@volter/tabnode 0.5.46 → 0.5.48

package/dist/assets/{runtime-worker-DuSugZ3P.js → runtime-worker-B-BP9mj-.js}

@@ -21191,17 +21191,10 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply;
-var hasRequiredFunctionApply;
-function requireFunctionApply() {
-  if (hasRequiredFunctionApply) return functionApply;
-  hasRequiredFunctionApply = 1;
-  functionApply = Function.prototype.apply;
-  return functionApply;
-}
+var functionApply = Function.prototype.apply;
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = requireFunctionApply();
+var $apply$1 = functionApply;
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -21321,7 +21314,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = requireFunctionApply();
+var $apply = functionApply;
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -21962,7 +21955,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = requireFunctionApply();
+  var $apply2 = functionApply;
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);
@@ -32282,6 +32275,123 @@ function guestFetch(process2, fallback) {
     return fallback.call(globalThis, input, init);
   };
 }
+const INSTALLED = Symbol.for("tabnode.response.keepsSetCookie");
+function withCookies(own, given) {
+  const headers = new Headers(own);
+  if (!given) return headers;
+  const cookies = [];
+  if (typeof given.getSetCookie === "function") cookies.push(...given.getSetCookie());
+  else given.forEach((value, name) => {
+    if (name === "set-cookie") cookies.push(value);
+  });
+  if (cookies.length) {
+    headers.delete("set-cookie");
+    for (const cookie of cookies) headers.append("set-cookie", cookie);
+  }
+  const cookie2 = given.get("set-cookie2");
+  if (cookie2 !== null) headers.set("set-cookie2", cookie2);
+  return headers;
+}
+function givenHeaders(init) {
+  const headers = init == null ? void 0 : init.headers;
+  return headers === void 0 || headers === null ? void 0 : new Headers(headers);
+}
+function withHeaders(init, headers) {
+  const status = init == null ? void 0 : init.status;
+  const statusText = init == null ? void 0 : init.statusText;
+  return {
+    headers,
+    ...status === void 0 ? {} : { status },
+    ...statusText === void 0 ? {} : { statusText }
+  };
+}
+function installNodeResponse(target) {
+  var _a3;
+  const Native = target.Response;
+  if (typeof Native !== "function" || Native[INSTALLED]) return;
+  const proto = Native.prototype;
+  const nativeHeaders = (_a3 = Object.getOwnPropertyDescriptor(proto, "headers")) == null ? void 0 : _a3.get;
+  const nativeFormData = proto.formData;
+  const nativeBlob = proto.blob;
+  const nativeArrayBuffer = proto.arrayBuffer;
+  const nativeClone = proto.clone;
+  if (!nativeHeaders) return;
+  const kept = /* @__PURE__ */ new WeakMap();
+  const NodeResponse = function Response2(body, init) {
+    if (!new.target) throw new TypeError("Class constructor Response cannot be invoked without 'new'");
+    const given = givenHeaders(init);
+    const response = Reflect.construct(Native, [body, given ? withHeaders(init, given) : init], new.target === NodeResponse ? Native : new.target);
+    kept.set(response, withCookies(nativeHeaders.call(response), given));
+    return response;
+  };
+  NodeResponse.prototype = proto;
+  Object.defineProperty(NodeResponse, "length", { value: 0, configurable: true });
+  Object.defineProperty(NodeResponse, INSTALLED, { value: true });
+  Object.setPrototypeOf(NodeResponse, Object.getPrototypeOf(Native));
+  Object.defineProperty(NodeResponse, "json", {
+    value: function json(data2, init) {
+      const given = givenHeaders(init);
+      const response = Native.json(data2, given ? withHeaders(init, given) : init);
+      kept.set(response, withCookies(nativeHeaders.call(response), given));
+      return response;
+    },
+    writable: true,
+    configurable: true
+  });
+  Object.defineProperty(NodeResponse, "redirect", { value: function redirect(url2, status) {
+    return Native.redirect(url2, status);
+  }, writable: true, configurable: true });
+  Object.defineProperty(NodeResponse, "error", { value: function error() {
+    return Native.error();
+  }, writable: true, configurable: true });
+  defineOnHost(proto, "headers", {
+    get() {
+      return kept.get(this) ?? nativeHeaders.call(this);
+    },
+    enumerable: true,
+    configurable: true
+  });
+  defineOnHost(proto, "constructor", { value: NodeResponse, writable: true, enumerable: false, configurable: true });
+  defineOnHost(proto, "clone", {
+    value: function clone() {
+      const copy2 = nativeClone.call(this);
+      const headers = kept.get(this);
+      if (headers) kept.set(copy2, new Headers(headers));
+      return copy2;
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  const changedType = (response) => {
+    const headers = kept.get(response);
+    if (!headers) return void 0;
+    const current3 = headers.get("content-type");
+    return current3 === nativeHeaders.call(response).get("content-type") ? void 0 : current3;
+  };
+  defineOnHost(proto, "formData", {
+    value: async function formData() {
+      const type2 = changedType(this);
+      if (type2 === void 0) return nativeFormData.call(this);
+      const bytes2 = await nativeArrayBuffer.call(this);
+      return nativeFormData.call(Reflect.construct(Native, [bytes2, type2 === null ? {} : { headers: { "content-type": type2 } }]));
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  defineOnHost(proto, "blob", {
+    value: async function blob() {
+      const type2 = changedType(this);
+      if (type2 === void 0) return nativeBlob.call(this);
+      return new Blob([await nativeArrayBuffer.call(this)], type2 === null ? {} : { type: type2 });
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  takeFromHost(target, "Response", NodeResponse);
+}
 function simpleHash(str) {
   let hash2 = 0;
   for (let i10 = 0; i10 < str.length; i10++) {
@@ -75670,7 +75780,7 @@ const readlineModule = lazyModule("readline");
 lazyModule("readline/promises");
 const zlibModule = lazyModule("zlib");
 const PUNYCODE_SOURCE = "'use strict';\n\n/** Highest positive signed 32-bit float value */\nconst maxInt = 2147483647; // aka. 0x7FFFFFFF or 2^31-1\n\n/** Bootstring parameters */\nconst base = 36;\nconst tMin = 1;\nconst tMax = 26;\nconst skew = 38;\nconst damp = 700;\nconst initialBias = 72;\nconst initialN = 128; // 0x80\nconst delimiter = '-'; // '\\x2D'\n\n/** Regular expressions */\nconst regexPunycode = /^xn--/;\nconst regexNonASCII = /[^\\0-\\x7F]/; // Note: U+007F DEL is excluded too.\nconst regexSeparators = /[\\x2E\\u3002\\uFF0E\\uFF61]/g; // RFC 3490 separators\n\n/** Error messages */\nconst errors = {\n	'overflow': 'Overflow: input needs wider integers to process',\n	'not-basic': 'Illegal input >= 0x80 (not a basic code point)',\n	'invalid-input': 'Invalid input'\n};\n\n/** Convenience shortcuts */\nconst baseMinusTMin = base - tMin;\nconst floor = Math.floor;\nconst stringFromCharCode = String.fromCharCode;\n\n/*--------------------------------------------------------------------------*/\n\n/**\n * A generic error utility function.\n * @private\n * @param {String} type The error type.\n * @returns {Error} Throws a `RangeError` with the applicable error message.\n */\nfunction error(type) {\n	throw new RangeError(errors[type]);\n}\n\n/**\n * A generic `Array#map` utility function.\n * @private\n * @param {Array} array The array to iterate over.\n * @param {Function} callback The function that gets called for every array\n * item.\n * @returns {Array} A new array of values returned by the callback function.\n */\nfunction map(array, callback) {\n	const result = [];\n	let length = array.length;\n	while (length--) {\n		result[length] = callback(array[length]);\n	}\n	return result;\n}\n\n/**\n * A simple `Array#map`-like wrapper to work with domain name strings or email\n * addresses.\n * @private\n * @param {String} domain The domain name or email address.\n * @param {Function} callback The function that gets called for every\n * character.\n * @returns {String} A new string of characters returned by the callback\n * function.\n */\nfunction mapDomain(domain, callback) {\n	const parts = domain.split('@');\n	let result = '';\n	if (parts.length > 1) {\n		// In email addresses, only the domain name should be punycoded. Leave\n		// the local part (i.e. everything up to `@`) intact.\n		result = parts[0] + '@';\n		domain = parts[1];\n	}\n	// Avoid `split(regex)` for IE8 compatibility. See #17.\n	domain = domain.replace(regexSeparators, '\\x2E');\n	const labels = domain.split('.');\n	const encoded = map(labels, callback).join('.');\n	return result + encoded;\n}\n\n/**\n * Creates an array containing the numeric code points of each Unicode\n * character in the string. While JavaScript uses UCS-2 internally,\n * this function will convert a pair of surrogate halves (each of which\n * UCS-2 exposes as separate characters) into a single code point,\n * matching UTF-16.\n * @see `punycode.ucs2.encode`\n * @see <https://mathiasbynens.be/notes/javascript-encoding>\n * @memberOf punycode.ucs2\n * @name decode\n * @param {String} string The Unicode input string (UCS-2).\n * @returns {Array} The new array of code points.\n */\nfunction ucs2decode(string) {\n	const output = [];\n	let counter = 0;\n	const length = string.length;\n	while (counter < length) {\n		const value = string.charCodeAt(counter++);\n		if (value >= 0xD800 && value <= 0xDBFF && counter < length) {\n			// It's a high surrogate, and there is a next character.\n			const extra = string.charCodeAt(counter++);\n			if ((extra & 0xFC00) == 0xDC00) { // Low surrogate.\n				output.push(((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000);\n			} else {\n				// It's an unmatched surrogate; only append this code unit, in case the\n				// next code unit is the high surrogate of a surrogate pair.\n				output.push(value);\n				counter--;\n			}\n		} else {\n			output.push(value);\n		}\n	}\n	return output;\n}\n\n/**\n * Creates a string based on an array of numeric code points.\n * @see `punycode.ucs2.decode`\n * @memberOf punycode.ucs2\n * @name encode\n * @param {Array} codePoints The array of numeric code points.\n * @returns {String} The new Unicode string (UCS-2).\n */\nconst ucs2encode = codePoints => String.fromCodePoint(...codePoints);\n\n/**\n * Converts a basic code point into a digit/integer.\n * @see `digitToBasic()`\n * @private\n * @param {Number} codePoint The basic numeric code point value.\n * @returns {Number} The numeric value of a basic code point (for use in\n * representing integers) in the range `0` to `base - 1`, or `base` if\n * the code point does not represent a value.\n */\nconst basicToDigit = function(codePoint) {\n	if (codePoint >= 0x30 && codePoint < 0x3A) {\n		return 26 + (codePoint - 0x30);\n	}\n	if (codePoint >= 0x41 && codePoint < 0x5B) {\n		return codePoint - 0x41;\n	}\n	if (codePoint >= 0x61 && codePoint < 0x7B) {\n		return codePoint - 0x61;\n	}\n	return base;\n};\n\n/**\n * Converts a digit/integer into a basic code point.\n * @see `basicToDigit()`\n * @private\n * @param {Number} digit The numeric value of a basic code point.\n * @returns {Number} The basic code point whose value (when used for\n * representing integers) is `digit`, which needs to be in the range\n * `0` to `base - 1`. If `flag` is non-zero, the uppercase form is\n * used; else, the lowercase form is used. The behavior is undefined\n * if `flag` is non-zero and `digit` has no uppercase form.\n */\nconst digitToBasic = function(digit, flag) {\n	//  0..25 map to ASCII a..z or A..Z\n	// 26..35 map to ASCII 0..9\n	return digit + 22 + 75 * (digit < 26) - ((flag != 0) << 5);\n};\n\n/**\n * Bias adaptation function as per section 3.4 of RFC 3492.\n * https://tools.ietf.org/html/rfc3492#section-3.4\n * @private\n */\nconst adapt = function(delta, numPoints, firstTime) {\n	let k = 0;\n	delta = firstTime ? floor(delta / damp) : delta >> 1;\n	delta += floor(delta / numPoints);\n	for (/* no initialization */; delta > baseMinusTMin * tMax >> 1; k += base) {\n		delta = floor(delta / baseMinusTMin);\n	}\n	return floor(k + (baseMinusTMin + 1) * delta / (delta + skew));\n};\n\n/**\n * Converts a Punycode string of ASCII-only symbols to a string of Unicode\n * symbols.\n * @memberOf punycode\n * @param {String} input The Punycode string of ASCII-only symbols.\n * @returns {String} The resulting string of Unicode symbols.\n */\nconst decode = function(input) {\n	// Don't use UCS-2.\n	const output = [];\n	const inputLength = input.length;\n	let i = 0;\n	let n = initialN;\n	let bias = initialBias;\n\n	// Handle the basic code points: let `basic` be the number of input code\n	// points before the last delimiter, or `0` if there is none, then copy\n	// the first basic code points to the output.\n\n	let basic = input.lastIndexOf(delimiter);\n	if (basic < 0) {\n		basic = 0;\n	}\n\n	for (let j = 0; j < basic; ++j) {\n		// if it's not a basic code point\n		if (input.charCodeAt(j) >= 0x80) {\n			error('not-basic');\n		}\n		output.push(input.charCodeAt(j));\n	}\n\n	// Main decoding loop: start just after the last delimiter if any basic code\n	// points were copied; start at the beginning otherwise.\n\n	for (let index = basic > 0 ? basic + 1 : 0; index < inputLength; /* no final expression */) {\n\n		// `index` is the index of the next character to be consumed.\n		// Decode a generalized variable-length integer into `delta`,\n		// which gets added to `i`. The overflow checking is easier\n		// if we increase `i` as we go, then subtract off its starting\n		// value at the end to obtain `delta`.\n		const oldi = i;\n		for (let w = 1, k = base; /* no condition */; k += base) {\n\n			if (index >= inputLength) {\n				error('invalid-input');\n			}\n\n			const digit = basicToDigit(input.charCodeAt(index++));\n\n			if (digit >= base) {\n				error('invalid-input');\n			}\n			if (digit > floor((maxInt - i) / w)) {\n				error('overflow');\n			}\n\n			i += digit * w;\n			const t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);\n\n			if (digit < t) {\n				break;\n			}\n\n			const baseMinusT = base - t;\n			if (w > floor(maxInt / baseMinusT)) {\n				error('overflow');\n			}\n\n			w *= baseMinusT;\n\n		}\n\n		const out = output.length + 1;\n		bias = adapt(i - oldi, out, oldi == 0);\n\n		// `i` was supposed to wrap around from `out` to `0`,\n		// incrementing `n` each time, so we'll fix that now:\n		if (floor(i / out) > maxInt - n) {\n			error('overflow');\n		}\n\n		n += floor(i / out);\n		i %= out;\n\n		// Insert `n` at position `i` of the output.\n		output.splice(i++, 0, n);\n\n	}\n\n	return String.fromCodePoint(...output);\n};\n\n/**\n * Converts a string of Unicode symbols (e.g. a domain name label) to a\n * Punycode string of ASCII-only symbols.\n * @memberOf punycode\n * @param {String} input The string of Unicode symbols.\n * @returns {String} The resulting Punycode string of ASCII-only symbols.\n */\nconst encode = function(input) {\n	const output = [];\n\n	// Convert the input in UCS-2 to an array of Unicode code points.\n	input = ucs2decode(input);\n\n	// Cache the length.\n	const inputLength = input.length;\n\n	// Initialize the state.\n	let n = initialN;\n	let delta = 0;\n	let bias = initialBias;\n\n	// Handle the basic code points.\n	for (const currentValue of input) {\n		if (currentValue < 0x80) {\n			output.push(stringFromCharCode(currentValue));\n		}\n	}\n\n	const basicLength = output.length;\n	let handledCPCount = basicLength;\n\n	// `handledCPCount` is the number of code points that have been handled;\n	// `basicLength` is the number of basic code points.\n\n	// Finish the basic string with a delimiter unless it's empty.\n	if (basicLength) {\n		output.push(delimiter);\n	}\n\n	// Main encoding loop:\n	while (handledCPCount < inputLength) {\n\n		// All non-basic code points < n have been handled already. Find the next\n		// larger one:\n		let m = maxInt;\n		for (const currentValue of input) {\n			if (currentValue >= n && currentValue < m) {\n				m = currentValue;\n			}\n		}\n\n		// Increase `delta` enough to advance the decoder's <n,i> state to <m,0>,\n		// but guard against overflow.\n		const handledCPCountPlusOne = handledCPCount + 1;\n		if (m - n > floor((maxInt - delta) / handledCPCountPlusOne)) {\n			error('overflow');\n		}\n\n		delta += (m - n) * handledCPCountPlusOne;\n		n = m;\n\n		for (const currentValue of input) {\n			if (currentValue < n && ++delta > maxInt) {\n				error('overflow');\n			}\n			if (currentValue === n) {\n				// Represent delta as a generalized variable-length integer.\n				let q = delta;\n				for (let k = base; /* no condition */; k += base) {\n					const t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);\n					if (q < t) {\n						break;\n					}\n					const qMinusT = q - t;\n					const baseMinusT = base - t;\n					output.push(\n						stringFromCharCode(digitToBasic(t + qMinusT % baseMinusT, 0))\n					);\n					q = floor(qMinusT / baseMinusT);\n				}\n\n				output.push(stringFromCharCode(digitToBasic(q, 0)));\n				bias = adapt(delta, handledCPCountPlusOne, handledCPCount === basicLength);\n				delta = 0;\n				++handledCPCount;\n			}\n		}\n\n		++delta;\n		++n;\n\n	}\n	return output.join('');\n};\n\n/**\n * Converts a Punycode string representing a domain name or an email address\n * to Unicode. Only the Punycoded parts of the input will be converted, i.e.\n * it doesn't matter if you call it on a string that has already been\n * converted to Unicode.\n * @memberOf punycode\n * @param {String} input The Punycoded domain name or email address to\n * convert to Unicode.\n * @returns {String} The Unicode representation of the given Punycode\n * string.\n */\nconst toUnicode = function(input) {\n	return mapDomain(input, function(string) {\n		return regexPunycode.test(string)\n			? decode(string.slice(4).toLowerCase())\n			: string;\n	});\n};\n\n/**\n * Converts a Unicode string representing a domain name or an email address to\n * Punycode. Only the non-ASCII parts of the domain name will be converted,\n * i.e. it doesn't matter if you call it with a domain that's already in\n * ASCII.\n * @memberOf punycode\n * @param {String} input The domain name or email address to convert, as a\n * Unicode string.\n * @returns {String} The Punycode representation of the given domain name or\n * email address.\n */\nconst toASCII = function(input) {\n	return mapDomain(input, function(string) {\n		return regexNonASCII.test(string)\n			? 'xn--' + encode(string)\n			: string;\n	});\n};\n\n/*--------------------------------------------------------------------------*/\n\n/** Define the public API */\nconst punycode = {\n	/**\n	 * A string representing the current Punycode.js version number.\n	 * @memberOf punycode\n	 * @type String\n	 */\n	'version': '2.3.1',\n	/**\n	 * An object of methods to convert from JavaScript's internal character\n	 * representation (UCS-2) to Unicode code points, and back.\n	 * @see <https://mathiasbynens.be/notes/javascript-encoding>\n	 * @memberOf punycode\n	 * @type Object\n	 */\n	'ucs2': {\n		'decode': ucs2decode,\n		'encode': ucs2encode\n	},\n	'decode': decode,\n	'encode': encode,\n	'toASCII': toASCII,\n	'toUnicode': toUnicode\n};\n\nmodule.exports = punycode;\n";
-const ESBUILD_WASM_VERSION = "0.20.0";
+const ESBUILD_WASM_VERSION = "0.28.2";
 const ROLLUP_BROWSER_VERSION = "4.63.1";
 const ESBUILD_WASM_BINARY_CDN = `https://unpkg.com/esbuild-wasm@${ESBUILD_WASM_VERSION}/esbuild.wasm`;
 const ESBUILD_WASM_BROWSER_CDN = `https://unpkg.com/esbuild-wasm@${ESBUILD_WASM_VERSION}/esm/browser.min.js`;
@@ -76559,7 +76669,7 @@ function buildSync(_options3) {
   throw new Error("buildSync is not available in browser. Use build() instead.");
 }
 function version() {
-  return "0.20.0";
+  return ESBUILD_WASM_VERSION;
 }
 async function context(options) {
   let disposed = false;
@@ -80461,6 +80571,9 @@ forGuestRealm(() => {
     takeFromHost(globalThis, "Request", NodeRequest);
   }
 });
+forGuestRealm(() => {
+  installNodeResponse(globalThis);
+});
 forGuestRealm(() => {
   const kIsClosedPromise = Symbol.for("nodejs.webstream.isClosedPromise");
   const Native = globalThis.ReadableStream;

package/dist/config/cdn.d.ts

@@ -3,9 +3,9 @@
  * other place: the versions the engine's `esbuild` and `rollup` doors are
  * written against.
  */
-export declare const ESBUILD_WASM_VERSION = "0.20.0";
+export declare const ESBUILD_WASM_VERSION = "0.28.2";
 export declare const ROLLUP_BROWSER_VERSION = "4.63.1";
-export declare const ESBUILD_WASM_ESM_CDN = "https://esm.sh/esbuild-wasm@0.20.0";
-export declare const ESBUILD_WASM_BINARY_CDN = "https://unpkg.com/esbuild-wasm@0.20.0/esbuild.wasm";
-export declare const ESBUILD_WASM_BROWSER_CDN = "https://unpkg.com/esbuild-wasm@0.20.0/esm/browser.min.js";
+export declare const ESBUILD_WASM_ESM_CDN = "https://esm.sh/esbuild-wasm@0.28.2";
+export declare const ESBUILD_WASM_BINARY_CDN = "https://unpkg.com/esbuild-wasm@0.28.2/esbuild.wasm";
+export declare const ESBUILD_WASM_BROWSER_CDN = "https://unpkg.com/esbuild-wasm@0.28.2/esm/browser.min.js";
 export declare const ROLLUP_BROWSER_CDN = "https://esm.sh/@rollup/browser@4.63.1";

package/dist/index.mjs

@@ -32494,6 +32494,123 @@ function guestFetch(process2, fallback) {
     return owner === null ? dispatch() : enterRun(owner, dispatch);
   };
 }
+const INSTALLED = Symbol.for("tabnode.response.keepsSetCookie");
+function withCookies(own, given) {
+  const headers = new Headers(own);
+  if (!given) return headers;
+  const cookies = [];
+  if (typeof given.getSetCookie === "function") cookies.push(...given.getSetCookie());
+  else given.forEach((value, name) => {
+    if (name === "set-cookie") cookies.push(value);
+  });
+  if (cookies.length) {
+    headers.delete("set-cookie");
+    for (const cookie of cookies) headers.append("set-cookie", cookie);
+  }
+  const cookie2 = given.get("set-cookie2");
+  if (cookie2 !== null) headers.set("set-cookie2", cookie2);
+  return headers;
+}
+function givenHeaders(init) {
+  const headers = init == null ? void 0 : init.headers;
+  return headers === void 0 || headers === null ? void 0 : new Headers(headers);
+}
+function withHeaders(init, headers) {
+  const status = init == null ? void 0 : init.status;
+  const statusText = init == null ? void 0 : init.statusText;
+  return {
+    headers,
+    ...status === void 0 ? {} : { status },
+    ...statusText === void 0 ? {} : { statusText }
+  };
+}
+function installNodeResponse(target) {
+  var _a2;
+  const Native = target.Response;
+  if (typeof Native !== "function" || Native[INSTALLED]) return;
+  const proto = Native.prototype;
+  const nativeHeaders = (_a2 = Object.getOwnPropertyDescriptor(proto, "headers")) == null ? void 0 : _a2.get;
+  const nativeFormData = proto.formData;
+  const nativeBlob = proto.blob;
+  const nativeArrayBuffer = proto.arrayBuffer;
+  const nativeClone = proto.clone;
+  if (!nativeHeaders) return;
+  const kept = /* @__PURE__ */ new WeakMap();
+  const NodeResponse = function Response(body, init) {
+    if (!new.target) throw new TypeError("Class constructor Response cannot be invoked without 'new'");
+    const given = givenHeaders(init);
+    const response = Reflect.construct(Native, [body, given ? withHeaders(init, given) : init], new.target === NodeResponse ? Native : new.target);
+    kept.set(response, withCookies(nativeHeaders.call(response), given));
+    return response;
+  };
+  NodeResponse.prototype = proto;
+  Object.defineProperty(NodeResponse, "length", { value: 0, configurable: true });
+  Object.defineProperty(NodeResponse, INSTALLED, { value: true });
+  Object.setPrototypeOf(NodeResponse, Object.getPrototypeOf(Native));
+  Object.defineProperty(NodeResponse, "json", {
+    value: function json(data2, init) {
+      const given = givenHeaders(init);
+      const response = Native.json(data2, given ? withHeaders(init, given) : init);
+      kept.set(response, withCookies(nativeHeaders.call(response), given));
+      return response;
+    },
+    writable: true,
+    configurable: true
+  });
+  Object.defineProperty(NodeResponse, "redirect", { value: function redirect(url2, status) {
+    return Native.redirect(url2, status);
+  }, writable: true, configurable: true });
+  Object.defineProperty(NodeResponse, "error", { value: function error() {
+    return Native.error();
+  }, writable: true, configurable: true });
+  defineOnHost(proto, "headers", {
+    get() {
+      return kept.get(this) ?? nativeHeaders.call(this);
+    },
+    enumerable: true,
+    configurable: true
+  });
+  defineOnHost(proto, "constructor", { value: NodeResponse, writable: true, enumerable: false, configurable: true });
+  defineOnHost(proto, "clone", {
+    value: function clone() {
+      const copy2 = nativeClone.call(this);
+      const headers = kept.get(this);
+      if (headers) kept.set(copy2, new Headers(headers));
+      return copy2;
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  const changedType = (response) => {
+    const headers = kept.get(response);
+    if (!headers) return void 0;
+    const current3 = headers.get("content-type");
+    return current3 === nativeHeaders.call(response).get("content-type") ? void 0 : current3;
+  };
+  defineOnHost(proto, "formData", {
+    value: async function formData() {
+      const type2 = changedType(this);
+      if (type2 === void 0) return nativeFormData.call(this);
+      const bytes2 = await nativeArrayBuffer.call(this);
+      return nativeFormData.call(Reflect.construct(Native, [bytes2, type2 === null ? {} : { headers: { "content-type": type2 } }]));
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  defineOnHost(proto, "blob", {
+    value: async function blob() {
+      const type2 = changedType(this);
+      if (type2 === void 0) return nativeBlob.call(this);
+      return new Blob([await nativeArrayBuffer.call(this)], type2 === null ? {} : { type: type2 });
+    },
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+  takeFromHost(target, "Response", NodeResponse);
+}
 function simpleHash(str) {
   let hash2 = 0;
   for (let i2 = 0; i2 < str.length; i2++) {
@@ -35327,7 +35444,7 @@ const readlineModule = lazyModule("readline");
 lazyModule("readline/promises");
 const zlibModule = lazyModule("zlib");
 const PUNYCODE_SOURCE = "'use strict';\n\n/** Highest positive signed 32-bit float value */\nconst maxInt = 2147483647; // aka. 0x7FFFFFFF or 2^31-1\n\n/** Bootstring parameters */\nconst base = 36;\nconst tMin = 1;\nconst tMax = 26;\nconst skew = 38;\nconst damp = 700;\nconst initialBias = 72;\nconst initialN = 128; // 0x80\nconst delimiter = '-'; // '\\x2D'\n\n/** Regular expressions */\nconst regexPunycode = /^xn--/;\nconst regexNonASCII = /[^\\0-\\x7F]/; // Note: U+007F DEL is excluded too.\nconst regexSeparators = /[\\x2E\\u3002\\uFF0E\\uFF61]/g; // RFC 3490 separators\n\n/** Error messages */\nconst errors = {\n	'overflow': 'Overflow: input needs wider integers to process',\n	'not-basic': 'Illegal input >= 0x80 (not a basic code point)',\n	'invalid-input': 'Invalid input'\n};\n\n/** Convenience shortcuts */\nconst baseMinusTMin = base - tMin;\nconst floor = Math.floor;\nconst stringFromCharCode = String.fromCharCode;\n\n/*--------------------------------------------------------------------------*/\n\n/**\n * A generic error utility function.\n * @private\n * @param {String} type The error type.\n * @returns {Error} Throws a `RangeError` with the applicable error message.\n */\nfunction error(type) {\n	throw new RangeError(errors[type]);\n}\n\n/**\n * A generic `Array#map` utility function.\n * @private\n * @param {Array} array The array to iterate over.\n * @param {Function} callback The function that gets called for every array\n * item.\n * @returns {Array} A new array of values returned by the callback function.\n */\nfunction map(array, callback) {\n	const result = [];\n	let length = array.length;\n	while (length--) {\n		result[length] = callback(array[length]);\n	}\n	return result;\n}\n\n/**\n * A simple `Array#map`-like wrapper to work with domain name strings or email\n * addresses.\n * @private\n * @param {String} domain The domain name or email address.\n * @param {Function} callback The function that gets called for every\n * character.\n * @returns {String} A new string of characters returned by the callback\n * function.\n */\nfunction mapDomain(domain, callback) {\n	const parts = domain.split('@');\n	let result = '';\n	if (parts.length > 1) {\n		// In email addresses, only the domain name should be punycoded. Leave\n		// the local part (i.e. everything up to `@`) intact.\n		result = parts[0] + '@';\n		domain = parts[1];\n	}\n	// Avoid `split(regex)` for IE8 compatibility. See #17.\n	domain = domain.replace(regexSeparators, '\\x2E');\n	const labels = domain.split('.');\n	const encoded = map(labels, callback).join('.');\n	return result + encoded;\n}\n\n/**\n * Creates an array containing the numeric code points of each Unicode\n * character in the string. While JavaScript uses UCS-2 internally,\n * this function will convert a pair of surrogate halves (each of which\n * UCS-2 exposes as separate characters) into a single code point,\n * matching UTF-16.\n * @see `punycode.ucs2.encode`\n * @see <https://mathiasbynens.be/notes/javascript-encoding>\n * @memberOf punycode.ucs2\n * @name decode\n * @param {String} string The Unicode input string (UCS-2).\n * @returns {Array} The new array of code points.\n */\nfunction ucs2decode(string) {\n	const output = [];\n	let counter = 0;\n	const length = string.length;\n	while (counter < length) {\n		const value = string.charCodeAt(counter++);\n		if (value >= 0xD800 && value <= 0xDBFF && counter < length) {\n			// It's a high surrogate, and there is a next character.\n			const extra = string.charCodeAt(counter++);\n			if ((extra & 0xFC00) == 0xDC00) { // Low surrogate.\n				output.push(((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000);\n			} else {\n				// It's an unmatched surrogate; only append this code unit, in case the\n				// next code unit is the high surrogate of a surrogate pair.\n				output.push(value);\n				counter--;\n			}\n		} else {\n			output.push(value);\n		}\n	}\n	return output;\n}\n\n/**\n * Creates a string based on an array of numeric code points.\n * @see `punycode.ucs2.decode`\n * @memberOf punycode.ucs2\n * @name encode\n * @param {Array} codePoints The array of numeric code points.\n * @returns {String} The new Unicode string (UCS-2).\n */\nconst ucs2encode = codePoints => String.fromCodePoint(...codePoints);\n\n/**\n * Converts a basic code point into a digit/integer.\n * @see `digitToBasic()`\n * @private\n * @param {Number} codePoint The basic numeric code point value.\n * @returns {Number} The numeric value of a basic code point (for use in\n * representing integers) in the range `0` to `base - 1`, or `base` if\n * the code point does not represent a value.\n */\nconst basicToDigit = function(codePoint) {\n	if (codePoint >= 0x30 && codePoint < 0x3A) {\n		return 26 + (codePoint - 0x30);\n	}\n	if (codePoint >= 0x41 && codePoint < 0x5B) {\n		return codePoint - 0x41;\n	}\n	if (codePoint >= 0x61 && codePoint < 0x7B) {\n		return codePoint - 0x61;\n	}\n	return base;\n};\n\n/**\n * Converts a digit/integer into a basic code point.\n * @see `basicToDigit()`\n * @private\n * @param {Number} digit The numeric value of a basic code point.\n * @returns {Number} The basic code point whose value (when used for\n * representing integers) is `digit`, which needs to be in the range\n * `0` to `base - 1`. If `flag` is non-zero, the uppercase form is\n * used; else, the lowercase form is used. The behavior is undefined\n * if `flag` is non-zero and `digit` has no uppercase form.\n */\nconst digitToBasic = function(digit, flag) {\n	//  0..25 map to ASCII a..z or A..Z\n	// 26..35 map to ASCII 0..9\n	return digit + 22 + 75 * (digit < 26) - ((flag != 0) << 5);\n};\n\n/**\n * Bias adaptation function as per section 3.4 of RFC 3492.\n * https://tools.ietf.org/html/rfc3492#section-3.4\n * @private\n */\nconst adapt = function(delta, numPoints, firstTime) {\n	let k = 0;\n	delta = firstTime ? floor(delta / damp) : delta >> 1;\n	delta += floor(delta / numPoints);\n	for (/* no initialization */; delta > baseMinusTMin * tMax >> 1; k += base) {\n		delta = floor(delta / baseMinusTMin);\n	}\n	return floor(k + (baseMinusTMin + 1) * delta / (delta + skew));\n};\n\n/**\n * Converts a Punycode string of ASCII-only symbols to a string of Unicode\n * symbols.\n * @memberOf punycode\n * @param {String} input The Punycode string of ASCII-only symbols.\n * @returns {String} The resulting string of Unicode symbols.\n */\nconst decode = function(input) {\n	// Don't use UCS-2.\n	const output = [];\n	const inputLength = input.length;\n	let i = 0;\n	let n = initialN;\n	let bias = initialBias;\n\n	// Handle the basic code points: let `basic` be the number of input code\n	// points before the last delimiter, or `0` if there is none, then copy\n	// the first basic code points to the output.\n\n	let basic = input.lastIndexOf(delimiter);\n	if (basic < 0) {\n		basic = 0;\n	}\n\n	for (let j = 0; j < basic; ++j) {\n		// if it's not a basic code point\n		if (input.charCodeAt(j) >= 0x80) {\n			error('not-basic');\n		}\n		output.push(input.charCodeAt(j));\n	}\n\n	// Main decoding loop: start just after the last delimiter if any basic code\n	// points were copied; start at the beginning otherwise.\n\n	for (let index = basic > 0 ? basic + 1 : 0; index < inputLength; /* no final expression */) {\n\n		// `index` is the index of the next character to be consumed.\n		// Decode a generalized variable-length integer into `delta`,\n		// which gets added to `i`. The overflow checking is easier\n		// if we increase `i` as we go, then subtract off its starting\n		// value at the end to obtain `delta`.\n		const oldi = i;\n		for (let w = 1, k = base; /* no condition */; k += base) {\n\n			if (index >= inputLength) {\n				error('invalid-input');\n			}\n\n			const digit = basicToDigit(input.charCodeAt(index++));\n\n			if (digit >= base) {\n				error('invalid-input');\n			}\n			if (digit > floor((maxInt - i) / w)) {\n				error('overflow');\n			}\n\n			i += digit * w;\n			const t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);\n\n			if (digit < t) {\n				break;\n			}\n\n			const baseMinusT = base - t;\n			if (w > floor(maxInt / baseMinusT)) {\n				error('overflow');\n			}\n\n			w *= baseMinusT;\n\n		}\n\n		const out = output.length + 1;\n		bias = adapt(i - oldi, out, oldi == 0);\n\n		// `i` was supposed to wrap around from `out` to `0`,\n		// incrementing `n` each time, so we'll fix that now:\n		if (floor(i / out) > maxInt - n) {\n			error('overflow');\n		}\n\n		n += floor(i / out);\n		i %= out;\n\n		// Insert `n` at position `i` of the output.\n		output.splice(i++, 0, n);\n\n	}\n\n	return String.fromCodePoint(...output);\n};\n\n/**\n * Converts a string of Unicode symbols (e.g. a domain name label) to a\n * Punycode string of ASCII-only symbols.\n * @memberOf punycode\n * @param {String} input The string of Unicode symbols.\n * @returns {String} The resulting Punycode string of ASCII-only symbols.\n */\nconst encode = function(input) {\n	const output = [];\n\n	// Convert the input in UCS-2 to an array of Unicode code points.\n	input = ucs2decode(input);\n\n	// Cache the length.\n	const inputLength = input.length;\n\n	// Initialize the state.\n	let n = initialN;\n	let delta = 0;\n	let bias = initialBias;\n\n	// Handle the basic code points.\n	for (const currentValue of input) {\n		if (currentValue < 0x80) {\n			output.push(stringFromCharCode(currentValue));\n		}\n	}\n\n	const basicLength = output.length;\n	let handledCPCount = basicLength;\n\n	// `handledCPCount` is the number of code points that have been handled;\n	// `basicLength` is the number of basic code points.\n\n	// Finish the basic string with a delimiter unless it's empty.\n	if (basicLength) {\n		output.push(delimiter);\n	}\n\n	// Main encoding loop:\n	while (handledCPCount < inputLength) {\n\n		// All non-basic code points < n have been handled already. Find the next\n		// larger one:\n		let m = maxInt;\n		for (const currentValue of input) {\n			if (currentValue >= n && currentValue < m) {\n				m = currentValue;\n			}\n		}\n\n		// Increase `delta` enough to advance the decoder's <n,i> state to <m,0>,\n		// but guard against overflow.\n		const handledCPCountPlusOne = handledCPCount + 1;\n		if (m - n > floor((maxInt - delta) / handledCPCountPlusOne)) {\n			error('overflow');\n		}\n\n		delta += (m - n) * handledCPCountPlusOne;\n		n = m;\n\n		for (const currentValue of input) {\n			if (currentValue < n && ++delta > maxInt) {\n				error('overflow');\n			}\n			if (currentValue === n) {\n				// Represent delta as a generalized variable-length integer.\n				let q = delta;\n				for (let k = base; /* no condition */; k += base) {\n					const t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);\n					if (q < t) {\n						break;\n					}\n					const qMinusT = q - t;\n					const baseMinusT = base - t;\n					output.push(\n						stringFromCharCode(digitToBasic(t + qMinusT % baseMinusT, 0))\n					);\n					q = floor(qMinusT / baseMinusT);\n				}\n\n				output.push(stringFromCharCode(digitToBasic(q, 0)));\n				bias = adapt(delta, handledCPCountPlusOne, handledCPCount === basicLength);\n				delta = 0;\n				++handledCPCount;\n			}\n		}\n\n		++delta;\n		++n;\n\n	}\n	return output.join('');\n};\n\n/**\n * Converts a Punycode string representing a domain name or an email address\n * to Unicode. Only the Punycoded parts of the input will be converted, i.e.\n * it doesn't matter if you call it on a string that has already been\n * converted to Unicode.\n * @memberOf punycode\n * @param {String} input The Punycoded domain name or email address to\n * convert to Unicode.\n * @returns {String} The Unicode representation of the given Punycode\n * string.\n */\nconst toUnicode = function(input) {\n	return mapDomain(input, function(string) {\n		return regexPunycode.test(string)\n			? decode(string.slice(4).toLowerCase())\n			: string;\n	});\n};\n\n/**\n * Converts a Unicode string representing a domain name or an email address to\n * Punycode. Only the non-ASCII parts of the domain name will be converted,\n * i.e. it doesn't matter if you call it with a domain that's already in\n * ASCII.\n * @memberOf punycode\n * @param {String} input The domain name or email address to convert, as a\n * Unicode string.\n * @returns {String} The Punycode representation of the given domain name or\n * email address.\n */\nconst toASCII = function(input) {\n	return mapDomain(input, function(string) {\n		return regexNonASCII.test(string)\n			? 'xn--' + encode(string)\n			: string;\n	});\n};\n\n/*--------------------------------------------------------------------------*/\n\n/** Define the public API */\nconst punycode = {\n	/**\n	 * A string representing the current Punycode.js version number.\n	 * @memberOf punycode\n	 * @type String\n	 */\n	'version': '2.3.1',\n	/**\n	 * An object of methods to convert from JavaScript's internal character\n	 * representation (UCS-2) to Unicode code points, and back.\n	 * @see <https://mathiasbynens.be/notes/javascript-encoding>\n	 * @memberOf punycode\n	 * @type Object\n	 */\n	'ucs2': {\n		'decode': ucs2decode,\n		'encode': ucs2encode\n	},\n	'decode': decode,\n	'encode': encode,\n	'toASCII': toASCII,\n	'toUnicode': toUnicode\n};\n\nmodule.exports = punycode;\n";
-const ESBUILD_WASM_VERSION = "0.20.0";
+const ESBUILD_WASM_VERSION = "0.28.2";
 const ROLLUP_BROWSER_VERSION = "4.63.1";
 const ESBUILD_WASM_ESM_CDN = `https://esm.sh/esbuild-wasm@${ESBUILD_WASM_VERSION}`;
 const ESBUILD_WASM_BINARY_CDN = `https://unpkg.com/esbuild-wasm@${ESBUILD_WASM_VERSION}/esbuild.wasm`;
@@ -36217,7 +36334,7 @@ function buildSync(_options2) {
   throw new Error("buildSync is not available in browser. Use build() instead.");
 }
 function version() {
-  return "0.20.0";
+  return ESBUILD_WASM_VERSION;
 }
 async function context(options) {
   let disposed = false;
@@ -40126,6 +40243,9 @@ forGuestRealm(() => {
     takeFromHost(globalThis, "Request", NodeRequest);
   }
 });
+forGuestRealm(() => {
+  installNodeResponse(globalThis);
+});
 forGuestRealm(() => {
   const kIsClosedPromise = Symbol.for("nodejs.webstream.isClosedPromise");
   const Native = globalThis.ReadableStream;
@@ -40428,7 +40548,7 @@ class WorkerRuntime {
     this.worker = new Worker(
       new URL(
         /* @vite-ignore */
-        "/assets/runtime-worker-DuSugZ3P.js",
+        "/assets/runtime-worker-B-BP9mj-.js",
         import.meta.url
       ),
       { type: "module" }

package/dist/node-response.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Install the corrected constructor on `target` (the realm's global object),
+ * over the `Response` it has. Every property it changes is remembered for the
+ * host to have back (`restoreHostGlobals`); a realm that has it already is left.
+ */
+export declare function installNodeResponse(target: {
+    Response?: typeof Response;
+}): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.46",
+  "version": "0.5.48",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/config/cdn.ts

@@ -4,7 +4,16 @@
  * written against.
  */
 
-export const ESBUILD_WASM_VERSION = '0.20.0';
+// esbuild-wasm 0.20.0 is built with Go 1.20.12, whose wasm `IndexByte`
+// sign-extends the address `memchr` answers (golang/go#65571, fixed in Go 1.23
+// and backported to 1.21.13 and 1.22.6): once esbuild's heap passes 2 GiB of
+// linear memory, a search that finds its byte in a buffer above that line
+// answers about -4294967295, and esbuild panics slicing with it
+// (`slice bounds out of range [:-4294967295]` in the printer, and outside the
+// linker's recover in `validatePathTemplate`, which ends the service). A long
+// shared instance gets there: a Next application's host pack build did at 2.0
+// GiB on 0.20.0, and ran to the end on 0.28.2.
+export const ESBUILD_WASM_VERSION = '0.28.2';
 export const ROLLUP_BROWSER_VERSION = '4.63.1';
 
 export const ESBUILD_WASM_ESM_CDN = `https://esm.sh/esbuild-wasm@${ESBUILD_WASM_VERSION}`;

package/src/node-response.ts

@@ -0,0 +1,157 @@
+import { defineOnHost, takeFromHost } from './host-globals';
+
+/**
+ * A web `Response` that keeps its `Set-Cookie` headers, as Node's does.
+ *
+ * Node's `Response` (undici's) is built with a `Headers` that holds every
+ * header it was given, `Set-Cookie` and `Set-Cookie2` among them, readable
+ * through `get` (joined with ", "), iteration (one entry per cookie) and
+ * `getSetCookie()`, and mutable afterwards. A browser's applies the fetch
+ * specification's response guard, which drops both silently, on construction
+ * and on every later `append` or `set`: `new Response('', { headers:
+ * { 'set-cookie': 'a=1' } }).headers` is empty in a tab. A server that answers
+ * with a web Response (Next's route handlers and middleware, Hono, Remix,
+ * SvelteKit's adapters, NextAuth among them) then loses every cookie it sets
+ * before its answer is written to the socket, and no one can sign in.
+ *
+ * The realm's `Response` stays the browser's own class in all but its
+ * constructor: the constructor is a function whose `prototype` is the
+ * browser's `Response.prototype`, so a fetch's answer, `Response.error()` and
+ * a program's subclass are each `instanceof Response`, share its prototype and
+ * name it as their `constructor`, as on Node. A response a program constructs
+ * keeps a `Headers` of its own, made without a guard (a `Headers` a program
+ * constructs is one, in a browser too), holding the browser's headers and every
+ * cookie the program gave; `headers` answers it. The body methods whose answer
+ * depends on the content type (`formData`, `blob`) read the kept one, as Node
+ * reads the response's own headers.
+ */
+const INSTALLED = Symbol.for('tabnode.response.keepsSetCookie');
+
+type ResponseConstructor = typeof Response & { [INSTALLED]?: true };
+
+/** The browser's headers with the cookies its guard dropped. */
+function withCookies(own: Headers, given: Headers | undefined): Headers {
+  const headers = new Headers(own);
+  if (!given) return headers;
+  const cookies: string[] = [];
+  if (typeof given.getSetCookie === 'function') cookies.push(...given.getSetCookie());
+  else given.forEach((value, name) => { if (name === 'set-cookie') cookies.push(value); });
+  if (cookies.length) {
+    headers.delete('set-cookie');
+    for (const cookie of cookies) headers.append('set-cookie', cookie);
+  }
+  const cookie2 = given.get('set-cookie2');
+  if (cookie2 !== null) headers.set('set-cookie2', cookie2);
+  return headers;
+}
+
+/** The headers an init names, read once (an iterable may be a generator), as a guard-free `Headers`. */
+function givenHeaders(init: ResponseInit | undefined): Headers | undefined {
+  const headers = init?.headers;
+  return headers === undefined || headers === null ? undefined : new Headers(headers);
+}
+
+/**
+ * The init with its headers replaced, read as the platform reads a
+ * dictionary: each member by name, inherited ones too (a `Response` passed as
+ * the init, as Next's `NextResponse` does, carries its status on a getter of
+ * its prototype, which a spread would not copy).
+ */
+function withHeaders(init: ResponseInit | undefined, headers: Headers): ResponseInit {
+  const status = init?.status;
+  const statusText = init?.statusText;
+  return {
+    headers,
+    ...(status === undefined ? {} : { status }),
+    ...(statusText === undefined ? {} : { statusText }),
+  };
+}
+
+/**
+ * Install the corrected constructor on `target` (the realm's global object),
+ * over the `Response` it has. Every property it changes is remembered for the
+ * host to have back (`restoreHostGlobals`); a realm that has it already is left.
+ */
+export function installNodeResponse(target: { Response?: typeof Response }): void {
+  const Native = target.Response as ResponseConstructor | undefined;
+  if (typeof Native !== 'function' || Native[INSTALLED]) return;
+  const proto = Native.prototype;
+  const nativeHeaders = Object.getOwnPropertyDescriptor(proto, 'headers')?.get;
+  const nativeFormData = proto.formData;
+  const nativeBlob = proto.blob;
+  const nativeArrayBuffer = proto.arrayBuffer;
+  const nativeClone = proto.clone;
+  if (!nativeHeaders) return;
+  const kept = new WeakMap<object, Headers>();
+
+  const NodeResponse = function Response(this: unknown, body?: BodyInit | null, init?: ResponseInit): Response {
+    if (!new.target) throw new TypeError("Class constructor Response cannot be invoked without 'new'");
+    const given = givenHeaders(init);
+    const response = Reflect.construct(Native, [body, given ? withHeaders(init, given) : init], (new.target as unknown) === NodeResponse ? Native : new.target) as Response;
+    kept.set(response, withCookies(nativeHeaders.call(response) as Headers, given));
+    return response;
+  } as unknown as ResponseConstructor;
+  NodeResponse.prototype = proto;
+  Object.defineProperty(NodeResponse, 'length', { value: 0, configurable: true });
+  Object.defineProperty(NodeResponse, INSTALLED, { value: true });
+  Object.setPrototypeOf(NodeResponse, Object.getPrototypeOf(Native));
+
+  // Node's statics answer a response whose headers are as mutable as a
+  // constructed one's (json) or immutable (redirect, error), as here.
+  Object.defineProperty(NodeResponse, 'json', {
+    value: function json(data: unknown, init?: ResponseInit): Response {
+      const given = givenHeaders(init);
+      const response = Native.json(data, given ? withHeaders(init, given) : init);
+      kept.set(response, withCookies(nativeHeaders.call(response) as Headers, given));
+      return response;
+    },
+    writable: true, configurable: true,
+  });
+  Object.defineProperty(NodeResponse, 'redirect', { value: function redirect(url: string | URL, status?: number): Response { return Native.redirect(url, status); }, writable: true, configurable: true });
+  Object.defineProperty(NodeResponse, 'error', { value: function error(): Response { return Native.error(); }, writable: true, configurable: true });
+
+  defineOnHost(proto, 'headers', {
+    get(this: Response): Headers { return kept.get(this) ?? (nativeHeaders.call(this) as Headers); },
+    enumerable: true, configurable: true,
+  });
+  defineOnHost(proto, 'constructor', { value: NodeResponse, writable: true, enumerable: false, configurable: true });
+
+  // A clone's headers are a copy of the original's, cookies and all.
+  defineOnHost(proto, 'clone', {
+    value: function clone(this: Response): Response {
+      const copy = nativeClone.call(this);
+      const headers = kept.get(this);
+      if (headers) kept.set(copy, new Headers(headers));
+      return copy;
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+
+  /** The kept content type where it is no longer the one the browser's body was built with. */
+  const changedType = (response: Response): string | null | undefined => {
+    const headers = kept.get(response);
+    if (!headers) return undefined;
+    const current = headers.get('content-type');
+    return current === (nativeHeaders.call(response) as Headers).get('content-type') ? undefined : current;
+  };
+  defineOnHost(proto, 'formData', {
+    value: async function formData(this: Response): Promise<FormData> {
+      const type = changedType(this);
+      if (type === undefined) return nativeFormData.call(this);
+      const bytes = await nativeArrayBuffer.call(this);
+      return nativeFormData.call(Reflect.construct(Native, [bytes, type === null ? {} : { headers: { 'content-type': type } }]) as Response);
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+  defineOnHost(proto, 'blob', {
+    value: async function blob(this: Response): Promise<Blob> {
+      const type = changedType(this);
+      if (type === undefined) return nativeBlob.call(this);
+      return new Blob([await nativeArrayBuffer.call(this)], type === null ? {} : { type });
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+
+  takeFromHost(target, 'Response', NodeResponse);
+}
+

package/src/runtime.ts

@@ -8,6 +8,7 @@
 import { VirtualFS } from './virtual-fs';
 import { guestPromise, intrinsicPromise } from './promise-ownership';
 import { guestFetch, rememberRequestBodySource } from './fetch-transport';
+import { installNodeResponse } from './node-response';
 import { forGuestRealm, installGuestRealm, takeFromHost, defineOnHost, heldWork } from './host-globals';
 import type { IRuntime, IExecuteResult, IRuntimeOptions } from './runtime-interface';
 import type { PackageJson } from './types/package-json';
@@ -2974,6 +2975,12 @@ forGuestRealm(() => {
   }
 });
 
+forGuestRealm(() => {
+  // A response keeps the Set-Cookie headers it was built with, as Node's
+  // does; the browser's response guard drops them (see node-response.ts).
+  installNodeResponse(globalThis);
+});
+
 forGuestRealm(() => {
   // Node's `stream.finished()` on a web stream waits on a promise Node's own
   // web streams carry (`nodejs.webstream.isClosedPromise`), settled when the

package/src/shims/esbuild.ts

@@ -5,7 +5,7 @@
 
 import { heldWork } from '../host-globals';
 import type { VirtualFS } from '../virtual-fs';
-import { ESBUILD_WASM_BINARY_CDN, ESBUILD_WASM_BROWSER_CDN } from '../config/cdn';
+import { ESBUILD_WASM_BINARY_CDN, ESBUILD_WASM_BROWSER_CDN, ESBUILD_WASM_VERSION } from '../config/cdn';
 import { __nodeResolverFor } from '../node-resolver';
 
 /**
@@ -1605,7 +1605,7 @@ export function buildSync(_options: BuildOptions): BuildResult {
  * Get the esbuild version
  */
 export function version(): string {
-  return '0.20.0'; // Version of esbuild-wasm we're using
+  return ESBUILD_WASM_VERSION; // Version of esbuild-wasm we're using
 }
 
 // A build that named an output wrote nothing and Vite's own build, which