@effect-agent/platform-cloudflare 0.1.0-beta.9 → 0.1.0-beta.90

package/dist/ProtectedBrowser.mjs

@@ -0,0 +1,1135 @@
+import { h as BrowserRunSessionLifecycle, o as BrowserRunLiveViewRequest, r as BrowserRunHandoffState, s as BrowserRunLiveViewResult, t as BrowserRunHandoffRequest } from "./InteractiveBrowser-DupDtfw2.mjs";
+import { Clock, Context, Crypto, Effect, Layer, Redacted, Schema, Semaphore } from "effect";
+import puppeteer from "@cloudflare/puppeteer";
+import { InteractiveBrowserPolicy } from "effect-agent/interactive-browser";
+import { BrowserCredentialAccess, CardCredential, CredentialObservationDecision, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserCheckpoint, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, UseCredential } from "effect-agent/protected-browser";
+//#region src/protected-browser/policy.ts
+var ProtectedTransportError = class extends Schema.TaggedError()("ProtectedTransportError", { reason: Schema.Literals([
+	"stale-reference",
+	"needs-attention",
+	"unsupported",
+	"provider"
+]) }) {};
+/** Per-write evidence authority, provided by the policy immediately around a transport fill. */
+var ProtectedBrowserDispatch = class extends Context.Service()("@effect-agent/platform-cloudflare/ProtectedBrowserDispatch") {};
+/** Adapter-private injection seam for deterministic tests, not a model capability. */
+var BrowserRunProtectedTransport = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedTransport") {};
+const ProtectedPageContext = Schema.Struct({
+	document: Schema.String.check(Schema.isUUID()),
+	topOrigin: CredentialOrigin,
+	frameOrigins: Schema.Array(CredentialOrigin).check(Schema.isMaxLength(16))
+});
+const ProtectedDiscovery = Schema.Struct({
+	...ProtectedPageContext.fields,
+	text: Schema.String.check(Schema.isMaxLength(65536)),
+	controls: Schema.Array(ProtectedBrowserControl).check(Schema.isMaxLength(64)),
+	truncated: Schema.Boolean
+});
+const sameTarget = (a, b) => a.topOrigin === b.topOrigin && a.frameOrigin === b.frameOrigin && a.recipientOrigin === b.recipientOrigin && a.document === b.document && a.frame === b.frame && a.form === b.form;
+const kindFor = (role) => role === "username" || role === "password" ? "login" : role.startsWith("card-") ? "card" : void 0;
+const secretFor = (material, role) => {
+	if (material._tag === "LoginCredential") return role === "username" ? material.username : role === "password" ? material.password : void 0;
+	switch (role) {
+		case "card-name": return material.name;
+		case "card-number": return material.number;
+		case "card-expiry": return material.expiry;
+		case "card-expiry-month": return material.expiryMonth;
+		case "card-expiry-year": return material.expiryYear;
+		case "card-security-code": return material.securityCode;
+		case "username":
+		case "password": return;
+	}
+};
+/** Shared protected policy implementation for ephemeral and host-owned passes. */
+const makeProtectedBrowserPolicy = Effect.fn("ProtectedBrowser.open")(function* (input, checkpoint) {
+	const initialError = (reason) => new ProtectedBrowserError({
+		reason,
+		dispatch: "not-dispatched",
+		milestone: "none",
+		observation: "closed",
+		cleanup: "not-requested"
+	});
+	const decodedPolicy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => initialError("denied")));
+	if (decodedPolicy.network._tag === "PublicWeb") return yield* initialError("unsupported");
+	const policy = InteractiveBrowserPolicy.make({
+		...decodedPolicy,
+		network: decodedPolicy.network._tag === "ExactHosts" ? {
+			_tag: "ExactHosts",
+			allowedHosts: [...decodedPolicy.network.allowedHosts]
+		} : { _tag: "Unrestricted" }
+	});
+	const access = yield* BrowserCredentialAccess;
+	const restored = checkpoint === void 0 ? void 0 : yield* Schema.decodeEffect(ProtectedBrowserCheckpoint)(checkpoint).pipe(Effect.mapError(() => initialError("denied")));
+	const now = yield* Clock.currentTimeMillis;
+	if (restored !== void 0 && (restored.startedAt > now || restored.actions > policy.maxActions || now - restored.startedAt >= policy.maxElapsedMillis)) return yield* initialError("timeout");
+	const started = restored?.startedAt ?? now;
+	const driver = yield* (yield* BrowserRunProtectedTransport).open(policy);
+	const crypto = yield* Crypto.Crypto;
+	let suspended = restored !== void 0;
+	let detached = false;
+	let needsObservation = restored !== void 0;
+	let humanExposure = restored?.humanExposure ?? false;
+	let humanOrigins = [...restored?.humanOrigins ?? []];
+	const lock = yield* Semaphore.make(1);
+	let observation = "before-exposure";
+	let cleanup = "not-requested";
+	let actions = restored?.actions ?? 0;
+	let dispatch = restored?.dispatch ?? "not-dispatched";
+	let milestone = restored?.milestone ?? "none";
+	const exposures = [...restored?.exposures ?? []];
+	const offers = /* @__PURE__ */ new Map();
+	const fail = (reason) => new ProtectedBrowserError({
+		reason,
+		dispatch,
+		milestone,
+		observation,
+		cleanup
+	});
+	const close = yield* Effect.cached(Effect.uninterruptible(Effect.gen(function* () {
+		observation = "closed";
+		offers.clear();
+		driver.invalidate();
+		cleanup = yield* driver.close.pipe(Effect.interruptible, Effect.timeoutOrElse({
+			duration: "10 seconds",
+			orElse: () => Effect.succeed("unconfirmed")
+		}), Effect.catchCause(() => Effect.succeed("unconfirmed")));
+		return cleanup;
+	})));
+	yield* Effect.addFinalizer(() => detached ? Effect.void : close.pipe(Effect.flatMap((result) => result === "unconfirmed" ? Effect.logWarning("Protected browser exact-session closure unconfirmed") : Effect.void)));
+	const remote = (effect) => effect.pipe(Effect.mapError((error) => fail(error.reason)));
+	const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => fail("provider")));
+	const caller = access.caller.pipe(Effect.mapError((error) => fail(error.reason)));
+	const pageContext = remote(driver.context);
+	const permitObservation = Effect.gen(function* () {
+		const context = yield* pageContext;
+		let origins;
+		if (exposures.length > 0 || humanExposure) {
+			observation = "protected";
+			const principal = yield* caller;
+			const rawDecision = yield* access.observation({
+				...context,
+				caller: principal,
+				exposures: [...exposures],
+				humanExposure,
+				humanOrigins
+			}).pipe(Effect.mapError((error) => fail(error.reason)));
+			if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+			const decision = yield* Schema.decodeEffect(CredentialObservationDecision)(rawDecision).pipe(Effect.mapError(() => fail("observation-blocked")));
+			if (decision === "deny") return yield* fail("observation-blocked");
+			if (typeof decision !== "string") {
+				origins = [...decision.origins];
+				if (!origins.includes(context.topOrigin)) return yield* fail("observation-blocked");
+			}
+			observation = "approved-after-exposure";
+		}
+		yield* remote(driver.restrictObservation(origins));
+		return {
+			...context,
+			frameOrigins: context.frameOrigins.filter((origin) => origins === void 0 || origins.includes(origin))
+		};
+	});
+	const target = (ref) => remote(driver.target(ref));
+	const authorizeAction = Effect.fn("ProtectedBrowser.authorizeAction")(function* (action) {
+		if (access.authorizeAction === void 0) {
+			if (action._tag === "Submit") return yield* fail("unsupported");
+			return;
+		}
+		const principal = yield* caller;
+		yield* access.authorizeAction({
+			caller: principal,
+			action,
+			exposures: [...exposures]
+		}).pipe(Effect.mapError((error) => fail(error.reason)));
+		if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+		if (action._tag !== "Navigate") {
+			const current = yield* target(action.ref);
+			if (!sameTarget(current.target, action.target) || current.role !== (action._tag === "Submit" ? "submit" : action.role) || action._tag === "Click" && action.role === "link" && current.url !== action.url) return yield* fail("stale-reference");
+		}
+	}, Effect.withTracerEnabled(false));
+	const bounded = (result) => {
+		return new TextEncoder().encode(JSON.stringify(result)).byteLength <= policy.maxReturnedBytes ? Effect.succeed(result) : Effect.fail(fail("limit"));
+	};
+	const run = (effect, observing = false) => lock.withPermitsIfAvailable(1)(Effect.gen(function* () {
+		if (suspended || detached) return yield* fail("busy");
+		if (needsObservation && !observing) return yield* fail("stale-reference");
+		dispatch = "not-dispatched";
+		milestone = "none";
+		if (observation === "closed") return yield* fail("closed");
+		if (++actions > policy.maxActions) return yield* fail("limit");
+		const remaining = policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started);
+		if (remaining <= 0) {
+			yield* close;
+			return yield* fail("timeout");
+		}
+		return yield* effect.pipe(Effect.timeoutOrElse({
+			duration: remaining,
+			orElse: () => Effect.fail(fail("timeout"))
+		}), Effect.catchCause((cause) => Effect.gen(function* () {
+			const error = cause.reasons.find((reason) => reason._tag === "Fail" && Schema.is(ProtectedBrowserError)(reason.error));
+			const reason = error?._tag === "Fail" && Schema.is(ProtectedBrowserError)(error.error) ? error.error.reason : "provider";
+			const interrupt = cause.reasons.some((reason) => reason._tag === "Interrupt");
+			if (dispatch !== "not-dispatched" || interrupt || reason === "provider" || reason === "timeout") yield* close;
+			if (interrupt) return yield* Effect.interrupt;
+			return yield* fail(dispatch === "possibly-dispatched" && reason === "provider" ? "outcome-unknown" : reason);
+		})), Effect.onInterrupt(() => close), Effect.withTracerEnabled(false));
+	})).pipe(Effect.flatMap(Effect.fromOption(() => new ProtectedBrowserError({
+		reason: "busy",
+		dispatch: "not-dispatched",
+		milestone: "none",
+		observation,
+		cleanup
+	}))));
+	const handle = {
+		close: Effect.suspend(() => detached ? Effect.succeed("not-requested") : close),
+		navigate: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserNavigate)(request).pipe(Effect.mapError(() => fail("denied")));
+			let url;
+			try {
+				url = new URL(decoded.url);
+			} catch {
+				return yield* fail("denied");
+			}
+			if (url.protocol !== "https:" || url.username || url.password || policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) return yield* fail("denied");
+			if (exposures.length > 0 || humanExposure) yield* permitObservation;
+			yield* authorizeAction({
+				_tag: "Navigate",
+				url: decoded.url
+			});
+			offers.clear();
+			dispatch = "possibly-dispatched";
+			yield* remote(driver.navigate(decoded.url));
+			dispatch = "dispatched";
+			yield* permitObservation;
+		})),
+		observe: run(Effect.gen(function* () {
+			const before = yield* permitObservation;
+			const result = yield* remote(driver.discover);
+			const after = yield* permitObservation;
+			if (before.document !== after.document || result.document !== after.document || result.topOrigin !== after.topOrigin) return yield* fail("stale-reference");
+			if (result.frameOrigins.some((origin) => !after.frameOrigins.includes(origin))) return yield* fail("observation-blocked");
+			const observation = yield* bounded(ProtectedBrowserObservation.make({
+				...result,
+				observation: exposures.length > 0 || humanExposure ? "approved-after-exposure" : "before-exposure"
+			}));
+			needsObservation = false;
+			return observation;
+		}), true),
+		click: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserClick)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.ref);
+			if (control.role !== "link" && control.role !== "button" && control.role !== "radio" && control.role !== "checkbox" && control.role !== "submit") return yield* fail("unsupported");
+			let action;
+			if (control.role === "link") {
+				if (control.url === void 0) return yield* fail("unsupported");
+				action = {
+					_tag: "Click",
+					ref: decoded.ref,
+					target: control.target,
+					role: "link",
+					url: control.url
+				};
+			} else if (control.role === "submit") action = {
+				_tag: "Submit",
+				ref: decoded.ref,
+				target: control.target
+			};
+			else action = {
+				_tag: "Click",
+				ref: decoded.ref,
+				target: control.target,
+				role: control.role
+			};
+			yield* authorizeAction(action);
+			dispatch = "possibly-dispatched";
+			yield* remote(driver.click(decoded.ref)).pipe(Effect.catch((error) => {
+				if (error.reason === "needs-attention") dispatch = "not-dispatched";
+				return Effect.fail(error);
+			}));
+			dispatch = "dispatched";
+			if (control.role === "submit") milestone = "submission-dispatched";
+			yield* permitObservation;
+		})),
+		fill: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ProtectedBrowserFill)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.ref);
+			if (control.role !== "text" && control.role !== "select") return yield* fail("unsupported");
+			yield* authorizeAction({
+				_tag: "Fill",
+				ref: decoded.ref,
+				target: control.target,
+				role: control.role
+			});
+			yield* remote(driver.fill(decoded.ref, control.role, Redacted.make(decoded.value))).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+				dispatch = "possibly-dispatched";
+			}) }));
+			dispatch = "dispatched";
+			milestone = "filled";
+			yield* permitObservation;
+		})),
+		listCredentialOffers: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(ListCredentialOffers)(request).pipe(Effect.mapError(() => fail("denied")));
+			yield* permitObservation;
+			const control = yield* target(decoded.target);
+			if (kindFor(control.role) !== decoded.kind) return yield* fail("unsupported");
+			const principal = yield* caller;
+			const candidates = yield* access.list({
+				caller: principal,
+				kind: decoded.kind,
+				target: control.target
+			}).pipe(Effect.mapError((error) => fail(error.reason)));
+			const now = yield* Clock.currentTimeMillis;
+			for (const [ref, offer] of offers) if (offer.expires <= now) offers.delete(ref);
+			if (candidates.length > 16 || offers.size + candidates.length > 64) return yield* fail("limit");
+			if (!sameTarget(control.target, (yield* target(decoded.target)).target)) return yield* fail("stale-reference");
+			const expires = now + 6e4;
+			const result = [];
+			const pending = /* @__PURE__ */ new Map();
+			for (const candidate of candidates) {
+				const metadata = yield* decode(CredentialOfferMetadata, candidate.metadata);
+				const ref = yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => fail("provider")));
+				pending.set(ref, {
+					caller: principal,
+					key: candidate.key,
+					target: control.target,
+					targetRef: decoded.target,
+					kind: decoded.kind,
+					expires
+				});
+				result.push(CredentialOffer.make({
+					ref,
+					kind: decoded.kind,
+					metadata
+				}));
+			}
+			yield* bounded(result);
+			for (const [ref, offer] of pending) offers.set(ref, offer);
+			return result;
+		})),
+		useCredential: (request) => run(Effect.gen(function* () {
+			const decoded = yield* Schema.decodeEffect(UseCredential)(request).pipe(Effect.mapError(() => fail("denied")));
+			const offer = offers.get(decoded.offer);
+			if (offer === void 0 || offer.expires <= (yield* Clock.currentTimeMillis)) return yield* fail("stale-reference");
+			const principal = yield* caller;
+			if (Redacted.value(principal) !== Redacted.value(offer.caller)) return yield* fail("denied");
+			if (new Set(decoded.fields.map((field) => field.ref)).size !== decoded.fields.length || new Set(decoded.fields.map((field) => field.role)).size !== decoded.fields.length) return yield* fail("denied");
+			const validate = Effect.gen(function* () {
+				if (!sameTarget(offer.target, (yield* target(offer.targetRef)).target)) return yield* fail("stale-reference");
+				for (const field of decoded.fields) {
+					const current = yield* target(field.ref);
+					if (field.role !== current.role || kindFor(field.role) !== offer.kind || !sameTarget(offer.target, current.target)) return yield* fail("denied");
+				}
+				if (decoded.submit !== void 0) {
+					const submit = yield* target(decoded.submit);
+					if (submit.role !== "submit" || !sameTarget(offer.target, submit.target)) return yield* fail("denied");
+				}
+			});
+			yield* validate;
+			const authorization = {
+				caller: principal,
+				key: offer.key,
+				kind: offer.kind,
+				target: offer.target,
+				roles: decoded.fields.map((field) => field.role),
+				submit: decoded.submit !== void 0
+			};
+			const authorize = Effect.gen(function* () {
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+				yield* access.authorize(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+				if (Redacted.value(yield* caller) !== Redacted.value(principal)) return yield* fail("denied");
+			});
+			yield* authorize;
+			yield* validate;
+			const raw = yield* access.resolve(authorization).pipe(Effect.mapError((error) => fail(error.reason)));
+			const material = yield* Schema.decodeEffect(offer.kind === "login" ? LoginCredential : CardCredential)(raw).pipe(Effect.mapError(() => fail("resolver")));
+			for (const field of decoded.fields) if (secretFor(material, field.role) === void 0) return yield* fail("missing-credential");
+			offers.delete(decoded.offer);
+			for (const field of decoded.fields) {
+				yield* validate;
+				yield* authorize;
+				const value = secretFor(material, field.role);
+				if (value === void 0) return yield* fail("missing-credential");
+				observation = "protected";
+				yield* remote(driver.fill(field.ref, field.role, value)).pipe(Effect.provideService(ProtectedBrowserDispatch, { mark: Effect.sync(() => {
+					dispatch = "possibly-dispatched";
+					if (!exposures.some((target) => sameTarget(target, offer.target))) exposures.push(offer.target);
+				}) }));
+				dispatch = "dispatched";
+				milestone = "partial-fill";
+			}
+			milestone = "filled";
+			if (decoded.submit !== void 0) {
+				yield* validate;
+				yield* authorize;
+				const ref = decoded.submit;
+				dispatch = "possibly-dispatched";
+				yield* remote(driver.click(ref)).pipe(Effect.catch((error) => {
+					if (error.reason === "needs-attention") dispatch = "dispatched";
+					return Effect.fail(error);
+				}));
+				dispatch = "dispatched";
+				milestone = "submission-dispatched";
+			}
+			yield* permitObservation;
+			return CredentialUseResult.make({
+				dispatch,
+				milestone,
+				observation,
+				cleanup,
+				authentication: "unverified"
+			});
+		}))
+	};
+	const locked = (effect) => lock.withPermitsIfAvailable(1)(effect).pipe(Effect.flatMap(Effect.fromOption(() => fail("busy"))));
+	return {
+		handle,
+		suspend: (human = false) => locked(Effect.gen(function* () {
+			if (detached || observation === "closed") return yield* fail("closed");
+			if (dispatch === "possibly-dispatched") return yield* fail("outcome-unknown");
+			if ((yield* Clock.currentTimeMillis) - started >= policy.maxElapsedMillis) return yield* fail("timeout");
+			suspended = true;
+			if (human) {
+				const context = yield* pageContext;
+				const origins = yield* Schema.decodeEffect(ProtectedBrowserCheckpoint.fields.humanOrigins)([.../* @__PURE__ */ new Set([
+					...humanOrigins,
+					context.topOrigin,
+					...context.frameOrigins
+				])]).pipe(Effect.catch(() => fail("needs-attention")));
+				humanExposure = true;
+				humanOrigins = [...origins];
+				observation = "protected";
+			}
+			driver.resetReferences();
+			offers.clear();
+			return ProtectedBrowserCheckpoint.make({
+				policy,
+				startedAt: started,
+				actions,
+				exposures: [...exposures],
+				humanExposure,
+				humanOrigins,
+				dispatch,
+				milestone
+			});
+		})),
+		returnControl: locked(Effect.gen(function* () {
+			if (detached || observation === "closed") return yield* fail("closed");
+			if (!suspended) return yield* fail("denied");
+			yield* permitObservation;
+			offers.clear();
+			driver.resetReferences();
+			needsObservation = true;
+			suspended = false;
+		})),
+		detach: locked(Effect.gen(function* () {
+			if (!suspended || observation === "closed") return yield* fail("denied");
+			if (driver.detach === void 0) return yield* fail("unsupported");
+			yield* driver.detach.pipe(Effect.onError(() => close), Effect.onInterrupt(() => close));
+			detached = true;
+			offers.clear();
+			driver.invalidate();
+		}))
+	};
+}, Effect.withTracerEnabled(false));
+/** Fresh private passes; scoped release confirms exact-session termination. */
+const browserRunProtectedLayer = () => Layer.effect(ProtectedBrowser)(Effect.gen(function* () {
+	const transport = yield* BrowserRunProtectedTransport;
+	const crypto = yield* Crypto.Crypto;
+	return { open: (policy) => makeProtectedBrowserPolicy(policy).pipe(Effect.map((session) => session.handle), Effect.provideService(BrowserRunProtectedTransport, transport), Effect.provideService(Crypto.Crypto, crypto)) };
+}));
+//#endregion
+//#region src/protected-browser/inspect-frame.ts
+const maxAttributeLength = 2048;
+const inspectFrame = `(() => {
+  const doc = document;
+  const forms = [];
+  const isChoice = el => el instanceof HTMLInputElement && ['radio','checkbox'].includes(el.type);
+  const presented = el => {
+    if (el.closest('[hidden],[aria-hidden="true"],[inert]') ||
+      ['hidden','collapse'].includes(getComputedStyle(el).visibility)) return false;
+    for (let parent = el; parent; parent = parent.parentElement) {
+      if (getComputedStyle(parent).opacity === '0') return false;
+    }
+    return true;
+  };
+  const hasLayout = el => presented(el) &&
+    [...el.getClientRects()].some(rect => rect.width > 0 && rect.height > 0);
+  const available = el => el.type !== 'hidden' && !el.closest('[hidden],[aria-hidden="true"],[inert]') &&
+    (hasLayout(el) || (isChoice(el) && [...(el.labels ?? [])].some(hasLayout)));
+  const elements = [...doc.querySelectorAll('input,textarea,select,button,a[href]')].filter(available).slice(0, 65);
+  const labelText = el => {
+    const label = el.labels?.[0]?.cloneNode(true);
+    label?.querySelectorAll('input,textarea,select,script,style,noscript').forEach(child => child.remove());
+    return label?.textContent ?? el.getAttribute('aria-label');
+  };
+  const describe = (el) => {
+    if (doc !== document || !el.isConnected || el.ownerDocument !== doc || !available(el)) return null;
+    const form = el.form ?? null;
+    let formIndex = forms.indexOf(form);
+    if (formIndex < 0) { formIndex = forms.length; forms.push(form); }
+    // Resolved href (including path/query/fragment and base-URL changes) is part of the fingerprint.
+    const action = el instanceof HTMLAnchorElement ? el.href : form ? (el.hasAttribute('formaction') ? el.formAction : form.action || doc.URL) : doc.URL;
+    const method = form ? (el.hasAttribute('formmethod') ? el.formMethod : form.method) : '';
+    const enctype = form?.enctype ?? '';
+    const name = el.name ?? '';
+    const completion = el.getAttribute('autocomplete') ?? '';
+    const inputType = el.type ?? '';
+    const choiceValue = isChoice(el) ? el.value : '';
+    // Reject before parsing, fingerprinting or CDP transfer. Truncation could hide a target change.
+    if ([action, method, enctype, name, completion, inputType, choiceValue].some(value => value.length > ${maxAttributeLength})) return null;
+    const type = inputType.toLowerCase();
+    const autocomplete = completion.trim().toLowerCase().split(/\\s+/).at(-1);
+    const cardRoles = { 'cc-name':'card-name', 'cc-number':'card-number', 'cc-exp':'card-expiry',
+      'cc-exp-month':'card-expiry-month', 'cc-exp-year':'card-expiry-year', 'cc-csc':'card-security-code' };
+    let role = 'unsupported';
+    const nativeField = el instanceof HTMLInputElement || el instanceof HTMLSelectElement || el instanceof HTMLTextAreaElement;
+    if (nativeField && !['submit','button'].includes(type) && !el.matches(':disabled') && !el.readOnly && !(el instanceof HTMLSelectElement && el.multiple)) {
+      if (isChoice(el)) role = type;
+      else if (type === 'password' || ['current-password','new-password','one-time-code'].includes(autocomplete)) {
+        if (type === 'password' && form) role = 'password';
+      } else if (['text','email','tel','number','month','search','url','date','time','week','datetime-local','textarea',''].includes(type) || el instanceof HTMLSelectElement) {
+        if (cardRoles[autocomplete]) { if (form) role = cardRoles[autocomplete]; }
+        else if (autocomplete === 'username' || autocomplete === 'email') { if (form) role = 'username'; }
+        else if (['text','email'].includes(type) && form && form.querySelector('input[type="password"]')) role = 'username';
+        else if (el instanceof HTMLSelectElement) { if (!el.multiple) role = 'select'; }
+        else role = 'text';
+      }
+    } else if (el instanceof HTMLButtonElement || (el instanceof HTMLInputElement && ['submit','button'].includes(type))) {
+      if (!el.matches(':disabled')) role = type === 'submit' && form ? 'submit' : type === 'button' ? 'button' : 'unsupported';
+    } else if (el instanceof HTMLAnchorElement) role = 'link';
+    const fingerprint = JSON.stringify([role, action, method, enctype, name, completion, type, choiceValue]);
+    return { role, formIndex, action, fingerprint, ...(isChoice(el) ? {checked: el.checked} : {}),
+      label: (labelText(el) ?? (nativeField ? '' : el.textContent) ?? '').slice(0,200) };
+  };
+  const expose = ({role, formIndex, action, label, checked}) =>
+    ({role, formIndex, action, label, ...(checked === undefined ? {} : {checked})});
+  const original = elements.map(describe);
+  const validate = (index) => {
+    const current = describe(elements[index]);
+    if (!current || !original[index] || current.fingerprint !== original[index].fingerprint ||
+      current.formIndex !== original[index].formIndex) return null;
+    return expose(current);
+  };
+  return {
+    doc, elements, original: original.map(current => current && expose(current)), validate,
+    text: () => {
+      if (doc !== document) return null;
+      if (!doc.body) return '';
+      const walker = doc.createTreeWalker(doc.body, NodeFilter.SHOW_TEXT);
+      const range = doc.createRange();
+      let text = '';
+      for (let node = walker.nextNode(); node && text.length < 65536; node = walker.nextNode()) {
+        const parent = node.parentElement;
+        if (!parent || parent.closest('input,textarea,select,script,style,noscript,iframe,object,embed')) continue;
+        if (!presented(parent)) continue;
+        range.selectNodeContents(node);
+        if (![...range.getClientRects()].some(rect => rect.width > 0 && rect.height > 0)) continue;
+        text += (node.textContent ?? '').replace(/\\s+/g, ' ') + ' ';
+      }
+      return text.slice(0,65536);
+    },
+    fill: (index, role, value) => {
+      const current = validate(index);
+      if (!current || current.role !== role) return false;
+      const el = elements[index];
+      if (role === 'select') {
+        const options = [...el.options].filter(option => !option.matches(':disabled'));
+        const values = options.filter(option => option.value === value);
+        const matches = values.length > 0 ? values : options.filter(option => option.textContent?.trim() === value);
+        if (matches.length !== 1) return 'unsupported';
+        value = matches[0].value;
+        if ([...el.options].filter(option => option.value === value).length !== 1) return 'unsupported';
+      }
+      let prototype = Object.getPrototypeOf(el);
+      let setter;
+      while (prototype && !setter) { setter = Object.getOwnPropertyDescriptor(prototype,'value')?.set; prototype = Object.getPrototypeOf(prototype); }
+      if (!setter) return false;
+      // Validate and mutate in one isolated-world task, without focusing first and running
+      // page handlers between validation and assignment. Native setters support controlled inputs.
+      setter.call(el, value);
+      if (el.value !== value) return 'unsupported';
+      el.dispatchEvent(new Event('input', {bubbles:true}));
+      el.dispatchEvent(new Event('change', {bubbles:true}));
+      return true;
+    },
+    click: (index) => {
+      const current = validate(index);
+      if (!current || !['button','submit','link','radio','checkbox'].includes(current.role)) return false;
+      if (current.role === 'submit' && elements[index].form && !elements[index].form.matches(':valid')) return 'needs-attention';
+      elements[index].click();
+      return true;
+    }
+  };
+})()`;
+//#endregion
+//#region src/protected-browser/native.ts
+const Description = Schema.Struct({
+	role: ProtectedBrowserControl.fields.role,
+	formIndex: Schema.Natural,
+	action: Schema.String.check(Schema.isMaxLength(maxAttributeLength)),
+	label: Schema.String.check(Schema.isMaxLength(200)),
+	checked: Schema.optionalKey(Schema.Boolean)
+});
+const Descriptions = Schema.Array(Schema.NullOr(Description)).check(Schema.isMaxLength(65));
+/** One host-private acquired session. The SDK handles and exact-session cleanup have one owner. */
+var ProtectedNativeSession = class extends Context.Service()("@effect-agent/platform-cloudflare/ProtectedNativeSession") {};
+const transportError = (reason) => new ProtectedTransportError({ reason });
+const decode = (schema, value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => transportError("provider")));
+const remote = (run) => Effect.tryPromise({
+	try: async (signal) => {
+		try {
+			return {
+				ok: true,
+				value: await run(signal)
+			};
+		} catch {
+			return { ok: false };
+		}
+	},
+	catch: () => transportError("provider")
+}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(transportError("provider"))));
+/** Host-private scoped transport. Session capabilities are requirements; policy is per-pass data. */
+const makeProtectedNativeTransport = Effect.fn("ProtectedNativeTransport.make")(function* (policy) {
+	const session = yield* ProtectedNativeSession;
+	const { browser, page } = session;
+	const crypto = yield* Crypto.Crypto;
+	const clock = yield* Clock.Clock;
+	const uuid = crypto.randomUUIDv4.pipe(Effect.mapError(() => transportError("provider")));
+	let closed = false;
+	let violation = false;
+	let documentRef;
+	let observationOrigins;
+	const frames = /* @__PURE__ */ new Map();
+	const controls = /* @__PURE__ */ new Map();
+	const origin = (value) => Effect.try({
+		try: () => {
+			const url = new URL(value);
+			if (url.username || url.password) throw transportError("stale-reference");
+			if (!Schema.is(CredentialOrigin)(url.origin)) throw transportError("unsupported");
+			if (policy.network._tag === "ExactHosts" && !policy.network.allowedHosts.includes(url.host)) throw transportError("stale-reference");
+			return url.origin;
+		},
+		catch: (cause) => Schema.is(ProtectedTransportError)(cause) ? cause : transportError("provider")
+	});
+	const check = Effect.suspend(() => closed || violation || !browser.isConnected() ? Effect.fail(transportError("stale-reference")) : Effect.void);
+	const clear = () => {
+		controls.clear();
+		documentRef = void 0;
+	};
+	const onNavigated = () => {
+		clear();
+	};
+	const onTarget = (target) => {
+		if (target.type() !== "page") return;
+		violation = true;
+		clear();
+	};
+	const invalidate = () => {
+		closed = true;
+		clear();
+	};
+	const observationFrames = Effect.gen(function* () {
+		const list = page.frames();
+		if (list.length > 32) return yield* transportError("unsupported");
+		return yield* Effect.filter(list, (frame) => frame === page.mainFrame() ? Effect.succeed(true) : Effect.try({
+			try: () => frame.url() !== "" && new URL(frame.url()).protocol === "https:",
+			catch: () => transportError("provider")
+		}));
+	});
+	const context = Effect.gen(function* () {
+		yield* check;
+		const list = yield* observationFrames;
+		const topOrigin = yield* origin(page.url());
+		const frameOrigins = [...new Set(yield* Effect.forEach(list, (frame) => origin(frame.url())))];
+		if (frameOrigins.length > 16) return yield* transportError("unsupported");
+		if (documentRef === void 0) documentRef = yield* uuid;
+		return yield* decode(ProtectedPageContext, {
+			document: documentRef,
+			topOrigin,
+			frameOrigins
+		});
+	});
+	const isCurrent = Effect.fn("ProtectedNativeTransport.isCurrent")(function* (state) {
+		if (state.frame.detached) return false;
+		return yield* remote(() => state.handle.evaluate((held) => {
+			if (typeof held !== "object" || held === null) return false;
+			return Reflect.get(held, "doc") === Reflect.get(globalThis, "document");
+		}));
+	});
+	const get = Effect.fn("ProtectedNativeTransport.get")(function* (ref) {
+		yield* check;
+		const state = controls.get(ref);
+		if (!state || observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin) || state.expires <= (yield* clock.currentTimeMillis) || !(yield* isCurrent(state.frame))) return yield* transportError("stale-reference");
+		const current = yield* remote(() => state.frame.handle.evaluate((held, index) => {
+			if (typeof held !== "object" || held === null) return null;
+			return Reflect.apply(Reflect.get(held, "validate"), held, [index]);
+		}, state.index));
+		const description = yield* decode(Schema.NullOr(Description), current);
+		if (description === null) return yield* transportError("stale-reference");
+		if ((yield* context).topOrigin !== state.control.target.topOrigin || (yield* origin(state.frame.frame.url())) !== state.control.target.frameOrigin || (yield* origin(description.action)) !== state.control.target.recipientOrigin || description.role !== state.control.role) return yield* transportError("stale-reference");
+		return state;
+	});
+	const close = yield* Effect.cached(Effect.gen(function* () {
+		invalidate();
+		return yield* session.close;
+	}).pipe(Effect.ensuring(Effect.sync(() => {
+		page.off("framenavigated", onNavigated);
+		page.off("framedetached", onNavigated);
+		browser.off("targetcreated", onTarget);
+		frames.clear();
+	}))));
+	yield* Effect.acquireRelease(Effect.sync(() => {
+		page.on("framenavigated", onNavigated);
+		page.on("framedetached", onNavigated);
+		browser.on("targetcreated", onTarget);
+	}), () => session.release === void 0 ? close : session.release.pipe(Effect.ensuring(Effect.sync(() => {
+		invalidate();
+		page.off("framenavigated", onNavigated);
+		page.off("framedetached", onNavigated);
+		browser.off("targetcreated", onTarget);
+		frames.clear();
+	}))));
+	return {
+		restrictObservation: Effect.fn("ProtectedNativeTransport.restrictObservation")(function* (origins) {
+			yield* check;
+			observationOrigins = origins === void 0 ? void 0 : new Set(yield* decode(Schema.Array(CredentialOrigin), origins));
+			for (const [ref, state] of controls) if (observationOrigins !== void 0 && !observationOrigins.has(state.control.target.frameOrigin)) controls.delete(ref);
+		}),
+		context,
+		invalidate,
+		resetReferences: clear,
+		close,
+		navigate: Effect.fn("ProtectedNativeTransport.navigate")(function* (url) {
+			yield* check;
+			yield* origin(url);
+			clear();
+			yield* remote(() => page.goto(url, { waitUntil: "load" }));
+			yield* context;
+		}),
+		target: (ref) => get(ref).pipe(Effect.map((state) => state.control)),
+		discover: Effect.gen(function* () {
+			const before = yield* context;
+			controls.clear();
+			for (const state of frames.values()) yield* remote(() => state.handle.dispose());
+			frames.clear();
+			const discovered = [];
+			let text = "";
+			let truncated = false;
+			const frameOrigins = /* @__PURE__ */ new Set();
+			for (const frame of yield* observationFrames) {
+				const frameOrigin = yield* origin(frame.url());
+				if (observationOrigins !== void 0 && !observationOrigins.has(frameOrigin)) continue;
+				frameOrigins.add(frameOrigin);
+				if (typeof frame.isolatedRealm !== "function") return yield* transportError("unsupported");
+				const handle = yield* remote(() => frame.isolatedRealm().evaluateHandle(inspectFrame));
+				const state = {
+					frame,
+					handle,
+					ref: yield* uuid,
+					document: yield* uuid,
+					forms: /* @__PURE__ */ new Map()
+				};
+				frames.set(frame, state);
+				const raw = yield* remote(() => handle.evaluate((held) => {
+					if (typeof held !== "object" || held === null) return null;
+					return Reflect.get(held, "original");
+				}));
+				const descriptions = yield* decode(Descriptions, raw);
+				for (let index = 0; index < descriptions.length; index++) {
+					const desc = descriptions[index];
+					if (!desc) continue;
+					if (discovered.length === 64) {
+						truncated = true;
+						break;
+					}
+					let form = state.forms.get(desc.formIndex);
+					if (form === void 0) {
+						form = yield* uuid;
+						state.forms.set(desc.formIndex, form);
+					}
+					const recipient = yield* origin(desc.action).pipe(Effect.result);
+					if (recipient._tag === "Failure") continue;
+					const control = ProtectedBrowserControl.make({
+						ref: yield* uuid,
+						role: desc.role,
+						label: desc.label,
+						...desc.checked === void 0 ? {} : { checked: desc.checked },
+						...desc.role === "link" ? { url: desc.action } : {},
+						target: CredentialTarget.make({
+							topOrigin: before.topOrigin,
+							frameOrigin: yield* origin(frame.url()),
+							recipientOrigin: recipient.success,
+							document: state.document,
+							frame: state.ref,
+							form
+						})
+					});
+					controls.set(control.ref, {
+						frame: state,
+						index,
+						control,
+						expires: (yield* clock.currentTimeMillis) + 6e4
+					});
+					discovered.push(control);
+				}
+				const rawText = yield* remote(() => handle.evaluate((held) => {
+					if (typeof held !== "object" || held === null) return null;
+					return Reflect.apply(Reflect.get(held, "text"), held, []);
+				}));
+				text += yield* decode(Schema.String.check(Schema.isMaxLength(65536)), rawText);
+				if (text.length > 65536) {
+					text = text.slice(0, 65536);
+					truncated = true;
+				}
+			}
+			if ((yield* context).document !== before.document) return yield* transportError("stale-reference");
+			return yield* decode(ProtectedDiscovery, {
+				...before,
+				frameOrigins: [...frameOrigins],
+				text,
+				controls: discovered,
+				truncated
+			});
+		}),
+		fill: Effect.fn("ProtectedNativeTransport.fill")(function* (ref, role, value) {
+			const dispatch = yield* ProtectedBrowserDispatch;
+			const state = yield* get(ref);
+			yield* dispatch.mark;
+			const filled = yield* remote(() => state.frame.handle.evaluate((held, index, expectedRole, secret) => {
+				if (typeof held !== "object" || held === null) return false;
+				return Reflect.apply(Reflect.get(held, "fill"), held, [
+					index,
+					expectedRole,
+					secret
+				]);
+			}, state.index, role, Redacted.value(value)));
+			if (filled === "unsupported") return yield* transportError("unsupported");
+			if (filled !== true) return yield* transportError("stale-reference");
+		}),
+		click: Effect.fn("ProtectedNativeTransport.click")(function* (ref) {
+			const state = yield* get(ref);
+			const clicked = yield* remote(() => state.frame.handle.evaluate((held, index) => {
+				if (typeof held !== "object" || held === null) return false;
+				return Reflect.apply(Reflect.get(held, "click"), held, [index]);
+			}, state.index));
+			if (clicked === "needs-attention") return yield* transportError("needs-attention");
+			if (clicked !== true) return yield* transportError("stale-reference");
+		})
+	};
+}, Effect.withTracerEnabled(false));
+//#endregion
+//#region src/protected-browser/binding.ts
+/** Host-private exact page identity; never include it in model-visible results. */
+const ProtectedProviderIdentity = Schema.Struct({
+	sessionId: Schema.Redacted(Schema.String.check(Schema.isUUID())),
+	contextId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+	targetId: Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(256)))
+});
+var BrowserRunProtectedBinding = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedBinding") {};
+/**
+* Acquires through BROWSER with recording=false explicitly on the wire. The trusted provider's
+* documented opt-in semantics are the recording guarantee; no recording-status API exists.
+* Account operators remain trusted, and must not attach external observers to private passes.
+*/
+const protectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedBinding)(Effect.gen(function* () {
+	const lifecycle = yield* BrowserRunSessionLifecycle;
+	const crypto = yield* Crypto.Crypto;
+	return { open: Effect.fn("BrowserRunProtectedTransport.open")(function* (policy, identity) {
+		const failure = () => new ProtectedBrowserError({
+			reason: "provider",
+			dispatch: "not-dispatched",
+			milestone: "none",
+			observation: "closed",
+			cleanup: "unconfirmed"
+		});
+		let sessionId = identity?.sessionId;
+		let detached = false;
+		let control;
+		let providerIdentity;
+		let browser;
+		let driver;
+		let invalid = false;
+		const runCleanup = Effect.runPromiseWith(Context.make(Clock.Clock, yield* Clock.Clock));
+		const terminate = Effect.gen(function* () {
+			invalid = true;
+			driver?.invalidate();
+			if (sessionId === void 0) return "unconfirmed";
+			const cleanup = yield* lifecycle.close(sessionId).pipe(Effect.as("confirmed"), Effect.catchCause(() => Effect.succeed("unconfirmed")), Effect.interruptible, Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.succeed("unconfirmed")
+			}));
+			const connected = browser;
+			if (connected !== void 0) yield* Effect.promise(() => connected.disconnect()).pipe(Effect.catchCause(() => Effect.void), Effect.interruptible, Effect.timeoutOrElse({
+				duration: "1 second",
+				orElse: () => Effect.void
+			}));
+			return cleanup;
+		});
+		const close = yield* Effect.cached(terminate);
+		yield* Effect.addFinalizer(() => detached ? Effect.void : close.pipe(Effect.flatMap((state) => state === "confirmed" ? Effect.void : Effect.logWarning("Protected browser exact-session closure unconfirmed"))));
+		const acquired = yield* Effect.tryPromise({
+			try: async (signal) => {
+				let recordingDisabled = false;
+				const acquired = identity === void 0 ? await puppeteer.acquire({ fetch: async (input, init) => {
+					const request = new Request(input, init);
+					const url = new URL(request.url);
+					if (url.pathname === "/v1/devtools/browser" && request.method === "POST") {
+						url.searchParams.set("recording", "false");
+						recordingDisabled = url.searchParams.get("recording") === "false";
+						return options.browser.fetch(new Request(url, request));
+					}
+					return options.browser.fetch(request);
+				} }, {
+					recording: false,
+					keep_alive: Math.min(6e5, Math.max(1e4, policy.maxElapsedMillis))
+				}) : { sessionId: Redacted.value(identity.sessionId) };
+				sessionId = Redacted.make(Schema.decodeSync(Schema.String.check(Schema.isUUID()))(acquired.sessionId));
+				if (identity === void 0 && !recordingDisabled || signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				browser = await puppeteer.connect(options.browser, acquired.sessionId);
+				if (signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				let page;
+				if (identity === void 0) page = await (await browser.createBrowserContext()).newPage();
+				else {
+					const context = browser.browserContexts().find((candidate) => candidate.id === Redacted.value(identity.contextId));
+					if (context === void 0) throw new ProtectedTransportError({ reason: "stale-reference" });
+					const pages = await context.pages();
+					let found;
+					for (const candidate of pages) {
+						const client = await candidate.createCDPSession();
+						const info = await client.send("Target.getTargetInfo");
+						await client.detach();
+						if (info.targetInfo.targetId === Redacted.value(identity.targetId)) found = candidate;
+					}
+					if (found === void 0 || pages.length !== 1) throw new ProtectedTransportError({ reason: "stale-reference" });
+					page = found;
+				}
+				control = await page.createCDPSession();
+				const info = await control.send("Target.getTargetInfo");
+				providerIdentity = Schema.decodeSync(ProtectedProviderIdentity)({
+					sessionId,
+					contextId: Redacted.make(page.browserContext().id ?? ""),
+					targetId: Redacted.make(info.targetInfo.targetId)
+				});
+				await page.setBypassServiceWorker(true);
+				await page.setRequestInterception(true);
+				page.on("request", (request) => {
+					let allowed = policy.network._tag === "Unrestricted";
+					try {
+						const url = new URL(request.url());
+						allowed ||= policy.network._tag === "ExactHosts" && url.protocol === "https:" && !url.username && !url.password && policy.network.allowedHosts.includes(url.host);
+					} catch {}
+					(allowed && !invalid ? request.continue() : request.abort("blockedbyclient")).catch(() => {
+						invalid = true;
+						driver?.invalidate();
+					});
+				});
+				if (signal.aborted || invalid) {
+					await runCleanup(terminate);
+					throw new ProtectedTransportError({ reason: "stale-reference" });
+				}
+				return ProtectedNativeSession.of({
+					browser,
+					page,
+					close,
+					release: Effect.suspend(() => detached ? Effect.void : close.pipe(Effect.asVoid))
+				});
+			},
+			catch: failure
+		}).pipe(Effect.timeoutOrElse({
+			duration: Math.min(policy.maxElapsedMillis, 3e4),
+			orElse: () => Effect.fail(new ProtectedBrowserError({
+				...failure(),
+				reason: "timeout"
+			}))
+		}), Effect.catch((error) => close.pipe(Effect.flatMap((cleanup) => Effect.fail(new ProtectedBrowserError({
+			...error,
+			cleanup
+		}))))));
+		driver = yield* makeProtectedNativeTransport(policy).pipe(Effect.provideService(ProtectedNativeSession, acquired), Effect.provideService(Crypto.Crypto, crypto));
+		const exact = providerIdentity;
+		if (exact === void 0) return yield* failure();
+		return {
+			identity: exact,
+			driver,
+			command: (method, parameters) => Effect.tryPromise({
+				try: async () => {
+					if (invalid || detached || control === void 0) throw void 0;
+					const send = Reflect.get(control, "send");
+					return await Reflect.apply(send, control, [method, parameters]);
+				},
+				catch: failure
+			}).pipe(Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.fail(failure())
+			})),
+			detach: Effect.tryPromise({
+				try: async () => {
+					if (invalid || detached || browser === void 0) throw void 0;
+					await browser.disconnect();
+					detached = true;
+					driver?.invalidate();
+				},
+				catch: failure
+			}).pipe(Effect.timeoutOrElse({
+				duration: "10 seconds",
+				orElse: () => Effect.fail(failure())
+			}))
+		};
+	}, Effect.withTracerEnabled(false)) };
+}));
+/** One binding implementation serves scoped tools and host-managed protected handoffs. */
+const browserRunProtectedBindingLayer = (options) => Layer.effect(BrowserRunProtectedTransport)(Effect.gen(function* () {
+	const binding = yield* BrowserRunProtectedBinding;
+	return { open: (policy) => binding.open(policy).pipe(Effect.map((session) => session.driver)) };
+})).pipe(Layer.provideMerge(protectedBindingLayer(options)));
+//#endregion
+//#region src/protected-browser/host.ts
+/** Host-only receipt. Store atomically with the controller lease; never return it to a model. */
+var BrowserRunProtectedCheckpoint = class extends Schema.Class("BrowserRunProtectedCheckpoint")({
+	...ProtectedProviderIdentity.fields,
+	protected: ProtectedBrowserCheckpoint,
+	handoffId: Schema.optionalKey(Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(1024))))
+}) {};
+/**
+* Host authority for one protected page. The consumer owns durable generation fencing, authorized
+* human recipients, checkpoint integrity, vault exposure metadata, and expiry cleanup. Resume only
+* the latest committed suspended receipt; it never replays browser mutations or creates a page.
+* Hosted passes require Unrestricted network policy: attachment-local request interception
+* cannot enforce an ExactHosts policy during detachment. Current credential grants still apply.
+* Provider inactivity/session deadlines still apply while the host is detached.
+*/
+var BrowserRunProtectedHost = class extends Context.Service()("@effect-agent/platform-cloudflare/BrowserRunProtectedHost") {};
+const failure = (reason) => new ProtectedBrowserError({
+	reason,
+	dispatch: "not-dispatched",
+	milestone: "none",
+	observation: "protected",
+	cleanup: "not-requested"
+});
+const Handoff = Schema.Struct({ handoffId: Schema.NonEmptyString.check(Schema.isMaxLength(1024)) });
+const HandoffState = Schema.Struct({
+	active: Schema.Boolean,
+	handoffId: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(1024))),
+	durationMs: Schema.optionalKey(Schema.Natural)
+});
+const LiveView = Schema.Struct({ devtoolsFrontendUrl: Schema.String });
+/** Compose with browserRunProtectedBindingLayer and BrowserRunSessionLifecycle. */
+const browserRunProtectedHostLayer = () => Layer.effect(BrowserRunProtectedHost)(Effect.gen(function* () {
+	const binding = yield* BrowserRunProtectedBinding;
+	const lifecycle = yield* BrowserRunSessionLifecycle;
+	const crypto = yield* Crypto.Crypto;
+	const open = Effect.fn("BrowserRunProtectedHost.open")(function* (input, checkpoint) {
+		const policy = yield* Schema.decodeEffect(InteractiveBrowserPolicy)(input).pipe(Effect.mapError(() => failure("denied")));
+		if (policy.network._tag !== "Unrestricted") return yield* failure("unsupported");
+		if (policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - (checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis))) <= 0 || checkpoint !== void 0 && checkpoint.protected.startedAt > (yield* Clock.currentTimeMillis)) return yield* failure("timeout");
+		if (checkpoint !== void 0 && checkpoint.protected.actions > policy.maxActions) return yield* failure("denied");
+		const provider = yield* binding.open(policy, checkpoint);
+		const state = yield* makeProtectedBrowserPolicy(policy, checkpoint?.protected).pipe(Effect.provideService(BrowserRunProtectedTransport, { open: () => Effect.succeed({
+			...provider.driver,
+			detach: provider.detach
+		}) }), Effect.provideService(Crypto.Crypto, crypto));
+		const lock = yield* Semaphore.make(1);
+		let handoff = checkpoint;
+		let detached = false;
+		const control = (effect) => lock.withPermitsIfAvailable(1)(Effect.suspend(() => detached ? Effect.fail(failure("closed")) : effect)).pipe(Effect.flatMap(Effect.fromOption(() => failure("busy"))));
+		const fits = (millis) => Effect.gen(function* () {
+			const started = handoff?.protected.startedAt ?? startedAt;
+			if (millis > policy.maxElapsedMillis - ((yield* Clock.currentTimeMillis) - started)) return yield* failure("timeout");
+		});
+		const startedAt = checkpoint?.protected.startedAt ?? (yield* Clock.currentTimeMillis);
+		const getHandoffState = Effect.gen(function* () {
+			if (handoff?.handoffId === void 0) return yield* failure("denied");
+			yield* fits(0);
+			const raw = yield* provider.command("Cloudflare.getHandoffState", {});
+			const result = yield* Schema.decodeUnknownEffect(HandoffState)(raw).pipe(Effect.mapError(() => failure("provider")));
+			if (result.active && result.handoffId === void 0 || result.handoffId !== void 0 && result.handoffId !== Redacted.value(handoff.handoffId)) return yield* failure("denied");
+			return BrowserRunHandoffState.make({
+				active: result.active,
+				...result.durationMs === void 0 ? {} : { durationMs: result.durationMs },
+				...result.handoffId === void 0 ? {} : { handoffId: Redacted.make(result.handoffId) }
+			});
+		});
+		return {
+			handle: state.handle,
+			sessionId: provider.identity.sessionId,
+			suspend: control(Effect.gen(function* () {
+				if (handoff !== void 0) {
+					yield* state.suspend();
+					return handoff;
+				}
+				const suspended = yield* state.suspend();
+				handoff = BrowserRunProtectedCheckpoint.make({
+					...provider.identity,
+					protected: suspended
+				});
+				return handoff;
+			})),
+			handoff: (request) => control(Effect.gen(function* () {
+				if (handoff?.handoffId !== void 0) return yield* failure("busy");
+				const decoded = yield* Schema.decodeEffect(BrowserRunHandoffRequest)(request).pipe(Effect.mapError(() => failure("denied")));
+				yield* fits(decoded.timeout);
+				const suspended = yield* state.suspend(true);
+				const result = yield* provider.command("Cloudflare.handoff", {
+					instructions: decoded.instructions,
+					timeout: decoded.timeout
+				}).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Handoff)), Effect.catch(() => state.handle.close.pipe(Effect.flatMap((cleanup) => Effect.fail(new ProtectedBrowserError({
+					reason: "outcome-unknown",
+					dispatch: "possibly-dispatched",
+					milestone: suspended.milestone,
+					observation: "closed",
+					cleanup
+				}))))), Effect.onInterrupt(() => state.handle.close));
+				handoff = BrowserRunProtectedCheckpoint.make({
+					...provider.identity,
+					protected: suspended,
+					handoffId: Redacted.make(result.handoffId)
+				});
+				return handoff;
+			})),
+			getLiveView: (request) => control(Effect.gen(function* () {
+				if (handoff?.handoffId === void 0) return yield* failure("denied");
+				const decoded = yield* Schema.decodeEffect(BrowserRunLiveViewRequest)(request).pipe(Effect.mapError(() => failure("denied")));
+				yield* fits(decoded.expiresInMs);
+				const raw = yield* provider.command("Cloudflare.getLiveView", {
+					mode: decoded.mode,
+					expiresInMs: decoded.expiresInMs
+				});
+				const result = yield* Schema.decodeUnknownEffect(LiveView)(raw).pipe(Effect.mapError(() => failure("provider")));
+				return yield* Schema.decodeEffect(BrowserRunLiveViewResult)({ devtoolsFrontendUrl: Redacted.make(result.devtoolsFrontendUrl) }).pipe(Effect.mapError(() => failure("provider")));
+			})),
+			getHandoffState: control(getHandoffState),
+			getReturnOrigin: control(Effect.gen(function* () {
+				if ((yield* getHandoffState).active) return yield* failure("busy");
+				const context = yield* provider.driver.context.pipe(Effect.mapError((error) => failure(error.reason)));
+				return yield* Schema.decodeEffect(CredentialOrigin)(context.topOrigin).pipe(Effect.mapError(() => failure("provider")));
+			})),
+			returnControl: control(Effect.gen(function* () {
+				if ((yield* getHandoffState).active) return yield* failure("busy");
+				yield* state.returnControl;
+				handoff = void 0;
+			})),
+			detach: control(Effect.gen(function* () {
+				if (handoff === void 0) return yield* failure("denied");
+				yield* state.detach;
+				detached = true;
+			})),
+			close: state.handle.close
+		};
+	}, Effect.withTracerEnabled(false));
+	return {
+		open: (policy) => open(policy),
+		resume: (checkpoint) => Schema.decodeEffect(BrowserRunProtectedCheckpoint)(checkpoint).pipe(Effect.mapError(() => failure("denied")), Effect.flatMap((decoded) => open(decoded.protected.policy, decoded))),
+		closeSession: (id) => lifecycle.close(id).pipe(Effect.as("confirmed"), Effect.catchCause(() => Effect.succeed("unconfirmed")))
+	};
+}));
+//#endregion
+export { BrowserRunProtectedCheckpoint, BrowserRunProtectedHost, browserRunProtectedBindingLayer, browserRunProtectedHostLayer, browserRunProtectedLayer };
+
+//# sourceMappingURL=ProtectedBrowser.mjs.map