@wenathlan/extension 1.1.42 → 1.1.44

package/extension/dist/background.js

@@ -862,15 +862,22 @@ var sessionmemory = class {
   async getfetchconsents() {
     return await this.adapter.get("fetchconsents") ?? [];
   }
-  /** Stores one api key reference record without any key material; the secret value stays behind its storage id. */
-  async setapikey(ref) {
-    const records = (await this.adapter.get("apikeys") ?? []).filter((item) => item.name !== ref.name);
-    await this.adapter.set("apikeys", [ref, ...records]);
+  /** Stores one api key entry with its origin scope and created time, replacing the previous entry of that name; the key material stays behind its storage id. */
+  async setapikey(entry) {
+    const records = (await this.adapter.get("apikeys") ?? []).filter((item) => item.name !== entry.name);
+    await this.adapter.set("apikeys", [entry, ...records]);
   }
-  /** Returns every stored api key reference with its origin scope, header name and storage id; key material never loads here. */
+  /** Returns every stored api key entry with its origin scope, header name, storage id and last use timestamp; key material never loads here. */
   async getapikeys() {
     return await this.adapter.get("apikeys") ?? [];
   }
+  /** Stamps the last use timestamp of one stored api key entry without ever loading the key material. */
+  async touchapikey(name, at) {
+    const records = await this.getapikeys();
+    const entry = records.find((item) => item.name === name);
+    if (!entry) return;
+    await this.adapter.set("apikeys", [{ ...entry, lastuse: at }, ...records.filter((item) => item.name !== name)]);
+  }
   /** Removes one api key reference and its stored secret together. */
   async removeapikey(name) {
     const records = await this.getapikeys();
@@ -886,6 +893,155 @@ var sessionmemory = class {
   async getsecret(storageid) {
     return this.adapter.get(storageid);
   }
+  /** Stores one channel record of a socket or event stream, replacing the previous record of that id. */
+  async addchannel(record2) {
+    const records = (await this.adapter.get("channels") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("channels", [record2, ...records]);
+  }
+  /** Returns every stored channel record, newest first. */
+  async getchannels() {
+    return await this.adapter.get("channels") ?? [];
+  }
+  /** Returns one channel record by its id. */
+  async getchannel(id) {
+    return (await this.getchannels()).find((item) => item.id === id);
+  }
+  /** Queues one message envelope of a channel stream, keeping the arrival order for the waitmessage matchers. */
+  async addmessage(envelope) {
+    const records = (await this.adapter.get("messages") ?? []).filter((item) => !(item.channelid === envelope.channelid && item.sequence === envelope.sequence));
+    await this.adapter.set("messages", [...records, envelope]);
+  }
+  /** Returns every queued message envelope, oldest first, optionally filtered by channel and stream. */
+  async getmessages(channelid, stream) {
+    const records = await this.adapter.get("messages") ?? [];
+    return records.filter((item) => (channelid === void 0 || item.channelid === channelid) && (stream === void 0 || item.stream === stream));
+  }
+  /** Drops the matched message envelopes of one channel from the queue once a waitmessage step consumed them. */
+  async drainmessages(sequences) {
+    const records = await this.adapter.get("messages") ?? [];
+    const kept = records.filter((item) => !sequences.some((match) => match.channelid === item.channelid && match.sequence === item.sequence));
+    await this.adapter.set("messages", kept);
+  }
+  /** Stores one observed exchange record, replacing the previous record of that id. */
+  async addexchange(record2) {
+    const records = (await this.adapter.get("exchanges") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("exchanges", [record2, ...records]);
+  }
+  /** Returns every stored exchange record, newest first. */
+  async getexchanges() {
+    return await this.adapter.get("exchanges") ?? [];
+  }
+  /** Returns one exchange record by its id. */
+  async getexchange(id) {
+    return (await this.getexchanges()).find((item) => item.id === id);
+  }
+  /** Returns the exchange records filtered by run, origin and status; the status filter accepts one code or the failed class of every exchange with an error class. */
+  async listexchanges(filter) {
+    const records = await this.getexchanges();
+    return records.filter((item) => (filter.runid === void 0 || item.runid === filter.runid) && (filter.origin === void 0 || item.origin === filter.origin) && (filter.status === void 0 || (filter.status === "failed" ? item.errorclass !== void 0 : item.status === filter.status)));
+  }
+  /** Stores one captured response body with its mime type and byte size; the user configured body retention window expires the oldest bodies while the exchange metadata always survives. */
+  async addbody(record2) {
+    const records = await this.getbodies();
+    const retention = (await this.getsettings())?.bodyretention;
+    const combined = [record2, ...records.filter((item) => item.ref !== record2.ref)];
+    const stored = retention === void 0 ? combined : combined.map((item, index) => index < retention ? item : expirebodybytes(item));
+    await this.adapter.set("bodies", stored);
+  }
+  /** Returns every captured body record, newest first. */
+  async getbodies() {
+    return await this.adapter.get("bodies") ?? [];
+  }
+  /** Returns one captured body record with its stored text by its reference. */
+  async getbody(ref) {
+    return (await this.getbodies()).find((item) => item.ref === ref);
+  }
+  /** Stores the page api map of one origin, replacing the previous map of that origin. */
+  async setapimap(origin, entries) {
+    const records = (await this.adapter.get("apimap") ?? []).filter((item) => item.origin !== origin);
+    await this.adapter.set("apimap", [...entries, ...records]);
+  }
+  /** Returns every stored page api map entry, newest first. */
+  async getapimap() {
+    return await this.adapter.get("apimap") ?? [];
+  }
+  /** Stores one event stream subscription record, replacing the previous record of that id. */
+  async setsubscription(record2) {
+    const records = (await this.adapter.get("subscriptions") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("subscriptions", [record2, ...records]);
+  }
+  /** Returns every stored event stream subscription, newest first. */
+  async getsubscriptions() {
+    return await this.adapter.get("subscriptions") ?? [];
+  }
+  /** Stores one registered request block rule of a run, replacing the previous rule of that id; every rule reverts and stays auditable after the run ends. */
+  async addblockrule(rule) {
+    const records = (await this.adapter.get("blockrules") ?? []).filter((item) => item.id !== rule.id);
+    await this.adapter.set("blockrules", [rule, ...records]);
+  }
+  /** Returns every stored block rule, newest first. */
+  async getblockrules() {
+    return await this.adapter.get("blockrules") ?? [];
+  }
+  /** Stores one registered response mock fixture of a run, replacing the previous fixture of that id; the fixture body stays out of every audit trail. */
+  async addmockspec(spec) {
+    const records = (await this.adapter.get("mockspecs") ?? []).filter((item) => item.id !== spec.id);
+    await this.adapter.set("mockspecs", [spec, ...records]);
+  }
+  /** Returns every stored mock fixture, newest first. */
+  async getmockspecs() {
+    return await this.adapter.get("mockspecs") ?? [];
+  }
+  /** Stores one registered header rewrite rule of a run, replacing the previous rule of that id; the provenance of every applied rule stays auditable. */
+  async addheaderule(rule) {
+    const records = (await this.adapter.get("headerules") ?? []).filter((item) => item.id !== rule.id);
+    await this.adapter.set("headerules", [rule, ...records]);
+  }
+  /** Returns every stored header rewrite rule, newest first. */
+  async getheaderules() {
+    return await this.adapter.get("headerules") ?? [];
+  }
+  /** Stores one cookie operation of a run per domain with its timestamp; cookie values never enter the operation record. */
+  async addcookieop(operation) {
+    const records = await this.adapter.get("cookieops") ?? [];
+    await this.adapter.set("cookieops", [operation, ...records]);
+  }
+  /** Returns every stored cookie operation, newest first, optionally filtered by domain. */
+  async getcookieops(domain) {
+    const records = await this.adapter.get("cookieops") ?? [];
+    return records.filter((item) => domain === void 0 || item.domain === domain);
+  }
+  /** Stores one token record of a provider with scopes, origin scope and expiry; the token values stay behind their storage ids. */
+  async addtoken(record2) {
+    const records = (await this.adapter.get("tokens") ?? []).filter((item) => item.id !== record2.id);
+    await this.adapter.set("tokens", [record2, ...records]);
+  }
+  /** Returns every stored token record, newest first, optionally filtered by provider; token values never load here. */
+  async listtokens(provider) {
+    const records = await this.adapter.get("tokens") ?? [];
+    return records.filter((item) => provider === void 0 || item.provider === provider);
+  }
+  /** Stores one applied proxy route of a run with its apply time, replacing the previous route of that id; the history keeps the revert times. */
+  async addproxyroute(route) {
+    const records = (await this.adapter.get("proxyroutes") ?? []).filter((item) => item.id !== route.id);
+    await this.adapter.set("proxyroutes", [route, ...records]);
+  }
+  /** Returns every stored proxy route with apply and revert times, newest first. */
+  async getproxyroutes() {
+    return await this.adapter.get("proxyroutes") ?? [];
+  }
+  /** Stores one parsed rate limit read per origin, replacing the previous read of that origin. */
+  async setratelimit(read) {
+    const records = (await this.adapter.get("ratelimits") ?? []).filter((item) => item.origin !== read.origin);
+    await this.adapter.set("ratelimits", [read, ...records]);
+  }
+  /** Returns every stored rate limit read whose reset window has not passed yet; expired states drop out at their reset windows. */
+  async getratelimits(now) {
+    const records = await this.adapter.get("ratelimits") ?? [];
+    const live = records.filter((item) => item.resetat > now);
+    if (live.length !== records.length) await this.adapter.set("ratelimits", live);
+    return live;
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -920,207 +1076,1174 @@ function expirecallbody(record2) {
   void body;
   return { ...metadata, bodyexpired: true };
 }
+function expirebodybytes(record2) {
+  const { body, ...metadata } = record2;
+  void body;
+  return { ...metadata, bodyexpired: true };
+}
 function randomid() {
   return crypto.randomUUID();
 }
 
-// policy.ts
-var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql"]);
-var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml"]);
-var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
-var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
-var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
-var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "pausedownload", "resumedownload", "verifydownload", "writeclipboard", "quarantinedownload", "scanvirus"]);
-var tabscommandactions = /* @__PURE__ */ new Set(["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"]);
-var formactions = /* @__PURE__ */ new Set(["fillform", "filllabel", "fillplaceholder", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "submitform", "readerrors", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "handoffcaptcha", "fillcard", "fillcode", "consentpassword", "skiphoneypot", "detectlogin", "detecttemplate"]);
-var datasetactions = /* @__PURE__ */ new Set(["scrapetable", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "importcsv", "looprows", "transformvalues", "deduperows", "paginateextract", "mergepages", "stamplerows", "previewgrid", "streamdisk", "resumeextract", "logprovenance"]);
-var exportactions = /* @__PURE__ */ new Set(["exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk"]);
-var filesactions = /* @__PURE__ */ new Set(["batchdownload", "pausedownload", "resumedownload", "verifydownload", "interceptmime", "exportnetlog", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "namecaptures", "cleanupartifacts"]);
-var captureactions = /* @__PURE__ */ new Set(["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"]);
-var mediaactions = /* @__PURE__ */ new Set(["capturepdf", "recordscreen", "captureaudio", "captureframe", "downloadimages", "shotcanvas", "probestream", "readmedia", "readassets", "timelapse", "convertimage", "makethumbs"]);
-var httpactions = /* @__PURE__ */ new Set(["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"]);
-var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
-var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
-var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
-var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
-function normalizeendpoint(value) {
-  const endpoint = new URL(value.trim());
-  if (endpoint.protocol !== "https:") throw new Error("Devthink accepts HTTPS endpoints only.");
-  if (endpoint.username || endpoint.password) throw new Error("Endpoint credentials are not allowed in the URL.");
-  return { endpoint: endpoint.toString(), origin: endpoint.origin, configuredat: Date.now() };
-}
-function hostpattern(origin) {
-  const parsed = new URL(origin);
-  if (parsed.protocol !== "https:") throw new Error("Only HTTPS origins can be granted.");
-  return `${parsed.origin}/*`;
-}
-function actionrisk(kind) {
-  if (!allowedactions.has(kind)) throw new Error("Unsupported browser action.");
-  if (sensitiveactions.has(kind)) return "sensitive";
-  return interactionactions.has(kind) ? "interaction" : "read";
-}
-function parseoptions(step) {
-  if (step.options === void 0) return {};
-  let parsed;
+// socketbus.ts
+var socketkinds = ["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"];
+function channelorigin(url) {
   try {
-    parsed = JSON.parse(step.options);
+    const parsed = new URL(url);
+    const protocol = parsed.protocol === "wss:" ? "https:" : parsed.protocol === "ws:" ? "http:" : parsed.protocol;
+    return `${protocol}//${parsed.host}`;
   } catch {
-    throw new Error("Step options must be a JSON object.");
+    return "";
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Step options must be a JSON object.");
-  return parsed;
-}
-function requiredcapability(kind) {
-  if (kind === "tablist") return "tabs";
-  if (kind === "downloadfile") return "downloads";
-  if (kind === "openclipboard") return "clipboardRead";
-  if (kind === "copytable") return "clipboardWrite";
-  if (kind === "batchdownload" || kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "interceptmime" || kind === "quarantinedownload" || kind === "scanvirus") return "downloads";
-  if (kind === "readclipboard") return "clipboardRead";
-  if (kind === "writeclipboard" || kind === "copyscreen") return "clipboardWrite";
-  if (kind === "downloadimages") return "downloads";
-  if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
-  if (tabscommandactions.has(kind)) return "tabs";
-  return void 0;
-}
-function istabscommandkind(kind) {
-  return tabscommandactions.has(kind);
-}
-function islayoutkind(kind) {
-  return layoutmutationactions.has(kind);
 }
-function isformkind(kind) {
-  return formactions.has(kind);
-}
-function isdatasetkind(kind) {
-  return datasetactions.has(kind);
+function channeloptionsof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  if (typeof entry.url !== "string" || !entry.url.trim()) return void 0;
+  const options = {};
+  if (Array.isArray(entry.protocols)) options.protocols = entry.protocols.filter((item) => typeof item === "string" && item.trim().length > 0);
+  if (typeof entry.reconnect === "number" && Number.isFinite(entry.reconnect)) options.reconnect = entry.reconnect;
+  if (typeof entry.backoff === "number" && Number.isFinite(entry.backoff)) options.backoff = entry.backoff;
+  if (typeof entry.backoffceiling === "number" && Number.isFinite(entry.backoffceiling)) options.backoffceiling = entry.backoffceiling;
+  if (typeof entry.lifetime === "number" && Number.isFinite(entry.lifetime)) options.lifetime = entry.lifetime;
+  return { url: entry.url.trim(), options };
+}
+function newchannel(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, kind: input.kind, url: input.url, origin: channelorigin(input.url), state: "connecting", openedat: input.at, sent: 0, received: 0, reconnects: 0, ...input.protocols !== void 0 && input.protocols.length > 0 ? { protocols: [...input.protocols] } : {} };
+}
+function reconnectwaits(attempts, base, ceiling) {
+  const count = Math.max(0, Math.floor(attempts));
+  const waits = [];
+  let wait = Math.max(0, base);
+  for (let index = 0; index < count; index += 1) {
+    waits.push(wait);
+    const next = wait * 2;
+    wait = ceiling !== void 0 && Number.isFinite(ceiling) && ceiling >= 0 ? Math.min(next, ceiling) : next;
+  }
+  return waits;
+}
+async function openchannel(input) {
+  const sleep = input.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds))));
+  const now = input.now ?? Date.now;
+  const attempts = Math.max(1, Math.floor(input.options.reconnect ?? 0) + 1);
+  const waits = reconnectwaits(attempts - 1, input.options.backoff ?? 0, input.options.backoffceiling);
+  let record2 = { ...input.record, state: "connecting" };
+  let lasterror = "";
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    try {
+      const result = await input.connect(record2.url, record2.protocols ?? []);
+      if (result.open) return { ...record2, state: "open", openedat: now() };
+      lasterror = result.error ?? `closed with code ${result.code ?? 0}`;
+    } catch (error) {
+      lasterror = error instanceof Error ? error.message : String(error);
+    }
+    if (attempt < attempts - 1) {
+      const wait = waits[attempt] ?? 0;
+      if (wait > 0) await sleep(wait);
+      record2 = { ...record2, reconnects: record2.reconnects + 1 };
+    }
+  }
+  return { ...record2, state: "failed", error: lasterror };
 }
-function isexportkind(kind) {
-  return exportactions.has(kind);
+function closechannel(record2, at, error) {
+  const state = error !== void 0 ? "failed" : "closed";
+  return { ...record2, state, closedat: at, ...error !== void 0 ? { error } : {} };
 }
-function isfileskind(kind) {
-  return filesactions.has(kind);
+function tagmessage(state, channelid, stream, payload, at) {
+  const sequence = (state.sequences[channelid] ?? 0) + 1;
+  const envelope = { channelid, stream, payload, sequence, at };
+  return { state: { sequences: { ...state.sequences, [channelid]: sequence }, queue: state.queue }, envelope };
 }
-function iscapturekind(kind) {
-  return captureactions.has(kind);
+function publishmessage(state, channelid, stream, payload, at) {
+  return tagmessage(state, channelid, stream, payload, at);
 }
-function capturegate(session, tabid2, origin, now) {
-  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the capture." };
-  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot capture." };
-  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot capture." };
-  if (session.tabid !== tabid2) return { allowed: false, reason: `The capture needs the active tab grant of session tab ${session.tabid} and refuses tab ${tabid2}.` };
-  if (!origingranted(session, origin)) return { allowed: false, reason: `The capture of ${origin} needs the session origin grants first.` };
-  return { allowed: true };
+function receivemessage(state, channelid, stream, payload, at) {
+  const tagged = tagmessage(state, channelid, stream, payload, at);
+  return { state: { ...tagged.state, queue: [...state.queue, tagged.envelope] }, envelope: tagged.envelope };
 }
-function validatecaptureoptions(value) {
-  if (value === void 0) return { allowed: true };
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "The reviewed capture options must be an object in options.capture." };
-  const options = value;
-  if (options.format !== void 0 && options.format !== "png" && options.format !== "jpeg" && options.format !== "webp") return { allowed: false, reason: "The reviewed capture format must be png, jpeg or webp." };
-  if (options.quality !== void 0 && (typeof options.quality !== "number" || !Number.isFinite(options.quality) || options.quality < 0 || options.quality > 100)) return { allowed: false, reason: "The reviewed capture quality must stay between zero and one hundred; any value in that range is the user choice with no code cap." };
-  if (options.pixelratio !== void 0 && (typeof options.pixelratio !== "number" || !Number.isFinite(options.pixelratio) || options.pixelratio < 1)) return { allowed: false, reason: "The reviewed pixel ratio starts at one and climbs to any user configured ceiling with no code ceiling." };
-  if (options.annotate !== void 0 && typeof options.annotate !== "boolean") return { allowed: false, reason: "The reviewed capture annotation flag must be a boolean." };
-  if (options.exporttarget !== void 0 && options.exporttarget !== "memory" && options.exporttarget !== "download" && options.exporttarget !== "clipboard") return { allowed: false, reason: "The reviewed capture export target must be memory, download or clipboard." };
-  return { allowed: true };
+function pathstep(current, segment) {
+  if (Array.isArray(current) && /^\d+$/.test(segment)) return current[Number.parseInt(segment, 10)];
+  if (current && typeof current === "object" && !Array.isArray(current)) return current[segment];
+  return void 0;
 }
-function validateregionrect(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed regionrect with x, y, width and height in css pixels is required in options." };
-  const rect = value;
-  for (const field of ["x", "y", "width", "height"]) {
-    if (typeof rect[field] !== "number" || !Number.isFinite(rect[field])) return { allowed: false, reason: `The reviewed regionrect needs a numeric ${field} in css pixels.` };
+function matchmessage(filter, envelope) {
+  if (!filter) return true;
+  if (filter.stream !== void 0 && filter.stream !== envelope.stream) return false;
+  if (filter.path !== void 0) {
+    try {
+      const parsed = JSON.parse(envelope.payload);
+      let current = parsed;
+      let missing = false;
+      for (const segment of filter.path.split(".")) {
+        const next = pathstep(current, segment);
+        if (next === void 0) {
+          missing = true;
+          break;
+        }
+        current = next;
+      }
+      if (missing) return false;
+    } catch {
+      return false;
+    }
   }
-  if (rect.x < 0 || rect.y < 0) return { allowed: false, reason: "The reviewed regionrect refuses negative coordinates." };
-  if (rect.width <= 0 || rect.height <= 0) return { allowed: false, reason: "The reviewed regionrect needs positive width and height values." };
-  return { allowed: true };
+  return true;
 }
-function validatecapturenaming(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed capturenaming rule with run, step, sequence and kind flags is required." };
-  const rule = value;
-  const segments = ["run", "step", "sequence", "kind"];
-  for (const key of Object.keys(rule)) {
-    if (!segments.includes(key)) return { allowed: false, reason: `The reviewed capturenaming rule refuses the unknown ${key} segment; only run, step, sequence and kind participate.` };
-  }
-  for (const segment of segments) {
-    if (rule[segment] !== void 0 && typeof rule[segment] !== "boolean") return { allowed: false, reason: `The reviewed capturenaming ${segment} flag must be a boolean.` };
-  }
-  if (!segments.some((segment) => rule[segment] === true)) return { allowed: false, reason: "The reviewed capturenaming rule needs at least one enabled segment of run, step, sequence and kind." };
-  return { allowed: true };
+function messagefilterof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const entry = value;
+  const filter = {};
+  if (typeof entry.stream === "string" && entry.stream.trim()) filter.stream = entry.stream.trim();
+  if (typeof entry.path === "string" && entry.path.trim()) filter.path = entry.path.trim();
+  if (typeof entry.limit === "number" && Number.isFinite(entry.limit) && entry.limit >= 1) filter.limit = Math.floor(entry.limit);
+  return filter;
+}
+function parsessetext(text2) {
+  const separator = text2.lastIndexOf("\n\n");
+  const complete = separator === -1 ? "" : text2.slice(0, separator + 2);
+  const rest = separator === -1 ? text2 : text2.slice(separator + 2);
+  const events = [];
+  for (const block of complete.split(/\n\n/)) {
+    const id = [];
+    const names = [];
+    const data = [];
+    let retry;
+    for (const line of block.split("\n")) {
+      if (line === "" || line.startsWith(":")) continue;
+      const colon = line.indexOf(":");
+      const field = colon === -1 ? line : line.slice(0, colon);
+      let value = colon === -1 ? "" : line.slice(colon + 1);
+      if (value.startsWith(" ")) value = value.slice(1);
+      if (field === "id" && value !== "") id.push(value);
+      if (field === "event" && value !== "") names.push(value);
+      if (field === "data") data.push(value);
+      if (field === "retry" && /^\d+$/.test(value)) retry = Number.parseInt(value, 10);
+    }
+    if (id.length === 0 && names.length === 0 && data.length === 0) continue;
+    events.push({ ...id.length > 0 ? { id: id[id.length - 1] } : {}, ...names.length > 0 ? { event: names[names.length - 1] } : {}, data: data.join("\n"), ...retry !== void 0 ? { retry } : {} });
+  }
+  return { events, rest };
+}
+function sserequestheaders(record2) {
+  return { accept: "text/event-stream", ...record2.lasteventid !== void 0 && record2.lasteventid !== "" ? { "last-event-id": record2.lasteventid } : {} };
+}
+function subscriptionoptionsof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  if (typeof entry.url !== "string" || !entry.url.trim()) return void 0;
+  const cancel = entry.cancel;
+  if (!cancel || typeof cancel !== "object" || Array.isArray(cancel)) return void 0;
+  const cancelrecord = cancel;
+  if (cancelrecord.kind !== "stop" && cancelrecord.kind !== "lifetime") return void 0;
+  if (typeof cancelrecord.value !== "string" && typeof cancelrecord.value !== "number") return void 0;
+  const result = { url: entry.url.trim(), cancel: { kind: cancelrecord.kind, value: cancelrecord.value } };
+  if (typeof entry.lifetime === "number" && Number.isFinite(entry.lifetime) && entry.lifetime > 0) result.lifetime = entry.lifetime;
+  if (typeof entry.lasteventid === "string" && entry.lasteventid.trim()) result.lasteventid = entry.lasteventid.trim();
+  return result;
+}
+function pollcursorof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  if (typeof entry.url !== "string" || !entry.url.trim()) return void 0;
+  if (typeof entry.cursorfield !== "string" || !entry.cursorfield.trim()) return void 0;
+  if (typeof entry.interval !== "number" || !Number.isFinite(entry.interval) || entry.interval <= 0) return void 0;
+  const stop = entry.stop;
+  if (!stop || typeof stop !== "object" || Array.isArray(stop)) return void 0;
+  const stoprecord = stop;
+  if (typeof stoprecord.field !== "string" || !stoprecord.field.trim()) return void 0;
+  if (typeof stoprecord.equals !== "string") return void 0;
+  const cursor = { url: entry.url.trim(), cursorfield: entry.cursorfield.trim(), interval: entry.interval, stop: { field: stoprecord.field.trim(), equals: stoprecord.equals } };
+  if (typeof entry.maxpolls === "number" && Number.isFinite(entry.maxpolls) && entry.maxpolls >= 1) cursor.maxpolls = Math.floor(entry.maxpolls);
+  if (typeof entry.param === "string" && entry.param.trim()) cursor.param = entry.param.trim();
+  return cursor;
+}
+function cursorfrom(response, field) {
+  let current = response;
+  for (const segment of field.split(".")) {
+    const next = pathstep(current, segment);
+    if (next === void 0) return void 0;
+    current = next;
+  }
+  return current === void 0 || current === null ? void 0 : String(current);
+}
+function pollurl(cursor, value) {
+  if (cursor.param === void 0 || value === void 0) {
+    return { url: cursor.url, ...value !== void 0 ? { body: JSON.stringify({ [cursor.cursorfield]: value }) } : {} };
+  }
+  const url = new URL(cursor.url);
+  url.searchParams.set(cursor.param, value);
+  return { url: url.toString() };
+}
+function polldecision(input) {
+  if (input.cancelled?.() === true) return { continue: false, reason: "The long poll loop was cancelled." };
+  if (input.expiresat !== void 0 && input.now >= input.expiresat) return { continue: false, reason: "The long poll loop stopped at the reviewed plan expiry." };
+  const stopvalue = cursorfrom(input.response, input.cursor.stop.field);
+  if (stopvalue !== void 0 && stopvalue === input.cursor.stop.equals) return { continue: false, reason: `The stop condition matched ${input.cursor.stop.field} ${stopvalue}.` };
+  if (input.cursor.maxpolls !== void 0 && input.polls + 1 >= input.cursor.maxpolls) return { continue: false, reason: `The long poll loop reached the reviewed poll ceiling of ${input.cursor.maxpolls}.` };
+  const value = cursorfrom(input.response, input.cursor.cursorfield);
+  const next = pollurl(input.cursor, value);
+  return { continue: true, reason: "The long poll loop continues.", ...value !== void 0 ? { cursor: value } : {}, next: { ...next, wait: input.cursor.interval } };
 }
-function stitchbudgetallowed(tiles, settle2, wait) {
-  if (tiles <= 0) return { allowed: false, reason: "The stitch budget needs at least one tile." };
-  if (settle2 < 0 || wait < 0) return { allowed: false, reason: "The reviewed settle and wait windows must be zero or positive milliseconds." };
-  if (tiles * settle2 > wait) return { allowed: false, reason: `The stitching scroll budget of ${tiles} tiles at ${settle2} milliseconds exceeds the reviewed wait window of ${wait} milliseconds; review a wider window or a smaller settle.` };
-  return { allowed: true };
+
+// httpclient.ts
+var httpkinds = ["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"];
+var redirectstatuses = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var bodilessmethods = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+function statusclassof(status) {
+  if (status >= 100 && status < 200) return "informational";
+  if (status >= 200 && status < 300) return "success";
+  if (status >= 300 && status < 400) return "redirect";
+  if (status >= 400 && status < 500) return "clienterror";
+  if (status >= 500 && status < 600) return "servererror";
+  return "unknown";
 }
-function beforeafterwrapallowed(kind) {
-  return allowedactions.has(kind) && !captureactions.has(kind);
+function templateurl(template, values) {
+  return template.replace(/\{([a-z0-9_]+)\}/gi, (whole, name) => values[name] === void 0 ? whole : String(values[name]));
 }
-function validatecapturegrammar(step, options) {
-  const kind = step.kind;
-  const optioncheck = validatecaptureoptions(options.capture);
-  if (!optioncheck.allowed) return optioncheck;
-  if (options.settle !== void 0 && (typeof options.settle !== "number" || !Number.isFinite(options.settle) || options.settle < 0)) return { allowed: false, reason: "The reviewed capture settle window must be zero or a positive number of milliseconds." };
-  if (options.overlap !== void 0 && (typeof options.overlap !== "number" || !Number.isInteger(options.overlap) || options.overlap < 0)) return { allowed: false, reason: "The reviewed stitch overlap must be zero or a positive number of rows." };
-  if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed capture wait window must be zero or a positive number of milliseconds." };
-  if (options.naming !== void 0) {
-    const namingcheck = validatecapturenaming(options.naming);
-    if (!namingcheck.allowed) return namingcheck;
-  }
-  if (kind === "shotregion") {
-    const rectcheck = validateregionrect(options.regionrect);
-    if (!rectcheck.allowed) return rectcheck;
-    if (options.reviewed !== true) return { allowed: false, reason: "Every reviewed regionrect needs the explicit reviewed flag before shotregion runs." };
-    if (options.container !== void 0 && !isnonempty(options.container)) return { allowed: false, reason: "The reviewed scrollable container selector must be a non-empty string." };
-    if (options.steps !== void 0 && (typeof options.steps !== "number" || !Number.isInteger(options.steps) || options.steps < 1)) return { allowed: false, reason: "The reviewed container scroll steps must be a positive integer with no code ceiling." };
-  }
-  if (kind === "contactsheet") {
-    const elements = options.elements;
-    if (!Array.isArray(elements) || elements.length === 0 || !elements.every((item) => isnonempty(item))) return { allowed: false, reason: "A reviewed non-empty list of element selectors is required in options for the contact sheet; the cell count stays the user choice." };
-    const layout = options.sheet;
-    if (layout !== void 0) {
-      if (!layout || typeof layout !== "object" || Array.isArray(layout)) return { allowed: false, reason: "The reviewed sheetlayout must be an object with cellsize, columns and label." };
-      const sheet = layout;
-      if (typeof sheet.cellsize !== "number" || !Number.isFinite(sheet.cellsize) || sheet.cellsize <= 0) return { allowed: false, reason: "The reviewed contact sheet cell size must be a positive number of pixels." };
-      if (typeof sheet.columns !== "number" || !Number.isInteger(sheet.columns) || sheet.columns < 1) return { allowed: false, reason: "The reviewed contact sheet column count must be a positive integer with no code ceiling." };
-      if (sheet.label !== void 0 && sheet.label !== "none" && sheet.label !== "index" && sheet.label !== "selector" && sheet.label !== "both") return { allowed: false, reason: "The reviewed contact sheet label style must be none, index, selector or both." };
+function fetchrequestof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.url !== "string" || !options.url.trim()) return void 0;
+  const request = { url: options.url.trim() };
+  if (typeof options.method === "string" && options.method.trim()) request.method = options.method.trim().toUpperCase();
+  if (options.headers && typeof options.headers === "object" && !Array.isArray(options.headers)) {
+    const headers = {};
+    for (const [name, headervalue] of Object.entries(options.headers)) {
+      if (typeof headervalue === "string") headers[name] = headervalue;
     }
+    request.headers = headers;
   }
-  return { allowed: true };
+  if (typeof options.body === "string") request.body = options.body;
+  if (options.mode === "cors" || options.mode === "no-cors" || options.mode === "same-origin") request.mode = options.mode;
+  return request;
 }
-function exportgranted(session, origin) {
-  if (!origingranted(session, origin)) return { allowed: false, reason: `The export of extracted data from ${origin} needs the session origin grants before it leaves local memory.` };
-  return { allowed: true };
+function fetchoptionsof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  const normalized = {};
+  if (typeof options.timeout === "number" && Number.isFinite(options.timeout)) normalized.timeout = options.timeout;
+  if (typeof options.retries === "number" && Number.isFinite(options.retries)) normalized.retries = options.retries;
+  if (typeof options.backoff === "number" && Number.isFinite(options.backoff)) normalized.backoff = options.backoff;
+  if (typeof options.follow === "number" && Number.isFinite(options.follow)) normalized.follow = options.follow;
+  return normalized;
 }
-function validatefieldmatch(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed field match is required in options." };
-  const match = value;
-  if (match.mode !== "label" && match.mode !== "placeholder" && match.mode !== "arialabel" && match.mode !== "name") return { allowed: false, reason: "The reviewed field match mode must be label, placeholder, arialabel or name." };
-  const key = match.mode === "label" ? "label" : match.mode === "placeholder" ? "placeholder" : match.mode === "arialabel" ? "arialabel" : "name";
-  if (!isnonempty(match[key])) return { allowed: false, reason: `The reviewed ${match.mode} field match needs a non-empty ${key}.` };
-  return { allowed: true };
+function streamwindowof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const options = value;
+  const window2 = {};
+  if (typeof options.budget === "number" && Number.isFinite(options.budget)) window2.budget = options.budget;
+  return window2;
 }
-function validateformrecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed form record with entries is required in options." };
-  const record2 = value;
-  if (record2.form !== void 0 && !isnonempty(record2.form)) return { allowed: false, reason: "The reviewed form record form selector must be a non-empty string." };
-  if (!Array.isArray(record2.entries) || record2.entries.length === 0) return { allowed: false, reason: "The reviewed form record needs a non-empty list of entries." };
-  for (const item of record2.entries) {
-    if (!item || typeof item !== "object" || Array.isArray(item)) return { allowed: false, reason: "Every reviewed form record entry must be an object." };
+function jsonpathrulesof(value) {
+  if (!Array.isArray(value)) return [];
+  const rules = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
     const entry = item;
-    const matchcheck = validatefieldmatch(entry.match);
-    if (!matchcheck.allowed) return matchcheck;
-    if (typeof entry.kind !== "string" || !fieldkinds.includes(entry.kind)) return { allowed: false, reason: "Every reviewed form record entry needs a known field kind." };
-    if (typeof entry.value !== "string") return { allowed: false, reason: "Every reviewed form record entry needs a string value." };
-    if (entry.kind === "password") return { allowed: false, reason: "Password entries are refused inside form records; use consentpassword with a reviewed consent ref." };
+    if (typeof entry.name !== "string" || !entry.name.trim()) continue;
+    if (typeof entry.path !== "string" || !entry.path.trim()) continue;
+    const rule = { name: entry.name.trim(), path: entry.path.trim() };
+    if (entry.kind === "text" || entry.kind === "number" || entry.kind === "boolean" || entry.kind === "json") rule.kind = entry.kind;
+    if (entry.default !== void 0) rule.default = entry.default;
+    rules.push(rule);
   }
-  return { allowed: true };
+  return rules;
 }
-function validatevaluegen(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed valuegen rule with a field kind is required in options." };
-  const rule = value;
-  if (typeof rule.kind !== "string" || !fieldkinds.includes(rule.kind)) return { allowed: false, reason: "The reviewed valuegen kind must be a known field kind." };
-  if (rule.locale !== void 0 && !isnonempty(rule.locale)) return { allowed: false, reason: "The reviewed valuegen locale must be a non-empty string." };
+function htmlqueriesof(value) {
+  if (!Array.isArray(value)) return [];
+  const queries = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const entry = item;
+    if (typeof entry.selector !== "string" || !entry.selector.trim()) continue;
+    const query = { selector: entry.selector.trim() };
+    if (typeof entry.attribute === "string" && entry.attribute.trim()) query.attribute = entry.attribute.trim();
+    if (entry.multi === true) query.multi = true;
+    queries.push(query);
+  }
+  return queries;
+}
+function graphqlrequestof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.query !== "string" || !options.query.trim()) return void 0;
+  if (options.operationkind !== "query" && options.operationkind !== "mutation") return void 0;
+  const request = { query: options.query, operationkind: options.operationkind };
+  if (options.variables && typeof options.variables === "object" && !Array.isArray(options.variables)) request.variables = options.variables;
+  if (typeof options.operationname === "string" && options.operationname.trim()) request.operationname = options.operationname.trim();
+  return request;
+}
+var realsleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+async function sendfetch(input) {
+  const options = input.options ?? {};
+  const sleep = input.sleep ?? realsleep;
+  const now = input.now ?? Date.now;
+  const attempts = Math.max(1, Math.floor(options.retries ?? 0) + 1);
+  const backoff = options.backoff ?? 0;
+  const follow = options.follow ?? Number.POSITIVE_INFINITY;
+  let url = input.request.url;
+  let method = (input.request.method ?? "GET").toUpperCase();
+  let retries = 0;
+  let redirects = 0;
+  let lastreason = "";
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    let hops = 0;
+    const startedat = now();
+    let response;
+    try {
+      const init = { method, headers: { ...input.request.headers ?? {} }, ...input.request.body !== void 0 && !bodilessmethods.has(method) ? { body: input.request.body } : {}, ...input.request.mode !== void 0 ? { mode: input.request.mode } : {}, redirect: follow <= 0 ? "error" : "follow" };
+      const sent = input.transport(url, init);
+      if (options.timeout !== void 0 && Number.isFinite(options.timeout) && options.timeout >= 0) {
+        let timedout = false;
+        response = await Promise.race([sent, sleep(options.timeout).then(() => {
+          timedout = true;
+          return void 0;
+        })]).then((value) => value ?? (timedout ? (() => {
+          throw new Error(`The request timed out after ${options.timeout} milliseconds.`);
+        })() : value));
+      } else {
+        response = await sent;
+      }
+      while (response !== void 0 && redirectstatuses.has(response.status) && typeof response.location === "string" && response.location) {
+        hops += 1;
+        if (hops > follow) throw new Error(`The redirect chain exceeded the reviewed follow limit of ${follow}.`);
+        url = new URL(response.location, url).toString();
+        if (method === "POST" && [301, 302, 303].includes(response.status)) method = "GET";
+        response = await input.transport(url, { ...init, method });
+      }
+      redirects = hops;
+    } catch (error) {
+      lastreason = error instanceof Error ? error.message : String(error);
+      response = void 0;
+    }
+    if (response !== void 0) {
+      const body = response.body;
+      return { url, status: response.status, statusclass: statusclassof(response.status), headernames: Object.keys(response.headers), body, bytes: body.length, duration: now() - startedat, retries, redirects };
+    }
+    if (attempt < attempts) {
+      const wait = backoff * attempt;
+      if (wait > 0) await sleep(wait);
+      input.onretry?.(attempt, wait, lastreason);
+      retries = attempt;
+    }
+  }
+  throw new Error(`The request failed after ${attempts} attempt${attempts === 1 ? "" : "s"} with ${retries} retr${retries === 1 ? "y" : "ies"}: ${lastreason}`);
+}
+async function readstream(input) {
+  const pull = typeof input.chunks === "function" ? input.chunks : /* @__PURE__ */ ((source) => {
+    let index = 0;
+    return async () => source[index++];
+  })(input.chunks);
+  let count = 0;
+  let total = 0;
+  for (; ; ) {
+    if (input.window.abort?.() === true) return { chunks: count, bytes: total, aborted: true, reason: "The reviewed abort flag stopped the stream." };
+    const chunk = await pull();
+    if (chunk === void 0) return { chunks: count, bytes: total, aborted: false };
+    const next = total + chunk.length;
+    if (input.window.budget !== void 0 && next > input.window.budget) return { chunks: count, bytes: total, aborted: true, reason: `The stream aborted at ${next} bytes past the reviewed byte budget of ${input.window.budget}.` };
+    total = next;
+    count += 1;
+    input.window.onchunk?.(chunk, total);
+  }
+}
+function pathstep2(current, segment) {
+  if (Array.isArray(current) && /^\d+$/.test(segment)) return current[Number.parseInt(segment, 10)];
+  if (current && typeof current === "object" && !Array.isArray(current)) return current[segment];
+  return void 0;
+}
+function coerce(value, kind, fallback) {
+  if (value === void 0 || value === null) return { value: fallback, missing: true };
+  if (kind === "text") return { value: String(value), missing: false };
+  if (kind === "number") {
+    const numeric = typeof value === "number" ? value : Number(value);
+    return Number.isFinite(numeric) ? { value: numeric, missing: false } : { value: fallback, missing: true };
+  }
+  if (kind === "boolean") return { value: value === true || value === "true", missing: false };
+  return { value, missing: false };
+}
+function readpath(parsed, rules) {
+  const fields = [];
+  for (const rule of rules) {
+    const kind = rule.kind ?? "text";
+    let current = parsed;
+    let missing = false;
+    for (const segment of rule.path.split(".")) {
+      const next = pathstep2(current, segment);
+      if (next === void 0) {
+        missing = true;
+        break;
+      }
+      current = next;
+    }
+    if (missing) fields.push({ name: rule.name, path: rule.path, kind, ...rule.default !== void 0 ? { value: rule.default } : {}, missing: true });
+    else {
+      const resolved = coerce(current, kind, rule.default);
+      fields.push({ name: rule.name, path: rule.path, kind, ...resolved.value !== void 0 ? { value: resolved.value } : {}, ...resolved.missing ? { missing: true } : {} });
+    }
+  }
+  return fields;
+}
+function payloadvalid(payload, schema) {
+  if (!schema) return { ok: false, errors: ["The typed endpoint call needs a reviewed payload schema before it runs."] };
+  const errors = [];
+  for (const field of schema.fields) {
+    const value = payload[field.name];
+    if (value === void 0 || value === null) {
+      if (field.required === true) errors.push(`The required field ${field.name} of kind ${field.kind} is missing.`);
+      continue;
+    }
+    if (field.kind === "string" && typeof value !== "string") errors.push(`The field ${field.name} must be a string.`);
+    if (field.kind === "number" && (typeof value !== "number" || !Number.isFinite(value))) errors.push(`The field ${field.name} must be a finite number.`);
+    if (field.kind === "boolean" && typeof value !== "boolean") errors.push(`The field ${field.name} must be a boolean.`);
+  }
+  return { ok: errors.length === 0, errors };
+}
+function payloadwithdefaults(payload, schema) {
+  if (!schema) return payload;
+  const merged = { ...payload };
+  for (const field of schema.fields) {
+    if (merged[field.name] === void 0 && field.default !== void 0) merged[field.name] = field.default;
+  }
+  return merged;
+}
+function errorsof(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [body];
+    const record2 = parsed;
+    for (const key of ["errors", "messages", "error", "message"]) {
+      const value = record2[key];
+      if (Array.isArray(value)) return value.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item));
+      if (typeof value === "string") return [value];
+    }
+    return [body];
+  } catch {
+    return [body];
+  }
+}
+async function callrest(input) {
+  const check = payloadvalid(input.payload, input.endpoint.schema);
+  if (!check.ok) throw new Error(check.errors.join(" "));
+  const payload = payloadwithdefaults(input.payload, input.endpoint.schema);
+  const url = templateurl(input.endpoint.url, payload);
+  const method = input.endpoint.method.toUpperCase();
+  const request = { url, method, ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, ...bodilessmethods.has(method) ? {} : { body: JSON.stringify(payload) } };
+  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
+  const ok = input.success !== void 0 ? input.success.includes(transport.status) : transport.statusclass === "success";
+  return { transport, url, payload, ok, errors: ok ? [] : errorsof(transport.body) };
+}
+function graphqlopenvelope(request) {
+  return JSON.stringify({ query: request.query, ...request.variables !== void 0 ? { variables: request.variables } : {}, ...request.operationname !== void 0 ? { operationName: request.operationname } : {} });
+}
+function unwrapgraphql(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { errors: ["The graphql response is not a json object."] };
+  const record2 = value;
+  const errors = Array.isArray(record2.errors) ? record2.errors.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item)) : [];
+  return { ...record2.data !== void 0 ? { data: record2.data } : {}, errors };
+}
+async function callgraphql(input) {
+  const request = { url: input.endpoint.url, method: "POST", ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, body: graphqlopenvelope(input.request) };
+  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
+  try {
+    const unwrapped = unwrapgraphql(JSON.parse(transport.body));
+    return { transport, ...unwrapped.data !== void 0 ? { data: unwrapped.data } : {}, errors: unwrapped.errors };
+  } catch {
+    return { transport, errors: [transport.body] };
+  }
+}
+
+// netwatch.ts
+var netwatchkinds = ["watchrequests", "readheaders", "capturebodies", "mapapi", "extractapi"];
+function resourcefacts(entries) {
+  const facts = [];
+  for (const entry of entries) {
+    const url = typeof entry.name === "string" ? entry.name : "";
+    if (!url) continue;
+    const entrytype = typeof entry.entryType === "string" ? entry.entryType : "resource";
+    if (entrytype !== "resource" && entrytype !== "navigation") continue;
+    facts.push({
+      url,
+      initiator: typeof entry.initiatorType === "string" ? entry.initiatorType : "",
+      entrytype,
+      start: typeof entry.startTime === "number" && Number.isFinite(entry.startTime) ? entry.startTime : 0,
+      duration: typeof entry.duration === "number" && Number.isFinite(entry.duration) ? entry.duration : 0,
+      transfer: typeof entry.transferSize === "number" && Number.isFinite(entry.transferSize) ? entry.transferSize : 0,
+      protocol: typeof entry.nextHopProtocol === "string" ? entry.nextHopProtocol : "",
+      ...typeof entry.responseStatus === "number" && Number.isInteger(entry.responseStatus) ? { status: entry.responseStatus } : {},
+      ...entry.failed === true ? { failed: true } : {}
+    });
+  }
+  return facts;
+}
+function failureclass(fact) {
+  if (fact.status !== void 0 && fact.status >= 400) return { errorclass: "httperror", status: fact.status };
+  if (fact.failed === true) return { errorclass: "networkerror", status: 0 };
+  if ((fact.initiator === "fetch" || fact.initiator === "xmlhttprequest") && fact.duration > 0 && fact.transfer === 0 && fact.protocol === "") return { errorclass: "networkerror", status: 0 };
+  return { status: fact.status ?? 0 };
+}
+function correlationid(runid, index) {
+  return `${runid}-${index + 1}`;
+}
+function newexchange(input) {
+  const verdict = failureclass(input.fact);
+  let origin = "";
+  try {
+    origin = new URL(input.fact.url).origin;
+  } catch {
+    origin = "";
+  }
+  const method = input.fact.initiator === "fetch" || input.fact.initiator === "xmlhttprequest" ? "?" : "GET";
+  const statusclass = verdict.status >= 100 && verdict.status < 600 ? verdict.status >= 200 && verdict.status < 300 ? "success" : verdict.status >= 300 && verdict.status < 400 ? "redirect" : verdict.status >= 400 && verdict.status < 500 ? "clienterror" : verdict.status >= 500 ? "servererror" : "informational" : "unknown";
+  return { id: input.id, runid: input.runid, stepid: input.stepid, correlationid: input.correlationid, url: input.fact.url, origin, method, status: verdict.status, statusclass, ...verdict.errorclass !== void 0 ? { errorclass: verdict.errorclass } : {}, source: "page", ...input.fact.initiator ? { initiator: input.fact.initiator } : {}, timing: Math.round(input.fact.duration), bytes: input.fact.transfer, at: input.at };
+}
+function pairexchange(exchange, response) {
+  if (exchange.correlationid !== response.correlationid) throw new Error(`The response ${response.correlationid} does not pair with the exchange ${exchange.correlationid}.`);
+  return { ...exchange, status: response.status, statusclass: response.status >= 200 && response.status < 300 ? "success" : response.status >= 400 && response.status < 500 ? "clienterror" : response.status >= 500 ? "servererror" : response.status >= 300 && response.status < 400 ? "redirect" : "unknown", bytes: response.bytes, ...response.mime !== void 0 ? { mime: response.mime } : {}, ...response.bodyref !== void 0 ? { bodyref: response.bodyref } : {}, ...Object.keys(response.headers).length > 0 ? { responseheaders: response.headers } : {} };
+}
+function headerfilterof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allow: [], redact: [] };
+  const entry = value;
+  const names = (source) => Array.isArray(source) ? source.filter((name) => typeof name === "string" && name.trim().length > 0).map((name) => name.trim().toLowerCase()) : [];
+  return { allow: names(entry.allow), redact: names(entry.redact) };
+}
+function capturedheaders(headers, filter) {
+  const result = {};
+  for (const [name, value] of Object.entries(headers)) {
+    const key = name.trim().toLowerCase();
+    if (filter.allow.length > 0 && !filter.allow.includes(key)) continue;
+    result[key] = filter.redact.includes(key) ? "[redacted]" : value;
+  }
+  return result;
+}
+function bodyfilterof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const entry = value;
+  const filter = {};
+  if (typeof entry.urlpattern === "string" && entry.urlpattern.trim()) filter.urlpattern = entry.urlpattern.trim();
+  if (Array.isArray(entry.mimes)) filter.mimes = entry.mimes.filter((mime) => typeof mime === "string" && mime.trim().length > 0).map((mime) => mime.trim().toLowerCase());
+  if (typeof entry.ceiling === "number" && Number.isFinite(entry.ceiling) && entry.ceiling >= 0) filter.ceiling = entry.ceiling;
+  return filter;
+}
+function bodymatches(filter, exchange) {
+  if (filter.urlpattern !== void 0 && !exchange.url.includes(filter.urlpattern)) return false;
+  if (filter.mimes !== void 0 && filter.mimes.length > 0) {
+    const mime = ((exchange.mime ?? "").split(";")[0] ?? "").trim().toLowerCase();
+    if (!filter.mimes.includes(mime)) return false;
+  }
+  return true;
+}
+var privatemimes = /* @__PURE__ */ new Set(["text/html", "text/plain", "text/xml", "application/xml", "application/json", "text/json", "application/x-www-form-urlencoded", "application/graphql", "multipart/form-data"]);
+function privatemime(mime) {
+  return privatemimes.has((mime.split(";")[0] ?? "").trim().toLowerCase());
+}
+function capturebody(input) {
+  if (!bodymatches(input.filter, input.exchange)) return { refused: `The exchange ${input.exchange.correlationid} does not match the reviewed body filter.` };
+  const ceiling = input.filter.ceiling;
+  const stored = ceiling !== void 0 && input.body.length > ceiling ? input.body.slice(0, ceiling) : input.body;
+  return { record: { ref: input.ref, runid: input.runid, correlationid: input.exchange.correlationid, url: input.exchange.url, mime: input.mime, bytes: stored.length, body: stored, at: input.at }, truncated: stored.length < input.body.length };
+}
+function payloadshapeof(body) {
+  if (body === void 0) return [];
+  try {
+    const parsed = JSON.parse(body);
+    const shape = (value) => value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
+    if (Array.isArray(parsed)) return parsed.length > 0 ? shape(parsed[0]) : [];
+    return shape(parsed);
+  } catch {
+    return [];
+  }
+}
+function isapicandidate(exchange) {
+  if (exchange.initiator === "fetch" || exchange.initiator === "xmlhttprequest") return true;
+  if (exchange.bodyref !== void 0) return true;
+  try {
+    return /\/api\/|\/graphql|\.json($|\?)|\/v\d+\//i.test(new URL(exchange.url).pathname);
+  } catch {
+    return false;
+  }
+}
+function apientries(exchanges, bodies) {
+  const bodybyref = new Map(bodies.map((body) => [body.correlationid, body]));
+  const groups = /* @__PURE__ */ new Map();
+  for (const exchange of exchanges) {
+    if (!isapicandidate(exchange)) continue;
+    let endpoint = exchange.url;
+    let origin = exchange.origin;
+    try {
+      const parsed = new URL(exchange.url);
+      endpoint = `${parsed.origin}${parsed.pathname}`;
+      origin = parsed.origin;
+    } catch {
+    }
+    const key = `${exchange.method} ${endpoint}`;
+    const group = groups.get(key) ?? { endpoint, method: exchange.method, origin, mimes: /* @__PURE__ */ new Map(), frequency: 0, json: 0, captured: 0, shapes: /* @__PURE__ */ new Map(), correlationids: [] };
+    group.frequency += 1;
+    group.correlationids.push(exchange.correlationid);
+    const body = exchange.bodyref !== void 0 ? bodybyref.get(exchange.correlationid) : void 0;
+    const mime = body?.mime ?? exchange.mime ?? "";
+    group.mimes.set(mime, (group.mimes.get(mime) ?? 0) + 1);
+    if (body !== void 0) {
+      group.captured += 1;
+      const shape = payloadshapeof(body.body);
+      if (shape.length > 0) group.json += 1;
+      const shapekey = shape.join(",");
+      group.shapes.set(shapekey, (group.shapes.get(shapekey) ?? 0) + 1);
+    }
+    groups.set(key, group);
+  }
+  return [...groups.values()].map((group) => {
+    const mime = [...group.mimes.entries()].sort((left, right) => right[1] - left[1])[0]?.[0] ?? "";
+    const modalshape = [...group.shapes.entries()].sort((left, right) => right[1] - left[1])[0];
+    return { endpoint: group.endpoint, method: group.method, mime, frequency: group.frequency, payloadshape: (modalshape?.[0] ?? "").split(",").filter(Boolean), jsonshare: group.captured > 0 ? group.json / group.captured : 0, stability: group.captured > 0 ? (modalshape?.[1] ?? 0) / group.captured : 0, origin: group.origin, correlationids: group.correlationids };
+  });
+}
+function rankapis(entries) {
+  const score = (entry) => entry.frequency * (1 + entry.jsonshare + entry.stability);
+  return [...entries].sort((left, right) => score(right) - score(left) || right.frequency - left.frequency);
+}
+function apireplayspecof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const entry = value;
+  if (typeof entry.endpoint !== "string" || !entry.endpoint.trim()) return void 0;
+  const spec = { endpoint: entry.endpoint.trim() };
+  if (typeof entry.verb === "string" && entry.verb.trim()) spec.verb = entry.verb.trim().toUpperCase();
+  if (entry.overrides !== void 0 && entry.overrides !== null && typeof entry.overrides === "object" && !Array.isArray(entry.overrides)) {
+    const overrides = {};
+    for (const [name, override] of Object.entries(entry.overrides)) {
+      if (typeof override === "string") overrides[name] = override;
+    }
+    spec.overrides = overrides;
+  }
+  if (Array.isArray(entry.paths)) spec.paths = entry.paths.filter((path) => typeof path === "string" && path.trim().length > 0);
+  return spec;
+}
+function replayurl(spec) {
+  const url = new URL(spec.endpoint);
+  for (const [name, value] of Object.entries(spec.overrides ?? {})) url.searchParams.set(name, value);
+  return url.toString();
+}
+function extractvalues(body, paths) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return paths.map((path) => ({ path, missing: true }));
+  }
+  const fields = readpath(parsed, paths.map((path) => ({ name: path, path, kind: "json" })));
+  return fields.map((field) => ({ path: field.path, ...field.value !== void 0 ? { value: field.value } : {}, ...field.missing ? { missing: true } : {} }));
+}
+
+// netcontrol.ts
+var controlkinds = ["blockrequest", "mockresponse", "rewriteheaders", "setcookies", "readcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles"];
+function patternorigin(pattern) {
+  const trimmed = pattern.trim();
+  if (!trimmed.startsWith("https://")) return void 0;
+  const rest = trimmed.slice("https://".length);
+  const host = rest.split("/")[0] ?? "";
+  if (!host.trim()) return void 0;
+  return `https://${host.toLowerCase()}`;
+}
+function matchurlpattern(pattern, url) {
+  const origin = patternorigin(pattern);
+  if (!origin) return false;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.origin !== origin) return false;
+  const patternpath = pattern.trim().slice(origin.length);
+  if (patternpath === "" || patternpath === "/") return true;
+  const segments = patternpath.split("/").filter((segment) => segment !== "");
+  if (segments.includes("**")) return true;
+  const pathsegments = parsed.pathname.split("/").filter((segment) => segment !== "");
+  if (segments.length !== pathsegments.length) return false;
+  return segments.every((segment, index) => segment === pathsegments[index] || segment.includes("*") && new RegExp(`^${segment.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`).test(pathsegments[index] ?? ""));
+}
+function blockruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.urlpattern !== "string" || !options.urlpattern.trim()) return void 0;
+  const rule = { urlpattern: options.urlpattern.trim() };
+  if (Array.isArray(options.resourcetypes)) {
+    const types = options.resourcetypes.filter((item) => typeof item === "string" && item.trim().length > 0);
+    if (types.length === 0) return void 0;
+    rule.resourcetypes = types;
+  }
+  return rule;
+}
+function newblockrule(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, urlpattern: input.urlpattern, ...input.resourcetypes !== void 0 ? { resourcetypes: input.resourcetypes } : {}, hits: 0, registeredat: input.at };
+}
+function mockspecof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.urlpattern !== "string" || !options.urlpattern.trim()) return void 0;
+  if (typeof options.status !== "number" || !Number.isInteger(options.status) || options.status < 100 || options.status > 599) return void 0;
+  const hasbody = typeof options.body === "string";
+  const bodyref = typeof options.bodyref === "string" ? options.bodyref.trim() : "";
+  if (!hasbody && bodyref === "") return void 0;
+  const spec = { urlpattern: options.urlpattern.trim(), status: options.status };
+  if (hasbody) spec.body = options.body;
+  if (bodyref !== "") spec.bodyref = bodyref;
+  if (options.headers && typeof options.headers === "object" && !Array.isArray(options.headers)) spec.headers = options.headers;
+  if (options.reviewed === true) spec.reviewed = true;
+  return spec;
+}
+function newmockspec(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, urlpattern: input.urlpattern, status: input.status, ...input.headers !== void 0 ? { headers: input.headers } : {}, ...input.body !== void 0 ? { body: input.body } : {}, ...input.bodyref !== void 0 ? { bodyref: input.bodyref } : {}, reviewed: input.reviewed, hits: 0, registeredat: input.at };
+}
+function mockfor(url, specs) {
+  return specs.find((spec) => spec.revertedat === void 0 && matchurlpattern(spec.urlpattern, url));
+}
+function headeruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.urlpattern !== "string" || !options.urlpattern.trim()) return void 0;
+  if (typeof options.name !== "string" || !options.name.trim()) return void 0;
+  if (options.operation !== "set" && options.operation !== "append" && options.operation !== "remove") return void 0;
+  if (options.operation === "remove" && options.value !== void 0) return void 0;
+  if (options.operation !== "remove" && typeof options.value !== "string") return void 0;
+  const rule = { urlpattern: options.urlpattern.trim(), name: options.name.trim(), operation: options.operation };
+  if (options.operation !== "remove") rule.value = typeof options.value === "string" ? options.value : "";
+  return rule;
+}
+function newheaderule(input) {
+  return { id: input.id, runid: input.runid, stepid: input.stepid, urlpattern: input.urlpattern, name: input.name, operation: input.operation, ...input.value !== void 0 ? { value: input.value } : {}, hits: 0, registeredat: input.at };
+}
+function applyheaderules(url, headers, rules) {
+  const rewritten = { ...headers };
+  const applied = [];
+  for (const rule of rules) {
+    if (rule.revertedat !== void 0) continue;
+    if (!matchurlpattern(rule.urlpattern, url)) continue;
+    const name = rule.name;
+    if (rule.operation === "remove") {
+      delete rewritten[name];
+      applied.push(rule);
+      continue;
+    }
+    const value = rule.value ?? "";
+    if (rule.operation === "set") rewritten[name] = value;
+    else rewritten[name] = rewritten[name] !== void 0 ? `${rewritten[name]}, ${value}` : value;
+    applied.push(rule);
+  }
+  return { headers: rewritten, applied };
+}
+function revertrule(rule, at) {
+  if (rule.revertedat !== void 0) return rule;
+  return { ...rule, revertedat: at };
+}
+function cookierecordof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.name !== "string" || !options.name.trim()) return void 0;
+  if (typeof options.domain !== "string" || !options.domain.trim()) return void 0;
+  if (typeof options.path !== "string" || !options.path.trim()) return void 0;
+  if (typeof options.value !== "string") return void 0;
+  const record2 = { name: options.name.trim(), domain: options.domain.trim().toLowerCase(), path: options.path.trim(), value: options.value };
+  if (typeof options.expiresat === "number" && Number.isFinite(options.expiresat)) record2.expiresat = options.expiresat;
+  return record2;
+}
+function cookiedomaingranted(domain, grants) {
+  const host = domain.trim().toLowerCase().replace(/^\./, "");
+  return grants.some((grant) => {
+    let granthost = "";
+    try {
+      granthost = new URL(grant).hostname.toLowerCase();
+    } catch {
+      return false;
+    }
+    return host === granthost || host.endsWith(`.${granthost}`);
+  });
+}
+function redactedcookies(records) {
+  return records.map((record2) => ({ name: record2.name, domain: record2.domain, path: record2.path, ...record2.expiresat !== void 0 ? { expiresat: record2.expiresat } : {} }));
+}
+function proxyrouteof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (options.scheme !== "http" && options.scheme !== "https" && options.scheme !== "socks4" && options.scheme !== "socks5") return void 0;
+  if (typeof options.host !== "string" || !options.host.trim()) return void 0;
+  if (typeof options.port !== "number" || !Number.isInteger(options.port) || options.port < 1 || options.port > 65535) return void 0;
+  if (!Array.isArray(options.bypass) || options.bypass.length === 0 || !options.bypass.every((item) => typeof item === "string" && item.trim().length > 0)) return void 0;
+  return { scheme: options.scheme, host: options.host.trim(), port: options.port, bypass: options.bypass.map((item) => item.trim()) };
+}
+function ratelimitreadof(headers, origin, now) {
+  const pick = (name) => {
+    for (const key of Object.keys(headers)) {
+      if (key.toLowerCase() !== name) continue;
+      const value = Number(headers[key]);
+      return Number.isFinite(value) && value >= 0 ? value : void 0;
+    }
+    return void 0;
+  };
+  const remaining = pick("x-ratelimit-remaining");
+  const limit = pick("x-ratelimit-limit");
+  const reset = pick("x-ratelimit-reset");
+  if (remaining === void 0 && limit === void 0 && reset === void 0) return void 0;
+  const read = { origin, ...remaining !== void 0 ? { remaining } : {}, ...limit !== void 0 ? { limit } : {}, resetat: now, at: now };
+  if (reset !== void 0) read.resetat = reset > Math.floor(now / 1e3) ? reset * 1e3 : now + reset * 1e3;
+  return read;
+}
+function retryafterof(status, headers) {
+  if (status !== 429 && status !== 503) return void 0;
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() !== "retry-after") continue;
+    const raw = headers[key];
+    if (raw === void 0) continue;
+    const value = raw.trim();
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+    const date = Date.parse(value);
+    if (Number.isFinite(date)) return Math.max(0, date - Date.now());
+    return void 0;
+  }
+  return void 0;
+}
+function ratelimitwait(state, now) {
+  if (!state) return 0;
+  return Math.max(0, state.resetat - now);
+}
+
+// netauth.ts
+function oauthflowof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.provider !== "string" || !options.provider.trim()) return void 0;
+  if (typeof options.authorizeurl !== "string" || !options.authorizeurl.trim()) return void 0;
+  if (typeof options.tokenurl !== "string" || !options.tokenurl.trim()) return void 0;
+  if (!Array.isArray(options.scopes) || options.scopes.length === 0 || !options.scopes.every((item) => typeof item === "string" && item.trim().length > 0)) return void 0;
+  if (typeof options.redirectorigin !== "string" || !options.redirectorigin.trim()) return void 0;
+  return { provider: options.provider.trim(), authorizeurl: options.authorizeurl.trim(), tokenurl: options.tokenurl.trim(), scopes: options.scopes.map((item) => item.trim()), redirectorigin: options.redirectorigin.trim() };
+}
+function authorizeurl(flow, state) {
+  const url = new URL(flow.authorizeurl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", flow.redirectorigin);
+  url.searchParams.set("scope", flow.scopes.join(" "));
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+function capturecode(url, redirectorigin, state) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { error: "The redirect url does not parse for the code capture." };
+  }
+  const granted = redirectorigin.includes("/", redirectorigin.indexOf("://") + 3) ? `${parsed.origin}${parsed.pathname}`.startsWith(redirectorigin) : parsed.origin === redirectorigin;
+  if (!granted) return { error: `The redirect landed on ${parsed.origin} outside the granted redirect origin ${redirectorigin}.` };
+  const returned = parsed.searchParams.get("state");
+  if (returned !== state) return { error: "The redirect state token does not match the reviewed flow." };
+  const error = parsed.searchParams.get("error");
+  if (error) return { error: `The provider refused the flow: ${error}.` };
+  const code = parsed.searchParams.get("code");
+  if (!code) return { error: "The redirect carries no authorization code." };
+  return { code };
+}
+function parsetokens(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+  const record2 = parsed;
+  const tokens = {};
+  if (typeof record2.access_token === "string" && record2.access_token) tokens.accesstoken = record2.access_token;
+  if (typeof record2.refresh_token === "string" && record2.refresh_token) tokens.refreshtoken = record2.refresh_token;
+  if (typeof record2.expires_in === "number" && Number.isFinite(record2.expires_in) && record2.expires_in >= 0) tokens.expiresin = record2.expires_in;
+  if (typeof record2.scope === "string" && record2.scope.trim()) tokens.scopes = record2.scope.trim().split(/\s+/);
+  if (tokens.accesstoken === void 0 && tokens.refreshtoken === void 0) return void 0;
+  return tokens;
+}
+function tokenrequest(flow, input) {
+  if (input.refreshtoken !== void 0) return { url: flow.tokenurl, body: urlencodeform([{ name: "grant_type", value: "refresh_token" }, { name: "refresh_token", value: input.refreshtoken }]) };
+  return { url: flow.tokenurl, body: urlencodeform([{ name: "grant_type", value: "authorization_code" }, { name: "code", value: input.code ?? "" }, { name: "redirect_uri", value: flow.redirectorigin }]) };
+}
+function revocationruleof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (!Array.isArray(options.tokenids) || options.tokenids.length === 0 || !options.tokenids.every((item) => typeof item === "string" && item.trim().length > 0)) return void 0;
+  if (typeof options.reason !== "string" || !options.reason.trim()) return void 0;
+  return { tokenids: options.tokenids.map((item) => item.trim()), reason: options.reason.trim(), revokedat: Date.now() };
+}
+function formpayloadof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.url !== "string" || !options.url.trim()) return void 0;
+  if (!Array.isArray(options.fields) || options.fields.length === 0) return void 0;
+  const fields = [];
+  for (const item of options.fields) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
+    const field = item;
+    if (typeof field.name !== "string" || !field.name.trim()) return void 0;
+    if (typeof field.value !== "string") return void 0;
+    fields.push({ name: field.name.trim(), value: field.value });
+  }
+  return { url: options.url.trim(), fields };
+}
+function urlencodeform(fields) {
+  return fields.map((field) => `${formencode(field.name)}=${formencode(field.value)}`).join("&");
+}
+function formencode(value) {
+  const bytes = [...new TextEncoder().encode(value)];
+  return bytes.map((byte) => byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 || byte >= 48 && byte <= 57 || byte === 45 || byte === 95 || byte === 46 || byte === 126 ? String.fromCharCode(byte) : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join("");
+}
+function multipartpayloadof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.url !== "string" || !options.url.trim()) return void 0;
+  if (!Array.isArray(options.files) || options.files.length === 0) return void 0;
+  const fields = [];
+  for (const item of Array.isArray(options.fields) ? options.fields : []) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
+    const field = item;
+    if (typeof field.name !== "string" || !field.name.trim()) return void 0;
+    if (typeof field.value !== "string") return void 0;
+    fields.push({ name: field.name.trim(), value: field.value });
+  }
+  const files = [];
+  for (const item of options.files) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
+    const file = item;
+    if (typeof file.name !== "string" || !file.name.trim()) return void 0;
+    if (typeof file.filename !== "string" || !file.filename.trim()) return void 0;
+    if (typeof file.mime !== "string" || !file.mime.trim()) return void 0;
+    if (typeof file.content !== "string") return void 0;
+    if (file.reviewed !== true) return void 0;
+    files.push({ name: file.name.trim(), filename: file.filename.trim(), mime: file.mime.trim(), content: file.content, reviewed: true });
+  }
+  const payload = { url: options.url.trim(), fields, files, ...typeof options.boundary === "string" && options.boundary.trim() ? { boundary: options.boundary.trim() } : {} };
+  return payload;
+}
+function newboundary() {
+  return `----devthink${Math.random().toString(16).slice(2)}${Date.now().toString(16)}`;
+}
+function multipartchunks(payload) {
+  const boundary = payload.boundary ?? newboundary();
+  const chunks = [];
+  for (const field of payload.fields) chunks.push(`--${boundary}\r
+content-disposition: form-data; name="${field.name}"\r
+\r
+${field.value}\r
+`);
+  for (const file of payload.files) chunks.push(`--${boundary}\r
+content-disposition: form-data; name="${file.name}"; filename="${file.filename}"\r
+content-type: ${file.mime}\r
+\r
+${file.content}\r
+`);
+  chunks.push(`--${boundary}--\r
+`);
+  return { chunks, boundary, bytes: chunks.reduce((total, chunk) => total + chunk.length, 0) };
+}
+
+// policy.ts
+var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles"]);
+var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies"]);
+var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
+var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
+var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
+var valueactions = /* @__PURE__ */ new Set(["presskey", "drag", "drop", "upload", "readattribute", "removeattribute", "waittext", "evaluate", "zoomset", "tabactivate", "tabclose", "tabreload", "windowclose", "windowresize", "tabcreate", "windowcreate", "downloadfile", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "chooseradio", "setslider", "setdate", "setcolor", "followlink", "setfragment", "handleauth", "navintent", "openclipboard", "checksafe", "reopentab", "spanav", "duplicatetab", "pintab", "mutetab", "movetab", "movetabwindow", "searchtabs", "badgetab", "attachmeta", "focuswindow", "maximizewindow", "minimizewindow", "restorewindow", "incognitowindow", "asksubmit", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "pausedownload", "resumedownload", "verifydownload", "writeclipboard", "quarantinedownload", "scanvirus"]);
+var tabscommandactions = /* @__PURE__ */ new Set(["querytabs", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "watchtab", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "savelayout", "restorelayout", "findclones", "searchtabs", "badgetab", "attachmeta", "listaudio", "reopenrun", "snapshotsession"]);
+var formactions = /* @__PURE__ */ new Set(["fillform", "filllabel", "fillplaceholder", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "submitform", "readerrors", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "handoffcaptcha", "fillcard", "fillcode", "consentpassword", "skiphoneypot", "detectlogin", "detecttemplate"]);
+var datasetactions = /* @__PURE__ */ new Set(["scrapetable", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "importcsv", "looprows", "transformvalues", "deduperows", "paginateextract", "mergepages", "stamplerows", "previewgrid", "streamdisk", "resumeextract", "logprovenance"]);
+var exportactions = /* @__PURE__ */ new Set(["exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk"]);
+var filesactions = /* @__PURE__ */ new Set(["batchdownload", "pausedownload", "resumedownload", "verifydownload", "interceptmime", "exportnetlog", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "namecaptures", "cleanupartifacts"]);
+var captureactions = /* @__PURE__ */ new Set(["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"]);
+var mediaactions = /* @__PURE__ */ new Set(["capturepdf", "recordscreen", "captureaudio", "captureframe", "downloadimages", "shotcanvas", "probestream", "readmedia", "readassets", "timelapse", "convertimage", "makethumbs"]);
+var httpactions = /* @__PURE__ */ new Set(["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"]);
+var socketactions = /* @__PURE__ */ new Set(["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"]);
+var netwatchactions = /* @__PURE__ */ new Set(["watchrequests", "readheaders", "capturebodies", "mapapi", "extractapi"]);
+var controlactions = /* @__PURE__ */ new Set(["blockrequest", "mockresponse", "rewriteheaders", "setcookies", "readcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles"]);
+var credentialheaders = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2", "set-cookie", "api-key", "x-api-key", "x-auth-token", "x-session-token", "proxy-authorization"]);
+var fieldkinds = ["text", "email", "phone", "date", "number", "select", "check", "radio", "file", "password", "card", "code"];
+var layoutmutationactions = /* @__PURE__ */ new Set(["grouptabs", "colorgroup", "collapsegroup", "savelayout", "restorelayout"]);
+var groupcolors = ["grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange"];
+function normalizeendpoint(value) {
+  const endpoint = new URL(value.trim());
+  if (endpoint.protocol !== "https:") throw new Error("Devthink accepts HTTPS endpoints only.");
+  if (endpoint.username || endpoint.password) throw new Error("Endpoint credentials are not allowed in the URL.");
+  return { endpoint: endpoint.toString(), origin: endpoint.origin, configuredat: Date.now() };
+}
+function hostpattern(origin) {
+  const parsed = new URL(origin);
+  if (parsed.protocol !== "https:") throw new Error("Only HTTPS origins can be granted.");
+  return `${parsed.origin}/*`;
+}
+function actionrisk(kind) {
+  if (!allowedactions.has(kind)) throw new Error("Unsupported browser action.");
+  if (sensitiveactions.has(kind)) return "sensitive";
+  return interactionactions.has(kind) ? "interaction" : "read";
+}
+function parseoptions(step) {
+  if (step.options === void 0) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(step.options);
+  } catch {
+    throw new Error("Step options must be a JSON object.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Step options must be a JSON object.");
+  return parsed;
+}
+function requiredcapability(kind) {
+  if (kind === "tablist") return "tabs";
+  if (kind === "downloadfile") return "downloads";
+  if (kind === "openclipboard") return "clipboardRead";
+  if (kind === "copytable") return "clipboardWrite";
+  if (kind === "batchdownload" || kind === "pausedownload" || kind === "resumedownload" || kind === "verifydownload" || kind === "interceptmime" || kind === "quarantinedownload" || kind === "scanvirus") return "downloads";
+  if (kind === "readclipboard") return "clipboardRead";
+  if (kind === "writeclipboard" || kind === "copyscreen") return "clipboardWrite";
+  if (kind === "downloadimages") return "downloads";
+  if (kind === "authflow") return "tabs";
+  if (kind === "openlink" || kind === "openprivate" || kind === "navlist" || kind === "batchopen" || kind === "reopentab" || kind === "deeplink") return "tabs";
+  if (tabscommandactions.has(kind)) return "tabs";
+  return void 0;
+}
+function istabscommandkind(kind) {
+  return tabscommandactions.has(kind);
+}
+function islayoutkind(kind) {
+  return layoutmutationactions.has(kind);
+}
+function isformkind(kind) {
+  return formactions.has(kind);
+}
+function isdatasetkind(kind) {
+  return datasetactions.has(kind);
+}
+function isexportkind(kind) {
+  return exportactions.has(kind);
+}
+function isfileskind(kind) {
+  return filesactions.has(kind);
+}
+function iscapturekind(kind) {
+  return captureactions.has(kind);
+}
+function capturegate(session, tabid2, origin, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the capture." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot capture." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot capture." };
+  if (session.tabid !== tabid2) return { allowed: false, reason: `The capture needs the active tab grant of session tab ${session.tabid} and refuses tab ${tabid2}.` };
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The capture of ${origin} needs the session origin grants first.` };
+  return { allowed: true };
+}
+function validatecaptureoptions(value) {
+  if (value === void 0) return { allowed: true };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "The reviewed capture options must be an object in options.capture." };
+  const options = value;
+  if (options.format !== void 0 && options.format !== "png" && options.format !== "jpeg" && options.format !== "webp") return { allowed: false, reason: "The reviewed capture format must be png, jpeg or webp." };
+  if (options.quality !== void 0 && (typeof options.quality !== "number" || !Number.isFinite(options.quality) || options.quality < 0 || options.quality > 100)) return { allowed: false, reason: "The reviewed capture quality must stay between zero and one hundred; any value in that range is the user choice with no code cap." };
+  if (options.pixelratio !== void 0 && (typeof options.pixelratio !== "number" || !Number.isFinite(options.pixelratio) || options.pixelratio < 1)) return { allowed: false, reason: "The reviewed pixel ratio starts at one and climbs to any user configured ceiling with no code ceiling." };
+  if (options.annotate !== void 0 && typeof options.annotate !== "boolean") return { allowed: false, reason: "The reviewed capture annotation flag must be a boolean." };
+  if (options.exporttarget !== void 0 && options.exporttarget !== "memory" && options.exporttarget !== "download" && options.exporttarget !== "clipboard") return { allowed: false, reason: "The reviewed capture export target must be memory, download or clipboard." };
+  return { allowed: true };
+}
+function validateregionrect(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed regionrect with x, y, width and height in css pixels is required in options." };
+  const rect = value;
+  for (const field of ["x", "y", "width", "height"]) {
+    if (typeof rect[field] !== "number" || !Number.isFinite(rect[field])) return { allowed: false, reason: `The reviewed regionrect needs a numeric ${field} in css pixels.` };
+  }
+  if (rect.x < 0 || rect.y < 0) return { allowed: false, reason: "The reviewed regionrect refuses negative coordinates." };
+  if (rect.width <= 0 || rect.height <= 0) return { allowed: false, reason: "The reviewed regionrect needs positive width and height values." };
+  return { allowed: true };
+}
+function validatecapturenaming(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed capturenaming rule with run, step, sequence and kind flags is required." };
+  const rule = value;
+  const segments = ["run", "step", "sequence", "kind"];
+  for (const key of Object.keys(rule)) {
+    if (!segments.includes(key)) return { allowed: false, reason: `The reviewed capturenaming rule refuses the unknown ${key} segment; only run, step, sequence and kind participate.` };
+  }
+  for (const segment of segments) {
+    if (rule[segment] !== void 0 && typeof rule[segment] !== "boolean") return { allowed: false, reason: `The reviewed capturenaming ${segment} flag must be a boolean.` };
+  }
+  if (!segments.some((segment) => rule[segment] === true)) return { allowed: false, reason: "The reviewed capturenaming rule needs at least one enabled segment of run, step, sequence and kind." };
+  return { allowed: true };
+}
+function stitchbudgetallowed(tiles, settle2, wait) {
+  if (tiles <= 0) return { allowed: false, reason: "The stitch budget needs at least one tile." };
+  if (settle2 < 0 || wait < 0) return { allowed: false, reason: "The reviewed settle and wait windows must be zero or positive milliseconds." };
+  if (tiles * settle2 > wait) return { allowed: false, reason: `The stitching scroll budget of ${tiles} tiles at ${settle2} milliseconds exceeds the reviewed wait window of ${wait} milliseconds; review a wider window or a smaller settle.` };
+  return { allowed: true };
+}
+function beforeafterwrapallowed(kind) {
+  return allowedactions.has(kind) && !captureactions.has(kind);
+}
+function validatecapturegrammar(step, options) {
+  const kind = step.kind;
+  const optioncheck = validatecaptureoptions(options.capture);
+  if (!optioncheck.allowed) return optioncheck;
+  if (options.settle !== void 0 && (typeof options.settle !== "number" || !Number.isFinite(options.settle) || options.settle < 0)) return { allowed: false, reason: "The reviewed capture settle window must be zero or a positive number of milliseconds." };
+  if (options.overlap !== void 0 && (typeof options.overlap !== "number" || !Number.isInteger(options.overlap) || options.overlap < 0)) return { allowed: false, reason: "The reviewed stitch overlap must be zero or a positive number of rows." };
+  if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed capture wait window must be zero or a positive number of milliseconds." };
+  if (options.naming !== void 0) {
+    const namingcheck = validatecapturenaming(options.naming);
+    if (!namingcheck.allowed) return namingcheck;
+  }
+  if (kind === "shotregion") {
+    const rectcheck = validateregionrect(options.regionrect);
+    if (!rectcheck.allowed) return rectcheck;
+    if (options.reviewed !== true) return { allowed: false, reason: "Every reviewed regionrect needs the explicit reviewed flag before shotregion runs." };
+    if (options.container !== void 0 && !isnonempty(options.container)) return { allowed: false, reason: "The reviewed scrollable container selector must be a non-empty string." };
+    if (options.steps !== void 0 && (typeof options.steps !== "number" || !Number.isInteger(options.steps) || options.steps < 1)) return { allowed: false, reason: "The reviewed container scroll steps must be a positive integer with no code ceiling." };
+  }
+  if (kind === "contactsheet") {
+    const elements = options.elements;
+    if (!Array.isArray(elements) || elements.length === 0 || !elements.every((item) => isnonempty(item))) return { allowed: false, reason: "A reviewed non-empty list of element selectors is required in options for the contact sheet; the cell count stays the user choice." };
+    const layout = options.sheet;
+    if (layout !== void 0) {
+      if (!layout || typeof layout !== "object" || Array.isArray(layout)) return { allowed: false, reason: "The reviewed sheetlayout must be an object with cellsize, columns and label." };
+      const sheet = layout;
+      if (typeof sheet.cellsize !== "number" || !Number.isFinite(sheet.cellsize) || sheet.cellsize <= 0) return { allowed: false, reason: "The reviewed contact sheet cell size must be a positive number of pixels." };
+      if (typeof sheet.columns !== "number" || !Number.isInteger(sheet.columns) || sheet.columns < 1) return { allowed: false, reason: "The reviewed contact sheet column count must be a positive integer with no code ceiling." };
+      if (sheet.label !== void 0 && sheet.label !== "none" && sheet.label !== "index" && sheet.label !== "selector" && sheet.label !== "both") return { allowed: false, reason: "The reviewed contact sheet label style must be none, index, selector or both." };
+    }
+  }
+  return { allowed: true };
+}
+function exportgranted(session, origin) {
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The export of extracted data from ${origin} needs the session origin grants before it leaves local memory.` };
+  return { allowed: true };
+}
+function validatefieldmatch(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed field match is required in options." };
+  const match = value;
+  if (match.mode !== "label" && match.mode !== "placeholder" && match.mode !== "arialabel" && match.mode !== "name") return { allowed: false, reason: "The reviewed field match mode must be label, placeholder, arialabel or name." };
+  const key = match.mode === "label" ? "label" : match.mode === "placeholder" ? "placeholder" : match.mode === "arialabel" ? "arialabel" : "name";
+  if (!isnonempty(match[key])) return { allowed: false, reason: `The reviewed ${match.mode} field match needs a non-empty ${key}.` };
+  return { allowed: true };
+}
+function validateformrecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed form record with entries is required in options." };
+  const record2 = value;
+  if (record2.form !== void 0 && !isnonempty(record2.form)) return { allowed: false, reason: "The reviewed form record form selector must be a non-empty string." };
+  if (!Array.isArray(record2.entries) || record2.entries.length === 0) return { allowed: false, reason: "The reviewed form record needs a non-empty list of entries." };
+  for (const item of record2.entries) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return { allowed: false, reason: "Every reviewed form record entry must be an object." };
+    const entry = item;
+    const matchcheck = validatefieldmatch(entry.match);
+    if (!matchcheck.allowed) return matchcheck;
+    if (typeof entry.kind !== "string" || !fieldkinds.includes(entry.kind)) return { allowed: false, reason: "Every reviewed form record entry needs a known field kind." };
+    if (typeof entry.value !== "string") return { allowed: false, reason: "Every reviewed form record entry needs a string value." };
+    if (entry.kind === "password") return { allowed: false, reason: "Password entries are refused inside form records; use consentpassword with a reviewed consent ref." };
+  }
+  return { allowed: true };
+}
+function validatevaluegen(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { allowed: false, reason: "A reviewed valuegen rule with a field kind is required in options." };
+  const rule = value;
+  if (typeof rule.kind !== "string" || !fieldkinds.includes(rule.kind)) return { allowed: false, reason: "The reviewed valuegen kind must be a known field kind." };
+  if (rule.locale !== void 0 && !isnonempty(rule.locale)) return { allowed: false, reason: "The reviewed valuegen locale must be a non-empty string." };
   if (rule.seed !== void 0 && (typeof rule.seed !== "number" || !Number.isFinite(rule.seed))) return { allowed: false, reason: "The reviewed valuegen seed must be a finite number." };
   return { allowed: true };
 }
@@ -1673,6 +2796,72 @@ function ismediakind(kind) {
 function ishttpkind(kind) {
   return httpactions.has(kind);
 }
+function issocketkind(kind) {
+  return socketactions.has(kind);
+}
+function isnetwatchkind(kind) {
+  return netwatchactions.has(kind);
+}
+function iscontrolkind(kind) {
+  return controlactions.has(kind);
+}
+function resolvedrisk(step) {
+  if (step.kind === "capturebodies") {
+    let options = {};
+    try {
+      options = parseoptions(step);
+    } catch {
+      options = {};
+    }
+    const body = options.body;
+    const mimes = body && typeof body === "object" && !Array.isArray(body) ? body.mimes : void 0;
+    if (Array.isArray(mimes) && mimes.some((mime) => typeof mime === "string" && privatemime(mime))) return "sensitive";
+    return "interaction";
+  }
+  if (step.kind === "extractapi") {
+    let options = {};
+    try {
+      options = parseoptions(step);
+    } catch {
+      options = {};
+    }
+    const replay = options.replay;
+    const verb = replay && typeof replay === "object" && !Array.isArray(replay) ? replay.verb : void 0;
+    if (typeof verb === "string" && !["GET", "HEAD", "OPTIONS"].includes(verb.trim().toUpperCase())) return "sensitive";
+    return "read";
+  }
+  return actionrisk(step.kind);
+}
+function socketgate(session, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { allowed: false, reason: "The channel needs a valid url before it can be reviewed." };
+  }
+  if (parsed.protocol !== "wss:" && parsed.protocol !== "https:") return { allowed: false, reason: "Channels use wss websocket urls or https event stream urls only." };
+  if (parsed.username || parsed.password) return { allowed: false, reason: "Channel credentials are not allowed in the url." };
+  const origin = channelorigin(url);
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The channel to ${origin} stays outside the session origin grants.` };
+  return { allowed: true };
+}
+function watchgate(session, settings, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the request watch." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot watch requests." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot watch requests." };
+  if (settings?.webrequestgrant !== true) return { allowed: false, reason: "Request watching needs the webrequest grant in the review panel first; the observation derives from the page timing buffers and adds no manifest permission." };
+  return { allowed: true };
+}
+function observedorigingranted(session, url) {
+  let origin = "";
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return { allowed: false, reason: "The observed exchange url does not parse for an origin check." };
+  }
+  if (!origingranted(session, origin)) return { allowed: false, reason: `The observed origin ${origin} stays outside the session origin grants; grant it before reading headers, bodies or replays.` };
+  return { allowed: true };
+}
 function origincheck(session, url) {
   let parsed;
   try {
@@ -1890,6 +3079,265 @@ function fetchnumeric(options, key) {
 function isrecordingkind(kind) {
   return kind === "recordscreen" || kind === "captureaudio";
 }
+function validatesocketgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "opensocket") {
+    const channel = channeloptionsof(options.socket);
+    if (!channel) return { allowed: false, reason: "A reviewed socket with a url is required in options.socket." };
+    if (channel.options.reconnect !== void 0 && !Number.isInteger(channel.options.reconnect)) return { allowed: false, reason: "The reviewed socket reconnect budget must be an integer attempt count with no code ceiling." };
+    for (const label of ["backoff", "backoffceiling"]) {
+      const value = channel.options[label];
+      if (value !== void 0 && (typeof value !== "number" || !Number.isFinite(value) || value < 0)) return { allowed: false, reason: `The reviewed socket ${label} must be zero or a positive number of milliseconds with no code ceiling.` };
+    }
+    if (channel.options.lifetime !== void 0 && (typeof channel.options.lifetime !== "number" || !Number.isFinite(channel.options.lifetime) || channel.options.lifetime <= 0)) return { allowed: false, reason: "The reviewed socket lifetime window must be a positive number of milliseconds." };
+  }
+  if (kind === "sendmessage") {
+    const message = options.message;
+    if (!message || typeof message !== "object" || Array.isArray(message)) return { allowed: false, reason: "A reviewed message with a channel, stream and payload is required in options.message." };
+    const envelope = message;
+    if (!isnonempty(envelope.channel)) return { allowed: false, reason: "The reviewed message needs the open channel id in options.message.channel." };
+    if (envelope.stream !== void 0 && !isnonempty(envelope.stream)) return { allowed: false, reason: "The reviewed message stream name must be a non-empty string." };
+    if (typeof envelope.payload !== "string") return { allowed: false, reason: "The reviewed message payload must be a string." };
+  }
+  if (kind === "waitmessage") {
+    if (options.filter !== void 0) {
+      const filter = options.filter;
+      if (!filter || typeof filter !== "object" || Array.isArray(filter)) return { allowed: false, reason: "The reviewed message filter must be an object of stream, path and limit." };
+      const reviewed = filter;
+      if (reviewed.stream !== void 0 && !isnonempty(reviewed.stream)) return { allowed: false, reason: "The reviewed message filter stream name must be a non-empty string." };
+      if (reviewed.path !== void 0 && (typeof reviewed.path !== "string" || !validpath(reviewed.path.trim()))) return { allowed: false, reason: "The reviewed message filter path must be a dotted path of non-empty segments." };
+      if (reviewed.limit !== void 0 && (typeof reviewed.limit !== "number" || !Number.isInteger(reviewed.limit) || reviewed.limit < 1)) return { allowed: false, reason: "The reviewed message match limit must be a positive integer with no code ceiling." };
+    }
+    if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed message wait budget must be zero or a positive number of milliseconds." };
+  }
+  if (kind === "subscribesse") {
+    const subscription = subscriptionoptionsof(options.subscription);
+    if (!subscription) return { allowed: false, reason: "A reviewed subscription with an event stream url and a cancellation path is required in options.subscription." };
+    const rawlifetime = options.subscription && typeof options.subscription === "object" && !Array.isArray(options.subscription) ? options.subscription.lifetime : void 0;
+    if (rawlifetime !== void 0 && (typeof rawlifetime !== "number" || !Number.isFinite(rawlifetime) || rawlifetime <= 0)) return { allowed: false, reason: "The reviewed subscription lifetime window must be a positive number of milliseconds." };
+  }
+  if (kind === "longpoll") {
+    const cursor = pollcursorof(options.poll);
+    if (!cursor) return { allowed: false, reason: "A reviewed poll cursor with a url, cursor field, interval and stop condition is required in options.poll." };
+    const wait = options.wait;
+    if (wait !== void 0 && (typeof wait !== "number" || !Number.isFinite(wait) || wait < 0)) return { allowed: false, reason: "The reviewed long poll wait budget must be zero or a positive number of milliseconds." };
+    if (wait !== void 0 && cursor.interval > wait) return { allowed: false, reason: `The long poll interval of ${cursor.interval} milliseconds exceeds the reviewed wait budget of ${wait} milliseconds; review a wider budget or a shorter interval.` };
+  }
+  return { allowed: true };
+}
+function validatenetwatchgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "watchrequests") {
+    if (options.watch !== void 0) {
+      const watch = options.watch;
+      if (!watch || typeof watch !== "object" || Array.isArray(watch)) return { allowed: false, reason: "The reviewed watch window must be an object." };
+      const reviewed = watch;
+      if (reviewed.window !== void 0 && (typeof reviewed.window !== "number" || !Number.isFinite(reviewed.window) || reviewed.window < 0)) return { allowed: false, reason: "The reviewed watch window must be zero or a positive number of milliseconds." };
+    }
+    if (options.limit !== void 0 && (typeof options.limit !== "number" || !Number.isInteger(options.limit) || options.limit < 1)) return { allowed: false, reason: "The reviewed watch match limit must be a positive integer with no code ceiling." };
+  }
+  if (kind === "readheaders") {
+    const headers = options.headers;
+    if (!headers || typeof headers !== "object" || Array.isArray(headers)) return { allowed: false, reason: "A reviewed header filter with a name allowlist and a redaction list is required in options.headers." };
+    const reviewed = headers;
+    if (!Array.isArray(reviewed.allow) || reviewed.allow.length === 0 || !reviewed.allow.every((name) => isnonempty(name))) return { allowed: false, reason: "The reviewed header allowlist must be a non-empty list of header names." };
+    if (!Array.isArray(reviewed.redact) || reviewed.redact.length === 0 || !reviewed.redact.every((name) => isnonempty(name))) return { allowed: false, reason: "Header capture requires a reviewed redaction list before any header value is stored." };
+  }
+  if (kind === "capturebodies") {
+    const body = options.body;
+    if (!body || typeof body !== "object" || Array.isArray(body)) return { allowed: false, reason: "A reviewed body filter with a url pattern, mime list and byte ceiling is required in options.body." };
+    const reviewed = body;
+    if (reviewed.urlpattern !== void 0 && !isnonempty(reviewed.urlpattern)) return { allowed: false, reason: "The reviewed body url pattern must be a non-empty string." };
+    if (reviewed.mimes !== void 0 && (!Array.isArray(reviewed.mimes) || reviewed.mimes.length === 0 || !reviewed.mimes.every((mime) => isnonempty(mime)))) return { allowed: false, reason: "The reviewed body mime list must be a non-empty list of mime types." };
+    if (reviewed.ceiling !== void 0 && (typeof reviewed.ceiling !== "number" || !Number.isFinite(reviewed.ceiling) || reviewed.ceiling < 0)) return { allowed: false, reason: "The reviewed body byte ceiling must be zero or a positive number of bytes with no code ceiling." };
+  }
+  if (kind === "mapapi") {
+    if (options.limit !== void 0 && (typeof options.limit !== "number" || !Number.isInteger(options.limit) || options.limit < 1)) return { allowed: false, reason: "The reviewed mapapi match limit must be a positive integer with no code ceiling." };
+  }
+  if (kind === "extractapi") {
+    const replay = apireplayspecof(options.replay);
+    if (!replay) return { allowed: false, reason: "A reviewed replay spec with an endpoint is required in options.replay." };
+    if (!ishttpsurl(replay.endpoint)) return { allowed: false, reason: "The reviewed replay endpoint must be an HTTPS url." };
+    if (replay.verb !== void 0 && !["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"].includes(replay.verb)) return { allowed: false, reason: "The reviewed replay verb must be a known HTTP verb." };
+    for (const path of replay.paths ?? []) {
+      if (!validpath(path.trim())) return { allowed: false, reason: `The reviewed replay extraction path ${path} must be a dotted path of non-empty segments.` };
+    }
+  }
+  return { allowed: true };
+}
+function validatecontrolgrammar(step, options) {
+  const kind = step.kind;
+  if (kind === "blockrequest") {
+    const rule = blockruleof(options.block);
+    if (!rule) return { allowed: false, reason: "A reviewed block rule with a url pattern is required in options.block." };
+    if (patternorigin(rule.urlpattern) === void 0) return { allowed: false, reason: "Block rules need an https origin pattern; patterns without a named origin are refused." };
+    if (options.block.reviewed !== true) return { allowed: false, reason: "The block rule carries the explicit reviewed flag before any request is blocked." };
+  }
+  if (kind === "mockresponse") {
+    const spec = mockspecof(options.mock);
+    if (!spec) return { allowed: false, reason: "A reviewed mock fixture with a url pattern, status and its reviewed body or a captured body ref is required in options.mock." };
+    if (patternorigin(spec.urlpattern) === void 0) return { allowed: false, reason: "Mock fixtures need an https origin pattern; patterns without a named origin are refused." };
+    if (spec.reviewed !== true) return { allowed: false, reason: "Every mock fixture is reviewed with its full body or the referenced captured body through the explicit reviewed flag before it serves." };
+  }
+  if (kind === "rewriteheaders") {
+    const rules = options.rules;
+    if (!Array.isArray(rules) || rules.length === 0) return { allowed: false, reason: "A reviewed non-empty list of header rewrite rules is required in options.rules." };
+    for (const item of rules) {
+      const rule = headeruleof(item);
+      if (!rule) return { allowed: false, reason: "Every header rewrite rule needs a url pattern, header name, a set, append or remove operation and its value." };
+      if (patternorigin(rule.urlpattern) === void 0) return { allowed: false, reason: "Header rewrite rules must name their origin pattern explicitly; patterns without a named origin are refused." };
+    }
+  }
+  if (kind === "setcookies") {
+    const cookies = options.cookies;
+    if (!Array.isArray(cookies) || cookies.length === 0) return { allowed: false, reason: "A reviewed non-empty list of cookie records is required in options.cookies." };
+    for (const item of cookies) {
+      if (!cookierecordof(item)) return { allowed: false, reason: "Every cookie record needs a name, domain, path and reviewed string value with an optional expiry." };
+    }
+  }
+  if (kind === "readcookies" && options.domain !== void 0 && !isnonempty(options.domain)) return { allowed: false, reason: "The reviewed cookie read domain must be a non-empty host." };
+  if (kind === "clearcookies") {
+    if (!isnonempty(options.domain)) return { allowed: false, reason: "A reviewed cookie domain is required before cookies are cleared." };
+    if (options.names !== void 0 && (!Array.isArray(options.names) || options.names.length === 0 || !options.names.every((name) => isnonempty(name)))) return { allowed: false, reason: "The reviewed cookie clear list must be a non-empty list of cookie names when present." };
+  }
+  if (kind === "authflow") {
+    const flow = oauthflowof(options.oauth);
+    if (!flow) return { allowed: false, reason: "A reviewed oauth flow with provider, authorize url, token url, scopes and redirect origin is required in options.oauth." };
+    if (!ishttpsurl(flow.authorizeurl) || !ishttpsurl(flow.tokenurl)) return { allowed: false, reason: "The oauth authorize and token urls must use HTTPS." };
+    if (!ishttpsurl(flow.redirectorigin) && !/^https:\/\/[^/]+\/?$/.test(flow.redirectorigin)) return { allowed: false, reason: "The oauth redirect origin must be an HTTPS origin inside the grants." };
+    const consent = authconsentgranted(step);
+    if (!consent.allowed) return consent;
+  }
+  if (kind === "saveapikey") {
+    const key = options.key;
+    if (!key || typeof key !== "object" || Array.isArray(key)) return { allowed: false, reason: "A reviewed api key entry with name, origin scopes and header is required in options.key." };
+    const entry = key;
+    if (!isnonempty(entry.name)) return { allowed: false, reason: "The api key entry needs a reviewed non-empty name." };
+    if (!Array.isArray(entry.origins) || entry.origins.length === 0 || !entry.origins.every((item) => ishttpsurl(item))) return { allowed: false, reason: "The api key needs a reviewed non-empty list of HTTPS origin scopes." };
+    if (!isnonempty(entry.header)) return { allowed: false, reason: "The api key entry needs a reviewed non-empty header name." };
+    if (typeof entry.value !== "string" || !entry.value) return { allowed: false, reason: "The api key needs its secret value in the reviewed options; it never enters the audit trail." };
+    const consent = apikeyconsentgranted(step);
+    if (!consent.allowed) return consent;
+  }
+  if (kind === "routeproxy") {
+    if (!proxyrouteof(options.proxy)) return { allowed: false, reason: "A reviewed proxy route with scheme, host, port and a non-empty bypass list is required in options.proxy." };
+    if (!isnonempty(options.consentref)) return { allowed: false, reason: "Proxy routing needs the explicit reviewed consent ref before any route applies." };
+  }
+  if (kind === "postform") {
+    const form = formpayloadof(options.form);
+    if (!form) return { allowed: false, reason: "A reviewed form payload with a url and a non-empty field list is required in options.form." };
+    if (!ishttpsurl(form.url)) return { allowed: false, reason: "The form submission target must use HTTPS." };
+    if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed rate limit wait budget must be zero or a positive number of milliseconds." };
+  }
+  if (kind === "postfiles") {
+    const upload = multipartpayloadof(options.upload);
+    if (!upload) return { allowed: false, reason: "A reviewed multipart upload with a url and reviewed files is required in options.upload; every file carries the explicit reviewed flag." };
+    if (!ishttpsurl(upload.url)) return { allowed: false, reason: "The multipart upload target must use HTTPS." };
+    if (options.wait !== void 0 && (typeof options.wait !== "number" || !Number.isFinite(options.wait) || options.wait < 0)) return { allowed: false, reason: "The reviewed rate limit wait budget must be zero or a positive number of milliseconds." };
+  }
+  return { allowed: true };
+}
+function blockgate(session, step, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the request block." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot block requests." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot block requests." };
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const rule = options.block;
+  if (!rule || typeof rule !== "object" || Array.isArray(rule) || rule.reviewed !== true) return { allowed: false, reason: "Request blocking needs its reviewed block rule with the explicit reviewed flag before any rule applies." };
+  if (!blockruleof(rule)) return { allowed: false, reason: "The block rule needs a url pattern and an optional resource type list." };
+  return { allowed: true };
+}
+function cookiegate(session, domain, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the cookie operation." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot touch cookies." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot touch cookies." };
+  const grants = session.grants ?? [session.origin];
+  if (!cookiedomaingranted(domain, grants)) return { allowed: false, reason: `The cookie domain ${domain} stays outside the session origin grants; cookie control refuses domains beyond the grants.` };
+  return { allowed: true };
+}
+function proxygate(session, step, now) {
+  if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the proxy route." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot change routing." };
+  if (session.pausedat) return { allowed: false, reason: "The browser session is paused and cannot change routing." };
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  if (!isnonempty(options.consentref)) return { allowed: false, reason: "Proxy routing needs the explicit reviewed consent ref before any route applies." };
+  if (!proxyrouteof(options.proxy)) return { allowed: false, reason: "The proxy route needs a scheme, host, port and a non-empty bypass list of origins that stay direct." };
+  return { allowed: true };
+}
+function authconsentgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const consentref = options.consentref;
+  if (typeof consentref !== "string" || !consentref.trim()) return { allowed: false, reason: "An oauth flow requires the reviewed provider consent prompt ref in options before it starts." };
+  return { allowed: true };
+}
+function apikeyconsentgranted(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  const consentref = options.consentref;
+  if (typeof consentref !== "string" || !consentref.trim()) return { allowed: false, reason: "Storing an api key requires the explicit reviewed consent prompt ref in options before anything is stored." };
+  return { allowed: true };
+}
+function ratelimitbudgetallowed(wait, budget) {
+  if (wait !== void 0 && (typeof wait !== "number" || !Number.isFinite(wait) || wait < 0)) return { allowed: false, reason: "The rate limit wait must be zero or a positive number of milliseconds." };
+  if (budget !== void 0 && (typeof budget !== "number" || !Number.isFinite(budget) || budget < 0)) return { allowed: false, reason: "The reviewed rate limit budget must be zero or a positive number of milliseconds." };
+  if (wait !== void 0 && budget !== void 0 && wait > budget) return { allowed: false, reason: `The rate limit wait of ${wait} milliseconds exceeds the reviewed budget of ${budget} milliseconds; review a wider budget or submit later.` };
+  return { allowed: true };
+}
+function controltarget(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  for (const key of ["form", "upload"]) {
+    const value = options[key];
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const url = value.url;
+      if (typeof url === "string" && url.trim()) return url.trim();
+    }
+  }
+  if (step.kind === "authflow") {
+    const flow = oauthflowof(options.oauth);
+    if (flow) return flow.tokenurl;
+  }
+  return void 0;
+}
+function sockettarget(step) {
+  let options = {};
+  try {
+    options = parseoptions(step);
+  } catch {
+    options = {};
+  }
+  for (const key of ["socket", "subscription", "poll"]) {
+    const value = options[key];
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const url = value.url;
+      if (typeof url === "string" && url.trim()) return url.trim();
+    }
+  }
+  return void 0;
+}
 function mediagate(session, tabid2, origin, now) {
   if (!session || session.stoppedat) return { allowed: false, reason: "No active browser session exists for the media capture." };
   if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and cannot capture media." };
@@ -2251,6 +3699,18 @@ function validatestep(step, origin) {
     const httpcheck = validatehttpgrammar(step, options);
     if (!httpcheck.allowed) return httpcheck;
   }
+  if (issocketkind(step.kind)) {
+    const socketcheck = validatesocketgrammar(step, options);
+    if (!socketcheck.allowed) return socketcheck;
+  }
+  if (isnetwatchkind(step.kind)) {
+    const netwatchcheck = validatenetwatchgrammar(step, options);
+    if (!netwatchcheck.allowed) return netwatchcheck;
+  }
+  if (iscontrolkind(step.kind)) {
+    const controlcheck = validatecontrolgrammar(step, options);
+    if (!controlcheck.allowed) return controlcheck;
+  }
   if (step.kind === "tabcreate") {
     if (options.background !== void 0 && typeof options.background !== "boolean") return { allowed: false, reason: "The reviewed background flag must be a boolean." };
     if (options.window !== void 0 && (typeof options.window !== "number" || !Number.isInteger(options.window) || options.window < 0)) return { allowed: false, reason: "The reviewed target window id must be a non-negative integer." };
@@ -2341,6 +3801,79 @@ function canexecute(input) {
       if (!consentgate.allowed) return consentgate;
     }
   }
+  if (issocketkind(input.step.kind)) {
+    const channelurl = sockettarget(input.step);
+    if (channelurl !== void 0) {
+      const channelgate = socketgate(input.session, channelurl);
+      if (!channelgate.allowed) return channelgate;
+    }
+  }
+  if (input.step.kind === "watchrequests") {
+    const watchgatecheck = watchgate(input.session, input.settings, now);
+    if (!watchgatecheck.allowed) return watchgatecheck;
+  }
+  if (iscontrolkind(input.step.kind)) {
+    const controlgate = sessiongate({ session: input.session, tabid: input.tabid, origin: input.origin, now, action: "control the network" });
+    if (!controlgate.allowed) return controlgate;
+    let controloptions = {};
+    try {
+      controloptions = parseoptions(input.step);
+    } catch {
+      controloptions = {};
+    }
+    if (input.step.kind === "blockrequest") {
+      const blockgatecheck = blockgate(input.session, input.step, now);
+      if (!blockgatecheck.allowed) return blockgatecheck;
+      const rule = blockruleof(controloptions.block);
+      if (rule) {
+        const blockorigin = origincheck(input.session, rule.urlpattern);
+        if (!blockorigin.allowed) return blockorigin;
+      }
+    }
+    if (input.step.kind === "mockresponse" || input.step.kind === "rewriteheaders") {
+      const patterns = input.step.kind === "mockresponse" ? [mockspecof(controloptions.mock)?.urlpattern ?? ""] : Array.isArray(controloptions.rules) ? controloptions.rules.map((item) => item && typeof item === "object" && !Array.isArray(item) ? String(item.urlpattern ?? "") : "") : [];
+      for (const pattern of patterns) {
+        const patterngate = origincheck(input.session, pattern);
+        if (!patterngate.allowed) return patterngate;
+      }
+    }
+    if (input.step.kind === "setcookies" || input.step.kind === "readcookies" || input.step.kind === "clearcookies") {
+      const domain = typeof controloptions.domain === "string" && controloptions.domain.trim() ? controloptions.domain : Array.isArray(controloptions.cookies) ? String(controloptions.cookies[0]?.domain ?? "") : "";
+      if (!domain) return { allowed: false, reason: "A reviewed cookie domain is required before cookie control runs." };
+      const cookiegatecheck = cookiegate(input.session, domain, now);
+      if (!cookiegatecheck.allowed) return cookiegatecheck;
+    }
+    if (input.step.kind === "authflow") {
+      const authconsent = authconsentgranted(input.step);
+      if (!authconsent.allowed) return authconsent;
+    }
+    if (input.step.kind === "saveapikey") {
+      const keyconsent = apikeyconsentgranted(input.step);
+      if (!keyconsent.allowed) return keyconsent;
+    }
+    if (input.step.kind === "routeproxy") {
+      const proxygatecheck = proxygate(input.session, input.step, now);
+      if (!proxygatecheck.allowed) return proxygatecheck;
+    }
+    const target = controltarget(input.step);
+    if (target !== void 0) {
+      const targetgate = origincheck(input.session, target);
+      if (!targetgate.allowed) return targetgate;
+    }
+  }
+  if (input.step.kind === "extractapi") {
+    let replayoptions = {};
+    try {
+      replayoptions = parseoptions(input.step);
+    } catch {
+      replayoptions = {};
+    }
+    const replay = apireplayspecof(replayoptions.replay);
+    if (replay !== void 0) {
+      const replaygate = origincheck(input.session, replay.endpoint);
+      if (!replaygate.allowed) return replaygate;
+    }
+  }
   if (input.step.kind === "openlink" || input.step.kind === "openprivate" || input.step.kind === "batchopen" || input.step.kind === "prefetch" || input.step.kind === "deeplink" || input.step.kind === "reopentab") {
     let options = {};
     try {
@@ -2448,38 +3981,68 @@ function downloadshare(completed, total) {
 }
 function recorddownload(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const outcome = { stepid, ok: entry.state === "complete", summary: `Download ${entry.index + 1} of ${entry.url} ended in the ${entry.state} state.`, details: { download: entry }, at: now };
+  const outcome = { stepid, ok: entry.state === "complete", summary: `Download ${entry.index + 1} of ${entry.url} ended in the ${entry.state} state.`, details: { download: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordcapture(progress, planid, stepid, capture, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const bytes = capture.bytes?.length ?? 0;
+  const outcome = { stepid, ok: true, summary: `Captured a ${capture.format} ${capture.kind} shot of ${capture.width} by ${capture.height} pixels with ${bytes} character${bytes === 1 ? "" : "s"} of image data.`, details: { capture: { id: capture.id, kind: capture.kind, format: capture.format, width: capture.width, height: capture.height, bytes } }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordpair(progress, planid, stepid, pair, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: true, summary: `Paired the before shot ${pair.beforeid} with the after shot ${pair.afterid} around the ${pair.actionkind} action.`, details: { shotpair: { id: pair.id, beforeid: pair.beforeid, afterid: pair.afterid, actionkind: pair.actionkind, ...pair.target !== void 0 ? { target: pair.target } : {}, ...pair.domsnapshotid !== void 0 ? { domsnapshotid: pair.domsnapshotid } : {} } }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordmedia(progress, planid, stepid, media, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: true, summary: `Captured a ${media.kind} media record of ${media.scope} scope with ${media.bytes} character${media.bytes === 1 ? "" : "s"} of media data.`, details: { media }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordcall(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.statusclass === "success", summary: `Outbound ${entry.method} ${entry.kind} call to ${entry.origin} ended in the ${entry.status} ${entry.statusclass} class after ${entry.retries} retr${entry.retries === 1 ? "y" : "ies"} and ${entry.bytes} byte${entry.bytes === 1 ? "" : "s"}.`, details: { call: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordfetchretry(progress, planid, stepid, retry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: false, summary: `Fetch attempt ${retry.attempt} of ${retry.url} failed (${retry.reason}); retrying after a ${retry.wait} millisecond backoff.`, details: { fetchretry: retry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
+function recordchannel(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.state !== "failed", summary: `The ${entry.kind} channel of ${entry.url} is ${entry.state} after ${entry.sent} sent and ${entry.received} received message${entry.received === 1 ? "" : "s"}.`, details: { channel: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
-function recordcapture(progress, planid, stepid, capture, now) {
+function recordexchange(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const bytes = capture.bytes?.length ?? 0;
-  const outcome = { stepid, ok: true, summary: `Captured a ${capture.format} ${capture.kind} shot of ${capture.width} by ${capture.height} pixels with ${bytes} character${bytes === 1 ? "" : "s"} of image data.`, details: { capture: { id: capture.id, kind: capture.kind, format: capture.format, width: capture.width, height: capture.height, bytes } }, at: now };
+  const outcome = { stepid, ok: entry.errorclass === void 0 && entry.statusclass === "success", summary: `Observed the ${entry.method} request of ${entry.url} as exchange ${entry.correlationid} in the ${entry.status} ${entry.statusclass} class over ${entry.duration} millisecond${entry.duration === 1 ? "" : "s"}${entry.errorclass !== void 0 ? ` failing with the ${entry.errorclass} class` : ""}.`, details: { exchange: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
-function recordpair(progress, planid, stepid, pair, now) {
+function recordevent(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const outcome = { stepid, ok: true, summary: `Paired the before shot ${pair.beforeid} with the after shot ${pair.afterid} around the ${pair.actionkind} action.`, details: { shotpair: { id: pair.id, beforeid: pair.beforeid, afterid: pair.afterid, actionkind: pair.actionkind, ...pair.target !== void 0 ? { target: pair.target } : {}, ...pair.domsnapshotid !== void 0 ? { domsnapshotid: pair.domsnapshotid } : {} } }, at: now };
+  const outcome = { stepid, ok: true, summary: `The event stream of ${entry.url} observed ${entry.events} ${entry.name || "message"} event${entry.events === 1 ? "" : "s"}${entry.lasteventid !== void 0 ? ` resuming from ${entry.lasteventid}` : ""}.`, details: { event: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
-function recordmedia(progress, planid, stepid, media, now) {
+function recordpoll(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const outcome = { stepid, ok: true, summary: `Captured a ${media.kind} media record of ${media.scope} scope with ${media.bytes} character${media.bytes === 1 ? "" : "s"} of media data.`, details: { media }, at: now };
+  const outcome = { stepid, ok: true, summary: `Long poll ${entry.poll} returned the ${entry.status} status${entry.cursor !== void 0 ? ` at cursor ${entry.cursor}` : ""} and ${entry.stopped ? `stopped: ${entry.reason}` : "continues"}.`, details: { poll: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
-function recordcall(progress, planid, stepid, entry, now) {
+function recordcontrol(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const outcome = { stepid, ok: entry.statusclass === "success", summary: `Outbound ${entry.method} ${entry.kind} call to ${entry.origin} ended in the ${entry.status} ${entry.statusclass} class after ${entry.retries} retr${entry.retries === 1 ? "y" : "ies"} and ${entry.bytes} byte${entry.bytes === 1 ? "" : "s"}.`, details: { call: entry }, at: now };
+  const outcome = { stepid, ok: true, summary: `${entry.reason}: ${entry.applied} applied rule${entry.applied === 1 ? "" : "s"}, ${entry.blocked} blocked request${entry.blocked === 1 ? "" : "s"}, ${entry.mocked} mocked response${entry.mocked === 1 ? "" : "s"} and ${entry.reverts} reverted rule${entry.reverts === 1 ? "" : "s"}.`, details: { control: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
-function recordfetchretry(progress, planid, stepid, retry, now) {
+function recordupload(progress, planid, stepid, entry, now) {
   const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
-  const outcome = { stepid, ok: false, summary: `Fetch attempt ${retry.attempt} of ${retry.url} failed (${retry.reason}); retrying after a ${retry.wait} millisecond backoff.`, details: { fetchretry: retry }, at: now };
+  const outcome = { stepid, ok: true, summary: `The multipart upload moved chunk ${entry.chunk} of ${entry.chunks} with ${entry.uploaded} of ${entry.bytes} bytes sent.`, details: { upload: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
 
 // version.ts
-var packageversion = "1.1.42";
+var packageversion = "1.1.44";
 
 // types.ts
 var protocolversion = packageversion;
@@ -2500,6 +4063,10 @@ function parseproposal(value, origin, grants) {
   const planinput = record(root.plan);
   const stepsinput = planinput.steps;
   if (!Array.isArray(stepsinput) || stepsinput.length === 0) throw new Error("A plan needs at least one step.");
+  const createdat = Date.now();
+  const expiresat = typeof planinput.expiresat === "number" ? planinput.expiresat : createdat + 10 * 60 * 1e3;
+  if (expiresat <= createdat) throw new Error("Plan expiry must be in the future.");
+  const planwindow = expiresat - createdat;
   const steps = stepsinput.map((input, index) => {
     const candidate = record(input);
     const kind = text(candidate.kind, `step ${index + 1} kind`);
@@ -2507,11 +4074,32 @@ function parseproposal(value, origin, grants) {
       id: typeof candidate.id === "string" ? candidate.id : crypto.randomUUID(),
       kind,
       summary: text(candidate.summary, `step ${index + 1} summary`),
-      risk: actionrisk(kind),
+      risk: resolvedrisk(stepof(kind, candidate, index)),
       ...typeof candidate.target === "string" ? { target: candidate.target } : {},
       ...typeof candidate.value === "string" ? { value: candidate.value } : {},
       ...typeof candidate.options === "string" ? { options: candidate.options } : {}
     };
+    if (step.kind === "blockrequest") {
+      let blockoptions = {};
+      try {
+        blockoptions = parseoptions(step);
+      } catch {
+        blockoptions = {};
+      }
+      const rule = blockruleof(blockoptions.block);
+      if (rule && patternorigin(rule.urlpattern) === void 0) throw new Error("Block rules without a named origin pattern are refused.");
+    }
+    if (step.kind === "routeproxy") {
+      let proxyoptions = {};
+      try {
+        proxyoptions = parseoptions(step);
+      } catch {
+        proxyoptions = {};
+      }
+      const proxy = proxyoptions.proxy;
+      const bypass = proxy && typeof proxy === "object" && !Array.isArray(proxy) ? proxy.bypass : void 0;
+      if (!Array.isArray(bypass) || bypass.length === 0) throw new Error("Proxy routes without a bypass list are refused.");
+    }
     const evaluation = validatestep(step, origin);
     if (!evaluation.allowed) throw new Error(evaluation.reason);
     const target = outboundtarget(step);
@@ -2525,6 +4113,29 @@ function parseproposal(value, origin, grants) {
       });
       if (!granted) throw new Error(`The fetch request to ${target} targets an origin outside the grants.`);
     }
+    const channelurl = sockettarget(step);
+    if (channelurl !== void 0) {
+      const channeloriginvalue = channeloriginof(channelurl);
+      const granted = covered.some((pattern) => {
+        try {
+          return new URL(channelurl).origin === new URL(pattern).origin || channeloriginvalue === new URL(pattern).origin;
+        } catch {
+          return false;
+        }
+      });
+      if (!granted) throw new Error(`The channel to ${channelurl} targets an origin outside the grants.`);
+    }
+    let lifetime;
+    try {
+      const options = parseoptions(step);
+      for (const key of ["socket", "subscription"]) {
+        const value2 = options[key];
+        if (value2 && typeof value2 === "object" && !Array.isArray(value2) && typeof value2.lifetime === "number") lifetime = value2.lifetime;
+      }
+    } catch {
+      lifetime = void 0;
+    }
+    if (lifetime !== void 0 && lifetime > planwindow) throw new Error(`The channel lifetime of ${lifetime} milliseconds exceeds the reviewed plan window of ${planwindow} milliseconds.`);
     return step;
   });
   for (const step of steps) {
@@ -2537,8 +4148,6 @@ function parseproposal(value, origin, grants) {
     const review = submitreviewgranted(steps, step.id);
     if (!review.allowed) throw new Error(review.reason);
   }
-  const createdat = Date.now();
-  const expiresat = typeof planinput.expiresat === "number" ? planinput.expiresat : createdat + 10 * 60 * 1e3;
   const plan = {
     id: typeof planinput.id === "string" ? planinput.id : crypto.randomUUID(),
     objective: text(planinput.objective, "objective"),
@@ -2548,14 +4157,24 @@ function parseproposal(value, origin, grants) {
     expiresat,
     state: "pending"
   };
-  if (plan.expiresat <= createdat) throw new Error("Plan expiry must be in the future.");
   return { version: protocolversion, plan };
 }
+function stepof(kind, candidate, index) {
+  return { id: typeof candidate.id === "string" ? candidate.id : `candidate${index + 1}`, kind, summary: typeof candidate.summary === "string" ? candidate.summary : "", risk: "read", ...typeof candidate.options === "string" ? { options: candidate.options } : {} };
+}
+function channeloriginof(url) {
+  try {
+    const parsed = new URL(url);
+    return `${parsed.protocol === "wss:" ? "https:" : parsed.protocol}//${parsed.host}`;
+  } catch {
+    return "";
+  }
+}
 function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -2631,6 +4250,26 @@ function callsreport(input) {
   });
   return { version: protocolversion, calls };
 }
+function exchangesreport(input) {
+  return { version: protocolversion, exchanges: input.exchanges, channels: input.channels, subscriptions: input.subscriptions, apimap: input.apimap };
+}
+function authreport(input) {
+  const tokens = input.tokens.map((token) => {
+    const { accessstorageid, refreshstorageid, ...metadata } = token;
+    void accessstorageid;
+    void refreshstorageid;
+    return metadata;
+  });
+  return { version: protocolversion, tokens };
+}
+function controlreport(input) {
+  const mocks = input.mocks.map((spec) => {
+    const { body, ...metadata } = spec;
+    void body;
+    return metadata;
+  });
+  return { version: protocolversion, blocks: input.blocks, mocks, rewrites: input.rewrites, cookies: input.cookies, proxies: input.proxies, ratelimits: input.ratelimits };
+}
 
 // capture.ts
 var capturekinds = ["shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet"];
@@ -2941,451 +4580,183 @@ endstream`);
   let document2 = "%PDF-1.4\n";
   const offsets = [];
   for (let index = 0; index < objects.length; index += 1) {
-    offsets.push(document2.length);
-    document2 += `${index + 1} 0 obj
-${objects[index]}
-endobj
-`;
-  }
-  const xrefstart = document2.length;
-  document2 += `xref
-0 ${objects.length + 1}
-0000000000 65535 f 
-`;
-  for (const offset of offsets) document2 += `${String(offset).padStart(10, "0")} 00000 n 
-`;
-  document2 += `trailer
-<< /Size ${objects.length + 1} /Root 1 0 R >>
-startxref
-${xrefstart}
-%%EOF
-`;
-  return { document: document2, bytes: document2.length, pages: laidout.length, pagewidth: Math.round(size.width), pageheight: Math.round(size.height) };
-}
-function recordingoptionsof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const options = value;
-  const normalized = {};
-  if (options.scope === "tab" || options.scope === "run") normalized.scope = options.scope;
-  if (typeof options.fps === "number" && Number.isFinite(options.fps)) normalized.fps = options.fps;
-  if (typeof options.bitrate === "number" && Number.isFinite(options.bitrate)) normalized.bitrate = options.bitrate;
-  if (typeof options.audio === "boolean") normalized.audio = options.audio;
-  return normalized;
-}
-function newrecording(input) {
-  return {
-    id: input.id,
-    runid: input.runid,
-    stepid: input.stepid,
-    tabid: input.tabid,
-    kind: input.kind,
-    scope: input.options.scope ?? "tab",
-    format: input.kind === "audio" ? "evidence" : "frames",
-    startedat: input.at,
-    at: input.at,
-    ...input.options.fps !== void 0 ? { fps: input.options.fps } : {},
-    ...input.options.bitrate !== void 0 ? { bitrate: input.options.bitrate } : {},
-    ...input.options.audio !== void 0 ? { audio: input.options.audio } : {},
-    frames: []
-  };
-}
-function finishrecording(record2, endat) {
-  return { ...record2, endedat: endat, duration: Math.max(0, endat - record2.startedat) };
-}
-function frameinterval(fps) {
-  if (!Number.isFinite(fps) || fps <= 0) return 1e3;
-  return Math.max(1, Math.round(1e3 / fps));
-}
-function imagefilterof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const options = value;
-  const normalized = {};
-  if (typeof options.selector === "string" && options.selector.trim()) normalized.selector = options.selector.trim();
-  if (typeof options.minwidth === "number" && Number.isFinite(options.minwidth)) normalized.minwidth = options.minwidth;
-  if (typeof options.minheight === "number" && Number.isFinite(options.minheight)) normalized.minheight = options.minheight;
-  if (Array.isArray(options.formats) && options.formats.every((item) => typeof item === "string" && item.trim())) normalized.formats = options.formats;
-  return normalized;
-}
-function imagematches(image, filter) {
-  if (filter.minwidth !== void 0 && image.width < filter.minwidth) return false;
-  if (filter.minheight !== void 0 && image.height < filter.minheight) return false;
-  if (filter.formats !== void 0 && filter.formats.length > 0) {
-    const mime = image.mime.toLowerCase();
-    const matches = filter.formats.some((format) => {
-      const wanted = format.toLowerCase().trim();
-      return mime === wanted || mime === `image/${wanted}` || mime.endsWith(`/${wanted}`);
-    });
-    if (!matches) return false;
-  }
-  return true;
-}
-function dedupeimages(images) {
-  const seen = /* @__PURE__ */ new Set();
-  const unique = [];
-  for (const image of images) {
-    if (seen.has(image.url)) continue;
-    seen.add(image.url);
-    unique.push(image);
-  }
-  return unique;
-}
-function imagenames(rule, run, step, count, extension) {
-  const names = [];
-  for (let index = 1; index <= Math.max(0, Math.round(count)); index += 1) names.push(buildname(rule, { run, step, sequence: index, kind: "image" }, extension));
-  return names;
-}
-function lapseplanof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const options = value;
-  if (typeof options.interval !== "number" || !Number.isFinite(options.interval)) return void 0;
-  if (typeof options.duration !== "number" || !Number.isFinite(options.duration)) return void 0;
-  const format = options.format === "jpeg" || options.format === "webp" ? options.format : "png";
-  return { interval: options.interval, duration: options.duration, format };
-}
-function lapseframes(plan) {
-  if (!(plan.interval > 0) || !(plan.duration > 0)) return [];
-  const frames = [];
-  for (let time = 0; time < plan.duration; time += plan.interval) frames.push(Math.round(time));
-  return frames;
-}
-function convertdirectiveof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const options = value;
-  if (options.target !== "png" && options.target !== "jpeg" && options.target !== "webp") return void 0;
-  const normalized = { target: options.target };
-  if (options.source === "png" || options.source === "jpeg" || options.source === "webp") normalized.source = options.source;
-  if (typeof options.quality === "number" && Number.isFinite(options.quality)) normalized.quality = options.quality;
-  return normalized;
-}
-function thumbdirectiveof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const options = value;
-  if (typeof options.size !== "number" || !Number.isFinite(options.size) || options.size <= 0) return void 0;
-  if (options.fit !== "cover" && options.fit !== "contain") return void 0;
-  if (typeof options.suffix !== "string" || !options.suffix.trim()) return void 0;
-  return { size: options.size, fit: options.fit, suffix: options.suffix.trim() };
-}
-function thumbgeometry(source, directive) {
-  const size = Math.max(1, Math.round(directive.size));
-  if (directive.fit === "contain") {
-    const scale2 = Math.min(size / Math.max(1, source.width), size / Math.max(1, source.height));
-    const dw = Math.max(1, Math.round(source.width * scale2));
-    const dh = Math.max(1, Math.round(source.height * scale2));
-    return { sx: 0, sy: 0, sw: source.width, sh: source.height, dx: Math.floor((size - dw) / 2), dy: Math.floor((size - dh) / 2), dw, dh, width: size, height: size };
-  }
-  const scale = Math.max(size / Math.max(1, source.width), size / Math.max(1, source.height));
-  const sw = Math.min(source.width, Math.round(size / scale));
-  const sh = Math.min(source.height, Math.round(size / scale));
-  return { sx: Math.floor((source.width - sw) / 2), sy: Math.floor((source.height - sh) / 2), sw, sh, dx: 0, dy: 0, dw: size, dh: size, width: size, height: size };
-}
-function mediaentries(raw) {
-  return raw.map((entry) => ({
-    url: typeof entry.url === "string" ? entry.url : "",
-    mime: typeof entry.mime === "string" ? entry.mime : "",
-    duration: typeof entry.duration === "number" && Number.isFinite(entry.duration) ? entry.duration : 0,
-    width: typeof entry.width === "number" && Number.isFinite(entry.width) ? Math.round(entry.width) : 0,
-    height: typeof entry.height === "number" && Number.isFinite(entry.height) ? Math.round(entry.height) : 0,
-    codecs: typeof entry.codecs === "string" ? entry.codecs : "",
-    tracks: Array.isArray(entry.tracks) ? entry.tracks.filter((item) => typeof item === "string") : []
-  }));
-}
-function assetentries(raw) {
-  return raw.map((entry) => ({
-    kind: entry.kind === "logo" ? "logo" : "favicon",
-    url: typeof entry.url === "string" ? entry.url : "",
-    bytes: typeof entry.bytes === "number" && Number.isFinite(entry.bytes) ? entry.bytes : 0,
-    ...typeof entry.sizes === "string" && entry.sizes.trim() ? { sizes: entry.sizes.trim() } : {}
-  }));
-}
-function streamsummaries(raw) {
-  return raw.map((entry) => {
-    const tracks = Array.isArray(entry.tracks) ? entry.tracks : [];
-    return {
-      kind: typeof entry.kind === "string" ? entry.kind : "stream",
-      tracks: tracks.length,
-      label: typeof entry.label === "string" ? entry.label : "",
-      live: entry.live === true,
-      detail: tracks.map((track) => {
-        const item = track;
-        return {
-          kind: typeof item.kind === "string" ? item.kind : "",
-          label: typeof item.label === "string" ? item.label : "",
-          ...typeof item.width === "number" && Number.isFinite(item.width) ? { width: Math.round(item.width) } : {},
-          ...typeof item.height === "number" && Number.isFinite(item.height) ? { height: Math.round(item.height) } : {},
-          ...typeof item.framerate === "number" && Number.isFinite(item.framerate) ? { framerate: item.framerate } : {},
-          state: typeof item.state === "string" ? item.state : ""
-        };
-      })
-    };
-  });
-}
-
-// httpclient.ts
-var httpkinds = ["fetchurl", "parsejson", "parsehtml", "callrest", "callgraphql"];
-var redirectstatuses = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
-var bodilessmethods = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-function statusclassof(status) {
-  if (status >= 100 && status < 200) return "informational";
-  if (status >= 200 && status < 300) return "success";
-  if (status >= 300 && status < 400) return "redirect";
-  if (status >= 400 && status < 500) return "clienterror";
-  if (status >= 500 && status < 600) return "servererror";
-  return "unknown";
-}
-function templateurl(template, values) {
-  return template.replace(/\{([a-z0-9_]+)\}/gi, (whole, name) => values[name] === void 0 ? whole : String(values[name]));
-}
-function fetchrequestof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const options = value;
-  if (typeof options.url !== "string" || !options.url.trim()) return void 0;
-  const request = { url: options.url.trim() };
-  if (typeof options.method === "string" && options.method.trim()) request.method = options.method.trim().toUpperCase();
-  if (options.headers && typeof options.headers === "object" && !Array.isArray(options.headers)) {
-    const headers = {};
-    for (const [name, headervalue] of Object.entries(options.headers)) {
-      if (typeof headervalue === "string") headers[name] = headervalue;
-    }
-    request.headers = headers;
+    offsets.push(document2.length);
+    document2 += `${index + 1} 0 obj
+${objects[index]}
+endobj
+`;
   }
-  if (typeof options.body === "string") request.body = options.body;
-  if (options.mode === "cors" || options.mode === "no-cors" || options.mode === "same-origin") request.mode = options.mode;
-  return request;
+  const xrefstart = document2.length;
+  document2 += `xref
+0 ${objects.length + 1}
+0000000000 65535 f 
+`;
+  for (const offset of offsets) document2 += `${String(offset).padStart(10, "0")} 00000 n 
+`;
+  document2 += `trailer
+<< /Size ${objects.length + 1} /Root 1 0 R >>
+startxref
+${xrefstart}
+%%EOF
+`;
+  return { document: document2, bytes: document2.length, pages: laidout.length, pagewidth: Math.round(size.width), pageheight: Math.round(size.height) };
 }
-function fetchoptionsof(value) {
+function recordingoptionsof(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   const options = value;
   const normalized = {};
-  if (typeof options.timeout === "number" && Number.isFinite(options.timeout)) normalized.timeout = options.timeout;
-  if (typeof options.retries === "number" && Number.isFinite(options.retries)) normalized.retries = options.retries;
-  if (typeof options.backoff === "number" && Number.isFinite(options.backoff)) normalized.backoff = options.backoff;
-  if (typeof options.follow === "number" && Number.isFinite(options.follow)) normalized.follow = options.follow;
+  if (options.scope === "tab" || options.scope === "run") normalized.scope = options.scope;
+  if (typeof options.fps === "number" && Number.isFinite(options.fps)) normalized.fps = options.fps;
+  if (typeof options.bitrate === "number" && Number.isFinite(options.bitrate)) normalized.bitrate = options.bitrate;
+  if (typeof options.audio === "boolean") normalized.audio = options.audio;
   return normalized;
 }
-function streamwindowof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const options = value;
-  const window2 = {};
-  if (typeof options.budget === "number" && Number.isFinite(options.budget)) window2.budget = options.budget;
-  return window2;
+function newrecording(input) {
+  return {
+    id: input.id,
+    runid: input.runid,
+    stepid: input.stepid,
+    tabid: input.tabid,
+    kind: input.kind,
+    scope: input.options.scope ?? "tab",
+    format: input.kind === "audio" ? "evidence" : "frames",
+    startedat: input.at,
+    at: input.at,
+    ...input.options.fps !== void 0 ? { fps: input.options.fps } : {},
+    ...input.options.bitrate !== void 0 ? { bitrate: input.options.bitrate } : {},
+    ...input.options.audio !== void 0 ? { audio: input.options.audio } : {},
+    frames: []
+  };
 }
-function jsonpathrulesof(value) {
-  if (!Array.isArray(value)) return [];
-  const rules = [];
-  for (const item of value) {
-    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-    const entry = item;
-    if (typeof entry.name !== "string" || !entry.name.trim()) continue;
-    if (typeof entry.path !== "string" || !entry.path.trim()) continue;
-    const rule = { name: entry.name.trim(), path: entry.path.trim() };
-    if (entry.kind === "text" || entry.kind === "number" || entry.kind === "boolean" || entry.kind === "json") rule.kind = entry.kind;
-    if (entry.default !== void 0) rule.default = entry.default;
-    rules.push(rule);
-  }
-  return rules;
+function finishrecording(record2, endat) {
+  return { ...record2, endedat: endat, duration: Math.max(0, endat - record2.startedat) };
 }
-function htmlqueriesof(value) {
-  if (!Array.isArray(value)) return [];
-  const queries = [];
-  for (const item of value) {
-    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-    const entry = item;
-    if (typeof entry.selector !== "string" || !entry.selector.trim()) continue;
-    const query = { selector: entry.selector.trim() };
-    if (typeof entry.attribute === "string" && entry.attribute.trim()) query.attribute = entry.attribute.trim();
-    if (entry.multi === true) query.multi = true;
-    queries.push(query);
-  }
-  return queries;
+function frameinterval(fps) {
+  if (!Number.isFinite(fps) || fps <= 0) return 1e3;
+  return Math.max(1, Math.round(1e3 / fps));
 }
-function graphqlrequestof(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+function imagefilterof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   const options = value;
-  if (typeof options.query !== "string" || !options.query.trim()) return void 0;
-  if (options.operationkind !== "query" && options.operationkind !== "mutation") return void 0;
-  const request = { query: options.query, operationkind: options.operationkind };
-  if (options.variables && typeof options.variables === "object" && !Array.isArray(options.variables)) request.variables = options.variables;
-  if (typeof options.operationname === "string" && options.operationname.trim()) request.operationname = options.operationname.trim();
-  return request;
+  const normalized = {};
+  if (typeof options.selector === "string" && options.selector.trim()) normalized.selector = options.selector.trim();
+  if (typeof options.minwidth === "number" && Number.isFinite(options.minwidth)) normalized.minwidth = options.minwidth;
+  if (typeof options.minheight === "number" && Number.isFinite(options.minheight)) normalized.minheight = options.minheight;
+  if (Array.isArray(options.formats) && options.formats.every((item) => typeof item === "string" && item.trim())) normalized.formats = options.formats;
+  return normalized;
 }
-var realsleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
-async function sendfetch(input) {
-  const options = input.options ?? {};
-  const sleep = input.sleep ?? realsleep;
-  const now = input.now ?? Date.now;
-  const attempts = Math.max(1, Math.floor(options.retries ?? 0) + 1);
-  const backoff = options.backoff ?? 0;
-  const follow = options.follow ?? Number.POSITIVE_INFINITY;
-  let url = input.request.url;
-  let method = (input.request.method ?? "GET").toUpperCase();
-  let retries = 0;
-  let redirects = 0;
-  let lastreason = "";
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    let hops = 0;
-    const startedat = now();
-    let response;
-    try {
-      const init = { method, headers: { ...input.request.headers ?? {} }, ...input.request.body !== void 0 && !bodilessmethods.has(method) ? { body: input.request.body } : {}, ...input.request.mode !== void 0 ? { mode: input.request.mode } : {}, redirect: follow <= 0 ? "error" : "follow" };
-      const sent = input.transport(url, init);
-      if (options.timeout !== void 0 && Number.isFinite(options.timeout) && options.timeout >= 0) {
-        let timedout = false;
-        response = await Promise.race([sent, sleep(options.timeout).then(() => {
-          timedout = true;
-          return void 0;
-        })]).then((value) => value ?? (timedout ? (() => {
-          throw new Error(`The request timed out after ${options.timeout} milliseconds.`);
-        })() : value));
-      } else {
-        response = await sent;
-      }
-      while (response !== void 0 && redirectstatuses.has(response.status) && typeof response.location === "string" && response.location) {
-        hops += 1;
-        if (hops > follow) throw new Error(`The redirect chain exceeded the reviewed follow limit of ${follow}.`);
-        url = new URL(response.location, url).toString();
-        if (method === "POST" && [301, 302, 303].includes(response.status)) method = "GET";
-        response = await input.transport(url, { ...init, method });
-      }
-      redirects = hops;
-    } catch (error) {
-      lastreason = error instanceof Error ? error.message : String(error);
-      response = void 0;
-    }
-    if (response !== void 0) {
-      const body = response.body;
-      return { url, status: response.status, statusclass: statusclassof(response.status), headernames: Object.keys(response.headers), body, bytes: body.length, duration: now() - startedat, retries, redirects };
-    }
-    if (attempt < attempts) {
-      const wait = backoff * attempt;
-      if (wait > 0) await sleep(wait);
-      input.onretry?.(attempt, wait, lastreason);
-      retries = attempt;
-    }
+function imagematches(image, filter) {
+  if (filter.minwidth !== void 0 && image.width < filter.minwidth) return false;
+  if (filter.minheight !== void 0 && image.height < filter.minheight) return false;
+  if (filter.formats !== void 0 && filter.formats.length > 0) {
+    const mime = image.mime.toLowerCase();
+    const matches = filter.formats.some((format) => {
+      const wanted = format.toLowerCase().trim();
+      return mime === wanted || mime === `image/${wanted}` || mime.endsWith(`/${wanted}`);
+    });
+    if (!matches) return false;
   }
-  throw new Error(`The request failed after ${attempts} attempt${attempts === 1 ? "" : "s"} with ${retries} retr${retries === 1 ? "y" : "ies"}: ${lastreason}`);
+  return true;
 }
-async function readstream(input) {
-  const pull = typeof input.chunks === "function" ? input.chunks : /* @__PURE__ */ ((source) => {
-    let index = 0;
-    return async () => source[index++];
-  })(input.chunks);
-  let count = 0;
-  let total = 0;
-  for (; ; ) {
-    if (input.window.abort?.() === true) return { chunks: count, bytes: total, aborted: true, reason: "The reviewed abort flag stopped the stream." };
-    const chunk = await pull();
-    if (chunk === void 0) return { chunks: count, bytes: total, aborted: false };
-    const next = total + chunk.length;
-    if (input.window.budget !== void 0 && next > input.window.budget) return { chunks: count, bytes: total, aborted: true, reason: `The stream aborted at ${next} bytes past the reviewed byte budget of ${input.window.budget}.` };
-    total = next;
-    count += 1;
-    input.window.onchunk?.(chunk, total);
+function dedupeimages(images) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const image of images) {
+    if (seen.has(image.url)) continue;
+    seen.add(image.url);
+    unique.push(image);
   }
+  return unique;
 }
-function pathstep(current, segment) {
-  if (Array.isArray(current) && /^\d+$/.test(segment)) return current[Number.parseInt(segment, 10)];
-  if (current && typeof current === "object" && !Array.isArray(current)) return current[segment];
-  return void 0;
+function imagenames(rule, run, step, count, extension) {
+  const names = [];
+  for (let index = 1; index <= Math.max(0, Math.round(count)); index += 1) names.push(buildname(rule, { run, step, sequence: index, kind: "image" }, extension));
+  return names;
 }
-function coerce(value, kind, fallback) {
-  if (value === void 0 || value === null) return { value: fallback, missing: true };
-  if (kind === "text") return { value: String(value), missing: false };
-  if (kind === "number") {
-    const numeric = typeof value === "number" ? value : Number(value);
-    return Number.isFinite(numeric) ? { value: numeric, missing: false } : { value: fallback, missing: true };
-  }
-  if (kind === "boolean") return { value: value === true || value === "true", missing: false };
-  return { value, missing: false };
+function lapseplanof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.interval !== "number" || !Number.isFinite(options.interval)) return void 0;
+  if (typeof options.duration !== "number" || !Number.isFinite(options.duration)) return void 0;
+  const format = options.format === "jpeg" || options.format === "webp" ? options.format : "png";
+  return { interval: options.interval, duration: options.duration, format };
 }
-function readpath(parsed, rules) {
-  const fields = [];
-  for (const rule of rules) {
-    const kind = rule.kind ?? "text";
-    let current = parsed;
-    let missing = false;
-    for (const segment of rule.path.split(".")) {
-      const next = pathstep(current, segment);
-      if (next === void 0) {
-        missing = true;
-        break;
-      }
-      current = next;
-    }
-    if (missing) fields.push({ name: rule.name, path: rule.path, kind, ...rule.default !== void 0 ? { value: rule.default } : {}, missing: true });
-    else {
-      const resolved = coerce(current, kind, rule.default);
-      fields.push({ name: rule.name, path: rule.path, kind, ...resolved.value !== void 0 ? { value: resolved.value } : {}, ...resolved.missing ? { missing: true } : {} });
-    }
-  }
-  return fields;
+function lapseframes(plan) {
+  if (!(plan.interval > 0) || !(plan.duration > 0)) return [];
+  const frames = [];
+  for (let time = 0; time < plan.duration; time += plan.interval) frames.push(Math.round(time));
+  return frames;
 }
-function payloadvalid(payload, schema) {
-  if (!schema) return { ok: false, errors: ["The typed endpoint call needs a reviewed payload schema before it runs."] };
-  const errors = [];
-  for (const field of schema.fields) {
-    const value = payload[field.name];
-    if (value === void 0 || value === null) {
-      if (field.required === true) errors.push(`The required field ${field.name} of kind ${field.kind} is missing.`);
-      continue;
-    }
-    if (field.kind === "string" && typeof value !== "string") errors.push(`The field ${field.name} must be a string.`);
-    if (field.kind === "number" && (typeof value !== "number" || !Number.isFinite(value))) errors.push(`The field ${field.name} must be a finite number.`);
-    if (field.kind === "boolean" && typeof value !== "boolean") errors.push(`The field ${field.name} must be a boolean.`);
-  }
-  return { ok: errors.length === 0, errors };
+function convertdirectiveof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (options.target !== "png" && options.target !== "jpeg" && options.target !== "webp") return void 0;
+  const normalized = { target: options.target };
+  if (options.source === "png" || options.source === "jpeg" || options.source === "webp") normalized.source = options.source;
+  if (typeof options.quality === "number" && Number.isFinite(options.quality)) normalized.quality = options.quality;
+  return normalized;
 }
-function payloadwithdefaults(payload, schema) {
-  if (!schema) return payload;
-  const merged = { ...payload };
-  for (const field of schema.fields) {
-    if (merged[field.name] === void 0 && field.default !== void 0) merged[field.name] = field.default;
-  }
-  return merged;
+function thumbdirectiveof(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const options = value;
+  if (typeof options.size !== "number" || !Number.isFinite(options.size) || options.size <= 0) return void 0;
+  if (options.fit !== "cover" && options.fit !== "contain") return void 0;
+  if (typeof options.suffix !== "string" || !options.suffix.trim()) return void 0;
+  return { size: options.size, fit: options.fit, suffix: options.suffix.trim() };
 }
-function errorsof(body) {
-  try {
-    const parsed = JSON.parse(body);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [body];
-    const record2 = parsed;
-    for (const key of ["errors", "messages", "error", "message"]) {
-      const value = record2[key];
-      if (Array.isArray(value)) return value.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item));
-      if (typeof value === "string") return [value];
-    }
-    return [body];
-  } catch {
-    return [body];
+function thumbgeometry(source, directive) {
+  const size = Math.max(1, Math.round(directive.size));
+  if (directive.fit === "contain") {
+    const scale2 = Math.min(size / Math.max(1, source.width), size / Math.max(1, source.height));
+    const dw = Math.max(1, Math.round(source.width * scale2));
+    const dh = Math.max(1, Math.round(source.height * scale2));
+    return { sx: 0, sy: 0, sw: source.width, sh: source.height, dx: Math.floor((size - dw) / 2), dy: Math.floor((size - dh) / 2), dw, dh, width: size, height: size };
   }
+  const scale = Math.max(size / Math.max(1, source.width), size / Math.max(1, source.height));
+  const sw = Math.min(source.width, Math.round(size / scale));
+  const sh = Math.min(source.height, Math.round(size / scale));
+  return { sx: Math.floor((source.width - sw) / 2), sy: Math.floor((source.height - sh) / 2), sw, sh, dx: 0, dy: 0, dw: size, dh: size, width: size, height: size };
 }
-async function callrest(input) {
-  const check = payloadvalid(input.payload, input.endpoint.schema);
-  if (!check.ok) throw new Error(check.errors.join(" "));
-  const payload = payloadwithdefaults(input.payload, input.endpoint.schema);
-  const url = templateurl(input.endpoint.url, payload);
-  const method = input.endpoint.method.toUpperCase();
-  const request = { url, method, ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, ...bodilessmethods.has(method) ? {} : { body: JSON.stringify(payload) } };
-  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
-  const ok = input.success !== void 0 ? input.success.includes(transport.status) : transport.statusclass === "success";
-  return { transport, url, payload, ok, errors: ok ? [] : errorsof(transport.body) };
-}
-function graphqlopenvelope(request) {
-  return JSON.stringify({ query: request.query, ...request.variables !== void 0 ? { variables: request.variables } : {}, ...request.operationname !== void 0 ? { operationName: request.operationname } : {} });
+function mediaentries(raw) {
+  return raw.map((entry) => ({
+    url: typeof entry.url === "string" ? entry.url : "",
+    mime: typeof entry.mime === "string" ? entry.mime : "",
+    duration: typeof entry.duration === "number" && Number.isFinite(entry.duration) ? entry.duration : 0,
+    width: typeof entry.width === "number" && Number.isFinite(entry.width) ? Math.round(entry.width) : 0,
+    height: typeof entry.height === "number" && Number.isFinite(entry.height) ? Math.round(entry.height) : 0,
+    codecs: typeof entry.codecs === "string" ? entry.codecs : "",
+    tracks: Array.isArray(entry.tracks) ? entry.tracks.filter((item) => typeof item === "string") : []
+  }));
 }
-function unwrapgraphql(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return { errors: ["The graphql response is not a json object."] };
-  const record2 = value;
-  const errors = Array.isArray(record2.errors) ? record2.errors.map((item) => typeof item === "string" ? item : item && typeof item === "object" && typeof item.message === "string" ? item.message : String(item)) : [];
-  return { ...record2.data !== void 0 ? { data: record2.data } : {}, errors };
+function assetentries(raw) {
+  return raw.map((entry) => ({
+    kind: entry.kind === "logo" ? "logo" : "favicon",
+    url: typeof entry.url === "string" ? entry.url : "",
+    bytes: typeof entry.bytes === "number" && Number.isFinite(entry.bytes) ? entry.bytes : 0,
+    ...typeof entry.sizes === "string" && entry.sizes.trim() ? { sizes: entry.sizes.trim() } : {}
+  }));
 }
-async function callgraphql(input) {
-  const request = { url: input.endpoint.url, method: "POST", ...input.endpoint.headers !== void 0 ? { headers: input.endpoint.headers } : {}, body: graphqlopenvelope(input.request) };
-  const transport = await sendfetch({ request, ...input.options !== void 0 ? { options: input.options } : {}, transport: input.transport, ...input.sleep !== void 0 ? { sleep: input.sleep } : {}, ...input.onretry !== void 0 ? { onretry: input.onretry } : {}, ...input.now !== void 0 ? { now: input.now } : {} });
-  try {
-    const unwrapped = unwrapgraphql(JSON.parse(transport.body));
-    return { transport, ...unwrapped.data !== void 0 ? { data: unwrapped.data } : {}, errors: unwrapped.errors };
-  } catch {
-    return { transport, errors: [transport.body] };
-  }
+function streamsummaries(raw) {
+  return raw.map((entry) => {
+    const tracks = Array.isArray(entry.tracks) ? entry.tracks : [];
+    return {
+      kind: typeof entry.kind === "string" ? entry.kind : "stream",
+      tracks: tracks.length,
+      label: typeof entry.label === "string" ? entry.label : "",
+      live: entry.live === true,
+      detail: tracks.map((track) => {
+        const item = track;
+        return {
+          kind: typeof item.kind === "string" ? item.kind : "",
+          label: typeof item.label === "string" ? item.label : "",
+          ...typeof item.width === "number" && Number.isFinite(item.width) ? { width: Math.round(item.width) } : {},
+          ...typeof item.height === "number" && Number.isFinite(item.height) ? { height: Math.round(item.height) } : {},
+          ...typeof item.framerate === "number" && Number.isFinite(item.framerate) ? { framerate: item.framerate } : {},
+          state: typeof item.state === "string" ? item.state : ""
+        };
+      })
+    };
+  });
 }
 
 // extension/browsertabs.ts
@@ -4587,7 +5958,7 @@ function stepoptions2(step) {
 }
 async function refreshcapabilities() {
   const report = await readcapabilities();
-  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds] };
+  const withmedia = { ...report, captures: [...capturekinds], media: [...mediakinds], http: [...httpkinds], netwatch: [...socketkinds, ...netwatchkinds], control: [...controlkinds] };
   await memory.setcapabilities(withmedia);
   return withmedia;
 }
@@ -4759,6 +6130,12 @@ function stepauditkind(step, ok) {
     if (step.kind === "logprovenance") return "provenance";
     return "scrape";
   }
+  if (issocketkind(step.kind)) return "socket";
+  if (isnetwatchkind(step.kind)) {
+    if (step.kind === "extractapi") return "replay";
+    if (step.kind === "watchrequests") return "watch";
+    return "observation";
+  }
   if (formfillkinds.has(step.kind)) return "fill";
   if (pointerkinds.has(step.kind)) return "pointer";
   if (watchstepkinds.has(step.kind)) return "watch";
@@ -7146,7 +8523,7 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
       streamstate.bytes = total;
     } } : void 0;
     try {
-      const transport = (url, init) => livefetch(url, init, controller, window2, streamstate);
+      const transport = (url, init) => controlledfetch(plan.id, url, init, controller, window2, streamstate);
       const result = await sendfetch({ request, ...policy !== void 0 && Object.keys(policy).length > 0 ? { options: policy } : {}, transport, onretry: (attempt, wait, reason) => {
         void (async () => {
           await memory.setprogress(recordfetchretry(await memory.getprogress(), plan.id, step.id, { attempt, url: request.url, wait, reason }, Date.now()));
@@ -7202,7 +8579,7 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
     const controller = new AbortController();
     activefetches.set(callid, controller);
     try {
-      const transport = (url, init) => livefetch(url, init, controller);
+      const transport = (url, init) => controlledfetch(plan.id, url, init, controller);
       const keynames = Array.isArray(options.apikeys) ? options.apikeys.filter((name) => typeof name === "string" && name.trim().length > 0) : [];
       if (step.kind === "callrest") {
         const methodoverride = typeof options.method === "string" ? options.method.trim().toUpperCase() : void 0;
@@ -7252,6 +8629,750 @@ async function executehttpstep(step, session, plan, tabid2, origin) {
   }
   throw new Error("Unsupported network observation kind.");
 }
+var activesockets = /* @__PURE__ */ new Map();
+var channelbuses = /* @__PURE__ */ new Map();
+var netpoll = 100;
+function waitsome(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+async function queueinboundmessage(channelid, payload) {
+  const stored = await memory.getchannel(channelid);
+  if (!stored) return;
+  const bus = channelbuses.get(channelid) ?? { sequences: {}, queue: [] };
+  const received = receivemessage(bus, channelid, "inbound", payload, Date.now());
+  channelbuses.set(channelid, received.state);
+  await memory.addmessage(received.envelope);
+  await memory.addchannel({ ...stored, received: stored.received + 1 });
+  await refreshbadge().catch(() => {
+  });
+}
+function wirewebsocket(channelid, url, protocols, options, budget) {
+  let settled = false;
+  const socket = new WebSocket(url, protocols.length > 0 ? protocols : void 0);
+  const active = activesockets.get(channelid);
+  if (active) activesockets.set(channelid, { ...active, socket });
+  void budget;
+  socket.onmessage = (event) => {
+    void queueinboundmessage(channelid, String(event.data)).catch(() => {
+    });
+  };
+  socket.onopen = () => {
+    void (async () => {
+      const stored = await memory.getchannel(channelid);
+      if (stored) await memory.addchannel({ ...stored, state: "open", openedat: stored.openedat || Date.now() });
+    })().catch(() => {
+    });
+  };
+  socket.onclose = (event) => {
+    if (settled) return;
+    settled = true;
+    void (async () => {
+      const stored = await memory.getchannel(channelid);
+      if (!stored) return;
+      if (stored.state !== "open") return;
+      const remaining = Math.max(0, Math.floor(options.reconnect ?? 0) - budget.reconnects);
+      if (remaining <= 0) {
+        await memory.addchannel(closechannel(stored, Date.now(), `The websocket closed with code ${event.code}.`));
+        activesockets.delete(channelid);
+        channelbuses.delete(channelid);
+        await audit("socket", `Channel ${channelid} of ${stored.origin} closed with code ${event.code} after ${stored.sent} sent and ${stored.received} received message${stored.received === 1 ? "" : "s"}.`, { stepid: stored.stepid });
+        return;
+      }
+      const wait = reconnectwaits(1, options.backoff ?? 0, options.backoffceiling)[0] ?? 0;
+      budget.reconnects += 1;
+      await memory.addchannel({ ...stored, state: "connecting", reconnects: stored.reconnects + 1 });
+      setTimeout(() => wirewebsocket(channelid, url, protocols, options, budget), wait);
+    })().catch(() => {
+    });
+  };
+  socket.onerror = () => {
+  };
+  void settled;
+}
+async function runsubscription(subscription, controller) {
+  let buffer = "";
+  let current = subscription;
+  const startedat = Date.now();
+  for (; ; ) {
+    if (controller.signal.aborted) break;
+    if (subscription.lifetime !== void 0 && Date.now() - startedat >= subscription.lifetime) break;
+    try {
+      const response = await fetch(subscription.url, { headers: sserequestheaders(current), credentials: "omit", signal: controller.signal });
+      if (!response.body) throw new Error("The event stream returned no body.");
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        const parsed = parsestreamchunk(buffer);
+        buffer = parsed.rest;
+        for (const event of parsed.events) {
+          const names = event.event !== void 0 && !current.names.includes(event.event) ? [...current.names, event.event] : current.names;
+          current = { ...current, events: current.events + 1, names, ...event.id !== void 0 ? { lasteventid: event.id } : {} };
+          await memory.setsubscription(current);
+          await memory.setprogress(recordevent(await memory.getprogress(), current.runid, current.stepid, { url: current.url, name: event.event ?? "", events: current.events, ...current.lasteventid !== void 0 ? { lasteventid: current.lasteventid } : {} }, Date.now())).catch(() => {
+          });
+        }
+      }
+    } catch {
+      if (controller.signal.aborted) break;
+    }
+    if (controller.signal.aborted) break;
+    if (subscription.lifetime !== void 0 && Date.now() - startedat >= subscription.lifetime) break;
+    await waitsome(netpoll * 10);
+  }
+  const closed = { ...current, state: "closed", closedat: Date.now() };
+  await memory.setsubscription(closed);
+  activesockets.delete(subscription.id);
+  await audit("socket", `Event subscription ${subscription.id} of ${subscription.origin} closed after ${closed.events} observed event${closed.events === 1 ? "" : "s"}${closed.lasteventid !== void 0 ? ` at last event id ${closed.lasteventid}` : ""}.`, { stepid: subscription.stepid });
+}
+function parsestreamchunk(chunk) {
+  return parsessetext(chunk);
+}
+async function closechannelsforrun(runid) {
+  for (const [id, active] of [...activesockets.entries()]) {
+    if (active.runid !== runid) continue;
+    active.cancelled = true;
+    active.controller?.abort();
+    try {
+      active.socket?.close(1e3);
+    } catch {
+    }
+    activesockets.delete(id);
+    if (active.channel) {
+      const closed = closechannel(active.channel, Date.now());
+      await memory.addchannel(closed).catch(() => {
+      });
+      await audit("socket", `Channel ${id} of ${active.channel.origin} closed at the end of the run with ${active.channel.sent} sent and ${active.channel.received} received message${active.channel.received === 1 ? "" : "s"}.`, { stepid: active.channel.stepid }).catch(() => void 0);
+    }
+    if (active.subscription) {
+      const closed = { ...active.subscription, state: "closed", closedat: Date.now() };
+      await memory.setsubscription(closed).catch(() => void 0);
+      await audit("socket", `Event subscription ${id} of ${active.subscription.origin} closed at the end of the run after ${closed.events} observed event${closed.events === 1 ? "" : "s"}.`, { stepid: active.subscription.stepid }).catch(() => void 0);
+    }
+  }
+  channelbuses.clear();
+}
+async function executesocketstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  if (step.kind === "opensocket") {
+    const channel = channeloptionsof(options.socket);
+    if (!channel) throw new Error("A reviewed socket with a url is required in options.socket.");
+    const gate = socketgate(session, channel.url);
+    if (!gate.allowed) throw new Error(gate.reason ?? "The channel stays outside the session origin grants.");
+    const record2 = newchannel({ id: randomid(), runid: plan.id, stepid: step.id, kind: "websocket", url: channel.url, ...channel.options.protocols !== void 0 ? { protocols: channel.options.protocols } : {}, at: Date.now() });
+    const connect = (url, protocols) => new Promise((resolve) => {
+      const socket = new WebSocket(url, protocols.length > 0 ? protocols : void 0);
+      socket.onopen = () => resolve({ open: true });
+      socket.onerror = () => resolve({ open: false, error: "The websocket reported an error before opening." });
+      socket.onclose = (event) => resolve({ open: false, code: event.code, error: `The websocket closed with code ${event.code}.` });
+    });
+    const opened = await openchannel({ record: record2, options: channel.options, connect });
+    await memory.addchannel(opened);
+    channelbuses.set(opened.id, { sequences: {}, queue: [] });
+    activesockets.set(opened.id, { runid: plan.id, channel: opened, cancelled: false });
+    if (opened.state === "open") wirewebsocket(opened.id, opened.url, opened.protocols ?? [], channel.options, { reconnects: 0 });
+    await memory.setprogress(recordchannel(await memory.getprogress(), plan.id, step.id, { id: opened.id, kind: opened.kind, state: opened.state, url: opened.url, sent: opened.sent, received: opened.received }, Date.now()));
+    await refreshbadge();
+    await audit("socket", `Opened the websocket channel ${opened.id} to ${opened.origin}${(opened.protocols ?? []).length > 0 ? ` with the reviewed protocol${(opened.protocols ?? []).length === 1 ? "" : "s"} ${(opened.protocols ?? []).join(", ")}` : ""} in the ${opened.state} state after ${opened.reconnects} reconnect attempt${opened.reconnects === 1 ? "" : "s"}; payloads stay out of the audit trail.`, extra);
+    return { ok: opened.state === "open", summary: `The websocket channel to ${opened.origin} is ${opened.state}.`, details: { network: { exchanges: 0, channelstate: opened.state, messages: 0 }, channel: { id: opened.id, url: opened.url, state: opened.state, reconnects: opened.reconnects, protocols: opened.protocols ?? [] } } };
+  }
+  if (step.kind === "sendmessage") {
+    const message = options.message;
+    const channelid = message && typeof message === "object" && !Array.isArray(message) && typeof message.channel === "string" ? message.channel : "";
+    const stream = message && typeof message === "object" && !Array.isArray(message) && typeof message.stream === "string" ? message.stream : "outbound";
+    const payload = message && typeof message === "object" && !Array.isArray(message) && typeof message.payload === "string" ? message.payload : void 0;
+    if (!channelid || payload === void 0) throw new Error("A reviewed message with an open channel id and a payload is required in options.message.");
+    const stored = await memory.getchannel(channelid);
+    if (!stored) throw new Error(`No stored channel matches ${channelid}.`);
+    if (stored.state !== "open") throw new Error(`The channel ${channelid} is ${stored.state} and cannot publish.`);
+    const active = activesockets.get(channelid);
+    if (!active?.socket || active.socket.readyState !== WebSocket.OPEN) throw new Error(`The channel ${channelid} has no live websocket to publish on.`);
+    const bus = channelbuses.get(channelid) ?? { sequences: {}, queue: [] };
+    const published = publishmessage(bus, channelid, stream, payload, Date.now());
+    channelbuses.set(channelid, published.state);
+    active.socket.send(payload);
+    const updated = { ...stored, sent: stored.sent + 1 };
+    await memory.addchannel(updated);
+    await memory.addmessage(published.envelope);
+    await memory.setprogress(recordchannel(await memory.getprogress(), plan.id, step.id, { id: updated.id, kind: updated.kind, state: updated.state, url: updated.url, sent: updated.sent, received: updated.received }, Date.now()));
+    await audit("socket", `Published ${payload.length} reviewed character${payload.length === 1 ? "" : "s"} on the ${stream} stream of channel ${channelid} as sequence ${published.envelope.sequence}; the payload value stays out of the audit trail.`, extra);
+    return { ok: true, summary: `Published the reviewed payload on the ${stream} stream of channel ${channelid} as sequence ${published.envelope.sequence}.`, details: { network: { exchanges: 0, channelstate: updated.state, messages: updated.sent + updated.received }, message: { channelid, stream, sequence: published.envelope.sequence, bytes: payload.length } } };
+  }
+  if (step.kind === "waitmessage") {
+    const filter = messagefilterof(options.filter);
+    const channelid = typeof options.channel === "string" ? options.channel : typeof options.filter?.channel === "string" ? options.filter.channel : "";
+    if (!channelid) throw new Error("A reviewed channel id is required in options.channel before a message waits.");
+    const stored = await memory.getchannel(channelid);
+    if (!stored) throw new Error(`No stored channel matches ${channelid}.`);
+    const budget = typeof options.wait === "number" && Number.isFinite(options.wait) && options.wait >= 0 ? options.wait : 0;
+    const deadline = Date.now() + budget;
+    let matched = [];
+    for (; ; ) {
+      const queued = await memory.getmessages(channelid);
+      matched = queued.filter((envelope) => matchmessage(filter, envelope)).slice(0, filter.limit ?? (matched.length || void 0));
+      if (matched.length >= (filter.limit ?? 1) || Date.now() >= deadline) break;
+      await waitsome(netpoll);
+    }
+    await memory.drainmessages(matched.map((envelope) => ({ channelid: envelope.channelid, sequence: envelope.sequence })));
+    await audit("socket", `The message wait on channel ${channelid} matched ${matched.length} envelope${matched.length === 1 ? "" : "s"} of the reviewed filter within the ${budget} millisecond budget; payload values stay out of the audit trail.`, extra);
+    return { ok: matched.length > 0, summary: matched.length > 0 ? `Matched ${matched.length} message${matched.length === 1 ? "" : "s"} on channel ${channelid}.` : `No message of channel ${channelid} matched the reviewed filter within the ${budget} millisecond budget.`, details: { network: { exchanges: 0, channelstate: stored.state, messages: stored.sent + stored.received }, messages: matched.map((envelope) => ({ stream: envelope.stream, sequence: envelope.sequence, payload: envelope.payload })) } };
+  }
+  if (step.kind === "subscribesse") {
+    const subscription = subscriptionoptionsof(options.subscription);
+    if (!subscription) throw new Error("A reviewed subscription with an event stream url and a cancellation path is required in options.subscription.");
+    const gate = socketgate(session, subscription.url);
+    if (!gate.allowed) throw new Error(gate.reason ?? "The event stream stays outside the session origin grants.");
+    const record2 = { id: randomid(), runid: plan.id, stepid: step.id, url: subscription.url, origin: new URL(subscription.url).origin, state: "open", events: 0, names: [], cancel: subscription.cancel, openedat: Date.now(), ...subscription.lasteventid !== void 0 ? { lasteventid: subscription.lasteventid } : {}, ...subscription.lifetime !== void 0 ? { lifetime: subscription.lifetime } : {} };
+    const controller = new AbortController();
+    activesockets.set(record2.id, { runid: plan.id, subscription: record2, controller, cancelled: false });
+    await memory.setsubscription(record2);
+    await memory.setprogress(recordchannel(await memory.getprogress(), plan.id, step.id, { id: record2.id, kind: "sse", state: record2.state, url: record2.url, sent: 0, received: 0 }, Date.now()));
+    await audit("socket", `Subscribed the server sent events stream ${record2.id} of ${record2.origin} with the reviewed ${subscription.cancel.kind} cancellation path${subscription.lifetime !== void 0 ? ` and the ${subscription.lifetime} millisecond lifetime window` : ""}.`, extra);
+    void runsubscription(record2, controller).catch(() => {
+    });
+    return { ok: true, summary: `The event stream subscription of ${record2.origin} is open.`, details: { network: { exchanges: 0, channelstate: "open", messages: 0 }, subscription: { id: record2.id, url: record2.url, cancel: record2.cancel, ...subscription.lifetime !== void 0 ? { lifetime: subscription.lifetime } : {} } } };
+  }
+  if (step.kind === "longpoll") {
+    const cursor = pollcursorof(options.poll);
+    if (!cursor) throw new Error("A reviewed poll cursor with a url, cursor field, interval and stop condition is required in options.poll.");
+    const gate = socketgate(session, cursor.url);
+    if (!gate.allowed) throw new Error(gate.reason ?? "The poll loop stays outside the session origin grants.");
+    const pollid = randomid();
+    const controller = new AbortController();
+    activesockets.set(pollid, { runid: plan.id, controller, cancelled: false });
+    let polls = 0;
+    let next = pollurl(cursor, void 0);
+    let lastreason = "";
+    let stopcursor;
+    try {
+      for (; ; ) {
+        const active = activesockets.get(pollid);
+        if (!active || active.cancelled) {
+          lastreason = "The long poll loop was cancelled.";
+          break;
+        }
+        const started = Date.now();
+        const response = await fetch(next.url, { method: next.body !== void 0 ? "POST" : "GET", ...next.body !== void 0 ? { headers: { "content-type": "application/json" }, body: next.body } : {}, credentials: "omit", signal: controller.signal });
+        const text2 = await response.text();
+        polls += 1;
+        let parsed;
+        try {
+          parsed = JSON.parse(text2);
+        } catch {
+          parsed = void 0;
+        }
+        const mime = response.headers.get("content-type")?.split(";")[0] ?? "";
+        const exchange = { id: randomid(), runid: plan.id, stepid: step.id, correlationid: correlationid(plan.id, polls), url: next.url, origin: new URL(next.url).origin, method: next.body !== void 0 ? "POST" : "GET", status: response.status, statusclass: response.status >= 200 && response.status < 300 ? "success" : response.status >= 400 && response.status < 500 ? "clienterror" : response.status >= 500 ? "servererror" : "unknown", source: "extension", timing: Date.now() - started, bytes: text2.length, ...mime ? { mime } : {}, at: Date.now() };
+        await memory.addexchange(exchange);
+        await memory.setprogress(recordexchange(await memory.getprogress(), plan.id, step.id, { id: exchange.id, correlationid: exchange.correlationid, method: exchange.method, origin: exchange.origin, url: exchange.url, status: exchange.status, statusclass: exchange.statusclass, duration: exchange.timing, bytes: exchange.bytes }, Date.now()));
+        const decision = polldecision({ cursor, polls: polls - 1, response: parsed, cancelled: () => activesockets.get(pollid)?.cancelled === true, expiresat: plan.expiresat, now: Date.now() });
+        await memory.setprogress(recordpoll(await memory.getprogress(), plan.id, step.id, { poll: polls, ...decision.cursor !== void 0 ? { cursor: decision.cursor } : {}, status: response.status, stopped: !decision.continue, reason: decision.reason }, Date.now()));
+        if (!decision.continue) {
+          lastreason = decision.reason;
+          break;
+        }
+        stopcursor = decision.cursor;
+        await waitsome(decision.next?.wait ?? cursor.interval);
+        next = { url: decision.next?.url ?? next.url, ...decision.next?.body !== void 0 ? { body: decision.next.body } : {} };
+      }
+    } finally {
+      activesockets.delete(pollid);
+    }
+    await audit("socket", `The long poll loop of ${cursor.url} ran ${polls} poll${polls === 1 ? "" : "s"} on the ${cursor.cursorfield} cursor and stopped: ${lastreason}.`, extra);
+    return { ok: true, summary: `The long poll loop ran ${polls} poll${polls === 1 ? "" : "s"} and stopped: ${lastreason}`, details: { network: { exchanges: polls, channelstate: "none", messages: 0 }, poll: { url: cursor.url, polls, ...stopcursor !== void 0 ? { cursor: stopcursor } : {}, stop: cursor.stop, reason: lastreason } } };
+  }
+  void tabid2;
+  void origin;
+  throw new Error("Unsupported socket observation kind.");
+}
+async function executenetwatchstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  if (step.kind === "watchrequests") {
+    const watch = options.watch && typeof options.watch === "object" && !Array.isArray(options.watch) ? options.watch : {};
+    const window2 = typeof watch.window === "number" && Number.isFinite(watch.window) && watch.window >= 0 ? watch.window : 0;
+    const limit = typeof options.limit === "number" && Number.isInteger(options.limit) && options.limit >= 1 ? options.limit : void 0;
+    const before = await bridgecall(tabid2, "resourcerecords");
+    const known = new Set(resourcefacts(before ?? []).map((fact) => `${fact.url}@${fact.start}`));
+    if (window2 > 0) await waitsome(window2);
+    const after = await bridgecall(tabid2, "resourcerecords");
+    const fresh = resourcefacts(after ?? []).filter((fact) => !known.has(`${fact.url}@${fact.start}`));
+    const chosen = limit !== void 0 ? fresh.slice(0, limit) : fresh;
+    const observed = [];
+    for (const [index, fact] of chosen.entries()) {
+      const exchange = newexchange({ id: randomid(), runid: plan.id, stepid: step.id, correlationid: correlationid(plan.id, index + 1), fact, at: Date.now() });
+      await memory.addexchange(exchange);
+      await memory.setprogress(recordexchange(await memory.getprogress(), plan.id, step.id, { id: exchange.id, correlationid: exchange.correlationid, method: exchange.method, origin: exchange.origin, url: exchange.url, status: exchange.status, statusclass: exchange.statusclass, duration: exchange.timing, bytes: exchange.bytes, ...exchange.errorclass !== void 0 ? { errorclass: exchange.errorclass } : {} }, Date.now()));
+      observed.push(exchange);
+    }
+    const failed = observed.filter((exchange) => exchange.errorclass !== void 0).length;
+    await refreshbadge();
+    await audit("watch", `Observed ${observed.length} request${observed.length === 1 ? "" : "s"} of the run tab over the reviewed ${window2} millisecond window, derived from the page timing buffers with ${failed} marked failed; headers and bodies stay out of this observation.`, extra);
+    return { ok: true, summary: `Observed ${observed.length} request${observed.length === 1 ? "" : "s"} of the run tab${failed > 0 ? ` with ${failed} failed` : ""}.`, details: { network: { exchanges: observed.length, channelstate: "none", messages: 0 }, observed: observed.map((exchange) => ({ correlationid: exchange.correlationid, method: exchange.method, url: exchange.url, status: exchange.status, statusclass: exchange.statusclass, ...exchange.errorclass !== void 0 ? { errorclass: exchange.errorclass } : {}, bytes: exchange.bytes, duration: exchange.timing })), derivation: "The request lifecycle derives from the page performance and navigation buffers; the timing buffers expose no header names, body bytes or subresource status codes." } };
+  }
+  if (step.kind === "readheaders") {
+    const filter = headerfilterof(options.headers);
+    const exchanges = typeof options.exchange === "string" ? (await memory.getexchanges()).filter((item) => item.id === options.exchange || item.correlationid === options.exchange) : await memory.listexchanges({ runid: plan.id });
+    if (exchanges.length === 0) throw new Error("No observed exchange of the run is stored yet; watch requests first.");
+    const views = [];
+    for (const exchange of exchanges) {
+      const gate = observedorigingranted(session, exchange.url);
+      if (!gate.allowed) {
+        views.push({ correlationid: exchange.correlationid, request: {}, response: {}, redacted: 0, ...gate.reason !== void 0 ? { refused: gate.reason } : {} });
+        continue;
+      }
+      const request = capturedheaders(exchange.requestheaders ?? {}, filter);
+      const response = capturedheaders(exchange.responseheaders ?? {}, filter);
+      const redacted = [...Object.keys(exchange.requestheaders ?? {}), ...Object.keys(exchange.responseheaders ?? {})].filter((name) => filter.redact.includes(name.trim().toLowerCase())).length;
+      const updated = { ...exchange, ...Object.keys(request).length > 0 ? { requestheaders: request } : {}, ...Object.keys(response).length > 0 ? { responseheaders: response } : {} };
+      if (updated.requestheaders !== exchange.requestheaders || updated.responseheaders !== exchange.responseheaders) await memory.addexchange(updated);
+      views.push({ correlationid: exchange.correlationid, request, response, redacted });
+    }
+    const refused = views.filter((view) => view.refused !== void 0).length;
+    await audit("watch", `Read the captured headers of ${views.length - refused} exchange${views.length - refused === 1 ? "" : "s"} through the reviewed allowlist with ${views.reduce((total, view) => total + view.redacted, 0)} redacted value${views.reduce((total, view) => total + view.redacted, 0) === 1 ? "" : "s"}${refused > 0 ? ` and ${refused} refused exchange${refused === 1 ? "" : "s"} outside the grants` : ""}; derived page exchanges carry no headers.`, extra);
+    return { ok: true, summary: `Read the captured headers of ${views.length - refused} exchange${views.length - refused === 1 ? "" : "s"} with ${views.reduce((total, view) => total + view.redacted, 0)} redacted value${views.reduce((total, view) => total + view.redacted, 0) === 1 ? "" : "s"}.`, details: { network: { exchanges: views.length, channelstate: "none", messages: 0 }, headers: views, derivation: "Header values exist only for exchanges captured through the extension context; derived page exchanges carry none." } };
+  }
+  if (step.kind === "capturebodies") {
+    const filter = bodyfilterof(options.body);
+    const exchanges = await memory.listexchanges({ runid: plan.id });
+    const matched = exchanges.filter((exchange) => bodymatches(filter, exchange));
+    if (matched.length === 0) throw new Error("No observed exchange matches the reviewed body filter yet.");
+    const captures = [];
+    for (const exchange of matched) {
+      const gate = observedorigingranted(session, exchange.url);
+      if (!gate.allowed) {
+        captures.push({ correlationid: exchange.correlationid, ref: "", mime: "", bytes: 0, truncated: false, ...gate.reason !== void 0 ? { refused: gate.reason } : {} });
+        continue;
+      }
+      if (exchange.bodyref !== void 0) {
+        captures.push({ correlationid: exchange.correlationid, ref: exchange.bodyref, mime: exchange.mime ?? "", bytes: exchange.bytes, truncated: false });
+        continue;
+      }
+      const controller = new AbortController();
+      activefetches.set(exchange.id, controller);
+      try {
+        const response = await fetch(exchange.url, { method: "GET", credentials: "omit", signal: controller.signal });
+        const text2 = await response.text();
+        const mime = response.headers.get("content-type")?.split(";")[0] ?? "";
+        const captured = capturebody({ ref: randomid(), runid: plan.id, exchange: { ...exchange, ...mime ? { mime } : {} }, body: text2, mime, filter, at: Date.now() });
+        if ("refused" in captured) {
+          captures.push({ correlationid: exchange.correlationid, ref: "", mime, bytes: 0, truncated: false, refused: captured.refused });
+          continue;
+        }
+        void captures;
+        await memory.addbody(captured.record);
+        const headers = {};
+        response.headers.forEach((value, name) => {
+          headers[name] = value;
+        });
+        const entry = { correlationid: exchange.correlationid, status: response.status, headers: capturedheaders(headers, { allow: filter.mimes !== void 0 ? ["content-type", "content-length"] : ["content-type", "content-length"], redact: [] }), bytes: captured.record.bytes, ...mime ? { mime } : {}, bodyref: captured.record.ref, at: Date.now() };
+        const paired = pairexchange({ ...exchange, ...mime ? { mime } : {} }, entry);
+        await memory.addexchange(paired);
+        captures.push({ correlationid: exchange.correlationid, ref: captured.record.ref, mime, bytes: captured.record.bytes, truncated: captured.truncated });
+      } finally {
+        controller.abort();
+        activefetches.delete(exchange.id);
+      }
+    }
+    const refused = captures.filter((capture) => capture.refused !== void 0).length;
+    const truncated = captures.filter((capture) => capture.truncated).length;
+    await refreshbadge();
+    await audit("watch", `Captured ${captures.length - refused} response bod${captures.length - refused === 1 ? "y" : "ies"} inside the reviewed byte ceiling${filter.ceiling !== void 0 ? ` of ${filter.ceiling} byte${filter.ceiling === 1 ? "" : "s"}` : ""} with ${truncated} truncated and ${refused} refused${refused > 0 ? " outside the grants" : ""}; body bytes stay out of the audit trail and derive from fresh reviewed fetches of the matched urls.`, extra);
+    return { ok: true, summary: `Captured ${captures.length - refused} response bod${captures.length - refused === 1 ? "y" : "ies"} inside the reviewed byte ceiling.`, details: { network: { exchanges: matched.length, channelstate: "none", messages: 0 }, bodies: captures, derivation: "The page timing buffers expose no body bytes, so each captured body comes from a fresh reviewed fetch of the matched url through the extension context." } };
+  }
+  if (step.kind === "mapapi") {
+    const exchanges = await memory.listexchanges({ runid: plan.id });
+    const bodies = await memory.getbodies();
+    const ranked = rankapis(apientries(exchanges, bodies));
+    const limit = typeof options.limit === "number" && Number.isInteger(options.limit) && options.limit >= 1 ? options.limit : void 0;
+    const chosen = limit !== void 0 ? ranked.slice(0, limit) : ranked;
+    for (const entry of chosen) await memory.setapimap(entry.origin, chosen.filter((item) => item.origin === entry.origin));
+    await audit("observation", `Mapped ${chosen.length} page api endpoint${chosen.length === 1 ? "" : "s"} of the run from ${exchanges.length} observed exchange${exchanges.length === 1 ? "" : "s"} ranked by frequency, json share and payload stability.`, extra);
+    return { ok: true, summary: `Mapped ${chosen.length} page api endpoint${chosen.length === 1 ? "" : "s"} of the run.`, details: { network: { exchanges: exchanges.length, channelstate: "none", messages: 0 }, apimap: chosen } };
+  }
+  if (step.kind === "extractapi") {
+    const spec = apireplayspecof(options.replay);
+    if (!spec) throw new Error("A reviewed replay spec with an endpoint is required in options.replay.");
+    const gate = origincheck(session, spec.endpoint);
+    if (!gate.allowed) throw new Error(gate.reason ?? "The replay endpoint stays outside the session origin grants.");
+    const url = replayurl(spec);
+    const verb = spec.verb ?? "GET";
+    const controller = new AbortController();
+    activefetches.set(step.id, controller);
+    try {
+      const started = Date.now();
+      const response = await fetch(url, { method: verb, credentials: "omit", signal: controller.signal });
+      const text2 = await response.text();
+      const mime = response.headers.get("content-type")?.split(";")[0] ?? "";
+      const headers = {};
+      response.headers.forEach((value, name) => {
+        headers[name] = value;
+      });
+      const exchange = { id: randomid(), runid: plan.id, stepid: step.id, correlationid: correlationid(plan.id, (await memory.getexchanges()).length + 1), url, origin: new URL(url).origin, method: verb, requestheaders: {}, responseheaders: headers, status: response.status, statusclass: response.status >= 200 && response.status < 300 ? "success" : response.status >= 400 && response.status < 500 ? "clienterror" : response.status >= 500 ? "servererror" : "unknown", source: "extension", timing: Date.now() - started, bytes: text2.length, ...mime ? { mime } : {}, at: Date.now() };
+      await memory.addexchange(exchange);
+      await memory.setprogress(recordexchange(await memory.getprogress(), plan.id, step.id, { id: exchange.id, correlationid: exchange.correlationid, method: exchange.method, origin: exchange.origin, url: exchange.url, status: exchange.status, statusclass: exchange.statusclass, duration: exchange.timing, bytes: exchange.bytes }, Date.now()));
+      const fields = extractvalues(text2, spec.paths ?? []);
+      await refreshbadge();
+      await audit("replay", `Replayed the captured endpoint ${spec.endpoint} with ${verb} as exchange ${exchange.correlationid} ending in the ${response.status} ${exchange.statusclass} class and mapped ${fields.length} extraction path${fields.length === 1 ? "" : "s"}; body bytes stay out of the audit trail.`, extra);
+      return { ok: exchange.statusclass === "success", summary: `The replay of ${spec.endpoint} ended in the ${response.status} ${exchange.statusclass} class with ${fields.length} extracted field${fields.length === 1 ? "" : "s"}.`, details: { network: { exchanges: 1, channelstate: "none", messages: 0 }, replay: { endpoint: spec.endpoint, verb, url, overrides: spec.overrides ?? {}, fields } } };
+    } finally {
+      controller.abort();
+      activefetches.delete(step.id);
+    }
+  }
+  void origin;
+  throw new Error("Unsupported request observation kind.");
+}
+var activerules = /* @__PURE__ */ new Map();
+var activeauthflows = /* @__PURE__ */ new Map();
+function rulesetof(runid) {
+  const existing = activerules.get(runid);
+  if (existing) return existing;
+  const created = { blocks: [], mocks: [], rewrites: [] };
+  activerules.set(runid, created);
+  return created;
+}
+async function revertcontrolsforrun(runid, reason) {
+  const ruleset = activerules.get(runid);
+  if (!ruleset) return;
+  const at = Date.now();
+  let reverted = 0;
+  for (const rule of ruleset.blocks) {
+    if (rule.revertedat !== void 0) continue;
+    await memory.addblockrule(revertrule(rule, at)).catch(() => void 0);
+    await audit("control", `Reverted the block rule ${rule.id} of ${rule.urlpattern} with ${rule.hits} blocked request${rule.hits === 1 ? "" : "s"} at ${reason}.`, { stepid: rule.stepid }).catch(() => void 0);
+    reverted += 1;
+  }
+  for (const spec of ruleset.mocks) {
+    if (spec.revertedat !== void 0) continue;
+    await memory.addmockspec(revertrule(spec, at)).catch(() => void 0);
+    await audit("control", `Reverted the mock fixture ${spec.id} of ${spec.urlpattern} with ${spec.hits} served response${spec.hits === 1 ? "" : "s"} at ${reason}.`, { stepid: spec.stepid }).catch(() => void 0);
+    reverted += 1;
+  }
+  for (const rule of ruleset.rewrites) {
+    if (rule.revertedat !== void 0) continue;
+    await memory.addheaderule(revertrule(rule, at)).catch(() => void 0);
+    await audit("control", `Reverted the header rewrite rule ${rule.id} of ${rule.urlpattern} with ${rule.hits} applied request${rule.hits === 1 ? "" : "s"} at ${reason}.`, { stepid: rule.stepid }).catch(() => void 0);
+    reverted += 1;
+  }
+  if (ruleset.proxy && ruleset.proxy.revertedat === void 0) {
+    await memory.addproxyroute(revertrule(ruleset.proxy, at)).catch(() => void 0);
+    await audit("control", `Reverted the proxy route ${ruleset.proxy.id} of ${ruleset.proxy.scheme}://${ruleset.proxy.host}:${ruleset.proxy.port} at ${reason}; the previous routing state is restored.`, { stepid: ruleset.proxy.stepid }).catch(() => void 0);
+    reverted += 1;
+  }
+  activerules.delete(runid);
+  if (reverted > 0) {
+    await memory.setprogress(recordcontrol(await memory.getprogress(), runid, ruleset.blocks[0]?.stepid ?? ruleset.rewrites[0]?.stepid ?? ruleset.mocks[0]?.stepid ?? ruleset.proxy?.stepid ?? "control", { applied: 0, blocked: 0, mocked: 0, reverts: reverted, reason: `The traffic rules reverted at ${reason}` }, at)).catch(() => void 0);
+    await refreshbadge().catch(() => void 0);
+  }
+}
+async function cancelauthflowsforrun(runid, reason) {
+  for (const [state, active] of [...activeauthflows.entries()]) {
+    if (active.runid !== runid) continue;
+    active.cancelled = true;
+    if (active.tabid) await chrome.tabs.remove(active.tabid).catch(() => void 0);
+    activeauthflows.delete(state);
+    await audit("auth", `Cancelled the oauth flow of provider ${active.flow.provider} at ${reason} before any token was exchanged.`, { stepid: active.stepid }).catch(() => void 0);
+  }
+}
+async function controlledfetch(runid, url, init, controller, window2, streamstate) {
+  const ruleset = activerules.get(runid);
+  if (ruleset) {
+    for (const rule of ruleset.blocks) {
+      if (rule.revertedat !== void 0) continue;
+      if (!matchurlpattern(rule.urlpattern, url)) continue;
+      rule.hits += 1;
+      await memory.addblockrule(rule).catch(() => void 0);
+      await audit("control", `Blocked the ${init.method} request to ${url} by the reviewed rule ${rule.id} of ${rule.urlpattern}; blocking applies to extension initiated traffic and page requests stay visible in the watch buffers.`, { stepid: rule.stepid }).catch(() => void 0);
+      throw new Error(`The request to ${url} was blocked by the reviewed block rule ${rule.id}.`);
+    }
+    const fixture = mockfor(url, ruleset.mocks);
+    if (fixture) {
+      fixture.hits += 1;
+      await memory.addmockspec(fixture).catch(() => void 0);
+      await audit("control", `Served the reviewed mock fixture ${fixture.id} with the ${fixture.status} status for ${url} instead of the network; the fixture body stays out of the audit trail.`, { stepid: fixture.stepid }).catch(() => void 0);
+      return { status: fixture.status, headers: fixture.headers ?? {}, body: fixture.body ?? "" };
+    }
+    const rewritten = applyheaderules(url, init.headers, ruleset.rewrites);
+    if (rewritten.applied.length > 0) {
+      for (const rule of rewritten.applied) {
+        rule.hits += 1;
+        await memory.addheaderule(rule).catch(() => void 0);
+        await audit("control", `Applied the header rewrite rule ${rule.id} of ${rule.operation} ${rule.name} on ${url} from step ${rule.stepid}; the provenance of every applied rule is recorded here.`, { stepid: rule.stepid }).catch(() => void 0);
+      }
+      init = { ...init, headers: rewritten.headers };
+    }
+    if (ruleset.proxy && ruleset.proxy.revertedat === void 0) {
+      const targetorigin = new URL(url).origin;
+      const bypassed = ruleset.proxy.bypass.some((pattern) => {
+        try {
+          return new URL(pattern).origin === targetorigin;
+        } catch {
+          return false;
+        }
+      });
+      if (!bypassed) {
+        const config = await memory.getconfig();
+        if (config?.endpoint) {
+          await audit("control", `Routed the ${init.method} request to ${url} through the reviewed proxy route ${ruleset.proxy.id} of ${ruleset.proxy.scheme}://${ruleset.proxy.host}:${ruleset.proxy.port} via the reviewed relay endpoint ${config.endpoint}.`, { stepid: ruleset.proxy.stepid }).catch(() => void 0);
+          const relayed = await livefetch(config.endpoint, { ...init, headers: { ...init.headers, "x-devthink-target": url } }, controller, window2, streamstate);
+          return relayed;
+        }
+        await audit("control", `The proxy route ${ruleset.proxy.id} of ${ruleset.proxy.host}:${ruleset.proxy.port} covers ${url} but no reviewed relay endpoint is configured, so the request sends direct; the route stays recorded for review.`, { stepid: ruleset.proxy.stepid }).catch(() => void 0);
+      }
+    }
+  }
+  const response = await livefetch(url, init, controller, window2, streamstate);
+  const read = ratelimitreadof(response.headers, new URL(url).origin, Date.now());
+  if (read) await memory.setratelimit(read).catch(() => void 0);
+  return response;
+}
+async function executenetcontrolstep(step, session, plan, tabid2, origin) {
+  const options = stepoptions2(step);
+  const extra = { ...session ? { sessionid: session.id } : {}, planid: plan.id, stepid: step.id };
+  const ruleset = rulesetof(plan.id);
+  if (step.kind === "blockrequest") {
+    const rule = blockruleof(options.block);
+    if (!rule) throw new Error("A reviewed block rule with a url pattern is required in options.block.");
+    const registered = newblockrule({ id: randomid(), runid: plan.id, stepid: step.id, urlpattern: rule.urlpattern, ...rule.resourcetypes !== void 0 ? { resourcetypes: rule.resourcetypes } : {}, at: Date.now() });
+    ruleset.blocks = [...ruleset.blocks.filter((item) => item.urlpattern !== registered.urlpattern), registered];
+    await memory.addblockrule(registered);
+    await audit("control", `Registered the reviewed block rule ${registered.id} of ${registered.urlpattern}${registered.resourcetypes !== void 0 ? ` for the resource types ${registered.resourcetypes.join(", ")}` : ""} for the run only; every rule reverts at run end and blocking applies to extension initiated traffic.`, extra);
+    await refreshbadge();
+    return { ok: true, summary: `The block rule of ${registered.urlpattern} applies for this run; matched extension requests are refused.`, details: { control: { applied: ruleset.blocks.filter((item) => item.revertedat === void 0).length, blocked: ruleset.blocks.reduce((total, item) => total + item.hits, 0), mocked: ruleset.mocks.reduce((total, item) => total + item.hits, 0) }, rule: { id: registered.id, urlpattern: registered.urlpattern, ...registered.resourcetypes !== void 0 ? { resourcetypes: registered.resourcetypes } : {} }, derivation: "The manifest keeps webRequest out, so blocking refuses extension initiated requests to the pattern and page requests stay visible in the watch buffers." } };
+  }
+  if (step.kind === "mockresponse") {
+    const spec = mockspecof(options.mock);
+    if (!spec || spec.reviewed !== true) throw new Error("A reviewed mock fixture with its full body or captured body ref reviewed is required in options.mock.");
+    let fixturebody = spec.body ?? "";
+    let bodyref;
+    if (spec.bodyref !== void 0) {
+      const captured = await memory.getbody(spec.bodyref);
+      if (!captured) throw new Error(`No captured body matches ${spec.bodyref}; capture it again before the fixture replays it.`);
+      if (captured.body === void 0 || captured.bodyexpired) throw new Error(`The captured body ${spec.bodyref} expired from the retention window; capture it again before the fixture replays it.`);
+      fixturebody = captured.body;
+      bodyref = spec.bodyref;
+    }
+    const registered = newmockspec({ id: randomid(), runid: plan.id, stepid: step.id, urlpattern: spec.urlpattern, status: spec.status, ...spec.headers !== void 0 ? { headers: spec.headers } : {}, body: fixturebody, ...bodyref !== void 0 ? { bodyref } : {}, reviewed: true, at: Date.now() });
+    ruleset.mocks = [...ruleset.mocks.filter((item) => item.urlpattern !== registered.urlpattern), registered];
+    await memory.addmockspec(registered);
+    await audit("control", `Registered the reviewed mock fixture ${registered.id} of ${registered.urlpattern} serving the ${registered.status} status for the run only${bodyref !== void 0 ? ` replaying the captured body ${bodyref} of the body store` : ""}; the fixture body stays out of the audit trail.`, extra);
+    await refreshbadge();
+    return { ok: true, summary: `The mock fixture of ${registered.urlpattern} serves the ${registered.status} status for this run.`, details: { control: { applied: ruleset.mocks.filter((item) => item.revertedat === void 0).length, blocked: ruleset.blocks.reduce((total, item) => total + item.hits, 0), mocked: ruleset.mocks.reduce((total, item) => total + item.hits, 0) }, mock: { id: registered.id, urlpattern: registered.urlpattern, status: registered.status, bytes: fixturebody.length } } };
+  }
+  if (step.kind === "rewriteheaders") {
+    const rules = Array.isArray(options.rules) ? options.rules : [];
+    const registered = [];
+    for (const item of rules) {
+      const rule = headeruleof(item);
+      if (!rule) throw new Error("Every header rewrite rule needs a url pattern, header name, operation and value.");
+      const record2 = newheaderule({ id: randomid(), runid: plan.id, stepid: step.id, urlpattern: rule.urlpattern, name: rule.name, operation: rule.operation, ...rule.value !== void 0 ? { value: rule.value } : {}, at: Date.now() });
+      registered.push(record2);
+    }
+    ruleset.rewrites = [...ruleset.rewrites.filter((item) => !registered.some((record2) => record2.urlpattern === item.urlpattern && record2.name === item.name)), ...registered];
+    for (const record2 of registered) await memory.addheaderule(record2);
+    await audit("control", `Registered ${registered.length} reviewed header rewrite rule${registered.length === 1 ? "" : "s"} of ${registered.map((rule) => `${rule.operation} ${rule.name} on ${rule.urlpattern}`).join("; ")} for the run only; the provenance of every applied rule is audited per request.`, extra);
+    await refreshbadge();
+    return { ok: true, summary: `${registered.length} header rewrite rule${registered.length === 1 ? "" : "s"} apply for this run.`, details: { control: { applied: ruleset.rewrites.filter((item) => item.revertedat === void 0).length, blocked: ruleset.blocks.reduce((total, item) => total + item.hits, 0), mocked: ruleset.mocks.reduce((total, item) => total + item.hits, 0) }, rules: registered.map((rule) => ({ id: rule.id, urlpattern: rule.urlpattern, name: rule.name, operation: rule.operation })) } };
+  }
+  if (step.kind === "setcookies" || step.kind === "readcookies" || step.kind === "clearcookies") {
+    const domain = typeof options.domain === "string" && options.domain.trim() ? options.domain.trim() : step.kind === "setcookies" && Array.isArray(options.cookies) ? String(options.cookies[0]?.domain ?? "") : origin;
+    const gate = cookiegate(session, domain, Date.now());
+    if (!gate.allowed) throw new Error(gate.reason ?? "The cookie domain stays outside the session origin grants.");
+    const pageorigin = `https://${domain.replace(/^\./, "")}`;
+    if (step.kind === "setcookies") {
+      const records = (Array.isArray(options.cookies) ? options.cookies : []).map((item) => cookierecordof(item)).filter((item) => item !== void 0);
+      if (records.length === 0) throw new Error("A reviewed non-empty list of cookie records is required in options.cookies.");
+      const written = await bridgecall(tabid2, "writecookies", records.map((record2) => ({ name: record2.name, value: record2.value, path: record2.path, ...record2.expiresat !== void 0 ? { expiresat: record2.expiresat } : {} })));
+      const operation2 = { id: randomid(), runid: plan.id, stepid: step.id, kind: "write", domain, names: records.map((record2) => record2.name), at: Date.now() };
+      await memory.addcookieop(operation2);
+      await audit("control", `Wrote ${written.written} reviewed cookie${written.written === 1 ? "" : "s"} for the granted domain ${domain} through the page cookie jar; cookie values stay out of the audit trail.`, extra);
+      return { ok: true, summary: `Wrote ${written.written} cookie${written.written === 1 ? "" : "s"} for ${domain}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, cookies: redactedcookies(records), domain } };
+    }
+    if (step.kind === "readcookies") {
+      const jar = await bridgecall(tabid2, "readcookies");
+      const operation2 = { id: randomid(), runid: plan.id, stepid: step.id, kind: "read", domain, names: jar.map((cookie) => cookie.name), at: Date.now() };
+      await memory.addcookieop(operation2);
+      await audit("control", `Read ${jar.length} cookie${jar.length === 1 ? "" : "s"} of the granted domain ${domain} through the page cookie jar; the values return to the step result and stay out of the audit trail.`, extra);
+      return { ok: true, summary: `Read ${jar.length} cookie${jar.length === 1 ? "" : "s"} of ${domain}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, cookies: jar, domain } };
+    }
+    const names = Array.isArray(options.names) ? options.names.filter((name) => typeof name === "string" && name.trim().length > 0) : void 0;
+    const cleared = await bridgecall(tabid2, "clearcookies", names);
+    const operation = { id: randomid(), runid: plan.id, stepid: step.id, kind: "clear", domain, names: names ?? [], at: Date.now() };
+    await memory.addcookieop(operation);
+    await audit("control", `Cleared ${cleared.cleared} cookie${cleared.cleared === 1 ? "" : "s"} of the granted domain ${domain} through the page cookie jar.`, extra);
+    return { ok: true, summary: `Cleared ${cleared.cleared} cookie${cleared.cleared === 1 ? "" : "s"} of ${domain}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, cleared: cleared.cleared, domain, ...names !== void 0 ? { names } : {} } };
+  }
+  if (step.kind === "authflow") {
+    const flow = oauthflowof(options.oauth);
+    if (!flow) throw new Error("A reviewed oauth flow with provider, authorize url, token url, scopes and redirect origin is required in options.oauth.");
+    const tokenorigin = new URL(flow.tokenurl).origin;
+    const tokenorigincheck = origincheck(session, tokenorigin);
+    if (!tokenorigincheck.allowed) throw new Error(tokenorigincheck.reason ?? "The token endpoint stays outside the session origin grants.");
+    const redirectcheck = origincheck(session, flow.redirectorigin);
+    if (!redirectcheck.allowed) throw new Error(redirectcheck.reason ?? "The redirect origin stays outside the session origin grants.");
+    if (options.refresh === true) {
+      const tokenid = typeof options.token === "string" ? options.token : "";
+      const stored = (await memory.listtokens()).find((token) => token.id === tokenid && token.revokedat === void 0);
+      if (!stored) throw new Error(`No stored token record matches ${tokenid}.`);
+      const refreshsecret = await memory.getsecret(stored.refreshstorageid ?? "");
+      if (!refreshsecret) throw new Error("The stored token has no refresh secret; run the flow again.");
+      const controller = new AbortController();
+      activefetches.set(step.id, controller);
+      try {
+        const request = tokenrequest(flow, { refreshtoken: refreshsecret });
+        const response = await controlledfetch(plan.id, request.url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: request.body, redirect: "error" }, controller);
+        const tokens = parsetokens(response.body);
+        if (!tokens?.accesstoken) throw new Error(`The token refresh failed with the ${response.status} status.`);
+        const expiresat = Date.now() + (tokens.expiresin !== void 0 ? tokens.expiresin * 1e3 : 3600 * 1e3);
+        await memory.setsecret(stored.accessstorageid, tokens.accesstoken);
+        await memory.addtoken({ ...stored, expiresat, refreshedat: Date.now(), ...tokens.refreshtoken !== void 0 ? { refreshstorageid: stored.refreshstorageid } : {} });
+        await audit("auth", `Refreshed the token of provider ${stored.provider} scoped to ${stored.origin} for the scopes ${stored.scopes.join(", ")} through the reviewed refresh flow; token values never enter the audit trail.`, extra);
+        return { ok: true, summary: `Refreshed the token of ${stored.provider} expiring at ${new Date(expiresat).toISOString()}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, token: { id: stored.id, provider: stored.provider, scopes: stored.scopes, origin: stored.origin, expiresat, refreshed: true } } };
+      } finally {
+        controller.abort();
+        activefetches.delete(step.id);
+      }
+    }
+    if (options.revoke === true) {
+      const rule = revocationruleof(options.revocation);
+      const tokenids = rule ? rule.tokenids : Array.isArray(options.tokenids) ? options.tokenids.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+      if (tokenids.length === 0) throw new Error("Token revocation needs reviewed token ids in options.");
+      const records = await memory.listtokens();
+      let revoked = 0;
+      for (const tokenid of tokenids) {
+        const stored = records.find((token) => token.id === tokenid);
+        if (!stored || stored.revokedat !== void 0) continue;
+        await memory.setsecret(stored.accessstorageid, "");
+        if (stored.refreshstorageid) await memory.setsecret(stored.refreshstorageid, "");
+        await memory.addtoken({ ...stored, revokedat: Date.now() });
+        revoked += 1;
+      }
+      await audit("auth", `Revoked ${revoked} stored token record${revoked === 1 ? "" : "s"} of the run${rule ? ` with the reason ${rule.reason}` : ""}; the token material is dropped from storage.`, extra);
+      return { ok: true, summary: `Revoked ${revoked} token record${revoked === 1 ? "" : "s"}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, revoked, tokenids } };
+    }
+    const open = [...activeauthflows.entries()].find(([, active]) => active.runid === plan.id && active.stepid === step.id && !active.cancelled);
+    if (open) {
+      const [state2, active] = open;
+      if (active.tabid) {
+        const tab = await chrome.tabs.get(active.tabid).catch(() => void 0);
+        const redirected = tab?.url;
+        if (redirected) {
+          const captured = capturecode(redirected, active.flow.redirectorigin, state2);
+          if ("code" in captured) {
+            activeauthflows.delete(state2);
+            const controller = new AbortController();
+            activefetches.set(step.id, controller);
+            try {
+              const request = tokenrequest(active.flow, { code: captured.code });
+              const response = await controlledfetch(plan.id, request.url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: request.body, redirect: "error" }, controller);
+              const tokens = parsetokens(response.body);
+              if (!tokens?.accesstoken) throw new Error(`The token exchange failed with the ${response.status} status.`);
+              const tokenid = randomid();
+              const expiresat = Date.now() + (tokens.expiresin !== void 0 ? tokens.expiresin * 1e3 : 3600 * 1e3);
+              const accessstorageid = `token-${tokenid}-access`;
+              await memory.setsecret(accessstorageid, tokens.accesstoken);
+              const record2 = { id: tokenid, provider: active.flow.provider, origin: new URL(active.flow.tokenurl).origin, scopes: tokens.scopes ?? active.flow.scopes, accessstorageid, ...tokens.refreshtoken !== void 0 ? { refreshstorageid: `token-${tokenid}-refresh` } : {}, expiresat, at: Date.now() };
+              if (tokens.refreshtoken !== void 0) await memory.setsecret(record2.refreshstorageid ?? "", tokens.refreshtoken);
+              await memory.addtoken(record2);
+              await chrome.tabs.remove(active.tabid).catch(() => void 0);
+              await audit("auth", `Exchanged the captured code of provider ${active.flow.provider} for a token scoped to ${record2.origin} with the scopes ${record2.scopes.join(", ")} expiring at ${new Date(expiresat).toISOString()}; token values stay behind storage ids and never enter the audit trail.`, extra);
+              return { ok: true, summary: `The oauth flow of ${active.flow.provider} captured the redirect code and exchanged it for a token expiring at ${new Date(expiresat).toISOString()}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, token: { id: record2.id, provider: record2.provider, scopes: record2.scopes, origin: record2.origin, expiresat }, auth: { provider: record2.provider, state: state2, redirectorigin: active.flow.redirectorigin, scopes: record2.scopes, stage: "exchanged" } } };
+            } finally {
+              controller.abort();
+              activefetches.delete(step.id);
+            }
+          }
+          if (captured.error) {
+            activeauthflows.delete(state2);
+            if (active.tabid) await chrome.tabs.remove(active.tabid).catch(() => void 0);
+            return { ok: false, summary: `The oauth flow of ${active.flow.provider} failed: ${captured.error}`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, auth: { provider: active.flow.provider, state: state2, redirectorigin: active.flow.redirectorigin, scopes: active.flow.scopes, stage: "failed" }, error: captured.error } };
+          }
+        }
+      }
+      return { ok: true, summary: `The oauth flow of ${active.flow.provider} still waits for the redirect on ${active.flow.redirectorigin}; finish the provider consent and rerun the step.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, auth: { provider: active.flow.provider, state: state2, redirectorigin: active.flow.redirectorigin, scopes: active.flow.scopes, stage: "consent" } } };
+    }
+    const state = `run-${plan.id.slice(0, 8)}-${randomid().slice(0, 8)}`;
+    const consent = authorizeurl(flow, state);
+    const opened = await chrome.tabs.create({ url: consent, active: true });
+    activeauthflows.set(state, { runid: plan.id, stepid: step.id, flow, ...opened?.id !== void 0 ? { tabid: opened.id } : {}, cancelled: false });
+    await audit("auth", `Opened the provider consent page of ${flow.provider} in reviewed tab ${opened?.id ?? 0} for the scopes ${flow.scopes.join(", ")} with the redirect origin ${flow.redirectorigin}; the extension captures the code on the granted redirect origin only and run cancel closes the flow.`, extra);
+    return { ok: true, summary: `The oauth flow of ${flow.provider} waits for your consent in the opened tab; the code capture watches the granted redirect origin.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, auth: { provider: flow.provider, state, redirectorigin: flow.redirectorigin, scopes: flow.scopes, tabid: opened?.id ?? 0, stage: "consent" }, consenturl: consent, hint: "Finish the provider consent, then rerun the step to capture the redirect code through the granted redirect origin." } };
+  }
+  if (step.kind === "saveapikey") {
+    const key = options.key;
+    if (!key || typeof key !== "object" || Array.isArray(key)) throw new Error("A reviewed api key entry with name, origin scopes, header and value is required in options.key.");
+    const entry = key;
+    const ref = { name: String(entry.name ?? "").trim(), origins: Array.isArray(entry.origins) ? entry.origins.map((item) => String(item)) : [], header: String(entry.header ?? "").trim(), storageid: `apikey-${String(entry.name ?? "").trim()}`, createdat: Date.now() };
+    await memory.setapikey(ref);
+    await memory.setsecret(ref.storageid, String(entry.value ?? ""));
+    await audit("control", `Stored the api key entry ${ref.name} for ${ref.origins.join(", ")} attaching header ${ref.header} behind the reviewed consent; the platform exposes no extension key store, so the material stays behind its storage id and never enters the audit trail.`, extra);
+    return { ok: true, summary: `Stored the api key ${ref.name} for ${ref.origins.join(", ")}.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, apikey: { name: ref.name, origins: ref.origins, header: ref.header, createdat: ref.createdat } } };
+  }
+  if (step.kind === "routeproxy") {
+    const route = proxyrouteof(options.proxy);
+    if (!route) throw new Error("A reviewed proxy route with scheme, host, port and bypass list is required in options.proxy.");
+    const registered = { id: randomid(), runid: plan.id, stepid: step.id, scheme: route.scheme, host: route.host, port: route.port, bypass: route.bypass, appliedat: Date.now() };
+    ruleset.proxy = registered;
+    await memory.addproxyroute(registered);
+    const config = await memory.getconfig();
+    await audit("control", `Applied the reviewed proxy route ${registered.id} of ${registered.scheme}://${registered.host}:${registered.port} for the run only with the bypassed origins ${registered.bypass.join(", ")}; non bypassed extension traffic routes through the reviewed relay endpoint${config?.endpoint ? ` ${config.endpoint}` : " once one is configured"} and the route reverts at run end.`, extra);
+    await refreshbadge();
+    return { ok: true, summary: `The proxy route of ${registered.host}:${registered.port} applies for this run with ${registered.bypass.length} bypassed origin${registered.bypass.length === 1 ? "" : "s"}.`, details: { control: { applied: 1, blocked: 0, mocked: 0 }, proxy: { id: registered.id, scheme: registered.scheme, host: registered.host, port: registered.port, bypass: registered.bypass, appliedat: registered.appliedat }, relay: config?.endpoint ?? "", derivation: "The manifest keeps proxy control out, so the route steers extension initiated traffic through the reviewed relay endpoint pattern and reverts at run end." } };
+  }
+  if (step.kind === "postform" || step.kind === "postfiles") {
+    const payload = step.kind === "postform" ? formpayloadof(options.form) : void 0;
+    const upload = step.kind === "postfiles" ? multipartpayloadof(options.upload) : void 0;
+    const url = payload?.url ?? upload?.url;
+    if (!url) throw new Error("A reviewed payload with a url is required in options.");
+    const urlgate = origincheck(session, url);
+    if (!urlgate.allowed) throw new Error(urlgate.reason ?? "The submission target stays outside the session origin grants.");
+    const budget = typeof options.wait === "number" ? options.wait : void 0;
+    const limits = await memory.getratelimits(Date.now());
+    const limit = limits.find((item) => item.origin === new URL(url).origin);
+    const wait = ratelimitwait(limit, Date.now());
+    const budgetcheck = ratelimitbudgetallowed(wait, budget);
+    if (!budgetcheck.allowed) throw new Error(budgetcheck.reason ?? "The rate limit wait exceeds the reviewed budget.");
+    if (wait > 0) {
+      await audit("control", `The rate limiter waits ${wait} milliseconds until the reset window of ${new URL(url).origin} passes before the submission.`, extra);
+      await new Promise((resolve) => setTimeout(resolve, wait));
+    }
+    const controller = new AbortController();
+    activefetches.set(step.id, controller);
+    try {
+      const started = Date.now();
+      let response;
+      if (payload) {
+        const body2 = urlencodeform(payload.fields);
+        response = await controlledfetch(plan.id, url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: body2, redirect: "error" }, controller);
+        await audit("control", `Posted the reviewed urlencoded form of ${payload.fields.length} field${payload.fields.length === 1 ? "" : "s"} to ${url} ending in the ${response.status} class after the rate limiter pass; field values stay out of the audit trail.`, extra);
+        const retryafter2 = retryafterof(response.status, response.headers);
+        if (retryafter2 !== void 0) await audit("control", `The submission endpoint answered ${response.status} with a retry after window of ${retryafter2} milliseconds; the next submission waits for it.`, extra);
+        return { ok: response.status >= 200 && response.status < 300, summary: `The form post to ${url} ended in the ${response.status} class.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, transport: { status: response.status, headers: Object.keys(response.headers), bytes: response.body.length, duration: Date.now() - started }, fields: payload.fields.map((field) => field.name), ...retryafter2 !== void 0 ? { retryafter: retryafter2 } : {} } };
+      }
+      const streamed = multipartchunks(upload ?? { url, fields: [], files: [] });
+      let uploaded = 0;
+      for (let index = 0; index < streamed.chunks.length; index += 1) {
+        uploaded += streamed.chunks[index]?.length ?? 0;
+        await memory.setprogress(recordupload(await memory.getprogress(), plan.id, step.id, { chunk: index + 1, chunks: streamed.chunks.length, uploaded, bytes: streamed.bytes }, Date.now())).catch(() => void 0);
+      }
+      const body = streamed.chunks.join("");
+      response = await controlledfetch(plan.id, url, { method: "POST", headers: { "content-type": `multipart/form-data; boundary=${streamed.boundary}` }, body, redirect: "error" }, controller);
+      await audit("control", `Streamed the reviewed multipart upload of ${(upload?.files ?? []).length} reviewed file${(upload?.files ?? []).length === 1 ? "" : "s"} in ${streamed.chunks.length} chunk${streamed.chunks.length === 1 ? "" : "s"} of ${streamed.bytes} bytes to ${url} ending in the ${response.status} class; file contents stay out of the audit trail.`, extra);
+      const retryafter = retryafterof(response.status, response.headers);
+      if (retryafter !== void 0) await audit("control", `The upload endpoint answered ${response.status} with a retry after window of ${retryafter} milliseconds; the next submission waits for it.`, extra);
+      return { ok: response.status >= 200 && response.status < 300, summary: `The multipart upload to ${url} ended in the ${response.status} class.`, details: { control: { applied: 0, blocked: 0, mocked: 0 }, transport: { status: response.status, headers: Object.keys(response.headers), bytes: response.body.length, duration: Date.now() - started }, upload: { chunks: streamed.chunks.length, bytes: streamed.bytes, files: (upload?.files ?? []).map((file) => file.filename) }, ...retryafter !== void 0 ? { retryafter } : {} } };
+    } finally {
+      controller.abort();
+      activefetches.delete(step.id);
+    }
+  }
+  void tabid2;
+  throw new Error("Unsupported network control kind.");
+}
 async function enforcewindowreview(step, session, plan) {
   const windowid = step.value && /^\d+$/.test(step.value) ? Number.parseInt(step.value, 10) : 0;
   const progress = plan ? await memory.getprogress() : void 0;
@@ -7294,8 +9415,11 @@ async function refreshbadge() {
   const media = (await memory.getmediarecords()).length + (await memory.getimagebatches()).length;
   const recordingprompts = (await memory.getrecordingconsents()).filter((record2) => record2.approved === void 0).length;
   const fetchprompts = (await memory.getfetchconsents()).filter((consent) => consent.approved === void 0).length;
+  const observedrequests = (await memory.getexchanges()).length;
+  const livechannels = (await memory.getchannels()).filter((channel) => channel.state === "open" || channel.state === "connecting").length;
+  const activerulescount = [...activerules.values()].reduce((total2, ruleset) => total2 + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0);
   const tasktabs2 = new Set(badges.map((badge) => badge.tabid)).size;
-  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts;
+  const total = (queues?.prefetch ?? 0) + (queues?.batchopen ?? 0) + tasktabs2 + prompts + consents + quarantined + datasets + captures + media + recordingprompts + fetchprompts + observedrequests + livechannels + activerulescount;
   await chrome.action.setBadgeText({ text: total > 0 ? String(total) : "" }).catch(() => {
   });
 }
@@ -7305,7 +9429,9 @@ async function executestep(stepid) {
   const { tab, origin } = await activecontext();
   const step = plan?.steps.find((candidate) => candidate.id === stepid);
   if (!step) throw new Error("Reviewed step was not found.");
-  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, verdicts: await memory.getsafeties() });
+  const settings = await memory.getsettings();
+  const verdicts = await memory.getsafeties();
+  const gate = canexecute({ session, plan, step, tabid: tab.id, origin, ...verdicts.length > 0 ? { verdicts } : {}, ...settings !== void 0 ? { settings } : {} });
   if (!gate.allowed) throw new Error(gate.reason);
   const capability = requiredcapability(step.kind);
   if (capability) {
@@ -7355,6 +9481,12 @@ async function executestep(stepid) {
       output = await executemediastep(step, session, plan, tab.id, origin);
     } else if (ishttpkind(step.kind)) {
       output = await executehttpstep(step, session, plan, tab.id, origin);
+    } else if (issocketkind(step.kind)) {
+      output = await executesocketstep(step, session, plan, tab.id, origin);
+    } else if (isnetwatchkind(step.kind)) {
+      output = await executenetwatchstep(step, session, plan, tab.id, origin);
+    } else if (iscontrolkind(step.kind)) {
+      output = await executenetcontrolstep(step, session, plan, tab.id, origin);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tab.id);
@@ -7406,6 +9538,12 @@ async function executestep(stepid) {
     if (iscomplete(tracked, plan) && plan.state === "approved") {
       await stoprecordingsforrun(plan.id).catch(() => {
       });
+      await closechannelsforrun(plan.id).catch(() => {
+      });
+      await cancelauthflowsforrun(plan.id, "plan completion").catch(() => {
+      });
+      await revertcontrolsforrun(plan.id, "plan completion").catch(() => {
+      });
       const done = { ...plan, state: "completed", completedat: Date.now() };
       await memory.setplan(done);
       await audit("complete", "Every reviewed step of the approved plan has executed.", { ...session ? { sessionid: session.id } : {}, planid: done.id });
@@ -7558,9 +9696,17 @@ async function handlerequest(message, sender) {
         void body;
         return metadata;
       });
+      const exchanges = await memory.getexchanges();
+      const channels = await memory.getchannels();
+      const subscriptions = await memory.getsubscriptions();
+      const apimap = await memory.getapimap();
+      const messagecount = (await memory.getmessages()).length;
       const endpoints = await memory.getendpoints();
       const fetchconsents = await memory.getfetchconsents();
-      const apikeys = (await memory.getapikeys()).map((ref) => ({ name: ref.name, origins: ref.origins, header: ref.header, configuredat: ref.configuredat }));
+      const apikeys = (await memory.getapikeys()).map((ref) => ({ name: ref.name, origins: ref.origins, header: ref.header, createdat: ref.createdat, ...ref.lastuse !== void 0 ? { lastuse: ref.lastuse } : {} }));
+      const traffic = controlreport({ blocks: await memory.getblockrules(), mocks: await memory.getmockspecs(), rewrites: await memory.getheaderules(), cookies: await memory.getcookieops(), proxies: await memory.getproxyroutes(), ratelimits: await memory.getratelimits(Date.now()) });
+      const tokens = authreport({ tokens: await memory.listtokens() });
+      const authflows = [...activeauthflows.values()].map((active) => ({ provider: active.flow.provider, redirectorigin: active.flow.redirectorigin, scopes: active.flow.scopes, stepid: active.stepid, tabid: active.tabid ?? 0, stage: active.cancelled ? "cancelled" : "consent" }));
       const runsettings = await memory.getsettings();
       const scanhooks = [];
       for (const hook of await memory.getscanhooks()) {
@@ -7572,7 +9718,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, socketsactive: activesockets.size, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -7616,7 +9762,8 @@ async function handlerequest(message, sender) {
       const resolved = outcome.details?.resolvedtarget;
       const capture = outcome.details?.capture;
       const media = outcome.details?.media;
-      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {} }));
+      const network = outcome.details?.network;
+      return JSON.parse(outcomeresponse({ outcome, plan, ...resolved ? { resolvedtarget: resolved } : {}, ...capture ? { capture } : {}, ...media ? { media } : {}, ...network ? { network } : {} }));
     }
     case "map": {
       const plan = await memory.getplan();
@@ -8184,12 +10331,12 @@ async function handlerequest(message, sender) {
       if (!Array.isArray(inputkey.origins) || inputkey.origins.length === 0 || !inputkey.origins.every((item) => typeof item === "string" && /^https:\/\//.test(item))) throw new Error("The api key needs a reviewed non-empty list of HTTPS origin scopes.");
       if (!inputkey.header?.trim()) throw new Error("A reviewed header name is required for the api key.");
       if (typeof inputkey.value !== "string" || !inputkey.value) throw new Error("The api key needs its secret value; it stays out of every audit trail.");
-      const ref = { name: inputkey.name.trim(), origins: inputkey.origins, header: inputkey.header.trim(), storageid: `apikey-${inputkey.name.trim()}`, configuredat: Date.now() };
-      await memory.setapikey(ref);
-      await memory.setsecret(ref.storageid, inputkey.value);
+      const entry = { name: inputkey.name.trim(), origins: inputkey.origins, header: inputkey.header.trim(), storageid: `apikey-${inputkey.name.trim()}`, createdat: Date.now() };
+      await memory.setapikey(entry);
+      await memory.setsecret(entry.storageid, inputkey.value);
       const session = await memory.getsession();
-      await audit("call", `Stored the api key reference ${ref.name} for ${ref.origins.join(", ")} attaching header ${ref.header}; the key material itself never enters the audit trail.`, { ...session ? { sessionid: session.id } : {} });
-      return { name: ref.name, origins: ref.origins, header: ref.header, configuredat: ref.configuredat };
+      await audit("call", `Stored the api key entry ${entry.name} for ${entry.origins.join(", ")} attaching header ${entry.header}; the key material itself never enters the audit trail.`, { ...session ? { sessionid: session.id } : {} });
+      return { name: entry.name, origins: entry.origins, header: entry.header, createdat: entry.createdat };
     }
     case "deleteapikey": {
       const inputdeletekey = message;
@@ -8212,12 +10359,125 @@ async function handlerequest(message, sender) {
       await audit("call", `The review panel exported ${report.calls.length} call record${report.calls.length === 1 ? "" : "s"} through the reviewed download flow with every response body held back.`, { sessionid: session.id });
       return { exported: report.calls.length };
     }
+    case "setwebrequestgrant": {
+      const inputgrant = message;
+      const settings = await memory.getsettings();
+      await memory.setsettings({ ...settings, webrequestgrant: inputgrant.granted === true });
+      await audit("configure", `The user ${inputgrant.granted === true ? "granted" : "revoked"} request watching; the observation derives from the page timing buffers and the manifest permissions stay unchanged.`);
+      return { webrequestgrant: inputgrant.granted === true };
+    }
+    case "setbodyretention": {
+      const inputretention = message;
+      const settings = await memory.getsettings();
+      const retention = typeof inputretention.retention === "number" && Number.isInteger(inputretention.retention) && inputretention.retention >= 0 ? inputretention.retention : void 0;
+      await memory.setsettings({ ...settings, ...retention !== void 0 ? { bodyretention: retention } : {} });
+      await audit("configure", `The user set the captured body retention to ${retention === void 0 ? "keep every body" : retention} record${retention === 1 ? "" : "s"}; the exchange metadata always survives.`);
+      return { bodyretention: retention };
+    }
+    case "trafficreport": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a traffic control envelope.");
+      return controlreport({ blocks: await memory.getblockrules(), mocks: await memory.getmockspecs(), rewrites: await memory.getheaderules(), cookies: await memory.getcookieops(), proxies: await memory.getproxyroutes(), ratelimits: await memory.getratelimits(Date.now()) });
+    }
+    case "authreport": {
+      return authreport({ tokens: await memory.listtokens() });
+    }
+    case "revoketokens": {
+      const inputrevoke = message;
+      const tokenids = Array.isArray(inputrevoke.tokenids) ? inputrevoke.tokenids.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+      if (tokenids.length === 0) throw new Error("Token revocation needs the reviewed token ids.");
+      const reason = inputrevoke.reason?.trim() || "user demand from the review panel";
+      const records = await memory.listtokens();
+      let revoked = 0;
+      for (const tokenid of tokenids) {
+        const stored = records.find((token) => token.id === tokenid);
+        if (!stored || stored.revokedat !== void 0) continue;
+        await memory.setsecret(stored.accessstorageid, "");
+        if (stored.refreshstorageid) await memory.setsecret(stored.refreshstorageid, "");
+        await memory.addtoken({ ...stored, revokedat: Date.now() });
+        revoked += 1;
+      }
+      const session = await memory.getsession();
+      await audit("auth", `Revoked ${revoked} stored token record${revoked === 1 ? "" : "s"} on ${reason}; the token material is dropped from storage.`, { ...session ? { sessionid: session.id } : {} });
+      await refreshbadge();
+      return { revoked, tokenids };
+    }
+    case "revertproxyroute": {
+      const inputrevert = message;
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a proxy revert.");
+      const ruleset = activerules.get(plan.id);
+      if (!ruleset?.proxy) throw new Error("No active proxy route covers this run.");
+      if (inputrevert.id && ruleset.proxy.id !== inputrevert.id) throw new Error(`No active proxy route matches ${inputrevert.id}.`);
+      const reverted = revertrule(ruleset.proxy, Date.now());
+      ruleset.proxy = reverted;
+      await memory.addproxyroute(reverted);
+      await audit("control", `Reverted the proxy route ${reverted.id} of ${reverted.scheme}://${reverted.host}:${reverted.port} from the review panel; the previous routing state is restored.`, { planid: plan.id, stepid: reverted.stepid });
+      await refreshbadge();
+      return { reverted: true, id: reverted.id };
+    }
+    case "revertcontrols": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a traffic rule revert.");
+      await revertcontrolsforrun(plan.id, "review panel demand");
+      return { reverted: true };
+    }
+    case "netreport": {
+      const plan = await memory.getplan();
+      if (!plan) throw new Error("No plan is available for a network envelope.");
+      return exchangesreport({ exchanges: await memory.getexchanges(), channels: await memory.getchannels(), subscriptions: await memory.getsubscriptions(), apimap: await memory.getapimap() });
+    }
+    case "exchangebody": {
+      const inputbody = message;
+      const record2 = await memory.getbody(inputbody.ref ?? "");
+      if (!record2) throw new Error(`No captured body matches ${inputbody.ref ?? ""}.`);
+      if (record2.body === void 0 || record2.bodyexpired) throw new Error("The captured body expired from the retention window; capture it again.");
+      return { ref: record2.ref, mime: record2.mime, bytes: record2.bytes, body: record2.body };
+    }
+    case "closesocket": {
+      const inputclose = message;
+      const active = activesockets.get(inputclose.id ?? "");
+      if (!active) throw new Error(`No live socket or stream matches ${inputclose.id ?? ""}.`);
+      active.cancelled = true;
+      active.controller?.abort();
+      try {
+        active.socket?.close(1e3);
+      } catch {
+      }
+      activesockets.delete(inputclose.id ?? "");
+      if (active.channel) {
+        const closed = closechannel(active.channel, Date.now());
+        await memory.addchannel(closed);
+        await audit("socket", `Channel ${active.channel.id} of ${active.channel.origin} closed from the review panel after ${active.channel.sent} sent and ${active.channel.received} received message${active.channel.received === 1 ? "" : "s"}.`, { stepid: active.channel.stepid });
+      }
+      if (active.subscription) {
+        const closed = { ...active.subscription, state: "closed", closedat: Date.now() };
+        await memory.setsubscription(closed);
+        await audit("socket", `Event subscription ${active.subscription.id} of ${active.subscription.origin} cancelled from the review panel after ${closed.events} observed event${closed.events === 1 ? "" : "s"}.`, { stepid: active.subscription.stepid });
+      }
+      await refreshbadge();
+      return { closed: true, id: inputclose.id ?? "" };
+    }
     case "stop": {
       const session = await memory.getsession();
       for (const [id, controller] of [...activefetches.entries()]) {
         controller.abort();
         activefetches.delete(id);
       }
+      const stoppedplan = await memory.getplan();
+      if (stoppedplan) {
+        await closechannelsforrun(stoppedplan.id).catch(() => {
+        });
+        await cancelauthflowsforrun(stoppedplan.id, "run cancel").catch(() => {
+        });
+        await revertcontrolsforrun(stoppedplan.id, "run cancel").catch(() => {
+        });
+      } else {
+        await closechannelsforrun("none").catch(() => {
+        });
+        await revertcontrolsforrun("none", "run cancel").catch(() => {
+        });
+      }
       for (const [id, active] of [...activerecordings.entries()]) {
         const finished = finishrecording(active.record, Date.now());
         await memory.addmedia(finished).catch(() => {