effect-agent 0.1.0-beta.121 → 0.1.0-beta.123

package/dist/sandbox/ProtectedBrowser.d.mts

@@ -1,283 +0,0 @@
-import { InteractiveBrowserPolicy } from "./InteractiveBrowser.mjs";
-import { Context, Effect, Layer, Redacted, Schema, Scope } from "effect";
-declare namespace ProtectedBrowser_d_exports {
-  export { BrowserCredentialAccess, BrowserCredentialMaterial, BrowserReference, CardCredential, CredentialAccessError, CredentialAccessRequest, CredentialDispatch, CredentialFieldRole, CredentialKind, CredentialMilestone, CredentialObservationDecision, CredentialObservationGrant, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseAuthorization, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserAction, ProtectedBrowserCheckpoint, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserHandle, ProtectedBrowserNavigate, ProtectedBrowserObservation, ProtectedBrowserSession, ProtectedCleanup, ProtectedObservationState, UseCredential };
-}
-/** Canonical HTTPS origin, including a non-default port. Host grants match exactly. */
-export declare const CredentialOrigin: Schema.String;
-export declare const BrowserReference: Schema.String;
-export declare const CredentialKind: Schema.Literals<readonly ["login", "card"]>;
-export declare const CredentialFieldRole: Schema.Literals<readonly ["username", "password", "card-name", "card-number", "card-expiry", "card-expiry-month", "card-expiry-year", "card-security-code"]>;
-declare const CredentialTarget_base: Schema.Class<CredentialTarget, Schema.Struct<{
-  readonly topOrigin: Schema.String;
-  readonly frameOrigin: Schema.String;
-  readonly recipientOrigin: Schema.String;
-  readonly document: Schema.String;
-  readonly frame: Schema.String;
-  readonly form: Schema.String;
-}>, {}>;
-export declare class CredentialTarget extends CredentialTarget_base {}
-declare const ProtectedBrowserControl_base: Schema.Class<ProtectedBrowserControl, Schema.Struct<{
-  readonly ref: Schema.String;
-  readonly target: typeof CredentialTarget;
-  readonly role: Schema.Union<readonly [Schema.Literals<readonly ["username", "password", "card-name", "card-number", "card-expiry", "card-expiry-month", "card-expiry-year", "card-security-code"]>, Schema.Literals<readonly ["text", "select", "radio", "checkbox", "submit", "link", "button", "unsupported"]>]>;
-  readonly label: Schema.String;
-  /** Current native radio/checkbox state; field values are never included. */
-  readonly checked: Schema.optionalKey<Schema.Boolean>;
-  /**
-   * Ordinary select choices only; credential choices and raw option values remain private.
-   * Omitted choices or labels beyond the bounds set the observation's truncated flag.
-   */
-  readonly options: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-    readonly label: Schema.String;
-    readonly selected: Schema.Boolean;
-    readonly disabled: Schema.Boolean;
-  }>>>;
-  /** Resolved HTTPS destination for a native link; target.recipientOrigin is its origin. */
-  readonly url: Schema.optionalKey<Schema.NonEmptyString>;
-}>, {}>;
-export declare class ProtectedBrowserControl extends ProtectedBrowserControl_base {}
-declare const ProtectedBrowserObservation_base: Schema.Class<ProtectedBrowserObservation, Schema.Struct<{
-  readonly document: Schema.String;
-  readonly topOrigin: Schema.String;
-  readonly text: Schema.String;
-  readonly controls: Schema.$Array<typeof ProtectedBrowserControl>;
-  readonly truncated: Schema.Boolean;
-  readonly observation: Schema.Literals<readonly ["before-exposure", "approved-after-exposure"]>;
-}>, {}>;
-export declare class ProtectedBrowserObservation extends ProtectedBrowserObservation_base {}
-declare const CredentialOfferMetadata_base: Schema.Class<CredentialOfferMetadata, Schema.Struct<{
-  readonly label: Schema.String;
-  readonly brand: Schema.optionalKey<Schema.String>;
-  readonly lastFour: Schema.optionalKey<Schema.String>;
-  /** Plaintext metadata disclosed only when the host authorizes listing this offer. */
-  readonly billingAddress: Schema.optionalKey<Schema.Struct<{
-    readonly name: Schema.optionalKey<Schema.String>;
-    readonly line1: Schema.optionalKey<Schema.String>;
-    readonly line2: Schema.optionalKey<Schema.String>;
-    readonly city: Schema.optionalKey<Schema.String>;
-    readonly region: Schema.optionalKey<Schema.String>;
-    readonly postalCode: Schema.optionalKey<Schema.String>;
-    readonly country: Schema.optionalKey<Schema.String>;
-  }>>;
-}>, {}>;
-export declare class CredentialOfferMetadata extends CredentialOfferMetadata_base {}
-declare const CredentialOffer_base: Schema.Class<CredentialOffer, Schema.Struct<{
-  readonly ref: Schema.String;
-  readonly kind: Schema.Literals<readonly ["login", "card"]>;
-  readonly metadata: typeof CredentialOfferMetadata;
-}>, {}>;
-export declare class CredentialOffer extends CredentialOffer_base {}
-declare const ListCredentialOffers_base: Schema.Class<ListCredentialOffers, Schema.Struct<{
-  readonly kind: Schema.Literals<readonly ["login", "card"]>;
-  readonly target: Schema.String;
-}>, {}>;
-export declare class ListCredentialOffers extends ListCredentialOffers_base {}
-declare const UseCredential_base: Schema.Class<UseCredential, Schema.Struct<{
-  readonly offer: Schema.String;
-  readonly fields: Schema.$Array<Schema.Struct<{
-    readonly ref: Schema.String;
-    readonly role: Schema.Literals<readonly ["username", "password", "card-name", "card-number", "card-expiry", "card-expiry-month", "card-expiry-year", "card-security-code"]>;
-  }>>;
-  readonly submit: Schema.optionalKey<Schema.String>;
-}>, {}>;
-export declare class UseCredential extends UseCredential_base {}
-declare const ProtectedBrowserNavigate_base: Schema.Class<ProtectedBrowserNavigate, Schema.Struct<{
-  readonly url: Schema.String;
-}>, {}>;
-export declare class ProtectedBrowserNavigate extends ProtectedBrowserNavigate_base {}
-declare const ProtectedBrowserClick_base: Schema.Class<ProtectedBrowserClick, Schema.Struct<{
-  readonly ref: Schema.String;
-}>, {}>;
-export declare class ProtectedBrowserClick extends ProtectedBrowserClick_base {}
-declare const ProtectedBrowserFill_base: Schema.Class<ProtectedBrowserFill, Schema.Struct<{
-  readonly ref: Schema.String;
-  readonly value: Schema.String;
-}>, {}>;
-/**
- * Non-secret text for an ordinary text control or native single select in the current observation.
- * Never pass credential material. Credential roles, including username, require useCredential.
- * Selects match one enabled option's exact observed label. Empty text clears text controls.
- */
-export declare class ProtectedBrowserFill extends ProtectedBrowserFill_base {}
-export declare const CredentialDispatch: Schema.Literals<readonly ["not-dispatched", "possibly-dispatched", "dispatched"]>;
-export declare const CredentialMilestone: Schema.Literals<readonly ["none", "partial-fill", "filled", "submission-dispatched"]>;
-export declare const ProtectedObservationState: Schema.Literals<readonly ["before-exposure", "protected", "approved-after-exposure", "closed"]>;
-export declare const ProtectedCleanup: Schema.Literals<readonly ["not-requested", "confirmed", "unconfirmed"]>;
-declare const ProtectedBrowserError_base: Schema.Class<ProtectedBrowserError, Schema.TaggedStruct<"ProtectedBrowserError", {
-  readonly dispatch: Schema.Literals<readonly ["not-dispatched", "possibly-dispatched", "dispatched"]>;
-  readonly milestone: Schema.Literals<readonly ["none", "partial-fill", "filled", "submission-dispatched"]>;
-  readonly observation: Schema.Literals<readonly ["before-exposure", "protected", "approved-after-exposure", "closed"]>;
-  readonly cleanup: Schema.Literals<readonly ["not-requested", "confirmed", "unconfirmed"]>;
-  readonly reason: Schema.Literals<readonly ["denied", "missing-credential", "stale-reference", "unsupported", "needs-attention", "busy", "closed", "limit", "timeout", "provider", "resolver", "outcome-unknown", "observation-blocked"]>;
-}>, import("effect/Cause").YieldableError>;
-/** No foreign message/cause or page data may enter this failure. Closure does not undo dispatch. */
-export declare class ProtectedBrowserError extends ProtectedBrowserError_base {}
-declare const CredentialUseResult_base: Schema.Class<CredentialUseResult, Schema.Struct<{
-  readonly dispatch: Schema.Literals<readonly ["not-dispatched", "possibly-dispatched", "dispatched"]>;
-  readonly milestone: Schema.Literals<readonly ["none", "partial-fill", "filled", "submission-dispatched"]>;
-  readonly observation: Schema.Literals<readonly ["before-exposure", "protected", "approved-after-exposure", "closed"]>;
-  readonly cleanup: Schema.Literals<readonly ["not-requested", "confirmed", "unconfirmed"]>;
-  readonly authentication: Schema.Literal<"unverified">;
-}>, {}>;
-export declare class CredentialUseResult extends CredentialUseResult_base {}
-/** Host-only material. Never encode it into Tool results, checkpoints, or storage. */
-export declare const LoginCredential: Schema.TaggedStruct<"LoginCredential", {
-  readonly username: Schema.Redacted<Schema.NonEmptyString>;
-  readonly password: Schema.Redacted<Schema.NonEmptyString>;
-}>;
-/** Security codes are transient, never persisted. Dummy tests are not PCI compliance evidence. */
-export declare const CardCredential: Schema.TaggedStruct<"CardCredential", {
-  readonly name: Schema.Redacted<Schema.NonEmptyString>;
-  readonly number: Schema.Redacted<Schema.String>;
-  readonly expiry: Schema.Redacted<Schema.NonEmptyString>;
-  readonly expiryMonth: Schema.Redacted<Schema.String>;
-  readonly expiryYear: Schema.Redacted<Schema.String>;
-  readonly securityCode: Schema.optionalKey<Schema.Redacted<Schema.String>>;
-}>;
-export declare const BrowserCredentialMaterial: Schema.Union<readonly [Schema.TaggedStruct<"LoginCredential", {
-  readonly username: Schema.Redacted<Schema.NonEmptyString>;
-  readonly password: Schema.Redacted<Schema.NonEmptyString>;
-}>, Schema.TaggedStruct<"CardCredential", {
-  readonly name: Schema.Redacted<Schema.NonEmptyString>;
-  readonly number: Schema.Redacted<Schema.String>;
-  readonly expiry: Schema.Redacted<Schema.NonEmptyString>;
-  readonly expiryMonth: Schema.Redacted<Schema.String>;
-  readonly expiryYear: Schema.Redacted<Schema.String>;
-  readonly securityCode: Schema.optionalKey<Schema.Redacted<Schema.String>>;
-}>]>;
-export type BrowserCredentialMaterial = typeof BrowserCredentialMaterial.Type;
-declare const CredentialAccessError_base: Schema.Class<CredentialAccessError, Schema.TaggedStruct<"CredentialAccessError", {
-  readonly reason: Schema.Literals<readonly ["denied", "missing-credential", "needs-attention", "busy", "resolver"]>;
-}>, import("effect/Cause").YieldableError>;
-/** Use busy for transient host-authority unavailability; return promptly without waiting for Tool completion. */
-export declare class CredentialAccessError extends CredentialAccessError_base {}
-export interface CredentialAccessRequest {
-  readonly caller: Redacted.Redacted<string>;
-  readonly kind: typeof CredentialKind.Type;
-  readonly target: CredentialTarget;
-}
-export interface CredentialUseAuthorization extends CredentialAccessRequest {
-  readonly key: Redacted.Redacted<string>;
-  readonly roles: ReadonlyArray<typeof CredentialFieldRole.Type>;
-  readonly submit: boolean;
-}
-/** Exact current action proposed to host authority; no ordinary fill value or secret is included. */
-export declare const ProtectedBrowserAction: Schema.Union<readonly [Schema.TaggedStruct<"Navigate", {
-  readonly url: Schema.String;
-}>, Schema.TaggedStruct<"Fill", {
-  readonly ref: Schema.String;
-  readonly target: typeof CredentialTarget;
-  readonly role: Schema.Literals<readonly ["text", "select"]>;
-}>, Schema.TaggedStruct<"Click", {
-  readonly ref: Schema.String;
-  readonly target: typeof CredentialTarget;
-  readonly role: Schema.Literals<readonly ["button", "radio", "checkbox"]>;
-}>, Schema.TaggedStruct<"Click", {
-  readonly ref: Schema.String;
-  readonly target: typeof CredentialTarget;
-  readonly role: Schema.Literal<"link">;
-  readonly url: Schema.NonEmptyString;
-}>, Schema.TaggedStruct<"Submit", {
-  readonly ref: Schema.String;
-  readonly target: typeof CredentialTarget;
-}>]>;
-export type ProtectedBrowserAction = typeof ProtectedBrowserAction.Type;
-declare const CredentialObservationGrant_base: Schema.Class<CredentialObservationGrant, Schema.Struct<{
-  readonly decision: Schema.Literal<"trust-recipient-no-credential-echo">;
-  readonly origins: Schema.$Array<Schema.String>;
-}>, {}>;
-/**
- * Trust only these current observation origins. The top origin must be included. Other frames
- * supply neither text nor usable refs. This does not expand network policy or credential grants.
- */
-export declare class CredentialObservationGrant extends CredentialObservationGrant_base {}
-export declare const CredentialObservationDecision: Schema.Union<readonly [Schema.Literals<readonly ["trust-recipient-no-credential-echo", "deny"]>, typeof CredentialObservationGrant]>;
-declare const BrowserCredentialAccess_base: Context.ServiceClass<BrowserCredentialAccess, "@effect-agent/sandbox/BrowserCredentialAccess", {
-  readonly caller: Effect.Effect<Redacted.Redacted<string>, CredentialAccessError>;
-  readonly list: (request: CredentialAccessRequest) => Effect.Effect<ReadonlyArray<{
-    readonly key: Redacted.Redacted<string>;
-    readonly metadata: CredentialOfferMetadata;
-  }>, CredentialAccessError>;
-  readonly authorize: (request: CredentialUseAuthorization) => Effect.Effect<void, CredentialAccessError>;
-  readonly resolve: (request: CredentialUseAuthorization) => Effect.Effect<BrowserCredentialMaterial, CredentialAccessError>;
-  /**
-   * Optional host authority for every ordinary navigate/fill/click, mandatory for Submit.
-   * Recheck caller ownership, user intent, current submission/continuation grants for ALL prior
-   * exposures, and this exact target. Exposures may come from separate credential frames/forms.
-   * Without this hook, ordinary actions retain their observation gate and Submit is unsupported.
-   * Observation trust alone never authorizes a new native submit. Called again on each action;
-   * approvals are not cached. The pass revalidates caller and target after this hook returns.
-   */
-  readonly authorizeAction?: (request: {
-    readonly caller: Redacted.Redacted<string>;
-    readonly action: ProtectedBrowserAction;
-    readonly exposures: ReadonlyArray<CredentialTarget>;
-  }) => Effect.Effect<void, CredentialAccessError>;
-  /**
-   * Explicitly trust all observed destinations not to echo credentials, including transformed
-   * or delayed echoes. Called for every observation and non-secret action after exposure.
-   * The string grant trusts all current observed origins. Return CredentialObservationGrant
-   * to select an explicit subset instead. This is recipient trust, not submission authority,
-   * a universal secrecy guarantee, or a login verifier.
-   */
-  readonly observation: (request: {
-    readonly caller: Redacted.Redacted<string>;
-    readonly topOrigin: typeof CredentialOrigin.Type;
-    readonly frameOrigins: ReadonlyArray<typeof CredentialOrigin.Type>;
-    readonly exposures: ReadonlyArray<CredentialTarget>;
-    /** A human may have entered secrets; explicitly authorize observation even with no vault exposures. */
-    readonly humanExposure?: boolean;
-    /** Origins present when the human received control, retained across durable suspension. */
-    readonly humanOrigins?: ReadonlyArray<typeof CredentialOrigin.Type>;
-  }) => Effect.Effect<typeof CredentialObservationDecision.Type, CredentialAccessError>;
-}>;
-/**
- * Host-only vault and grant port. Derive caller from the authorized invocation, never Tool input.
- * Recheck account ownership, current grants, merchant/frame/recipient pairing, and any side
- * effects caused by filling. Listing authorizes metadata only. Grant checks never widen network
- * policy. Implementations must not log material or put it in defects/traces.
- */
-export declare class BrowserCredentialAccess extends BrowserCredentialAccess_base {}
-declare const ProtectedBrowserCheckpoint_base: Schema.Class<ProtectedBrowserCheckpoint, Schema.Struct<{
-  readonly policy: typeof InteractiveBrowserPolicy;
-  readonly startedAt: Schema.Natural;
-  readonly actions: Schema.Natural;
-  readonly exposures: Schema.$Array<typeof CredentialTarget>;
-  readonly humanExposure: Schema.Boolean;
-  readonly humanOrigins: Schema.$Array<Schema.String>;
-  readonly dispatch: Schema.Literals<readonly ["not-dispatched", "possibly-dispatched", "dispatched"]>;
-  readonly milestone: Schema.Literals<readonly ["none", "partial-fill", "filled", "submission-dispatched"]>;
-}>, {}>;
-/**
- * Host-only suspended-pass state. Persist with the host's fenced controller receipt, never in
- * a Tool result. It contains no credential material, offers, DOM references usable after resume,
- * cookies, page text, or provider capability. A host must restore its own credential exposure
- * ledger as well. The original deadline and action allowance include time spent with the human.
- */
-export declare class ProtectedBrowserCheckpoint extends ProtectedBrowserCheckpoint_base {}
-/** A private ephemeral pass. No selectors, JavaScript, screenshots, viewer, or provider identity. */
-export interface ProtectedBrowserHandle {
-  readonly navigate: (request: ProtectedBrowserNavigate) => Effect.Effect<void, ProtectedBrowserError>;
-  readonly observe: Effect.Effect<ProtectedBrowserObservation, ProtectedBrowserError>;
-  readonly click: (request: ProtectedBrowserClick) => Effect.Effect<void, ProtectedBrowserError>;
-  /** Uses the same lock, budgets, current-target checks and post-exposure grant as other actions. */
-  readonly fill: (request: ProtectedBrowserFill) => Effect.Effect<void, ProtectedBrowserError>;
-  readonly listCredentialOffers: (request: ListCredentialOffers) => Effect.Effect<ReadonlyArray<CredentialOffer>, ProtectedBrowserError>;
-  readonly useCredential: (request: UseCredential) => Effect.Effect<CredentialUseResult, ProtectedBrowserError>;
-  readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;
-}
-declare const ProtectedBrowser_base: Context.ServiceClass<ProtectedBrowser, "@effect-agent/sandbox/ProtectedBrowser", {
-  readonly open: (policy: InteractiveBrowserPolicy) => Effect.Effect<ProtectedBrowserHandle, ProtectedBrowserError, Scope.Scope | BrowserCredentialAccess>;
-}>;
-export declare class ProtectedBrowser extends ProtectedBrowser_base {}
-declare const ProtectedBrowserSession_base: Context.ServiceClass<ProtectedBrowserSession, "@effect-agent/sandbox/ProtectedBrowserSession", {
-  readonly get: Effect.Effect<ProtectedBrowserHandle, ProtectedBrowserError>;
-}>;
-/** Build once in an execution/Attempt Layer. Acquires lazily and shares one pass across Tools. */
-export declare class ProtectedBrowserSession extends ProtectedBrowserSession_base {
-  static layer(policy: InteractiveBrowserPolicy): Layer.Layer<ProtectedBrowserSession, never, BrowserCredentialAccess | ProtectedBrowser>;
-}
-//#endregion
-export { ProtectedBrowser_d_exports as t };
-//# sourceMappingURL=ProtectedBrowser.d.mts.map

package/dist/sandbox/ProtectedBrowser.mjs

@@ -1,298 +0,0 @@
-import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
-import { InteractiveBrowserHost, InteractiveBrowserPolicy, InteractiveBrowserTargetUrl } from "./InteractiveBrowser.mjs";
-import { Context, Effect, Layer, Schema, Scope } from "effect";
-//#region src/sandbox/ProtectedBrowser.ts
-var ProtectedBrowser_exports = /* @__PURE__ */ __exportAll({
-	BrowserCredentialAccess: () => BrowserCredentialAccess,
-	BrowserCredentialMaterial: () => BrowserCredentialMaterial,
-	BrowserReference: () => BrowserReference,
-	CardCredential: () => CardCredential,
-	CredentialAccessError: () => CredentialAccessError,
-	CredentialDispatch: () => CredentialDispatch,
-	CredentialFieldRole: () => CredentialFieldRole,
-	CredentialKind: () => CredentialKind,
-	CredentialMilestone: () => CredentialMilestone,
-	CredentialObservationDecision: () => CredentialObservationDecision,
-	CredentialObservationGrant: () => CredentialObservationGrant,
-	CredentialOffer: () => CredentialOffer,
-	CredentialOfferMetadata: () => CredentialOfferMetadata,
-	CredentialOrigin: () => CredentialOrigin,
-	CredentialTarget: () => CredentialTarget,
-	CredentialUseResult: () => CredentialUseResult,
-	ListCredentialOffers: () => ListCredentialOffers,
-	LoginCredential: () => LoginCredential,
-	ProtectedBrowser: () => ProtectedBrowser,
-	ProtectedBrowserAction: () => ProtectedBrowserAction,
-	ProtectedBrowserCheckpoint: () => ProtectedBrowserCheckpoint,
-	ProtectedBrowserClick: () => ProtectedBrowserClick,
-	ProtectedBrowserControl: () => ProtectedBrowserControl,
-	ProtectedBrowserError: () => ProtectedBrowserError,
-	ProtectedBrowserFill: () => ProtectedBrowserFill,
-	ProtectedBrowserNavigate: () => ProtectedBrowserNavigate,
-	ProtectedBrowserObservation: () => ProtectedBrowserObservation,
-	ProtectedBrowserSession: () => ProtectedBrowserSession,
-	ProtectedCleanup: () => ProtectedCleanup,
-	ProtectedObservationState: () => ProtectedObservationState,
-	UseCredential: () => UseCredential
-});
-/** Canonical HTTPS origin, including a non-default port. Host grants match exactly. */
-const CredentialOrigin = Schema.String.check(Schema.makeFilter((value) => value.startsWith("https://") && Schema.is(InteractiveBrowserHost)(value.slice(8))));
-const BrowserReference = Schema.String.check(Schema.isUUID());
-const CredentialKind = Schema.Literals(["login", "card"]);
-const CredentialFieldRole = Schema.Literals([
-	"username",
-	"password",
-	"card-name",
-	"card-number",
-	"card-expiry",
-	"card-expiry-month",
-	"card-expiry-year",
-	"card-security-code"
-]);
-const Label = Schema.String.check(Schema.isMaxLength(200));
-const LinkUrl = InteractiveBrowserTargetUrl.check(Schema.isStartsWith("https://"));
-var CredentialTarget = class extends Schema.Class("CredentialTarget")({
-	topOrigin: CredentialOrigin,
-	frameOrigin: CredentialOrigin,
-	recipientOrigin: CredentialOrigin,
-	document: BrowserReference,
-	frame: BrowserReference,
-	form: BrowserReference
-}) {};
-var ProtectedBrowserControl = class extends Schema.Class("ProtectedBrowserControl")({
-	ref: BrowserReference,
-	target: CredentialTarget,
-	role: Schema.Union([CredentialFieldRole, Schema.Literals([
-		"text",
-		"select",
-		"radio",
-		"checkbox",
-		"submit",
-		"link",
-		"button",
-		"unsupported"
-	])]),
-	label: Label,
-	/** Current native radio/checkbox state; field values are never included. */
-	checked: Schema.optionalKey(Schema.Boolean),
-	/**
-	* Ordinary select choices only; credential choices and raw option values remain private.
-	* Omitted choices or labels beyond the bounds set the observation's truncated flag.
-	*/
-	options: Schema.optionalKey(Schema.Array(Schema.Struct({
-		label: Label,
-		selected: Schema.Boolean,
-		disabled: Schema.Boolean
-	})).check(Schema.isMaxLength(256))),
-	/** Resolved HTTPS destination for a native link; target.recipientOrigin is its origin. */
-	url: Schema.optionalKey(LinkUrl)
-}) {};
-var ProtectedBrowserObservation = class extends Schema.Class("ProtectedBrowserObservation")({
-	document: BrowserReference,
-	topOrigin: CredentialOrigin,
-	text: Schema.String.check(Schema.isMaxLength(65536)),
-	controls: Schema.Array(ProtectedBrowserControl).check(Schema.isMaxLength(64)),
-	truncated: Schema.Boolean,
-	observation: Schema.Literals(["before-exposure", "approved-after-exposure"])
-}) {};
-var CredentialOfferMetadata = class extends Schema.Class("CredentialOfferMetadata")({
-	label: Label,
-	brand: Schema.optionalKey(Label),
-	lastFour: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^\d{4}$/))),
-	/** Plaintext metadata disclosed only when the host authorizes listing this offer. */
-	billingAddress: Schema.optionalKey(Schema.Struct({
-		name: Schema.optionalKey(Label),
-		line1: Schema.optionalKey(Label),
-		line2: Schema.optionalKey(Label),
-		city: Schema.optionalKey(Label),
-		region: Schema.optionalKey(Label),
-		postalCode: Schema.optionalKey(Label),
-		country: Schema.optionalKey(Label)
-	}))
-}) {};
-var CredentialOffer = class extends Schema.Class("CredentialOffer")({
-	ref: BrowserReference,
-	kind: CredentialKind,
-	metadata: CredentialOfferMetadata
-}) {};
-var ListCredentialOffers = class extends Schema.Class("ListCredentialOffers")({
-	kind: CredentialKind,
-	target: BrowserReference
-}) {};
-var UseCredential = class extends Schema.Class("UseCredential")({
-	offer: BrowserReference,
-	fields: Schema.Array(Schema.Struct({
-		ref: BrowserReference,
-		role: CredentialFieldRole
-	})).check(Schema.isMinLength(1), Schema.isMaxLength(8)),
-	submit: Schema.optionalKey(BrowserReference)
-}) {};
-var ProtectedBrowserNavigate = class extends Schema.Class("ProtectedBrowserNavigate")({ url: Schema.String.check(Schema.isMaxLength(8192)) }) {};
-var ProtectedBrowserClick = class extends Schema.Class("ProtectedBrowserClick")({ ref: BrowserReference }) {};
-/**
-* Non-secret text for an ordinary text control or native single select in the current observation.
-* Never pass credential material. Credential roles, including username, require useCredential.
-* Selects match one enabled option's exact observed label. Empty text clears text controls.
-*/
-var ProtectedBrowserFill = class extends Schema.Class("ProtectedBrowserFill")(Schema.Struct({
-	ref: BrowserReference,
-	value: Schema.String.check(Schema.isMaxLength(8192))
-})) {};
-const CredentialDispatch = Schema.Literals([
-	"not-dispatched",
-	"possibly-dispatched",
-	"dispatched"
-]);
-const CredentialMilestone = Schema.Literals([
-	"none",
-	"partial-fill",
-	"filled",
-	"submission-dispatched"
-]);
-const ProtectedObservationState = Schema.Literals([
-	"before-exposure",
-	"protected",
-	"approved-after-exposure",
-	"closed"
-]);
-const ProtectedCleanup = Schema.Literals([
-	"not-requested",
-	"confirmed",
-	"unconfirmed"
-]);
-const Evidence = {
-	dispatch: CredentialDispatch,
-	milestone: CredentialMilestone,
-	observation: ProtectedObservationState,
-	cleanup: ProtectedCleanup
-};
-/** No foreign message/cause or page data may enter this failure. Closure does not undo dispatch. */
-var ProtectedBrowserError = class extends Schema.TaggedError()("ProtectedBrowserError", {
-	reason: Schema.Literals([
-		"denied",
-		"missing-credential",
-		"stale-reference",
-		"unsupported",
-		"needs-attention",
-		"busy",
-		"closed",
-		"limit",
-		"timeout",
-		"provider",
-		"resolver",
-		"outcome-unknown",
-		"observation-blocked"
-	]),
-	...Evidence
-}) {};
-var CredentialUseResult = class extends Schema.Class("CredentialUseResult")({
-	...Evidence,
-	authentication: Schema.Literal("unverified")
-}) {};
-const SecretText = Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(1024)));
-/** Host-only material. Never encode it into Tool results, checkpoints, or storage. */
-const LoginCredential = Schema.TaggedStruct("LoginCredential", {
-	username: SecretText,
-	password: SecretText
-});
-/** Security codes are transient, never persisted. Dummy tests are not PCI compliance evidence. */
-const CardCredential = Schema.TaggedStruct("CardCredential", {
-	name: SecretText,
-	number: Schema.Redacted(Schema.String.check(Schema.isPattern(/^\d{12,19}$/))),
-	expiry: SecretText,
-	expiryMonth: Schema.Redacted(Schema.String.check(Schema.isPattern(/^(0[1-9]|1[0-2])$/))),
-	expiryYear: Schema.Redacted(Schema.String.check(Schema.isPattern(/^\d{4}$/))),
-	securityCode: Schema.optionalKey(Schema.Redacted(Schema.String.check(Schema.isPattern(/^\d{3,4}$/))))
-});
-const BrowserCredentialMaterial = Schema.Union([LoginCredential, CardCredential]);
-/** Use busy for transient host-authority unavailability; return promptly without waiting for Tool completion. */
-var CredentialAccessError = class extends Schema.TaggedError()("CredentialAccessError", { reason: Schema.Literals([
-	"denied",
-	"missing-credential",
-	"needs-attention",
-	"busy",
-	"resolver"
-]) }) {};
-/** Exact current action proposed to host authority; no ordinary fill value or secret is included. */
-const ProtectedBrowserAction = Schema.Union([
-	Schema.TaggedStruct("Navigate", { url: ProtectedBrowserNavigate.fields.url }),
-	Schema.TaggedStruct("Fill", {
-		ref: BrowserReference,
-		target: CredentialTarget,
-		role: Schema.Literals(["text", "select"])
-	}),
-	Schema.TaggedStruct("Click", {
-		ref: BrowserReference,
-		target: CredentialTarget,
-		role: Schema.Literals([
-			"button",
-			"radio",
-			"checkbox"
-		])
-	}),
-	Schema.TaggedStruct("Click", {
-		ref: BrowserReference,
-		target: CredentialTarget,
-		role: Schema.Literal("link"),
-		url: LinkUrl
-	}),
-	Schema.TaggedStruct("Submit", {
-		ref: BrowserReference,
-		target: CredentialTarget
-	})
-]);
-/**
-* Trust only these current observation origins. The top origin must be included. Other frames
-* supply neither text nor usable refs. This does not expand network policy or credential grants.
-*/
-var CredentialObservationGrant = class extends Schema.Class("CredentialObservationGrant")({
-	decision: Schema.Literal("trust-recipient-no-credential-echo"),
-	origins: Schema.Array(CredentialOrigin).check(Schema.isMinLength(1), Schema.isMaxLength(16), Schema.isUnique())
-}) {};
-const CredentialObservationDecision = Schema.Union([Schema.Literals(["trust-recipient-no-credential-echo", "deny"]), CredentialObservationGrant]);
-/**
-* Host-only vault and grant port. Derive caller from the authorized invocation, never Tool input.
-* Recheck account ownership, current grants, merchant/frame/recipient pairing, and any side
-* effects caused by filling. Listing authorizes metadata only. Grant checks never widen network
-* policy. Implementations must not log material or put it in defects/traces.
-*/
-var BrowserCredentialAccess = class extends Context.Service()("@effect-agent/sandbox/BrowserCredentialAccess") {};
-/**
-* Host-only suspended-pass state. Persist with the host's fenced controller receipt, never in
-* a Tool result. It contains no credential material, offers, DOM references usable after resume,
-* cookies, page text, or provider capability. A host must restore its own credential exposure
-* ledger as well. The original deadline and action allowance include time spent with the human.
-*/
-var ProtectedBrowserCheckpoint = class extends Schema.Class("ProtectedBrowserCheckpoint")({
-	policy: InteractiveBrowserPolicy,
-	startedAt: Schema.Natural,
-	actions: Schema.Natural,
-	exposures: Schema.Array(CredentialTarget).check(Schema.isMaxLength(1e3)),
-	humanExposure: Schema.Boolean,
-	humanOrigins: Schema.Array(CredentialOrigin).check(Schema.isMaxLength(16)),
-	dispatch: CredentialDispatch,
-	milestone: CredentialMilestone
-}) {};
-var ProtectedBrowser = class extends Context.Service()("@effect-agent/sandbox/ProtectedBrowser") {};
-/** Build once in an execution/Attempt Layer. Acquires lazily and shares one pass across Tools. */
-var ProtectedBrowserSession = class extends Context.Service()("@effect-agent/sandbox/ProtectedBrowserSession") {
-	static layer(policy) {
-		return Layer.effect(this)(Effect.gen(function* () {
-			const browser = yield* ProtectedBrowser;
-			const access = yield* BrowserCredentialAccess;
-			const scope = yield* Effect.scope;
-			const cached = yield* Effect.cached(browser.open(policy).pipe(Effect.provideService(BrowserCredentialAccess, access), Effect.provideService(Scope.Scope, scope)));
-			return { get: Effect.suspend(() => scope.state._tag === "Closed" ? Effect.fail(new ProtectedBrowserError({
-				reason: "closed",
-				dispatch: "not-dispatched",
-				milestone: "none",
-				observation: "closed",
-				cleanup: "not-requested"
-			})) : cached) };
-		}));
-	}
-};
-//#endregion
-export { BrowserCredentialAccess, BrowserCredentialMaterial, BrowserReference, CardCredential, CredentialAccessError, CredentialDispatch, CredentialFieldRole, CredentialKind, CredentialMilestone, CredentialObservationDecision, CredentialObservationGrant, CredentialOffer, CredentialOfferMetadata, CredentialOrigin, CredentialTarget, CredentialUseResult, ListCredentialOffers, LoginCredential, ProtectedBrowser, ProtectedBrowserAction, ProtectedBrowserCheckpoint, ProtectedBrowserClick, ProtectedBrowserControl, ProtectedBrowserError, ProtectedBrowserFill, ProtectedBrowserNavigate, ProtectedBrowserObservation, ProtectedBrowserSession, ProtectedCleanup, ProtectedObservationState, UseCredential, ProtectedBrowser_exports as t };
-
-//# sourceMappingURL=ProtectedBrowser.mjs.map

package/dist/sandbox/ProtectedBrowser.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ProtectedBrowser.mjs","names":[],"sources":["../../src/sandbox/ProtectedBrowser.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema, Scope, type Redacted } from \"effect\";\n\nimport {\n  InteractiveBrowserHost,\n  InteractiveBrowserTargetUrl,\n  InteractiveBrowserPolicy,\n} from \"./InteractiveBrowser.ts\";\n\n/** Canonical HTTPS origin, including a non-default port. Host grants match exactly. */\nexport const CredentialOrigin = Schema.String.check(\n  Schema.makeFilter(\n    (value) => value.startsWith(\"https://\") && Schema.is(InteractiveBrowserHost)(value.slice(8)),\n  ),\n);\n\nexport const BrowserReference = Schema.String.check(Schema.isUUID());\nexport const CredentialKind = Schema.Literals([\"login\", \"card\"]);\n\nexport const CredentialFieldRole = Schema.Literals([\n  \"username\",\n  \"password\",\n  \"card-name\",\n  \"card-number\",\n  \"card-expiry\",\n  \"card-expiry-month\",\n  \"card-expiry-year\",\n  \"card-security-code\",\n]);\n\nconst Label = Schema.String.check(Schema.isMaxLength(200));\nconst LinkUrl = InteractiveBrowserTargetUrl.check(Schema.isStartsWith(\"https://\"));\n\nexport class CredentialTarget extends Schema.Class<CredentialTarget>(\"CredentialTarget\")({\n  topOrigin: CredentialOrigin,\n  frameOrigin: CredentialOrigin,\n  recipientOrigin: CredentialOrigin,\n  document: BrowserReference,\n  frame: BrowserReference,\n  form: BrowserReference,\n}) {}\n\nexport class ProtectedBrowserControl extends Schema.Class<ProtectedBrowserControl>(\n  \"ProtectedBrowserControl\",\n)({\n  ref: BrowserReference,\n  target: CredentialTarget,\n  role: Schema.Union([\n    CredentialFieldRole,\n    Schema.Literals([\n      \"text\",\n      \"select\",\n      \"radio\",\n      \"checkbox\",\n      \"submit\",\n      \"link\",\n      \"button\",\n      \"unsupported\",\n    ]),\n  ]),\n  label: Label,\n  /** Current native radio/checkbox state; field values are never included. */\n  checked: Schema.optionalKey(Schema.Boolean),\n  /**\n   * Ordinary select choices only; credential choices and raw option values remain private.\n   * Omitted choices or labels beyond the bounds set the observation's truncated flag.\n   */\n  options: Schema.optionalKey(\n    Schema.Array(\n      Schema.Struct({ label: Label, selected: Schema.Boolean, disabled: Schema.Boolean }),\n    ).check(Schema.isMaxLength(256)),\n  ),\n  /** Resolved HTTPS destination for a native link; target.recipientOrigin is its origin. */\n  url: Schema.optionalKey(LinkUrl),\n}) {}\n\nexport class ProtectedBrowserObservation extends Schema.Class<ProtectedBrowserObservation>(\n  \"ProtectedBrowserObservation\",\n)({\n  document: BrowserReference,\n  topOrigin: CredentialOrigin,\n  text: Schema.String.check(Schema.isMaxLength(64 * 1024)),\n  controls: Schema.Array(ProtectedBrowserControl).check(Schema.isMaxLength(64)),\n  truncated: Schema.Boolean,\n  observation: Schema.Literals([\"before-exposure\", \"approved-after-exposure\"]),\n}) {}\n\nexport class CredentialOfferMetadata extends Schema.Class<CredentialOfferMetadata>(\n  \"CredentialOfferMetadata\",\n)({\n  label: Label,\n  brand: Schema.optionalKey(Label),\n  lastFour: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^\\d{4}$/))),\n  /** Plaintext metadata disclosed only when the host authorizes listing this offer. */\n  billingAddress: Schema.optionalKey(\n    Schema.Struct({\n      name: Schema.optionalKey(Label),\n      line1: Schema.optionalKey(Label),\n      line2: Schema.optionalKey(Label),\n      city: Schema.optionalKey(Label),\n      region: Schema.optionalKey(Label),\n      postalCode: Schema.optionalKey(Label),\n      country: Schema.optionalKey(Label),\n    }),\n  ),\n}) {}\n\nexport class CredentialOffer extends Schema.Class<CredentialOffer>(\"CredentialOffer\")({\n  ref: BrowserReference,\n  kind: CredentialKind,\n  metadata: CredentialOfferMetadata,\n}) {}\n\nexport class ListCredentialOffers extends Schema.Class<ListCredentialOffers>(\n  \"ListCredentialOffers\",\n)({\n  kind: CredentialKind,\n  target: BrowserReference,\n}) {}\n\nexport class UseCredential extends Schema.Class<UseCredential>(\"UseCredential\")({\n  offer: BrowserReference,\n  fields: Schema.Array(Schema.Struct({ ref: BrowserReference, role: CredentialFieldRole })).check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(8),\n  ),\n  submit: Schema.optionalKey(BrowserReference),\n}) {}\n\nexport class ProtectedBrowserNavigate extends Schema.Class<ProtectedBrowserNavigate>(\n  \"ProtectedBrowserNavigate\",\n)({\n  url: Schema.String.check(Schema.isMaxLength(8192)),\n}) {}\n\nexport class ProtectedBrowserClick extends Schema.Class<ProtectedBrowserClick>(\n  \"ProtectedBrowserClick\",\n)({\n  ref: BrowserReference,\n}) {}\n\n/**\n * Non-secret text for an ordinary text control or native single select in the current observation.\n * Never pass credential material. Credential roles, including username, require useCredential.\n * Selects match one enabled option's exact observed label. Empty text clears text controls.\n */\nexport class ProtectedBrowserFill extends Schema.Class<ProtectedBrowserFill>(\n  \"ProtectedBrowserFill\",\n)(\n  Schema.Struct({\n    ref: BrowserReference,\n    value: Schema.String.check(Schema.isMaxLength(8192)),\n  }),\n) {}\n\nexport const CredentialDispatch = Schema.Literals([\n  \"not-dispatched\",\n  \"possibly-dispatched\",\n  \"dispatched\",\n]);\n\nexport const CredentialMilestone = Schema.Literals([\n  \"none\",\n  \"partial-fill\",\n  \"filled\",\n  \"submission-dispatched\",\n]);\n\nexport const ProtectedObservationState = Schema.Literals([\n  \"before-exposure\",\n  \"protected\",\n  \"approved-after-exposure\",\n  \"closed\",\n]);\n\nexport const ProtectedCleanup = Schema.Literals([\"not-requested\", \"confirmed\", \"unconfirmed\"]);\n\nconst Evidence = {\n  dispatch: CredentialDispatch,\n  milestone: CredentialMilestone,\n  observation: ProtectedObservationState,\n  cleanup: ProtectedCleanup,\n};\n\n/** No foreign message/cause or page data may enter this failure. Closure does not undo dispatch. */\nexport class ProtectedBrowserError extends Schema.TaggedError<ProtectedBrowserError>()(\n  \"ProtectedBrowserError\",\n  {\n    reason: Schema.Literals([\n      \"denied\",\n      \"missing-credential\",\n      \"stale-reference\",\n      \"unsupported\",\n      \"needs-attention\",\n      \"busy\",\n      \"closed\",\n      \"limit\",\n      \"timeout\",\n      \"provider\",\n      \"resolver\",\n      \"outcome-unknown\",\n      \"observation-blocked\",\n    ]),\n    ...Evidence,\n  },\n) {}\n\nexport class CredentialUseResult extends Schema.Class<CredentialUseResult>(\"CredentialUseResult\")({\n  ...Evidence,\n  authentication: Schema.Literal(\"unverified\"),\n}) {}\n\nconst SecretText = Schema.Redacted(Schema.NonEmptyString.check(Schema.isMaxLength(1024)));\n\n/** Host-only material. Never encode it into Tool results, checkpoints, or storage. */\nexport const LoginCredential = Schema.TaggedStruct(\"LoginCredential\", {\n  username: SecretText,\n  password: SecretText,\n});\n\n/** Security codes are transient, never persisted. Dummy tests are not PCI compliance evidence. */\nexport const CardCredential = Schema.TaggedStruct(\"CardCredential\", {\n  name: SecretText,\n  number: Schema.Redacted(Schema.String.check(Schema.isPattern(/^\\d{12,19}$/))),\n  expiry: SecretText,\n  expiryMonth: Schema.Redacted(Schema.String.check(Schema.isPattern(/^(0[1-9]|1[0-2])$/))),\n  expiryYear: Schema.Redacted(Schema.String.check(Schema.isPattern(/^\\d{4}$/))),\n  securityCode: Schema.optionalKey(\n    Schema.Redacted(Schema.String.check(Schema.isPattern(/^\\d{3,4}$/))),\n  ),\n});\n\nexport const BrowserCredentialMaterial = Schema.Union([LoginCredential, CardCredential]);\nexport type BrowserCredentialMaterial = typeof BrowserCredentialMaterial.Type;\n\n/** Use busy for transient host-authority unavailability; return promptly without waiting for Tool completion. */\nexport class CredentialAccessError extends Schema.TaggedError<CredentialAccessError>()(\n  \"CredentialAccessError\",\n  {\n    reason: Schema.Literals([\n      \"denied\",\n      \"missing-credential\",\n      \"needs-attention\",\n      \"busy\",\n      \"resolver\",\n    ]),\n  },\n) {}\n\nexport interface CredentialAccessRequest {\n  readonly caller: Redacted.Redacted<string>;\n  readonly kind: typeof CredentialKind.Type;\n  readonly target: CredentialTarget;\n}\n\nexport interface CredentialUseAuthorization extends CredentialAccessRequest {\n  readonly key: Redacted.Redacted<string>;\n  readonly roles: ReadonlyArray<typeof CredentialFieldRole.Type>;\n  readonly submit: boolean;\n}\n\n/** Exact current action proposed to host authority; no ordinary fill value or secret is included. */\nexport const ProtectedBrowserAction = Schema.Union([\n  Schema.TaggedStruct(\"Navigate\", { url: ProtectedBrowserNavigate.fields.url }),\n  Schema.TaggedStruct(\"Fill\", {\n    ref: BrowserReference,\n    target: CredentialTarget,\n    role: Schema.Literals([\"text\", \"select\"]),\n  }),\n  Schema.TaggedStruct(\"Click\", {\n    ref: BrowserReference,\n    target: CredentialTarget,\n    role: Schema.Literals([\"button\", \"radio\", \"checkbox\"]),\n  }),\n  Schema.TaggedStruct(\"Click\", {\n    ref: BrowserReference,\n    target: CredentialTarget,\n    role: Schema.Literal(\"link\"),\n    url: LinkUrl,\n  }),\n  Schema.TaggedStruct(\"Submit\", { ref: BrowserReference, target: CredentialTarget }),\n]);\n\nexport type ProtectedBrowserAction = typeof ProtectedBrowserAction.Type;\n\n/**\n * Trust only these current observation origins. The top origin must be included. Other frames\n * supply neither text nor usable refs. This does not expand network policy or credential grants.\n */\nexport class CredentialObservationGrant extends Schema.Class<CredentialObservationGrant>(\n  \"CredentialObservationGrant\",\n)({\n  decision: Schema.Literal(\"trust-recipient-no-credential-echo\"),\n  origins: Schema.Array(CredentialOrigin).check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(16),\n    Schema.isUnique(),\n  ),\n}) {}\n\nexport const CredentialObservationDecision = Schema.Union([\n  Schema.Literals([\"trust-recipient-no-credential-echo\", \"deny\"]),\n  CredentialObservationGrant,\n]);\n\n/**\n * Host-only vault and grant port. Derive caller from the authorized invocation, never Tool input.\n * Recheck account ownership, current grants, merchant/frame/recipient pairing, and any side\n * effects caused by filling. Listing authorizes metadata only. Grant checks never widen network\n * policy. Implementations must not log material or put it in defects/traces.\n */\nexport class BrowserCredentialAccess extends Context.Service<\n  BrowserCredentialAccess,\n  {\n    readonly caller: Effect.Effect<Redacted.Redacted<string>, CredentialAccessError>;\n    readonly list: (request: CredentialAccessRequest) => Effect.Effect<\n      ReadonlyArray<{\n        readonly key: Redacted.Redacted<string>;\n        readonly metadata: CredentialOfferMetadata;\n      }>,\n      CredentialAccessError\n    >;\n    readonly authorize: (\n      request: CredentialUseAuthorization,\n    ) => Effect.Effect<void, CredentialAccessError>;\n    readonly resolve: (\n      request: CredentialUseAuthorization,\n    ) => Effect.Effect<BrowserCredentialMaterial, CredentialAccessError>;\n    /**\n     * Optional host authority for every ordinary navigate/fill/click, mandatory for Submit.\n     * Recheck caller ownership, user intent, current submission/continuation grants for ALL prior\n     * exposures, and this exact target. Exposures may come from separate credential frames/forms.\n     * Without this hook, ordinary actions retain their observation gate and Submit is unsupported.\n     * Observation trust alone never authorizes a new native submit. Called again on each action;\n     * approvals are not cached. The pass revalidates caller and target after this hook returns.\n     */\n    readonly authorizeAction?: (request: {\n      readonly caller: Redacted.Redacted<string>;\n      readonly action: ProtectedBrowserAction;\n      readonly exposures: ReadonlyArray<CredentialTarget>;\n    }) => Effect.Effect<void, CredentialAccessError>;\n    /**\n     * Explicitly trust all observed destinations not to echo credentials, including transformed\n     * or delayed echoes. Called for every observation and non-secret action after exposure.\n     * The string grant trusts all current observed origins. Return CredentialObservationGrant\n     * to select an explicit subset instead. This is recipient trust, not submission authority,\n     * a universal secrecy guarantee, or a login verifier.\n     */\n    readonly observation: (request: {\n      readonly caller: Redacted.Redacted<string>;\n      readonly topOrigin: typeof CredentialOrigin.Type;\n      readonly frameOrigins: ReadonlyArray<typeof CredentialOrigin.Type>;\n      readonly exposures: ReadonlyArray<CredentialTarget>;\n      /** A human may have entered secrets; explicitly authorize observation even with no vault exposures. */\n      readonly humanExposure?: boolean;\n      /** Origins present when the human received control, retained across durable suspension. */\n      readonly humanOrigins?: ReadonlyArray<typeof CredentialOrigin.Type>;\n    }) => Effect.Effect<typeof CredentialObservationDecision.Type, CredentialAccessError>;\n  }\n>()(\"@effect-agent/sandbox/BrowserCredentialAccess\") {}\n\n/**\n * Host-only suspended-pass state. Persist with the host's fenced controller receipt, never in\n * a Tool result. It contains no credential material, offers, DOM references usable after resume,\n * cookies, page text, or provider capability. A host must restore its own credential exposure\n * ledger as well. The original deadline and action allowance include time spent with the human.\n */\nexport class ProtectedBrowserCheckpoint extends Schema.Class<ProtectedBrowserCheckpoint>(\n  \"ProtectedBrowserCheckpoint\",\n)({\n  policy: InteractiveBrowserPolicy,\n  startedAt: Schema.Natural,\n  actions: Schema.Natural,\n  exposures: Schema.Array(CredentialTarget).check(Schema.isMaxLength(1000)),\n  humanExposure: Schema.Boolean,\n  humanOrigins: Schema.Array(CredentialOrigin).check(Schema.isMaxLength(16)),\n  dispatch: CredentialDispatch,\n  milestone: CredentialMilestone,\n}) {}\n\n/** A private ephemeral pass. No selectors, JavaScript, screenshots, viewer, or provider identity. */\nexport interface ProtectedBrowserHandle {\n  readonly navigate: (\n    request: ProtectedBrowserNavigate,\n  ) => Effect.Effect<void, ProtectedBrowserError>;\n  readonly observe: Effect.Effect<ProtectedBrowserObservation, ProtectedBrowserError>;\n  readonly click: (request: ProtectedBrowserClick) => Effect.Effect<void, ProtectedBrowserError>;\n  /** Uses the same lock, budgets, current-target checks and post-exposure grant as other actions. */\n  readonly fill: (request: ProtectedBrowserFill) => Effect.Effect<void, ProtectedBrowserError>;\n  readonly listCredentialOffers: (\n    request: ListCredentialOffers,\n  ) => Effect.Effect<ReadonlyArray<CredentialOffer>, ProtectedBrowserError>;\n  readonly useCredential: (\n    request: UseCredential,\n  ) => Effect.Effect<CredentialUseResult, ProtectedBrowserError>;\n  readonly close: Effect.Effect<typeof ProtectedCleanup.Type>;\n}\n\nexport class ProtectedBrowser extends Context.Service<\n  ProtectedBrowser,\n  {\n    readonly open: (\n      policy: InteractiveBrowserPolicy,\n    ) => Effect.Effect<\n      ProtectedBrowserHandle,\n      ProtectedBrowserError,\n      Scope.Scope | BrowserCredentialAccess\n    >;\n  }\n>()(\"@effect-agent/sandbox/ProtectedBrowser\") {}\n\n/** Build once in an execution/Attempt Layer. Acquires lazily and shares one pass across Tools. */\nexport class ProtectedBrowserSession extends Context.Service<\n  ProtectedBrowserSession,\n  {\n    readonly get: Effect.Effect<ProtectedBrowserHandle, ProtectedBrowserError>;\n  }\n>()(\"@effect-agent/sandbox/ProtectedBrowserSession\") {\n  static layer(policy: InteractiveBrowserPolicy) {\n    return Layer.effect(this)(\n      Effect.gen(function* () {\n        const browser = yield* ProtectedBrowser;\n        const access = yield* BrowserCredentialAccess;\n        const scope = yield* Effect.scope;\n\n        const cached = yield* Effect.cached(\n          browser\n            .open(policy)\n            .pipe(\n              Effect.provideService(BrowserCredentialAccess, access),\n              Effect.provideService(Scope.Scope, scope),\n            ),\n        );\n\n        return {\n          get: Effect.suspend(() =>\n            scope.state._tag === \"Closed\"\n              ? Effect.fail(\n                  new ProtectedBrowserError({\n                    reason: \"closed\",\n                    dispatch: \"not-dispatched\",\n                    milestone: \"none\",\n                    observation: \"closed\",\n                    cleanup: \"not-requested\",\n                  }),\n                )\n              : cached,\n          ),\n        };\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,mBAAmB,OAAO,OAAO,MAC5C,OAAO,YACJ,UAAU,MAAM,WAAW,UAAU,KAAK,OAAO,GAAG,sBAAsB,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAC7F,CACF;AAEA,MAAa,mBAAmB,OAAO,OAAO,MAAM,OAAO,OAAO,CAAC;AACnE,MAAa,iBAAiB,OAAO,SAAS,CAAC,SAAS,MAAM,CAAC;AAE/D,MAAa,sBAAsB,OAAO,SAAS;CACjD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;AACzD,MAAM,UAAU,4BAA4B,MAAM,OAAO,aAAa,UAAU,CAAC;AAEjF,IAAa,mBAAb,cAAsC,OAAO,MAAwB,kBAAkB,CAAC,CAAC;CACvF,WAAW;CACX,aAAa;CACb,iBAAiB;CACjB,UAAU;CACV,OAAO;CACP,MAAM;AACR,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,yBACF,CAAC,CAAC;CACA,KAAK;CACL,QAAQ;CACR,MAAM,OAAO,MAAM,CACjB,qBACA,OAAO,SAAS;EACd;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH,CAAC;CACD,OAAO;;CAEP,SAAS,OAAO,YAAY,OAAO,OAAO;;;;;CAK1C,SAAS,OAAO,YACd,OAAO,MACL,OAAO,OAAO;EAAE,OAAO;EAAO,UAAU,OAAO;EAAS,UAAU,OAAO;CAAQ,CAAC,CACpF,CAAC,CAAC,MAAM,OAAO,YAAY,GAAG,CAAC,CACjC;;CAEA,KAAK,OAAO,YAAY,OAAO;AACjC,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,8BAAb,cAAiD,OAAO,MACtD,6BACF,CAAC,CAAC;CACA,UAAU;CACV,WAAW;CACX,MAAM,OAAO,OAAO,MAAM,OAAO,YAAY,KAAS,CAAC;CACvD,UAAU,OAAO,MAAM,uBAAuB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC5E,WAAW,OAAO;CAClB,aAAa,OAAO,SAAS,CAAC,mBAAmB,yBAAyB,CAAC;AAC7E,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,yBACF,CAAC,CAAC;CACA,OAAO;CACP,OAAO,OAAO,YAAY,KAAK;CAC/B,UAAU,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,SAAS,CAAC,CAAC;;CAE7E,gBAAgB,OAAO,YACrB,OAAO,OAAO;EACZ,MAAM,OAAO,YAAY,KAAK;EAC9B,OAAO,OAAO,YAAY,KAAK;EAC/B,OAAO,OAAO,YAAY,KAAK;EAC/B,MAAM,OAAO,YAAY,KAAK;EAC9B,QAAQ,OAAO,YAAY,KAAK;EAChC,YAAY,OAAO,YAAY,KAAK;EACpC,SAAS,OAAO,YAAY,KAAK;CACnC,CAAC,CACH;AACF,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,iBAAiB,CAAC,CAAC;CACpF,KAAK;CACL,MAAM;CACN,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,sBACF,CAAC,CAAC;CACA,MAAM;CACN,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,gBAAb,cAAmC,OAAO,MAAqB,eAAe,CAAC,CAAC;CAC9E,OAAO;CACP,QAAQ,OAAO,MAAM,OAAO,OAAO;EAAE,KAAK;EAAkB,MAAM;CAAoB,CAAC,CAAC,CAAC,CAAC,MACxF,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,CAAC,CACtB;CACA,QAAQ,OAAO,YAAY,gBAAgB;AAC7C,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,2BAAb,cAA8C,OAAO,MACnD,0BACF,CAAC,CAAC,EACA,KAAK,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,EACnD,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,uBACF,CAAC,CAAC,EACA,KAAK,iBACP,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,sBACF,CAAC,CACC,OAAO,OAAO;CACZ,KAAK;CACL,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AACrD,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,qBAAqB,OAAO,SAAS;CAChD;CACA;CACA;AACF,CAAC;AAED,MAAa,sBAAsB,OAAO,SAAS;CACjD;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,4BAA4B,OAAO,SAAS;CACvD;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,mBAAmB,OAAO,SAAS;CAAC;CAAiB;CAAa;AAAa,CAAC;AAE7F,MAAM,WAAW;CACf,UAAU;CACV,WAAW;CACX,aAAa;CACb,SAAS;AACX;;AAGA,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,GAAG;AACL,CACF,CAAC,CAAC,CAAC;AAEH,IAAa,sBAAb,cAAyC,OAAO,MAA2B,qBAAqB,CAAC,CAAC;CAChG,GAAG;CACH,gBAAgB,OAAO,QAAQ,YAAY;AAC7C,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,aAAa,OAAO,SAAS,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;;AAGxF,MAAa,kBAAkB,OAAO,aAAa,mBAAmB;CACpE,UAAU;CACV,UAAU;AACZ,CAAC;;AAGD,MAAa,iBAAiB,OAAO,aAAa,kBAAkB;CAClE,MAAM;CACN,QAAQ,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,aAAa,CAAC,CAAC;CAC5E,QAAQ;CACR,aAAa,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,mBAAmB,CAAC,CAAC;CACvF,YAAY,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,SAAS,CAAC,CAAC;CAC5E,cAAc,OAAO,YACnB,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,WAAW,CAAC,CAAC,CACpE;AACF,CAAC;AAED,MAAa,4BAA4B,OAAO,MAAM,CAAC,iBAAiB,cAAc,CAAC;;AAIvF,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;;AAeH,MAAa,yBAAyB,OAAO,MAAM;CACjD,OAAO,aAAa,YAAY,EAAE,KAAK,yBAAyB,OAAO,IAAI,CAAC;CAC5E,OAAO,aAAa,QAAQ;EAC1B,KAAK;EACL,QAAQ;EACR,MAAM,OAAO,SAAS,CAAC,QAAQ,QAAQ,CAAC;CAC1C,CAAC;CACD,OAAO,aAAa,SAAS;EAC3B,KAAK;EACL,QAAQ;EACR,MAAM,OAAO,SAAS;GAAC;GAAU;GAAS;EAAU,CAAC;CACvD,CAAC;CACD,OAAO,aAAa,SAAS;EAC3B,KAAK;EACL,QAAQ;EACR,MAAM,OAAO,QAAQ,MAAM;EAC3B,KAAK;CACP,CAAC;CACD,OAAO,aAAa,UAAU;EAAE,KAAK;EAAkB,QAAQ;CAAiB,CAAC;AACnF,CAAC;;;;;AAQD,IAAa,6BAAb,cAAgD,OAAO,MACrD,4BACF,CAAC,CAAC;CACA,UAAU,OAAO,QAAQ,oCAAoC;CAC7D,SAAS,OAAO,MAAM,gBAAgB,CAAC,CAAC,MACtC,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,GACrB,OAAO,SAAS,CAClB;AACF,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,gCAAgC,OAAO,MAAM,CACxD,OAAO,SAAS,CAAC,sCAAsC,MAAM,CAAC,GAC9D,0BACF,CAAC;;;;;;;AAQD,IAAa,0BAAb,cAA6C,QAAQ,QAgDnD,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;;;;;;;AAQtD,IAAa,6BAAb,cAAgD,OAAO,MACrD,4BACF,CAAC,CAAC;CACA,QAAQ;CACR,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,WAAW,OAAO,MAAM,gBAAgB,CAAC,CAAC,MAAM,OAAO,YAAY,GAAI,CAAC;CACxE,eAAe,OAAO;CACtB,cAAc,OAAO,MAAM,gBAAgB,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CACzE,UAAU;CACV,WAAW;AACb,CAAC,CAAC,CAAC,CAAC;AAoBJ,IAAa,mBAAb,cAAsC,QAAQ,QAW5C,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;;AAG/C,IAAa,0BAAb,cAA6C,QAAQ,QAKnD,CAAC,CAAC,+CAA+C,CAAC,CAAC;CACnD,OAAO,MAAM,QAAkC;EAC7C,OAAO,MAAM,OAAO,IAAI,CAAC,CACvB,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GACvB,MAAM,SAAS,OAAO;GACtB,MAAM,QAAQ,OAAO,OAAO;GAE5B,MAAM,SAAS,OAAO,OAAO,OAC3B,QACG,KAAK,MAAM,CAAC,CACZ,KACC,OAAO,eAAe,yBAAyB,MAAM,GACrD,OAAO,eAAe,MAAM,OAAO,KAAK,CAC1C,CACJ;GAEA,OAAO,EACL,KAAK,OAAO,cACV,MAAM,MAAM,SAAS,WACjB,OAAO,KACL,IAAI,sBAAsB;IACxB,QAAQ;IACR,UAAU;IACV,WAAW;IACX,aAAa;IACb,SAAS;GACX,CAAC,CACH,IACA,MACN,EACF;EACF,CAAC,CACH;CACF;AACF"}