@xopcai/xopc 0.0.367 → 0.0.369

package/dist/browser-ext/dist/assets/{auth-beGtbLPS.js → page-context-BeworyNB.js}

@@ -5107,6 +5107,149 @@ function superRefine(fn, params) {
     return _superRefine(fn, params);
 }
 
+const MAX_BROWSER_CONTEXTS_PER_TURN = 2;
+const MAX_BROWSER_SELECTION_BYTES = 32 * 1024;
+const MAX_BROWSER_PAGE_TEXT_BYTES = 128 * 1024;
+const MAX_BROWSER_CONTEXT_BODY_BYTES = 256 * 1024;
+const utf8Bytes = (value) => new TextEncoder().encode(value).byteLength;
+const browserPageContextInputSchema = strictObject({
+  kind: literal("browser_page"),
+  sourceId: uuid(),
+  version: string().regex(/^[a-f0-9]{64}$/),
+  title: string().trim().min(1).max(512),
+  url: url(),
+  capturedAt: number().int().nonnegative(),
+  documentId: string().trim().min(1).max(256),
+  selection: string().optional(),
+  text: string().optional(),
+  truncated: boolean()
+}).superRefine((value, ctx) => {
+  const url = new URL(value.url);
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash) {
+    ctx.addIssue({ code: "custom", path: ["url"], message: "URL must be a sanitized HTTP(S) URL" });
+  }
+  if (!value.selection?.trim() && !value.text?.trim()) {
+    ctx.addIssue({ code: "custom", message: "A browser context must include selection or page text" });
+  }
+  if (value.selection && utf8Bytes(value.selection) > MAX_BROWSER_SELECTION_BYTES) {
+    ctx.addIssue({ code: "custom", path: ["selection"], message: "Selection is too large" });
+  }
+  if (value.text && utf8Bytes(value.text) > MAX_BROWSER_PAGE_TEXT_BYTES) {
+    ctx.addIssue({ code: "custom", path: ["text"], message: "Page text is too large" });
+  }
+});
+const browserPageContextsInputSchema = array(browserPageContextInputSchema).max(MAX_BROWSER_CONTEXTS_PER_TURN).superRefine((value, ctx) => {
+  if (utf8Bytes(JSON.stringify(value)) > MAX_BROWSER_CONTEXT_BODY_BYTES) {
+    ctx.addIssue({ code: "custom", message: "Browser contexts are too large" });
+  }
+});
+
+const DEVICE_PAIRING_VERSION = 3;
+const MOBILE_PAIRING_INVITATION_VERSION = 4;
+const BROWSER_PAIRING_INVITATION_VERSION = 1;
+const BROWSER_PAIRING_INVITATION_PREFIX = `XOPC-BROWSER-INVITE-V${BROWSER_PAIRING_INVITATION_VERSION}:`;
+_enum(["mobile", "browser"]);
+const devicePlatformSchema = _enum(["ios", "android", "harmonyos", "chrome"]);
+const devicePairingRouteSchema = strictObject({
+  id: string().trim().min(1).max(80),
+  kind: _enum(["xopc-secure-link", "tailscale", "custom-https", "local-browser"]),
+  url: string().url()
+}).superRefine((route, context) => {
+  const url = new URL(route.url);
+  const isOrigin = !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+  const valid = route.kind === "local-browser" ? url.protocol === "http:" && url.hostname === "127.0.0.1" && isOrigin : url.protocol === "https:" && isOrigin;
+  if (!valid) context.addIssue({ code: "custom", path: ["url"], message: "Pairing route must be a secure origin" });
+});
+const browserPairingInvitationPayloadSchema = strictObject({
+  version: literal(DEVICE_PAIRING_VERSION),
+  targetKind: literal("browser"),
+  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
+  gatewayId: string().uuid(),
+  gatewayName: string().trim().min(1).max(120),
+  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
+  routes: array(devicePairingRouteSchema).min(1).max(8),
+  expiresAt: number().int().positive()
+});
+const secureMobileOriginSchema = string().url().superRefine((origin, context) => {
+  const url = new URL(origin);
+  if (url.protocol !== "https:" || url.username || url.password || origin !== url.origin) {
+    context.addIssue({ code: "custom", message: "Mobile pairing origins must be canonical HTTPS origins" });
+  }
+});
+strictObject({
+  version: literal(MOBILE_PAIRING_INVITATION_VERSION),
+  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
+  gatewayId: string().uuid(),
+  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
+  origins: array(secureMobileOriginSchema).min(1).max(8),
+  expiresAt: number().int().positive()
+}).superRefine((payload, context) => {
+  if (new Set(payload.origins).size !== payload.origins.length) {
+    context.addIssue({ code: "custom", path: ["origins"], message: "Mobile pairing origins must be unique" });
+  }
+});
+const devicePairingKeySchema = strictObject({
+  kty: literal("EC"),
+  crv: literal("P-256"),
+  x: string().regex(/^[A-Za-z0-9_-]{43}$/),
+  y: string().regex(/^[A-Za-z0-9_-]{43}$/)
+});
+const devicePairingDeviceSchema = strictObject({
+  displayName: string().trim().min(1).max(80),
+  platform: devicePlatformSchema,
+  publicKeyJwk: devicePairingKeySchema,
+  extensionId: string().regex(/^[a-p]{32}$/).optional()
+}).superRefine((device, context) => {
+  if (device.platform === "chrome" && !device.extensionId) {
+    context.addIssue({ code: "custom", path: ["extensionId"], message: "Chrome devices require an extension id" });
+  }
+  if (device.platform !== "chrome" && device.extensionId) {
+    context.addIssue({ code: "custom", path: ["extensionId"], message: "Only Chrome devices may set an extension id" });
+  }
+});
+const initialDeviceRefreshTokenSchema = string().regex(
+  /^xopc_rt_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_[A-Za-z0-9_-]{43}$/i
+);
+const devicePairingProofSchema = strictObject({
+  gatewayId: string().uuid(),
+  requestId: string().uuid(),
+  pairingToken: string().min(1).max(256),
+  timestamp: number().int().positive(),
+  nonce: string().regex(/^[A-Za-z0-9_-]{24,128}$/),
+  signature: string().regex(/^[A-Za-z0-9_-]{86}$/)
+});
+devicePairingProofSchema.extend({ device: devicePairingDeviceSchema });
+devicePairingProofSchema.extend({
+  idempotencyKey: string().uuid(),
+  initialRefreshToken: initialDeviceRefreshTokenSchema
+});
+function isRetryableDevicePairingHttpStatus(status) {
+  return status >= 500 || [404, 408, 425, 429].includes(status);
+}
+function readBrowserPairingInvitation(value) {
+  const invitation = value.trim();
+  if (!invitation.startsWith(BROWSER_PAIRING_INVITATION_PREFIX)) {
+    throw new Error("Browser pairing invitation is invalid");
+  }
+  const encodedPayload = invitation.slice(BROWSER_PAIRING_INVITATION_PREFIX.length);
+  if (!/^[A-Za-z0-9_-]+$/.test(encodedPayload)) throw new Error("Browser pairing invitation is invalid");
+  return encodedPayload;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a.localeCompare(b, "en")).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function buildDevicePairingProof(action, body) {
+  const { signature: _signature, ...payload } = body;
+  return `xopc-device-pairing-v3
+POST
+${action}
+${canonical(payload)}`;
+}
+
 const ENDPOINT_PROTOCOL_VERSION = 2;
 const endpointKindSchema = _enum(["web", "desktop", "mobile", "browser"]);
 const endpointAvailabilitySchema = _enum(["foreground", "background"]);
@@ -5300,575 +5443,18 @@ function endpointHelloSigningPayload(payload) {
   return canonicalJson(unsigned);
 }
 
-const REALTIME_PROTOCOL_VERSION = 2;
-const REALTIME_MAX_CLIENT_FRAME_BYTES = 256 * 1024;
-const REALTIME_HEARTBEAT_INTERVAL_MS = 15e3;
-const REALTIME_HEARTBEAT_TIMEOUT_MS = 45e3;
-const REALTIME_CAPABILITIES = ["realtime.capability-negotiation.v1"];
-const realtimeClientKindSchema = _enum([
-  "web",
-  "desktop",
-  "mobile",
-  "browser_extension",
-  "tui",
-  "mcp"
-]);
-const realtimeTopicSchema = string().min(1).max(512);
-const realtimeEventNameSchema = string().regex(/^[a-z][a-z0-9_.-]*$/).max(160);
-const messageIdSchema = uuid();
-const timestampSchema = number().int().nonnegative();
-const sequenceSchema = number().int().positive();
-const capabilitySchema = string().min(1).max(160);
-const envelope = (kind, payload) => object({
-  protocolVersion: literal(REALTIME_PROTOCOL_VERSION),
-  messageId: messageIdSchema,
-  kind: literal(kind),
-  sentAt: timestampSchema,
-  payload
-});
-const realtimeSubscriptionSchema = object({
-  topic: realtimeTopicSchema,
-  afterSeq: number().int().nonnegative().optional(),
-  view: literal("compact").optional()
-});
-discriminatedUnion("kind", [
-  envelope("realtime.hello", object({
-    ticket: string().min(32).max(512),
-    clientId: string().min(1).max(160),
-    clientKind: realtimeClientKindSchema,
-    subscriptions: array(realtimeSubscriptionSchema).max(100).default([]),
-    capabilities: array(capabilitySchema).max(64).optional(),
-    endpoint: endpointHelloPayloadSchema.optional()
-  })),
-  envelope("realtime.subscribe", object({
-    subscriptions: array(realtimeSubscriptionSchema).min(1).max(100)
-  })),
-  envelope("realtime.unsubscribe", object({
-    topics: array(realtimeTopicSchema).min(1).max(100)
-  })),
-  envelope("realtime.ping", object({})),
-  envelope("endpoint.message", clientEndpointMessageSchema)
-]);
-const realtimeEventPayloadSchema = object({
-  topic: realtimeTopicSchema,
-  seq: sequenceSchema,
-  event: realtimeEventNameSchema,
-  data: unknown()
-});
-const serverRealtimeMessageSchema = discriminatedUnion("kind", [
-  envelope("realtime.ready", object({
-    connectionId: uuid(),
-    heartbeatIntervalMs: literal(REALTIME_HEARTBEAT_INTERVAL_MS),
-    heartbeatTimeoutMs: literal(REALTIME_HEARTBEAT_TIMEOUT_MS),
-    negotiatedCapabilities: array(capabilitySchema).max(64).optional(),
-    endpoint: object({
-      endpointId: string().min(1).max(160),
-      turnToken: string().min(32).max(160)
-    }).optional()
-  })),
-  envelope("realtime.event", realtimeEventPayloadSchema),
-  envelope("realtime.subscribed", object({
-    topic: realtimeTopicSchema,
-    cursor: number().int().nonnegative()
-  })),
-  envelope("realtime.gap", object({
-    topic: realtimeTopicSchema,
-    requestedSeq: number().int().nonnegative(),
-    earliestSeq: sequenceSchema,
-    recoverable: boolean()
-  })),
-  envelope("realtime.pong", object({})),
-  envelope("realtime.error", object({
-    code: string().min(1).max(80),
-    message: string().min(1).max(500)
-  })),
-  envelope("endpoint.message", serverEndpointMessageSchema)
-]);
-function parseServerRealtimeMessage(value) {
-  return serverRealtimeMessageSchema.parse(value);
+const LOCALE_STORAGE_KEY = "xopc.sidepanel.locale";
+const LOCALE_PATHS = {
+  en: "_locales/en/messages.json",
+  "zh-CN": "_locales/zh_CN/messages.json"
+};
+let activeLocale;
+let activeCatalog;
+function isExtensionLocale(value) {
+  return value === "en" || value === "zh-CN";
 }
-
-class RealtimeConnectionError extends Error {
-  constructor(message, retryable) {
-    super(message);
-    this.retryable = retryable;
-    this.name = "RealtimeConnectionError";
-  }
-  retryable;
-}
-class RealtimeFrameTooLargeError extends Error {
-  constructor(bytes, maxBytes) {
-    super(`Realtime client frame is ${bytes} bytes; maximum is ${maxBytes} bytes`);
-    this.bytes = bytes;
-    this.maxBytes = maxBytes;
-    this.name = "RealtimeFrameTooLargeError";
-  }
-  bytes;
-  maxBytes;
-}
-function frameText(data) {
-  if (typeof data === "string") return data;
-  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
-  if (ArrayBuffer.isView(data)) {
-    const bytes = Uint8Array.from(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
-    return new TextDecoder().decode(bytes);
-  }
-  throw new Error("Realtime server sent a non-text frame");
-}
-function isNonRetryableCloseCode(code) {
-  return code === 1009 || code === 4400 || code === 4401 || code === 4409 || code === 4413;
-}
-class RealtimeClient {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  desiredSubscriptions = /* @__PURE__ */ new Map();
-  cursors = /* @__PURE__ */ new Map();
-  socket;
-  reconnectTimer;
-  heartbeatTimer;
-  connectionTimer;
-  ticketAbort;
-  generation = 0;
-  reconnectAttempts = 0;
-  shouldReconnect = false;
-  ready = false;
-  lastServerMessageAt = 0;
-  endpointBinding;
-  reconnectWhenSocketOpens = false;
-  offeredCapabilities = /* @__PURE__ */ new Set();
-  connect() {
-    if (this.shouldReconnect) return;
-    this.shouldReconnect = true;
-    void this.open(false);
-  }
-  disconnect() {
-    this.shouldReconnect = false;
-    this.reconnectWhenSocketOpens = false;
-    this.generation += 1;
-    this.clearTimers();
-    this.ready = false;
-    this.offeredCapabilities.clear();
-    this.endpointBinding?.onDisconnected?.();
-    this.socket?.close(1e3, "Client disconnected");
-    this.socket = void 0;
-    this.options.onStateChange?.("disconnected");
-  }
-  reconnect() {
-    this.reconnectWhenSocketOpens = false;
-    this.generation += 1;
-    this.clearTimers();
-    this.ready = false;
-    this.endpointBinding?.onDisconnected?.();
-    this.socket?.close(1e3, "Client reconnecting");
-    this.socket = void 0;
-    this.reconnectAttempts = 0;
-    this.shouldReconnect = true;
-    void this.open(true);
-  }
-  subscribe(topic, afterSeq) {
-    this.desiredSubscriptions.set(topic, afterSeq);
-    if (afterSeq !== void 0) this.cursors.set(topic, afterSeq);
-    if (this.ready) {
-      this.sendSubscriptions([{ topic, afterSeq: this.cursors.get(topic) ?? afterSeq }]);
-    }
-  }
-  unsubscribe(topic) {
-    this.desiredSubscriptions.delete(topic);
-    if (this.ready) this.send(this.clientMessage("realtime.unsubscribe", { topics: [topic] }));
-  }
-  sendEndpointMessage(message) {
-    if (!this.ready) throw new Error("Realtime connection is not ready");
-    this.send(this.clientMessage("endpoint.message", message));
-  }
-  setEndpoint(binding) {
-    this.endpointBinding = binding;
-    this.refreshEndpointConnection();
-  }
-  clearEndpoint(binding) {
-    if (binding && this.endpointBinding !== binding) return;
-    const previous = this.endpointBinding;
-    this.endpointBinding = void 0;
-    previous?.onDisconnected?.();
-    this.refreshEndpointConnection();
-  }
-  refreshEndpointConnection() {
-    if (!this.shouldReconnect) return;
-    if (this.socket?.readyState === 0) {
-      this.reconnectWhenSocketOpens = true;
-      return;
-    }
-    this.reconnect();
-  }
-  async open(reconnecting) {
-    const generation = ++this.generation;
-    const timeoutMs = this.options.connectionTimeoutMs ?? 15e3;
-    const ticketAbort = new AbortController();
-    this.ticketAbort?.abort();
-    this.ticketAbort = ticketAbort;
-    let socket;
-    let closed = false;
-    let messageQueue;
-    const failAttempt = (error, retry = true) => {
-      if (closed || generation !== this.generation) return;
-      closed = true;
-      this.clearConnectionTimer();
-      ticketAbort.abort();
-      if (this.ticketAbort === ticketAbort) this.ticketAbort = void 0;
-      this.ready = false;
-      this.offeredCapabilities.clear();
-      this.endpointBinding?.onDisconnected?.();
-      this.clearHeartbeat();
-      if (this.socket === socket) this.socket = void 0;
-      if (socket) {
-        socket.onopen = null;
-        socket.onmessage = null;
-        socket.onerror = null;
-        socket.onclose = null;
-        socket.close(4e3, error.slice(0, 120));
-      }
-      if (this.shouldReconnect && retry) this.scheduleReconnect(error);
-      else if (this.shouldReconnect) {
-        this.shouldReconnect = false;
-        this.options.onStateChange?.("error", error);
-      } else this.options.onStateChange?.("disconnected");
-    };
-    this.connectionTimer = setTimeout(() => failAttempt("Realtime connection timed out"), timeoutMs);
-    this.options.onStateChange?.(reconnecting ? "reconnecting" : "connecting");
-    try {
-      const [issuedTicket, endpoint] = await Promise.all([
-        this.options.issueTicket(ticketAbort.signal),
-        this.endpointBinding?.createHello()
-      ]);
-      const ticket = issuedTicket.ticket;
-      if (REALTIME_PROTOCOL_VERSION < issuedTicket.realtime.minVersion) {
-        throw new RealtimeConnectionError("CLIENT_UPDATE_REQUIRED", false);
-      }
-      if (REALTIME_PROTOCOL_VERSION > issuedTicket.realtime.maxVersion) {
-        throw new RealtimeConnectionError("GATEWAY_UPDATE_REQUIRED", false);
-      }
-      const capabilities = REALTIME_CAPABILITIES.filter((capability) => issuedTicket.realtime.capabilities.includes(capability));
-      if (closed || !this.shouldReconnect || generation !== this.generation) return;
-      this.offeredCapabilities = new Set(capabilities ?? []);
-      socket = this.options.createWebSocket(this.options.getWebSocketUrl());
-      this.socket = socket;
-      socket.onopen = () => {
-        if (generation !== this.generation) return;
-        if (this.reconnectWhenSocketOpens) {
-          this.reconnect();
-          return;
-        }
-        const subscriptions = [...this.desiredSubscriptions].map(([topic, afterSeq]) => ({
-          topic,
-          afterSeq: this.cursors.get(topic) ?? afterSeq
-        }));
-        this.send(this.clientMessage("realtime.hello", {
-          ticket,
-          clientId: this.options.clientId,
-          clientKind: this.options.clientKind,
-          subscriptions,
-          ...capabilities?.length ? { capabilities } : {},
-          ...endpoint ? { endpoint } : {}
-        }));
-      };
-      socket.onmessage = (event) => {
-        if (generation !== this.generation) return;
-        const process = () => {
-          if (closed || generation !== this.generation) return;
-          return this.handleServerMessage(frameText(event.data));
-        };
-        if (!messageQueue) {
-          try {
-            const pending = process();
-            if (!pending) return;
-            const current2 = pending.catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
-            messageQueue = current2;
-            void current2.finally(() => {
-              if (messageQueue === current2) messageQueue = void 0;
-            });
-          } catch (error) {
-            failAttempt(error instanceof Error ? error.message : "Invalid realtime server message");
-          }
-          return;
-        }
-        const current = messageQueue.then(process).catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
-        messageQueue = current;
-        void current.finally(() => {
-          if (messageQueue === current) messageQueue = void 0;
-        });
-      };
-      socket.onerror = () => {
-      };
-      socket.onclose = (event) => {
-        failAttempt(
-          event.reason || `WebSocket closed (${event.code ?? 0})`,
-          !isNonRetryableCloseCode(event.code)
-        );
-      };
-    } catch (error) {
-      failAttempt(
-        error instanceof Error ? error.message : "Realtime connection failed",
-        !(error instanceof RealtimeConnectionError) || error.retryable
-      );
-    }
-  }
-  handleServerMessage(text) {
-    const message = parseServerRealtimeMessage(JSON.parse(text));
-    this.lastServerMessageAt = Date.now();
-    if (message.kind === "realtime.ready") {
-      const negotiated = message.payload.negotiatedCapabilities ?? [];
-      if (negotiated.some((capability) => !this.offeredCapabilities.has(capability))) {
-        throw new Error("Realtime server negotiated a capability the client did not offer");
-      }
-      this.ready = true;
-      this.reconnectAttempts = 0;
-      this.clearConnectionTimer();
-      this.ticketAbort = void 0;
-      this.options.onStateChange?.("connected");
-      this.options.onCapabilities?.(negotiated);
-      if (message.payload.endpoint) this.endpointBinding?.onReady(message.payload.endpoint);
-      this.clearHeartbeat();
-      this.heartbeatTimer = setInterval(() => {
-        if (!this.ready) return;
-        if (Date.now() - this.lastServerMessageAt >= message.payload.heartbeatTimeoutMs) {
-          this.reconnect();
-          return;
-        }
-        this.send(this.clientMessage("realtime.ping", {}));
-      }, message.payload.heartbeatIntervalMs);
-    } else if (message.kind === "realtime.event") {
-      const cursor = this.cursors.get(message.payload.topic);
-      if (cursor !== void 0 && message.payload.seq <= cursor) return;
-      this.options.onEvent?.(message.payload);
-      this.cursors.set(message.payload.topic, message.payload.seq);
-    } else if (message.kind === "realtime.subscribed") {
-      this.cursors.set(message.payload.topic, message.payload.cursor);
-      this.options.onSubscribed?.(message.payload);
-    } else if (message.kind === "realtime.gap") {
-      this.cursors.set(message.payload.topic, message.payload.earliestSeq - 1);
-      return this.options.onGap?.(message.payload);
-    } else if (message.kind === "realtime.error") {
-      this.options.onStateChange?.("error", message.payload.message);
-    } else if (message.kind === "endpoint.message") {
-      this.endpointBinding?.onMessage(message.payload);
-      this.options.onEndpointMessage?.(message.payload);
-    }
-  }
-  sendSubscriptions(subscriptions) {
-    this.send(this.clientMessage("realtime.subscribe", { subscriptions }));
-  }
-  clientMessage(kind, payload) {
-    const messageId = this.options.createMessageId?.() ?? globalThis.crypto?.randomUUID?.();
-    if (!messageId) throw new Error("RealtimeClient requires createMessageId when crypto.randomUUID is unavailable");
-    return {
-      protocolVersion: REALTIME_PROTOCOL_VERSION,
-      messageId,
-      kind,
-      sentAt: Date.now(),
-      payload
-    };
-  }
-  send(message) {
-    if (!this.socket || this.socket.readyState !== 1) return;
-    const data = JSON.stringify(message);
-    const bytes = new TextEncoder().encode(data).byteLength;
-    if (bytes > REALTIME_MAX_CLIENT_FRAME_BYTES) {
-      throw new RealtimeFrameTooLargeError(bytes, REALTIME_MAX_CLIENT_FRAME_BYTES);
-    }
-    this.socket.send(data);
-  }
-  scheduleReconnect(error) {
-    if (!this.shouldReconnect) return;
-    this.reconnectAttempts += 1;
-    const max = this.options.maxReconnectAttempts;
-    if (max !== void 0 && this.reconnectAttempts > max) {
-      this.shouldReconnect = false;
-      this.options.onStateChange?.("error", error);
-      return;
-    }
-    this.options.onStateChange?.("reconnecting", error);
-    const cap = Math.min(3e4, 1e3 * 2 ** Math.min(this.reconnectAttempts - 1, 5));
-    const delay = Math.round(cap * (0.5 + Math.random() * 0.5));
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = void 0;
-      void this.open(true);
-    }, delay);
-  }
-  clearHeartbeat() {
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    this.heartbeatTimer = void 0;
-  }
-  clearTimers() {
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.reconnectTimer = void 0;
-    this.clearConnectionTimer();
-    this.ticketAbort?.abort();
-    this.ticketAbort = void 0;
-    this.clearHeartbeat();
-  }
-  clearConnectionTimer() {
-    if (this.connectionTimer) clearTimeout(this.connectionTimer);
-    this.connectionTimer = void 0;
-  }
-}
-
-const MAX_BROWSER_CONTEXTS_PER_TURN = 2;
-const MAX_BROWSER_SELECTION_BYTES = 32 * 1024;
-const MAX_BROWSER_PAGE_TEXT_BYTES = 128 * 1024;
-const MAX_BROWSER_CONTEXT_BODY_BYTES = 256 * 1024;
-const utf8Bytes = (value) => new TextEncoder().encode(value).byteLength;
-const browserPageContextInputSchema = strictObject({
-  kind: literal("browser_page"),
-  sourceId: uuid(),
-  version: string().regex(/^[a-f0-9]{64}$/),
-  title: string().trim().min(1).max(512),
-  url: url(),
-  capturedAt: number().int().nonnegative(),
-  documentId: string().trim().min(1).max(256),
-  selection: string().optional(),
-  text: string().optional(),
-  truncated: boolean()
-}).superRefine((value, ctx) => {
-  const url = new URL(value.url);
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash) {
-    ctx.addIssue({ code: "custom", path: ["url"], message: "URL must be a sanitized HTTP(S) URL" });
-  }
-  if (!value.selection?.trim() && !value.text?.trim()) {
-    ctx.addIssue({ code: "custom", message: "A browser context must include selection or page text" });
-  }
-  if (value.selection && utf8Bytes(value.selection) > MAX_BROWSER_SELECTION_BYTES) {
-    ctx.addIssue({ code: "custom", path: ["selection"], message: "Selection is too large" });
-  }
-  if (value.text && utf8Bytes(value.text) > MAX_BROWSER_PAGE_TEXT_BYTES) {
-    ctx.addIssue({ code: "custom", path: ["text"], message: "Page text is too large" });
-  }
-});
-const browserPageContextsInputSchema = array(browserPageContextInputSchema).max(MAX_BROWSER_CONTEXTS_PER_TURN).superRefine((value, ctx) => {
-  if (utf8Bytes(JSON.stringify(value)) > MAX_BROWSER_CONTEXT_BODY_BYTES) {
-    ctx.addIssue({ code: "custom", message: "Browser contexts are too large" });
-  }
-});
-
-const DEVICE_PAIRING_VERSION = 3;
-const MOBILE_PAIRING_INVITATION_VERSION = 4;
-const BROWSER_PAIRING_INVITATION_VERSION = 1;
-const BROWSER_PAIRING_INVITATION_PREFIX = `XOPC-BROWSER-INVITE-V${BROWSER_PAIRING_INVITATION_VERSION}:`;
-_enum(["mobile", "browser"]);
-const devicePlatformSchema = _enum(["ios", "android", "harmonyos", "chrome"]);
-const devicePairingRouteSchema = strictObject({
-  id: string().trim().min(1).max(80),
-  kind: _enum(["xopc-secure-link", "tailscale", "custom-https", "local-browser"]),
-  url: string().url()
-}).superRefine((route, context) => {
-  const url = new URL(route.url);
-  const isOrigin = !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
-  const valid = route.kind === "local-browser" ? url.protocol === "http:" && url.hostname === "127.0.0.1" && isOrigin : url.protocol === "https:" && isOrigin;
-  if (!valid) context.addIssue({ code: "custom", path: ["url"], message: "Pairing route must be a secure origin" });
-});
-const browserPairingInvitationPayloadSchema = strictObject({
-  version: literal(DEVICE_PAIRING_VERSION),
-  targetKind: literal("browser"),
-  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
-  gatewayId: string().uuid(),
-  gatewayName: string().trim().min(1).max(120),
-  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
-  routes: array(devicePairingRouteSchema).min(1).max(8),
-  expiresAt: number().int().positive()
-});
-const secureMobileOriginSchema = string().url().superRefine((origin, context) => {
-  const url = new URL(origin);
-  if (url.protocol !== "https:" || url.username || url.password || origin !== url.origin) {
-    context.addIssue({ code: "custom", message: "Mobile pairing origins must be canonical HTTPS origins" });
-  }
-});
-strictObject({
-  version: literal(MOBILE_PAIRING_INVITATION_VERSION),
-  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
-  gatewayId: string().uuid(),
-  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
-  origins: array(secureMobileOriginSchema).min(1).max(8),
-  expiresAt: number().int().positive()
-}).superRefine((payload, context) => {
-  if (new Set(payload.origins).size !== payload.origins.length) {
-    context.addIssue({ code: "custom", path: ["origins"], message: "Mobile pairing origins must be unique" });
-  }
-});
-const devicePairingKeySchema = strictObject({
-  kty: literal("EC"),
-  crv: literal("P-256"),
-  x: string().regex(/^[A-Za-z0-9_-]{43}$/),
-  y: string().regex(/^[A-Za-z0-9_-]{43}$/)
-});
-const devicePairingDeviceSchema = strictObject({
-  displayName: string().trim().min(1).max(80),
-  platform: devicePlatformSchema,
-  publicKeyJwk: devicePairingKeySchema,
-  extensionId: string().regex(/^[a-p]{32}$/).optional()
-}).superRefine((device, context) => {
-  if (device.platform === "chrome" && !device.extensionId) {
-    context.addIssue({ code: "custom", path: ["extensionId"], message: "Chrome devices require an extension id" });
-  }
-  if (device.platform !== "chrome" && device.extensionId) {
-    context.addIssue({ code: "custom", path: ["extensionId"], message: "Only Chrome devices may set an extension id" });
-  }
-});
-const initialDeviceRefreshTokenSchema = string().regex(
-  /^xopc_rt_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_[A-Za-z0-9_-]{43}$/i
-);
-const devicePairingProofSchema = strictObject({
-  gatewayId: string().uuid(),
-  requestId: string().uuid(),
-  pairingToken: string().min(1).max(256),
-  timestamp: number().int().positive(),
-  nonce: string().regex(/^[A-Za-z0-9_-]{24,128}$/),
-  signature: string().regex(/^[A-Za-z0-9_-]{86}$/)
-});
-devicePairingProofSchema.extend({ device: devicePairingDeviceSchema });
-devicePairingProofSchema.extend({
-  idempotencyKey: string().uuid(),
-  initialRefreshToken: initialDeviceRefreshTokenSchema
-});
-function isRetryableDevicePairingHttpStatus(status) {
-  return status >= 500 || [404, 408, 425, 429].includes(status);
-}
-function readBrowserPairingInvitation(value) {
-  const invitation = value.trim();
-  if (!invitation.startsWith(BROWSER_PAIRING_INVITATION_PREFIX)) {
-    throw new Error("Browser pairing invitation is invalid");
-  }
-  const encodedPayload = invitation.slice(BROWSER_PAIRING_INVITATION_PREFIX.length);
-  if (!/^[A-Za-z0-9_-]+$/.test(encodedPayload)) throw new Error("Browser pairing invitation is invalid");
-  return encodedPayload;
-}
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a.localeCompare(b, "en")).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-function buildDevicePairingProof(action, body) {
-  const { signature: _signature, ...payload } = body;
-  return `xopc-device-pairing-v3
-POST
-${action}
-${canonical(payload)}`;
-}
-
-const LOCALE_STORAGE_KEY = "xopc.sidepanel.locale";
-const LOCALE_PATHS = {
-  en: "_locales/en/messages.json",
-  "zh-CN": "_locales/zh_CN/messages.json"
-};
-let activeLocale;
-let activeCatalog;
-function isExtensionLocale(value) {
-  return value === "en" || value === "zh-CN";
-}
-function browserLocale() {
-  return chrome.i18n.getUILanguage().replaceAll("_", "-").toLowerCase().startsWith("zh") ? "zh-CN" : "en";
+function browserLocale() {
+  return chrome.i18n.getUILanguage().replaceAll("_", "-").toLowerCase().startsWith("zh") ? "zh-CN" : "en";
 }
 function messageWithSubstitutions(entry, substitutions) {
   const values = substitutions === void 0 ? [] : Array.isArray(substitutions) ? substitutions : [substitutions];
@@ -5883,887 +5469,1277 @@ function messageWithSubstitutions(entry, substitutions) {
     return values[index] ?? "";
   }).replace(/\$(\d+)/g, (_match, index) => values[Number(index) - 1] ?? "");
 }
-function t(key, substitutions) {
-  const entry = activeCatalog?.[key];
-  return entry ? messageWithSubstitutions(entry, substitutions) : chrome.i18n.getMessage(key, substitutions) || key;
+function t(key, substitutions) {
+  const entry = activeCatalog?.[key];
+  return entry ? messageWithSubstitutions(entry, substitutions) : chrome.i18n.getMessage(key, substitutions) || key;
+}
+function extensionLocale() {
+  if (activeLocale) return activeLocale;
+  return typeof chrome === "undefined" ? "en" : chrome.i18n.getUILanguage().replaceAll("_", "-");
+}
+async function loadExtensionLocalePreference() {
+  const stored = await chrome.storage.local.get(LOCALE_STORAGE_KEY);
+  const locale = isExtensionLocale(stored[LOCALE_STORAGE_KEY]) ? stored[LOCALE_STORAGE_KEY] : browserLocale();
+  await applyExtensionLocale(locale);
+  return locale;
+}
+async function saveExtensionLocalePreference(locale) {
+  await chrome.storage.local.set({ [LOCALE_STORAGE_KEY]: locale });
+  await applyExtensionLocale(locale);
+}
+async function applyExtensionLocale(locale) {
+  const response = await fetch(chrome.runtime.getURL(LOCALE_PATHS[locale]));
+  if (!response.ok) throw new Error(`Could not load extension locale: ${locale}`);
+  activeCatalog = await response.json();
+  activeLocale = locale;
+  initializeDocumentLocale();
+}
+function initializeDocumentLocale() {
+  document.documentElement.lang = extensionLocale();
+  document.documentElement.dir = chrome.i18n.getMessage("@@bidi_dir") || "ltr";
+  document.title = t("appName");
+}
+
+const DATABASE_NAME = "xopc-browser-chat-state";
+const DATABASE_VERSION = 2;
+function openDatabase() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DATABASE_NAME, DATABASE_VERSION);
+    request.onupgradeneeded = () => {
+      if (!request.result.objectStoreNames.contains("drafts")) request.result.createObjectStore("drafts");
+      if (!request.result.objectStoreNames.contains("outbox")) {
+        request.result.createObjectStore("outbox");
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error(t("errorOpenOutbox")));
+  });
+}
+async function clearBrowserChatState() {
+  const db = await openDatabase();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(["outbox", "drafts"], "readwrite");
+      tx.objectStore("outbox").clear();
+      tx.objectStore("drafts").clear();
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+      tx.onabort = () => reject(tx.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+
+const PROFILE_KEY = "xopc.browser.profile";
+const PAIRING_JOURNAL_KEY = "xopc.browser.pairing";
+const REFRESH_JOURNAL_KEY = "xopc.browser.auth-refresh";
+const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
+const KEY_DATABASE = "xopc-browser-identity";
+const KEY_STORE = "identity";
+const KEY_NAME = "device-key";
+const NATIVE_HOST_NAME = "ai.xopc.browser";
+const GATEWAY_REQUEST_TIMEOUT_MS = 8e3;
+const ACCESS_TOKEN_EXPIRY_MARGIN_MS = 3e4;
+const REFRESH_LOCK_NAME = "xopc.browser.auth-refresh";
+let refreshTask;
+function assertProfileIdentity(profile, expected) {
+  if (!profile || profile.gatewayId !== expected.gatewayId || profile.deviceId !== expected.deviceId || profile.gatewayPublicKey !== expected.gatewayPublicKey) throw new Error("Gateway identity changed");
+}
+async function browserPublicKeyThumbprint(jwk) {
+  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  return encodeBase64Url(new Uint8Array(await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(canonical)
+  )));
+}
+async function isAutoConnectEnabled() {
+  const stored = await chrome.storage.local.get(AUTO_CONNECT_KEY);
+  return stored[AUTO_CONNECT_KEY] !== false;
+}
+async function setAutoConnectEnabled(enabled) {
+  await chrome.storage.local.set({ [AUTO_CONNECT_KEY]: enabled });
+}
+async function discoverLocalGateway(options) {
+  try {
+    if (!options?.force && !await isAutoConnectEnabled()) return void 0;
+    const pair = await getOrCreateKeyPair();
+    const key = await publicKeyJwk(pair);
+    const nonce = randomNonce();
+    const response = await chrome.runtime.sendNativeMessage(
+      NATIVE_HOST_NAME,
+      {
+        type: "bootstrap",
+        extensionId: chrome.runtime.id,
+        publicKeyJwk: key,
+        publicKeyThumbprint: await browserPublicKeyThumbprint(key),
+        nonce
+      }
+    );
+    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.invitation !== "string" || typeof response.expiresAt !== "number") {
+      if (options?.force) throw new Error(response.error || t("errorInvalidLocalHostResponse"));
+      return void 0;
+    }
+    return {
+      gatewayUrl: response.gatewayUrl,
+      invitation: response.invitation,
+      expiresAt: response.expiresAt
+    };
+  } catch (cause) {
+    if (options?.force) throw cause;
+    return void 0;
+  }
+}
+function encodeBase64Url(bytes) {
+  let binary = "";
+  bytes.forEach((byte) => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decodeBase64Url(value) {
+  const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4);
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function decodeJson(value) {
+  return JSON.parse(new TextDecoder().decode(decodeBase64Url(value)));
+}
+function randomNonce(bytes = 24) {
+  return encodeBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function createRefreshToken() {
+  return `xopc_rt_${crypto.randomUUID()}_${randomNonce(32)}`;
+}
+function parseBrowserPairingInvitation(value, allowExpired = false) {
+  const encoded = readBrowserPairingInvitation(value);
+  const parsed = browserPairingInvitationPayloadSchema.safeParse(decodeJson(encoded));
+  if (!parsed.success) throw new Error("Pairing invitation version is not supported");
+  const payload = parsed.data;
+  if (!allowExpired && payload.expiresAt <= Date.now()) throw new Error("Pairing invitation has expired");
+  return payload;
+}
+function openIdentityDatabase() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(KEY_DATABASE, 1);
+    request.onupgradeneeded = () => request.result.createObjectStore(KEY_STORE);
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+async function storedKeyPair() {
+  const database = await openIdentityDatabase();
+  try {
+    return await new Promise((resolve, reject) => {
+      const request = database.transaction(KEY_STORE).objectStore(KEY_STORE).get(KEY_NAME);
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    database.close();
+  }
 }
-function extensionLocale() {
-  if (activeLocale) return activeLocale;
-  return typeof chrome === "undefined" ? "en" : chrome.i18n.getUILanguage().replaceAll("_", "-");
+async function getOrCreateKeyPair() {
+  const existing = await storedKeyPair();
+  if (existing) return existing;
+  const pair = await crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign", "verify"]
+  );
+  const database = await openIdentityDatabase();
+  await new Promise((resolve, reject) => {
+    const request = database.transaction(KEY_STORE, "readwrite").objectStore(KEY_STORE).put(pair, KEY_NAME);
+    request.onsuccess = () => resolve();
+    request.onerror = () => reject(request.error);
+  }).finally(() => database.close());
+  return pair;
 }
-async function loadExtensionLocalePreference() {
-  const stored = await chrome.storage.local.get(LOCALE_STORAGE_KEY);
-  const locale = isExtensionLocale(stored[LOCALE_STORAGE_KEY]) ? stored[LOCALE_STORAGE_KEY] : browserLocale();
-  await applyExtensionLocale(locale);
-  return locale;
+async function forgetIdentity() {
+  await new Promise((resolve, reject) => {
+    const request = indexedDB.deleteDatabase(KEY_DATABASE);
+    request.onsuccess = () => resolve();
+    request.onerror = () => reject(request.error);
+    request.onblocked = () => reject(new Error(t("errorIdentityInUse")));
+  });
 }
-async function saveExtensionLocalePreference(locale) {
-  await chrome.storage.local.set({ [LOCALE_STORAGE_KEY]: locale });
-  await applyExtensionLocale(locale);
+async function publicKeyJwk(pair) {
+  const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  if (!exported.x || !exported.y) throw new Error(t("errorIdentityExport"));
+  return { kty: "EC", crv: "P-256", x: exported.x, y: exported.y };
 }
-async function applyExtensionLocale(locale) {
-  const response = await fetch(chrome.runtime.getURL(LOCALE_PATHS[locale]));
-  if (!response.ok) throw new Error(`Could not load extension locale: ${locale}`);
-  activeCatalog = await response.json();
-  activeLocale = locale;
-  initializeDocumentLocale();
+async function sign(pair, text) {
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    pair.privateKey,
+    new TextEncoder().encode(text)
+  );
+  return encodeBase64Url(new Uint8Array(signature));
 }
-function initializeDocumentLocale() {
-  document.documentElement.lang = extensionLocale();
-  document.documentElement.dir = chrome.i18n.getMessage("@@bidi_dir") || "ltr";
-  document.title = t("appName");
+async function verifyGateway(publicKey, payload, signature) {
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      decodeBase64Url(publicKey),
+      { name: "Ed25519" },
+      false,
+      ["verify"]
+    );
+    return crypto.subtle.verify(
+      { name: "Ed25519" },
+      key,
+      decodeBase64Url(signature),
+      new TextEncoder().encode(payload)
+    );
+  } catch {
+    return false;
+  }
 }
-
-const PENDING_CONTEXT_KEY = "xopc.browser.pending-context";
-const TAB_BINDING_PREFIX = "xopc.browser.tab-binding.";
-async function buildPageContext(raw, pageUrl) {
-  const url = sanitizedUrl(pageUrl);
-  const selected = raw.selection ? truncateUtf8(raw.selection, MAX_BROWSER_SELECTION_BYTES) : void 0;
-  const page = raw.text ? truncateUtf8(raw.text, MAX_BROWSER_PAGE_TEXT_BYTES) : void 0;
-  const canonical = {
-    title: raw.title.trim() || new URL(url).hostname,
-    url,
-    capturedAt: Date.now(),
-    documentId: await sha256(`${url}
-${raw.timeOrigin}`),
-    selection: selected?.value,
-    text: page?.value
-  };
-  return {
-    kind: "browser_page",
-    sourceId: crypto.randomUUID(),
-    version: await sha256(JSON.stringify(canonical)),
-    ...canonical,
-    truncated: selected?.truncated === true || page?.truncated === true
-  };
+async function hasGatewayOriginPermission(origin) {
+  const url = new URL(origin);
+  if (url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname)) return true;
+  return chrome.permissions.contains({ origins: [`${url.origin}/*`] });
 }
-function truncateUtf8(value, maxBytes) {
-  const encoder = new TextEncoder();
-  if (encoder.encode(value).byteLength <= maxBytes) return { value, truncated: false };
-  let low = 0;
-  let high = value.length;
-  while (low < high) {
-    const middle = Math.ceil((low + high) / 2);
-    if (encoder.encode(value.slice(0, middle)).byteLength <= maxBytes) low = middle;
-    else high = middle - 1;
+class GatewayHttpError extends Error {
+  constructor(code, status, serverMessage) {
+    super(code);
+    this.code = code;
+    this.status = status;
+    this.serverMessage = serverMessage;
+    this.name = "GatewayHttpError";
   }
-  return { value: value.slice(0, low), truncated: true };
+  code;
+  status;
+  serverMessage;
 }
-function sanitizedUrl(raw) {
-  let url;
+async function post(origin, path, body) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), GATEWAY_REQUEST_TIMEOUT_MS);
+  let response;
   try {
-    url = new URL(raw);
-  } catch {
-    throw new Error(t("errorInvalidWebAddress"));
+    response = await fetch(`${origin}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+  } catch (cause) {
+    if (controller.signal.aborted) throw new Error(t("errorGatewayTimeout", String(GATEWAY_REQUEST_TIMEOUT_MS / 1e3)));
+    throw cause;
+  } finally {
+    clearTimeout(timeout);
   }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(t("errorRestrictedPage"));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new GatewayHttpError(
+      json.error?.code ?? json.error?.message ?? t("errorGatewayStatus", String(response.status)),
+      response.status,
+      json.error?.message
+    );
   }
-  if (url.hostname === "chromewebstore.google.com" || url.hostname === "chrome.google.com" && url.pathname.startsWith("/webstore")) {
-    throw new Error(t("errorWebStorePage"));
+  return json;
+}
+async function signedPairingRequest(pair, payload, origin, requestId, action, completion) {
+  const nonce = randomNonce();
+  const body = {
+    gatewayId: payload.gatewayId,
+    requestId,
+    pairingToken: payload.pairingToken,
+    timestamp: Date.now(),
+    nonce,
+    ...action === "request" ? {
+      device: {
+        displayName: `Chrome · ${navigator.platform || "Browser"}`,
+        platform: "chrome",
+        extensionId: chrome.runtime.id,
+        publicKeyJwk: await publicKeyJwk(pair)
+      }
+    } : {},
+    ...action === "complete" ? completion : {}
+  };
+  const signature = await sign(pair, buildDevicePairingProof(action, body));
+  const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/${requestId}/${action}`;
+  const response = await post(origin, path, { ...body, signature });
+  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string") {
+    throw new Error(t("errorUnsignedPairing"));
   }
-  url.username = "";
-  url.password = "";
-  url.hash = "";
-  return url.toString();
+  if (!await verifyGateway(payload.gatewayPublicKey, response.signedPayload, response.signature)) {
+    throw new Error(t("errorGatewayVerification"));
+  }
+  const decoded = decodeJson(response.signedPayload);
+  if (decoded.gateway.id !== payload.gatewayId || decoded.nonce !== nonce || decoded.request.requestId !== requestId) {
+    throw new Error(t("errorPairingMismatch"));
+  }
+  return decoded;
 }
-function siteAccessError(cause, url) {
+function shouldTryNextRoute(cause) {
+  return !(cause instanceof GatewayHttpError) || isRetryableDevicePairingHttpStatus(cause.status);
+}
+function isRouteFailure(cause) {
+  if (cause instanceof GatewayHttpError) return isRetryableDevicePairingHttpStatus(cause.status);
   const message = cause instanceof Error ? cause.message : String(cause);
-  const hostname = new URL(url).hostname;
-  if (/cannot access|cannot be scripted|missing host permission|extensions gallery|chrome web store/i.test(message)) {
-    return new Error(t("errorSiteAccessBlocked", hostname));
-  }
-  return cause instanceof Error ? cause : new Error(message);
+  return /network|fetch|respond|identity|route/i.test(message);
 }
-async function runWithTabSiteAccess(tabId, operation) {
-  const tab = await chrome.tabs.get(tabId);
-  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) {
-    throw new Error(t("errorTabUnavailable"));
+async function signedPairingRequestAcrossRoutes(pair, payload, origins, requestId, action, completion) {
+  let lastRouteError;
+  for (const origin of origins) {
+    try {
+      return { origin, result: await signedPairingRequest(pair, payload, origin, requestId, action, completion) };
+    } catch (cause) {
+      if (!shouldTryNextRoute(cause)) throw cause;
+      lastRouteError = cause;
+    }
   }
-  const url = sanitizedUrl(tab.url);
-  const originPattern = `${new URL(url).origin}/*`;
-  const alreadyGranted = await chrome.permissions.contains({ origins: [originPattern] });
-  let newlyGranted = false;
-  if (!alreadyGranted) {
-    let granted = false;
+  throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
+}
+async function refreshAccessToken(gatewayUrls, refreshToken, pair, gateway, operation = {
+  requestId: crypto.randomUUID(),
+  nextRefreshToken: createRefreshToken()
+}) {
+  const { nextRefreshToken, requestId } = operation;
+  const timestamp = Date.now();
+  const nonce = randomNonce();
+  const credentialId = refreshToken.slice("xopc_rt_".length).split("_")[0];
+  const proof = `xopc-device-refresh-v2
+${credentialId}
+${timestamp}
+${nonce}
+${requestId}
+${nextRefreshToken}`;
+  const signature = await sign(pair, proof);
+  const body = {
+    refreshToken,
+    nextRefreshToken,
+    requestId,
+    timestamp,
+    nonce,
+    signature
+  };
+  let gatewayUrl;
+  let response;
+  let lastRouteError;
+  for (const origin of gatewayUrls) {
     try {
-      granted = await chrome.permissions.request({ origins: [originPattern] });
+      response = await post(origin, "/api/device-auth/refresh", body);
+      gatewayUrl = origin;
+      break;
     } catch (cause) {
-      throw siteAccessError(cause, url);
+      if (!shouldTryNextRoute(cause)) throw cause;
+      lastRouteError = cause;
     }
-    if (!granted) throw new Error(t("errorSiteAccessRequired", new URL(url).hostname));
-    newlyGranted = true;
   }
-  try {
-    return await operation({ ...tab, id: tab.id, windowId: tab.windowId, url });
-  } catch (cause) {
-    if (newlyGranted) await chrome.permissions.remove({ origins: [originPattern] }).catch(() => false);
-    throw siteAccessError(cause, url);
+  if (!response || !gatewayUrl) {
+    throw lastRouteError instanceof Error ? lastRouteError : new Error(t("errorNoReachableGatewayRoute"));
   }
-}
-async function sha256(value) {
-  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function extractPage(mode) {
-  const normalize = (value) => value.replace(/\s+/g, " ").trim();
-  if (mode === "selection") {
-    const focused = document.activeElement;
-    const fieldSelection = focused instanceof HTMLTextAreaElement || focused instanceof HTMLInputElement && ["text", "search", "url", "email", "tel"].includes(focused.type) ? focused.value.slice(focused.selectionStart ?? 0, focused.selectionEnd ?? 0) : "";
-    const selection = normalize(fieldSelection || window.getSelection()?.toString() || "");
-    return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, selection };
+  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string" || !await verifyGateway(gateway.gatewayPublicKey, response.signedPayload, response.signature)) throw new Error(t("errorGatewayVerification"));
+  const responseProof = decodeJson(response.signedPayload);
+  if (responseProof.purpose !== "device-refresh-v3" || responseProof.gatewayId !== gateway.gatewayId || responseProof.requestId !== requestId || responseProof.nonce !== nonce || !(responseProof.expiresAt > Date.now()) || responseProof.expiresAt > Date.now() + 6e4) throw new Error("Gateway refresh response does not match this request");
+  const payload = responseProof.tokens;
+  if (!payload?.accessToken || !payload.accessTokenExpiresAt || payload.refreshToken !== nextRefreshToken) {
+    throw new Error(t("errorInvalidCredentials"));
   }
-  const source = document.querySelector("article, main") ?? document.body;
-  if (!source) return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin };
-  const clone = source.cloneNode(true);
-  clone.querySelectorAll([
-    "script",
-    "style",
-    "noscript",
-    "template",
-    "iframe",
-    "svg",
-    "canvas",
-    "video",
-    "audio",
-    "nav",
-    "aside",
-    "header",
-    "footer",
-    "form",
-    "[hidden]",
-    '[aria-hidden="true"]',
-    "[inert]"
-  ].join(",")).forEach((element) => element.remove());
-  const text = normalize(clone.innerText || clone.textContent || "");
-  return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, text };
+  return { ...payload, gatewayUrl };
 }
-async function captureContextMenuSelection(tabId, selectionText, pageUrl) {
-  const tab = await chrome.tabs.get(tabId);
-  if (!tab.url) throw new Error(t("errorTabUnavailable"));
-  const url = sanitizedUrl(tab.url);
-  if (pageUrl && sanitizedUrl(pageUrl) !== url) throw new Error(t("errorPageChangedReading"));
-  const selection = selectionText.replace(/\s+/g, " ").trim();
-  if (!selection) throw new Error(t("errorSelectText"));
-  return buildPageContext({ title: tab.title ?? "", timeOrigin: Date.now(), selection }, url);
+function wait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-async function captureTabPage(tabId, mode) {
-  const tab = await chrome.tabs.get(tabId);
-  if (!tab.url) throw new Error(t("errorTabUnavailable"));
-  sanitizedUrl(tab.url);
-  const result = await chrome.scripting.executeScript({
-    target: { tabId, allFrames: true },
-    func: extractPage,
-    args: [mode]
-  });
-  const main = result[0]?.result;
-  if (!main) throw new Error(t("errorReadPage"));
-  const currentTab = await chrome.tabs.get(tabId);
-  if (!currentTab.url || sanitizedUrl(main.url) !== sanitizedUrl(tab.url) || sanitizedUrl(main.url) !== sanitizedUrl(currentTab.url)) {
-    throw new Error(t("errorPageChangedReading"));
-  }
-  const content = result.map((item) => item.result).find((item) => mode === "selection" ? item?.selection : item?.text);
-  if (!content?.selection && !content?.text) {
-    throw new Error(t(mode === "selection" ? "errorSelectText" : "errorNoReadableContent"));
+async function pairGateway(invitation, onApproval, requestedOrigin) {
+  const payload = parseBrowserPairingInvitation(invitation, true);
+  const origins = [...new Set(payload.routes.map((route) => new URL(route.url).origin))];
+  const selectedOrigin = requestedOrigin && origins.includes(requestedOrigin) ? requestedOrigin : origins[0];
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
+  const pair = await getOrCreateKeyPair();
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  let journal = stored[PAIRING_JOURNAL_KEY];
+  if (journal && journal.payload.pairingToken !== payload.pairingToken) {
+    throw new Error("PAIRING_ALREADY_PENDING");
   }
-  return buildPageContext({ ...main, selection: content.selection, text: content.text }, main.url);
-}
-async function captureTabWithPermission(tabId, mode) {
-  return runWithTabSiteAccess(tabId, () => captureTabPage(tabId, mode));
-}
-async function activeTabId() {
-  return (await chrome.tabs.query({ active: true, currentWindow: true }))[0]?.id;
-}
-async function currentTabDescriptor() {
-  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
-  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) throw new Error(t("errorNoActivePage"));
-  return runWithTabSiteAccess(tab.id, async (accessibleTab) => {
-    const result = await chrome.scripting.executeScript({
-      target: { tabId: accessibleTab.id },
-      func: () => ({ url: location.href, timeOrigin: performance.timeOrigin })
-    });
-    const marker = result[0]?.result;
-    if (!marker) throw new Error(t("errorIdentifyPage"));
-    const currentUrl = sanitizedUrl(marker.url);
-    if (new URL(currentUrl).origin !== new URL(accessibleTab.url).origin) {
-      throw new Error(t("errorPageChangedConnecting"));
-    }
-    return {
-      tabId: String(accessibleTab.id),
-      windowId: String(accessibleTab.windowId),
-      documentId: await sha256(`${currentUrl}
-${marker.timeOrigin}`),
-      urlOrigin: new URL(currentUrl).origin
-    };
-  });
-}
-
-const DATABASE_NAME = "xopc-browser-chat-state";
-const DATABASE_VERSION = 2;
-function openDatabase() {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(DATABASE_NAME, DATABASE_VERSION);
-    request.onupgradeneeded = () => {
-      if (!request.result.objectStoreNames.contains("drafts")) request.result.createObjectStore("drafts");
-      if (!request.result.objectStoreNames.contains("outbox")) {
-        request.result.createObjectStore("outbox");
-      }
+  if (!journal) {
+    if (payload.expiresAt <= Date.now()) throw new Error(t("errorExpiredPairingLink"));
+    journal = {
+      invitation: invitation.trim(),
+      payload,
+      requestId: crypto.randomUUID(),
+      idempotencyKey: crypto.randomUUID(),
+      initialRefreshToken: createRefreshToken()
     };
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error ?? new Error(t("errorOpenOutbox")));
-  });
-}
-async function clearBrowserChatState() {
-  const db = await openDatabase();
-  try {
-    await new Promise((resolve, reject) => {
-      const tx = db.transaction(["outbox", "drafts"], "readwrite");
-      tx.objectStore("outbox").clear();
-      tx.objectStore("drafts").clear();
-      tx.oncomplete = () => resolve();
-      tx.onerror = () => reject(tx.error);
-      tx.onabort = () => reject(tx.error);
-    });
-  } finally {
-    db.close();
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+  }
+  delete journal.nextOrigin;
+  await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+  const requestId = journal.requestId;
+  const availableOrigins = journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : [selectedOrigin, ...permittedOrigins.filter((candidate) => candidate !== selectedOrigin)];
+  try {
+    let { origin, result } = await signedPairingRequestAcrossRoutes(
+      pair,
+      journal.payload,
+      availableOrigins,
+      requestId,
+      "request"
+    );
+    journal.origin = origin;
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    if (result.request.status === "pending") onApproval(result.request.confirmationCode);
+    while (result.request.status === "pending") {
+      await wait(1500);
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "status"
+      );
+      ({ origin, result } = response);
+      journal.origin = origin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    }
+    if (result.request.status !== "approved" && result.request.status !== "completed") {
+      await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+      throw new Error(t("errorPairingStatus", result.request.status));
+    }
+    if (result.request.status !== "completed") {
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "complete",
+        {
+          idempotencyKey: journal.idempotencyKey,
+          initialRefreshToken: journal.initialRefreshToken
+        }
+      );
+      ({ origin, result } = response);
+    }
+    if (!result.request.deviceId) throw new Error(t("errorBrowserNotRegistered"));
+    journal.origin = origin;
+    journal.completed = { deviceId: result.request.deviceId, gatewayName: result.gateway.name };
+    journal.refresh ??= { requestId: crypto.randomUUID(), nextRefreshToken: createRefreshToken() };
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    const orderedOrigins = [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)];
+    const tokens = await refreshAccessToken(
+      orderedOrigins,
+      journal.initialRefreshToken,
+      pair,
+      journal.payload,
+      journal.refresh
+    );
+    const profile = {
+      gatewayId: journal.payload.gatewayId,
+      gatewayName: journal.completed.gatewayName,
+      gatewayUrl: tokens.gatewayUrl,
+      gatewayUrls: [tokens.gatewayUrl, ...orderedOrigins.filter((candidate) => candidate !== tokens.gatewayUrl)],
+      gatewayPublicKey: journal.payload.gatewayPublicKey,
+      deviceId: journal.completed.deviceId,
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken,
+      accessTokenExpiresAt: tokens.accessTokenExpiresAt
+    };
+    await chrome.storage.local.set({ [PROFILE_KEY]: profile });
+    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+    return profile;
+  } catch (cause) {
+    const nextOrigin = origins.find((origin) => !permittedOrigins.includes(origin));
+    if (nextOrigin && isRouteFailure(cause)) {
+      journal.nextOrigin = nextOrigin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+      throw new Error(`PAIRING_ROUTE_PERMISSION_REQUIRED:${nextOrigin}`);
+    }
+    throw cause;
   }
 }
-
-const PROFILE_KEY = "xopc.browser.profile";
-const PAIRING_JOURNAL_KEY = "xopc.browser.pairing";
-const REFRESH_JOURNAL_KEY = "xopc.browser.auth-refresh";
-const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
-const KEY_DATABASE = "xopc-browser-identity";
-const KEY_STORE = "identity";
-const KEY_NAME = "device-key";
-const NATIVE_HOST_NAME = "ai.xopc.browser";
-const GATEWAY_REQUEST_TIMEOUT_MS = 8e3;
-const ACCESS_TOKEN_EXPIRY_MARGIN_MS = 3e4;
-const REFRESH_LOCK_NAME = "xopc.browser.auth-refresh";
-let refreshTask;
-function assertProfileIdentity(profile, expected) {
-  if (!profile || profile.gatewayId !== expected.gatewayId || profile.deviceId !== expected.deviceId || profile.gatewayPublicKey !== expected.gatewayPublicKey) throw new Error("Gateway identity changed");
-}
-async function browserPublicKeyThumbprint(jwk) {
-  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
-  return encodeBase64Url(new Uint8Array(await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(canonical)
-  )));
-}
-async function isAutoConnectEnabled() {
-  const stored = await chrome.storage.local.get(AUTO_CONNECT_KEY);
-  return stored[AUTO_CONNECT_KEY] !== false;
-}
-async function setAutoConnectEnabled(enabled) {
-  await chrome.storage.local.set({ [AUTO_CONNECT_KEY]: enabled });
+async function readPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  return journal ? { invitation: journal.invitation, ...journal.nextOrigin ? { nextOrigin: journal.nextOrigin } : {} } : void 0;
 }
-async function discoverLocalGateway(options) {
+async function cancelPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  if (!journal) return;
+  const origins = [...new Set(journal.payload.routes.map((route) => new URL(route.url).origin))];
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
   try {
-    if (!options?.force && !await isAutoConnectEnabled()) return void 0;
-    const pair = await getOrCreateKeyPair();
-    const key = await publicKeyJwk(pair);
-    const nonce = randomNonce();
-    const response = await chrome.runtime.sendNativeMessage(
-      NATIVE_HOST_NAME,
-      {
-        type: "bootstrap",
-        extensionId: chrome.runtime.id,
-        publicKeyJwk: key,
-        publicKeyThumbprint: await browserPublicKeyThumbprint(key),
-        nonce
-      }
+    await signedPairingRequestAcrossRoutes(
+      await getOrCreateKeyPair(),
+      journal.payload,
+      journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : permittedOrigins,
+      journal.requestId,
+      "cancel"
     );
-    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.invitation !== "string" || typeof response.expiresAt !== "number") {
-      if (options?.force) throw new Error(response.error || t("errorInvalidLocalHostResponse"));
-      return void 0;
-    }
-    return {
-      gatewayUrl: response.gatewayUrl,
-      invitation: response.invitation,
-      expiresAt: response.expiresAt
-    };
   } catch (cause) {
-    if (options?.force) throw cause;
-    return void 0;
+    if (!(cause instanceof GatewayHttpError) || !["PAIRING_NOT_FOUND", "PAIRING_EXPIRED", "PAIRING_CANCELLED"].includes(cause.message)) throw cause;
   }
+  await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
 }
-function encodeBase64Url(bytes) {
-  let binary = "";
-  bytes.forEach((byte) => {
-    binary += String.fromCharCode(byte);
-  });
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-function decodeBase64Url(value) {
-  const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4);
-  const binary = atob(padded);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+async function readProfile() {
+  const stored = await chrome.storage.local.get([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
+  const profile = stored[PROFILE_KEY];
+  if (!profile?.gatewayId || !profile.gatewayUrl || !profile.refreshToken) return void 0;
+  const pairing = stored[PAIRING_JOURNAL_KEY];
+  if (pairing?.payload?.gatewayId === profile.gatewayId && pairing.completed?.deviceId === profile.deviceId) {
+    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  }
+  return profile;
 }
-function decodeJson(value) {
-  return JSON.parse(new TextDecoder().decode(decodeBase64Url(value)));
+function withRefreshLock(operation) {
+  const locks = globalThis.navigator?.locks;
+  if (!locks) return operation();
+  return new Promise((resolve, reject) => {
+    void locks.request(REFRESH_LOCK_NAME, () => operation().then(resolve, reject)).catch(reject);
+  });
 }
-function randomNonce(bytes = 24) {
-  return encodeBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+function isRefreshDenied(cause) {
+  return cause instanceof GatewayHttpError && cause.status === 401 && cause.code === "REFRESH_DENIED";
 }
-function createRefreshToken() {
-  return `xopc_rt_${crypto.randomUUID()}_${randomNonce(32)}`;
+async function refreshJournalFor(profile) {
+  const stored = await chrome.storage.local.get(REFRESH_JOURNAL_KEY);
+  const journal = stored[REFRESH_JOURNAL_KEY];
+  if (journal?.gatewayId === profile.gatewayId && journal.refreshToken === profile.refreshToken) return journal;
+  const next = {
+    gatewayId: profile.gatewayId,
+    refreshToken: profile.refreshToken,
+    requestId: crypto.randomUUID(),
+    nextRefreshToken: createRefreshToken()
+  };
+  await chrome.storage.local.set({ [REFRESH_JOURNAL_KEY]: next });
+  return next;
 }
-function parseBrowserPairingInvitation(value, allowExpired = false) {
-  const encoded = readBrowserPairingInvitation(value);
-  const parsed = browserPairingInvitationPayloadSchema.safeParse(decodeJson(encoded));
-  if (!parsed.success) throw new Error("Pairing invitation version is not supported");
-  const payload = parsed.data;
-  if (!allowExpired && payload.expiresAt <= Date.now()) throw new Error("Pairing invitation has expired");
-  return payload;
+async function recoverLocalProfile(gatewayId) {
+  const local = await discoverLocalGateway();
+  if (!local) return void 0;
+  try {
+    if (parseBrowserPairingInvitation(local.invitation).gatewayId !== gatewayId) return void 0;
+    return await pairGateway(local.invitation, () => void 0, new URL(local.gatewayUrl).origin);
+  } catch {
+    return void 0;
+  }
 }
-function openIdentityDatabase() {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(KEY_DATABASE, 1);
-    request.onupgradeneeded = () => request.result.createObjectStore(KEY_STORE);
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error);
+async function refreshStoredProfile(options) {
+  return withRefreshLock(async () => {
+    const profile = await readProfile();
+    if (!profile) throw new Error(t("errorBrowserNotPaired"));
+    if (options?.rejectedAccessToken && profile.accessToken !== options.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
+    if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
+    const gatewayUrls = profile.gatewayUrls?.length ? profile.gatewayUrls : [profile.gatewayUrl];
+    const journal = await refreshJournalFor(profile);
+    try {
+      const tokens = await refreshAccessToken(
+        gatewayUrls,
+        profile.refreshToken,
+        await getOrCreateKeyPair(),
+        profile,
+        journal
+      );
+      const current = await readProfile();
+      assertProfileIdentity(current, profile);
+      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken) {
+        return current;
+      }
+      const next = {
+        ...profile,
+        ...tokens,
+        gatewayUrls: [tokens.gatewayUrl, ...gatewayUrls.filter((candidate) => candidate !== tokens.gatewayUrl)]
+      };
+      await chrome.storage.local.set({ [PROFILE_KEY]: next });
+      await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
+      return next;
+    } catch (cause) {
+      const current = await readProfile();
+      assertProfileIdentity(current, profile);
+      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken && current.accessTokenExpiresAt > Date.now()) return current;
+      if (!isRefreshDenied(cause)) throw cause;
+      const recovered = await recoverLocalProfile(profile.gatewayId);
+      if (recovered) {
+        await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
+        return recovered;
+      }
+      await chrome.storage.local.remove([PROFILE_KEY, REFRESH_JOURNAL_KEY]);
+      throw new Error(t("errorBrowserNotPaired"), { cause });
+    }
   });
 }
-async function storedKeyPair() {
-  const database = await openIdentityDatabase();
+async function getAccessProfile(options) {
+  const profile = await readProfile();
+  if (!profile) throw new Error(t("errorBrowserNotPaired"));
+  if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
+  if (refreshTask) return refreshTask;
+  refreshTask = refreshStoredProfile(options);
   try {
-    return await new Promise((resolve, reject) => {
-      const request = database.transaction(KEY_STORE).objectStore(KEY_STORE).get(KEY_NAME);
-      request.onsuccess = () => resolve(request.result);
-      request.onerror = () => reject(request.error);
-    });
+    return await refreshTask;
   } finally {
-    database.close();
+    refreshTask = void 0;
   }
 }
-async function getOrCreateKeyPair() {
-  const existing = await storedKeyPair();
-  if (existing) return existing;
-  const pair = await crypto.subtle.generateKey(
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign", "verify"]
-  );
-  const database = await openIdentityDatabase();
-  await new Promise((resolve, reject) => {
-    const request = database.transaction(KEY_STORE, "readwrite").objectStore(KEY_STORE).put(pair, KEY_NAME);
-    request.onsuccess = () => resolve();
-    request.onerror = () => reject(request.error);
-  }).finally(() => database.close());
-  return pair;
+async function gatewayFetch(path, init = {}, expectedIdentity) {
+  let profile = await getAccessProfile();
+  const identity = expectedIdentity ?? profile;
+  assertProfileIdentity(profile, identity);
+  const request = () => {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${profile.accessToken}`);
+    return fetch(`${profile.gatewayUrl}${path}`, { ...init, headers });
+  };
+  let response = await request();
+  assertProfileIdentity(await readProfile(), identity);
+  if (response.status !== 401) return response;
+  profile = await getAccessProfile({ rejectedAccessToken: profile.accessToken });
+  assertProfileIdentity(profile, identity);
+  response = await request();
+  assertProfileIdentity(await readProfile(), identity);
+  return response;
 }
-async function forgetIdentity() {
-  await new Promise((resolve, reject) => {
-    const request = indexedDB.deleteDatabase(KEY_DATABASE);
-    request.onsuccess = () => resolve();
-    request.onerror = () => reject(request.error);
-    request.onblocked = () => reject(new Error(t("errorIdentityInUse")));
+async function registerBrowserEndpoint() {
+  const profile = await getAccessProfile();
+  const pair = await getOrCreateKeyPair();
+  const publicKey = encodeBase64Url(new Uint8Array(await crypto.subtle.exportKey("spki", pair.publicKey)));
+  const response = await gatewayFetch("/api/endpoint-tools/principals", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      principalId: profile.deviceId,
+      displayName: "xopc Chrome",
+      kind: "browser",
+      platform: "chrome",
+      publicKey
+    })
   });
+  if (!response.ok) throw new Error(t("errorEndpointRegistration", String(response.status)));
 }
-async function publicKeyJwk(pair) {
-  const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
-  if (!exported.x || !exported.y) throw new Error(t("errorIdentityExport"));
-  return { kty: "EC", crv: "P-256", x: exported.x, y: exported.y };
+async function createBrowserEndpointHello(tools = []) {
+  const profile = await getAccessProfile();
+  const pair = await getOrCreateKeyPair();
+  const unsigned = {
+    principalId: profile.deviceId,
+    endpointId: `browser:${profile.deviceId}`,
+    connectionInstanceId: crypto.randomUUID(),
+    displayName: "xopc Chrome",
+    kind: "browser",
+    platform: "chrome",
+    appVersion: chrome.runtime.getManifest().version,
+    availability: "foreground",
+    nonce: crypto.randomUUID(),
+    signedAt: Date.now(),
+    signature: "pending",
+    tools
+  };
+  return {
+    ...unsigned,
+    signature: await sign(pair, endpointHelloSigningPayload(unsigned))
+  };
 }
-async function sign(pair, text) {
-  const signature = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    pair.privateKey,
-    new TextEncoder().encode(text)
-  );
-  return encodeBase64Url(new Uint8Array(signature));
+async function forgetProfile() {
+  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY, REFRESH_JOURNAL_KEY]);
 }
-async function verifyGateway(publicKey, payload, signature) {
+async function revokeAndForgetProfile() {
   try {
-    const key = await crypto.subtle.importKey(
-      "raw",
-      decodeBase64Url(publicKey),
-      { name: "Ed25519" },
-      false,
-      ["verify"]
-    );
-    return crypto.subtle.verify(
-      { name: "Ed25519" },
-      key,
-      decodeBase64Url(signature),
-      new TextEncoder().encode(payload)
-    );
-  } catch {
-    return false;
+    const profile = await getAccessProfile();
+    await fetch(`${profile.gatewayUrl}/api/devices/me`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${profile.accessToken}` }
+    });
+  } finally {
+    await forgetProfile();
+    try {
+      await clearBrowserChatState();
+    } finally {
+      try {
+        await forgetIdentity();
+      } finally {
+        await setAutoConnectEnabled(false);
+      }
+    }
   }
 }
-function requestGatewayOriginPermissions(origins) {
-  const patterns = origins.filter((origin) => {
-    const url = new URL(origin);
-    return !(url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname));
-  }).map((origin) => `${new URL(origin).origin}/*`);
-  if (!patterns.length) return Promise.resolve(true);
-  return chrome.permissions.request({ origins: patterns });
+
+const REALTIME_PROTOCOL_VERSION = 2;
+const REALTIME_MAX_CLIENT_FRAME_BYTES = 256 * 1024;
+const REALTIME_HEARTBEAT_INTERVAL_MS = 15e3;
+const REALTIME_HEARTBEAT_TIMEOUT_MS = 45e3;
+const REALTIME_CAPABILITIES = ["realtime.capability-negotiation.v1"];
+const realtimeClientKindSchema = _enum([
+  "web",
+  "desktop",
+  "mobile",
+  "browser_extension",
+  "tui",
+  "mcp"
+]);
+const realtimeTopicSchema = string().min(1).max(512);
+const realtimeEventNameSchema = string().regex(/^[a-z][a-z0-9_.-]*$/).max(160);
+const messageIdSchema = uuid();
+const timestampSchema = number().int().nonnegative();
+const sequenceSchema = number().int().positive();
+const capabilitySchema = string().min(1).max(160);
+const envelope = (kind, payload) => object({
+  protocolVersion: literal(REALTIME_PROTOCOL_VERSION),
+  messageId: messageIdSchema,
+  kind: literal(kind),
+  sentAt: timestampSchema,
+  payload
+});
+const realtimeSubscriptionSchema = object({
+  topic: realtimeTopicSchema,
+  afterSeq: number().int().nonnegative().optional(),
+  view: literal("compact").optional()
+});
+discriminatedUnion("kind", [
+  envelope("realtime.hello", object({
+    ticket: string().min(32).max(512),
+    clientId: string().min(1).max(160),
+    clientKind: realtimeClientKindSchema,
+    subscriptions: array(realtimeSubscriptionSchema).max(100).default([]),
+    capabilities: array(capabilitySchema).max(64).optional(),
+    endpoint: endpointHelloPayloadSchema.optional()
+  })),
+  envelope("realtime.subscribe", object({
+    subscriptions: array(realtimeSubscriptionSchema).min(1).max(100)
+  })),
+  envelope("realtime.unsubscribe", object({
+    topics: array(realtimeTopicSchema).min(1).max(100)
+  })),
+  envelope("realtime.ping", object({})),
+  envelope("endpoint.message", clientEndpointMessageSchema)
+]);
+const realtimeEventPayloadSchema = object({
+  topic: realtimeTopicSchema,
+  seq: sequenceSchema,
+  event: realtimeEventNameSchema,
+  data: unknown()
+});
+const serverRealtimeMessageSchema = discriminatedUnion("kind", [
+  envelope("realtime.ready", object({
+    connectionId: uuid(),
+    heartbeatIntervalMs: literal(REALTIME_HEARTBEAT_INTERVAL_MS),
+    heartbeatTimeoutMs: literal(REALTIME_HEARTBEAT_TIMEOUT_MS),
+    negotiatedCapabilities: array(capabilitySchema).max(64).optional(),
+    endpoint: object({
+      endpointId: string().min(1).max(160),
+      turnToken: string().min(32).max(160)
+    }).optional()
+  })),
+  envelope("realtime.event", realtimeEventPayloadSchema),
+  envelope("realtime.subscribed", object({
+    topic: realtimeTopicSchema,
+    cursor: number().int().nonnegative()
+  })),
+  envelope("realtime.gap", object({
+    topic: realtimeTopicSchema,
+    requestedSeq: number().int().nonnegative(),
+    earliestSeq: sequenceSchema,
+    recoverable: boolean()
+  })),
+  envelope("realtime.pong", object({})),
+  envelope("realtime.error", object({
+    code: string().min(1).max(80),
+    message: string().min(1).max(500)
+  })),
+  envelope("endpoint.message", serverEndpointMessageSchema)
+]);
+function parseServerRealtimeMessage(value) {
+  return serverRealtimeMessageSchema.parse(value);
+}
+
+class RealtimeConnectionError extends Error {
+  constructor(message, retryable) {
+    super(message);
+    this.retryable = retryable;
+    this.name = "RealtimeConnectionError";
+  }
+  retryable;
 }
-async function hasGatewayOriginPermission(origin) {
-  const url = new URL(origin);
-  if (url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname)) return true;
-  return chrome.permissions.contains({ origins: [`${url.origin}/*`] });
+class RealtimeFrameTooLargeError extends Error {
+  constructor(bytes, maxBytes) {
+    super(`Realtime client frame is ${bytes} bytes; maximum is ${maxBytes} bytes`);
+    this.bytes = bytes;
+    this.maxBytes = maxBytes;
+    this.name = "RealtimeFrameTooLargeError";
+  }
+  bytes;
+  maxBytes;
 }
-class GatewayHttpError extends Error {
-  constructor(code, status, serverMessage) {
-    super(code);
-    this.code = code;
-    this.status = status;
-    this.serverMessage = serverMessage;
-    this.name = "GatewayHttpError";
+function frameText(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
+  if (ArrayBuffer.isView(data)) {
+    const bytes = Uint8Array.from(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+    return new TextDecoder().decode(bytes);
   }
-  code;
-  status;
-  serverMessage;
+  throw new Error("Realtime server sent a non-text frame");
 }
-async function post(origin, path, body) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), GATEWAY_REQUEST_TIMEOUT_MS);
-  let response;
-  try {
-    response = await fetch(`${origin}${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-  } catch (cause) {
-    if (controller.signal.aborted) throw new Error(t("errorGatewayTimeout", String(GATEWAY_REQUEST_TIMEOUT_MS / 1e3)));
-    throw cause;
-  } finally {
-    clearTimeout(timeout);
+function isNonRetryableCloseCode(code) {
+  return code === 1009 || code === 4400 || code === 4401 || code === 4409 || code === 4413;
+}
+class RealtimeClient {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  desiredSubscriptions = /* @__PURE__ */ new Map();
+  cursors = /* @__PURE__ */ new Map();
+  socket;
+  reconnectTimer;
+  heartbeatTimer;
+  connectionTimer;
+  ticketAbort;
+  generation = 0;
+  reconnectAttempts = 0;
+  shouldReconnect = false;
+  ready = false;
+  lastServerMessageAt = 0;
+  endpointBinding;
+  reconnectWhenSocketOpens = false;
+  offeredCapabilities = /* @__PURE__ */ new Set();
+  connect() {
+    if (this.shouldReconnect) return;
+    this.shouldReconnect = true;
+    void this.open(false);
+  }
+  disconnect() {
+    this.shouldReconnect = false;
+    this.reconnectWhenSocketOpens = false;
+    this.generation += 1;
+    this.clearTimers();
+    this.ready = false;
+    this.offeredCapabilities.clear();
+    this.endpointBinding?.onDisconnected?.();
+    this.socket?.close(1e3, "Client disconnected");
+    this.socket = void 0;
+    this.options.onStateChange?.("disconnected");
+  }
+  reconnect() {
+    this.reconnectWhenSocketOpens = false;
+    this.generation += 1;
+    this.clearTimers();
+    this.ready = false;
+    this.endpointBinding?.onDisconnected?.();
+    this.socket?.close(1e3, "Client reconnecting");
+    this.socket = void 0;
+    this.reconnectAttempts = 0;
+    this.shouldReconnect = true;
+    void this.open(true);
+  }
+  subscribe(topic, afterSeq) {
+    this.desiredSubscriptions.set(topic, afterSeq);
+    if (afterSeq !== void 0) this.cursors.set(topic, afterSeq);
+    if (this.ready) {
+      this.sendSubscriptions([{ topic, afterSeq: this.cursors.get(topic) ?? afterSeq }]);
+    }
   }
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    throw new GatewayHttpError(
-      json.error?.code ?? json.error?.message ?? t("errorGatewayStatus", String(response.status)),
-      response.status,
-      json.error?.message
-    );
+  unsubscribe(topic) {
+    this.desiredSubscriptions.delete(topic);
+    if (this.ready) this.send(this.clientMessage("realtime.unsubscribe", { topics: [topic] }));
   }
-  return json;
-}
-async function signedPairingRequest(pair, payload, origin, requestId, action, completion) {
-  const nonce = randomNonce();
-  const body = {
-    gatewayId: payload.gatewayId,
-    requestId,
-    pairingToken: payload.pairingToken,
-    timestamp: Date.now(),
-    nonce,
-    ...action === "request" ? {
-      device: {
-        displayName: `Chrome · ${navigator.platform || "Browser"}`,
-        platform: "chrome",
-        extensionId: chrome.runtime.id,
-        publicKeyJwk: await publicKeyJwk(pair)
-      }
-    } : {},
-    ...action === "complete" ? completion : {}
-  };
-  const signature = await sign(pair, buildDevicePairingProof(action, body));
-  const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/${requestId}/${action}`;
-  const response = await post(origin, path, { ...body, signature });
-  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string") {
-    throw new Error(t("errorUnsignedPairing"));
+  sendEndpointMessage(message) {
+    if (!this.ready) throw new Error("Realtime connection is not ready");
+    this.send(this.clientMessage("endpoint.message", message));
   }
-  if (!await verifyGateway(payload.gatewayPublicKey, response.signedPayload, response.signature)) {
-    throw new Error(t("errorGatewayVerification"));
+  setEndpoint(binding) {
+    this.endpointBinding = binding;
+    this.refreshEndpointConnection();
   }
-  const decoded = decodeJson(response.signedPayload);
-  if (decoded.gateway.id !== payload.gatewayId || decoded.nonce !== nonce || decoded.request.requestId !== requestId) {
-    throw new Error(t("errorPairingMismatch"));
+  clearEndpoint(binding) {
+    if (binding && this.endpointBinding !== binding) return;
+    const previous = this.endpointBinding;
+    this.endpointBinding = void 0;
+    previous?.onDisconnected?.();
+    this.refreshEndpointConnection();
   }
-  return decoded;
-}
-function shouldTryNextRoute(cause) {
-  return !(cause instanceof GatewayHttpError) || isRetryableDevicePairingHttpStatus(cause.status);
-}
-function isRouteFailure(cause) {
-  if (cause instanceof GatewayHttpError) return isRetryableDevicePairingHttpStatus(cause.status);
-  const message = cause instanceof Error ? cause.message : String(cause);
-  return /network|fetch|respond|identity|route/i.test(message);
-}
-async function signedPairingRequestAcrossRoutes(pair, payload, origins, requestId, action, completion) {
-  let lastRouteError;
-  for (const origin of origins) {
-    try {
-      return { origin, result: await signedPairingRequest(pair, payload, origin, requestId, action, completion) };
-    } catch (cause) {
-      if (!shouldTryNextRoute(cause)) throw cause;
-      lastRouteError = cause;
+  refreshEndpointConnection() {
+    if (!this.shouldReconnect) return;
+    if (this.socket?.readyState === 0) {
+      this.reconnectWhenSocketOpens = true;
+      return;
     }
+    this.reconnect();
   }
-  throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
-}
-async function refreshAccessToken(gatewayUrls, refreshToken, pair, gateway, operation = {
-  requestId: crypto.randomUUID(),
-  nextRefreshToken: createRefreshToken()
-}) {
-  const { nextRefreshToken, requestId } = operation;
-  const timestamp = Date.now();
-  const nonce = randomNonce();
-  const credentialId = refreshToken.slice("xopc_rt_".length).split("_")[0];
-  const proof = `xopc-device-refresh-v2
-${credentialId}
-${timestamp}
-${nonce}
-${requestId}
-${nextRefreshToken}`;
-  const signature = await sign(pair, proof);
-  const body = {
-    refreshToken,
-    nextRefreshToken,
-    requestId,
-    timestamp,
-    nonce,
-    signature
-  };
-  let gatewayUrl;
-  let response;
-  let lastRouteError;
-  for (const origin of gatewayUrls) {
+  async open(reconnecting) {
+    const generation = ++this.generation;
+    const timeoutMs = this.options.connectionTimeoutMs ?? 15e3;
+    const ticketAbort = new AbortController();
+    this.ticketAbort?.abort();
+    this.ticketAbort = ticketAbort;
+    let socket;
+    let closed = false;
+    let messageQueue;
+    const failAttempt = (error, retry = true) => {
+      if (closed || generation !== this.generation) return;
+      closed = true;
+      this.clearConnectionTimer();
+      ticketAbort.abort();
+      if (this.ticketAbort === ticketAbort) this.ticketAbort = void 0;
+      this.ready = false;
+      this.offeredCapabilities.clear();
+      this.endpointBinding?.onDisconnected?.();
+      this.clearHeartbeat();
+      if (this.socket === socket) this.socket = void 0;
+      if (socket) {
+        socket.onopen = null;
+        socket.onmessage = null;
+        socket.onerror = null;
+        socket.onclose = null;
+        socket.close(4e3, error.slice(0, 120));
+      }
+      if (this.shouldReconnect && retry) this.scheduleReconnect(error);
+      else if (this.shouldReconnect) {
+        this.shouldReconnect = false;
+        this.options.onStateChange?.("error", error);
+      } else this.options.onStateChange?.("disconnected");
+    };
+    this.connectionTimer = setTimeout(() => failAttempt("Realtime connection timed out"), timeoutMs);
+    this.options.onStateChange?.(reconnecting ? "reconnecting" : "connecting");
     try {
-      response = await post(origin, "/api/device-auth/refresh", body);
-      gatewayUrl = origin;
-      break;
-    } catch (cause) {
-      if (!shouldTryNextRoute(cause)) throw cause;
-      lastRouteError = cause;
+      const [issuedTicket, endpoint] = await Promise.all([
+        this.options.issueTicket(ticketAbort.signal),
+        this.endpointBinding?.createHello()
+      ]);
+      const ticket = issuedTicket.ticket;
+      if (REALTIME_PROTOCOL_VERSION < issuedTicket.realtime.minVersion) {
+        throw new RealtimeConnectionError("CLIENT_UPDATE_REQUIRED", false);
+      }
+      if (REALTIME_PROTOCOL_VERSION > issuedTicket.realtime.maxVersion) {
+        throw new RealtimeConnectionError("GATEWAY_UPDATE_REQUIRED", false);
+      }
+      const capabilities = REALTIME_CAPABILITIES.filter((capability) => issuedTicket.realtime.capabilities.includes(capability));
+      if (closed || !this.shouldReconnect || generation !== this.generation) return;
+      this.offeredCapabilities = new Set(capabilities ?? []);
+      socket = this.options.createWebSocket(this.options.getWebSocketUrl());
+      this.socket = socket;
+      socket.onopen = () => {
+        if (generation !== this.generation) return;
+        if (this.reconnectWhenSocketOpens) {
+          this.reconnect();
+          return;
+        }
+        const subscriptions = [...this.desiredSubscriptions].map(([topic, afterSeq]) => ({
+          topic,
+          afterSeq: this.cursors.get(topic) ?? afterSeq
+        }));
+        this.send(this.clientMessage("realtime.hello", {
+          ticket,
+          clientId: this.options.clientId,
+          clientKind: this.options.clientKind,
+          subscriptions,
+          ...capabilities?.length ? { capabilities } : {},
+          ...endpoint ? { endpoint } : {}
+        }));
+      };
+      socket.onmessage = (event) => {
+        if (generation !== this.generation) return;
+        const process = () => {
+          if (closed || generation !== this.generation) return;
+          return this.handleServerMessage(frameText(event.data));
+        };
+        if (!messageQueue) {
+          try {
+            const pending = process();
+            if (!pending) return;
+            const current2 = pending.catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
+            messageQueue = current2;
+            void current2.finally(() => {
+              if (messageQueue === current2) messageQueue = void 0;
+            });
+          } catch (error) {
+            failAttempt(error instanceof Error ? error.message : "Invalid realtime server message");
+          }
+          return;
+        }
+        const current = messageQueue.then(process).catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
+        messageQueue = current;
+        void current.finally(() => {
+          if (messageQueue === current) messageQueue = void 0;
+        });
+      };
+      socket.onerror = () => {
+      };
+      socket.onclose = (event) => {
+        failAttempt(
+          event.reason || `WebSocket closed (${event.code ?? 0})`,
+          !isNonRetryableCloseCode(event.code)
+        );
+      };
+    } catch (error) {
+      failAttempt(
+        error instanceof Error ? error.message : "Realtime connection failed",
+        !(error instanceof RealtimeConnectionError) || error.retryable
+      );
+    }
+  }
+  handleServerMessage(text) {
+    const message = parseServerRealtimeMessage(JSON.parse(text));
+    this.lastServerMessageAt = Date.now();
+    if (message.kind === "realtime.ready") {
+      const negotiated = message.payload.negotiatedCapabilities ?? [];
+      if (negotiated.some((capability) => !this.offeredCapabilities.has(capability))) {
+        throw new Error("Realtime server negotiated a capability the client did not offer");
+      }
+      this.ready = true;
+      this.reconnectAttempts = 0;
+      this.clearConnectionTimer();
+      this.ticketAbort = void 0;
+      this.options.onStateChange?.("connected");
+      this.options.onCapabilities?.(negotiated);
+      if (message.payload.endpoint) this.endpointBinding?.onReady(message.payload.endpoint);
+      this.clearHeartbeat();
+      this.heartbeatTimer = setInterval(() => {
+        if (!this.ready) return;
+        if (Date.now() - this.lastServerMessageAt >= message.payload.heartbeatTimeoutMs) {
+          this.reconnect();
+          return;
+        }
+        this.send(this.clientMessage("realtime.ping", {}));
+      }, message.payload.heartbeatIntervalMs);
+    } else if (message.kind === "realtime.event") {
+      const cursor = this.cursors.get(message.payload.topic);
+      if (cursor !== void 0 && message.payload.seq <= cursor) return;
+      this.options.onEvent?.(message.payload);
+      this.cursors.set(message.payload.topic, message.payload.seq);
+    } else if (message.kind === "realtime.subscribed") {
+      this.cursors.set(message.payload.topic, message.payload.cursor);
+      this.options.onSubscribed?.(message.payload);
+    } else if (message.kind === "realtime.gap") {
+      this.cursors.set(message.payload.topic, message.payload.earliestSeq - 1);
+      return this.options.onGap?.(message.payload);
+    } else if (message.kind === "realtime.error") {
+      this.options.onStateChange?.("error", message.payload.message);
+    } else if (message.kind === "endpoint.message") {
+      this.endpointBinding?.onMessage(message.payload);
+      this.options.onEndpointMessage?.(message.payload);
     }
   }
-  if (!response || !gatewayUrl) {
-    throw lastRouteError instanceof Error ? lastRouteError : new Error(t("errorNoReachableGatewayRoute"));
-  }
-  if (typeof response.signedPayload !== "string" || typeof response.signature !== "string" || !await verifyGateway(gateway.gatewayPublicKey, response.signedPayload, response.signature)) throw new Error(t("errorGatewayVerification"));
-  const responseProof = decodeJson(response.signedPayload);
-  if (responseProof.purpose !== "device-refresh-v3" || responseProof.gatewayId !== gateway.gatewayId || responseProof.requestId !== requestId || responseProof.nonce !== nonce || !(responseProof.expiresAt > Date.now()) || responseProof.expiresAt > Date.now() + 6e4) throw new Error("Gateway refresh response does not match this request");
-  const payload = responseProof.tokens;
-  if (!payload?.accessToken || !payload.accessTokenExpiresAt || payload.refreshToken !== nextRefreshToken) {
-    throw new Error(t("errorInvalidCredentials"));
-  }
-  return { ...payload, gatewayUrl };
-}
-function wait(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-async function pairGateway(invitation, onApproval, requestedOrigin) {
-  const payload = parseBrowserPairingInvitation(invitation, true);
-  const origins = [...new Set(payload.routes.map((route) => new URL(route.url).origin))];
-  const selectedOrigin = requestedOrigin && origins.includes(requestedOrigin) ? requestedOrigin : origins[0];
-  const permissionTask = requestGatewayOriginPermissions([selectedOrigin]);
-  if (!await permissionTask) throw new Error("Gateway site permission was not granted");
-  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
-    origin,
-    permitted: await hasGatewayOriginPermission(origin)
-  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
-  const pair = await getOrCreateKeyPair();
-  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
-  let journal = stored[PAIRING_JOURNAL_KEY];
-  if (journal && journal.payload.pairingToken !== payload.pairingToken) {
-    throw new Error("PAIRING_ALREADY_PENDING");
+  sendSubscriptions(subscriptions) {
+    this.send(this.clientMessage("realtime.subscribe", { subscriptions }));
   }
-  if (!journal) {
-    if (payload.expiresAt <= Date.now()) throw new Error(t("errorExpiredPairingLink"));
-    journal = {
-      invitation: invitation.trim(),
-      payload,
-      requestId: crypto.randomUUID(),
-      idempotencyKey: crypto.randomUUID(),
-      initialRefreshToken: createRefreshToken()
+  clientMessage(kind, payload) {
+    const messageId = this.options.createMessageId?.() ?? globalThis.crypto?.randomUUID?.();
+    if (!messageId) throw new Error("RealtimeClient requires createMessageId when crypto.randomUUID is unavailable");
+    return {
+      protocolVersion: REALTIME_PROTOCOL_VERSION,
+      messageId,
+      kind,
+      sentAt: Date.now(),
+      payload
     };
-    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
   }
-  delete journal.nextOrigin;
-  await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
-  const requestId = journal.requestId;
-  const availableOrigins = journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : [selectedOrigin, ...permittedOrigins.filter((candidate) => candidate !== selectedOrigin)];
-  try {
-    let { origin, result } = await signedPairingRequestAcrossRoutes(
-      pair,
-      journal.payload,
-      availableOrigins,
-      requestId,
-      "request"
-    );
-    journal.origin = origin;
-    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
-    if (result.request.status === "pending") onApproval(result.request.confirmationCode);
-    while (result.request.status === "pending") {
-      await wait(1500);
-      const response = await signedPairingRequestAcrossRoutes(
-        pair,
-        journal.payload,
-        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
-        requestId,
-        "status"
-      );
-      ({ origin, result } = response);
-      journal.origin = origin;
-      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
-    }
-    if (result.request.status !== "approved" && result.request.status !== "completed") {
-      await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
-      throw new Error(t("errorPairingStatus", result.request.status));
-    }
-    if (result.request.status !== "completed") {
-      const response = await signedPairingRequestAcrossRoutes(
-        pair,
-        journal.payload,
-        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
-        requestId,
-        "complete",
-        {
-          idempotencyKey: journal.idempotencyKey,
-          initialRefreshToken: journal.initialRefreshToken
-        }
-      );
-      ({ origin, result } = response);
+  send(message) {
+    if (!this.socket || this.socket.readyState !== 1) return;
+    const data = JSON.stringify(message);
+    const bytes = new TextEncoder().encode(data).byteLength;
+    if (bytes > REALTIME_MAX_CLIENT_FRAME_BYTES) {
+      throw new RealtimeFrameTooLargeError(bytes, REALTIME_MAX_CLIENT_FRAME_BYTES);
     }
-    if (!result.request.deviceId) throw new Error(t("errorBrowserNotRegistered"));
-    journal.origin = origin;
-    journal.completed = { deviceId: result.request.deviceId, gatewayName: result.gateway.name };
-    journal.refresh ??= { requestId: crypto.randomUUID(), nextRefreshToken: createRefreshToken() };
-    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
-    const orderedOrigins = [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)];
-    const tokens = await refreshAccessToken(
-      orderedOrigins,
-      journal.initialRefreshToken,
-      pair,
-      journal.payload,
-      journal.refresh
-    );
-    const profile = {
-      gatewayId: journal.payload.gatewayId,
-      gatewayName: journal.completed.gatewayName,
-      gatewayUrl: tokens.gatewayUrl,
-      gatewayUrls: [tokens.gatewayUrl, ...orderedOrigins.filter((candidate) => candidate !== tokens.gatewayUrl)],
-      gatewayPublicKey: journal.payload.gatewayPublicKey,
-      deviceId: journal.completed.deviceId,
-      refreshToken: tokens.refreshToken,
-      accessToken: tokens.accessToken,
-      accessTokenExpiresAt: tokens.accessTokenExpiresAt
-    };
-    await chrome.storage.local.set({ [PROFILE_KEY]: profile });
-    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
-    return profile;
-  } catch (cause) {
-    const nextOrigin = origins.find((origin) => !permittedOrigins.includes(origin));
-    if (nextOrigin && isRouteFailure(cause)) {
-      journal.nextOrigin = nextOrigin;
-      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
-      throw new Error(`PAIRING_ROUTE_PERMISSION_REQUIRED:${nextOrigin}`);
+    this.socket.send(data);
+  }
+  scheduleReconnect(error) {
+    if (!this.shouldReconnect) return;
+    this.reconnectAttempts += 1;
+    const max = this.options.maxReconnectAttempts;
+    if (max !== void 0 && this.reconnectAttempts > max) {
+      this.shouldReconnect = false;
+      this.options.onStateChange?.("error", error);
+      return;
     }
-    throw cause;
+    this.options.onStateChange?.("reconnecting", error);
+    const cap = Math.min(3e4, 1e3 * 2 ** Math.min(this.reconnectAttempts - 1, 5));
+    const delay = Math.round(cap * (0.5 + Math.random() * 0.5));
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = void 0;
+      void this.open(true);
+    }, delay);
   }
-}
-async function readPendingBrowserPairing() {
-  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
-  const journal = stored[PAIRING_JOURNAL_KEY];
-  return journal ? { invitation: journal.invitation, ...journal.nextOrigin ? { nextOrigin: journal.nextOrigin } : {} } : void 0;
-}
-async function cancelPendingBrowserPairing() {
-  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
-  const journal = stored[PAIRING_JOURNAL_KEY];
-  if (!journal) return;
-  const origins = [...new Set(journal.payload.routes.map((route) => new URL(route.url).origin))];
-  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
-    origin,
-    permitted: await hasGatewayOriginPermission(origin)
-  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
-  try {
-    await signedPairingRequestAcrossRoutes(
-      await getOrCreateKeyPair(),
-      journal.payload,
-      journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : permittedOrigins,
-      journal.requestId,
-      "cancel"
-    );
-  } catch (cause) {
-    if (!(cause instanceof GatewayHttpError) || !["PAIRING_NOT_FOUND", "PAIRING_EXPIRED", "PAIRING_CANCELLED"].includes(cause.message)) throw cause;
+  clearHeartbeat() {
+    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
+    this.heartbeatTimer = void 0;
   }
-  await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
-}
-async function readProfile() {
-  const stored = await chrome.storage.local.get([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
-  const profile = stored[PROFILE_KEY];
-  if (!profile?.gatewayId || !profile.gatewayUrl || !profile.refreshToken) return void 0;
-  const pairing = stored[PAIRING_JOURNAL_KEY];
-  if (pairing?.payload?.gatewayId === profile.gatewayId && pairing.completed?.deviceId === profile.deviceId) {
-    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  clearTimers() {
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = void 0;
+    this.clearConnectionTimer();
+    this.ticketAbort?.abort();
+    this.ticketAbort = void 0;
+    this.clearHeartbeat();
+  }
+  clearConnectionTimer() {
+    if (this.connectionTimer) clearTimeout(this.connectionTimer);
+    this.connectionTimer = void 0;
   }
-  return profile;
-}
-function withRefreshLock(operation) {
-  const locks = globalThis.navigator?.locks;
-  if (!locks) return operation();
-  return new Promise((resolve, reject) => {
-    void locks.request(REFRESH_LOCK_NAME, () => operation().then(resolve, reject)).catch(reject);
-  });
-}
-function isRefreshDenied(cause) {
-  return cause instanceof GatewayHttpError && cause.status === 401 && cause.code === "REFRESH_DENIED";
 }
-async function refreshJournalFor(profile) {
-  const stored = await chrome.storage.local.get(REFRESH_JOURNAL_KEY);
-  const journal = stored[REFRESH_JOURNAL_KEY];
-  if (journal?.gatewayId === profile.gatewayId && journal.refreshToken === profile.refreshToken) return journal;
-  const next = {
-    gatewayId: profile.gatewayId,
-    refreshToken: profile.refreshToken,
-    requestId: crypto.randomUUID(),
-    nextRefreshToken: createRefreshToken()
+
+const PENDING_CONTEXT_KEY = "xopc.browser.pending-context";
+const TAB_BINDING_PREFIX = "xopc.browser.tab-binding.";
+async function buildPageContext(raw, pageUrl) {
+  const url = sanitizedUrl(pageUrl);
+  const selected = raw.selection ? truncateUtf8(raw.selection, MAX_BROWSER_SELECTION_BYTES) : void 0;
+  const page = raw.text ? truncateUtf8(raw.text, MAX_BROWSER_PAGE_TEXT_BYTES) : void 0;
+  const canonical = {
+    title: raw.title.trim() || new URL(url).hostname,
+    url,
+    capturedAt: Date.now(),
+    documentId: await sha256(`${url}
+${raw.timeOrigin}`),
+    selection: selected?.value,
+    text: page?.value
   };
-  await chrome.storage.local.set({ [REFRESH_JOURNAL_KEY]: next });
-  return next;
+  return {
+    kind: "browser_page",
+    sourceId: crypto.randomUUID(),
+    version: await sha256(JSON.stringify(canonical)),
+    ...canonical,
+    truncated: selected?.truncated === true || page?.truncated === true
+  };
+}
+function truncateUtf8(value, maxBytes) {
+  const encoder = new TextEncoder();
+  if (encoder.encode(value).byteLength <= maxBytes) return { value, truncated: false };
+  let low = 0;
+  let high = value.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (encoder.encode(value.slice(0, middle)).byteLength <= maxBytes) low = middle;
+    else high = middle - 1;
+  }
+  return { value: value.slice(0, low), truncated: true };
 }
-async function recoverLocalProfile(gatewayId) {
-  const local = await discoverLocalGateway();
-  if (!local) return void 0;
+function sanitizedUrl(raw) {
+  let url;
   try {
-    if (parseBrowserPairingInvitation(local.invitation).gatewayId !== gatewayId) return void 0;
-    return await pairGateway(local.invitation, () => void 0, new URL(local.gatewayUrl).origin);
+    url = new URL(raw);
   } catch {
-    return void 0;
+    throw new Error(t("errorInvalidWebAddress"));
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(t("errorRestrictedPage"));
+  }
+  if (url.hostname === "chromewebstore.google.com" || url.hostname === "chrome.google.com" && url.pathname.startsWith("/webstore")) {
+    throw new Error(t("errorWebStorePage"));
   }
+  url.username = "";
+  url.password = "";
+  url.hash = "";
+  return url.toString();
 }
-async function refreshStoredProfile(options) {
-  return withRefreshLock(async () => {
-    const profile = await readProfile();
-    if (!profile) throw new Error(t("errorBrowserNotPaired"));
-    if (options?.rejectedAccessToken && profile.accessToken !== options.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
-    if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
-    const gatewayUrls = profile.gatewayUrls?.length ? profile.gatewayUrls : [profile.gatewayUrl];
-    const journal = await refreshJournalFor(profile);
-    try {
-      const tokens = await refreshAccessToken(
-        gatewayUrls,
-        profile.refreshToken,
-        await getOrCreateKeyPair(),
-        profile,
-        journal
-      );
-      const current = await readProfile();
-      assertProfileIdentity(current, profile);
-      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken) {
-        return current;
-      }
-      const next = {
-        ...profile,
-        ...tokens,
-        gatewayUrls: [tokens.gatewayUrl, ...gatewayUrls.filter((candidate) => candidate !== tokens.gatewayUrl)]
-      };
-      await chrome.storage.local.set({ [PROFILE_KEY]: next });
-      await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
-      return next;
-    } catch (cause) {
-      const current = await readProfile();
-      assertProfileIdentity(current, profile);
-      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken && current.accessTokenExpiresAt > Date.now()) return current;
-      if (!isRefreshDenied(cause)) throw cause;
-      const recovered = await recoverLocalProfile(profile.gatewayId);
-      if (recovered) {
-        await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
-        return recovered;
-      }
-      await chrome.storage.local.remove([PROFILE_KEY, REFRESH_JOURNAL_KEY]);
-      throw new Error(t("errorBrowserNotPaired"), { cause });
-    }
-  });
+function siteAccessError(cause, url) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  const hostname = new URL(url).hostname;
+  if (/cannot access|cannot be scripted|missing host permission|extensions gallery|chrome web store/i.test(message)) {
+    return new Error(t("errorSiteAccessBlocked", hostname));
+  }
+  return cause instanceof Error ? cause : new Error(message);
 }
-async function getAccessProfile(options) {
-  const profile = await readProfile();
-  if (!profile) throw new Error(t("errorBrowserNotPaired"));
-  if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
-  if (refreshTask) return refreshTask;
-  refreshTask = refreshStoredProfile(options);
+async function runWithTabSiteAccess(tabId, operation) {
+  const tab = await chrome.tabs.get(tabId);
+  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) {
+    throw new Error(t("errorTabUnavailable"));
+  }
+  const url = sanitizedUrl(tab.url);
   try {
-    return await refreshTask;
-  } finally {
-    refreshTask = void 0;
+    return await operation({ ...tab, id: tab.id, windowId: tab.windowId, url });
+  } catch (cause) {
+    throw siteAccessError(cause, url);
   }
 }
-async function gatewayFetch(path, init = {}, expectedIdentity) {
-  let profile = await getAccessProfile();
-  const identity = expectedIdentity ?? profile;
-  assertProfileIdentity(profile, identity);
-  const request = () => {
-    const headers = new Headers(init.headers);
-    headers.set("Authorization", `Bearer ${profile.accessToken}`);
-    return fetch(`${profile.gatewayUrl}${path}`, { ...init, headers });
-  };
-  let response = await request();
-  assertProfileIdentity(await readProfile(), identity);
-  if (response.status !== 401) return response;
-  profile = await getAccessProfile({ rejectedAccessToken: profile.accessToken });
-  assertProfileIdentity(profile, identity);
-  response = await request();
-  assertProfileIdentity(await readProfile(), identity);
-  return response;
+async function sha256(value) {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-async function registerBrowserEndpoint() {
-  const profile = await getAccessProfile();
-  const pair = await getOrCreateKeyPair();
-  const publicKey = encodeBase64Url(new Uint8Array(await crypto.subtle.exportKey("spki", pair.publicKey)));
-  const response = await gatewayFetch("/api/endpoint-tools/principals", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      principalId: profile.deviceId,
-      displayName: "xopc Chrome",
-      kind: "browser",
-      platform: "chrome",
-      publicKey
-    })
+function extractPage(mode) {
+  const normalize = (value) => value.replace(/\s+/g, " ").trim();
+  if (mode === "selection") {
+    const focused = document.activeElement;
+    const fieldSelection = focused instanceof HTMLTextAreaElement || focused instanceof HTMLInputElement && ["text", "search", "url", "email", "tel"].includes(focused.type) ? focused.value.slice(focused.selectionStart ?? 0, focused.selectionEnd ?? 0) : "";
+    const selection = normalize(fieldSelection || window.getSelection()?.toString() || "");
+    return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, selection };
+  }
+  const source = document.querySelector("article, main") ?? document.body;
+  if (!source) return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin };
+  const clone = source.cloneNode(true);
+  clone.querySelectorAll([
+    "script",
+    "style",
+    "noscript",
+    "template",
+    "iframe",
+    "svg",
+    "canvas",
+    "video",
+    "audio",
+    "nav",
+    "aside",
+    "header",
+    "footer",
+    "form",
+    "[hidden]",
+    '[aria-hidden="true"]',
+    "[inert]"
+  ].join(",")).forEach((element) => element.remove());
+  const text = normalize(clone.innerText || clone.textContent || "");
+  return { title: document.title, url: location.href, timeOrigin: performance.timeOrigin, text };
+}
+async function captureContextMenuSelection(tabId, selectionText, pageUrl) {
+  const tab = await chrome.tabs.get(tabId);
+  if (!tab.url) throw new Error(t("errorTabUnavailable"));
+  const url = sanitizedUrl(tab.url);
+  if (pageUrl && sanitizedUrl(pageUrl) !== url) throw new Error(t("errorPageChangedReading"));
+  const selection = selectionText.replace(/\s+/g, " ").trim();
+  if (!selection) throw new Error(t("errorSelectText"));
+  return buildPageContext({ title: tab.title ?? "", timeOrigin: Date.now(), selection }, url);
+}
+async function captureTabPage(tabId, mode) {
+  const tab = await chrome.tabs.get(tabId);
+  if (!tab.url) throw new Error(t("errorTabUnavailable"));
+  sanitizedUrl(tab.url);
+  const result = await chrome.scripting.executeScript({
+    target: { tabId, allFrames: true },
+    func: extractPage,
+    args: [mode]
   });
-  if (!response.ok) throw new Error(t("errorEndpointRegistration", String(response.status)));
+  const main = result[0]?.result;
+  if (!main) throw new Error(t("errorReadPage"));
+  const currentTab = await chrome.tabs.get(tabId);
+  if (!currentTab.url || sanitizedUrl(main.url) !== sanitizedUrl(tab.url) || sanitizedUrl(main.url) !== sanitizedUrl(currentTab.url)) {
+    throw new Error(t("errorPageChangedReading"));
+  }
+  const content = result.map((item) => item.result).find((item) => mode === "selection" ? item?.selection : item?.text);
+  if (!content?.selection && !content?.text) {
+    throw new Error(t(mode === "selection" ? "errorSelectText" : "errorNoReadableContent"));
+  }
+  return buildPageContext({ ...main, selection: content.selection, text: content.text }, main.url);
 }
-async function createBrowserEndpointHello(tools = []) {
-  const profile = await getAccessProfile();
-  const pair = await getOrCreateKeyPair();
-  const unsigned = {
-    principalId: profile.deviceId,
-    endpointId: `browser:${profile.deviceId}`,
-    connectionInstanceId: crypto.randomUUID(),
-    displayName: "xopc Chrome",
-    kind: "browser",
-    platform: "chrome",
-    appVersion: chrome.runtime.getManifest().version,
-    availability: "foreground",
-    nonce: crypto.randomUUID(),
-    signedAt: Date.now(),
-    signature: "pending",
-    tools
-  };
-  return {
-    ...unsigned,
-    signature: await sign(pair, endpointHelloSigningPayload(unsigned))
-  };
+async function captureTabWithPermission(tabId, mode) {
+  return runWithTabSiteAccess(tabId, () => captureTabPage(tabId, mode));
 }
-async function forgetProfile() {
-  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY, REFRESH_JOURNAL_KEY]);
+async function activeTabId() {
+  return (await chrome.tabs.query({ active: true, currentWindow: true }))[0]?.id;
 }
-async function revokeAndForgetProfile() {
-  try {
-    const profile = await getAccessProfile();
-    await fetch(`${profile.gatewayUrl}/api/devices/me`, {
-      method: "DELETE",
-      headers: { Authorization: `Bearer ${profile.accessToken}` }
+async function currentTabDescriptor() {
+  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
+  if (tab.id === void 0 || tab.windowId === void 0 || !tab.url) throw new Error(t("errorNoActivePage"));
+  return runWithTabSiteAccess(tab.id, async (accessibleTab) => {
+    const result = await chrome.scripting.executeScript({
+      target: { tabId: accessibleTab.id },
+      func: () => ({ url: location.href, timeOrigin: performance.timeOrigin })
     });
-  } finally {
-    await forgetProfile();
-    try {
-      await clearBrowserChatState();
-    } finally {
-      try {
-        await forgetIdentity();
-      } finally {
-        await setAutoConnectEnabled(false);
-      }
+    const marker = result[0]?.result;
+    if (!marker) throw new Error(t("errorIdentifyPage"));
+    const currentUrl = sanitizedUrl(marker.url);
+    if (new URL(currentUrl).origin !== new URL(accessibleTab.url).origin) {
+      throw new Error(t("errorPageChangedConnecting"));
     }
-  }
+    return {
+      tabId: String(accessibleTab.id),
+      windowId: String(accessibleTab.windowId),
+      documentId: await sha256(`${currentUrl}
+${marker.timeOrigin}`),
+      urlOrigin: new URL(currentUrl).origin
+    };
+  });
 }
 
 export { revokeAndForgetProfile as A, runWithTabSiteAccess as B, saveExtensionLocalePreference as C, setAutoConnectEnabled as D, ENDPOINT_PROTOCOL_VERSION as E, strictObject as F, string as G, t as H, MAX_BROWSER_CONTEXTS_PER_TURN as M, PENDING_CONTEXT_KEY as P, REALTIME_PROTOCOL_VERSION as R, TAB_BINDING_PREFIX as T, _enum as _, RealtimeClient as a, activeTabId as b, array as c, boolean as d, browserPageContextsInputSchema as e, cancelPendingBrowserPairing as f, canonicalJson as g, captureContextMenuSelection as h, captureTabWithPermission as i, createBrowserEndpointHello as j, currentTabDescriptor as k, discoverLocalGateway as l, discriminatedUnion as m, endpointToolContentSchema as n, extensionLocale as o, gatewayFetch as p, getAccessProfile as q, literal as r, loadExtensionLocalePreference as s, number as t, object as u, openDatabase as v, pairGateway as w, readPendingBrowserPairing as x, readProfile as y, registerBrowserEndpoint as z };