@fkn/lib 0.9.43 → 0.9.44

package/{api-H1TzWitc.d.ts → api-CFkZVr53.d.ts}

@@ -1,5 +1,5 @@
-import { D as IpFamily, Dt as UdpSocketOptions, Et as UdpDatagram, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, N as OverlayState, Nt as WriteData, P as PackageQuery, Q as RoomEvent, R as PickOptions, St as TcpSocketListenerOptions, T as InstallOptions, V as ProxyFetchInit, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, c as AdoptRequest, d as ConflictRequest, et as RoomJoinOptions, it as RoomOpenOptions, l as AdoptState, m as ConnectOptions, o as AccountPinOptions, p as ConnectAvailability, st as RoomsErrorCode, tt as RoomMailbox, u as ConflictChoice, wt as TcpSocketOptions, x as FrameConsentRequest, z as Placement } from "./contract-DJxGa8lb.js";
-import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
+import { D as IpFamily, Dt as UdpSocketOptions, Et as UdpDatagram, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, N as OverlayState, Nt as WriteData, P as PackageQuery, Q as RoomEvent, R as PickOptions, St as TcpSocketListenerOptions, T as InstallOptions, V as ProxyFetchInit, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, c as AdoptRequest, d as ConflictRequest, et as RoomJoinOptions, it as RoomOpenOptions, l as AdoptState, m as ConnectOptions, o as AccountPinOptions, p as ConnectAvailability, st as RoomsErrorCode, tt as RoomMailbox, u as ConflictChoice, wt as TcpSocketOptions, x as FrameConsentRequest, z as Placement } from "./contract-6Xfd_qel.js";
+import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 import { Remote } from "osra";
 //#region src/api-epochs.d.ts
 type EpochListener<T> = (remote: T, epoch: number) => void;
@@ -8,10 +8,9 @@ type EpochListener<T> = (remote: T, epoch: number) => void;
 declare const hasTransport: boolean;
 type Api = Remote<Resolvers>;
 /**
- * The broker api. Settles when the first connection exists, exactly as before, but resolves with a
- * stable facade that always routes to the NEWEST connection, so holding the resolved value across a
- * broker replacement is safe. A call in flight at the moment of replacement rejects with a named
- * error instead of hanging.
+ * The broker api. Settles when the first connection exists and resolves with a stable facade that
+ * always routes to the NEWEST connection, so holding the resolved value across a broker replacement
+ * is safe. A call in flight at the moment of replacement rejects with a named error instead of hanging.
  *
  * A window realm that relays its channel to a worker (`relayWorker`) moves its own calls to a channel
  * of their own, never back to the relayed one. There it also settles once the realm relays, a call in
@@ -21,23 +20,14 @@ type Api = Remote<Resolvers>;
  */
 declare const apiPromise: Promise<Api>;
 /**
- * `apiPromise` bounded by a deadline, for call sites that must not park forever.
+ * The deadline of `apiWithin`, for call sites that own a socket, a timer or a UI and must not park.
+ * `apiPromise` NEVER REJECTS: a broker frame that never bridges leaves it pending for the realm's
+ * life. In a worker the transport `{receive: self, emit: self}` is inert until the page bridges it,
+ * so an unbridged worker parks every socket call with no `listening`, `error` or rejection, which
+ * presents as a transport fault invisible from every counter.
  *
- * `apiPromise` NEVER REJECTS: `epochs.first` settles only when a broker connection exists, so a
- * broker frame that never bridges leaves it pending for the life of the realm. Awaiting it directly
- * is correct wherever hanging is the honest answer, and wrong wherever the caller owns a socket, a
- * timer or a UI that has to say something.
- *
- * That distinction is not academic. In a WORKER realm the osra transport is `{receive: self,
- * emit: self}`, which is inert until the page bridges it, so an unbridged worker parks every socket
- * call here with no `listening`, no `error` and no rejection. The engine then reports a listener
- * that neither succeeded nor failed, its reopen counters stay at 0 because reopen only runs from an
- * `error` or `close` that never arrives, and the relay is never contacted at all. That state cost a
- * long diagnosis: it presents as a transport fault and is invisible from every counter.
- *
- * The latch mirrors `storage.ts`: once the broker has missed one deadline, later calls stop paying
- * the full wait. `net.ts` needs it especially, because its listen path is `bind('::').catch(() =>
- * bind('0.0.0.0'))`, so an unbounded-then-rejecting version would charge the deadline twice.
+ * Once one deadline is missed, later calls wait only the retry deadline (as `storage.ts` does):
+ * `net.ts` listens with `bind('::').catch(() => bind('0.0.0.0'))` and would otherwise pay it twice.
  */
 declare const API_DEADLINE_MS = 8000;
 declare class BrokerUnreachableError extends Error {
@@ -45,15 +35,14 @@ declare class BrokerUnreachableError extends Error {
 }
 /**
  * A page's own call, refused because the page relays its FKN channel to a worker (`relayWorker`) and
- * the broker it reached never answered on the page's own channel within the deadline: a broker
- * document from before that channel, as fkn.app's service worker can still serve from its cache. The
- * page's own calls never fall back to the relayed channel, so this is the answer until a reload
- * reaches a newer broker. The relayed worker's calls are unaffected.
+ * the broker never answered on the page's own channel within the deadline: a broker document from
+ * before that channel, as fkn.app's service worker can still serve from its cache. The page's own
+ * calls never fall back to the relayed channel, so this is the answer until a reload reaches a newer
+ * broker. The relayed worker's calls are unaffected.
  *
- * What the page registered on the relayed channel went with it, and nothing registers it again until
- * then: FKN's UI on this page (the prompts and header the broker draws over it, those the worker's
- * calls raise included) is no longer placed, and account changes are no longer heard. So the realm also logs this error
- * once with `console.error` when the deadline passes, whether or not the page calls.
+ * What the page registered on the relayed channel went with it: FKN's UI over this page is no longer
+ * placed and account changes are no longer heard. So the realm also logs this error once with
+ * `console.error` when the deadline passes, whether or not the page calls.
  */
 declare class OwnChannelUnavailableError extends Error {
   constructor();
@@ -322,6 +311,7 @@ declare const onApiEpoch: (listener: EpochListener<{
       claimed: boolean;
       mailbox: RoomMailbox | null;
       temporaryClaims?: true;
+      mailboxSwitch?: true;
       defaults: () => Promise<{
         readonly send: boolean;
         readonly receive: boolean;
@@ -410,6 +400,12 @@ declare const onApiEpoch: (listener: EpochListener<{
       } | {
         ok: true;
       }>;
+      setMailbox: (on: boolean) => Promise<{
+        error: RoomsErrorCode;
+        message: string;
+      } | {
+        ok: true;
+      }>;
       release: () => Promise<{
         error: RoomsErrorCode;
         message: string;
@@ -453,6 +449,7 @@ declare const onApiEpoch: (listener: EpochListener<{
       claimed: boolean;
       mailbox: RoomMailbox | null;
       temporaryClaims?: true;
+      mailboxSwitch?: true;
       defaults: () => Promise<{
         readonly send: boolean;
         readonly receive: boolean;
@@ -541,6 +538,12 @@ declare const onApiEpoch: (listener: EpochListener<{
       } | {
         ok: true;
       }>;
+      setMailbox: (on: boolean) => Promise<{
+        error: RoomsErrorCode;
+        message: string;
+      } | {
+        ok: true;
+      }>;
       release: () => Promise<{
         error: RoomsErrorCode;
         message: string;
@@ -584,6 +587,7 @@ declare const onApiEpoch: (listener: EpochListener<{
       claimed: boolean;
       mailbox: RoomMailbox | null;
       temporaryClaims?: true;
+      mailboxSwitch?: true;
       defaults: () => Promise<{
         readonly send: boolean;
         readonly receive: boolean;
@@ -672,6 +676,12 @@ declare const onApiEpoch: (listener: EpochListener<{
       } | {
         ok: true;
       }>;
+      setMailbox: (on: boolean) => Promise<{
+        error: RoomsErrorCode;
+        message: string;
+      } | {
+        ok: true;
+      }>;
       release: () => Promise<{
         error: RoomsErrorCode;
         message: string;
@@ -1039,6 +1049,7 @@ declare const currentApiEpoch: () => {
         claimed: boolean;
         mailbox: RoomMailbox | null;
         temporaryClaims?: true;
+        mailboxSwitch?: true;
         defaults: () => Promise<{
           readonly send: boolean;
           readonly receive: boolean;
@@ -1127,6 +1138,12 @@ declare const currentApiEpoch: () => {
         } | {
           ok: true;
         }>;
+        setMailbox: (on: boolean) => Promise<{
+          error: RoomsErrorCode;
+          message: string;
+        } | {
+          ok: true;
+        }>;
         release: () => Promise<{
           error: RoomsErrorCode;
           message: string;
@@ -1170,6 +1187,7 @@ declare const currentApiEpoch: () => {
         claimed: boolean;
         mailbox: RoomMailbox | null;
         temporaryClaims?: true;
+        mailboxSwitch?: true;
         defaults: () => Promise<{
           readonly send: boolean;
           readonly receive: boolean;
@@ -1258,6 +1276,12 @@ declare const currentApiEpoch: () => {
         } | {
           ok: true;
         }>;
+        setMailbox: (on: boolean) => Promise<{
+          error: RoomsErrorCode;
+          message: string;
+        } | {
+          ok: true;
+        }>;
         release: () => Promise<{
           error: RoomsErrorCode;
           message: string;
@@ -1301,6 +1325,7 @@ declare const currentApiEpoch: () => {
         claimed: boolean;
         mailbox: RoomMailbox | null;
         temporaryClaims?: true;
+        mailboxSwitch?: true;
         defaults: () => Promise<{
           readonly send: boolean;
           readonly receive: boolean;
@@ -1389,6 +1414,12 @@ declare const currentApiEpoch: () => {
         } | {
           ok: true;
         }>;
+        setMailbox: (on: boolean) => Promise<{
+          error: RoomsErrorCode;
+          message: string;
+        } | {
+          ok: true;
+        }>;
         release: () => Promise<{
           error: RoomsErrorCode;
           message: string;

package/api.d.ts

@@ -1,3 +1,3 @@
-import { K as Resolvers } from "./contract-DJxGa8lb.js";
-import { a as apiLastCall, c as currentApiEpoch, i as apiInFlight, l as hasTransport, n as BrokerUnreachableError, o as apiPromise, r as OwnChannelUnavailableError, s as apiWithin, t as API_DEADLINE_MS, u as onApiEpoch } from "./api-H1TzWitc.js";
+import { K as Resolvers } from "./contract-6Xfd_qel.js";
+import { a as apiLastCall, c as currentApiEpoch, i as apiInFlight, l as hasTransport, n as BrokerUnreachableError, o as apiPromise, r as OwnChannelUnavailableError, s as apiWithin, t as API_DEADLINE_MS, u as onApiEpoch } from "./api-CFkZVr53.js";
 export { API_DEADLINE_MS, BrokerUnreachableError, OwnChannelUnavailableError, type Resolvers, apiInFlight, apiLastCall, apiPromise, apiWithin, currentApiEpoch, hasTransport, onApiEpoch };

package/attach-policy.d.ts

@@ -2,9 +2,8 @@
 /** What `normalizeHosts` keeps beyond a bare hostname. */
 type NormalizeHostsOptions = {
   /**
-   * Keep a bracketed IPv6 literal, in the canonical form `URL.hostname` reports, because that is
-   * the value a document or a fetch is compared against. Off by default: only the extension's own
-   * callers pass it, so the cloud's declared hosts (`normalizeDeclaredHosts`) stay what they were.
+   * Keep a bracketed IPv6 literal, in the canonical form `URL.hostname` reports (what a document or
+   * fetch is compared against). Off by default; only the extension's own callers pass it.
    */
   ipv6?: boolean;
 };
@@ -18,12 +17,11 @@ declare const normalizeHosts: (raw: readonly string[], { ipv6 }?: NormalizeHosts
 //#endregion
 //#region src/attach-policy.d.ts
 /**
- * The pure half of the middle page's frame.fetch gate: everything that can be decided from the
- * attachment's own facts, with no broker and no UI. The middle page enforces this on EVERY fetch
- * call, because any app can drive the 'fkn-attach-frame' channel directly and skip the client
- * library's copy of the same checks.
+ * The pure half of the middle page's frame.fetch gate: what can be decided from the attachment's own
+ * facts, with no broker and no UI. The middle page enforces it on EVERY fetch call, because any app
+ * can drive the 'fkn-attach-frame' channel directly and skip the library's copy of the checks.
  *
- * Refusals here must surface under a TERMINAL locator error name (the caller maps them through
+ * Refusals must surface under a TERMINAL locator error name (callers map them through
  * `locatorDeniedError`), or the shared dispatch loop retries them to its 30 second deadline and
  * reports a timeout that names neither the operation nor the reason.
  */
@@ -44,13 +42,11 @@ export type FrameFetchVerdict = {
   promptHosts: string[];
 };
 /**
- * How a fetch url is read.
- *
- * `'no-base'` is `new URL(url)`, which accepts the two base-dependent forms `https:h/x` and
- * `http:h/x` as if they named `h`. `'fetchTarget'` is the shared classifier, which calls those
- * relative and refuses them here. The middle page keeps `'no-base'` until the contract deploy, so
- * an application on an older library is refused nothing it was not refused before; the library's
- * own gate passes `'fetchTarget'`.
+ * How a fetch url is read. `'no-base'` is `new URL(url)`, which accepts the base-dependent forms
+ * `https:h/x` and `http:h/x` as if they named `h`. `'fetchTarget'` is the shared classifier, which
+ * calls those relative and refuses them. The middle page keeps `'no-base'` until the contract deploy,
+ * so an application on an older library is refused nothing new; the library's own gate passes
+ * `'fetchTarget'`.
  */
 export type FrameFetchClassifier = 'no-base' | 'fetchTarget';
 export declare const frameFetchVerdict: (policy: FrameFetchPolicy, url: unknown, { classifier }?: {

package/cloud/dns.d.ts

@@ -1,3 +1,3 @@
-import { s as AddressLookupResult } from "../contract-DJxGa8lb.js";
+import { s as AddressLookupResult } from "../contract-6Xfd_qel.js";
 import { lookup } from "../dns.js";
 export { type AddressLookupResult, lookup };

package/cloud/fetch.d.ts

@@ -1,2 +1,2 @@
-import { t as cloudFetch } from "../proxy-ylK5lpw8.js";
+import { t as cloudFetch } from "../proxy-dOOmiMl4.js";
 export { cloudFetch as fetch };

package/cloud/fs/promises.d.ts

@@ -1,5 +1,5 @@
 import { a as WriteData, i as Stats, n as MakeOptions, o as WriteOptions, r as ReadOptions } from "../../index-BQgZVQl7.js";
-import "../../fs-D0MMRnHC.js";
+import "../../fs-KA1Mgisv.js";
 //#region src/cloud/fs-promises.d.ts
 export declare const readFile: (path: import("node:fs").PathLike, options?: ReadOptions) => Promise<Buffer | string>, writeFile: (path: import("node:fs").PathLike, data: WriteData, options?: WriteOptions) => Promise<void>, unlink: (path: import("node:fs").PathLike) => Promise<void>, rename: (from: import("node:fs").PathLike, to: import("node:fs").PathLike) => Promise<void>, readdir: (path: import("node:fs").PathLike) => Promise<string[]>, mkdir: (_path?: import("node:fs").PathLike, _options?: MakeOptions) => Promise<void>, rm: (path: import("node:fs").PathLike, options?: {
   recursive?: boolean;

package/cloud/fs.d.ts

@@ -1,5 +1,5 @@
 import { i as Stats } from "../index-BQgZVQl7.js";
-import { _ as unlock, a as StorageAccountChangedError, c as StorageNotFoundError, f as encryption, h as quota, i as SealedRead, l as StorageQuota, m as isNotFound, n as EncryptionStatus, o as StorageAccountPinUnsupportedError, p as isAccountChanged, r as FileEntry, s as StorageLockedError, t as CloudAvailability, u as availability } from "../storage-BVr2Rb-d.js";
-import { c as STORAGE_ACCOUNT_CHANGED, l as STORAGE_ACCOUNT_PIN_UNSUPPORTED, u as STORAGE_NOT_FOUND } from "../messages-CRcziTuC.js";
-import { a as promises, c as readdir, d as stat, f as unlink, i as mkdir, l as rename, o as readFile, p as writeFile, r as list, s as readFileSealed, t as available, u as rm } from "../fs-D0MMRnHC.js";
+import { _ as unlock, a as StorageAccountChangedError, c as StorageNotFoundError, f as encryption, h as quota, i as SealedRead, l as StorageQuota, m as isNotFound, n as EncryptionStatus, o as StorageAccountPinUnsupportedError, p as isAccountChanged, r as FileEntry, s as StorageLockedError, t as CloudAvailability, u as availability } from "../storage-BLBsmkmp.js";
+import { c as STORAGE_ACCOUNT_CHANGED, l as STORAGE_ACCOUNT_PIN_UNSUPPORTED, u as STORAGE_NOT_FOUND } from "../messages-d7pvCXPn.js";
+import { a as promises, c as readdir, d as stat, f as unlink, i as mkdir, l as rename, o as readFile, p as writeFile, r as list, s as readFileSealed, t as available, u as rm } from "../fs-KA1Mgisv.js";
 export { type CloudAvailability, type EncryptionStatus, type FileEntry, STORAGE_ACCOUNT_CHANGED, STORAGE_ACCOUNT_PIN_UNSUPPORTED, STORAGE_NOT_FOUND, type SealedRead, type Stats, StorageAccountChangedError, StorageAccountPinUnsupportedError, StorageLockedError, StorageNotFoundError, type StorageQuota, availability, available, encryption, isAccountChanged, isNotFound, list, mkdir, promises, quota, readFile, readFileSealed, readdir, rename, rm, stat, unlink, unlock, writeFile };

package/cloud/net.d.ts

@@ -1,2 +1,2 @@
-import { a as createConnection, c as isIP, i as connect, l as isIPv4, n as Socket, o as createServer, r as _default, t as Server, u as isIPv6 } from "../net-BOswhyfE.js";
+import { a as createConnection, c as isIP, i as connect, l as isIPv4, n as Socket, o as createServer, r as _default, t as Server, u as isIPv6 } from "../net-CmMZgV2a.js";
 export { Server, Socket, _default, _default as default, connect, createConnection, createServer, isIP, isIPv4, isIPv6 };

package/{cloud-Y0FzWpFT.d.ts → cloud-DyOQPyUB.d.ts}

@@ -1,8 +1,8 @@
-import { r as AttachFrameFunction } from "./index-Cgnfjh9o.js";
-import { t as cloudFetch } from "./proxy-ylK5lpw8.js";
+import { r as AttachFrameFunction } from "./index-BOInGaEl.js";
+import { t as cloudFetch } from "./proxy-dOOmiMl4.js";
 import { t as dns_d_exports } from "./dns.js";
-import { n as fs_d_exports } from "./fs-D0MMRnHC.js";
-import { s as net_d_exports } from "./net-BOswhyfE.js";
+import { n as fs_d_exports } from "./fs-KA1Mgisv.js";
+import { s as net_d_exports } from "./net-CmMZgV2a.js";
 import { t as dgram_d_exports } from "./dgram.js";
 import { t as http_d_exports } from "./http.js";
 //#region src/cloud/frame.d.ts

package/cloud.d.ts

@@ -1,8 +1,8 @@
-import { t as cloudFetch } from "./proxy-ylK5lpw8.js";
-import { a as attachFrame, i as quota, r as QuotaStatus, t as available } from "./cloud-Y0FzWpFT.js";
+import { t as cloudFetch } from "./proxy-dOOmiMl4.js";
+import { a as attachFrame, i as quota, r as QuotaStatus, t as available } from "./cloud-DyOQPyUB.js";
 import { t as dns_d_exports } from "./dns.js";
-import { n as fs_d_exports } from "./fs-D0MMRnHC.js";
-import { s as net_d_exports } from "./net-BOswhyfE.js";
+import { n as fs_d_exports } from "./fs-KA1Mgisv.js";
+import { s as net_d_exports } from "./net-CmMZgV2a.js";
 import { t as dgram_d_exports } from "./dgram.js";
 import { t as http_d_exports } from "./http.js";
 export { type QuotaStatus, attachFrame, available, dgram_d_exports as dgram, dns_d_exports as dns, cloudFetch as fetch, fs_d_exports as fs, http_d_exports as http, net_d_exports as net, quota };

package/{contract-DJxGa8lb.d.ts → contract-6Xfd_qel.d.ts}

@@ -1,5 +1,5 @@
-import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-Cgnfjh9o.js";
-import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
+import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-BOInGaEl.js";
+import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 //#region ../web-extension/lib/lib/storage-state.d.ts
 /**
  * A `storageState` cookie in the cloud jar's own shape (mirage's `Cookie`): `domain` always with
@@ -78,7 +78,7 @@ type WriteData = ArrayBuffer | Uint8Array | string;
 /**
  * The trailing option of every pinned storage call: a value `accountPin()` answered. The api refuses the
  * call ACCOUNT_CHANGED when the signed-in account (or the app) is not the one the pin was taken under.
- * Absent, the call is sent exactly as it was before pins existed.
+ * Absent, the call is unpinned.
  */
 type AccountPinOptions = {
   accountPin?: string;
@@ -558,8 +558,9 @@ type RoomMessage = {
   text: string;
 };
 /**
- * What a claimed room's mailbox holds, as the room last said. Null for a room nobody has claimed.
- * `cap` is the most it stores: 500 MB, or the size limit the account set in its fkn.app settings.
+ * What a claimed room's mailbox holds, as the room last said. Null for a room that keeps no messages:
+ * one nobody has claimed, or a claim whose mailbox is off. `cap` is the most it stores: 500 MB, or the
+ * size limit the account set in its fkn.app settings.
  */
 type RoomMailbox = {
   messages: number;
@@ -600,12 +601,15 @@ type RoomEvent =
 } |
 /**
  * the room was claimed, released (by its app, or by the account in its fkn.app settings) or
- * dissolved; `owner` is the owner's member id, or '' while a claimed room's owner has never joined
+ * dissolved, or its mailbox was turned off or on; `owner` is the owner's member id, or '' while a
+ * claimed room's owner has never joined. `mailbox` is whether the room now keeps messages, always
+ * false while `claimed` is false. Turning a mailbox off sends no `deleted`: what the app shows stays.
  */
 {
   type: 'claim';
   claimed: boolean;
   owner: string;
+  mailbox: boolean;
 };
 type RoomsErrorCode = 'invalid' | 'not-found' | 'bad-key' | 'full' | 'blocked' | 'denied' | 'rate-limited' | 'too-large' | 'storage' | 'quota' | 'unavailable' | 'closed';
 /** A refusal, as data. `packages` crosses the hop the same way, and for the same reason. */
@@ -646,8 +650,10 @@ type RoomClaimOptions = {
    * settings, where it can clear or unclaim the room, so say what would be lost. One line of plain text:
    * trimmed, then 1 to 200 characters as `String.length` counts them, with no control character, line or
    * paragraph separator, or bidi control; anything else is refused `invalid`, never cut short. Not sealed:
-   * stored with the claim and shown to the account only. Claiming again with one replaces it, from the app
-   * that claimed the room only (the same app once it is verified); claiming without one keeps it.
+   * stored with the claim and shown to the account only. Claiming again with one replaces it: on a room
+   * under an app's scope from the app that claimed the room only (the same app once it is verified), and
+   * from another app it is refused `denied` (`rooms: only the app that claimed the room can describe it`);
+   * on a `global` room from any app of the account. Claiming without one keeps it.
    */
   description?: string;
   /**
@@ -665,11 +671,27 @@ type RoomClaimOptions = {
    * room. It counts toward the account's room limit while it lasts and frees the slot when it ends.
    *
    * The latest claim decides: claiming again without it makes the room permanent, and with it makes it
-   * temporary again. Only the app that claimed the room (the same app once it is verified) sets or
-   * changes it; from another app it is refused `denied`, and a claim from another app without it leaves
-   * the room as it was.
+   * temporary again. On a room under an app's scope only the app that claimed the room (the same app
+   * once it is verified) sets or changes it, and from another app it is refused `denied` (`rooms: only
+   * the app that claimed the room can set when it expires`); on a `global` room any app of the account
+   * does. A claim from another app without it leaves the room as it was, on either kind of room.
    */
   temporary?: boolean | number;
+  /**
+   * Whether the room keeps its messages. `false` claims the name and stores nothing: a message reaches
+   * whoever is present and is kept nowhere, `backlog` answers an empty page, and `edit` and `delete` are
+   * refused `invalid` (`rooms: the room keeps no messages`). The claim still reserves the name, locks it
+   * to the key and keeps the owner, the blocks and the overrides when everyone leaves, and it still needs
+   * premium. `true` or no value keeps a mailbox. Anything else is refused `invalid` (`rooms: malformed
+   * frame`).
+   *
+   * Read only when the call starts the claim: on a room the account already holds it is ignored, so an
+   * app that claims on every open never undoes what the owner chose since. A claim landing after a
+   * temporary one ran out starts a new claim, so it reads it again. A broker too old to carry it refuses
+   * `false` `unavailable` (`rooms: the mailbox switch is not available`) rather than store what the app
+   * asked it not to.
+   */
+  mailbox?: boolean;
 };
 /** What a backlog page answered: the highest seq it sent, and whether another page follows. */
 type RoomBacklog = {
@@ -701,49 +723,108 @@ type RoomHandle = {
    * let the room outlive what the app asked for.
    */
   temporaryClaims?: true;
+  /**
+   * set by a broker that carries `mailbox` on a claim and sends `setMailbox`. A broker older than that
+   * drops the option and claims with a mailbox, and has no `setMailbox`, so the lib refuses both on a
+   * handle without it rather than store what the app asked it not to.
+   */
+  mailboxSwitch?: true;
   defaults: () => Promise<RoomDefaults>;
   members: () => Promise<RoomMember[]>;
   /** sealed before it leaves the browser and refused, never truncated, past this member's `maxMessageBytes` on the wire */
   send: (text: string) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** a stored message's text, replaced: the sender's own, or any as the owner */
+  /**
+   * a stored message's text, replaced: the sender's own, or any as the owner. From another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), the account's own messages included, as `claim` says.
+   */
   edit: (seq: number, text: string) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** stored messages dropped: one of the sender's own, or any range as the owner */
+  /**
+   * stored messages dropped: one of the sender's own, or any range as the owner. From another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), the account's own messages included, as `claim` says.
+   */
   delete: (from: number, to?: number) => Promise<RoomsFail | {
     ok: true;
   }>;
   /** replays stored messages above `after` as `message` events marked `replayed`, one page at a time */
   backlog: (after: number, limit?: number) => Promise<RoomsFail | RoomBacklog>;
+  /**
+   * the room default for `send` or `receive`, from the owner only (`denied`, `rooms: not the room
+   * owner`). From another app of the claim's account on a room claimed under an app's scope, `denied`
+   * (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   setDefault: (permission: 'send' | 'receive', value: boolean) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** the message size cap: the room default when no member is named, that member's override otherwise, cleared by null */
+  /**
+   * the message size cap: the room default when no member is named, that member's override otherwise,
+   * cleared by null. From the owner only (`denied`, `rooms: not the room owner`); from another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), as `claim` says.
+   */
   limit: (maxMessageBytes: number | null, id?: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member's override of a permission, set to true, from the owner only (`denied`, `rooms: not the
+   * room owner`). From another app of the claim's account on a room claimed under an app's scope,
+   * `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   grant: (id: string, permission: RoomPermission) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member's override of a permission, set to false, from the owner only (`denied`, `rooms: not the
+   * room owner`). From another app of the claim's account on a room claimed under an app's scope,
+   * `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   revoke: (id: string, permission: RoomPermission) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member sent out, free to join again, with the `remove` permission (`denied`, `rooms: permission
+   * denied`). From another app of the claim's account on a room claimed under an app's scope, `denied`
+   * (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   remove: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member sent out and kept out, with the `block` permission (`denied`, `rooms: permission denied`).
+   * From another app of the claim's account on a room claimed under an app's scope, `denied` (`rooms:
+   * only the app that claimed the room can change it`), as `claim` says.
+   */
   block: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a block lifted, with the `block` permission (`denied`, `rooms: permission denied`). From another app
+   * of the claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that
+   * claimed the room can change it`), as `claim` says.
+   */
   unblock: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
   /**
-   * keeps the name and a mailbox for the signed-in premium account; the only thing in rooms that premium
-   * buys. `description` says what the room is for, shown to the account in its fkn.app settings.
-   * `temporary` makes the claim end by itself that many milliseconds after its last claim (`true` is 7
-   * days); the broker carries it as a number of milliseconds and never as `true`.
+   * keeps the name for the signed-in premium account, and a mailbox unless `mailbox` is false; the only
+   * thing in rooms that premium buys. `description` says what the room is for, shown to the account in
+   * its fkn.app settings. `temporary` makes the claim end by itself that many milliseconds after its last
+   * claim (`true` is 7 days); the broker carries it as a number of milliseconds and never as `true`.
+   * `mailbox` is read only when the call starts the claim.
+   *
+   * A room under an app's scope, which is every room but a `global` one, is changed by the claim's
+   * account only through the app that claimed it (the same app once it is verified): from another app of
+   * the account `setDefault`, `limit`, `grant`, `revoke`, `remove`, `block`, `unblock`, `setMailbox`,
+   * `edit` and `delete` answer `denied` (`rooms: only the app that claimed the room can change it`), the
+   * account's own messages included, and `unavailable` while the room cannot tell whether two apps are
+   * one. A claimed `global` room is changed by any app of the account, which also describes it, sets its
+   * `temporary` and releases it. The account's fkn.app settings
+   * change every room it claimed, and members of other accounts are answered as in any room.
    *
    * Past the account's room limit the call waits while fkn.app shows the person their claimed rooms over
    * your app, with Unclaim on each: it answers `{ ok: true }` once one is unclaimed and this claim is
@@ -753,6 +834,15 @@ type RoomHandle = {
   claim: (options?: RoomClaimOptions) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * the owner turns a claimed room's mailbox off, deleting what it stored, or on, starting it empty.
+   * Answers once the room is in that state and has tried to tell the api its storage figure; the answer
+   * does not say whether the api heard it. From another app of the claim's account on a room claimed
+   * under an app's scope, `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
+  setMailbox: (on: boolean) => Promise<RoomsFail | {
+    ok: true;
+  }>;
   release: () => Promise<RoomsFail | {
     ok: true;
   }>;
@@ -806,9 +896,6 @@ type ProxyFetchInput = string | URL | Request;
  * A spread request is the app's own choice and is not announced: the header keeps naming the
  * session's node, which every request not carrying this flag still goes through. Only the cloud
  * backend reads it; the extension and the desktop fetch from the user's own address and ignore it.
- *
- * `render` used to sit here. It set a request header the proxy never read and never listed for CORS,
- * so a caller that passed it failed its own preflight; nothing did, and it is gone.
  */
 type ProxyFetchInit = (RequestInit & {
   spread?: boolean;

package/contract.d.ts

@@ -1,4 +1,4 @@
-import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-Cgnfjh9o.js";
-import { $ as RoomHandle, A as MiddleGotoOptions, At as WINDOW_HELLO_TIMEOUT_MS, B as ProxyFetch, C as FrameMessageRelay, Ct as TcpSocketListenerResult, D as IpFamily, Dt as UdpSocketOptions, E as InstalledPackage, Et as UdpDatagram, F as PackageResult, Ft as JarSeedCookie, G as Radii, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, L as PackagesFail, M as OverlayRect, Mt as WindowMiddleControl, N as OverlayState, Nt as WriteData, O as JAR_ANCHOR_MESSAGE, Ot as UdpSocketResult, P as PackageQuery, Pt as JarSeed, Q as RoomEvent, R as PickOptions, S as FrameFetchScope, St as TcpSocketListenerOptions, T as InstallOptions, Tt as TcpSocketResult, U as Quota, V as ProxyFetchInit, W as ROOM_TEMPORARY_MS, X as RoomDefaults, Y as RoomCreateOptions, Z as RoomEnd, _ as DnsLookup, _t as ShellGotoOptions, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, bt as StorageQuota, c as AdoptRequest, ct as RoomsFail, d as ConflictRequest, dt as SHELL_FRAME_MESSAGE, et as RoomJoinOptions, f as ConflictSide, ft as SHELL_JAR_MESSAGE, g as DisplayLevel, gt as ShellFrameMessage, h as DisplayCause, ht as ShellControl, i as Account, it as RoomOpenOptions, j as MountDescriptor, jt as WINDOW_JAR_MODE_TIMEOUT_MS, k as MiddleControl, kt as WINDOW_HANDSHAKE_TIMEOUT_MS, l as AdoptState, lt as SHELL_ATTACH_ERROR, m as ConnectOptions, mt as SetOverlayHost, n as ATTACH_WINDOW_KEY, nt as RoomMember, o as AccountPinOptions, ot as RoomPermissions, p as ConnectAvailability, pt as SHELL_JAR_UNREACHABLE, q as RoomBacklog, r as ATTACH_WINDOW_MESSAGE, rt as RoomMessage, s as AddressLookupResult, st as RoomsErrorCode, t as ATTACH_FRAME_KEY, tt as RoomMailbox, u as ConflictChoice, ut as SHELL_CONTROL_KEY, v as EncryptionState, vt as ShellJarUnreachable, w as HiddenSurface, wt as TcpSocketOptions, x as FrameConsentRequest, xt as SurfaceRect, y as FRAME_MESSAGE, yt as StorageEntry, z as Placement } from "./contract-DJxGa8lb.js";
-import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
+import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-BOInGaEl.js";
+import { $ as RoomHandle, A as MiddleGotoOptions, At as WINDOW_HELLO_TIMEOUT_MS, B as ProxyFetch, C as FrameMessageRelay, Ct as TcpSocketListenerResult, D as IpFamily, Dt as UdpSocketOptions, E as InstalledPackage, Et as UdpDatagram, F as PackageResult, Ft as JarSeedCookie, G as Radii, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, L as PackagesFail, M as OverlayRect, Mt as WindowMiddleControl, N as OverlayState, Nt as WriteData, O as JAR_ANCHOR_MESSAGE, Ot as UdpSocketResult, P as PackageQuery, Pt as JarSeed, Q as RoomEvent, R as PickOptions, S as FrameFetchScope, St as TcpSocketListenerOptions, T as InstallOptions, Tt as TcpSocketResult, U as Quota, V as ProxyFetchInit, W as ROOM_TEMPORARY_MS, X as RoomDefaults, Y as RoomCreateOptions, Z as RoomEnd, _ as DnsLookup, _t as ShellGotoOptions, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, bt as StorageQuota, c as AdoptRequest, ct as RoomsFail, d as ConflictRequest, dt as SHELL_FRAME_MESSAGE, et as RoomJoinOptions, f as ConflictSide, ft as SHELL_JAR_MESSAGE, g as DisplayLevel, gt as ShellFrameMessage, h as DisplayCause, ht as ShellControl, i as Account, it as RoomOpenOptions, j as MountDescriptor, jt as WINDOW_JAR_MODE_TIMEOUT_MS, k as MiddleControl, kt as WINDOW_HANDSHAKE_TIMEOUT_MS, l as AdoptState, lt as SHELL_ATTACH_ERROR, m as ConnectOptions, mt as SetOverlayHost, n as ATTACH_WINDOW_KEY, nt as RoomMember, o as AccountPinOptions, ot as RoomPermissions, p as ConnectAvailability, pt as SHELL_JAR_UNREACHABLE, q as RoomBacklog, r as ATTACH_WINDOW_MESSAGE, rt as RoomMessage, s as AddressLookupResult, st as RoomsErrorCode, t as ATTACH_FRAME_KEY, tt as RoomMailbox, u as ConflictChoice, ut as SHELL_CONTROL_KEY, v as EncryptionState, vt as ShellJarUnreachable, w as HiddenSurface, wt as TcpSocketOptions, x as FrameConsentRequest, xt as SurfaceRect, y as FRAME_MESSAGE, yt as StorageEntry, z as Placement } from "./contract-6Xfd_qel.js";
+import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 export { ATTACH_FRAME_KEY, ATTACH_WINDOW_KEY, ATTACH_WINDOW_MESSAGE, Account, AccountChange, AccountPinOptions, AddressLookupResult, AdoptRequest, AdoptState, type ClearCookiesWire, ConflictChoice, ConflictRequest, ConflictSide, ConnectAvailability, ConnectOptions, type CookieMatchWire, DisplayCause, DisplayLevel, DnsLookup, EncryptionState, FRAME_MESSAGE, FrameConsentAnswer, FrameConsentRequest, FrameFetchScope, FrameMessageRelay, HiddenSurface, InstallOptions, InstalledPackage, IpFamily, JAR_ANCHOR_MESSAGE, type JarSeed, type JarSeedCookie, MiddleControl, MiddleGotoOptions, MountDescriptor, OverlayRect, OverlayState, PackageQuery, PackageResult, PackagesErrorCode, PackagesFail, PickOptions, Placement, ProxyFetch, ProxyFetchInit, ProxyFetchInput, Quota, ROOM_TEMPORARY_MS, Radii, Resolvers, RoomBacklog, RoomClaimOptions, RoomCreateOptions, RoomDefaults, RoomEnd, RoomEvent, RoomHandle, RoomJoinOptions, RoomMailbox, RoomMember, RoomMessage, RoomOpenOptions, RoomPermission, RoomPermissions, RoomsErrorCode, RoomsFail, SHELL_ATTACH_ERROR, SHELL_CONTROL_KEY, SHELL_FRAME_MESSAGE, SHELL_JAR_MESSAGE, SHELL_JAR_UNREACHABLE, SetOverlayHost, ShellControl, ShellFrameMessage, ShellGotoOptions, ShellJarUnreachable, StorageEntry, StorageQuota, SurfaceRect, TcpSocketListenerOptions, TcpSocketListenerResult, type TcpSocketOption, TcpSocketOptions, TcpSocketResult, UdpDatagram, type UdpSocketOption, UdpSocketOptions, UdpSocketResult, WINDOW_HANDSHAKE_TIMEOUT_MS, WINDOW_HELLO_TIMEOUT_MS, WINDOW_JAR_MODE_TIMEOUT_MS, WindowMiddleControl, WriteData };

package/dgram.d.ts

@@ -1,6 +1,6 @@
-import { K as Resolvers, Ot as UdpSocketResult } from "./contract-DJxGa8lb.js";
-import { v as UdpSocketOption } from "./wire-Gbo-D74t.js";
-import "./api-H1TzWitc.js";
+import { K as Resolvers, Ot as UdpSocketResult } from "./contract-6Xfd_qel.js";
+import { v as UdpSocketOption } from "./wire-BwA4JjZH.js";
+import "./api-CFkZVr53.js";
 import { Buffer } from "buffer";
 import { AddressInfo } from "net";
 import { EventEmitter } from "events";
@@ -62,17 +62,10 @@ export declare class Socket extends EventEmitter implements Socket$2 {
   bind(callback?: (() => void) | undefined): this;
   bind(options: BindOptions, callback?: (() => void) | undefined): this;
   /**
-   * Wire a datagram socket up from a connection already in hand, and report it as bound.
-   *
-   * `endpoints` publishes the local address SYNCHRONOUSLY, for the same reason net.ts's TCP
-   * equivalent does: `address()` throws EBADF until the promise below resolves, so a caller that
-   * reads it in the same turn as the bind gets an exception rather than the answer. Node fills an
-   * address in before it reports a socket as bound.
-   *
-   * Splitting this out of `bind()` is also what gives a test a seam. Everything a refused bind does
-   * lives past `apiWithin`, so without this the only way to reach it is to mock the resolver, and
-   * the guard on that path stayed untested through the whole period the relay could not refuse a
-   * bind at all.
+   * Wires the socket up from a connection already in hand and reports it as bound; also the seam a
+   * test uses to reach a refused bind without mocking the resolver. `endpoints` publishes the local
+   * address synchronously, as net.ts does: `address()` throws EBADF until the connection resolves,
+   * while Node fills an address in before reporting a socket bound.
    */
   __webvpn_udp_socket_init__(connection: ReturnType<WebVpnUdpSocket>, endpoints?: Awaited<ReturnType<WebVpnUdpSocket>>): Promise<UdpSocketResult | undefined>;
   close(callback?: (() => void) | undefined): this;

package/dns.d.ts

@@ -1,4 +1,4 @@
-import { s as AddressLookupResult } from "./contract-DJxGa8lb.js";
+import { s as AddressLookupResult } from "./contract-6Xfd_qel.js";
 declare namespace dns_d_exports {
   export { AddressLookupResult, lookup };
 }