@parall/daemon 1.44.0 → 1.46.0

package/dist/cli.js

@@ -1,9 +1,11 @@
-import { execSync, spawn } from 'node:child_process';
+import { execFileSync, execSync, spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { daemonConfigDir, daemonConfigPath } from './config.js';
+import { WIN_TASK_NAME, buildLauncherCjs, buildLauncherVbs, buildTaskXml, encodeUtf16LeBom, winServicePaths, } from './win-service.js';
+import { probePidIdentity, queryTaskDisabled, queryTaskExists, readTrackedPid, stopDaemonWindows, uninstallDaemonWindows, } from './win-lifecycle.js';
 const CONFIG_DIR = daemonConfigDir();
 const CONFIG_PATH = daemonConfigPath();
 function readConfig() {
@@ -34,6 +36,188 @@ function isMacOS() {
 function isLinux() {
     return process.platform === 'linux';
 }
+function isWindows() {
+    return process.platform === 'win32';
+}
+// ---- Windows (Task Scheduler) service management ----
+// Artifact generation lives in win-service.ts (pure strings); the
+// stop/uninstall/probe state machines live in win-lifecycle.ts with
+// injected exec/fs (fail-closed contract + unit tests). This section binds
+// the real execFileSync/fs and owns install-time writes. All external
+// commands run through argv arrays — no shell, so spaces / non-ASCII in
+// %USERPROFILE% paths never need quoting here.
+const SLEEP_SIGNAL = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+    Atomics.wait(SLEEP_SIGNAL, 0, 0, ms);
+}
+/**
+ * Real-command binding for win-lifecycle: capture the exit code, never throw.
+ *
+ * Every call is bounded. schtasks talks to the Task Scheduler service over RPC
+ * and powershell.exe loads CIM — either can hang (a wedged service, a stalled
+ * WMI provider), and an unbounded execFileSync would block `stop` / `status` /
+ * `uninstall` forever with no way out. A timeout kills the child and surfaces
+ * as status=null → spawnError → 'indeterminate', which the fail-closed
+ * lifecycle already handles correctly (state is kept, exit is non-zero).
+ */
+const WIN_CMD_TIMEOUT_MS = 20_000;
+function runWinCmd(file, args) {
+    try {
+        const stdout = execFileSync(file, args, {
+            encoding: 'utf8',
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: WIN_CMD_TIMEOUT_MS,
+        });
+        return { code: 0, stdout };
+    }
+    catch (err) {
+        const e = err;
+        const code = typeof e.status === 'number' ? e.status : null;
+        return {
+            code,
+            stdout: String(e.stdout ?? ''),
+            spawnError: code === null ? String(e.message ?? err) : undefined,
+        };
+    }
+}
+function winDeps() {
+    return {
+        run: runWinCmd,
+        fs: {
+            readFile(p) {
+                try {
+                    return fs.readFileSync(p, 'utf8');
+                }
+                catch {
+                    return null;
+                }
+            },
+            unlink(p) {
+                try {
+                    fs.unlinkSync(p);
+                    return true;
+                }
+                catch (err) {
+                    return err.code === 'ENOENT';
+                }
+            },
+        },
+        paths: winServicePaths(os.homedir()),
+        sleep: sleepSync,
+        now: () => Date.now(),
+    };
+}
+function reportWinProblems(problems) {
+    for (const problem of problems) {
+        console.error(`ERROR: ${problem}`);
+    }
+    console.error('State was left in place so nothing is orphaned; fix the cause and retry.');
+}
+function installServiceWindows() {
+    let npmEntry;
+    try {
+        npmEntry = fs.realpathSync(process.argv[1] ?? '');
+    }
+    catch {
+        console.error('Cannot resolve the daemon entry script; reinstall with `npm install -g @parall/daemon`.');
+        process.exit(1);
+    }
+    if (/[\\/]_npx[\\/]/.test(npmEntry)) {
+        console.warn('Warning: installing from an npx cache path. Run `npm install -g @parall/daemon` and re-run\n' +
+            '`parall-daemon service install`, or the service breaks when the npx cache is pruned\n' +
+            '(a completed self-update heals this by switching to the overlay bundle).');
+    }
+    const p = winServicePaths(os.homedir());
+    fs.mkdirSync(p.serviceDir, { recursive: true });
+    fs.mkdirSync(p.logDir, { recursive: true });
+    fs.writeFileSync(p.launcherCjs, buildLauncherCjs({
+        npmEntry,
+        overlayEntry: p.overlayEntry,
+        pidFile: p.pidFile,
+        logFile: p.logFile,
+    }));
+    // Pre-.cjs installs wrote a .js launcher; remove it so nothing stale can
+    // be referenced or mistaken for the active artifact.
+    try {
+        fs.unlinkSync(p.legacyLauncherJs);
+    }
+    catch { }
+    const wscriptExe = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'wscript.exe');
+    fs.writeFileSync(p.launcherVbs, encodeUtf16LeBom(buildLauncherVbs({ nodeExe: process.execPath, launcherCjs: p.launcherCjs })));
+    fs.writeFileSync(p.taskXml, encodeUtf16LeBom(buildTaskXml({ wscriptExe, launcherVbs: p.launcherVbs })));
+    // /F replaces an existing task; without it schtasks prompts interactively
+    // and a scripted install hangs.
+    const create = runWinCmd('schtasks', ['/Create', '/TN', WIN_TASK_NAME, '/XML', p.taskXml, '/F']);
+    if (create.code !== 0) {
+        console.error(`ERROR: could not register the Task Scheduler task (schtasks /Create exit ${create.code ?? 'spawn-failed'}).`);
+        console.error(`       Task XML: ${p.taskXml}`);
+        process.exit(1);
+    }
+    // `/Run` triggers the task; it does not wait for the daemon, and install
+    // deliberately does not wait either. A healthy first launch may self-update
+    // and exit(42), which Task Scheduler only re-runs ~1 minute later
+    // (RestartOnFailure PT1M) — so any short liveness window here would report a
+    // perfectly good install as a failure. Registering + triggering is what this
+    // command owns; runtime health is `parall-daemon status` / `logs`.
+    const run = runWinCmd('schtasks', ['/Run', '/TN', WIN_TASK_NAME]);
+    if (run.code !== 0) {
+        console.error(`ERROR: the task registered but would not start (schtasks /Run exit ${run.code ?? 'spawn-failed'}).`);
+        console.error(`       Start it from Task Scheduler, or check ${p.logFile}.`);
+        process.exit(1);
+    }
+    console.log(`Task Scheduler task installed: ${WIN_TASK_NAME} (artifacts in ${p.serviceDir})`);
+    console.log('Task registered and triggered. Check `parall-daemon status` for the daemon itself.');
+    console.log(`Logs: ${p.logFile}`);
+}
+function stopWindows() {
+    const result = stopDaemonWindows(winDeps());
+    if (!result.ok) {
+        reportWinProblems(result.problems);
+        process.exit(1);
+    }
+    console.log('Daemon stopped (Task Scheduler task disabled). Re-arm with `parall-daemon service install`.');
+}
+function statusWindows() {
+    const deps = winDeps();
+    const exists = queryTaskExists(deps);
+    if (exists === 'indeterminate') {
+        console.log('Service: unknown (schtasks query failed)');
+    }
+    else if (!exists) {
+        console.log('Service: not installed');
+    }
+    else {
+        const disabled = queryTaskDisabled(deps);
+        const suffix = disabled === true ? ', disabled' : disabled === 'indeterminate' ? ', state unknown' : '';
+        console.log(`Service: installed${suffix} (Task Scheduler: ${WIN_TASK_NAME})`);
+    }
+    const pid = readTrackedPid(deps);
+    if (pid === null) {
+        console.log('Daemon: stopped');
+        return;
+    }
+    switch (probePidIdentity(deps, pid)) {
+        case 'daemon':
+            console.log('Daemon: running');
+            console.log(`PID: ${pid}`);
+            break;
+        case 'not-daemon':
+            console.log('Daemon: stopped (stale pidfile)');
+            break;
+        case 'indeterminate':
+            console.log(`Daemon: unknown (could not verify pid ${pid} — process query failed)`);
+            break;
+    }
+}
+function serviceUninstallWindows() {
+    const result = uninstallDaemonWindows(winDeps());
+    if (!result.ok) {
+        reportWinProblems(result.problems);
+        process.exit(1);
+    }
+    console.log('Task Scheduler task uninstalled (logs kept).');
+}
 const PLIST_LABEL = 'com.parall.daemon';
 function plistPath() {
     return path.join(os.homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);
@@ -102,11 +286,20 @@ RestartSec=5
 WantedBy=default.target`;
 }
 function installService() {
+    // A service-managed daemon (launchd / systemd / Task Scheduler) never
+    // inherits the installing shell's environment, so config.json is its only
+    // credential channel. `init` writes it; `service install` requires it.
     const config = readConfig();
     if (!config) {
         console.error('No config found. Run `parall-daemon init` first.');
         process.exit(1);
     }
+    if (isWindows()) {
+        // Windows resolves its own entry (realpath of argv[1]); `which` in
+        // getDaemonBin is POSIX-only.
+        installServiceWindows();
+        return;
+    }
     const bin = getDaemonBin();
     if (isMacOS()) {
         const dir = path.dirname(plistPath());
@@ -147,6 +340,10 @@ async function cmdInit() {
 function cmdStatus() {
     const config = readConfig();
     console.log(`Config: ${config ? CONFIG_PATH : 'not configured'}`);
+    if (isWindows()) {
+        statusWindows();
+        return;
+    }
     if (isMacOS()) {
         try {
             const output = execSync(`launchctl print gui/$(id -u)/${PLIST_LABEL} 2>&1`, {
@@ -173,6 +370,10 @@ function cmdStatus() {
     }
 }
 function cmdStop() {
+    if (isWindows()) {
+        stopWindows();
+        return;
+    }
     if (isMacOS()) {
         execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`, {
             stdio: 'inherit',
@@ -191,6 +392,28 @@ function cmdLogs(lines) {
         child.on('exit', (code) => process.exit(code ?? 0));
         return;
     }
+    if (isWindows()) {
+        const p = winServicePaths(os.homedir());
+        if (!fs.existsSync(p.logFile)) {
+            console.log('No log file found at', p.logFile);
+            return;
+        }
+        // The path is handed to PowerShell through the ENVIRONMENT, never through
+        // the script text: `$env:` expansion happens after parsing, so no quoting
+        // scheme (and no backtick / $() sequence in a profile path) can alter the
+        // command. -LiteralPath additionally stops `[ ]` being read as a wildcard.
+        // `lines` is dispatch-validated, but re-derive an integer here so this call
+        // site is provably interpolation-free on its own.
+        const tailCount = Number.parseInt(lines, 10);
+        const tail = Number.isInteger(tailCount) && tailCount > 0 ? tailCount : 50;
+        const child = spawn('powershell.exe', [
+            '-NoProfile',
+            '-Command',
+            `Get-Content -LiteralPath $env:PRLL_DAEMON_LOG_PATH -Tail ${tail} -Wait`,
+        ], { stdio: 'inherit', env: { ...process.env, PRLL_DAEMON_LOG_PATH: p.logFile } });
+        child.on('exit', (code) => process.exit(code ?? 0));
+        return;
+    }
     const logPath = path.join(os.homedir(), 'Library', 'Logs', 'parall-daemon.log');
     if (!fs.existsSync(logPath)) {
         console.log('No log file found at', logPath);
@@ -200,6 +423,10 @@ function cmdLogs(lines) {
     child.on('exit', (code) => process.exit(code ?? 0));
 }
 function cmdServiceUninstall() {
+    if (isWindows()) {
+        serviceUninstallWindows();
+        return;
+    }
     if (isMacOS()) {
         execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`);
         if (fs.existsSync(plistPath()))
@@ -269,7 +496,7 @@ Usage:
   parall-daemon stop               Stop the background service
   parall-daemon update [--check]   Check for / apply daemon updates
   parall-daemon logs [-n LINES]    Tail daemon logs
-  parall-daemon service install    Install as background service (launchd/systemd)
+  parall-daemon service install    Install as background service (launchd/systemd/Task Scheduler)
   parall-daemon service uninstall  Uninstall background service
   parall-daemon help               Show this help
 `.trim());

package/dist/clip-runtime/browser-cdp.d.ts

@@ -0,0 +1,40 @@
+export declare class BrowserCdpClient {
+    private readonly socket;
+    private nextId;
+    private readonly pending;
+    private closed;
+    private constructor();
+    /**
+     * Connect to the browser-level CDP endpoint behind host:port (`/json/version`).
+     * `timeoutMs` bounds BOTH the /json/version fetch and the websocket handshake —
+     * injectable so tests can force a fast timeout against a hung server, and so a
+     * caller with a wall-clock budget can hand down its remaining budget.
+     */
+    static connect(host: string, port: number, timeoutMs?: number): Promise<BrowserCdpClient>;
+    /** Send a browser-level CDP command and await its result. */
+    command<T>(method: string, params?: Record<string, unknown>): Promise<T>;
+    close(): void;
+    private onMessage;
+    private failAll;
+}
+/** The browserContextId owning a page target (empty for the default context). */
+export declare function targetBrowserContextId(cdp: BrowserCdpClient, targetId: string): Promise<string>;
+/**
+ * The full cookie jar of a BrowserContext (HttpOnly included) as CDP
+ * `Network.Cookie` objects — the capture side of cookie-preserving proxy
+ * reconciliation.
+ */
+export declare function getContextCookies(cdp: BrowserCdpClient, browserContextId: string): Promise<Array<Record<string, unknown>>>;
+/** Restore a captured jar into a (fresh) BrowserContext. */
+export declare function setContextCookies(cdp: BrowserCdpClient, browserContextId: string, cookies: Array<Record<string, unknown>>): Promise<void>;
+/**
+ * Map a CDP `Network.Cookie` (as returned by Storage.getCookies) to a
+ * `Network.CookieParam` accepted by Storage.setCookies. Allowlisted fields only:
+ * read-side extras (`size`, `session`, `sameParty`, …) are not valid params. A
+ * session cookie (session=true / expires=-1) is restored WITHOUT `expires`,
+ * which is exactly what makes it a session cookie again. This is
+ * higher-fidelity than bb-browser's own account-JSON persistence (which drops
+ * `sameSite=None` and partition keys).
+ */
+export declare function toCookieParam(cookie: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=browser-cdp.d.ts.map

package/dist/clip-runtime/browser-cdp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-cdp.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-cdp.ts"],"names":[],"mappings":"AAyCA,qBAAa,gBAAgB;IAKP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ3C,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,MAAM,CAAS;IAEvB,OAAO;IAOP;;;;;OAKG;WACU,OAAO,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,SAAqB,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IAgD5B,6DAA6D;IAC7D,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA0B5E,KAAK,IAAI,IAAI;IAUb,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,OAAO;CAOhB;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,gBAAgB,EACrB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAMzC;AAED,4DAA4D;AAC5D,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,gBAAgB,EACrB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBtF"}

package/dist/clip-runtime/browser-cdp.js

@@ -0,0 +1,218 @@
+import WebSocket from 'ws';
+/**
+ * Minimal browser-level CDP client — Parall's direct line to the Chromium that
+ * bb-browser manages, for the few operations bb-browser's HTTP surface cannot
+ * express (bb-browser is off-limits for changes; Chrome accepts multiple CDP
+ * clients on the browser endpoint, and Parall already consumes CDP directly for
+ * the live viewer's page websockets + /json/activate).
+ *
+ * Used for cookie-preserving proxy reconciliation: `Storage.getCookies` /
+ * `Storage.setCookies` against a specific browserContextId — the full jar
+ * including HttpOnly cookies, which no page-level API can read — and
+ * `Target.getTargetInfo` to map an owned tab to its BrowserContext.
+ */
+const CONNECT_TIMEOUT_MS = 5_000;
+const COMMAND_TIMEOUT_MS = 10_000;
+/**
+ * Force-close a socket that never finished connecting WITHOUT risking an
+ * unhandled 'error'. Once the connect Promise has removed its own error listener,
+ * a bare `terminate()` on a half-open handshake can still emit 'error'
+ * (ECONNRESET / abort) with no listener attached — which Node re-raises as an
+ * uncaughtException that crashes the daemon. Attach a permanent no-op error sink
+ * first, then terminate; swallow a synchronous throw from an already-dead socket.
+ */
+function safeTerminate(socket) {
+    socket.on('error', () => { });
+    try {
+        socket.terminate();
+    }
+    catch {
+        // terminate() on an already-closed socket can throw synchronously — ignore.
+    }
+}
+export class BrowserCdpClient {
+    socket;
+    nextId = 1;
+    pending = new Map();
+    closed = false;
+    constructor(socket) {
+        this.socket = socket;
+        socket.on('message', (data) => this.onMessage(data));
+        const fail = (reason) => this.failAll(new Error(reason));
+        socket.on('close', () => fail('CDP browser connection closed'));
+        socket.on('error', (err) => fail(`CDP browser connection error: ${String(err)}`));
+    }
+    /**
+     * Connect to the browser-level CDP endpoint behind host:port (`/json/version`).
+     * `timeoutMs` bounds BOTH the /json/version fetch and the websocket handshake —
+     * injectable so tests can force a fast timeout against a hung server, and so a
+     * caller with a wall-clock budget can hand down its remaining budget.
+     */
+    static async connect(host, port, timeoutMs = CONNECT_TIMEOUT_MS) {
+        const resp = await fetch(`http://${host}:${port}/json/version`, {
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!resp.ok) {
+            throw new Error(`CDP /json/version returned ${resp.status}`);
+        }
+        const info = (await resp.json());
+        if (!info.webSocketDebuggerUrl) {
+            throw new Error('CDP /json/version did not report a webSocketDebuggerUrl');
+        }
+        const socket = new WebSocket(info.webSocketDebuggerUrl);
+        await new Promise((resolve, reject) => {
+            // Explicit single-settle guard: whichever of open / error / timeout fires
+            // first wins and the others are no-ops. cleanup() also removes the listeners,
+            // but the flag makes the invariant obvious and covers a synchronous re-entry.
+            let settled = false;
+            const cleanup = () => {
+                clearTimeout(timer);
+                socket.removeListener('open', onOpen);
+                socket.removeListener('error', onError);
+            };
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                fn();
+            };
+            const onOpen = () => settle(resolve);
+            const onError = (err) => settle(() => {
+                safeTerminate(socket); // free the fd without a later unhandled 'error'
+                reject(err instanceof Error ? err : new Error(String(err)));
+            });
+            const timer = setTimeout(() => settle(() => {
+                safeTerminate(socket); // stop the pending connect + free the fd
+                reject(new Error('CDP browser websocket connect timed out'));
+            }), timeoutMs);
+            socket.once('open', onOpen);
+            socket.once('error', onError);
+        });
+        return new BrowserCdpClient(socket);
+    }
+    /** Send a browser-level CDP command and await its result. */
+    command(method, params = {}) {
+        if (this.closed)
+            return Promise.reject(new Error('CDP client is closed'));
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`CDP ${method} timed out`));
+            }, COMMAND_TIMEOUT_MS);
+            this.pending.set(id, {
+                resolve: resolve,
+                reject,
+                timer,
+            });
+            this.socket.send(JSON.stringify({ id, method, params }), (err) => {
+                if (err) {
+                    const entry = this.pending.get(id);
+                    if (entry) {
+                        clearTimeout(entry.timer);
+                        this.pending.delete(id);
+                        reject(err);
+                    }
+                }
+            });
+        });
+    }
+    close() {
+        this.closed = true;
+        this.failAll(new Error('CDP client closed'));
+        try {
+            this.socket.close();
+        }
+        catch {
+            /* already closed */
+        }
+    }
+    onMessage(data) {
+        let parsed;
+        try {
+            parsed = JSON.parse(String(data));
+        }
+        catch {
+            return; // not a JSON frame we understand — ignore (events etc.)
+        }
+        if (typeof parsed.id !== 'number')
+            return; // CDP event, not a command reply
+        const entry = this.pending.get(parsed.id);
+        if (!entry)
+            return;
+        this.pending.delete(parsed.id);
+        clearTimeout(entry.timer);
+        if (parsed.error) {
+            entry.reject(new Error(parsed.error.message || 'CDP command failed'));
+        }
+        else {
+            entry.resolve(parsed.result ?? {});
+        }
+    }
+    failAll(err) {
+        for (const [id, entry] of this.pending) {
+            this.pending.delete(id);
+            clearTimeout(entry.timer);
+            entry.reject(err);
+        }
+    }
+}
+/** The browserContextId owning a page target (empty for the default context). */
+export async function targetBrowserContextId(cdp, targetId) {
+    const { targetInfo } = await cdp.command('Target.getTargetInfo', { targetId });
+    return targetInfo?.browserContextId ?? '';
+}
+/**
+ * The full cookie jar of a BrowserContext (HttpOnly included) as CDP
+ * `Network.Cookie` objects — the capture side of cookie-preserving proxy
+ * reconciliation.
+ */
+export async function getContextCookies(cdp, browserContextId) {
+    const { cookies } = await cdp.command('Storage.getCookies', { browserContextId });
+    return cookies ?? [];
+}
+/** Restore a captured jar into a (fresh) BrowserContext. */
+export async function setContextCookies(cdp, browserContextId, cookies) {
+    if (cookies.length === 0)
+        return;
+    await cdp.command('Storage.setCookies', {
+        cookies: cookies.map(toCookieParam),
+        browserContextId,
+    });
+}
+/**
+ * Map a CDP `Network.Cookie` (as returned by Storage.getCookies) to a
+ * `Network.CookieParam` accepted by Storage.setCookies. Allowlisted fields only:
+ * read-side extras (`size`, `session`, `sameParty`, …) are not valid params. A
+ * session cookie (session=true / expires=-1) is restored WITHOUT `expires`,
+ * which is exactly what makes it a session cookie again. This is
+ * higher-fidelity than bb-browser's own account-JSON persistence (which drops
+ * `sameSite=None` and partition keys).
+ */
+export function toCookieParam(cookie) {
+    const out = {
+        name: cookie.name,
+        value: cookie.value,
+        domain: cookie.domain,
+        path: cookie.path,
+    };
+    if (typeof cookie.secure === 'boolean')
+        out.secure = cookie.secure;
+    if (typeof cookie.httpOnly === 'boolean')
+        out.httpOnly = cookie.httpOnly;
+    if (typeof cookie.sameSite === 'string')
+        out.sameSite = cookie.sameSite;
+    if (typeof cookie.expires === 'number' && cookie.expires > 0 && cookie.session !== true) {
+        out.expires = cookie.expires;
+    }
+    if (typeof cookie.priority === 'string')
+        out.priority = cookie.priority;
+    if (typeof cookie.sourceScheme === 'string')
+        out.sourceScheme = cookie.sourceScheme;
+    if (typeof cookie.sourcePort === 'number')
+        out.sourcePort = cookie.sourcePort;
+    if (cookie.partitionKey !== undefined)
+        out.partitionKey = cookie.partitionKey;
+    return out;
+}