automate-google-login-scraper 0.1.9

package/dist/secret-B4HOopFT.js

@@ -0,0 +1,276 @@
+const SESSION_COOKIE_EXPIRES = -1;
+const SAME_SITE = ["Strict", "Lax", "None"];
+const GOOGLE_DOMAINS = ["google.com", "accounts.google.com", "googleusercontent.com", "gstatic.com"];
+class InvalidStorageStateError extends Error {
+  constructor(reason) {
+    super(`Not a Playwright storage state: ${reason}`);
+    this.name = "InvalidStorageStateError";
+  }
+}
+function asSameSite(value) {
+  if (typeof value === "string") {
+    const match = SAME_SITE.find((candidate) => candidate.toLowerCase() === value.toLowerCase());
+    if (match) return match;
+  }
+  return "Lax";
+}
+function parseCookie(raw, index) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new InvalidStorageStateError(`cookies[${index}] is not an object`);
+  }
+  const cookie = raw;
+  if (typeof cookie.name !== "string" || typeof cookie.value !== "string") {
+    throw new InvalidStorageStateError(`cookies[${index}] has no name/value pair`);
+  }
+  if (typeof cookie.domain !== "string" || cookie.domain === "") {
+    throw new InvalidStorageStateError(`cookies[${index}] (${cookie.name}) has no domain`);
+  }
+  return {
+    name: cookie.name,
+    value: cookie.value,
+    domain: cookie.domain,
+    path: typeof cookie.path === "string" ? cookie.path : "/",
+    expires: typeof cookie.expires === "number" ? cookie.expires : SESSION_COOKIE_EXPIRES,
+    httpOnly: cookie.httpOnly === true,
+    secure: cookie.secure === true,
+    sameSite: asSameSite(cookie.sameSite)
+  };
+}
+function parseOrigin(raw, index) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new InvalidStorageStateError(`origins[${index}] is not an object`);
+  }
+  const origin = raw;
+  if (typeof origin.origin !== "string" || origin.origin === "") {
+    throw new InvalidStorageStateError(`origins[${index}] has no origin`);
+  }
+  const entries = Array.isArray(origin.localStorage) ? origin.localStorage : [];
+  return {
+    origin: origin.origin,
+    localStorage: entries.flatMap((entry) => {
+      if (typeof entry !== "object" || entry === null) return [];
+      const { name, value } = entry;
+      if (typeof name !== "string") return [];
+      return [{ name, value: typeof value === "string" ? value : String(value ?? "") }];
+    })
+  };
+}
+function normalizeStorageState(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new InvalidStorageStateError("top level is not an object");
+  }
+  const state = raw;
+  const cookies = state.cookies;
+  const origins = state.origins;
+  if (cookies !== void 0 && !Array.isArray(cookies)) {
+    throw new InvalidStorageStateError("`cookies` is present but not an array");
+  }
+  if (origins !== void 0 && !Array.isArray(origins)) {
+    throw new InvalidStorageStateError("`origins` is present but not an array");
+  }
+  if (cookies === void 0 && origins === void 0) {
+    throw new InvalidStorageStateError("neither `cookies` nor `origins` is present");
+  }
+  return {
+    cookies: (cookies ?? []).map(parseCookie),
+    origins: (origins ?? []).map(parseOrigin)
+  };
+}
+function parseStorageState(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new InvalidStorageStateError(`not valid JSON (${error.message})`);
+  }
+  return normalizeStorageState(parsed);
+}
+function isGoogleDomain(domain) {
+  const bare = domain.replace(/^\./, "").toLowerCase();
+  return GOOGLE_DOMAINS.some((google) => bare === google || bare.endsWith(`.${google}`));
+}
+function expiringCookies(state) {
+  return state.cookies.filter((cookie) => cookie.expires > 0);
+}
+function summarizeStorageState(state, options = {}) {
+  const nowSeconds = Math.floor((options.now ?? Date.now()) / 1e3);
+  const expiring = expiringCookies(state);
+  const earliestExpiry = expiring.length > 0 ? Math.min(...expiring.map((cookie) => cookie.expires)) : null;
+  const sessionCookies = state.cookies.length - expiring.length;
+  const expired = expiring.length > 0 && expiring.every((cookie) => cookie.expires <= nowSeconds);
+  const live = state.cookies.filter(
+    (cookie) => cookie.expires === SESSION_COOKIE_EXPIRES || cookie.expires > nowSeconds
+  );
+  return {
+    cookieCount: state.cookies.length,
+    originCount: state.origins.length,
+    domains: [...new Set(state.cookies.map((cookie) => cookie.domain))].sort(),
+    cookieNames: [...new Set(state.cookies.map((cookie) => cookie.name))].sort(),
+    localStorageKeys: Object.fromEntries(
+      state.origins.map((origin) => [origin.origin, origin.localStorage.map((entry) => entry.name).sort()])
+    ),
+    sessionCookies,
+    earliestExpiry,
+    expiresInSeconds: earliestExpiry === null ? null : earliestExpiry - nowSeconds,
+    expired,
+    usable: live.length > 0,
+    hasGoogleCookies: state.cookies.some((cookie) => isGoogleDomain(cookie.domain))
+  };
+}
+function findExpiringCookies(state, options = {}) {
+  const nowSeconds = Math.floor((options.now ?? Date.now()) / 1e3);
+  const withinSeconds = Math.floor((options.withinMs ?? 60 * 60 * 1e3) / 1e3);
+  return expiringCookies(state).filter((cookie) => cookie.expires - nowSeconds <= withinSeconds);
+}
+function redactStorageState(state) {
+  const redact = (value) => `«redacted ${value.length} chars»`;
+  return {
+    cookies: state.cookies.map((cookie) => ({ ...cookie, value: redact(cookie.value) })),
+    origins: state.origins.map((origin) => ({
+      origin: origin.origin,
+      localStorage: origin.localStorage.map((entry) => ({ name: entry.name, value: redact(entry.value) }))
+    }))
+  };
+}
+function toPuppeteerCookies(state) {
+  return state.cookies.map((cookie) => {
+    const converted = {
+      name: cookie.name,
+      value: cookie.value,
+      domain: cookie.domain,
+      path: cookie.path,
+      httpOnly: cookie.httpOnly,
+      secure: cookie.secure,
+      sameSite: cookie.sameSite
+    };
+    if (cookie.expires > 0) converted.expires = cookie.expires;
+    return converted;
+  });
+}
+function fromPuppeteerCookies(cookies) {
+  return cookies.map((cookie) => {
+    const hasExpiry = cookie.session !== true && typeof cookie.expires === "number" && cookie.expires > 0;
+    const sameSite = ["Strict", "Lax", "None"].find(
+      (candidate) => candidate.toLowerCase() === String(cookie.sameSite ?? "").toLowerCase()
+    );
+    return {
+      name: cookie.name,
+      value: cookie.value,
+      domain: cookie.domain,
+      path: cookie.path || "/",
+      expires: hasExpiry ? cookie.expires : SESSION_COOKIE_EXPIRES,
+      httpOnly: cookie.httpOnly === true,
+      secure: cookie.secure === true,
+      sameSite: sameSite ?? "Lax"
+    };
+  });
+}
+function storageStateOrigins(state) {
+  return state.origins.map((origin) => origin.origin);
+}
+async function applyLocalStorage(page, entries) {
+  if (entries.length === 0) return;
+  await page.evaluate(
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- runs in the page, not here
+    ((items) => {
+      for (const item of items) window.localStorage.setItem(item.name, item.value);
+    }),
+    entries
+  );
+}
+async function applyStorageState(page, state, options = {}) {
+  const result = { cookiesSet: 0, originsRestored: [], skipped: [] };
+  const cookies = toPuppeteerCookies(state);
+  if (cookies.length > 0) {
+    if (typeof page.setCookie !== "function") {
+      throw new TypeError(
+        "This page cannot set cookies — `page.setCookie` is missing. Puppeteer 23+ moved it to `browserContext.setCookie`; pass a page from an older API, or set them on the context yourself."
+      );
+    }
+    await page.setCookie(...cookies);
+    result.cookiesSet = cookies.length;
+  }
+  const wanted = options.origins;
+  const origins = wanted ? state.origins.filter((origin) => wanted.includes(origin.origin)) : state.origins;
+  for (const origin of origins) {
+    if (origin.localStorage.length === 0) {
+      result.skipped.push({ origin: origin.origin, reason: "no localStorage entries" });
+      continue;
+    }
+    try {
+      await page.goto(origin.origin, { waitUntil: "domcontentloaded", ...options.gotoOptions });
+      await applyLocalStorage(page, origin.localStorage);
+      result.originsRestored.push(origin.origin);
+    } catch (error) {
+      result.skipped.push({ origin: origin.origin, reason: error.message });
+    }
+  }
+  return result;
+}
+async function extractStorageState(page, options = {}) {
+  if (typeof page.cookies !== "function") {
+    throw new TypeError("This page cannot read cookies — `page.cookies` is missing.");
+  }
+  const cookies = fromPuppeteerCookies(await page.cookies());
+  const current = page.url();
+  const origins = options.origins ?? (current && current !== "about:blank" ? [originOf(current)] : []);
+  const captured = [];
+  for (const origin of origins) {
+    try {
+      if (originOf(page.url()) !== origin) {
+        await page.goto(origin, { waitUntil: "domcontentloaded", ...options.gotoOptions });
+      }
+      const localStorage = await page.evaluate(
+        (() => Object.keys(window.localStorage).map((name) => ({
+          name,
+          value: window.localStorage.getItem(name) ?? ""
+        })))
+      );
+      captured.push({ origin, localStorage });
+    } catch {
+    }
+  }
+  return { cookies, origins: captured };
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return url;
+  }
+}
+const encoder = new TextEncoder();
+function constantTimeEqual(supplied, expected) {
+  if (!expected) return false;
+  if (supplied == null) return false;
+  const a = encoder.encode(supplied);
+  const b = encoder.encode(expected);
+  let diff = a.length ^ b.length;
+  for (let i = 0; i < b.length; i += 1) {
+    diff |= (a[i] ?? 65535) ^ b[i];
+  }
+  return diff === 0;
+}
+const AUTH_HEADER = "x-test-auth-secret";
+function isAuthorized(headers, expected) {
+  return constantTimeEqual(headers.get(AUTH_HEADER), expected);
+}
+export {
+  AUTH_HEADER as A,
+  InvalidStorageStateError as I,
+  SESSION_COOKIE_EXPIRES as S,
+  applyLocalStorage as a,
+  applyStorageState as b,
+  constantTimeEqual as c,
+  fromPuppeteerCookies as d,
+  extractStorageState as e,
+  findExpiringCookies as f,
+  isGoogleDomain as g,
+  storageStateOrigins as h,
+  isAuthorized as i,
+  normalizeStorageState as n,
+  parseStorageState as p,
+  redactStorageState as r,
+  summarizeStorageState as s,
+  toPuppeteerCookies as t
+};

package/dist/secret.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared-secret comparison, in a form that runs in both halves of this package.
+ *
+ * `node:crypto.timingSafeEqual` would do, and the Worker could reach it through
+ * `nodejs_compat` — but this is twenty lines, needs no compatibility flag, and
+ * the Worker half is deliberately free of Node builtins so its bundle stays a
+ * Worker bundle. Hence the hand-rolled compare.
+ */
+/**
+ * Compare two secrets without leaking their contents through timing.
+ *
+ * A length mismatch is answered in the same shape as a content mismatch — the
+ * loop always runs over the expected value's full length — so an attacker
+ * learns neither the length nor the position of the first wrong byte.
+ *
+ * @param supplied what the caller presented (`null`/`undefined` is a miss, not a throw)
+ * @param expected the configured secret (empty or unset is always a miss)
+ */
+export declare function constantTimeEqual(supplied: string | null | undefined, expected: string | null | undefined): boolean;
+/** Header every request to the Worker half must carry. */
+export declare const AUTH_HEADER = "x-test-auth-secret";
+/**
+ * Whether a request presented the configured secret.
+ *
+ * Returns `false` when the secret is not configured at all, so a Worker deployed
+ * without `TEST_AUTH_SECRET` set refuses every request rather than serving an
+ * open browser to the internet.
+ */
+export declare function isAuthorized(headers: {
+    get(name: string): string | null;
+}, expected: string | null | undefined): boolean;

package/dist/state-core.d.ts

@@ -0,0 +1,50 @@
+import { StorageState, StorageStateCookie, StorageStateSummary } from './types.js';
+/** Playwright's sentinel for "dies with the browser". Not a timestamp. */
+export declare const SESSION_COOKIE_EXPIRES = -1;
+/** Thrown when a state file exists but is not a storage state. */
+export declare class InvalidStorageStateError extends Error {
+    constructor(reason: string);
+}
+/**
+ * Validate and normalize a parsed storage state.
+ *
+ * Normalizing rather than trusting: a state file may have been written by an
+ * older Playwright, hand-edited, or produced by the Puppeteer half of this
+ * package, and a missing `path` or a lowercase `sameSite` should not fail a
+ * suite three calls later with an opaque CDP error.
+ */
+export declare function normalizeStorageState(raw: unknown): StorageState;
+/** Parse JSON text into a validated storage state. */
+export declare function parseStorageState(text: string): StorageState;
+/** Is this domain Google's, rather than the app under test's? */
+export declare function isGoogleDomain(domain: string): boolean;
+/**
+ * Everything worth knowing about a state file, with no value from it included.
+ *
+ * `now` is injectable because every assertion about expiry otherwise depends on
+ * the wall clock, which makes for a test suite that passes until it doesn't.
+ *
+ * @param now milliseconds since epoch. Defaults to `Date.now()`.
+ */
+export declare function summarizeStorageState(state: StorageState, options?: {
+    now?: number;
+}): StorageStateSummary;
+/**
+ * Cookies that expire within `withinMs` — the warning before the failure.
+ *
+ * Worth running at the start of a suite: "3 cookies expire in 40 minutes" in the
+ * log beats a flaky-looking selector timeout at minute 41.
+ */
+export declare function findExpiringCookies(state: StorageState, options?: {
+    now?: number;
+    withinMs?: number;
+}): StorageStateCookie[];
+/**
+ * The same state with every secret replaced by a description of its length.
+ *
+ * Shape, names, domains, flags and expiries survive; cookie values and
+ * `localStorage` values do not. This is the only form of a state file that is
+ * safe to print, log, attach to an issue or return over HTTP — and having it
+ * means the answer to "can I see the state file?" is yes, this one.
+ */
+export declare function redactStorageState(state: StorageState): StorageState;

package/dist/storage-state.d.ts

@@ -0,0 +1,50 @@
+import { StorageState, StorageStateSummary } from './types.js';
+export * from './state-core.js';
+/** Thrown when a state file is absent — carries the command that creates one. */
+export declare class MissingStorageStateError extends Error {
+    readonly file: string;
+    constructor(file: string, hint: string);
+}
+/**
+ * Read a state file from disk.
+ *
+ * @throws {MissingStorageStateError} when the file is absent, with the codegen
+ *   command that creates it — the message is the whole fix, so it belongs in the
+ *   error rather than in documentation the reader has to go find.
+ */
+export declare function readStorageState(file: string, options?: {
+    baseUrl?: string;
+    cwd?: string;
+}): StorageState;
+/**
+ * Write a state file, owner-read-write only.
+ *
+ * The `chmod` after the write is not redundant: `writeFileSync`'s `mode` applies
+ * only when it creates the file, so re-saving over an existing 0644 state file
+ * would otherwise keep the loose mode it already had.
+ */
+export declare function writeStorageState(file: string, state: StorageState): string;
+/**
+ * Tighten an existing state file to 0600 and confirm it parses.
+ *
+ * For the files Playwright writes itself. `context.storageState({ path })` keeps
+ * shapes this package has no type for — `indexedDB: true` adds one — so
+ * round-tripping such a file through {@link writeStorageState} would quietly drop
+ * data the app needs. This validates and chmods in place instead.
+ *
+ * @returns a summary of what the file holds, safe to log
+ * @throws {InvalidStorageStateError} if the file is not a storage state after all
+ */
+export declare function hardenStorageStateFile(file: string): StorageStateSummary;
+/**
+ * Throw unless the state is still usable, with a message that says what to do.
+ *
+ * This is what a Playwright setup project calls: it turns "the dashboard heading
+ * never appeared" into "the session expired 6 hours ago, re-capture it like this".
+ */
+export declare function assertStorageStateUsable(state: StorageState, options?: {
+    now?: number;
+    file?: string;
+    baseUrl?: string;
+    cwd?: string;
+}): StorageStateSummary;

package/dist/types.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The shapes this package works in.
+ *
+ * `StorageState` is Playwright's `storageState()` output, declared here rather
+ * than imported from `@playwright/test` on purpose: the Worker half of this
+ * package reads the same file inside a Cloudflare isolate, where Playwright is
+ * not installed and cannot be. Keeping the type local is what lets one state
+ * file be produced by Playwright and consumed by Puppeteer.
+ */
+/** Playwright's `sameSite` spelling. Puppeteer/CDP uses the same three words. */
+export type SameSite = "Strict" | "Lax" | "None";
+/** One cookie as Playwright writes it into a storage-state file. */
+export interface StorageStateCookie {
+    name: string;
+    value: string;
+    domain: string;
+    path: string;
+    /**
+     * Unix seconds, **not** milliseconds — and `-1` for a session cookie, which is
+     * the single most common way to get expiry arithmetic wrong here.
+     */
+    expires: number;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: SameSite;
+}
+/** `localStorage` for one origin. Playwright groups storage by origin, not by domain. */
+export interface StorageStateOrigin {
+    origin: string;
+    localStorage: {
+        name: string;
+        value: string;
+    }[];
+}
+/**
+ * A whole persisted browser session: cookies plus per-origin `localStorage`.
+ *
+ * **This is a credential.** A populated instance of this type grants whatever the
+ * signed-in test account can do, which is why nothing in this package logs one,
+ * returns one over HTTP, or writes one anywhere but a 0600 file under
+ * `playwright/.auth/`.
+ */
+export interface StorageState {
+    cookies: StorageStateCookie[];
+    origins: StorageStateOrigin[];
+}
+/** What a cookie looks like to Puppeteer's `setCookie`/`cookies` (CDP naming). */
+export interface PuppeteerCookie {
+    name: string;
+    value: string;
+    domain: string;
+    path: string;
+    /** Unix seconds. Absent (not `-1`) for a session cookie. */
+    expires?: number;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite?: SameSite;
+    /** CDP sets this on read; it is the inverse of "has an expiry". */
+    session?: boolean;
+}
+/**
+ * What `summarizeStorageState` reports — everything you would want to know about
+ * a state file without ever seeing a value from it. Safe to print and to log.
+ */
+export interface StorageStateSummary {
+    cookieCount: number;
+    originCount: number;
+    /** Cookie domains, deduped and sorted. Names and values are never included. */
+    domains: string[];
+    /** Cookie names, deduped and sorted — a name is not a secret, a value is. */
+    cookieNames: string[];
+    /** `localStorage` keys per origin, values omitted. */
+    localStorageKeys: Record<string, string[]>;
+    /** How many cookies carry no expiry and die with the browser. */
+    sessionCookies: number;
+    /** Earliest expiry among cookies that have one, as Unix seconds; `null` if none do. */
+    earliestExpiry: number | null;
+    /** Seconds until `earliestExpiry`; negative once it has passed. `null` if none do. */
+    expiresInSeconds: number | null;
+    /** True when every cookie that had an expiry has passed it. */
+    expired: boolean;
+    /** True when the state still has at least one cookie a browser would send. */
+    usable: boolean;
+    /** True when any cookie belongs to a Google domain. */
+    hasGoogleCookies: boolean;
+}
+/** The minimum of a Puppeteer/Playwright `Page` that this package calls. */
+export interface PageLike {
+    goto(url: string, options?: Record<string, unknown>): Promise<unknown>;
+    evaluate<T>(fn: (...args: never[]) => T, ...args: unknown[]): Promise<T>;
+    url(): string;
+    setCookie?(...cookies: PuppeteerCookie[]): Promise<void>;
+    cookies?(...urls: string[]): Promise<PuppeteerCookie[]>;
+    deleteCookie?(...cookies: {
+        name: string;
+        domain?: string;
+        path?: string;
+    }[]): Promise<void>;
+}

package/dist/worker.d.ts

@@ -0,0 +1,138 @@
+import { PageLike, StorageStateSummary } from './types.js';
+/** Bindings this Worker expects. See `wrangler.jsonc`. */
+export interface Env {
+    /** Browser Rendering binding. Requires the Workers Paid plan. */
+    BROWSER: unknown;
+    /** The `GoogleLoginBrowser` namespace. */
+    BROWSER_SESSION: DurableObjectNamespaceLike;
+    /** Shared secret every request must present. Unset = the Worker serves nothing. */
+    TEST_AUTH_SECRET?: string;
+    /** "true" to enable `POST /login`. Anything else leaves it disabled. */
+    ALLOW_REAL_GOOGLE_LOGIN?: string;
+    GOOGLE_TEST_EMAIL?: string;
+    GOOGLE_TEST_PASSWORD?: string;
+    /** Minutes of inactivity before the browser is closed. Default 3. */
+    BROWSER_IDLE_MINUTES?: string;
+}
+/** The shape of a DO namespace, declared structurally so tests can fake it. */
+export interface DurableObjectNamespaceLike {
+    idFromName(name: string): unknown;
+    get(id: unknown): {
+        fetch(request: Request): Promise<Response>;
+    };
+}
+/**
+ * Route a request to the DO that owns its session, after checking the secret.
+ *
+ * The session name comes from `?session=` and defaults to `default`. Distinct
+ * names are distinct browsers — useful for one signed-in and one anonymous
+ * session in the same suite, and for keeping two concurrent CI jobs apart.
+ */
+export declare function handleRequest(request: Request, env: Env): Promise<Response>;
+declare const _default: {
+    fetch: typeof handleRequest;
+};
+export default _default;
+/** The minimum of `@cloudflare/puppeteer` this module calls. */
+export interface PuppeteerLike {
+    launch(binding: unknown): Promise<BrowserLike>;
+    connect?(binding: unknown, sessionId: string): Promise<BrowserLike>;
+}
+export interface BrowserLike {
+    newPage(): Promise<PageLike & {
+        close(): Promise<void>;
+        title(): Promise<string>;
+        screenshot(options?: Record<string, unknown>): Promise<ArrayBuffer | Uint8Array>;
+    }>;
+    close(): Promise<void>;
+    isConnected?(): boolean;
+}
+/** Inject a Puppeteer implementation — for tests, and for bring-your-own builds. */
+export declare function setPuppeteer(implementation: PuppeteerLike | undefined): void;
+/** State-checking result, returned by `POST /check`. */
+export interface CheckResult {
+    authenticated: boolean;
+    status: number | null;
+    url: string;
+    title: string;
+    /** Why the check concluded what it did — the useful half when it says `false`. */
+    reason: string;
+    applied: {
+        cookiesSet: number;
+        originsRestored: string[];
+        skipped: {
+            origin: string;
+            reason: string;
+        }[];
+    };
+}
+/**
+ * Holds one browser and one persisted session.
+ *
+ * Written against a structural `state`/`env` rather than extending
+ * `DurableObject`, so the class is constructible in a plain Vitest process. The
+ * runtime passes the real ones.
+ */
+export declare class GoogleLoginBrowser {
+    private readonly storage;
+    private readonly env;
+    private browser;
+    constructor(state: {
+        storage: DurableObjectStorageLike;
+    }, env: Env);
+    private get idleMs();
+    fetch(request: Request): Promise<Response>;
+    /**
+     * Store a storage state for this session.
+     *
+     * Validated on the way in, so a malformed upload fails here with a precise
+     * reason rather than as an opaque CDP error during the next check.
+     */
+    private putState;
+    /**
+     * Describe the stored state — redacted, always.
+     *
+     * There is no route that returns the live values. That is the point: this Worker
+     * can be handed to CI without handing CI a way to read the session back out.
+     */
+    private describeState;
+    private clearState;
+    /**
+     * Replay the stored session against a URL and report whether it is signed in.
+     *
+     * "Signed in" is whatever you say it is: `expectSelector` is checked in the page
+     * and `rejectUrl` catches the redirect-to-login case, which is the failure that
+     * otherwise looks like a passing 200.
+     */
+    private check;
+    /**
+     * Sign in to Google for real, in the Worker, and store the resulting session.
+     *
+     * Gated twice — the flag and the credentials — and still the path you should
+     * reach for last. Read {@link signInWithGoogle}'s notes in `google-login.ts`:
+     * they apply here in full, with the extra wrinkle that a datacentre IP makes
+     * Google's risk checks more likely, not less.
+     */
+    private login;
+    private ensureBrowser;
+    /** Push the idle alarm out. Called after every request that used the browser. */
+    private touch;
+    /**
+     * Close the browser when the session goes quiet.
+     *
+     * Not an optimisation — a Browser Rendering session left open is billed and
+     * counts against the account's concurrency limit, so the alarm is the difference
+     * between a test tool and a surprise invoice.
+     */
+    alarm(): Promise<void>;
+    private closeBrowser;
+}
+/** The part of a DO's storage this class uses. */
+export interface DurableObjectStorageLike {
+    get<T>(key: string): Promise<T | undefined>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    setAlarm(time: number): Promise<void>;
+}
+/** Exported for tests and for the summary type. */
+export type { StorageStateSummary };