@webhands/core 0.1.0 → 0.3.0

package/README.md

@@ -0,0 +1,177 @@
+# webhands
+
+A CLI (built with [`incur`](https://github.com/wevm/incur), so it doubles as an
+MCP server) that drives a real, persistent browser via Playwright, letting an
+agent or human control any website from a genuinely logged-in browser session on
+their own machine and IP.
+
+It launches (or attaches to) a Chromium browser using a dedicated profile,
+supports a one-time headed login that is later reused headless, keeps the session
+alive across separate CLI invocations behind a long-lived `serve` process, and
+exposes page verbs (`goto`, `snapshot`, `click`, `type`, `eval`, `wait`,
+`cookies`) with structured output.
+
+## Use it via your AI agent (start here)
+
+The simplest way to use `webhands` is to let your coding agent (Claude Code,
+Cursor, etc.) run it through plain `bash` with `npx`. No MCP wiring, no install
+step — the agent just runs `npx webhands <verb>` commands. The first run of
+`npx webhands` fetches the package automatically.
+
+Give your agent something like: *"Use `webhands` to open Kayak and read me the
+live prices for EDI→BOM on 31 Oct."* A capable agent will then:
+
+```sh
+# 1. start & HOLD the browser. serve blocks, so the agent backgrounds it:
+nohup npx webhands serve --headed > /tmp/webhands.log 2>&1 &
+sleep 12 && cat /tmp/webhands.log     # confirm it printed an endpoint + pid
+
+# 2. navigate the live page (separate invocation, same browser):
+npx webhands goto 'https://www.kayak.co.uk/flights/EDI-BOM/2026-10-31?sort=price_a'
+
+# 3. let JS results render, then read the page token-cheaply:
+npx webhands wait --ms 8000
+npx webhands snapshot --token-limit 6000
+
+# 4. always tear down when done:
+npx webhands stop
+```
+
+Three things a new user should know up front:
+
+- **You log in once, in a window you can see.** Run `npx webhands setup-profile`
+  (or start with `serve --headed`) and sign in / clear any cookie or anti-bot
+  prompt yourself. That state is saved to a dedicated profile and reused on later
+  runs. The tool never bypasses logins or solves CAPTCHAs — you do that part.
+- **It acts as the real, logged-in you.** Reading pages is low-risk; let the agent
+  do that freely. But anything that spends money, books, posts, or changes account
+  state should be YOUR explicit decision — have the agent surface the link and let
+  you finish checkout. (See *Scope and honesty* below.)
+- **Anti-bot sites may need the visible window.** Headless runs can hit a
+  "you look like a bot" page on sites like Kayak. The fix is to run `--headed` and
+  clear the challenge yourself once, not to defeat it.
+
+For the full agent playbook (workflow, gotchas, guardrails) install the bundled
+skill: `npx webhands skills add` then look for `use-webhands`. Per-verb flag
+reference: `npx webhands <verb> --help` or `npx webhands --llms-full`.
+
+## How it works (the pipe)
+
+The browser is owned by ONE long-lived `serve` process; each verb invocation is a
+thin client that drives the SAME live page and exits (see
+[`docs/adr/0005`](docs/adr/0005-incur-serve-hosts-the-long-lived-session.md)). The
+typical end-to-end flow:
+
+1. `webhands setup-profile`: opens the dedicated profile in a
+   VISIBLE browser so you log in / clear any anti-bot challenge ONCE. State
+   (cookies, login, challenge clearance) persists on disk.
+2. `webhands serve --headless`: launches the one browser against
+   that saved profile and keeps it alive (runs until `stop` or Ctrl-C).
+3. `webhands goto <url>` then `webhands snapshot` (and
+   `click` / `type` / `eval` / `wait`): separate invocations that all drive the
+   single live page the server holds.
+4. `webhands stop`: tears the session down.
+
+A verb run with no live server prints a clear error telling you to run `serve`
+first; the tool never silently spawns a browser.
+
+## Scope and honesty (please read)
+
+This is a **personal-use** tool. Its whole premise is that you drive a browser
+**you logged into yourself**, on **your own machine and your own IP**, reusing
+**your own authenticated session** (see
+[`docs/adr/0002`](docs/adr/0002-real-session-over-fingerprint-spoofing.md)). It is
+deliberately local and single-session by design.
+
+- **No login-bypass, no CAPTCHA-solving.** The human does the one-time login and
+  clears any anti-bot challenge in the headed `setup-profile` step. This tool
+  does NOT bypass authentication or solve CAPTCHAs programmatically, and it is not
+  intended to.
+- **No fingerprint-spoofing / anti-detect tricks.** It leans on being a *real*
+  browser/profile/IP rather than spoofing. There is no proxy rotation or
+  anti-detect build here.
+- **Your own session only.** A replayed/stolen cookie does not work anyway
+  (clearance is bound to the browser fingerprint and IP, not just the cookie);
+  the design assumes the session is genuinely yours.
+
+In short: this is for reading and acting on web apps **you already have an account
+on**, from **your own browser**, the way you could by hand.
+
+## Optional: stealth launch (opt-in, default OFF)
+
+Standard Playwright drives Chromium over CDP and calls `Runtime.enable` at
+startup. That emits a side-effect a few lines of page JS can detect, and some
+anti-bot WAFs (Imperva/Cloudflare/DataDome) use it to serve an "Access Denied"
+block page *before the page even renders* — even on a real residential IP, even
+headed. `@webhands/core` can optionally launch via
+[Patchright](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright) (an
+API-compatible Playwright fork that patches exactly these CDP leaks) to remove
+that one tell.
+
+This is **off by default** — vanilla Playwright stays the default. To enable it:
+
+1. Install the optional dependency (it is NOT pulled in unless you ask for it):
+
+   ```sh
+   pnpm add patchright
+   # if you do NOT pass --use-system-browser chrome, also fetch its browser:
+   #   pnpm exec patchright install chromium
+   ```
+
+2. Bring the session up with `--stealth`. The realistic recipe also drives your
+   installed system browser (`--use-system-browser chrome`), headed, against a
+   **warmed, logged-in profile**:
+
+   ```sh
+   # serve consumes these (it is where the browser is launched, ADR-0005):
+   npx webhands serve --headed --stealth --use-system-browser chrome
+   ```
+
+   `--use-system-browser` is independent of `--stealth`: you can drive real
+   Chrome with or without the Patchright path, and stealth with or without a
+   system browser. Other channel names work too (e.g. `msedge`).
+
+Programmatic equivalent (the `--stealth` / `--use-system-browser` flags map onto
+these transport options):
+
+```ts
+import {PlaywrightLaunchTransport} from '@webhands/core';
+
+const transport = new PlaywrightLaunchTransport(
+  {}, // profile location (omit for ~/.webhands)
+  [], // extra hands
+  {stealth: true, systemBrowser: 'chrome'},
+);
+// Stealth + headed + a real logged-in profile is the strongest recipe:
+const session = await transport.open({
+  mode: 'launch',
+  profile: 'default',
+  headed: true,
+});
+```
+
+If stealth is enabled but `patchright` is not installed, the open throws a typed
+`MissingStealthDependencyError` (the CLI prints `pnpm add patchright` as the fix).
+It **never silently falls back** to vanilla Playwright, because that would put
+the tell back without telling you.
+
+**Honest caveat.** Stealth addresses ONLY the CDP `Runtime.enable` automation
+tell. It is **necessary-but-not-sufficient**: IP reputation and session/profile
+reputation still matter. The realistic recipe is stealth +
+`systemBrowser: 'chrome'` + headed + a warmed, logged-in profile + a residential
+IP (see
+[`docs/adr/0002`](docs/adr/0002-real-session-over-fingerprint-spoofing.md)).
+
+## Security note (the `serve` endpoint runs arbitrary code)
+
+The page verbs execute caller-supplied expressions: `eval` runs a JS expression
+in the page, and a `click`/`type` locator is a raw Playwright locator EXPRESSION
+the controller evaluates (see
+[`docs/adr/0004`](docs/adr/0004-verb-surface-exposes-playwright-locator-semantics.md)).
+That is by design for a LOCAL tool driven by its own agent against your own
+session, but it means the running `serve` endpoint is a code-execution surface.
+
+- **Do NOT expose the `serve` endpoint to untrusted callers.** Keep it bound to
+  localhost (the default); never bind it to a public interface or hand its URL to
+  code you do not trust. Anyone who can call it can run arbitrary JavaScript in
+  your logged-in session.

package/dist/cookies-export.d.ts

@@ -2,8 +2,8 @@
  * The `cookies export` / `cookies import` verb's FILE FORMAT (PRD story 11).
  *
  * The seam already carries the transport-neutral cookie primitives:
- * {@link Page.cookies} reads the active context's cookies and
- * {@link Page.setCookies} loads cookies into it. The export/import VERB is built
+ * {@link WebHandsPage.cookies} reads the active context's cookies and
+ * {@link WebHandsPage.setCookies} loads cookies into it. The export/import VERB is built
  * ON TOP of those two methods (the forward-note: refine the existing seam,
  * do NOT add a parallel cookie path). What this module adds is only the
  * SERIALIZATION the verb needs to move a session to/from disk: how a
@@ -31,11 +31,11 @@ export declare const COOKIES_EXPORT_VERSION: 1;
 export interface CookiesExport {
     /** Format version (see {@link COOKIES_EXPORT_VERSION}). */
     readonly version: typeof COOKIES_EXPORT_VERSION;
-    /** The exported cookies, exactly as the seam's {@link Page.cookies} returns them. */
+    /** The exported cookies, exactly as the seam's {@link WebHandsPage.cookies} returns them. */
     readonly cookies: readonly Cookie[];
 }
 /**
- * Serialize the cookies read from the seam ({@link Page.cookies}) into the
+ * Serialize the cookies read from the seam ({@link WebHandsPage.cookies}) into the
  * export file's text. Pretty-printed JSON so a human can read/diff a backed-up
  * session. This is pure: it does NO disk I/O, so the caller (the CLI verb, a
  * test) owns WHERE the file lands — which is what lets a test keep its export
@@ -44,7 +44,7 @@ export interface CookiesExport {
 export declare function serializeCookies(cookies: readonly Cookie[]): string;
 /**
  * Parse an export file's text back into the cookies to hand to the seam's
- * {@link Page.setCookies} ({@link parse} is pure; the caller does the disk read
+ * {@link WebHandsPage.setCookies} ({@link parse} is pure; the caller does the disk read
  * and the `setCookies` call). Rejects anything that is not a recognised export
  * envelope so a corrupt or wrong-version file surfaces as a clear error rather
  * than silently importing nothing or a half-parsed list.

package/dist/cookies-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies-export.d.ts","sourceRoot":"","sources":["../src/cookies-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,WAAW,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,sBAAsB,CAAC;IAChD,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAyBlE"}
+{"version":3,"file":"cookies-export.d.ts","sourceRoot":"","sources":["../src/cookies-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,WAAW,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,sBAAsB,CAAC;IAChD,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAyBlE"}

package/dist/cookies-export.js

@@ -2,8 +2,8 @@
  * The `cookies export` / `cookies import` verb's FILE FORMAT (PRD story 11).
  *
  * The seam already carries the transport-neutral cookie primitives:
- * {@link Page.cookies} reads the active context's cookies and
- * {@link Page.setCookies} loads cookies into it. The export/import VERB is built
+ * {@link WebHandsPage.cookies} reads the active context's cookies and
+ * {@link WebHandsPage.setCookies} loads cookies into it. The export/import VERB is built
  * ON TOP of those two methods (the forward-note: refine the existing seam,
  * do NOT add a parallel cookie path). What this module adds is only the
  * SERIALIZATION the verb needs to move a session to/from disk: how a
@@ -23,7 +23,7 @@
  */
 export const COOKIES_EXPORT_VERSION = 1;
 /**
- * Serialize the cookies read from the seam ({@link Page.cookies}) into the
+ * Serialize the cookies read from the seam ({@link WebHandsPage.cookies}) into the
  * export file's text. Pretty-printed JSON so a human can read/diff a backed-up
  * session. This is pure: it does NO disk I/O, so the caller (the CLI verb, a
  * test) owns WHERE the file lands — which is what lets a test keep its export
@@ -38,7 +38,7 @@ export function serializeCookies(cookies) {
 }
 /**
  * Parse an export file's text back into the cookies to hand to the seam's
- * {@link Page.setCookies} ({@link parse} is pure; the caller does the disk read
+ * {@link WebHandsPage.setCookies} ({@link parse} is pure; the caller does the disk read
  * and the `setCookies` call). Rejects anything that is not a recognised export
  * envelope so a corrupt or wrong-version file surfaces as a clear error rather
  * than silently importing nothing or a half-parsed list.

package/dist/errors.d.ts

@@ -15,7 +15,7 @@
  * has to re-derive paths.
  */
 /** The closed set of identifiable `core` error conditions. */
-export type ControllerErrorCode = 'missing-browser-binary' | 'missing-profile' | 'attach-not-chromium' | 'attach-no-context' | 'no-live-server' | 'session-already-active';
+export type ControllerErrorCode = 'missing-browser-binary' | 'missing-stealth-dependency' | 'missing-profile' | 'attach-not-chromium' | 'attach-no-context' | 'no-live-server' | 'session-already-active';
 /**
  * Base class for every identifiable `core` error. Branch on {@link code}.
  *
@@ -45,6 +45,29 @@ export declare class MissingBrowserBinaryError extends ControllerError {
         cause?: unknown;
     });
 }
+/**
+ * Stealth launch was REQUESTED (the opt-in is on) but the optional `patchright`
+ * dependency is not installed/importable. Patchright is an OPTIONAL dependency
+ * of `@webhands/core` imported lazily only when stealth is enabled, so a user
+ * who never opts in is not forced to install it (ADR-0002: stealth is one extra
+ * layer, not the default). When it IS opted into and missing, we refuse LOUDLY
+ * with this typed condition rather than silently falling back to vanilla
+ * Playwright, because a silent fallback would re-introduce the exact CDP
+ * automation tell the user asked us to remove WITHOUT telling them.
+ *
+ * Mirrors {@link MissingBrowserBinaryError}: a stable typed error whose brittle
+ * detection (the dynamic-import failure) is confined to one spot in the launch
+ * transport. The CLI can render the exact `pnpm add patchright` fix command by
+ * branching on {@link code}.
+ */
+export declare class MissingStealthDependencyError extends ControllerError {
+    readonly code = "missing-stealth-dependency";
+    /** The optional package that must be installed to use stealth. */
+    readonly dependency: string;
+    constructor(dependency?: string, message?: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * The named profile has not been set up yet: its dedicated profile directory
  * does not exist on disk. A profile is created by the headed `setup-profile`

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,mBAAmB,GAC5B,wBAAwB,GACxB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,gBAAgB,GAChB,wBAAwB,CAAC;AAE5B;;;;;;GAMG;AACH,8BAAsB,eAAgB,SAAQ,KAAK;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAC5C,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAG,IAAI,CAAU;gBAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAMxD;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,IAAI,4BAA4B;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAGxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAA0D,EACnE,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,eAAe;IACvD,QAAQ,CAAC,IAAI,qBAAqB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAG3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAA0F,EACnG,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAM5B;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IAC1D,QAAQ,CAAC,IAAI,yBAAyB;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAGxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAuJ,EAChK,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;IACxD,QAAQ,CAAC,IAAI,uBAAuB;IACpC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAGzB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAA+H,EACxI,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACrD,QAAQ,CAAC,IAAI,oBAAoB;gBAGhC,OAAO,GAAE,MAAoF,EAC7F,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,IAAI,4BAA4B;gBAGxC,OAAO,GAAE,MAAmE,EAC5E,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,mBAAmB,GAC5B,wBAAwB,GACxB,4BAA4B,GAC5B,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,gBAAgB,GAChB,wBAAwB,CAAC;AAE5B;;;;;;GAMG;AACH,8BAAsB,eAAgB,SAAQ,KAAK;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAC5C,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAG,IAAI,CAAU;gBAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAMxD;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,IAAI,4BAA4B;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAGxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAA0D,EACnE,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,6BAA8B,SAAQ,eAAe;IACjE,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAG3B,UAAU,SAAe,EACzB,OAAO,GAAE,MAA+Q,EACxR,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,eAAe;IACvD,QAAQ,CAAC,IAAI,qBAAqB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAG3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAA0F,EACnG,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAM5B;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IAC1D,QAAQ,CAAC,IAAI,yBAAyB;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAGxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAuJ,EAChK,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;IACxD,QAAQ,CAAC,IAAI,uBAAuB;IACpC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAGzB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAA+H,EACxI,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAK5B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACrD,QAAQ,CAAC,IAAI,oBAAoB;gBAGhC,OAAO,GAAE,MAAoF,EAC7F,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,IAAI,4BAA4B;gBAGxC,OAAO,GAAE,MAAmE,EAC5E,OAAO,CAAC,EAAE;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAC;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E"}

package/dist/errors.js

@@ -45,6 +45,30 @@ export class MissingBrowserBinaryError extends ControllerError {
         this.browser = browser;
     }
 }
+/**
+ * Stealth launch was REQUESTED (the opt-in is on) but the optional `patchright`
+ * dependency is not installed/importable. Patchright is an OPTIONAL dependency
+ * of `@webhands/core` imported lazily only when stealth is enabled, so a user
+ * who never opts in is not forced to install it (ADR-0002: stealth is one extra
+ * layer, not the default). When it IS opted into and missing, we refuse LOUDLY
+ * with this typed condition rather than silently falling back to vanilla
+ * Playwright, because a silent fallback would re-introduce the exact CDP
+ * automation tell the user asked us to remove WITHOUT telling them.
+ *
+ * Mirrors {@link MissingBrowserBinaryError}: a stable typed error whose brittle
+ * detection (the dynamic-import failure) is confined to one spot in the launch
+ * transport. The CLI can render the exact `pnpm add patchright` fix command by
+ * branching on {@link code}.
+ */
+export class MissingStealthDependencyError extends ControllerError {
+    code = 'missing-stealth-dependency';
+    /** The optional package that must be installed to use stealth. */
+    dependency;
+    constructor(dependency = 'patchright', message = `Stealth launch is enabled but the optional "${dependency}" dependency is not installed. Install it with \`pnpm add ${dependency}\` (and \`${dependency} install chromium\` if you do not use channel: 'chrome'), or construct the transport without {stealth: true}.`, options) {
+        super(message, options);
+        this.dependency = dependency;
+    }
+}
 /**
  * The named profile has not been set up yet: its dedicated profile directory
  * does not exist on disk. A profile is created by the headed `setup-profile`

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH;;;;;;GAMG;AACH,MAAM,OAAgB,eAAgB,SAAQ,KAAK;IAGlD,8EAA8E;IACrE,iBAAiB,GAAG,IAAa,CAAC;IAE3C,YAAY,OAAe,EAAE,OAA2B;QACvD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IACpD,IAAI,GAAG,wBAAwB,CAAC;IACzC,6DAA6D;IACpD,OAAO,CAAS;IAEzB,YACC,OAAe,EACf,UAAkB,OAAO,OAAO,mCAAmC,EACnE,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,eAAe;IAC9C,IAAI,GAAG,iBAAiB,CAAC;IAClC,kDAAkD;IACzC,OAAO,CAAS;IACzB,kEAAkE;IACzD,UAAU,CAAS;IAE5B,YACC,OAAe,EACf,UAAkB,EAClB,UAAkB,QAAQ,OAAO,oDAAoD,UAAU,IAAI,EACnG,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACjD,IAAI,GAAG,qBAAqB,CAAC;IACtC,4EAA4E;IACnE,OAAO,CAAS;IAEzB,YACC,OAAe,EACf,UAAkB,oDAAoD,OAAO,mFAAmF,EAChK,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IAC/C,IAAI,GAAG,mBAAmB,CAAC;IACpC,qDAAqD;IAC5C,QAAQ,CAAS;IAE1B,YACC,QAAgB,EAChB,UAAkB,+CAA+C,QAAQ,+DAA+D,EACxI,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,IAAI,GAAG,gBAAgB,CAAC;IAEjC,YACC,UAAkB,2EAA2E,EAC7F,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IACpD,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YACC,UAAkB,0DAA0D,EAC5E,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAuC,CAAC,iBAAiB,KAAK,IAAI;QACnE,OAAQ,KAA0B,CAAC,IAAI,KAAK,QAAQ,CACpD,CAAC;AACH,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH;;;;;;GAMG;AACH,MAAM,OAAgB,eAAgB,SAAQ,KAAK;IAGlD,8EAA8E;IACrE,iBAAiB,GAAG,IAAa,CAAC;IAE3C,YAAY,OAAe,EAAE,OAA2B;QACvD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IACpD,IAAI,GAAG,wBAAwB,CAAC;IACzC,6DAA6D;IACpD,OAAO,CAAS;IAEzB,YACC,OAAe,EACf,UAAkB,OAAO,OAAO,mCAAmC,EACnE,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,6BAA8B,SAAQ,eAAe;IACxD,IAAI,GAAG,4BAA4B,CAAC;IAC7C,kEAAkE;IACzD,UAAU,CAAS;IAE5B,YACC,UAAU,GAAG,YAAY,EACzB,UAAkB,+CAA+C,UAAU,6DAA6D,UAAU,aAAa,UAAU,+GAA+G,EACxR,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,eAAe;IAC9C,IAAI,GAAG,iBAAiB,CAAC;IAClC,kDAAkD;IACzC,OAAO,CAAS;IACzB,kEAAkE;IACzD,UAAU,CAAS;IAE5B,YACC,OAAe,EACf,UAAkB,EAClB,UAAkB,QAAQ,OAAO,oDAAoD,UAAU,IAAI,EACnG,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACjD,IAAI,GAAG,qBAAqB,CAAC;IACtC,4EAA4E;IACnE,OAAO,CAAS;IAEzB,YACC,OAAe,EACf,UAAkB,oDAAoD,OAAO,mFAAmF,EAChK,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IAC/C,IAAI,GAAG,mBAAmB,CAAC;IACpC,qDAAqD;IAC5C,QAAQ,CAAS;IAE1B,YACC,QAAgB,EAChB,UAAkB,+CAA+C,QAAQ,+DAA+D,EACxI,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,IAAI,GAAG,gBAAgB,CAAC;IAEjC,YACC,UAAkB,2EAA2E,EAC7F,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IACpD,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YACC,UAAkB,0DAA0D,EAC5E,OAA2B;QAE3B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAuC,CAAC,iBAAiB,KAAK,IAAI;QACnE,OAAQ,KAA0B,CAAC,IAAI,KAAK,QAAQ,CACpD,CAAC;AACH,CAAC"}

package/dist/hand-host.d.ts

@@ -0,0 +1,217 @@
+import { type BrowserContext, type Page } from 'playwright';
+import type { WebHandsPage, WaitCondition } from './seam.js';
+/**
+ * The hand-host primitive (Phase 1 of the "hands" prd,
+ * `work/prds/tasked/hands-pluggable-page-capabilities.md`).
+ *
+ * A **hand** is in-process code that closes over the WebHandsPage and contributes named
+ * verbs (+ an optional `dispose`). This module is the host: it builds the
+ * scoped-but-LIVE {@link HandContext} from the live Playwright objects, lets
+ * each hand contribute its verbs, and composes them into the same {@link WebHandsPage}
+ * object the seam already exposes (see {@link composePage}).
+ *
+ * webhands' OWN eight verbs are themselves built-in hands over this host
+ * ({@link BUILT_IN_HANDS}), so the primitive is proven by self-application: if
+ * it can express webhands' `click`/`snapshot`/`cookies`, it can host a
+ * third-party hand the same way (Phase 2). This is a purely INTERNAL,
+ * behavior-preserving refactor — the verb composition that lived as a
+ * duplicated `page` object literal in BOTH Playwright transports now lives here
+ * once.
+ *
+ * INTERNAL-ONLY BOUNDARY (the prd's resolved Q2): this whole module is
+ * package-internal. {@link Hand}/{@link HandContext}/{@link composePage} are
+ * NOT exported from the package entry point (`index.ts`) in Phase 1; they go
+ * public in the separate Phase 2 task. The public seam (`seam.ts`) is
+ * unchanged.
+ *
+ * NO-LEAK / CROSS-BROWSER (ADR-0003, refined by the prd): the host is built
+ * INSIDE the Playwright transport(s) and uses only the Playwright
+ * `Page`/`BrowserContext` API — no CDP/Chromium-only types — so the live
+ * `pwPage` stays in-process and never crosses the seam, and the host introduces
+ * no Chromium-only dependency that would foreclose a future Firefox launch
+ * (only CDP-`attach` stays Chromium-bound, as today).
+ *
+ * TRUST MODEL (stated, not enforced here): hands are trusted, local, in-process
+ * peers with ZERO isolation between them (one live page, one process).
+ * Inter-hand reuse is ordinary Node composition (import & call), NOT a
+ * sibling-hand registry in the context — so {@link HandContext} carries live
+ * page access only.
+ */
+/**
+ * The scoped-but-LIVE access a hand receives. It carries live page access ONLY
+ * (the trust model note above): the real Playwright {@link Page} and
+ * {@link BrowserContext} the hand operates against in-process, plus the
+ * lifecycle guard.
+ *
+ * - `pwPage` — the live Node-side Playwright `Page`. NEVER crosses the seam.
+ * - `context` — the live `BrowserContext`; the built-in `cookies`/`setCookies`
+ *   hand proves it is needed (cookies are a context-level, not page-level,
+ *   concern).
+ * - `ensureOpen` — the per-session lifecycle guard. Each verb calls it first so
+ *   a verb invoked after the session closed rejects with `session is closed`
+ *   (the seam's lifetime contract). The guard's "closed" state is owned by the
+ *   per-transport session wiring (launch vs attach differ); the host only reads
+ *   it through this function.
+ */
+export interface HandContext {
+    readonly pwPage: Page;
+    readonly context: BrowserContext;
+    readonly ensureOpen: () => void;
+}
+/**
+ * What a hand contributes once given its {@link HandContext}: a set of named
+ * verbs (a subset of webhands' (eight) seam verbs, i.e. a `Partial` of the
+ * seam {@link WebHandsPage}) and an optional `dispose` for any in-process
+ * resource it set up.
+ *
+ * A hand may contribute several verbs (the built-in interaction hand contributes
+ * both `click` and `type`) — a hand is NOT a single verb. It is NOT a transport
+ * either: it does not `open` sessions. Nothing more than this is allowed (no
+ * lifecycle hooks, no event handlers, no MCP-definition objects) — those are
+ * either the transport's job (session lifecycle) or a later phase's.
+ */
+export interface HandContribution {
+    readonly verbs: Partial<WebHandsPage>;
+    readonly dispose?: () => Promise<void> | void;
+}
+/**
+ * A hand: a capability MODULE that, given live page access, contributes verbs.
+ * It is a plain factory function so a hand is just ordinary in-process Node
+ * code closing over the {@link HandContext} — the exact shape webhands' own
+ * verbs already had, made explicit.
+ */
+export type Hand = (ctx: HandContext) => HandContribution;
+/**
+ * The composed result the host hands back to a transport's session wiring: the
+ * {@link WebHandsPage} (the seam object the verbs were merged into) and a single
+ * `dispose` that tears down every hand.
+ */
+export interface ComposedHands {
+    readonly page: WebHandsPage;
+    /**
+     * Dispose every hand's resources. Hands are disposed in REVERSE registration
+     * order (LIFO, the natural teardown order for layered setup), and every
+     * hand's `dispose` is awaited even if an earlier one rejects, so one failing
+     * hand cannot strand another's cleanup. This disposes the HANDS only; tearing
+     * down the browser/context (and the order relative to this) is the
+     * per-transport session lifecycle's job, NOT the host's.
+     */
+    dispose(): Promise<void>;
+}
+/**
+ * Compose a set of hands over one live {@link HandContext} into a single
+ * {@link WebHandsPage}. This is the host primitive both Playwright transports call to
+ * build their session's verb surface — the SINGLE shared composition (no
+ * duplicated page-object literal).
+ *
+ * Composition is EAGER (exactly as the page object literal was built before):
+ * each hand is invoked once at session-open time and its verbs are merged into
+ * one page object. There is no lazy registration and no ordering effect on the
+ * verbs themselves (the eight built-in verbs have disjoint names). The returned
+ * {@link WebHandsPage} is validated to carry every verb the seam requires, so a missing
+ * built-in verb is a build-time/open-time failure here rather than an `undefined
+ * is not a function` at the call site.
+ */
+export declare function composePage(ctx: HandContext, hands: readonly Hand[]): ComposedHands;
+/** The `navigate` verb: go to a URL and let it settle on the `load` event. */
+export declare const navigationHand: Hand;
+/** The `snapshot` verb: the token-cheap a11y view, or `--full` raw DOM. */
+export declare const snapshotHand: Hand;
+/** The `click` + `type` verbs: page interaction by raw locator (ADR-0004). */
+export declare const interactionHand: Hand;
+/** The `eval` escape hatch: run a JS EXPRESSION in the page, return by value. */
+export declare const evalHand: Hand;
+/** The `wait` verb: pace actions by a condition (timeout/locator/navigation). */
+export declare const waitHand: Hand;
+/**
+ * The `cookies` + `setCookies` verbs. These prove the {@link HandContext} needs
+ * the `context`: cookies are a context-level, not page-level, concern, so this
+ * hand reaches `ctx.context`, not `ctx.pwPage`.
+ */
+export declare const cookiesHand: Hand;
+/**
+ * webhands' eight built-in verbs as built-in hands, in composition order. Both
+ * Playwright transports compose THIS exact set, so the verb surface is
+ * identical across launch and attach (the only legitimate difference is the
+ * per-transport SESSION LIFECYCLE, which is not a hand's concern).
+ */
+export declare const BUILT_IN_HANDS: readonly Hand[];
+/**
+ * Compose webhands' built-in hands over a live context into the seam's
+ * {@link WebHandsPage}. The convenience both transports call: `composePage(ctx,
+ * BUILT_IN_HANDS)`. The built-in hands set up no in-process resources, so the
+ * returned `dispose` is a no-op today; it exists so a transport can sequence
+ * hand-teardown before its own browser/context teardown once third-party hands
+ * (which may hold resources) are added in Phase 2.
+ */
+export declare function composeBuiltInPage(ctx: HandContext): ComposedHands;
+/**
+ * Compose webhands' built-in hands together with any explicitly-loaded
+ * third-party hands (Phase 2) over a live context. The third-party hands are
+ * composed AFTER the built-ins through the EXACT same {@link composePage} the
+ * built-ins use, so a loaded hand plugs into the same host: its verbs merge into
+ * the same seam {@link WebHandsPage} and its `dispose` is sequenced LIFO with the rest.
+ * A third-party hand may add NEW verbs (the common case) and, because later
+ * contributions win the merge, may also override a built-in verb — that is the
+ * operator's choice, made by the trust act of naming the hand (ADR-0007).
+ */
+export declare function composeWithHands(ctx: HandContext, extraHands: readonly Hand[]): ComposedHands;
+/**
+ * Run the `wait` verb's three forms (PRD story 10) against a Playwright page.
+ *
+ * - `timeout` — pace by a fixed delay (`waitForTimeout`), so an agent can act
+ *   like a human and let XHR-rendered content land.
+ * - `locator` — block until the addressed element appears (`Locator.waitFor()`),
+ *   the form for content rendered AFTER `goto` settled on `load`.
+ * - `navigation` — block until the NEXT navigation settles to `load`. We use
+ *   `waitForNavigation()` even though Playwright marks it `@deprecated` ("racy,
+ *   use waitForURL"): that deprecation targets in-process TEST code that can arm
+ *   the wait BEFORE the action and pass a target URL. Neither holds here. Across
+ *   this seam verbs are DISCRETE sequential calls (`click` then `wait`), so we
+ *   CANNOT arm before the trigger; and the realistic trigger is an async,
+ *   JS-driven transition (a redirect / SPA route change that fires AFTER the
+ *   agent's action, the "let XHR-rendered content load" case of story 10), so
+ *   "wait for the NEXT navigation" is exactly right — whereas `waitForLoadState`
+ *   would see the already-loaded current page and return before the pending
+ *   transition. `waitForURL` is unusable because the verb has no target URL by
+ *   design (the agent waits for "a navigation", not a known address). (See the
+ *   task's ## Decisions note.)
+ *
+ * Shared by both Playwright transports (via the `wait` built-in hand) so the
+ * verb behaviour stays identical (no parallel second implementation).
+ */
+export declare function waitFor(page: Page, condition: WaitCondition): Promise<void>;
+/**
+ * Resolve a raw Playwright locator EXPRESSION (ADR-0004) against the page. The
+ * verb surface passes locator expressions like `getByRole('button', …)`; we
+ * evaluate them in a small sandbox where `page`/`p` is the page, so the full
+ * Playwright locator grammar is available without leaking the type across the
+ * seam.
+ *
+ * One resolution path for both transports (via the built-in interaction/wait
+ * hands), so there is no parallel addressing scheme.
+ */
+export declare function resolveLocator(page: Page, expression: string): import("playwright").Locator;
+/**
+ * Run the `click` verb against a Playwright page (PRD story 8), shared by both
+ * Playwright transports (via the built-in interaction hand) so the verb behaves
+ * identically (mirrors {@link waitFor}; no parallel second implementation).
+ *
+ * First try a normal `Locator.click()`, which AUTO-WAITS for the element to be
+ * visible and actionable — the right behaviour for a real button. A hidden
+ * custom input (the case the prd calls out) NEVER becomes actionable, so that
+ * click times out; on a Playwright `TimeoutError` we fall back to
+ * `dispatchEvent('click')`, which fires a click WITHOUT the actionability
+ * checks. The fallback is deliberately the documented Playwright escape (a
+ * sibling to the `eval` hatch, ADR-0004), not a reimplemented click: we keep
+ * the locator a raw resolved expression and only change HOW the resolved
+ * locator is clicked.
+ *
+ * Only a timeout triggers the fallback. The fallback `dispatchEvent` is itself
+ * bounded by the same short timeout, so a locator that resolves NO element (a
+ * bad locator) surfaces its timeout quickly instead of hanging the dispatch on
+ * Playwright's 30s default — the dispatch escape is for elements that EXIST but
+ * are not actionable (hidden custom inputs), not for absent ones.
+ */
+export declare function clickLocator(page: Page, expression: string): Promise<void>;
+//# sourceMappingURL=hand-host.d.ts.map

package/dist/hand-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hand-host.d.ts","sourceRoot":"","sources":["../src/hand-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,IAAI,EAAC,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAEX,YAAY,EAGZ,aAAa,EACb,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;;;;;;OAOG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAC1B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,SAAS,IAAI,EAAE,GACpB,aAAa,CAgCf;AAsDD,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,IAe3B,CAAC;AAEH,2EAA2E;AAC3E,eAAO,MAAM,YAAY,EAAE,IAyBzB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,eAAe,EAAE,IAW5B,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,QAAQ,EAAE,IAoBrB,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,QAAQ,EAAE,IAOrB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,IAYxB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,IAAI,EAOzC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,aAAa,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC/B,GAAG,EAAE,WAAW,EAChB,UAAU,EAAE,SAAS,IAAI,EAAE,GACzB,aAAa,CAEf;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,OAAO,CAC5B,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gCAO5D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CACjC,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf"}