@fkn/lib 0.9.43 → 0.9.45

package/{contract-DJxGa8lb.d.ts → contract-DP_jc5pZ.d.ts}

@@ -1,5 +1,5 @@
-import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-Cgnfjh9o.js";
-import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
+import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-C8Y-YHrU.js";
+import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 //#region ../web-extension/lib/lib/storage-state.d.ts
 /**
  * A `storageState` cookie in the cloud jar's own shape (mirage's `Cookie`): `domain` always with
@@ -78,7 +78,7 @@ type WriteData = ArrayBuffer | Uint8Array | string;
 /**
  * The trailing option of every pinned storage call: a value `accountPin()` answered. The api refuses the
  * call ACCOUNT_CHANGED when the signed-in account (or the app) is not the one the pin was taken under.
- * Absent, the call is sent exactly as it was before pins existed.
+ * Absent, the call is unpinned.
  */
 type AccountPinOptions = {
   accountPin?: string;
@@ -118,12 +118,19 @@ type FrameFetchScope = 'frame.fetchRead' | 'frame.fetchWrite';
  *
  * A category asks for every capability in it; a `key` asks for one critical permission's own row,
  * and is refused unless the registry has that key at severity 4 (none today). A critical grant
- * covers that key alone, never another key or its category. `attach` binds an "Allow once" answer
- * to the attachment that asked, so no other attachment can consume it.
+ * covers that key alone, never another key or its category. On a `key`, `attach` binds an "Allow
+ * once" answer to the attachment that asked, so no other attachment can consume it.
+ *
+ * On an Interaction or Site data entry, `attach` is set when the call stays in the frame's own
+ * document (no `frameLocator` or `owner` step), and lets the card offer that page: it reads where
+ * that attachment's frame is from its middle page, never from the app, so the app learns no path. A
+ * card that predates it ignores it and offers the whole site. Upfront asks, Network and Evaluation
+ * never send it.
  */
 type FrameConsentRequest = {
   category: 'interaction' | 'storage' | 'network' | 'evaluation';
   hosts: string[];
+  attach?: string;
 } | {
   key: string;
   hosts: string[];
@@ -215,6 +222,33 @@ declare const SHELL_JAR_MESSAGE: {
  */
 declare const SHELL_JAR_UNREACHABLE: readonly ['bad-attach', 'no-storage', 'bad-jar', 'no-parent', 'no-jar-host', 'no-token', 'no-indexeddb', 'failed'];
 type ShellJarUnreachable = (typeof SHELL_JAR_UNREACHABLE)[number];
+/**
+ * FKN internal: why `Resolvers.proxyJar.key` answered no key. Only the render proxy's own documents
+ * ask, and only these names cross the wire.
+ *
+ * - `not-proxy`: the caller is not the render proxy's own origin.
+ * - `signed-out`: no account backs the app the proxy is attached to.
+ * - `not-enrolled`: the account has no key material, so there is nothing to seal under.
+ * - `locked`: the account has key material, and this partition holds no key for it.
+ * - `unconfirmed`: nothing answered in time, so neither of the two above is known.
+ */
+declare const PROXY_JAR_REFUSALS: readonly ['not-proxy', 'signed-out', 'not-enrolled', 'locked', 'unconfirmed'];
+type ProxyJarRefusal = (typeof PROXY_JAR_REFUSALS)[number];
+/**
+ * The key the render proxy seals one jar under. `key` is 32 bytes for AES-GCM and `jar` the name of the
+ * record (43 base64url characters); both are derived from the account's key for the top-level site the
+ * jar's storage partition belongs to, so a key handed out in one partition opens no other partition's
+ * jar. `verified` is false when no api answer vouched for the key's generation: such a key may open a
+ * record that exists, and must not create one or move a clear jar into one.
+ */
+type ProxyJarKey = {
+  key: Uint8Array;
+  jar: string;
+  verified: boolean;
+};
+type ProxyJarAnswer = ProxyJarKey | {
+  refused: ProxyJarRefusal;
+};
 /**
  * What a window's middle page, the jar anchor its app mounted (`/attach-jar`) and the anchor's jar
  * host say, all with the attach id.
@@ -310,9 +344,12 @@ type ShellControl = {
    *
    * Refuses, before anything is removed: a filter of any other shape (a TypeError
    * `frame.clearCookies: malformed filter`), an empty `scope.hosts`, and a string `domain` whose
-   * registered domain is none of the hosts' (each a LocatorDeniedError naming why). Rejects with the
-   * library's own message when the jar's store did not take the removal. Absent from a shell that
-   * predates it.
+   * registered domain is none of the hosts' (each a LocatorDeniedError naming why), and, on a jar
+   * sealed under the FKN account's key while this device does not hold the key, every filter (an
+   * Error `frame.clearCookies: this attachment's jar is sealed under the FKN account's key, which this
+   * device does not hold yet; unlock it and call it again`, from a shell from 2026-10 on). Rejects
+   * with the library's own message when the jar's store did not take the removal. Absent from a shell
+   * that predates it.
    */
   clearCookies?(filter: ClearCookiesWire, scope: {
     hosts: string[];
@@ -558,8 +595,9 @@ type RoomMessage = {
   text: string;
 };
 /**
- * What a claimed room's mailbox holds, as the room last said. Null for a room nobody has claimed.
- * `cap` is the most it stores: 500 MB, or the size limit the account set in its fkn.app settings.
+ * What a claimed room's mailbox holds, as the room last said. Null for a room that keeps no messages:
+ * one nobody has claimed, or a claim whose mailbox is off. `cap` is the most it stores: 500 MB, or the
+ * size limit the account set in its fkn.app settings.
  */
 type RoomMailbox = {
   messages: number;
@@ -600,12 +638,15 @@ type RoomEvent =
 } |
 /**
  * the room was claimed, released (by its app, or by the account in its fkn.app settings) or
- * dissolved; `owner` is the owner's member id, or '' while a claimed room's owner has never joined
+ * dissolved, or its mailbox was turned off or on; `owner` is the owner's member id, or '' while a
+ * claimed room's owner has never joined. `mailbox` is whether the room now keeps messages, always
+ * false while `claimed` is false. Turning a mailbox off sends no `deleted`: what the app shows stays.
  */
 {
   type: 'claim';
   claimed: boolean;
   owner: string;
+  mailbox: boolean;
 };
 type RoomsErrorCode = 'invalid' | 'not-found' | 'bad-key' | 'full' | 'blocked' | 'denied' | 'rate-limited' | 'too-large' | 'storage' | 'quota' | 'unavailable' | 'closed';
 /** A refusal, as data. `packages` crosses the hop the same way, and for the same reason. */
@@ -646,8 +687,10 @@ type RoomClaimOptions = {
    * settings, where it can clear or unclaim the room, so say what would be lost. One line of plain text:
    * trimmed, then 1 to 200 characters as `String.length` counts them, with no control character, line or
    * paragraph separator, or bidi control; anything else is refused `invalid`, never cut short. Not sealed:
-   * stored with the claim and shown to the account only. Claiming again with one replaces it, from the app
-   * that claimed the room only (the same app once it is verified); claiming without one keeps it.
+   * stored with the claim and shown to the account only. Claiming again with one replaces it: on a room
+   * under an app's scope from the app that claimed the room only (the same app once it is verified), and
+   * from another app it is refused `denied` (`rooms: only the app that claimed the room can describe it`);
+   * on a `global` room from any app of the account. Claiming without one keeps it.
    */
   description?: string;
   /**
@@ -665,11 +708,27 @@ type RoomClaimOptions = {
    * room. It counts toward the account's room limit while it lasts and frees the slot when it ends.
    *
    * The latest claim decides: claiming again without it makes the room permanent, and with it makes it
-   * temporary again. Only the app that claimed the room (the same app once it is verified) sets or
-   * changes it; from another app it is refused `denied`, and a claim from another app without it leaves
-   * the room as it was.
+   * temporary again. On a room under an app's scope only the app that claimed the room (the same app
+   * once it is verified) sets or changes it, and from another app it is refused `denied` (`rooms: only
+   * the app that claimed the room can set when it expires`); on a `global` room any app of the account
+   * does. A claim from another app without it leaves the room as it was, on either kind of room.
    */
   temporary?: boolean | number;
+  /**
+   * Whether the room keeps its messages. `false` claims the name and stores nothing: a message reaches
+   * whoever is present and is kept nowhere, `backlog` answers an empty page, and `edit` and `delete` are
+   * refused `invalid` (`rooms: the room keeps no messages`). The claim still reserves the name, locks it
+   * to the key and keeps the owner, the blocks and the overrides when everyone leaves, and it still needs
+   * premium. `true` or no value keeps a mailbox. Anything else is refused `invalid` (`rooms: malformed
+   * frame`).
+   *
+   * Read only when the call starts the claim: on a room the account already holds it is ignored, so an
+   * app that claims on every open never undoes what the owner chose since. A claim landing after a
+   * temporary one ran out starts a new claim, so it reads it again. A broker too old to carry it refuses
+   * `false` `unavailable` (`rooms: the mailbox switch is not available`) rather than store what the app
+   * asked it not to.
+   */
+  mailbox?: boolean;
 };
 /** What a backlog page answered: the highest seq it sent, and whether another page follows. */
 type RoomBacklog = {
@@ -701,49 +760,108 @@ type RoomHandle = {
    * let the room outlive what the app asked for.
    */
   temporaryClaims?: true;
+  /**
+   * set by a broker that carries `mailbox` on a claim and sends `setMailbox`. A broker older than that
+   * drops the option and claims with a mailbox, and has no `setMailbox`, so the lib refuses both on a
+   * handle without it rather than store what the app asked it not to.
+   */
+  mailboxSwitch?: true;
   defaults: () => Promise<RoomDefaults>;
   members: () => Promise<RoomMember[]>;
   /** sealed before it leaves the browser and refused, never truncated, past this member's `maxMessageBytes` on the wire */
   send: (text: string) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** a stored message's text, replaced: the sender's own, or any as the owner */
+  /**
+   * a stored message's text, replaced: the sender's own, or any as the owner. From another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), the account's own messages included, as `claim` says.
+   */
   edit: (seq: number, text: string) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** stored messages dropped: one of the sender's own, or any range as the owner */
+  /**
+   * stored messages dropped: one of the sender's own, or any range as the owner. From another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), the account's own messages included, as `claim` says.
+   */
   delete: (from: number, to?: number) => Promise<RoomsFail | {
     ok: true;
   }>;
   /** replays stored messages above `after` as `message` events marked `replayed`, one page at a time */
   backlog: (after: number, limit?: number) => Promise<RoomsFail | RoomBacklog>;
+  /**
+   * the room default for `send` or `receive`, from the owner only (`denied`, `rooms: not the room
+   * owner`). From another app of the claim's account on a room claimed under an app's scope, `denied`
+   * (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   setDefault: (permission: 'send' | 'receive', value: boolean) => Promise<RoomsFail | {
     ok: true;
   }>;
-  /** the message size cap: the room default when no member is named, that member's override otherwise, cleared by null */
+  /**
+   * the message size cap: the room default when no member is named, that member's override otherwise,
+   * cleared by null. From the owner only (`denied`, `rooms: not the room owner`); from another app of the
+   * claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that claimed
+   * the room can change it`), as `claim` says.
+   */
   limit: (maxMessageBytes: number | null, id?: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member's override of a permission, set to true, from the owner only (`denied`, `rooms: not the
+   * room owner`). From another app of the claim's account on a room claimed under an app's scope,
+   * `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   grant: (id: string, permission: RoomPermission) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member's override of a permission, set to false, from the owner only (`denied`, `rooms: not the
+   * room owner`). From another app of the claim's account on a room claimed under an app's scope,
+   * `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   revoke: (id: string, permission: RoomPermission) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member sent out, free to join again, with the `remove` permission (`denied`, `rooms: permission
+   * denied`). From another app of the claim's account on a room claimed under an app's scope, `denied`
+   * (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
   remove: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a member sent out and kept out, with the `block` permission (`denied`, `rooms: permission denied`).
+   * From another app of the claim's account on a room claimed under an app's scope, `denied` (`rooms:
+   * only the app that claimed the room can change it`), as `claim` says.
+   */
   block: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * a block lifted, with the `block` permission (`denied`, `rooms: permission denied`). From another app
+   * of the claim's account on a room claimed under an app's scope, `denied` (`rooms: only the app that
+   * claimed the room can change it`), as `claim` says.
+   */
   unblock: (id: string) => Promise<RoomsFail | {
     ok: true;
   }>;
   /**
-   * keeps the name and a mailbox for the signed-in premium account; the only thing in rooms that premium
-   * buys. `description` says what the room is for, shown to the account in its fkn.app settings.
-   * `temporary` makes the claim end by itself that many milliseconds after its last claim (`true` is 7
-   * days); the broker carries it as a number of milliseconds and never as `true`.
+   * keeps the name for the signed-in premium account, and a mailbox unless `mailbox` is false; the only
+   * thing in rooms that premium buys. `description` says what the room is for, shown to the account in
+   * its fkn.app settings. `temporary` makes the claim end by itself that many milliseconds after its last
+   * claim (`true` is 7 days); the broker carries it as a number of milliseconds and never as `true`.
+   * `mailbox` is read only when the call starts the claim.
+   *
+   * A room under an app's scope, which is every room but a `global` one, is changed by the claim's
+   * account only through the app that claimed it (the same app once it is verified): from another app of
+   * the account `setDefault`, `limit`, `grant`, `revoke`, `remove`, `block`, `unblock`, `setMailbox`,
+   * `edit` and `delete` answer `denied` (`rooms: only the app that claimed the room can change it`), the
+   * account's own messages included, and `unavailable` while the room cannot tell whether two apps are
+   * one. A claimed `global` room is changed by any app of the account, which also describes it, sets its
+   * `temporary` and releases it. The account's fkn.app settings
+   * change every room it claimed, and members of other accounts are answered as in any room.
    *
    * Past the account's room limit the call waits while fkn.app shows the person their claimed rooms over
    * your app, with Unclaim on each: it answers `{ ok: true }` once one is unclaimed and this claim is
@@ -753,6 +871,15 @@ type RoomHandle = {
   claim: (options?: RoomClaimOptions) => Promise<RoomsFail | {
     ok: true;
   }>;
+  /**
+   * the owner turns a claimed room's mailbox off, deleting what it stored, or on, starting it empty.
+   * Answers once the room is in that state and has tried to tell the api its storage figure; the answer
+   * does not say whether the api heard it. From another app of the claim's account on a room claimed
+   * under an app's scope, `denied` (`rooms: only the app that claimed the room can change it`), as `claim` says.
+   */
+  setMailbox: (on: boolean) => Promise<RoomsFail | {
+    ok: true;
+  }>;
   release: () => Promise<RoomsFail | {
     ok: true;
   }>;
@@ -806,9 +933,6 @@ type ProxyFetchInput = string | URL | Request;
  * A spread request is the app's own choice and is not announced: the header keeps naming the
  * session's node, which every request not carrying this flag still goes through. Only the cloud
  * backend reads it; the extension and the desktop fetch from the user's own address and ignore it.
- *
- * `render` used to sit here. It set a request header the proxy never read and never listed for CORS,
- * so a caller that passed it failed its own preflight; nothing did, and it is gone.
  */
 type ProxyFetchInit = (RequestInit & {
   spread?: boolean;
@@ -1011,6 +1135,16 @@ type Resolvers = {
     onUpdateTaken: (callback: () => void) => () => void;
     applyUpdate: () => Promise<boolean>;
   };
+  /** FKN internal: answers the render proxy's own origin only, every other caller gets `not-proxy`. */
+  proxyJar: {
+    /**
+     * The key of the cookie jar in the caller's storage partition. Refusals cross as data. `prompt`
+     * raises the key card, at most once per broker document, when the answer would be `locked`.
+     */
+    key: (options?: {
+      prompt?: boolean;
+    }) => Promise<ProxyJarAnswer>;
+  };
   proxyFetch: ProxyFetch;
   webVpnTcpSocket: (options: TcpSocketOptions) => Promise<TcpSocketResult>;
   webVpnTcpSocketListener: (options: TcpSocketListenerOptions) => Promise<TcpSocketListenerResult>;
@@ -1021,4 +1155,4 @@ type Resolvers = {
   hideInstallPrompt: () => void;
 };
 //#endregion
-export { RoomHandle as $, MiddleGotoOptions as A, WINDOW_HELLO_TIMEOUT_MS as At, ProxyFetch as B, FrameMessageRelay as C, TcpSocketListenerResult as Ct, IpFamily as D, UdpSocketOptions as Dt, InstalledPackage as E, UdpDatagram as Et, PackageResult as F, JarSeedCookie as Ft, Radii as G, ProxyFetchInput as H, PackagesErrorCode as I, RoomClaimOptions as J, Resolvers as K, PackagesFail as L, OverlayRect as M, WindowMiddleControl as Mt, OverlayState as N, WriteData as Nt, JAR_ANCHOR_MESSAGE as O, UdpSocketResult as Ot, PackageQuery as P, JarSeed as Pt, RoomEvent as Q, PickOptions as R, FrameFetchScope as S, TcpSocketListenerOptions as St, InstallOptions as T, TcpSocketResult as Tt, Quota as U, ProxyFetchInit as V, ROOM_TEMPORARY_MS as W, RoomDefaults as X, RoomCreateOptions as Y, RoomEnd as Z, DnsLookup as _, ShellGotoOptions as _t, AccountChange as a, RoomPermission as at, FrameConsentAnswer as b, StorageQuota as bt, AdoptRequest as c, RoomsFail as ct, ConflictRequest as d, SHELL_FRAME_MESSAGE as dt, RoomJoinOptions as et, ConflictSide as f, SHELL_JAR_MESSAGE as ft, DisplayLevel as g, ShellFrameMessage as gt, DisplayCause as h, ShellControl as ht, Account as i, RoomOpenOptions as it, MountDescriptor as j, WINDOW_JAR_MODE_TIMEOUT_MS as jt, MiddleControl as k, WINDOW_HANDSHAKE_TIMEOUT_MS as kt, AdoptState as l, SHELL_ATTACH_ERROR as lt, ConnectOptions as m, SetOverlayHost as mt, ATTACH_WINDOW_KEY as n, RoomMember as nt, AccountPinOptions as o, RoomPermissions as ot, ConnectAvailability as p, SHELL_JAR_UNREACHABLE as pt, RoomBacklog as q, ATTACH_WINDOW_MESSAGE as r, RoomMessage as rt, AddressLookupResult as s, RoomsErrorCode as st, ATTACH_FRAME_KEY as t, RoomMailbox as tt, ConflictChoice as u, SHELL_CONTROL_KEY as ut, EncryptionState as v, ShellJarUnreachable as vt, HiddenSurface as w, TcpSocketOptions as wt, FrameConsentRequest as x, SurfaceRect as xt, FRAME_MESSAGE as y, StorageEntry as yt, Placement as z };
+export { RoomCreateOptions as $, MiddleGotoOptions as A, UdpDatagram as At, Placement as B, FrameMessageRelay as C, StorageEntry as Ct, IpFamily as D, TcpSocketListenerResult as Dt, InstalledPackage as E, TcpSocketListenerOptions as Et, PackageQuery as F, WINDOW_JAR_MODE_TIMEOUT_MS as Ft, ProxyJarKey as G, ProxyFetchInit as H, PackageResult as I, WindowMiddleControl as It, ROOM_TEMPORARY_MS as J, ProxyJarRefusal as K, PackagesErrorCode as L, WriteData as Lt, OverlayRect as M, UdpSocketResult as Mt, OverlayState as N, WINDOW_HANDSHAKE_TIMEOUT_MS as Nt, JAR_ANCHOR_MESSAGE as O, TcpSocketOptions as Ot, PROXY_JAR_REFUSALS as P, WINDOW_HELLO_TIMEOUT_MS as Pt, RoomClaimOptions as Q, PackagesFail as R, JarSeed as Rt, FrameFetchScope as S, ShellJarUnreachable as St, InstallOptions as T, SurfaceRect as Tt, ProxyFetchInput as U, ProxyFetch as V, ProxyJarAnswer as W, Resolvers as X, Radii as Y, RoomBacklog as Z, DnsLookup as _, SHELL_JAR_UNREACHABLE as _t, AccountChange as a, RoomMailbox as at, FrameConsentAnswer as b, ShellFrameMessage as bt, AdoptRequest as c, RoomOpenOptions as ct, ConflictRequest as d, RoomsErrorCode as dt, RoomDefaults as et, ConflictSide as f, RoomsFail as ft, DisplayLevel as g, SHELL_JAR_MESSAGE as gt, DisplayCause as h, SHELL_FRAME_MESSAGE as ht, Account as i, RoomJoinOptions as it, MountDescriptor as j, UdpSocketOptions as jt, MiddleControl as k, TcpSocketResult as kt, AdoptState as l, RoomPermission as lt, ConnectOptions as m, SHELL_CONTROL_KEY as mt, ATTACH_WINDOW_KEY as n, RoomEvent as nt, AccountPinOptions as o, RoomMember as ot, ConnectAvailability as p, SHELL_ATTACH_ERROR as pt, Quota as q, ATTACH_WINDOW_MESSAGE as r, RoomHandle as rt, AddressLookupResult as s, RoomMessage as st, ATTACH_FRAME_KEY as t, RoomEnd as tt, ConflictChoice as u, RoomPermissions as ut, EncryptionState as v, SetOverlayHost as vt, HiddenSurface as w, StorageQuota as wt, FrameConsentRequest as x, ShellGotoOptions as xt, FRAME_MESSAGE as y, ShellControl as yt, PickOptions as z, JarSeedCookie as zt };

package/contract.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=`fkn-attach-frame`,t=`fkn-attach-window`,n=`sdbx-control`,r=`sdbx-attach-error`,i=`fkn-frame-message`,a=`sdbx-frame-message`,o={hello:`fkn-attach-window`,refused:`fkn-attach-window-refused`,gone:`fkn-attach-window-gone`,detach:`fkn-attach-window-detach`},s={request:`sdbx-jar-request`,port:`sdbx-jar-port`,mode:`sdbx-jar-mode`},c=[`bad-attach`,`no-storage`,`bad-jar`,`no-parent`,`no-jar-host`,`no-token`,`no-indexeddb`,`failed`],l={hello:`fkn-jar-hello`,ready:`fkn-jar-ready`,port:`fkn-jar-port`,who:`fkn-jar-who`,host:`fkn-jar-host`},u=2e4,d=3e4,f=6e4,p={default:6048e5,min:6e4,max:31536e6};exports.ATTACH_FRAME_KEY=e,exports.ATTACH_WINDOW_KEY=t,exports.ATTACH_WINDOW_MESSAGE=o,exports.FRAME_MESSAGE=i,exports.JAR_ANCHOR_MESSAGE=l,exports.ROOM_TEMPORARY_MS=p,exports.SHELL_ATTACH_ERROR=r,exports.SHELL_CONTROL_KEY=n,exports.SHELL_FRAME_MESSAGE=a,exports.SHELL_JAR_MESSAGE=s,exports.SHELL_JAR_UNREACHABLE=c,exports.WINDOW_HANDSHAKE_TIMEOUT_MS=f,exports.WINDOW_HELLO_TIMEOUT_MS=u,exports.WINDOW_JAR_MODE_TIMEOUT_MS=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=`fkn-attach-frame`,t=`fkn-attach-window`,n=`sdbx-control`,r=`sdbx-attach-error`,i=`fkn-frame-message`,a=`sdbx-frame-message`,o={hello:`fkn-attach-window`,refused:`fkn-attach-window-refused`,gone:`fkn-attach-window-gone`,detach:`fkn-attach-window-detach`},s={request:`sdbx-jar-request`,port:`sdbx-jar-port`,mode:`sdbx-jar-mode`},c=[`bad-attach`,`no-storage`,`bad-jar`,`no-parent`,`no-jar-host`,`no-token`,`no-indexeddb`,`failed`],l=[`not-proxy`,`signed-out`,`not-enrolled`,`locked`,`unconfirmed`],u={hello:`fkn-jar-hello`,ready:`fkn-jar-ready`,port:`fkn-jar-port`,who:`fkn-jar-who`,host:`fkn-jar-host`},d=2e4,f=3e4,p=6e4,m={default:6048e5,min:6e4,max:31536e6};exports.ATTACH_FRAME_KEY=e,exports.ATTACH_WINDOW_KEY=t,exports.ATTACH_WINDOW_MESSAGE=o,exports.FRAME_MESSAGE=i,exports.JAR_ANCHOR_MESSAGE=u,exports.PROXY_JAR_REFUSALS=l,exports.ROOM_TEMPORARY_MS=m,exports.SHELL_ATTACH_ERROR=r,exports.SHELL_CONTROL_KEY=n,exports.SHELL_FRAME_MESSAGE=a,exports.SHELL_JAR_MESSAGE=s,exports.SHELL_JAR_UNREACHABLE=c,exports.WINDOW_HANDSHAKE_TIMEOUT_MS=p,exports.WINDOW_HELLO_TIMEOUT_MS=d,exports.WINDOW_JAR_MODE_TIMEOUT_MS=f;

package/contract.d.ts

@@ -1,4 +1,4 @@
-import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-Cgnfjh9o.js";
-import { $ as RoomHandle, A as MiddleGotoOptions, At as WINDOW_HELLO_TIMEOUT_MS, B as ProxyFetch, C as FrameMessageRelay, Ct as TcpSocketListenerResult, D as IpFamily, Dt as UdpSocketOptions, E as InstalledPackage, Et as UdpDatagram, F as PackageResult, Ft as JarSeedCookie, G as Radii, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, L as PackagesFail, M as OverlayRect, Mt as WindowMiddleControl, N as OverlayState, Nt as WriteData, O as JAR_ANCHOR_MESSAGE, Ot as UdpSocketResult, P as PackageQuery, Pt as JarSeed, Q as RoomEvent, R as PickOptions, S as FrameFetchScope, St as TcpSocketListenerOptions, T as InstallOptions, Tt as TcpSocketResult, U as Quota, V as ProxyFetchInit, W as ROOM_TEMPORARY_MS, X as RoomDefaults, Y as RoomCreateOptions, Z as RoomEnd, _ as DnsLookup, _t as ShellGotoOptions, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, bt as StorageQuota, c as AdoptRequest, ct as RoomsFail, d as ConflictRequest, dt as SHELL_FRAME_MESSAGE, et as RoomJoinOptions, f as ConflictSide, ft as SHELL_JAR_MESSAGE, g as DisplayLevel, gt as ShellFrameMessage, h as DisplayCause, ht as ShellControl, i as Account, it as RoomOpenOptions, j as MountDescriptor, jt as WINDOW_JAR_MODE_TIMEOUT_MS, k as MiddleControl, kt as WINDOW_HANDSHAKE_TIMEOUT_MS, l as AdoptState, lt as SHELL_ATTACH_ERROR, m as ConnectOptions, mt as SetOverlayHost, n as ATTACH_WINDOW_KEY, nt as RoomMember, o as AccountPinOptions, ot as RoomPermissions, p as ConnectAvailability, pt as SHELL_JAR_UNREACHABLE, q as RoomBacklog, r as ATTACH_WINDOW_MESSAGE, rt as RoomMessage, s as AddressLookupResult, st as RoomsErrorCode, t as ATTACH_FRAME_KEY, tt as RoomMailbox, u as ConflictChoice, ut as SHELL_CONTROL_KEY, v as EncryptionState, vt as ShellJarUnreachable, w as HiddenSurface, wt as TcpSocketOptions, x as FrameConsentRequest, xt as SurfaceRect, y as FRAME_MESSAGE, yt as StorageEntry, z as Placement } from "./contract-DJxGa8lb.js";
-import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
-export { ATTACH_FRAME_KEY, ATTACH_WINDOW_KEY, ATTACH_WINDOW_MESSAGE, Account, AccountChange, AccountPinOptions, AddressLookupResult, AdoptRequest, AdoptState, type ClearCookiesWire, ConflictChoice, ConflictRequest, ConflictSide, ConnectAvailability, ConnectOptions, type CookieMatchWire, DisplayCause, DisplayLevel, DnsLookup, EncryptionState, FRAME_MESSAGE, FrameConsentAnswer, FrameConsentRequest, FrameFetchScope, FrameMessageRelay, HiddenSurface, InstallOptions, InstalledPackage, IpFamily, JAR_ANCHOR_MESSAGE, type JarSeed, type JarSeedCookie, MiddleControl, MiddleGotoOptions, MountDescriptor, OverlayRect, OverlayState, PackageQuery, PackageResult, PackagesErrorCode, PackagesFail, PickOptions, Placement, ProxyFetch, ProxyFetchInit, ProxyFetchInput, Quota, ROOM_TEMPORARY_MS, Radii, Resolvers, RoomBacklog, RoomClaimOptions, RoomCreateOptions, RoomDefaults, RoomEnd, RoomEvent, RoomHandle, RoomJoinOptions, RoomMailbox, RoomMember, RoomMessage, RoomOpenOptions, RoomPermission, RoomPermissions, RoomsErrorCode, RoomsFail, SHELL_ATTACH_ERROR, SHELL_CONTROL_KEY, SHELL_FRAME_MESSAGE, SHELL_JAR_MESSAGE, SHELL_JAR_UNREACHABLE, SetOverlayHost, ShellControl, ShellFrameMessage, ShellGotoOptions, ShellJarUnreachable, StorageEntry, StorageQuota, SurfaceRect, TcpSocketListenerOptions, TcpSocketListenerResult, type TcpSocketOption, TcpSocketOptions, TcpSocketResult, UdpDatagram, type UdpSocketOption, UdpSocketOptions, UdpSocketResult, WINDOW_HANDSHAKE_TIMEOUT_MS, WINDOW_HELLO_TIMEOUT_MS, WINDOW_JAR_MODE_TIMEOUT_MS, WindowMiddleControl, WriteData };
+import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-C8Y-YHrU.js";
+import { $ as RoomCreateOptions, A as MiddleGotoOptions, At as UdpDatagram, B as Placement, C as FrameMessageRelay, Ct as StorageEntry, D as IpFamily, Dt as TcpSocketListenerResult, E as InstalledPackage, Et as TcpSocketListenerOptions, F as PackageQuery, Ft as WINDOW_JAR_MODE_TIMEOUT_MS, G as ProxyJarKey, H as ProxyFetchInit, I as PackageResult, It as WindowMiddleControl, J as ROOM_TEMPORARY_MS, K as ProxyJarRefusal, L as PackagesErrorCode, Lt as WriteData, M as OverlayRect, Mt as UdpSocketResult, N as OverlayState, Nt as WINDOW_HANDSHAKE_TIMEOUT_MS, O as JAR_ANCHOR_MESSAGE, Ot as TcpSocketOptions, P as PROXY_JAR_REFUSALS, Pt as WINDOW_HELLO_TIMEOUT_MS, Q as RoomClaimOptions, R as PackagesFail, Rt as JarSeed, S as FrameFetchScope, St as ShellJarUnreachable, T as InstallOptions, Tt as SurfaceRect, U as ProxyFetchInput, V as ProxyFetch, W as ProxyJarAnswer, X as Resolvers, Y as Radii, Z as RoomBacklog, _ as DnsLookup, _t as SHELL_JAR_UNREACHABLE, a as AccountChange, at as RoomMailbox, b as FrameConsentAnswer, bt as ShellFrameMessage, c as AdoptRequest, ct as RoomOpenOptions, d as ConflictRequest, dt as RoomsErrorCode, et as RoomDefaults, f as ConflictSide, ft as RoomsFail, g as DisplayLevel, gt as SHELL_JAR_MESSAGE, h as DisplayCause, ht as SHELL_FRAME_MESSAGE, i as Account, it as RoomJoinOptions, j as MountDescriptor, jt as UdpSocketOptions, k as MiddleControl, kt as TcpSocketResult, l as AdoptState, lt as RoomPermission, m as ConnectOptions, mt as SHELL_CONTROL_KEY, n as ATTACH_WINDOW_KEY, nt as RoomEvent, o as AccountPinOptions, ot as RoomMember, p as ConnectAvailability, pt as SHELL_ATTACH_ERROR, q as Quota, r as ATTACH_WINDOW_MESSAGE, rt as RoomHandle, s as AddressLookupResult, st as RoomMessage, t as ATTACH_FRAME_KEY, tt as RoomEnd, u as ConflictChoice, ut as RoomPermissions, v as EncryptionState, vt as SetOverlayHost, w as HiddenSurface, wt as StorageQuota, x as FrameConsentRequest, xt as ShellGotoOptions, y as FRAME_MESSAGE, yt as ShellControl, z as PickOptions, zt as JarSeedCookie } from "./contract-DP_jc5pZ.js";
+import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
+export { ATTACH_FRAME_KEY, ATTACH_WINDOW_KEY, ATTACH_WINDOW_MESSAGE, Account, AccountChange, AccountPinOptions, AddressLookupResult, AdoptRequest, AdoptState, type ClearCookiesWire, ConflictChoice, ConflictRequest, ConflictSide, ConnectAvailability, ConnectOptions, type CookieMatchWire, DisplayCause, DisplayLevel, DnsLookup, EncryptionState, FRAME_MESSAGE, FrameConsentAnswer, FrameConsentRequest, FrameFetchScope, FrameMessageRelay, HiddenSurface, InstallOptions, InstalledPackage, IpFamily, JAR_ANCHOR_MESSAGE, type JarSeed, type JarSeedCookie, MiddleControl, MiddleGotoOptions, MountDescriptor, OverlayRect, OverlayState, PROXY_JAR_REFUSALS, PackageQuery, PackageResult, PackagesErrorCode, PackagesFail, PickOptions, Placement, ProxyFetch, ProxyFetchInit, ProxyFetchInput, ProxyJarAnswer, ProxyJarKey, ProxyJarRefusal, Quota, ROOM_TEMPORARY_MS, Radii, Resolvers, RoomBacklog, RoomClaimOptions, RoomCreateOptions, RoomDefaults, RoomEnd, RoomEvent, RoomHandle, RoomJoinOptions, RoomMailbox, RoomMember, RoomMessage, RoomOpenOptions, RoomPermission, RoomPermissions, RoomsErrorCode, RoomsFail, SHELL_ATTACH_ERROR, SHELL_CONTROL_KEY, SHELL_FRAME_MESSAGE, SHELL_JAR_MESSAGE, SHELL_JAR_UNREACHABLE, SetOverlayHost, ShellControl, ShellFrameMessage, ShellGotoOptions, ShellJarUnreachable, StorageEntry, StorageQuota, SurfaceRect, TcpSocketListenerOptions, TcpSocketListenerResult, type TcpSocketOption, TcpSocketOptions, TcpSocketResult, UdpDatagram, type UdpSocketOption, UdpSocketOptions, UdpSocketResult, WINDOW_HANDSHAKE_TIMEOUT_MS, WINDOW_HELLO_TIMEOUT_MS, WINDOW_JAR_MODE_TIMEOUT_MS, WindowMiddleControl, WriteData };

package/contract.js

@@ -17,16 +17,22 @@ var e = "fkn-attach-frame", t = "fkn-attach-window", n = "sdbx-control", r = "sd
 	"no-token",
 	"no-indexeddb",
 	"failed"
-], l = {
+], l = [
+	"not-proxy",
+	"signed-out",
+	"not-enrolled",
+	"locked",
+	"unconfirmed"
+], u = {
 	hello: "fkn-jar-hello",
 	ready: "fkn-jar-ready",
 	port: "fkn-jar-port",
 	who: "fkn-jar-who",
 	host: "fkn-jar-host"
-}, u = 2e4, d = 3e4, f = 6e4, p = {
+}, d = 2e4, f = 3e4, p = 6e4, m = {
 	default: 6048e5,
 	min: 6e4,
 	max: 31536e6
 };
 //#endregion
-export { e as ATTACH_FRAME_KEY, t as ATTACH_WINDOW_KEY, o as ATTACH_WINDOW_MESSAGE, i as FRAME_MESSAGE, l as JAR_ANCHOR_MESSAGE, p as ROOM_TEMPORARY_MS, r as SHELL_ATTACH_ERROR, n as SHELL_CONTROL_KEY, a as SHELL_FRAME_MESSAGE, s as SHELL_JAR_MESSAGE, c as SHELL_JAR_UNREACHABLE, f as WINDOW_HANDSHAKE_TIMEOUT_MS, u as WINDOW_HELLO_TIMEOUT_MS, d as WINDOW_JAR_MODE_TIMEOUT_MS };
+export { e as ATTACH_FRAME_KEY, t as ATTACH_WINDOW_KEY, o as ATTACH_WINDOW_MESSAGE, i as FRAME_MESSAGE, u as JAR_ANCHOR_MESSAGE, l as PROXY_JAR_REFUSALS, m as ROOM_TEMPORARY_MS, r as SHELL_ATTACH_ERROR, n as SHELL_CONTROL_KEY, a as SHELL_FRAME_MESSAGE, s as SHELL_JAR_MESSAGE, c as SHELL_JAR_UNREACHABLE, p as WINDOW_HANDSHAKE_TIMEOUT_MS, d as WINDOW_HELLO_TIMEOUT_MS, f as WINDOW_JAR_MODE_TIMEOUT_MS };

package/dgram.d.ts

@@ -1,6 +1,6 @@
-import { K as Resolvers, Ot as UdpSocketResult } from "./contract-DJxGa8lb.js";
-import { v as UdpSocketOption } from "./wire-Gbo-D74t.js";
-import "./api-H1TzWitc.js";
+import { Mt as UdpSocketResult, X as Resolvers } from "./contract-DP_jc5pZ.js";
+import { v as UdpSocketOption } from "./wire-BwA4JjZH.js";
+import "./api-Cuf3ynZX.js";
 import { Buffer } from "buffer";
 import { AddressInfo } from "net";
 import { EventEmitter } from "events";
@@ -62,17 +62,10 @@ export declare class Socket extends EventEmitter implements Socket$2 {
   bind(callback?: (() => void) | undefined): this;
   bind(options: BindOptions, callback?: (() => void) | undefined): this;
   /**
-   * Wire a datagram socket up from a connection already in hand, and report it as bound.
-   *
-   * `endpoints` publishes the local address SYNCHRONOUSLY, for the same reason net.ts's TCP
-   * equivalent does: `address()` throws EBADF until the promise below resolves, so a caller that
-   * reads it in the same turn as the bind gets an exception rather than the answer. Node fills an
-   * address in before it reports a socket as bound.
-   *
-   * Splitting this out of `bind()` is also what gives a test a seam. Everything a refused bind does
-   * lives past `apiWithin`, so without this the only way to reach it is to mock the resolver, and
-   * the guard on that path stayed untested through the whole period the relay could not refuse a
-   * bind at all.
+   * Wires the socket up from a connection already in hand and reports it as bound; also the seam a
+   * test uses to reach a refused bind without mocking the resolver. `endpoints` publishes the local
+   * address synchronously, as net.ts does: `address()` throws EBADF until the connection resolves,
+   * while Node fills an address in before reporting a socket bound.
    */
   __webvpn_udp_socket_init__(connection: ReturnType<WebVpnUdpSocket>, endpoints?: Awaited<ReturnType<WebVpnUdpSocket>>): Promise<UdpSocketResult | undefined>;
   close(callback?: (() => void) | undefined): this;

package/dns.d.ts

@@ -1,4 +1,4 @@
-import { s as AddressLookupResult } from "./contract-DJxGa8lb.js";
+import { s as AddressLookupResult } from "./contract-DP_jc5pZ.js";
 declare namespace dns_d_exports {
   export { AddressLookupResult, lookup };
 }

package/extension-Dmnh5pcs.js

@@ -0,0 +1,94 @@
+import { t as e } from "./rolldown-runtime-Dy4uBu1J.js";
+import { $ as t, A as n, B as r, C as i, D as a, E as o, F as ee, G as s, H as te, I as ne, J as c, K as l, L as u, M as re, O as ie, Q as ae, R as d, S as f, U as p, V as m, W as h, X as g, Y as _, Z as v, _ as y, a as b, at as x, b as S, ct as C, d as w, dt as T, et as E, ft as D, g as O, gt as k, ht as A, i as j, it as M, mt as N, n as oe, nt as P, pt as F, q as I, r as L, rt as R, st as z, t as B, tt as V, ut as H, v as U, w as W, x as G, y as K, z as q } from "./lib-H5-e2A1h.js";
+import { o as se, p as ce } from "./api-DIgTslNb.js";
+import { t as le } from "./proxy-Dixbk1WL.js";
+import { available as ue, fetch as J } from "./desktop.js";
+//#region ../web-extension/lib/utils/background-stopped.js
+var Y = "BackgroundStoppedError", X = (e) => w(e) && e.name === "BackgroundStoppedError", Z = async (e) => {
+	if (typeof window > "u") return !1;
+	if (P()) return !0;
+	let t = await se, n = null, r = new Promise((e) => {
+		n = () => {
+			P() && e(!0);
+		}, V.addEventListener("statuschange", n);
+	}), i = t.installPrompt.show(e).then(() => !1), a = await Promise.race([r, i]);
+	return n && V.removeEventListener("statuschange", n), await t.installPrompt.hide().catch(() => {}), a;
+}, Q = null;
+M(() => (Q ||= Z().then(() => void 0).finally(() => {
+	Q = null;
+}), Q));
+//#endregion
+//#region src/auto.ts
+var $ = () => typeof document < "u" && P(), de = async (e, t) => {
+	if (ce(e), t?.credentials === "include") {
+		if (typeof document > "u") throw Error("fetch with credentials needs the FKN extension, which only exists in window realms");
+		return s(e, t);
+	}
+	return $() ? s(e, {
+		...t,
+		credentials: "omit"
+	}) : ue() ? J(e, t) : le(e, t);
+}, fe = /* @__PURE__ */ e({
+	ATTACH_FRAME_EVENT_KEY: () => j,
+	BACKGROUND_STOPPED: () => Y,
+	CATEGORIES: () => W,
+	EXTENSION_ABI: () => 4,
+	ExtensionOperationUnsupportedError: () => z,
+	ExtensionOutdatedError: () => C,
+	FORGEABLE_HEADERS: () => v,
+	FrameWindowBlockedError: () => O,
+	FrameWindowRefusedError: () => y,
+	LOCATOR_DENIED: () => n,
+	LOCATOR_ERROR: () => ne,
+	LOCATOR_INVALID: () => d,
+	LOCATOR_UNSUPPORTED: () => a,
+	PERMISSION_DENIED: () => B,
+	REQUIRED_EXTENSION_ABI: () => 0,
+	TimeoutError: () => o,
+	assertAttachableFrameUrl: () => G,
+	assertFetchableUrl: () => h,
+	assertForgeableHeaders: () => ae,
+	assertLockdownApplicable: () => f,
+	assertOneCookieIdentity: () => t,
+	attachFrame: () => b,
+	attachFramePermission: () => U,
+	available: () => $,
+	box: () => D,
+	cookies: () => te,
+	createFrame: () => K,
+	createVideoElementHandle: () => F,
+	events: () => V,
+	extension: () => V,
+	fetch: () => s,
+	fetchCredentialedPermission: () => l,
+	fetchLocalPermission: () => I,
+	fetchPermission: () => c,
+	gotoPermission: () => S,
+	handleRevivableModules: () => T,
+	hasForgedCookie: () => E,
+	isBackgroundStopped: () => X,
+	isBlockedFetchUrl: () => _,
+	isBlockedFrameUrl: () => i,
+	isExtensionExposed: () => P,
+	isLocalNetworkUrl: () => g,
+	isLocatorDenied: () => u,
+	isLocatorInvalid: () => re,
+	isLocatorUnsupported: () => ie,
+	isPermissionDenied: () => oe,
+	isTerminalError: () => ee,
+	isType: () => N,
+	modifyRequestHeadersPermission: () => q,
+	permissions: () => L,
+	promptInstall: () => Z,
+	readCookiePermission: () => p,
+	readExtensionHandshake: () => R,
+	removeRequestHeaderRule: () => r,
+	revive: () => A,
+	setMissingExtensionHandler: () => M,
+	setRequestHeaderRule: () => m,
+	supportsOperation: () => H,
+	type: () => k,
+	waitForExtensionExposure: () => x
+});
+//#endregion
+export { Y as a, Z as i, de as n, X as o, $ as r, fe as t };

package/{extension-BtDg-F2g.d.ts → extension-X8cnvZej.d.ts}

@@ -1,4 +1,4 @@
-import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-Cgnfjh9o.js";
+import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-C8Y-YHrU.js";
 //#region ../frame-locator/lib/errors.d.ts
 declare const LOCATOR_ERROR = "LocatorError";
 declare const LOCATOR_UNSUPPORTED = "LocatorUnsupportedError";
@@ -121,6 +121,7 @@ type RequestHeaderRule = {
   requestHeaders: HeaderOperation[];
   reason?: string;
 };
+/** Tab-scoped: the rule is dropped when the tab goes away. */
 declare const setRequestHeaderRule: (rule: RequestHeaderRule) => Promise<{
   ruleId: number;
 }>;
@@ -158,9 +159,7 @@ declare const BACKGROUND_STOPPED = "BackgroundStoppedError";
 /**
  * What a call into the extension rejects with when Chrome stopped the extension's worker before it finished
  * answering: before the call resolved, or, for a `fetch`, while its response body was still arriving.
- *
- * The call may or may not have run, so the extension never sends it again. Retrying is the app's decision, and a
- * retry is answered by the restarted worker.
+ * The call may or may not have run, so it is never resent; a retry by the app reaches the restarted worker.
  */
 type BackgroundStoppedError = Error & {
   name: typeof BACKGROUND_STOPPED;
@@ -170,31 +169,21 @@ declare const isBackgroundStopped: (error: unknown) => boolean;
 //#endregion
 //#region ../web-extension/lib/utils/extension-abi.d.ts
 /**
- * What the extension half announces about itself. Increment when the callable surface CHANGES in a
- * way a page could notice: an operation added, removed, renamed, or given different semantics.
- *
- * This is not the package version and not the manifest version. Those move for reasons that have
- * nothing to do with the protocol (a dependency bump, a store resubmission), and tying the contract
- * to them would make every release look like a protocol change.
+ * What the extension half announces about itself. Increment when the callable surface changes in a
+ * way a page could notice: an operation added, removed, renamed, or given different semantics. Not
+ * the package or manifest version, which move for reasons unrelated to the protocol.
  */
 declare const EXTENSION_ABI = 4;
 /**
- * The oldest extension the page half will talk to. Raise it ONLY when the page half starts depending
- * on something older extensions cannot do, never merely because `EXTENSION_ABI` moved: an added
- * operation does not break a page that does not call it.
- *
- * Deliberately 0 for this release. Every extension currently installed predates versioning and
- * announces no ABI at all, so a floor of 1 would refuse all of them the moment this page half
- * deployed, which is precisely the failure this file exists to prevent.
+ * The oldest extension the page half will talk to. Raise it only when the page half starts depending
+ * on something older extensions cannot do, never merely because `EXTENSION_ABI` moved. Deliberately 0:
+ * extensions that predate versioning announce no ABI, and a floor of 1 would refuse all of them.
  */
 declare const REQUIRED_EXTENSION_ABI = 0;
 /**
- * Three answers, never a boolean.
- *
- * `operations` is `null` when the extension announced no list, which is NOT the same as announcing an
- * empty one. A pre-versioning extension supports the whole original surface and simply cannot say so,
- * so an absent list has to read as "unknown, assume the old set" rather than "supports nothing".
- * Reading it the other way would refuse every operation on every currently installed extension.
+ * `operations` is `null` when the extension announced no list, which is not the same as an empty one:
+ * a pre-versioning extension supports the whole original surface and cannot say so, so `null` reads
+ * as "assume the original set", never "supports nothing".
  */
 type ExtensionHandshake = {
   status: 'absent';
@@ -209,19 +198,14 @@ type ExtensionHandshake = {
   operations: readonly string[] | null;
 };
 /**
- * Whether a named operation is callable.
- *
- * `null` operations means the extension could not tell us, and the answer is YES: it predates the
- * ops list and supports the original surface. The ABI floor is the mechanism for refusing an
- * extension that is genuinely too old; this one only refines a list that was actually announced.
+ * Whether a named operation is callable. A `null` list answers true (the extension predates the list
+ * and supports the original surface); refusing a too-old extension is the ABI floor's job.
  */
 declare const supportsOperation: (handshake: ExtensionHandshake, operation: string) => boolean;
 /**
- * Thrown instead of the generic "not installed" message when the extension IS there and merely too
- * old. Carries both numbers so an app can say which, and link its listing.
- *
- * A named class rather than a message match: only the name survives a structured-clone hop, and the
- * codebase has been bitten before by an error whose identity was its text.
+ * Thrown instead of the generic "not installed" message when the extension is installed but too old.
+ * Carries both numbers so an app can say which and link its listing. Match it by `name`, which
+ * survives a structured-clone hop.
  */
 declare class ExtensionOutdatedError extends Error {
   readonly abi: number;
@@ -248,10 +232,8 @@ type ExtensionEventMap = {
 };
 declare const extension: import("osra").TypedEventTarget<ExtensionEventMap>;
 /**
- * Unchanged on purpose, and still exported: a page half built before versioning calls exactly this,
- * and an extension that announces an ABI must keep answering it the same way. Backwards
- * compatibility here runs in BOTH directions, which is the only property that matters when neither
- * end updates on demand.
+ * Unchanged on purpose: a page half built before versioning calls exactly this, so an extension that
+ * announces an ABI keeps answering it the same way. An outdated extension also answers true.
  */
 declare const isExtensionExposed: () => boolean;
 /** The three-way answer: absent, present but too old, or usable. */