@wenathlan/extension 1.1.38 → 1.1.40

package/extension/dist/background.js

@@ -619,23 +619,176 @@ var sessionmemory = class {
   async getexports() {
     return await this.adapter.get("exports") ?? [];
   }
+  /** Removes one exported data artifact by id and reports whether it existed. */
+  async removeexport(id) {
+    const records = await this.getexports();
+    const remaining = records.filter((item) => item.id !== id);
+    await this.adapter.set("exports", remaining);
+    return remaining.length !== records.length;
+  }
+  /** Removes one run store artifact by id and reports whether it existed. */
+  async removeartifact(id) {
+    const records = await this.getartifacts();
+    const remaining = records.filter((item) => item.id !== id);
+    await this.adapter.set("artifacts", remaining);
+    return remaining.length !== records.length;
+  }
+  /** Stores one batch download file record with its state, path and checksum, replacing the previous record of that id. */
+  async setdownload(record2) {
+    const records = (await this.adapter.get("downloads") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("downloads", [record2, ...records]);
+  }
+  /** Returns every batch download file record with its state, path and checksum, newest first. */
+  async getdownloads() {
+    return await this.adapter.get("downloads") ?? [];
+  }
+  /** Records one captured network log record; netlog retention is a user setting and an absent value keeps every record. */
+  async addnetlog(record2) {
+    const records = await this.getnetlog();
+    const combined = [record2, ...records];
+    const retention = (await this.getsettings())?.netlogretention;
+    await this.adapter.set("netlog", retention === void 0 ? combined : combined.slice(0, retention));
+  }
+  /** Returns the captured network log of the run with its step correlation, newest first. */
+  async getnetlog() {
+    return await this.adapter.get("netlog") ?? [];
+  }
+  /** Stores one clipboard consent record with its prompt and origin, replacing the previous record of that id. */
+  async setclipconsent(record2) {
+    const records = (await this.adapter.get("clipconsents") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("clipconsents", [record2, ...records]);
+  }
+  /** Returns every clipboard consent record with its prompt and origin, newest first. */
+  async getclipconsents() {
+    return await this.adapter.get("clipconsents") ?? [];
+  }
+  /** Records one clipboard entry hash with its origin provenance; the payload text itself never persists. */
+  async addclip(entry) {
+    const records = await this.getclips();
+    await this.adapter.set("clips", [entry, ...records]);
+  }
+  /** Returns every clipboard entry hash with its kind and origin provenance, newest first. */
+  async getclips() {
+    return await this.adapter.get("clips") ?? [];
+  }
+  /** Stores one quarantine entry with its scan verdict, replacing the previous entry of that id. */
+  async setquarantine(entry) {
+    const records = (await this.adapter.get("quarantines") ?? []).filter((item) => item.id !== entry.id);
+    await this.adapter.set("quarantines", [entry, ...records]);
+  }
+  /** Returns every quarantine entry with its scan verdict and release ref, newest first. */
+  async getquarantines() {
+    return await this.adapter.get("quarantines") ?? [];
+  }
+  /** Stores the reviewed cleanup rule set of the run, replacing the previous set. */
+  async setcleanuprules(rules) {
+    return this.adapter.set("cleanuprules", rules);
+  }
+  /** Returns the reviewed cleanup rule set of the run. */
+  async getcleanuprules() {
+    return await this.adapter.get("cleanuprules") ?? [];
+  }
+  /** Records one cleanup run in the run history. */
+  async addcleanuprun(run) {
+    const records = await this.getcleanupruns();
+    await this.adapter.set("cleanupruns", [run, ...records]);
+  }
+  /** Returns every cleanup run history record with removed and kept counts, newest first. */
+  async getcleanupruns() {
+    return await this.adapter.get("cleanupruns") ?? [];
+  }
+  /** Stores the capture naming counters of one task, replacing the previous counters of that task. */
+  async setcapturecounter(counter) {
+    const records = (await this.adapter.get("capturecounters") ?? []).filter((item) => item.taskid !== counter.taskid);
+    await this.adapter.set("capturecounters", [counter, ...records]);
+  }
+  /** Returns every stored capture naming counter per task, newest first. */
+  async getcapturecounters() {
+    return await this.adapter.get("capturecounters") ?? [];
+  }
+  /** Replaces the artifact inventory the cleanup sweeper plans against. */
+  async setinventory(entries) {
+    return this.adapter.set("inventory", entries);
+  }
+  /** Returns the artifact inventory with sizes and ages for the cleanup sweeper. */
+  async getinventory() {
+    return await this.adapter.get("inventory") ?? [];
+  }
+  /** Stores one user configured virus scanning hook, replacing the previous hook of that scanner name. */
+  async setscanhook(config) {
+    const records = (await this.adapter.get("scanhooks") ?? []).filter((item) => item.scanner !== config.scanner);
+    await this.adapter.set("scanhooks", [config, ...records]);
+  }
+  /** Returns every configured virus scanning hook, newest first. */
+  async getscanhooks() {
+    return await this.adapter.get("scanhooks") ?? [];
+  }
+  /** Stores the armed mime interception filters of the run, newest first. */
+  async setmimefilters(filters) {
+    return this.adapter.set("mimefilters", filters);
+  }
+  /** Returns the armed mime interception filters of the run, newest first. */
+  async getmimefilters() {
+    return await this.adapter.get("mimefilters") ?? [];
+  }
+  /** Stores one capture record with its bytes and step linkage, replacing the previous record of that id; the user configured capture retention window expires the oldest bytes while the metadata always survives for the audit trail. */
+  async addcapture(record2) {
+    const records = await this.getcaptures();
+    const retention = (await this.getsettings())?.captureretention;
+    const combined = [record2, ...records.filter((item) => item.id !== record2.id)];
+    const stored = retention === void 0 ? combined : combined.map((item, index) => index < retention ? item : expirecapturebytes(item));
+    await this.adapter.set("captures", stored);
+  }
+  /** Returns every stored capture record with its metadata, newest first. */
+  async getcaptures() {
+    return await this.adapter.get("captures") ?? [];
+  }
+  /** Returns one capture record with its bytes by its id. */
+  async getcapture(id) {
+    return (await this.getcaptures()).find((item) => item.id === id);
+  }
+  /** Returns the capture records filtered by run, step and kind. */
+  async listcaptures(filter) {
+    const records = await this.getcaptures();
+    return records.filter((item) => (filter.runid === void 0 || item.runid === filter.runid) && (filter.stepid === void 0 || item.stepid === filter.stepid) && (filter.kind === void 0 || item.kind === filter.kind));
+  }
+  /** Records one before and after shotpair of the run with its action context. */
+  async addpair(pair) {
+    const records = await this.getpairs();
+    await this.adapter.set("capturepairs", [pair, ...records.filter((item) => item.id !== pair.id)]);
+  }
+  /** Returns the shotpairs of one run resolved through their before records, newest first; an absent run returns every pair. */
+  async getpairs(runid) {
+    const records = await this.adapter.get("capturepairs") ?? [];
+    if (runid === void 0) return records;
+    const runs = /* @__PURE__ */ new Map();
+    for (const capture of await this.getcaptures()) runs.set(capture.id, capture.runid);
+    return records.filter((item) => runs.get(item.beforeid) === runid);
+  }
 };
+function expirecapturebytes(record2) {
+  const { bytes, ...metadata } = record2;
+  void bytes;
+  return { ...metadata, bytesexpired: true };
+}
 function randomid() {
   return crypto.randomUUID();
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
-var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract"]);
-var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword"]);
+var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement"]);
+var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "pausedownload", "resumedownload", "verifydownload", "writeclipboard", "quarantinedownload", "scanvirus"]);
 var tabscommandactions = /* @__PURE__ */ new Set(["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"]);
 var formactions = /* @__PURE__ */ new Set(["fillform", "filllabel", "fillplaceholder", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "submitform", "readerrors", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "handoffcaptcha", "fillcard", "fillcode", "consentpassword", "skiphoneypot", "detectlogin", "detecttemplate"]);
 var datasetactions = /* @__PURE__ */ new Set(["scrapetable", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "importcsv", "looprows", "transformvalues", "deduperows", "paginateextract", "mergepages", "stamplerows", "previewgrid", "streamdisk", "resumeextract", "logprovenance"]);
 var exportactions = /* @__PURE__ */ new Set(["exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk"]);
+var filesactions = /* @__PURE__ */ new Set(["batchdownload", "pausedownload", "resumedownload", "verifydownload", "interceptmime", "exportnetlog", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "namecaptures", "cleanupartifacts"]);
+var captureactions = /* @__PURE__ */ new Set(["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
 var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
@@ -671,6 +824,9 @@ function requiredcapability(kind) {
   if (kind === "downloadfile") return "downloads";
   if (kind === "openclipboard") return "clipboardRead";
   if (kind === "copytable") return "clipboardWrite";
+  if (kind === "batchdownload" || kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "interceptmime" || kind === "quarantinedownload" || kind === "scanvirus") return "downloads";
+  if (kind === "readclipboard") return "clipboardRead";
+  if (kind === "writeclipboard" || kind === "copyscreen") return "clipboardWrite";
   if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
   if (tabscommandactions.has(kind)) return "tabs";
   return void 0;
@@ -690,6 +846,95 @@ function isdatasetkind(kind) {
 function isexportkind(kind) {
   return exportactions.has(kind);
 }
+function isfileskind(kind) {
+  return filesactions.has(kind);
+}
+function iscapturekind(kind) {
+  return captureactions.has(kind);
+}
+function capturegate(session, tabid2, origin, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the capture." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot capture." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot capture." };
+  if (session.tabid !== tabid2) return { allowed: false, reason: `The capture needs the active tab grant of session tab ${session.tabid} and refuses tab ${tabid2}.` };
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The capture of ${origin} needs the session origin grants first.` };
+  return { allowed: true };
+}
+function validatecaptureoptions(value) {
+  if (value === void 0) return { allowed: true };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "The reviewed capture options must be an object in options.capture." };
+  const options = value;
+  if (options.format !== void 0 && options.format !== "png" && options.format !== "jpeg" && options.format !== "webp") return { allowed: false, reason: "The reviewed capture format must be png, jpeg or webp." };
+  if (options.quality !== void 0 && (typeof options.quality !== "number" || !Number.isFinite(options.quality) || options.quality < 0 || options.quality > 100)) return { allowed: false, reason: "The reviewed capture quality must stay between zero and one hundred; any value in that range is the user choice with no code cap." };
+  if (options.pixelratio !== void 0 && (typeof options.pixelratio !== "number" || !Number.isFinite(options.pixelratio) || options.pixelratio < 1)) return { allowed: false, reason: "The reviewed pixel ratio starts at one and climbs to any user configured ceiling with no code ceiling." };
+  if (options.annotate !== void 0 && typeof options.annotate !== "boolean") return { allowed: false, reason: "The reviewed capture annotation flag must be a boolean." };
+  if (options.exporttarget !== void 0 && options.exporttarget !== "memory" && options.exporttarget !== "download" && options.exporttarget !== "clipboard") return { allowed: false, reason: "The reviewed capture export target must be memory, download or clipboard." };
+  return { allowed: true };
+}
+function validateregionrect(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed regionrect with x, y, width and height in css pixels is required in options." };
+  const rect = value;
+  for (const field of ["x", "y", "width", "height"]) {
+    if (typeof rect[field] !== "number" || !Number.isFinite(rect[field])) return { allowed: false, reason: `The reviewed regionrect needs a numeric ${field} in css pixels.` };
+  }
+  if (rect.x < 0 || rect.y < 0) return { allowed: false, reason: "The reviewed regionrect refuses negative coordinates." };
+  if (rect.width <= 0 || rect.height <= 0) return { allowed: false, reason: "The reviewed regionrect needs positive width and height values." };
+  return { allowed: true };
+}
+function validatecapturenaming(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed capturenaming rule with run, step, sequence and kind flags is required." };
+  const rule = value;
+  const segments = ["run", "step", "sequence", "kind"];
+  for (const key of Object.keys(rule)) {
+    if (!segments.includes(key)) return { allowed: false, reason: `The reviewed capturenaming rule refuses the unknown ${key} segment; only run, step, sequence and kind participate.` };
+  }
+  for (const segment of segments) {
+    if (rule[segment] !== void 0 && typeof rule[segment] !== "boolean") return { allowed: false, reason: `The reviewed capturenaming ${segment} flag must be a boolean.` };
+  }
+  if (!segments.some((segment) => rule[segment] === true)) return { allowed: false, reason: "The reviewed capturenaming rule needs at least one enabled segment of run, step, sequence and kind." };
+  return { allowed: true };
+}
+function stitchbudgetallowed(tiles, settle2, wait) {
+  if (tiles <= 0) return { allowed: false, reason: "The stitch budget needs at least one tile." };
+  if (settle2 < 0 || wait < 0) return { allowed: false, reason: "The reviewed settle and wait windows must be zero or positive milliseconds." };
+  if (tiles * settle2 > wait) return { allowed: false, reason: `The stitching scroll budget of ${tiles} tiles at ${settle2} milliseconds exceeds the reviewed wait window of ${wait} milliseconds; review a wider window or a smaller settle.` };
+  return { allowed: true };
+}
+function beforeafterwrapallowed(kind) {
+  return allowedactions.has(kind) && !captureactions.has(kind);
+}
+function validatecapturegrammar(step, options) {
+  const kind = step.kind;
+  const optioncheck = validatecaptureoptions(options.capture);
+  if (!optioncheck.allowed) return optioncheck;
+  if (options.settle !== void 0 && (typeof options.settle !== "number" || !Number.isFinite(options.settle) || options.settle < 0)) return { allowed: false, reason: "The reviewed capture settle window must be zero or a positive number of milliseconds." };
+  if (options.overlap !== void 0 && (typeof options.overlap !== "number" || !Number.isInteger(options.overlap) || options.overlap < 0)) return { allowed: false, reason: "The reviewed stitch overlap must be zero or a positive number of rows." };
+  if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed capture wait window must be zero or a positive number of milliseconds." };
+  if (options.naming !== void 0) {
+    const namingcheck = validatecapturenaming(options.naming);
+    if (!namingcheck.allowed) return namingcheck;
+  }
+  if (kind === "shotregion") {
+    const rectcheck = validateregionrect(options.regionrect);
+    if (!rectcheck.allowed) return rectcheck;
+    if (options.reviewed !== true) return { allowed: false, reason: "Every reviewed regionrect needs the explicit reviewed flag before shotregion runs." };
+    if (options.container !== void 0 && !isnonempty(options.container)) return { allowed: false, reason: "The reviewed scrollable container selector must be a non-empty string." };
+    if (options.steps !== void 0 && (typeof options.steps !== "number" || !Number.isInteger(options.steps) || options.steps < 1)) return { allowed: false, reason: "The reviewed container scroll steps must be a positive integer with no code ceiling." };
+  }
+  if (kind === "contactsheet") {
+    const elements = options.elements;
+    if (!Array.isArray(elements) || elements.length === 0 || !elements.every((item) => isnonempty(item))) return { allowed: false, reason: "A reviewed non-empty list of element selectors is required in options for the contact sheet; the cell count stays the user choice." };
+    const layout = options.sheet;
+    if (layout !== void 0) {
+      if (!layout || typeof layout !== "object" || Array.isArray(layout)) return { allowed: false, reason: "The reviewed sheetlayout must be an object with cellsize, columns and label." };
+      const sheet = layout;
+      if (typeof sheet.cellsize !== "number" || !Number.isFinite(sheet.cellsize) || sheet.cellsize <= 0) return { allowed: false, reason: "The reviewed contact sheet cell size must be a positive number of pixels." };
+      if (typeof sheet.columns !== "number" || !Number.isInteger(sheet.columns) || sheet.columns < 1) return { allowed: false, reason: "The reviewed contact sheet column count must be a positive integer with no code ceiling." };
+      if (sheet.label !== void 0 && sheet.label !== "none" && sheet.label !== "index" && sheet.label !== "selector" && sheet.label !== "both") return { allowed: false, reason: "The reviewed contact sheet label style must be none, index, selector or both." };
+    }
+  }
+  return { allowed: true };
+}
 function exportgranted(session, origin) {
   if (!origingranted(session, origin)) return { allowed: false, reason: `The export of extracted data from ${origin} needs the session origin grants before it leaves local memory.` };
   return { allowed: true };
@@ -874,6 +1119,88 @@ function validatedatagrammar(step, options, origin) {
   if (kind === "logprovenance" && !isnonempty(options.artifact)) return { allowed: false, reason: "A reviewed artifact id or name is required in options." };
   return { allowed: true };
 }
+function validatedownloadspec(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed downloadspec with a url list is required in options." };
+  const spec = value;
+  if (!Array.isArray(spec.urls) || spec.urls.length === 0 || !spec.urls.every((url) => ishttpsurl(url))) return { allowed: false, reason: "The reviewed downloadspec needs a non-empty list of HTTPS urls." };
+  if (spec.filename !== void 0 && !isnonempty(spec.filename)) return { allowed: false, reason: "The reviewed downloadspec filename rule must be a non-empty string." };
+  if (spec.complete !== void 0 && spec.complete !== "size" && spec.complete !== "checksum") return { allowed: false, reason: "The reviewed downloadspec completion criterion must be size or checksum." };
+  return { allowed: true };
+}
+function validatemimefilter(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed mimefilter with include and exclude patterns is required in options." };
+  const filter = value;
+  if (!Array.isArray(filter.include) || filter.include.length === 0 || !filter.include.every((pattern) => isnonempty(pattern))) return { allowed: false, reason: "The reviewed mimefilter needs a non-empty list of include patterns." };
+  if (filter.exclude !== void 0 && (!Array.isArray(filter.exclude) || !filter.exclude.every((pattern) => isnonempty(pattern)))) return { allowed: false, reason: "The reviewed mimefilter exclude patterns must be a list of non-empty strings." };
+  if (filter.default !== "deny" && filter.default !== "allow") return { allowed: false, reason: "The reviewed mimefilter needs the deny or allow default for unlisted mime types." };
+  return { allowed: true };
+}
+function validatecleanuprule(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed cleanuprule with an age, a kind and a keep policy is required." };
+  const rule = value;
+  if (typeof rule.age !== "number" || !Number.isFinite(rule.age) || rule.age <= 0) return { allowed: false, reason: "The reviewed cleanup age window must be a positive number of milliseconds with no code ceiling." };
+  if (!isnonempty(rule.kind)) return { allowed: false, reason: "The reviewed cleanup rule needs a non-empty artifact kind, or any to match every kind." };
+  if (rule.keep !== "none" && rule.keep !== "latest" && rule.keep !== "all") return { allowed: false, reason: "The reviewed cleanup keep policy must be none, latest or all." };
+  return { allowed: true };
+}
+function validatefilesgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "batchdownload") {
+    const speccheck = validatedownloadspec(options.downloadspec);
+    if (!speccheck.allowed) return speccheck;
+    if (options.concurrent !== void 0 && (typeof options.concurrent !== "number" || !Number.isInteger(options.concurrent) || options.concurrent < 1)) return { allowed: false, reason: "The reviewed concurrent download window must be a positive integer with no code ceiling." };
+  }
+  if (kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "quarantinedownload" || kind === "scanvirus") {
+    if (!isnonempty(step.value)) return { allowed: false, reason: "A reviewed download or quarantine reference is required." };
+    if (kind === "verifydownload") {
+      if (options.checksum !== void 0 && !isnonempty(options.checksum)) return { allowed: false, reason: "The reviewed expected checksum must be a non-empty string." };
+      if (options.bytes !== void 0 && (typeof options.bytes !== "number" || !Number.isFinite(options.bytes) || options.bytes < 0)) return { allowed: false, reason: "The reviewed expected size must be zero or a positive number of bytes." };
+    }
+    if (kind === "scanvirus" && options.scanner !== void 0 && !isnonempty(options.scanner)) return { allowed: false, reason: "The reviewed scanner name must be a non-empty string." };
+    if (kind === "quarantinedownload" && options.reason !== void 0 && !isnonempty(options.reason)) return { allowed: false, reason: "The reviewed quarantine reason must be a non-empty string." };
+  }
+  if (kind === "interceptmime") {
+    const filtercheck = validatemimefilter(options.mimefilter);
+    if (!filtercheck.allowed) return filtercheck;
+  }
+  if (kind === "readclipboard") {
+    if (!isnonempty(options.consentref)) return { allowed: false, reason: "A clipboard read requires a reviewed consent ref of an approved consent prompt in options." };
+    if (options.prompt !== void 0 && !isnonempty(options.prompt)) return { allowed: false, reason: "The reviewed clipboard consent prompt must be a non-empty string." };
+  }
+  if (kind === "exportnetlog" && options.stepid !== void 0 && !isnonempty(options.stepid)) return { allowed: false, reason: "The reviewed netlog step filter must be a non-empty step id." };
+  if (kind === "namecaptures") {
+    if (!isnonempty(options.task)) return { allowed: false, reason: "A reviewed task id is required in options for capture naming." };
+    if (options.steps !== void 0 && (!Array.isArray(options.steps) || options.steps.length === 0 || !options.steps.every((item) => isnonempty(item)))) return { allowed: false, reason: "The reviewed capture steps must be a non-empty list of step ids when present." };
+    if (options.extension !== void 0 && !isnonempty(options.extension)) return { allowed: false, reason: "The reviewed capture extension must be a non-empty string." };
+  }
+  if (kind === "cleanupartifacts" && options.rules !== void 0) {
+    const rules = options.rules;
+    if (!Array.isArray(rules) || rules.length === 0) return { allowed: false, reason: "The reviewed cleanup rules must be a non-empty list when present." };
+    for (const item of rules) {
+      const rulecheck = validatecleanuprule(item);
+      if (!rulecheck.allowed) return rulecheck;
+    }
+  }
+  return { allowed: true };
+}
+function clipboardconsentgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const consentref = options.consentref;
+  if (typeof consentref !== "string" || !consentref.trim()) return { allowed: false, reason: "A clipboard read requires a reviewed consent ref in options." };
+  return { allowed: true };
+}
+function quarantinereleasegranted(entry) {
+  if (entry.scan !== "clean") return { allowed: false, reason: `The quarantined file ${entry.path} cannot leave quarantine with the ${entry.scan} scan verdict; only a clean verdict releases it.` };
+  return { allowed: true };
+}
+function maskclipboard(payload) {
+  return `[clipboard payload of ${payload.length} character${payload.length === 1 ? "" : "s"}]`;
+}
 function submitreviewgranted(steps, submitid) {
   const position = steps.findIndex((candidate) => candidate.id === submitid);
   const asked = steps.some((candidate, index) => candidate.kind === "asksubmit" && (position === -1 || index < position));
@@ -1400,6 +1727,14 @@ function validatestep(step, origin) {
     const datacheck = validatedatagrammar(step, options, origin);
     if (!datacheck.allowed) return datacheck;
   }
+  if (isfileskind(step.kind)) {
+    const filescheck = validatefilesgrammar(step, options);
+    if (!filescheck.allowed) return filescheck;
+  }
+  if (iscapturekind(step.kind)) {
+    const capturecheck = validatecapturegrammar(step, options);
+    if (!capturecheck.allowed) return capturecheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -1454,6 +1789,23 @@ function canexecute(input) {
     const consentgate = passwordconsentgranted(input.step);
     if (!consentgate.allowed) return consentgate;
   }
+  if (input.step.kind === "readclipboard") {
+    const clipgate = clipboardconsentgranted(input.step);
+    if (!clipgate.allowed) return clipgate;
+  }
+  if (input.step.kind === "interceptmime" && !origingranted(input.session, input.origin)) return { allowed: false, reason: "The download interception is outside the session origin grants." };
+  if (iscapturekind(input.step.kind)) {
+    const capturegatecheck = capturegate(input.session, input.tabid, input.origin, now);
+    if (!capturegatecheck.allowed) return capturegatecheck;
+    let captureoptions = {};
+    try {
+      captureoptions = parseoptions(input.step);
+    } catch {
+      captureoptions = {};
+    }
+    const target = captureoptions.capture?.exporttarget;
+    if (target !== void 0 && target !== "memory" && target !== "download" && target !== "clipboard") return { allowed: false, reason: "The capture export target must be memory, download or clipboard." };
+  }
   if (input.step.kind === "openlink" || input.step.kind === "openprivate" || input.step.kind === "batchopen" || input.step.kind === "prefetch" || input.step.kind === "deeplink" || input.step.kind === "reopentab") {
     let options = {};
     try {
@@ -1555,9 +1907,29 @@ function recordwizardstep(progress, planid, stepid, state, now) {
   const outcome = { stepid, ok: done, summary: `Wizard step ${executed} of ${state.steps} ${done ? "completed the wizard" : "executed"}.`, details: { wizard: { index: state.index, steps: state.steps, completed: [...state.completed] } }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function downloadshare(completed, total) {
+  if (!Number.isFinite(total) || total <= 0) return 0;
+  return Math.min(1, Math.max(0, completed) / total);
+}
+function recorddownload(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.state === "complete", summary: `Download ${entry.index + 1} of ${entry.url} ended in the ${entry.state} state.`, details: { download: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordcapture(progress, planid, stepid, capture, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const bytes = capture.bytes?.length ?? 0;
+  const outcome = { stepid, ok: true, summary: `Captured a ${capture.format} ${capture.kind} shot of ${capture.width} by ${capture.height} pixels with ${bytes} character${bytes === 1 ? "" : "s"} of image data.`, details: { capture: { id: capture.id, kind: capture.kind, format: capture.format, width: capture.width, height: capture.height, bytes } }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordpair(progress, planid, stepid, pair, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: true, summary: `Paired the before shot ${pair.beforeid} with the after shot ${pair.afterid} around the ${pair.actionkind} action.`, details: { shotpair: { id: pair.id, beforeid: pair.beforeid, afterid: pair.afterid, actionkind: pair.actionkind, ...pair.target !== void 0 ? { target: pair.target } : {}, ...pair.domsnapshotid !== void 0 ? { domsnapshotid: pair.domsnapshotid } : {} } }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.38";
+var packageversion = "1.1.40";
 
 // types.ts
 var protocolversion = packageversion;
@@ -1621,7 +1993,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -1674,6 +2046,204 @@ function extractionreport(input) {
 function provenancereport(input) {
   return { version: protocolversion, records: input.records };
 }
+function downloadreport(input) {
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, downloads: input.downloads });
+}
+function netlogreport(input) {
+  return { version: protocolversion, records: input.records };
+}
+function quarantinereport(input) {
+  return { version: protocolversion, entries: input.entries };
+}
+function capturereport(input) {
+  return { version: protocolversion, records: input.records, pairs: input.pairs };
+}
+
+// capture.ts
+var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
+function captureoptionsof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  const normalized = {};
+  if (options.format === "png" || options.format === "jpeg" || options.format === "webp") normalized.format = options.format;
+  if (typeof options.quality === "number" && Number.isFinite(options.quality)) normalized.quality = options.quality;
+  if (typeof options.pixelratio === "number" && Number.isFinite(options.pixelratio)) normalized.pixelratio = options.pixelratio;
+  if (typeof options.annotate === "boolean") normalized.annotate = options.annotate;
+  if (options.exporttarget === "memory" || options.exporttarget === "download" || options.exporttarget === "clipboard") normalized.exporttarget = options.exporttarget;
+  return normalized;
+}
+function capturevisible(input) {
+  const ratio = input.options.pixelratio ?? 1;
+  return {
+    id: input.id,
+    runid: input.runid,
+    stepid: input.stepid,
+    kind: "shotview",
+    format: input.options.format ?? "png",
+    width: Math.round(input.viewport.width * ratio),
+    height: Math.round(input.viewport.height * ratio),
+    capturedat: input.at,
+    bytes: input.dataurl,
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.options.annotate === true ? { annotated: true } : {},
+    ...input.options.exporttarget !== void 0 ? { exporttarget: input.options.exporttarget } : {},
+    ...input.target !== void 0 ? { target: input.target } : {}
+  };
+}
+function capturestitched(input) {
+  const ratio = input.options.pixelratio ?? 1;
+  return {
+    id: input.id,
+    runid: input.runid,
+    stepid: input.stepid,
+    kind: "shotfullpage",
+    format: input.options.format ?? "png",
+    width: Math.round(input.plan.scrollwidth * ratio),
+    height: Math.round(input.plan.scrollheight * ratio),
+    capturedat: input.at,
+    bytes: input.dataurl,
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.options.annotate === true ? { annotated: true } : {},
+    ...input.options.exporttarget !== void 0 ? { exporttarget: input.options.exporttarget } : {}
+  };
+}
+function captureelement(input) {
+  const ratio = input.options.pixelratio ?? 1;
+  const scaled = scaledrect(input.rect, ratio);
+  return {
+    id: input.id,
+    runid: input.runid,
+    stepid: input.stepid,
+    kind: "shotelement",
+    format: input.options.format ?? "png",
+    width: scaled.width,
+    height: scaled.height,
+    capturedat: input.at,
+    bytes: input.dataurl,
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.options.annotate === true ? { annotated: true } : {},
+    ...input.options.exporttarget !== void 0 ? { exporttarget: input.options.exporttarget } : {},
+    ...input.target !== void 0 ? { target: input.target } : {}
+  };
+}
+function captureregion(input) {
+  const ratio = input.options.pixelratio ?? 1;
+  const scaled = scaledrect(input.rect, ratio);
+  return {
+    id: input.id,
+    runid: input.runid,
+    stepid: input.stepid,
+    kind: "shotregion",
+    format: input.options.format ?? "png",
+    width: scaled.width,
+    height: scaled.height,
+    capturedat: input.at,
+    bytes: input.dataurl,
+    ...input.name !== void 0 ? { name: input.name } : {},
+    ...input.options.annotate === true ? { annotated: true } : {},
+    ...input.options.exporttarget !== void 0 ? { exporttarget: input.options.exporttarget } : {},
+    ...input.target !== void 0 ? { target: input.target } : {}
+  };
+}
+function pairstates(before, after, action, at, id) {
+  if (!before) return { skipped: "before", reason: "The before shot was not captured, so no state pair exists." };
+  if (!after) return { skipped: "after", reason: `The action of kind ${action.kind} failed before the after shot, so the state pair is skipped.` };
+  return {
+    pair: {
+      id,
+      beforeid: before.id,
+      afterid: after.id,
+      actionkind: action.kind,
+      ...action.target !== void 0 ? { target: action.target } : {},
+      ...action.domsnapshotid !== void 0 ? { domsnapshotid: action.domsnapshotid } : {},
+      at
+    },
+    reason: `Paired the before shot ${before.id} with the after shot ${after.id} around the ${action.kind} action.`
+  };
+}
+function capturestates(input) {
+  if (input.policy !== "beforeafter") return { reason: `The ${input.policy} capture policy takes no state pair around the ${input.actionkind} action.` };
+  return pairstates(input.before, input.after, { kind: input.actionkind, ...input.target !== void 0 ? { target: input.target } : {}, ...input.domsnapshotid !== void 0 ? { domsnapshotid: input.domsnapshotid } : {} }, input.at, input.id);
+}
+function buildstitchplan(input) {
+  const overlap = Math.max(0, Math.round(input.overlap ?? 0));
+  const stepy = Math.max(1, input.viewportheight - overlap);
+  const columns = Math.max(1, Math.ceil(input.scrollwidth / input.viewportwidth));
+  const rows = input.scrollheight <= input.viewportheight ? 1 : Math.max(1, Math.ceil((input.scrollheight - overlap) / stepy));
+  const tiles = [];
+  for (let column = 0; column < columns; column += 1) {
+    for (let row = 0; row < rows; row += 1) {
+      const x = Math.min(column * input.viewportwidth, Math.max(0, input.scrollwidth - input.viewportwidth));
+      const y = rows === 1 ? 0 : Math.min(row * stepy, Math.max(0, input.scrollheight - input.viewportheight));
+      tiles.push({ x: Math.round(x), y: Math.round(y) });
+    }
+  }
+  return { columns, rows, tiles, overlap, scrollwidth: Math.round(input.scrollwidth), scrollheight: Math.round(input.scrollheight), viewportwidth: Math.round(input.viewportwidth), viewportheight: Math.round(input.viewportheight) };
+}
+function seamweights(overlap) {
+  if (overlap <= 0) return [];
+  const weights = [];
+  for (let index = 0; index < overlap; index += 1) weights.push((index + 1) / (overlap + 1));
+  return weights;
+}
+function fixedheadermatch(band, firstband) {
+  if (band.length === 0 || band.length !== firstband.length) return false;
+  return band.every((value, index) => value === firstband[index]);
+}
+function scaledrect(rect, pixelratio) {
+  const ratio = pixelratio >= 1 ? pixelratio : 1;
+  return { x: Math.round(rect.x * ratio), y: Math.round(rect.y * ratio), width: Math.round(rect.width * ratio), height: Math.round(rect.height * ratio) };
+}
+function croprect(rect, viewport) {
+  const x = Math.max(0, rect.x);
+  const y = Math.max(0, rect.y);
+  return { x: Math.round(x), y: Math.round(y), width: Math.round(Math.max(0, Math.min(rect.width, viewport.width - x))), height: Math.round(Math.max(0, Math.min(rect.height, viewport.height - y))) };
+}
+function regionsteps(containerheight, viewportstep) {
+  if (containerheight <= 0 || viewportstep <= 0) return [0];
+  const steps = [];
+  for (let top = 0; top < containerheight; top += viewportstep) {
+    const clamped = Math.min(top, Math.max(0, containerheight - viewportstep));
+    if (!steps.includes(clamped)) steps.push(clamped);
+  }
+  return steps;
+}
+function buildsheet(cells, layout) {
+  const columns = Math.max(1, Math.round(layout.columns));
+  const rows = Math.max(1, Math.ceil(cells.length / columns));
+  const placed = cells.map((cell, index) => {
+    const column = index % columns;
+    const row = Math.floor(index / columns);
+    const label = cell.label ?? "";
+    const caption = layout.label === "none" ? "" : layout.label === "index" ? `${index + 1}` : layout.label === "selector" ? cell.selector : label ? `${index + 1} \xB7 ${cell.selector} \xB7 ${label}` : `${index + 1} \xB7 ${cell.selector}`;
+    return { index, column, row, selector: cell.selector, label, caption };
+  });
+  return { columns, rows, cells: placed };
+}
+function capturepart(value) {
+  return value.replace(/[^a-z0-9-]+/gi, "-").replace(/^-+|-+$/g, "").toLowerCase() || "capture";
+}
+function buildname(rule, parts, extension) {
+  const segments = [];
+  if (rule.run) segments.push(capturepart(parts.run));
+  if (rule.step) segments.push(capturepart(parts.step));
+  if (rule.sequence) segments.push(String(Math.max(0, Math.round(parts.sequence))));
+  if (rule.kind) segments.push(capturepart(parts.kind));
+  const safeextension = extension.replace(/^\.+/, "").toLowerCase() || "png";
+  return `${(segments.length > 0 ? segments : ["capture"]).join("-")}.${safeextension}`;
+}
+function annotationplanof(input) {
+  const inset = Math.min(24, Math.max(8, Math.round(Math.min(input.width, input.height) / 12)));
+  const plan = {
+    marker: { x: inset, y: inset, number: Math.max(1, Math.round(input.step)) },
+    footer: `${new Date(input.at).toISOString()} \xB7 ${input.url}`
+  };
+  if (input.rect !== void 0) {
+    const expansion = 2;
+    plan.outline = { x: Math.round(input.rect.x - expansion), y: Math.round(input.rect.y - expansion), width: Math.round(input.rect.width + expansion * 2), height: Math.round(input.rect.height + expansion * 2) };
+  }
+  return plan;
+}
 
 // extension/browsertabs.ts
 var browserkinds = /* @__PURE__ */ new Set(["tablist", "tabcreate", "tabactivate", "tabclose", "tabreload", "tabsnapshot", "windowlist", "windowcreate", "windowclose", "zoomset", "windowresize", "downloadfile"]);
@@ -2002,13 +2572,13 @@ function presshold(holds, hold) {
   return { holds: [...holds, hold], ok: true };
 }
 function releasehold(holds, holdid, releasedat) {
-  let released;
+  let released2;
   const next = holds.map((hold) => {
     if (hold.holdid !== holdid || hold.releasedat !== void 0) return hold;
-    released = { ...hold, releasedat };
-    return released;
+    released2 = { ...hold, releasedat };
+    return released2;
   });
-  return { holds: next, ...released ? { released } : {} };
+  return { holds: next, ...released2 ? { released: released2 } : {} };
 }
 function heldkeys(holds, tabid2) {
   return holds.filter((hold) => hold.releasedat === void 0 && (tabid2 === void 0 || hold.tabid === void 0 || hold.tabid === tabid2));
@@ -2691,6 +3261,153 @@ function mergetaskrules(existing, taskid, transforms, dedupekeys, at) {
   };
 }
 
+// extension/filescommand.ts
+var downloadtransitions = {
+  queued: ["running", "complete", "failed"],
+  running: ["paused", "complete", "failed"],
+  paused: ["running", "failed"],
+  complete: [],
+  failed: []
+};
+function transitionallowed(from, to) {
+  return downloadtransitions[from].includes(to);
+}
+function advancedownload(record2, state, at, evidence) {
+  if (!transitionallowed(record2.state, state)) return record2;
+  return {
+    ...record2,
+    state,
+    ...evidence?.path !== void 0 ? { path: evidence.path } : record2.path !== void 0 ? { path: record2.path } : {},
+    ...evidence?.bytes !== void 0 ? { bytes: evidence.bytes } : record2.bytes !== void 0 ? { bytes: record2.bytes } : {},
+    ...evidence?.checksum !== void 0 ? { checksum: evidence.checksum } : record2.checksum !== void 0 ? { checksum: record2.checksum } : {},
+    ...evidence?.downloadid !== void 0 ? { downloadid: evidence.downloadid } : record2.downloadid !== void 0 ? { downloadid: record2.downloadid } : {},
+    updatedat: at
+  };
+}
+function concurrentwindow(running, ceiling) {
+  return ceiling === void 0 || running < ceiling;
+}
+function conflictfree(filename, taken) {
+  if (!taken.includes(filename)) return filename;
+  const dot = filename.lastIndexOf(".");
+  const base = dot > 0 ? filename.slice(0, dot) : filename;
+  const extension = dot > 0 ? filename.slice(dot) : "";
+  let sequence = 2;
+  while (taken.includes(`${base}-${sequence}${extension}`)) sequence += 1;
+  return `${base}-${sequence}${extension}`;
+}
+function downloadfilename(url, rule) {
+  if (rule && rule.trim()) return rule.trim();
+  let name = "";
+  try {
+    const parsed = new URL(url);
+    name = decodeURIComponent(parsed.pathname.split("/").filter(Boolean).pop() ?? parsed.hostname);
+  } catch {
+    name = url;
+  }
+  return name || "download";
+}
+function verifybytes(record2, expected) {
+  const statematch = record2.state === "complete";
+  const sizematch = expected.bytes === void 0 ? true : record2.bytes === expected.bytes;
+  const checksummatch = expected.checksum === void 0 ? true : record2.checksum === expected.checksum;
+  const ok = statematch && sizematch && checksummatch;
+  const parts = [`state ${record2.state}${statematch ? " matches" : " does not match the completed expectation"}`];
+  if (expected.bytes !== void 0) parts.push(`size ${record2.bytes ?? "unknown"} of ${expected.bytes} bytes ${sizematch ? "matches" : "differs"}`);
+  if (expected.checksum !== void 0) parts.push(`checksum ${record2.checksum ?? "unknown"} ${checksummatch ? "matches" : "differs from"} the reviewed ${expected.checksum}`);
+  return { ok, summary: `${ok ? "Verified" : "Failed to verify"} the download of ${record2.filename}: ${parts.join("; ")}.`, matches: { state: statematch, size: sizematch, checksum: checksummatch } };
+}
+function mimepatternmatches(pattern, mime) {
+  if (!pattern.endsWith("*")) return pattern === mime;
+  return mime.startsWith(pattern.slice(0, -1));
+}
+function mimeallowed(filter, mime) {
+  if (filter.exclude.some((pattern) => mimepatternmatches(pattern, mime))) return false;
+  if (filter.include.some((pattern) => mimepatternmatches(pattern, mime))) return true;
+  return filter.default === "allow";
+}
+function redactheaders(headers) {
+  return Object.fromEntries(Object.entries(headers).map(([name]) => [name, "[redacted]"]));
+}
+function netlogentry(input) {
+  return { url: input.url, method: input.method, status: input.status, timing: input.timing, requestid: input.requestid, stepid: input.stepid, at: input.at };
+}
+function netlogforstep(records, stepid) {
+  return records.filter((record2) => record2.stepid === stepid);
+}
+function clipentryof(kind, payload, origin, stepid, at) {
+  return { kind, hash: payload.hash, length: payload.length, origin, stepid, at };
+}
+function cliphash(payload) {
+  return checksum(payload);
+}
+function quarantinedpath(filename) {
+  return `devthink-quarantine/${filename.replace(/^\/+/, "")}`;
+}
+function newquarantine(id, filename, reason, at) {
+  const path = quarantinedpath(filename);
+  return { id, path, reason, scan: "pending", at, updatedat: at };
+}
+function scanresult(entry, verdict, at) {
+  return { ...entry, scan: verdict, updatedat: at };
+}
+function scanverdictof(response) {
+  if (!response || typeof response !== "object") return "pending";
+  const verdict = response.verdict;
+  if (verdict === "clean" || verdict === "flagged" || verdict === "error") return verdict;
+  return "pending";
+}
+function released(entry, ref, at) {
+  return { ...entry, release: ref, updatedat: at };
+}
+function capturepart2(value) {
+  return value.replace(/[^a-z0-9-]+/gi, "-").replace(/^-+|-+$/g, "").toLowerCase() || "capture";
+}
+function capturefilename(name, extension) {
+  const safeextension = extension.replace(/^\.+/, "").toLowerCase() || "png";
+  return `${capturepart2(name.task)}-${capturepart2(name.step)}-${name.sequence}.${safeextension}`;
+}
+function advancecounter(counters, base) {
+  const sequence = (counters[base] ?? 0) + 1;
+  return { sequence, counters: { ...counters, [base]: sequence } };
+}
+function capturenames(counters, task, steps, extension) {
+  let current = { ...counters };
+  const names = steps.map((step) => {
+    const advanced = advancecounter(current, step);
+    current = advanced.counters;
+    return capturefilename({ task, step, sequence: advanced.sequence }, extension);
+  });
+  return { names, counters: current };
+}
+function referencedartifacts(plan, completed) {
+  if (!plan) return [];
+  return plan.steps.filter((step) => step.kind === "attachfile" && !completed.includes(step.id)).map((step) => step.value ?? "").filter((value) => value.trim().length > 0);
+}
+function sweepplan(entries, rules, now, keeprefs) {
+  const remove = /* @__PURE__ */ new Set();
+  for (const rule of rules) {
+    const matching = entries.filter((entry) => rule.kind === "any" || entry.kind === rule.kind);
+    const aged = matching.filter((entry) => now - entry.at >= rule.age);
+    const kept = [];
+    if (rule.keep === "all") kept.push(...aged);
+    else if (rule.keep === "latest") {
+      const newest = [...aged].sort((left, right) => right.at - left.at)[0];
+      if (newest) kept.push(newest);
+    }
+    for (const entry of aged) {
+      if (kept.some((item) => item.id === entry.id)) continue;
+      if (keeprefs.includes(entry.id) || keeprefs.includes(entry.name)) continue;
+      remove.add(entry.id);
+    }
+  }
+  return { remove: [...remove], keep: entries.filter((entry) => !remove.has(entry.id)).map((entry) => entry.id) };
+}
+function capturesteps(options, plan) {
+  const listed = Array.isArray(options.steps) ? options.steps.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  return listed.length > 0 ? listed : plan.steps.map((step) => step.id);
+}
+
 // extension/background.ts
 var sessionduration = 15 * 60 * 1e3;
 var freshcheckkinds = /* @__PURE__ */ new Set(["focus", "inspect", "click", "type", "scroll", "select", "hover"]);
@@ -2727,8 +3444,9 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  await memory.setcapabilities(report);
-  return report;
+  const withcaptures = { ...report, captures: [...capturekinds] };
+  await memory.setcapabilities(withcaptures);
+  return withcaptures;
 }
 async function activecontext() {
   const [tab] = await chrome.tabs.query({ active: true, lastFocusedWindow: true });
@@ -2881,6 +3599,15 @@ function stepauditkind(step, ok) {
   if (step.kind === "submitform" || step.kind === "asksubmit") return "submit";
   if (step.kind === "consentpassword") return "consent";
   if (step.kind === "handoffcaptcha") return "handoff";
+  if (iscapturekind(step.kind)) return "capture";
+  if (isfileskind(step.kind)) {
+    if (step.kind === "interceptmime") return "intercept";
+    if (step.kind === "readclipboard" || step.kind === "writeclipboard" || step.kind === "copyscreen") return "clipboard";
+    if (step.kind === "quarantinedownload" || step.kind === "scanvirus") return "quarantine";
+    if (step.kind === "cleanupartifacts") return "cleanup";
+    if (step.kind === "verifydownload" || step.kind === "exportnetlog" || step.kind === "namecaptures") return "observation";
+    return "download";
+  }
   if (isdatasetkind(step.kind)) {
     if (step.kind === "exportcsv" || step.kind === "exportjson" || step.kind === "exportexcel" || step.kind === "copytable" || step.kind === "pushsheets") return "export";
     if (step.kind === "streamdisk") return "stream";
@@ -3190,8 +3917,18 @@ async function recordnavigation(step, session, tabid2) {
   await memory.addnavrecord(record2);
   await memory.setnavstate(tabid2, record2);
   if (session && url) await memory.addtrailentry(session.id, { url, title, stepid: step.id, at: Date.now() });
+  await collectnetlog(tabid2, step);
   return record2;
 }
+async function collectnetlog(tabid2, step) {
+  const events = navbuffers.get(tabid2) ?? [];
+  if (events.length === 0) return;
+  const first = events[0]?.timestamp ?? Date.now();
+  for (const [index, event] of events.entries()) {
+    const status = event.status ?? (event.event === "completed" ? 200 : event.event === "error" ? 0 : 0);
+    await memory.addnetlog(netlogentry({ url: event.url, method: "GET", status, timing: Math.max(0, event.timestamp - first), requestid: `${step.id}-${index + 1}`, stepid: step.id, at: event.timestamp }));
+  }
+}
 function injectallowedorigins(step, session) {
   const allowedorigins = session?.grants ?? (session ? [session.origin] : []);
   let options = {};
@@ -4284,6 +5021,638 @@ async function executedatastep(step, session, plan, tabid2, origin) {
       return { ok: false, summary: "Unsupported forms and data step." };
   }
 }
+async function loadownload(reference) {
+  const records = await memory.getdownloads();
+  return records.find((item) => item.id === reference || item.filename === reference || item.url === reference);
+}
+async function settlesdownload(record2) {
+  const started = Date.now();
+  for (; ; ) {
+    const items = record2.downloadid === void 0 ? [] : await chrome.downloads.search({ id: record2.downloadid }).catch(() => []);
+    const item = items[0];
+    if (item?.state === "complete") return { state: "complete", evidence: { path: item.filename, bytes: item.fileSize ?? item.totalBytes ?? 0 } };
+    if (item?.state === "interrupted") return { state: "failed" };
+    if (Date.now() - started >= evidencesettle) return { state: "running" };
+    await new Promise((resolve) => setTimeout(resolve, evidencepoll));
+  }
+}
+async function pauseonerecord(record2, extra) {
+  if (!transitionallowed(record2.state, "paused")) throw new Error(`A ${record2.state} download cannot pause.`);
+  if (record2.downloadid !== void 0) await chrome.downloads.pause(record2.downloadid).catch(() => void 0);
+  const paused = advancedownload(record2, "paused", Date.now());
+  await memory.setdownload(paused);
+  await audit("download", `Paused the download of ${record2.filename} from ${record2.url}.`, extra);
+  return { ok: true, summary: `Paused the download of ${record2.filename}.`, details: { download: paused } };
+}
+async function resumeonerecord(record2, extra) {
+  if (!transitionallowed(record2.state, "running")) throw new Error(`A ${record2.state} download cannot resume.`);
+  if (record2.downloadid !== void 0) await chrome.downloads.resume(record2.downloadid).catch(() => void 0);
+  const resumed = advancedownload(record2, "running", Date.now());
+  await memory.setdownload(resumed);
+  await audit("download", `Resumed the paused download of ${record2.filename} from ${record2.url}.`, extra);
+  return { ok: true, summary: `Resumed the download of ${record2.filename}.`, details: { download: resumed } };
+}
+async function verifyonerecord(record2, expected, extra) {
+  const verification = verifybytes(record2, expected);
+  await audit("observation", `Verified the download of ${record2.filename}: ${verification.summary}`, extra);
+  return { ok: verification.ok, summary: verification.summary, details: { verification: { ...verification.matches, state: record2.state, path: record2.path, checksum: record2.checksum, bytes: record2.bytes } } };
+}
+async function executefilesstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  switch (step.kind) {
+    case "batchdownload": {
+      const spec = options.downloadspec;
+      const urls = Array.isArray(spec?.urls) ? (spec?.urls).filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+      const concurrent = typeof options.concurrent === "number" && Number.isInteger(options.concurrent) && options.concurrent > 0 ? options.concurrent : void 0;
+      const taken = (await memory.getdownloads()).map((record2) => record2.filename);
+      const records = urls.map((url) => {
+        const filename = conflictfree(downloadfilename(url, spec?.filename), taken);
+        taken.push(filename);
+        return { id: randomid(), url, filename, state: "queued", at: Date.now(), updatedat: Date.now() };
+      });
+      let completed = 0;
+      let failed = 0;
+      let queued = 0;
+      let index = 0;
+      while (index < records.length) {
+        const wave = [];
+        while (index < records.length && concurrentwindow(wave.length, concurrent)) {
+          const record2 = records[index];
+          index += 1;
+          const downloadid = await chrome.downloads.download({ url: record2.url, filename: record2.filename }).catch(() => void 0);
+          const started = downloadid === void 0 ? advancedownload(record2, "failed", Date.now()) : advancedownload(record2, "running", Date.now(), { downloadid });
+          await memory.setdownload(started);
+          wave.push(started);
+        }
+        for (const started of wave) {
+          if (started.state === "failed") {
+            failed += 1;
+            continue;
+          }
+          const settled = await settlesdownload(started);
+          const final = advancedownload(started, settled.state, Date.now(), settled.evidence);
+          await memory.setdownload(final);
+          if (final.state === "complete") completed += 1;
+          else if (final.state === "failed") failed += 1;
+          else queued += 1;
+          await memory.setprogress(recorddownload(await memory.getprogress(), plan.id, step.id, { index: records.indexOf(started), url: started.url, state: final.state }, Date.now()));
+        }
+      }
+      await refreshbadge();
+      await audit("download", `Batch downloaded ${records.length} reviewed file${records.length === 1 ? "" : "s"}${concurrent !== void 0 ? ` under the user configured concurrent window of ${concurrent}` : ""}: ${completed} completed, ${failed} failed${queued > 0 ? `, ${queued} still running` : ""}.`, extra);
+      return { ok: failed === 0, summary: `Batch downloaded ${records.length} file${records.length === 1 ? "" : "s"}: ${completed} completed, ${failed} failed${queued > 0 ? `, ${queued} still running` : ""}.`, details: { downloads: records, completed, failed, running: queued, total: records.length, share: downloadshare(completed, records.length), concurrent } };
+    }
+    case "pausedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return pauseonerecord(record2, extra);
+    }
+    case "resumedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return resumeonerecord(record2, extra);
+    }
+    case "verifydownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      return verifyonerecord(record2, { ...typeof options.bytes === "number" ? { bytes: options.bytes } : {}, ...typeof options.checksum === "string" ? { checksum: options.checksum } : {} }, extra);
+    }
+    case "interceptmime": {
+      const filter = options.mimefilter;
+      if (!filter) throw new Error("A reviewed mimefilter is required in options.");
+      const filters = await memory.getmimefilters();
+      await memory.setmimefilters([filter, ...filters]);
+      armedmimefilter = filter;
+      installmimelistener();
+      await audit("intercept", `Armed the reviewed mime interception filter: include ${filter.include.join(", ")}, exclude ${filter.exclude.join(", ") || "none"} and the ${filter.default} default for unlisted mime types; matching downloads reroute into quarantine.`, extra);
+      return { ok: true, summary: `Armed the mime interception filter with the ${filter.default} default for unlisted mime types.`, details: { mimefilter: filter } };
+    }
+    case "exportnetlog": {
+      const records = await memory.getnetlog();
+      const stepfilter = typeof options.stepid === "string" && options.stepid ? options.stepid : void 0;
+      const filtered = (stepfilter ? netlogforstep(records, stepfilter) : records).map((record2) => ({ ...record2, headers: redactheaders(record2.headers ?? {}) }));
+      await audit("observation", `Exported ${filtered.length} netlog record${filtered.length === 1 ? "" : "s"} of the run${stepfilter ? ` correlated with step ${stepfilter}` : ""} with every header value redacted.`, extra);
+      return { ok: true, summary: `Exported ${filtered.length} netlog record${filtered.length === 1 ? "" : "s"} with header values redacted.`, details: { netlog: filtered, count: filtered.length, redacted: true, redaction: "every header value is redacted from exported netlogs" } };
+    }
+    case "readclipboard": {
+      const consentref = typeof options.consentref === "string" ? options.consentref : "";
+      const consents = await memory.getclipconsents();
+      const consent = consents.find((item) => item.id === consentref && item.approved === true && item.usedat === void 0);
+      if (!consent) {
+        const pending = { id: consentref || randomid(), prompt: typeof options.prompt === "string" && options.prompt ? options.prompt : step.summary, origin, stepid: step.id, at: Date.now() };
+        await memory.setclipconsent(pending);
+        await refreshbadge();
+        await audit("clipboard", `Clipboard read consent prompt ${pending.id} opened for step ${step.id} on ${origin}; the read waits for the user approval and every read needs its own prompt.`, extra);
+        return { ok: false, summary: `The clipboard read waits for your consent approval${consentref ? ` under ref ${consentref}` : ""}; approve it in the review panel and run the step again.`, details: { consent: { id: pending.id, prompt: pending.prompt, origin, stepid: step.id, approved: false } } };
+      }
+      const text2 = await navigator.clipboard.readText();
+      const entry = clipentryof("read", { hash: cliphash(text2), length: text2.length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await memory.setclipconsent({ ...consent, usedat: Date.now() });
+      await refreshbadge();
+      await audit("clipboard", `Read ${entry.length} clipboard character${entry.length === 1 ? "" : "s"} on the approved consent ${consent.id} with payload hash ${entry.hash}; the payload text never appears in logs or memory.`, extra);
+      return { ok: true, summary: `Read ${entry.length} clipboard character${entry.length === 1 ? "" : "s"} on the approved consent ${consent.id} with payload hash ${entry.hash}.`, details: { clip: entry, masked: maskclipboard(text2) } };
+    }
+    case "writeclipboard": {
+      const output = await dispatchpagestep(step, tabid2, origin, plan);
+      const hash = typeof output?.details?.hash === "string" ? output.details.hash : cliphash(step.value ?? "");
+      const length = typeof output?.details?.length === "number" ? output.details.length : (step.value ?? "").length;
+      const entry = clipentryof("write", { hash, length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await audit("clipboard", `Wrote ${length} reviewed character${length === 1 ? "" : "s"} to the clipboard with payload hash ${hash}; the payload text never appears in logs or memory.`, extra);
+      return { ok: Boolean(output?.ok), summary: output?.summary ?? "The clipboard write returned no result.", details: { ...output?.details ?? {}, clip: entry } };
+    }
+    case "copyscreen": {
+      const windowid = chrome.windows.WINDOW_ID_CURRENT;
+      const shot = await chrome.tabs.captureVisibleTab(windowid, { format: "png" });
+      let destination = "clipboard";
+      try {
+        const blob = await (await fetch(shot)).blob();
+        await navigator.clipboard.write([new ClipboardItem({ "image/png": blob })]);
+      } catch {
+        destination = "clipboard unavailable";
+      }
+      const entry = clipentryof("screen", { hash: cliphash(shot), length: shot.length }, origin, step.id, Date.now());
+      await memory.addclip(entry);
+      await audit("clipboard", `Copied a screenshot of the visible tab (${entry.length} characters of png data) to the clipboard with payload hash ${entry.hash}; destination ${destination}.`, extra);
+      return { ok: destination === "clipboard", summary: `Copied the visible tab screenshot with payload hash ${entry.hash} to the clipboard.`, details: { clip: entry, destination } };
+    }
+    case "quarantinedownload": {
+      const record2 = await loadownload(step.value ?? "");
+      if (!record2) throw new Error(`No stored download matches ${step.value ?? ""}.`);
+      const reason = typeof options.reason === "string" && options.reason ? options.reason : `moved from ${record2.url} by the reviewed quarantine step`;
+      const entry = newquarantine(randomid(), record2.path ?? record2.filename, reason, Date.now());
+      await memory.setquarantine(entry);
+      await refreshbadge();
+      await audit("quarantine", `Quarantined the download ${record2.filename} outside the downloads folder at ${entry.path} with reason ${reason}; the file stays there until a clean scan verdict releases it.`, extra);
+      return { ok: true, summary: `Quarantined ${record2.filename} at ${entry.path} with a pending scan verdict.`, details: { quarantine: entry } };
+    }
+    case "scanvirus": {
+      const reference = step.value ?? "";
+      const entry = (await memory.getquarantines()).find((item) => item.id === reference || item.path === reference);
+      if (!entry) throw new Error(`No quarantined file matches ${reference}.`);
+      const scanner = typeof options.scanner === "string" && options.scanner ? options.scanner : void 0;
+      const hooks = await memory.getscanhooks();
+      const hook = scanner ? hooks.find((item) => item.scanner === scanner) : hooks[0];
+      let verdict = "pending";
+      if (hook) {
+        const granted = await chrome.permissions.contains({ origins: [hostpattern(hook.origin)] }).catch(() => false);
+        if (granted) {
+          try {
+            const response = await fetch(hook.endpoint, { method: "POST", headers: { "content-type": "application/json" }, credentials: "omit", body: JSON.stringify({ quarantine: entry.id, path: entry.path, reason: entry.reason }) });
+            verdict = scanverdictof(await response.json().catch(() => void 0));
+          } catch {
+            verdict = "pending";
+          }
+        }
+      }
+      const scanned = scanresult(entry, verdict, Date.now());
+      await memory.setquarantine(scanned);
+      await refreshbadge();
+      await audit("quarantine", `Scan hook ${hook ? hook.scanner : scanner ?? "none configured"} ${hook ? `returned the ${verdict} verdict` : "is not configured or granted; the verdict stays pending"} for the quarantined file ${entry.path}; hook failures never release a file.`, extra);
+      return { ok: true, summary: `Scan verdict ${verdict} recorded for ${entry.path}.`, details: { quarantine: scanned, verdict } };
+    }
+    case "namecaptures": {
+      const task = typeof options.task === "string" && options.task ? options.task : plan.id;
+      const steps = capturesteps(options, plan);
+      const extension = typeof options.extension === "string" && options.extension ? options.extension : "png";
+      const existing = (await memory.getcapturecounters()).find((item) => item.taskid === task);
+      const stamped = capturenames(existing?.counters ?? {}, task, steps, extension);
+      await memory.setcapturecounter({ taskid: task, counters: stamped.counters, at: Date.now() });
+      await audit("observation", `Stamped ${stamped.names.length} consistent capture name${stamped.names.length === 1 ? "" : "s"} for task ${task} from task, step and sequence parts.`, extra);
+      return { ok: true, summary: `Stamped ${stamped.names.length} capture name${stamped.names.length === 1 ? "" : "s"} for task ${task}.`, details: { task, names: stamped.names, counters: stamped.counters } };
+    }
+    case "cleanupartifacts": {
+      const inlinrules = (Array.isArray(options.rules) ? options.rules : []).filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item));
+      const rules = inlinrules.length > 0 ? inlinrules : await memory.getcleanuprules();
+      if (rules.length === 0) throw new Error("No reviewed cleanup rules are present; pass rules in options or store a rule set from the review panel.");
+      if (inlinrules.length > 0) await memory.setcleanuprules(inlinrules);
+      const exportrecords = await memory.getexports();
+      const artifacts = await memory.getartifacts();
+      const inventory = [
+        ...exportrecords.map((artifact) => ({ id: artifact.id, kind: `export-${artifact.kind}`, name: artifact.name, size: artifact.content.length, at: artifact.at })),
+        ...artifacts.map((artifact) => ({ id: artifact.id, kind: artifact.kind, name: artifact.name, size: 0, at: artifact.at }))
+      ];
+      await memory.setinventory(inventory);
+      const progress = await memory.getprogress();
+      const keeprefs = referencedartifacts(plan, progress?.planid === plan.id ? progress.completedsteps : []);
+      const sweep = sweepplan(inventory, rules, Date.now(), keeprefs);
+      let removed = 0;
+      for (const id of sweep.remove) {
+        if (await memory.removeexport(id)) removed += 1;
+        else if (await memory.removeartifact(id)) removed += 1;
+      }
+      const run = { id: randomid(), rules: rules.length, removed, kept: sweep.keep.length, at: Date.now() };
+      await memory.addcleanuprun(run);
+      await refreshbadge();
+      await audit("cleanup", `Cleanup sweep applied ${rules.length} reviewed rule${rules.length === 1 ? "" : "s"} by age and kind: removed ${removed} artifact${removed === 1 ? "" : "s"}, kept ${sweep.keep.length}${keeprefs.length > 0 ? ` while holding every artifact referenced by open review cards` : ""}.`, extra);
+      return { ok: true, summary: `Cleanup sweep removed ${removed} artifact${removed === 1 ? "" : "s"} and kept ${sweep.keep.length} under the reviewed rules.`, details: { run: { id: run.id, rules: run.rules, removed: run.removed, kept: run.kept }, remove: sweep.remove, inventory: inventory.length } };
+    }
+    default:
+      return { ok: false, summary: "Unsupported files, clipboard and downloads step." };
+  }
+}
+var armedmimefilter;
+var mimelistenerinstalled = false;
+function installmimelistener() {
+  if (mimelistenerinstalled || typeof chrome.downloads?.onDeterminingFilename?.addListener !== "function") return;
+  mimelistenerinstalled = true;
+  chrome.downloads.onDeterminingFilename.addListener((item, suggest) => {
+    const filter = armedmimefilter;
+    if (!filter || item.byExtensionId === chrome.runtime.id) {
+      suggest({ filename: item.filename, conflictAction: "uniquify" });
+      return;
+    }
+    const mime = item.mime ?? "";
+    if (mimeallowed(filter, mime)) {
+      suggest({ filename: `devthink-quarantine/${item.filename}`, conflictAction: "uniquify" });
+      void memory.setquarantine(newquarantine(randomid(), item.filename, `mime ${mime || "unknown"} matched the reviewed include patterns`, Date.now())).then(() => audit("intercept", `Intercepted the download of ${item.filename} (${mime || "unknown mime"}) into quarantine under the reviewed mime filter.`, {})).catch(() => void 0);
+      return;
+    }
+    if (filter.default === "deny") {
+      void chrome.downloads.cancel(item.id).catch(() => void 0);
+      void audit("intercept", `Denied the unlisted download of ${item.filename} (${mime || "unknown mime"}) under the deny default of the reviewed mime filter.`, {}).catch(() => void 0);
+    }
+    suggest({ filename: item.filename, conflictAction: "uniquify" });
+  });
+}
+installmimelistener();
+async function reconcilmimefilter() {
+  const filters = await memory.getmimefilters();
+  armedmimefilter = filters[0];
+  installmimelistener();
+}
+reconcilmimefilter().catch(() => {
+});
+var stitchprogress = /* @__PURE__ */ new Map();
+function stepcaptureoptions(step) {
+  return captureoptionsof(stepoptions2(step).capture);
+}
+async function blobtodataurl(blob) {
+  const buffer = new Uint8Array(await blob.arrayBuffer());
+  let binary = "";
+  const chunk = 32768;
+  for (let index = 0; index < buffer.length; index += chunk) binary += String.fromCharCode(...buffer.subarray(index, index + chunk));
+  return `data:${blob.type};base64,${btoa(binary)}`;
+}
+async function tabshot(format, quality) {
+  const shot = { format: format === "jpeg" ? "jpeg" : "png" };
+  if (format === "jpeg" && quality !== void 0) shot.quality = Math.max(0, Math.min(100, Math.round(quality)));
+  return chrome.tabs.captureVisibleTab(chrome.windows.WINDOW_ID_CURRENT, shot);
+}
+async function bridgecall(tabid2, name, ...args) {
+  await chrome.scripting.executeScript({ target: { tabId: tabid2 }, files: ["pagebridge.js"] });
+  const result = await chrome.scripting.executeScript({ target: { tabId: tabid2 }, func: (bridgeName, bridgeArgs) => {
+    const bridge = globalThis.devthinkbridge;
+    if (!bridge) throw new Error("Devthink page bridge is unavailable.");
+    const seam = bridge[bridgeName];
+    if (typeof seam !== "function") throw new Error(`The page bridge has no ${bridgeName} capture seam.`);
+    return seam(...bridgeArgs);
+  }, args: [name, args] });
+  return result[0]?.result;
+}
+function tileband(bitmap, rows) {
+  if (rows <= 0 || bitmap.height <= 0) return [];
+  const canvas = new OffscreenCanvas(bitmap.width, Math.min(rows, bitmap.height));
+  const context = canvas.getContext("2d");
+  if (!context) return [];
+  context.drawImage(bitmap, 0, 0);
+  const data = context.getImageData(0, 0, canvas.width, canvas.height).data;
+  const band = [];
+  const pixels = canvas.width * canvas.height;
+  const stride = Math.max(1, Math.floor(pixels / 64));
+  for (let pixel = 0; pixel < pixels; pixel += stride) {
+    const index = pixel * 4;
+    band.push((data[index] ?? 0) + (data[index + 1] ?? 0) * 256 + (data[index + 2] ?? 0) * 65536 + (data[index + 3] ?? 0) * 16777216);
+  }
+  return band;
+}
+function drawannotations(context, plan, width, height, ratio) {
+  context.save();
+  context.scale(ratio, ratio);
+  context.fillStyle = "rgba(47,128,237,.92)";
+  context.beginPath();
+  context.arc(plan.marker.x, plan.marker.y, 14, 0, Math.PI * 2);
+  context.fill();
+  context.fillStyle = "#ffffff";
+  context.font = "bold 14px sans-serif";
+  context.textBaseline = "middle";
+  context.textAlign = "center";
+  context.fillText(String(plan.marker.number), plan.marker.x, plan.marker.y);
+  if (plan.outline !== void 0) {
+    context.strokeStyle = "#2f80ed";
+    context.lineWidth = 2;
+    context.strokeRect(plan.outline.x, plan.outline.y, plan.outline.width, plan.outline.height);
+  }
+  const footery = Math.max(12, height - 22);
+  context.fillStyle = "rgba(23,32,44,.86)";
+  context.fillRect(0, footery, width, 22);
+  context.fillStyle = "#ffffff";
+  context.font = "12px sans-serif";
+  context.textAlign = "left";
+  context.fillText(plan.footer.slice(0, 160), 8, footery + 11);
+  context.restore();
+}
+async function canvasdataurl(canvas, format, quality) {
+  const type = format === "jpeg" ? "image/jpeg" : format === "webp" ? "image/webp" : "image/png";
+  const encoded = format === "png" ? await canvas.convertToBlob({ type }) : await canvas.convertToBlob({ type, quality: Math.max(0, Math.min(1, (quality ?? 100) / 100)) });
+  return blobtodataurl(encoded);
+}
+async function composestitched(tiles, width, height, overlap, ratio, options) {
+  const canvas = new OffscreenCanvas(Math.max(1, Math.round(width * ratio)), Math.max(1, Math.round(height * ratio)));
+  const context = canvas.getContext("2d");
+  if (!context) throw new Error("The stitcher could not create a canvas context.");
+  const weights = seamweights(overlap);
+  const firstband = overlap > 0 && tiles[0] ? tileband(tiles[0].bitmap, overlap) : [];
+  for (const tile of tiles) {
+    const band = overlap > 0 ? tileband(tile.bitmap, overlap) : [];
+    const repeated = overlap > 0 && !tile.firstofcolumn && fixedheadermatch(band, firstband);
+    if (repeated) {
+      const skipped = Math.min(overlap, tile.bitmap.height);
+      context.drawImage(tile.bitmap, 0, skipped, tile.bitmap.width, tile.bitmap.height - skipped, tile.x, tile.y + skipped, tile.bitmap.width, tile.bitmap.height - skipped);
+      continue;
+    }
+    if (weights.length > 0 && !tile.firstofcolumn) {
+      for (let row = 0; row < weights.length && row < tile.bitmap.height; row += 1) {
+        context.globalAlpha = weights[row] ?? 1;
+        context.drawImage(tile.bitmap, 0, row, tile.bitmap.width, 1, tile.x, tile.y + row, tile.bitmap.width, 1);
+      }
+      context.globalAlpha = 1;
+      const below = Math.min(overlap, tile.bitmap.height);
+      context.drawImage(tile.bitmap, 0, below, tile.bitmap.width, tile.bitmap.height - below, tile.x, tile.y + below, tile.bitmap.width, tile.bitmap.height - below);
+      continue;
+    }
+    context.drawImage(tile.bitmap, tile.x, tile.y);
+  }
+  if (options.annotate) drawannotations(context, options.annotate, width, height, ratio);
+  return canvasdataurl(canvas, options.format, options.quality);
+}
+async function decodeTile(dataurl, x, y, firstofcolumn) {
+  const blob = await (await fetch(dataurl)).blob();
+  return { bitmap: await createImageBitmap(blob), x, y, firstofcolumn };
+}
+async function croptoRect(dataurl, rect, ratio, options) {
+  const blob = await (await fetch(dataurl)).blob();
+  const bitmap = await createImageBitmap(blob);
+  const canvas = new OffscreenCanvas(Math.max(1, Math.round(rect.width * ratio)), Math.max(1, Math.round(rect.height * ratio)));
+  const context = canvas.getContext("2d");
+  if (!context) throw new Error("The crop could not create a canvas context.");
+  context.drawImage(bitmap, rect.x, rect.y, rect.width, rect.height, 0, 0, canvas.width, canvas.height);
+  if (options.annotate) drawannotations(context, options.annotate, rect.width, rect.height, ratio);
+  return canvasdataurl(canvas, options.format, options.quality);
+}
+async function encodecanvas(width, height, draw, options) {
+  const canvas = new OffscreenCanvas(Math.max(1, Math.round(width)), Math.max(1, Math.round(height)));
+  const context = canvas.getContext("2d");
+  if (!context) throw new Error("The capture canvas could not create a context.");
+  await draw(context);
+  if (options.annotate) drawannotations(context, options.annotate, canvas.width / (options.annotateratio ?? 1), canvas.height / (options.annotateratio ?? 1), options.annotateratio ?? 1);
+  return canvasdataurl(canvas, options.format, options.quality);
+}
+async function capturenamefor(step, plan, kind, format) {
+  const naming = stepoptions2(step).naming;
+  const rule = naming && typeof naming === "object" && !Array.isArray(naming) ? naming : { run: true, step: true, sequence: true, kind: true };
+  const counters = (await memory.getcapturecounters()).find((item) => item.taskid === plan.id);
+  const advanced = advancecounter(counters?.counters ?? {}, step.id);
+  await memory.setcapturecounter({ taskid: plan.id, counters: advanced.counters, at: Date.now() });
+  return buildname(rule, { run: plan.id, step: step.id, sequence: advanced.sequence, kind }, format);
+}
+async function routecapture(record2, session, plan, step, origin) {
+  const target = record2.exporttarget ?? "memory";
+  if (target === "clipboard") {
+    const granted = await chrome.permissions.contains({ permissions: ["clipboardWrite"] }).catch(() => false);
+    if (!granted) throw new Error("The clipboard capture export needs the clipboardwrite capability; request it from the review panel.");
+    const blob = await (await fetch(record2.bytes ?? "")).blob();
+    await navigator.clipboard.write([new ClipboardItem({ [blob.type]: blob })]);
+    await memory.addclip(clipentryof("screen", { hash: cliphash(record2.bytes ?? ""), length: (record2.bytes ?? "").length }, origin, step.id, Date.now()));
+    void session;
+    void plan;
+    return { target, destination: "clipboard" };
+  }
+  if (target === "download") {
+    const granted = await chrome.permissions.contains({ permissions: ["downloads"] }).catch(() => false);
+    if (!granted) throw new Error("The download capture export needs the downloads capability; request it from the review panel.");
+    await chrome.downloads.download({ url: record2.bytes ?? "", filename: record2.name ?? `capture.${record2.format}` });
+    return { target, destination: "reviewed download flow" };
+  }
+  return { target, destination: "session memory" };
+}
+async function runcapturepolicy() {
+  return (await memory.getsettings())?.capturepolicy ?? "manual";
+}
+async function grabstateshot(step, session, plan, tabid2, phase) {
+  const options = stepcaptureoptions(step);
+  const format = options.format ?? "png";
+  const shot = await tabshot(format, options.quality);
+  const measured = await bridgecall(tabid2, "measurepage");
+  const record2 = capturevisible({ runid: plan.id, stepid: step.id, options: { ...options, annotate: options.annotate ?? true }, viewport: { width: measured.viewportwidth, height: measured.viewportheight }, dataurl: shot, at: Date.now(), id: randomid(), name: `${phase}-${await capturenamefor(step, plan, "state", format)}` });
+  await memory.addcapture(record2);
+  return record2;
+}
+async function storecapture(record2, session, plan, step, origin) {
+  await memory.addcapture(record2);
+  const routed = await routecapture(record2, session, plan, step, origin);
+  await memory.setprogress(recordcapture(await memory.getprogress(), plan.id, step.id, record2, Date.now()));
+  await refreshbadge();
+  return { record: record2, routed };
+}
+async function executecapturestep(step, session, plan, tabid2, origin) {
+  const options = stepcaptureoptions(step);
+  const format = options.format ?? "png";
+  const ratio = options.pixelratio ?? 1;
+  const runpolicy = await runcapturepolicy();
+  const annotate = options.annotate ?? runpolicy === "annotated";
+  const stepnumber = plan.steps.findIndex((candidate) => candidate.id === step.id) + 1;
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  const pageurl = await chrome.tabs.get(tabid2).then((tab) => tab.url ?? origin).catch(() => origin);
+  if (step.kind === "shotview") {
+    const measured = await bridgecall(tabid2, "measurepage");
+    const raw = await tabshot(format, options.quality);
+    const marker = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: measured.viewportwidth, height: measured.viewportheight, url: pageurl, at: Date.now() }) : void 0;
+    const dataurl = format === "png" && ratio === 1 && !marker ? raw : await encodecanvas(measured.viewportwidth * ratio, measured.viewportheight * ratio, async (context) => {
+      const bitmap = await createImageBitmap(await (await fetch(raw)).blob());
+      context.drawImage(bitmap, 0, 0, context.canvas.width, context.canvas.height);
+    }, { format, quality: options.quality, annotate: marker, annotateratio: ratio });
+    const record2 = capturevisible({ runid: plan.id, stepid: step.id, options: { ...options, ...annotate ? { annotate: true } : {} }, viewport: { width: measured.viewportwidth, height: measured.viewportheight }, dataurl, at: Date.now(), id: randomid(), name: await capturenamefor(step, plan, "shotview", format) });
+    const stored = await storecapture(record2, session, plan, step, origin);
+    await audit("capture", `Captured the visible viewport at ${record2.width} by ${record2.height} pixels in ${format} for step ${step.id}, routed to ${stored.routed.destination}.`, extra);
+    return { ok: true, summary: `Captured the visible viewport at ${record2.width} by ${record2.height} pixels.`, details: { capture: { id: record2.id, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, bytes: (record2.bytes ?? "").length, exporttarget: stored.routed.target } } };
+  }
+  if (step.kind === "shotfullpage") {
+    const rawoptions = stepoptions2(step);
+    const settle2 = typeof rawoptions.settle === "number" ? rawoptions.settle : 150;
+    const overlap = typeof rawoptions.overlap === "number" ? rawoptions.overlap : 0;
+    const wait = typeof rawoptions.wait === "number" ? rawoptions.wait : void 0;
+    const state = await bridgecall(tabid2, "preparecapture");
+    try {
+      const measured = await bridgecall(tabid2, "measurepage");
+      const stitch = buildstitchplan({ scrollwidth: measured.scrollwidth, scrollheight: measured.scrollheight, viewportwidth: measured.viewportwidth, viewportheight: measured.viewportheight, overlap });
+      if (wait !== void 0) {
+        const budget = stitchbudgetallowed(stitch.tiles.length, settle2, wait);
+        if (!budget.allowed) throw new Error(budget.reason ?? "The stitching scroll budget exceeds the reviewed wait window.");
+      }
+      const tiles = [];
+      let done = 0;
+      for (let index = 0; index < stitch.tiles.length; index += 1) {
+        const tile = stitch.tiles[index];
+        if (!tile) continue;
+        await bridgecall(tabid2, "scrollcapture", tile.x, tile.y);
+        await bridgecall(tabid2, "waitsettle", settle2);
+        const shot = await tabshot("png", void 0);
+        tiles.push(await decodeTile(shot, tile.x, tile.y, index % stitch.rows === 0));
+        done += 1;
+        stitchprogress.set(step.id, { stepid: step.id, done, total: stitch.tiles.length });
+      }
+      const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: stitch.scrollwidth, height: stitch.scrollheight, url: pageurl, at: Date.now() }) : void 0;
+      const dataurl = await composestitched(tiles, stitch.scrollwidth, stitch.scrollheight, overlap, ratio, { format, quality: options.quality, annotate: annotation });
+      const record2 = capturestitched({ runid: plan.id, stepid: step.id, options: { ...options, ...annotate ? { annotate: true } : {} }, plan: stitch, dataurl, at: Date.now(), id: randomid(), name: await capturenamefor(step, plan, "shotfullpage", format) });
+      const stored = await storecapture(record2, session, plan, step, origin);
+      await audit("capture", `Captured the full page of ${stitch.scrollwidth} by ${stitch.scrollheight} css pixels from ${stitch.tiles.length} stitched tile${stitch.tiles.length === 1 ? "" : "s"} with ${overlap} overlap row${overlap === 1 ? "" : "s"}, routed to ${stored.routed.destination}.`, extra);
+      return { ok: true, summary: `Captured the full page from ${stitch.tiles.length} stitched tiles.`, details: { capture: { id: record2.id, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, bytes: (record2.bytes ?? "").length, exporttarget: stored.routed.target }, tiles: stitch.tiles.length, columns: stitch.columns, rows: stitch.rows, overlap } };
+    } finally {
+      stitchprogress.delete(step.id);
+      await bridgecall(tabid2, "restorecapture", state).catch(() => void 0);
+    }
+  }
+  if (step.kind === "shotelement") {
+    const selector = step.target ?? "";
+    const settle2 = typeof stepoptions2(step).settle === "number" ? stepoptions2(step).settle : 150;
+    const measured = await bridgecall(tabid2, "measurepage");
+    const targetinfo = await bridgecall(tabid2, "elementrect", selector);
+    if (!targetinfo.ok || !targetinfo.rect) throw new Error(targetinfo.summary);
+    const rect = targetinfo.rect;
+    const crossing = targetinfo.crossesviewport === true;
+    const state = await bridgecall(tabid2, "preparecapture");
+    try {
+      let dataurl = "";
+      if (!crossing) {
+        const scrollto = Math.max(0, rect.y - Math.floor((measured.viewportheight - rect.height) / 2));
+        await bridgecall(tabid2, "scrollcapture", 0, scrollto);
+        await bridgecall(tabid2, "waitsettle", settle2);
+        const shot = await tabshot("png", void 0);
+        const crop = croprect({ x: rect.x, y: rect.y - scrollto, width: rect.width, height: rect.height }, { width: measured.viewportwidth, height: measured.viewportheight });
+        const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: crop.width, height: crop.height, rect: { x: 0, y: 0, width: crop.width, height: crop.height }, url: pageurl, at: Date.now() }) : void 0;
+        dataurl = await croptoRect(shot, crop, ratio, { format, quality: options.quality, annotate: annotation });
+      } else {
+        const tops = regionsteps(rect.height, measured.viewportheight);
+        const slices = [];
+        for (let index = 0; index < tops.length; index += 1) {
+          const top = tops[index] ?? 0;
+          await bridgecall(tabid2, "scrollcapture", 0, rect.y + top);
+          await bridgecall(tabid2, "waitsettle", settle2);
+          const shot = await tabshot("png", void 0);
+          const crop = croprect({ x: rect.x, y: 0, width: rect.width, height: Math.min(measured.viewportheight, rect.height - top) }, { width: measured.viewportwidth, height: measured.viewportheight });
+          const slicedata = await croptoRect(shot, crop, 1, { format: "png" });
+          slices.push(await decodeTile(slicedata, 0, top, index === 0));
+        }
+        const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: Math.min(rect.width, measured.viewportwidth), height: rect.height, rect: { x: 0, y: 0, width: Math.min(rect.width, measured.viewportwidth), height: rect.height }, url: pageurl, at: Date.now() }) : void 0;
+        dataurl = await composestitched(slices, Math.min(rect.width, measured.viewportwidth), rect.height, 0, ratio, { format, quality: options.quality, annotate: annotation });
+      }
+      const record2 = captureelement({ runid: plan.id, stepid: step.id, options: { ...options, ...annotate ? { annotate: true } : {} }, rect, dataurl, at: Date.now(), id: randomid(), name: await capturenamefor(step, plan, "shotelement", format), target: selector });
+      const stored = await storecapture(record2, session, plan, step, origin);
+      await audit("capture", `Captured the element ${selector} at ${rect.width} by ${rect.height} css pixels${crossing ? " through the tiled fallback" : ""}, routed to ${stored.routed.destination}.`, extra);
+      return { ok: true, summary: `Captured the element ${selector}.`, details: { capture: { id: record2.id, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, bytes: (record2.bytes ?? "").length, exporttarget: stored.routed.target }, rect, tiledfallback: crossing, target: selector } };
+    } finally {
+      await bridgecall(tabid2, "restorecapture", state).catch(() => void 0);
+    }
+  }
+  if (step.kind === "shotregion") {
+    const rawoptions = stepoptions2(step);
+    const rect = rawoptions.regionrect;
+    if (!rect) throw new Error("A reviewed regionrect is required in options.");
+    const container = typeof rawoptions.container === "string" ? rawoptions.container : void 0;
+    const measured = await bridgecall(tabid2, "measurepage");
+    const state = await bridgecall(tabid2, "preparecapture");
+    try {
+      let dataurl = "";
+      let captured = rect;
+      if (container) {
+        const info = await bridgecall(tabid2, "scrollcontainercapture", container, 0);
+        if (!info.ok || info.height === void 0 || info.viewportheight === void 0) throw new Error(info.summary);
+        const steps = regionsteps(info.height, info.viewportheight);
+        const strips = [];
+        for (let index = 0; index < steps.length; index += 1) {
+          await bridgecall(tabid2, "scrollcontainercapture", container, steps[index] ?? 0);
+          await bridgecall(tabid2, "waitsettle", typeof rawoptions.settle === "number" ? rawoptions.settle : 150);
+          const shot = await tabshot("png", void 0);
+          strips.push(await decodeTile(shot, 0, steps[index] ?? 0, index === 0));
+        }
+        const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: rect.width, height: info.height, rect, url: pageurl, at: Date.now() }) : void 0;
+        dataurl = await composestitched(strips, rect.width, info.height, 0, ratio, { format, quality: options.quality, annotate: annotation });
+        captured = { x: rect.x, y: rect.y, width: rect.width, height: info.height };
+      } else {
+        await bridgecall(tabid2, "scrollcapture", 0, Math.max(0, rect.y - Math.floor((measured.viewportheight - rect.height) / 2)));
+        await bridgecall(tabid2, "waitsettle", typeof rawoptions.settle === "number" ? rawoptions.settle : 150);
+        const shot = await tabshot("png", void 0);
+        const crop = croprect({ x: rect.x, y: rect.y - Math.max(0, rect.y - Math.floor((measured.viewportheight - rect.height) / 2)), width: rect.width, height: rect.height }, { width: measured.viewportwidth, height: measured.viewportheight });
+        const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width: crop.width, height: crop.height, rect: { x: 0, y: 0, width: crop.width, height: crop.height }, url: pageurl, at: Date.now() }) : void 0;
+        dataurl = await croptoRect(shot, crop, ratio, { format, quality: options.quality, annotate: annotation });
+        captured = crop;
+      }
+      const record2 = captureregion({ runid: plan.id, stepid: step.id, options: { ...options, ...annotate ? { annotate: true } : {} }, rect: captured, dataurl, at: Date.now(), id: randomid(), name: await capturenamefor(step, plan, "shotregion", format), ...container ? { target: container } : {} });
+      const stored = await storecapture(record2, session, plan, step, origin);
+      await audit("capture", `Captured the reviewed region at ${captured.width} by ${captured.height} css pixels${container ? ` of the scrollable container ${container}` : ""}, routed to ${stored.routed.destination}.`, extra);
+      return { ok: true, summary: `Captured the reviewed region${container ? ` of container ${container}` : ""}.`, details: { capture: { id: record2.id, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, bytes: (record2.bytes ?? "").length, exporttarget: stored.routed.target }, rect: captured, ...container ? { container } : {} } };
+    } finally {
+      await bridgecall(tabid2, "restorecapture", state).catch(() => void 0);
+    }
+  }
+  if (step.kind === "contactsheet") {
+    const rawoptions = stepoptions2(step);
+    const elements = (Array.isArray(rawoptions.elements) ? rawoptions.elements : []).filter((item) => typeof item === "string" && item.trim().length > 0);
+    const layout = rawoptions.sheet && typeof rawoptions.sheet === "object" && !Array.isArray(rawoptions.sheet) ? rawoptions.sheet : { cellsize: 240, columns: 3, label: "both" };
+    const measured = await bridgecall(tabid2, "measurepage");
+    const state = await bridgecall(tabid2, "preparecapture");
+    try {
+      const cells = [];
+      for (const selector of elements) {
+        const targetinfo = await bridgecall(tabid2, "elementrect", selector);
+        if (!targetinfo.ok || !targetinfo.rect) throw new Error(targetinfo.summary);
+        await bridgecall(tabid2, "scrollcapture", 0, Math.max(0, targetinfo.rect.y - Math.floor((measured.viewportheight - targetinfo.rect.height) / 2)));
+        await bridgecall(tabid2, "waitsettle", typeof rawoptions.settle === "number" ? rawoptions.settle : 150);
+        const shot = await tabshot("png", void 0);
+        const crop = croprect({ x: 0, y: targetinfo.rect.y - Math.max(0, targetinfo.rect.y - Math.floor((measured.viewportheight - targetinfo.rect.height) / 2)), width: targetinfo.rect.width, height: targetinfo.rect.height }, { width: measured.viewportwidth, height: measured.viewportheight });
+        const celldata = await croptoRect(shot, crop, 1, { format: "png" });
+        cells.push({ selector, dataurl: celldata, width: crop.width, height: crop.height });
+      }
+      const placed = buildsheet(cells.map((cell) => ({ selector: cell.selector })), layout);
+      const width = placed.columns * layout.cellsize;
+      const rows = placed.rows;
+      const height = rows * (layout.cellsize + 28);
+      const annotation = annotate ? annotationplanof({ step: Math.max(1, stepnumber), width, height, url: pageurl, at: Date.now() }) : void 0;
+      const dataurl = await encodecanvas(width * ratio, height * ratio, async (context) => {
+        context.scale(ratio, ratio);
+        for (let index = 0; index < cells.length; index += 1) {
+          const cell = cells[index];
+          const place = placed.cells[index];
+          if (!cell || !place) continue;
+          const bitmap = await createImageBitmap(await (await fetch(cell.dataurl)).blob());
+          const scaled = Math.min(layout.cellsize / Math.max(1, bitmap.width), layout.cellsize / Math.max(1, bitmap.height));
+          const drawwidth = Math.max(1, Math.round(bitmap.width * scaled));
+          const drawheight = Math.max(1, Math.round(bitmap.height * scaled));
+          context.drawImage(bitmap, place.column * layout.cellsize + Math.floor((layout.cellsize - drawwidth) / 2), place.row * (layout.cellsize + 28) + Math.floor((layout.cellsize - drawheight) / 2), drawwidth, drawheight);
+          if (place.caption) {
+            context.fillStyle = "rgba(23,32,44,.86)";
+            context.fillRect(place.column * layout.cellsize, place.row * (layout.cellsize + 28) + layout.cellsize, layout.cellsize, 28);
+            context.fillStyle = "#ffffff";
+            context.font = "12px sans-serif";
+            context.textAlign = "left";
+            context.textBaseline = "middle";
+            context.fillText(place.caption.slice(0, Math.floor(layout.cellsize / 7)), place.column * layout.cellsize + 6, place.row * (layout.cellsize + 28) + layout.cellsize + 14);
+          }
+        }
+      }, { format, quality: options.quality, annotate: annotation, annotateratio: ratio });
+      const record2 = { id: randomid(), runid: plan.id, stepid: step.id, kind: "contactsheet", format, width: Math.round(width * ratio), height: Math.round(height * ratio), capturedat: Date.now(), bytes: dataurl, name: await capturenamefor(step, plan, "contactsheet", format), ...annotate ? { annotated: true } : {}, ...options.exporttarget !== void 0 ? { exporttarget: options.exporttarget } : {} };
+      const stored = await storecapture(record2, session, plan, step, origin);
+      await audit("capture", `Tiled ${cells.length} element capture${cells.length === 1 ? "" : "s"} into one labeled ${placed.columns} column contact sheet, routed to ${stored.routed.destination}.`, extra);
+      return { ok: true, summary: `Tiled ${cells.length} element captures into one contact sheet.`, details: { capture: { id: record2.id, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, bytes: (record2.bytes ?? "").length, exporttarget: stored.routed.target }, cells: placed.cells, columns: placed.columns, rows: placed.rows } };
+    } finally {
+      await bridgecall(tabid2, "restorecapture", state).catch(() => void 0);
+    }
+  }
+  throw new Error("Unsupported capture kind.");
+}
 async function enforcewindowreview(step, session, plan) {
   const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
   const progress = plan ? await memory.getprogress() : void 0;
@@ -4319,9 +5688,12 @@ async function refreshbadge() {
   const queues = await memory.getnavqueues();
   const badges = await memory.getbadges();
   const prompts = (await memory.gettickets()).filter((ticket) => ticket.approved === void 0).length;
+  const consents = (await memory.getclipconsents()).filter((record2) => record2.approved === void 0).length;
+  const quarantined = (await memory.getquarantines()).filter((entry) => entry.scan === "pending").length;
   const datasets = (await memory.getdatasets()).length;
+  const captures = (await memory.getcaptures()).length;
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + datasets;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -4340,44 +5712,69 @@ async function executestep(stepid) {
   }
   let output;
   let watchwindow;
-  if (step.kind === "windowclose") {
-    await enforcewindowreview(step, session, plan);
-  }
-  if (istabscommandkind(step.kind)) {
-    output = await executetabscommand(step, session, plan, tab.id);
-  } else if (isdatasetkind(step.kind)) {
-    output = await executedatastep(step, session, plan, tab.id, origin);
-  } else if (isformkind(step.kind)) {
-    output = await executeformstep(step, session, plan, tab.id, origin);
-  } else if (isbrowserkind(step.kind)) {
-    output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
-  } else if (step.kind === "keyhold") {
-    output = await executekeyhold(step, session, plan, tab.id, origin);
-  } else if (step.kind === "keyrelease") {
-    output = await executekeyrelease(step, session, plan, tab.id, origin);
-  } else if (step.kind === "dismissdialog") {
-    output = await executedismissdialog(step, session, plan, tab.id, origin);
-  } else if (step.kind === "retryaction") {
-    output = await executeretryaction(step, session, plan, tab.id, origin);
-  } else if (step.kind === "mapclicks") {
-    output = await executemapclicks(step, plan, tab.id, origin);
-  } else if (step.kind === "enterframe") {
-    output = await executeenterframe(step, plan, tab.id, origin);
-  } else if (watchstepkinds.has(step.kind)) {
-    if (!session || !plan || plan.state !== "approved") throw new Error("Watch kinds refuse to run outside an approved session plan.");
-    const watched = await executewatchstep(step, session, plan, tab.id, origin);
-    output = watched.output;
-    watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
-  } else if (step.kind === "diffsnapshots") {
-    output = await executediffsnapshots(step, session, plan, tab.id, origin);
-  } else if (navigationstepkinds.has(step.kind)) {
-    output = await executenavigationkind(step, session, plan, tab.id, origin);
-  } else {
-    if (step.target && freshcheckkinds.has(step.kind)) {
-      const fresh = await snapshot(tab.id);
-      if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
+  const dispatchreviewedstep = async () => {
+    if (step.kind === "windowclose") {
+      await enforcewindowreview(step, session, plan);
+    }
+    if (istabscommandkind(step.kind)) {
+      output = await executetabscommand(step, session, plan, tab.id);
+    } else if (isdatasetkind(step.kind)) {
+      output = await executedatastep(step, session, plan, tab.id, origin);
+    } else if (isfileskind(step.kind)) {
+      output = await executefilesstep(step, session, plan, tab.id, origin);
+    } else if (isformkind(step.kind)) {
+      output = await executeformstep(step, session, plan, tab.id, origin);
+    } else if (isbrowserkind(step.kind)) {
+      output = await runbrowseraction(step, tab.id, tab.windowId ?? chrome.windows.WINDOW_ID_CURRENT);
+    } else if (step.kind === "keyhold") {
+      output = await executekeyhold(step, session, plan, tab.id, origin);
+    } else if (step.kind === "keyrelease") {
+      output = await executekeyrelease(step, session, plan, tab.id, origin);
+    } else if (step.kind === "dismissdialog") {
+      output = await executedismissdialog(step, session, plan, tab.id, origin);
+    } else if (step.kind === "retryaction") {
+      output = await executeretryaction(step, session, plan, tab.id, origin);
+    } else if (step.kind === "mapclicks") {
+      output = await executemapclicks(step, plan, tab.id, origin);
+    } else if (step.kind === "enterframe") {
+      output = await executeenterframe(step, plan, tab.id, origin);
+    } else if (watchstepkinds.has(step.kind)) {
+      if (!session || !plan || plan.state !== "approved") throw new Error("Watch kinds refuse to run outside an approved session plan.");
+      const watched = await executewatchstep(step, session, plan, tab.id, origin);
+      output = watched.output;
+      watchwindow = { startedat: watched.watch.startedat, lifetime: watched.watch.lifetime };
+    } else if (step.kind === "diffsnapshots") {
+      output = await executediffsnapshots(step, session, plan, tab.id, origin);
+    } else if (navigationstepkinds.has(step.kind)) {
+      output = await executenavigationkind(step, session, plan, tab.id, origin);
+    } else if (iscapturekind(step.kind)) {
+      output = await executecapturestep(step, session, plan, tab.id, origin);
+    } else {
+      if (step.target && freshcheckkinds.has(step.kind)) {
+        const fresh = await snapshot(tab.id);
+        if (!fresh.interactive.some((item) => item.selector === step.target)) throw new Error("The page changed and the target must be reviewed again.");
+      }
+      output = await dispatchpagestep(step, tab.id, origin, plan);
     }
-    output = await dispatchpagestep(step, tab.id, origin, plan);
+    return output;
+  };
+  const runplan = plan;
+  const capturepolicystate = await runcapturepolicy();
+  if (capturepolicystate === "beforeafter" && session && step.risk !== "read" && beforeafterwrapallowed(step.kind)) {
+    const before = await grabstateshot(step, session, runplan, tab.id, "before");
+    output = await dispatchreviewedstep();
+    if (output?.ok) {
+      const after = await grabstateshot(step, session, runplan, tab.id, "after");
+      const domversion = await memory.getobservationversion();
+      const paired = capturestates({ policy: "beforeafter", before, after, actionkind: step.kind, ...step.target ? { target: step.target } : {}, ...domversion !== void 0 ? { domsnapshotid: String(domversion) } : {}, at: Date.now(), id: randomid() });
+      if (paired.pair) {
+        await memory.addpair(paired.pair);
+        await memory.setprogress(recordpair(await memory.getprogress(), runplan.id, step.id, paired.pair, Date.now()));
+        await audit("capture", `Paired the before shot ${paired.pair.beforeid} with the after shot ${paired.pair.afterid} around the ${step.kind} action${paired.pair.domsnapshotid !== void 0 ? ` with dom snapshot ${paired.pair.domsnapshotid}` : ""}.`, { sessionid: session.id, planid: runplan.id, stepid: step.id });
+      }
+    }
+  } else {
+    output = await dispatchreviewedstep();
   }
   if (["navigate", "back", "forward"].includes(step.kind)) await recordnavigation(step, session, tab.id);
   await recordevidence(step, output, session, plan, origin);
@@ -4451,6 +5848,7 @@ async function grantcapability(permission) {
   if (!["tabs", "downloads", "clipboardRead", "clipboardWrite"].includes(permission)) throw new Error("Unknown capability.");
   const granted = await chrome.permissions.request({ permissions: [permission] });
   if (!granted) throw new Error("The capability grant was declined.");
+  if (permission === "downloads") installmimelistener();
   await audit("capability", `Capability ${permission} granted by the user.`);
   return refreshcapabilities();
 }
@@ -4524,13 +5922,34 @@ async function handlerequest(message, sender) {
       for (const config of sheetendpoints) {
         sheetgrants.push({ ...config, granted: await chrome.permissions.contains({ origins: [hostpattern(config.origin)] }).catch(() => false) });
       }
+      const downloads = await memory.getdownloads();
+      const netlogs = await memory.getnetlog();
+      const clipconsents = await memory.getclipconsents();
+      const clips = await memory.getclips();
+      const quarantines = await memory.getquarantines();
+      const cleanuprules = await memory.getcleanuprules();
+      const cleanupruns = await memory.getcleanupruns();
+      const capturecounters = await memory.getcapturecounters();
+      const inventory = await memory.getinventory();
+      const mimefilters = await memory.getmimefilters();
+      const capturemetadata = (await memory.getcaptures()).map((record2) => {
+        const { bytes, ...meta } = record2;
+        void bytes;
+        return meta;
+      });
+      const capturepairs = await memory.getpairs();
+      const runsettings = await memory.getsettings();
+      const scanhooks = [];
+      for (const hook of await memory.getscanhooks()) {
+        scanhooks.push({ ...hook, granted: await chrome.permissions.contains({ origins: [hostpattern(hook.origin)] }).catch(() => false) });
+      }
       const clones = clonetabs(tabs);
       const taskgauge = tasktabgauge(tabs.filter((tab) => badges.some((badge) => badge.tabid === tab.tabid)).length, tasktabceiling(await memory.getsettings()));
       const report = await buildtabreport(tabs);
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -4572,7 +5991,8 @@ async function handlerequest(message, sender) {
       const outcome = (await memory.getoutcomes()).find((candidate) => candidate.stepid === (input.stepid ?? ""));
       if (!outcome) throw new Error("No outcome exists for the reviewed step.");
       const resolved = outcome.details?.resolvedtarget;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {} }));
+      const capture = outcome.details?.capture;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -4861,6 +6281,128 @@ async function handlerequest(message, sender) {
       return extractionreportValue();
     case "provenance":
       return provenancereportValue();
+    case "downloadreport": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a download report envelope.");
+      return JSON.parse(downloadreport({ downloads: await memory.getdownloads(), plan }));
+    }
+    case "quarantine":
+      return quarantinereport({ entries: await memory.getquarantines() });
+    case "netlog":
+      return netlogreport({ records: await memory.getnetlog() });
+    case "downloadaction": {
+      const inputdownload = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Download actions stay behind the consent gate of an active session.");
+      const record2 = await loadownload(inputdownload.id ?? "");
+      if (!record2) throw new Error(`No stored download matches ${inputdownload.id ?? ""}.`);
+      const extra = { sessionid: session.id };
+      if (inputdownload.action === "pause") return pauseonerecord(record2, extra);
+      if (inputdownload.action === "resume") return resumeonerecord(record2, extra);
+      if (inputdownload.action === "verify") return verifyonerecord(record2, {}, extra);
+      throw new Error("A pause, resume or verify action is required.");
+    }
+    case "approveclipconsent": {
+      const inputconsent = message;
+      const record2 = (await memory.getclipconsents()).find((item) => item.id === inputconsent.id);
+      if (!record2) throw new Error("No clipboard consent prompt matches the requested id.");
+      await memory.setclipconsent({ ...record2, approved: inputconsent.approved !== false });
+      const session = await memory.getsession();
+      await audit("clipboard", `Clipboard consent prompt ${record2.id} for step ${record2.stepid} on ${record2.origin} ${inputconsent.approved !== false ? "approved" : "declined"} by the user; every read consumes its own prompt.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return { id: record2.id, approved: inputconsent.approved !== false };
+    }
+    case "releasequarantine": {
+      const inputquarantine = message;
+      const entry = (await memory.getquarantines()).find((item) => item.id === inputquarantine.id);
+      if (!entry) throw new Error("No quarantined file matches the requested id.");
+      if (entry.release !== void 0) throw new Error(`The quarantined file ${entry.path} was already released.`);
+      const gate = quarantinereleasegranted(entry);
+      if (!gate.allowed) throw new Error(gate.reason);
+      const releasedentry = released(entry, `user-${Date.now()}`, Date.now());
+      await memory.setquarantine(releasedentry);
+      const session = await memory.getsession();
+      await audit("quarantine", `Quarantine release of ${entry.path} approved with the ${entry.scan} scan verdict under ref ${releasedentry.release}; every release is audited with its verdict.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return releasedentry;
+    }
+    case "setcleanuprules": {
+      const inputrules = message;
+      const rules = (Array.isArray(inputrules.rules) ? inputrules.rules : []).filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item));
+      for (const rule of rules) {
+        const gate = validatecleanuprule(rule);
+        if (!gate.allowed) throw new Error(gate.reason);
+      }
+      await memory.setcleanuprules(rules);
+      const session = await memory.getsession();
+      await audit("cleanup", `The review panel stored ${rules.length} reviewed cleanup rule${rules.length === 1 ? "" : "s"} with age windows and keep policies; ages stay user configured with no code ceiling.`, { ...session ? { sessionid: session.id } : {} });
+      return { rules: rules.length };
+    }
+    case "configurescanhook": {
+      const inputhook = message;
+      const config = normalizeendpoint(inputhook.endpoint ?? "");
+      const granted = await chrome.permissions.contains({ origins: [hostpattern(config.origin)] });
+      if (!granted) throw new Error("The scan hook origin has not received optional permission.");
+      if (!inputhook.scanner?.trim()) throw new Error("A scanner name is required for the scan hook.");
+      const hook = { scanner: inputhook.scanner.trim(), endpoint: config.endpoint, origin: config.origin, configuredat: Date.now() };
+      await memory.setscanhook(hook);
+      await audit("quarantine", `Configured the virus scanning hook ${hook.scanner} at ${hook.origin}; scan verdicts arrive from the endpoint and hook failures stay pending verdicts.`, {});
+      return hook;
+    }
+    case "exportnetlog": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Netlog exports stay behind the consent gate of an active session.");
+      const records = (await memory.getnetlog()).map((record2) => ({ ...record2, headers: redactheaders(record2.headers ?? {}) }));
+      await audit("observation", `The review panel exported ${records.length} netlog record${records.length === 1 ? "" : "s"} of the run with every header value redacted.`, { sessionid: session.id });
+      return { records, redacted: true, redaction: "every header value is redacted from exported netlogs" };
+    }
+    case "capturebytes": {
+      const inputcapture = message;
+      const record2 = await memory.getcapture(inputcapture.id ?? "");
+      if (!record2) throw new Error("No stored capture matches the requested id.");
+      if (!record2.bytes) throw new Error("The capture bytes expired from the retention window; the metadata stays for the audit trail.");
+      return { id: record2.id, runid: record2.runid, kind: record2.kind, format: record2.format, width: record2.width, height: record2.height, capturedat: record2.capturedat, name: record2.name, annotated: record2.annotated === true, bytes: record2.bytes };
+    }
+    case "capturereport":
+      return capturereport({ records: await memory.getcaptures(), pairs: await memory.getpairs() });
+    case "copycapture": {
+      const inputcopy = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Capture clipboard copies stay behind the consent gate of an active session.");
+      const record2 = await memory.getcapture(inputcopy.id ?? "");
+      if (!record2) throw new Error("No stored capture matches the requested id.");
+      if (!record2.bytes) throw new Error("The capture bytes expired from the retention window; the metadata stays for the audit trail.");
+      const granted = await chrome.permissions.contains({ permissions: ["clipboardWrite"] }).catch(() => false);
+      if (!granted) throw new Error("The capture copy needs the clipboardwrite capability; request it from the review panel.");
+      const blob = await (await fetch(record2.bytes)).blob();
+      await navigator.clipboard.write([new ClipboardItem({ [blob.type]: blob })]);
+      await memory.addclip(clipentryof("screen", { hash: cliphash(record2.bytes), length: record2.bytes.length }, session.origin, record2.stepid, Date.now()));
+      await audit("capture", `The review panel copied capture ${record2.id} of kind ${record2.kind} to the clipboard with payload hash ${cliphash(record2.bytes)}.`, { sessionid: session.id });
+      return { id: record2.id, copied: true };
+    }
+    case "downloadcapture": {
+      const inputdownloadcapture = message;
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Capture downloads stay behind the consent gate of an active session.");
+      const record2 = await memory.getcapture(inputdownloadcapture.id ?? "");
+      if (!record2) throw new Error("No stored capture matches the requested id.");
+      if (!record2.bytes) throw new Error("The capture bytes expired from the retention window; the metadata stays for the audit trail.");
+      const granted = await chrome.permissions.contains({ permissions: ["downloads"] }).catch(() => false);
+      if (!granted) throw new Error("The capture download needs the downloads capability; request it from the review panel.");
+      await chrome.downloads.download({ url: record2.bytes, filename: record2.name ?? `capture.${record2.format}` });
+      await audit("capture", `The review panel downloaded capture ${record2.id} of kind ${record2.kind} through the reviewed download flow.`, { sessionid: session.id });
+      return { id: record2.id, downloaded: true };
+    }
+    case "setcapturepolicy": {
+      const inputpolicy = message;
+      const mode = inputpolicy.mode === "off" || inputpolicy.mode === "manual" || inputpolicy.mode === "annotated" || inputpolicy.mode === "beforeafter" ? inputpolicy.mode : void 0;
+      if (!mode) throw new Error("The capture policy must be off, manual, annotated or beforeafter.");
+      const settings = await memory.getsettings();
+      await memory.setsettings({ ...settings, capturepolicy: mode });
+      await audit("configure", `The user set the capture policy of the run to ${mode}; beforeafter wraps page moving actions with state pairs.`);
+      await refreshbadge();
+      return { capturepolicy: mode };
+    }
     case "stop": {
       const session = await memory.getsession();
       if (session) await memory.setsession({ ...session, stoppedat: Date.now() });