@effect-agent/platform-cloudflare 0.1.0-beta.87 → 0.1.0-beta.89

package/dist/ProtectedBrowser.d.mts

@@ -1,7 +1,7 @@
-import { r as BrowserRunSessionLifecycle } from "./browser-session-lifecycle-DJpqLXy_.mjs";
+import { h as BrowserRunLiveViewResult, i as BrowserRunHandoffState, m as BrowserRunLiveViewRequest, n as BrowserRunHandoffRequest, w as BrowserRunSessionLifecycle } from "./InteractiveBrowser-DUE_m12-.mjs";
 import { Context, Crypto, Effect, Layer, Redacted, Schema, Scope } from "effect";
 import { InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
-import { CredentialFieldRole, CredentialOrigin, ProtectedBrowser, ProtectedBrowserControl, ProtectedBrowserError, ProtectedCleanup } from "effect-agent/protected-browser";
+import { BrowserCredentialAccess, CredentialFieldRole, CredentialOrigin, ProtectedBrowser, ProtectedBrowserCheckpoint, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserHandle, ProtectedCleanup } from "effect-agent/protected-browser";
 //#region src/protected-browser/policy.d.ts
 declare const ProtectedTransportError_base: Schema.Class<ProtectedTransportError, Schema.TaggedStruct<"ProtectedTransportError", {
   readonly reason: Schema.Literals<readonly ["stale-reference", "needs-attention", "unsupported", "provider"]>;
@@ -24,6 +24,10 @@ interface ProtectedBrowserTransport {
   readonly fill: (ref: string, role: typeof CredentialFieldRole.Type | "text" | "select", value: Redacted.Redacted<string>) => Effect.Effect<void, ProtectedTransportError, ProtectedBrowserDispatch>;
   /** Invalidates local references synchronously before bounded exact-session cleanup. */
   readonly invalidate: () => void;
+  /** Forget all discovered controls on a controller transition. */
+  readonly resetReferences: () => void;
+  /** Host attachment release, available only for transferable provider sessions. */
+  readonly detach?: Effect.Effect<void, ProtectedBrowserError>;
   readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;
 }
 declare const BrowserRunProtectedTransport_base: Context.ServiceClass<BrowserRunProtectedTransport, "@effect-agent/platform-cloudflare/BrowserRunProtectedTransport", {
@@ -44,22 +48,74 @@ declare const ProtectedDiscovery: Schema.Struct<{
   readonly controls: Schema.$Array<typeof ProtectedBrowserControl>;
   readonly truncated: Schema.Boolean;
 }>;
-/**
- * Fresh private passes only. Account administrators and Browser Rendering token holders are
- * trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
- * Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
- */
+/** Fresh private passes; scoped release confirms exact-session termination. */
 declare const browserRunProtectedLayer: () => Layer.Layer<ProtectedBrowser, never, BrowserRunProtectedTransport | Crypto.Crypto>;
 //#endregion
 //#region src/protected-browser/binding.d.ts
-/**
- * Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
- * documented opt-in semantics are the recording guarantee; no recording-status API exists.
- * Account operators remain trusted, and must not attach external observers to private passes.
- */
+/** Host-private exact page identity; never include it in model-visible results. */
+declare const ProtectedProviderIdentity: Schema.Struct<{
+  readonly sessionId: Schema.Redacted<Schema.String>;
+  readonly contextId: Schema.Redacted<Schema.NonEmptyString>;
+  readonly targetId: Schema.Redacted<Schema.NonEmptyString>;
+}>;
+type ProtectedProviderIdentity = typeof ProtectedProviderIdentity.Type;
+interface ProtectedProviderSession {
+  readonly identity: ProtectedProviderIdentity;
+  readonly driver: ProtectedBrowserTransport;
+  readonly command: (method: "Cloudflare.getLiveView" | "Cloudflare.handoff" | "Cloudflare.getHandoffState", parameters: Readonly<Record<string, string | number>>) => Effect.Effect<unknown, ProtectedBrowserError>;
+  readonly detach: Effect.Effect<void, ProtectedBrowserError>;
+}
+declare const BrowserRunProtectedBinding_base: Context.ServiceClass<BrowserRunProtectedBinding, "@effect-agent/platform-cloudflare/BrowserRunProtectedBinding", {
+  readonly open: (policy: InteractiveBrowserPolicy, identity?: ProtectedProviderIdentity) => Effect.Effect<ProtectedProviderSession, ProtectedBrowserError, Scope.Scope>;
+}>;
+declare class BrowserRunProtectedBinding extends BrowserRunProtectedBinding_base {}
+/** One binding implementation serves scoped tools and host-managed protected handoffs. */
 declare const browserRunProtectedBindingLayer: (options: {
   readonly browser: Pick<BrowserRun, "fetch">;
-}) => Layer.Layer<BrowserRunProtectedTransport, never, BrowserRunSessionLifecycle | Crypto.Crypto>;
+}) => Layer.Layer<BrowserRunProtectedBinding | BrowserRunProtectedTransport, never, BrowserRunSessionLifecycle | Crypto.Crypto>;
+//#endregion
+//#region src/protected-browser/host.d.ts
+declare const BrowserRunProtectedCheckpoint_base: Schema.Class<BrowserRunProtectedCheckpoint, Schema.Struct<{
+  readonly sessionId: Schema.Redacted<Schema.String>;
+  readonly contextId: Schema.Redacted<Schema.NonEmptyString>;
+  readonly targetId: Schema.Redacted<Schema.NonEmptyString>;
+  readonly protected: typeof ProtectedBrowserCheckpoint;
+  readonly handoffId: Schema.optionalKey<Schema.Redacted<Schema.NonEmptyString>>;
+}>, {}>;
+/** Host-only receipt. Store atomically with the controller lease; never return it to a model. */
+declare class BrowserRunProtectedCheckpoint extends BrowserRunProtectedCheckpoint_base {}
+interface BrowserRunProtectedSession {
+  readonly handle: ProtectedBrowserHandle;
+  readonly sessionId: Redacted.Redacted<string>;
+  /** Quiesce before publishing a durable human-control request. Persist before detaching. */
+  readonly suspend: Effect.Effect<BrowserRunProtectedCheckpoint, ProtectedBrowserError>;
+  /** Fences agent tools before dispatch. Persist the returned receipt before detaching. */
+  readonly handoff: (request: BrowserRunHandoffRequest) => Effect.Effect<BrowserRunProtectedCheckpoint, ProtectedBrowserError>;
+  /** Available only while human control is held; the host must authorize the specific human. */
+  readonly getLiveView: (request: BrowserRunLiveViewRequest) => Effect.Effect<BrowserRunLiveViewResult, ProtectedBrowserError>;
+  readonly getHandoffState: Effect.Effect<BrowserRunHandoffState, ProtectedBrowserError>;
+  /** Requires provider completion and a renewed observation grant. Tools must observe before acting. */
+  readonly returnControl: Effect.Effect<void, ProtectedBrowserError>;
+  /** Releases this attachment without terminating the remote browser. Only a committed handoff may detach. */
+  readonly detach: Effect.Effect<void, ProtectedBrowserError>;
+  readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;
+}
+declare const BrowserRunProtectedHost_base: Context.ServiceClass<BrowserRunProtectedHost, "@effect-agent/platform-cloudflare/BrowserRunProtectedHost", {
+  readonly open: (policy: InteractiveBrowserPolicy) => Effect.Effect<BrowserRunProtectedSession, ProtectedBrowserError, Scope.Scope | BrowserCredentialAccess>;
+  readonly resume: (checkpoint: BrowserRunProtectedCheckpoint) => Effect.Effect<BrowserRunProtectedSession, ProtectedBrowserError, Scope.Scope | BrowserCredentialAccess>;
+  readonly closeSession: (sessionId: Redacted.Redacted<string>) => Effect.Effect<typeof ProtectedCleanup.Type>;
+}>;
+/**
+ * Host authority for one protected page. The consumer owns durable generation fencing, authorized
+ * human recipients, checkpoint integrity, vault exposure metadata, and expiry cleanup. Resume only
+ * the latest committed suspended receipt; it never replays browser mutations or creates a page.
+ * Hosted passes require Unrestricted network policy: attachment-local request interception
+ * cannot enforce an ExactHosts policy during detachment. Current credential grants still apply.
+ * Provider inactivity/session deadlines still apply while the host is detached.
+ */
+declare class BrowserRunProtectedHost extends BrowserRunProtectedHost_base {}
+/** Compose with browserRunProtectedBindingLayer and BrowserRunSessionLifecycle. */
+declare const browserRunProtectedHostLayer: () => Layer.Layer<BrowserRunProtectedHost, never, BrowserRunProtectedBinding | BrowserRunSessionLifecycle | Crypto.Crypto>;
 //#endregion
-export { browserRunProtectedBindingLayer, browserRunProtectedLayer };
+export { BrowserRunProtectedCheckpoint, BrowserRunProtectedHost, type BrowserRunProtectedSession, browserRunProtectedBindingLayer, browserRunProtectedHostLayer, browserRunProtectedLayer };
 //# sourceMappingURL=ProtectedBrowser.d.mts.map