@wenathlan/extension 1.1.41 → 1.1.42

package/extension/dist/background.js

@@ -813,6 +813,79 @@ var sessionmemory = class {
   async getrecordingconsents() {
     return await this.adapter.get("recordingconsents") ?? [];
   }
+  /** Stores one outbound call record with its transport facts and body, replacing the previous record of that id; the user configured call retention window expires the oldest bodies while the metadata always survives. */
+  async addcall(record2) {
+    const records = await this.getcalls();
+    const retention = (await this.getsettings())?.callretention;
+    const combined = [record2, ...records.filter((item) => item.id !== record2.id)];
+    const stored = retention === void 0 ? combined : combined.map((item, index) => index < retention ? item : expirecallbody(item));
+    await this.adapter.set("calls", stored);
+  }
+  /** Returns every stored outbound call record, newest first. */
+  async getcalls() {
+    return await this.adapter.get("calls") ?? [];
+  }
+  /** Returns one outbound call record with its body by its id. */
+  async getcall(id) {
+    return (await this.getcalls()).find((item) => item.id === id);
+  }
+  /** Returns the outbound call records filtered by run and origin; an absent filter returns every call. */
+  async listcalls(filter) {
+    const records = await this.getcalls();
+    return records.filter((item) => (filter.runid === void 0 || item.runid === filter.runid) && (filter.origin === void 0 || item.origin === filter.origin));
+  }
+  /** Stores one typed endpoint definition version, appending to the version history of that endpoint name. */
+  async setendpoint(record2) {
+    const records = await this.adapter.get("endpoints") ?? [];
+    const prior = records.filter((item) => item.name === record2.name);
+    const version = prior.length > 0 ? Math.max(...prior.map((item) => item.version)) + 1 : 1;
+    await this.adapter.set("endpoints", [{ ...record2, version, at: record2.at }, ...records]);
+  }
+  /** Returns the newest endpointrecord definition of one name with its payload schema and version. */
+  async getendpoint(name) {
+    const records = await this.adapter.get("endpoints") ?? [];
+    return records.find((item) => item.name === name);
+  }
+  /** Returns the newest definition of every typed endpoint name with its schema and version history. */
+  async getendpoints() {
+    const records = await this.adapter.get("endpoints") ?? [];
+    const latest = /* @__PURE__ */ new Map();
+    for (const record2 of records) if (!latest.has(record2.name)) latest.set(record2.name, record2);
+    return [...latest.values()];
+  }
+  /** Stores one fetch consent decision per origin with its reviewed header names and values and its expiry window. */
+  async setfetchconsent(consent) {
+    const records = (await this.adapter.get("fetchconsents") ?? []).filter((item) => item.id !== consent.id);
+    await this.adapter.set("fetchconsents", [consent, ...records]);
+  }
+  /** Returns every fetch consent decision with its origin, header names and expiry window, newest first. */
+  async getfetchconsents() {
+    return await this.adapter.get("fetchconsents") ?? [];
+  }
+  /** Stores one api key reference record without any key material; the secret value stays behind its storage id. */
+  async setapikey(ref) {
+    const records = (await this.adapter.get("apikeys") ?? []).filter((item) => item.name !== ref.name);
+    await this.adapter.set("apikeys", [ref, ...records]);
+  }
+  /** Returns every stored api key reference with its origin scope, header name and storage id; key material never loads here. */
+  async getapikeys() {
+    return await this.adapter.get("apikeys") ?? [];
+  }
+  /** Removes one api key reference and its stored secret together. */
+  async removeapikey(name) {
+    const records = await this.getapikeys();
+    const ref = records.find((item) => item.name === name);
+    if (ref) await this.adapter.set(ref.storageid, void 0);
+    await this.adapter.set("apikeys", records.filter((item) => item.name !== name));
+  }
+  /** Stores one api key secret under its storage id; the value never appears in reports, outcomes or the audit trail. */
+  async setsecret(storageid, value) {
+    return this.adapter.set(storageid, value);
+  }
+  /** Loads one api key secret under its storage id for the executor only. */
+  async getsecret(storageid) {
+    return this.adapter.get(storageid);
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -842,14 +915,19 @@ function expirecapturebytes(record2) {
   void bytes;
   return { ...metadata, bytesexpired: true };
 }
+function expirecallbody(record2) {
+  const { body, ...metadata } = record2;
+  void body;
+  return { ...metadata, bodyexpired: true };
+}
 function randomid() {
   return crypto.randomUUID();
 }
 
 // policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages"]);
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -861,6 +939,8 @@ var exportactions = /* @__PURE__ */ new Set(["exportcsv", "exportjson", "exporte
 var filesactions = /* @__PURE__ */ new Set(["batchdownload", "pausedownload", "resumedownload", "verifydownload", "interceptmime", "exportnetlog", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "namecaptures", "cleanupartifacts"]);
 var captureactions = /* @__PURE__ */ new Set(["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"]);
 var mediaactions = /* @__PURE__ */ new Set(["capturepdf", "recordscreen", "captureaudio", "captureframe", "downloadimages", "shotcanvas", "probestream", "readmedia", "readassets", "timelapse", "convertimage", "makethumbs"]);
+var httpactions = /* @__PURE__ */ new Set(["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"]);
+var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
 var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
 var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
 var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
@@ -1590,6 +1670,223 @@ function validatetabsgrammar(step, options) {
 function ismediakind(kind) {
   return mediaactions.has(kind);
 }
+function ishttpkind(kind) {
+  return httpactions.has(kind);
+}
+function origincheck(session, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { allowed: false, reason: "The outbound request needs a valid url before it can be reviewed." };
+  }
+  if (parsed.protocol !== "https:") return { allowed: false, reason: "Outbound requests use HTTPS urls only." };
+  if (parsed.username || parsed.password) return { allowed: false, reason: "Endpoint credentials are not allowed in the url." };
+  if (!origingranted(session, parsed.origin)) return { allowed: false, reason: `The outbound request to ${parsed.origin} stays outside the session origin grants.` };
+  return { allowed: true };
+}
+function credentialheadername(name) {
+  return credentialheaders.has(name.trim().toLowerCase());
+}
+function fetchconsentrefgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const request = options.fetch;
+  const headers = request && typeof request === "object" && !Array.isArray(request) ? request.headers : void 0;
+  const names = headers && typeof headers === "object" && !Array.isArray(headers) ? Object.keys(headers) : [];
+  if (names.length === 0) return { allowed: true };
+  const empty = names.some((name) => !name.trim());
+  if (empty) return { allowed: false, reason: "Header allowlists with empty names are refused." };
+  const credential = names.find((name) => credentialheadername(name));
+  if (credential !== void 0 && !isnonempty(options.consentref)) return { allowed: false, reason: `The credential bearing header ${credential} needs the explicit reviewed consent that names it before it is sent.` };
+  if (!isnonempty(options.consentref)) return { allowed: false, reason: `The ${names.length} reviewed custom header${names.length === 1 ? "" : "s"} need a reviewed consent ref in options before any send.` };
+  return { allowed: true };
+}
+function fetchconsentcovers(consent, origin, headernames, now) {
+  if (consent.approved !== true) return false;
+  if (consent.expiresat <= now) return false;
+  if (consent.origin !== origin) return false;
+  const covered = new Set(consent.headers.map((header) => header.name.trim().toLowerCase()));
+  return headernames.every((name) => covered.has(name.trim().toLowerCase()));
+}
+function mutationcallof(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  if (step.kind === "callgraphql") {
+    const request = options.graphql;
+    return Boolean(request && typeof request === "object" && !Array.isArray(request) && request.operationkind === "mutation");
+  }
+  if (step.kind === "callrest") {
+    const method = typeof options.method === "string" ? options.method.trim().toUpperCase() : void 0;
+    if (method !== void 0) return !["GET", "HEAD", "OPTIONS"].includes(method);
+  }
+  return false;
+}
+function fetchbudgetallowed(timeout, retries, backoff, wait) {
+  for (const [label, value] of [["timeout", timeout], ["retries", retries], ["backoff", backoff]]) {
+    if (value !== void 0 && (typeof value !== "number" || !Number.isFinite(value) || value < 0)) return { allowed: false, reason: `The reviewed fetch ${label} must be zero or a positive number with no code ceiling.` };
+  }
+  if (wait !== void 0 && (typeof wait !== "number" || !Number.isFinite(wait) || wait < 0)) return { allowed: false, reason: "The reviewed fetch wait budget must be zero or a positive number of milliseconds." };
+  if (wait === void 0 || timeout === void 0) return { allowed: true };
+  const attempts = Math.max(1, Math.floor(retries ?? 0) + 1);
+  const waits = (backoff ?? 0) * (attempts * (attempts - 1)) / 2;
+  const worstcase = timeout * attempts + waits;
+  if (worstcase > wait) return { allowed: false, reason: `The fetch worst case of ${worstcase} milliseconds exceeds the reviewed wait budget of ${wait} milliseconds; review a wider budget or fewer retries.` };
+  return { allowed: true };
+}
+function outboundtarget(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const request = options.fetch;
+  if (request && typeof request === "object" && !Array.isArray(request)) {
+    const url = request.url;
+    if (typeof url === "string" && url.trim()) return url.trim();
+  }
+  return void 0;
+}
+function validateendpointrecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed endpoint record is required." };
+  const record2 = value;
+  if (!isnonempty(record2.name)) return { allowed: false, reason: "The endpoint record needs a reviewed non-empty name." };
+  if (!isnonempty(record2.method)) return { allowed: false, reason: "The endpoint record needs a reviewed method." };
+  if (!ishttpsurl(record2.url)) return { allowed: false, reason: "The endpoint record url template must be an HTTPS url." };
+  if (record2.headers !== void 0) {
+    if (!record2.headers || typeof record2.headers !== "object" || Array.isArray(record2.headers)) return { allowed: false, reason: "The endpoint header allowlist must be an object of reviewed headers." };
+    for (const name of Object.keys(record2.headers)) {
+      if (!name.trim()) return { allowed: false, reason: "Endpoint header allowlists with empty names are refused." };
+      const headervalue = record2.headers[name];
+      if (typeof headervalue !== "string") return { allowed: false, reason: `The endpoint header ${name} needs a reviewed string value.` };
+    }
+  }
+  const schema = record2.schema;
+  if (!schema || typeof schema !== "object" || Array.isArray(schema)) return { allowed: false, reason: "Every typed endpoint call needs a reviewed payload schema; endpoint records without schemas are refused." };
+  const fields = schema.fields;
+  if (!Array.isArray(fields) || fields.length === 0) return { allowed: false, reason: "The endpoint payload schema needs a non-empty field list." };
+  for (const item of fields) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return { allowed: false, reason: "Every payload schema field must be an object." };
+    const field = item;
+    if (!isnonempty(field.name)) return { allowed: false, reason: "Every payload schema field needs a non-empty name." };
+    if (field.kind !== "string" && field.kind !== "number" && field.kind !== "boolean") return { allowed: false, reason: `The payload schema field ${field.name} must be a string, number or boolean kind.` };
+    if (field.required !== void 0 && typeof field.required !== "boolean") return { allowed: false, reason: `The payload schema field ${field.name} required flag must be a boolean.` };
+    if (field.default !== void 0 && typeof field.default !== "string" && typeof field.default !== "number" && typeof field.default !== "boolean") return { allowed: false, reason: `The payload schema field ${field.name} default must match its kind.` };
+  }
+  return { allowed: true };
+}
+function validpath(path) {
+  return path.split(".").every((segment) => /^[A-Za-z0-9_-]+$/.test(segment));
+}
+function validatehttpgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "fetchurl") {
+    const request = options.fetch;
+    if (!request || typeof request !== "object" || Array.isArray(request)) return { allowed: false, reason: "A reviewed fetch request with a url is required in options.fetch." };
+    const fetchrequest = request;
+    if (typeof fetchrequest.url !== "string" || !fetchrequest.url.trim()) return { allowed: false, reason: "The reviewed fetch request needs a non-empty url." };
+    if (fetchrequest.method !== void 0 && (typeof fetchrequest.method !== "string" || !["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"].includes(fetchrequest.method.trim().toUpperCase()))) return { allowed: false, reason: "The reviewed fetch method must be a known HTTP verb." };
+    if (fetchrequest.headers !== void 0) {
+      if (!fetchrequest.headers || typeof fetchrequest.headers !== "object" || Array.isArray(fetchrequest.headers)) return { allowed: false, reason: "The reviewed header allowlist must be an object of custom headers." };
+      for (const name of Object.keys(fetchrequest.headers)) {
+        if (!name.trim()) return { allowed: false, reason: "Header allowlists with empty names are refused." };
+        if (typeof fetchrequest.headers[name] !== "string") return { allowed: false, reason: `The reviewed header ${name} needs a string value.` };
+      }
+    }
+    if (fetchrequest.body !== void 0 && typeof fetchrequest.body !== "string") return { allowed: false, reason: "The reviewed fetch body must be a string." };
+    if (fetchrequest.mode !== void 0 && fetchrequest.mode !== "cors" && fetchrequest.mode !== "no-cors" && fetchrequest.mode !== "same-origin") return { allowed: false, reason: "The reviewed fetch mode must be cors, no-cors or same-origin." };
+    const consentgate = fetchconsentrefgranted(step);
+    if (!consentgate.allowed) return consentgate;
+    const policycheck = validatefetchoptions(options.fetchoptions);
+    if (!policycheck.allowed) return policycheck;
+    const fetchpolicy = fetchoptionsvalues(options.fetchoptions);
+    const budget = fetchbudgetallowed(fetchpolicy.timeout, fetchpolicy.retries, fetchpolicy.backoff, fetchnumeric(options, "wait"));
+    if (!budget.allowed) return budget;
+    if (options.stream !== void 0) {
+      if (!options.stream || typeof options.stream !== "object" || Array.isArray(options.stream)) return { allowed: false, reason: "The reviewed stream window must be an object with an optional byte budget." };
+      const streambudget = options.stream.budget;
+      if (streambudget !== void 0 && (typeof streambudget !== "number" || !Number.isFinite(streambudget) || streambudget < 0)) return { allowed: false, reason: "The reviewed stream byte budget must be zero or a positive number of bytes with no code ceiling." };
+    }
+  }
+  if (kind === "parsejson") {
+    if (!isnonempty(options.call)) return { allowed: false, reason: "A reviewed stored call id is required in options.call before the body parses." };
+    const fields = options.fields;
+    if (!Array.isArray(fields) || fields.length === 0) return { allowed: false, reason: "A reviewed non-empty list of json path rules is required in options.fields." };
+    for (const item of fields) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) return { allowed: false, reason: "Every json path rule must be an object." };
+      const rule = item;
+      if (!isnonempty(rule.name)) return { allowed: false, reason: "Every json path rule needs a non-empty field name." };
+      if (typeof rule.path !== "string" || !rule.path.trim() || !validpath(rule.path.trim())) return { allowed: false, reason: `The json path of ${rule.name} must be a dotted path of non-empty segments.` };
+      if (rule.kind !== void 0 && rule.kind !== "text" && rule.kind !== "number" && rule.kind !== "boolean" && rule.kind !== "json") return { allowed: false, reason: `The json path kind of ${rule.name} must be text, number, boolean or json.` };
+    }
+  }
+  if (kind === "parsehtml") {
+    if (!isnonempty(options.call)) return { allowed: false, reason: "A reviewed stored call id is required in options.call before the markup parses." };
+    const queries = options.queries;
+    if (!Array.isArray(queries) || queries.length === 0) return { allowed: false, reason: "A reviewed non-empty list of html queries is required in options.queries." };
+    for (const item of queries) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) return { allowed: false, reason: "Every html query must be an object." };
+      const query = item;
+      if (!isnonempty(query.selector)) return { allowed: false, reason: "Every html query needs a selector from the reviewed selector grammar." };
+      if (query.attribute !== void 0 && !isnonempty(query.attribute)) return { allowed: false, reason: "The reviewed html query attribute must be a non-empty attribute name." };
+      if (query.multi !== void 0 && typeof query.multi !== "boolean") return { allowed: false, reason: "The reviewed html query multi flag must be a boolean." };
+    }
+  }
+  if (kind === "callrest" || kind === "callgraphql") {
+    if (!isnonempty(options.endpoint)) return { allowed: false, reason: "A reviewed typed endpoint name is required in options.endpoint." };
+    if (kind === "callrest") {
+      if (options.payload !== void 0 && (!options.payload || typeof options.payload !== "object" || Array.isArray(options.payload))) return { allowed: false, reason: "The reviewed rest payload must be an object of reviewed values." };
+      if (options.method !== void 0 && (typeof options.method !== "string" || !["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"].includes(options.method.trim().toUpperCase()))) return { allowed: false, reason: "The reviewed endpoint method override must be a known HTTP verb." };
+      if (options.success !== void 0 && (!Array.isArray(options.success) || !options.success.every((code) => typeof code === "number" && Number.isInteger(code)))) return { allowed: false, reason: "The reviewed success status list must be a list of integer status codes." };
+    }
+    if (kind === "callgraphql") {
+      const request = options.graphql;
+      if (!request || typeof request !== "object" || Array.isArray(request)) return { allowed: false, reason: "A reviewed graphql request with an operation is required in options.graphql." };
+      const graphql = request;
+      if (typeof graphql.query !== "string" || !graphql.query.trim()) return { allowed: false, reason: "The reviewed graphql operation text must be a non-empty string." };
+      if (graphql.operationkind !== "query" && graphql.operationkind !== "mutation") return { allowed: false, reason: "The reviewed graphql operation kind must be query or mutation; unknown operation kinds are refused." };
+      if (graphql.variables !== void 0 && (!graphql.variables || typeof graphql.variables !== "object" || Array.isArray(graphql.variables))) return { allowed: false, reason: "The reviewed graphql variables must be an object of reviewed values." };
+      if (graphql.operationname !== void 0 && !isnonempty(graphql.operationname)) return { allowed: false, reason: "The reviewed graphql operation name must be a non-empty string." };
+    }
+    if (options.apikeys !== void 0 && (!Array.isArray(options.apikeys) || !options.apikeys.every((name) => isnonempty(name)))) return { allowed: false, reason: "The reviewed api key reference list must be a list of non-empty stored names." };
+    const policycheck = validatefetchoptions(options.fetchoptions);
+    if (!policycheck.allowed) return policycheck;
+    const fetchpolicy = fetchoptionsvalues(options.fetchoptions);
+    const budget = fetchbudgetallowed(fetchpolicy.timeout, fetchpolicy.retries, fetchpolicy.backoff, fetchnumeric(options, "wait"));
+    if (!budget.allowed) return budget;
+  }
+  return { allowed: true };
+}
+function validatefetchoptions(value) {
+  if (value === void 0) return { allowed: true };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "The reviewed fetch options must be an object with timeout, retries, backoff and follow." };
+  const options = value;
+  for (const key of ["timeout", "backoff"]) {
+    if (options[key] !== void 0 && (typeof options[key] !== "number" || !Number.isFinite(options[key]) || options[key] < 0)) return { allowed: false, reason: `The reviewed fetch ${key} must be zero or a positive number with no code ceiling.` };
+  }
+  for (const key of ["retries", "follow"]) {
+    if (options[key] !== void 0 && (typeof options[key] !== "number" || !Number.isInteger(options[key]) || options[key] < 0)) return { allowed: false, reason: `The reviewed fetch ${key} must be zero or a positive integer with no code ceiling.` };
+  }
+  return { allowed: true };
+}
+function fetchoptionsvalues(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  return { timeout: fetchnumeric(options, "timeout"), retries: fetchnumeric(options, "retries"), backoff: fetchnumeric(options, "backoff") };
+}
+function fetchnumeric(options, key) {
+  const value = options[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
 function isrecordingkind(kind) {
   return kind === "recordscreen" || kind === "captureaudio";
 }
@@ -1950,6 +2247,10 @@ function validatestep(step, origin) {
     const mediacheck = validatemediagrammar(step, options);
     if (!mediacheck.allowed) return mediacheck;
   }
+  if (ishttpkind(step.kind)) {
+    const httpcheck = validatehttpgrammar(step, options);
+    if (!httpcheck.allowed) return httpcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -2029,6 +2330,17 @@ function canexecute(input) {
     const recordinggate = recordingconsentgranted(input.step);
     if (!recordinggate.allowed) return recordinggate;
   }
+  if (ishttpkind(input.step.kind)) {
+    const target = outboundtarget(input.step);
+    if (target !== void 0) {
+      const outboundgate = origincheck(input.session, target);
+      if (!outboundgate.allowed) return outboundgate;
+    }
+    if (input.step.kind === "fetchurl" || input.step.kind === "callrest" || input.step.kind === "callgraphql") {
+      const consentgate = fetchconsentrefgranted(input.step);
+      if (!consentgate.allowed) return consentgate;
+    }
+  }
   if (input.step.kind === "openlink" || input.step.kind === "openprivate" || input.step.kind === "batchopen" || input.step.kind === "prefetch" || input.step.kind === "deeplink" || input.step.kind === "reopentab") {
     let options = {};
     try {
@@ -2155,9 +2467,19 @@ function recordmedia(progress, planid, stepid, media, now) {
   const outcome = { stepid, ok: true, summary: `Captured a ${media.kind} media record of ${media.scope} scope with ${media.bytes} character${media.bytes === 1 ? "" : "s"} of media data.`, details: { media }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordcall(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.statusclass === "success", summary: `Outbound ${entry.method} ${entry.kind} call to ${entry.origin} ended in the ${entry.status} ${entry.statusclass} class after ${entry.retries} retr${entry.retries === 1 ? "y" : "ies"} and ${entry.bytes} byte${entry.bytes === 1 ? "" : "s"}.`, details: { call: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordfetchretry(progress, planid, stepid, retry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: false, summary: `Fetch attempt ${retry.attempt} of ${retry.url} failed (${retry.reason}); retrying after a ${retry.wait} millisecond backoff.`, details: { fetchretry: retry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.41";
+var packageversion = "1.1.42";
 
 // types.ts
 var protocolversion = packageversion;
@@ -2171,9 +2493,10 @@ function text(value, field) {
   if (typeof value !== "string" || !value.trim()) throw new Error(`${field} must be a non-empty string.`);
   return value.trim();
 }
-function parseproposal(value, origin) {
+function parseproposal(value, origin, grants) {
   const root = record(value);
   if (root.version !== protocolversion) throw new Error("Unsupported protocol version.");
+  const covered = grants !== void 0 && grants.length > 0 ? grants : [origin];
   const planinput = record(root.plan);
   const stepsinput = planinput.steps;
   if (!Array.isArray(stepsinput) || stepsinput.length === 0) throw new Error("A plan needs at least one step.");
@@ -2191,6 +2514,17 @@ function parseproposal(value, origin) {
     };
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
+    const target = outboundtarget(step);
+    if (target !== void 0) {
+      const granted = covered.some((pattern) => {
+        try {
+          return new URL(target).origin === new URL(pattern).origin;
+        } catch {
+          return false;
+        }
+      });
+      if (!granted) throw new Error(`The fetch request to ${target} targets an origin outside the grants.`);
+    }
     return step;
   });
   for (const step of steps) {
@@ -2221,7 +2555,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -2289,6 +2623,14 @@ function capturereport(input) {
 function mediareport(input) {
   return { version: protocolversion, records: input.records, images: input.images };
 }
+function callsreport(input) {
+  const calls = input.calls.map((call) => {
+    const { body, ...metadata } = call;
+    void body;
+    return metadata;
+  });
+  return { version: protocolversion, calls };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -2778,6 +3120,274 @@ function streamsummaries(raw) {
   });
 }
 
+// httpclient.ts
+var httpkinds = ["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"];
+var redirectstatuses = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var bodilessmethods = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+function statusclassof(status) {
+  if (status >= 100 && status < 200) return "informational";
+  if (status >= 200 && status < 300) return "success";
+  if (status >= 300 && status < 400) return "redirect";
+  if (status >= 400 && status < 500) return "clienterror";
+  if (status >= 500 && status < 600) return "servererror";
+  return "unknown";
+}
+function templateurl(template, values) {
+  return template.replace(/\{([a-z0-9_]+)\}/gi, (whole, name) => values[name] === void 0 ? whole : String(values[name]));
+}
+function fetchrequestof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.url !== "string" || !options.url.trim()) return void 0;
+  const request = { url: options.url.trim() };
+  if (typeof options.method === "string" && options.method.trim()) request.method = options.method.trim().toUpperCase();
+  if (options.headers && typeof options.headers === "object" && !Array.isArray(options.headers)) {
+    const headers = {};
+    for (const [name, headervalue] of Object.entries(options.headers)) {
+      if (typeof headervalue === "string") headers[name] = headervalue;
+    }
+    request.headers = headers;
+  }
+  if (typeof options.body === "string") request.body = options.body;
+  if (options.mode === "cors" || options.mode === "no-cors" || options.mode === "same-origin") request.mode = options.mode;
+  return request;
+}
+function fetchoptionsof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  const normalized = {};
+  if (typeof options.timeout === "number" && Number.isFinite(options.timeout)) normalized.timeout = options.timeout;
+  if (typeof options.retries === "number" && Number.isFinite(options.retries)) normalized.retries = options.retries;
+  if (typeof options.backoff === "number" && Number.isFinite(options.backoff)) normalized.backoff = options.backoff;
+  if (typeof options.follow === "number" && Number.isFinite(options.follow)) normalized.follow = options.follow;
+  return normalized;
+}
+function streamwindowof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  const window2 = {};
+  if (typeof options.budget === "number" && Number.isFinite(options.budget)) window2.budget = options.budget;
+  return window2;
+}
+function jsonpathrulesof(value) {
+  if (!Array.isArray(value)) return [];
+  const rules = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const entry = item;
+    if (typeof entry.name !== "string" || !entry.name.trim()) continue;
+    if (typeof entry.path !== "string" || !entry.path.trim()) continue;
+    const rule = { name: entry.name.trim(), path: entry.path.trim() };
+    if (entry.kind === "text" || entry.kind === "number" || entry.kind === "boolean" || entry.kind === "json") rule.kind = entry.kind;
+    if (entry.default !== void 0) rule.default = entry.default;
+    rules.push(rule);
+  }
+  return rules;
+}
+function htmlqueriesof(value) {
+  if (!Array.isArray(value)) return [];
+  const queries = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const entry = item;
+    if (typeof entry.selector !== "string" || !entry.selector.trim()) continue;
+    const query = { selector: entry.selector.trim() };
+    if (typeof entry.attribute === "string" && entry.attribute.trim()) query.attribute = entry.attribute.trim();
+    if (entry.multi === true) query.multi = true;
+    queries.push(query);
+  }
+  return queries;
+}
+function graphqlrequestof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.query !== "string" || !options.query.trim()) return void 0;
+  if (options.operationkind !== "query" && options.operationkind !== "mutation") return void 0;
+  const request = { query: options.query, operationkind: options.operationkind };
+  if (options.variables && typeof options.variables === "object" && !Array.isArray(options.variables)) request.variables = options.variables;
+  if (typeof options.operationname === "string" && options.operationname.trim()) request.operationname = options.operationname.trim();
+  return request;
+}
+var realsleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+async function sendfetch(input) {
+  const options = input.options ?? {};
+  const sleep = input.sleep ?? realsleep;
+  const now = input.now ?? Date.now;
+  const attempts = Math.max(1, Math.floor(options.retries ?? 0) + 1);
+  const backoff = options.backoff ?? 0;
+  const follow = options.follow ?? Number.POSITIVE_INFINITY;
+  let url = input.request.url;
+  let method = (input.request.method ?? "GET").toUpperCase();
+  let retries = 0;
+  let redirects = 0;
+  let lastreason = "";
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    let hops = 0;
+    const startedat = now();
+    let response;
+    try {
+      const init = { method, headers: { ...input.request.headers ?? {} }, ...input.request.body !== void 0 && !bodilessmethods.has(method) ? { body: input.request.body } : {}, ...input.request.mode !== void 0 ? { mode: input.request.mode } : {}, redirect: follow <= 0 ? "error" : "follow" };
+      const sent = input.transport(url, init);
+      if (options.timeout !== void 0 && Number.isFinite(options.timeout) && options.timeout >= 0) {
+        let timedout = false;
+        response = await Promise.race([sent, sleep(options.timeout).then(() => {
+          timedout = true;
+          return void 0;
+        })]).then((value) => value ?? (timedout ? (() => {
+          throw new Error(`The request timed out after ${options.timeout} milliseconds.`);
+        })() : value));
+      } else {
+        response = await sent;
+      }
+      while (response !== void 0 && redirectstatuses.has(response.status) && typeof response.location === "string" && response.location) {
+        hops += 1;
+        if (hops > follow) throw new Error(`The redirect chain exceeded the reviewed follow limit of ${follow}.`);
+        url = new URL(response.location, url).toString();
+        if (method === "POST" && [301, 302, 303].includes(response.status)) method = "GET";
+        response = await input.transport(url, { ...init, method });
+      }
+      redirects = hops;
+    } catch (error) {
+      lastreason = error instanceof Error ? error.message : String(error);
+      response = void 0;
+    }
+    if (response !== void 0) {
+      const body = response.body;
+      return { url, status: response.status, statusclass: statusclassof(response.status), headernames: Object.keys(response.headers), body, bytes: body.length, duration: now() - startedat, retries, redirects };
+    }
+    if (attempt < attempts) {
+      const wait = backoff * attempt;
+      if (wait > 0) await sleep(wait);
+      input.onretry?.(attempt, wait, lastreason);
+      retries = attempt;
+    }
+  }
+  throw new Error(`The request failed after ${attempts} attempt${attempts === 1 ? "" : "s"} with ${retries} retr${retries === 1 ? "y" : "ies"}: ${lastreason}`);
+}
+async function readstream(input) {
+  const pull = typeof input.chunks === "function" ? input.chunks : /* @__PURE__ */ ((source) => {
+    let index = 0;
+    return async () => source[index++];
+  })(input.chunks);
+  let count = 0;
+  let total = 0;
+  for (; ; ) {
+    if (input.window.abort?.() === true) return { chunks: count, bytes: total, aborted: true, reason: "The reviewed abort flag stopped the stream." };
+    const chunk = await pull();
+    if (chunk === void 0) return { chunks: count, bytes: total, aborted: false };
+    const next = total + chunk.length;
+    if (input.window.budget !== void 0 && next > input.window.budget) return { chunks: count, bytes: total, aborted: true, reason: `The stream aborted at ${next} bytes past the reviewed byte budget of ${input.window.budget}.` };
+    total = next;
+    count += 1;
+    input.window.onchunk?.(chunk, total);
+  }
+}
+function pathstep(current, segment) {
+  if (Array.isArray(current) && /^\d+$/.test(segment)) return current[Number.parseInt(segment, 10)];
+  if (current && typeof current === "object" && !Array.isArray(current)) return current[segment];
+  return void 0;
+}
+function coerce(value, kind, fallback) {
+  if (value === void 0 || value === null) return { value: fallback, missing: true };
+  if (kind === "text") return { value: String(value), missing: false };
+  if (kind === "number") {
+    const numeric = typeof value === "number" ? value : Number(value);
+    return Number.isFinite(numeric) ? { value: numeric, missing: false } : { value: fallback, missing: true };
+  }
+  if (kind === "boolean") return { value: value === true || value === "true", missing: false };
+  return { value, missing: false };
+}
+function readpath(parsed, rules) {
+  const fields = [];
+  for (const rule of rules) {
+    const kind = rule.kind ?? "text";
+    let current = parsed;
+    let missing = false;
+    for (const segment of rule.path.split(".")) {
+      const next = pathstep(current, segment);
+      if (next === void 0) {
+        missing = true;
+        break;
+      }
+      current = next;
+    }
+    if (missing) fields.push({ name: rule.name, path: rule.path, kind, ...rule.default !== void 0 ? { value: rule.default } : {}, missing: true });
+    else {
+      const resolved = coerce(current, kind, rule.default);
+      fields.push({ name: rule.name, path: rule.path, kind, ...resolved.value !== void 0 ? { value: resolved.value } : {}, ...resolved.missing ? { missing: true } : {} });
+    }
+  }
+  return fields;
+}
+function payloadvalid(payload, schema) {
+  if (!schema) return { ok: false, errors: ["The typed endpoint call needs a reviewed payload schema before it runs."] };
+  const errors = [];
+  for (const field of schema.fields) {
+    const value = payload[field.name];
+    if (value === void 0 || value === null) {
+      if (field.required === true) errors.push(`The required field ${field.name} of kind ${field.kind} is missing.`);
+      continue;
+    }
+    if (field.kind === "string" && typeof value !== "string") errors.push(`The field ${field.name} must be a string.`);
+    if (field.kind === "number" && (typeof value !== "number" || !Number.isFinite(value))) errors.push(`The field ${field.name} must be a finite number.`);
+    if (field.kind === "boolean" && typeof value !== "boolean") errors.push(`The field ${field.name} must be a boolean.`);
+  }
+  return { ok: errors.length === 0, errors };
+}
+function payloadwithdefaults(payload, schema) {
+  if (!schema) return payload;
+  const merged = { ...payload };
+  for (const field of schema.fields) {
+    if (merged[field.name] === void 0 && field.default !== void 0) merged[field.name] = field.default;
+  }
+  return merged;
+}
+function errorsof(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [body];
+    const record2 = parsed;
+    for (const key of ["errors", "messages", "error", "message"]) {
+      const value = record2[key];
+      if (Array.isArray(value)) return value.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item));
+      if (typeof value === "string") return [value];
+    }
+    return [body];
+  } catch {
+    return [body];
+  }
+}
+async function callrest(input) {
+  const check = payloadvalid(input.payload, input.endpoint.schema);
+  if (!check.ok) throw new Error(check.errors.join(" "));
+  const payload = payloadwithdefaults(input.payload, input.endpoint.schema);
+  const url = templateurl(input.endpoint.url, payload);
+  const method = input.endpoint.method.toUpperCase();
+  const request = { url, method, ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, ...bodilessmethods.has(method) ? {} : { body: JSON.stringify(payload) } };
+  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
+  const ok = input.success !== void 0 ? input.success.includes(transport.status) : transport.statusclass === "success";
+  return { transport, url, payload, ok, errors: ok ? [] : errorsof(transport.body) };
+}
+function graphqlopenvelope(request) {
+  return JSON.stringify({ query: request.query, ...request.variables !== void 0 ? { variables: request.variables } : {}, ...request.operationname !== void 0 ? { operationName: request.operationname } : {} });
+}
+function unwrapgraphql(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { errors: ["The graphql response is not a json object."] };
+  const record2 = value;
+  const errors = Array.isArray(record2.errors) ? record2.errors.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item)) : [];
+  return { ...record2.data !== void 0 ? { data: record2.data } : {}, errors };
+}
+async function callgraphql(input) {
+  const request = { url: input.endpoint.url, method: "POST", ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, body: graphqlopenvelope(input.request) };
+  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
+  try {
+    const unwrapped = unwrapgraphql(JSON.parse(transport.body));
+    return { transport, ...unwrapped.data !== void 0 ? { data: unwrapped.data } : {}, errors: unwrapped.errors };
+  } catch {
+    return { transport, errors: [transport.body] };
+  }
+}
+
 // extension/browsertabs.ts
 var browserkinds = /* @__PURE__ */ new Set(["tablist", "tabcreate", "tabactivate", "tabclose", "tabreload", "tabsnapshot", "windowlist", "windowcreate", "windowclose", "zoomset", "windowresize", "downloadfile"]);
 function isbrowserkind(kind) {
@@ -3977,7 +4587,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -4103,7 +4713,7 @@ async function propose(objective, remote) {
     if (!config) throw new Error("Configure an approved HTTPS endpoint before requesting a remote proposal.");
     const response = await fetch(config.endpoint, { method: "POST", headers: { "content-type": "application/json" }, credentials: "omit", body: requestbody({ objective: objective.trim(), session, observation, capabilities }) });
     if (!response.ok) throw new Error(`Proposal endpoint returned ${response.status}.`);
-    plan = parseproposal(await response.json(), session.origin).plan;
+    plan = parseproposal(await response.json(), session.origin, session.grants ?? [session.origin]).plan;
   }
   await memory.setplan(plan);
   await memory.setprogress(resetforplan(await memory.getprogress(), plan, Date.now()));
@@ -6458,6 +7068,190 @@ async function executemediastep(step, session, plan, tabid2, origin) {
   }
   throw new Error("Unsupported media kind.");
 }
+var activefetches = /* @__PURE__ */ new Map();
+var defaultconsentwindow = 10 * 60 * 1e3;
+async function livefetch(url, init, controller, window2, streamstate) {
+  const response = await fetch(url, { method: init.method, headers: init.headers, ...init.body !== void 0 ? { body: init.body } : {}, ...init.mode !== void 0 ? { mode: init.mode } : {}, redirect: init.redirect, credentials: "omit", signal: controller.signal });
+  const headers = {};
+  response.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  let body = "";
+  if (window2 !== void 0 && response.body !== null) {
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const pulled = await readstream({ chunks: async () => {
+      const { done, value } = await reader.read();
+      return done ? void 0 : decoder.decode(value, { stream: true });
+    }, window: window2 });
+    if (streamstate) {
+      streamstate.bytes = pulled.bytes;
+      streamstate.chunks = pulled.chunks;
+      streamstate.aborted = pulled.aborted;
+      streamstate.reason = pulled.reason;
+    }
+    if (pulled.aborted) controller.abort();
+    body = decoder.decode();
+  } else {
+    body = await response.text();
+  }
+  return { status: response.status, headers, body, ...response.redirected ? { redirected: true } : {} };
+}
+async function attachapikeys(names, origin) {
+  const headers = {};
+  const attached = [];
+  const refs = await memory.getapikeys();
+  for (const name of names) {
+    const ref = refs.find((item) => item.name === name);
+    if (!ref) throw new Error(`No stored api key reference matches ${name}.`);
+    if (!ref.origins.includes(origin)) throw new Error(`The api key ${name} is not scoped to ${origin}.`);
+    const secret = await memory.getsecret(ref.storageid);
+    if (secret === void 0) throw new Error(`The api key ${name} has no stored secret; set it from the review panel first.`);
+    headers[ref.header] = secret;
+    attached.push(name);
+  }
+  return { headers, keys: attached };
+}
+async function executehttpstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  if (step.kind === "fetchurl") {
+    const request = fetchrequestof(options.fetch);
+    if (!request) throw new Error("A reviewed fetch request with a url is required in options.fetch.");
+    const gate = origincheck(session, request.url);
+    if (!gate.allowed) throw new Error(gate.reason ?? "The outbound request stays outside the session origin grants.");
+    const callorigin = new URL(request.url).origin;
+    const names = Object.keys(request.headers ?? {});
+    if (names.length > 0) {
+      const consents = await memory.getfetchconsents();
+      const covering = consents.find((consent) => fetchconsentcovers(consent, callorigin, names, Date.now()));
+      if (!covering) {
+        const consentref = typeof options.consentref === "string" ? options.consentref : "";
+        const pending = consents.find((consent) => consent.approved !== true && consent.origin === callorigin && names.every((name) => consent.headers.some((header) => header.name.toLowerCase() === name.toLowerCase())));
+        const prompt = pending ?? { id: consentref || randomid(), origin: callorigin, headers: names.map((name) => ({ name, value: (request.headers ?? {})[name] ?? "" })), expiresat: Date.now() + defaultconsentwindow, at: Date.now() };
+        await memory.setfetchconsent(prompt);
+        await refreshbadge();
+        await audit("consent", `Fetch consent prompt ${prompt.id} opened for ${callorigin} with the header name${names.length === 1 ? "" : "s"} ${names.join(", ")}; header values stay out of the audit trail and appear only in the review prompt.`, extra);
+        return { ok: false, summary: `The fetch waits for your header consent approval${consentref ? ` under ref ${consentref}` : ""}; approve it in the review panel and run the step again.`, details: { fetchconsent: { id: prompt.id, origin: callorigin, headers: prompt.headers, stepid: step.id, approved: false, expirywindow: prompt.expiresat - prompt.at } } };
+      }
+    }
+    const policy = fetchoptionsof(options.fetchoptions);
+    const callid = randomid();
+    const controller = new AbortController();
+    activefetches.set(callid, controller);
+    const stream = options.stream !== void 0 ? streamwindowof(options.stream) : void 0;
+    const streamstate = { bytes: 0, chunks: 0, aborted: false };
+    const window2 = stream !== void 0 ? { ...stream, onchunk: (chunk, total) => {
+      streamstate.chunks += 1;
+      streamstate.bytes = total;
+    } } : void 0;
+    try {
+      const transport = (url, init) => livefetch(url, init, controller, window2, streamstate);
+      const result = await sendfetch({ request, ...policy !== void 0 && Object.keys(policy).length > 0 ? { options: policy } : {}, transport, onretry: (attempt, wait, reason) => {
+        void (async () => {
+          await memory.setprogress(recordfetchretry(await memory.getprogress(), plan.id, step.id, { attempt, url: request.url, wait, reason }, Date.now()));
+        })().catch(() => {
+        });
+      } });
+      const record2 = { id: callid, runid: plan.id, stepid: step.id, kind: "fetch", url: result.url, origin: new URL(result.url).origin, method: (request.method ?? "GET").toUpperCase(), status: result.status, statusclass: result.statusclass, duration: result.duration, retries: result.retries, bytes: result.bytes, headernames: names, body: result.body, ...streamstate.bytes > 0 ? { streambytes: streamstate.bytes } : {}, at: Date.now() };
+      await memory.addcall(record2);
+      await memory.setprogress(recordcall(await memory.getprogress(), plan.id, step.id, { id: record2.id, kind: record2.kind, origin: record2.origin, method: record2.method, status: record2.status, statusclass: record2.statusclass, duration: record2.duration, retries: record2.retries, bytes: record2.bytes }, Date.now()));
+      await refreshbadge();
+      await audit("call", `Fetched ${record2.method} ${record2.url} from the extension context ending in the ${record2.status} ${record2.statusclass} class after ${record2.retries} retr${record2.retries === 1 ? "y" : "ies"} with ${record2.bytes} body byte${record2.bytes === 1 ? "" : "s"}${names.length > 0 ? ` and ${names.length} consented header name${names.length === 1 ? "" : "s"}` : ""}; header values and body bytes stay out of the audit trail.`, extra);
+      return { ok: true, summary: `Fetched ${record2.url} ending in the ${record2.status} ${record2.statusclass} class.`, details: { transport: { status: record2.status, headers: result.headernames, bytes: record2.bytes, duration: record2.duration }, call: record2.id, retries: record2.retries, redirects: result.redirects, ...streamstate.bytes > 0 ? { stream: { bytes: streamstate.bytes, chunks: streamstate.chunks, budget: window2?.budget, aborted: streamstate.aborted, ...streamstate.reason !== void 0 ? { reason: streamstate.reason } : {} } } : {}, credentialcall: names.some((name) => credentialheadername(name)) } };
+    } finally {
+      controller.abort();
+      activefetches.delete(callid);
+    }
+  }
+  if (step.kind === "parsejson") {
+    const callid = typeof options.call === "string" ? options.call : "";
+    const stored = await memory.getcall(callid);
+    if (!stored) throw new Error(`No stored call matches ${callid}.`);
+    if (stored.body === void 0 || stored.bodyexpired) throw new Error("The stored call body expired from the retention window; fetch it again before parsing.");
+    let parsed;
+    try {
+      parsed = JSON.parse(stored.body);
+    } catch {
+      return { ok: false, summary: `The stored body of call ${callid} is not valid json.`, details: { call: callid, parseerror: true } };
+    }
+    const rules = jsonpathrulesof(options.fields);
+    const fields = readpath(parsed, rules);
+    const misses = fields.filter((field) => field.missing);
+    await memory.addcall({ ...stored, fields });
+    await audit("call", `Parsed the stored ${stored.method} body of ${stored.origin} into ${fields.length} named field${fields.length === 1 ? "" : "s"} with ${misses.length} path mis${misses.length === 1 ? "s" : "ses"} reported as outcomes.`, extra);
+    return { ok: true, summary: `Extracted ${fields.length} field${fields.length === 1 ? "" : "s"} from the stored body${misses.length > 0 ? ` with ${misses.length} path mis${misses.length === 1 ? "s" : "ses"} filled by the reviewed defaults` : ""}.`, details: { call: callid, fields, misses: misses.map((field) => field.name), transport: { status: stored.status, headers: [], bytes: stored.bytes, duration: stored.duration } } };
+  }
+  if (step.kind === "parsehtml") {
+    const callid = typeof options.call === "string" ? options.call : "";
+    const stored = await memory.getcall(callid);
+    if (!stored) throw new Error(`No stored call matches ${callid}.`);
+    if (stored.body === void 0 || stored.bodyexpired) throw new Error("The stored call body expired from the retention window; fetch it again before parsing.");
+    const queries = htmlqueriesof(options.queries);
+    const results = await bridgecall(tabid2, "parsehtmlmarkup", stored.body, queries);
+    await audit("call", `Parsed the stored ${stored.method} markup of ${stored.origin} through the page bridge domparser with ${queries.length} reviewed html quer${queries.length === 1 ? "y" : "ies"} over ${results.reduce((total, result) => total + result.count, 0)} matched element${results.reduce((total, result) => total + result.count, 0) === 1 ? "" : "s"}.`, extra);
+    return { ok: true, summary: `Ran ${queries.length} html quer${queries.length === 1 ? "y" : "ies"} over the fetched markup.`, details: { call: callid, queries: results, transport: { status: stored.status, headers: [], bytes: stored.bytes, duration: stored.duration } } };
+  }
+  if (step.kind === "callrest" || step.kind === "callgraphql") {
+    const endpointname = typeof options.endpoint === "string" ? options.endpoint : "";
+    const stored = await memory.getendpoint(endpointname);
+    if (!stored) throw new Error(`No stored typed endpoint matches ${endpointname}.`);
+    if (!stored.schema) throw new Error("Every typed endpoint call needs a reviewed payload schema; store the endpoint with one from the review panel.");
+    const policy = fetchoptionsof(options.fetchoptions);
+    const callid = randomid();
+    const controller = new AbortController();
+    activefetches.set(callid, controller);
+    try {
+      const transport = (url, init) => livefetch(url, init, controller);
+      const keynames = Array.isArray(options.apikeys) ? options.apikeys.filter((name) => typeof name === "string" && name.trim().length > 0) : [];
+      if (step.kind === "callrest") {
+        const methodoverride = typeof options.method === "string" ? options.method.trim().toUpperCase() : void 0;
+        const endpoint = { ...stored, ...methodoverride !== void 0 ? { method: methodoverride } : {} };
+        const payload = options.payload && typeof options.payload === "object" && !Array.isArray(options.payload) ? options.payload : {};
+        const resolvedurl = templateurl(endpoint.url, payloadwithdefaults(payload, endpoint.schema));
+        const urlgate2 = origincheck(session, resolvedurl);
+        if (!urlgate2.allowed) throw new Error(urlgate2.reason ?? "The typed call stays outside the session origin grants.");
+        const keys2 = keynames.length > 0 ? await attachapikeys(keynames, new URL(resolvedurl).origin) : { headers: {}, keys: [] };
+        const headers2 = { ...endpoint.headers ?? {}, ...keys2.headers };
+        const success = Array.isArray(options.success) ? options.success.filter((code) => typeof code === "number" && Number.isInteger(code)) : void 0;
+        const result2 = await callrest({ endpoint: { ...endpoint, ...Object.keys(headers2).length > 0 ? { headers: headers2 } : {} }, payload, ...policy !== void 0 && Object.keys(policy).length > 0 ? { options: policy } : {}, transport, ...success !== void 0 ? { success } : {}, onretry: (attempt, wait, reason) => {
+          void (async () => {
+            await memory.setprogress(recordfetchretry(await memory.getprogress(), plan.id, step.id, { attempt, url: resolvedurl, wait, reason }, Date.now()));
+          })().catch(() => {
+          });
+        } });
+        const record3 = { id: callid, runid: plan.id, stepid: step.id, kind: "rest", url: result2.url, origin: new URL(result2.url).origin, method: endpoint.method.toUpperCase(), status: result2.transport.status, statusclass: result2.transport.statusclass, duration: result2.transport.duration, retries: result2.transport.retries, bytes: result2.transport.bytes, headernames: [...Object.keys(endpoint.headers ?? {}), ...keynames.map((name) => `apikey:${name}`)], endpoint: endpointname, body: result2.transport.body, ...result2.errors.length > 0 ? { errors: result2.errors } : {}, at: Date.now() };
+        await memory.addcall(record3);
+        await memory.setprogress(recordcall(await memory.getprogress(), plan.id, step.id, { id: record3.id, kind: record3.kind, origin: record3.origin, method: record3.method, status: record3.status, statusclass: record3.statusclass, duration: record3.duration, retries: record3.retries, bytes: record3.bytes }, Date.now()));
+        await refreshbadge();
+        await audit("call", `Called the typed rest endpoint ${endpointname} with ${record3.method} on ${record3.origin} ending in the ${record3.status} ${record3.statusclass} class after ${record3.retries} retr${record3.retries === 1 ? "y" : "ies"}${mutationcallof(step) ? " as a reviewed mutating verb" : ""}${keys2.keys.length > 0 ? ` with ${keys2.keys.length} attached api key reference${keys2.keys.length === 1 ? "" : "s"}` : ""}; payload values, header values and body bytes stay out of the audit trail.`, extra);
+        return { ok: result2.ok, summary: `The typed rest call ${endpointname} ended in the ${record3.status} ${record3.statusclass} class.`, details: { transport: { status: record3.status, headers: result2.transport.headernames, bytes: record3.bytes, duration: record3.duration }, call: record3.id, endpoint: endpointname, payload: result2.payload, retries: record3.retries, ...result2.errors.length > 0 ? { errors: result2.errors } : {}, mutation: mutationcallof(step), credentialcall: keys2.keys.length > 0 } };
+      }
+      const request = graphqlrequestof(options.graphql);
+      if (!request) throw new Error("A reviewed graphql request with an operation and its kind is required in options.graphql.");
+      const urlgate = origincheck(session, stored.url);
+      if (!urlgate.allowed) throw new Error(urlgate.reason ?? "The typed call stays outside the session origin grants.");
+      const keys = keynames.length > 0 ? await attachapikeys(keynames, new URL(stored.url).origin) : { headers: {}, keys: [] };
+      const headers = { ...stored.headers ?? {}, ...keys.headers };
+      const result = await callgraphql({ endpoint: { ...stored, ...Object.keys(headers).length > 0 ? { headers } : {} }, request, ...policy !== void 0 && Object.keys(policy).length > 0 ? { options: policy } : {}, transport, onretry: (attempt, wait, reason) => {
+        void (async () => {
+          await memory.setprogress(recordfetchretry(await memory.getprogress(), plan.id, step.id, { attempt, url: stored.url, wait, reason }, Date.now()));
+        })().catch(() => {
+        });
+      } });
+      const record2 = { id: callid, runid: plan.id, stepid: step.id, kind: "graphql", url: result.transport.url, origin: new URL(result.transport.url).origin, method: "POST", status: result.transport.status, statusclass: result.transport.statusclass, duration: result.transport.duration, retries: result.transport.retries, bytes: result.transport.bytes, headernames: [...Object.keys(stored.headers ?? {}), ...keynames.map((name) => `apikey:${name}`)], endpoint: endpointname, body: result.transport.body, ...result.errors.length > 0 ? { errors: result.errors } : {}, at: Date.now() };
+      await memory.addcall(record2);
+      await memory.setprogress(recordcall(await memory.getprogress(), plan.id, step.id, { id: record2.id, kind: record2.kind, origin: record2.origin, method: record2.method, status: record2.status, statusclass: record2.statusclass, duration: record2.duration, retries: record2.retries, bytes: record2.bytes }, Date.now()));
+      await refreshbadge();
+      await audit("call", `Called the typed graphql endpoint ${endpointname} with a reviewed ${request.operationkind} on ${record2.origin} ending in the ${record2.status} ${record2.statusclass} class with ${result.errors.length} returned error${result.errors.length === 1 ? "" : "s"}${keys.keys.length > 0 ? ` and ${keys.keys.length} attached api key reference${keys.keys.length === 1 ? "" : "s"}` : ""}; variables, header values and body bytes stay out of the audit trail.`, extra);
+      return { ok: result.errors.length === 0 && result.transport.statusclass === "success", summary: `The graphql ${request.operationkind} ended in the ${record2.status} ${record2.statusclass} class with ${result.errors.length} error${result.errors.length === 1 ? "" : "s"}.`, details: { transport: { status: record2.status, headers: result.transport.headernames, bytes: record2.bytes, duration: record2.duration }, call: record2.id, endpoint: endpointname, operationkind: request.operationkind, retries: record2.retries, ...result.errors.length > 0 ? { errors: result.errors } : {}, ...result.data !== void 0 ? { datapaths: result.data && typeof result.data === "object" && !Array.isArray(result.data) ? Object.keys(result.data) : [] } : {}, mutation: request.operationkind === "mutation", credentialcall: keys.keys.length > 0 } };
+    } finally {
+      controller.abort();
+      activefetches.delete(callid);
+    }
+  }
+  throw new Error("Unsupported network observation kind.");
+}
 async function enforcewindowreview(step, session, plan) {
   const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
   const progress = plan ? await memory.getprogress() : void 0;
@@ -6499,8 +7293,9 @@ async function refreshbadge() {
   const captures = (await memory.getcaptures()).length;
   const media = (await memory.getmediarecords()).length + (await memory.getimagebatches()).length;
   const recordingprompts = (await memory.getrecordingconsents()).filter((record2) => record2.approved === void 0).length;
+  const fetchprompts = (await memory.getfetchconsents()).filter((consent) => consent.approved === void 0).length;
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -6558,6 +7353,8 @@ async function executestep(stepid) {
       output = await executecapturestep(step, session, plan, tab.id, origin);
     } else if (ismediakind(step.kind)) {
       output = await executemediastep(step, session, plan, tab.id, origin);
+    } else if (ishttpkind(step.kind)) {
+      output = await executehttpstep(step, session, plan, tab.id, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tab.id);
@@ -6756,6 +7553,14 @@ async function handlerequest(message, sender) {
       });
       const imagebatches = await memory.getimagebatches();
       const recordingconsents = await memory.getrecordingconsents();
+      const calls = (await memory.getcalls()).map((call) => {
+        const { body, ...metadata } = call;
+        void body;
+        return metadata;
+      });
+      const endpoints = await memory.getendpoints();
+      const fetchconsents = await memory.getfetchconsents();
+      const apikeys = (await memory.getapikeys()).map((ref) => ({ name: ref.name, origins: ref.origins, header: ref.header, configuredat: ref.configuredat }));
       const runsettings = await memory.getsettings();
       const scanhooks = [];
       for (const hook of await memory.getscanhooks()) {
@@ -6767,7 +7572,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -7341,8 +8146,78 @@ async function handlerequest(message, sender) {
       await audit("configure", `The user set the recording duration window of the run to ${window2} milliseconds; recordings never run past it.`);
       return { recordingwindow: window2 };
     }
+    case "setcallretention": {
+      const inputretention = message;
+      const retention = inputretention.retention;
+      if (retention !== void 0 && (typeof retention !== "number" || !Number.isFinite(retention) || retention < 0)) throw new Error("The call body retention window must be zero or a positive number of records with no code ceiling.");
+      const settings = await memory.getsettings();
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { callretention: retention } : {} });
+      await audit("configure", `The user set the outbound call body retention window to ${retention === void 0 ? "keep every body" : `${retention} record${retention === 1 ? "" : "s"}`}; the call metadata always survives for the audit trail.`);
+      return { callretention: retention };
+    }
+    case "approvefetchconsent": {
+      const inputconsent = message;
+      const record2 = (await memory.getfetchconsents()).find((item) => item.id === inputconsent.id);
+      if (!record2) throw new Error("No fetch consent prompt matches the requested id.");
+      await memory.setfetchconsent({ ...record2, approved: inputconsent.approved !== false });
+      const session = await memory.getsession();
+      await audit("consent", `Fetch consent prompt ${record2.id} for ${record2.origin} with the header name${record2.headers.length === 1 ? "" : "s"} ${record2.headers.map((header) => header.name).join(", ")} ${inputconsent.approved !== false ? "approved" : "declined"} by the user; the prompt appears once per origin and expires on the reviewed window.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return { id: record2.id, approved: inputconsent.approved !== false };
+    }
+    case "configureendpoint": {
+      const inputendpoint = message;
+      const candidate = { name: inputendpoint.name ?? "", method: inputendpoint.method ?? "", url: inputendpoint.url ?? "", ...inputendpoint.headers !== void 0 ? { headers: inputendpoint.headers } : {}, ...inputendpoint.schema !== void 0 ? { schema: inputendpoint.schema } : {}, version: 1, at: Date.now() };
+      const gate = validateendpointrecord(candidate);
+      if (!gate.allowed) throw new Error(gate.reason);
+      const normalized = normalizeendpoint(candidate.url);
+      const record2 = { name: candidate.name.trim(), method: candidate.method.trim().toUpperCase(), url: normalized.endpoint, ...candidate.headers !== void 0 ? { headers: candidate.headers } : {}, ...inputendpoint.schema !== void 0 ? { schema: inputendpoint.schema } : {}, version: 1, at: Date.now() };
+      await memory.setendpoint(record2);
+      const session = await memory.getsession();
+      await audit("call", `Stored the typed endpoint ${record2.name} version as ${record2.method} ${normalized.endpoint} with a reviewed payload schema and header allowlist; every stored version stays in the history.`, { ...session ? { sessionid: session.id } : {} });
+      const stored = await memory.getendpoint(record2.name);
+      return stored;
+    }
+    case "setapikey": {
+      const inputkey = message;
+      if (!inputkey.name?.trim()) throw new Error("A reviewed api key name is required.");
+      if (!Array.isArray(inputkey.origins) || inputkey.origins.length === 0 || !inputkey.origins.every((item) => typeof item === "string" && /^https:\/\//.test(item))) throw new Error("The api key needs a reviewed non-empty list of HTTPS origin scopes.");
+      if (!inputkey.header?.trim()) throw new Error("A reviewed header name is required for the api key.");
+      if (typeof inputkey.value !== "string" || !inputkey.value) throw new Error("The api key needs its secret value; it stays out of every audit trail.");
+      const ref = { name: inputkey.name.trim(), origins: inputkey.origins, header: inputkey.header.trim(), storageid: `apikey-${inputkey.name.trim()}`, configuredat: Date.now() };
+      await memory.setapikey(ref);
+      await memory.setsecret(ref.storageid, inputkey.value);
+      const session = await memory.getsession();
+      await audit("call", `Stored the api key reference ${ref.name} for ${ref.origins.join(", ")} attaching header ${ref.header}; the key material itself never enters the audit trail.`, { ...session ? { sessionid: session.id } : {} });
+      return { name: ref.name, origins: ref.origins, header: ref.header, configuredat: ref.configuredat };
+    }
+    case "deleteapikey": {
+      const inputdeletekey = message;
+      if (!inputdeletekey.name?.trim()) throw new Error("A reviewed api key name is required.");
+      await memory.removeapikey(inputdeletekey.name.trim());
+      const session = await memory.getsession();
+      await audit("call", `Removed the api key reference ${inputdeletekey.name.trim()} and its stored secret.`, { ...session ? { sessionid: session.id } : {} });
+      return { name: inputdeletekey.name.trim(), deleted: true };
+    }
+    case "callsreport":
+      return callsreport({ calls: await memory.getcalls() });
+    case "exportcalls": {
+      const session = await memory.getsession();
+      if (!session || session.stoppedat || session.expiresat <= Date.now()) throw new Error("Call list exports stay behind the consent gate of an active session.");
+      const granted = await chrome.permissions.contains({ permissions: ["downloads"] }).catch(() => false);
+      if (!granted) throw new Error("The call list export needs the downloads capability; request it from the review panel.");
+      const report = callsreport({ calls: await memory.getcalls() });
+      const dataurl = `data:application/json;base64,${btoa(JSON.stringify(report, null, 2))}`;
+      await chrome.downloads.download({ url: dataurl, filename: `devthink-calls-${Date.now()}.json` });
+      await audit("call", `The review panel exported ${report.calls.length} call record${report.calls.length === 1 ? "" : "s"} through the reviewed download flow with every response body held back.`, { sessionid: session.id });
+      return { exported: report.calls.length };
+    }
     case "stop": {
       const session = await memory.getsession();
+      for (const [id, controller] of [...activefetches.entries()]) {
+        controller.abort();
+        activefetches.delete(id);
+      }
       for (const [id, active] of [...activerecordings.entries()]) {
         const finished = finishrecording(active.record, Date.now());
         await memory.addmedia(finished).catch(() => {