browserclaw 0.5.3 → 0.5.6

package/dist/index.cjs

@@ -10,35 +10,826 @@ var promises = require('dns/promises');
 var dns = require('dns');
 var promises$1 = require('fs/promises');
 var crypto = require('crypto');
-var ipaddr = require('ipaddr.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-function _interopNamespace(e) {
-  if (e && e.__esModule) return e;
-  var n = Object.create(null);
-  if (e) {
-    Object.keys(e).forEach(function (k) {
-      if (k !== 'default') {
-        var d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: function () { return e[k]; }
-        });
-      }
-    });
-  }
-  n.default = e;
-  return Object.freeze(n);
-}
-
 var os__default = /*#__PURE__*/_interopDefault(os);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
 var net__default = /*#__PURE__*/_interopDefault(net);
-var ipaddr__namespace = /*#__PURE__*/_interopNamespace(ipaddr);
 
-// src/chrome-launcher.ts
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  __defProp(target, "default", { value: mod, enumerable: true }) ,
+  mod
+));
+
+// node_modules/ipaddr.js/lib/ipaddr.js
+var require_ipaddr = __commonJS({
+  "node_modules/ipaddr.js/lib/ipaddr.js"(exports$1, module) {
+    (function(root) {
+      const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
+      const ipv4Regexes = {
+        fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+        threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+        twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
+        longValue: new RegExp(`^${ipv4Part}$`, "i")
+      };
+      const octalRegex = new RegExp(`^0[0-7]+$`, "i");
+      const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
+      const zoneIndex = "%[0-9a-z]{1,}";
+      const ipv6Part = "(?:[0-9a-f]+::?)+";
+      const ipv6Regexes = {
+        zoneIndex: new RegExp(zoneIndex, "i"),
+        "native": new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
+        deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
+        transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
+      };
+      function expandIPv6(string, parts) {
+        if (string.indexOf("::") !== string.lastIndexOf("::")) {
+          return null;
+        }
+        let colonCount = 0;
+        let lastColon = -1;
+        let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
+        let replacement, replacementCount;
+        if (zoneId) {
+          zoneId = zoneId.substring(1);
+          string = string.replace(/%.+$/, "");
+        }
+        while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) {
+          colonCount++;
+        }
+        if (string.substr(0, 2) === "::") {
+          colonCount--;
+        }
+        if (string.substr(-2, 2) === "::") {
+          colonCount--;
+        }
+        if (colonCount > parts) {
+          return null;
+        }
+        replacementCount = parts - colonCount;
+        replacement = ":";
+        while (replacementCount--) {
+          replacement += "0:";
+        }
+        string = string.replace("::", replacement);
+        if (string[0] === ":") {
+          string = string.slice(1);
+        }
+        if (string[string.length - 1] === ":") {
+          string = string.slice(0, -1);
+        }
+        parts = (function() {
+          const ref = string.split(":");
+          const results = [];
+          for (let i = 0; i < ref.length; i++) {
+            results.push(parseInt(ref[i], 16));
+          }
+          return results;
+        })();
+        return {
+          parts,
+          zoneId
+        };
+      }
+      function matchCIDR(first, second, partSize, cidrBits) {
+        if (first.length !== second.length) {
+          throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
+        }
+        let part = 0;
+        let shift;
+        while (cidrBits > 0) {
+          shift = partSize - cidrBits;
+          if (shift < 0) {
+            shift = 0;
+          }
+          if (first[part] >> shift !== second[part] >> shift) {
+            return false;
+          }
+          cidrBits -= partSize;
+          part += 1;
+        }
+        return true;
+      }
+      function parseIntAuto(string) {
+        if (hexRegex.test(string)) {
+          return parseInt(string, 16);
+        }
+        if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
+          if (octalRegex.test(string)) {
+            return parseInt(string, 8);
+          }
+          throw new Error(`ipaddr: cannot parse ${string} as octal`);
+        }
+        return parseInt(string, 10);
+      }
+      function padPart(part, length) {
+        while (part.length < length) {
+          part = `0${part}`;
+        }
+        return part;
+      }
+      const ipaddr2 = {};
+      ipaddr2.IPv4 = (function() {
+        function IPv42(octets) {
+          if (octets.length !== 4) {
+            throw new Error("ipaddr: ipv4 octet count should be 4");
+          }
+          let i, octet;
+          for (i = 0; i < octets.length; i++) {
+            octet = octets[i];
+            if (!(0 <= octet && octet <= 255)) {
+              throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
+            }
+          }
+          this.octets = octets;
+        }
+        IPv42.prototype.SpecialRanges = {
+          unspecified: [[new IPv42([0, 0, 0, 0]), 8]],
+          broadcast: [[new IPv42([255, 255, 255, 255]), 32]],
+          // RFC3171
+          multicast: [[new IPv42([224, 0, 0, 0]), 4]],
+          // RFC3927
+          linkLocal: [[new IPv42([169, 254, 0, 0]), 16]],
+          // RFC5735
+          loopback: [[new IPv42([127, 0, 0, 0]), 8]],
+          // RFC6598
+          carrierGradeNat: [[new IPv42([100, 64, 0, 0]), 10]],
+          // RFC1918
+          "private": [
+            [new IPv42([10, 0, 0, 0]), 8],
+            [new IPv42([172, 16, 0, 0]), 12],
+            [new IPv42([192, 168, 0, 0]), 16]
+          ],
+          // Reserved and testing-only ranges; RFCs 5735, 5737, 2544, 1700
+          reserved: [
+            [new IPv42([192, 0, 0, 0]), 24],
+            [new IPv42([192, 0, 2, 0]), 24],
+            [new IPv42([192, 88, 99, 0]), 24],
+            [new IPv42([198, 18, 0, 0]), 15],
+            [new IPv42([198, 51, 100, 0]), 24],
+            [new IPv42([203, 0, 113, 0]), 24],
+            [new IPv42([240, 0, 0, 0]), 4]
+          ],
+          // RFC7534, RFC7535
+          as112: [
+            [new IPv42([192, 175, 48, 0]), 24],
+            [new IPv42([192, 31, 196, 0]), 24]
+          ],
+          // RFC7450
+          amt: [
+            [new IPv42([192, 52, 193, 0]), 24]
+          ]
+        };
+        IPv42.prototype.kind = function() {
+          return "ipv4";
+        };
+        IPv42.prototype.match = function(other, cidrRange) {
+          let ref;
+          if (cidrRange === void 0) {
+            ref = other;
+            other = ref[0];
+            cidrRange = ref[1];
+          }
+          if (other.kind() !== "ipv4") {
+            throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
+          }
+          return matchCIDR(this.octets, other.octets, 8, cidrRange);
+        };
+        IPv42.prototype.prefixLengthFromSubnetMask = function() {
+          let cidr = 0;
+          let stop = false;
+          const zerotable = {
+            0: 8,
+            128: 7,
+            192: 6,
+            224: 5,
+            240: 4,
+            248: 3,
+            252: 2,
+            254: 1,
+            255: 0
+          };
+          let i, octet, zeros;
+          for (i = 3; i >= 0; i -= 1) {
+            octet = this.octets[i];
+            if (octet in zerotable) {
+              zeros = zerotable[octet];
+              if (stop && zeros !== 0) {
+                return null;
+              }
+              if (zeros !== 8) {
+                stop = true;
+              }
+              cidr += zeros;
+            } else {
+              return null;
+            }
+          }
+          return 32 - cidr;
+        };
+        IPv42.prototype.range = function() {
+          return ipaddr2.subnetMatch(this, this.SpecialRanges);
+        };
+        IPv42.prototype.toByteArray = function() {
+          return this.octets.slice(0);
+        };
+        IPv42.prototype.toIPv4MappedAddress = function() {
+          return ipaddr2.IPv6.parse(`::ffff:${this.toString()}`);
+        };
+        IPv42.prototype.toNormalizedString = function() {
+          return this.toString();
+        };
+        IPv42.prototype.toString = function() {
+          return this.octets.join(".");
+        };
+        return IPv42;
+      })();
+      ipaddr2.IPv4.broadcastAddressFromCIDR = function(string) {
+        try {
+          const cidr = this.parseCIDR(string);
+          const ipInterfaceOctets = cidr[0].toByteArray();
+          const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+          const octets = [];
+          let i = 0;
+          while (i < 4) {
+            octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
+            i++;
+          }
+          return new this(octets);
+        } catch (e) {
+          throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+        }
+      };
+      ipaddr2.IPv4.isIPv4 = function(string) {
+        return this.parser(string) !== null;
+      };
+      ipaddr2.IPv4.isValid = function(string) {
+        try {
+          new this(this.parser(string));
+          return true;
+        } catch (e) {
+          return false;
+        }
+      };
+      ipaddr2.IPv4.isValidCIDR = function(string) {
+        try {
+          this.parseCIDR(string);
+          return true;
+        } catch (e) {
+          return false;
+        }
+      };
+      ipaddr2.IPv4.isValidFourPartDecimal = function(string) {
+        if (ipaddr2.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) {
+          return true;
+        } else {
+          return false;
+        }
+      };
+      ipaddr2.IPv4.isValidCIDRFourPartDecimal = function(string) {
+        const match = string.match(/^(.+)\/(\d+)$/);
+        if (!ipaddr2.IPv4.isValidCIDR(string) || !match) {
+          return false;
+        }
+        return ipaddr2.IPv4.isValidFourPartDecimal(match[1]);
+      };
+      ipaddr2.IPv4.networkAddressFromCIDR = function(string) {
+        let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
+        try {
+          cidr = this.parseCIDR(string);
+          ipInterfaceOctets = cidr[0].toByteArray();
+          subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+          octets = [];
+          i = 0;
+          while (i < 4) {
+            octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
+            i++;
+          }
+          return new this(octets);
+        } catch (e) {
+          throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+        }
+      };
+      ipaddr2.IPv4.parse = function(string) {
+        const parts = this.parser(string);
+        if (parts === null) {
+          throw new Error("ipaddr: string is not formatted like an IPv4 Address");
+        }
+        return new this(parts);
+      };
+      ipaddr2.IPv4.parseCIDR = function(string) {
+        let match;
+        if (match = string.match(/^(.+)\/(\d+)$/)) {
+          const maskLength = parseInt(match[2]);
+          if (maskLength >= 0 && maskLength <= 32) {
+            const parsed = [this.parse(match[1]), maskLength];
+            Object.defineProperty(parsed, "toString", {
+              value: function() {
+                return this.join("/");
+              }
+            });
+            return parsed;
+          }
+        }
+        throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
+      };
+      ipaddr2.IPv4.parser = function(string) {
+        let match, part, value;
+        if (match = string.match(ipv4Regexes.fourOctet)) {
+          return (function() {
+            const ref = match.slice(1, 6);
+            const results = [];
+            for (let i = 0; i < ref.length; i++) {
+              part = ref[i];
+              results.push(parseIntAuto(part));
+            }
+            return results;
+          })();
+        } else if (match = string.match(ipv4Regexes.longValue)) {
+          value = parseIntAuto(match[1]);
+          if (value > 4294967295 || value < 0) {
+            throw new Error("ipaddr: address outside defined range");
+          }
+          return (function() {
+            const results = [];
+            let shift;
+            for (shift = 0; shift <= 24; shift += 8) {
+              results.push(value >> shift & 255);
+            }
+            return results;
+          })().reverse();
+        } else if (match = string.match(ipv4Regexes.twoOctet)) {
+          return (function() {
+            const ref = match.slice(1, 4);
+            const results = [];
+            value = parseIntAuto(ref[1]);
+            if (value > 16777215 || value < 0) {
+              throw new Error("ipaddr: address outside defined range");
+            }
+            results.push(parseIntAuto(ref[0]));
+            results.push(value >> 16 & 255);
+            results.push(value >> 8 & 255);
+            results.push(value & 255);
+            return results;
+          })();
+        } else if (match = string.match(ipv4Regexes.threeOctet)) {
+          return (function() {
+            const ref = match.slice(1, 5);
+            const results = [];
+            value = parseIntAuto(ref[2]);
+            if (value > 65535 || value < 0) {
+              throw new Error("ipaddr: address outside defined range");
+            }
+            results.push(parseIntAuto(ref[0]));
+            results.push(parseIntAuto(ref[1]));
+            results.push(value >> 8 & 255);
+            results.push(value & 255);
+            return results;
+          })();
+        } else {
+          return null;
+        }
+      };
+      ipaddr2.IPv4.subnetMaskFromPrefixLength = function(prefix) {
+        prefix = parseInt(prefix);
+        if (prefix < 0 || prefix > 32) {
+          throw new Error("ipaddr: invalid IPv4 prefix length");
+        }
+        const octets = [0, 0, 0, 0];
+        let j = 0;
+        const filledOctetCount = Math.floor(prefix / 8);
+        while (j < filledOctetCount) {
+          octets[j] = 255;
+          j++;
+        }
+        if (filledOctetCount < 4) {
+          octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+        }
+        return new this(octets);
+      };
+      ipaddr2.IPv6 = (function() {
+        function IPv62(parts, zoneId) {
+          let i, part;
+          if (parts.length === 16) {
+            this.parts = [];
+            for (i = 0; i <= 14; i += 2) {
+              this.parts.push(parts[i] << 8 | parts[i + 1]);
+            }
+          } else if (parts.length === 8) {
+            this.parts = parts;
+          } else {
+            throw new Error("ipaddr: ipv6 part count should be 8 or 16");
+          }
+          for (i = 0; i < this.parts.length; i++) {
+            part = this.parts[i];
+            if (!(0 <= part && part <= 65535)) {
+              throw new Error("ipaddr: ipv6 part should fit in 16 bits");
+            }
+          }
+          if (zoneId) {
+            this.zoneId = zoneId;
+          }
+        }
+        IPv62.prototype.SpecialRanges = {
+          // RFC4291, here and after
+          unspecified: [new IPv62([0, 0, 0, 0, 0, 0, 0, 0]), 128],
+          linkLocal: [new IPv62([65152, 0, 0, 0, 0, 0, 0, 0]), 10],
+          multicast: [new IPv62([65280, 0, 0, 0, 0, 0, 0, 0]), 8],
+          loopback: [new IPv62([0, 0, 0, 0, 0, 0, 0, 1]), 128],
+          uniqueLocal: [new IPv62([64512, 0, 0, 0, 0, 0, 0, 0]), 7],
+          ipv4Mapped: [new IPv62([0, 0, 0, 0, 0, 65535, 0, 0]), 96],
+          // RFC6666
+          discard: [new IPv62([256, 0, 0, 0, 0, 0, 0, 0]), 64],
+          // RFC6145
+          rfc6145: [new IPv62([0, 0, 0, 0, 65535, 0, 0, 0]), 96],
+          // RFC6052
+          rfc6052: [new IPv62([100, 65435, 0, 0, 0, 0, 0, 0]), 96],
+          // RFC3056
+          "6to4": [new IPv62([8194, 0, 0, 0, 0, 0, 0, 0]), 16],
+          // RFC6052, RFC6146
+          teredo: [new IPv62([8193, 0, 0, 0, 0, 0, 0, 0]), 32],
+          // RFC5180
+          benchmarking: [new IPv62([8193, 2, 0, 0, 0, 0, 0, 0]), 48],
+          // RFC7450
+          amt: [new IPv62([8193, 3, 0, 0, 0, 0, 0, 0]), 32],
+          as112v6: [
+            [new IPv62([8193, 4, 274, 0, 0, 0, 0, 0]), 48],
+            [new IPv62([9760, 79, 32768, 0, 0, 0, 0, 0]), 48]
+          ],
+          deprecated: [new IPv62([8193, 16, 0, 0, 0, 0, 0, 0]), 28],
+          orchid2: [new IPv62([8193, 32, 0, 0, 0, 0, 0, 0]), 28],
+          droneRemoteIdProtocolEntityTags: [new IPv62([8193, 48, 0, 0, 0, 0, 0, 0]), 28],
+          reserved: [
+            // RFC3849
+            [new IPv62([8193, 0, 0, 0, 0, 0, 0, 0]), 23],
+            // RFC2928
+            [new IPv62([8193, 3512, 0, 0, 0, 0, 0, 0]), 32]
+          ]
+        };
+        IPv62.prototype.isIPv4MappedAddress = function() {
+          return this.range() === "ipv4Mapped";
+        };
+        IPv62.prototype.kind = function() {
+          return "ipv6";
+        };
+        IPv62.prototype.match = function(other, cidrRange) {
+          let ref;
+          if (cidrRange === void 0) {
+            ref = other;
+            other = ref[0];
+            cidrRange = ref[1];
+          }
+          if (other.kind() !== "ipv6") {
+            throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
+          }
+          return matchCIDR(this.parts, other.parts, 16, cidrRange);
+        };
+        IPv62.prototype.prefixLengthFromSubnetMask = function() {
+          let cidr = 0;
+          let stop = false;
+          const zerotable = {
+            0: 16,
+            32768: 15,
+            49152: 14,
+            57344: 13,
+            61440: 12,
+            63488: 11,
+            64512: 10,
+            65024: 9,
+            65280: 8,
+            65408: 7,
+            65472: 6,
+            65504: 5,
+            65520: 4,
+            65528: 3,
+            65532: 2,
+            65534: 1,
+            65535: 0
+          };
+          let part, zeros;
+          for (let i = 7; i >= 0; i -= 1) {
+            part = this.parts[i];
+            if (part in zerotable) {
+              zeros = zerotable[part];
+              if (stop && zeros !== 0) {
+                return null;
+              }
+              if (zeros !== 16) {
+                stop = true;
+              }
+              cidr += zeros;
+            } else {
+              return null;
+            }
+          }
+          return 128 - cidr;
+        };
+        IPv62.prototype.range = function() {
+          return ipaddr2.subnetMatch(this, this.SpecialRanges);
+        };
+        IPv62.prototype.toByteArray = function() {
+          let part;
+          const bytes = [];
+          const ref = this.parts;
+          for (let i = 0; i < ref.length; i++) {
+            part = ref[i];
+            bytes.push(part >> 8);
+            bytes.push(part & 255);
+          }
+          return bytes;
+        };
+        IPv62.prototype.toFixedLengthString = function() {
+          const addr = (function() {
+            const results = [];
+            for (let i = 0; i < this.parts.length; i++) {
+              results.push(padPart(this.parts[i].toString(16), 4));
+            }
+            return results;
+          }).call(this).join(":");
+          let suffix = "";
+          if (this.zoneId) {
+            suffix = `%${this.zoneId}`;
+          }
+          return addr + suffix;
+        };
+        IPv62.prototype.toIPv4Address = function() {
+          if (!this.isIPv4MappedAddress()) {
+            throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
+          }
+          const ref = this.parts.slice(-2);
+          const high = ref[0];
+          const low = ref[1];
+          return new ipaddr2.IPv4([high >> 8, high & 255, low >> 8, low & 255]);
+        };
+        IPv62.prototype.toNormalizedString = function() {
+          const addr = (function() {
+            const results = [];
+            for (let i = 0; i < this.parts.length; i++) {
+              results.push(this.parts[i].toString(16));
+            }
+            return results;
+          }).call(this).join(":");
+          let suffix = "";
+          if (this.zoneId) {
+            suffix = `%${this.zoneId}`;
+          }
+          return addr + suffix;
+        };
+        IPv62.prototype.toRFC5952String = function() {
+          const regex = /((^|:)(0(:|$)){2,})/g;
+          const string = this.toNormalizedString();
+          let bestMatchIndex = 0;
+          let bestMatchLength = -1;
+          let match;
+          while (match = regex.exec(string)) {
+            if (match[0].length > bestMatchLength) {
+              bestMatchIndex = match.index;
+              bestMatchLength = match[0].length;
+            }
+          }
+          if (bestMatchLength < 0) {
+            return string;
+          }
+          return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}`;
+        };
+        IPv62.prototype.toString = function() {
+          return this.toRFC5952String();
+        };
+        return IPv62;
+      })();
+      ipaddr2.IPv6.broadcastAddressFromCIDR = function(string) {
+        try {
+          const cidr = this.parseCIDR(string);
+          const ipInterfaceOctets = cidr[0].toByteArray();
+          const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+          const octets = [];
+          let i = 0;
+          while (i < 16) {
+            octets.push(parseInt(ipInterfaceOctets[i], 10) | parseInt(subnetMaskOctets[i], 10) ^ 255);
+            i++;
+          }
+          return new this(octets);
+        } catch (e) {
+          throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+        }
+      };
+      ipaddr2.IPv6.isIPv6 = function(string) {
+        return this.parser(string) !== null;
+      };
+      ipaddr2.IPv6.isValid = function(string) {
+        if (typeof string === "string" && string.indexOf(":") === -1) {
+          return false;
+        }
+        try {
+          const addr = this.parser(string);
+          new this(addr.parts, addr.zoneId);
+          return true;
+        } catch (e) {
+          return false;
+        }
+      };
+      ipaddr2.IPv6.isValidCIDR = function(string) {
+        if (typeof string === "string" && string.indexOf(":") === -1) {
+          return false;
+        }
+        try {
+          this.parseCIDR(string);
+          return true;
+        } catch (e) {
+          return false;
+        }
+      };
+      ipaddr2.IPv6.networkAddressFromCIDR = function(string) {
+        let cidr, i, ipInterfaceOctets, octets, subnetMaskOctets;
+        try {
+          cidr = this.parseCIDR(string);
+          ipInterfaceOctets = cidr[0].toByteArray();
+          subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+          octets = [];
+          i = 0;
+          while (i < 16) {
+            octets.push(parseInt(ipInterfaceOctets[i], 10) & parseInt(subnetMaskOctets[i], 10));
+            i++;
+          }
+          return new this(octets);
+        } catch (e) {
+          throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+        }
+      };
+      ipaddr2.IPv6.parse = function(string) {
+        const addr = this.parser(string);
+        if (addr.parts === null) {
+          throw new Error("ipaddr: string is not formatted like an IPv6 Address");
+        }
+        return new this(addr.parts, addr.zoneId);
+      };
+      ipaddr2.IPv6.parseCIDR = function(string) {
+        let maskLength, match, parsed;
+        if (match = string.match(/^(.+)\/(\d+)$/)) {
+          maskLength = parseInt(match[2]);
+          if (maskLength >= 0 && maskLength <= 128) {
+            parsed = [this.parse(match[1]), maskLength];
+            Object.defineProperty(parsed, "toString", {
+              value: function() {
+                return this.join("/");
+              }
+            });
+            return parsed;
+          }
+        }
+        throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
+      };
+      ipaddr2.IPv6.parser = function(string) {
+        let addr, i, match, octet, octets, zoneId;
+        if (match = string.match(ipv6Regexes.deprecatedTransitional)) {
+          return this.parser(`::ffff:${match[1]}`);
+        }
+        if (ipv6Regexes.native.test(string)) {
+          return expandIPv6(string, 8);
+        }
+        if (match = string.match(ipv6Regexes.transitional)) {
+          zoneId = match[6] || "";
+          addr = match[1];
+          if (!match[1].endsWith("::")) {
+            addr = addr.slice(0, -1);
+          }
+          addr = expandIPv6(addr + zoneId, 6);
+          if (addr.parts) {
+            octets = [
+              parseInt(match[2]),
+              parseInt(match[3]),
+              parseInt(match[4]),
+              parseInt(match[5])
+            ];
+            for (i = 0; i < octets.length; i++) {
+              octet = octets[i];
+              if (!(0 <= octet && octet <= 255)) {
+                return null;
+              }
+            }
+            addr.parts.push(octets[0] << 8 | octets[1]);
+            addr.parts.push(octets[2] << 8 | octets[3]);
+            return {
+              parts: addr.parts,
+              zoneId: addr.zoneId
+            };
+          }
+        }
+        return null;
+      };
+      ipaddr2.IPv6.subnetMaskFromPrefixLength = function(prefix) {
+        prefix = parseInt(prefix);
+        if (prefix < 0 || prefix > 128) {
+          throw new Error("ipaddr: invalid IPv6 prefix length");
+        }
+        const octets = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        let j = 0;
+        const filledOctetCount = Math.floor(prefix / 8);
+        while (j < filledOctetCount) {
+          octets[j] = 255;
+          j++;
+        }
+        if (filledOctetCount < 16) {
+          octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+        }
+        return new this(octets);
+      };
+      ipaddr2.fromByteArray = function(bytes) {
+        const length = bytes.length;
+        if (length === 4) {
+          return new ipaddr2.IPv4(bytes);
+        } else if (length === 16) {
+          return new ipaddr2.IPv6(bytes);
+        } else {
+          throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
+        }
+      };
+      ipaddr2.isValid = function(string) {
+        return ipaddr2.IPv6.isValid(string) || ipaddr2.IPv4.isValid(string);
+      };
+      ipaddr2.isValidCIDR = function(string) {
+        return ipaddr2.IPv6.isValidCIDR(string) || ipaddr2.IPv4.isValidCIDR(string);
+      };
+      ipaddr2.parse = function(string) {
+        if (ipaddr2.IPv6.isValid(string)) {
+          return ipaddr2.IPv6.parse(string);
+        } else if (ipaddr2.IPv4.isValid(string)) {
+          return ipaddr2.IPv4.parse(string);
+        } else {
+          throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
+        }
+      };
+      ipaddr2.parseCIDR = function(string) {
+        try {
+          return ipaddr2.IPv6.parseCIDR(string);
+        } catch (e) {
+          try {
+            return ipaddr2.IPv4.parseCIDR(string);
+          } catch (e2) {
+            throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format");
+          }
+        }
+      };
+      ipaddr2.process = function(string) {
+        const addr = this.parse(string);
+        if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+          return addr.toIPv4Address();
+        } else {
+          return addr;
+        }
+      };
+      ipaddr2.subnetMatch = function(address, rangeList, defaultName) {
+        let i, rangeName, rangeSubnets, subnet;
+        if (defaultName === void 0 || defaultName === null) {
+          defaultName = "unicast";
+        }
+        for (rangeName in rangeList) {
+          if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
+            rangeSubnets = rangeList[rangeName];
+            if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) {
+              rangeSubnets = [rangeSubnets];
+            }
+            for (i = 0; i < rangeSubnets.length; i++) {
+              subnet = rangeSubnets[i];
+              if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) {
+                return rangeName;
+              }
+            }
+          }
+        }
+        return defaultName;
+      };
+      if (typeof module !== "undefined" && module.exports) {
+        module.exports = ipaddr2;
+      } else {
+        root.ipaddr = ipaddr2;
+      }
+    })(exports$1);
+  }
+});
 var CHROMIUM_BUNDLE_IDS = /* @__PURE__ */ new Set([
   "com.google.Chrome",
   "com.google.Chrome.beta",
@@ -829,15 +1620,16 @@ async function connectBrowser(cdpUrl, authToken) {
         const headers = {};
         if (authToken) headers["Authorization"] = `Bearer ${authToken}`;
         const browser = await playwrightCore.chromium.connectOverCDP(endpoint, { timeout, headers });
-        const connected = { browser, cdpUrl: normalized, authToken };
-        cached = connected;
-        observeBrowser(browser);
-        browser.on("disconnected", () => {
+        const onDisconnected = () => {
           if (cached?.browser === browser) cached = null;
           for (const key of roleRefsByTarget.keys()) {
             if (key.startsWith(normalized + "::")) roleRefsByTarget.delete(key);
           }
-        });
+        };
+        const connected = { browser, cdpUrl: normalized, authToken, onDisconnected };
+        cached = connected;
+        observeBrowser(browser);
+        browser.on("disconnected", onDisconnected);
         return connected;
       } catch (err) {
         lastErr = err;
@@ -867,6 +1659,14 @@ async function disconnectBrowser() {
   if (cur) await cur.browser.close().catch(() => {
   });
 }
+function cdpSocketNeedsAttach(wsUrl) {
+  try {
+    const pathname = new URL(wsUrl).pathname;
+    return pathname === "/cdp" || pathname.endsWith("/cdp") || pathname.includes("/devtools/browser/") || pathname === "/";
+  } catch {
+    return false;
+  }
+}
 async function tryTerminateExecutionViaCdp(cdpUrl, targetId) {
   const httpBase = normalizeCdpHttpBaseForJsonEndpoints(cdpUrl);
   const ctrl = new AbortController();
@@ -883,8 +1683,10 @@ async function tryTerminateExecutionViaCdp(cdpUrl, targetId) {
   }
   if (!Array.isArray(targets)) return;
   const target = targets.find((entry) => String(entry?.id ?? "").trim() === targetId);
-  const wsUrl = String(target?.webSocketDebuggerUrl ?? "").trim();
-  if (!wsUrl) return;
+  const wsUrlRaw = String(target?.webSocketDebuggerUrl ?? "").trim();
+  if (!wsUrlRaw) return;
+  const wsUrl = normalizeCdpWsUrl(wsUrlRaw, httpBase);
+  const needsAttach = cdpSocketNeedsAttach(wsUrl);
   await new Promise((resolve2) => {
     let done = false;
     const finish = () => {
@@ -897,8 +1699,9 @@ async function tryTerminateExecutionViaCdp(cdpUrl, targetId) {
       }
       resolve2();
     };
-    const timer = setTimeout(finish, 2e3);
+    const timer = setTimeout(finish, 3e3);
     let ws;
+    let nextId = 1;
     try {
       ws = new WebSocket(wsUrl);
     } catch {
@@ -906,11 +1709,27 @@ async function tryTerminateExecutionViaCdp(cdpUrl, targetId) {
       return;
     }
     ws.onopen = () => {
+      if (needsAttach) {
+        ws.send(JSON.stringify({ id: nextId++, method: "Target.attachToTarget", params: { targetId, flatten: true } }));
+      } else {
+        ws.send(JSON.stringify({ id: nextId++, method: "Runtime.terminateExecution" }));
+        setTimeout(finish, 300);
+      }
+    };
+    ws.onmessage = (event) => {
+      if (!needsAttach) return;
       try {
-        ws.send(JSON.stringify({ id: 1, method: "Runtime.terminateExecution" }));
+        const msg = JSON.parse(String(event.data));
+        if (msg.id && msg.result?.sessionId) {
+          ws.send(JSON.stringify({ id: nextId++, sessionId: msg.result.sessionId, method: "Runtime.terminateExecution" }));
+          try {
+            ws.send(JSON.stringify({ id: nextId++, method: "Target.detachFromTarget", params: { sessionId: msg.result.sessionId } }));
+          } catch {
+          }
+          setTimeout(finish, 300);
+        }
       } catch {
       }
-      setTimeout(finish, 300);
     };
     ws.onerror = () => finish();
     ws.onclose = () => finish();
@@ -922,6 +1741,9 @@ async function forceDisconnectPlaywrightForTarget(opts) {
   if (!cur || cur.cdpUrl !== normalized) return;
   cached = null;
   connectingByUrl.delete(normalized);
+  if (cur.onDisconnected && typeof cur.browser.off === "function") {
+    cur.browser.off("disconnected", cur.onDisconnected);
+  }
   const targetId = opts.targetId?.trim() || "";
   if (targetId) {
     await tryTerminateExecutionViaCdp(normalized, targetId).catch(() => {
@@ -1472,6 +2294,9 @@ function formatAriaNodes(nodes, limit) {
   }
   return out;
 }
+
+// src/security.ts
+var ipaddr = __toESM(require_ipaddr());
 var InvalidBrowserNavigationUrlError = class extends Error {
   constructor(message) {
     super(message);
@@ -1512,20 +2337,6 @@ function isBlockedHostnameNormalized(normalized) {
   if (BLOCKED_HOSTNAMES.has(normalized)) return true;
   return normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal");
 }
-function isStrictDecimalOctet(part) {
-  if (!/^[0-9]+$/.test(part)) return false;
-  const n = parseInt(part, 10);
-  if (n < 0 || n > 255) return false;
-  if (String(n) !== part) return false;
-  return true;
-}
-function isUnsupportedIPv4Literal(ip) {
-  if (/^[0-9]+$/.test(ip)) return true;
-  const parts = ip.split(".");
-  if (parts.length !== 4) return true;
-  if (!parts.every(isStrictDecimalOctet)) return true;
-  return false;
-}
 var BLOCKED_IPV4_RANGES = /* @__PURE__ */ new Set([
   "unspecified",
   "broadcast",
@@ -1543,7 +2354,98 @@ var BLOCKED_IPV6_RANGES = /* @__PURE__ */ new Set([
   "uniqueLocal",
   "multicast"
 ]);
-var RFC2544_BENCHMARK_PREFIX = [ipaddr__namespace.IPv4.parse("198.18.0.0"), 15];
+var RFC2544_BENCHMARK_PREFIX = [ipaddr.IPv4.parse("198.18.0.0"), 15];
+var EMBEDDED_IPV4_SENTINEL_RULES = [
+  // IPv4-compatible (::a.b.c.d)
+  {
+    matches: (parts) => parts[0] === 0 && parts[1] === 0 && parts[2] === 0 && parts[3] === 0 && parts[4] === 0 && parts[5] === 0,
+    toHextets: (parts) => [parts[6], parts[7]]
+  },
+  // NAT64 local-use (64:ff9b:1::/48)
+  {
+    matches: (parts) => parts[0] === 100 && parts[1] === 65435 && parts[2] === 1 && parts[3] === 0 && parts[4] === 0 && parts[5] === 0,
+    toHextets: (parts) => [parts[6], parts[7]]
+  },
+  // 6to4 (2002::/16)
+  {
+    matches: (parts) => parts[0] === 8194,
+    toHextets: (parts) => [parts[1], parts[2]]
+  },
+  // Teredo (2001:0000::/32) — IPv4 XOR'd
+  {
+    matches: (parts) => parts[0] === 8193 && parts[1] === 0,
+    toHextets: (parts) => [parts[6] ^ 65535, parts[7] ^ 65535]
+  },
+  // ISATAP — sentinel in parts[4-5]: 0x0000:0x5efe or 0x0200:0x5efe
+  {
+    matches: (parts) => (parts[4] & 64767) === 0 && parts[5] === 24318,
+    toHextets: (parts) => [parts[6], parts[7]]
+  }
+];
+function stripIpv6Brackets(value) {
+  if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
+  return value;
+}
+function isNumericIpv4LiteralPart(value) {
+  return /^[0-9]+$/.test(value) || /^0x[0-9a-f]+$/i.test(value);
+}
+function parseIpv6WithEmbeddedIpv4(raw) {
+  if (!raw.includes(":") || !raw.includes(".")) return;
+  const match = /^(.*:)([^:%]+(?:\.[^:%]+){3})(%[0-9A-Za-z]+)?$/i.exec(raw);
+  if (!match) return;
+  const [, prefix, embeddedIpv4, zoneSuffix = ""] = match;
+  if (!ipaddr.IPv4.isValidFourPartDecimal(embeddedIpv4)) return;
+  const octets = embeddedIpv4.split(".").map((part) => Number.parseInt(part, 10));
+  const normalizedIpv6 = `${prefix}${(octets[0] << 8 | octets[1]).toString(16)}:${(octets[2] << 8 | octets[3]).toString(16)}${zoneSuffix}`;
+  if (!ipaddr.IPv6.isValid(normalizedIpv6)) return;
+  return ipaddr.IPv6.parse(normalizedIpv6);
+}
+function normalizeIpParseInput(raw) {
+  const trimmed = raw?.trim();
+  if (!trimmed) return;
+  return stripIpv6Brackets(trimmed);
+}
+function parseCanonicalIpAddress(raw) {
+  const normalized = normalizeIpParseInput(raw);
+  if (!normalized) return;
+  if (ipaddr.IPv4.isValid(normalized)) {
+    if (!ipaddr.IPv4.isValidFourPartDecimal(normalized)) return;
+    return ipaddr.IPv4.parse(normalized);
+  }
+  if (ipaddr.IPv6.isValid(normalized)) return ipaddr.IPv6.parse(normalized);
+  return parseIpv6WithEmbeddedIpv4(normalized);
+}
+function parseLooseIpAddress(raw) {
+  const normalized = normalizeIpParseInput(raw);
+  if (!normalized) return;
+  if (ipaddr.isValid(normalized)) return ipaddr.parse(normalized);
+  return parseIpv6WithEmbeddedIpv4(normalized);
+}
+function isCanonicalDottedDecimalIPv4(raw) {
+  const trimmed = raw?.trim();
+  if (!trimmed) return false;
+  const normalized = stripIpv6Brackets(trimmed);
+  if (!normalized) return false;
+  return ipaddr.IPv4.isValidFourPartDecimal(normalized);
+}
+function isLegacyIpv4Literal(raw) {
+  const trimmed = raw?.trim();
+  if (!trimmed) return false;
+  const normalized = stripIpv6Brackets(trimmed);
+  if (!normalized || normalized.includes(":")) return false;
+  if (isCanonicalDottedDecimalIPv4(normalized)) return false;
+  const parts = normalized.split(".");
+  if (parts.length === 0 || parts.length > 4) return false;
+  if (parts.some((part) => part.length === 0)) return false;
+  if (!parts.every((part) => isNumericIpv4LiteralPart(part))) return false;
+  return true;
+}
+function looksLikeUnsupportedIpv4Literal(address) {
+  const parts = address.split(".");
+  if (parts.length === 0 || parts.length > 4) return false;
+  if (parts.some((part) => part.length === 0)) return true;
+  return parts.every((part) => /^[0-9]+$/.test(part) || /^0x/i.test(part));
+}
 function isBlockedSpecialUseIpv4Address(address, opts) {
   const inRfc2544 = address.match(RFC2544_BENCHMARK_PREFIX);
   if (inRfc2544 && opts?.allowRfc2544BenchmarkRange === true) return false;
@@ -1553,89 +2455,50 @@ function isBlockedSpecialUseIpv6Address(address) {
   if (BLOCKED_IPV6_RANGES.has(address.range())) return true;
   return (address.parts[0] & 65472) === 65216;
 }
-function extractEmbeddedIpv4FromIpv6(v6, opts) {
-  if (v6.isIPv4MappedAddress()) {
-    return isBlockedSpecialUseIpv4Address(v6.toIPv4Address(), opts);
-  }
-  const parts = v6.parts;
-  if (parts[0] === 100 && parts[1] === 65435 && parts[2] === 0 && parts[3] === 0 && parts[4] === 0 && parts[5] === 0) {
-    const ip4str = `${parts[6] >> 8 & 255}.${parts[6] & 255}.${parts[7] >> 8 & 255}.${parts[7] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if (parts[0] === 100 && parts[1] === 65435 && parts[2] === 1) {
-    const ip4str = `${parts[6] >> 8 & 255}.${parts[6] & 255}.${parts[7] >> 8 & 255}.${parts[7] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if (parts[0] === 8194) {
-    const ip4str = `${parts[1] >> 8 & 255}.${parts[1] & 255}.${parts[2] >> 8 & 255}.${parts[2] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if (parts[0] === 8193 && parts[1] === 0) {
-    const hiXored = parts[6] ^ 65535;
-    const loXored = parts[7] ^ 65535;
-    const ip4str = `${hiXored >> 8 & 255}.${hiXored & 255}.${loXored >> 8 & 255}.${loXored & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if (parts[0] === 0 && parts[1] === 0 && parts[2] === 0 && parts[3] === 0 && parts[4] === 65535 && parts[5] === 0) {
-    const ip4str = `${parts[6] >> 8 & 255}.${parts[6] & 255}.${parts[7] >> 8 & 255}.${parts[7] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if (parts[0] === 0 && parts[1] === 0 && parts[2] === 0 && parts[3] === 0 && parts[4] === 0 && parts[5] === 0) {
-    const ip4str = `${parts[6] >> 8 & 255}.${parts[6] & 255}.${parts[7] >> 8 & 255}.${parts[7] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
-  }
-  if ((parts[4] & 65023) === 0 && parts[5] === 24318) {
-    const ip4str = `${parts[6] >> 8 & 255}.${parts[6] & 255}.${parts[7] >> 8 & 255}.${parts[7] & 255}`;
-    try {
-      return isBlockedSpecialUseIpv4Address(ipaddr__namespace.IPv4.parse(ip4str), opts);
-    } catch {
-      return true;
-    }
+function decodeIpv4FromHextets(high, low) {
+  const octets = [
+    high >>> 8 & 255,
+    high & 255,
+    low >>> 8 & 255,
+    low & 255
+  ];
+  return ipaddr.IPv4.parse(octets.join("."));
+}
+function extractEmbeddedIpv4FromIpv6(address) {
+  if (address.isIPv4MappedAddress()) return address.toIPv4Address();
+  if (address.range() === "rfc6145") return decodeIpv4FromHextets(address.parts[6], address.parts[7]);
+  if (address.range() === "rfc6052") return decodeIpv4FromHextets(address.parts[6], address.parts[7]);
+  for (const rule of EMBEDDED_IPV4_SENTINEL_RULES) {
+    if (!rule.matches(address.parts)) continue;
+    const [high, low] = rule.toHextets(address.parts);
+    return decodeIpv4FromHextets(high, low);
   }
-  return null;
 }
-function isPrivateIpAddress(address, opts) {
+function resolveIpv4SpecialUseBlockOptions(policy) {
+  return { allowRfc2544BenchmarkRange: policy?.allowRfc2544BenchmarkRange === true };
+}
+function isBlockedHostnameOrIp(hostname, policy) {
+  const normalized = normalizeHostname(hostname);
+  if (!normalized) return false;
+  return isBlockedHostnameNormalized(normalized) || isPrivateIpAddress(normalized, policy);
+}
+function isPrivateIpAddress(address, policy) {
   let normalized = address.trim().toLowerCase();
   if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
   if (!normalized) return false;
-  try {
-    const parsed = ipaddr__namespace.parse(normalized);
-    if (parsed.kind() === "ipv4") {
-      return isBlockedSpecialUseIpv4Address(parsed, opts);
-    }
-    const v6 = parsed;
+  const blockOptions = resolveIpv4SpecialUseBlockOptions(policy);
+  const strictIp = parseCanonicalIpAddress(normalized);
+  if (strictIp) {
+    if (strictIp.kind() === "ipv4") return isBlockedSpecialUseIpv4Address(strictIp, blockOptions);
+    const v6 = strictIp;
     if (isBlockedSpecialUseIpv6Address(v6)) return true;
-    const embeddedV4 = extractEmbeddedIpv4FromIpv6(v6, opts);
-    if (embeddedV4 !== null) return embeddedV4;
+    const embeddedIpv4 = extractEmbeddedIpv4FromIpv6(v6);
+    if (embeddedIpv4) return isBlockedSpecialUseIpv4Address(embeddedIpv4, blockOptions);
     return false;
-  } catch {
   }
-  if (!normalized.includes(":") && isUnsupportedIPv4Literal(normalized)) return true;
-  if (normalized.includes(":")) return true;
+  if (normalized.includes(":") && !parseLooseIpAddress(normalized)) return true;
+  if (!isCanonicalDottedDecimalIPv4(normalized) && isLegacyIpv4Literal(normalized)) return true;
+  if (looksLikeUnsupportedIpv4Literal(normalized)) return true;
   return false;
 }
 function normalizeHostnameSet(values) {
@@ -1717,13 +2580,7 @@ async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
     );
   }
   if (!skipPrivateNetworkChecks) {
-    if (isBlockedHostnameNormalized(normalized)) {
-      throw new InvalidBrowserNavigationUrlError(
-        `Navigation to internal/loopback address blocked: "${hostname}". ssrfPolicy.dangerouslyAllowPrivateNetwork is false (strict mode).`
-      );
-    }
-    const ipOpts = { allowRfc2544BenchmarkRange: params.policy?.allowRfc2544BenchmarkRange };
-    if (isPrivateIpAddress(normalized, ipOpts)) {
+    if (isBlockedHostnameOrIp(normalized, params.policy)) {
       throw new InvalidBrowserNavigationUrlError(
         `Navigation to internal/loopback address blocked: "${hostname}". ssrfPolicy.dangerouslyAllowPrivateNetwork is false (strict mode).`
       );
@@ -1744,9 +2601,8 @@ async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
     );
   }
   if (!skipPrivateNetworkChecks) {
-    const ipOpts = { allowRfc2544BenchmarkRange: params.policy?.allowRfc2544BenchmarkRange };
     for (const r of results) {
-      if (isPrivateIpAddress(r.address, ipOpts)) {
+      if (isBlockedHostnameOrIp(r.address, params.policy)) {
         throw new InvalidBrowserNavigationUrlError(
           `Navigation to internal/loopback address blocked: "${hostname}" resolves to "${r.address}". ssrfPolicy.dangerouslyAllowPrivateNetwork is false (strict mode).`
         );
@@ -1767,6 +2623,7 @@ async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
 }
 async function assertBrowserNavigationAllowed(opts) {
   const rawUrl = String(opts.url ?? "").trim();
+  if (!rawUrl) throw new InvalidBrowserNavigationUrlError("url is required");
   let parsed;
   try {
     parsed = new URL(rawUrl);
@@ -1923,12 +2780,30 @@ function resolveBoundedDelayMs(value, label, maxMs) {
   if (normalized > maxMs) throw new Error(`${label} exceeds maximum of ${maxMs}ms`);
   return normalized;
 }
-async function clickViaPlaywright(opts) {
+function resolveInteractionTimeoutMs(timeoutMs) {
+  return Math.max(500, Math.min(6e4, Math.floor(timeoutMs ?? 8e3)));
+}
+function requireRefOrSelector(ref, selector) {
+  const trimmedRef = typeof ref === "string" ? ref.trim() : "";
+  const trimmedSelector = typeof selector === "string" ? selector.trim() : "";
+  if (!trimmedRef && !trimmedSelector) throw new Error("ref or selector is required");
+  return { ref: trimmedRef || void 0, selector: trimmedSelector || void 0 };
+}
+function resolveLocator(page, resolved) {
+  return resolved.ref ? refLocator(page, resolved.ref) : page.locator(resolved.selector);
+}
+async function getRestoredPageForTarget(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
   ensurePageState(page);
   restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
-  const locator = refLocator(page, opts.ref);
-  const timeout = normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4);
+  return page;
+}
+async function clickViaPlaywright(opts) {
+  const resolved = requireRefOrSelector(opts.ref, opts.selector);
+  const page = await getRestoredPageForTarget(opts);
+  const label = resolved.ref ?? resolved.selector;
+  const locator = resolveLocator(page, resolved);
+  const timeout = resolveInteractionTimeoutMs(opts.timeoutMs);
   try {
     const delayMs = resolveBoundedDelayMs(opts.delayMs, "click delayMs", MAX_CLICK_DELAY_MS);
     if (delayMs > 0) {
@@ -1941,28 +2816,27 @@ async function clickViaPlaywright(opts) {
       await locator.click({ timeout, button: opts.button, modifiers: opts.modifiers });
     }
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    throw toAIFriendlyError(err, label);
   }
 }
 async function hoverViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const resolved = requireRefOrSelector(opts.ref, opts.selector);
+  const page = await getRestoredPageForTarget(opts);
+  const label = resolved.ref ?? resolved.selector;
+  const locator = resolveLocator(page, resolved);
   try {
-    await refLocator(page, opts.ref).hover({
-      timeout: normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4)
-    });
+    await locator.hover({ timeout: resolveInteractionTimeoutMs(opts.timeoutMs) });
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    throw toAIFriendlyError(err, label);
   }
 }
 async function typeViaPlaywright(opts) {
+  const resolved = requireRefOrSelector(opts.ref, opts.selector);
   const text = String(opts.text ?? "");
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
-  const locator = refLocator(page, opts.ref);
-  const timeout = normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4);
+  const page = await getRestoredPageForTarget(opts);
+  const label = resolved.ref ?? resolved.selector;
+  const locator = resolveLocator(page, resolved);
+  const timeout = resolveInteractionTimeoutMs(opts.timeoutMs);
   try {
     if (opts.slowly) {
       await locator.click({ timeout });
@@ -1972,39 +2846,38 @@ async function typeViaPlaywright(opts) {
     }
     if (opts.submit) await locator.press("Enter", { timeout });
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    throw toAIFriendlyError(err, label);
   }
 }
 async function selectOptionViaPlaywright(opts) {
+  const resolved = requireRefOrSelector(opts.ref, opts.selector);
   if (!opts.values?.length) throw new Error("values are required");
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const page = await getRestoredPageForTarget(opts);
+  const label = resolved.ref ?? resolved.selector;
+  const locator = resolveLocator(page, resolved);
   try {
-    await refLocator(page, opts.ref).selectOption(opts.values, {
-      timeout: normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4)
-    });
+    await locator.selectOption(opts.values, { timeout: resolveInteractionTimeoutMs(opts.timeoutMs) });
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    throw toAIFriendlyError(err, label);
   }
 }
 async function dragViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const resolvedStart = requireRefOrSelector(opts.startRef, opts.startSelector);
+  const resolvedEnd = requireRefOrSelector(opts.endRef, opts.endSelector);
+  const page = await getRestoredPageForTarget(opts);
+  const startLocator = resolveLocator(page, resolvedStart);
+  const endLocator = resolveLocator(page, resolvedEnd);
+  const startLabel = resolvedStart.ref ?? resolvedStart.selector;
+  const endLabel = resolvedEnd.ref ?? resolvedEnd.selector;
   try {
-    await refLocator(page, opts.startRef).dragTo(refLocator(page, opts.endRef), {
-      timeout: normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4)
-    });
+    await startLocator.dragTo(endLocator, { timeout: resolveInteractionTimeoutMs(opts.timeoutMs) });
   } catch (err) {
-    throw toAIFriendlyError(err, `${opts.startRef} -> ${opts.endRef}`);
+    throw toAIFriendlyError(err, `${startLabel} -> ${endLabel}`);
   }
 }
 async function fillFormViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
-  const timeout = normalizeTimeoutMs(opts.timeoutMs, 8e3, 6e4);
+  const page = await getRestoredPageForTarget(opts);
+  const timeout = resolveInteractionTimeoutMs(opts.timeoutMs);
   for (const field of opts.fields) {
     const ref = field.ref.trim();
     const type = (typeof field.type === "string" ? field.type.trim() : "") || "text";
@@ -2029,21 +2902,18 @@ async function fillFormViaPlaywright(opts) {
   }
 }
 async function scrollIntoViewViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const resolved = requireRefOrSelector(opts.ref, opts.selector);
+  const page = await getRestoredPageForTarget(opts);
+  const label = resolved.ref ?? resolved.selector;
+  const locator = resolveLocator(page, resolved);
   try {
-    await refLocator(page, opts.ref).scrollIntoViewIfNeeded({
-      timeout: normalizeTimeoutMs(opts.timeoutMs, 2e4)
-    });
+    await locator.scrollIntoViewIfNeeded({ timeout: normalizeTimeoutMs(opts.timeoutMs, 2e4) });
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    throw toAIFriendlyError(err, label);
   }
 }
 async function highlightViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const page = await getRestoredPageForTarget(opts);
   try {
     await refLocator(page, opts.ref).highlight();
   } catch (err) {
@@ -2051,9 +2921,7 @@ async function highlightViaPlaywright(opts) {
   }
 }
 async function setInputFilesViaPlaywright(opts) {
-  const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
-  restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
+  const page = await getRestoredPageForTarget(opts);
   if (!opts.paths.length) throw new Error("paths are required");
   const inputRef = typeof opts.ref === "string" ? opts.ref.trim() : "";
   const element = typeof opts.element === "string" ? opts.element.trim() : "";
@@ -2246,13 +3114,18 @@ async function resizeViewportViaPlaywright(opts) {
 
 // src/actions/wait.ts
 var MAX_WAIT_TIME_MS = 3e4;
+function resolveBoundedDelayMs2(value, label, maxMs) {
+  const normalized = Math.floor(value ?? 0);
+  if (!Number.isFinite(normalized) || normalized < 0) throw new Error(`${label} must be >= 0`);
+  if (normalized > maxMs) throw new Error(`${label} exceeds maximum of ${maxMs}ms`);
+  return normalized;
+}
 async function waitForViaPlaywright(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
   ensurePageState(page);
   const timeout = normalizeTimeoutMs(opts.timeoutMs, 2e4);
   if (typeof opts.timeMs === "number" && Number.isFinite(opts.timeMs)) {
-    const bounded = Math.max(0, Math.min(MAX_WAIT_TIME_MS, Math.floor(opts.timeMs)));
-    await page.waitForTimeout(bounded);
+    await page.waitForTimeout(resolveBoundedDelayMs2(opts.timeMs, "wait timeMs", MAX_WAIT_TIME_MS));
   }
   if (opts.text) {
     await page.getByText(opts.text).first().waitFor({ state: "visible", timeout });
@@ -2414,55 +3287,106 @@ async function evaluateViaPlaywright(opts) {
     if (signal && abortListener) signal.removeEventListener("abort", abortListener);
   }
 }
+function createPageDownloadWaiter(page, timeoutMs) {
+  let done = false;
+  let timer;
+  let handler;
+  const cleanup = () => {
+    if (timer) clearTimeout(timer);
+    timer = void 0;
+    if (handler) {
+      page.off("download", handler);
+      handler = void 0;
+    }
+  };
+  return {
+    promise: new Promise((resolve2, reject) => {
+      handler = (download) => {
+        if (done) return;
+        done = true;
+        cleanup();
+        resolve2(download);
+      };
+      page.on("download", handler);
+      timer = setTimeout(() => {
+        if (done) return;
+        done = true;
+        cleanup();
+        reject(new Error("Timeout waiting for download"));
+      }, timeoutMs);
+    }),
+    cancel: () => {
+      if (done) return;
+      done = true;
+      cleanup();
+    }
+  };
+}
+async function saveDownloadPayload(download, outPath) {
+  await writeViaSiblingTempPath({
+    rootDir: path.dirname(outPath),
+    targetPath: outPath,
+    writeTemp: async (tempPath) => {
+      await download.saveAs(tempPath);
+    }
+  });
+  return {
+    url: download.url(),
+    suggestedFilename: download.suggestedFilename(),
+    path: outPath
+  };
+}
+async function awaitDownloadPayload(params) {
+  try {
+    const download = await params.waiter.promise;
+    if (params.state.armIdDownload !== params.armId) throw new Error("Download was superseded by another waiter");
+    return await saveDownloadPayload(download, params.outPath);
+  } catch (err) {
+    params.waiter.cancel();
+    throw err;
+  }
+}
 async function downloadViaPlaywright(opts) {
   await assertSafeOutputPath(opts.path, opts.allowedOutputRoots);
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
   const state = ensurePageState(page);
   restoreRoleRefsForTarget({ cdpUrl: opts.cdpUrl, targetId: opts.targetId, page });
   const timeout = normalizeTimeoutMs(opts.timeoutMs, 12e4);
-  const locator = refLocator(page, opts.ref);
+  const outPath = String(opts.path ?? "").trim();
+  if (!outPath) throw new Error("path is required");
   state.armIdDownload = bumpDownloadArmId();
+  const armId = state.armIdDownload;
+  const waiter = createPageDownloadWaiter(page, timeout);
   try {
-    const [download] = await Promise.all([
-      page.waitForEvent("download", { timeout }),
-      locator.click({ timeout })
-    ]);
-    const outPath = opts.path;
-    await writeViaSiblingTempPath({
-      rootDir: path.dirname(outPath),
-      targetPath: outPath,
-      writeTemp: async (tempPath) => {
-        await download.saveAs(tempPath);
-      }
-    });
-    return {
-      url: download.url(),
-      suggestedFilename: download.suggestedFilename(),
-      path: outPath
-    };
+    const locator = refLocator(page, opts.ref);
+    try {
+      await locator.click({ timeout });
+    } catch (err) {
+      throw toAIFriendlyError(err, opts.ref);
+    }
+    return await awaitDownloadPayload({ waiter, state, armId, outPath });
   } catch (err) {
-    throw toAIFriendlyError(err, opts.ref);
+    waiter.cancel();
+    throw err;
   }
 }
 async function waitForDownloadViaPlaywright(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
-  ensurePageState(page);
+  const state = ensurePageState(page);
   const timeout = normalizeTimeoutMs(opts.timeoutMs, 12e4);
-  const download = await page.waitForEvent("download", { timeout });
-  const savePath = opts.path ?? download.suggestedFilename();
-  await assertSafeOutputPath(savePath, opts.allowedOutputRoots);
-  await writeViaSiblingTempPath({
-    rootDir: path.dirname(savePath),
-    targetPath: savePath,
-    writeTemp: async (tempPath) => {
-      await download.saveAs(tempPath);
-    }
-  });
-  return {
-    url: download.url(),
-    suggestedFilename: download.suggestedFilename(),
-    path: savePath
-  };
+  state.armIdDownload = bumpDownloadArmId();
+  const armId = state.armIdDownload;
+  const waiter = createPageDownloadWaiter(page, timeout);
+  try {
+    const download = await waiter.promise;
+    if (state.armIdDownload !== armId) throw new Error("Download was superseded by another waiter");
+    const savePath = opts.path ?? download.suggestedFilename();
+    await assertSafeOutputPath(savePath, opts.allowedOutputRoots);
+    return await saveDownloadPayload(download, savePath);
+  } catch (err) {
+    waiter.cancel();
+    throw err;
+  }
 }
 async function emulateMediaViaPlaywright(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
@@ -2577,7 +3501,7 @@ async function setLocaleViaPlaywright(opts) {
 async function setOfflineViaPlaywright(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });
   ensurePageState(page);
-  await page.context().setOffline(opts.offline);
+  await page.context().setOffline(Boolean(opts.offline));
 }
 async function setTimezoneViaPlaywright(opts) {
   const page = await getPageForTargetId({ cdpUrl: opts.cdpUrl, targetId: opts.targetId });