@freedomofpress/webcat 0.0.0-stage → 3.0.1

package/Readme.md

@@ -0,0 +1,45 @@
+## WEBCAT Browser Extension
+
+The extension is written in TypeScript, using the Manifest V3 API. Chromium is not supported, as the extension relies heavily on intercepting and modifying network requests and responses, which Chromium does not allow in Manifest V3. There are no external runtime dependencies: the Sigsum, Sigstore and CometBFT clients are maintained by the Freedom of the Press Foundation and, like the rest of the extension, use only the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API). The only exception is in the WebAssembly hooks, where a synchronous SHA256 function is needed in order to hook synchronous WebAssembly methods and Worklets, where `crypto` is not available.
+
+The latest tagged release is generally published on the [Mozilla Add-ons store](https://addons.mozilla.org/en-US/firefox/addon/webcat/).
+
+### Build
+
+Install build dependencies:
+
+`npm install`
+
+Compile the TypeScript and bundle it with [Vite](https://vite.dev):
+
+`npm run build`
+
+The output will be in `./dist/bundle.js` and `./dist/hooks/`. Everything else in the extension folder does not need any action.
+
+Alternatively, `make package` will install, build, fetch the current enrollment list and package the extension, saving the archive as `../dist/webcat-extension.zip`. The archive can then be loaded in `about:debugging` as a temporary add-on. `make package-test` builds with `VITE_TESTING=true`, which disables minification and mocks the light client, and is what the integration tests use.
+
+The extension can also be built as an npm library with `npm run build:lib`. API docs are generated with [Typedoc](https://typedoc.org).
+
+### Tests
+
+Unit tests use [vitest](https://vitest.dev/) and run natively, with the browser APIs mocked:
+
+`npm run test`
+
+Tests in `tests/webcat/` cover the verification logic, tests in `tests/browser/` the wrappers around the WebExtension APIs. `npm run coverage` also prints a coverage report.
+
+Integration tests are in [`../test/`](../test/README.md). They use pytest to run Firefox and Tor Browser with the `package-test` archive (or the library build) installed, and check the test apps. CI runs them on Firefox, Firefox ESR and Tor Browser at the Standard, Safer and Safest security levels.
+
+### Linting
+
+The project uses [dpdm](https://github.com/acrazing/dpdm) to catch circular imports, [eslint](eslint.config.mjs) for linting and [prettier](https://prettier.io/) for sorting imports and style consistency. All three are run together with:
+
+`npm run lint`
+
+To check for issues without auto-fixing (this is what CI runs):
+
+`npm run lint:check`
+
+### How it works
+
+For an overview of the verification flow and the response validation logic, see [Towards auditable web application runtimes](https://securedrop.org/news/webcat-towards-auditable-web-application-runtimes/) and the [specifications](https://github.com/freedomofpress/webcat-spec).

package/data/block.json

@@ -0,0 +1,101 @@
+{
+  "signed_header": {
+    "header": {
+      "version": {
+        "block": "11",
+        "app": "0"
+      },
+      "chain_id": "webcat-test-02",
+      "height": "330644",
+      "time": "2026-10-14T13:00:53.8169638Z",
+      "last_block_id": {
+        "hash": "E54776034F308197AA0112DFEDB54EB0C64AD294FCEC1BA4A4C88F7F9F497872",
+        "parts": {
+          "total": 1,
+          "hash": "2446521004F6194EF5C5DCC82A1DB8D7C1CDE92D068800098733F77E8C9F7267"
+        }
+      },
+      "last_commit_hash": "9049801B0E90DB5E299730F4890C3D58E3A5BBAD1C50C47161F248CE340FA939",
+      "data_hash": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "validators_hash": "166D75D14EE1555615C57D2F013454152214BDB143D458C00A02B2AC0F2AC128",
+      "next_validators_hash": "166D75D14EE1555615C57D2F013454152214BDB143D458C00A02B2AC0F2AC128",
+      "consensus_hash": "048091BC7DDC283F77BFBF91D73C44DA58C3DF8A9CBC867405D8B7F3DAADA22F",
+      "app_hash": "CC69EBA2887F829EF2670DF9D43FD035C60DCCFCE6543FE292C28C46E7A50E76",
+      "last_results_hash": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "evidence_hash": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "proposer_address": "A39CFEBE6E8CA10B6101C46884A6EB8E62D04417"
+    },
+    "commit": {
+      "height": "330644",
+      "round": 0,
+      "block_id": {
+        "hash": "DB939428FF9FBA2D65EA42FD14A1E1AF3E87101E671D4541E3A35C536E8E4EC3",
+        "parts": {
+          "total": 1,
+          "hash": "94FF793011CB30A5F38C87CE20DF8334EF1DDCE9C328B74094596CEED45EDF78"
+        }
+      },
+      "signatures": [
+        {
+          "block_id_flag": 2,
+          "validator_address": "48926DF1CC10DBBFAA78953F9BE38E59020DE01D",
+          "timestamp": "2026-10-14T13:01:54.718663088Z",
+          "signature": "gjC8v87ugu+Sf8vVm56NmapJ/O7+1oE/m9ivmVEQJhIPPUTsNg2L0VPGwI2+cqM5FebzQE2666Ffnv1i/dQUAw=="
+        },
+        {
+          "block_id_flag": 2,
+          "validator_address": "A39CFEBE6E8CA10B6101C46884A6EB8E62D04417",
+          "timestamp": "2026-10-14T13:01:54.801194901Z",
+          "signature": "veHQpG9BTRM+22yljMnbx0NjSjw3vWJkOY9B7Xn4IQZDtarh/5UdAKICQZtiaabhWtHXeUxMpURmPVvGnp/UCQ=="
+        },
+        {
+          "block_id_flag": 2,
+          "validator_address": "B734AC6CC1F14AAC8315FE8DBB07402ED4E45D72",
+          "timestamp": "2026-10-14T13:01:54.679594575Z",
+          "signature": "ZzKX9UDVNTmeUkIi6zwYBq942LZbrjlfBGhCTw6P+RmyZDWdRAKnAO+w/KPB1BKFHRWZ4okKRd+pnXcTggXFDA=="
+        }
+      ]
+    }
+  },
+  "validator_set": {
+    "validators": [
+      {
+        "address": "48926DF1CC10DBBFAA78953F9BE38E59020DE01D",
+        "pub_key": {
+          "type": "tendermint/PubKeyEd25519",
+          "value": "zEK+pyAEhhCaoHYhhT+rrorJoc9kZbfY+JkbMtF8u5Y="
+        },
+        "power": "1",
+        "name": null
+      },
+      {
+        "address": "A39CFEBE6E8CA10B6101C46884A6EB8E62D04417",
+        "pub_key": {
+          "type": "tendermint/PubKeyEd25519",
+          "value": "8dZUej72UriKCPIDvk01c6yLaAB2ssYIli3fT3jKwSM="
+        },
+        "power": "1",
+        "name": null
+      },
+      {
+        "address": "B734AC6CC1F14AAC8315FE8DBB07402ED4E45D72",
+        "pub_key": {
+          "type": "tendermint/PubKeyEd25519",
+          "value": "WBK6Af3uKtC+VTv8x48f2TPoNnsebSXSBTIsJku/nQw="
+        },
+        "power": "1",
+        "name": null
+      }
+    ],
+    "proposer": {
+      "address": "A39CFEBE6E8CA10B6101C46884A6EB8E62D04417",
+      "pub_key": {
+        "type": "tendermint/PubKeyEd25519",
+        "value": "8dZUej72UriKCPIDvk01c6yLaAB2ssYIli3fT3jKwSM="
+      },
+      "power": "1",
+      "name": null
+    },
+    "total_voting_power": "3"
+  }
+}

package/data/list.json

@@ -0,0 +1,80 @@
+{
+  "block_height": 330643,
+  "leaves": [
+    [
+      "canonical/.app.riskmapper",
+      "0a205bc15fa3cf1bbe8cd7550bd988e48020da0c32689ee4fd7f02fa7a9485268476"
+    ],
+    [
+      "canonical/.build.rick",
+      "0a20af7b41b46aabc27ffbae7f3ad22234706f3e497cc7d53d714913f41792cc86e0"
+    ],
+    [
+      "canonical/.cat.lsd",
+      "0a20b1de98823019eb9e8ce01dfe8d27f72e99e0b7826e8163086d08ec6285d826c3"
+    ],
+    [
+      "canonical/.com.legoktm.git",
+      "0a20ef903936a3167942c49ccee664b7bfc8400c036b52f0263066d621718a9529ec"
+    ],
+    [
+      "canonical/.llc.micrographia",
+      "0a20d3e1d66add2d2ed3cf15f23d740e48ee7567922ad0dc3e67a379588cfef24b19"
+    ],
+    [
+      "canonical/.net.strongphrase",
+      "0a20db2b798219451a47d04a9c3b03d5f0873facefe5b2bab42791e81ebfa342473d"
+    ],
+    [
+      "canonical/.org.endeixis.www",
+      "0a20ff788a2293dbc439882d65d18a51e81444b5354f92d6f375791a7f014faa54a0"
+    ],
+    [
+      "canonical/.org.osservatorionessuno.upload",
+      "0a20b82cb5694148e4f05cc98a66bd00adc0baaba21dd4f96867e4d6f6e707ac7dae"
+    ],
+    [
+      "canonical/.sh.tinfoil.verification-center",
+      "0a2029a12b3e97dc6746cebc18c4ce03acf27ff53c324ee7e26b2c70182191bd2d2c"
+    ],
+    [
+      "canonical/.sh.tinfoil.verification-center-preview",
+      "0a20676f6fd20ae82cabeb8a13a320af9ce8be5323af439b538d852fe8c089e4cc64"
+    ],
+    [
+      "canonical/.solutions.hacked",
+      "0a20c869dc60104f61e89360f80bc8ea07ac6837b20d9e22098206dd90f47ff6c959"
+    ],
+    [
+      "canonical/.tech.webcat.demo.element",
+      "0a2024955e41f46221d79fcbb3370abd2219a3a7be13d3fb6341f2cf150788d3311e"
+    ],
+    [
+      "canonical/.tech.webcat.demo.enrollment-error",
+      "0a2049278ed1c0dce64b6f417ef47ef8c464caaaa66896f1bf903c170b90cc85af18"
+    ],
+    [
+      "canonical/.tech.webcat.demo.integrity-error",
+      "0a206909132ad0fe3779eb59b61af318ae60c06cd78cdff39c31d1d0db61043a24af"
+    ],
+    [
+      "canonical/.tech.webcat.demo.manifest-error",
+      "0a20dd8be8c859a0995a8326a19e145e2756c0c9bd98df88be501bdd73a4b17d67b0"
+    ],
+    [
+      "canonical/.tech.webcat.demo.test",
+      "0a208904d6d804470443a14eaa24edcf78041a7606e2b194d0105c4e2c2d5cf53821"
+    ]
+  ],
+  "proof": {
+    "app_hash": "cc69eba2887f829ef2670df9d43fd035c60dccfce6543fe292c28c46e7a50e76",
+    "canonical_root_hash": "5ef5175877cd6395edb37d16cd75563a2755856aaae0e45e882af6429bac9c0a",
+    "merkle_proof": {
+      "proof_bytes": [
+        "0ad7030a162e746563682e7765626361742e64656d6f2e7465737412220a208904d6d804470443a14eaa24edcf78041a7606e2b194d0105c4e2c2d5cf538211a150801100118012a0d4a4d543a3a4c6561664e6f64652236080112104a4d543a3a496e74726e616c4e6f64651a2051ab1571299e2c3fc4a9bea2ef7d957c49f9e809e7568e948c400ea111a66a952236080112104a4d543a3a496e74726e616c4e6f64651a205350415253455f4d45524b4c455f504c414345484f4c4445525f484153485f5f2234080112304a4d543a3a496e74726e616c4e6f64655350415253455f4d45524b4c455f504c414345484f4c4445525f484153485f5f2236080112104a4d543a3a496e74726e616c4e6f64651a205350415253455f4d45524b4c455f504c414345484f4c4445525f484153485f5f2236080112104a4d543a3a496e74726e616c4e6f64651a20fbf809557d948b48663301baf50cbcaea85626cf032ad94dc26ac49ee506f30d2234080112304a4d543a3a496e74726e616c4e6f64652cfd256ee4f9a769eedd2ff8165c665dcd52ab3245e7cf6fbb0d3c2652fd43c42236080112104a4d543a3a496e74726e616c4e6f64651a20f492db53692b860ecc0aff2b1e48d16a6089b66db3c844ac6766e6c0e6059031",
+        "0aec010a0963616e6f6e6963616c12205ef5175877cd6395edb37d16cd75563a2755856aaae0e45e882af6429bac9c0a1a150801100118012a0d4a4d543a3a4c6561664e6f64652236080112104a4d543a3a496e74726e616c4e6f64651a20f4b689332e69b27264c62b8bd05261e95090f3b5370cd05874eef504ea75d9052236080112104a4d543a3a496e74726e616c4e6f64651a205350415253455f4d45524b4c455f504c414345484f4c4445525f484153485f5f2236080112104a4d543a3a496e74726e616c4e6f64651a205350415253455f4d45524b4c455f504c414345484f4c4445525f484153485f5f"
+      ],
+      "representative_key": "canonical/.tech.webcat.demo.test"
+    }
+  }
+}

package/dist/hooks/content.js

@@ -0,0 +1 @@
+(function(){"use strict";const o=Symbol("WEBCAT internal"),H=Symbol("WEBCAT hooked"),s=globalThis.self||globalThis,P=Reflect.apply,U=typeof globalThis.exportFunction=="function";function n(r){return U?XPCNativeWrapper.unwrap(r):r}function b(r,e=s,t=void 0){if(U){const i={};return t!==void 0&&(i.defineAs=t),exportFunction(r,XPCNativeWrapper.unwrap(e),i)}else t!==void 0&&(e[t]=r);return r}function R(r){const e=n(new s.Object);for(const t of Object.keys(r))e[t]=r[t];return e.listeners=new Map,e}function j(r,e){return function(t,i){const c=t;if(c.hooks||(c.hooks={}),r in c.hooks){console.log(`[WEBCAT] Hook already injected: ${r}`),c.hooks[r].data=i;return}const{promise:l,resolve:a}=s.Promise.withResolvers();c.hooks[r]={ready:l,data:i},Object.defineProperty(c.hooks[r],"data",{set:d=>{i=d,a()},get:()=>i}),typeof i=="object"&&(c.hooks[r].data=i),e(l.then(()=>i),c.hooks[r])}}function $(r,e,t){return r.has(e)?r.get(e):(r.set(e,t),t)}function B(r){const e=n(r);return e&&(typeof e=="object"||typeof e=="function")?e:{capture:!!e}}function _(r,e){return b((...t)=>P(r,e,t))}function q(r,e,t,i){const c=n(e[1]),{once:l}=B(e[2]);return e[1]=b((...a)=>{l&&t[i]===e&&delete t[i];const d=typeof c=="function"?c:c?.handleEvent;return d&&P(d,r,a)}),e}function C(r,e){const{get:t,set:i}=Object.getOwnPropertyDescriptor(r,e);function c(){return o in n(this)?n(this)[o][e]:t&&P(t,this,[])}function l(a){o in n(this)?(n(this)[o][e]=a,n(this)[o].instance&&(n(this)[o].instance[e]=typeof a=="function"?_(a,n(this)):null)):i&&P(i,this,[a])}Object.defineProperty(r,e,{get:b(c),set:b(l)})}function x(r){const e=Object.keys(r[o]).filter(t=>t.startsWith("on"));for(const t of e){const i=r[o][t];r[o].instance[t]=typeof i=="function"?_(i,r):null}for(const t of r[o].listeners.values())for(const{nonCapturingArgs:i,capturingArgs:c}of t.values())i&&r[o].instance.addEventListener(...i),c&&r[o].instance.addEventListener(...c)}const z=j("EventTarget",function(){const{value:r}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"addEventListener");function e(...a){const[d,w,u]=a;if(this&&o in n(this)){const{capture:f,once:m,passive:k,signal:p}=B(u),h=n(new s.Object);h.capture=!!f,h.once=!!m,h.passive=k===void 0?void 0:!!k,h.signal=p;const W=$($(n(this)[o].listeners,d,new Map),w,{}),O=f?"capturingArgs":"nonCapturingArgs",E=W[O];if(!E||B(E[2]).signal?.aborted){const L=q(n(this),[d,w,h],W,O);W[O]=L,n(this)[o].instance&&n(this)[o].instance.addEventListener(...L)}}else P(r,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"addEventListener",{value:b(e)});const{value:t}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"removeEventListener");function i(...a){const[d,w,u]=a;if(this&&o in n(this)){const f=n(this)[o].listeners.get(d)?.get(w),m=B(u).capture?"capturingArgs":"nonCapturingArgs";f?.[m]&&(n(this)[o].instance&&n(this)[o].instance.removeEventListener(...f[m]),delete f[m])}else P(t,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"removeEventListener",{value:b(i)});const{value:c}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"dispatchEvent");function l(...a){return this&&o in n(this)?n(this)[o].instance?n(this)[o].instance.dispatchEvent(...a):!0:P(c,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"dispatchEvent",{value:b(l)})}),G=j("Event",function(){for(const t of["target","currentTarget","originalTarget","explicitOriginalTarget","srcElement"]){let i=function(){const l=n(P(c,this,[]));return l?.[H]??l};const{get:c}=Object.getOwnPropertyDescriptor(n(s.Event.prototype),t)??{};c&&Object.defineProperty(n(s.Event.prototype),t,{get:b(i)})}const{value:r}=Object.getOwnPropertyDescriptor(n(s.Event.prototype),"composedPath");function e(){const t=n(P(r,this,[]));for(let i=0;i<t.length;i++){const c=t[i];t[i]=c?.[H]??c}return t}Object.defineProperty(n(s.Event.prototype),"composedPath",{value:b(e)})}),N=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]);function I(r,e,t,i,c){let l,a,d,w,u,f,m,k,p,h,W,O,E;for(;c>=64;){for(l=e[0],a=e[1],d=e[2],w=e[3],u=e[4],f=e[5],m=e[6],k=e[7],h=0;h<16;h++)W=i+h*4,r[h]=(t[W]&255)<<24|(t[W+1]&255)<<16|(t[W+2]&255)<<8|t[W+3]&255;for(h=16;h<64;h++)p=r[h-2],O=(p>>>17|p<<15)^(p>>>19|p<<13)^p>>>10,p=r[h-15],E=(p>>>7|p<<25)^(p>>>18|p<<14)^p>>>3,r[h]=(O+r[h-7]|0)+(E+r[h-16]|0);for(h=0;h<64;h++)O=(((u>>>6|u<<26)^(u>>>11|u<<21)^(u>>>25|u<<7))+(u&f^~u&m)|0)+(k+(N[h]+r[h]|0)|0)|0,E=((l>>>2|l<<30)^(l>>>13|l<<19)^(l>>>22|l<<10))+(l&a^l&d^a&d)|0,k=m,m=f,f=u,u=w+O|0,w=d,d=a,a=l,l=O+E|0;e[0]+=l,e[1]+=a,e[2]+=d,e[3]+=w,e[4]+=u,e[5]+=f,e[6]+=m,e[7]+=k,i+=64,c-=64}return i}class V{constructor(){this.digestLength=32,this.blockSize=64,this.state=new Int32Array(8),this.temp=new Int32Array(64),this.buffer=new Uint8Array(128),this.bufferLength=0,this.bytesHashed=0,this.finished=!1,this.reset()}reset(){return this.state[0]=1779033703,this.state[1]=3144134277,this.state[2]=1013904242,this.state[3]=2773480762,this.state[4]=1359893119,this.state[5]=2600822924,this.state[6]=528734635,this.state[7]=1541459225,this.bufferLength=0,this.bytesHashed=0,this.finished=!1,this}clean(){for(let e=0;e<this.buffer.length;e++)this.buffer[e]=0;for(let e=0;e<this.temp.length;e++)this.temp[e]=0;this.reset()}update(e,t=e.length){if(this.finished)throw new Error("SHA256: can't update because hash was finished.");let i=0;if(this.bytesHashed+=t,this.bufferLength>0){for(;this.bufferLength<64&&t>0;)this.buffer[this.bufferLength++]=e[i++],t--;this.bufferLength===64&&(I(this.temp,this.state,this.buffer,0,64),this.bufferLength=0)}for(t>=64&&(i=I(this.temp,this.state,e,i,t),t%=64);t>0;)this.buffer[this.bufferLength++]=e[i++],t--;return this}finish(e){if(!this.finished){const t=this.bytesHashed,i=this.bufferLength,c=t/536870912|0,l=t<<3,a=t%64<56?64:128;this.buffer[i]=128;for(let d=i+1;d<a-8;d++)this.buffer[d]=0;this.buffer[a-8]=c>>>24&255,this.buffer[a-7]=c>>>16&255,this.buffer[a-6]=c>>>8&255,this.buffer[a-5]=c>>>0&255,this.buffer[a-4]=l>>>24&255,this.buffer[a-3]=l>>>16&255,this.buffer[a-2]=l>>>8&255,this.buffer[a-1]=l>>>0&255,I(this.temp,this.state,this.buffer,0,a),this.finished=!0}for(let t=0;t<8;t++)e[t*4+0]=this.state[t]>>>24&255,e[t*4+1]=this.state[t]>>>16&255,e[t*4+2]=this.state[t]>>>8&255,e[t*4+3]=this.state[t]>>>0&255;return this}digest(){const e=new Uint8Array(this.digestLength);return this.finish(e),e}_saveState(e){for(let t=0;t<this.state.length;t++)e[t]=this.state[t]}_restoreState(e,t){for(let i=0;i<this.state.length;i++)this.state[i]=e[i];this.bytesHashed=t,this.finished=!1,this.bufferLength=0}}function F(r){const e=new V().update(new Uint8Array(r)),t=e.digest();return e.clean(),t}const J=j("WASM",function(r,e){const t=n(s.WebAssembly);if(!t)return;function i(y){const v=y instanceof Uint8Array?y:new Uint8Array(y),g=new s.Object;return g.alphabet="base64url",g.omitPadding=!0,v.toBase64(g)}function c(y){return r.then(({hashes:v})=>{if(!("crypto"in globalThis))return Promise.resolve(l(y));const g=a(y);return crypto.subtle.digest("SHA-256",g).then(A=>{const T=i(A);if(!v?.includes(T))throw new s.Error(`[WEBCAT] Unauthorized WebAssembly bytecode: ${T}`);return console.log(`[WEBCAT] Verified WASM (async) ${T}`),g})})}function l(y){const v=a(y),g=i(F(v));if(!e.data.hashes?.includes(g))throw new s.Error(`[WEBCAT] Unauthorized WebAssembly bytecode: ${g}`);return console.log(`[WEBCAT] Verified WASM (sync) ${g}`),v}function a(y){return s.ArrayBuffer.isView(y)?y.buffer.slice():y.slice()}const d=t.instantiate;function w(y,v,g){return y instanceof t.Module?d.call(this,y,v,g):c(y).then(A=>d.call(this,A,v,g))}b(w,t,"instantiate");const u=t.compile;function f(y,v){return c(y).then(g=>u.call(this,g,v))}b(f,t,"compile");const m=t.validate;function k(y){const v=l(y);return m.call(this,v)}b(k,t,"validate");const p=t.instantiateStreaming;function h(y,v,g){return s.Promise.resolve(y).then(A=>Promise.all([A.clone().arrayBuffer(),A.headers])).then(([A,T])=>Promise.all([c(A),T])).then(([A,T])=>p.call(this,new Response(A,{headers:T}),v,g))}b(h,t,"instantiateStreaming");const W=t.compileStreaming;function O(y,v){return s.Promise.resolve(y).then(g=>Promise.all([g.clone().arrayBuffer(),g.headers])).then(([g,A])=>Promise.all([c(g),A])).then(([g,A])=>W.call(this,new Response(g,{headers:A}),v))}b(O,t,"compileStreaming");const E=t.Module;function L(y){if(!(this instanceof L))throw new s.TypeError("[WEBCAT] Constructor WebAssembly.Module requires 'new'");const v=l(y);return new E(v)}const D=L;D.customSections=E.customSections.bind(E),D.exports=E.exports.bind(E),D.imports=E.imports.bind(E),b(D,t,"Module"),E.prototype.constructor=t.Module,t.Module.prototype=E.prototype,console.log("[WEBCAT] WebAssembly successfully hooked: all bytecode entry points now require authorization.")}),X=j("SharedWorker",function(r){if(!s.SharedWorker)return;const e=n(s.MessagePort),t=e.prototype.postMessage;function i(...k){if(o in n(this))if(n(this)[o].instance)t.call(n(this)[o].instance,...k);else{let p=k[1];if(p&&s.Symbol.iterator in p){const h=p;p=new s.Object,p.transfer=h}k[0]=s.structuredClone(k[0],p),n(this)[o].messages.push(k)}else t.call(this,...k)}b(i,e.prototype,"postMessage");const c=e.prototype.start;function l(){o in n(this)?n(this)[o].instance?c.call(n(this)[o].instance):n(this)[o].started=!0:c.call(this)}b(l,e.prototype,"start");const a=e.prototype.close;function d(){o in n(this)?n(this)[o].instance?a.call(n(this)[o].instance):n(this)[o].closed=!0:a.call(this)}b(d,e.prototype,"close"),C(e.prototype,"onmessage"),C(e.prototype,"onmessageerror");const w=n(s.SharedWorker);function u(...k){if(!(this instanceof u))throw new s.TypeError("SharedWorker constructor: 'new' is required");if(k.length===0)throw new s.TypeError("SharedWorker constructor: At least 1 argument required, but only 0 passed");const p=n(s.Object).create(w.prototype),h=n(s.Object).create(e.prototype);return h[o]=R({onmessage:null,messages:[],onmessageerror:null,started:!1,closed:!1}),p[o]=R({port:h,onerror:null}),r.then(({firstParty:W})=>{k[0]=`${k[0]}#${W}`,p[o].instance=new w(...k),p[o].instance[H]=p,x(p),h[o].instance=p[o].instance.port,h[o].instance[H]=h,x(h),h[o].started&&h[o].instance.start(),h[o].closed&&h[o].instance.close(),h[o].messages.forEach(O=>{h[o].instance?.postMessage(...O)})}),p}b(u,s,"SharedWorker"),w.prototype.constructor=n(s.SharedWorker),n(s).SharedWorker.prototype=w.prototype;const{get:f}=Object.getOwnPropertyDescriptor(w.prototype,"port");function m(){return o in this?this[o].port:f?.apply(this)}Object.defineProperty(w.prototype,"port",{get:b(m,s)}),C(w.prototype,"onerror")}),K=j("ServiceWorker",function(r,{data:e}){if(typeof e=="string")try{Object.hasOwn(s.top||{},"name");return}catch{}else if(e===!0)return;delete n((s.Navigator||s.WorkerNavigator||s.Object).prototype).serviceWorker,delete n(s).ServiceWorker,delete n(s).ServiceWorkerContainer,delete n(s).ServiceWorkerRegistration}),Q=j("Worker",function(r){if(!s.SharedWorker)return;const e=n(s.Worker),t=n(s.EventTarget),i=n(s.Reflect).construct.bind(n(s.Reflect));function c(...u){if(!(this instanceof c))throw new TypeError("Worker constructor: 'new' is required");if(u.length===0)throw new s.TypeError("Worker constructor: At least 1 argument required, but only 0 passed");const f=i(t,new s.Array,e);return f[o]=R({onmessage:null,messages:[],onerror:null}),r.then(({firstParty:m})=>{u[0]=`${u[0]}#${m}`,f[o].instance=new e(...u),f[o].instance[H]=f,f[o].terminated&&f[o].instance.terminate(),x(f),f[o].messages.forEach(k=>{f[o].instance?.postMessage(...k)})}),f}b(c,s,"Worker"),e.prototype.constructor=n(s.Worker),n(s).Worker.prototype=e.prototype;const l=e.prototype.postMessage;function a(...u){if(o in n(this))if(n(this)[o].instance)l.call(n(this)[o].instance,...u);else{let f=u[1];if(f&&s.Symbol.iterator in f){const m=f;f=new s.Object,f.transfer=m}u[0]=s.structuredClone(u[0],f),n(this)[o].messages.push(u)}else l.call(this,...u)}b(a,e.prototype,"postMessage");const d=e.prototype.terminate;function w(){o in n(this)?n(this)[o].instance?d.call(n(this)[o].instance):n(this)[o].terminated=!0:d.call(this)}b(w,e.prototype,"terminate"),C(e.prototype,"onmessage"),C(e.prototype,"onerror"),C(e.prototype,"onmessageerror")});console.log("[WEBCAT] Installing content script hook");const M="__DATA_PLACEHOLDER__";let S=window;for(;!S.location.protocol.startsWith("http")&&S.parent!==S;){try{Object.hasOwn(S.parent,"name")}catch{break}S=S.parent}S!==window?window.wrappedJSObject.WebAssembly=S.wrappedJSObject.WebAssembly:J(window,M),X(window,M),K(window,M),Q(window,M),z(window,M),G(window,M)})();

package/dist/lib/browser/chrome.d.ts

@@ -0,0 +1,86 @@
+/** @inline */
+type ColorScheme = "dark" | "light";
+/** Properties passed to {@link PathTemplate} functions. */
+export type PathTemplateProperties = {
+    /** The name of the resource. */
+    name: string;
+    /** The current color scheme of the browser. */
+    colorScheme: ColorScheme;
+};
+/**
+ * A template for a file path.
+ *
+ * @example
+ * const icons: PathTemplate = ({ name, colorScheme }) => `icons/${name}-${colorScheme}.png`;
+ */
+export type PathTemplate = (p: PathTemplateProperties) => string;
+/** @internal @inline */
+export type IconOptions = {
+    /** The name of the icon. */
+    name?: string;
+    /** The title displayed in the icon's tooltip. */
+    title?: string;
+    /** The popup page to display on click. */
+    popup?: {
+        name: string;
+        query?: string | URLSearchParams;
+        fragment?: string | URLSearchParams;
+    };
+};
+/** @internal @inline */
+export type BrowserChromeControllerConfig = {
+    /** Template for icon paths. */
+    iconPaths: PathTemplate;
+    /** Template for page paths. */
+    pagePaths: PathTemplate;
+};
+/**
+ * A class for interacting with browser chrome and extension internal pages.
+ */
+export declare class BrowserChromeController {
+    #private;
+    constructor(config: BrowserChromeControllerConfig);
+    /**
+     * Determines the browser color scheme currently in use.
+     *
+     * @returns The current color scheme.
+     */
+    getColorScheme(): ColorScheme;
+    /**
+     * Computes the URL of a named page.
+     *
+     * @param name The name of the page.
+     * @param options
+     * @returns The absolute URL of the page.
+     */
+    getPageURL(name: string, options?: {
+        query?: string | URLSearchParams;
+        fragment?: string | URLSearchParams;
+    }): string;
+    /**
+     * Displays an icon in the browser's URL bar.
+     *
+     * @param tabId The ID of the tab to display the icon in.
+     * @param options
+     */
+    showIcon(tabId: number, options?: IconOptions): Promise<void>;
+    /**
+     * Hides the icon shown on a specific tab.
+     *
+     * @param tabId The ID of the tab to hide the icon from.
+     */
+    hideIcon(tabId: number): Promise<void>;
+    /**
+     * Loads a named page in the specified tab.
+     *
+     * @param tabId The ID of the tab to load the page in.
+     * @param name The name of the page.
+     * @param options
+     */
+    loadPage(tabId: number, name: string, options?: {
+        replace?: boolean;
+        query?: string | URLSearchParams;
+        fragment?: string | URLSearchParams;
+    }): Promise<void>;
+}
+export {};

package/dist/lib/browser/chrome.js

@@ -0,0 +1,138 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var _iconPaths, _pagePaths;
+import permissions from "./permissions.js";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError2 = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __decoratorStart = (base) => [, , , __create(null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError2("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError2("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) fns[i].call(self);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var it, done, ctx, k = flags & 7, p = false;
+  var j = 0;
+  var extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (target = target.prototype, k < 5 && (k > 3 || !p) && __getOwnPropDesc(target, name));
+  __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    it = (0, decorators[i])(target, ctx), done._ = 1;
+    __expectFn(it) && (target = it);
+  }
+  return __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var _BrowserChromeController_decorators, _init;
+_BrowserChromeController_decorators = [permissions.require("tabs")];
+class BrowserChromeController {
+  constructor(config) {
+    __privateAdd(this, _iconPaths);
+    __privateAdd(this, _pagePaths);
+    __privateSet(this, _iconPaths, config.iconPaths);
+    __privateSet(this, _pagePaths, config.pagePaths);
+  }
+  /**
+   * Determines the browser color scheme currently in use.
+   *
+   * @returns The current color scheme.
+   */
+  getColorScheme() {
+    if (window.matchMedia("(prefers-color-scheme: dark)").matches) {
+      return "dark";
+    }
+    return "light";
+  }
+  /**
+   * Computes the URL of a named page.
+   *
+   * @param name The name of the page.
+   * @param options
+   * @returns The absolute URL of the page.
+   */
+  getPageURL(name, options) {
+    let url = browser.runtime.getURL(
+      __privateGet(this, _pagePaths).call(this, { name, colorScheme: this.getColorScheme() })
+    );
+    if (options?.query) {
+      url += `?${options.query.toString()}`;
+    }
+    if (options?.fragment) {
+      url += `#${options.fragment.toString()}`;
+    }
+    return url;
+  }
+  /**
+   * Displays an icon in the browser's URL bar.
+   *
+   * @param tabId The ID of the tab to display the icon in.
+   * @param options
+   */
+  async showIcon(tabId, options) {
+    if (tabId < 0) {
+      return;
+    }
+    if (options?.title) {
+      browser.pageAction.setTitle({ tabId, title: options.title });
+    }
+    if (options?.name) {
+      const path = __privateGet(this, _iconPaths).call(this, {
+        name: options.name,
+        colorScheme: this.getColorScheme()
+      });
+      await browser.pageAction.setIcon({ tabId, path });
+    }
+    if (options?.popup) {
+      const popup = this.getPageURL(options.popup.name, options.popup);
+      browser.pageAction.setPopup({ tabId, popup });
+    }
+    await browser.pageAction.show(tabId);
+  }
+  /**
+   * Hides the icon shown on a specific tab.
+   *
+   * @param tabId The ID of the tab to hide the icon from.
+   */
+  async hideIcon(tabId) {
+    await browser.pageAction.hide(tabId);
+  }
+  /**
+   * Loads a named page in the specified tab.
+   *
+   * @param tabId The ID of the tab to load the page in.
+   * @param name The name of the page.
+   * @param options
+   */
+  async loadPage(tabId, name, options) {
+    if (tabId < 0) {
+      return;
+    }
+    await browser.tabs.update(tabId, {
+      url: this.getPageURL(name, options),
+      loadReplace: options?.replace ?? false
+    });
+  }
+}
+_iconPaths = new WeakMap();
+_pagePaths = new WeakMap();
+_init = __decoratorStart();
+BrowserChromeController = __decorateElement(_init, 0, "BrowserChromeController", _BrowserChromeController_decorators, BrowserChromeController);
+__runInitializers(_init, 1, BrowserChromeController);
+export {
+  BrowserChromeController
+};

package/dist/lib/browser/kvstore.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Persistent key-value storage backed by the {@link browser.storage} API.
+ */
+export declare class KVStore {
+    /**
+     * Reads a persisted value.
+     *
+     * @param key The key to read.
+     * @param area The name of the {@link browser.storage.StorageArea | storage area} to read from.
+     * @returns A Promise that resolves to the value read.
+     */
+    get(key: string, area?: "local" | "session"): Promise<any>;
+    /**
+     * Stores values.
+     *
+     * @param items An object consisting of one or more key/value pairs to store.
+     * @param area The name of the {@link browser.storage.StorageArea | storage area} to use.
+     */
+    set(items: {
+        [key: string]: unknown;
+    }, area?: "local" | "session"): Promise<void>;
+    /**
+     * Clears all values whose key matches the specified prefix.
+     *
+     * @param prefix The prefix to match against.
+     * @param area The name of the {@link browser.storage.StorageArea | storage area} to use.
+     */
+    clear(prefix?: string, area?: "local" | "session"): Promise<void>;
+    /**
+     * Retrieves a list of stored keys matching the specified prefix.
+     *
+     * @param prefix The prefix to match against.
+     * @param area The name of the {@link browser.storage.StorageArea | storage area} to read from.
+     * @returns A Promise that resolves to an array of matching keys.
+     */
+    getKeys(prefix?: string, area?: "local" | "session"): Promise<string[]>;
+    /**
+     * Clears a single persisted value.
+     *
+     * @param key The key to clear.
+     * @param area The name of the {@link browser.storage.StorageArea | storage area} to use.
+     */
+    remove(key: string, area?: "local" | "session"): Promise<void>;
+}
+/**
+ * Namespaced key-value storage. Operations are atomic within
+ * an instance; distinct instances of the same namespace may
+ * access the same data in an unsafe manner.
+ */
+export declare class NamespacedKVStore implements KVStore {
+    #private;
+    /**
+     * @param namespace The namespace prefix to use for this store.
+     * @param store A backing {@link KVStore} instance to use for persistence.
+     */
+    constructor(namespace: string, store?: KVStore);
+    get(key: string, area?: "local" | "session"): Promise<any>;
+    set(items: {
+        [key: string]: unknown;
+    }, area?: "local" | "session"): Promise<void>;
+    clear(prefix?: string, area?: "local" | "session"): Promise<void>;
+    getKeys(prefix?: string, area?: "local" | "session"): Promise<string[]>;
+    remove(key: string, area?: "local" | "session"): Promise<void>;
+    /**
+     * Creates a new subnamespace within this namespace.
+     *
+     * @param namespace A new namespace prefix to append to the existing prefix.
+     */
+    namespace(namespace: string): NamespacedKVStore;
+}