@xopcai/xopc 0.0.273 → 0.0.275

package/dist/browser-ext/dist/assets/{auth-DkwOUI6_.js → auth-ClQTK565.js}

@@ -5655,7 +5655,34 @@ class RealtimeClient {
   }
 }
 
-_enum(["mobile", "browser"]);
+const DEVICE_PAIRING_VERSION = 3;
+const BROWSER_PAIRING_INVITATION_VERSION = 1;
+const BROWSER_PAIRING_INVITATION_PREFIX = `XOPC-BROWSER-INVITE-V${BROWSER_PAIRING_INVITATION_VERSION}:`;
+const devicePairingTargetKindSchema = _enum(["mobile", "browser"]);
+const devicePairingRouteSchema = strictObject({
+  id: string().trim().min(1).max(80),
+  kind: _enum(["xopc-secure-link", "tailscale", "custom-https", "local-browser"]),
+  url: string().url()
+}).superRefine((route, context) => {
+  const url = new URL(route.url);
+  const isOrigin = !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+  const valid = route.kind === "local-browser" ? url.protocol === "http:" && url.hostname === "127.0.0.1" && isOrigin : url.protocol === "https:" && isOrigin;
+  if (!valid) context.addIssue({ code: "custom", path: ["url"], message: "Pairing route must be a secure origin" });
+});
+const devicePairingInvitationPayloadSchema = strictObject({
+  version: literal(DEVICE_PAIRING_VERSION),
+  targetKind: devicePairingTargetKindSchema,
+  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
+  gatewayId: string().uuid(),
+  gatewayName: string().trim().min(1).max(120),
+  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
+  routes: array(devicePairingRouteSchema).min(1).max(8),
+  expiresAt: number().int().positive()
+}).superRefine((payload, context) => {
+  if (payload.targetKind === "mobile" && payload.routes.some((route) => route.kind === "local-browser")) {
+    context.addIssue({ code: "custom", path: ["routes"], message: "Mobile invitations require remote routes" });
+  }
+});
 const devicePairingKeySchema = strictObject({
   kty: literal("EC"),
   crv: literal("P-256"),
@@ -5691,6 +5718,18 @@ devicePairingProofSchema.extend({
   idempotencyKey: string().uuid(),
   initialRefreshToken: initialDeviceRefreshTokenSchema
 });
+function isRetryableDevicePairingHttpStatus(status) {
+  return status >= 500 || [404, 408, 425, 429].includes(status);
+}
+function readBrowserPairingInvitation(value) {
+  const invitation = value.trim();
+  if (!invitation.startsWith(BROWSER_PAIRING_INVITATION_PREFIX)) {
+    throw new Error("Browser pairing invitation is invalid");
+  }
+  const encodedPayload = invitation.slice(BROWSER_PAIRING_INVITATION_PREFIX.length);
+  if (!/^[A-Za-z0-9_-]+$/.test(encodedPayload)) throw new Error("Browser pairing invitation is invalid");
+  return encodedPayload;
+}
 function canonical(value) {
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
   if (value !== null && typeof value === "object") {
@@ -5743,6 +5782,62 @@ array(browserPageContextInputSchema).max(MAX_BROWSER_CONTEXTS_PER_TURN).superRef
   }
 });
 
+const LOCALE_STORAGE_KEY = "xopc.sidepanel.locale";
+const LOCALE_PATHS = {
+  en: "_locales/en/messages.json",
+  "zh-CN": "_locales/zh_CN/messages.json"
+};
+let activeLocale;
+let activeCatalog;
+function isExtensionLocale(value) {
+  return value === "en" || value === "zh-CN";
+}
+function browserLocale() {
+  return chrome.i18n.getUILanguage().replaceAll("_", "-").toLowerCase().startsWith("zh") ? "zh-CN" : "en";
+}
+function messageWithSubstitutions(entry, substitutions) {
+  const values = substitutions === void 0 ? [] : Array.isArray(substitutions) ? substitutions : [substitutions];
+  const valueAt = (content) => content.replace(/\$(\d+)/g, (_match, index) => values[Number(index) - 1] ?? "");
+  let message = entry.message;
+  for (const [name, placeholder] of Object.entries(entry.placeholders ?? {})) {
+    message = message.replaceAll(new RegExp(`\\$${name}\\$`, "gi"), valueAt(placeholder.content));
+  }
+  let sequentialIndex = 0;
+  return message.replace(/%(?:(\d+)\$)?s/g, (_match, position) => {
+    const index = position ? Number(position) - 1 : sequentialIndex++;
+    return values[index] ?? "";
+  }).replace(/\$(\d+)/g, (_match, index) => values[Number(index) - 1] ?? "");
+}
+function t(key, substitutions) {
+  const entry = activeCatalog?.[key];
+  return entry ? messageWithSubstitutions(entry, substitutions) : chrome.i18n.getMessage(key, substitutions) || key;
+}
+function extensionLocale() {
+  return activeLocale ?? chrome.i18n.getUILanguage().replaceAll("_", "-");
+}
+async function loadExtensionLocalePreference() {
+  const stored = await chrome.storage.local.get(LOCALE_STORAGE_KEY);
+  const locale = isExtensionLocale(stored[LOCALE_STORAGE_KEY]) ? stored[LOCALE_STORAGE_KEY] : browserLocale();
+  await applyExtensionLocale(locale);
+  return locale;
+}
+async function saveExtensionLocalePreference(locale) {
+  await chrome.storage.local.set({ [LOCALE_STORAGE_KEY]: locale });
+  await applyExtensionLocale(locale);
+}
+async function applyExtensionLocale(locale) {
+  const response = await fetch(chrome.runtime.getURL(LOCALE_PATHS[locale]));
+  if (!response.ok) throw new Error(`Could not load extension locale: ${locale}`);
+  activeCatalog = await response.json();
+  activeLocale = locale;
+  initializeDocumentLocale();
+}
+function initializeDocumentLocale() {
+  document.documentElement.lang = extensionLocale();
+  document.documentElement.dir = chrome.i18n.getMessage("@@bidi_dir") || "ltr";
+  document.title = t("appName");
+}
+
 const PENDING_CONTEXT_KEY = "xopc.browser.pending-context";
 const TAB_BINDING_PREFIX = "xopc.browser.tab-binding.";
 function truncateUtf8(value, maxBytes) {
@@ -5762,13 +5857,13 @@ function sanitizedUrl(raw) {
   try {
     url = new URL(raw);
   } catch {
-    throw new Error("This tab does not have a valid web address");
+    throw new Error(t("errorInvalidWebAddress"));
   }
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error("Chrome does not allow xopc to read this page. Open a regular http(s) page and try again.");
+    throw new Error(t("errorRestrictedPage"));
   }
   if (url.hostname === "chromewebstore.google.com" || url.hostname === "chrome.google.com" && url.pathname.startsWith("/webstore")) {
-    throw new Error("Chrome does not allow extensions to read Chrome Web Store pages.");
+    throw new Error(t("errorWebStorePage"));
   }
   url.username = "";
   url.password = "";
@@ -5779,14 +5874,14 @@ function siteAccessError(cause, url) {
   const message = cause instanceof Error ? cause.message : String(cause);
   const hostname = new URL(url).hostname;
   if (/cannot access|cannot be scripted|missing host permission|extensions gallery|chrome web store/i.test(message)) {
-    return new Error(`Chrome blocked access to ${hostname}. Check xopc's site access for this page and try again.`);
+    return new Error(t("errorSiteAccessBlocked", hostname));
   }
   return cause instanceof Error ? cause : new Error(message);
 }
 async function runWithTabSiteAccess(tabId, operation) {
   const tab = await chrome.tabs.get(tabId);
   if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) {
-    throw new Error("The selected tab is no longer available");
+    throw new Error(t("errorTabUnavailable"));
   }
   const url = sanitizedUrl(tab.url);
   const originPattern = `${new URL(url).origin}/*`;
@@ -5799,7 +5894,7 @@ async function runWithTabSiteAccess(tabId, operation) {
     } catch (cause) {
       throw siteAccessError(cause, url);
     }
-    if (!granted) throw new Error(`Allow xopc to access ${new URL(url).hostname} to continue.`);
+    if (!granted) throw new Error(t("errorSiteAccessRequired", new URL(url).hostname));
     newlyGranted = true;
   }
   try {
@@ -5813,15 +5908,15 @@ async function sha256(value) {
   const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
   return [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-function extractPage(mode) {
+function extractPage(mode, messages) {
   const normalize = (value) => value.replace(/\s+/g, " ").trim();
   const selection = normalize(window.getSelection()?.toString() ?? "");
   if (mode === "selection") {
-    if (!selection) throw new Error("Select text on the page first");
+    if (!selection) throw new Error(messages.selectText);
     return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, selection };
   }
   const source = document.querySelector("article, main") ?? document.body;
-  if (!source) throw new Error("This page has no readable content");
+  if (!source) throw new Error(messages.noReadableContent);
   const clone = source.cloneNode(true);
   clone.querySelectorAll([
     "script",
@@ -5843,23 +5938,26 @@ function extractPage(mode) {
     "[inert]"
   ].join(",")).forEach((element) => element.remove());
   const text = normalize(clone.innerText || clone.textContent || "");
-  if (!text) throw new Error("This page has no readable content");
+  if (!text) throw new Error(messages.noReadableContent);
   return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, text };
 }
 async function captureTabPage(tabId, mode) {
   const tab = await chrome.tabs.get(tabId);
-  if (!tab.url) throw new Error("The selected tab is no longer available");
+  if (!tab.url) throw new Error(t("errorTabUnavailable"));
   sanitizedUrl(tab.url);
   const result = await chrome.scripting.executeScript({
     target: { tabId },
     func: extractPage,
-    args: [mode]
+    args: [mode, {
+      selectText: t("errorSelectText"),
+      noReadableContent: t("errorNoReadableContent")
+    }]
   });
   const raw = result[0]?.result;
-  if (!raw) throw new Error("Could not read this page");
+  if (!raw) throw new Error(t("errorReadPage"));
   const url = sanitizedUrl(raw.url);
   if (new URL(url).origin !== new URL(sanitizedUrl(tab.url)).origin) {
-    throw new Error("The page changed while xopc was reading it. Try again.");
+    throw new Error(t("errorPageChangedReading"));
   }
   const selected = raw.selection ? truncateUtf8(raw.selection, MAX_BROWSER_SELECTION_BYTES) : void 0;
   const page = raw.text ? truncateUtf8(raw.text, MAX_BROWSER_PAGE_TEXT_BYTES) : void 0;
@@ -5888,17 +5986,17 @@ async function activeTabId() {
 }
 async function currentTabDescriptor() {
   const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
-  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) throw new Error("No active web page");
+  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) throw new Error(t("errorNoActivePage"));
   return runWithTabSiteAccess(tab.id, async (accessibleTab) => {
     const result = await chrome.scripting.executeScript({
       target: { tabId: accessibleTab.id },
       func: () => ({ url: location.href, timeOrigin: performance.timeOrigin })
     });
     const marker = result[0]?.result;
-    if (!marker) throw new Error("Could not identify this page");
+    if (!marker) throw new Error(t("errorIdentifyPage"));
     const currentUrl = sanitizedUrl(marker.url);
     if (new URL(currentUrl).origin !== new URL(accessibleTab.url).origin) {
-      throw new Error("The page changed while xopc was connecting to it. Try again.");
+      throw new Error(t("errorPageChangedConnecting"));
     }
     return {
       tabId: String(accessibleTab.id),
@@ -5922,7 +6020,7 @@ function openDatabase() {
       }
     };
     request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error ?? new Error("Could not open the browser chat outbox"));
+    request.onerror = () => reject(request.error ?? new Error(t("errorOpenOutbox")));
   });
 }
 function transactionResult(database, mode, createRequest) {
@@ -5933,10 +6031,10 @@ function transactionResult(database, mode, createRequest) {
     request.onsuccess = () => {
       result = request.result;
     };
-    request.onerror = () => reject(request.error ?? new Error("Browser chat outbox request failed"));
+    request.onerror = () => reject(request.error ?? new Error(t("errorOutboxRequest")));
     transaction.oncomplete = () => resolve(result);
-    transaction.onerror = () => reject(transaction.error ?? new Error("Browser chat outbox transaction failed"));
-    transaction.onabort = () => reject(transaction.error ?? new Error("Browser chat outbox transaction was aborted"));
+    transaction.onerror = () => reject(transaction.error ?? new Error(t("errorOutboxTransaction")));
+    transaction.onabort = () => reject(transaction.error ?? new Error(t("errorOutboxAborted")));
   });
 }
 async function readBrowserOutbox(sessionKey) {
@@ -5977,6 +6075,7 @@ async function clearBrowserOutboxes() {
 }
 
 const PROFILE_KEY = "xopc.browser.profile";
+const PAIRING_JOURNAL_KEY = "xopc.browser.pairing";
 const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
 const KEY_DATABASE = "xopc-browser-identity";
 const KEY_STORE = "identity";
@@ -6014,13 +6113,13 @@ async function discoverLocalGateway(options) {
         nonce
       }
     );
-    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.pairingLink !== "string" || typeof response.expiresAt !== "number") {
-      if (options?.force) throw new Error(response.error || "The local xopc enrollment host returned an invalid response");
+    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.invitation !== "string" || typeof response.expiresAt !== "number") {
+      if (options?.force) throw new Error(response.error || t("errorInvalidLocalHostResponse"));
       return void 0;
     }
     return {
       gatewayUrl: response.gatewayUrl,
-      pairingLink: response.pairingLink,
+      invitation: response.invitation,
       expiresAt: response.expiresAt
     };
   } catch (cause) {
@@ -6049,25 +6148,12 @@ function randomNonce(bytes = 24) {
 function createRefreshToken() {
   return `xopc_rt_${crypto.randomUUID()}_${randomNonce(32)}`;
 }
-function parseBrowserPairingLink(value) {
-  const url = new URL(value.trim());
-  if (url.protocol !== "https:" || url.hostname !== "link.xopc.ai" || url.pathname !== "/connect") {
-    throw new Error("Pairing link is not from xopc");
-  }
-  const encoded = new URLSearchParams(url.hash.slice(1)).get("p");
-  if (!encoded) throw new Error("Pairing link is invalid");
-  const payload = decodeJson(encoded);
-  if (payload.version !== 3 || payload.targetKind !== "browser" || !payload.gatewayId || !payload.pairingToken || !payload.gatewayPublicKey || !Array.isArray(payload.routes)) {
-    throw new Error("Pairing link version is not supported");
-  }
-  if (payload.expiresAt <= Date.now()) throw new Error("Pairing link has expired");
-  if (!payload.routes.length) throw new Error("Pairing link has no Gateway route");
-  for (const route of payload.routes) {
-    const routeUrl = new URL(route.url);
-    if (!route.id || !["http:", "https:"].includes(routeUrl.protocol)) {
-      throw new Error("Pairing link has an invalid Gateway route");
-    }
-  }
+function parseBrowserPairingInvitation(value, allowExpired = false) {
+  const encoded = readBrowserPairingInvitation(value);
+  const parsed = devicePairingInvitationPayloadSchema.safeParse(decodeJson(encoded));
+  if (!parsed.success || parsed.data.targetKind !== "browser") throw new Error("Pairing invitation version is not supported");
+  const payload = parsed.data;
+  if (!allowExpired && payload.expiresAt <= Date.now()) throw new Error("Pairing invitation has expired");
   return payload;
 }
 function openIdentityDatabase() {
@@ -6111,12 +6197,12 @@ async function forgetIdentity() {
     const request = indexedDB.deleteDatabase(KEY_DATABASE);
     request.onsuccess = () => resolve();
     request.onerror = () => reject(request.error);
-    request.onblocked = () => reject(new Error("Browser identity is still in use"));
+    request.onblocked = () => reject(new Error(t("errorIdentityInUse")));
   });
 }
 async function publicKeyJwk(pair) {
   const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
-  if (!exported.x || !exported.y) throw new Error("Browser identity key export failed");
+  if (!exported.x || !exported.y) throw new Error(t("errorIdentityExport"));
   return { kty: "EC", crv: "P-256", x: exported.x, y: exported.y };
 }
 async function sign(pair, text) {
@@ -6154,6 +6240,11 @@ function requestGatewayOriginPermissions(origins) {
   if (!patterns.length) return Promise.resolve(true);
   return chrome.permissions.request({ origins: patterns });
 }
+async function hasGatewayOriginPermission(origin) {
+  const url = new URL(origin);
+  if (url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname)) return true;
+  return chrome.permissions.contains({ origins: [`${url.origin}/*`] });
+}
 class GatewayHttpError extends Error {
   constructor(message, status) {
     super(message);
@@ -6174,7 +6265,7 @@ async function post(origin, path, body) {
       signal: controller.signal
     });
   } catch (cause) {
-    if (controller.signal.aborted) throw new Error(`Gateway did not respond within ${GATEWAY_REQUEST_TIMEOUT_MS / 1e3} seconds`);
+    if (controller.signal.aborted) throw new Error(t("errorGatewayTimeout", String(GATEWAY_REQUEST_TIMEOUT_MS / 1e3)));
     throw cause;
   } finally {
     clearTimeout(timeout);
@@ -6182,7 +6273,7 @@ async function post(origin, path, body) {
   const json = await response.json().catch(() => ({}));
   if (!response.ok) {
     throw new GatewayHttpError(
-      json.error?.code ?? json.error?.message ?? `Gateway returned ${response.status}`,
+      json.error?.code ?? json.error?.message ?? t("errorGatewayStatus", String(response.status)),
       response.status
     );
   }
@@ -6210,19 +6301,24 @@ async function signedPairingRequest(pair, payload, origin, requestId, action, co
   const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/${requestId}/${action}`;
   const response = await post(origin, path, { ...body, signature });
   if (typeof response.signedPayload !== "string" || typeof response.signature !== "string") {
-    throw new Error("Gateway pairing response is unsigned");
+    throw new Error(t("errorUnsignedPairing"));
   }
   if (!await verifyGateway(payload.gatewayPublicKey, response.signedPayload, response.signature)) {
-    throw new Error("Gateway identity could not be verified");
+    throw new Error(t("errorGatewayVerification"));
   }
   const decoded = decodeJson(response.signedPayload);
   if (decoded.gateway.id !== payload.gatewayId || decoded.nonce !== nonce || decoded.request.requestId !== requestId) {
-    throw new Error("Gateway pairing response does not match this request");
+    throw new Error(t("errorPairingMismatch"));
   }
   return decoded;
 }
 function shouldTryNextRoute(cause) {
-  return !(cause instanceof GatewayHttpError) || cause.status >= 500 || [404, 408, 425, 429].includes(cause.status);
+  return !(cause instanceof GatewayHttpError) || isRetryableDevicePairingHttpStatus(cause.status);
+}
+function isRouteFailure(cause) {
+  if (cause instanceof GatewayHttpError) return isRetryableDevicePairingHttpStatus(cause.status);
+  const message = cause instanceof Error ? cause.message : String(cause);
+  return /network|fetch|respond|identity|route/i.test(message);
 }
 async function signedPairingRequestAcrossRoutes(pair, payload, origins, requestId, action, completion) {
   let lastRouteError;
@@ -6236,9 +6332,11 @@ async function signedPairingRequestAcrossRoutes(pair, payload, origins, requestI
   }
   throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
 }
-async function refreshAccessToken(gatewayUrls, refreshToken, pair, gateway) {
-  const nextRefreshToken = createRefreshToken();
-  const requestId = crypto.randomUUID();
+async function refreshAccessToken(gatewayUrls, refreshToken, pair, gateway, operation = {
+  requestId: crypto.randomUUID(),
+  nextRefreshToken: createRefreshToken()
+}) {
+  const { nextRefreshToken, requestId } = operation;
   const timestamp = Date.now();
   const nonce = randomNonce();
   const credentialId = refreshToken.slice("xopc_rt_".length).split("_")[0];
@@ -6271,89 +6369,167 @@ ${nextRefreshToken}`;
     }
   }
   if (!response || !gatewayUrl) {
-    throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
+    throw lastRouteError instanceof Error ? lastRouteError : new Error(t("errorNoReachableGatewayRoute"));
   }
-  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string" || !await verifyGateway(gateway.gatewayPublicKey, response.signedPayload, response.signature)) throw new Error("Gateway identity could not be verified");
+  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string" || !await verifyGateway(gateway.gatewayPublicKey, response.signedPayload, response.signature)) throw new Error(t("errorGatewayVerification"));
   const responseProof = decodeJson(response.signedPayload);
   if (responseProof.purpose !== "device-refresh-v3" || responseProof.gatewayId !== gateway.gatewayId || responseProof.requestId !== requestId || responseProof.nonce !== nonce || !(responseProof.expiresAt > Date.now()) || responseProof.expiresAt > Date.now() + 6e4) throw new Error("Gateway refresh response does not match this request");
   const payload = responseProof.tokens;
   if (!payload?.accessToken || !payload.accessTokenExpiresAt || payload.refreshToken !== nextRefreshToken) {
-    throw new Error("Gateway returned invalid browser credentials");
+    throw new Error(t("errorInvalidCredentials"));
   }
   return { ...payload, gatewayUrl };
 }
 function wait(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-async function pairGateway(link, onApproval) {
-  const payload = parseBrowserPairingLink(link);
+async function pairGateway(invitation, onApproval, requestedOrigin) {
+  const payload = parseBrowserPairingInvitation(invitation, true);
   const origins = [...new Set(payload.routes.map((route) => new URL(route.url).origin))];
-  const permissionTask = requestGatewayOriginPermissions(origins);
+  const selectedOrigin = requestedOrigin && origins.includes(requestedOrigin) ? requestedOrigin : origins[0];
+  const permissionTask = requestGatewayOriginPermissions([selectedOrigin]);
   if (!await permissionTask) throw new Error("Gateway site permission was not granted");
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
   const pair = await getOrCreateKeyPair();
-  const requestId = crypto.randomUUID();
-  const initialRefreshToken = createRefreshToken();
-  let { origin, result } = await signedPairingRequestAcrossRoutes(
-    pair,
-    payload,
-    origins,
-    requestId,
-    "request"
-  );
-  if (result.request.status === "pending") onApproval(result.request.confirmationCode);
-  while (result.request.status === "pending") {
-    await wait(1500);
-    const response = await signedPairingRequestAcrossRoutes(
-      pair,
-      payload,
-      [origin, ...origins.filter((candidate) => candidate !== origin)],
-      requestId,
-      "status"
-    );
-    ({ origin, result } = response);
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  let journal = stored[PAIRING_JOURNAL_KEY];
+  if (journal && journal.payload.pairingToken !== payload.pairingToken) {
+    throw new Error("PAIRING_ALREADY_PENDING");
   }
-  if (result.request.status !== "approved" && result.request.status !== "completed") {
-    throw new Error(`Pairing ${result.request.status}`);
+  if (!journal) {
+    if (payload.expiresAt <= Date.now()) throw new Error(t("errorExpiredPairingLink"));
+    journal = {
+      invitation: invitation.trim(),
+      payload,
+      requestId: crypto.randomUUID(),
+      idempotencyKey: crypto.randomUUID(),
+      initialRefreshToken: createRefreshToken()
+    };
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
   }
-  if (result.request.status !== "completed") {
-    const response = await signedPairingRequestAcrossRoutes(
+  delete journal.nextOrigin;
+  await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+  const requestId = journal.requestId;
+  const availableOrigins = journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : [selectedOrigin, ...permittedOrigins.filter((candidate) => candidate !== selectedOrigin)];
+  try {
+    let { origin, result } = await signedPairingRequestAcrossRoutes(
       pair,
-      payload,
-      [origin, ...origins.filter((candidate) => candidate !== origin)],
+      journal.payload,
+      availableOrigins,
       requestId,
-      "complete",
-      {
-        idempotencyKey: crypto.randomUUID(),
-        initialRefreshToken
-      }
+      "request"
+    );
+    journal.origin = origin;
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    if (result.request.status === "pending") onApproval(result.request.confirmationCode);
+    while (result.request.status === "pending") {
+      await wait(1500);
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "status"
+      );
+      ({ origin, result } = response);
+      journal.origin = origin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    }
+    if (result.request.status !== "approved" && result.request.status !== "completed") {
+      await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+      throw new Error(t("errorPairingStatus", result.request.status));
+    }
+    if (result.request.status !== "completed") {
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "complete",
+        {
+          idempotencyKey: journal.idempotencyKey,
+          initialRefreshToken: journal.initialRefreshToken
+        }
+      );
+      ({ origin, result } = response);
+    }
+    if (!result.request.deviceId) throw new Error(t("errorBrowserNotRegistered"));
+    journal.origin = origin;
+    journal.completed = { deviceId: result.request.deviceId, gatewayName: result.gateway.name };
+    journal.refresh ??= { requestId: crypto.randomUUID(), nextRefreshToken: createRefreshToken() };
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    const orderedOrigins = [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)];
+    const tokens = await refreshAccessToken(
+      orderedOrigins,
+      journal.initialRefreshToken,
+      pair,
+      journal.payload,
+      journal.refresh
+    );
+    const profile = {
+      gatewayId: journal.payload.gatewayId,
+      gatewayName: journal.completed.gatewayName,
+      gatewayUrl: tokens.gatewayUrl,
+      gatewayUrls: [tokens.gatewayUrl, ...orderedOrigins.filter((candidate) => candidate !== tokens.gatewayUrl)],
+      gatewayPublicKey: journal.payload.gatewayPublicKey,
+      deviceId: journal.completed.deviceId,
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken,
+      accessTokenExpiresAt: tokens.accessTokenExpiresAt
+    };
+    await chrome.storage.local.set({ [PROFILE_KEY]: profile });
+    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+    return profile;
+  } catch (cause) {
+    const nextOrigin = origins.find((origin) => !permittedOrigins.includes(origin));
+    if (nextOrigin && isRouteFailure(cause)) {
+      journal.nextOrigin = nextOrigin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+      throw new Error(`PAIRING_ROUTE_PERMISSION_REQUIRED:${nextOrigin}`);
+    }
+    throw cause;
+  }
+}
+async function readPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  return journal ? { invitation: journal.invitation, ...journal.nextOrigin ? { nextOrigin: journal.nextOrigin } : {} } : void 0;
+}
+async function cancelPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  if (!journal) return;
+  const origins = [...new Set(journal.payload.routes.map((route) => new URL(route.url).origin))];
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
+  try {
+    await signedPairingRequestAcrossRoutes(
+      await getOrCreateKeyPair(),
+      journal.payload,
+      journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : permittedOrigins,
+      journal.requestId,
+      "cancel"
     );
-    ({ origin, result } = response);
+  } catch (cause) {
+    if (!(cause instanceof GatewayHttpError) || !["PAIRING_NOT_FOUND", "PAIRING_EXPIRED", "PAIRING_CANCELLED"].includes(cause.message)) throw cause;
   }
-  if (!result.request.deviceId) throw new Error("Gateway did not register the browser");
-  const orderedOrigins = [origin, ...origins.filter((candidate) => candidate !== origin)];
-  const tokens = await refreshAccessToken(orderedOrigins, initialRefreshToken, pair, payload);
-  const profile = {
-    gatewayId: payload.gatewayId,
-    gatewayName: result.gateway.name,
-    gatewayUrl: tokens.gatewayUrl,
-    gatewayUrls: [tokens.gatewayUrl, ...orderedOrigins.filter((candidate) => candidate !== tokens.gatewayUrl)],
-    gatewayPublicKey: payload.gatewayPublicKey,
-    deviceId: result.request.deviceId,
-    refreshToken: tokens.refreshToken,
-    accessToken: tokens.accessToken,
-    accessTokenExpiresAt: tokens.accessTokenExpiresAt
-  };
-  await chrome.storage.local.set({ [PROFILE_KEY]: profile });
-  return profile;
+  await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
 }
 async function readProfile() {
-  const stored = await chrome.storage.local.get(PROFILE_KEY);
+  const stored = await chrome.storage.local.get([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
   const profile = stored[PROFILE_KEY];
-  return profile?.gatewayId && profile.gatewayUrl && profile.refreshToken ? profile : void 0;
+  if (!profile?.gatewayId || !profile.gatewayUrl || !profile.refreshToken) return void 0;
+  if (stored[PAIRING_JOURNAL_KEY]) await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  return profile;
 }
 async function getAccessProfile() {
   const profile = await readProfile();
-  if (!profile) throw new Error("Browser is not paired");
+  if (!profile) throw new Error(t("errorBrowserNotPaired"));
   if (profile.accessTokenExpiresAt > Date.now() + 3e4) return profile;
   if (refreshTask) return refreshTask;
   refreshTask = (async () => {
@@ -6403,7 +6579,7 @@ async function registerBrowserEndpoint() {
       publicKey
     })
   });
-  if (!response.ok) throw new Error(`Browser endpoint registration failed (${response.status})`);
+  if (!response.ok) throw new Error(t("errorEndpointRegistration", String(response.status)));
 }
 async function createBrowserEndpointHello(tools = []) {
   const profile = await getAccessProfile();
@@ -6428,7 +6604,7 @@ async function createBrowserEndpointHello(tools = []) {
   };
 }
 async function forgetProfile() {
-  await chrome.storage.local.remove(PROFILE_KEY);
+  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
 }
 async function revokeAndForgetProfile() {
   try {
@@ -6451,4 +6627,4 @@ async function revokeAndForgetProfile() {
   }
 }
 
-export { ENDPOINT_PROTOCOL_VERSION as E, PENDING_CONTEXT_KEY as P, RealtimeClient as R, TAB_BINDING_PREFIX as T, activeTabId as a, captureTabWithPermission as b, canonicalJson as c, createBrowserEndpointHello as d, currentTabDescriptor as e, deleteBrowserOutbox as f, discoverLocalGateway as g, endpointToolContentSchema as h, gatewayFetch as i, getAccessProfile as j, readProfile as k, registerBrowserEndpoint as l, revokeAndForgetProfile as m, runWithTabSiteAccess as n, pairGateway as p, readBrowserOutbox as r, setAutoConnectEnabled as s, writeBrowserOutbox as w };
+export { ENDPOINT_PROTOCOL_VERSION as E, PENDING_CONTEXT_KEY as P, RealtimeClient as R, TAB_BINDING_PREFIX as T, activeTabId as a, canonicalJson as b, cancelPendingBrowserPairing as c, captureTabWithPermission as d, createBrowserEndpointHello as e, currentTabDescriptor as f, deleteBrowserOutbox as g, discoverLocalGateway as h, endpointToolContentSchema as i, extensionLocale as j, gatewayFetch as k, getAccessProfile as l, loadExtensionLocalePreference as m, readPendingBrowserPairing as n, readProfile as o, pairGateway as p, registerBrowserEndpoint as q, readBrowserOutbox as r, revokeAndForgetProfile as s, runWithTabSiteAccess as t, saveExtensionLocalePreference as u, setAutoConnectEnabled as v, t as w, writeBrowserOutbox as x };