbVfEgP.mjs";
+import { Clock, Context, Crypto, Effect, Layer, Option, Redacted, Schema, Semaphore } from "effect";
+import puppeteer from "@cloudflare/puppeteer";
+import { InteractiveBrowserPolicy } from "@effect-agent/sandbox/InteractiveBrowser";
+import { BrowserCredentialAccess, CardCredential, CredentialObservationDecision, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "@effect-agent/sandbox/ProtectedBrowser";
+//#region src/protected-browser/policy.ts
+var ProtectedTransportError = class extends Schema.TaggedError()("ProtectedTransportError", { reason: Schema.Literals([
+	"stale-reference",
+	"needs-attention",
+	"unsupported",
+	"provider"
+]) }) {};
+/** Per-write evidence authority, provided by the policy immediately around a transport fill. */
+var ProtectedBrowserDispatch = class extends Context.Service()("@effect-agent/platform-cloudflare/ProtectedBrowserDispatch") {};
+/** Adapter-private injection seam for deterministic tests, not a model capability. */
+var BrowserRunProtectedTransport = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedTransport") {};
+const ProtectedPageContext = Schema.Struct({
+	document: Schema.String.check(Schema.isUUID()),
+	topOrigin: CredentialOrigin,
+	frameOrigins: Schema.Array(CredentialOrigin).check(Schema.isMaxLength(16))
+});
+const ProtectedDiscovery = Schema.Struct({
+	...ProtectedPageContext.fields,
+	text: Schema.String.check(Schema.isMaxLength(65536)),
+	controls: Schema.Array(ProtectedBrowserControl).check(Schema.isMaxLength(64)),
+	truncated: Schema.Boolean
+});
+const sameTarget = (a, b) => a.topOrigin === b.topOrigin && a.frameOrigin === b.frameOrigin && a.recipientOrigin === b.recipientOrigin && a.document === b.document && a.frame === b.frame && a.form === b.form;
+const kindFor = (role) => role === "username" || role === "password" ? "login" : role.startsWith("card-") ? "card" : void 0;
+const secretFor = (material, role) => {
+	if (material._tag === "LoginCredential") return role === "username" ? material.username : role === "password" ? material.password : void 0;
+	switch (role) {
+		case "card-name": return material.name;
+		case "card-number": return material.number;
+		case "card-expiry": return material.expiry;
+		case "card-expiry-month": return material.expiryMonth;
+		case "card-expiry-year": return material.expiryYear;
+		case "card-security-code": return material.securityCode;
+		case "username":
+		case "password": return;
+	}
+};
+/**
+* Fresh private passes only. Account administrators and Browser Rendering token holders are
+* trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
+* Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
+*/
+const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen(function* () {
+	const transport = yield* BrowserRunProtectedTransport;
+	const crypto = yield* Crypto.Crypto;
+	return { open: Effect.fn("ProtectedBrowser.open")(function* (input) {
+		const initialError = (reason) => new ProtectedBrowserError({
+			reason,
+			dispatch: "not-dispatched",
+			milestone: "none",
+			observation: "closed",
+			cleanup: "not-requested"
+		});
+		const decodedPolicy = yield* Schema.decodeUnknownEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => initialError("denied")));
+		if (decodedPolicy.network._tag === "PublicWeb") return yield* initialError("unsupported");
+		const policy = InteractiveBrowserPolicy.make({
+			...decodedPolicy,
+			network: decodedPolicy.network._tag === "ExactHosts" ? {
+				_tag: "ExactHosts",
+				allowedHosts: [...decodedPolicy.network.allowedHosts]
+			} : { _tag: "Unrestricted" }
+		});
+		const access = yield* BrowserCredentialAccess;
+		const started = yield* Clock.currentTimeMillis;
+		const driver = yield* transport.open(policy);
+		const lock = yield* Semaphore.make(1);
+		let observation = "before-exposure";
+		let cleanup = "not-requested";
+		let actions = 0;
+		let dispatch = "not-dispatched";
+		let milestone = "none";
+		const exposures = [];
+		const offers = /* @__PURE__ */ new Map();
+		const fail = (reason) => new ProtectedBrowserError({
+			reason,
+			dispatch,
+			milestone,
+			observation,
+			cleanup
+		});
+		const close = yield* Effect.cached(Effect.uninterruptible(Effect.gen(function* () {
+			observation = "closed";
+			offers.clear();
+			driver.invalidate();
+			cleanup = yield* driver.close.pipe(Effect.interruptible, Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.succeed("unconfirmed")
+			}), Effect.catchCause(() => Effect.succeed("unconfirmed")));
+			return cleanup;
+		})));
+		yield* Effect.addFinalizer(() => close.pipe(Effect.flatMap((result) => result === "unconfirmed" ? Effect.logWarning("Protected browser exact-session closure unconfirmed") : Effect.void)));
+		const remote = (effect) => effect.pipe(Effect.mapError((error) => fail(error.reason)));
+		const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => fail("provider")));
+		const caller = access.caller.pipe(Effect.mapError((error) => fail(error.reason)));
+		const pageContext = remote(driver.context);
+		const permitObservation = Effect.gen(function* () {
+			const context = yield* pageContext;
+			let origins;
+			if (exposures.length > 0) {
+				observation = "protected";
+				const principal = yield* caller;
+				const rawDecision = yield* access.observation({
+					...context,
+					caller: principal,
+					exposures: [...exposures]
+				}).pipe(Effect.mapError((error) => fail(error.reason)));
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+				const decision = yield* Schema.decodeUnknownEffect(CredentialObservationDecision)(rawDecision).pipe(Effect.mapError(() => fail("observation-blocked")));
+				if (decision === "deny") return yield* fail("observation-blocked");
+				if (typeof decision !== "string") {
+					origins = [...decision.origins];
+					if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
+				}
+				observation = "approved-after-exposure";
+			}
+			yield* remote(driver.restrictObservation(origins));
+			return {
+				...context,
+				frameOrigins: context.frameOrigins.filter((origin) => origins === void 0 || origins.includes(origin))
+			};
+		});
+		const target = (ref) => remote(driver.target(ref));
+		const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (action) {
+			if (access.authorizeAction === void 0) {
+				if (action._tag === "Submit") return yield* fail("unsupported");
+				return;
+			}
+			const principal = yield* caller;
+			yield* access.authorizeAction({
+				caller: principal,
+				action,
+				exposures: [...exposures]
+			}).pipe(Effect.mapError((error) => fail(error.reason)));
+			if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+			if (action._tag !== "Navigate") {
+				const current = yield* target(action.ref);
+				if (!sameTarget(current.target, action.target) || current.role !== (action._tag === "Submit" ? "submit" : action.role) || action._tag === "Click" && action.role === "link" && current.url !== action.url) return yield* fail("stale-reference");
+			}
+		}, Effect.withTracerEnabled(false));
+		const bounded = (result) => {
+			return new TextEncoder().encode(JSON.stringify(result)).byteLength <= policy.maxReturnedBytes ? Effect.succeed(result) : Effect.fail(fail("limit"));
+		};
+		const run = (effect) => lock.withPermitsIfAvailable(1)(Effect.gen(function* () {
+			dispatch = "not-dispatched";
+			milestone = "none";
+			if (observation === "closed") return yield* fail("closed");
+			if (++actions > policy.maxActions) return yield* fail("limit");
+			const remaining = policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started);
+			if (remaining <= 0) {
+				yield* close;
+				return yield* fail("timeout");
+			}
+			return yield* effect.pipe(Effect.timeoutOrElse({
+				duration: remaining,
+				orElse: () => Effect.fail(fail("timeout"))
+			}), Effect.catchCause((cause) => Effect.gen(function* () {
+				const error = cause.reasons.find((reason) => reason._tag === "Fail" && Schema.is(ProtectedBrowserError)(reason.error));
+				const reason = error?._tag === "Fail" && Schema.is(ProtectedBrowserError)(error.error) ? error.error.reason : "provider";
+				const interrupt = cause.reasons.some((reason) => reason._tag === "Interrupt");
+				if (dispatch !== "not-dispatched" || interrupt || reason === "provider" || reason === "timeout") yield* close;
+				if (interrupt) return yield* Effect.interrupt;
+				return yield* fail(dispatch === "possibly-dispatched" && reason === "provider" ? "outcome-unknown" : reason);
+			})), Effect.onInterrupt(() => close), Effect.withTracerEnabled(false));
+		})).pipe(Effect.flatMap((result) => Option.isSome(result) ? Effect.succeed(result.value) : Effect.fail(new ProtectedBrowserError({
+			reason: "busy",
+			dispatch: "not-dispatched",
+			milestone: "none",
+			observation,
+			cleanup
+		}))));
+		return {
+			close,
+			navigate: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserNavigate)(request).pipe(Effect.mapError(() => fail("denied")));
+				let url;
+				try {
+					url = new URL(decoded.url);
+				} catch {
+					return yield* fail("denied");
+				}
+				if (url.protocol !== "https:" || url.username || url.password || policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) return yield* fail("denied");
+				if (exposures.length > 0) yield* permitObservation;
+				yield* authorizeAction({
+					_tag: "Navigate",
+					url: decoded.url
+				});
+				offers.clear();
+				dispatch = "possibly-dispatched";
+				yield* remote(driver.navigate(decoded.url));
+				dispatch = "dispatched";
+				yield* permitObservation;
+			})),
+			observe: run(Effect.gen(function* () {
+				const before = yield* permitObservation;
+				const result = yield* remote(driver.discover);
+				const after = yield* permitObservation;
+				if (before.document !== after.document || result.document !== after.document || result.topOrigin !== after.topOrigin) return yield* fail("stale-reference");
+				if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin))) return yield* fail("observation-blocked");
+				return yield* bounded(ProtectedBrowserObservation.make({
+					...result,
+					observation: exposures.length > 0 ? "approved-after-exposure" : "before-exposure"
+				}));
+			})),
+			click: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserClick)(request).pipe(Effect.mapError(() => fail("denied")));
+				yield* permitObservation;
+				const control = yield* target(decoded.ref);
+				if (control.role !== "link" && control.role !== "button" && control.role !== "radio" && control.role !== "checkbox" && control.role !== "submit") return yield* fail("unsupported");
+				let action;
+				if (control.role === "link") {
+					if (control.url === void 0) return yield* fail("unsupported");
+					action = {
+						_tag: "Click",
+						ref: decoded.ref,
+						target: control.target,
+						role: "link",
+						url: control.url
+					};
+				} else if (control.role === "submit") action = {
+					_tag: "Submit",
+					ref: decoded.ref,
+					target: control.target
+				};
+				else action = {
+					_tag: "Click",
+					ref: decoded.ref,
+					target: control.target,
+					role: control.role
+				};
+				yield* authorizeAction(action);
+				dispatch = "possibly-dispatched";
+				yield* remote(driver.click(decoded.ref)).pipe(Effect.catch((error) => {
+					if (error.reason === "needs-attention") dispatch = "not-dispatched";
+					return Effect.fail(error);
+				}));
+				dispatch = "dispatched";
+				if (control.role === "submit") milestone = "submission-dispatched";
+				yield* permitObservation;
+			})),
+			fill: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(ProtectedBrowserFill)(request).pipe(Effect.mapError(() => fail("denied")));
+				yield* permitObservation;
+				const control = yield* target(decoded.ref);
+				if (control.role !== "text" && control.role !== "select") return yield* fail("unsupported");
+				yield* authorizeAction({
+					_tag: "Fill",
+					ref: decoded.ref,
+					target: control.target,
+					role: control.role
+				});
+				yield* remote(driver.fill(decoded.ref, control.role, Redacted.make(decoded.value))).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+					dispatch = "possibly-dispatched";
+				}) }));
+				dispatch = "dispatched";
+				milestone = "filled";
+				yield* permitObservation;
+			})),
+			listCredentialOffers: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(ListCredentialOffers)(request).pipe(Effect.mapError(() => fail("denied")));
+				yield* permitObservation;
+				const control = yield* target(decoded.target);
+				if (kindFor(control.role) !== decoded.kind) return yield* fail("unsupported");
+				const principal = yield* caller;
+				const candidates = yield* access.list({
+					caller: principal,
+					kind: decoded.kind,
+					target: control.target
+				}).pipe(Effect.mapError((error) => fail(error.reason)));
+				const now = yield* Clock.currentTimeMillis;
+				for (const [ref, offer] of offers) if (offer.expires <= now) offers.delete(ref);
+				if (candidates.length > 16 || offers.size + candidates.length > 64) return yield* fail("limit");
+				if (!sameTarget(control.target, (yield* target(decoded.target)).target)) return yield* fail("stale-reference");
+				const expires = now + 6e4;
+				const result = [];
+				const pending = /* @__PURE__ */ new Map();
+				for (const candidate of candidates) {
+					const metadata = yield* decode(CredentialOfferMetadata, candidate.metadata);
+					const ref = yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => fail("provider")));
+					pending.set(ref, {
+						caller: principal,
+						key: candidate.key,
+						target: control.target,
+						targetRef: decoded.target,
+						kind: decoded.kind,
+						expires
+					});
+					result.push(CredentialOffer.make({
+						ref,
+						kind: decoded.kind,
+						metadata
+					}));
+				}
+				yield* bounded(result);
+				for (const [ref, offer] of pending) offers.set(ref, offer);
+				return result;
+			})),
+			useCredential: (request) => run(Effect.gen(function* () {
+				const decoded = yield* Schema.decodeUnknownEffect(UseCredential)(request).pipe(Effect.mapError(() => fail("denied")));
+				const offer = offers.get(decoded.offer);
+				if (offer === void 0 || offer.expires <= (yield* Clock.currentTimeMillis)) return yield* fail("stale-reference");
+				const principal = yield* caller;
+				if (Redacted.value(principal) !== Redacted.value(offer.caller)) return yield* fail("denied");
+				if (new Set(decoded.fields.map((field) => field.ref)).size !== decoded.fields.length || new Set(decoded.fields.map((field) => field.role)).size !== decoded.fields.length) return yield* fail("denied");
+				const validate = Effect.gen(function* () {
+					if (!sameTarget(offer.target, (yield* target(offer.targetRef)).target)) return yield* fail("stale-reference");
+					for (const field of decoded.fields) {
+						const current = yield* target(field.ref);
+						if (field.role !== current.role || kindFor(field.role) !== offer.kind || !sameTarget(offer.target, current.target)) return yield* fail("denied");
+					}
+					if (decoded.submit !== void 0) {
+						const submit = yield* target(decoded.submit);
+						if (submit.role !== "submit" || !sameTarget(offer.target, submit.target)) return yield* fail("denied");
+					}
+				});
+				yield* validate;
+				const authorization = {
+					caller: principal,
+					key: offer.key,
+					kind: offer.kind,
+					target: offer.target,
+					roles: decoded.fields.map((field) => field.role),
+					submit: decoded.submit !== void 0
+				};
+				const authorize = Effect.gen(function* () {
+					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+					yield* access.authorize(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+				});
+				yield* authorize;
+				yield* validate;
+				const raw = yield* access.resolve(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+				const material = yield* Schema.decodeUnknownEffect(offer.kind === "login" ? LoginCredential : CardCredential)(raw).pipe(Effect.mapError(() => fail("resolver")));
+				for (const field of decoded.fields) if (secretFor(material, field.role) === void 0) return yield* fail("missing-credential");
+				offers.delete(decoded.offer);
+				for (const field of decoded.fields) {
+					yield* validate;
+					yield* authorize;
+					const value = secretFor(material, field.role);
+					if (value === void 0) return yield* fail("missing-credential");
+					observation = "protected";
+					yield* remote(driver.fill(field.ref, field.role, value)).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+						dispatch = "possibly-dispatched";
+						if (!exposures.some((target) => sameTarget(target, offer.target))) exposures.push(offer.target);
+					}) }));
+					dispatch = "dispatched";
+					milestone = "partial-fill";
+				}
+				milestone = "filled";
+				if (decoded.submit !== void 0) {
+					yield* validate;
+					yield* authorize;
+					const ref = decoded.submit;
+					dispatch = "possibly-dispatched";
+					yield* remote(driver.click(ref)).pipe(Effect.catch((error) => {
+						if (error.reason === "needs-attention") dispatch = "dispatched";
+						return Effect.fail(error);
+					}));
+					dispatch = "dispatched";
+					milestone = "submission-dispatched";
+				}
+				yield* permitObservation;
+				return CredentialUseResult.make({
+					dispatch,
+					milestone,
+					observation,
+					cleanup,
+					authentication: "unverified"
+				});
+			}))
+		};
+	}, Effect.withTracerEnabled(false)) };
+}));
+//#endregion
+//#region src/protected-browser/inspect-frame.ts
+const maxAttributeLength = 2048;
+const inspectFrame = `(() => {
+  const doc = document;
+  const forms = [];
+  const isChoice = el => el instanceof HTMLInputElement && ['radio','checkbox'].includes(el.type);
+  const presented = el => {
+    if (el.closest('[hidden],[aria-hidden="true"],[inert]') ||
+      ['hidden','collapse'].includes(getComputedStyle(el).visibility)) return false;
+    for (let parent = el; parent; parent = parent.parentElement) {
+      if (getComputedStyle(parent).opacity === '0') return false;
+    }
+    return true;
+  };
+  const hasLayout = el => presented(el) &&
+    [...el.getClientRects()].some(rect => rect.width > 0 && rect.height > 0);
+  const available = el => el.type !== 'hidden' && !el.closest('[hidden],[aria-hidden="true"],[inert]') &&
+    (hasLayout(el) || (isChoice(el) && [...(el.labels ?? [])].some(hasLayout)));
+  const elements = [...doc.querySelectorAll('input,textarea,select,button,a[href]')].filter(available).slice(0, 65);
+  const labelText = el => {
+    const label = el.labels?.[0]?.cloneNode(true);
+    label?.querySelectorAll('input,textarea,select,script,style,noscript').forEach(child => child.remove());
+    return label?.textContent ?? el.getAttribute('aria-label');
+  };
+  const describe = (el) => {
+    if (doc !== document || !el.isConnected || el.ownerDocument !== doc || !available(el)) return null;
+    const form = el.form ?? null;
+    let formIndex = forms.indexOf(form);
+    if (formIndex < 0) { formIndex = forms.length; forms.push(form); }
+    // Resolved href (including path/query/fragment and base-URL changes) is part of the fingerprint.
+    const action = el instanceof HTMLAnchorElement ? el.href : form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
+    const method = form ? (el.hasAttribute('formmethod') ? el.formMethod : form.method) : '';
+    const enctype = form?.enctype ?? '';
+    const name = el.name ?? '';
+    const completion = el.getAttribute('autocomplete') ?? '';
+    const inputType = el.type ?? '';
+    const choiceValue = isChoice(el) ? el.value : '';
+    // Reject before parsing, fingerprinting or CDP transfer. Truncation could hide a target change.
+    if ([action, method, enctype, name, completion, inputType, choiceValue].some(value => value.length > ${maxAttributeLength})) return null;
+    const type = inputType.toLowerCase();
+    const autocomplete = completion.trim().toLowerCase().split(/\\s+/).at(-1);
+    const cardRoles = { 'cc-name':'card-name', 'cc-number':'card-number', 'cc-exp':'card-expiry',
+      'cc-exp-month':'card-expiry-month', 'cc-exp-year':'card-expiry-year', 'cc-csc':'card-security-code' };
+    let role = 'unsupported';
+    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement || el instanceof HTMLTextAreaElement;
+    if (nativeField && !['submit','button'].includes(type) && !el.matches(':disabled') && !el.readOnly && !(el instanceof HTMLSelectElement && el.multiple)) {
+      if (isChoice(el)) role = type;
+      else if (type === 'password' || ['current-password','new-password','one-time-code'].includes(autocomplete)) {
+        if (type === 'password' && form) role = 'password';
+      } else if (['text','email','tel','number','month','search','url','date','time','week','datetime-local','textarea',''].includes(type) || el instanceof HTMLSelectElement) {
+        if (cardRoles[autocomplete]) { if (form) role = cardRoles[autocomplete]; }
+        else if (autocomplete === 'username' || autocomplete === 'email') { if (form) role = 'username'; }
+        else if (['text','email'].includes(type) && form && form.querySelector('input[type="password"]')) role = 'username';
+        else if (el instanceof HTMLSelectElement) { if (!el.multiple) role = 'select'; }
+        else role = 'text';
+      }
+    } else if (el instanceof HTMLButtonElement || (el instanceof HTMLInputElement && ['submit','button'].includes(type))) {
+      if (!el.matches(':disabled')) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
+    } else if (el instanceof HTMLAnchorElement) role = 'link';
+    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type, choiceValue]);
+    return { role, formIndex, action, fingerprint, ...(isChoice(el) ? {checked: el.checked} : {}),
+      label: (labelText(el) ?? (nativeField ? '' : el.textContent) ?? '').slice(0,200) };
+  };
+  const expose = ({role, formIndex, action, label, checked}) =>
+    ({role, formIndex, action, label, ...(checked === undefined ? {} : {checked})});
+  const original = elements.map(describe);
+  const validate = (index) => {
+    const current = describe(elements[index]);
+    if (!current || !original[index] || current.fingerprint !== original[index].fingerprint ||
+      current.formIndex !== original[index].formIndex) return null;
+    return expose(current);
+  };
+  return {
+    doc, elements, original: original.map(current => current && expose(current)), validate,
+    text: () => {
+      if (doc !== document) return null;
+      if (!doc.body) return '';
+      const walker = doc.createTreeWalker(doc.body, NodeFilter.SHOW_TEXT);
+      const range = doc.createRange();
+      let text = '';
+      for (let node = walker.nextNode(); node && text.length < 65536; node = walker.nextNode()) {
+        const parent = node.parentElement;
+        if (!parent || parent.closest('input,textarea,select,script,style,noscript,iframe,object,embed')) continue;
+        if (!presented(parent)) continue;
+        range.selectNodeContents(node);
+        if (![...range.getClientRects()].some(rect => rect.width > 0 && rect.height > 0)) continue;
+        text += (node.textContent ?? '').replace(/\\s+/g, ' ') + ' ';
+      }
+      return text.slice(0,65536);
+    },
+    fill: (index, role, value) => {
+      const current = validate(index);
+      if (!current || current.role !== role) return false;
+      const el = elements[index];
+      if (role === 'select') {
+        const options = [...el.options].filter(option => !option.matches(':disabled'));
+        const values = options.filter(option => option.value === value);
+        const matches = values.length > 0 ? values : options.filter(option => option.textContent?.trim() === value);
+        if (matches.length !== 1) return 'unsupported';
+        value = matches[0].value;
+        if ([...el.options].filter(option => option.value === value).length !== 1) return 'unsupported';
+      }
+      let prototype = Object.getPrototypeOf(el);
+      let setter;
+      while (prototype && !setter) { setter = Object.getOwnPropertyDescriptor(prototype,'value')?.set; prototype = Object.getPrototypeOf(prototype); }
+      if (!setter) return false;
+      // Validate and mutate in one isolated-world task, without focusing first and running
+      // page handlers between validation and assignment. Native setters support controlled inputs.
+      setter.call(el, value);
+      if (el.value !== value) return 'unsupported';
+      el.dispatchEvent(new Event('input', {bubbles:true}));
+      el.dispatchEvent(new Event('change', {bubbles:true}));
+      return true;
+    },
+    click: (index) => {
+      const current = validate(index);
+      if (!current || !['button','submit','link','radio','checkbox'].includes(current.role)) return false;
+      if (current.role === 'submit' && elements[index].form && !elements[index].form.matches(':valid')) return 'needs-attention';
+      elements[index].click();
+      return true;
+    }
+  };
+})()`;
+//#endregion
+//#region src/protected-browser/native.ts
+const Description = Schema.Struct({
+	role: ProtectedBrowserControl.fields.role,
+	formIndex: Schema.Natural,
+	action: Schema.String.check(Schema.isMaxLength(maxAttributeLength)),
+	label: Schema.String.check(Schema.isMaxLength(200)),
+	checked: Schema.optionalKey(Schema.Boolean)
+});
+const Descriptions = Schema.Array(Schema.NullOr(Description)).check(Schema.isMaxLength(65));
+/** One host-private acquired session. The SDK handles and exact-session cleanup have one owner. */
+var ProtectedNativeSession = class extends Context.Service()("@effect-agent/platform-cloudflare/ProtectedNativeSession") {};
+const transportError = (reason) => new ProtectedTransportError({ reason });
+const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => transportError("provider")));
+const remote = (run) => Effect.tryPromise({
+	try: async (signal) => {
+		try {
+			return {
+				ok: true,
+				value: await run(signal)
+			};
+		} catch {
+			return { ok: false };
+		}
+	},
+	catch: () => transportError("provider")
+}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(transportError("provider"))));
+/** Host-private scoped transport. Session capabilities are requirements; policy is per-pass data. */
+const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(function* (policy) {
+	const session = yield* ProtectedNativeSession;
+	const { browser, page } = session;
+	const crypto = yield* Crypto.Crypto;
+	const clock = yield* Clock.Clock;
+	const uuid = crypto.randomUUIDv4.pipe(Effect.mapError(() => transportError("provider")));
+	let closed = false;
+	let violation = false;
+	let documentRef;
+	let observationOrigins;
+	const frames = /* @__PURE__ */ new Map();
+	const controls = /* @__PURE__ */ new Map();
+	const origin = (value) => Effect.try({
+		try: () => {
+			const url = new URL(value);
+			if (url.username || url.password) throw transportError("stale-reference");
+			if (!Schema.is(CredentialOrigin)(url.origin)) throw transportError("unsupported");
+			if (policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) throw transportError("stale-reference");
+			return url.origin;
+		},
+		catch: (cause) => Schema.is(ProtectedTransportError)(cause) ? cause : transportError("provider")
+	});
+	const check = Effect.suspend(() => closed || violation || !browser.isConnected() ? Effect.fail(transportError("stale-reference")) : Effect.void);
+	const clear = () => {
+		controls.clear();
+		documentRef = void 0;
+	};
+	const onNavigated = () => {
+		clear();
+	};
+	const onTarget = (target) => {
+		if (target.type() !== "page") return;
+		violation = true;
+		clear();
+	};
+	const invalidate = () => {
+		closed = true;
+		clear();
+	};
+	const observationFrames = Effect.gen(function* () {
+		const list = page.frames();
+		if (list.length > 32) return yield* transportError("unsupported");
+		return yield* Effect.filter(list, (frame) => frame === page.mainFrame() ? Effect.succeed(true) : Effect.try({
+			try: () => frame.url() !== "" && new URL(frame.url()).protocol === "https:",
+			catch: () => transportError("provider")
+		}));
+	});
+	const context = Effect.gen(function* () {
+		yield* check;
+		const list = yield* observationFrames;
+		const topOrigin = yield* origin(page.url());
+		const frameOrigins = [...new Set(yield* Effect.forEach(list, (frame) => origin(frame.url())))];
+		if (frameOrigins.length > 16) return yield* transportError("unsupported");
+		if (documentRef === void 0) documentRef = yield* uuid;
+		return yield* decode(ProtectedPageContext, {
+			document: documentRef,
+			topOrigin,
+			frameOrigins
+		});
+	});
+	const isCurrent = Effect.fn("ProtectedNativeTransport.isCurrent")(function* (state) {
+		if (state.frame.detached) return false;
+		return yield* remote(() => state.handle.evaluate((held) => {
+			if (typeof held !== "object" || held === null) return false;
+			return Reflect.get(held, "doc") === Reflect.get(globalThis, "document");
+		}));
+	});
+	const get = Effect.fn("ProtectedNativeTransport.get")(function* (ref) {
+		yield* check;
+		const state = controls.get(ref);
+		if (!state || observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin) || state.expires <= (yield* clock.currentTimeMillis) || !(yield* isCurrent(state.frame))) return yield* transportError("stale-reference");
+		const current = yield* remote(() => state.frame.handle.evaluate((held, index) => {
+			if (typeof held !== "object" || held === null) return null;
+			return Reflect.apply(Reflect.get(held, "validate"), held, [index]);
+		}, state.index));
+		const description = yield* decode(Schema.NullOr(Description), current);
+		if (description === null) return yield* transportError("stale-reference");
+		if ((yield* context).topOrigin !== state.control.target.topOrigin || (yield* origin(state.frame.frame.url())) !== state.control.target.frameOrigin || (yield* origin(description.action)) !== state.control.target.recipientOrigin || description.role !== state.control.role) return yield* transportError("stale-reference");
+		return state;
+	});
+	const close = yield* Effect.cached(Effect.gen(function* () {
+		invalidate();
+		return yield* session.close;
+	}).pipe(Effect.ensuring(Effect.sync(() => {
+		page.off("framenavigated", onNavigated);
+		page.off("framedetached", onNavigated);
+		browser.off("targetcreated", onTarget);
+		frames.clear();
+	}))));
+	yield* Effect.acquireRelease(Effect.sync(() => {
+		page.on("framenavigated", onNavigated);
+		page.on("framedetached", onNavigated);
+		browser.on("targetcreated", onTarget);
+	}), () => close);
+	return {
+		restrictObservation: Effect.fn("ProtectedNativeTransport.restrictObservation")(function* (origins) {
+			yield* check;
+			observationOrigins = origins === void 0 ? void 0 : new Set(yield* decode(Schema.Array(CredentialOrigin), origins));
+			for (const [ref, state] of controls) if (observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin)) controls.delete(ref);
+		}),
+		context,
+		invalidate,
+		close,
+		navigate: Effect.fn("ProtectedNativeTransport.navigate")(function* (url) {
+			yield* check;
+			yield* origin(url);
+			clear();
+			yield* remote(() => page.goto(url, { waitUntil: "load" }));
+			yield* context;
+		}),
+		target: (ref) => get(ref).pipe(Effect.map((state) => state.control)),
+		discover: Effect.gen(function* () {
+			const before = yield* context;
+			controls.clear();
+			for (const state of frames.values()) yield* remote(() => state.handle.dispose());
+			frames.clear();
+			const discovered = [];
+			let text = "";
+			let truncated = false;
+			const frameOrigins = /* @__PURE__ */ new Set();
+			for (const frame of yield* observationFrames) {
+				const frameOrigin = yield* origin(frame.url());
+				if (observationOrigins !== void 0 && !observationOrigins.has(frameOrigin)) continue;
+				frameOrigins.add(frameOrigin);
+				if (typeof frame.isolatedRealm !== "function") return yield* transportError("unsupported");
+				const handle = yield* remote(() => frame.isolatedRealm().evaluateHandle(inspectFrame));
+				const state = {
+					frame,
+					handle,
+					ref: yield* uuid,
+					document: yield* uuid,
+					forms: /* @__PURE__ */ new Map()
+				};
+				frames.set(frame, state);
+				const raw = yield* remote(() => handle.evaluate((held) => {
+					if (typeof held !== "object" || held === null) return null;
+					return Reflect.get(held, "original");
+				}));
+				const descriptions = yield* decode(Descriptions, raw);
+				for (let index = 0; index < descriptions.length; index++) {
+					const desc = descriptions[index];
+					if (!desc) continue;
+					if (discovered.length === 64) {
+						truncated = true;
+						break;
+					}
+					let form = state.forms.get(desc.formIndex);
+					if (form === void 0) {
+						form = yield* uuid;
+						state.forms.set(desc.formIndex, form);
+					}
+					const recipient = yield* origin(desc.action).pipe(Effect.result);
+					if (recipient._tag === "Failure") continue;
+					const control = ProtectedBrowserControl.make({
+						ref: yield* uuid,
+						role: desc.role,
+						label: desc.label,
+						...desc.checked === void 0 ? {} : { checked: desc.checked },
+						...desc.role === "link" ? { url: desc.action } : {},
+						target: CredentialTarget.make({
+							topOrigin: before.topOrigin,
+							frameOrigin: yield* origin(frame.url()),
+							recipientOrigin: recipient.success,
+							document: state.document,
+							frame: state.ref,
+							form
+						})
+					});
+					controls.set(control.ref, {
+						frame: state,
+						index,
+						control,
+						expires: (yield* clock.currentTimeMillis) + 6e4
+					});
+					discovered.push(control);
+				}
+				const rawText = yield* remote(() => handle.evaluate((held) => {
+					if (typeof held !== "object" || held === null) return null;
+					return Reflect.apply(Reflect.get(held, "text"), held, []);
+				}));
+				text += yield* decode(Schema.String.check(Schema.isMaxLength(65536)), rawText);
+				if (text.length > 65536) {
+					text = text.slice(0, 65536);
+					truncated = true;
+				}
+			}
+			if ((yield* context).document !== before.document) return yield* transportError("stale-reference");
+			return yield* decode(ProtectedDiscovery, {
+				...before,
+				frameOrigins: [...frameOrigins],
+				text,
+				controls: discovered,
+				truncated
+			});
+		}),
+		fill: Effect.fn("ProtectedNativeTransport.fill")(function* (ref, role, value) {
+			const dispatch = yield* ProtectedBrowserDispatch;
+			const state = yield* get(ref);
+			yield* dispatch.mark;
+			const filled = yield* remote(() => state.frame.handle.evaluate((held, index, expectedRole, secret) => {
+				if (typeof held !== "object" || held === null) return false;
+				return Reflect.apply(Reflect.get(held, "fill"), held, [
+					index,
+					expectedRole,
+					secret
+				]);
+			}, state.index, role, Redacted.value(value)));
+			if (filled === "unsupported") return yield* transportError("unsupported");
+			if (filled !== true) return yield* transportError("stale-reference");
+		}),
+		click: Effect.fn("ProtectedNativeTransport.click")(function* (ref) {
+			const state = yield* get(ref);
+			const clicked = yield* remote(() => state.frame.handle.evaluate((held, index) => {
+				if (typeof held !== "object" || held === null) return false;
+				return Reflect.apply(Reflect.get(held, "click"), held, [index]);
+			}, state.index));
+			if (clicked === "needs-attention") return yield* transportError("needs-attention");
+			if (clicked !== true) return yield* transportError("stale-reference");
+		})
+	};
+}, Effect.withTracerEnabled(false));
+//#endregion
+//#region src/protected-browser/binding.ts
+/**
+* Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
+* documented opt-in semantics are the recording guarantee; no recording-status API exists.
+* Account operators remain trusted, and must not attach external observers to private passes.
+*/
+const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedTransport)(Effect.gen(function* () {
+	const lifecycle = yield* BrowserRunSessionLifecycle;
+	const crypto = yield* Crypto.Crypto;
+	return { open: Effect.fn("BrowserRunProtectedTransport.open")(function* (policy) {
+		const failure = () => new ProtectedBrowserError({
+			reason: "provider",
+			dispatch: "not-dispatched",
+			milestone: "none",
+			observation: "closed",
+			cleanup: "unconfirmed"
+		});
+		let sessionId;
+		let browser;
+		let driver;
+		let invalid = false;
+		const runCleanup = Effect.runPromiseWith(Context.make(Clock.Clock, yield* Clock.Clock));
+		const terminate = Effect.gen(function* () {
+			invalid = true;
+			driver?.invalidate();
+			if (sessionId === void 0) return "unconfirmed";
+			const cleanup = yield* lifecycle.close(sessionId).pipe(Effect.as("confirmed"), Effect.catchCause(() => Effect.succeed("unconfirmed")), Effect.interruptible, Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.succeed("unconfirmed")
+			}));
+			const connected = browser;
+			if (connected !== void 0) yield* Effect.promise(() => connected.disconnect()).pipe(Effect.catchCause(() => Effect.void), Effect.interruptible, Effect.timeoutOrElse({
+				duration: "1 second",
+				orElse: () => Effect.void
+			}));
+			return cleanup;
+		});
+		const close = yield* Effect.cached(terminate);
+		yield* Effect.addFinalizer(() => close.pipe(Effect.flatMap((state) => state === "confirmed" ? Effect.void : Effect.logWarning("Protected browser exact-session closure unconfirmed"))));
+		const acquired = yield* Effect.tryPromise({
+			try: async (signal) => {
+				let recordingDisabled = false;
+				const acquired = await puppeteer.acquire({ fetch: async (input, init) => {
+					const request = new Request(input, init);
+					const url = new URL(request.url);
+					if (url.pathname === "/v1/devtools/browser" && request.method === "POST") {
+						url.searchParams.set("recording", "false");
+						recordingDisabled = url.searchParams.get("recording") === "false";
+						return options.browser.fetch(new Request(url, request));
+					}
+					return options.browser.fetch(request);
+				} }, {
+					recording: false,
+					keep_alive: Math.min(6e5, Math.max(1e4, policy.maxElapsedMillis))
+				});
+				sessionId = Redacted.make(Schema.decodeUnknownSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId));
+				if (!recordingDisabled || signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				browser = await puppeteer.connect(options.browser, acquired.sessionId);
+				if (signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				const page = await (await browser.createBrowserContext()).newPage();
+				await page.setBypassServiceWorker(true);
+				await page.setRequestInterception(true);
+				page.on("request", (request) => {
+					let allowed = policy.network._tag === "Unrestricted";
+					try {
+						const url = new URL(request.url());
+						allowed ||= policy.network._tag === "ExactHosts" && url.protocol === "https:" && !url.username && !url.password && policy.network.allowedHosts.includes(url.host);
+					} catch {}
+					(allowed && !invalid ? request.continue() : request.abort("blockedbyclient")).catch(() => {
+						invalid = true;
+						driver?.invalidate();
+					});
+				});
+				if (signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				return ProtectedNativeSession.of({
+					browser,
+					page,
+					close
+				});
+			},
+			catch: failure
+		}).pipe(Effect.timeoutOrElse({
+			duration: Math.min(policy.maxElapsedMillis, 3e4),
+			orElse: () => Effect.fail(new ProtectedBrowserError({
+				...failure(),
+				reason: "timeout"
+			}))
+		}), Effect.catch((error) => close.pipe(Effect.flatMap((cleanup) => Effect.fail(new ProtectedBrowserError({
+			...error,
+			cleanup
+		}))))));
+		driver = yield* makeProtectedNativeTransport(policy).pipe(Effect.provideService(ProtectedNativeSession, acquired), Effect.provideService(Crypto.Crypto, crypto));
+		return driver;
+	}, Effect.withTracerEnabled(false)) };
+}));
+//#endregion
+export { browserRunProtectedBindingLayer, browserRunProtectedLayer };
+
+//# sourceMappingURL=ProtectedBrowser.mjs.map