@freedomofpress/webcat 0.0.0-stage → 3.0.0

package/dist/lib/webcat/db.js

@@ -0,0 +1,131 @@
+import { NamespacedKVStore } from "../browser/kvstore.js";
+import permissions from "../browser/permissions.js";
+import { PersistentLRUCache, LRUSet, CacheKey } from "./cache.js";
+import { OriginState } from "./originstate.js";
+import { extractHostname, extractRawHash } from "./parsers.js";
+import "../browser/sync.js";
+import "./canonicalize.js";
+import "./encoding.js";
+import "./interfaces/bundle.js";
+import "./interfaces/errors.js";
+import "./utils.js";
+import "./validators.js";
+import "@freedomofpress/sigstore-browser";
+import "@freedomofpress/sigsum";
+import "@freedomofpress/sigsum/dist/compiledPolicy";
+import "@freedomofpress/sigsum/dist/crypto";
+import "@freedomofpress/sigsum/dist/proof";
+import "@freedomofpress/sigsum/dist/types";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) fns[i].call(self);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var it, done, ctx, k = flags & 7, p = false;
+  var j = 0;
+  var extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (target = target.prototype, k < 5 && (k > 3 || !p) && __getOwnPropDesc(target, name));
+  __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    it = (0, decorators[i])(target, ctx), done._ = 1;
+    __expectFn(it) && (target = it);
+  }
+  return __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var _WebcatDatabase_decorators, _init, _a;
+const META_KEY = "block_meta";
+_WebcatDatabase_decorators = [permissions.require("unlimitedStorage")];
+class WebcatDatabase extends (_a = NamespacedKVStore) {
+  constructor(config) {
+    super(config.namespace);
+    this.origins = void 0;
+    this.nonOrigins = void 0;
+    this.enrollments = this.namespace("enrollments");
+    this.origins = new PersistentLRUCache(
+      config.originCacheSize,
+      this.namespace("origins"),
+      "session",
+      OriginState
+    );
+    this.nonOrigins = new LRUSet(config.nonOriginCacheSize);
+  }
+  async updateList(leaves, meta) {
+    const batch = {};
+    for (const [reverseKey, hexHash] of leaves) {
+      const hostname = extractHostname(reverseKey);
+      const rawHash = extractRawHash(hexHash);
+      batch[hostname] = Array.from(rawHash);
+    }
+    const old = await this.enrollments.getKeys();
+    const disenrolled = old.filter((enrollment) => !(enrollment in batch));
+    for (const host of disenrolled) {
+      await this.enrollments.remove(host);
+    }
+    await this.enrollments.set(batch);
+    await this.set({ [META_KEY]: meta });
+    await this.origins.clear();
+    await this.nonOrigins.clear();
+    console.log(`[webcat] Replaced list with ${leaves.length} entries`);
+  }
+  async getBlockMeta() {
+    return await this.get(META_KEY) ?? null;
+  }
+  async listAllFQDNs() {
+    return await this.enrollments.getKeys();
+  }
+  async getFQDNEnrollment(fqdn, cachePartition) {
+    const originState = await this.origins.get(CacheKey(fqdn, cachePartition));
+    if (originState) {
+      const cached = originState.enrollment_hash;
+      if (!cached) {
+        throw new Error(
+          "FATAL: cached origin exists without an enrollment_hash"
+        );
+      }
+      return cached;
+    }
+    if (await this.nonOrigins.has(CacheKey(fqdn, cachePartition))) {
+      return new Uint8Array();
+    }
+    const stored = await this.enrollments.get(fqdn);
+    if (stored) {
+      return new Uint8Array(stored);
+    } else {
+      await this.nonOrigins.add(CacheKey(fqdn, cachePartition));
+      return new Uint8Array();
+    }
+  }
+  async setLastChecked() {
+    await this.set({ lastChecked: Date.now() }, "session");
+  }
+  async getLastChecked() {
+    return await this.get("lastChecked", "session") ?? null;
+  }
+  async setLastUpdated() {
+    await this.set({ lastUpdated: Date.now() }, "session");
+  }
+  async getLastUpdated() {
+    return await this.get("lastUpdated", "session") ?? null;
+  }
+}
+_init = __decoratorStart(_a);
+WebcatDatabase = __decorateElement(_init, 0, "WebcatDatabase", _WebcatDatabase_decorators, WebcatDatabase);
+__runInitializers(_init, 1, WebcatDatabase);
+export {
+  WebcatDatabase
+};

package/dist/lib/webcat/encoding.d.ts

@@ -0,0 +1,8 @@
+export declare function base64ToUint8Array(base64: string): Uint8Array;
+export declare function Uint8ArrayToBase64(uint8Array: Uint8Array): string;
+export declare function stringToUint8Array(str: string): Uint8Array<ArrayBuffer>;
+export declare function Uint8ArrayToString(uint8Array: Uint8Array): string;
+export declare function base64UrlToUint8Array(base64url: string): Uint8Array;
+export declare function Uint8ArrayToBase64Url(uint8Array: Uint8Array): string;
+export declare function hexToUint8Array(hex: string): Uint8Array;
+export declare function Uint8ArrayToHex(uint8Array: Uint8Array): string;

package/dist/lib/webcat/encoding.js

@@ -0,0 +1,57 @@
+function base64ToUint8Array(base64) {
+  const binaryString = atob(base64);
+  const length = binaryString.length;
+  const bytes = new Uint8Array(length);
+  for (let i = 0; i < length; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+  return bytes;
+}
+function Uint8ArrayToBase64(uint8Array) {
+  let binaryString = "";
+  for (let i = 0; i < uint8Array.length; i++) {
+    binaryString += String.fromCharCode(uint8Array[i]);
+  }
+  return btoa(binaryString);
+}
+function stringToUint8Array(str) {
+  const encoder = new TextEncoder();
+  return encoder.encode(str);
+}
+function Uint8ArrayToString(uint8Array) {
+  const decoder = new TextDecoder("ascii");
+  return decoder.decode(uint8Array);
+}
+function base64UrlToUint8Array(base64url) {
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/").padEnd(base64url.length + (4 - base64url.length % 4) % 4, "=");
+  return base64ToUint8Array(base64);
+}
+function Uint8ArrayToBase64Url(uint8Array) {
+  return Uint8ArrayToBase64(uint8Array).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function hexToUint8Array(hex) {
+  if (!/^[0-9a-fA-F]*$/.test(hex)) {
+    throw new Error("Hex string contains invalid characters");
+  }
+  if (hex.length % 2 !== 0) {
+    throw new Error("Hex string must have an even length");
+  }
+  const uint8Array = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < uint8Array.length; i++) {
+    uint8Array[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return uint8Array;
+}
+function Uint8ArrayToHex(uint8Array) {
+  return Array.from(uint8Array).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export {
+  Uint8ArrayToBase64,
+  Uint8ArrayToBase64Url,
+  Uint8ArrayToHex,
+  Uint8ArrayToString,
+  base64ToUint8Array,
+  base64UrlToUint8Array,
+  hexToUint8Array,
+  stringToUint8Array
+};

package/dist/lib/webcat/handler.d.ts

@@ -0,0 +1,26 @@
+import { NamespacedKVStore } from "../browser/kvstore";
+import { BeforeRequestDetails, RequestEvent, RequestHandler } from "../browser/requests";
+import { HookBuilderConfig } from "./hookbuilder";
+import { Database } from "./interfaces/database";
+import { BundleFetcherConfig } from "./originstate";
+import { WebcatUI } from "./ui";
+export interface WebcatRequestHandler extends RequestHandler {
+    addEventListener: RequestHandler["addEventListener"] & ((type: "beforeframeload", callback: (event: RequestEvent<BeforeRequestDetails>) => void) => void);
+}
+export declare class WebcatRequestHandler extends RequestHandler {
+    #private;
+    constructor(db: Database & NamespacedKVStore, ui: WebcatUI, config: BundleFetcherConfig & HookBuilderConfig);
+    bind(fqdns: string[]): Promise<void>;
+    /**
+     * Binds the handler to `<all_urls>`. Unlike {@link bind}, does not bind
+     * content scripts. The bindAll method can be called synchronously before
+     * FQDNs are available, but it should be always followed by a call to
+     * {@link bind} to both restrict the scope of the binding and bind content
+     * scripts.
+     */
+    bindAll(): void;
+    protected getListenerOptions(fqdns: string[], type: "beforerequest"): [browser.webRequest.RequestFilter, browser.webRequest.OnBeforeRequestOptions[]];
+    protected getListenerOptions(fqdns: string[], type: "beforeheaders"): [browser.webRequest.RequestFilter, browser.webRequest.OnBeforeSendHeadersOptions[]];
+    protected getListenerOptions(fqdns: string[], type: "headersreceived"): [browser.webRequest.RequestFilter, browser.webRequest.OnHeadersReceivedOptions[]];
+    protected getListenerOptions(fqdns: string[], type: "erroroccurred" | "completed"): [browser.webRequest.RequestFilter];
+}

package/dist/lib/webcat/handler.js

@@ -0,0 +1,419 @@
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var __using = (stack, value, async) => {
+  if (value != null) {
+    if (typeof value !== "object" && typeof value !== "function") __typeError("Object expected");
+    var dispose, inner;
+    if (async) dispose = value[__knownSymbol("asyncDispose")];
+    if (dispose === void 0) {
+      dispose = value[__knownSymbol("dispose")];
+      if (async) inner = dispose;
+    }
+    if (typeof dispose !== "function") __typeError("Object not disposable");
+    if (inner) dispose = function() {
+      try {
+        inner.call(this);
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    };
+    stack.push([async, dispose, value]);
+  } else if (async) {
+    stack.push([async]);
+  }
+  return value;
+};
+var __callDispose = (stack, error, hasError) => {
+  var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
+    return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
+  };
+  var fail = (e) => error = hasError ? new E(e, error, "An error was suppressed during disposal") : (hasError = true, e);
+  var next = (it) => {
+    while (it = stack.pop()) {
+      try {
+        var result = it[1] && it[1].call(it[2]);
+        if (it[0]) return Promise.resolve(result).then(next, (e) => (fail(e), next()));
+      } catch (e) {
+        fail(e);
+      }
+    }
+    if (hasError) throw error;
+  };
+  return next();
+};
+var _db, _ui, _config, _hooks, _contentScript, _responseValidator, _mutex, _requestLock, _bindLock, _WebcatRequestHandler_instances, initializeState_fn, onRequest_fn, onHeaders_fn, commitVerifiedOrigin_fn, getFirstParty_fn, onWindowClosed_fn;
+import permissions from "../browser/permissions.js";
+import { RequestHandler, RequestEvent } from "../browser/requests.js";
+import { ContentScript } from "../browser/scripting.js";
+import { Mutex } from "../browser/sync.js";
+import { CacheKey, isInPartition } from "./cache.js";
+import { HookBuilder } from "./hookbuilder.js";
+import { WebcatError } from "./interfaces/errors.js";
+import { logger } from "./logger.js";
+import { validateOrigin } from "./request.js";
+import { FRAME_TYPES } from "./resources.js";
+import { ResponseValidator } from "./response.js";
+import { clearBrowserCaches, getFQDN, isExtensionRequest, isSameOriginURL, isNewerSemver } from "./utils.js";
+import "../browser/utils.js";
+import "./originstate.js";
+import "./canonicalize.js";
+import "./encoding.js";
+import "./interfaces/bundle.js";
+import "./validators.js";
+import "@freedomofpress/sigstore-browser";
+import "@freedomofpress/sigsum";
+import "@freedomofpress/sigsum/dist/compiledPolicy";
+import "@freedomofpress/sigsum/dist/crypto";
+import "@freedomofpress/sigsum/dist/proof";
+import "@freedomofpress/sigsum/dist/types";
+import "./parsers.js";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol2 = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError2 = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol2("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError2("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError2("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol2("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) fns[i].call(self);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var it, done, ctx, k = flags & 7, p = false;
+  var j = 0;
+  var extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (target = target.prototype, k < 5 && (k > 3 || !p) && __getOwnPropDesc(target, name));
+  __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    it = (0, decorators[i])(target, ctx), done._ = 1;
+    __expectFn(it) && (target = it);
+  }
+  return __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var _WebcatRequestHandler_decorators, _init, _a;
+_WebcatRequestHandler_decorators = [permissions.require("scripting"), permissions.require("webNavigation"), permissions.require("<all_urls>")];
+class WebcatRequestHandler extends (_a = RequestHandler) {
+  constructor(db, ui, config) {
+    super();
+    __privateAdd(this, _WebcatRequestHandler_instances);
+    __privateAdd(this, _db);
+    __privateAdd(this, _ui);
+    __privateAdd(this, _config);
+    __privateAdd(this, _hooks);
+    __privateAdd(this, _contentScript);
+    __privateAdd(this, _responseValidator);
+    __privateAdd(this, _mutex, new Mutex());
+    __privateAdd(this, _requestLock, __privateGet(this, _mutex).createLock());
+    __privateAdd(this, _bindLock, __privateGet(this, _mutex).createLock());
+    __privateSet(this, _db, db);
+    __privateSet(this, _ui, ui);
+    __privateSet(this, _config, config);
+    __privateSet(this, _hooks, new HookBuilder(db.namespace("hooks"), config));
+    __privateSet(this, _contentScript, new ContentScript(__privateGet(this, _hooks).getStaticHookPath()));
+    __privateSet(this, _responseValidator, new ResponseValidator(
+      __privateGet(this, _db),
+      __privateGet(this, _ui),
+      __privateGet(this, _hooks)
+    ));
+    this.addEventListener("beforerequest", __privateMethod(this, _WebcatRequestHandler_instances, onRequest_fn));
+    this.addEventListener("headersreceived", __privateMethod(this, _WebcatRequestHandler_instances, onHeaders_fn));
+    browser.windows.onRemoved.addListener(__privateMethod(this, _WebcatRequestHandler_instances, onWindowClosed_fn).bind(this));
+    __privateGet(this, _mutex).acquire(__privateGet(this, _bindLock));
+  }
+  async bind(fqdns) {
+    var _stack = [];
+    try {
+      const lock = __privateGet(this, _bindLock);
+      __privateSet(this, _bindLock, void 0);
+      const _ = __using(_stack, await __privateGet(this, _mutex).acquire(lock));
+      super.bind(fqdns);
+      const newFqdns = await __privateGet(this, _contentScript).bind(fqdns);
+      await clearBrowserCaches(newFqdns);
+    } catch (_2) {
+      var _error = _2, _hasError = true;
+    } finally {
+      __callDispose(_stack, _error, _hasError);
+    }
+  }
+  /**
+   * Binds the handler to `<all_urls>`. Unlike {@link bind}, does not bind
+   * content scripts. The bindAll method can be called synchronously before
+   * FQDNs are available, but it should be always followed by a call to
+   * {@link bind} to both restrict the scope of the binding and bind content
+   * scripts.
+   */
+  bindAll() {
+    super.bind(["<all_urls>"]);
+  }
+  // prettier-ignore
+  getListenerOptions(fqdns, type) {
+    let all = false;
+    for (let i; (i = fqdns.indexOf("<all_urls>")) !== -1; ) {
+      fqdns = [...fqdns.slice(0, i), ...fqdns.slice(i + 1)];
+      all = true;
+    }
+    let result;
+    if (type === "beforeheaders") {
+      const [filter, options] = super.getListenerOptions(fqdns, type);
+      filter.types = ["script"];
+      result = [filter, options];
+    } else {
+      result = super.getListenerOptions(fqdns, type);
+    }
+    if (all) {
+      result[0].urls.push("<all_urls>");
+    }
+    return result;
+  }
+}
+_db = new WeakMap();
+_ui = new WeakMap();
+_config = new WeakMap();
+_hooks = new WeakMap();
+_contentScript = new WeakMap();
+_responseValidator = new WeakMap();
+_mutex = new WeakMap();
+_requestLock = new WeakMap();
+_bindLock = new WeakMap();
+_WebcatRequestHandler_instances = new WeakSet();
+initializeState_fn = async function(details) {
+  return Object.assign(details, {
+    state: {
+      fqdn: getFQDN(details.url),
+      cachePartition: {
+        firstParty: await __privateMethod(this, _WebcatRequestHandler_instances, getFirstParty_fn).call(this, details),
+        incognito: !!details.incognito
+      },
+      isFrame: FRAME_TYPES.includes(details.type)
+    }
+  });
+};
+onRequest_fn = async function(event) {
+  var _stack = [];
+  try {
+    const blockingResponse = __using(_stack, event.createBlockingResponse());
+    if (isExtensionRequest(event.details)) {
+      blockingResponse.cancel = false;
+      return;
+    }
+    const details = await __privateMethod(this, _WebcatRequestHandler_instances, initializeState_fn).call(this, event.details);
+    const _ = __using(_stack, await __privateGet(this, _mutex).acquire(__privateGet(this, _requestLock)));
+    if (details.state.isFrame) {
+      logger.info(`Loading ${details.type} ${details.url}`, details);
+      const beforeframeload = new RequestEvent(
+        "beforeframeload",
+        event.details
+      );
+      this.dispatchEvent(beforeframeload);
+      const frameResult = await beforeframeload.ready();
+      if (frameResult.cancel) {
+        return blockingResponse.set(frameResult);
+      }
+    }
+    if (!details.state.isFrame) {
+      const cached = await __privateGet(this, _db).origins.get(
+        CacheKey(details.state.fqdn, details.state.cachePartition)
+      );
+      const now = Math.floor(Date.now() / 1e3);
+      if (cached?.validUntil && cached.validUntil > now) {
+        details.state.pendingOrigin = cached;
+      }
+    }
+    if (!details.state.pendingOrigin) {
+      const result = await validateOrigin(
+        __privateGet(this, _db),
+        __privateGet(this, _ui),
+        details,
+        __privateGet(this, _config)
+      );
+      if (result instanceof WebcatError) {
+        if (details.state.isFrame) {
+          __privateGet(this, _ui).showErrorPage(details, result);
+        }
+        return blockingResponse.set({ cancel: true });
+      }
+      if (result) {
+        if (details.state.isFrame) {
+          logger.info(`Redirecting to https`, details);
+        }
+        return blockingResponse.set({ ...result, cancel: false });
+      }
+    }
+    if (!details.state.pendingOrigin) {
+      blockingResponse.cancel = false;
+      return;
+    }
+    await __privateGet(this, _responseValidator).validateContent(details);
+    blockingResponse.cancel = false;
+  } catch (_2) {
+    var _error = _2, _hasError = true;
+  } finally {
+    __callDispose(_stack, _error, _hasError);
+  }
+};
+onHeaders_fn = async function(event) {
+  var _stack = [];
+  try {
+    const blockingResponse = __using(_stack, event.createBlockingResponse());
+    const details = event.details;
+    if (isExtensionRequest(details)) {
+      const location = details.responseHeaders?.find(
+        (header) => header.name.toLowerCase() === "location"
+      )?.value;
+      if (location && !isSameOriginURL(location, details.url)) {
+        return;
+      }
+      blockingResponse.cancel = false;
+      return;
+    }
+    if (!details.state) {
+      blockingResponse.cancel = false;
+      return;
+    }
+    if (!details.state.pendingOrigin) {
+      throw new Error("missing pendingOrigin in request state");
+    }
+    const result = await __privateGet(this, _responseValidator).validateHeaders(details);
+    if (result instanceof WebcatError) {
+      logger.error(
+        `Error when parsing response headers: ${result}: ${result.details?.join(", ")}`,
+        details
+      );
+      __privateGet(this, _ui).showErrorPage(details, result);
+      return blockingResponse.set({ cancel: true });
+    }
+    await __privateMethod(this, _WebcatRequestHandler_instances, commitVerifiedOrigin_fn).call(this, details.state.fqdn, details.state.pendingOrigin, details.state.cachePartition);
+    if (details.state.isFrame) {
+      blockingResponse.setHeader("Origin-Agent-Cluster", "?1");
+    }
+    __privateGet(this, _responseValidator).markContent(event.details);
+    if (FRAME_TYPES.includes(details.type) && details.state.pendingOrigin.manifest) {
+      const wasm = details.state.pendingOrigin.manifest.wasm;
+      const listener = async (navDetails) => {
+        if (navDetails.tabId !== details.tabId) return;
+        if (navDetails.frameId !== details.frameId) return;
+        browser.webNavigation.onDOMContentLoaded.removeListener(listener);
+        const [func, args] = await __privateGet(this, _hooks).getContentScriptHooks(
+          wasm,
+          details.state.cachePartition.firstParty,
+          details.state.cachePartition.firstParty === new URL(details.url).origin
+        );
+        await browser.scripting.executeScript({
+          target: {
+            tabId: details.tabId,
+            frameIds: [details.frameId]
+          },
+          func,
+          args,
+          injectImmediately: true,
+          world: "ISOLATED"
+        });
+      };
+      browser.webNavigation.onDOMContentLoaded.addListener(listener);
+    }
+    blockingResponse.cancel = false;
+  } catch (_) {
+    var _error = _, _hasError = true;
+  } finally {
+    __callDispose(_stack, _error, _hasError);
+  }
+};
+commitVerifiedOrigin_fn = async function(fqdn, newState, cachePartition) {
+  if (newState.stale) {
+    return;
+  }
+  if (!newState.isManifestVerified()) {
+    return;
+  }
+  const incoming = newState.manifest.version;
+  const currentState = await __privateGet(this, _db).origins.get(
+    CacheKey(fqdn, cachePartition)
+  );
+  if (currentState && currentState.isManifestVerified()) {
+    const current = currentState.manifest.version;
+    if (!isNewerSemver(incoming, current) && currentState.validUntil >= newState.validUntil) {
+      return;
+    }
+  }
+  await __privateGet(this, _db).origins.set(CacheKey(fqdn, cachePartition), newState);
+};
+getFirstParty_fn = async function(details) {
+  if (details.tabId === -1 || details.frameId === -1 || details.frameId === 0) {
+    for (const url of [details.url, details.documentUrl, details.originUrl]) {
+      if (url === void 0) continue;
+      try {
+        return await __privateGet(this, _hooks).decryptFragment(url);
+      } catch {
+      }
+    }
+  }
+  if (details.frameAncestors?.length) {
+    return new URL(
+      details.frameAncestors[details.frameAncestors.length - 1].url
+    ).origin;
+  }
+  if (details.frameId !== 0 && details.frameId !== -1) {
+    const frames = await browser.webNavigation.getAllFrames({
+      tabId: details.tabId
+    });
+    if (frames.find((frame) => frame.frameId === details.frameId)) {
+      return new URL(frames.find((frame) => frame.frameId === 0)?.url || "").origin;
+    }
+    logger.addLog(
+      "warn",
+      `Cannot determine first-party origin for '${details.url}'; using unique cache partition`,
+      details.tabId,
+      getFQDN(details.url)
+    );
+    return details.requestId;
+  }
+  if (details.documentUrl) {
+    return new URL(details.documentUrl).origin;
+  }
+  if (details.type === "main_frame") {
+    return new URL(details.url).origin;
+  }
+  logger.addLog(
+    "error",
+    `No first-party origin found for '${details.url}'`,
+    details.tabId,
+    getFQDN(details.url)
+  );
+  return details.requestId;
+};
+onWindowClosed_fn = async function() {
+  const windows = await browser.windows.getAll();
+  if (windows.filter((win) => win.incognito).length === 0) {
+    for (const key of await __privateGet(this, _db).origins.keys()) {
+      if (isInPartition(key, { incognito: true })) {
+        __privateGet(this, _db).origins.delete(key);
+      }
+    }
+    for (const value of await __privateGet(this, _db).nonOrigins.values()) {
+      if (isInPartition(value, { incognito: true })) {
+        __privateGet(this, _db).nonOrigins.delete(value);
+      }
+    }
+  }
+};
+_init = __decoratorStart(_a);
+WebcatRequestHandler = __decorateElement(_init, 0, "WebcatRequestHandler", _WebcatRequestHandler_decorators, WebcatRequestHandler);
+__runInitializers(_init, 1, WebcatRequestHandler);
+export {
+  WebcatRequestHandler
+};