@owear/core 0.1.2 → 0.1.4

package/dist/updater.js

@@ -0,0 +1,429 @@
+// Copyright 2026 Owear Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// @owear/core/src/updater.ts — autoUpdater (proceso principal).
+//
+// Estilo electron-updater pero para Owear:
+//   autoUpdater.checkForUpdates() · downloadUpdate() · quitAndInstall()
+//   autoUpdater.rollback() · commitUpdate() · armBootGuard()
+//   eventos: checking-for-update · update-available · update-not-available ·
+//            error · download-progress · update-downloaded
+//
+// Manifiesto YAML por canal (`<channel>.yml`, p. ej. latest.yml):
+//   version: 1.4.0
+//   releaseDate: '2026-09-29T…'
+//   notes: |
+//     …
+//   path: MiApp-1.4.0.bin
+//   sha256: <hex>            # integridad del artefacto
+//   sha512: <hex>
+//   size: 123456
+//   blockSize: 262144        # delta por bloques
+//   blockmap: https://…/MiApp-1.4.0.bin.blockmap
+//   signature: <base64>      # Ed25519 sobre "<version>:<sha256>" (metadata)
+//   binarySig: <base64>      # Ed25519 sobre los bytes del artefacto (payload)
+//
+// La firma se verifica con la clave pública del bridge (`updater.publicKey`).
+import { EventEmitter } from 'node:events';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { app } from './app.js';
+import { invokeNative } from './channel.js';
+import { parseYaml } from './updater/yaml.js';
+import { assemble, blockHashes, planDelta } from './updater/delta.js';
+import { bootRecordPath, nextBoot, readBoot, writeBoot } from './updater/boot.js';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function semverGt(a, b) {
+    const p = (s) => {
+        const core = s.replace(/^v/, '').split('-')[0];
+        const parts = core.split('.').map((n) => parseInt(n, 10) || 0);
+        while (parts.length < 3)
+            parts.push(0);
+        return parts;
+    };
+    const [x, y] = [p(a), p(b)];
+    for (let i = 0; i < 3; i++)
+        if (x[i] !== y[i])
+            return x[i] > y[i];
+    return false;
+}
+function isPrerelease(v) {
+    return v.replace(/^v/, '').includes('-');
+}
+function canonical(version, sha256) {
+    return Buffer.from(`${version}:${sha256}`);
+}
+const RETRYABLE = new Set([408, 425, 429, 500, 502, 503, 504]);
+class AutoUpdater extends EventEmitter {
+    currentVersion = app.getVersion();
+    channel = 'latest';
+    allowPrerelease = false;
+    autoDownload = true;
+    autoInstallOnAppQuit = true;
+    /** Nº de reintentos por petición (con backoff exponencial). */
+    maxRetries = 3;
+    /** Espera base entre reintentos (ms); se duplica cada intento. */
+    retryDelay = 800;
+    /** Timeout por petición (ms). */
+    requestTimeout = 60_000;
+    feed = null;
+    info = null;
+    newFile = '';
+    healthTimer = null;
+    setFeedURL(opts) {
+        this.feed = opts;
+        if (opts.channel)
+            this.channel = opts.channel;
+    }
+    manifestUrl() {
+        if (!this.feed)
+            throw new Error('autoUpdater.setFeedURL() primero');
+        const { provider = 'generic', url } = this.feed;
+        if (provider === 'github')
+            return `https://github.com/${url}/releases/latest/download/${this.channel}.yml`;
+        return `${url.replace(/\/+$/, '')}/${this.channel}.yml`;
+    }
+    publicKey() {
+        const pub = this.feed?.publicKey;
+        if (!pub)
+            return null;
+        try {
+            if (pub.includes('BEGIN'))
+                return crypto.createPublicKey(pub);
+            return crypto.createPublicKey({
+                key: Buffer.from(pub, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Verifica la firma Ed25519 del manifiesto (sobre `"<version>:<sha256>"`). */
+    verifyManifest(info) {
+        const key = this.publicKey();
+        if (!key)
+            return true; // sin clave pública: no se exige (pero sha256 sí)
+        if (!info.signature || !info.sha256)
+            return false;
+        try {
+            return crypto.verify(null, canonical(info.version, info.sha256), key, Buffer.from(info.signature, 'base64'));
+        }
+        catch {
+            return false;
+        }
+    }
+    backoff(attempt) {
+        const ms = Math.min(this.retryDelay * 2 ** (attempt - 1), 15_000) + Math.floor(Math.random() * 250);
+        return sleep(ms);
+    }
+    /**
+     * `fetch` con timeout y reintentos (backoff exponencial) para errores de red
+     * y estados transitorios. Devuelve la respuesta (incluidos 4xx no
+     * reintentables, para que el llamante dé un error concreto).
+     */
+    async request(url, init = {}, what = 'petición') {
+        let lastErr;
+        for (let attempt = 0;; attempt++) {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), this.requestTimeout);
+            try {
+                const res = await fetch(url, { ...init, signal: ctrl.signal });
+                if (RETRYABLE.has(res.status) && attempt < this.maxRetries) {
+                    // libera la conexión antes de reintentar (si no, se filtra el socket)
+                    await res.body?.cancel().catch(() => undefined);
+                    await this.backoff(attempt + 1);
+                    continue;
+                }
+                return res;
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt >= this.maxRetries)
+                    throw e;
+                await this.backoff(attempt + 1);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        throw lastErr instanceof Error ? lastErr : new Error(`${what} falló`);
+    }
+    async checkForUpdates() {
+        this.emit('checking-for-update');
+        try {
+            const res = await this.request(this.manifestUrl(), {}, 'manifiesto');
+            if (!res.ok)
+                throw new Error(`feed ${res.status} ${res.statusText}`);
+            const text = await res.text();
+            const doc = parseYaml(text);
+            if (!doc || typeof doc !== 'object')
+                throw new Error('manifiesto YAML inválido');
+            const version = String(doc.version ?? '');
+            const filePath = String(doc.path ?? '');
+            const base = this.manifestUrl().replace(/\/[^/]+$/, '');
+            const rawBlockmap = doc.blockmap != null ? String(doc.blockmap) : undefined;
+            const info = {
+                version,
+                notes: doc.notes != null ? String(doc.notes) : undefined,
+                releaseDate: doc.releaseDate != null ? String(doc.releaseDate) : undefined,
+                mandatory: doc.mandatory === true,
+                sha256: doc.sha256 != null ? String(doc.sha256) : undefined,
+                sha512: doc.sha512 != null ? String(doc.sha512) : undefined,
+                size: typeof doc.size === 'number' ? doc.size : undefined,
+                blockSize: typeof doc.blockSize === 'number' ? doc.blockSize : undefined,
+                // un blockmap relativo se resuelve contra el directorio del manifiesto
+                blockmap: rawBlockmap && !/^https?:\/\//i.test(rawBlockmap) ? `${base}/${rawBlockmap}` : rawBlockmap,
+                signature: doc.signature != null ? String(doc.signature) : undefined,
+                binarySig: doc.binarySig != null ? String(doc.binarySig) : undefined,
+                file: {
+                    url: `${base}/${filePath}`,
+                    sha256: doc.sha256 != null ? String(doc.sha256) : undefined,
+                },
+            };
+            if (!version)
+                throw new Error('manifiesto sin version');
+            if (!this.verifyManifest(info))
+                throw new Error('firma del manifiesto inválida');
+            // sin clave pública la firma es best-effort (documentado): no abortamos.
+            // Si hay clave, `verifyManifest` ya exigió `signature`.
+            this.info = info;
+            const isNew = semverGt(version, this.currentVersion);
+            const preBlocked = isPrerelease(version) && !this.allowPrerelease && !isPrerelease(this.currentVersion);
+            if (isNew && !preBlocked) {
+                this.emit('update-available', info);
+                if (this.autoDownload)
+                    void this.downloadUpdate().catch((e) => this.emit('error', e));
+                return { updateInfo: info };
+            }
+            this.emit('update-not-available', info);
+            return null;
+        }
+        catch (e) {
+            this.emit('error', e instanceof Error ? e : new Error(String(e)));
+            return null;
+        }
+    }
+    async fetchRange(url, r) {
+        const res = await this.request(url, { headers: { Range: `bytes=${r.start}-${r.end}` } }, 'rango');
+        if (res.status !== 206)
+            throw new Error(`el servidor no soporta Range (${res.status} al pedir ${r.start}-${r.end})`);
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.length !== r.end - r.start + 1)
+            throw new Error(`rango ${r.start}-${r.end}: recibidos ${buf.length} bytes`);
+        return buf;
+    }
+    /** Delta por bloques: blockmap + reutilización local + rangos. */
+    async downloadDelta(info, local) {
+        const bmRes = await this.request(info.blockmap, {}, 'blockmap');
+        if (!bmRes.ok)
+            throw new Error(`blockmap ${bmRes.status}`);
+        const bm = JSON.parse(await bmRes.text());
+        const plan = planDelta(blockHashes(local, bm.blockSize), bm.blocks, bm.blockSize, bm.size);
+        this.emit('download-progress', { total: plan.totalBytes, transferred: 0, percent: 0, bytesPerSecond: 0 });
+        const started = Date.now();
+        let done = 0;
+        const out = await assemble(local, bm.blocks, plan, bm.size, async (r) => {
+            const buf = await this.fetchRange(info.file.url, r);
+            done += buf.length;
+            const elapsed = (Date.now() - started) / 1000 || 0.001;
+            this.emit('download-progress', {
+                total: plan.totalBytes,
+                transferred: done,
+                percent: plan.totalBytes ? Math.round((done / plan.totalBytes) * 100) : 100,
+                bytesPerSecond: Math.round(done / elapsed),
+            });
+            return buf;
+        });
+        // cierre: el "100%" del delta es sobre los bloques descargados, no sobre el
+        // total del artefacto; al terminar lo reflejamos explícitamente.
+        const elapsed = (Date.now() - started) / 1000 || 0.001;
+        this.emit('download-progress', {
+            total: plan.totalBytes,
+            transferred: plan.totalBytes,
+            percent: 100,
+            bytesPerSecond: Math.round(plan.totalBytes / elapsed),
+        });
+        return out;
+    }
+    /**
+     * Descarga completa con **reanudación**: si la conexión cae a mitad, reintenta
+     * con `Range: bytes=<recibido>-` y continúa en vez de empezar de cero.
+     */
+    async downloadFull(info) {
+        const url = info.file.url;
+        const started = Date.now();
+        let chunks = [];
+        let got = 0;
+        let lastErr;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+            try {
+                const headers = {};
+                if (got > 0)
+                    headers.Range = `bytes=${got}-`;
+                const res = await this.request(url, { headers }, 'descarga');
+                if (!res.ok && res.status !== 206)
+                    throw new Error(`descarga ${res.status}`);
+                if (got > 0 && res.status !== 206) {
+                    chunks = [];
+                    got = 0; // el servidor ignoró el Range
+                }
+                const total = Number(res.headers.get('content-length') ?? 0) + got || info.size || 0;
+                const reader = res.body?.getReader();
+                if (!reader) {
+                    const buf = Buffer.from(await res.arrayBuffer());
+                    chunks.push(buf);
+                    got += buf.length;
+                    return Buffer.concat(chunks);
+                }
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    const b = Buffer.from(value);
+                    chunks.push(b);
+                    got += b.length;
+                    const elapsed = (Date.now() - started) / 1000 || 0.001;
+                    this.emit('download-progress', {
+                        total,
+                        transferred: got,
+                        percent: total ? Math.min(100, Math.round((got / total) * 100)) : 0,
+                        bytesPerSecond: Math.round(got / elapsed),
+                    });
+                }
+                return Buffer.concat(chunks);
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt >= this.maxRetries)
+                    break;
+                await this.backoff(attempt + 1); // continúa desde `got` (resume)
+            }
+        }
+        throw lastErr instanceof Error ? lastErr : new Error('descarga falló');
+    }
+    /** Descarga el update (delta si hay blockmap; si no, completa con resume). */
+    async downloadUpdate() {
+        const info = this.info;
+        if (!info)
+            throw new Error('checkForUpdates() primero');
+        const state = await invokeNative('updater', 'state').catch(() => ({}));
+        const dest = path.join(os.tmpdir(), `owear-update-${info.version}${path.extname(info.file.url) || '.bin'}`);
+        let local = Buffer.alloc(0);
+        if (info.blockmap && info.blockSize && state.exe) {
+            try {
+                local = fs.readFileSync(state.exe);
+            }
+            catch {
+                local = Buffer.alloc(0);
+            }
+        }
+        let data;
+        if (info.blockmap && info.blockSize && local.length > 0) {
+            try {
+                data = await this.downloadDelta(info, local);
+            }
+            catch {
+                // sin Range / blockmap inválido → descarga completa
+                data = await this.downloadFull(info);
+            }
+        }
+        else {
+            data = await this.downloadFull(info);
+        }
+        // Integridad (sha256; sha512 opcional) y firma del payload (binarySig).
+        if (info.sha256) {
+            const got = crypto.createHash('sha256').update(data).digest('hex');
+            if (got !== info.sha256)
+                throw new Error('sha256 del update no coincide');
+        }
+        if (info.sha512) {
+            const got = crypto.createHash('sha512').update(data).digest('hex');
+            if (got !== info.sha512)
+                throw new Error('sha512 del update no coincide');
+        }
+        if (info.binarySig) {
+            const key = this.publicKey();
+            if (key) {
+                const ok = crypto.verify(null, data, key, Buffer.from(info.binarySig, 'base64'));
+                if (!ok)
+                    throw new Error('firma del binario (binarySig) inválida');
+            }
+            // sin clave pública: best-effort (el sha256 ya garantiza integridad)
+        }
+        fs.writeFileSync(dest, data);
+        this.newFile = dest;
+        this.emit('update-downloaded', info);
+        if (this.autoInstallOnAppQuit) {
+            app.once('before-quit', () => void this.quitAndInstall().catch(() => undefined));
+        }
+        return [dest];
+    }
+    /**
+     * Aplica el update (reemplazo atómico + relaunch) vía el módulo nativo.
+     *
+     * El kernel se reemplaza a sí mismo y se re-ejecuta (`execv`) dentro de esta
+     * llamada, así que **no habrá respuesta**: la conexión cae. Lo tratamos como
+     * éxito (el proceso nuevo arranca con el binario actualizado).
+     */
+    async quitAndInstall(opts = {}) {
+        if (!this.newFile)
+            throw new Error('downloadUpdate() primero');
+        const backup = opts.backup !== false;
+        try {
+            await invokeNative('updater', 'apply', { path: this.newFile, backup });
+        }
+        catch {
+            // esperado: el proceso fue reemplazado y relanzado
+        }
+    }
+    /**
+     * Revierte al binario anterior (`<exe>.owprev`) y relanza. Solo tiene efecto
+     * si hay una copia de seguridad pendiente (p. ej. tras un update con backup).
+     */
+    async rollback() {
+        try {
+            await invokeNative('updater', 'rollback');
+        }
+        catch {
+            // el proceso fue reemplazado y relanzado
+        }
+    }
+    /** Confirma el update (borra la copia de seguridad) → desarma el rollback. */
+    async commitUpdate() {
+        if (this.healthTimer) {
+            clearTimeout(this.healthTimer);
+            this.healthTimer = null;
+        }
+        await invokeNative('updater', 'commit').catch(() => undefined);
+    }
+    /**
+     * Arma el **guard de arranque** tras un update: si el binario nuevo se
+     * reinicia sin llegar a "sano" (crash loop) más de `threshold` veces,
+     * revierte. Si arranca bien `healthDelayMs`, confirma (borra el backup).
+     *
+     *   app.whenReady().then(() => autoUpdater.armBootGuard())
+     */
+    async armBootGuard(opts = {}) {
+        const threshold = opts.threshold ?? 3;
+        const healthDelayMs = opts.healthDelayMs ?? 10_000;
+        const st = await invokeNative('updater', 'state').catch(() => ({}));
+        if (!st.hasRollback)
+            return 'idle'; // sin update pendiente
+        const file = bootRecordPath(app.getPath('userData'));
+        const next = nextBoot(readBoot(file), this.currentVersion, threshold);
+        if (next.shouldRollback) {
+            await this.rollback();
+            return 'rolled-back';
+        }
+        writeBoot(file, next.record);
+        this.healthTimer = setTimeout(() => void this.commitUpdate(), healthDelayMs);
+        this.healthTimer.unref?.();
+        return 'armed';
+    }
+}
+export const autoUpdater = new AutoUpdater();
+export { semverGt, isPrerelease };

package/dist/webcontents.d.ts

@@ -0,0 +1,44 @@
+import { EventEmitter } from 'node:events';
+import { NativeImage } from './nativeimage.js';
+export interface WindowOpenDetails {
+    url: string;
+}
+export type WindowOpenHandler = (details: WindowOpenDetails) => {
+    action: 'allow' | 'deny';
+    overrideBrowserWindowOptions?: Record<string, unknown>;
+} | void;
+/** Eventos de ventana → nombres estilo Electron de webContents. */
+export declare const WC_EVENT_NAMES: Record<string, string>;
+/** Eventos de ventana → nombres estilo Electron (dash) que emite BrowserWindow. */
+export declare const WIN_EVENT_NAMES: Record<string, string>;
+/**
+ * Vista del contenido web de una ventana (estilo Electron).
+ * Eventos: `did-finish-load`, `did-fail-load`, `did-start-navigation`,
+ * `did-navigate`, `page-title-updated`, `before-input-event`.
+ * `setWindowOpenHandler` controla `window.open`/`target=_blank`.
+ */
+export declare class WebContents extends EventEmitter {
+    private _windowId;
+    constructor(windowId?: number | null);
+    _setWindowId(id: number): void;
+    get id(): number;
+    /** Envía un evento SOLO a esta ventana (renderer: `ow.on(name, cb)`). */
+    send(name: string, payload?: unknown): Promise<void>;
+    loadURL(url: string): Promise<void>;
+    reload(): Promise<void>;
+    openDevTools(): Promise<void>;
+    getURL(): Promise<string>;
+    getTitle(): Promise<string>;
+    executeJavaScript<T = unknown>(js: string): Promise<T>;
+    /** Captura la página (PNG) como `NativeImage` (resizable, toPNG/toDataURL). */
+    capturePage(): Promise<NativeImage>;
+    /** Exporta la página a PDF (Buffer). */
+    printToPDF(_options?: Record<string, unknown>): Promise<Buffer>;
+    /** Abre el diálogo de impresión del sistema. */
+    print(_options?: Record<string, unknown>): void;
+    /**
+     * Controla `window.open`/`target=_blank`. Devuelve `{action:'deny'}` para
+     * bloquear o `{action:'allow'}` para permitir (por defecto).
+     */
+    setWindowOpenHandler(handler: WindowOpenHandler | null): void;
+}

package/dist/webcontents.js

@@ -0,0 +1,109 @@
+// Copyright 2026 Owear Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// @owear/core/src/webcontents.ts — objeto webContents (C3).
+import { EventEmitter } from 'node:events';
+import { channel, invokeNative } from './channel.js';
+import { nativeImage } from './nativeimage.js';
+/** Eventos de ventana → nombres estilo Electron de webContents. */
+export const WC_EVENT_NAMES = {
+    didFinishLoad: 'did-finish-load',
+    didFailLoad: 'did-fail-load',
+    navigationStarted: 'did-start-navigation',
+    loadCommitted: 'did-navigate',
+    pageTitleUpdated: 'page-title-updated',
+    beforeInput: 'before-input-event',
+};
+/** Eventos de ventana → nombres estilo Electron (dash) que emite BrowserWindow. */
+export const WIN_EVENT_NAMES = {
+    pageTitleUpdated: 'page-title-updated',
+    enterFullScreen: 'enter-full-screen',
+    leaveFullScreen: 'leave-full-screen',
+    alwaysOnTopChanged: 'always-on-top-changed',
+};
+let windowOpenHandler = null;
+channel.on('webContents.windowOpen', (params) => {
+    const { id, url } = params ?? {};
+    let action = 'allow';
+    try {
+        const r = windowOpenHandler?.({ url });
+        if (r && r.action === 'deny')
+            action = 'deny';
+    }
+    catch {
+        /* handler lanzó → allow */
+    }
+    void channel.call('webContents.respondWindowOpen', { id, action });
+});
+/**
+ * Vista del contenido web de una ventana (estilo Electron).
+ * Eventos: `did-finish-load`, `did-fail-load`, `did-start-navigation`,
+ * `did-navigate`, `page-title-updated`, `before-input-event`.
+ * `setWindowOpenHandler` controla `window.open`/`target=_blank`.
+ */
+export class WebContents extends EventEmitter {
+    _windowId;
+    constructor(windowId = null) {
+        super();
+        this._windowId = windowId;
+    }
+    _setWindowId(id) {
+        this._windowId = id;
+    }
+    get id() {
+        return this._windowId ?? -1;
+    }
+    /** Envía un evento SOLO a esta ventana (renderer: `ow.on(name, cb)`). */
+    send(name, payload) {
+        if (this._windowId == null)
+            return Promise.reject(new Error('ventana aún no creada'));
+        return channel.call('node.emit', { name, payload, windowId: this._windowId });
+    }
+    loadURL(url) {
+        return channel.call('window.loadURL', { windowId: this.id, url });
+    }
+    reload() {
+        return invokeNative('window', 'reload', this.id);
+    }
+    openDevTools() {
+        return invokeNative('window', 'openDevTools', this.id);
+    }
+    getURL() {
+        return invokeNative('window', 'getURL', this.id);
+    }
+    getTitle() {
+        return invokeNative('window', 'getTitle', this.id);
+    }
+    executeJavaScript(js) {
+        return channel.call('window.eval', { windowId: this.id, js });
+    }
+    /** Captura la página (PNG) como `NativeImage` (resizable, toPNG/toDataURL). */
+    async capturePage() {
+        const r = await channel.call('window.capturePage', {
+            windowId: this.id,
+            base64: true,
+        });
+        return nativeImage.createFromBuffer(Buffer.from(r.data, 'base64'));
+    }
+    /** Exporta la página a PDF (Buffer). */
+    async printToPDF(_options = {}) {
+        const r = await channel.call('window.printToPDF', {
+            windowId: this.id,
+        });
+        return Buffer.from(r.data, 'base64');
+    }
+    /** Abre el diálogo de impresión del sistema. */
+    print(_options = {}) {
+        void invokeNative('window', 'print', this.id).catch(() => undefined);
+    }
+    /**
+     * Controla `window.open`/`target=_blank`. Devuelve `{action:'deny'}` para
+     * bloquear o `{action:'allow'}` para permitir (por defecto).
+     */
+    setWindowOpenHandler(handler) {
+        windowOpenHandler = handler ?? null;
+        void channel
+            .call('webContents.setWindowOpenHandler', { windowId: this.id, enabled: !!handler })
+            .catch(() => undefined);
+    }
+}

package/dist/webrequest.d.ts

@@ -0,0 +1,23 @@
+export interface WebRequestDetails {
+    id: number;
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+}
+export type WebRequestResult = {
+    cancel?: boolean;
+    redirectURL?: string;
+} | void;
+export type WebRequestHandler = (details: WebRequestDetails) => WebRequestResult | Promise<WebRequestResult>;
+/**
+ * Intercepción de requests (webRequest). `onBeforeRequest` puede cancelar o
+ * redirigir. En **Windows** intercepta todos los requests; en **Linux** solo
+ * navegaciones (WebKitGTK 2.52 ya no expone `send-request` para subrecursos).
+ *
+ *   webRequest.onBeforeRequest({ urls: ['https://ads.example.com/w'] }, () => ({ cancel: true }))
+ */
+export declare const webRequest: {
+    onBeforeRequest(filter: {
+        urls?: string[];
+    } | string[], handler: WebRequestHandler): () => void;
+};

package/dist/webrequest.js

@@ -0,0 +1,76 @@
+// Copyright 2026 Owear Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// @owear/core/src/webrequest.ts — intercepción de requests (webRequest).
+import { channel } from './channel.js';
+import { app } from './index.js';
+const webRequestRegistrations = [];
+function globMatch(pattern, url) {
+    if (pattern === '<all_urls>' || pattern === '*')
+        return true;
+    const re = '^' +
+        pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*')
+            .replace(/\?/g, '.') +
+        '$';
+    try {
+        return new RegExp(re).test(url);
+    }
+    catch {
+        return false;
+    }
+}
+function webRequestPatterns() {
+    const set = new Set();
+    for (const r of webRequestRegistrations)
+        for (const p of r.patterns)
+            set.add(p);
+    return [...set];
+}
+function syncWebRequest() {
+    app
+        .whenReady()
+        .then(() => channel.call('webRequest.register', { urls: webRequestPatterns() }))
+        .catch(() => undefined);
+}
+channel.on('webRequest.request', (params) => {
+    const { id, url, method, headers } = params ?? {};
+    const matched = webRequestRegistrations.filter((r) => r.patterns.some((p) => globMatch(p, url)));
+    Promise.resolve()
+        .then(async () => {
+        for (const r of matched) {
+            const res = await r.handler({ id, url, method, headers: headers ?? {} });
+            if (res && (res.cancel || res.redirectURL))
+                return res;
+        }
+        return null;
+    })
+        .then((res) => channel.call('webRequest.respond', {
+        id,
+        cancel: !!(res && res.cancel),
+        redirectURL: res && res.redirectURL,
+    }))
+        .catch(() => channel.call('webRequest.respond', { id, cancel: false }));
+});
+/**
+ * Intercepción de requests (webRequest). `onBeforeRequest` puede cancelar o
+ * redirigir. En **Windows** intercepta todos los requests; en **Linux** solo
+ * navegaciones (WebKitGTK 2.52 ya no expone `send-request` para subrecursos).
+ *
+ *   webRequest.onBeforeRequest({ urls: ['https://ads.example.com/w'] }, () => ({ cancel: true }))
+ */
+export const webRequest = {
+    onBeforeRequest(filter, handler) {
+        const patterns = Array.isArray(filter) ? filter : filter?.urls ?? ['<all_urls>'];
+        const reg = { patterns, handler };
+        webRequestRegistrations.push(reg);
+        syncWebRequest();
+        return () => {
+            const i = webRequestRegistrations.indexOf(reg);
+            if (i >= 0)
+                webRequestRegistrations.splice(i, 1);
+            syncWebRequest();
+        };
+    },
+};