@volter/tabnode 0.5.21 → 0.5.23

package/dist/__sw__.js

@@ -1,48 +1,123 @@
 /**
  * Service Worker for Mini WebContainers
  * Intercepts fetch requests and routes them to virtual servers
- * Version: 15 - cleanup: extract helpers, gate debug logs, remove test endpoints
+ * Version: 16 - a host per page: each page's channel, servers and preview are its own
  */
 
 const DEBUG = false;
 
-// Communication port with main thread
-let mainPort = null;
+// Every page that holds a container's servers is a host of its own: its own
+// channel, its own servers, its own preview. Two pages of one origin, each
+// with its container, share this worker and never each other's ports. A host
+// is keyed by the id of the window that sent `init`.
+const hosts = new Map();
+let latestHost = null;
+// The documents and workers a host's servers made, by client id, so their
+// requests reach the host that served them.
+const clientHosts = new Map();
+// The event a request arrived with, so every route to a server can ask which
+// host it is for without the event being passed along.
+const requestEvents = new WeakMap();
+
+function openHost(id, channel) {
+  const previous = hosts.get(id);
+  if (previous) {
+    for (const pending of pendingRequests.values()) {
+      if (pending.host === previous && pending.flowControl === 1) pending.fail(new Error('Host connection replaced'));
+    }
+    for (const upload of controlledUploads) {
+      if (upload.host === previous) upload.controller.abort(new Error('Host connection replaced'));
+    }
+    previous.port.onmessage = null;
+    previous.port.close();
+  }
+  const host = {
+    id,
+    port: channel,
+    registeredPorts: new Set(),
+    flowControlledPorts: new Map(),
+    primaryPort: null,
+    ownDocuments: new Set(),
+  };
+  hosts.set(id, host);
+  latestHost = host;
+  void pruneClients();
+  return host;
+}
+
+/** The host a client belongs to: a host's own window, or a document or worker one of its servers made. */
+function ownerOf(clientId) {
+  if (!clientId) return null;
+  return hosts.get(clientId) ?? hosts.get(clientHosts.get(clientId)) ?? null;
+}
+
+/**
+ * The host a request is for. One host is the answer while there is one. With
+ * more, the requesting client's own host; else the host that owns the
+ * document named by the referrer, which is how a frame's navigation carries
+ * its parent; else the only host holding the port; else the latest host.
+ */
+async function hostForEvent(event, port) {
+  if (hosts.size === 0) return null;
+  if (hosts.size === 1) return hosts.values().next().value;
+  const direct = ownerOf(event.clientId);
+  if (direct) return direct;
+  const referrer = event.request.referrer;
+  if (referrer) {
+    const all = await self.clients.matchAll({ type: 'all', includeUncontrolled: true });
+    const owners = new Set(all.filter((client) => client.url === referrer).map((client) => ownerOf(client.id)).filter(Boolean));
+    if (owners.size === 1) return owners.values().next().value;
+  }
+  if (port !== undefined) {
+    const holding = [...hosts.values()].filter((host) => host.registeredPorts.has(port));
+    if (holding.length === 1) return holding[0];
+  }
+  return latestHost;
+}
+
+/** The host a request is for, found through the event it arrived with; remembers the clients it makes. */
+async function hostForRequest(request, port) {
+  const event = requestEvents.get(request);
+  const host = event ? await hostForEvent(event, port) : latestHost;
+  if (host && event) {
+    if (event.resultingClientId) clientHosts.set(event.resultingClientId, host.id);
+    if (event.clientId && !hosts.has(event.clientId)) clientHosts.set(event.clientId, host.id);
+  }
+  return host;
+}
 
 // Pending requests waiting for response
 const pendingRequests = new Map();
 let requestId = 0;
 
-// Registered virtual server ports
-const registeredPorts = new Set();
 // HTTP response flow control is a transport property, never a path/package
-// heuristic. Legacy ports keep their existing protocol until their host opts in.
-const flowControlledPorts = new Map();
+// heuristic. Legacy ports keep their existing protocol until their host opts
+// in; each host's `flowControlledPorts` holds what its ports negotiated.
 const controlledUploads = new Set();
 const MAX_STREAM_CHUNK_BYTES = 65536;
 
-function updateFlowControl(type, data) {
+function updateFlowControl(host, type, data) {
   if (type === 'server-registered' || type === 'server-unregistered') {
     for (const upload of controlledUploads) {
-      if (upload.port === data?.port) upload.controller.abort(new Error('Virtual server registration changed'));
+      if (upload.host === host && upload.port === data?.port) upload.controller.abort(new Error('Virtual server registration changed'));
     }
     // A port number is not a listener identity. Rebinding must terminate the
     // old connection, even when the replacement advertises identical limits.
     // Otherwise an already-headed response can wait forever on its old owner.
     for (const pending of pendingRequests.values()) {
-      if (pending.flowControl === 1 && pending.port === data?.port)
+      if (pending.host === host && pending.flowControl === 1 && pending.port === data?.port)
         pending.fail(new Error(type === 'server-unregistered'
           ? 'Virtual server closed' : 'Virtual server registration changed'));
     }
   }
   if (type === 'server-unregistered') {
-    flowControlledPorts.delete(data?.port);
+    host.flowControlledPorts.delete(data?.port);
   }
   if (type !== 'server-registered' || !data) return;
   if (data.flowControl === 1 && Number.isSafeInteger(data.maxRequestBytes)
       && data.maxRequestBytes > 0 && data.maxChunkBytes === MAX_STREAM_CHUNK_BYTES) {
-    flowControlledPorts.set(data.port, { maxRequestBytes: data.maxRequestBytes, channel: mainPort });
-  } else flowControlledPorts.delete(data.port);
+    host.flowControlledPorts.set(data.port, { maxRequestBytes: data.maxRequestBytes, channel: host.port });
+  } else host.flowControlledPorts.delete(data.port);
 }
 
 /**
@@ -66,42 +141,35 @@ self.addEventListener('message', (event) => {
   DEBUG && console.log('[SW] Received message:', type, 'hasPort in event.ports:', event.ports?.length > 0);
 
   // When a MessagePort is transferred, it's in event.ports[0], not event.data.port
+  const source = event.source && event.source.id ? hosts.get(event.source.id) : null;
+
   if (type === 'init' && event.ports && event.ports[0]) {
-    // Initialize communication channel
-    for (const pending of pendingRequests.values()) {
-      if (pending.flowControl === 1) pending.fail(new Error('Host connection replaced'));
-    }
-    for (const upload of controlledUploads) upload.controller.abort(new Error('Host connection replaced'));
-    if (mainPort) {
-      mainPort.onmessage = null;
-      mainPort.close();
-    }
-    registeredPorts.clear();
-    flowControlledPorts.clear();
-    primaryPort = null;
-    // Existing preview documents/workers retain their virtual origin identity;
-    // a channel reconnect must not send their root-relative requests to network.
-    mainPort = event.ports[0];
+    // A page's channel replaces only that page's: another page's requests
+    // and servers are its own. Existing preview documents/workers retain
+    // their virtual origin identity; a channel reconnect must not send their
+    // root-relative requests to network.
+    const mainPort = event.ports[0];
+    const host = openHost(event.source && event.source.id ? event.source.id : `host-${++requestId}`, mainPort);
     const initializedPort = mainPort;
     mainPort.onmessage = (message) => {
-      if (mainPort === initializedPort) handleMainMessage(message);
+      if (host.port === initializedPort) handleMainMessage(host, message);
     };
-    if (data && Array.isArray(data.ownDocuments)) ownDocuments = new Set(data.ownDocuments.map((path) => ownPath(String(path))));
+    if (data && Array.isArray(data.ownDocuments)) host.ownDocuments = new Set(data.ownDocuments.map((path) => ownPath(String(path))));
     DEBUG && console.log('[SW] Initialized communication channel with transferred port');
     // Re-claim clients so that pages opened after SW activation get controlled.
     // Without this, controllerchange never fires for late-arriving pages.
     self.clients.claim();
   }
 
-  if (type === 'server-registered' && data) {
-    registeredPorts.add(data.port);
-    if (data.primary) primaryPort = data.port;
+  if (type === 'server-registered' && data && source) {
+    source.registeredPorts.add(data.port);
+    if (data.primary) source.primaryPort = data.port;
     DEBUG && console.log(`[SW] Server registered on port ${data.port}`);
   }
 
-  if (type === 'server-unregistered' && data) {
-    registeredPorts.delete(data.port);
-    if (primaryPort === data.port) primaryPort = null;
+  if (type === 'server-unregistered' && data && source) {
+    source.registeredPorts.delete(data.port);
+    if (source.primaryPort === data.port) source.primaryPort = null;
     DEBUG && console.log(`[SW] Server unregistered from port ${data.port}`);
   }
 });
@@ -109,11 +177,13 @@ self.addEventListener('message', (event) => {
 /**
  * Handle response messages from main thread
  */
-function handleMainMessage(event) {
+function handleMainMessage(host, event) {
   const { type, id, data, error } = event.data;
-  updateFlowControl(type, data);
+  updateFlowControl(host, type, data);
 
   const controlled = pendingRequests.get(id);
+  // A request is answered only by the host it was sent to.
+  if (controlled && controlled.host !== host) return;
   if (controlled?.flowControl === 1) {
     controlled.message(type, data, error);
     return;
@@ -122,18 +192,18 @@ function handleMainMessage(event) {
   // The page's bridge speaks over this port: which servers it holds, which
   // is the preview's, and which documents are the page's own frames.
   if (type === 'server-registered' && data) {
-    registeredPorts.add(data.port);
-    if (data.primary) primaryPort = data.port;
-    else if (primaryPort === data.port) primaryPort = null;
+    host.registeredPorts.add(data.port);
+    if (data.primary) host.primaryPort = data.port;
+    else if (host.primaryPort === data.port) host.primaryPort = null;
     return;
   }
   if (type === 'server-unregistered' && data) {
-    registeredPorts.delete(data.port);
-    if (primaryPort === data.port) primaryPort = null;
+    host.registeredPorts.delete(data.port);
+    if (host.primaryPort === data.port) host.primaryPort = null;
     return;
   }
   if (type === 'own-documents' && data && Array.isArray(data.paths)) {
-    ownDocuments = new Set(data.paths.map((path) => ownPath(String(path))));
+    host.ownDocuments = new Set(data.paths.map((path) => ownPath(String(path))));
     return;
   }
 
@@ -213,30 +283,17 @@ function handleMainMessage(event) {
 /**
  * Send request to main thread and wait for response
  */
-async function sendRequest(port, method, url, headers, body) {
-  DEBUG && console.log('[SW] sendRequest called, mainPort:', !!mainPort, 'url:', url);
-
-  if (!mainPort) {
-    // Ask all clients to re-send the init message
-    const allClients = await self.clients.matchAll({ type: 'window' });
-    for (const client of allClients) {
-      client.postMessage({ type: 'sw-needs-init' });
-    }
-    // Wait up to 5s for a client to re-initialize the port
-    // (main thread may be busy with heavy operations like CLI execution)
-    await new Promise(resolve => {
-      const check = setInterval(() => { if (mainPort) { clearInterval(check); resolve(); } }, 50);
-      setTimeout(() => { clearInterval(check); resolve(); }, 5000);
-    });
-    if (!mainPort) {
-      throw new Error('Service Worker not initialized - no connection to main thread');
-    }
+async function sendRequest(host, port, method, url, headers, body) {
+  DEBUG && console.log('[SW] sendRequest called, host:', !!host, 'url:', url);
+
+  if (!host) {
+    throw new Error('Service Worker not initialized - no connection to main thread');
   }
 
   const id = ++requestId;
 
   return new Promise((resolve, reject) => {
-    pendingRequests.set(id, { resolve, reject });
+    pendingRequests.set(id, { host, resolve, reject });
 
     // Set timeout for request
     setTimeout(() => {
@@ -246,7 +303,7 @@ async function sendRequest(port, method, url, headers, body) {
       }
     }, 30000);
 
-    mainPort.postMessage({
+    host.port.postMessage({
       type: 'request',
       id,
       data: { port, method, url, headers, body },
@@ -258,22 +315,11 @@ async function sendRequest(port, method, url, headers, body) {
  * Send streaming request to main thread
  * Returns a ReadableStream that receives chunks from main thread
  */
-async function sendStreamingRequest(port, method, url, headers, body) {
+async function sendStreamingRequest(host, port, method, url, headers, body) {
   DEBUG && console.log('[SW] sendStreamingRequest called, url:', url);
 
-  if (!mainPort) {
-    // Ask all clients to re-send the init message
-    const allClients = await self.clients.matchAll({ type: 'window' });
-    for (const client of allClients) {
-      client.postMessage({ type: 'sw-needs-init' });
-    }
-    await new Promise(resolve => {
-      const check = setInterval(() => { if (mainPort) { clearInterval(check); resolve(); } }, 50);
-      setTimeout(() => { clearInterval(check); resolve(); }, 5000);
-    });
-    if (!mainPort) {
-      throw new Error('Service Worker not initialized');
-    }
+  if (!host) {
+    throw new Error('Service Worker not initialized');
   }
 
   const id = ++requestId;
@@ -288,6 +334,7 @@ async function sendStreamingRequest(port, method, url, headers, body) {
 
       // Store in pending requests so handleMainMessage can find it
       pendingRequests.set(id, {
+        host,
         resolve: () => {},
         reject: (err) => controller.error(err),
         streamController: controller,
@@ -295,7 +342,7 @@ async function sendStreamingRequest(port, method, url, headers, body) {
       });
 
       // Send request to main thread with streaming flag
-      mainPort.postMessage({
+      host.port.postMessage({
         type: 'request',
         id,
         data: { port, method, url, headers, body, streaming: true },
@@ -312,10 +359,10 @@ async function sendStreamingRequest(port, method, url, headers, body) {
 // A Node HTTP producer must stop when its consumer stops reading and must
 // observe disconnect. One pull credit bounds the service-worker response queue;
 // this protocol requires a paired host bridge and is negotiated per port.
-async function sendControlledRequest(port, method, url, headers, body, signal) {
-  if (!mainPort) throw new Error('Service Worker not initialized');
+async function sendControlledRequest(host, port, method, url, headers, body, signal) {
+  if (!host) throw new Error('Service Worker not initialized');
   if (signal.aborted) throw signal.reason;
-  const channel = mainPort;
+  const channel = host.port;
   const id = ++requestId;
   let controller, resolveHeaders, rejectHeaders, resolvePull;
   let headed = false, credited = false, ended = false;
@@ -364,6 +411,7 @@ async function sendControlledRequest(port, method, url, headers, body, signal) {
     },
   }, { highWaterMark: 0 });
   pendingRequests.set(id, {
+    host,
     flowControl: 1,
     fail,
     port,
@@ -457,10 +505,9 @@ async function readRequestBody(request, limit, registrationSignal) {
 // they would be at their own origin: an app reads its routes from
 // `location.pathname`, and a document under /__virtual__/<port>/ is not at
 // the path its router expects.
-let primaryPort = null;
-// The page's own documents that are frames of it, told by `init`, so a
-// nested document at one of these paths is the page's and not the preview's.
-let ownDocuments = new Set();
+// Each host's `primaryPort`. The page's own documents that are frames of it,
+// told by `init`, are each host's `ownDocuments`, so a nested document at one
+// of these paths is the page's and not the preview's.
 // The documents and workers served from a virtual server at the root, by
 // client id, so their requests reach that server without a prefix to read.
 const rootedClients = new Map();
@@ -480,21 +527,23 @@ async function blobWorkerContext(client, requestUrl) {
         url: requestUrl, referrer: owner.url, mode: 'cors', destination: '',
       } });
       if (!context) return null;
+      const host = ownerOf(owner.id);
       return new Promise((resolve) => {
         const channel = new MessageChannel();
         const finish = (value) => { clearTimeout(timer); channel.port1.close(); resolve(value); };
         const timer = setTimeout(() => finish(null), 1000);
-        channel.port1.onmessage = (event) => finish(event.data === true ? context : null);
+        channel.port1.onmessage = (event) => finish(event.data === true ? { context, host } : null);
         try { owner.postMessage({ type: 'virtual-blob-owner', url: client.url }, [channel.port2]); }
         catch { finish(null); }
       });
     }));
     const owners = candidates.filter(Boolean);
     if (owners.length === 0) return null;
-    if (owners.some(owner => owner.port !== owners[0].port)) throw new Error('Ambiguous virtual blob owner');
-    rootedClients.set(client.id, owners[0].port);
-    if (rootedClients.size > 256) pruneRootedClients();
-    return owners[0];
+    if (owners.some(owner => owner.context.port !== owners[0].context.port || owner.host !== owners[0].host)) throw new Error('Ambiguous virtual blob owner');
+    rootedClients.set(client.id, owners[0].context.port);
+    if (owners[0].host) clientHosts.set(client.id, owners[0].host.id);
+    if (rootedClients.size > 256) pruneClients();
+    return owners[0].context;
   })();
   pendingBlobContexts.set(client.id, pending);
   try { return await pending; } finally { pendingBlobContexts.delete(client.id); }
@@ -522,7 +571,7 @@ async function virtualContext(event) {
   // or a frame's navigation, asks the page for its registrations first, as a
   // virtual request asks for its port, so a restart does not send the
   // preview's own requests to the network.
-  if (primaryPort === null && !mainPort && ((client && client.frameType === 'nested') || (event.request.mode === 'navigate' && (event.request.destination === 'iframe' || event.request.destination === 'frame')))) {
+  if (hosts.size === 0 && ((client && client.frameType === 'nested') || (event.request.mode === 'navigate' && (event.request.destination === 'iframe' || event.request.destination === 'frame')))) {
     await askForInit();
   }
   const contextUrl = event.request.referrer || (client ? client.url : '');
@@ -536,13 +585,14 @@ async function virtualContext(event) {
   if (client && (client.type === 'worker' || client.type === 'sharedworker') && client.url.startsWith('blob:')) {
     return blobWorkerContext(client, event.request.url);
   }
-  if (primaryPort === null) return null;
+  const host = await hostForEvent(event);
+  if (!host || host.primaryPort === null) return null;
   if (event.request.mode === 'navigate') {
     if (event.request.destination !== 'iframe' && event.request.destination !== 'frame') return null;
-    if (ownDocuments.has(ownPath(url.pathname))) return null;
-    return { prefix: null, port: primaryPort };
+    if (host.ownDocuments.has(ownPath(url.pathname))) return null;
+    return { prefix: null, port: host.primaryPort };
   }
-  if (client && client.frameType === 'nested' && !ownDocuments.has(ownPath(new URL(client.url).pathname))) return { prefix: null, port: primaryPort };
+  if (client && client.frameType === 'nested' && !host.ownDocuments.has(ownPath(new URL(client.url).pathname))) return { prefix: null, port: host.primaryPort };
   return null;
 }
 
@@ -556,7 +606,7 @@ async function askForInit() {
   const allClients = await self.clients.matchAll({ type: 'window' });
   for (const client of allClients) client.postMessage({ type: 'sw-needs-init' });
   await new Promise((resolve) => {
-    const check = setInterval(() => { if (mainPort) { clearInterval(check); resolve(); } }, 50);
+    const check = setInterval(() => { if (hosts.size > 0) { clearInterval(check); resolve(); } }, 50);
     setTimeout(() => { clearInterval(check); resolve(); }, 5000);
   });
 }
@@ -565,15 +615,23 @@ async function askForInit() {
 function handleRootedRequest(event, port, path) {
   if (event.resultingClientId) {
     rootedClients.set(event.resultingClientId, port);
-    if (rootedClients.size > 256) pruneRootedClients();
+    if (rootedClients.size > 256) pruneClients();
   }
   return handleVirtualRequest(event.request, port, path, true);
 }
 
-/** Forgets the documents and workers that are gone. */
-async function pruneRootedClients() {
-  const alive = new Set((await self.clients.matchAll({ type: 'all' })).map((client) => client.id));
+/** Forgets the documents, workers and hosts that are gone. */
+async function pruneClients() {
+  const alive = new Set((await self.clients.matchAll({ type: 'all', includeUncontrolled: true })).map((client) => client.id));
   for (const id of [...rootedClients.keys()]) if (!alive.has(id)) rootedClients.delete(id);
+  for (const [id, host] of [...clientHosts]) if (!alive.has(id) || !hosts.has(host)) clientHosts.delete(id);
+  for (const [id, host] of [...hosts]) {
+    if (alive.has(id) || id.startsWith('host-')) continue;
+    hosts.delete(id);
+    host.port.onmessage = null;
+    host.port.close();
+    if (latestHost === host) latestHost = [...hosts.values()].pop() ?? null;
+  }
 }
 
 /**
@@ -581,8 +639,9 @@ async function pruneRootedClients() {
  */
 self.addEventListener('fetch', (event) => {
   const url = new URL(event.request.url);
+  requestEvents.set(event.request, event);
 
-  DEBUG && console.log('[SW] Fetch:', url.pathname, 'mainPort:', !!mainPort);
+  DEBUG && console.log('[SW] Fetch:', url.pathname, 'hosts:', hosts.size);
 
   // Check if this is a virtual server request
   const match = url.pathname.match(/^\/__virtual__\/(\d+)(\/.*)?$/);
@@ -595,7 +654,7 @@ self.addEventListener('fetch', (event) => {
     // the referrer, which a document sent with no referrer never has, is
     // the fallback. A document at the root is the preview's server's, and
     // its own requests are that server's with it.
-    if (event.request.referrer || event.clientId || (event.request.mode === 'navigate' && primaryPort !== null)) {
+    if (event.request.referrer || event.clientId || (event.request.mode === 'navigate' && [...hosts.values()].some((host) => host.primaryPort !== null))) {
       event.respondWith((async () => {
         const context = await virtualContext(event);
         if (!context) return fetch(event.request);
@@ -629,7 +688,9 @@ self.addEventListener('fetch', (event) => {
  */
 async function handleVirtualRequest(request, port, path, rooted = false) {
   try {
-    const registration = flowControlledPorts.get(port);
+    if (hosts.size === 0) await askForInit();
+    const host = await hostForRequest(request, port);
+    const registration = host ? host.flowControlledPorts.get(port) : undefined;
     // Build headers object
     const headers = {};
     request.headers.forEach((value, key) => {
@@ -646,7 +707,7 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
     let body = null;
     if (request.method !== 'GET' && request.method !== 'HEAD') {
       if (registration) {
-        const upload = { port, controller: new AbortController() };
+        const upload = { host, port, controller: new AbortController() };
         controlledUploads.add(upload);
         try {
           body = await readRequestBody(request, registration.maxRequestBytes, upload.controller.signal);
@@ -661,9 +722,9 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
     }
 
     if (registration) {
-      if (flowControlledPorts.get(port) !== registration || mainPort !== registration.channel)
+      if (host.flowControlledPorts.get(port) !== registration || host.port !== registration.channel || hosts.get(host.id) !== host)
         throw new Error('Virtual server registration changed during upload');
-      return await sendControlledRequest(port, request.method, path, headers, body, request.signal);
+      return await sendControlledRequest(host, port, request.method, path, headers, body, request.signal);
     }
 
     // Legacy peers retain their old selection until they negotiate flow control.
@@ -671,12 +732,12 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
 
     if (isStreamingCandidate) {
       DEBUG && console.log('[SW] Using streaming mode for:', path);
-      return handleStreamingRequest(port, request.method, path, headers, body);
+      return handleStreamingRequest(host, port, request.method, path, headers, body);
     }
     DEBUG && console.log('[SW] Using non-streaming mode for:', request.method, path);
 
     // Send to main thread
-    const response = await sendRequest(port, request.method, path, headers, body);
+    const response = await sendRequest(host, port, request.method, path, headers, body);
 
     DEBUG && console.log('[SW] Got response from main thread:', {
       statusCode: response.statusCode,
@@ -741,8 +802,8 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
 /**
  * Handle a streaming request
  */
-async function handleStreamingRequest(port, method, path, headers, body) {
-  const { stream, headersPromise, id } = await sendStreamingRequest(port, method, path, headers, body);
+async function handleStreamingRequest(host, port, method, path, headers, body) {
+  const { stream, headersPromise, id } = await sendStreamingRequest(host, port, method, path, headers, body);
 
   // Wait for headers to arrive
   const responseData = await headersPromise;

package/dist/assets/{runtime-worker-XRE6n_4W.js → runtime-worker-Bw5ePWPu.js}

@@ -23705,6 +23705,83 @@ function createCryptoModule(require2) {
     const keyInfo = extractKeyInfo(key);
     return new KeyObject2("private", keyInfo.keyData, keyInfo.algorithm);
   }
+  const NAMED_CURVES = {
+    "prime256v1": "P-256",
+    "p-256": "P-256",
+    "secp256r1": "P-256",
+    "secp384r1": "P-384",
+    "p-384": "P-384",
+    "secp521r1": "P-521",
+    "p-521": "P-521"
+  };
+  function keyPairAlgorithm(type2, options) {
+    const exponent = (value) => {
+      let rest = value ?? 65537;
+      const bytes2 = [];
+      while (rest > 0) {
+        bytes2.unshift(rest & 255);
+        rest = Math.floor(rest / 256);
+      }
+      return new Uint8Array(bytes2);
+    };
+    switch (type2) {
+      case "rsa":
+      case "rsa-pss": {
+        if (!Number.isInteger(options.modulusLength)) throw Object.assign(new TypeError('The "options.modulusLength" property must be of type number.'), { code: "ERR_INVALID_ARG_TYPE" });
+        const name = type2 === "rsa" ? "RSASSA-PKCS1-v1_5" : "RSA-PSS";
+        return { generate: { name, modulusLength: options.modulusLength, publicExponent: exponent(options.publicExponent), hash: "SHA-256" }, usages: ["sign", "verify"], name: type2 === "rsa" ? "RSA-SHA256" : "RSA-PSS" };
+      }
+      case "ec": {
+        const curve = NAMED_CURVES[String(options.namedCurve ?? "").toLowerCase()];
+        if (!curve) throw Object.assign(new TypeError(`Invalid EC curve name ${String(options.namedCurve)}`), { code: "ERR_CRYPTO_INVALID_CURVE" });
+        return { generate: { name: "ECDSA", namedCurve: curve }, usages: ["sign", "verify"], name: curve === "P-256" ? "ES256" : curve === "P-384" ? "ES384" : "ES512" };
+      }
+      case "ed25519":
+        return { generate: { name: "Ed25519" }, usages: ["sign", "verify"], name: "Ed25519" };
+      case "x25519":
+        return { generate: { name: "X25519" }, usages: ["deriveBits"], name: "X25519" };
+      default:
+        throw Object.assign(new TypeError(`The argument 'type' must be a supported key type. Received '${type2}'`), { code: "ERR_INVALID_ARG_VALUE" });
+    }
+  }
+  function encodedKey(der, encoding, kind) {
+    const expected = kind === "public" ? "spki" : "pkcs8";
+    if (encoding.type !== void 0 && encoding.type !== expected) {
+      unsupported2(`Encoding a ${kind} key as ${encoding.type}`);
+    }
+    const bytes2 = Buffer2.from(der);
+    if (encoding.format === "der") return bytes2;
+    if (encoding.format !== "pem") unsupported2(`Encoding a key in the ${String(encoding.format)} format`);
+    const label = kind === "public" ? "PUBLIC KEY" : "PRIVATE KEY";
+    const body = bytes2.toString("base64").match(/.{1,64}/g).join("\n");
+    return `-----BEGIN ${label}-----
+${body}
+-----END ${label}-----
+`;
+  }
+  async function generateKeyPairAsync(type2, options) {
+    const algorithm = keyPairAlgorithm(type2, options);
+    const pair = await crypto.subtle.generateKey(algorithm.generate, true, algorithm.usages);
+    const publicKey = options.publicKeyEncoding ? encodedKey(await crypto.subtle.exportKey("spki", pair.publicKey), options.publicKeyEncoding, "public") : new KeyObject2("public", pair.publicKey, algorithm.name);
+    const privateKey = options.privateKeyEncoding ? encodedKey(await crypto.subtle.exportKey("pkcs8", pair.privateKey), options.privateKeyEncoding, "private") : new KeyObject2("private", pair.privateKey, algorithm.name);
+    return { publicKey, privateKey };
+  }
+  function generateKeyPair2(type2, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = {};
+    }
+    if (typeof callback !== "function") throw Object.assign(new TypeError('The "callback" argument must be of type function.'), { code: "ERR_INVALID_ARG_TYPE" });
+    const done = callback;
+    keyPairAlgorithm(type2, options ?? {});
+    generateKeyPairAsync(type2, options ?? {}).then(
+      ({ publicKey, privateKey }) => done(null, publicKey, privateKey),
+      (error) => done(error instanceof Error ? error : new Error(String(error)))
+    );
+  }
+  Object.defineProperty(generateKeyPair2, Symbol.for("nodejs.util.promisify.custom"), {
+    value: (type2, options) => generateKeyPairAsync(type2, options ?? {})
+  });
   function timingSafeEqual2(a, b) {
     if (a.length !== b.length) {
       return false;
@@ -23861,11 +23938,12 @@ function createCryptoModule(require2) {
     KeyObject: KeyObject2,
     createSecretKey: createSecretKey2,
     createPublicKey: createPublicKey2,
-    createPrivateKey: createPrivateKey2
+    createPrivateKey: createPrivateKey2,
+    generateKeyPair: generateKeyPair2
   };
 }
 const cryptoModule = createCryptoModule();
-const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
+const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, generateKeyPair, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
 var cryptoShim = /* @__PURE__ */ Object.freeze({
   __proto__: null,
   KeyObject,
@@ -23879,6 +23957,7 @@ var cryptoShim = /* @__PURE__ */ Object.freeze({
   createSign,
   createVerify,
   default: cryptoModule,
+  generateKeyPair,
   getCiphers,
   getHashes,
   getRandomValues,

package/dist/index.mjs

@@ -23874,6 +23874,83 @@ function createCryptoModule(require2) {
     const keyInfo = extractKeyInfo(key);
     return new KeyObject2("private", keyInfo.keyData, keyInfo.algorithm);
   }
+  const NAMED_CURVES = {
+    "prime256v1": "P-256",
+    "p-256": "P-256",
+    "secp256r1": "P-256",
+    "secp384r1": "P-384",
+    "p-384": "P-384",
+    "secp521r1": "P-521",
+    "p-521": "P-521"
+  };
+  function keyPairAlgorithm(type2, options) {
+    const exponent = (value) => {
+      let rest = value ?? 65537;
+      const bytes2 = [];
+      while (rest > 0) {
+        bytes2.unshift(rest & 255);
+        rest = Math.floor(rest / 256);
+      }
+      return new Uint8Array(bytes2);
+    };
+    switch (type2) {
+      case "rsa":
+      case "rsa-pss": {
+        if (!Number.isInteger(options.modulusLength)) throw Object.assign(new TypeError('The "options.modulusLength" property must be of type number.'), { code: "ERR_INVALID_ARG_TYPE" });
+        const name = type2 === "rsa" ? "RSASSA-PKCS1-v1_5" : "RSA-PSS";
+        return { generate: { name, modulusLength: options.modulusLength, publicExponent: exponent(options.publicExponent), hash: "SHA-256" }, usages: ["sign", "verify"], name: type2 === "rsa" ? "RSA-SHA256" : "RSA-PSS" };
+      }
+      case "ec": {
+        const curve = NAMED_CURVES[String(options.namedCurve ?? "").toLowerCase()];
+        if (!curve) throw Object.assign(new TypeError(`Invalid EC curve name ${String(options.namedCurve)}`), { code: "ERR_CRYPTO_INVALID_CURVE" });
+        return { generate: { name: "ECDSA", namedCurve: curve }, usages: ["sign", "verify"], name: curve === "P-256" ? "ES256" : curve === "P-384" ? "ES384" : "ES512" };
+      }
+      case "ed25519":
+        return { generate: { name: "Ed25519" }, usages: ["sign", "verify"], name: "Ed25519" };
+      case "x25519":
+        return { generate: { name: "X25519" }, usages: ["deriveBits"], name: "X25519" };
+      default:
+        throw Object.assign(new TypeError(`The argument 'type' must be a supported key type. Received '${type2}'`), { code: "ERR_INVALID_ARG_VALUE" });
+    }
+  }
+  function encodedKey(der, encoding, kind) {
+    const expected = kind === "public" ? "spki" : "pkcs8";
+    if (encoding.type !== void 0 && encoding.type !== expected) {
+      unsupported2(`Encoding a ${kind} key as ${encoding.type}`);
+    }
+    const bytes2 = Buffer2.from(der);
+    if (encoding.format === "der") return bytes2;
+    if (encoding.format !== "pem") unsupported2(`Encoding a key in the ${String(encoding.format)} format`);
+    const label = kind === "public" ? "PUBLIC KEY" : "PRIVATE KEY";
+    const body = bytes2.toString("base64").match(/.{1,64}/g).join("\n");
+    return `-----BEGIN ${label}-----
+${body}
+-----END ${label}-----
+`;
+  }
+  async function generateKeyPairAsync(type2, options) {
+    const algorithm = keyPairAlgorithm(type2, options);
+    const pair = await crypto.subtle.generateKey(algorithm.generate, true, algorithm.usages);
+    const publicKey = options.publicKeyEncoding ? encodedKey(await crypto.subtle.exportKey("spki", pair.publicKey), options.publicKeyEncoding, "public") : new KeyObject2("public", pair.publicKey, algorithm.name);
+    const privateKey = options.privateKeyEncoding ? encodedKey(await crypto.subtle.exportKey("pkcs8", pair.privateKey), options.privateKeyEncoding, "private") : new KeyObject2("private", pair.privateKey, algorithm.name);
+    return { publicKey, privateKey };
+  }
+  function generateKeyPair2(type2, options, callback) {
+    if (typeof options === "function") {
+      callback = options;
+      options = {};
+    }
+    if (typeof callback !== "function") throw Object.assign(new TypeError('The "callback" argument must be of type function.'), { code: "ERR_INVALID_ARG_TYPE" });
+    const done = callback;
+    keyPairAlgorithm(type2, options ?? {});
+    generateKeyPairAsync(type2, options ?? {}).then(
+      ({ publicKey, privateKey }) => done(null, publicKey, privateKey),
+      (error) => done(error instanceof Error ? error : new Error(String(error)))
+    );
+  }
+  Object.defineProperty(generateKeyPair2, Symbol.for("nodejs.util.promisify.custom"), {
+    value: (type2, options) => generateKeyPairAsync(type2, options ?? {})
+  });
   function timingSafeEqual2(a, b) {
     if (a.length !== b.length) {
       return false;
@@ -24030,11 +24107,12 @@ function createCryptoModule(require2) {
     KeyObject: KeyObject2,
     createSecretKey: createSecretKey2,
     createPublicKey: createPublicKey2,
-    createPrivateKey: createPrivateKey2
+    createPrivateKey: createPrivateKey2,
+    generateKeyPair: generateKeyPair2
   };
 }
 const cryptoModule = createCryptoModule();
-const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported: unsupported$1, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
+const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported: unsupported$1, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, generateKeyPair, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
 const cryptoShim = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   KeyObject,
@@ -24048,6 +24126,7 @@ const cryptoShim = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   createSign,
   createVerify,
   default: cryptoModule,
+  generateKeyPair,
   getCiphers,
   getHashes,
   getRandomValues,
@@ -39839,7 +39918,7 @@ class WorkerRuntime {
     this.worker = new Worker(
       new URL(
         /* @vite-ignore */
-        "/assets/runtime-worker-XRE6n_4W.js",
+        "/assets/runtime-worker-Bw5ePWPu.js",
         import.meta.url
       ),
       { type: "module" }

package/dist/shims/crypto.d.ts

@@ -245,6 +245,19 @@ export declare function createCryptoModule(require?: (name: string) => any): {
             format?: string;
         }): Buffer | string;
     };
+    generateKeyPair: (type: string, options: {
+        modulusLength?: number;
+        publicExponent?: number;
+        namedCurve?: string;
+        publicKeyEncoding?: {
+            type?: string;
+            format?: string;
+        };
+        privateKeyEncoding?: {
+            type?: string;
+            format?: string;
+        };
+    } | ((error: Error | null, publicKey?: unknown, privateKey?: unknown) => void), callback?: (error: Error | null, publicKey?: unknown, privateKey?: unknown) => void) => void;
 };
 declare const cryptoModule: {
     unsupported: (operation: string) => never;
@@ -477,6 +490,19 @@ declare const cryptoModule: {
             format?: string;
         }): Buffer | string;
     };
+    generateKeyPair: (type: string, options: {
+        modulusLength?: number;
+        publicExponent?: number;
+        namedCurve?: string;
+        publicKeyEncoding?: {
+            type?: string;
+            format?: string;
+        };
+        privateKeyEncoding?: {
+            type?: string;
+            format?: string;
+        };
+    } | ((error: Error | null, publicKey?: unknown, privateKey?: unknown) => void), callback?: (error: Error | null, publicKey?: unknown, privateKey?: unknown) => void) => void;
 };
 export declare const randomBytes: {
     (size: number): Buffer;
@@ -679,6 +705,18 @@ export declare const randomBytes: {
         type?: string;
         format?: string;
     }): Buffer | string;
-}, timingSafeEqual: (a: Buffer | Uint8Array, b: Buffer | Uint8Array) => boolean, getCiphers: () => string[], getHashes: () => string[];
+}, generateKeyPair: (type: string, options: {
+    modulusLength?: number;
+    publicExponent?: number;
+    namedCurve?: string;
+    publicKeyEncoding?: {
+        type?: string;
+        format?: string;
+    };
+    privateKeyEncoding?: {
+        type?: string;
+        format?: string;
+    };
+} | ((error: Error | null, publicKey?: unknown, privateKey?: unknown) => void), callback?: (error: Error | null, publicKey?: unknown, privateKey?: unknown) => void) => void, timingSafeEqual: (a: Buffer | Uint8Array, b: Buffer | Uint8Array) => boolean, getCiphers: () => string[], getHashes: () => string[];
 export type KeyObject = InstanceType<typeof KeyObject>;
 export default cryptoModule;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.21",
+  "version": "0.5.23",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/shims/crypto.ts

@@ -800,6 +800,92 @@ function createPrivateKey(key: KeyLike): KeyObject {
   return new KeyObject('private', keyInfo.keyData as Uint8Array, keyInfo.algorithm);
 }
 
+// ============================================================================
+// generateKeyPair: Node's asynchronous key generation, done by WebCrypto.
+// A browser has no synchronous key generation, so generateKeyPairSync stays
+// absent; the callback form and its promisified form (which resolves
+// { publicKey, privateKey }, as Node's custom promisify does) are complete for
+// the types WebCrypto generates. jose's Node build promisifies this function
+// when it loads, so its absence failed any module that imported jose.
+// ============================================================================
+
+type KeyEncoding = { type?: string; format?: string };
+type KeyPairOptions = { modulusLength?: number; publicExponent?: number; namedCurve?: string; publicKeyEncoding?: KeyEncoding; privateKeyEncoding?: KeyEncoding };
+
+const NAMED_CURVES: Record<string, string> = {
+  'prime256v1': 'P-256', 'p-256': 'P-256', 'secp256r1': 'P-256',
+  'secp384r1': 'P-384', 'p-384': 'P-384',
+  'secp521r1': 'P-521', 'p-521': 'P-521',
+};
+
+function keyPairAlgorithm(type: string, options: KeyPairOptions): { generate: AlgorithmIdentifier & Record<string, unknown>; usages: KeyUsage[]; name: string } {
+  const exponent = (value: number | undefined): Uint8Array => {
+    let rest = value ?? 0x10001;
+    const bytes: number[] = [];
+    while (rest > 0) { bytes.unshift(rest & 0xff); rest = Math.floor(rest / 256); }
+    return new Uint8Array(bytes);
+  };
+  switch (type) {
+    case 'rsa':
+    case 'rsa-pss': {
+      if (!Number.isInteger(options.modulusLength)) throw Object.assign(new TypeError('The "options.modulusLength" property must be of type number.'), { code: 'ERR_INVALID_ARG_TYPE' });
+      const name = type === 'rsa' ? 'RSASSA-PKCS1-v1_5' : 'RSA-PSS';
+      return { generate: { name, modulusLength: options.modulusLength, publicExponent: exponent(options.publicExponent), hash: 'SHA-256' }, usages: ['sign', 'verify'], name: type === 'rsa' ? 'RSA-SHA256' : 'RSA-PSS' };
+    }
+    case 'ec': {
+      const curve = NAMED_CURVES[String(options.namedCurve ?? '').toLowerCase()];
+      if (!curve) throw Object.assign(new TypeError(`Invalid EC curve name ${String(options.namedCurve)}`), { code: 'ERR_CRYPTO_INVALID_CURVE' });
+      return { generate: { name: 'ECDSA', namedCurve: curve }, usages: ['sign', 'verify'], name: curve === 'P-256' ? 'ES256' : curve === 'P-384' ? 'ES384' : 'ES512' };
+    }
+    case 'ed25519':
+      return { generate: { name: 'Ed25519' }, usages: ['sign', 'verify'], name: 'Ed25519' };
+    case 'x25519':
+      return { generate: { name: 'X25519' }, usages: ['deriveBits'], name: 'X25519' };
+    default:
+      throw Object.assign(new TypeError(`The argument 'type' must be a supported key type. Received '${type}'`), { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+}
+
+function encodedKey(der: ArrayBuffer, encoding: KeyEncoding, kind: 'public' | 'private'): string | Buffer {
+  const expected = kind === 'public' ? 'spki' : 'pkcs8';
+  if (encoding.type !== undefined && encoding.type !== expected) {
+    unsupported(`Encoding a ${kind} key as ${encoding.type}`);
+  }
+  const bytes = Buffer.from(der);
+  if (encoding.format === 'der') return bytes;
+  if (encoding.format !== 'pem') unsupported(`Encoding a key in the ${String(encoding.format)} format`);
+  const label = kind === 'public' ? 'PUBLIC KEY' : 'PRIVATE KEY';
+  const body = bytes.toString('base64').match(/.{1,64}/g)!.join('\n');
+  return `-----BEGIN ${label}-----\n${body}\n-----END ${label}-----\n`;
+}
+
+async function generateKeyPairAsync(type: string, options: KeyPairOptions): Promise<{ publicKey: KeyObject | string | Buffer; privateKey: KeyObject | string | Buffer }> {
+  const algorithm = keyPairAlgorithm(type, options);
+  const pair = await crypto.subtle.generateKey(algorithm.generate as AlgorithmIdentifier, true, algorithm.usages) as CryptoKeyPair;
+  const publicKey = options.publicKeyEncoding
+    ? encodedKey(await crypto.subtle.exportKey('spki', pair.publicKey), options.publicKeyEncoding, 'public')
+    : new KeyObject('public', pair.publicKey, algorithm.name);
+  const privateKey = options.privateKeyEncoding
+    ? encodedKey(await crypto.subtle.exportKey('pkcs8', pair.privateKey), options.privateKeyEncoding, 'private')
+    : new KeyObject('private', pair.privateKey, algorithm.name);
+  return { publicKey, privateKey };
+}
+
+function generateKeyPair(type: string, options: KeyPairOptions | ((error: Error | null, publicKey?: unknown, privateKey?: unknown) => void), callback?: (error: Error | null, publicKey?: unknown, privateKey?: unknown) => void): void {
+  if (typeof options === 'function') { callback = options; options = {}; }
+  if (typeof callback !== 'function') throw Object.assign(new TypeError('The "callback" argument must be of type function.'), { code: 'ERR_INVALID_ARG_TYPE' });
+  const done = callback;
+  // Argument errors throw synchronously, as Node's do.
+  keyPairAlgorithm(type, options ?? {});
+  generateKeyPairAsync(type, options ?? {}).then(
+    ({ publicKey, privateKey }) => done(null, publicKey, privateKey),
+    (error) => done(error instanceof Error ? error : new Error(String(error))),
+  );
+}
+Object.defineProperty(generateKeyPair, Symbol.for('nodejs.util.promisify.custom'), {
+  value: (type: string, options?: KeyPairOptions) => generateKeyPairAsync(type, options ?? {}),
+});
+
 // ============================================================================
 // Utility functions
 // ============================================================================
@@ -1067,10 +1153,11 @@ return {
   createSecretKey,
   createPublicKey,
   createPrivateKey,
+  generateKeyPair,
 };
 
 }
 const cryptoModule = createCryptoModule();
-export const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
+export const { randomBytes, randomFillSync, randomFill, randomUUID, randomInt, getRandomValues, unsupported, createHash, createHmac, hash, pbkdf2Sync, pbkdf2, sign, verify, createSign, createVerify, KeyObject, createSecretKey, createPublicKey, createPrivateKey, generateKeyPair, timingSafeEqual, getCiphers, getHashes } = cryptoModule;
 export type KeyObject = InstanceType<typeof KeyObject>;
 export default cryptoModule;