@volter/tabnode 0.5.34 → 0.5.36

package/dist/__sw__.js

@@ -289,7 +289,7 @@ function handleMainMessage(host, event) {
 /**
  * Send request to main thread and wait for response
  */
-async function sendRequest(host, port, method, url, headers, body) {
+async function sendRequest(host, port, method, url, headers, body, destination = '') {
   DEBUG && console.log('[SW] sendRequest called, host:', !!host, 'url:', url);
 
   if (!host) {
@@ -312,7 +312,7 @@ async function sendRequest(host, port, method, url, headers, body) {
     host.port.postMessage({
       type: 'request',
       id,
-      data: { port, method, url, headers, body },
+      data: { port, method, url, headers, body, destination },
     });
   });
 }
@@ -321,7 +321,7 @@ async function sendRequest(host, port, method, url, headers, body) {
  * Send streaming request to main thread
  * Returns a ReadableStream that receives chunks from main thread
  */
-async function sendStreamingRequest(host, port, method, url, headers, body) {
+async function sendStreamingRequest(host, port, method, url, headers, body, destination = '') {
   DEBUG && console.log('[SW] sendStreamingRequest called, url:', url);
 
   if (!host) {
@@ -351,7 +351,7 @@ async function sendStreamingRequest(host, port, method, url, headers, body) {
       host.port.postMessage({
         type: 'request',
         id,
-        data: { port, method, url, headers, body, streaming: true },
+        data: { port, method, url, headers, body, streaming: true, destination },
       });
     },
     cancel() {
@@ -365,7 +365,7 @@ async function sendStreamingRequest(host, port, method, url, headers, body) {
 // A Node HTTP producer must stop when its consumer stops reading and must
 // observe disconnect. One pull credit bounds the service-worker response queue;
 // this protocol requires a paired host bridge and is negotiated per port.
-async function sendControlledRequest(host, port, method, url, headers, body, signal) {
+async function sendControlledRequest(host, port, method, url, headers, body, signal, destination = '') {
   if (!host) throw new Error('Service Worker not initialized');
   if (signal.aborted) throw signal.reason;
   const channel = host.port;
@@ -450,7 +450,7 @@ async function sendControlledRequest(host, port, method, url, headers, body, sig
   signal.addEventListener('abort', abort, { once: true });
   try {
     channel.postMessage({ type: 'request', id,
-      data: { port, method, url, headers, body, streaming: true, flowControl: 1 } });
+      data: { port, method, url, headers, body, streaming: true, flowControl: 1, destination } });
     if (signal.aborted) abort();
     const head = await headersPromise;
     const noBody = method === 'HEAD' || [204, 205, 304].includes(head.statusCode);
@@ -775,7 +775,7 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
     if (registration) {
       if (host.flowControlledPorts.get(port) !== registration || host.port !== registration.channel || hosts.get(host.id) !== host)
         throw new Error('Virtual server registration changed during upload');
-      return await sendControlledRequest(host, port, request.method, path, headers, body, request.signal);
+      return await sendControlledRequest(host, port, request.method, path, headers, body, request.signal, request.destination);
     }
 
     // Legacy peers retain their old selection until they negotiate flow control.
@@ -783,12 +783,12 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
 
     if (isStreamingCandidate) {
       DEBUG && console.log('[SW] Using streaming mode for:', path);
-      return handleStreamingRequest(host, port, request.method, path, headers, body);
+      return handleStreamingRequest(host, port, request.method, path, headers, body, request.destination);
     }
     DEBUG && console.log('[SW] Using non-streaming mode for:', request.method, path);
 
     // Send to main thread
-    const response = await sendRequest(host, port, request.method, path, headers, body);
+    const response = await sendRequest(host, port, request.method, path, headers, body, request.destination);
 
     DEBUG && console.log('[SW] Got response from main thread:', {
       statusCode: response.statusCode,
@@ -796,6 +796,16 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
       bodyBase64Length: response.bodyBase64?.length,
     });
 
+    // The frame's embedding policy goes on every answer, an empty one too:
+    // the page is cross-origin isolated, and a document without these
+    // headers is blocked in its frame (an empty 200 lost the preview).
+    const respHeaders = new Headers(response.headers);
+    respHeaders.set('Cross-Origin-Embedder-Policy', 'credentialless');
+    respHeaders.set('Cross-Origin-Opener-Policy', 'same-origin');
+    respHeaders.set('Cross-Origin-Resource-Policy', 'cross-origin');
+    // Remove any headers that might block iframe loading
+    respHeaders.delete('X-Frame-Options');
+
     // Decode base64 body and create response
     let finalResponse;
     if (response.bodyBase64 && response.bodyBase64.length > 0) {
@@ -803,19 +813,13 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
         const bytes = base64ToBytes(response.bodyBase64);
         DEBUG && console.log('[SW] Decoded body length:', bytes.length);
 
-        // Use Blob to ensure proper body handling
-        const blob = new Blob([bytes], { type: response.headers['Content-Type'] || 'application/octet-stream' });
+        // Use Blob to ensure proper body handling. Its type is the server's,
+        // or none: a document the server gave no type is the browser's to
+        // sniff, and an invented octet-stream made a page a download.
+        const declared = new Headers(response.headers).get('content-type');
+        const blob = new Blob([bytes], declared ? { type: declared } : {});
         DEBUG && console.log('[SW] Created blob size:', blob.size);
 
-        // Merge response headers with CORP/COEP headers to allow iframe embedding
-        // The parent page has COEP: credentialless, so we need matching headers
-        const respHeaders = new Headers(response.headers);
-        respHeaders.set('Cross-Origin-Embedder-Policy', 'credentialless');
-        respHeaders.set('Cross-Origin-Opener-Policy', 'same-origin');
-        respHeaders.set('Cross-Origin-Resource-Policy', 'cross-origin');
-        // Remove any headers that might block iframe loading
-        respHeaders.delete('X-Frame-Options');
-
         finalResponse = new Response(blob, {
           status: response.statusCode,
           statusText: response.statusMessage,
@@ -832,7 +836,7 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
       finalResponse = new Response(null, {
         status: response.statusCode,
         statusText: response.statusMessage,
-        headers: response.headers,
+        headers: respHeaders,
       });
     }
 
@@ -853,8 +857,8 @@ async function handleVirtualRequest(request, port, path, rooted = false) {
 /**
  * Handle a streaming request
  */
-async function handleStreamingRequest(host, port, method, path, headers, body) {
-  const { stream, headersPromise, id } = await sendStreamingRequest(host, port, method, path, headers, body);
+async function handleStreamingRequest(host, port, method, path, headers, body, destination = '') {
+  const { stream, headersPromise, id } = await sendStreamingRequest(host, port, method, path, headers, body, destination);
 
   // Wait for headers to arrive
   const responseData = await headersPromise;

package/dist/assets/{runtime-worker-DsSAHE2C.js → runtime-worker-DEgP1CYS.js}

@@ -21154,10 +21154,17 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply = Function.prototype.apply;
+var functionApply;
+var hasRequiredFunctionApply;
+function requireFunctionApply() {
+  if (hasRequiredFunctionApply) return functionApply;
+  hasRequiredFunctionApply = 1;
+  functionApply = Function.prototype.apply;
+  return functionApply;
+}
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = functionApply;
+var $apply$1 = requireFunctionApply();
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -21277,7 +21284,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = functionApply;
+var $apply = requireFunctionApply();
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -21918,7 +21925,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = functionApply;
+  var $apply2 = requireFunctionApply();
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);

package/dist/index.mjs

@@ -40293,7 +40293,7 @@ class WorkerRuntime {
     this.worker = new Worker(
       new URL(
         /* @vite-ignore */
-        "/assets/runtime-worker-DsSAHE2C.js",
+        "/assets/runtime-worker-DEgP1CYS.js",
         import.meta.url
       ),
       { type: "module" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.34",
+  "version": "0.5.36",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",