/**
 * Restrict persistent extension storage from content scripts when the browser
 * exposes the WebExtensions access-level API. Firefox versions without this
 * method remain safe for the sensitive paths because message authorization and
 * session-owned secrets do not rely on this defense-in-depth setting.
 */
export async function restrictLocalStorageToTrustedContexts(): Promise<void> {
  const local = chrome.storage?.local as (typeof chrome.storage.local & {
    setAccessLevel?: (options: { accessLevel: "TRUSTED_CONTEXTS" }) => Promise<void>;
  }) | undefined;
  if (typeof local?.setAccessLevel !== "function") return;
  try {
    await local.setAccessLevel({ accessLevel: "TRUSTED_CONTEXTS" });
  } catch {
    // Optional browser hardening must never prevent the extension from
    // starting; the message policy remains the primary security boundary.
  }
}