@fkn/lib 0.9.44 → 0.9.46

package/{api-CFkZVr53.d.ts → api-DOXb_WrB.d.ts}

@@ -1,4 +1,4 @@
-import { D as IpFamily, Dt as UdpSocketOptions, Et as UdpDatagram, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, N as OverlayState, Nt as WriteData, P as PackageQuery, Q as RoomEvent, R as PickOptions, St as TcpSocketListenerOptions, T as InstallOptions, V as ProxyFetchInit, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, c as AdoptRequest, d as ConflictRequest, et as RoomJoinOptions, it as RoomOpenOptions, l as AdoptState, m as ConnectOptions, o as AccountPinOptions, p as ConnectAvailability, st as RoomsErrorCode, tt as RoomMailbox, u as ConflictChoice, wt as TcpSocketOptions, x as FrameConsentRequest, z as Placement } from "./contract-6Xfd_qel.js";
+import { At as UdpDatagram, B as Placement, D as IpFamily, Et as TcpSocketListenerOptions, F as PackageQuery, H as ProxyFetchInit, K as ProxyJarRefusal, L as PackagesErrorCode, Lt as WriteData, N as OverlayState, Ot as TcpSocketOptions, Q as RoomClaimOptions, T as InstallOptions, U as ProxyFetchInput, X as Resolvers, a as AccountChange, at as RoomMailbox, b as FrameConsentAnswer, c as AdoptRequest, ct as RoomOpenOptions, d as ConflictRequest, dt as RoomsErrorCode, it as RoomJoinOptions, jt as UdpSocketOptions, l as AdoptState, lt as RoomPermission, m as ConnectOptions, nt as RoomEvent, o as AccountPinOptions, p as ConnectAvailability, u as ConflictChoice, x as FrameConsentRequest, z as PickOptions } from "./contract-BmLpSueo.js";
 import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 import { Remote } from "osra";
 //#region src/api-epochs.d.ts
@@ -724,6 +724,17 @@ declare const onApiEpoch: (listener: EpochListener<{
     onUpdateTaken: (callback: () => void) => Promise<() => Promise<void>>;
     applyUpdate: () => Promise<boolean>;
   };
+  proxyJar: {
+    key: (options?: {
+      prompt?: boolean;
+    } | undefined) => Promise<{
+      key: Uint8Array;
+      jar: string;
+      verified: boolean;
+    } | {
+      refused: ProxyJarRefusal;
+    }>;
+  };
   proxyFetch: (input: ProxyFetchInput, init: ProxyFetchInit) => Promise<Response>;
   webVpnTcpSocket: (options: TcpSocketOptions) => Promise<{
     localAddress: string;
@@ -1462,6 +1473,17 @@ declare const currentApiEpoch: () => {
       onUpdateTaken: (callback: () => void) => Promise<() => Promise<void>>;
       applyUpdate: () => Promise<boolean>;
     };
+    proxyJar: {
+      key: (options?: {
+        prompt?: boolean;
+      } | undefined) => Promise<{
+        key: Uint8Array;
+        jar: string;
+        verified: boolean;
+      } | {
+        refused: ProxyJarRefusal;
+      }>;
+    };
     proxyFetch: (input: ProxyFetchInput, init: ProxyFetchInit) => Promise<Response>;
     webVpnTcpSocket: (options: TcpSocketOptions) => Promise<{
       localAddress: string;

package/api.d.ts

@@ -1,3 +1,3 @@
-import { K as Resolvers } from "./contract-6Xfd_qel.js";
-import { a as apiLastCall, c as currentApiEpoch, i as apiInFlight, l as hasTransport, n as BrokerUnreachableError, o as apiPromise, r as OwnChannelUnavailableError, s as apiWithin, t as API_DEADLINE_MS, u as onApiEpoch } from "./api-CFkZVr53.js";
+import { X as Resolvers } from "./contract-BmLpSueo.js";
+import { a as apiLastCall, c as currentApiEpoch, i as apiInFlight, l as hasTransport, n as BrokerUnreachableError, o as apiPromise, r as OwnChannelUnavailableError, s as apiWithin, t as API_DEADLINE_MS, u as onApiEpoch } from "./api-DOXb_WrB.js";
 export { API_DEADLINE_MS, BrokerUnreachableError, OwnChannelUnavailableError, type Resolvers, apiInFlight, apiLastCall, apiPromise, apiWithin, currentApiEpoch, hasTransport, onApiEpoch };

package/cloud/dns.d.ts

@@ -1,3 +1,3 @@
-import { s as AddressLookupResult } from "../contract-6Xfd_qel.js";
+import { s as AddressLookupResult } from "../contract-BmLpSueo.js";
 import { lookup } from "../dns.js";
 export { type AddressLookupResult, lookup };

package/cloud/fetch.d.ts

@@ -1,2 +1,2 @@
-import { t as cloudFetch } from "../proxy-dOOmiMl4.js";
+import { t as cloudFetch } from "../proxy-BrsMJmiK.js";
 export { cloudFetch as fetch };

package/cloud/net.d.ts

@@ -1,2 +1,2 @@
-import { a as createConnection, c as isIP, i as connect, l as isIPv4, n as Socket, o as createServer, r as _default, t as Server, u as isIPv6 } from "../net-CmMZgV2a.js";
+import { a as createConnection, c as isIP, i as connect, l as isIPv4, n as Socket, o as createServer, r as _default, t as Server, u as isIPv6 } from "../net-BFjtzAK0.js";
 export { Server, Socket, _default, _default as default, connect, createConnection, createServer, isIP, isIPv4, isIPv6 };

package/{cloud-Bx64HSkQ.cjs → cloud-CUzZFzG3.cjs}

@@ -1 +1 @@
-const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-fqQfEPk6.cjs"),n=require("./hosts-GNBhZO3-.cjs"),r=require("./api--LOXTOpv.cjs"),i=require("./busy-Dv8wzE5M.cjs"),a=require("./proxy-CFK-KiwE.cjs"),o=require("./attach-policy.cjs"),s=require("./contract.cjs"),c=require("./dns.cjs"),l=require("./cloud/fs.cjs"),u=require("./net.cjs"),d=require("./dgram.cjs"),f=require("./http.cjs");let p=require("osra");var m=async()=>{let e=()=>r.s(`frame consent`);try{let t=await e();return{request:typeof t.frameConsent.request==`function`?t.frameConsent.request:void 0,ensure:t.frameConsent.ensure}}catch(t){if(!(t instanceof r.n))throw t;return{request:void 0,ensure:t=>e().then(e=>e.frameConsent.ensure(t))}}},h=`frame: this frame no longer holds the document the app attached it to`,g=!1,_=()=>{g||(g=!0,console.warn(`[fkn-frame] this FKN broker is too old to ask for permission categories, so nothing was asked for upfront and each capability is asked for as it is first used. Reloading the page picks up the current broker.`))},v=e=>[...e].flatMap(e=>{try{return[new URL(e).hostname]}catch{return[]}}),y=(e,t,n)=>n===null?`frame.${e}: the user did not grant ${t} here`:`frame.${e}: the user did not grant ${t} on ${n}`,b=e=>{let{assertLive:r,attach:i,consent:a,current:s,declaredHosts:c,documentHost:l,freshBlank:u,session:d,approvedOrigins:f}=e,p=new Set,m=()=>{try{return new URL(s()).hostname}catch{return``}},g=async()=>l?await l():m(),b=()=>n.t([...c,...v(f)]),x=async(e,t)=>(await e([t]))[0]??!1;return{gate:async({operation:e,args:s,phase:l})=>{r();let _=n.m(e,s);if(_===null)return;let v=t.h(_);if(v===void 0||v===`auto`)return;if(e===`fetch`){let e=o.frameFetchVerdict({session:d,declaredHosts:c,approvedOrigins:f},l===`ensure`?void 0:s[0],{classifier:`fetchTarget`});if(l===`ensure`&&!d)throw t.O(e.kind===`refuse`?e.reason:``,`fetch`);if(l!==`ensure`&&e.kind===`refuse`)throw t.O(e.reason,`fetch`);let{request:r,ensure:i}=await a();if(!r){if(e.kind===`refuse`)throw t.O(e.reason,`fetch`);if(!await i({scope:n.c(s[0],s[1]).scope,hosts:e.promptHosts}))throw t.O(`frame.fetch: the user did not grant this`,`fetch`);return}let u=e.kind===`consent`?e.targetHost:await g(),p=n.t([u,...c]);if(!p.length)throw t.O(`frame: navigate the frame before fetch`,`fetch`);if(await x(r,{category:`network`,hosts:p})===!1)throw t.O(y(`fetch`,`network`,u||null),`fetch`);return}let S=await g();if(!S)throw t.O(`frame: navigate the frame before ${e}`,e);if(!b().includes(S))throw t.O(h,e);let C=t.m(_);if(C===void 0||C===`evaluation`&&S===m()&&await u?.()||v===`critical`&&p.has(`${_} ${S}`))return;let{request:w}=await a();if(!w)return;let T=n.t([S,...c]),E=await x(w,v===`critical`?{key:_,hosts:T,attach:i}:{category:C,hosts:T});if(E===!1)throw t.O(y(e,C,null),e);if(E===`once`&&l!==`ensure`)for(let e of T)p.add(`${_} ${e}`)},requestCategories:async e=>{r(),t.f(`frame.requestPermissions`,e);let o=await g(),s=n.t(o?[o,...c]:c);if(!s.length)throw TypeError(`frame.requestPermissions: navigate the frame or declare domains first`);let l=e.map(e=>{let n=e.key;return n===void 0?{named:void 0,critical:!1,category:e.category}:{named:n,critical:t.h(n)===`critical`,category:t.p(n)}}),u=({named:e,critical:t,category:n},r)=>({category:n,...t?{key:e}:{},hosts:s,allow:r}),{request:d}=await a();if(!d)return _(),l.map(e=>u(e,!1));let f=await d(l.map(({named:e,critical:t,category:n})=>t?{key:e,hosts:s,attach:i}:{category:n,hosts:s}));return l.map((e,t)=>u(e,f[t]!==void 0&&f[t]!==!1))},boundary:b}},x=e=>e,S=5e3,C=new Set([]),w=()=>`https://fkn.app`,T=e=>e===`persistent`?``:`incognito-${crypto.randomUUID()}`,E=(e,n,r)=>{let i,a=new Promise((e,a)=>{i=setTimeout(()=>a(typeof r==`string`?new t.T(r):r()),n)});return Promise.race([e,a]).finally(()=>clearTimeout(i))},D=e=>Object.assign(Error(e),{name:t.E}),O=`frame.postMessage: this FKN page predates frame messaging; reload the app to load the current one`,k=`frame.addScriptTag: this render proxy predates addScriptTag; reload the app`,A=`frame.addScriptTag: no answer within ${t.l}ms; the script may or may not have run`,j=`frame.clearCookies: this FKN page predates clearCookies; reload the app to load the current one`,M=`frame.clearCookies: this attachment reaches no site yet; attach a url, goto one, or declare it in domains`,N=3e4,P=`attachFrame: this FKN page predates storageState; reload the app to load the current one`,F=2e4,I=async(e,n)=>{if(typeof e.seed!=`function`)throw t.M(P,`storageState`,`cloud`);try{await E(e.seed(n),F,`attachFrame: the render proxy did not take the storageState seed`)}catch(e){throw t.D(e)?t.M(P,`storageState`,`cloud`):e}},L=`frame.clearCookies: the render proxy did not answer within ${N}ms; the cookies may or may not be gone, and calling it again is safe`,ee=e=>t.D(e)&&e.message===t.A(`addScriptTag`).message,R=!1,te=()=>{R||(R=!0,console.warn(`[fkn-frame] this FKN page predates frame messaging, so the page's messages and documents are never reported. Reloading the app loads the current one.`))},z=({from:e,origin:t,attach:n,signal:r})=>i=>{let a=r=>{if(r.source===null||r.source!==e()||r.origin!==t)return;let a=r.data;typeof a==`object`&&a&&a.type===`fkn-frame-message`&&a.attach===n&&typeof a.origin==`string`&&(a.kind===`message`?i({type:`message`,data:a.data,origin:a.origin,ports:r.ports}):a.kind===`document`&&i({type:`document`,origin:a.origin}))};return window.addEventListener(`message`,a,{signal:r}),()=>window.removeEventListener(`message`,a)},ne=e=>{if(typeof e!=`function`)return()=>Promise.resolve(e);let t=null;return()=>t??=e().catch(e=>{throw t=null,e})},B=({control:e,target:n,blank:r=!1,session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,guard:l,consent:u,onNavigated:d,relay:f})=>{let p=n,m=r&&i!==``,g=async()=>{if(!m)return!1;let t=typeof e.blank==`function`?await l(()=>e.blank()):``;return(typeof t!=`string`||t.split(`#`)[0]!==n.split(`#`)[0])&&(m=!1),m},_=Promise.resolve(),{gate:v,requestCategories:y,boundary:x}=b({session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,documentHost:typeof e.documentHost==`function`?()=>l(()=>e.documentHost()):void 0,current:()=>p,consent:ne(u),freshBlank:g});return t.y({backend:`cloud`,executor:{execute:(n,r,i)=>C.has(r)?Promise.reject(t.A(r,`cloud`)):(c(),l(()=>e.executeLocator(n,r,i))),highlight:async()=>{}},gate:v,requestPermissions:y,evaluate:async(n,r)=>(c(),await v({parts:[],operation:`evaluate`,args:[n,r],phase:`execute`}),E(l(()=>e.executeLocator([],`evaluate`,[n,r])),t.l,t.u)),addScriptTag:async(n,r)=>{c();let i=[n,r];await v({parts:[],operation:`addScriptTag`,args:i,phase:`execute`});try{await E(l(()=>e.executeLocator([],`addScriptTag`,i)),t.l,A)}catch(e){throw ee(e)?t.M(k,`addScriptTag`,`cloud`):e}},clearCookies:async n=>{if(c(),typeof e.clearCookies!=`function`)throw t.M(j,`clearCookies`,`cloud`);if(x().length===0)throw t.O(M,`clearCookies`);await E(l(()=>e.clearCookies(n)),N,L)},postMessage:(n,r,i)=>{if(c(),typeof e.messaging!=`function`)throw t.M(O,`postMessage`,`cloud`);if(r!==`*`&&!x().includes(new URL(r).hostname))throw t.O(h,`postMessage`);let{port1:a,port2:o}=new MessageChannel;a.postMessage({data:n,transfer:i},i);let s=[o,r],u=_.then(async()=>(await v({parts:[],operation:`postMessage`,args:s,phase:`execute`}),{answer:l(()=>e.executeLocator([],`postMessage`,s))}));return _=u.catch(()=>{}),u.then(async({answer:e})=>{await e})},listen:t=>(typeof e.messaging!=`function`&&te(),f(t)),goto:async(n,{timeout:r,...i}={})=>{let a=new URL(n,location.href).href;c(),m=!1;let s=(()=>{try{return new URL(a).origin}catch{return``}})(),u=s!==``&&!o.has(s);u&&o.add(s);try{await E(l(()=>e.goto(a,r===void 0?i:{...i,timeoutMs:r})),(r??3e4)+S,`cloud.attachFrame: the render proxy did not answer goto; the frame may have been detached or its page reloaded`)}catch(e){throw u&&o.delete(s),t.c(e)}p=a,d()},url:()=>p})},re=250,ie=500,ae=65e3,oe=2e3,se=2e3,ce=2,le=2e3,ue=2e3,V=({origin:e,target:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-window`,e);return a.searchParams.set(`attach`,i),t&&a.searchParams.set(`url`,t),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.href},H=(e,t)=>{let n=document.createElement(`iframe`),r=new URL(`/attach-jar`,e);return r.searchParams.set(`attach`,t),n.src=r.href,n.tabIndex=-1,n.setAttribute(`aria-hidden`,`true`),n.setAttribute(`style`,`display:none`),(document.body??document.documentElement).appendChild(n),n},de=(e,t)=>{let n=new MutationObserver(()=>{e.isConnected||t.aborted||(n.disconnect(),console.warn(`cloud.attachFrame: the window's jar anchor was removed from this page, so a sign-in in the window no longer reaches this app's cookie jar`))});e.parentNode&&n.observe(e.parentNode,{childList:!0}),n.observe(document.documentElement,{childList:!0}),t.addEventListener(`abort`,()=>n.disconnect(),{once:!0})},U=()=>D(`cloud.attachFrame: the attached window closed, reloaded or left the page FKN attached; attach a fresh window`),W=()=>D(`cloud.attachFrame: the attached window stopped answering; attach a fresh window`),fe=()=>D(`cloud.attachFrame: the window went away before it connected; attach a fresh window`),pe=()=>D(`cloud.attachFrame: the window closed before it connected. Either the user closed it, or this page's Cross-Origin-Opener-Policy cut its link to the window`),me=async(e,r,a)=>{if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);let{domains:o=[],permissions:c}=e,{url:l,width:u,height:d}=t.s(e.window);if(window.origin===`null`)throw new t._(`opaque-opener`);let f=w(),m=crypto.randomUUID(),h=T(r),g=n.t(o),_=new Set;l&&_.add(new URL(l).origin);let v=r===`persistent`?H(f,m):null,y=window.open(V({origin:f,target:a===void 0?l:``,session:h,domains:g,attach:m}),`_blank`,`popup,width=${u},height=${d}`);if(!y)throw v?.remove(),new t.g;let b=new AbortController,S=!1,C=null,D=(e,t=!1)=>{if(C===null){C=e,b.abort(t?W():U());try{y.closed||y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.detach,attach:m,...t?{unanswered:t}:{}},f)}catch{}v&&setTimeout(()=>v.remove(),ue)}};v&&de(v,b.signal);let O=new Promise((e,t)=>{b.signal.addEventListener(`abort`,()=>t(b.signal.reason),{once:!0})});O.catch(()=>{});let k=O.then(()=>{},()=>{}),A=()=>{if(b.signal.aborted)throw b.signal.reason},j=e=>b.signal.aborted?Promise.reject(b.signal.reason):Promise.race([e(),O]),M=e=>e.source===y&&e.origin===f;window.addEventListener(`message`,e=>{if(!M(e))return;let n=e.data;typeof n==`object`&&n&&n.attach===m&&(n.type===s.ATTACH_WINDOW_MESSAGE.refused?D(new t._(n.reason)):n.type===s.ATTACH_WINDOW_MESSAGE.gone&&D(S?U():fe()))},{signal:b.signal}),window.addEventListener(`pagehide`,()=>D(U()),{signal:b.signal});let N=()=>{try{y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.hello,attach:m},f)}catch{}};N();let P=setInterval(N,re),F=setInterval(()=>{y.closed&&D(S?U():pe())},ie);b.signal.addEventListener(`abort`,()=>{clearInterval(P),clearInterval(F)},{once:!0});let L=async e=>{try{return await Promise.race([e,O])}catch(e){throw C??e}};try{let e=await L(E((0,p.expose)({},{key:s.ATTACH_WINDOW_KEY,transport:{emit:(e,t)=>y.postMessage(e,f,t??[]),receive:e=>{let t=t=>{M(t)&&e(t.data,{source:t.source,origin:t.origin})};return window.addEventListener(`message`,t),()=>window.removeEventListener(`message`,t)}},unregisterSignal:b.signal,revivableModules:x(t.lt)}),s.WINDOW_HANDSHAKE_TIMEOUT_MS,`cloud.attachFrame: timed out connecting to the window`));S=!0,clearInterval(P);let n=0,r=setInterval(()=>{E(j(()=>e.ping()),se,`ping`).then(()=>{n=0},()=>{b.signal.aborted||(document.visibilityState===`hidden`?n=0:++n>=ce&&D(W(),!0))})},oe);b.signal.addEventListener(`abort`,()=>clearInterval(r),{once:!0}),await L(E(e.ready(),ae,`cloud.attachFrame: the window never became ready`)),a!==void 0&&await L(I(e,a));let o=i.t(`attached frame`);b.signal.aborted?o():b.signal.addEventListener(`abort`,o,{once:!0});let u=B({control:e,target:l,session:h,declaredHosts:g,approvedOrigins:_,attach:m,assertLive:A,guard:j,consent:{request:t=>j(()=>e.requestConsent(t)),ensure:t=>j(()=>e.requestConsent([t])).then(([e])=>e!==void 0&&e!==!1)},onNavigated:()=>{},relay:z({from:()=>y,origin:f,attach:m,signal:b.signal})}),d=null,v=Object.assign(u,{close:()=>d??=(async()=>{b.signal.aborted||await E(Promise.allSettled([j(()=>e.flushCookies()),j(()=>e.sweepStorage())]),le,`close`).catch(()=>{});try{y.close()}catch{}D(U())})(),closed:k});return a!==void 0&&l&&await L(v.goto(l)),c?.length&&await L(v.requestPermissions(c)),v}catch(e){let n=C??e;if(!(n instanceof t._))try{y.close()}catch{}throw D(n),n}},he=2e4,G=65e3,K=e=>!e||e===`about:blank`,ge=`cloud.attachFrame: this FKN page predates blank pages; reload the app to load the current one`,_e=`cloud.attachFrame: cookies: 'native' needs the FKN browser extension; the cloud render proxy has no browser cookies`,q=e=>e.split(`#`)[0]??``,J=({iframe:e,lockdown:n,cookies:r,blank:i})=>{if(i===void 0)return``;if(typeof i!=`object`||!i)throw TypeError(`attachFrame: blank must be an object { url }`);let a=Object.keys(i).find(e=>e!==`url`);if(a!==void 0)throw TypeError(`attachFrame: blank takes { url }, not "${a}"`);let{url:o}=i,s=(()=>{try{return typeof o==`string`?new URL(o):null}catch{return null}})();if(!s||s.protocol!==`http:`&&s.protocol!==`https:`)throw TypeError(`attachFrame: blank.url must be an absolute http or https url, not "${String(o)}"`);let c=e.getAttribute(`src`)??``;if(!K(c))throw TypeError(`attachFrame: blank needs an iframe with no src; this one has "${c}"`);if(n)throw TypeError(`attachFrame: blank does not combine with lockdown`);if(r===`native`)throw TypeError(`attachFrame: blank runs on the cloud render proxy, which has no browser cookies; pass cookies: 'persistent' or 'ephemeral'`);if(t.x(s.href),!Te())throw Error(`attachFrame: a blank page is served by the cloud render proxy, which this build does not configure`);return s.href},ve=({target:e,blank:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-frame`,w());return t?a.searchParams.set(`blank`,t):e&&a.searchParams.set(`url`,e),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.searchParams.set(`attach`,i),a.href},ye=(e,t)=>{let n=()=>{a(),t()},r=e.parentNode,i=new MutationObserver(()=>{(!e.isConnected||e.parentNode!==r)&&(a(),t())}),a=()=>{window.removeEventListener(`pagehide`,n),i.disconnect()};window.addEventListener(`pagehide`,n,{once:!0}),r&&i.observe(r,{childList:!0}),e.isConnected||(a(),t())},be=()=>D(`cloud.attachFrame: the attached iframe left the document or was reloaded; attach a fresh iframe`),xe=(e,t)=>{let n=[...e.split(`;`),...t.split(`;`)].map(e=>e.trim()).filter(Boolean);return[...new Set(n)].join(`; `)},Se=[300,1200,4e3],Y=e=>{let t=()=>{if(!e.isConnected)return;let t=e.style.height,n=e.getBoundingClientRect();n.height&&(e.style.height=`${n.height-1}px`,setTimeout(()=>{e.style.height=t},50))};t();for(let e of Se)setTimeout(t,e)},Ce=e=>{let t=e.getAttribute(`sandbox`);if(t===null)return;let n=new Set(t.toLowerCase().split(/\s+/).filter(Boolean)),r=[`allow-scripts`,`allow-same-origin`].filter(e=>!n.has(e));if(r.length)throw Error(`cloud.attachFrame: the iframe's sandbox attribute must include ${r.join(` and `)} for the render proxy to load`)},X=async(e,n)=>{let r=typeof e.blank==`function`?await E(e.blank(),G,`cloud.attachFrame: the render proxy never became ready`):``;if(typeof r!=`string`||q(r)!==q(n))throw t.M(ge,`blank`,`cloud`)},we=async(e,a,o)=>{let c=J(e),{iframe:l,domains:u=[],permissions:d}=e;if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);if(!l.isConnected)throw Error(`cloud.attachFrame: the iframe must be connected to the document before attaching`);Ce(l);let f=l.getAttribute(`src`)??``,h=(()=>{if(K(f))return null;try{return new URL(l.src||f,location.href)}catch{throw Error(`cloud.attachFrame: the iframe src is not a valid URL: ${f}`)}})();if(h){let e=new URL(`/attach-frame`,w());if(h.origin===e.origin&&h.pathname===e.pathname)throw Error(`cloud.attachFrame: this iframe is already attached; navigate with the Frame returned by that attach or use a fresh iframe`)}let g=h?.href??``;g&&t.x(g);let _=o===void 0?g:``,v=T(a),y=n.t(u),b=new Set;try{b.add(new URL(c||g).origin)}catch{}let S=new AbortController,C=l.referrerPolicy,D=l.allow,O=crypto.randomUUID();if(l.referrerPolicy=`origin`,l.allow=xe(r.m(),l.allow),l.src=ve({target:_,blank:c,session:v,domains:y,attach:O}),!l.contentWindow)throw Error(`cloud.attachFrame: the iframe window is not available`);try{let e=await E((0,p.expose)({},{key:s.ATTACH_FRAME_KEY,origin:w(),transport:{receive:window,emit:l.contentWindow},unregisterSignal:S.signal,revivableModules:x(t.lt)}),he,`cloud.attachFrame: timed out connecting to the render proxy page`);await E(e.ready(),G,`cloud.attachFrame: the render proxy never became ready`),c&&await X(e,c),o!==void 0&&await I(e,o),(g||c)&&Y(l),ye(l,()=>S.abort());let n=i.t(`attached frame`);S.signal.aborted?n():S.signal.addEventListener(`abort`,n,{once:!0});let r=l.contentWindow,a=B({control:e,target:c||g,blank:c!==``,session:v,declaredHosts:y,approvedOrigins:b,attach:O,assertLive:()=>{if(S.signal.aborted||!l.isConnected||l.contentWindow!==r)throw S.abort(),be()},guard:e=>e(),consent:m,onNavigated:()=>Y(l),relay:z({from:()=>r,origin:w(),attach:O,signal:S.signal})});return o!==void 0&&g&&await a.goto(g),d?.length&&await a.requestPermissions(d),a}catch(e){throw S.abort(),l.referrerPolicy=C,l.allow=D,l.src=_||`about:blank`,e}},Z=(async e=>{let{kind:n,cookies:r,storageState:i}=t.o(e);if(r===`native`)throw TypeError(_e);return n===`window`?me(e,r,i):we(e,r,i)}),Te=()=>typeof window<`u`&&!0,Q=async()=>{let e=await r.o.then(e=>e.cloud.quota());return{premium:e.premium,overQuota:e.overQuota,throttled:e.overQuota&&!e.premium,usedBytes:e.usedBytes,limitBytes:e.limitBytes,remainingBytes:e.remaining,bytesPerSecond:e.bytesPerSecond,bitsPerSecond:e.bytesPerSecond*8}},Ee=e.t({attachFrame:()=>Z,available:()=>$,dgram:()=>d.t,dns:()=>c.t,fetch:()=>a.t,fs:()=>l.t,http:()=>f.t,net:()=>u.t,quota:()=>Q}),$=()=>r.l;Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return J}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Z}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return Ee}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Q}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return $}});
+const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-47LPHYgB.cjs"),n=require("./hosts-GNBhZO3-.cjs"),r=require("./api--LOXTOpv.cjs"),i=require("./busy-Dv8wzE5M.cjs"),a=require("./proxy-CFK-KiwE.cjs"),o=require("./attach-policy.cjs"),s=require("./contract.cjs"),c=require("./dns.cjs"),l=require("./cloud/fs.cjs"),u=require("./net.cjs"),d=require("./dgram.cjs"),f=require("./http.cjs");let p=require("osra");var m=async()=>{let e=()=>r.s(`frame consent`);try{let t=await e();return{request:typeof t.frameConsent.request==`function`?t.frameConsent.request:void 0,ensure:t.frameConsent.ensure}}catch(t){if(!(t instanceof r.n))throw t;return{request:void 0,ensure:t=>e().then(e=>e.frameConsent.ensure(t))}}},h=`frame: this frame no longer holds the document the app attached it to`,g=!1,_=()=>{g||(g=!0,console.warn(`[fkn-frame] this FKN broker is too old to ask for permission categories, so nothing was asked for upfront and each capability is asked for as it is first used. Reloading the page picks up the current broker.`))},v=e=>[...e].flatMap(e=>{try{return[new URL(e).hostname]}catch{return[]}}),y=(e,t,n)=>n===null?`frame.${e}: the user did not grant ${t} here`:`frame.${e}: the user did not grant ${t} on ${n}`,b=e=>{let{assertLive:r,attach:i,consent:a,current:s,declaredHosts:c,documentHost:l,freshBlank:u,session:d,approvedOrigins:f}=e,p=new Set,m=()=>{try{return new URL(s()).hostname}catch{return``}},g=async()=>l?await l():m(),b=()=>n.t([...c,...v(f)]),x=async(e,t)=>(await e([t]))[0]??!1;return{gate:async({operation:e,args:s,phase:l})=>{r();let _=n.m(e,s);if(_===null)return;let v=t.h(_);if(v===void 0||v===`auto`)return;if(e===`fetch`){let e=o.frameFetchVerdict({session:d,declaredHosts:c,approvedOrigins:f},l===`ensure`?void 0:s[0],{classifier:`fetchTarget`});if(l===`ensure`&&!d)throw t.O(e.kind===`refuse`?e.reason:``,`fetch`);if(l!==`ensure`&&e.kind===`refuse`)throw t.O(e.reason,`fetch`);let{request:r,ensure:i}=await a();if(!r){if(e.kind===`refuse`)throw t.O(e.reason,`fetch`);if(!await i({scope:n.c(s[0],s[1]).scope,hosts:e.promptHosts}))throw t.O(`frame.fetch: the user did not grant this`,`fetch`);return}let u=e.kind===`consent`?e.targetHost:await g(),p=n.t([u,...c]);if(!p.length)throw t.O(`frame: navigate the frame before fetch`,`fetch`);if(await x(r,{category:`network`,hosts:p})===!1)throw t.O(y(`fetch`,`network`,u||null),`fetch`);return}let S=await g();if(!S)throw t.O(`frame: navigate the frame before ${e}`,e);if(!b().includes(S))throw t.O(h,e);let C=t.m(_);if(C===void 0||C===`evaluation`&&S===m()&&await u?.()||v===`critical`&&p.has(`${_} ${S}`))return;let{request:w}=await a();if(!w)return;let T=n.t([S,...c]),E=await x(w,v===`critical`?{key:_,hosts:T,attach:i}:{category:C,hosts:T});if(E===!1)throw t.O(y(e,C,null),e);if(E===`once`&&l!==`ensure`)for(let e of T)p.add(`${_} ${e}`)},requestCategories:async e=>{r(),t.f(`frame.requestPermissions`,e);let o=await g(),s=n.t(o?[o,...c]:c);if(!s.length)throw TypeError(`frame.requestPermissions: navigate the frame or declare domains first`);let l=e.map(e=>{let n=e.key;return n===void 0?{named:void 0,critical:!1,category:e.category}:{named:n,critical:t.h(n)===`critical`,category:t.p(n)}}),u=({named:e,critical:t,category:n},r)=>({category:n,...t?{key:e}:{},hosts:s,allow:r}),{request:d}=await a();if(!d)return _(),l.map(e=>u(e,!1));let f=await d(l.map(({named:e,critical:t,category:n})=>t?{key:e,hosts:s,attach:i}:{category:n,hosts:s}));return l.map((e,t)=>u(e,f[t]!==void 0&&f[t]!==!1))},boundary:b}},x=e=>e,S=5e3,C=new Set([]),w=()=>`https://fkn.app`,T=e=>e===`persistent`?``:`incognito-${crypto.randomUUID()}`,E=(e,n,r)=>{let i,a=new Promise((e,a)=>{i=setTimeout(()=>a(typeof r==`string`?new t.T(r):r()),n)});return Promise.race([e,a]).finally(()=>clearTimeout(i))},D=e=>Object.assign(Error(e),{name:t.E}),O=`frame.postMessage: this FKN page predates frame messaging; reload the app to load the current one`,k=`frame.addScriptTag: this render proxy predates addScriptTag; reload the app`,A=`frame.addScriptTag: no answer within ${t.l}ms; the script may or may not have run`,j=`frame.clearCookies: this FKN page predates clearCookies; reload the app to load the current one`,M=`frame.clearCookies: this attachment reaches no site yet; attach a url, goto one, or declare it in domains`,N=3e4,P=`attachFrame: this FKN page predates storageState; reload the app to load the current one`,F=2e4,I=async(e,n)=>{if(typeof e.seed!=`function`)throw t.M(P,`storageState`,`cloud`);try{await E(e.seed(n),F,`attachFrame: the render proxy did not take the storageState seed`)}catch(e){throw t.D(e)?t.M(P,`storageState`,`cloud`):e}},L=`frame.clearCookies: the render proxy did not answer within ${N}ms; the cookies may or may not be gone, and calling it again is safe`,ee=e=>t.D(e)&&e.message===t.A(`addScriptTag`).message,R=!1,te=()=>{R||(R=!0,console.warn(`[fkn-frame] this FKN page predates frame messaging, so the page's messages and documents are never reported. Reloading the app loads the current one.`))},z=({from:e,origin:t,attach:n,signal:r})=>i=>{let a=r=>{if(r.source===null||r.source!==e()||r.origin!==t)return;let a=r.data;typeof a==`object`&&a&&a.type===`fkn-frame-message`&&a.attach===n&&typeof a.origin==`string`&&(a.kind===`message`?i({type:`message`,data:a.data,origin:a.origin,ports:r.ports}):a.kind===`document`&&i({type:`document`,origin:a.origin}))};return window.addEventListener(`message`,a,{signal:r}),()=>window.removeEventListener(`message`,a)},ne=e=>{if(typeof e!=`function`)return()=>Promise.resolve(e);let t=null;return()=>t??=e().catch(e=>{throw t=null,e})},B=({control:e,target:n,blank:r=!1,session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,guard:l,consent:u,onNavigated:d,relay:f})=>{let p=n,m=r&&i!==``,g=async()=>{if(!m)return!1;let t=typeof e.blank==`function`?await l(()=>e.blank()):``;return(typeof t!=`string`||t.split(`#`)[0]!==n.split(`#`)[0])&&(m=!1),m},_=Promise.resolve(),{gate:v,requestCategories:y,boundary:x}=b({session:i,declaredHosts:a,approvedOrigins:o,attach:s,assertLive:c,documentHost:typeof e.documentHost==`function`?()=>l(()=>e.documentHost()):void 0,current:()=>p,consent:ne(u),freshBlank:g});return t.y({backend:`cloud`,executor:{execute:(n,r,i)=>C.has(r)?Promise.reject(t.A(r,`cloud`)):(c(),l(()=>e.executeLocator(n,r,i))),highlight:async()=>{}},gate:v,requestPermissions:y,evaluate:async(n,r)=>(c(),await v({parts:[],operation:`evaluate`,args:[n,r],phase:`execute`}),E(l(()=>e.executeLocator([],`evaluate`,[n,r])),t.l,t.u)),addScriptTag:async(n,r)=>{c();let i=[n,r];await v({parts:[],operation:`addScriptTag`,args:i,phase:`execute`});try{await E(l(()=>e.executeLocator([],`addScriptTag`,i)),t.l,A)}catch(e){throw ee(e)?t.M(k,`addScriptTag`,`cloud`):e}},clearCookies:async n=>{if(c(),typeof e.clearCookies!=`function`)throw t.M(j,`clearCookies`,`cloud`);if(x().length===0)throw t.O(M,`clearCookies`);await E(l(()=>e.clearCookies(n)),N,L)},postMessage:(n,r,i)=>{if(c(),typeof e.messaging!=`function`)throw t.M(O,`postMessage`,`cloud`);if(r!==`*`&&!x().includes(new URL(r).hostname))throw t.O(h,`postMessage`);let{port1:a,port2:o}=new MessageChannel;a.postMessage({data:n,transfer:i},i);let s=[o,r],u=_.then(async()=>(await v({parts:[],operation:`postMessage`,args:s,phase:`execute`}),{answer:l(()=>e.executeLocator([],`postMessage`,s))}));return _=u.catch(()=>{}),u.then(async({answer:e})=>{await e})},listen:t=>(typeof e.messaging!=`function`&&te(),f(t)),goto:async(n,{timeout:r,...i}={})=>{let a=new URL(n,location.href).href;c(),m=!1;let s=(()=>{try{return new URL(a).origin}catch{return``}})(),u=s!==``&&!o.has(s);u&&o.add(s);try{await E(l(()=>e.goto(a,r===void 0?i:{...i,timeoutMs:r})),(r??3e4)+S,`cloud.attachFrame: the render proxy did not answer goto; the frame may have been detached or its page reloaded`)}catch(e){throw u&&o.delete(s),t.c(e)}p=a,d()},url:()=>p})},re=250,ie=500,ae=65e3,oe=2e3,se=2e3,ce=2,le=2e3,ue=2e3,V=({origin:e,target:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-window`,e);return a.searchParams.set(`attach`,i),t&&a.searchParams.set(`url`,t),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.href},H=(e,t)=>{let n=document.createElement(`iframe`),r=new URL(`/attach-jar`,e);return r.searchParams.set(`attach`,t),n.src=r.href,n.tabIndex=-1,n.setAttribute(`aria-hidden`,`true`),n.setAttribute(`style`,`display:none`),(document.body??document.documentElement).appendChild(n),n},de=(e,t)=>{let n=new MutationObserver(()=>{e.isConnected||t.aborted||(n.disconnect(),console.warn(`cloud.attachFrame: the window's jar anchor was removed from this page, so a sign-in in the window no longer reaches this app's cookie jar`))});e.parentNode&&n.observe(e.parentNode,{childList:!0}),n.observe(document.documentElement,{childList:!0}),t.addEventListener(`abort`,()=>n.disconnect(),{once:!0})},U=()=>D(`cloud.attachFrame: the attached window closed, reloaded or left the page FKN attached; attach a fresh window`),W=()=>D(`cloud.attachFrame: the attached window stopped answering; attach a fresh window`),fe=()=>D(`cloud.attachFrame: the window went away before it connected; attach a fresh window`),pe=()=>D(`cloud.attachFrame: the window closed before it connected. Either the user closed it, or this page's Cross-Origin-Opener-Policy cut its link to the window`),me=async(e,r,a)=>{if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);let{domains:o=[],permissions:c}=e,{url:l,width:u,height:d}=t.s(e.window);if(window.origin===`null`)throw new t._(`opaque-opener`);let f=w(),m=crypto.randomUUID(),h=T(r),g=n.t(o),_=new Set;l&&_.add(new URL(l).origin);let v=r===`persistent`?H(f,m):null,y=window.open(V({origin:f,target:a===void 0?l:``,session:h,domains:g,attach:m}),`_blank`,`popup,width=${u},height=${d}`);if(!y)throw v?.remove(),new t.g;let b=new AbortController,S=!1,C=null,D=(e,t=!1)=>{if(C===null){C=e,b.abort(t?W():U());try{y.closed||y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.detach,attach:m,...t?{unanswered:t}:{}},f)}catch{}v&&setTimeout(()=>v.remove(),ue)}};v&&de(v,b.signal);let O=new Promise((e,t)=>{b.signal.addEventListener(`abort`,()=>t(b.signal.reason),{once:!0})});O.catch(()=>{});let k=O.then(()=>{},()=>{}),A=()=>{if(b.signal.aborted)throw b.signal.reason},j=e=>b.signal.aborted?Promise.reject(b.signal.reason):Promise.race([e(),O]),M=e=>e.source===y&&e.origin===f;window.addEventListener(`message`,e=>{if(!M(e))return;let n=e.data;typeof n==`object`&&n&&n.attach===m&&(n.type===s.ATTACH_WINDOW_MESSAGE.refused?D(new t._(n.reason)):n.type===s.ATTACH_WINDOW_MESSAGE.gone&&D(S?U():fe()))},{signal:b.signal}),window.addEventListener(`pagehide`,()=>D(U()),{signal:b.signal});let N=()=>{try{y.postMessage({type:s.ATTACH_WINDOW_MESSAGE.hello,attach:m},f)}catch{}};N();let P=setInterval(N,re),F=setInterval(()=>{y.closed&&D(S?U():pe())},ie);b.signal.addEventListener(`abort`,()=>{clearInterval(P),clearInterval(F)},{once:!0});let L=async e=>{try{return await Promise.race([e,O])}catch(e){throw C??e}};try{let e=await L(E((0,p.expose)({},{key:s.ATTACH_WINDOW_KEY,transport:{emit:(e,t)=>y.postMessage(e,f,t??[]),receive:e=>{let t=t=>{M(t)&&e(t.data,{source:t.source,origin:t.origin})};return window.addEventListener(`message`,t),()=>window.removeEventListener(`message`,t)}},unregisterSignal:b.signal,revivableModules:x(t.lt)}),s.WINDOW_HANDSHAKE_TIMEOUT_MS,`cloud.attachFrame: timed out connecting to the window`));S=!0,clearInterval(P);let n=0,r=setInterval(()=>{E(j(()=>e.ping()),se,`ping`).then(()=>{n=0},()=>{b.signal.aborted||(document.visibilityState===`hidden`?n=0:++n>=ce&&D(W(),!0))})},oe);b.signal.addEventListener(`abort`,()=>clearInterval(r),{once:!0}),await L(E(e.ready(),ae,`cloud.attachFrame: the window never became ready`)),a!==void 0&&await L(I(e,a));let o=i.t(`attached frame`);b.signal.aborted?o():b.signal.addEventListener(`abort`,o,{once:!0});let u=B({control:e,target:l,session:h,declaredHosts:g,approvedOrigins:_,attach:m,assertLive:A,guard:j,consent:{request:t=>j(()=>e.requestConsent(t)),ensure:t=>j(()=>e.requestConsent([t])).then(([e])=>e!==void 0&&e!==!1)},onNavigated:()=>{},relay:z({from:()=>y,origin:f,attach:m,signal:b.signal})}),d=null,v=Object.assign(u,{close:()=>d??=(async()=>{b.signal.aborted||await E(Promise.allSettled([j(()=>e.flushCookies()),j(()=>e.sweepStorage())]),le,`close`).catch(()=>{});try{y.close()}catch{}D(U())})(),closed:k});return a!==void 0&&l&&await L(v.goto(l)),c?.length&&await L(v.requestPermissions(c)),v}catch(e){let n=C??e;if(!(n instanceof t._))try{y.close()}catch{}throw D(n),n}},he=2e4,G=65e3,K=e=>!e||e===`about:blank`,ge=`cloud.attachFrame: this FKN page predates blank pages; reload the app to load the current one`,_e=`cloud.attachFrame: cookies: 'native' needs the FKN browser extension; the cloud render proxy has no browser cookies`,q=e=>e.split(`#`)[0]??``,J=({iframe:e,lockdown:n,cookies:r,blank:i})=>{if(i===void 0)return``;if(typeof i!=`object`||!i)throw TypeError(`attachFrame: blank must be an object { url }`);let a=Object.keys(i).find(e=>e!==`url`);if(a!==void 0)throw TypeError(`attachFrame: blank takes { url }, not "${a}"`);let{url:o}=i,s=(()=>{try{return typeof o==`string`?new URL(o):null}catch{return null}})();if(!s||s.protocol!==`http:`&&s.protocol!==`https:`)throw TypeError(`attachFrame: blank.url must be an absolute http or https url, not "${String(o)}"`);let c=e.getAttribute(`src`)??``;if(!K(c))throw TypeError(`attachFrame: blank needs an iframe with no src; this one has "${c}"`);if(n)throw TypeError(`attachFrame: blank does not combine with lockdown`);if(r===`native`)throw TypeError(`attachFrame: blank runs on the cloud render proxy, which has no browser cookies; pass cookies: 'persistent' or 'ephemeral'`);if(t.x(s.href),!Te())throw Error(`attachFrame: a blank page is served by the cloud render proxy, which this build does not configure`);return s.href},ve=({target:e,blank:t,session:n,domains:r,attach:i})=>{let a=new URL(`/attach-frame`,w());return t?a.searchParams.set(`blank`,t):e&&a.searchParams.set(`url`,e),n&&a.searchParams.set(`session`,n),r.length&&a.searchParams.set(`domains`,r.join(`,`)),a.searchParams.set(`attach`,i),a.href},ye=(e,t)=>{let n=()=>{a(),t()},r=e.parentNode,i=new MutationObserver(()=>{(!e.isConnected||e.parentNode!==r)&&(a(),t())}),a=()=>{window.removeEventListener(`pagehide`,n),i.disconnect()};window.addEventListener(`pagehide`,n,{once:!0}),r&&i.observe(r,{childList:!0}),e.isConnected||(a(),t())},be=()=>D(`cloud.attachFrame: the attached iframe left the document or was reloaded; attach a fresh iframe`),xe=(e,t)=>{let n=[...e.split(`;`),...t.split(`;`)].map(e=>e.trim()).filter(Boolean);return[...new Set(n)].join(`; `)},Se=[300,1200,4e3],Y=e=>{let t=()=>{if(!e.isConnected)return;let t=e.style.height,n=e.getBoundingClientRect();n.height&&(e.style.height=`${n.height-1}px`,setTimeout(()=>{e.style.height=t},50))};t();for(let e of Se)setTimeout(t,e)},Ce=e=>{let t=e.getAttribute(`sandbox`);if(t===null)return;let n=new Set(t.toLowerCase().split(/\s+/).filter(Boolean)),r=[`allow-scripts`,`allow-same-origin`].filter(e=>!n.has(e));if(r.length)throw Error(`cloud.attachFrame: the iframe's sandbox attribute must include ${r.join(` and `)} for the render proxy to load`)},X=async(e,n)=>{let r=typeof e.blank==`function`?await E(e.blank(),G,`cloud.attachFrame: the render proxy never became ready`):``;if(typeof r!=`string`||q(r)!==q(n))throw t.M(ge,`blank`,`cloud`)},we=async(e,a,o)=>{let c=J(e),{iframe:l,domains:u=[],permissions:d}=e;if(typeof window>`u`)throw Error(`cloud.attachFrame needs a window realm`);if(!l.isConnected)throw Error(`cloud.attachFrame: the iframe must be connected to the document before attaching`);Ce(l);let f=l.getAttribute(`src`)??``,h=(()=>{if(K(f))return null;try{return new URL(l.src||f,location.href)}catch{throw Error(`cloud.attachFrame: the iframe src is not a valid URL: ${f}`)}})();if(h){let e=new URL(`/attach-frame`,w());if(h.origin===e.origin&&h.pathname===e.pathname)throw Error(`cloud.attachFrame: this iframe is already attached; navigate with the Frame returned by that attach or use a fresh iframe`)}let g=h?.href??``;g&&t.x(g);let _=o===void 0?g:``,v=T(a),y=n.t(u),b=new Set;try{b.add(new URL(c||g).origin)}catch{}let S=new AbortController,C=l.referrerPolicy,D=l.allow,O=crypto.randomUUID();if(l.referrerPolicy=`origin`,l.allow=xe(r.m(),l.allow),l.src=ve({target:_,blank:c,session:v,domains:y,attach:O}),!l.contentWindow)throw Error(`cloud.attachFrame: the iframe window is not available`);try{let e=await E((0,p.expose)({},{key:s.ATTACH_FRAME_KEY,origin:w(),transport:{receive:window,emit:l.contentWindow},unregisterSignal:S.signal,revivableModules:x(t.lt)}),he,`cloud.attachFrame: timed out connecting to the render proxy page`);await E(e.ready(),G,`cloud.attachFrame: the render proxy never became ready`),c&&await X(e,c),o!==void 0&&await I(e,o),(g||c)&&Y(l),ye(l,()=>S.abort());let n=i.t(`attached frame`);S.signal.aborted?n():S.signal.addEventListener(`abort`,n,{once:!0});let r=l.contentWindow,a=B({control:e,target:c||g,blank:c!==``,session:v,declaredHosts:y,approvedOrigins:b,attach:O,assertLive:()=>{if(S.signal.aborted||!l.isConnected||l.contentWindow!==r)throw S.abort(),be()},guard:e=>e(),consent:m,onNavigated:()=>Y(l),relay:z({from:()=>r,origin:w(),attach:O,signal:S.signal})});return o!==void 0&&g&&await a.goto(g),d?.length&&await a.requestPermissions(d),a}catch(e){throw S.abort(),l.referrerPolicy=C,l.allow=D,l.src=_||`about:blank`,e}},Z=(async e=>{let{kind:n,cookies:r,storageState:i}=t.o(e);if(r===`native`)throw TypeError(_e);return n===`window`?me(e,r,i):we(e,r,i)}),Te=()=>typeof window<`u`&&!0,Q=async()=>{let e=await r.o.then(e=>e.cloud.quota());return{premium:e.premium,overQuota:e.overQuota,throttled:e.overQuota&&!e.premium,usedBytes:e.usedBytes,limitBytes:e.limitBytes,remainingBytes:e.remaining,bytesPerSecond:e.bytesPerSecond,bitsPerSecond:e.bytesPerSecond*8}},Ee=e.t({attachFrame:()=>Z,available:()=>$,dgram:()=>d.t,dns:()=>c.t,fetch:()=>a.t,fs:()=>l.t,http:()=>f.t,net:()=>u.t,quota:()=>Q}),$=()=>r.l;Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return J}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Z}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return Ee}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Q}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return $}});

package/{cloud-DyOQPyUB.d.ts → cloud-DSx-jDFk.d.ts}

@@ -1,8 +1,8 @@
-import { r as AttachFrameFunction } from "./index-BOInGaEl.js";
-import { t as cloudFetch } from "./proxy-dOOmiMl4.js";
+import { r as AttachFrameFunction } from "./index-B98wvTaI.js";
+import { t as cloudFetch } from "./proxy-BrsMJmiK.js";
 import { t as dns_d_exports } from "./dns.js";
 import { n as fs_d_exports } from "./fs-KA1Mgisv.js";
-import { s as net_d_exports } from "./net-CmMZgV2a.js";
+import { s as net_d_exports } from "./net-BFjtzAK0.js";
 import { t as dgram_d_exports } from "./dgram.js";
 import { t as http_d_exports } from "./http.js";
 //#region src/cloud/frame.d.ts

package/{cloud-D-vDUzzx.js → cloud-v5x4uhDC.js}

@@ -1,5 +1,5 @@
 import { t as e } from "./rolldown-runtime-Dy4uBu1J.js";
-import { A as t, D as n, E as r, M as i, O as a, T as o, _ as s, c, f as l, g as u, h as d, l as f, lt as p, m, o as h, p as g, s as _, u as v, x as y, y as b } from "./lib-C3UwxjVs.js";
+import { A as t, D as n, E as r, M as i, O as a, T as o, _ as s, c, f as l, g as u, h as d, l as f, lt as p, m, o as h, p as g, s as _, u as v, x as y, y as b } from "./lib-BFwrzgpu.js";
 import { c as x, m as S, t as C } from "./hosts-t7CKGTRz.js";
 import { l as w, m as T, n as E, o as D, s as O } from "./api-DIgTslNb.js";
 import { t as k } from "./busy-B189uX--.js";

package/cloud.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./proxy-CFK-KiwE.cjs"),t=require("./cloud-Bx64HSkQ.cjs"),n=require("./dns.cjs"),r=require("./cloud/fs.cjs"),i=require("./net.cjs"),a=require("./dgram.cjs"),o=require("./http.cjs");exports.attachFrame=t.i,exports.available=t.t,Object.defineProperty(exports,"dgram",{enumerable:!0,get:function(){return a.t}}),Object.defineProperty(exports,"dns",{enumerable:!0,get:function(){return n.t}}),exports.fetch=e.t,Object.defineProperty(exports,"fs",{enumerable:!0,get:function(){return r.t}}),Object.defineProperty(exports,"http",{enumerable:!0,get:function(){return o.t}}),Object.defineProperty(exports,"net",{enumerable:!0,get:function(){return i.t}}),exports.quota=t.r;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./proxy-CFK-KiwE.cjs"),t=require("./cloud-CUzZFzG3.cjs"),n=require("./dns.cjs"),r=require("./cloud/fs.cjs"),i=require("./net.cjs"),a=require("./dgram.cjs"),o=require("./http.cjs");exports.attachFrame=t.i,exports.available=t.t,Object.defineProperty(exports,"dgram",{enumerable:!0,get:function(){return a.t}}),Object.defineProperty(exports,"dns",{enumerable:!0,get:function(){return n.t}}),exports.fetch=e.t,Object.defineProperty(exports,"fs",{enumerable:!0,get:function(){return r.t}}),Object.defineProperty(exports,"http",{enumerable:!0,get:function(){return o.t}}),Object.defineProperty(exports,"net",{enumerable:!0,get:function(){return i.t}}),exports.quota=t.r;

package/cloud.d.ts

@@ -1,8 +1,8 @@
-import { t as cloudFetch } from "./proxy-dOOmiMl4.js";
-import { a as attachFrame, i as quota, r as QuotaStatus, t as available } from "./cloud-DyOQPyUB.js";
+import { t as cloudFetch } from "./proxy-BrsMJmiK.js";
+import { a as attachFrame, i as quota, r as QuotaStatus, t as available } from "./cloud-DSx-jDFk.js";
 import { t as dns_d_exports } from "./dns.js";
 import { n as fs_d_exports } from "./fs-KA1Mgisv.js";
-import { s as net_d_exports } from "./net-CmMZgV2a.js";
+import { s as net_d_exports } from "./net-BFjtzAK0.js";
 import { t as dgram_d_exports } from "./dgram.js";
 import { t as http_d_exports } from "./http.js";
 export { type QuotaStatus, attachFrame, available, dgram_d_exports as dgram, dns_d_exports as dns, cloudFetch as fetch, fs_d_exports as fs, http_d_exports as http, net_d_exports as net, quota };

package/cloud.js

@@ -1,5 +1,5 @@
 import { t as e } from "./proxy-Dixbk1WL.js";
-import { i as t, r as n, t as r } from "./cloud-D-vDUzzx.js";
+import { i as t, r as n, t as r } from "./cloud-v5x4uhDC.js";
 import { t as i } from "./dns.js";
 import { t as a } from "./cloud/fs.js";
 import { t as o } from "./net.js";

package/{contract-6Xfd_qel.d.ts → contract-BmLpSueo.d.ts}

@@ -1,4 +1,4 @@
-import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-BOInGaEl.js";
+import { D as StorageState, tt as SelectorPart, u as ClearCookiesWire } from "./index-B98wvTaI.js";
 import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
 //#region ../web-extension/lib/lib/storage-state.d.ts
 /**
@@ -215,6 +215,33 @@ declare const SHELL_JAR_MESSAGE: {
  */
 declare const SHELL_JAR_UNREACHABLE: readonly ['bad-attach', 'no-storage', 'bad-jar', 'no-parent', 'no-jar-host', 'no-token', 'no-indexeddb', 'failed'];
 type ShellJarUnreachable = (typeof SHELL_JAR_UNREACHABLE)[number];
+/**
+ * FKN internal: why `Resolvers.proxyJar.key` answered no key. Only the render proxy's own documents
+ * ask, and only these names cross the wire.
+ *
+ * - `not-proxy`: the caller is not the render proxy's own origin.
+ * - `signed-out`: no account backs the app the proxy is attached to.
+ * - `not-enrolled`: the account has no key material, so there is nothing to seal under.
+ * - `locked`: the account has key material, and this partition holds no key for it.
+ * - `unconfirmed`: nothing answered in time, so neither of the two above is known.
+ */
+declare const PROXY_JAR_REFUSALS: readonly ['not-proxy', 'signed-out', 'not-enrolled', 'locked', 'unconfirmed'];
+type ProxyJarRefusal = (typeof PROXY_JAR_REFUSALS)[number];
+/**
+ * The key the render proxy seals one jar under. `key` is 32 bytes for AES-GCM and `jar` the name of the
+ * record (43 base64url characters); both are derived from the account's key for the top-level site the
+ * jar's storage partition belongs to, so a key handed out in one partition opens no other partition's
+ * jar. `verified` is false when no api answer vouched for the key's generation: such a key may open a
+ * record that exists, and must not create one or move a clear jar into one.
+ */
+type ProxyJarKey = {
+  key: Uint8Array;
+  jar: string;
+  verified: boolean;
+};
+type ProxyJarAnswer = ProxyJarKey | {
+  refused: ProxyJarRefusal;
+};
 /**
  * What a window's middle page, the jar anchor its app mounted (`/attach-jar`) and the anchor's jar
  * host say, all with the attach id.
@@ -310,9 +337,12 @@ type ShellControl = {
    *
    * Refuses, before anything is removed: a filter of any other shape (a TypeError
    * `frame.clearCookies: malformed filter`), an empty `scope.hosts`, and a string `domain` whose
-   * registered domain is none of the hosts' (each a LocatorDeniedError naming why). Rejects with the
-   * library's own message when the jar's store did not take the removal. Absent from a shell that
-   * predates it.
+   * registered domain is none of the hosts' (each a LocatorDeniedError naming why), and, on a jar
+   * sealed under the FKN account's key while this device does not hold the key, every filter (an
+   * Error `frame.clearCookies: this attachment's jar is sealed under the FKN account's key, which this
+   * device does not hold yet; unlock it and call it again`, from a shell from 2026-10 on). Rejects
+   * with the library's own message when the jar's store did not take the removal. Absent from a shell
+   * that predates it.
    */
   clearCookies?(filter: ClearCookiesWire, scope: {
     hosts: string[];
@@ -1098,6 +1128,16 @@ type Resolvers = {
     onUpdateTaken: (callback: () => void) => () => void;
     applyUpdate: () => Promise<boolean>;
   };
+  /** FKN internal: answers the render proxy's own origin only, every other caller gets `not-proxy`. */
+  proxyJar: {
+    /**
+     * The key of the cookie jar in the caller's storage partition. Refusals cross as data. `prompt`
+     * raises the key card, at most once per broker document, when the answer would be `locked`.
+     */
+    key: (options?: {
+      prompt?: boolean;
+    }) => Promise<ProxyJarAnswer>;
+  };
   proxyFetch: ProxyFetch;
   webVpnTcpSocket: (options: TcpSocketOptions) => Promise<TcpSocketResult>;
   webVpnTcpSocketListener: (options: TcpSocketListenerOptions) => Promise<TcpSocketListenerResult>;
@@ -1108,4 +1148,4 @@ type Resolvers = {
   hideInstallPrompt: () => void;
 };
 //#endregion
-export { RoomHandle as $, MiddleGotoOptions as A, WINDOW_HELLO_TIMEOUT_MS as At, ProxyFetch as B, FrameMessageRelay as C, TcpSocketListenerResult as Ct, IpFamily as D, UdpSocketOptions as Dt, InstalledPackage as E, UdpDatagram as Et, PackageResult as F, JarSeedCookie as Ft, Radii as G, ProxyFetchInput as H, PackagesErrorCode as I, RoomClaimOptions as J, Resolvers as K, PackagesFail as L, OverlayRect as M, WindowMiddleControl as Mt, OverlayState as N, WriteData as Nt, JAR_ANCHOR_MESSAGE as O, UdpSocketResult as Ot, PackageQuery as P, JarSeed as Pt, RoomEvent as Q, PickOptions as R, FrameFetchScope as S, TcpSocketListenerOptions as St, InstallOptions as T, TcpSocketResult as Tt, Quota as U, ProxyFetchInit as V, ROOM_TEMPORARY_MS as W, RoomDefaults as X, RoomCreateOptions as Y, RoomEnd as Z, DnsLookup as _, ShellGotoOptions as _t, AccountChange as a, RoomPermission as at, FrameConsentAnswer as b, StorageQuota as bt, AdoptRequest as c, RoomsFail as ct, ConflictRequest as d, SHELL_FRAME_MESSAGE as dt, RoomJoinOptions as et, ConflictSide as f, SHELL_JAR_MESSAGE as ft, DisplayLevel as g, ShellFrameMessage as gt, DisplayCause as h, ShellControl as ht, Account as i, RoomOpenOptions as it, MountDescriptor as j, WINDOW_JAR_MODE_TIMEOUT_MS as jt, MiddleControl as k, WINDOW_HANDSHAKE_TIMEOUT_MS as kt, AdoptState as l, SHELL_ATTACH_ERROR as lt, ConnectOptions as m, SetOverlayHost as mt, ATTACH_WINDOW_KEY as n, RoomMember as nt, AccountPinOptions as o, RoomPermissions as ot, ConnectAvailability as p, SHELL_JAR_UNREACHABLE as pt, RoomBacklog as q, ATTACH_WINDOW_MESSAGE as r, RoomMessage as rt, AddressLookupResult as s, RoomsErrorCode as st, ATTACH_FRAME_KEY as t, RoomMailbox as tt, ConflictChoice as u, SHELL_CONTROL_KEY as ut, EncryptionState as v, ShellJarUnreachable as vt, HiddenSurface as w, TcpSocketOptions as wt, FrameConsentRequest as x, SurfaceRect as xt, FRAME_MESSAGE as y, StorageEntry as yt, Placement as z };
+export { RoomCreateOptions as $, MiddleGotoOptions as A, UdpDatagram as At, Placement as B, FrameMessageRelay as C, StorageEntry as Ct, IpFamily as D, TcpSocketListenerResult as Dt, InstalledPackage as E, TcpSocketListenerOptions as Et, PackageQuery as F, WINDOW_JAR_MODE_TIMEOUT_MS as Ft, ProxyJarKey as G, ProxyFetchInit as H, PackageResult as I, WindowMiddleControl as It, ROOM_TEMPORARY_MS as J, ProxyJarRefusal as K, PackagesErrorCode as L, WriteData as Lt, OverlayRect as M, UdpSocketResult as Mt, OverlayState as N, WINDOW_HANDSHAKE_TIMEOUT_MS as Nt, JAR_ANCHOR_MESSAGE as O, TcpSocketOptions as Ot, PROXY_JAR_REFUSALS as P, WINDOW_HELLO_TIMEOUT_MS as Pt, RoomClaimOptions as Q, PackagesFail as R, JarSeed as Rt, FrameFetchScope as S, ShellJarUnreachable as St, InstallOptions as T, SurfaceRect as Tt, ProxyFetchInput as U, ProxyFetch as V, ProxyJarAnswer as W, Resolvers as X, Radii as Y, RoomBacklog as Z, DnsLookup as _, SHELL_JAR_UNREACHABLE as _t, AccountChange as a, RoomMailbox as at, FrameConsentAnswer as b, ShellFrameMessage as bt, AdoptRequest as c, RoomOpenOptions as ct, ConflictRequest as d, RoomsErrorCode as dt, RoomDefaults as et, ConflictSide as f, RoomsFail as ft, DisplayLevel as g, SHELL_JAR_MESSAGE as gt, DisplayCause as h, SHELL_FRAME_MESSAGE as ht, Account as i, RoomJoinOptions as it, MountDescriptor as j, UdpSocketOptions as jt, MiddleControl as k, TcpSocketResult as kt, AdoptState as l, RoomPermission as lt, ConnectOptions as m, SHELL_CONTROL_KEY as mt, ATTACH_WINDOW_KEY as n, RoomEvent as nt, AccountPinOptions as o, RoomMember as ot, ConnectAvailability as p, SHELL_ATTACH_ERROR as pt, Quota as q, ATTACH_WINDOW_MESSAGE as r, RoomHandle as rt, AddressLookupResult as s, RoomMessage as st, ATTACH_FRAME_KEY as t, RoomEnd as tt, ConflictChoice as u, RoomPermissions as ut, EncryptionState as v, SetOverlayHost as vt, HiddenSurface as w, StorageQuota as wt, FrameConsentRequest as x, ShellGotoOptions as xt, FRAME_MESSAGE as y, ShellControl as yt, PickOptions as z, JarSeedCookie as zt };

package/contract.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=`fkn-attach-frame`,t=`fkn-attach-window`,n=`sdbx-control`,r=`sdbx-attach-error`,i=`fkn-frame-message`,a=`sdbx-frame-message`,o={hello:`fkn-attach-window`,refused:`fkn-attach-window-refused`,gone:`fkn-attach-window-gone`,detach:`fkn-attach-window-detach`},s={request:`sdbx-jar-request`,port:`sdbx-jar-port`,mode:`sdbx-jar-mode`},c=[`bad-attach`,`no-storage`,`bad-jar`,`no-parent`,`no-jar-host`,`no-token`,`no-indexeddb`,`failed`],l={hello:`fkn-jar-hello`,ready:`fkn-jar-ready`,port:`fkn-jar-port`,who:`fkn-jar-who`,host:`fkn-jar-host`},u=2e4,d=3e4,f=6e4,p={default:6048e5,min:6e4,max:31536e6};exports.ATTACH_FRAME_KEY=e,exports.ATTACH_WINDOW_KEY=t,exports.ATTACH_WINDOW_MESSAGE=o,exports.FRAME_MESSAGE=i,exports.JAR_ANCHOR_MESSAGE=l,exports.ROOM_TEMPORARY_MS=p,exports.SHELL_ATTACH_ERROR=r,exports.SHELL_CONTROL_KEY=n,exports.SHELL_FRAME_MESSAGE=a,exports.SHELL_JAR_MESSAGE=s,exports.SHELL_JAR_UNREACHABLE=c,exports.WINDOW_HANDSHAKE_TIMEOUT_MS=f,exports.WINDOW_HELLO_TIMEOUT_MS=u,exports.WINDOW_JAR_MODE_TIMEOUT_MS=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=`fkn-attach-frame`,t=`fkn-attach-window`,n=`sdbx-control`,r=`sdbx-attach-error`,i=`fkn-frame-message`,a=`sdbx-frame-message`,o={hello:`fkn-attach-window`,refused:`fkn-attach-window-refused`,gone:`fkn-attach-window-gone`,detach:`fkn-attach-window-detach`},s={request:`sdbx-jar-request`,port:`sdbx-jar-port`,mode:`sdbx-jar-mode`},c=[`bad-attach`,`no-storage`,`bad-jar`,`no-parent`,`no-jar-host`,`no-token`,`no-indexeddb`,`failed`],l=[`not-proxy`,`signed-out`,`not-enrolled`,`locked`,`unconfirmed`],u={hello:`fkn-jar-hello`,ready:`fkn-jar-ready`,port:`fkn-jar-port`,who:`fkn-jar-who`,host:`fkn-jar-host`},d=2e4,f=3e4,p=6e4,m={default:6048e5,min:6e4,max:31536e6};exports.ATTACH_FRAME_KEY=e,exports.ATTACH_WINDOW_KEY=t,exports.ATTACH_WINDOW_MESSAGE=o,exports.FRAME_MESSAGE=i,exports.JAR_ANCHOR_MESSAGE=u,exports.PROXY_JAR_REFUSALS=l,exports.ROOM_TEMPORARY_MS=m,exports.SHELL_ATTACH_ERROR=r,exports.SHELL_CONTROL_KEY=n,exports.SHELL_FRAME_MESSAGE=a,exports.SHELL_JAR_MESSAGE=s,exports.SHELL_JAR_UNREACHABLE=c,exports.WINDOW_HANDSHAKE_TIMEOUT_MS=p,exports.WINDOW_HELLO_TIMEOUT_MS=d,exports.WINDOW_JAR_MODE_TIMEOUT_MS=f;

package/contract.d.ts

@@ -1,4 +1,4 @@
-import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-BOInGaEl.js";
-import { $ as RoomHandle, A as MiddleGotoOptions, At as WINDOW_HELLO_TIMEOUT_MS, B as ProxyFetch, C as FrameMessageRelay, Ct as TcpSocketListenerResult, D as IpFamily, Dt as UdpSocketOptions, E as InstalledPackage, Et as UdpDatagram, F as PackageResult, Ft as JarSeedCookie, G as Radii, H as ProxyFetchInput, I as PackagesErrorCode, J as RoomClaimOptions, K as Resolvers, L as PackagesFail, M as OverlayRect, Mt as WindowMiddleControl, N as OverlayState, Nt as WriteData, O as JAR_ANCHOR_MESSAGE, Ot as UdpSocketResult, P as PackageQuery, Pt as JarSeed, Q as RoomEvent, R as PickOptions, S as FrameFetchScope, St as TcpSocketListenerOptions, T as InstallOptions, Tt as TcpSocketResult, U as Quota, V as ProxyFetchInit, W as ROOM_TEMPORARY_MS, X as RoomDefaults, Y as RoomCreateOptions, Z as RoomEnd, _ as DnsLookup, _t as ShellGotoOptions, a as AccountChange, at as RoomPermission, b as FrameConsentAnswer, bt as StorageQuota, c as AdoptRequest, ct as RoomsFail, d as ConflictRequest, dt as SHELL_FRAME_MESSAGE, et as RoomJoinOptions, f as ConflictSide, ft as SHELL_JAR_MESSAGE, g as DisplayLevel, gt as ShellFrameMessage, h as DisplayCause, ht as ShellControl, i as Account, it as RoomOpenOptions, j as MountDescriptor, jt as WINDOW_JAR_MODE_TIMEOUT_MS, k as MiddleControl, kt as WINDOW_HANDSHAKE_TIMEOUT_MS, l as AdoptState, lt as SHELL_ATTACH_ERROR, m as ConnectOptions, mt as SetOverlayHost, n as ATTACH_WINDOW_KEY, nt as RoomMember, o as AccountPinOptions, ot as RoomPermissions, p as ConnectAvailability, pt as SHELL_JAR_UNREACHABLE, q as RoomBacklog, r as ATTACH_WINDOW_MESSAGE, rt as RoomMessage, s as AddressLookupResult, st as RoomsErrorCode, t as ATTACH_FRAME_KEY, tt as RoomMailbox, u as ConflictChoice, ut as SHELL_CONTROL_KEY, v as EncryptionState, vt as ShellJarUnreachable, w as HiddenSurface, wt as TcpSocketOptions, x as FrameConsentRequest, xt as SurfaceRect, y as FRAME_MESSAGE, yt as StorageEntry, z as Placement } from "./contract-6Xfd_qel.js";
+import { d as CookieMatchWire, u as ClearCookiesWire } from "./index-B98wvTaI.js";
+import { $ as RoomCreateOptions, A as MiddleGotoOptions, At as UdpDatagram, B as Placement, C as FrameMessageRelay, Ct as StorageEntry, D as IpFamily, Dt as TcpSocketListenerResult, E as InstalledPackage, Et as TcpSocketListenerOptions, F as PackageQuery, Ft as WINDOW_JAR_MODE_TIMEOUT_MS, G as ProxyJarKey, H as ProxyFetchInit, I as PackageResult, It as WindowMiddleControl, J as ROOM_TEMPORARY_MS, K as ProxyJarRefusal, L as PackagesErrorCode, Lt as WriteData, M as OverlayRect, Mt as UdpSocketResult, N as OverlayState, Nt as WINDOW_HANDSHAKE_TIMEOUT_MS, O as JAR_ANCHOR_MESSAGE, Ot as TcpSocketOptions, P as PROXY_JAR_REFUSALS, Pt as WINDOW_HELLO_TIMEOUT_MS, Q as RoomClaimOptions, R as PackagesFail, Rt as JarSeed, S as FrameFetchScope, St as ShellJarUnreachable, T as InstallOptions, Tt as SurfaceRect, U as ProxyFetchInput, V as ProxyFetch, W as ProxyJarAnswer, X as Resolvers, Y as Radii, Z as RoomBacklog, _ as DnsLookup, _t as SHELL_JAR_UNREACHABLE, a as AccountChange, at as RoomMailbox, b as FrameConsentAnswer, bt as ShellFrameMessage, c as AdoptRequest, ct as RoomOpenOptions, d as ConflictRequest, dt as RoomsErrorCode, et as RoomDefaults, f as ConflictSide, ft as RoomsFail, g as DisplayLevel, gt as SHELL_JAR_MESSAGE, h as DisplayCause, ht as SHELL_FRAME_MESSAGE, i as Account, it as RoomJoinOptions, j as MountDescriptor, jt as UdpSocketOptions, k as MiddleControl, kt as TcpSocketResult, l as AdoptState, lt as RoomPermission, m as ConnectOptions, mt as SHELL_CONTROL_KEY, n as ATTACH_WINDOW_KEY, nt as RoomEvent, o as AccountPinOptions, ot as RoomMember, p as ConnectAvailability, pt as SHELL_ATTACH_ERROR, q as Quota, r as ATTACH_WINDOW_MESSAGE, rt as RoomHandle, s as AddressLookupResult, st as RoomMessage, t as ATTACH_FRAME_KEY, tt as RoomEnd, u as ConflictChoice, ut as RoomPermissions, v as EncryptionState, vt as SetOverlayHost, w as HiddenSurface, wt as StorageQuota, x as FrameConsentRequest, xt as ShellGotoOptions, y as FRAME_MESSAGE, yt as ShellControl, z as PickOptions, zt as JarSeedCookie } from "./contract-BmLpSueo.js";
 import { o as TcpSocketOption, v as UdpSocketOption } from "./wire-BwA4JjZH.js";
-export { ATTACH_FRAME_KEY, ATTACH_WINDOW_KEY, ATTACH_WINDOW_MESSAGE, Account, AccountChange, AccountPinOptions, AddressLookupResult, AdoptRequest, AdoptState, type ClearCookiesWire, ConflictChoice, ConflictRequest, ConflictSide, ConnectAvailability, ConnectOptions, type CookieMatchWire, DisplayCause, DisplayLevel, DnsLookup, EncryptionState, FRAME_MESSAGE, FrameConsentAnswer, FrameConsentRequest, FrameFetchScope, FrameMessageRelay, HiddenSurface, InstallOptions, InstalledPackage, IpFamily, JAR_ANCHOR_MESSAGE, type JarSeed, type JarSeedCookie, MiddleControl, MiddleGotoOptions, MountDescriptor, OverlayRect, OverlayState, PackageQuery, PackageResult, PackagesErrorCode, PackagesFail, PickOptions, Placement, ProxyFetch, ProxyFetchInit, ProxyFetchInput, Quota, ROOM_TEMPORARY_MS, Radii, Resolvers, RoomBacklog, RoomClaimOptions, RoomCreateOptions, RoomDefaults, RoomEnd, RoomEvent, RoomHandle, RoomJoinOptions, RoomMailbox, RoomMember, RoomMessage, RoomOpenOptions, RoomPermission, RoomPermissions, RoomsErrorCode, RoomsFail, SHELL_ATTACH_ERROR, SHELL_CONTROL_KEY, SHELL_FRAME_MESSAGE, SHELL_JAR_MESSAGE, SHELL_JAR_UNREACHABLE, SetOverlayHost, ShellControl, ShellFrameMessage, ShellGotoOptions, ShellJarUnreachable, StorageEntry, StorageQuota, SurfaceRect, TcpSocketListenerOptions, TcpSocketListenerResult, type TcpSocketOption, TcpSocketOptions, TcpSocketResult, UdpDatagram, type UdpSocketOption, UdpSocketOptions, UdpSocketResult, WINDOW_HANDSHAKE_TIMEOUT_MS, WINDOW_HELLO_TIMEOUT_MS, WINDOW_JAR_MODE_TIMEOUT_MS, WindowMiddleControl, WriteData };
+export { ATTACH_FRAME_KEY, ATTACH_WINDOW_KEY, ATTACH_WINDOW_MESSAGE, Account, AccountChange, AccountPinOptions, AddressLookupResult, AdoptRequest, AdoptState, type ClearCookiesWire, ConflictChoice, ConflictRequest, ConflictSide, ConnectAvailability, ConnectOptions, type CookieMatchWire, DisplayCause, DisplayLevel, DnsLookup, EncryptionState, FRAME_MESSAGE, FrameConsentAnswer, FrameConsentRequest, FrameFetchScope, FrameMessageRelay, HiddenSurface, InstallOptions, InstalledPackage, IpFamily, JAR_ANCHOR_MESSAGE, type JarSeed, type JarSeedCookie, MiddleControl, MiddleGotoOptions, MountDescriptor, OverlayRect, OverlayState, PROXY_JAR_REFUSALS, PackageQuery, PackageResult, PackagesErrorCode, PackagesFail, PickOptions, Placement, ProxyFetch, ProxyFetchInit, ProxyFetchInput, ProxyJarAnswer, ProxyJarKey, ProxyJarRefusal, Quota, ROOM_TEMPORARY_MS, Radii, Resolvers, RoomBacklog, RoomClaimOptions, RoomCreateOptions, RoomDefaults, RoomEnd, RoomEvent, RoomHandle, RoomJoinOptions, RoomMailbox, RoomMember, RoomMessage, RoomOpenOptions, RoomPermission, RoomPermissions, RoomsErrorCode, RoomsFail, SHELL_ATTACH_ERROR, SHELL_CONTROL_KEY, SHELL_FRAME_MESSAGE, SHELL_JAR_MESSAGE, SHELL_JAR_UNREACHABLE, SetOverlayHost, ShellControl, ShellFrameMessage, ShellGotoOptions, ShellJarUnreachable, StorageEntry, StorageQuota, SurfaceRect, TcpSocketListenerOptions, TcpSocketListenerResult, type TcpSocketOption, TcpSocketOptions, TcpSocketResult, UdpDatagram, type UdpSocketOption, UdpSocketOptions, UdpSocketResult, WINDOW_HANDSHAKE_TIMEOUT_MS, WINDOW_HELLO_TIMEOUT_MS, WINDOW_JAR_MODE_TIMEOUT_MS, WindowMiddleControl, WriteData };

package/contract.js

@@ -17,16 +17,22 @@ var e = "fkn-attach-frame", t = "fkn-attach-window", n = "sdbx-control", r = "sd
 	"no-token",
 	"no-indexeddb",
 	"failed"
-], l = {
+], l = [
+	"not-proxy",
+	"signed-out",
+	"not-enrolled",
+	"locked",
+	"unconfirmed"
+], u = {
 	hello: "fkn-jar-hello",
 	ready: "fkn-jar-ready",
 	port: "fkn-jar-port",
 	who: "fkn-jar-who",
 	host: "fkn-jar-host"
-}, u = 2e4, d = 3e4, f = 6e4, p = {
+}, d = 2e4, f = 3e4, p = 6e4, m = {
 	default: 6048e5,
 	min: 6e4,
 	max: 31536e6
 };
 //#endregion
-export { e as ATTACH_FRAME_KEY, t as ATTACH_WINDOW_KEY, o as ATTACH_WINDOW_MESSAGE, i as FRAME_MESSAGE, l as JAR_ANCHOR_MESSAGE, p as ROOM_TEMPORARY_MS, r as SHELL_ATTACH_ERROR, n as SHELL_CONTROL_KEY, a as SHELL_FRAME_MESSAGE, s as SHELL_JAR_MESSAGE, c as SHELL_JAR_UNREACHABLE, f as WINDOW_HANDSHAKE_TIMEOUT_MS, u as WINDOW_HELLO_TIMEOUT_MS, d as WINDOW_JAR_MODE_TIMEOUT_MS };
+export { e as ATTACH_FRAME_KEY, t as ATTACH_WINDOW_KEY, o as ATTACH_WINDOW_MESSAGE, i as FRAME_MESSAGE, u as JAR_ANCHOR_MESSAGE, l as PROXY_JAR_REFUSALS, m as ROOM_TEMPORARY_MS, r as SHELL_ATTACH_ERROR, n as SHELL_CONTROL_KEY, a as SHELL_FRAME_MESSAGE, s as SHELL_JAR_MESSAGE, c as SHELL_JAR_UNREACHABLE, p as WINDOW_HANDSHAKE_TIMEOUT_MS, d as WINDOW_HELLO_TIMEOUT_MS, f as WINDOW_JAR_MODE_TIMEOUT_MS };

package/dgram.d.ts

@@ -1,6 +1,6 @@
-import { K as Resolvers, Ot as UdpSocketResult } from "./contract-6Xfd_qel.js";
+import { Mt as UdpSocketResult, X as Resolvers } from "./contract-BmLpSueo.js";
 import { v as UdpSocketOption } from "./wire-BwA4JjZH.js";
-import "./api-CFkZVr53.js";
+import "./api-DOXb_WrB.js";
 import { Buffer } from "buffer";
 import { AddressInfo } from "net";
 import { EventEmitter } from "events";

package/dns.d.ts

@@ -1,4 +1,4 @@
-import { s as AddressLookupResult } from "./contract-6Xfd_qel.js";
+import { s as AddressLookupResult } from "./contract-BmLpSueo.js";
 declare namespace dns_d_exports {
   export { AddressLookupResult, lookup };
 }

package/{extension-DvFf7uoG.cjs → extension-3bxlAW8M.cjs}

@@ -1 +1 @@
-const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-fqQfEPk6.cjs"),n=require("./api--LOXTOpv.cjs"),r=require("./proxy-CFK-KiwE.cjs"),i=require("./desktop.cjs");var a=`BackgroundStoppedError`,o=e=>t.d(e)&&e.name===`BackgroundStoppedError`,s=async e=>{if(typeof window>`u`)return!1;if(t.et())return!0;let r=await n.o,i=null,a=new Promise(e=>{i=()=>{t.et()&&e(!0)},t.$.addEventListener(`statuschange`,i)}),o=r.installPrompt.show(e).then(()=>!1),s=await Promise.race([a,o]);return i&&t.$.removeEventListener(`statuschange`,i),await r.installPrompt.hide().catch(()=>{}),s},c=null;t.nt(()=>(c||=s().then(()=>void 0).finally(()=>{c=null}),c));var l=()=>typeof document<`u`&&t.et(),u=async(e,a)=>{if(n.p(e),a?.credentials===`include`){if(typeof document>`u`)throw Error(`fetch with credentials needs the FKN extension, which only exists in window realms`);return t.U(e,a)}return l()?t.U(e,{...a,credentials:`omit`}):i.available()?i.fetch(e,a):r.t(e,a)},d=e.t({ATTACH_FRAME_EVENT_KEY:()=>t.i,BACKGROUND_STOPPED:()=>a,CATEGORIES:()=>t.w,EXTENSION_ABI:()=>4,ExtensionOperationUnsupportedError:()=>t.at,ExtensionOutdatedError:()=>t.ot,FORGEABLE_HEADERS:()=>t.Y,FrameWindowBlockedError:()=>t.g,FrameWindowRefusedError:()=>t._,LOCATOR_DENIED:()=>t.k,LOCATOR_ERROR:()=>t.P,LOCATOR_INVALID:()=>t.I,LOCATOR_UNSUPPORTED:()=>t.E,PERMISSION_DENIED:()=>t.t,REQUIRED_EXTENSION_ABI:()=>0,TimeoutError:()=>t.T,assertAttachableFrameUrl:()=>t.x,assertFetchableUrl:()=>t.H,assertForgeableHeaders:()=>t.X,assertLockdownApplicable:()=>t.S,assertOneCookieIdentity:()=>t.Z,attachFrame:()=>t.a,attachFramePermission:()=>t.v,available:()=>l,box:()=>t.ut,cookies:()=>t.B,createFrame:()=>t.y,createVideoElementHandle:()=>t.dt,events:()=>t.$,extension:()=>t.$,fetch:()=>t.U,fetchCredentialedPermission:()=>t.W,fetchLocalPermission:()=>t.G,fetchPermission:()=>t.K,gotoPermission:()=>t.b,handleRevivableModules:()=>t.lt,hasForgedCookie:()=>t.Q,isBackgroundStopped:()=>o,isBlockedFetchUrl:()=>t.q,isBlockedFrameUrl:()=>t.C,isExtensionExposed:()=>t.et,isLocalNetworkUrl:()=>t.J,isLocatorDenied:()=>t.F,isLocatorInvalid:()=>t.j,isLocatorUnsupported:()=>t.D,isPermissionDenied:()=>t.n,isTerminalError:()=>t.N,isType:()=>t.ft,modifyRequestHeadersPermission:()=>t.L,permissions:()=>t.r,promptInstall:()=>s,readCookiePermission:()=>t.V,readExtensionHandshake:()=>t.tt,removeRequestHeaderRule:()=>t.R,revive:()=>t.pt,setMissingExtensionHandler:()=>t.nt,setRequestHeaderRule:()=>t.z,supportsOperation:()=>t.ct,type:()=>t.mt,waitForExtensionExposure:()=>t.rt});Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return a}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return o}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return d}});
+const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-47LPHYgB.cjs"),n=require("./api--LOXTOpv.cjs"),r=require("./proxy-CFK-KiwE.cjs"),i=require("./desktop.cjs");var a=`BackgroundStoppedError`,o=e=>t.d(e)&&e.name===`BackgroundStoppedError`,s=async e=>{if(typeof window>`u`)return!1;if(t.et())return!0;let r=await n.o,i=null,a=new Promise(e=>{i=()=>{t.et()&&e(!0)},t.$.addEventListener(`statuschange`,i)}),o=r.installPrompt.show(e).then(()=>!1),s=await Promise.race([a,o]);return i&&t.$.removeEventListener(`statuschange`,i),await r.installPrompt.hide().catch(()=>{}),s},c=null;t.nt(()=>(c||=s().then(()=>void 0).finally(()=>{c=null}),c));var l=()=>typeof document<`u`&&t.et(),u=async(e,a)=>{if(n.p(e),a?.credentials===`include`){if(typeof document>`u`)throw Error(`fetch with credentials needs the FKN extension, which only exists in window realms`);return t.U(e,a)}return l()?t.U(e,{...a,credentials:`omit`}):i.available()?i.fetch(e,a):r.t(e,a)},d=e.t({ATTACH_FRAME_EVENT_KEY:()=>t.i,BACKGROUND_STOPPED:()=>a,CATEGORIES:()=>t.w,EXTENSION_ABI:()=>4,ExtensionOperationUnsupportedError:()=>t.at,ExtensionOutdatedError:()=>t.ot,FORGEABLE_HEADERS:()=>t.Y,FrameWindowBlockedError:()=>t.g,FrameWindowRefusedError:()=>t._,LOCATOR_DENIED:()=>t.k,LOCATOR_ERROR:()=>t.P,LOCATOR_INVALID:()=>t.I,LOCATOR_UNSUPPORTED:()=>t.E,PERMISSION_DENIED:()=>t.t,REQUIRED_EXTENSION_ABI:()=>0,TimeoutError:()=>t.T,assertAttachableFrameUrl:()=>t.x,assertFetchableUrl:()=>t.H,assertForgeableHeaders:()=>t.X,assertLockdownApplicable:()=>t.S,assertOneCookieIdentity:()=>t.Z,attachFrame:()=>t.a,attachFramePermission:()=>t.v,available:()=>l,box:()=>t.ut,cookies:()=>t.B,createFrame:()=>t.y,createVideoElementHandle:()=>t.dt,events:()=>t.$,extension:()=>t.$,fetch:()=>t.U,fetchCredentialedPermission:()=>t.W,fetchLocalPermission:()=>t.G,fetchPermission:()=>t.K,gotoPermission:()=>t.b,handleRevivableModules:()=>t.lt,hasForgedCookie:()=>t.Q,isBackgroundStopped:()=>o,isBlockedFetchUrl:()=>t.q,isBlockedFrameUrl:()=>t.C,isExtensionExposed:()=>t.et,isLocalNetworkUrl:()=>t.J,isLocatorDenied:()=>t.F,isLocatorInvalid:()=>t.j,isLocatorUnsupported:()=>t.D,isPermissionDenied:()=>t.n,isTerminalError:()=>t.N,isType:()=>t.ft,modifyRequestHeadersPermission:()=>t.L,permissions:()=>t.r,promptInstall:()=>s,readCookiePermission:()=>t.V,readExtensionHandshake:()=>t.tt,removeRequestHeaderRule:()=>t.R,revive:()=>t.pt,setMissingExtensionHandler:()=>t.nt,setRequestHeaderRule:()=>t.z,supportsOperation:()=>t.ct,type:()=>t.mt,waitForExtensionExposure:()=>t.rt});Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return a}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return o}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return d}});

package/{extension-CzZn0bY2.js → extension-BnVG0YL4.js}

@@ -1,5 +1,5 @@
 import { t as e } from "./rolldown-runtime-Dy4uBu1J.js";
-import { $ as t, B as n, C as r, D as i, E as a, F as o, G as ee, H as te, I as ne, J as s, K as c, L as l, N as u, P as d, Q as re, R as ie, S as f, T as p, U as m, V as h, W as g, X as _, Y as v, Z as y, _ as b, a as x, at as S, b as C, ct as w, d as T, dt as E, et as D, ft as O, g as k, i as A, j, k as M, lt as N, mt as P, n as ae, nt as F, ot as I, pt as L, q as R, r as z, rt as B, t as V, tt as H, ut as U, v as W, w as G, x as K, y as q, z as J } from "./lib-C3UwxjVs.js";
+import { $ as t, B as n, C as r, D as i, E as a, F as o, G as ee, H as te, I as ne, J as s, K as c, L as l, N as u, P as d, Q as re, R as ie, S as f, T as p, U as m, V as h, W as g, X as _, Y as v, Z as y, _ as b, a as x, at as S, b as C, ct as w, d as T, dt as E, et as D, ft as O, g as k, i as A, j, k as M, lt as N, mt as P, n as ae, nt as F, ot as I, pt as L, q as R, r as z, rt as B, t as V, tt as H, ut as U, v as W, w as G, x as K, y as q, z as J } from "./lib-BFwrzgpu.js";
 import { o as oe, p as se } from "./api-DIgTslNb.js";
 import { t as ce } from "./proxy-Dixbk1WL.js";
 import { available as le, fetch as ue } from "./desktop.js";

package/{extension-BlEtNAYc.d.ts → extension-C2tBRE9i.d.ts}

@@ -1,4 +1,4 @@
-import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-BOInGaEl.js";
+import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-B98wvTaI.js";
 //#region ../frame-locator/lib/errors.d.ts
 declare const LOCATOR_ERROR = "LocatorError";
 declare const LOCATOR_UNSUPPORTED = "LocatorUnsupportedError";
@@ -77,6 +77,15 @@ type FetchInit = RequestInit & {
 };
 declare const isBlockedFetchUrl: (raw: string) => boolean;
 declare const assertFetchableUrl: (raw: string) => void;
+/**
+ * Fetches through the extension. A credentialed fetch (`credentials: 'include'`) and one to the local
+ * network are asked for on the target's host first. A url on the extension's own pages or an FKN
+ * platform host is refused with an Error before anything is asked. A redirect onto an FKN platform
+ * host is not followed: on Chromium the hop is blocked before it is sent and the fetch rejects as on a
+ * network error; where the browser does not apply that block, the answer is withheld with an Error. A
+ * fetch that follows redirects is refused before it is sent when the extension could not set the
+ * block up.
+ */
 declare const fetch$1: (input: RequestInfo | URL, init?: FetchInit) => Promise<Response>;
 //#endregion
 //#region ../web-extension/lib/lib/cookies.d.ts
@@ -98,6 +107,11 @@ type SiteCookie = {
   value: string;
 };
 declare const cookies: {
+  /**
+   * Reads one named cookie of another site behind a Network ask on its host, `null` when there is
+   * none. A url on an FKN platform host (`fkn.app`, `fkn.dev`, `sdbx.app` and their subdomains) is
+   * refused with an Error before anything is asked, and again by the extension.
+   */
   get: (details: CookieDetails) => Promise<SiteCookie | null>;
 };
 //#endregion
@@ -121,7 +135,11 @@ type RequestHeaderRule = {
   requestHeaders: HeaderOperation[];
   reason?: string;
 };
-/** Tab-scoped: the rule is dropped when the tab goes away. */
+/**
+ * Tab-scoped: the rule is dropped when the tab goes away. A domain the rule would carry onto an FKN
+ * platform host (one of them, one under one, or a parent such as `app`, since a rule also matches every
+ * host under each domain) is refused with an Error before anything is asked, and again by the extension.
+ */
 declare const setRequestHeaderRule: (rule: RequestHeaderRule) => Promise<{
   ruleId: number;
 }>;

package/extension.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./lib-fqQfEPk6.cjs"),t=require("./extension-DvFf7uoG.cjs");exports.ATTACH_FRAME_EVENT_KEY=e.i,exports.BACKGROUND_STOPPED=t.a,exports.CATEGORIES=e.w,exports.EXTENSION_ABI=e.it,exports.ExtensionOperationUnsupportedError=e.at,exports.ExtensionOutdatedError=e.ot,exports.FORGEABLE_HEADERS=e.Y,exports.FrameWindowBlockedError=e.g,exports.FrameWindowRefusedError=e._,exports.LOCATOR_DENIED=e.k,exports.LOCATOR_ERROR=e.P,exports.LOCATOR_INVALID=e.I,exports.LOCATOR_UNSUPPORTED=e.E,exports.PERMISSION_DENIED=e.t,exports.REQUIRED_EXTENSION_ABI=e.st,exports.TimeoutError=e.T,exports.assertAttachableFrameUrl=e.x,exports.assertFetchableUrl=e.H,exports.assertForgeableHeaders=e.X,exports.assertLockdownApplicable=e.S,exports.assertOneCookieIdentity=e.Z,exports.attachFrame=e.a,exports.attachFramePermission=e.v,exports.available=t.r,exports.box=e.ut,exports.cookies=e.B,exports.createFrame=e.y,exports.createVideoElementHandle=e.dt,exports.events=e.$,exports.extension=e.$,exports.fetch=e.U,exports.fetchCredentialedPermission=e.W,exports.fetchLocalPermission=e.G,exports.fetchPermission=e.K,exports.gotoPermission=e.b,exports.handleRevivableModules=e.lt,exports.hasForgedCookie=e.Q,exports.isBackgroundStopped=t.o,exports.isBlockedFetchUrl=e.q,exports.isBlockedFrameUrl=e.C,exports.isExtensionExposed=e.et,exports.isLocalNetworkUrl=e.J,exports.isLocatorDenied=e.F,exports.isLocatorInvalid=e.j,exports.isLocatorUnsupported=e.D,exports.isPermissionDenied=e.n,exports.isTerminalError=e.N,exports.isType=e.ft,exports.modifyRequestHeadersPermission=e.L,exports.permissions=e.r,exports.promptInstall=t.i,exports.readCookiePermission=e.V,exports.readExtensionHandshake=e.tt,exports.removeRequestHeaderRule=e.R,exports.revive=e.pt,exports.setMissingExtensionHandler=e.nt,exports.setRequestHeaderRule=e.z,exports.supportsOperation=e.ct,exports.type=e.mt,exports.waitForExtensionExposure=e.rt;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./lib-47LPHYgB.cjs"),t=require("./extension-3bxlAW8M.cjs");exports.ATTACH_FRAME_EVENT_KEY=e.i,exports.BACKGROUND_STOPPED=t.a,exports.CATEGORIES=e.w,exports.EXTENSION_ABI=e.it,exports.ExtensionOperationUnsupportedError=e.at,exports.ExtensionOutdatedError=e.ot,exports.FORGEABLE_HEADERS=e.Y,exports.FrameWindowBlockedError=e.g,exports.FrameWindowRefusedError=e._,exports.LOCATOR_DENIED=e.k,exports.LOCATOR_ERROR=e.P,exports.LOCATOR_INVALID=e.I,exports.LOCATOR_UNSUPPORTED=e.E,exports.PERMISSION_DENIED=e.t,exports.REQUIRED_EXTENSION_ABI=e.st,exports.TimeoutError=e.T,exports.assertAttachableFrameUrl=e.x,exports.assertFetchableUrl=e.H,exports.assertForgeableHeaders=e.X,exports.assertLockdownApplicable=e.S,exports.assertOneCookieIdentity=e.Z,exports.attachFrame=e.a,exports.attachFramePermission=e.v,exports.available=t.r,exports.box=e.ut,exports.cookies=e.B,exports.createFrame=e.y,exports.createVideoElementHandle=e.dt,exports.events=e.$,exports.extension=e.$,exports.fetch=e.U,exports.fetchCredentialedPermission=e.W,exports.fetchLocalPermission=e.G,exports.fetchPermission=e.K,exports.gotoPermission=e.b,exports.handleRevivableModules=e.lt,exports.hasForgedCookie=e.Q,exports.isBackgroundStopped=t.o,exports.isBlockedFetchUrl=e.q,exports.isBlockedFrameUrl=e.C,exports.isExtensionExposed=e.et,exports.isLocalNetworkUrl=e.J,exports.isLocatorDenied=e.F,exports.isLocatorInvalid=e.j,exports.isLocatorUnsupported=e.D,exports.isPermissionDenied=e.n,exports.isTerminalError=e.N,exports.isType=e.ft,exports.modifyRequestHeadersPermission=e.L,exports.permissions=e.r,exports.promptInstall=t.i,exports.readCookiePermission=e.V,exports.readExtensionHandshake=e.tt,exports.removeRequestHeaderRule=e.R,exports.revive=e.pt,exports.setMissingExtensionHandler=e.nt,exports.setRequestHeaderRule=e.z,exports.supportsOperation=e.ct,exports.type=e.mt,exports.waitForExtensionExposure=e.rt;

package/extension.d.ts

@@ -1,3 +1,3 @@
-import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-BOInGaEl.js";
-import { $ as isLocatorInvalid, A as CookieDetails, B as fetchPermission, C as assertLockdownApplicable, D as modifyRequestHeadersPermission, E as RequestHeaderRule, F as ProxyFetchRequest, G as assertOneCookieIdentity, H as isLocalNetworkUrl, I as assertFetchableUrl, J as LOCATOR_ERROR, K as hasForgedCookie, L as fetch, M as cookies, N as readCookiePermission, O as removeRequestHeaderRule, P as FetchInit, Q as isLocatorDenied, R as fetchCredentialedPermission, S as assertAttachableFrameUrl, T as HeaderOperation, U as FORGEABLE_HEADERS, V as isBlockedFetchUrl, W as assertForgeableHeaders, X as LOCATOR_UNSUPPORTED, Y as LOCATOR_INVALID, Z as TimeoutError, _ as BackgroundStoppedError, a as extension, b as PermissionDeniedError, c as setMissingExtensionHandler, d as ExtensionHandshake, et as isLocatorUnsupported, f as ExtensionOperationUnsupportedError, g as BACKGROUND_STOPPED, h as supportsOperation, i as promptInstall, j as SiteCookie, k as setRequestHeaderRule, l as waitForExtensionExposure, m as REQUIRED_EXTENSION_ABI, o as isExtensionExposed, p as ExtensionOutdatedError, q as LOCATOR_DENIED, r as isExtensionAvailable, s as readExtensionHandshake, tt as isTerminalError, u as EXTENSION_ABI, v as isBackgroundStopped, w as isBlockedFrameUrl, x as isPermissionDenied, y as PERMISSION_DENIED, z as fetchLocalPermission } from "./extension-BlEtNAYc.js";
+import { $ as GateTools, A as attachFramePermission, B as CategoryMeta, C as FrameWindowRefusal, D as StorageState, E as Locator, F as LegacyPermissionRequest, G as VideoElementState, H as handleRevivableModules, I as PermissionGrant, J as isType, K as box, L as PermissionRequest, M as gotoPermission, N as CategoryGrant, O as StorageStateCookie, P as CategoryRequest, Q as Gate, R as permissions, S as FrameWindowOptions, T as GotoOptions, U as BoxedVideoElement, V as PermissionCategory, W as RemoteVideoElement, X as type, Y as revive, Z as Executor, _ as FrameEventMap, a as AttachCookies, b as FramePostMessageOptions, c as BlankPage, d as CookieMatchWire, et as OperationRequest, f as Frame, g as FrameEventListener, h as FrameDocumentEvent, i as AddScriptTagOptions, j as createFrame, k as WindowFrame, l as ClearCookiesOptions, m as FrameBackendEvent, n as attachFrame, o as AttachFrameOptions, p as FrameBackend, q as createVideoElementHandle, s as AttachWindowOptions, t as ATTACH_FRAME_EVENT_KEY, tt as SelectorPart, u as ClearCookiesWire, v as FrameLocator, w as FrameWindowRefusedError, x as FrameWindowBlockedError, y as FrameMessageEvent, z as CATEGORIES } from "./index-B98wvTaI.js";
+import { $ as isLocatorInvalid, A as CookieDetails, B as fetchPermission, C as assertLockdownApplicable, D as modifyRequestHeadersPermission, E as RequestHeaderRule, F as ProxyFetchRequest, G as assertOneCookieIdentity, H as isLocalNetworkUrl, I as assertFetchableUrl, J as LOCATOR_ERROR, K as hasForgedCookie, L as fetch, M as cookies, N as readCookiePermission, O as removeRequestHeaderRule, P as FetchInit, Q as isLocatorDenied, R as fetchCredentialedPermission, S as assertAttachableFrameUrl, T as HeaderOperation, U as FORGEABLE_HEADERS, V as isBlockedFetchUrl, W as assertForgeableHeaders, X as LOCATOR_UNSUPPORTED, Y as LOCATOR_INVALID, Z as TimeoutError, _ as BackgroundStoppedError, a as extension, b as PermissionDeniedError, c as setMissingExtensionHandler, d as ExtensionHandshake, et as isLocatorUnsupported, f as ExtensionOperationUnsupportedError, g as BACKGROUND_STOPPED, h as supportsOperation, i as promptInstall, j as SiteCookie, k as setRequestHeaderRule, l as waitForExtensionExposure, m as REQUIRED_EXTENSION_ABI, o as isExtensionExposed, p as ExtensionOutdatedError, q as LOCATOR_DENIED, r as isExtensionAvailable, s as readExtensionHandshake, tt as isTerminalError, u as EXTENSION_ABI, v as isBackgroundStopped, w as isBlockedFrameUrl, x as isPermissionDenied, y as PERMISSION_DENIED, z as fetchLocalPermission } from "./extension-C2tBRE9i.js";
 export { ATTACH_FRAME_EVENT_KEY, AddScriptTagOptions, AttachCookies, AttachFrameOptions, AttachWindowOptions, BACKGROUND_STOPPED, type BackgroundStoppedError, BlankPage, BoxedVideoElement, CATEGORIES, CategoryGrant, type CategoryMeta, CategoryRequest, ClearCookiesOptions, ClearCookiesWire, CookieDetails, CookieMatchWire, EXTENSION_ABI, type Executor, type ExtensionHandshake, ExtensionOperationUnsupportedError, ExtensionOutdatedError, FORGEABLE_HEADERS, FetchInit, Frame, FrameBackend, FrameBackendEvent, FrameDocumentEvent, FrameEventListener, FrameEventMap, FrameLocator, FrameMessageEvent, FramePostMessageOptions, FrameWindowBlockedError, FrameWindowOptions, FrameWindowRefusal, FrameWindowRefusedError, type Gate, type GateTools, GotoOptions, HeaderOperation, LOCATOR_DENIED, LOCATOR_ERROR, LOCATOR_INVALID, LOCATOR_UNSUPPORTED, LegacyPermissionRequest, Locator, type OperationRequest, PERMISSION_DENIED, type PermissionCategory, type PermissionDeniedError, PermissionGrant, PermissionRequest, ProxyFetchRequest, REQUIRED_EXTENSION_ABI, RemoteVideoElement, RequestHeaderRule, type SelectorPart, SiteCookie, StorageState, StorageStateCookie, TimeoutError, VideoElementState, WindowFrame, assertAttachableFrameUrl, assertFetchableUrl, assertForgeableHeaders, assertLockdownApplicable, assertOneCookieIdentity, attachFrame, attachFramePermission, isExtensionAvailable as available, box, cookies, createFrame, createVideoElementHandle, extension as events, extension, fetch, fetchCredentialedPermission, fetchLocalPermission, fetchPermission, gotoPermission, handleRevivableModules, hasForgedCookie, isBackgroundStopped, isBlockedFetchUrl, isBlockedFrameUrl, isExtensionExposed, isLocalNetworkUrl, isLocatorDenied, isLocatorInvalid, isLocatorUnsupported, isPermissionDenied, isTerminalError, isType, modifyRequestHeadersPermission, permissions, promptInstall, readCookiePermission, readExtensionHandshake, removeRequestHeaderRule, revive, setMissingExtensionHandler, setRequestHeaderRule, supportsOperation, type, waitForExtensionExposure };

package/extension.js

@@ -1,3 +1,3 @@
-import { $ as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as c, J as l, K as u, L as d, N as f, P as p, Q as m, R as h, S as g, T as _, U as v, V as y, W as b, X as x, Y as S, Z as C, _ as w, a as T, at as E, b as D, ct as O, dt as k, et as A, ft as j, g as M, i as N, it as P, j as F, k as I, lt as L, mt as R, n as z, nt as B, ot as V, pt as H, q as U, r as W, rt as G, st as K, t as q, tt as J, ut as Y, v as X, w as Z, x as Q, y as $, z as ee } from "./lib-C3UwxjVs.js";
-import { a as te, i as ne, o as re, r as ie } from "./extension-CzZn0bY2.js";
+import { $ as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as c, J as l, K as u, L as d, N as f, P as p, Q as m, R as h, S as g, T as _, U as v, V as y, W as b, X as x, Y as S, Z as C, _ as w, a as T, at as E, b as D, ct as O, dt as k, et as A, ft as j, g as M, i as N, it as P, j as F, k as I, lt as L, mt as R, n as z, nt as B, ot as V, pt as H, q as U, r as W, rt as G, st as K, t as q, tt as J, ut as Y, v as X, w as Z, x as Q, y as $, z as ee } from "./lib-BFwrzgpu.js";
+import { a as te, i as ne, o as re, r as ie } from "./extension-BnVG0YL4.js";
 export { N as ATTACH_FRAME_EVENT_KEY, te as BACKGROUND_STOPPED, Z as CATEGORIES, P as EXTENSION_ABI, E as ExtensionOperationUnsupportedError, V as ExtensionOutdatedError, S as FORGEABLE_HEADERS, M as FrameWindowBlockedError, w as FrameWindowRefusedError, I as LOCATOR_DENIED, p as LOCATOR_ERROR, c as LOCATOR_INVALID, i as LOCATOR_UNSUPPORTED, q as PERMISSION_DENIED, K as REQUIRED_EXTENSION_ABI, _ as TimeoutError, Q as assertAttachableFrameUrl, s as assertFetchableUrl, x as assertForgeableHeaders, g as assertLockdownApplicable, C as assertOneCookieIdentity, T as attachFrame, X as attachFramePermission, ie as available, Y as box, t as cookies, $ as createFrame, k as createVideoElementHandle, e as events, e as extension, v as fetch, b as fetchCredentialedPermission, o as fetchLocalPermission, u as fetchPermission, D as gotoPermission, L as handleRevivableModules, m as hasForgedCookie, re as isBackgroundStopped, U as isBlockedFetchUrl, n as isBlockedFrameUrl, A as isExtensionExposed, l as isLocalNetworkUrl, a as isLocatorDenied, F as isLocatorInvalid, r as isLocatorUnsupported, z as isPermissionDenied, f as isTerminalError, j as isType, d as modifyRequestHeadersPermission, W as permissions, ne as promptInstall, y as readCookiePermission, J as readExtensionHandshake, h as removeRequestHeaderRule, H as revive, B as setMissingExtensionHandler, ee as setRequestHeaderRule, O as supportsOperation, R as type, G as waitForExtensionExposure };

package/http.d.ts

@@ -1,4 +1,4 @@
-import { n as Socket, t as Server$1 } from "./net-CmMZgV2a.js";
+import { n as Socket, t as Server$1 } from "./net-BFjtzAK0.js";
 import { Buffer } from "buffer";
 import { Stream } from "stream";
 import { IncomingHttpHeaders, OutgoingHttpHeaders, RequestOptions } from "http";

package/{index-BOInGaEl.d.ts → index-B98wvTaI.d.ts}

@@ -940,6 +940,8 @@ declare const permissions: {
    *
    * An ask naming a category or key the registry cannot place on a row is a `TypeError`, thrown
    * before anything is sent: its answer would have to name a category the caller never asked for.
+   * A category ask naming an FKN platform host is an Error, also before anything is sent; the
+   * extension answers `allow: false` for any item, legacy ones included, that names one.
    */
   request: (requests: PermissionRequest[]) => Promise<PermissionGrant[]>;
 };
@@ -1264,6 +1266,10 @@ type Frame = Omit<FrameLocator, 'owner'> & {
    *   reload the app`.
    * - cloud, `Error` `frame.clearCookies: the cookies are gone from this attachment, but its jar did
    *   not take the removal, so other attachments may still send them; call it again`.
+   * - cloud, `Error` `frame.clearCookies: this attachment's jar is sealed under the FKN account's key,
+   *   which this device does not hold yet; unlock it and call it again`, with nothing removed: the
+   *   jar runs without the sealed cookies until the key card is answered, so a removal then would
+   *   only look done.
    * - cloud, `TimeoutError` `frame.clearCookies: the render proxy did not answer within 30000ms; the
    *   cookies may or may not be gone, and calling it again is safe`.
    * - extension, `ExtensionOperationUnsupportedError` (operation `'clearCookies'`)
@@ -1348,9 +1354,13 @@ type Frame = Omit<FrameLocator, 'owner'> & {
  *
  * - `'persistent'`, the default: the cloud render proxy's jar of the app's top-level site
  *   (https://fkn.app for every fkn.app app), which every app of that site shares, the same jar its
- *   inline frames and its windows use, kept across visits. Always the cloud backend, whatever is
- *   installed, so `frame.backend()` answers `'cloud'`. Its requests leave through WebVPN, which
- *   keeps the cookies their answers set.
+ *   inline frames and its windows use, kept across visits on this device. Once a key the FKN api
+ *   vouched for reaches it, the jar is written sealed under a key derived from the account's for that
+ *   site: a copy of the browser's files without that key shows none of its cookies, and a device that
+ *   remembers the account's key holds what opens them. Without an account it is kept in the clear,
+ *   and once an account's jar on that site is sealed, as a jar of its own that the account's never
+ *   takes in. Always the cloud backend, whatever is installed, so `frame.backend()` answers
+ *   `'cloud'`. Its requests leave through WebVPN, which keeps the cookies their answers set.
  * - `'ephemeral'`: a fresh jar of the attachment's own, with site storage under a namespace of its
  *   own, both gone with it, seeded from `storageState` when one is given. Always the cloud backend:
  *   the browser keeps a partition's cookies after its frame goes, so no extension jar ends with the
@@ -1677,7 +1687,10 @@ declare const ATTACH_FRAME_EVENT_KEY = "FKN_WEB_EXTENSION_ATTACH_FRAME_EVENT_KEY
 /**
  * Attaches through the extension, on `cookies: 'native'` only: the other values, the default
  * among them, are the cloud render proxy's, refused here with `ExtensionOperationUnsupportedError`
- * (operation `'cookies'`) before any exposure wait (`AttachCookies`).
+ * (operation `'cookies'`) before any exposure wait (`AttachCookies`). A `domains` entry, of the
+ * attach or of a `goto`, or a `goto` target's host, that the frame's header rule would carry onto an
+ * FKN platform host (one of them, one under one, or a parent such as `app`) is refused with an Error
+ * before anything is armed.
  */
 declare const attachFrame: AttachFrameFunction;
 //#endregion

package/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-fqQfEPk6.cjs"),n=require("./extension-DvFf7uoG.cjs"),r=require("./api--LOXTOpv.cjs"),i=require("./busy-Dv8wzE5M.cjs"),a=require("./cloud-Bx64HSkQ.cjs"),o=require("./dns.cjs"),s=require("./net.cjs"),c=require("./dgram.cjs"),l=require("./http.cjs"),u=require("./desktop.cjs"),d=require("./fs-p0bOOj5n.cjs"),f=require("./opfs.cjs"),p=require("./packages.cjs"),m=require("./rooms.cjs"),h=require("./account.cjs"),g=require("./connect-button-BpXDs7tw.cjs");let _=require("osra");var v=1e4,y=150,b=()=>new Promise(e=>{if(t.et())return e(!0);let n,r=setTimeout(()=>i(t.et()),v),i=t=>{clearTimeout(n),clearTimeout(r),o.disconnect(),document.removeEventListener(`readystatechange`,s),e(t)},a=()=>{clearTimeout(n),n=setTimeout(()=>i(t.et()),y)},o=new MutationObserver(()=>{t.et()&&i(!0)}),s=()=>{document.readyState===`complete`&&!t.et()&&a()};o.observe(document.documentElement,{attributes:!0,attributeFilter:[`data-fkn-extension`]}),document.addEventListener(`readystatechange`,s),document.readyState===`complete`&&a()}),x=(async e=>{let{kind:n,cookies:r}=t.o(e);if(n===`window`){let n=e;return r===`native`?t.a(n):a.i(n)}let i=e;return r===`native`?S(i):a.i(i)}),S=async e=>(a.a(e),await b(),t.a(e)),C=`https://fkn.app`,w=async(e,t)=>{if(typeof window>`u`)throw Error(`FKN @fkn/lib: relayWorker must be called from the main thread`);let n=await r.f;if(!n)throw Error(`FKN @fkn/lib: relayWorker found no FKN transport in this realm`);r.d();let a=i.t(`relayed worker`);t?.unregisterSignal?.aborted?a():t?.unregisterSignal?.addEventListener(`abort`,a,{once:!0});let o=n.emit instanceof MessagePort?{}:{originA:t?.originA??C,originB:t?.originB??`*`};(0,_.relay)(n,e,{key:`fkn-api`,...o,unregisterSignal:t?.unregisterSignal})},T=async()=>typeof window>`u`?!1:(await r.o).connect.prompt(location.origin).catch(()=>!1),E=async()=>typeof window>`u`?null:(await r.o).relay.prompt().catch(()=>null),D=new Set,O=e=>(D.add(e),()=>{D.delete(e)}),k=()=>{if(D.size===0)return!1;for(let e of[...D])try{e()}catch{}return!0},A=(e,t)=>{if(typeof e?.onUpdateTaken==`function`)return Promise.resolve(e.onUpdateTaken(t))},j=e.t({applyUpdate:()=>W,busyReasons:()=>U,onUpdate:()=>R,onUpdateTaken:()=>z,updateReady:()=>M}),M=async()=>typeof window>`u`?!1:r.o.then(e=>e.shell?.updateReady()).then(e=>e===!0).catch(()=>!1),N=new Set,P=!1,F=()=>{P=!0;for(let e of[...N])try{e()}catch{}},I=0,L=()=>{let e=r.c();e&&N.size!==0&&I!==e.epoch&&(I=e.epoch,P=!1,Promise.resolve(e.remote.shell?.onUpdate(F)).catch(()=>{I===e.epoch&&(I=0)}))};typeof window<`u`&&r.u(L);var R=async e=>{if(typeof window>`u`)return()=>{};if(N.add(e),P)try{e()}catch{}return L(),()=>{N.delete(e)}},z=e=>typeof window>`u`?()=>{}:O(e),B=0,V=!1,H=()=>{if(!k()&&!V){V=!0;try{location.reload()}catch{}}};typeof window<`u`&&r.u(()=>{let e=r.c();if(!e||B===e.epoch)return;B=e.epoch;let t=A(e.remote.shell,H);if(!t){B=0;return}t.catch(()=>{B===e.epoch&&(B=0)})});var U=()=>i.n(),W=async()=>typeof window>`u`?!1:r.o.then(e=>e.shell?.applyUpdate()).then(e=>e===!0).catch(()=>!1);exports.ATTACH_FRAME_EVENT_KEY=t.i,exports.BACKGROUND_STOPPED=n.a,exports.CATEGORIES=t.w,exports.EXTENSION_ABI=t.it,exports.ExtensionOperationUnsupportedError=t.at,exports.ExtensionOutdatedError=t.ot,exports.FORGEABLE_HEADERS=t.Y,exports.FrameWindowBlockedError=t.g,exports.FrameWindowRefusedError=t._,exports.LOCATOR_DENIED=t.k,exports.LOCATOR_ERROR=t.P,exports.LOCATOR_INVALID=t.I,exports.LOCATOR_UNSUPPORTED=t.E,exports.PERMISSION_DENIED=t.t,exports.REQUIRED_EXTENSION_ABI=t.st,exports.TimeoutError=t.T,Object.defineProperty(exports,"account",{enumerable:!0,get:function(){return h.t}}),exports.assertAttachableFrameUrl=t.x,exports.assertFetchableUrl=t.H,exports.assertForgeableHeaders=t.X,exports.assertLockdownApplicable=t.S,exports.assertOneCookieIdentity=t.Z,exports.attachFrame=x,exports.attachFramePermission=t.v,exports.box=t.ut,Object.defineProperty(exports,"cloud",{enumerable:!0,get:function(){return a.n}}),exports.connect=T,exports.connectButtonUrl=g.t,exports.cookies=t.B,exports.createFrame=t.y,exports.createVideoElementHandle=t.dt,Object.defineProperty(exports,"desktop",{enumerable:!0,get:function(){return u.t}}),Object.defineProperty(exports,"dgram",{enumerable:!0,get:function(){return c.t}}),Object.defineProperty(exports,"dns",{enumerable:!0,get:function(){return o.t}}),Object.defineProperty(exports,"extension",{enumerable:!0,get:function(){return n.t}}),exports.fetch=n.n,exports.fetchCredentialedPermission=t.W,exports.fetchLocalPermission=t.G,exports.fetchPermission=t.K,Object.defineProperty(exports,"fs",{enumerable:!0,get:function(){return d.u}}),exports.gotoPermission=t.b,exports.handleRevivableModules=t.lt,exports.hasForgedCookie=t.Q,Object.defineProperty(exports,"http",{enumerable:!0,get:function(){return l.t}}),exports.isBackgroundStopped=n.o,exports.isBlockedFetchUrl=t.q,exports.isBlockedFrameUrl=t.C,exports.isExtensionExposed=t.et,exports.isLocalNetworkUrl=t.J,exports.isLocatorDenied=t.F,exports.isLocatorInvalid=t.j,exports.isLocatorUnsupported=t.D,exports.isPermissionDenied=t.n,exports.isTerminalError=t.N,exports.isType=t.ft,exports.modifyRequestHeadersPermission=t.L,Object.defineProperty(exports,"net",{enumerable:!0,get:function(){return s.t}}),Object.defineProperty(exports,"opfs",{enumerable:!0,get:function(){return f.t}}),Object.defineProperty(exports,"packages",{enumerable:!0,get:function(){return p.t}}),exports.permissions=t.r,exports.promptInstall=n.i,exports.promptRelay=E,exports.readCookiePermission=t.V,exports.readExtensionHandshake=t.tt,exports.relayWorker=w,exports.removeRequestHeaderRule=t.R,exports.revive=t.pt,Object.defineProperty(exports,"rooms",{enumerable:!0,get:function(){return m.t}}),exports.setMissingExtensionHandler=t.nt,exports.setRequestHeaderRule=t.z,Object.defineProperty(exports,"shell",{enumerable:!0,get:function(){return j}}),exports.supportsOperation=t.ct,exports.type=t.mt,exports.waitForExtensionExposure=t.rt;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./rolldown-runtime-BIInC43l.cjs"),t=require("./lib-47LPHYgB.cjs"),n=require("./extension-3bxlAW8M.cjs"),r=require("./api--LOXTOpv.cjs"),i=require("./busy-Dv8wzE5M.cjs"),a=require("./cloud-CUzZFzG3.cjs"),o=require("./dns.cjs"),s=require("./net.cjs"),c=require("./dgram.cjs"),l=require("./http.cjs"),u=require("./desktop.cjs"),d=require("./fs-p0bOOj5n.cjs"),f=require("./opfs.cjs"),p=require("./packages.cjs"),m=require("./rooms.cjs"),h=require("./account.cjs"),g=require("./connect-button-BpXDs7tw.cjs");let _=require("osra");var v=1e4,y=150,b=()=>new Promise(e=>{if(t.et())return e(!0);let n,r=setTimeout(()=>i(t.et()),v),i=t=>{clearTimeout(n),clearTimeout(r),o.disconnect(),document.removeEventListener(`readystatechange`,s),e(t)},a=()=>{clearTimeout(n),n=setTimeout(()=>i(t.et()),y)},o=new MutationObserver(()=>{t.et()&&i(!0)}),s=()=>{document.readyState===`complete`&&!t.et()&&a()};o.observe(document.documentElement,{attributes:!0,attributeFilter:[`data-fkn-extension`]}),document.addEventListener(`readystatechange`,s),document.readyState===`complete`&&a()}),x=(async e=>{let{kind:n,cookies:r}=t.o(e);if(n===`window`){let n=e;return r===`native`?t.a(n):a.i(n)}let i=e;return r===`native`?S(i):a.i(i)}),S=async e=>(a.a(e),await b(),t.a(e)),C=`https://fkn.app`,w=async(e,t)=>{if(typeof window>`u`)throw Error(`FKN @fkn/lib: relayWorker must be called from the main thread`);let n=await r.f;if(!n)throw Error(`FKN @fkn/lib: relayWorker found no FKN transport in this realm`);r.d();let a=i.t(`relayed worker`);t?.unregisterSignal?.aborted?a():t?.unregisterSignal?.addEventListener(`abort`,a,{once:!0});let o=n.emit instanceof MessagePort?{}:{originA:t?.originA??C,originB:t?.originB??`*`};(0,_.relay)(n,e,{key:`fkn-api`,...o,unregisterSignal:t?.unregisterSignal})},T=async()=>typeof window>`u`?!1:(await r.o).connect.prompt(location.origin).catch(()=>!1),E=async()=>typeof window>`u`?null:(await r.o).relay.prompt().catch(()=>null),D=new Set,O=e=>(D.add(e),()=>{D.delete(e)}),k=()=>{if(D.size===0)return!1;for(let e of[...D])try{e()}catch{}return!0},A=(e,t)=>{if(typeof e?.onUpdateTaken==`function`)return Promise.resolve(e.onUpdateTaken(t))},j=e.t({applyUpdate:()=>W,busyReasons:()=>U,onUpdate:()=>R,onUpdateTaken:()=>z,updateReady:()=>M}),M=async()=>typeof window>`u`?!1:r.o.then(e=>e.shell?.updateReady()).then(e=>e===!0).catch(()=>!1),N=new Set,P=!1,F=()=>{P=!0;for(let e of[...N])try{e()}catch{}},I=0,L=()=>{let e=r.c();e&&N.size!==0&&I!==e.epoch&&(I=e.epoch,P=!1,Promise.resolve(e.remote.shell?.onUpdate(F)).catch(()=>{I===e.epoch&&(I=0)}))};typeof window<`u`&&r.u(L);var R=async e=>{if(typeof window>`u`)return()=>{};if(N.add(e),P)try{e()}catch{}return L(),()=>{N.delete(e)}},z=e=>typeof window>`u`?()=>{}:O(e),B=0,V=!1,H=()=>{if(!k()&&!V){V=!0;try{location.reload()}catch{}}};typeof window<`u`&&r.u(()=>{let e=r.c();if(!e||B===e.epoch)return;B=e.epoch;let t=A(e.remote.shell,H);if(!t){B=0;return}t.catch(()=>{B===e.epoch&&(B=0)})});var U=()=>i.n(),W=async()=>typeof window>`u`?!1:r.o.then(e=>e.shell?.applyUpdate()).then(e=>e===!0).catch(()=>!1);exports.ATTACH_FRAME_EVENT_KEY=t.i,exports.BACKGROUND_STOPPED=n.a,exports.CATEGORIES=t.w,exports.EXTENSION_ABI=t.it,exports.ExtensionOperationUnsupportedError=t.at,exports.ExtensionOutdatedError=t.ot,exports.FORGEABLE_HEADERS=t.Y,exports.FrameWindowBlockedError=t.g,exports.FrameWindowRefusedError=t._,exports.LOCATOR_DENIED=t.k,exports.LOCATOR_ERROR=t.P,exports.LOCATOR_INVALID=t.I,exports.LOCATOR_UNSUPPORTED=t.E,exports.PERMISSION_DENIED=t.t,exports.REQUIRED_EXTENSION_ABI=t.st,exports.TimeoutError=t.T,Object.defineProperty(exports,"account",{enumerable:!0,get:function(){return h.t}}),exports.assertAttachableFrameUrl=t.x,exports.assertFetchableUrl=t.H,exports.assertForgeableHeaders=t.X,exports.assertLockdownApplicable=t.S,exports.assertOneCookieIdentity=t.Z,exports.attachFrame=x,exports.attachFramePermission=t.v,exports.box=t.ut,Object.defineProperty(exports,"cloud",{enumerable:!0,get:function(){return a.n}}),exports.connect=T,exports.connectButtonUrl=g.t,exports.cookies=t.B,exports.createFrame=t.y,exports.createVideoElementHandle=t.dt,Object.defineProperty(exports,"desktop",{enumerable:!0,get:function(){return u.t}}),Object.defineProperty(exports,"dgram",{enumerable:!0,get:function(){return c.t}}),Object.defineProperty(exports,"dns",{enumerable:!0,get:function(){return o.t}}),Object.defineProperty(exports,"extension",{enumerable:!0,get:function(){return n.t}}),exports.fetch=n.n,exports.fetchCredentialedPermission=t.W,exports.fetchLocalPermission=t.G,exports.fetchPermission=t.K,Object.defineProperty(exports,"fs",{enumerable:!0,get:function(){return d.u}}),exports.gotoPermission=t.b,exports.handleRevivableModules=t.lt,exports.hasForgedCookie=t.Q,Object.defineProperty(exports,"http",{enumerable:!0,get:function(){return l.t}}),exports.isBackgroundStopped=n.o,exports.isBlockedFetchUrl=t.q,exports.isBlockedFrameUrl=t.C,exports.isExtensionExposed=t.et,exports.isLocalNetworkUrl=t.J,exports.isLocatorDenied=t.F,exports.isLocatorInvalid=t.j,exports.isLocatorUnsupported=t.D,exports.isPermissionDenied=t.n,exports.isTerminalError=t.N,exports.isType=t.ft,exports.modifyRequestHeadersPermission=t.L,Object.defineProperty(exports,"net",{enumerable:!0,get:function(){return s.t}}),Object.defineProperty(exports,"opfs",{enumerable:!0,get:function(){return f.t}}),Object.defineProperty(exports,"packages",{enumerable:!0,get:function(){return p.t}}),exports.permissions=t.r,exports.promptInstall=n.i,exports.promptRelay=E,exports.readCookiePermission=t.V,exports.readExtensionHandshake=t.tt,exports.relayWorker=w,exports.removeRequestHeaderRule=t.R,exports.revive=t.pt,Object.defineProperty(exports,"rooms",{enumerable:!0,get:function(){return m.t}}),exports.setMissingExtensionHandler=t.nt,exports.setRequestHeaderRule=t.z,Object.defineProperty(exports,"shell",{enumerable:!0,get:function(){return j}}),exports.supportsOperation=t.ct,exports.type=t.mt,exports.waitForExtensionExposure=t.rt;