@wenathlan/extension 1.1.60 → 1.1.62

package/dist/index.js

@@ -2178,6 +2178,73 @@ function exportrunstate(states, now) {
   };
 }
 
+// immutablelog.ts
+async function sha2562(payload) {
+  const bytes = new TextEncoder().encode(payload);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function entrybody(entry) {
+  return JSON.stringify({ id: entry.id, runid: entry.runid, kind: entry.kind, summary: entry.summary, origin: entry.origin, ...entry.stepid !== void 0 ? { stepid: entry.stepid } : {}, at: entry.at });
+}
+async function entryhashof(input) {
+  return { previous: input.previous, current: await sha2562(`${input.previous}
+${entrybody(input.entry)}`), algorithm: "sha-256" };
+}
+async function logentryof(input) {
+  if (input.summary.trim() === "") throw new Error("The log entry needs its summary in plain language.");
+  if (input.origin.trim() === "") throw new Error("The log entry needs its origin provenance.");
+  const entry = { id: input.id ?? randomid(), runid: input.runid, kind: input.kind, summary: input.summary, origin: input.origin, ...input.stepid !== void 0 ? { stepid: input.stepid } : {}, at: input.at };
+  return { ...entry, hash: await entryhashof({ previous: input.previous, entry }) };
+}
+function openrunlog(input) {
+  if (input.runid.trim() === "" || input.sessionid.trim() === "") throw new Error("The run log needs its run and session ids.");
+  return { runid: input.runid, sessionid: input.sessionid, entries: [], updatedat: input.now };
+}
+function lasthashof(log) {
+  const entry = log.entries[log.entries.length - 1];
+  return entry === void 0 ? "0".repeat(64) : entry.hash.current;
+}
+async function appendlogentry(input) {
+  if (input.log.seal !== void 0) throw new Error(`The run log of ${input.log.runid} sealed at ${input.log.seal.sealedat} and accepts no append; the seal is terminal.`);
+  const entry = await logentryof({ ...input.id !== void 0 ? { id: input.id } : {}, runid: input.log.runid, kind: input.kind, summary: input.summary, origin: input.origin, ...input.stepid !== void 0 ? { stepid: input.stepid } : {}, at: input.at, previous: lasthashof(input.log) });
+  return { ...input.log, entries: [...input.log.entries, entry], updatedat: input.at };
+}
+async function sealrunlog(log, now) {
+  if (log.seal !== void 0) throw new Error(`The run log of ${log.runid} already sealed at ${log.seal.sealedat}; the seal is terminal.`);
+  if (log.entries.length === 0) throw new Error("The run log seals at completion with at least one entry.");
+  const sealhash = await entryhashof({ previous: lasthashof(log), entry: { id: `seal:${log.runid}`, runid: log.runid, kind: "seal", summary: `The run ${log.runid} completed and the log sealed with ${log.entries.length} entries.`, origin: log.entries[log.entries.length - 1]?.origin ?? log.runid, at: now } });
+  const seal = { runid: log.runid, entries: log.entries.length, sealhash, sealedat: now };
+  return { log: { ...log, seal, updatedat: now }, seal };
+}
+async function verifylogchain(entries) {
+  let previous = "0".repeat(64);
+  for (let index = 0; index < entries.length; index += 1) {
+    const entry = entries[index];
+    if (entry === void 0) continue;
+    if (entry.hash.previous !== previous) return { valid: false, brokenat: index, reason: `The chain link of entry ${index} carries the previous hash ${entry.hash.previous} while its predecessor hashes to ${previous}; the chain reports tamper evidence.` };
+    const expected = await entryhashof({ previous, entry: { id: entry.id, runid: entry.runid, kind: entry.kind, summary: entry.summary, origin: entry.origin, ...entry.stepid !== void 0 ? { stepid: entry.stepid } : {}, at: entry.at } });
+    if (entry.hash.current !== expected.current) return { valid: false, brokenat: index, reason: `The entry hash of entry ${index} matches neither its body nor its predecessor hash; the chain reports tamper evidence.` };
+    previous = entry.hash.current;
+  }
+  return { valid: true, reason: `The hash chain of ${entries.length} entr${entries.length === 1 ? "y" : "ies"} verifies from the genesis hash to the last entry.` };
+}
+async function readverifiedlog(log) {
+  const verification = await verifylogchain(log.entries);
+  if (!verification.valid) return { ok: false, entries: [], reason: verification.reason };
+  return { ok: true, entries: [...log.entries], reason: verification.reason };
+}
+async function chainreportof(log) {
+  const verification = await verifylogchain(log.entries);
+  if (!verification.valid) return { runid: log.runid, valid: false, entries: log.entries.length, ...verification.brokenat !== void 0 ? { brokenat: verification.brokenat } : {}, reason: verification.reason };
+  return { runid: log.runid, valid: true, entries: log.entries.length, reason: verification.reason, ...log.seal !== void 0 ? { sealhash: log.seal.sealhash.current, sealedat: log.seal.sealedat } : {} };
+}
+async function exportlogchain(log) {
+  const read = await readverifiedlog(log);
+  if (!read.ok) return { runid: log.runid, entries: 0, chainvalid: false, reason: read.reason, log: [] };
+  return { runid: log.runid, entries: read.entries.length, chainvalid: true, reason: read.reason, ...log.seal !== void 0 ? { sealhash: log.seal.sealhash.current, sealedat: log.seal.sealedat } : {}, log: read.entries };
+}
+
 // memory.ts
 var sessionmemory = class {
   constructor(adapter) {
@@ -4637,6 +4704,302 @@ var sessionmemory = class {
   async exportrunstates() {
     return exportrunstate(await this.listrunstates(), Date.now());
   }
+  /**
+   * Security part one persistence of the 1.1.61 family.
+   * The trust boundary records live here: the per origin automation allowlist scoped per profile workspace with one exact origin per entry, the per site originprofiles with their kind grants and denials, the active consentwindows with their expiry timestamps that expire closed past their boundary, the mid run revokerun events with the halted step ids that stay visible for later consent prompts, the fresh class consents per origin, the mask rules for field shapes per origin, and the sealed immutable run logs with their final hash.
+   * The run log store exposes no update or delete path: appends land whole, the seal closes a log with its final hash and the read path verifies the chain before returning a single entry so a broken link refuses the read.
+   * The adapter seam keeps every accessor a one line storage delegation so a future append only backend replaces the adapter only; the current storage areas offer no append only hardware, so the honest derivation is the hash chain that makes any rewrite detectable at read time.
+   */
+  /** Replaces the per origin automation allowlist of the profile workspaces; every entry carries one exact origin with no wildcard expansion. */
+  async setautomationallowlist(entries) {
+    return this.adapter.set("automationallowlist", entries);
+  }
+  /** Returns the per origin automation allowlist entries, oldest grant first. */
+  async getautomationallowlist() {
+    return await this.adapter.get("automationallowlist") ?? [];
+  }
+  /** Adds one exact origin to the automation allowlist of a profile workspace; a duplicate origin keeps its first grant. */
+  async addallowlistorigin(entry) {
+    const entries = await this.getautomationallowlist();
+    if (entries.some((candidate) => candidate.origin === entry.origin && candidate.profileid === entry.profileid)) return;
+    await this.setautomationallowlist([...entries, entry]);
+  }
+  /** Removes one origin from the automation allowlist; the denydefault posture refuses the origin again after the removal. */
+  async removeallowlistorigin(origin, profileid) {
+    await this.setautomationallowlist((await this.getautomationallowlist()).filter((entry) => !(entry.origin === origin && entry.profileid === profileid)));
+  }
+  /** Replaces the per site origin profiles with their kind grants and denials; one profile per origin. */
+  async setoriginprofiles(profiles) {
+    return this.adapter.set("originprofiles", profiles);
+  }
+  /** Returns the stored per site origin profiles, oldest update first. */
+  async getoriginprofiles() {
+    return await this.adapter.get("originprofiles") ?? [];
+  }
+  /** Upserts one origin profile: a profile of the same origin replaces its grants and denials while a new origin joins the list. */
+  async saveoriginprofile(profile) {
+    const profiles = await this.getoriginprofiles();
+    await this.setoriginprofiles(profiles.some((candidate) => candidate.origin === profile.origin) ? profiles.map((candidate) => candidate.origin === profile.origin ? profile : candidate) : [...profiles, profile]);
+  }
+  /** Replaces the consent windows; active windows keep their expiry timestamps and closed windows stay for the audit trail. */
+  async setconsentwindows(windows) {
+    return this.adapter.set("consentwindows", windows);
+  }
+  /** Returns the stored consent windows, newest start first. */
+  async getconsentwindows() {
+    return await this.adapter.get("consentwindows") ?? [];
+  }
+  /** Expires every consent window past its duration boundary: the closed windows keep their records while their grants bind no step anymore. */
+  async expireconsentwindows(now) {
+    const windows = await this.getconsentwindows();
+    const expired = windows.map((window) => window.state === "active" && now >= window.expiresat ? { ...window, state: "closed", closedat: now } : window);
+    await this.setconsentwindows(expired);
+    return expired;
+  }
+  /** Records one mid run revocation with its halted step ids; the history stays visible for later consent prompts. */
+  async addrevocation(event) {
+    await this.adapter.set("revocations", [event, ...await this.adapter.get("revocations") ?? []].slice(0, 500));
+  }
+  /** Returns the recorded mid run revocations with their halted step ids, newest first. */
+  async getrevocations() {
+    return await this.adapter.get("revocations") ?? [];
+  }
+  /** Replaces the fresh class consents per origin. */
+  async setclassconsents(consents) {
+    return this.adapter.set("classconsents", consents);
+  }
+  /** Returns the fresh class consents per origin, newest grant first. */
+  async getclassconsents() {
+    return await this.adapter.get("classconsents") ?? [];
+  }
+  /** Records one fresh class consent per origin; the prompt of one class never widens another class. */
+  async addclassconsent(consent) {
+    const consents = (await this.getclassconsents()).filter((candidate) => !(candidate.origin === consent.origin && candidate.sensitiveclass === consent.sensitiveclass));
+    await this.setclassconsents([consent, ...consents]);
+  }
+  /** Replaces the mask rules for sensitive field shapes per origin. */
+  async setmaskrules(rules) {
+    return this.adapter.set("maskrules", rules);
+  }
+  /** Returns the stored mask rules for sensitive field shapes per origin, oldest rule first. */
+  async getmaskrules() {
+    return await this.adapter.get("maskrules") ?? [];
+  }
+  /** Adds one mask rule for field shapes, optionally scoped to one origin. */
+  async addmaskrule(rule) {
+    await this.setmaskrules([...await this.getmaskrules(), rule]);
+  }
+  /** Removes one mask rule by its id. */
+  async removemaskrule(id) {
+    await this.setmaskrules((await this.getmaskrules()).filter((rule) => rule.id !== id));
+  }
+  /** Stores the whole run log of one run: the append lands in one storage transaction so the entries and their chain links persist together. */
+  async setimmutablelog(log) {
+    return this.adapter.set(`immutablelog:${log.runid}`, log);
+  }
+  /** Returns the stored run log of one run; an absent log returns undefined. */
+  async getimmutablelog(runid) {
+    return this.adapter.get(`immutablelog:${runid}`);
+  }
+  /** Lists the stored run logs, oldest update first, with the sealed logs carrying their final hash. */
+  async listimmutablelogs() {
+    const index = await this.adapter.get("immutablelogindex") ?? [];
+    const logs = [];
+    for (const runid of index) {
+      const log = await this.getimmutablelog(runid);
+      if (log) logs.push(log);
+    }
+    return logs.sort((one, two) => one.updatedat - two.updatedat);
+  }
+  /** Stores the run log index entry of one run so the log listing reads every stored log. */
+  async trackimmutablelog(runid) {
+    const index = await this.adapter.get("immutablelogindex") ?? [];
+    if (!index.includes(runid)) await this.adapter.set("immutablelogindex", [...index, runid]);
+  }
+  /** Exports the verified log chain of one run for the audit file: the read path verifies the whole hash chain first and a broken link refuses the export with no entries served. */
+  async exportverifiedrunlog(runid) {
+    const log = await this.getimmutablelog(runid);
+    if (!log) throw new Error(`No run log exists for the run ${runid}.`);
+    return exportlogchain(log);
+  }
+  /** Expires the sealed run logs past the user configured retention: the entries reduce to their chain summaries while the seal hash always survives. */
+  async expireimmutablelogs(retention, now) {
+    const logs = await this.listimmutablelogs();
+    if (retention === void 0) return logs;
+    const kept = [];
+    for (const log of logs) {
+      if (log.seal !== void 0 && now - log.seal.sealedat > retention) {
+        const summary = { runid: log.runid, sessionid: log.sessionid, entries: [], seal: { ...log.seal, entries: log.seal.entries }, updatedat: now };
+        await this.setimmutablelog(summary);
+      } else {
+        kept.push(log);
+      }
+    }
+    return kept;
+  }
+  /**
+   * Security part two persistence of the 1.1.62 family.
+   * The protections for secrets, messages and money live here: the secretvault metadata with labels and scopes only and never values, scoped per profile workspace; the connectallow entries with their senders shipping empty by default; the ratelimit bucket state per origin and per session; the confirm gates with their resolution events and their human action provenance; the redactshot regions per origin and page template; the phishguard verdicts with their distance scores expiring past their freshness window; the permdiff records of each installed version; the safedefaults applications with their first seen origins; and the deferred command events waiting for their bucket reset.
+   * The vault values never touch this seam: only metadata persists while the values stay behind the vault seam the background wires.
+   */
+  /** Replaces the secretvault metadata of the profile workspaces: labels, scopes, provenance and digests only, never values. */
+  async setsecretvault(entries) {
+    return this.adapter.set("secretvault", entries);
+  }
+  /** Returns the stored secretvault metadata, oldest record first; the values live behind the vault seam and never persist. */
+  async getsecretvault() {
+    return await this.adapter.get("secretvault") ?? [];
+  }
+  /** Adds one secretvault metadata record scoped to a profile workspace; a duplicate vault id keeps its first record. */
+  async addsecret(entry) {
+    const entries = await this.getsecretvault();
+    if (entries.some((candidate) => candidate.vaultid === entry.vaultid)) return;
+    await this.setsecretvault([...entries, entry]);
+  }
+  /** Removes one secretvault metadata record by its vault id; the background drops the value behind the seam in the same action. */
+  async removesecret(vaultid) {
+    await this.setsecretvault((await this.getsecretvault()).filter((entry) => entry.vaultid !== vaultid));
+  }
+  /** Stamps the last use of one secretvault record: the metadata notes when the vault last released its value while the value itself stays unrecorded. */
+  async stampsecretuse(vaultid, at) {
+    await this.setsecretvault((await this.getsecretvault()).map((entry) => entry.vaultid === vaultid ? { ...entry, lastusedat: at } : entry));
+  }
+  /** Replaces the connectallow entries of external senders; the list ships empty by default with user managed entries only. */
+  async setconnectallow(entries) {
+    return this.adapter.set("connectallow", entries);
+  }
+  /** Returns the stored connectallow entries, oldest add first. */
+  async getconnectallow() {
+    return await this.adapter.get("connectallow") ?? [];
+  }
+  /** Adds one connectallow entry for an external sender; a duplicate sender id keeps its first entry. */
+  async addconnectallow(entry) {
+    const entries = await this.getconnectallow();
+    if (entries.some((candidate) => candidate.senderid === entry.senderid)) return;
+    await this.setconnectallow([...entries, entry]);
+  }
+  /** Removes one connectallow entry by its sender id; the origincheck drops the sender again after the removal. */
+  async removeconnectallow(senderid) {
+    await this.setconnectallow((await this.getconnectallow()).filter((entry) => entry.senderid !== senderid));
+  }
+  /** Replaces the ratelimit bucket state per origin and per session: the user configured bounds and windows with their used counts. */
+  async setratelimitbuckets(buckets) {
+    return this.adapter.set("ratelimitbuckets", buckets);
+  }
+  /** Returns the stored ratelimit buckets per origin and per session. */
+  async getratelimitbuckets() {
+    return await this.adapter.get("ratelimitbuckets") ?? [];
+  }
+  /** Upserts one ratelimit bucket: a bucket of the same origin and session replaces its state while a new pair joins the list. */
+  async saveratelimitbucket(bucket) {
+    const buckets = await this.getratelimitbuckets();
+    await this.setratelimitbuckets(buckets.some((candidate) => candidate.origin === bucket.origin && candidate.sessionid === bucket.sessionid) ? buckets.map((candidate) => candidate.origin === bucket.origin && candidate.sessionid === bucket.sessionid ? bucket : candidate) : [...buckets, bucket]);
+  }
+  /** Removes the ratelimit bucket of one origin and session; the origin runs without a bucket because the bounds stay user choices only. */
+  async removeratelimitbucket(origin, sessionid) {
+    await this.setratelimitbuckets((await this.getratelimitbuckets()).filter((bucket) => !(bucket.origin === origin && bucket.sessionid === sessionid)));
+  }
+  /** Replaces the confirm gates with their payloads and states; a resolved or refused gate stays terminal for the audit trail. */
+  async setgates(gates) {
+    return this.adapter.set("confirmgates", gates);
+  }
+  /** Returns the stored confirm gates, newest open first. */
+  async getgates() {
+    return await this.adapter.get("confirmgates") ?? [];
+  }
+  /** Upserts one confirm gate: a gate of the same step keeps its latest record because one gated step carries one live gate. */
+  async savegate(gate) {
+    const gates = await this.getgates();
+    await this.setgates(gates.some((candidate) => candidate.stepid === gate.stepid && candidate.kind === gate.kind) ? gates.map((candidate) => candidate.stepid === gate.stepid && candidate.kind === gate.kind ? gate : candidate) : [gate, ...gates]);
+  }
+  /** Records one gate resolution event with its human action provenance; the resolution history stays visible for the audit trail. */
+  async addgateresolution(resolution) {
+    await this.adapter.set("gateresolutions", [resolution, ...await this.adapter.get("gateresolutions") ?? []].slice(0, 500));
+  }
+  /** Returns the recorded gate resolution events with their human action provenance, newest first. */
+  async getgateresolutions() {
+    return await this.adapter.get("gateresolutions") ?? [];
+  }
+  /** Replaces the redactshot regions per origin and page template. */
+  async setredactregions(regions) {
+    return this.adapter.set("redactregions", regions);
+  }
+  /** Returns the stored redactshot regions per origin and page template, oldest rule first. */
+  async getredactregions() {
+    return await this.adapter.get("redactregions") ?? [];
+  }
+  /** Adds one redactshot region, derived from a field shape or drawn by the user. */
+  async addredactregion(region) {
+    await this.setredactregions([...await this.getredactregions(), region]);
+  }
+  /** Removes one redactshot region by its id. */
+  async removeredactregion(id) {
+    await this.setredactregions((await this.getredactregions()).filter((region) => region.id !== id));
+  }
+  /** Records one phishguard verdict with its distance score; the records stay for the audit trail while the freshness window governs the live set. */
+  async addphishverdict(verdict) {
+    await this.adapter.set("phishverdicts", [verdict, ...(await this.adapter.get("phishverdicts") ?? []).filter((candidate) => candidate.origin !== verdict.origin)].slice(0, 500));
+  }
+  /** Returns the stored phishguard verdicts with their distance scores, newest first. */
+  async getphishverdicts() {
+    return await this.adapter.get("phishverdicts") ?? [];
+  }
+  /** Expires the phishguard verdicts past the user configured freshness window: the expired verdicts keep their records for the audit trail while the guard recomputes the next login step. */
+  async expirephishverdicts(freshness, now) {
+    const verdicts = await this.getphishverdicts();
+    if (freshness === void 0) return verdicts;
+    return verdicts.filter((verdict) => now - verdict.at < freshness);
+  }
+  /** Records one permdiff between two installed permission versions; the record of each installed update stays for the audit trail. */
+  async addpermdiff(diff) {
+    await this.adapter.set("permdiffs", [diff, ...await this.adapter.get("permdiffs") ?? []].slice(0, 500));
+  }
+  /** Returns the recorded permdiffs of each installed update, newest first. */
+  async getpermdiffs() {
+    return await this.adapter.get("permdiffs") ?? [];
+  }
+  /** Stores the last installed permission set the permdiff of the next update compares against. */
+  async setlastpermissions(permissions, version) {
+    await this.adapter.set("lastpermissions", { permissions, version });
+  }
+  /** Returns the last installed permission set with its version; an absent record returns undefined. */
+  async getlastpermissions() {
+    return this.adapter.get("lastpermissions");
+  }
+  /** Records one safedefaults application with its first seen origin; the first visit of an unknown origin stays visible. */
+  async addsafedefaultapplication(application) {
+    const applications = await this.adapter.get("safedefaults") ?? [];
+    if (applications.some((candidate) => candidate.origin === application.origin)) return;
+    await this.adapter.set("safedefaults", [...applications, application]);
+  }
+  /** Returns the recorded safedefaults applications with their first seen origins, oldest first. */
+  async getsafedefaultapplications() {
+    return await this.adapter.get("safedefaults") ?? [];
+  }
+  /** Records one deferred command event with the reset time it waits for. */
+  async adddeferredevent(event) {
+    await this.adapter.set("deferredevents", [event, ...await this.adapter.get("deferredevents") ?? []].slice(0, 500));
+  }
+  /** Returns the recorded deferred command events, newest first. */
+  async getdeferredevents() {
+    return await this.adapter.get("deferredevents") ?? [];
+  }
+  /** Serves the transparency data of the transparencypage in one read: every active grant with its origin, scope and boundary, every consent window ever granted with its expiry, the connectallow entries with their senders, the permdiff records of each installed update, the safedefaults applications and the secretvault metadata with labels and scopes only. */
+  async gettransparencyview() {
+    return {
+      allowlist: await this.getautomationallowlist(),
+      profiles: await this.getoriginprofiles(),
+      windows: await this.getconsentwindows(),
+      connectallow: await this.getconnectallow(),
+      permdiffs: await this.getpermdiffs(),
+      safedefaults: await this.getsafedefaultapplications(),
+      vault: await this.getsecretvault(),
+      gates: await this.getgates(),
+      resolutions: await this.getgateresolutions(),
+      deferred: await this.getdeferredevents(),
+      phishverdicts: await this.getphishverdicts()
+    };
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -5277,6 +5640,87 @@ function tlsstateof(tls) {
   return { mode: tls.mode, certificaterequired: tls.mode === "required" || tls.certificatefingerprint !== void 0, verified: tls.verifiedat !== void 0 };
 }
 
+// confirmgates.ts
+function stepoptions(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function gatekindfor(classes) {
+  if (classes.includes("payment")) return "confirmpay";
+  if (classes.includes("delete")) return "confirmdelete";
+  if (classes.includes("credential")) return "confirmcreds";
+  return void 0;
+}
+function paypayload(input) {
+  const payload = { payeeorigin: input.payeeorigin };
+  if (input.amount !== void 0 && input.amount.trim() !== "") payload.amount = input.amount.trim();
+  if (input.target !== void 0 && input.target.trim() !== "") payload.target = input.target.trim();
+  return payload;
+}
+function deletepayload(input) {
+  const payload = { scope: input.scope, irreversibility: input.irreversibility };
+  if (input.target !== void 0 && input.target.trim() !== "") payload.target = input.target.trim();
+  return payload;
+}
+function credspayload(label) {
+  if (label.trim() === "") throw new Error("The confirmcreds gate names its credential label; the value never appears.");
+  return { label: label.trim() };
+}
+function opengate(input) {
+  if (input.stepid.trim() === "" || input.runid.trim() === "" || input.origin.trim() === "") throw new Error("The confirm gate needs its step, run and origin.");
+  if (Object.keys(input.payload).length === 0) throw new Error("The confirm gate carries the payload the human reviews.");
+  return { gateid: input.gateid ?? randomid(), kind: input.kind, stepid: input.stepid, runid: input.runid, origin: input.origin, payload: { ...input.payload }, state: "open", openedat: input.now };
+}
+function gatestateof(gates, stepid) {
+  const gate = [...gates].reverse().find((candidate) => candidate.stepid === stepid);
+  if (gate === void 0) return { state: "none" };
+  return { state: gate.state, gate };
+}
+function resolvegate(input) {
+  if (input.actor.trim() === "") throw new Error("The gate resolution names its acting user; only a human resolves a gate.");
+  const gate = input.gates.find((candidate) => candidate.gateid === input.gateid);
+  if (gate === void 0) return { gates: input.gates };
+  if (gate.state !== "open") return { gates: input.gates };
+  const resolution = { gateid: gate.gateid, kind: gate.kind, stepid: gate.stepid, decision: input.decision, actor: input.actor, at: input.now };
+  return { gates: input.gates.map((candidate) => candidate.gateid === input.gateid ? { ...candidate, state: input.decision, resolvedat: input.now, actor: input.actor } : candidate), resolution };
+}
+function nobatchresolution(gateids) {
+  if (gateids.length > 1) return { allowed: false, reason: `One human action resolves exactly one gate; the batch of ${gateids.length} gates refuses in full because no batch approval exists.` };
+  if (gateids.length === 0) return { allowed: false, reason: "A gate resolution names its single gate." };
+  return { allowed: true, reason: "The resolution names exactly one gate; the distinct human action resolves it alone." };
+}
+function gateprompttext(gate) {
+  if (gate.kind === "confirmpay") {
+    const amount = gate.payload.amount !== void 0 ? `the amount ${gate.payload.amount}` : "an amount the step options name";
+    const target = gate.payload.target !== void 0 ? ` on ${gate.payload.target}` : "";
+    return `Approve the payment of ${amount} to ${gate.payload.payeeorigin}${target}? The step dispatches only after this distinct human action.`;
+  }
+  if (gate.kind === "confirmdelete") {
+    const target = gate.payload.target !== void 0 ? ` on ${gate.payload.target}` : "";
+    return `Approve the destructive delete${target} scoped to ${gate.payload.scope}? ${gate.payload.irreversibility} The step dispatches only after this distinct human action.`;
+  }
+  return `Approve the use of the credential ${gate.payload.label} on ${gate.origin}? The value stays behind the vault; the label is everything this prompt shows.`;
+}
+function gateforstep(input) {
+  const kind = gatekindfor(input.classes);
+  if (kind === void 0) return void 0;
+  const options = stepoptions(input.step);
+  if (kind === "confirmpay") {
+    const amount = typeof options.amount === "string" ? options.amount : typeof options.value === "string" ? options.value : void 0;
+    return opengate({ kind, stepid: input.step.id, runid: input.runid, origin: input.origin, payload: paypayload({ ...amount !== void 0 && amount !== "" ? { amount } : {}, payeeorigin: String(options.payeeorigin ?? input.origin), ...input.step.target !== void 0 && input.step.target !== "" ? { target: input.step.target } : {} }), now: input.now });
+  }
+  if (kind === "confirmdelete") {
+    return opengate({ kind, stepid: input.step.id, runid: input.runid, origin: input.origin, payload: deletepayload({ ...input.step.target !== void 0 && input.step.target !== "" ? { target: input.step.target } : {}, scope: String(options.scope ?? input.origin), irreversibility: String(options.irreversibility ?? "A destructive delete destroys state the page cannot restore.") }), now: input.now });
+  }
+  if (input.credentiallabel === void 0 || input.credentiallabel.trim() === "") return void 0;
+  return opengate({ kind, stepid: input.step.id, runid: input.runid, origin: input.origin, payload: credspayload(input.credentiallabel), now: input.now });
+}
+
 // coordination.ts
 function lockkey(origin, selector) {
   return `${origin}|${selector}`;
@@ -5839,6 +6283,238 @@ async function callgraphql(input) {
   }
 }
 
+// inboundguard.ts
+function shapeof(value) {
+  if (typeof value === "string") return "string";
+  if (typeof value === "number") return "number";
+  if (typeof value === "boolean") return "boolean";
+  if (Array.isArray(value)) return "array";
+  return "object";
+}
+function schemacheck(input) {
+  const errors = [];
+  for (const [field, value] of Object.entries(input.command)) {
+    const expected = input.schema[field];
+    if (expected === void 0) {
+      errors.push({ path: field, expected: "absent", found: shapeof(value), reason: `The ${field} field sits absent from the declared grammar of the command; schemastrict refuses unknown fields before dispatch.` });
+      continue;
+    }
+    if (expected === "absent") {
+      errors.push({ path: field, expected: "absent", found: shapeof(value), reason: `The ${field} field carries no value under the declared grammar; schemastrict refuses it before dispatch.` });
+      continue;
+    }
+    if (shapeof(value) !== expected) errors.push({ path: field, expected, found: shapeof(value), reason: `The ${field} field expects a ${expected} while the command carries a ${shapeof(value)}; schemastrict refuses the shape mismatch before dispatch.` });
+  }
+  for (const field of input.required ?? []) {
+    if (input.command[field] === void 0) errors.push({ path: field, expected: input.schema[field] ?? "string", found: "absent", reason: `The ${field} field is required by the declared grammar and the command carries no value; schemastrict refuses the incomplete command before dispatch.` });
+  }
+  return { valid: errors.length === 0, errors };
+}
+function envelopecheck(input) {
+  const kind = input.command.kind;
+  if (typeof kind !== "string" || kind.trim() === "") return { valid: false, errors: [{ path: "kind", expected: "string", found: shapeof(kind), reason: "Every inbound command names its kind as a non-empty string; a kindless command never dispatches." }] };
+  if (!input.knownkinds.includes(kind)) return { valid: false, errors: [{ path: "kind", expected: `one of ${input.knownkinds.length} declared command kinds`, found: kind, reason: `The ${kind} command kind sits absent from the dispatch registry; schemastrict refuses unknown commands before dispatch.` }] };
+  return { valid: true, errors: [] };
+}
+function origincheckof(input) {
+  const sender = input.senderid ?? "an unknown sender";
+  const origin = input.senderorigin ?? "";
+  if (input.senderid === input.extensionid) return { accepted: true, sender, origin, reason: "The sender is this extension itself; the internal surface accepts." };
+  if (input.senderid !== void 0 && input.connectallow.some((entry) => entry.senderid === input.senderid && (entry.origin === void 0 || entry.origin === origin))) {
+    return { accepted: true, sender, origin, reason: `The sender ${sender} sits in the connectallow list the user manages${origin !== "" ? ` for ${origin}` : ""}; the message accepts.` };
+  }
+  if (input.senderid === void 0) return { accepted: false, sender, origin, reason: "The message carries no sender identity; the guard drops it before any handler runs." };
+  return { accepted: false, sender, origin, reason: `The sender ${sender} sits absent from the connectallow list; the guard drops the message without handler execution.` };
+}
+function portaccept(input) {
+  const verdict = origincheckof(input);
+  if (!verdict.accepted) return { ...verdict, reason: `The port ${input.portname} closes at its handshake: ${verdict.reason}` };
+  return { ...verdict, reason: `The port ${input.portname} accepted its handshake: ${verdict.reason}` };
+}
+function connectallowentryof(input) {
+  if (input.senderid.trim() === "") throw new Error("The connectallow entry needs its sender id.");
+  if (input.displayname.trim() === "") throw new Error("The connectallow entry needs its display name.");
+  return { senderid: input.senderid.trim(), displayname: input.displayname.trim(), ...input.origin !== void 0 && input.origin.trim() !== "" ? { origin: input.origin.trim() } : {}, addedat: input.now };
+}
+var emptyconnectallow = [];
+function bucketboundsvalid(limit, window) {
+  if (!Number.isFinite(limit) || limit <= 0) return { valid: false, reason: "The ratelimit bucket limit stays a positive user value; no hidden ceiling exists." };
+  if (!Number.isFinite(window) || window <= 0) return { valid: false, reason: "The ratelimit bucket window stays a positive user value in milliseconds; the window reset stays the user's choice." };
+  return { valid: true, reason: `The bucket bound of ${limit} commands per ${window} milliseconds stays the user configured choice with no hidden ceiling.` };
+}
+function bucketof(input) {
+  const bounds = bucketboundsvalid(input.limit, input.window);
+  if (!bounds.valid) throw new Error(bounds.reason);
+  return { origin: input.origin, sessionid: input.sessionid, limit: input.limit, window: input.window, used: 0, windowstartedat: input.now, resetsat: input.now + input.window };
+}
+function bucketconsume(input) {
+  if (input.now >= input.bucket.resetsat) {
+    const fresh = { ...input.bucket, used: 0, windowstartedat: input.now, resetsat: input.now + input.bucket.window };
+    return { allowed: true, deferred: false, bucket: { ...fresh, used: 1 }, resetsat: fresh.resetsat, reason: `The bucket window of ${input.bucket.origin} reset and the command consumes the first slot of ${fresh.limit}.` };
+  }
+  if (input.bucket.used < input.bucket.limit) {
+    return { allowed: true, deferred: false, bucket: { ...input.bucket, used: input.bucket.used + 1 }, resetsat: input.bucket.resetsat, reason: `The command consumes slot ${input.bucket.used + 1} of ${input.bucket.limit} in the bucket of ${input.bucket.origin}.` };
+  }
+  return { allowed: false, deferred: true, bucket: input.bucket, resetsat: input.bucket.resetsat, reason: `The bucket of ${input.bucket.origin} holds its ${input.bucket.limit} command bound; the command defers until the window resets at ${input.bucket.resetsat}.` };
+}
+function deferredeventof(input) {
+  if (input.stepid.trim() === "" || input.kind.trim() === "") throw new Error("The deferred event needs its step and kind.");
+  return { id: input.id ?? randomid(), stepid: input.stepid, kind: input.kind, origin: input.origin, reason: input.reason, resetsat: input.resetsat, at: input.now };
+}
+function deferredready(deferred, now) {
+  return now >= deferred.resetsat;
+}
+
+// originpolicy.ts
+var denydefaultposture = "denydefault";
+function exactorigin(origin, entry) {
+  return origin.trim() !== "" && origin === entry;
+}
+function wildcardentry(entry) {
+  return entry.includes("*") || entry.includes("://*.") || entry.trim() === "" || entry.trim() === "https://" || entry.trim() === "http://";
+}
+function allowlistcheck(input) {
+  if (input.origin.trim() === "") return { allowed: false, reason: "The step needs the exact origin it targets." };
+  for (const entry of input.allowlist) {
+    if (wildcardentry(entry.origin)) return { allowed: false, reason: `The allowlist entry ${entry.origin} carries a wildcard; every grant binds to one exact origin with no wildcard expansion.` };
+  }
+  const scoped = input.profileid === void 0 ? input.allowlist : input.allowlist.filter((entry) => entry.profileid === input.profileid);
+  const granted = scoped.some((entry) => exactorigin(input.origin, entry.origin));
+  if (granted) return { allowed: true, reason: `The origin ${input.origin} sits inside the automation allowlist the user granted.` };
+  if (input.sessionorigin !== void 0 && exactorigin(input.origin, input.sessionorigin)) return { allowed: true, reason: `The active tab grant covers ${input.origin} as exactly one explicit single origin grant.` };
+  return { allowed: false, reason: `The denydefault posture refuses ${input.origin} because the origin sits absent from the automation allowlist; grant the origin first.` };
+}
+function originprofileof(input) {
+  if (input.origin.trim() === "") throw new Error("The origin profile needs its exact origin.");
+  return { profileid: input.profileid ?? randomid(), origin: input.origin, grants: [...input.grants ?? []], denials: [...input.denials ?? []], createdat: input.now, updatedat: input.now };
+}
+function profilekind(input) {
+  if (input.profile.grants.includes(input.kind) && input.decision === "grant") return input.profile;
+  if (input.profile.denials.includes(input.kind) && input.decision === "deny") return input.profile;
+  const grants = input.decision === "grant" ? [.../* @__PURE__ */ new Set([...input.profile.grants, input.kind])] : input.profile.grants.filter((kind) => kind !== input.kind);
+  const denials = input.decision === "deny" ? [.../* @__PURE__ */ new Set([...input.profile.denials, input.kind])] : input.profile.denials.filter((kind) => kind !== input.kind);
+  return { ...input.profile, grants, denials, updatedat: input.now };
+}
+function profilegrade(input) {
+  if (!input.sensitive) return { allowed: true, consult: false, reason: `The ${input.kind} kind grades non-sensitive and the origin profile needs no consult.` };
+  if (input.profile === void 0) return { allowed: true, consult: true, reason: `No origin profile exists for the ${input.kind} kind, so the fresh class consent gate alone routes the sensitive step.` };
+  if (input.profile.denials.includes(input.kind)) return { allowed: false, consult: true, reason: `The origin profile of ${input.profile.origin} denies the ${input.kind} kind; a denied kind never runs on that origin.` };
+  if (input.profile.grants.includes(input.kind)) return { allowed: true, consult: true, reason: `The origin profile of ${input.profile.origin} grants the ${input.kind} kind the user reviewed.` };
+  return { allowed: true, consult: true, reason: `The origin profile of ${input.profile.origin} carries no ${input.kind} decision, so the fresh class consent gate alone routes the sensitive step.` };
+}
+function stepoptions2(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var paymentkinds = /* @__PURE__ */ new Set(["fillcard", "fillcode"]);
+var credentialkinds = /* @__PURE__ */ new Set(["consentpassword", "saveapikey", "handleauth", "authflow"]);
+var deletekinds = /* @__PURE__ */ new Set(["discardtab", "closepattern", "clearcookies", "removeattribute", "cleanupartifacts"]);
+var publishkinds = /* @__PURE__ */ new Set(["postform", "postfiles", "sendmessage", "submitform", "submitsearch", "writeclipboard"]);
+var defaultsensitivekinds = /* @__PURE__ */ new Set(["attachfile", "uploadfile", "uploadfiles", "downloadfile", "downloadimages", "batchdownload", "pausedownload", "resumedownload", "quarantinedownload", "evaluate"]);
+function sensitiveclassesof(step) {
+  const options = stepoptions2(step);
+  const fields = Array.isArray(options.fields) ? options.fields.filter((item) => Boolean(item) && typeof item === "object") : [];
+  const names = [...fields.map((field) => typeof field.name === "string" ? field.name : ""), typeof options.field === "string" ? options.field : "", typeof options.target === "string" ? options.target : ""].map((name) => name.toLowerCase());
+  const carries = (shape) => names.some((name) => name.includes(shape));
+  const classes = /* @__PURE__ */ new Set();
+  if (paymentkinds.has(step.kind) || carries("card") || carries("cvc") || carries("cvv")) classes.add("payment");
+  const credentialshape = carries("password") || carries("token") || carries("secret") || carries("apikey") || carries("passphrase");
+  const submits = step.kind === "submitform" || step.kind === "postform" || step.kind === "submitsearch" || step.kind === "fillform" || step.kind === "filllabel" || step.kind === "fillplaceholder";
+  if (credentialkinds.has(step.kind) || submits && credentialshape) classes.add("credential");
+  if (deletekinds.has(step.kind)) classes.add("delete");
+  if (publishkinds.has(step.kind) || step.kind === "callrest" || step.kind === "callgraphql") {
+    const verb = typeof options.method === "string" ? options.method.trim().toUpperCase() : typeof options.verb === "string" ? options.verb.trim().toUpperCase() : "";
+    if (step.kind === "callrest" || step.kind === "callgraphql") {
+      if (verb !== "" && !["GET", "HEAD", "OPTIONS"].includes(verb)) classes.add("publish");
+    } else classes.add("publish");
+  }
+  const bydefault = defaultsensitivekinds.has(step.kind);
+  const list = [...classes];
+  if (list.length === 0 && !bydefault) return { classes: [], bydefault: false, sensitive: false, reason: `The ${step.kind} kind carries no sensitive class and no default sensitive grade.` };
+  return { classes: list, bydefault, sensitive: true, reason: `The ${step.kind} kind grades sensitive${list.length > 0 ? ` through the ${list.join(", ")} class${list.length === 1 ? "" : "es"}` : ""}${bydefault ? " by default" : ""}.` };
+}
+function classconsentcovers(consents, origin, sensitiveclass, now) {
+  return consents.some((consent) => consent.origin === origin && consent.sensitiveclass === sensitiveclass && consent.grantedat <= now && (consent.expiresat === void 0 || now < consent.expiresat));
+}
+function missingclassconsents(input) {
+  const missing = input.classes.filter((kind) => !classconsentcovers(input.consents, input.origin, kind, input.now));
+  if (missing.length > 0) return { needed: true, missing, reason: `The sensitive classes ${missing.join(", ")} need one fresh consent prompt each on ${input.origin}.` };
+  if (input.bydefault && input.classes.length === 0) return { needed: true, missing: [], reason: `The ${input.origin} step grades sensitive by default and needs its fresh consent window prompt.` };
+  return { needed: false, missing: [], reason: `The fresh class consents of ${input.origin} cover every class the step names.` };
+}
+function openconsentwindow(input) {
+  if (input.sessionid.trim() === "" || input.origin.trim() === "") throw new Error("The consent window needs its session and its exact origin.");
+  if (!Number.isFinite(input.duration) || input.duration <= 0) throw new Error("The consent window needs its duration as a positive user value; no window defaults to unlimited.");
+  return { id: input.id ?? randomid(), sessionid: input.sessionid, origin: input.origin, startedat: input.now, duration: input.duration, expiresat: input.now + input.duration, boundary: input.boundary?.trim() !== "" && input.boundary !== void 0 ? input.boundary : `${input.duration} milliseconds the user chose`, kinds: [...new Set(input.kinds)], state: "active" };
+}
+function consentwindowstate(window, now) {
+  if (window.state === "closed" || now >= window.expiresat) return { state: "expired", remaining: 0, reason: `The consent window of ${window.origin} closed at its ${window.boundary} boundary; the run suspends until a new explicit prompt renews it.` };
+  return { state: "active", remaining: window.expiresat - now, reason: `The consent window of ${window.origin} stays active with ${window.expiresat - now} milliseconds left of its ${window.boundary} boundary.` };
+}
+function windowgatesstep(input) {
+  if (input.window === void 0) return { allowed: false, suspended: false, reason: `No active consent window covers ${input.origin}; the consent prompt opens one before any step dispatches.` };
+  if (input.window.sessionid !== input.sessionid) return { allowed: false, suspended: false, reason: `The consent window scopes to the session ${input.window.sessionid} only and never widens to another session.` };
+  if (input.window.origin !== input.origin) return { allowed: false, suspended: false, reason: `The consent window scopes to the origin ${input.window.origin} only and never widens to another origin.` };
+  const state = consentwindowstate(input.window, input.now);
+  if (state.state === "expired") return { allowed: false, suspended: true, reason: state.reason };
+  return { allowed: true, suspended: false, reason: state.reason };
+}
+function expireconsentwindows(windows, now) {
+  return windows.map((window) => window.state === "active" && now >= window.expiresat ? { ...window, state: "closed", closedat: now } : window);
+}
+function renewconsentwindow(input) {
+  const closed = input.window.state === "active" ? { ...input.window, state: "closed", closedat: input.now } : input.window;
+  const renewed = openconsentwindow({ sessionid: input.window.sessionid, origin: input.window.origin, duration: input.duration, kinds: input.kinds.length > 0 ? input.kinds : input.window.kinds, now: input.now });
+  return { renewed, closed };
+}
+function revokerun(input) {
+  if (input.sessionid.trim() === "" || input.runid.trim() === "") throw new Error("The revocation needs its session and run ids.");
+  if (input.actor.trim() === "") throw new Error("The revocation names the acting user.");
+  const halted = [...input.pendingstepid !== void 0 ? [input.pendingstepid] : [], ...input.queuedstepids ?? []];
+  if (halted.length === 0) throw new Error("The revocation halts at least the pending step of the run.");
+  return { id: input.id ?? randomid(), sessionid: input.sessionid, runid: input.runid, haltedstepids: halted, actor: input.actor, reason: input.reason?.trim() !== "" && input.reason !== void 0 ? input.reason : "The user revoked the consent mid run.", at: input.now };
+}
+function haltedstepsof(revocation) {
+  return { ...revocation.haltedstepids.length > 0 ? { pending: revocation.haltedstepids[0] } : {}, queued: revocation.haltedstepids.slice(1) };
+}
+function scopegrantof(input) {
+  if (input.origin.trim() === "") throw new Error("The consent scope needs its exact origin.");
+  if (input.kinds.length === 0) throw new Error("The consent scope names the kinds it covers.");
+  if (input.boundary.trim() === "") throw new Error("The consent scope names its boundary; no grant defaults to unlimited.");
+  return { origin: input.origin, kinds: [...new Set(input.kinds)], boundary: input.boundary, grantedat: input.now };
+}
+function deniedevidenceof(input) {
+  return { origin: input.origin, kind: input.kind, reason: input.reason, at: input.now };
+}
+function consentprompttext(input) {
+  const label = input.classes.length > 0 ? `the ${input.classes.join(" and ")} class${input.classes.length === 1 ? "" : "es"}` : "a sensitive by default grade";
+  return `Allow the ${input.kind} step on ${input.origin} graded as ${label} for ${input.duration} milliseconds? The consent window closes at that boundary; no grant ever defaults to unlimited.`;
+}
+function denydefaultnotice(origin) {
+  return `The denydefault posture refuses ${origin} until the user adds the origin to the automation allowlist; no step dispatches without the grant.`;
+}
+function profilesummary(profile) {
+  if (profile === void 0) return "No origin profile exists for this origin yet; sensitive steps route through their fresh consent prompts.";
+  return `The origin profile of ${profile.origin} grants ${profile.grants.length} kind${profile.grants.length === 1 ? "" : "s"} and denies ${profile.denials.length} kind${profile.denials.length === 1 ? "" : "s"} the user reviewed.`;
+}
+var safedefaultreadkinds = /* @__PURE__ */ new Set(["observe", "readhtml", "readtext", "readlinks", "readtable", "readforms", "readvisible", "readselection", "readmeta", "readlang", "readoutline", "readstyle", "readimages", "readertree"]);
+function safedefaultprofile(input) {
+  if (input.origin.trim() === "") throw new Error("The safedefaults profile needs its exact origin.");
+  const denials = /* @__PURE__ */ new Set([...paymentkinds, ...credentialkinds, ...deletekinds, ...publishkinds, ...defaultsensitivekinds]);
+  return { profileid: input.profileid ?? randomid(), origin: input.origin.trim(), grants: [...safedefaultreadkinds], denials: [...denials], createdat: input.now, updatedat: input.now };
+}
+function safedefaultreadkind(kind) {
+  return safedefaultreadkinds.has(kind);
+}
+function safedefaultnotice(origin) {
+  return `The safedefaults posture profiles ${origin} on its first visit: reads only, every sensitive class denied; open the originprofile editor to widen the profile.`;
+}
+
 // socketbus.ts
 var socketkinds = ["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"];
 function channelorigin(url) {
@@ -7136,6 +7812,87 @@ function consolediff(input) {
   return { base: input.baseid, target: input.targetid, lines, added: added.length, removed: removed.length, repeated: repeated.length, at: input.now };
 }
 
+// phishguard.ts
+function stepoptions3(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function credentialstep(step) {
+  const credentialkinds2 = /* @__PURE__ */ new Set(["consentpassword", "saveapikey", "handleauth", "authflow", "fillcard", "fillcode"]);
+  if (credentialkinds2.has(step.kind)) return true;
+  const options = stepoptions3(step);
+  const fields = Array.isArray(options.fields) ? options.fields.filter((item) => Boolean(item) && typeof item === "object") : [];
+  const names = [...fields.map((field) => typeof field.name === "string" ? field.name : ""), typeof options.field === "string" ? options.field : "", step.target ?? ""].map((name) => name.toLowerCase());
+  return names.some((name) => name.includes("password") || name.includes("passwd") || name.includes("passphrase") || name.includes("token") || name.includes("secret") || name.includes("apikey"));
+}
+function originlabels(origin) {
+  const host = origin.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").split("/")[0] ?? "";
+  return host.split(".").filter((label) => label !== "").reverse();
+}
+function labeldistance(one, two) {
+  const rows = one.length + 1;
+  const columns = two.length + 1;
+  let previous = Array.from({ length: columns }, (_, index) => index);
+  for (let row = 1; row < rows; row += 1) {
+    const current = [row, ...Array.from({ length: columns - 1 }, () => 0)];
+    for (let column = 1; column < columns; column += 1) {
+      const substitution = (previous[column - 1] ?? 0) + (one[row - 1] === two[column - 1] ? 0 : 1);
+      current[column] = Math.min((previous[column] ?? 0) + 1, (current[column - 1] ?? 0) + 1, substitution);
+    }
+    previous = current;
+  }
+  return previous[columns - 1] ?? Math.max(one.length, two.length);
+}
+function lookalikedistance(one, two) {
+  if (one.trim() === "" || two.trim() === "") return 1;
+  if (one === two) return 0;
+  const first = originlabels(one);
+  const second = originlabels(two);
+  const edits = labeldistance(first, second);
+  const longest = Math.max(first.length, second.length);
+  if (longest === 0) return 1;
+  const distance = edits / longest;
+  return Math.min(1, Math.max(0, distance));
+}
+function phishthresholdvalid(threshold) {
+  if (!Number.isFinite(threshold) || threshold <= 0 || threshold >= 1) return { valid: false, reason: "The phishguard threshold stays a user choice between zero and one; the lookalike line never defaults." };
+  return { valid: true, reason: `The lookalike threshold ${threshold} stays the user configured line a login origin crosses at its own risk.` };
+}
+function phishverdictof(input) {
+  const threshold = phishthresholdvalid(input.threshold);
+  if (!threshold.valid) throw new Error(threshold.reason);
+  if (input.granted.includes(input.origin)) {
+    return { origin: input.origin, distance: 0, threshold: input.threshold, blocked: false, reason: `The login origin ${input.origin} sits among the granted origins; no lookalike watch applies.`, at: input.now };
+  }
+  let matchedorigin;
+  let distance = 1;
+  for (const granted of input.granted) {
+    const candidate = lookalikedistance(input.origin, granted);
+    if (candidate < distance) {
+      distance = candidate;
+      matchedorigin = granted;
+    }
+  }
+  if (matchedorigin !== void 0 && distance <= input.threshold) {
+    return { origin: input.origin, matchedorigin, distance, threshold: input.threshold, blocked: true, reason: `The login origin ${input.origin} sits ${distance} away from the granted origin ${matchedorigin} and crosses the user threshold ${input.threshold}; the credential step blocks and the deny event names ${matchedorigin}.`, at: input.now };
+  }
+  return { origin: input.origin, ...matchedorigin !== void 0 ? { matchedorigin } : {}, distance, threshold: input.threshold, blocked: false, reason: matchedorigin !== void 0 ? `The login origin ${input.origin} sits ${distance} away from its closest granted origin ${matchedorigin} and stays under the user threshold ${input.threshold}.` : `The login origin ${input.origin} carries no granted origin to resemble; the watch records the first visit.`, at: input.now };
+}
+function verdictfresh(verdict, now, freshness) {
+  if (freshness === void 0) return true;
+  return now - verdict.at < freshness;
+}
+function phishnotetext(verdict) {
+  if (verdict.blocked) return verdict.reason;
+  if (verdict.matchedorigin !== void 0) return `The login origin ${verdict.origin} sits ${verdict.distance} from the granted origin ${verdict.matchedorigin}, under the user threshold ${verdict.threshold}.`;
+  return `The login origin ${verdict.origin} has no granted lookalike under the user threshold ${verdict.threshold}.`;
+}
+
 // policy.ts
 var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow", "visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
@@ -10217,6 +10974,127 @@ function sandboxorigingate(input) {
 function environmentrequirements() {
   return environmentrequirementsof([...allowedactions]);
 }
+function automationallowlistgate(input) {
+  const verdict = allowlistcheck({ origin: input.origin, allowlist: input.allowlist, ...input.session !== void 0 ? { sessionorigin: input.session.origin } : {} });
+  if (!verdict.allowed) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function originprofilegate(input) {
+  const verdict = profilegrade(input);
+  if (!verdict.allowed) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function consentwindowgate(input) {
+  if (!input.sensitive) return { allowed: true, reason: "The non-sensitive step rides the session origin grants and needs no consent window of its own." };
+  const verdict = windowgatesstep({ window: input.window, sessionid: input.sessionid, origin: input.origin, now: input.now });
+  if (!verdict.allowed) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function revokerungate(input) {
+  if (input.revocation === void 0) return { allowed: true, reason: "No revocation halted the run; the steps keep their reviewed order." };
+  if (input.revocation.sessionid !== input.sessionid) return { allowed: true, reason: "The revocation belongs to another session and halts nothing here." };
+  if (input.revocation.runid !== input.runid) return { allowed: true, reason: "The revocation belongs to another run and halts nothing here." };
+  return { allowed: false, reason: `The revocation of ${input.revocation.actor} halted the pending step and ${Math.max(0, input.revocation.haltedstepids.length - 1)} queued step${Math.max(0, input.revocation.haltedstepids.length - 1) === 1 ? "" : "s"} without executing them: ${input.revocation.haltedstepids.join(", ")}.` };
+}
+function sensitiveclassgate(input) {
+  if (!input.sensitive) return { allowed: true, reason: "The step carries no sensitive class and needs no fresh consent prompt." };
+  const verdict = missingclassconsents({ origin: input.origin, classes: input.classes, bydefault: input.bydefault, consents: input.consents, now: input.now });
+  if (verdict.needed) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function consentdurationvalid(duration) {
+  if (!Number.isFinite(duration) || duration <= 0) return { allowed: false, reason: "The consent window duration stays a positive user value in milliseconds; no grant ever defaults to unlimited." };
+  return { allowed: true, reason: `The consent window duration ${duration} milliseconds stays the user configured boundary the prompt names.` };
+}
+function logreadgate(input) {
+  if (!input.valid) return { allowed: false, reason: input.brokenat !== void 0 ? `The log chain breaks at entry ${input.brokenat}; the audit accessor refuses the read of a forged record.` : "The log chain fails its verification; the audit accessor refuses the read of a forged record." };
+  return { allowed: true, reason: "The log chain verifies from the genesis hash to the last entry; the audit accessor serves the entries." };
+}
+function sensitivepipelingate(input) {
+  const classification = sensitiveclassesof(input.step);
+  const profileverdict = originprofilegate({ profile: input.profile, kind: input.step.kind, sensitive: classification.sensitive });
+  if (!profileverdict.allowed) return { allowed: false, reason: profileverdict.reason ?? "" };
+  const consentverdict = sensitiveclassgate({ origin: input.origin, classes: classification.classes, bydefault: classification.bydefault, sensitive: classification.sensitive, consents: input.consents, now: input.now });
+  if (!consentverdict.allowed) return { allowed: false, reason: `${classification.reason} ${consentverdict.reason}` };
+  return { allowed: true, reason: `${classification.reason} ${consentverdict.reason}` };
+}
+function schemaguardgate(input) {
+  if (input.errors.length === 0) return { allowed: true, reason: "The inbound command matches its declared schemastrict grammar field by field." };
+  const first = input.errors[0];
+  return { allowed: false, reason: `${input.errors.length} schema error${input.errors.length === 1 ? "" : "s"} refuse the command before dispatch: ${input.errors.map((error) => error.reason).join(" ")}${first !== void 0 ? ` The first error sits at ${first.path} expecting ${first.expected}.` : ""}` };
+}
+function origincheckgate(input) {
+  if (!input.verdict.accepted) return { allowed: false, reason: input.verdict.reason };
+  return { allowed: true, reason: input.verdict.reason };
+}
+function connectallowgate(input) {
+  const verdict = origincheckof(input);
+  if (!verdict.accepted) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function ratelimitboundsvalid(limit, window) {
+  const bounds = bucketboundsvalid(limit, window);
+  if (!bounds.valid) return { allowed: false, reason: bounds.reason };
+  return { allowed: true, reason: bounds.reason };
+}
+function ratelimitgate(input) {
+  if (input.bucket === void 0) return { allowed: true, reason: "No ratelimit bucket covers the origin of the command; the bounds stay user configured choices only." };
+  if (input.now >= input.bucket.resetsat) return { allowed: true, reason: `The bucket window of ${input.bucket.origin} reset at ${input.bucket.resetsat}; the command consumes the first slot of its fresh window.` };
+  if (input.bucket.used < input.bucket.limit) return { allowed: true, reason: `The command consumes slot ${input.bucket.used + 1} of ${input.bucket.limit} in the bucket of ${input.bucket.origin}.` };
+  return { allowed: false, reason: `The bucket of ${input.bucket.origin} holds its ${input.bucket.limit} command bound; the command defers until the window resets at ${input.bucket.resetsat}.` };
+}
+function confirmpaygate(input) {
+  const kind = gatekindfor(input.classes);
+  if (kind !== "confirmpay") return { allowed: true, reason: "The step carries no payment class and needs no confirmpay gate." };
+  if (input.state === "resolved") return { allowed: true, reason: "The human resolved the confirmpay gate of the payment step; the step dispatches with its reviewed amount, payee origin and target." };
+  if (input.state === "refused") return { allowed: false, reason: "The human refused the confirmpay gate of the payment step; the payment never dispatches." };
+  if (input.state === "open") return { allowed: false, reason: "The confirmpay gate of the payment step stays open with the amount, the payee origin and the target element; the executor pauses until the human resolves it and no timeout ever resolves a gate." };
+  return { allowed: false, reason: "The payment step opens its confirmpay gate with the amount, the payee origin and the target element; the executor pauses until one distinct human action resolves it." };
+}
+function confirmdeletegate(input) {
+  const kind = gatekindfor(input.classes);
+  if (kind !== "confirmdelete") return { allowed: true, reason: "The step carries no delete class and needs no confirmdelete gate." };
+  if (input.state === "resolved") return { allowed: true, reason: "The human resolved the confirmdelete gate of the destructive step; the step dispatches with its reviewed target, scope and irreversibility." };
+  if (input.state === "refused") return { allowed: false, reason: "The human refused the confirmdelete gate of the destructive step; the deletion never dispatches." };
+  if (input.state === "open") return { allowed: false, reason: "The confirmdelete gate of the destructive step stays open with the target, the scope and the irreversibility; the executor pauses until the human resolves it and no timeout ever resolves a gate." };
+  return { allowed: false, reason: "The destructive step opens its confirmdelete gate with the target, the scope and the irreversibility; the executor pauses until one distinct human action resolves it." };
+}
+function confirmcredsgate(input) {
+  const kind = gatekindfor(input.classes);
+  if (kind !== "confirmcreds") return { allowed: true, reason: "The step carries no credential class and needs no confirmcreds gate." };
+  if (input.state === "resolved") return { allowed: true, reason: "The human resolved the confirmcreds gate of the credential step; the step reads its value from the vault at the last possible moment and no log records it." };
+  if (input.state === "refused") return { allowed: false, reason: "The human refused the confirmcreds gate of the credential step; the credential never dispatches." };
+  if (input.state === "open") return { allowed: false, reason: "The confirmcreds gate of the credential step stays open with its credential label only; the executor pauses until the human resolves it and no timeout ever resolves a gate." };
+  return { allowed: false, reason: "The credential step opens its confirmcreds gate with its credential label only; the executor pauses until one distinct human action resolves it." };
+}
+function gatebatchgate(input) {
+  if (input.gateids.length === 0) return { allowed: false, reason: "A gate resolution names its single gate." };
+  if (input.gateids.length > 1) return { allowed: false, reason: `One human action resolves exactly one gate; the batch of ${input.gateids.length} gates refuses in full because no batch approval exists.` };
+  return { allowed: true, reason: "The resolution names exactly one gate; the distinct human action resolves it alone." };
+}
+function phishthresholdgate(threshold) {
+  const verdict = phishthresholdvalid(threshold);
+  if (!verdict.valid) return { allowed: false, reason: verdict.reason };
+  return { allowed: true, reason: verdict.reason };
+}
+function phishguardgate(input) {
+  if (input.verdict.blocked) return { allowed: false, reason: input.verdict.reason };
+  return { allowed: true, reason: input.verdict.reason };
+}
+function safedefaultsgate(input) {
+  if (input.profile !== void 0) return { allowed: true, reason: `The origin profile of ${input.profile.origin} exists; the safedefaults posture stays out of the decision.` };
+  if (!input.sensitive) return { allowed: true, reason: "The non-sensitive step rides the reads only baseline of the safedefaults posture; the first visit grants reads alone." };
+  return { allowed: false, reason: `No origin profile exists and the safedefaults posture denies the sensitive ${input.classes.length > 0 ? input.classes.join(" and ") : "by default"} step; open the originprofile editor to widen the profile the user controls.` };
+}
+function vaultsecretgate(input) {
+  if (input.leaks.length > 0) return { allowed: false, reason: `The plan carries ${input.leaks.length} plaintext secret value${input.leaks.length === 1 ? "" : "s"} that digest to vault records; secrets never ride step options, variables or plan texts, only the vault holds them.` };
+  if (input.carries) return { allowed: false, reason: "The step types a raw value into a masked field shape; credential steps read their value from the vault at the last possible moment and never carry it in the options." };
+  return { allowed: true, reason: "The step and the plan carry no secret outside the vault; the values stay behind the seam." };
+}
+function untrustedrendergate(input) {
+  if (input.environment === "sandboxframe") return { allowed: true, reason: "The extracted markup renders inside the sandboxframe under its nonce with scripts and handlers stripped; the untrusted content never reenters the page context." };
+  return { allowed: false, reason: `The extracted markup grades untrusted and refuses to render inside the ${input.environment}; every untrusted render routes through the sandboxframe.` };
+}
 
 // llm.ts
 var defaultrefusalmarkers = ["i cannot", "i can't", "i'm unable", "refusal:", "cannot comply"];
@@ -10577,7 +11455,7 @@ function budgetcheck(input) {
 }
 
 // version.ts
-var packageversion = "1.1.60";
+var packageversion = "1.1.62";
 
 // types.ts
 var protocolversion = packageversion;
@@ -11173,6 +12051,79 @@ function streamsummaries(raw) {
   });
 }
 
+// maskinputs.ts
+var defaultmaskshapes = ["password", "token", "card", "secret"];
+var maskmarker = "[redacted]";
+function fieldshapekind(name) {
+  const lowered = name.toLowerCase();
+  if (lowered.includes("password") || lowered.includes("passwd") || lowered.includes("pwd") || lowered.includes("passphrase")) return "password";
+  if (lowered.includes("token") || lowered.includes("apikey") || lowered.includes("api_key") || lowered.includes("auth") || lowered.includes("bearer")) return "token";
+  if (lowered.includes("card") || lowered.includes("cvc") || lowered.includes("cvv") || lowered.includes("expiry") || lowered.includes("pan")) return "card";
+  if (lowered.includes("secret")) return "secret";
+  return void 0;
+}
+function shapesof(input) {
+  const shapes = new Set(defaultmaskshapes);
+  for (const shape of input.settings?.maskshapes ?? []) if (shape.trim() !== "") shapes.add(shape.trim().toLowerCase());
+  for (const rule of input.rules) {
+    const scoped = rule.origin === void 0 || rule.origin === "" || input.origin !== void 0 && rule.origin === input.origin;
+    if (scoped) {
+      for (const shape of rule.shapes) if (shape.trim() !== "") shapes.add(shape.trim().toLowerCase());
+    }
+  }
+  return [...shapes];
+}
+function maskingfield(name, shapes) {
+  if (fieldshapekind(name) !== void 0) return true;
+  const lowered = name.toLowerCase();
+  return shapes.some((shape) => shape !== "" && lowered.includes(shape));
+}
+function maskvalue(value) {
+  return value === "" ? "" : maskmarker;
+}
+function maskfield(input) {
+  return maskingfield(input.name, input.shapes) ? maskvalue(input.value) : input.value;
+}
+function maskrecord(record2, shapes) {
+  const masked = {};
+  for (const [key, value] of Object.entries(record2)) {
+    if (typeof value === "string") {
+      const sibling = record2.name;
+      masked[key] = key === "value" && typeof sibling === "string" ? maskfield({ name: sibling, value, shapes }) : maskfield({ name: key, value, shapes });
+    } else if (Array.isArray(value)) masked[key] = value.map((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item) ? maskrecord(item, shapes) : item);
+    else if (Boolean(value) && typeof value === "object") masked[key] = maskrecord(value, shapes);
+    else masked[key] = value;
+  }
+  return masked;
+}
+function masktypedvalues(input) {
+  const sensitive = maskingfield(input.step.target ?? "", input.shapes) || maskingfield(input.step.kind, input.shapes);
+  const maskedvalue = input.step.value !== void 0 && sensitive ? maskvalue(input.step.value) : input.step.value;
+  let maskedoptions = input.step.options;
+  if (input.step.options !== void 0) {
+    try {
+      const parsed = JSON.parse(input.step.options);
+      if (Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed)) maskedoptions = JSON.stringify(maskrecord(parsed, input.shapes));
+    } catch {
+    }
+  }
+  return { ...maskedvalue !== void 0 ? { value: maskedvalue } : {}, ...maskedoptions !== void 0 ? { options: maskedoptions } : {} };
+}
+function maskformstate(fields, shapes) {
+  return fields.map((field) => ({ ...field, value: maskfield({ name: field.name, value: field.value, shapes }) }));
+}
+function maskobservation(shot, shapes) {
+  return { ...shot, forms: shot.forms.map((form) => maskingfield(form.name, shapes) ? { ...form, options: [maskmarker] } : form) };
+}
+function maskstoredvalues(record2, shapes) {
+  const masked = {};
+  for (const [key, value] of Object.entries(record2)) masked[key] = maskfield({ name: key, value, shapes });
+  return masked;
+}
+function maskexport(record2, shapes) {
+  return maskrecord(record2, shapes);
+}
+
 // modelroute.ts
 function routevalid(route) {
   if (route.kind.trim() === "") return { allowed: false, reason: "The model route needs its task kind." };
@@ -11428,6 +12379,67 @@ function removetemplate(templates, name) {
   return templates.filter((template) => template.name !== name);
 }
 
+// redactshots.ts
+function regionof(input) {
+  if (input.origin.trim() === "" || input.template.trim() === "") throw new Error("The redact region needs its origin and its page template.");
+  for (const value of [input.x, input.y, input.width, input.height]) {
+    if (!Number.isFinite(value) || value < 0) throw new Error("The redact region needs finite, non-negative geometry in css pixels.");
+  }
+  if (input.width <= 0 || input.height <= 0) throw new Error("The redact region needs a positive width and height so the mask covers a real area.");
+  if (input.reason.trim() === "") throw new Error("The redact region names its reason in plain language.");
+  return { id: input.id ?? randomid(), origin: input.origin.trim(), template: input.template.trim(), x: input.x, y: input.y, width: input.width, height: input.height, reason: input.reason.trim(), source: input.source, createdat: input.now };
+}
+function regionvalid(region) {
+  return Number.isFinite(region.x) && Number.isFinite(region.y) && Number.isFinite(region.width) && Number.isFinite(region.height) && region.width > 0 && region.height > 0;
+}
+function regionsfor(regions, origin, template) {
+  return regions.filter((region) => region.origin === origin && region.template === template);
+}
+function fieldshaperegions(input) {
+  const regions = [];
+  for (const field of input.fields) {
+    if (!maskingfield(field.name, [])) continue;
+    regions.push(regionof({ origin: input.origin, template: input.template, x: field.rect.x, y: field.rect.y, width: field.rect.width, height: field.rect.height, reason: `The ${field.name} field carries a sensitive field shape the recognizer masks.`, source: "fieldshape", now: input.now }));
+  }
+  return regions;
+}
+function mergeregions(existing, added) {
+  const merged = [...existing];
+  for (const region of added) {
+    if (merged.some((candidate) => candidate.origin === region.origin && candidate.template === region.template && candidate.x === region.x && candidate.y === region.y && candidate.width === region.width && candidate.height === region.height)) continue;
+    merged.push(region);
+  }
+  return merged;
+}
+function capturesurfaceof(kind) {
+  if (kind === "element" || kind === "elementshot") return "element";
+  if (kind === "stitched" || kind === "fullpage" || kind === "shotfullpage" || kind === "stitch" || kind === "contactsheet" || kind === "timelapse" || kind === "recordscreen") return "stitched";
+  return "viewport";
+}
+function templateof(step) {
+  if (step.options) {
+    try {
+      const parsed = JSON.parse(step.options);
+      if (Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const template = parsed.template;
+        if (typeof template === "string" && template.trim() !== "") return template.trim();
+      }
+    } catch {
+    }
+  }
+  return step.kind;
+}
+function redactedshot(record2, regions) {
+  if (regions.length === 0) return record2;
+  return { ...record2, redacted: true, redactedregions: regions.length };
+}
+function redactionsummary(regions) {
+  if (regions.length === 0) return "No redact region covered the capture; the stored bytes carry everything the surface saw.";
+  const sources = { fieldshape: 0, userdrawn: 0 };
+  for (const region of regions) sources[region.source] += 1;
+  return `${regions.length} redact region${regions.length === 1 ? "" : "s"} covered the capture before storage: ${sources.fieldshape} derived from sensitive field shapes and ${sources.userdrawn} drawn by the user (${regions.map((region) => region.reason).join("; ")}).`;
+}
+
 // sandboxframe.ts
 function stripscripts(markup) {
   return markup.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<script\b[^>]*\/>/gi, "").replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, "").replace(/\son[a-z]+\s*=\s*'[^']*'/gi, "").replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, "").replace(/javascript:/gi, "").trim();
@@ -11466,6 +12478,82 @@ function renderprovenance(render) {
   return { origin: render.sourceorigin, stepid: render.stepid, environment: "sandboxframe" };
 }
 
+// secretvault.ts
+var vaultdigestprefix = "sha256:";
+async function vaultdigestof(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return vaultdigestprefix + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function vaultentryof(input) {
+  if (input.label.trim() === "") throw new Error("The vault record needs its label; the surfaces show the label only.");
+  if (input.scope.trim() === "") throw new Error("The vault record needs its exact origin scope; a secret never rides every origin.");
+  if (!input.digest.startsWith(vaultdigestprefix)) throw new Error("The vault record carries its sha-256 digest, never its value.");
+  return { vaultid: input.vaultid ?? randomid(), label: input.label.trim(), scope: input.scope.trim(), profileid: input.profileid, provenance: input.provenance, algorithm: "sha-256", digest: input.digest, createdat: input.now };
+}
+function inmemoryvault() {
+  const values = /* @__PURE__ */ new Map();
+  return {
+    put: async (vaultid, value) => {
+      values.set(vaultid, value);
+    },
+    fetch: async (vaultid) => values.get(vaultid),
+    drop: async (vaultid) => {
+      values.delete(vaultid);
+    }
+  };
+}
+async function vaultstore(input) {
+  if (input.value === "") throw new Error("The vault stores a secret value the user supplied; an empty value stores nothing.");
+  const entry = vaultentryof({ label: input.label, scope: input.scope, profileid: input.profileid, provenance: input.provenance, digest: await vaultdigestof(input.value), now: input.now });
+  await input.seam.put(entry.vaultid, input.value);
+  return entry;
+}
+async function vaultvaluefor(input) {
+  const value = await input.seam.fetch(input.entry.vaultid);
+  if (value === void 0) return { ok: false, reason: `The vault holds no value behind the label ${input.entry.label}; add the secret again.` };
+  return { ok: true, value, reason: `The vault released the value behind the label ${input.entry.label} at the last possible moment; the value reaches the credential field only and no log records it.` };
+}
+async function vaultdelete(input) {
+  await input.seam.drop(input.entry.vaultid);
+  return { dropped: true, label: input.entry.label, reason: `The vault dropped the secret ${input.entry.label} of ${input.entry.scope}; no value and no copy remains behind the seam.` };
+}
+function vaultcovers(entry, origin) {
+  return entry.scope === origin;
+}
+async function secretleakscan(input) {
+  const leaks = [];
+  for (const candidate of input.candidates) {
+    if (candidate.trim() === "") continue;
+    const digest = await vaultdigestof(candidate);
+    if (input.entries.some((entry) => entry.digest === digest)) leaks.push(candidate);
+  }
+  if (leaks.length > 0) return { leaks, reason: `The plan carries ${leaks.length} plaintext value${leaks.length === 1 ? "" : "s"} that digest to vault records; secrets never ride step options, variables or plan texts, only the vault holds them.` };
+  return { leaks: [], reason: "No candidate value digests to a vault record; the plan carries no leaked secret." };
+}
+function stepoptions4(step) {
+  if (!step.options) return {};
+  try {
+    const parsed = JSON.parse(step.options);
+    return Boolean(parsed) && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function secretshapecarrying(step) {
+  const options = stepoptions4(step);
+  const fields = Array.isArray(options.fields) ? options.fields.filter((item) => Boolean(item) && typeof item === "object") : [];
+  const rawfield = fields.find((field) => typeof field.name === "string" && typeof field.value === "string" && field.value !== "" && maskingfield(field.name, []));
+  if (rawfield !== void 0) return { carries: true, reason: `The ${step.kind} step types a raw value into the ${String(rawfield.name)} field; credential steps read their value from the vault at the last possible moment and never carry it in the options.` };
+  if (typeof options.field === "string" && maskingfield(options.field, []) && step.value !== void 0 && step.value !== "") return { carries: true, reason: `The ${step.kind} step types a raw value into the ${options.field} field; credential steps read their value from the vault at the last possible moment and never carry it in the options.` };
+  return { carries: false, reason: "The step carries no raw value behind a masked field shape." };
+}
+function vaultview(entries) {
+  return entries.map((entry) => ({ vaultid: entry.vaultid, label: entry.label, scope: entry.scope, provenance: entry.provenance, createdat: entry.createdat, ...entry.lastusedat !== void 0 ? { lastusedat: entry.lastusedat } : {} }));
+}
+function vaultprompttext(entry, origin) {
+  return `Use the credential ${entry.label} of ${entry.scope} on ${origin}? The value stays behind the vault and no surface ever displays it.`;
+}
+
 // taskqueue.ts
 function emptyqueue(input = {}) {
   return { lanes: input.lanes ?? [], priorities: input.priorities ?? [], completionpolicy: input.completionpolicy ?? "all", items: [], claims: [] };
@@ -11561,6 +12649,40 @@ function taskcounts(queue) {
   };
 }
 
+// transparency.ts
+function permissiondiff(input) {
+  if (input.fromversion.trim() === "" || input.toversion.trim() === "") throw new Error("The permdiff names the two versions it compares.");
+  const added = [...new Set(input.to.filter((permission) => !input.from.includes(permission)))];
+  const removed = [...new Set(input.from.filter((permission) => !input.to.includes(permission)))];
+  return { fromversion: input.fromversion, toversion: input.toversion, added, removed, computedat: input.now };
+}
+function permdiffchanged(diff) {
+  return diff.added.length > 0 || diff.removed.length > 0;
+}
+function permdiffsummary(diff) {
+  if (!permdiffchanged(diff)) return `The update from ${diff.fromversion} to ${diff.toversion} changed no permission.`;
+  const parts = [];
+  if (diff.added.length > 0) parts.push(`added ${diff.added.join(", ")}`);
+  if (diff.removed.length > 0) parts.push(`removed ${diff.removed.join(", ")}`);
+  return `The update from ${diff.fromversion} to ${diff.toversion} ${parts.join(" and ")}.`;
+}
+function transparencygrants(input) {
+  const grants = input.allowlist.map((entry) => ({ origin: entry.origin, scope: `automation allowlist of the profile workspace ${entry.profileid}`, boundary: "the user revokes the entry or the profile workspace", grantedat: entry.grantedat }));
+  for (const profile of input.profiles) {
+    grants.push({ origin: profile.origin, scope: `origin profile with ${profile.grants.length} granted and ${profile.denials.length} denied kinds`, boundary: "the user edits or revokes the profile", grantedat: profile.createdat });
+  }
+  return grants;
+}
+function revokeaction(grant) {
+  return { action: "revoke", origin: grant.origin, scope: grant.scope };
+}
+function windowhistory(windows) {
+  return windows.map((window) => ({ id: window.id, origin: window.origin, state: window.state, boundary: window.boundary, startedat: window.startedat, expiresat: window.expiresat }));
+}
+function connectallowlist(entries) {
+  return entries.map((entry) => ({ senderid: entry.senderid, displayname: entry.displayname, ...entry.origin !== void 0 ? { origin: entry.origin } : {}, addedat: entry.addedat }));
+}
+
 // protocol.ts
 function record(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Protocol message must be an object.");
@@ -12360,6 +13482,31 @@ function environmentreport(input) {
     ...input.keepalive !== void 0 ? { keepalive: input.keepalive } : {}
   };
 }
+function consentmodel() {
+  return {
+    version: protocolversion,
+    posture: "denydefault",
+    sensitiveclasses: ["payment", "credential", "delete", "publish"],
+    maskshapes: [...defaultmaskshapes],
+    notes: [
+      "The denydefault posture refuses every origin the user never granted; the per origin automation allowlist holds one exact origin per entry with no wildcard expansion and the active tab grant counts as exactly one explicit single origin grant.",
+      "The per site originprofiles grant and deny single action kinds; a denied kind never runs on that origin and a granted kind still routes its sensitive classes through the fresh consent prompts.",
+      "Every consent window scopes to one session and one origin, binds the duration the user chose and names its boundary; no grant ever defaults to unlimited, and a window past its boundary suspends the run mid step until a new explicit prompt renews it.",
+      "The revokerun is a terminal session event: the pending step and every queued step halt without executing and the immutable log records the user action.",
+      "The immutable run log appends only: every entry chains through its loghash to the hash of its predecessor, the completion seal writes the final hash, and the read path verifies the whole chain before serving a single entry.",
+      "maskinputs keeps typed values, form values and stored values out of every record behind the documented password, token, card and secret shapes the user extends; the observation schema keeps its field shapes while the values carry the redaction marker."
+    ]
+  };
+}
+function securityreport(input) {
+  return { version: protocolversion, posture: "denydefault", allowlist: input.allowlist, profiles: input.profiles, windows: input.windows, consents: input.consents, revocations: input.revocations, maskrules: input.maskrules, chain: input.chain };
+}
+function logchainreport(input) {
+  return { version: protocolversion, runid: input.runid, valid: input.valid, entries: input.entries, ...input.brokenat !== void 0 ? { brokenat: input.brokenat } : {}, reason: input.reason, ...input.sealhash !== void 0 ? { sealhash: input.sealhash } : {}, ...input.sealedat !== void 0 ? { sealedat: input.sealedat } : {} };
+}
+function transparencyreport(input) {
+  return { version: protocolversion, posture: "denydefault", grants: input.grants, windows: input.windows, connectallow: input.connectallow, permdiffs: input.permdiffs, safedefaults: input.safedefaults, vault: input.vault };
+}
 
 // workfloweditor.ts
 var palettecategories = ["actions", "controlflow", "waits", "variables", "triggers"];
@@ -13083,6 +14230,7 @@ export {
   agentpresetof,
   agentruncontext,
   agentscopevalid,
+  allowlistcheck,
   allowlistcovers,
   allowlistreport,
   alltools,
@@ -13092,6 +14240,7 @@ export {
   apientries,
   apikeyconsentgranted,
   apireplayspecof,
+  appendlogentry,
   applycooldown,
   applyheaderules,
   applylayer,
@@ -13116,6 +14265,7 @@ export {
   authrefusedmessage,
   authreport,
   autointervalof,
+  automationallowlistgate,
   backoffdelay,
   batchreport,
   beatrun,
@@ -13143,6 +14293,9 @@ export {
   breakpointinputof,
   broadcastrecipient,
   browserpermissions,
+  bucketboundsvalid,
+  bucketconsume,
+  bucketof,
   budgetcheck,
   buildname,
   buildpdf,
@@ -13176,6 +14329,7 @@ export {
   capturesourcemaps,
   capturestates,
   capturestitched,
+  capturesurfaceof,
   capturetargets,
   capturevisible,
   castvote,
@@ -13184,6 +14338,7 @@ export {
   cdpeventruleof,
   cdpkinds,
   cdpreport,
+  chainreportof,
   channellive,
   channeloptionsof,
   channelorigin,
@@ -13192,6 +14347,7 @@ export {
   choosebranch,
   claim,
   claimheartbeat,
+  classconsentcovers,
   classifyintent,
   closechannel,
   closeidlechannels,
@@ -13204,9 +14360,20 @@ export {
   complete,
   composeworkflow,
   conditionof,
+  confirmcredsgate,
+  confirmdeletegate,
   confirmmanualrun,
+  confirmpaygate,
+  connectallowentryof,
+  connectallowgate,
+  connectallowlist,
   connectclient,
   consensusstate,
+  consentdurationvalid,
+  consentmodel,
+  consentprompttext,
+  consentwindowgate,
+  consentwindowstate,
   consolecapture,
   consoleconsentcovers,
   consolediff,
@@ -13226,6 +14393,8 @@ export {
   costbudgetvalid,
   cpusnap,
   crashinterrupted,
+  credentialstep,
+  credspayload,
   cronnext,
   cronparse,
   croprect,
@@ -13243,13 +14412,20 @@ export {
   defaulthttpstream,
   defaultidlewindowms,
   defaultloopbound,
+  defaultmaskshapes,
   defaultmcpconfig,
   defaultmcpport,
   defaultpairinglifetimems,
   defaultrefusalmarkers,
   defaulttokenlifetimems,
   defaulttriggercooldown,
+  deferredeventof,
+  deferredready,
   delayjitter,
+  deletepayload,
+  deniedevidenceof,
+  denydefaultnotice,
+  denydefaultposture,
   actionrisk as deriveactionrisk,
   detachcdpsession,
   devicepresetof,
@@ -13273,6 +14449,7 @@ export {
   egressconsentgate,
   electleader,
   emptyboard,
+  emptyconnectallow,
   emptyqueue,
   emugate,
   emulationkinds,
@@ -13284,6 +14461,8 @@ export {
   enqueue,
   enqueuerequest,
   entryfresh,
+  entryhashof,
+  envelopecheck,
   environmentgrammar,
   environmentgrantgate,
   environmentreport,
@@ -13298,11 +14477,13 @@ export {
   eventnotification,
   eventresponse,
   eventrulematches,
+  exactorigin,
   exchangesreport,
   executorregistry,
   expandblocks,
   expandtemplate,
   expireapprovals,
+  expireconsentwindows,
   expirelayers,
   expirelocks,
   expireprofilerecords,
@@ -13310,6 +14491,7 @@ export {
   expiresessions,
   expiretokens,
   exportcontentreview,
+  exportlogchain,
   exportpresetlibrary,
   exportrunstate,
   exportsessionfile,
@@ -13324,6 +14506,8 @@ export {
   familyofkind,
   fetchoptionsof,
   fetchrequestof,
+  fieldshapekind,
+  fieldshaperegions,
   filteredsessions,
   filterentries,
   filterexchanges,
@@ -13336,6 +14520,11 @@ export {
   formreportresponse,
   framedlog,
   frameinterval,
+  gatebatchgate,
+  gateforstep,
+  gatekindfor,
+  gateprompttext,
+  gatestateof,
   generatedvalueallowed,
   grantallowlistentry,
   graphqlopenvelope,
@@ -13345,6 +14534,7 @@ export {
   growthtrend,
   guardoutput,
   guardverdictgate,
+  haltedstepsof,
   handleframe,
   handoffframe,
   headerfilterof,
@@ -13371,6 +14561,7 @@ export {
   inflightreport,
   inheritconsent,
   initialize,
+  inmemoryvault,
   interleavetimeline,
   iscdpkind,
   iscontrolflowkind,
@@ -13400,6 +14591,7 @@ export {
   lanereport,
   lapseframes,
   lapseplanof,
+  lasthashof,
   latesttemplate,
   launchbridge,
   layernames,
@@ -13417,8 +14609,12 @@ export {
   locationpresetof,
   locationrangevalid,
   lockkey,
+  logchainreport,
+  logentryof,
   loglevels,
+  logreadgate,
   longtaskcapture,
+  lookalikedistance,
   loopof,
   mailboxof,
   manualpreview,
@@ -13429,6 +14625,16 @@ export {
   markpending,
   markprovider,
   markuprenderstep,
+  maskexport,
+  maskfield,
+  maskformstate,
+  maskingfield,
+  maskmarker,
+  maskobservation,
+  maskrecord,
+  maskstoredvalues,
+  masktypedvalues,
+  maskvalue,
   matchmessage,
   matchurl,
   matchurlpattern,
@@ -13436,11 +14642,13 @@ export {
   mediaentries,
   mediakinds,
   mediareport,
+  mergeregions,
   mergeresults,
   messageegressgrade,
   messagefilterof,
   methoddomain,
   minimapfocus,
+  missingclassconsents,
   mockfor,
   mockreport,
   mockspecof,
@@ -13467,6 +14675,7 @@ export {
   newsessionrecord,
   newworkflowrun,
   nextrequest,
+  nobatchresolution,
   nonceof,
   normalizeendpoint,
   oauthflowof,
@@ -13478,11 +14687,19 @@ export {
   offscreencapabilitygate,
   openchannel,
   openconsensus,
+  openconsentwindow,
+  opengate,
   openoffscreen,
   openrun,
+  openrunlog,
   openseal,
   openstreamchannel,
   opentabagent,
+  origincheckgate,
+  origincheckof,
+  originlabels,
+  originprofilegate,
+  originprofileof,
   outcomeresponse,
   overrideinputof,
   overridematches,
@@ -13513,15 +14730,24 @@ export {
   payloadshapeof,
   payloadvalid,
   payloadwithdefaults,
+  paypayload,
   pdfoptionsof,
   pdfpagesize,
   pdfsegments,
   pdftextlayout,
+  permdiffchanged,
+  permdiffsummary,
+  permissiondiff,
   permissiongrade,
   permissiongrantof,
   permissionnamevalid,
   permissionstates,
   permissionstatevalid,
+  phishguardgate,
+  phishnotetext,
+  phishthresholdgate,
+  phishthresholdvalid,
+  phishverdictof,
   ping,
   planallowlist,
   plandraftreviewgate,
@@ -13532,13 +14758,17 @@ export {
   pollurl,
   poolplan,
   popscope,
+  portaccept,
   postentry,
   preparehandoff,
   privatemime,
+  profilegrade,
   profilegrantgranted,
+  profilekind,
   profilereport,
   profileretentionwindow,
   profilerkinds,
+  profilesummary,
   progressnoticeframe,
   promptcallframe,
   promptreport,
@@ -13557,13 +14787,16 @@ export {
   queuelanesvalid,
   randomid,
   rankapis,
+  ratelimitboundsvalid,
   ratelimitbudgetallowed,
+  ratelimitgate,
   ratelimitreadof,
   ratelimitreport,
   ratelimitwait,
   readentries,
   readpath,
   readstream,
+  readverifiedlog,
   reattachrun,
   receivemessage,
   receivemessages,
@@ -13577,6 +14810,8 @@ export {
   recoveryplan,
   redactconsoletext,
   redactedcookies,
+  redactedshot,
+  redactionsummary,
   redactparams,
   redeempairingcode,
   redoedit,
@@ -13584,7 +14819,10 @@ export {
   reflectstep,
   regexextract,
   regexruleof,
+  regionof,
+  regionsfor,
   regionsteps,
+  regionvalid,
   registeragent,
   rejectioncapture,
   relayframe,
@@ -13598,6 +14836,7 @@ export {
   renderprovenance,
   rendertemplate,
   rendertoolbriefs,
+  renewconsentwindow,
   reordersteps,
   repeatuntilof,
   replannonfail,
@@ -13614,6 +14853,7 @@ export {
   resolveapproval,
   resolvedrisk,
   resolveescalation,
+  resolvegate,
   resolverecipients,
   resolveroute,
   resolvetool,
@@ -13638,7 +14878,10 @@ export {
   reviewedkinds,
   reviewframe,
   revocationruleof,
+  revokeaction,
   revokeclient,
+  revokerun,
+  revokerungate,
   rewritesourcelocation,
   roleaddress,
   roledefaults,
@@ -13667,6 +14910,10 @@ export {
   runurllist,
   runwhile,
   runworkflow,
+  safedefaultnotice,
+  safedefaultprofile,
+  safedefaultreadkind,
+  safedefaultsgate,
   safetyresponse,
   samplingframes,
   sandboxorigingate,
@@ -13678,8 +14925,12 @@ export {
   scanconflicts,
   schedulecron,
   scheduleinterval,
+  schemacheck,
+  schemaguardgate,
   scopecheck,
   scopegate,
+  scopegrantof,
+  sealrunlog,
   sealrunstate,
   seamweights,
   searchfields,
@@ -13687,11 +14938,17 @@ export {
   searchsessionrecords,
   searchsteps,
   searchtemplates,
+  secretleakscan,
+  secretshapecarrying,
+  securityreport,
   seededrandom,
   selectorresponse,
   sendcdpcommand,
   sendfetch,
   sendmessage,
+  sensitiveclassesof,
+  sensitiveclassgate,
+  sensitivepipelingate,
   sequenceintegrity,
   serializearg,
   serializecdpcommand,
@@ -13711,6 +14968,7 @@ export {
   sessionrestoregate,
   sessiontabof,
   setvariable,
+  shapesof,
   sharelesson,
   shareworkflow,
   shiftentryof,
@@ -13763,6 +15021,7 @@ export {
   taskstatevalid,
   teardowncdpsession,
   teardownplanof,
+  templateof,
   templateurl,
   templatevariables,
   thumbdirectiveof,
@@ -13802,6 +15061,8 @@ export {
   transferablekeys,
   transferhandoff,
   transformgrammar,
+  transparencygrants,
+  transparencyreport,
   triggereventcatalog,
   triggerfamilies,
   triggerfamilyof,
@@ -13815,6 +15076,7 @@ export {
   tryof,
   undoedit,
   unreadcount,
+  untrustedrendergate,
   unwrapgraphql,
   updaterule,
   urlencodeform,
@@ -13831,7 +15093,19 @@ export {
   validatetoolcatalog,
   validatevaluegen,
   validateworkflow,
+  vaultcovers,
+  vaultdelete,
+  vaultdigestof,
+  vaultdigestprefix,
+  vaultentryof,
+  vaultprompttext,
+  vaultsecretgate,
+  vaultstore,
+  vaultvaluefor,
+  vaultview,
+  verdictfresh,
   verifyauth,
+  verifylogchain,
   verifytoken,
   verifywebhook,
   visitmatch,
@@ -13844,6 +15118,9 @@ export {
   watchgate,
   webhooksecretok,
   whileof,
+  wildcardentry,
+  windowgatesstep,
+  windowhistory,
   wireformat,
   wizardreport,
   workerpoolsizevalid,