@wenathlan/extension 1.1.61 → 1.1.62

package/dist/types.d.ts

@@ -1,9 +1,9 @@
-export declare const protocolversion: "1.1.61";
+export declare const protocolversion: "1.1.62";
 /** Every reviewed action kind. Read kinds observe, interaction kinds move focus, sensitive kinds change page or browser state. */
 export type actionkind = "observe" | "inspect" | "extract" | "wait" | "waitfor" | "waittext" | "readattribute" | "readstyle" | "readgeometry" | "readvalue" | "readtext" | "readhtml" | "countelements" | "readtable" | "readlinks" | "readimages" | "readmeta" | "readforms" | "readstorage" | "highlight" | "tablist" | "windowlist" | "tabsnapshot" | "focus" | "scroll" | "hover" | "clickdeep" | "rightclick" | "doubleclick" | "scrollpage" | "scrollby" | "scrollend" | "scrolltop" | "fullscreen" | "zoomset" | "click" | "type" | "navigate" | "select" | "presskey" | "drag" | "drop" | "upload" | "clear" | "check" | "uncheck" | "toggle" | "submit" | "reload" | "back" | "forward" | "writestorage" | "setattribute" | "removeattribute" | "evaluate" | "tabcreate" | "tabactivate" | "tabclose" | "tabreload" | "windowcreate" | "windowclose" | "windowresize" | "downloadfile" | "movepointer" | "clickpoint" | "shiftclick" | "clicktext" | "clickaria" | "clickname" | "resolvexpath" | "typetime" | "appendtext" | "setvalue" | "typeedit" | "keyhold" | "keyrelease" | "submitsearch" | "selectmulti" | "chooseradio" | "setslider" | "setdate" | "setcolor" | "expanddetails" | "dismissdialog" | "pierceshadow" | "enterframe" | "retryaction" | "mapclicks" | "verifyvisible" | "verifyenabled" | "a11ytree" | "readvisible" | "readertree" | "detectlists" | "detecttables" | "readjson" | "watchmutate" | "waitquiet" | "watchbanner" | "detectinfinitescroll" | "detectvirtual" | "detectlazy" | "readscrollpos" | "readlang" | "readoutline" | "countpages" | "listshadow" | "listframes" | "classifypage" | "fingerprintsection" | "diffsnapshots" | "readselection" | "watchfocus" | "detectsticky" | "detectscrolllock" | "readopengraph" | "detectlanguage" | "deriveselector" | "openlink" | "openprivate" | "reloadcache" | "stopnav" | "waitload" | "waiturl" | "followlink" | "spanav" | "spawait" | "rewritequery" | "setfragment" | "navlist" | "navprofile" | "detecthttp" | "readredirects" | "readfinalurl" | "handleauth" | "printpdf" | "prefetch" | "preconnect" | "deeplink" | "reopentab" | "trailaudit" | "pausenav" | "navintent" | "navrate" | "openclipboard" | "checksafe" | "batchopen" | "querytabs" | "duplicatetab" | "closepattern" | "pintab" | "mutetab" | "movetab" | "movetabwindow" | "grouptabs" | "colorgroup" | "collapsegroup" | "discardtab" | "reloadtabs" | "zoomin" | "zoomout" | "watchtab" | "switchtab" | "maximizewindow" | "minimizewindow" | "restorewindow" | "focuswindow" | "scratchwindow" | "incognitowindow" | "restoretab" | "savelayout" | "restorelayout" | "findclones" | "searchtabs" | "badgetab" | "attachmeta" | "listaudio" | "reopenrun" | "snapshotsession" | "fillform" | "filllabel" | "fillplaceholder" | "detectfields" | "generatevalues" | "saveprofiles" | "asksubmit" | "submitform" | "readerrors" | "retryform" | "runwizard" | "selectchain" | "picktypeahead" | "pickdate" | "attachfile" | "handoffcaptcha" | "fillcard" | "fillcode" | "consentpassword" | "skiphoneypot" | "detectlogin" | "detecttemplate" | "scrapetable" | "exportcsv" | "exportjson" | "exportexcel" | "copytable" | "pushsheets" | "importcsv" | "looprows" | "transformvalues" | "deduperows" | "paginateextract" | "mergepages" | "stamplerows" | "previewgrid" | "streamdisk" | "resumeextract" | "logprovenance" | "batchdownload" | "pausedownload" | "resumedownload" | "verifydownload" | "interceptmime" | "exportnetlog" | "readclipboard" | "writeclipboard" | "copyscreen" | "quarantinedownload" | "scanvirus" | "namecaptures" | "cleanupartifacts" | "shotview" | "shotfullpage" | "shotelement" | "shotregion" | "contactsheet" | "capturepdf" | "recordscreen" | "captureaudio" | "captureframe" | "downloadimages" | "shotcanvas" | "probestream" | "readmedia" | "readassets" | "timelapse" | "convertimage" | "makethumbs" | "fetchurl" | "parsejson" | "parsehtml" | "callrest" | "callgraphql" | "opensocket" | "sendmessage" | "waitmessage" | "watchrequests" | "readheaders" | "capturebodies" | "subscribesse" | "longpoll" | "mapapi" | "extractapi" | "blockrequest" | "mockresponse" | "rewriteheaders" | "setcookies" | "readcookies" | "clearcookies" | "authflow" | "saveapikey" | "routeproxy" | "postform" | "postfiles" | "watchconsole" | "watcherrors" | "watchtasks" | "attachcdp" | "detachcdp" | "cdpcmd" | "watchcdp" | "setbreakpoint" | "stepcode" | "watchexpr" | "overridescript" | "measureflow" | "heapshot" | "trackmemory" | "profilecpu" | "watchshifts" | "traceload" | "annotatetrace" | "replaytrace" | "capturesourcemaps" | "emulatedevice" | "emulatenetwork" | "emulatelocate" | "setuseragent" | "overridepermission" | "blackboxscripts" | "persiststate" | "capturesession" | "restoresession" | "namedsessions" | "diffsessions" | "searchsessions" | "exportsessions" | "importsessions" | "composeworkflow" | "savetemplate" | "runworkflow" | "dryrun" | "delay" | "waitelement" | "compute" | "extractvars" | "listruns" | "condition" | "branch" | "loop" | "repeatuntil" | "whileloop" | "foreach" | "parallel" | "trycatch" | "visitrule" | "urlrule" | "menurule" | "keyrule" | "buttonrule" | "cronrule" | "intervalrule" | "urllistrule" | "webhookrule" | "eventrule";
 export type actionrisk = "read" | "interaction" | "sensitive";
 export type planstate = "draft" | "pending" | "approved" | "rejected" | "expired" | "completed" | "cancelled";
-export type auditkind = "configure" | "session" | "observe" | "proposal" | "approval" | "action" | "error" | "stop" | "pause" | "resume" | "complete" | "capability" | "tab" | "window" | "download" | "pointer" | "dialog" | "hold" | "retry" | "observation" | "watch" | "diff" | "navigation" | "redirect" | "auth" | "prefetch" | "rate" | "group" | "layout" | "discard" | "badge" | "fill" | "submit" | "consent" | "handoff" | "scrape" | "export" | "stream" | "provenance" | "resume" | "intercept" | "clipboard" | "quarantine" | "cleanup" | "capture" | "media" | "call" | "socket" | "replay" | "control" | "timeline" | "debugger" | "profile" | "emulation" | "workflow" | "trigger" | "protocol" | "tool" | "model" | "swarm" | "environment" | "worker" | "sandbox" | "grant" | "expiry" | "revoke" | "deny" | "seal" | "mask";
+export type auditkind = "configure" | "session" | "observe" | "proposal" | "approval" | "action" | "error" | "stop" | "pause" | "resume" | "complete" | "capability" | "tab" | "window" | "download" | "pointer" | "dialog" | "hold" | "retry" | "observation" | "watch" | "diff" | "navigation" | "redirect" | "auth" | "prefetch" | "rate" | "group" | "layout" | "discard" | "badge" | "fill" | "submit" | "consent" | "handoff" | "scrape" | "export" | "stream" | "provenance" | "resume" | "intercept" | "clipboard" | "quarantine" | "cleanup" | "capture" | "media" | "call" | "socket" | "replay" | "control" | "timeline" | "debugger" | "profile" | "emulation" | "workflow" | "trigger" | "protocol" | "tool" | "model" | "swarm" | "environment" | "worker" | "sandbox" | "grant" | "expiry" | "revoke" | "deny" | "seal" | "mask" | "vault" | "gate" | "phish" | "defer" | "schema" | "inbound" | "transparency";
 /** Observation mode classes: passive capture, watched lifetimes and diffing passes. */
 export type observationmode = "passive" | "watching" | "diffing";
 export interface toolstep {
@@ -222,6 +222,10 @@ export interface runsettings {
     consentduration?: number;
     /** Retention window for stored sealed run logs; an absent window keeps every sealed log while the chain verification summaries always survive. */
     logretention?: number;
+    /** The phishguard lookalike distance threshold between zero and one the user chooses; a login origin whose distance to a granted origin crosses the threshold blocks the step. */
+    phishdistance?: number;
+    /** The freshness window of stored phishguard verdicts in milliseconds; an absent window keeps every verdict fresh while the records always survive for the audit trail. */
+    phishfreshness?: number;
     /** User configured mask shapes for sensitive field shapes beyond the documented password, token, card and secret families; per origin mask rules extend this list. */
     maskshapes?: string[];
 }
@@ -250,6 +254,8 @@ export interface planprogress {
     environments?: Record<string, environmentkind>;
     /** The worker turnaround of every offloaded step by step id, in milliseconds. */
     turnarounds?: Record<string, number>;
+    /** The gate wait of every gated step by step id: the confirm gate the step waited at with its waited milliseconds. */
+    gatewaits?: Record<string, gatewaitevidence>;
     /** Prior progress snapshots preserved when a new plan replaces the tracked one. */
     prior?: planprogress[];
     updatedat: number;
@@ -1146,6 +1152,10 @@ export interface shotrecord {
     annotated?: boolean;
     exporttarget?: captureexport;
     target?: string;
+    /** True when redactshot regions covered the capture before storage; the masked regions never reach the stored bytes. */
+    redacted?: boolean;
+    /** The count of redactshot regions the capture seam masked before storage. */
+    redactedregions?: number;
     /** True once the retention window expired the bytes; the metadata stays for the audit trail. */
     bytesexpired?: boolean;
 }
@@ -4295,7 +4305,7 @@ export interface sealedrunstate {
 /** The sensitive classes of the 1.1.61 family: payment, credential, delete and publish steps each need one fresh consent prompt per class per origin. */
 export type sensitiveclass = "payment" | "credential" | "delete" | "publish";
 /** The event kinds of the immutable run log: step transitions, grants, window expiries, revocations, denials, suspensions, resumes and the completion seal. */
-export type logeventkind = "step" | "grant" | "expiry" | "revoke" | "deny" | "suspend" | "resume" | "seal";
+export type logeventkind = "step" | "grant" | "expiry" | "revoke" | "deny" | "suspend" | "resume" | "seal" | "gate" | "phish" | "schema" | "inbound";
 /** The hash chain fields of one immutable log entry: the hash of its predecessor, the entry hash written at append time and the algorithm that derives both. */
 export interface loghash {
     previous: string;
@@ -4424,5 +4434,165 @@ export interface securityview {
         sealedat?: number;
     }>;
     posture: "denydefault";
+    /** The open and resolved confirm gates of the 1.1.62 family with their payloads and human action provenance. */
+    gates?: confirmgate[];
+    /** The gate resolution events with their human action provenance. */
+    resolutions?: gateresolution[];
+    /** The deferred automation commands waiting for their ratelimit bucket reset. */
+    deferred?: deferredevent[];
+    /** The stored phishguard verdicts with their distance scores. */
+    phishverdicts?: phishverdict[];
+    /** The secretvault metadata with labels and scopes only; the values never leave the vault seam. */
+    vault?: secretvaultentry[];
+    /** The connectallow entries of external senders; the list ships empty by default. */
+    connectallow?: connectallowentry[];
+    /** The safedefaults applications with their first seen origins. */
+    safedefaults?: safedefaultapplication[];
+    /** The redactshot regions per origin and page template with their geometry and reason. */
+    redactregions?: redactregion[];
+}
+/**
+ * Security part two contracts of the 1.1.62 family.
+ * The protections for secrets, messages and money live here: the secretvault keeps passwords and tokens behind a vault seam with only labels, scopes, provenance and digests persisting, redactshots mask sensitive capture regions across every capture kind, schemastrict rejects every inbound command field the grammar never declared, origincheck and connectallow guard every runtime message and port connection while dropping unknown senders, ratelimit buckets bound automation commands per origin and per session with deferral until the window resets, confirmpay, confirmdelete and confirmcreds put one distinct human action in front of payments, deletions and credential use with no batch approval and no timeout, phishguard watches login targets for lookalike origins against the granted origins under the user threshold, safedefaults profile unknown origins as reads only, and permdiff records every installed permission change for the transparencypage.
+ * The consent gates do not move: every security operation rides the same session, plan and origin review, and no security record ever bypasses the human review.
+ */
+/** The provenance of one secretvault record: the user typed the secret, or a reviewed session step stored it. */
+export type secretprovenance = "user" | "session";
+/** One secretvault record: the label, the exact origin scope, the profile workspace, the provenance and the sha-256 verification digest; the value itself lives behind the vault seam and never persists in any storage area, log or export. */
+export interface secretvaultentry {
+    vaultid: string;
+    label: string;
+    scope: string;
+    profileid: string;
+    provenance: secretprovenance;
+    algorithm: "sha-256";
+    digest: string;
+    createdat: number;
+    lastusedat?: number;
+}
+/** The vault seam the background implements: values enter and leave through put, fetch and drop only, so no plaintext value ever reaches a storage writer, a log entry or an export path. */
+export interface vaultseam {
+    put(vaultid: string, value: string): Promise<void>;
+    fetch(vaultid: string): Promise<string | undefined>;
+    drop(vaultid: string): Promise<void>;
+}
+/** One redactshot region: the geometry on the capture surface in css pixels, the plain language reason and whether the user drew it or a sensitive field shape derived it. */
+export interface redactregion {
+    id: string;
+    origin: string;
+    template: string;
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    reason: string;
+    source: "fieldshape" | "userdrawn";
+    createdat: number;
+}
+/** The capture surfaces redactshots covers: viewport, element and stitched captures alike. */
+export type capturesurface = "viewport" | "element" | "stitched";
+/** One schemastrict error: the path inside the command, the expected shape, the found shape and the reason in plain language; the error echoes no payload. */
+export interface schemaerror {
+    path: string;
+    expected: string;
+    found: string;
+    reason: string;
+}
+/** One origincheck verdict of an inbound runtime message or port connection: accepted, or dropped with the sender and its origin named. */
+export interface origincheckverdict {
+    accepted: boolean;
+    sender: string;
+    origin: string;
+    reason: string;
+}
+/** One connectallow entry: the external sender the user allowed with its display name and optional origin; the list ships empty by default and holds user managed entries only. */
+export interface connectallowentry {
+    senderid: string;
+    displayname: string;
+    origin?: string;
+    addedat: number;
+}
+/** One ratelimit bucket of automation commands per origin and per session: the user configured bound and window, the used count, the window start and the reset time. */
+export interface ratelimitbucket {
+    origin: string;
+    sessionid: string;
+    limit: number;
+    window: number;
+    used: number;
+    windowstartedat: number;
+    resetsat: number;
+}
+/** One deferred command event: the step the bucket deferred, the reason and the reset time it waits for. */
+export interface deferredevent {
+    id: string;
+    stepid: string;
+    kind: string;
+    origin: string;
+    reason: string;
+    resetsat: number;
+    at: number;
+}
+/** The gated step families of the 1.1.62 family: payments, destructive deletions and credential use each pause in front of a human. */
+export type gatekind = "confirmpay" | "confirmdelete" | "confirmcreds";
+/** One confirm gate: the step it holds, the payload the human reviews and the state only one explicit human action resolves; no timeout ever resolves a gate and no batch approval resolves two. */
+export interface confirmgate {
+    gateid: string;
+    kind: gatekind;
+    stepid: string;
+    runid: string;
+    origin: string;
+    /** confirmpay carries the amount, the payee origin and the target element; confirmdelete carries the target, the scope and the irreversibility; confirmcreds carries the credential label only, never its value. */
+    payload: Record<string, string>;
+    state: "open" | "resolved" | "refused";
+    openedat: number;
+    resolvedat?: number;
+    actor?: string;
+}
+/** One gate resolution event with its human action provenance: one gate, one decision, one acting user. */
+export interface gateresolution {
+    gateid: string;
+    kind: gatekind;
+    stepid: string;
+    decision: "resolved" | "refused";
+    actor: string;
+    at: number;
+}
+/** One gate wait evidence of the progress log: the gate the step waited at and the milliseconds it waited. */
+export interface gatewaitevidence {
+    gateid: string;
+    kind: string;
+    openedat: number;
+    resolvedat: number;
+    waitedms: number;
+}
+/** One phishguard verdict: the login origin checked, the closest granted origin with the lookalike distance, the user threshold and the block decision that names the matched origin. */
+export interface phishverdict {
+    origin: string;
+    matchedorigin?: string;
+    distance: number;
+    threshold: number;
+    blocked: boolean;
+    reason: string;
+    at: number;
+}
+/** One permdiff record between two installed permission versions: the added and removed permissions with the computed time. */
+export interface permdiffrecord {
+    fromversion: string;
+    toversion: string;
+    added: string[];
+    removed: string[];
+    computedat: number;
+}
+/** One safedefaults application: the unknown origin that received the reads only profile with its first seen time. */
+export interface safedefaultapplication {
+    origin: string;
+    firstseenat: number;
+}
+/** One transparency grant row of the transparencypage: the origin, the scope, the boundary and the revoke action it offers. */
+export interface transparencygrant {
+    origin: string;
+    scope: string;
+    boundary: string;
+    grantedat: number;
 }
 //# sourceMappingURL=types.d.ts.map