@fkn/lib 0.9.43 → 0.9.45

package/{storage-BVr2Rb-d.d.ts → storage-BLBsmkmp.d.ts}

@@ -7,12 +7,10 @@ type FileEntry$1 = {
 };
 type WriteData$1 = Blob | ArrayBuffer | Uint8Array | string;
 /**
- * Which account a cloud call belongs to. Library plumbing that app code never passes: an operation of
- * several calls (a rename, a mount, a queue drain) captures one when it starts, so none of its calls
- * can land in an account the realm switched to meanwhile.
- *
- * `{ generation }` is a ticket from `captureAccount()`: its calls carry that generation's pin. `{ pin }`
- * is a pin a queued entry was stamped with, sent as is.
+ * Which account a cloud call belongs to; library plumbing app code never passes. A multi-call
+ * operation (a rename, a mount, a queue drain) captures one at its start so no call lands in an
+ * account the realm switched to meanwhile. `{ generation }` is a ticket from `captureAccount()`;
+ * `{ pin }` is the pin a queued entry was stamped with, sent as is.
  */
 type PinFrom = {
   readonly generation: number;
@@ -61,18 +59,12 @@ declare class StorageLockedError extends Error {
   constructor();
 }
 /**
- * There is no object at this path. Test `err.code === STORAGE_NOT_FOUND`, never the message.
- *
- * Absence arrives from two places that word it completely differently: the api refusing to presign
- * a path with no committed row says "Not found", and a presign that succeeded followed by an object
- * fetch that 404s says "storage: read failed (404)". Neither is a fault, both mean the same thing,
- * and matching either by hand means matching both. Ripple matched only the first, so a missing
- * backup read as a transient failure, retried forever, and a library went un-backed-up for a day
- * without a single error anywhere.
+ * There is no object at this path. Test `err.code === STORAGE_NOT_FOUND`, never the message: absence
+ * is worded differently by the presign ("Not found") and by the object fetch ("storage: read failed
+ * (404)").
  *
- * The distinction matters more than it sounds. "There is nothing here" is safe to overwrite;
- * "I could not tell you" is not, and a caller that confuses them either never writes a first
- * backup or destroys a real one.
+ * "There is nothing here" is safe to overwrite; "I could not tell you" is not, and a caller that
+ * confuses them either never writes a first backup or destroys a real one.
  */
 declare class StorageNotFoundError extends Error {
   code: string;
@@ -114,7 +106,6 @@ declare class StorageAccountPinUnsupportedError extends Error {
 declare const isAccountChanged: (error: unknown) => boolean;
 /** Whether the api could not read a pin at all (a queued entry's record damaged on the device). */
 declare const isInvalidPin: (error: unknown) => boolean;
-/** One account generation of this realm, captured when an operation started. */
 type AccountTicket = {
   readonly generation: number;
 };
@@ -145,16 +136,11 @@ type SealedRead = {
 /**
  * A cloud read that also reports when the copy was sealed.
  *
- * `sealedAt` is an ISO string, or null when the envelope carries no such field (one written before
- * the seal time existed) or when the data plane is older than this call. The value is
- * AUTHENTICATED, so the server can neither forge nor alter it, and it is the WRITER's own claim
- * about when it sealed, so on its own it does not prove this copy is the newest one: an older but
- * perfectly authentic copy of the same path is still authentic. An app that needs that answer keeps
- * a high-water mark per path and compares. Do not confuse it with the `updatedAt` on a listing,
- * which is the server's hint and is fine for display and nothing else.
- *
- * The bytes and the stamp come from ONE read of ONE envelope, which is what makes the stamp
- * describe the bytes returned beside it. `readFile` is unchanged and unaffected.
+ * `sealedAt` is an ISO string, or null for an envelope written before the seal time existed or a
+ * data plane older than this call. It is authenticated, so the server can neither forge nor alter
+ * it, but it is the WRITER's claim: it does not prove this copy is the newest, so an app that needs
+ * that keeps a high-water mark per path. The listing's `updatedAt` is a server hint, for display only.
+ * The bytes and the stamp come from one read of one envelope.
  */
 declare const readFileSealed: (path: string, opts?: PinOptions) => Promise<SealedRead>;
 declare const writeFile: (path: string, data: WriteData, opts?: {

package/{wire-Gbo-D74t.d.ts → wire-BwA4JjZH.d.ts}

@@ -2,19 +2,13 @@
 /**
  * Socket option codes as they appear on the WebVPN wire, and the option shapes built from them.
  *
- * These live in the library rather than beside the packet codecs because BOTH sides need them and
- * only one side may own them. `@fkn/lib` already imported these constants at value level (see
- * `webvpn/net.ts` and `webvpn/dgram.ts`), so the previous arrangement had the published package
- * reaching into `src/api/webvpn/packets/*` for its own vocabulary, which dragged those modules and
- * their imports into the library's type program.
+ * Owned by the library so both sides share one source: the packet codecs in
+ * `src/api/webvpn/packets/` import from this file, and the library needs nothing from the app.
  *
- * Owning them here inverts that: the codecs in `src/api/webvpn/packets/` import from this file, and
- * the library needs nothing from the app to describe a socket option.
- *
- * The VALUES are protocol. They are the u8 discriminant of a tagged union nested inside a
- * TcpSetOption or UdpSetOption client packet (metadata-stream tag 8), and a relay built against
- * these numbers is deployed independently of any browser holding this file. Renumbering one is a
- * wire break, not a refactor. Booleans go on the wire as u8, 0 for false and anything else true.
+ * The VALUES are protocol: the u8 discriminant of a tagged union inside a TcpSetOption or
+ * UdpSetOption client packet (metadata-stream tag 8). A relay built against these numbers deploys
+ * independently of any browser holding this file, so renumbering one is a wire break. Booleans go
+ * on the wire as u8, 0 for false and anything else true.
  */
 declare const TCP_OPTION_NODELAY: 0;
 declare const TCP_OPTION_TTL: 1;

package/wire.d.ts

@@ -1,2 +1,2 @@
-import { _ as UDP_OPTION_TTL, a as TCP_OPTION_TTL, c as UDP_OPTION_ADD_MEMBERSHIP_V6, d as UDP_OPTION_DROP_MEMBERSHIP_V6, f as UDP_OPTION_MULTICAST_LOOP_V4, g as UDP_OPTION_SEND_BUFFER_SIZE, h as UDP_OPTION_RECV_BUFFER_SIZE, i as TCP_OPTION_SEND_BUFFER_SIZE, l as UDP_OPTION_BROADCAST, m as UDP_OPTION_MULTICAST_TTL_V4, n as TCP_OPTION_NODELAY, o as TcpSocketOption, p as UDP_OPTION_MULTICAST_LOOP_V6, r as TCP_OPTION_RECV_BUFFER_SIZE, s as UDP_OPTION_ADD_MEMBERSHIP_V4, t as TCP_OPTION_KEEPALIVE, u as UDP_OPTION_DROP_MEMBERSHIP_V4, v as UdpSocketOption } from "./wire-Gbo-D74t.js";
+import { _ as UDP_OPTION_TTL, a as TCP_OPTION_TTL, c as UDP_OPTION_ADD_MEMBERSHIP_V6, d as UDP_OPTION_DROP_MEMBERSHIP_V6, f as UDP_OPTION_MULTICAST_LOOP_V4, g as UDP_OPTION_SEND_BUFFER_SIZE, h as UDP_OPTION_RECV_BUFFER_SIZE, i as TCP_OPTION_SEND_BUFFER_SIZE, l as UDP_OPTION_BROADCAST, m as UDP_OPTION_MULTICAST_TTL_V4, n as TCP_OPTION_NODELAY, o as TcpSocketOption, p as UDP_OPTION_MULTICAST_LOOP_V6, r as TCP_OPTION_RECV_BUFFER_SIZE, s as UDP_OPTION_ADD_MEMBERSHIP_V4, t as TCP_OPTION_KEEPALIVE, u as UDP_OPTION_DROP_MEMBERSHIP_V4, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 export { TCP_OPTION_KEEPALIVE, TCP_OPTION_NODELAY, TCP_OPTION_RECV_BUFFER_SIZE, TCP_OPTION_SEND_BUFFER_SIZE, TCP_OPTION_TTL, TcpSocketOption, UDP_OPTION_ADD_MEMBERSHIP_V4, UDP_OPTION_ADD_MEMBERSHIP_V6, UDP_OPTION_BROADCAST, UDP_OPTION_DROP_MEMBERSHIP_V4, UDP_OPTION_DROP_MEMBERSHIP_V6, UDP_OPTION_MULTICAST_LOOP_V4, UDP_OPTION_MULTICAST_LOOP_V6, UDP_OPTION_MULTICAST_TTL_V4, UDP_OPTION_RECV_BUFFER_SIZE, UDP_OPTION_SEND_BUFFER_SIZE, UDP_OPTION_TTL, UdpSocketOption };

package/cloud-Bx64HSkQ.cjs

@@ -1 +0,0 @@
-const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-fqQfEPk6.cjs"),n=require("./hosts-GNBhZO3-.cjs"),r=require("./api--LOXTOpv.cjs"),i=require("./busy-Dv8wzE5M.cjs"),a=require("./proxy-CFK-KiwE.cjs"),o=require("./attach-policy.cjs"),s=require("./contract.cjs"),c=require("./dns.cjs"),l=require("./cloud/fs.cjs"),u=require("./net.cjs"),d=require("./dgram.cjs"),f=require("./http.cjs");let p=require("osra");var m=async()=>{let e=()=>r.s(`frame consent`);try{let t=await e();return{request:typeof t.frameConsent.request==`function`?t.frameConsent.request:void 0,ensure:t.frameConsent.ensure}}catch(t){if(!(t instanceof r.n))throw t;return{request:void 0,ensure:t=>e().then(e=>e.frameConsent.ensure(t))}}},h=`frame: this frame no longer holds the document the app attached it to`,g=!1,_=()=>{g||(g=!0,console.warn(`[fkn-frame] this FKN broker is too old to ask for permission categories, so nothing was asked for upfront and each capability is asked for as it is first used. Reloading the page picks up the current broker.`))},v=e=>[...e].flatMap(e=>{try{return[new URL(e).hostname]}catch{return[]}}),y=(e,t,n)=>n===null?`frame.${e}: the user did not grant ${t} here`:`frame.${e}: the user did not grant ${t} on ${n}`,b=e=>{let{assertLive:r,attach:i,consent:a,current:s,declaredHosts:c,documentHost:l,freshBlank:u,session:d,approvedOrigins:f}=e,p=new Set,m=()=>{try{return new URL(s()).hostname}catch{return``}},g=async()=>l?await l():m(),b=()=>n.t([...c,...v(f)]),x=async(e,t)=>(await e([t]))[0]??!1;return{gate:async({operation:e,args:s,phase:l})=>{r();let _=n.m(e,s);if(_===null)return;let v=t.h(_);if(v===void 0||v===`auto`)return;if(e===`fetch`){let e=o.frameFetchVerdict({session:d,declaredHosts:c,approvedOrigins:f},l===`ensure`?void 0:s[0],{classifier:`fetchTarget`});if(l===`ensure`&&!d)throw t.O(e.kind===`refuse`?e.reason:``,`fetch`);if(l!==`ensure`&&e.kind===`refuse`)throw t.O(e.reason,`fetch`);let{request:r,ensure:i}=await a();if(!r){if(e.kind===`refuse`)throw t.O(e.reason,`fetch`);if(!await i({scope:n.c(s[0],s[1]).scope,hosts:e.promptHosts}))throw t.O(`frame.fetch: the user did not grant this`,`fetch`);return}let u=e.kind===`consent`?e.targetHost:await g(),p=n.t([u,...c]);if(!p.length)throw t.O(`frame: navigate the frame before fetch`,`fetch`);if(await x(r,{category:`network`,hosts:p})===!1)throw t.O(y(`fetch`,`network`,u||null),`fetch`);return}let S=await g();if(!S)throw t.O(`frame: navigate the frame before ${e}`,e);if(!b().includes(S))throw t.O(h,e);let C=t.m(_);if(C===void 0||C===`evaluation`&&S===m()&&await u?.()||v===`critical`&&p.has(`${_} ${S}`))return;let{request:w}=await a();if(!w)return;let T=n.t([S,...c]),E=await x(w,v===`critical`?{key:_,hosts:T,attach:i}:{category:C,hosts:T});if(E===!1)throw t.O(y(e,C,null),e);if(E===`once`&&l!==`ensure`)for(let e of T)p.add(`${_} ${e}`)},requestCategories:async e=>{r(),t.f(`frame.requestPermissions`,e);let o=await g(),s=n.t(o?[o,...c]:c);if(!s.length)throw TypeError(`frame.requestPermissions: navigate the frame or declare domains first`);let l=e.map(e=>{let n=e.key;return n===void 0?{named:void 0,critical:!1,category:e.category}:{named:n,critical:t.h(n)===`critical`,category:t.p(n)}}),u=({named:e,critical:t,category:n},r)=>({category:n,...t?{key:e}:{},hosts:s,allow:r}),{request:d}=await a();if(!d)return _(),l.map(e=>u(e,!1));let f=await d(l.map(({named:e,critical:t,category:n})=>t?{key:e,hosts:s,attach:i}:{category:n,hosts:s}));return l.map((e,t)=>u(e,f[t]!==void 0&&f[t]!==!1))},boundary:b}},x=e=>e,S=5e3,C=new Set([]),w=()=>`https://fkn.app`,T=e=>e===`persistent`?``:`incognito-${crypto.randomUUID()}`,E=(e,n,r)=>{let i,a=new Promise((e,a)=>{i=setTimeout(()=>a(typeof r==`string`?new t.T(r):r()),n)});return Promise.race([e,a]).finally(()=>clearTimeout(i))},D=e=>Object.assign(Error(e),{name:t.E}),O=`frame.postMessage: this FKN page predates frame messaging; reload the app to load the current one`,k=`frame.addScriptTag: this render proxy predates addScriptTag; reload the app`,A=`frame.addScriptTag: no answer within ${t.l}ms; the script may or may not have run`,j=`frame.clearCookies: this FKN page predates clearCookies; reload the app to load the current one`,M=`frame.clearCookies: this attachment reaches no site yet; attach a url, goto one, or declare it in domains`,N=3e4,P=`attachFrame: this FKN page predates storageState; reload the app to load the current one`,F=2e4,I=async(e,n)=>{if(typeof e.seed!=`function`)throw t.M(P,`storageState`,`cloud`);try{await E(e.seed(n),F,`attachFrame: the render proxy did not take the storageState seed`)}catch(e){throw t.D(e)?t.M(P,`storageState`,`cloud`):e}},L=`frame.clearCookies: the render proxy did not answer within ${N}ms; the cookies may or may not be gone, and calling it again is safe`,ee=e=>t.D(e)&&e.message===t.A(`addScriptTag`).message,R=!1,te=()=>{R||(R=!0,console.warn(`[fkn-frame] this FKN page predates frame messaging, so the page's messages and documents are never reported. Reloading the app loads the current one.`))},z=({from:e,origin:t,attach:n,signal:r})=>i=>{let a=r=>{if(r.source===null||r.source!==e()||r.origin!==t)return;let a=r.data;typeof a==`object`&&a&&a.type===`fkn-frame-message`&&a.attach===n&&typeof a.origin==`string`&&(a.kind===`message`?i({type:`message`,data:a.data,origin:a.origin,ports:r.ports}):a.kind===`document`&&i({type:`document`,origin:a.origin}))};return window.addEventListener(`message`,a,{signal:r}),()=>window.removeEventListener(`message`,a)},ne=e=>{if(typeof e!=`function`)return()=>Promise.resolve(e);let t=null;return()=>t??=e().catch(e=>{throw t=null,e})},B=({control:e,target:n,blank:r=!1,session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,guard:l,consent:u,onNavigated:d,relay:f})=>{let p=n,m=r&&i!==``,g=async()=>{if(!m)return!1;let t=typeof e.blank==`function`?await l(()=>e.blank()):``;return(typeof t!=`string`||t.split(`#`)[0]!==n.split(`#`)[0])&&(m=!1),m},_=Promise.resolve(),{gate:v,requestCategories:y,boundary:x}=b({session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,documentHost:typeof e.documentHost==`function`?()=>l(()=>e.documentHost()):void 0,current:()=>p,consent:ne(u),freshBlank:g});return t.y({backend:`cloud`,executor:{execute:(n,r,i)=>C.has(r)?Promise.reject(t.A(r,`cloud`)):(c(),l(()=>e.executeLocator(n,r,i))),highlight:async()=>{}},gate:v,requestPermissions:y,evaluate:async(n,r)=>(c(),await v({parts:[],operation:`evaluate`,args:[n,r],phase:`execute`}),E(l(()=>e.executeLocator([],`evaluate`,[n,r])),t.l,t.u)),addScriptTag:async(n,r)=>{c();let i=[n,r];await v({parts:[],operation:`addScriptTag`,args:i,phase:`execute`});try{await E(l(()=>e.executeLocator([],`addScriptTag`,i)),t.l,A)}catch(e){throw ee(e)?t.M(k,`addScriptTag`,`cloud`):e}},clearCookies:async n=>{if(c(),typeof e.clearCookies!=`function`)throw t.M(j,`clearCookies`,`cloud`);if(x().length===0)throw t.O(M,`clearCookies`);await E(l(()=>e.clearCookies(n)),N,L)},postMessage:(n,r,i)=>{if(c(),typeof e.messaging!=`function`)throw t.M(O,`postMessage`,`cloud`);if(r!==`*`&&!x().includes(new URL(r).hostname))throw t.O(h,`postMessage`);let{port1:a,port2:o}=new MessageChannel;a.postMessage({data:n,transfer:i},i);let s=[o,r],u=_.then(async()=>(await v({parts:[],operation:`postMessage`,args:s,phase:`execute`}),{answer:l(()=>e.executeLocator([],`postMessage`,s))}));return _=u.catch(()=>{}),u.then(async({answer:e})=>{await e})},listen:t=>(typeof e.messaging!=`function`&&te(),f(t)),goto:async(n,{timeout:r,...i}={})=>{let a=new URL(n,location.href).href;c(),m=!1;let s=(()=>{try{return new URL(a).origin}catch{return``}})(),u=s!==``&&!o.has(s);u&&o.add(s);try{await E(l(()=>e.goto(a,r===void 0?i:{...i,timeoutMs:r})),(r??3e4)+S,`cloud.attachFrame: the render proxy did not answer goto; the frame may have been detached or its page reloaded`)}catch(e){throw u&&o.delete(s),t.c(e)}p=a,d()},url:()=>p})},re=250,ie=500,ae=65e3,oe=2e3,se=2e3,ce=2,le=2e3,ue=2e3,V=({origin:e,target:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-window`,e);return a.searchParams.set(`attach`,i),t&&a.searchParams.set(`url`,t),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.href},H=(e,t)=>{let n=document.createElement(`iframe`),r=new URL(`/attach-jar`,e);return r.searchParams.set(`attach`,t),n.src=r.href,n.tabIndex=-1,n.setAttribute(`aria-hidden`,`true`),n.setAttribute(`style`,`display:none`),(document.body??document.documentElement).appendChild(n),n},de=(e,t)=>{let n=new MutationObserver(()=>{e.isConnected||t.aborted||(n.disconnect(),console.warn(`cloud.attachFrame: the window's jar anchor was removed from this page, so a sign-in in the window no longer reaches this app's cookie jar`))});e.parentNode&&n.observe(e.parentNode,{childList:!0}),n.observe(document.documentElement,{childList:!0}),t.addEventListener(`abort`,()=>n.disconnect(),{once:!0})},U=()=>D(`cloud.attachFrame: the attached window closed, reloaded or left the page FKN attached; attach a fresh window`),W=()=>D(`cloud.attachFrame: the attached window stopped answering; attach a fresh window`),fe=()=>D(`cloud.attachFrame: the window went away before it connected; attach a fresh window`),pe=()=>D(`cloud.attachFrame: the window closed before it connected. Either the user closed it, or this page's Cross-Origin-Opener-Policy cut its link to the window`),me=async(e,r,a)=>{if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);let{domains:o=[],permissions:c}=e,{url:l,width:u,height:d}=t.s(e.window);if(window.origin===`null`)throw new t._(`opaque-opener`);let f=w(),m=crypto.randomUUID(),h=T(r),g=n.t(o),_=new Set;l&&_.add(new URL(l).origin);let v=r===`persistent`?H(f,m):null,y=window.open(V({origin:f,target:a===void 0?l:``,session:h,domains:g,attach:m}),`_blank`,`popup,width=${u},height=${d}`);if(!y)throw v?.remove(),new t.g;let b=new AbortController,S=!1,C=null,D=(e,t=!1)=>{if(C===null){C=e,b.abort(t?W():U());try{y.closed||y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.detach,attach:m,...t?{unanswered:t}:{}},f)}catch{}v&&setTimeout(()=>v.remove(),ue)}};v&&de(v,b.signal);let O=new Promise((e,t)=>{b.signal.addEventListener(`abort`,()=>t(b.signal.reason),{once:!0})});O.catch(()=>{});let k=O.then(()=>{},()=>{}),A=()=>{if(b.signal.aborted)throw b.signal.reason},j=e=>b.signal.aborted?Promise.reject(b.signal.reason):Promise.race([e(),O]),M=e=>e.source===y&&e.origin===f;window.addEventListener(`message`,e=>{if(!M(e))return;let n=e.data;typeof n==`object`&&n&&n.attach===m&&(n.type===s.ATTACH_WINDOW_MESSAGE.refused?D(new t._(n.reason)):n.type===s.ATTACH_WINDOW_MESSAGE.gone&&D(S?U():fe()))},{signal:b.signal}),window.addEventListener(`pagehide`,()=>D(U()),{signal:b.signal});let N=()=>{try{y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.hello,attach:m},f)}catch{}};N();let P=setInterval(N,re),F=setInterval(()=>{y.closed&&D(S?U():pe())},ie);b.signal.addEventListener(`abort`,()=>{clearInterval(P),clearInterval(F)},{once:!0});let L=async e=>{try{return await Promise.race([e,O])}catch(e){throw C??e}};try{let e=await L(E((0,p.expose)({},{key:s.ATTACH_WINDOW_KEY,transport:{emit:(e,t)=>y.postMessage(e,f,t??[]),receive:e=>{let t=t=>{M(t)&&e(t.data,{source:t.source,origin:t.origin})};return window.addEventListener(`message`,t),()=>window.removeEventListener(`message`,t)}},unregisterSignal:b.signal,revivableModules:x(t.lt)}),s.WINDOW_HANDSHAKE_TIMEOUT_MS,`cloud.attachFrame: timed out connecting to the window`));S=!0,clearInterval(P);let n=0,r=setInterval(()=>{E(j(()=>e.ping()),se,`ping`).then(()=>{n=0},()=>{b.signal.aborted||(document.visibilityState===`hidden`?n=0:++n>=ce&&D(W(),!0))})},oe);b.signal.addEventListener(`abort`,()=>clearInterval(r),{once:!0}),await L(E(e.ready(),ae,`cloud.attachFrame: the window never became ready`)),a!==void 0&&await L(I(e,a));let o=i.t(`attached frame`);b.signal.aborted?o():b.signal.addEventListener(`abort`,o,{once:!0});let u=B({control:e,target:l,session:h,declaredHosts:g,approvedOrigins:_,attach:m,assertLive:A,guard:j,consent:{request:t=>j(()=>e.requestConsent(t)),ensure:t=>j(()=>e.requestConsent([t])).then(([e])=>e!==void 0&&e!==!1)},onNavigated:()=>{},relay:z({from:()=>y,origin:f,attach:m,signal:b.signal})}),d=null,v=Object.assign(u,{close:()=>d??=(async()=>{b.signal.aborted||await E(Promise.allSettled([j(()=>e.flushCookies()),j(()=>e.sweepStorage())]),le,`close`).catch(()=>{});try{y.close()}catch{}D(U())})(),closed:k});return a!==void 0&&l&&await L(v.goto(l)),c?.length&&await L(v.requestPermissions(c)),v}catch(e){let n=C??e;if(!(n instanceof t._))try{y.close()}catch{}throw D(n),n}},he=2e4,G=65e3,K=e=>!e||e===`about:blank`,ge=`cloud.attachFrame: this FKN page predates blank pages; reload the app to load the current one`,_e=`cloud.attachFrame: cookies: 'native' needs the FKN browser extension; the cloud render proxy has no browser cookies`,q=e=>e.split(`#`)[0]??``,J=({iframe:e,lockdown:n,cookies:r,blank:i})=>{if(i===void 0)return``;if(typeof i!=`object`||!i)throw TypeError(`attachFrame: blank must be an object { url }`);let a=Object.keys(i).find(e=>e!==`url`);if(a!==void 0)throw TypeError(`attachFrame: blank takes { url }, not "${a}"`);let{url:o}=i,s=(()=>{try{return typeof o==`string`?new URL(o):null}catch{return null}})();if(!s||s.protocol!==`http:`&&s.protocol!==`https:`)throw TypeError(`attachFrame: blank.url must be an absolute http or https url, not "${String(o)}"`);let c=e.getAttribute(`src`)??``;if(!K(c))throw TypeError(`attachFrame: blank needs an iframe with no src; this one has "${c}"`);if(n)throw TypeError(`attachFrame: blank does not combine with lockdown`);if(r===`native`)throw TypeError(`attachFrame: blank runs on the cloud render proxy, which has no browser cookies; pass cookies: 'persistent' or 'ephemeral'`);if(t.x(s.href),!Te())throw Error(`attachFrame: a blank page is served by the cloud render proxy, which this build does not configure`);return s.href},ve=({target:e,blank:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-frame`,w());return t?a.searchParams.set(`blank`,t):e&&a.searchParams.set(`url`,e),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.searchParams.set(`attach`,i),a.href},ye=(e,t)=>{let n=()=>{a(),t()},r=e.parentNode,i=new MutationObserver(()=>{(!e.isConnected||e.parentNode!==r)&&(a(),t())}),a=()=>{window.removeEventListener(`pagehide`,n),i.disconnect()};window.addEventListener(`pagehide`,n,{once:!0}),r&&i.observe(r,{childList:!0}),e.isConnected||(a(),t())},be=()=>D(`cloud.attachFrame: the attached iframe left the document or was reloaded; attach a fresh iframe`),xe=(e,t)=>{let n=[...e.split(`;`),...t.split(`;`)].map(e=>e.trim()).filter(Boolean);return[...new Set(n)].join(`; `)},Se=[300,1200,4e3],Y=e=>{let t=()=>{if(!e.isConnected)return;let t=e.style.height,n=e.getBoundingClientRect();n.height&&(e.style.height=`${n.height-1}px`,setTimeout(()=>{e.style.height=t},50))};t();for(let e of Se)setTimeout(t,e)},Ce=e=>{let t=e.getAttribute(`sandbox`);if(t===null)return;let n=new Set(t.toLowerCase().split(/\s+/).filter(Boolean)),r=[`allow-scripts`,`allow-same-origin`].filter(e=>!n.has(e));if(r.length)throw Error(`cloud.attachFrame: the iframe's sandbox attribute must include ${r.join(` and `)} for the render proxy to load`)},X=async(e,n)=>{let r=typeof e.blank==`function`?await E(e.blank(),G,`cloud.attachFrame: the render proxy never became ready`):``;if(typeof r!=`string`||q(r)!==q(n))throw t.M(ge,`blank`,`cloud`)},we=async(e,a,o)=>{let c=J(e),{iframe:l,domains:u=[],permissions:d}=e;if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);if(!l.isConnected)throw Error(`cloud.attachFrame: the iframe must be connected to the document before attaching`);Ce(l);let f=l.getAttribute(`src`)??``,h=(()=>{if(K(f))return null;try{return new URL(l.src||f,location.href)}catch{throw Error(`cloud.attachFrame: the iframe src is not a valid URL: ${f}`)}})();if(h){let e=new URL(`/attach-frame`,w());if(h.origin===e.origin&&h.pathname===e.pathname)throw Error(`cloud.attachFrame: this iframe is already attached; navigate with the Frame returned by that attach or use a fresh iframe`)}let g=h?.href??``;g&&t.x(g);let _=o===void 0?g:``,v=T(a),y=n.t(u),b=new Set;try{b.add(new URL(c||g).origin)}catch{}let S=new AbortController,C=l.referrerPolicy,D=l.allow,O=crypto.randomUUID();if(l.referrerPolicy=`origin`,l.allow=xe(r.m(),l.allow),l.src=ve({target:_,blank:c,session:v,domains:y,attach:O}),!l.contentWindow)throw Error(`cloud.attachFrame: the iframe window is not available`);try{let e=await E((0,p.expose)({},{key:s.ATTACH_FRAME_KEY,origin:w(),transport:{receive:window,emit:l.contentWindow},unregisterSignal:S.signal,revivableModules:x(t.lt)}),he,`cloud.attachFrame: timed out connecting to the render proxy page`);await E(e.ready(),G,`cloud.attachFrame: the render proxy never became ready`),c&&await X(e,c),o!==void 0&&await I(e,o),(g||c)&&Y(l),ye(l,()=>S.abort());let n=i.t(`attached frame`);S.signal.aborted?n():S.signal.addEventListener(`abort`,n,{once:!0});let r=l.contentWindow,a=B({control:e,target:c||g,blank:c!==``,session:v,declaredHosts:y,approvedOrigins:b,attach:O,assertLive:()=>{if(S.signal.aborted||!l.isConnected||l.contentWindow!==r)throw S.abort(),be()},guard:e=>e(),consent:m,onNavigated:()=>Y(l),relay:z({from:()=>r,origin:w(),attach:O,signal:S.signal})});return o!==void 0&&g&&await a.goto(g),d?.length&&await a.requestPermissions(d),a}catch(e){throw S.abort(),l.referrerPolicy=C,l.allow=D,l.src=_||`about:blank`,e}},Z=(async e=>{let{kind:n,cookies:r,storageState:i}=t.o(e);if(r===`native`)throw TypeError(_e);return n===`window`?me(e,r,i):we(e,r,i)}),Te=()=>typeof window<`u`&&!0,Q=async()=>{let e=await r.o.then(e=>e.cloud.quota());return{premium:e.premium,overQuota:e.overQuota,throttled:e.overQuota&&!e.premium,usedBytes:e.usedBytes,limitBytes:e.limitBytes,remainingBytes:e.remaining,bytesPerSecond:e.bytesPerSecond,bitsPerSecond:e.bytesPerSecond*8}},Ee=e.t({attachFrame:()=>Z,available:()=>$,dgram:()=>d.t,dns:()=>c.t,fetch:()=>a.t,fs:()=>l.t,http:()=>f.t,net:()=>u.t,quota:()=>Q}),$=()=>r.l;Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return J}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Z}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return Ee}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Q}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return $}});