@effect-agent/platform-cloudflare 0.1.0-beta.88 → 0.1.0-beta.89

package/dist/ProtectedBrowser.mjs

@@ -1,8 +1,8 @@
-import { n as BrowserRunSessionLifecycle } from "./browser-session-lifecycle-CmbQABHC.mjs";
+import { h as BrowserRunSessionLifecycle, o as BrowserRunLiveViewRequest, r as BrowserRunHandoffState, s as BrowserRunLiveViewResult, t as BrowserRunHandoffRequest } from "./InteractiveBrowser-DupDtfw2.mjs";
 import { Clock, Context, Crypto, Effect, Layer, Redacted, Schema, Semaphore } from "effect";
 import puppeteer from "@cloudflare/puppeteer";
 import { InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
-import { BrowserCredentialAccess, CardCredential, CredentialObservationDecision, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "effect-agent/protected-browser";
+import { BrowserCredentialAccess, CardCredential, CredentialObservationDecision, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserCheckpoint, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "effect-agent/protected-browser";
 //#region src/protected-browser/policy.ts
 var ProtectedTransportError = class extends Schema.TaggedError()("ProtectedTransportError", { reason: Schema.Literals([
 	"stale-reference",
@@ -40,340 +40,403 @@ const secretFor = (material, role) => {
 		case "password": return;
 	}
 };
-/**
-* Fresh private passes only. Account administrators and Browser Rendering token holders are
-* trusted operators. No viewer, handoff, raw JavaScript, screenshot or plaintext credential API exists.
-* Hosts explicitly authorize post-exposure observations for recipients they trust not to echo.
-*/
-const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen(function* () {
-	const transport = yield* BrowserRunProtectedTransport;
+/** Shared protected policy implementation for ephemeral and host-owned passes. */
+const makeProtectedBrowserPolicy = Effect.fn("ProtectedBrowser.open")(function* (input, checkpoint) {
+	const initialError = (reason) => new ProtectedBrowserError({
+		reason,
+		dispatch: "not-dispatched",
+		milestone: "none",
+		observation: "closed",
+		cleanup: "not-requested"
+	});
+	const decodedPolicy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => initialError("denied")));
+	if (decodedPolicy.network._tag === "PublicWeb") return yield* initialError("unsupported");
+	const policy = InteractiveBrowserPolicy.make({
+		...decodedPolicy,
+		network: decodedPolicy.network._tag === "ExactHosts" ? {
+			_tag: "ExactHosts",
+			allowedHosts: [...decodedPolicy.network.allowedHosts]
+		} : { _tag: "Unrestricted" }
+	});
+	const access = yield* BrowserCredentialAccess;
+	const restored = checkpoint === void 0 ? void 0 : yield* Schema.decodeEffect(ProtectedBrowserCheckpoint)(checkpoint).pipe(Effect.mapError(() => initialError("denied")));
+	const now = yield* Clock.currentTimeMillis;
+	if (restored !== void 0 && (restored.startedAt > now || restored.actions > policy.maxActions || now - restored.startedAt >= policy.maxElapsedMillis)) return yield* initialError("timeout");
+	const started = restored?.startedAt ?? now;
+	const driver = yield* (yield* BrowserRunProtectedTransport).open(policy);
 	const crypto = yield* Crypto.Crypto;
-	return { open: Effect.fn("ProtectedBrowser.open")(function* (input) {
-		const initialError = (reason) => new ProtectedBrowserError({
-			reason,
-			dispatch: "not-dispatched",
-			milestone: "none",
-			observation: "closed",
-			cleanup: "not-requested"
-		});
-		const decodedPolicy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => initialError("denied")));
-		if (decodedPolicy.network._tag === "PublicWeb") return yield* initialError("unsupported");
-		const policy = InteractiveBrowserPolicy.make({
-			...decodedPolicy,
-			network: decodedPolicy.network._tag === "ExactHosts" ? {
-				_tag: "ExactHosts",
-				allowedHosts: [...decodedPolicy.network.allowedHosts]
-			} : { _tag: "Unrestricted" }
-		});
-		const access = yield* BrowserCredentialAccess;
-		const started = yield* Clock.currentTimeMillis;
-		const driver = yield* transport.open(policy);
-		const lock = yield* Semaphore.make(1);
-		let observation = "before-exposure";
-		let cleanup = "not-requested";
-		let actions = 0;
-		let dispatch = "not-dispatched";
-		let milestone = "none";
-		const exposures = [];
-		const offers = /* @__PURE__ */ new Map();
-		const fail = (reason) => new ProtectedBrowserError({
-			reason,
-			dispatch,
-			milestone,
-			observation,
-			cleanup
-		});
-		const close = yield* Effect.cached(Effect.uninterruptible(Effect.gen(function* () {
-			observation = "closed";
-			offers.clear();
-			driver.invalidate();
-			cleanup = yield* driver.close.pipe(Effect.interruptible, Effect.timeoutOrElse({
-				duration: "10 seconds",
-				orElse: () => Effect.succeed("unconfirmed")
-			}), Effect.catchCause(() => Effect.succeed("unconfirmed")));
-			return cleanup;
-		})));
-		yield* Effect.addFinalizer(() => close.pipe(Effect.flatMap((result) => result === "unconfirmed" ? Effect.logWarning("Protected browser exact-session closure unconfirmed") : Effect.void)));
-		const remote = (effect) => effect.pipe(Effect.mapError((error) => fail(error.reason)));
-		const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => fail("provider")));
-		const caller = access.caller.pipe(Effect.mapError((error) => fail(error.reason)));
-		const pageContext = remote(driver.context);
-		const permitObservation = Effect.gen(function* () {
-			const context = yield* pageContext;
-			let origins;
-			if (exposures.length > 0) {
-				observation = "protected";
-				const principal = yield* caller;
-				const rawDecision = yield* access.observation({
-					...context,
-					caller: principal,
-					exposures: [...exposures]
-				}).pipe(Effect.mapError((error) => fail(error.reason)));
-				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
-				const decision = yield* Schema.decodeEffect(CredentialObservationDecision)(rawDecision).pipe(Effect.mapError(() => fail("observation-blocked")));
-				if (decision === "deny") return yield* fail("observation-blocked");
-				if (typeof decision !== "string") {
-					origins = [...decision.origins];
-					if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
-				}
-				observation = "approved-after-exposure";
-			}
-			yield* remote(driver.restrictObservation(origins));
-			return {
-				...context,
-				frameOrigins: context.frameOrigins.filter((origin) => origins === void 0 || origins.includes(origin))
-			};
-		});
-		const target = (ref) => remote(driver.target(ref));
-		const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (action) {
-			if (access.authorizeAction === void 0) {
-				if (action._tag === "Submit") return yield* fail("unsupported");
-				return;
-			}
+	let suspended = restored !== void 0;
+	let detached = false;
+	let needsObservation = restored !== void 0;
+	let humanExposure = restored?.humanExposure ?? false;
+	let humanOrigins = [...restored?.humanOrigins ?? []];
+	const lock = yield* Semaphore.make(1);
+	let observation = "before-exposure";
+	let cleanup = "not-requested";
+	let actions = restored?.actions ?? 0;
+	let dispatch = restored?.dispatch ?? "not-dispatched";
+	let milestone = restored?.milestone ?? "none";
+	const exposures = [...restored?.exposures ?? []];
+	const offers = /* @__PURE__ */ new Map();
+	const fail = (reason) => new ProtectedBrowserError({
+		reason,
+		dispatch,
+		milestone,
+		observation,
+		cleanup
+	});
+	const close = yield* Effect.cached(Effect.uninterruptible(Effect.gen(function* () {
+		observation = "closed";
+		offers.clear();
+		driver.invalidate();
+		cleanup = yield* driver.close.pipe(Effect.interruptible, Effect.timeoutOrElse({
+			duration: "10 seconds",
+			orElse: () => Effect.succeed("unconfirmed")
+		}), Effect.catchCause(() => Effect.succeed("unconfirmed")));
+		return cleanup;
+	})));
+	yield* Effect.addFinalizer(() => detached ? Effect.void : close.pipe(Effect.flatMap((result) => result === "unconfirmed" ? Effect.logWarning("Protected browser exact-session closure unconfirmed") : Effect.void)));
+	const remote = (effect) => effect.pipe(Effect.mapError((error) => fail(error.reason)));
+	const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => fail("provider")));
+	const caller = access.caller.pipe(Effect.mapError((error) => fail(error.reason)));
+	const pageContext = remote(driver.context);
+	const permitObservation = Effect.gen(function* () {
+		const context = yield* pageContext;
+		let origins;
+		if (exposures.length > 0 || humanExposure) {
+			observation = "protected";
 			const principal = yield* caller;
-			yield* access.authorizeAction({
+			const rawDecision = yield* access.observation({
+				...context,
 				caller: principal,
-				action,
-				exposures: [...exposures]
+				exposures: [...exposures],
+				humanExposure,
+				humanOrigins
 			}).pipe(Effect.mapError((error) => fail(error.reason)));
 			if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
-			if (action._tag !== "Navigate") {
-				const current = yield* target(action.ref);
-				if (!sameTarget(current.target, action.target) || current.role !== (action._tag === "Submit" ? "submit" : action.role) || action._tag === "Click" && action.role === "link" && current.url !== action.url) return yield* fail("stale-reference");
+			const decision = yield* Schema.decodeEffect(CredentialObservationDecision)(rawDecision).pipe(Effect.mapError(() => fail("observation-blocked")));
+			if (decision === "deny") return yield* fail("observation-blocked");
+			if (typeof decision !== "string") {
+				origins = [...decision.origins];
+				if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
 			}
-		}, Effect.withTracerEnabled(false));
-		const bounded = (result) => {
-			return new TextEncoder().encode(JSON.stringify(result)).byteLength <= policy.maxReturnedBytes ? Effect.succeed(result) : Effect.fail(fail("limit"));
+			observation = "approved-after-exposure";
+		}
+		yield* remote(driver.restrictObservation(origins));
+		return {
+			...context,
+			frameOrigins: context.frameOrigins.filter((origin) => origins === void 0 || origins.includes(origin))
 		};
-		const run = (effect) => lock.withPermitsIfAvailable(1)(Effect.gen(function* () {
-			dispatch = "not-dispatched";
-			milestone = "none";
-			if (observation === "closed") return yield* fail("closed");
-			if (++actions > policy.maxActions) return yield* fail("limit");
-			const remaining = policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started);
-			if (remaining <= 0) {
-				yield* close;
-				return yield* fail("timeout");
+	});
+	const target = (ref) => remote(driver.target(ref));
+	const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (action) {
+		if (access.authorizeAction === void 0) {
+			if (action._tag === "Submit") return yield* fail("unsupported");
+			return;
+		}
+		const principal = yield* caller;
+		yield* access.authorizeAction({
+			caller: principal,
+			action,
+			exposures: [...exposures]
+		}).pipe(Effect.mapError((error) => fail(error.reason)));
+		if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+		if (action._tag !== "Navigate") {
+			const current = yield* target(action.ref);
+			if (!sameTarget(current.target, action.target) || current.role !== (action._tag === "Submit" ? "submit" : action.role) || action._tag === "Click" && action.role === "link" && current.url !== action.url) return yield* fail("stale-reference");
+		}
+	}, Effect.withTracerEnabled(false));
+	const bounded = (result) => {
+		return new TextEncoder().encode(JSON.stringify(result)).byteLength <= policy.maxReturnedBytes ? Effect.succeed(result) : Effect.fail(fail("limit"));
+	};
+	const run = (effect, observing = false) => lock.withPermitsIfAvailable(1)(Effect.gen(function* () {
+		if (suspended || detached) return yield* fail("busy");
+		if (needsObservation && !observing) return yield* fail("stale-reference");
+		dispatch = "not-dispatched";
+		milestone = "none";
+		if (observation === "closed") return yield* fail("closed");
+		if (++actions > policy.maxActions) return yield* fail("limit");
+		const remaining = policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started);
+		if (remaining <= 0) {
+			yield* close;
+			return yield* fail("timeout");
+		}
+		return yield* effect.pipe(Effect.timeoutOrElse({
+			duration: remaining,
+			orElse: () => Effect.fail(fail("timeout"))
+		}), Effect.catchCause((cause) => Effect.gen(function* () {
+			const error = cause.reasons.find((reason) => reason._tag === "Fail" && Schema.is(ProtectedBrowserError)(reason.error));
+			const reason = error?._tag === "Fail" && Schema.is(ProtectedBrowserError)(error.error) ? error.error.reason : "provider";
+			const interrupt = cause.reasons.some((reason) => reason._tag === "Interrupt");
+			if (dispatch !== "not-dispatched" || interrupt || reason === "provider" || reason === "timeout") yield* close;
+			if (interrupt) return yield* Effect.interrupt;
+			return yield* fail(dispatch === "possibly-dispatched" && reason === "provider" ? "outcome-unknown" : reason);
+		})), Effect.onInterrupt(() => close), Effect.withTracerEnabled(false));
+	})).pipe(Effect.flatMap(Effect.fromOption(() => new ProtectedBrowserError({
+		reason: "busy",
+		dispatch: "not-dispatched",
+		milestone: "none",
+		observation,
+		cleanup
+	}))));
+	const handle = {
+		close: Effect.suspend(() => detached ? Effect.succeed("not-requested") : close),
+		navigate: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserNavigate)(request).pipe(Effect.mapError(() => fail("denied")));
+			let url;
+			try {
+				url = new URL(decoded.url);
+			} catch {
+				return yield* fail("denied");
 			}
-			return yield* effect.pipe(Effect.timeoutOrElse({
-				duration: remaining,
-				orElse: () => Effect.fail(fail("timeout"))
-			}), Effect.catchCause((cause) => Effect.gen(function* () {
-				const error = cause.reasons.find((reason) => reason._tag === "Fail" && Schema.is(ProtectedBrowserError)(reason.error));
-				const reason = error?._tag === "Fail" && Schema.is(ProtectedBrowserError)(error.error) ? error.error.reason : "provider";
-				const interrupt = cause.reasons.some((reason) => reason._tag === "Interrupt");
-				if (dispatch !== "not-dispatched" || interrupt || reason === "provider" || reason === "timeout") yield* close;
-				if (interrupt) return yield* Effect.interrupt;
-				return yield* fail(dispatch === "possibly-dispatched" && reason === "provider" ? "outcome-unknown" : reason);
-			})), Effect.onInterrupt(() => close), Effect.withTracerEnabled(false));
-		})).pipe(Effect.flatMap(Effect.fromOption(() => new ProtectedBrowserError({
-			reason: "busy",
-			dispatch: "not-dispatched",
-			milestone: "none",
-			observation,
-			cleanup
-		}))));
-		return {
-			close,
-			navigate: (request) => run(Effect.gen(function* () {
-				const decoded = yield* Schema.decodeEffect(ProtectedBrowserNavigate)(request).pipe(Effect.mapError(() => fail("denied")));
-				let url;
-				try {
-					url = new URL(decoded.url);
-				} catch {
-					return yield* fail("denied");
-				}
-				if (url.protocol !== "https:" || url.username || url.password || policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) return yield* fail("denied");
-				if (exposures.length > 0) yield* permitObservation;
-				yield* authorizeAction({
-					_tag: "Navigate",
-					url: decoded.url
-				});
-				offers.clear();
-				dispatch = "possibly-dispatched";
-				yield* remote(driver.navigate(decoded.url));
-				dispatch = "dispatched";
-				yield* permitObservation;
-			})),
-			observe: run(Effect.gen(function* () {
-				const before = yield* permitObservation;
-				const result = yield* remote(driver.discover);
-				const after = yield* permitObservation;
-				if (before.document !== after.document || result.document !== after.document || result.topOrigin !== after.topOrigin) return yield* fail("stale-reference");
-				if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin))) return yield* fail("observation-blocked");
-				return yield* bounded(ProtectedBrowserObservation.make({
-					...result,
-					observation: exposures.length > 0 ? "approved-after-exposure" : "before-exposure"
-				}));
-			})),
-			click: (request) => run(Effect.gen(function* () {
-				const decoded = yield* Schema.decodeEffect(ProtectedBrowserClick)(request).pipe(Effect.mapError(() => fail("denied")));
-				yield* permitObservation;
-				const control = yield* target(decoded.ref);
-				if (control.role !== "link" && control.role !== "button" && control.role !== "radio" && control.role !== "checkbox" && control.role !== "submit") return yield* fail("unsupported");
-				let action;
-				if (control.role === "link") {
-					if (control.url === void 0) return yield* fail("unsupported");
-					action = {
-						_tag: "Click",
-						ref: decoded.ref,
-						target: control.target,
-						role: "link",
-						url: control.url
-					};
-				} else if (control.role === "submit") action = {
-					_tag: "Submit",
-					ref: decoded.ref,
-					target: control.target
-				};
-				else action = {
+			if (url.protocol !== "https:" || url.username || url.password || policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) return yield* fail("denied");
+			if (exposures.length > 0 || humanExposure) yield* permitObservation;
+			yield* authorizeAction({
+				_tag: "Navigate",
+				url: decoded.url
+			});
+			offers.clear();
+			dispatch = "possibly-dispatched";
+			yield* remote(driver.navigate(decoded.url));
+			dispatch = "dispatched";
+			yield* permitObservation;
+		})),
+		observe: run(Effect.gen(function* () {
+			const before = yield* permitObservation;
+			const result = yield* remote(driver.discover);
+			const after = yield* permitObservation;
+			if (before.document !== after.document || result.document !== after.document || result.topOrigin !== after.topOrigin) return yield* fail("stale-reference");
+			if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin))) return yield* fail("observation-blocked");
+			const observation = yield* bounded(ProtectedBrowserObservation.make({
+				...result,
+				observation: exposures.length > 0 || humanExposure ? "approved-after-exposure" : "before-exposure"
+			}));
+			needsObservation = false;
+			return observation;
+		}), true),
+		click: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserClick)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.ref);
+			if (control.role !== "link" && control.role !== "button" && control.role !== "radio" && control.role !== "checkbox" && control.role !== "submit") return yield* fail("unsupported");
+			let action;
+			if (control.role === "link") {
+				if (control.url === void 0) return yield* fail("unsupported");
+				action = {
 					_tag: "Click",
 					ref: decoded.ref,
 					target: control.target,
-					role: control.role
+					role: "link",
+					url: control.url
 				};
-				yield* authorizeAction(action);
+			} else if (control.role === "submit") action = {
+				_tag: "Submit",
+				ref: decoded.ref,
+				target: control.target
+			};
+			else action = {
+				_tag: "Click",
+				ref: decoded.ref,
+				target: control.target,
+				role: control.role
+			};
+			yield* authorizeAction(action);
+			dispatch = "possibly-dispatched";
+			yield* remote(driver.click(decoded.ref)).pipe(Effect.catch((error) => {
+				if (error.reason === "needs-attention") dispatch = "not-dispatched";
+				return Effect.fail(error);
+			}));
+			dispatch = "dispatched";
+			if (control.role === "submit") milestone = "submission-dispatched";
+			yield* permitObservation;
+		})),
+		fill: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserFill)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.ref);
+			if (control.role !== "text" && control.role !== "select") return yield* fail("unsupported");
+			yield* authorizeAction({
+				_tag: "Fill",
+				ref: decoded.ref,
+				target: control.target,
+				role: control.role
+			});
+			yield* remote(driver.fill(decoded.ref, control.role, Redacted.make(decoded.value))).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
 				dispatch = "possibly-dispatched";
-				yield* remote(driver.click(decoded.ref)).pipe(Effect.catch((error) => {
-					if (error.reason === "needs-attention") dispatch = "not-dispatched";
-					return Effect.fail(error);
-				}));
-				dispatch = "dispatched";
-				if (control.role === "submit") milestone = "submission-dispatched";
-				yield* permitObservation;
-			})),
-			fill: (request) => run(Effect.gen(function* () {
-				const decoded = yield* Schema.decodeEffect(ProtectedBrowserFill)(request).pipe(Effect.mapError(() => fail("denied")));
-				yield* permitObservation;
-				const control = yield* target(decoded.ref);
-				if (control.role !== "text" && control.role !== "select") return yield* fail("unsupported");
-				yield* authorizeAction({
-					_tag: "Fill",
-					ref: decoded.ref,
-					target: control.target,
-					role: control.role
-				});
-				yield* remote(driver.fill(decoded.ref, control.role, Redacted.make(decoded.value))).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
-					dispatch = "possibly-dispatched";
-				}) }));
-				dispatch = "dispatched";
-				milestone = "filled";
-				yield* permitObservation;
-			})),
-			listCredentialOffers: (request) => run(Effect.gen(function* () {
-				const decoded = yield* Schema.decodeEffect(ListCredentialOffers)(request).pipe(Effect.mapError(() => fail("denied")));
-				yield* permitObservation;
-				const control = yield* target(decoded.target);
-				if (kindFor(control.role) !== decoded.kind) return yield* fail("unsupported");
-				const principal = yield* caller;
-				const candidates = yield* access.list({
+			}) }));
+			dispatch = "dispatched";
+			milestone = "filled";
+			yield* permitObservation;
+		})),
+		listCredentialOffers: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ListCredentialOffers)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.target);
+			if (kindFor(control.role) !== decoded.kind) return yield* fail("unsupported");
+			const principal = yield* caller;
+			const candidates = yield* access.list({
+				caller: principal,
+				kind: decoded.kind,
+				target: control.target
+			}).pipe(Effect.mapError((error) => fail(error.reason)));
+			const now = yield* Clock.currentTimeMillis;
+			for (const [ref, offer] of offers) if (offer.expires <= now) offers.delete(ref);
+			if (candidates.length > 16 || offers.size + candidates.length > 64) return yield* fail("limit");
+			if (!sameTarget(control.target, (yield* target(decoded.target)).target)) return yield* fail("stale-reference");
+			const expires = now + 6e4;
+			const result = [];
+			const pending = /* @__PURE__ */ new Map();
+			for (const candidate of candidates) {
+				const metadata = yield* decode(CredentialOfferMetadata, candidate.metadata);
+				const ref = yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => fail("provider")));
+				pending.set(ref, {
 					caller: principal,
+					key: candidate.key,
+					target: control.target,
+					targetRef: decoded.target,
 					kind: decoded.kind,
-					target: control.target
-				}).pipe(Effect.mapError((error) => fail(error.reason)));
-				const now = yield* Clock.currentTimeMillis;
-				for (const [ref, offer] of offers) if (offer.expires <= now) offers.delete(ref);
-				if (candidates.length > 16 || offers.size + candidates.length > 64) return yield* fail("limit");
-				if (!sameTarget(control.target, (yield* target(decoded.target)).target)) return yield* fail("stale-reference");
-				const expires = now + 6e4;
-				const result = [];
-				const pending = /* @__PURE__ */ new Map();
-				for (const candidate of candidates) {
-					const metadata = yield* decode(CredentialOfferMetadata, candidate.metadata);
-					const ref = yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => fail("provider")));
-					pending.set(ref, {
-						caller: principal,
-						key: candidate.key,
-						target: control.target,
-						targetRef: decoded.target,
-						kind: decoded.kind,
-						expires
-					});
-					result.push(CredentialOffer.make({
-						ref,
-						kind: decoded.kind,
-						metadata
-					}));
-				}
-				yield* bounded(result);
-				for (const [ref, offer] of pending) offers.set(ref, offer);
-				return result;
-			})),
-			useCredential: (request) => run(Effect.gen(function* () {
-				const decoded = yield* Schema.decodeEffect(UseCredential)(request).pipe(Effect.mapError(() => fail("denied")));
-				const offer = offers.get(decoded.offer);
-				if (offer === void 0 || offer.expires <= (yield* Clock.currentTimeMillis)) return yield* fail("stale-reference");
-				const principal = yield* caller;
-				if (Redacted.value(principal) !== Redacted.value(offer.caller)) return yield* fail("denied");
-				if (new Set(decoded.fields.map((field) => field.ref)).size !== decoded.fields.length || new Set(decoded.fields.map((field) => field.role)).size !== decoded.fields.length) return yield* fail("denied");
-				const validate = Effect.gen(function* () {
-					if (!sameTarget(offer.target, (yield* target(offer.targetRef)).target)) return yield* fail("stale-reference");
-					for (const field of decoded.fields) {
-						const current = yield* target(field.ref);
-						if (field.role !== current.role || kindFor(field.role) !== offer.kind || !sameTarget(offer.target, current.target)) return yield* fail("denied");
-					}
-					if (decoded.submit !== void 0) {
-						const submit = yield* target(decoded.submit);
-						if (submit.role !== "submit" || !sameTarget(offer.target, submit.target)) return yield* fail("denied");
-					}
-				});
-				yield* validate;
-				const authorization = {
-					caller: principal,
-					key: offer.key,
-					kind: offer.kind,
-					target: offer.target,
-					roles: decoded.fields.map((field) => field.role),
-					submit: decoded.submit !== void 0
-				};
-				const authorize = Effect.gen(function* () {
-					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
-					yield* access.authorize(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
-					if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+					expires
 				});
-				yield* authorize;
-				yield* validate;
-				const raw = yield* access.resolve(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
-				const material = yield* Schema.decodeEffect(offer.kind === "login" ? LoginCredential : CardCredential)(raw).pipe(Effect.mapError(() => fail("resolver")));
-				for (const field of decoded.fields) if (secretFor(material, field.role) === void 0) return yield* fail("missing-credential");
-				offers.delete(decoded.offer);
+				result.push(CredentialOffer.make({
+					ref,
+					kind: decoded.kind,
+					metadata
+				}));
+			}
+			yield* bounded(result);
+			for (const [ref, offer] of pending) offers.set(ref, offer);
+			return result;
+		})),
+		useCredential: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(UseCredential)(request).pipe(Effect.mapError(() => fail("denied")));
+			const offer = offers.get(decoded.offer);
+			if (offer === void 0 || offer.expires <= (yield* Clock.currentTimeMillis)) return yield* fail("stale-reference");
+			const principal = yield* caller;
+			if (Redacted.value(principal) !== Redacted.value(offer.caller)) return yield* fail("denied");
+			if (new Set(decoded.fields.map((field) => field.ref)).size !== decoded.fields.length || new Set(decoded.fields.map((field) => field.role)).size !== decoded.fields.length) return yield* fail("denied");
+			const validate = Effect.gen(function* () {
+				if (!sameTarget(offer.target, (yield* target(offer.targetRef)).target)) return yield* fail("stale-reference");
 				for (const field of decoded.fields) {
-					yield* validate;
-					yield* authorize;
-					const value = secretFor(material, field.role);
-					if (value === void 0) return yield* fail("missing-credential");
-					observation = "protected";
-					yield* remote(driver.fill(field.ref, field.role, value)).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
-						dispatch = "possibly-dispatched";
-						if (!exposures.some((target) => sameTarget(target, offer.target))) exposures.push(offer.target);
-					}) }));
-					dispatch = "dispatched";
-					milestone = "partial-fill";
+					const current = yield* target(field.ref);
+					if (field.role !== current.role || kindFor(field.role) !== offer.kind || !sameTarget(offer.target, current.target)) return yield* fail("denied");
 				}
-				milestone = "filled";
 				if (decoded.submit !== void 0) {
-					yield* validate;
-					yield* authorize;
-					const ref = decoded.submit;
-					dispatch = "possibly-dispatched";
-					yield* remote(driver.click(ref)).pipe(Effect.catch((error) => {
-						if (error.reason === "needs-attention") dispatch = "dispatched";
-						return Effect.fail(error);
-					}));
-					dispatch = "dispatched";
-					milestone = "submission-dispatched";
+					const submit = yield* target(decoded.submit);
+					if (submit.role !== "submit" || !sameTarget(offer.target, submit.target)) return yield* fail("denied");
 				}
-				yield* permitObservation;
-				return CredentialUseResult.make({
-					dispatch,
-					milestone,
-					observation,
-					cleanup,
-					authentication: "unverified"
-				});
-			}))
-		};
-	}, Effect.withTracerEnabled(false)) };
+			});
+			yield* validate;
+			const authorization = {
+				caller: principal,
+				key: offer.key,
+				kind: offer.kind,
+				target: offer.target,
+				roles: decoded.fields.map((field) => field.role),
+				submit: decoded.submit !== void 0
+			};
+			const authorize = Effect.gen(function* () {
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+				yield* access.authorize(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+			});
+			yield* authorize;
+			yield* validate;
+			const raw = yield* access.resolve(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+			const material = yield* Schema.decodeEffect(offer.kind === "login" ? LoginCredential : CardCredential)(raw).pipe(Effect.mapError(() => fail("resolver")));
+			for (const field of decoded.fields) if (secretFor(material, field.role) === void 0) return yield* fail("missing-credential");
+			offers.delete(decoded.offer);
+			for (const field of decoded.fields) {
+				yield* validate;
+				yield* authorize;
+				const value = secretFor(material, field.role);
+				if (value === void 0) return yield* fail("missing-credential");
+				observation = "protected";
+				yield* remote(driver.fill(field.ref, field.role, value)).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+					dispatch = "possibly-dispatched";
+					if (!exposures.some((target) => sameTarget(target, offer.target))) exposures.push(offer.target);
+				}) }));
+				dispatch = "dispatched";
+				milestone = "partial-fill";
+			}
+			milestone = "filled";
+			if (decoded.submit !== void 0) {
+				yield* validate;
+				yield* authorize;
+				const ref = decoded.submit;
+				dispatch = "possibly-dispatched";
+				yield* remote(driver.click(ref)).pipe(Effect.catch((error) => {
+					if (error.reason === "needs-attention") dispatch = "dispatched";
+					return Effect.fail(error);
+				}));
+				dispatch = "dispatched";
+				milestone = "submission-dispatched";
+			}
+			yield* permitObservation;
+			return CredentialUseResult.make({
+				dispatch,
+				milestone,
+				observation,
+				cleanup,
+				authentication: "unverified"
+			});
+		}))
+	};
+	const locked = (effect) => lock.withPermitsIfAvailable(1)(effect).pipe(Effect.flatMap(Effect.fromOption(() => fail("busy"))));
+	return {
+		handle,
+		suspend: (human = false) => locked(Effect.gen(function* () {
+			if (detached || observation === "closed") return yield* fail("closed");
+			if (dispatch === "possibly-dispatched") return yield* fail("outcome-unknown");
+			if ((yield* Clock.currentTimeMillis) - started >= policy.maxElapsedMillis) return yield* fail("timeout");
+			suspended = true;
+			if (human) {
+				const context = yield* pageContext;
+				const origins = yield* Schema.decodeEffect(ProtectedBrowserCheckpoint.fields.humanOrigins)([.../* @__PURE__ */ new Set([
+					...humanOrigins,
+					context.topOrigin,
+					...context.frameOrigins
+				])]).pipe(Effect.catch(() => fail("needs-attention")));
+				humanExposure = true;
+				humanOrigins = [...origins];
+				observation = "protected";
+			}
+			driver.resetReferences();
+			offers.clear();
+			return ProtectedBrowserCheckpoint.make({
+				policy,
+				startedAt: started,
+				actions,
+				exposures: [...exposures],
+				humanExposure,
+				humanOrigins,
+				dispatch,
+				milestone
+			});
+		})),
+		returnControl: locked(Effect.gen(function* () {
+			if (detached || observation === "closed") return yield* fail("closed");
+			if (!suspended) return yield* fail("denied");
+			yield* permitObservation;
+			offers.clear();
+			driver.resetReferences();
+			needsObservation = true;
+			suspended = false;
+		})),
+		detach: locked(Effect.gen(function* () {
+			if (!suspended || observation === "closed") return yield* fail("denied");
+			if (driver.detach === void 0) return yield* fail("unsupported");
+			yield* driver.detach.pipe(Effect.onError(() => close), Effect.onInterrupt(() => close));
+			detached = true;
+			offers.clear();
+			driver.invalidate();
+		}))
+	};
+}, Effect.withTracerEnabled(false));
+/** Fresh private passes; scoped release confirms exact-session termination. */
+const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen(function* () {
+	const transport = yield* BrowserRunProtectedTransport;
+	const crypto = yield* Crypto.Crypto;
+	return { open: (policy) => makeProtectedBrowserPolicy(policy).pipe(Effect.map((session) => session.handle), Effect.provideService(BrowserRunProtectedTransport, transport), Effect.provideService(Crypto.Crypto, crypto)) };
 }));
 //#endregion
 //#region src/protected-browser/inspect-frame.ts
@@ -620,7 +683,13 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 		page.on("framenavigated", onNavigated);
 		page.on("framedetached", onNavigated);
 		browser.on("targetcreated", onTarget);
-	}), () => close);
+	}), () => session.release === void 0 ? close : session.release.pipe(Effect.ensuring(Effect.sync(() => {
+		invalidate();
+		page.off("framenavigated", onNavigated);
+		page.off("framedetached", onNavigated);
+		browser.off("targetcreated", onTarget);
+		frames.clear();
+	}))));
 	return {
 		restrictObservation: Effect.fn("ProtectedNativeTransport.restrictObservation")(function* (origins) {
 			yield* check;
@@ -629,6 +698,7 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 		}),
 		context,
 		invalidate,
+		resetReferences: clear,
 		close,
 		navigate: Effect.fn("ProtectedNativeTransport.navigate")(function* (url) {
 			yield* check;
@@ -750,15 +820,22 @@ const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(
 }, Effect.withTracerEnabled(false));
 //#endregion
 //#region src/protected-browser/binding.ts
+/** Host-private exact page identity; never include it in model-visible results. */
+const ProtectedProviderIdentity = Schema.Struct({
+	sessionId: Schema.Redacted(Schema.String.check(Schema.isUUID())),
+	contextId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+	targetId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256)))
+});
+var BrowserRunProtectedBinding = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedBinding") {};
 /**
 * Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
 * documented opt-in semantics are the recording guarantee; no recording-status API exists.
 * Account operators remain trusted, and must not attach external observers to private passes.
 */
-const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedTransport)(Effect.gen(function* () {
+const protectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedBinding)(Effect.gen(function* () {
 	const lifecycle = yield* BrowserRunSessionLifecycle;
 	const crypto = yield* Crypto.Crypto;
-	return { open: Effect.fn("BrowserRunProtectedTransport.open")(function* (policy) {
+	return { open: Effect.fn("BrowserRunProtectedTransport.open")(function* (policy, identity) {
 		const failure = () => new ProtectedBrowserError({
 			reason: "provider",
 			dispatch: "not-dispatched",
@@ -766,7 +843,10 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 			observation: "closed",
 			cleanup: "unconfirmed"
 		});
-		let sessionId;
+		let sessionId = identity?.sessionId;
+		let detached = false;
+		let control;
+		let providerIdentity;
 		let browser;
 		let driver;
 		let invalid = false;
@@ -787,11 +867,11 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 			return cleanup;
 		});
 		const close = yield* Effect.cached(terminate);
-		yield* Effect.addFinalizer(() => close.pipe(Effect.flatMap((state) => state === "confirmed" ? Effect.void : Effect.logWarning("Protected browser exact-session closure unconfirmed"))));
+		yield* Effect.addFinalizer(() => detached ? Effect.void : close.pipe(Effect.flatMap((state) => state === "confirmed" ? Effect.void : Effect.logWarning("Protected browser exact-session closure unconfirmed"))));
 		const acquired = yield* Effect.tryPromise({
 			try: async (signal) => {
 				let recordingDisabled = false;
-				const acquired = await puppeteer.acquire({ fetch: async (input, init) => {
+				const acquired = identity === void 0 ? await puppeteer.acquire({ fetch: async (input, init) => {
 					const request = new Request(input, init);
 					const url = new URL(request.url);
 					if (url.pathname === "/v1/devtools/browser" && request.method === "POST") {
@@ -803,9 +883,9 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 				} }, {
 					recording: false,
 					keep_alive: Math.min(6e5, Math.max(1e4, policy.maxElapsedMillis))
-				});
+				}) : { sessionId: Redacted.value(identity.sessionId) };
 				sessionId = Redacted.make(Schema.decodeSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId));
-				if (!recordingDisabled || signal.aborted || invalid) {
+				if (identity === void 0 && !recordingDisabled || signal.aborted || invalid) {
 					await runCleanup(terminate);
 					throw new ProtectedTransportError({ reason: "stale-reference" });
 				}
@@ -814,7 +894,29 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 					await runCleanup(terminate);
 					throw new ProtectedTransportError({ reason: "stale-reference" });
 				}
-				const page = await (await browser.createBrowserContext()).newPage();
+				let page;
+				if (identity === void 0) page = await (await browser.createBrowserContext()).newPage();
+				else {
+					const context = browser.browserContexts().find((candidate) => candidate.id === Redacted.value(identity.contextId));
+					if (context === void 0) throw new ProtectedTransportError({ reason: "stale-reference" });
+					const pages = await context.pages();
+					let found;
+					for (const candidate of pages) {
+						const client = await candidate.createCDPSession();
+						const info = await client.send("Target.getTargetInfo");
+						await client.detach();
+						if (info.targetInfo.targetId === Redacted.value(identity.targetId)) found = candidate;
+					}
+					if (found === void 0 || pages.length !== 1) throw new ProtectedTransportError({ reason: "stale-reference" });
+					page = found;
+				}
+				control = await page.createCDPSession();
+				const info = await control.send("Target.getTargetInfo");
+				providerIdentity = Schema.decodeSync(ProtectedProviderIdentity)({
+					sessionId,
+					contextId: Redacted.make(page.browserContext().id ?? ""),
+					targetId: Redacted.make(info.targetInfo.targetId)
+				});
 				await page.setBypassServiceWorker(true);
 				await page.setRequestInterception(true);
 				page.on("request", (request) => {
@@ -835,7 +937,8 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 				return ProtectedNativeSession.of({
 					browser,
 					page,
-					close
+					close,
+					release: Effect.suspend(() => detached ? Effect.void : close.pipe(Effect.asVoid))
 				});
 			},
 			catch: failure
@@ -850,10 +953,178 @@ const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProt
 			cleanup
 		}))))));
 		driver = yield* makeProtectedNativeTransport(policy).pipe(Effect.provideService(ProtectedNativeSession, acquired), Effect.provideService(Crypto.Crypto, crypto));
-		return driver;
+		const exact = providerIdentity;
+		if (exact === void 0) return yield* failure();
+		return {
+			identity: exact,
+			driver,
+			command: (method, parameters) => Effect.tryPromise({
+				try: async () => {
+					if (invalid || detached || control === void 0) throw void 0;
+					const send = Reflect.get(control, "send");
+					return await Reflect.apply(send, control, [method, parameters]);
+				},
+				catch: failure
+			}).pipe(Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.fail(failure())
+			})),
+			detach: Effect.tryPromise({
+				try: async () => {
+					if (invalid || detached || browser === void 0) throw void 0;
+					await browser.disconnect();
+					detached = true;
+					driver?.invalidate();
+				},
+				catch: failure
+			}).pipe(Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.fail(failure())
+			}))
+		};
 	}, Effect.withTracerEnabled(false)) };
 }));
+/** One binding implementation serves scoped tools and host-managed protected handoffs. */
+const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedTransport)(Effect.gen(function* () {
+	const binding = yield* BrowserRunProtectedBinding;
+	return { open: (policy) => binding.open(policy).pipe(Effect.map((session) => session.driver)) };
+})).pipe(Layer.provideMerge(protectedBindingLayer(options)));
+//#endregion
+//#region src/protected-browser/host.ts
+/** Host-only receipt. Store atomically with the controller lease; never return it to a model. */
+var BrowserRunProtectedCheckpoint = class extends Schema.Class("BrowserRunProtectedCheckpoint")({
+	...ProtectedProviderIdentity.fields,
+	protected: ProtectedBrowserCheckpoint,
+	handoffId: Schema.optionalKey(Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(1024))))
+}) {};
+/**
+* Host authority for one protected page. The consumer owns durable generation fencing, authorized
+* human recipients, checkpoint integrity, vault exposure metadata, and expiry cleanup. Resume only
+* the latest committed suspended receipt; it never replays browser mutations or creates a page.
+* Hosted passes require Unrestricted network policy: attachment-local request interception
+* cannot enforce an ExactHosts policy during detachment. Current credential grants still apply.
+* Provider inactivity/session deadlines still apply while the host is detached.
+*/
+var BrowserRunProtectedHost = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedHost") {};
+const failure = (reason) => new ProtectedBrowserError({
+	reason,
+	dispatch: "not-dispatched",
+	milestone: "none",
+	observation: "protected",
+	cleanup: "not-requested"
+});
+const Handoff = Schema.Struct({ handoffId: Schema.NonEmptyString.check(Schema.isMaxLength(1024)) });
+const HandoffState = Schema.Struct({
+	active: Schema.Boolean,
+	handoffId: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(1024))),
+	durationMs: Schema.optionalKey(Schema.Natural)
+});
+const LiveView = Schema.Struct({ devtoolsFrontendUrl: Schema.String });
+/** Compose with browserRunProtectedBindingLayer and BrowserRunSessionLifecycle. */
+const browserRunProtectedHostLayer = () => Layer.effect(BrowserRunProtectedHost)(Effect.gen(function* () {
+	const binding = yield* BrowserRunProtectedBinding;
+	const lifecycle = yield* BrowserRunSessionLifecycle;
+	const crypto = yield* Crypto.Crypto;
+	const open = Effect.fn("BrowserRunProtectedHost.open")(function* (input, checkpoint) {
+		const policy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => failure("denied")));
+		if (policy.network._tag !== "Unrestricted") return yield* failure("unsupported");
+		if (policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - (checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis))) <= 0 || checkpoint !== void 0 && checkpoint.protected.startedAt > (yield* Clock.currentTimeMillis)) return yield* failure("timeout");
+		if (checkpoint !== void 0 && checkpoint.protected.actions > policy.maxActions) return yield* failure("denied");
+		const provider = yield* binding.open(policy, checkpoint);
+		const state = yield* makeProtectedBrowserPolicy(policy, checkpoint?.protected).pipe(Effect.provideService(BrowserRunProtectedTransport, { open: () => Effect.succeed({
+			...provider.driver,
+			detach: provider.detach
+		}) }), Effect.provideService(Crypto.Crypto, crypto));
+		const lock = yield* Semaphore.make(1);
+		let handoff = checkpoint;
+		let detached = false;
+		const control = (effect) => lock.withPermitsIfAvailable(1)(Effect.suspend(() => detached ? Effect.fail(failure("closed")) : effect)).pipe(Effect.flatMap(Effect.fromOption(() => failure("busy"))));
+		const fits = (millis) => Effect.gen(function* () {
+			const started = handoff?.protected.startedAt ?? startedAt;
+			if (millis > policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started)) return yield* failure("timeout");
+		});
+		const startedAt = checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis);
+		const getHandoffState = Effect.gen(function* () {
+			if (handoff?.handoffId === void 0) return yield* failure("denied");
+			yield* fits(0);
+			const raw = yield* provider.command("Cloudflare.getHandoffState", {});
+			const result = yield* Schema.decodeUnknownEffect(HandoffState)(raw).pipe(Effect.mapError(() => failure("provider")));
+			if (result.active && result.handoffId === void 0 || result.handoffId !== void 0 && result.handoffId !== Redacted.value(handoff.handoffId)) return yield* failure("denied");
+			return BrowserRunHandoffState.make({
+				active: result.active,
+				...result.durationMs === void 0 ? {} : { durationMs: result.durationMs },
+				...result.handoffId === void 0 ? {} : { handoffId: Redacted.make(result.handoffId) }
+			});
+		});
+		return {
+			handle: state.handle,
+			sessionId: provider.identity.sessionId,
+			suspend: control(Effect.gen(function* () {
+				if (handoff !== void 0) {
+					yield* state.suspend();
+					return handoff;
+				}
+				const suspended = yield* state.suspend();
+				handoff = BrowserRunProtectedCheckpoint.make({
+					...provider.identity,
+					protected: suspended
+				});
+				return handoff;
+			})),
+			handoff: (request) => control(Effect.gen(function* () {
+				if (handoff?.handoffId !== void 0) return yield* failure("busy");
+				const decoded = yield* Schema.decodeEffect(BrowserRunHandoffRequest)(request).pipe(Effect.mapError(() => failure("denied")));
+				yield* fits(decoded.timeout);
+				const suspended = yield* state.suspend(true);
+				const result = yield* provider.command("Cloudflare.handoff", {
+					instructions: decoded.instructions,
+					timeout: decoded.timeout
+				}).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Handoff)), Effect.catch(() => state.handle.close.pipe(Effect.flatMap((cleanup) => Effect.fail(new ProtectedBrowserError({
+					reason: "outcome-unknown",
+					dispatch: "possibly-dispatched",
+					milestone: suspended.milestone,
+					observation: "closed",
+					cleanup
+				}))))), Effect.onInterrupt(() => state.handle.close));
+				handoff = BrowserRunProtectedCheckpoint.make({
+					...provider.identity,
+					protected: suspended,
+					handoffId: Redacted.make(result.handoffId)
+				});
+				return handoff;
+			})),
+			getLiveView: (request) => control(Effect.gen(function* () {
+				if (handoff?.handoffId === void 0) return yield* failure("denied");
+				const decoded = yield* Schema.decodeEffect(BrowserRunLiveViewRequest)(request).pipe(Effect.mapError(() => failure("denied")));
+				yield* fits(decoded.expiresInMs);
+				const raw = yield* provider.command("Cloudflare.getLiveView", {
+					mode: decoded.mode,
+					expiresInMs: decoded.expiresInMs
+				});
+				const result = yield* Schema.decodeUnknownEffect(LiveView)(raw).pipe(Effect.mapError(() => failure("provider")));
+				return yield* Schema.decodeEffect(BrowserRunLiveViewResult)({ devtoolsFrontendUrl: Redacted.make(result.devtoolsFrontendUrl) }).pipe(Effect.mapError(() => failure("provider")));
+			})),
+			getHandoffState: control(getHandoffState),
+			returnControl: control(Effect.gen(function* () {
+				if ((yield* getHandoffState).active) return yield* failure("busy");
+				yield* state.returnControl;
+				handoff = void 0;
+			})),
+			detach: control(Effect.gen(function* () {
+				if (handoff === void 0) return yield* failure("denied");
+				yield* state.detach;
+				detached = true;
+			})),
+			close: state.handle.close
+		};
+	}, Effect.withTracerEnabled(false));
+	return {
+		open: (policy) => open(policy),
+		resume: (checkpoint) => Schema.decodeEffect(BrowserRunProtectedCheckpoint)(checkpoint).pipe(Effect.mapError(() => failure("denied")), Effect.flatMap((decoded) => open(decoded.protected.policy, decoded))),
+		closeSession: (id) => lifecycle.close(id).pipe(Effect.as("confirmed"), Effect.catchCause(() => Effect.succeed("unconfirmed")))
+	};
+}));
 //#endregion
-export { browserRunProtectedBindingLayer, browserRunProtectedLayer };
+export { BrowserRunProtectedCheckpoint, BrowserRunProtectedHost, browserRunProtectedBindingLayer, browserRunProtectedHostLayer, browserRunProtectedLayer };
 
 //# sourceMappingURL=ProtectedBrowser.mjs.map