diff --git a/pkg/spec/src/index.ts b/pkg/spec/src/index.ts
index 39f9f46..4bbb54e 100644
--- a/pkg/spec/src/index.ts
+++ b/pkg/spec/src/index.ts
@@ -23,6 +23,7 @@ export type {
   TapAction,
   SanderlingRuntime,
   WaitAction,
+  WebState,
   WeightedEntry,
 } from "./types.ts";
 
diff --git a/pkg/spec/src/types.ts b/pkg/spec/src/types.ts
index a72eb3d..cd61b62 100644
--- a/pkg/spec/src/types.ts
+++ b/pkg/spec/src/types.ts
@@ -1,3 +1,5 @@
+/// <reference lib="dom" />
+
 export type Snapshots = Record<string, unknown>;
 
 /**
@@ -10,20 +12,28 @@ export type Snapshots = Record<string, unknown>;
  */
 export interface KnownAttrSelectors {
   testTag?: string;
+  testID?: string;
   identifier?: string;
   accessibilityIdentifier?: string;
   "resource-id"?: string;
+  id?: string;
 
   "content-desc"?: string;
+  contentDescription?: string;
   accessibilityText?: string;
   accessibilityLabel?: string;
+  ariaLabel?: string;
+  "aria-label"?: string;
   label?: string;
 
   text?: string;
+  tag?: string;
   class?: string;
+  className?: string;
   elementType?: string;
   package?: string;
   placeholderValue?: string;
+  placeholder?: string;
   hintText?: string;
 
   clickable?: boolean;
@@ -99,6 +109,17 @@ export interface State {
   exceptions: readonly ExceptionRecord[];
 }
 
+/**
+ * State as observed inside a web (V8/browser) extractor. Adds the live
+ * `document` and `window` handles. `state.document` is V8-only — goja-side
+ * predicates do not see it; if you need DOM data in a predicate, surface it
+ * via an `extract()`.
+ */
+export interface WebState extends State {
+  readonly document: Document;
+  readonly window: Window;
+}
+
 export interface Extracted<T> {
   readonly current: T;
   readonly previous: T | undefined;