buninu-browser 0.2.2 → 0.2.4

package/test/media-source-webm-accounting.test.js

@@ -0,0 +1,98 @@
+import { expect, test } from "bun:test";
+import { createMediaSourceScope } from "../lib/renderer/media-source.js";
+
+function context(appendQuota = 1000) {
+  const tasks = [];
+  const media = createMediaSourceScope({
+    origin: "https://media.test", DOMException, appendQuota,
+    schedule: task => tasks.push(task),
+  });
+  const flush = () => { while (tasks.length) tasks.shift()(); };
+  const source = new media.MediaSource();
+  source.attach("blob:https://media.test/audio");
+  flush();
+  const buffer = source.addSourceBuffer('audio/webm; codecs="opus"');
+  const append = bytes => { buffer.appendBuffer(bytes); flush(); };
+  return { source, buffer, flush, append };
+}
+
+// One finite Cluster, timecode 0, with a SimpleBlock at 1000 ms.
+const cluster = Uint8Array.from([
+  0x1f, 0x43, 0xb6, 0x75, 0x8a, 0xe7, 0x81, 0x00,
+  0xa3, 0x85, 0x81, 0x03, 0xe8, 0x00, 0x00,
+]);
+const header = Uint8Array.from([0x1a, 0x45, 0xdf, 0xa3, 0x80]);
+
+test("idle abort discards an incomplete WebM element before the next initialization", () => {
+  const { buffer, flush, append } = context();
+  append(cluster.subarray(0, 7));
+  expect(buffer._pipe.size).toBe(0);
+  const events = [];
+  buffer.addEventListener("abort", () => events.push("abort"));
+  buffer.addEventListener("updateend", () => events.push("updateend"));
+  buffer.abort();
+  flush();
+  expect(buffer._accountedBytes).toBe(0);
+  expect(events).toEqual([]);
+  const next = new Uint8Array(Bun.concatArrayBuffers([header, cluster]));
+  append(next);
+  expect(buffer._pipe.bytes()).toEqual(next);
+  expect(buffer.buffered.end(0)).toBeCloseTo(1.02, 5);
+});
+
+test("abort cancels a queued WebM append and clears a previous incomplete element", () => {
+  const { buffer, flush, append } = context();
+  append(cluster.subarray(0, 7));
+  const events = [];
+  buffer.addEventListener("abort", () => events.push("abort"));
+  buffer.addEventListener("updateend", () => events.push("updateend"));
+  buffer.appendBuffer(cluster.subarray(7));
+  buffer.abort();
+  flush();
+  expect(buffer.updating).toBe(false);
+  expect(buffer._accountedBytes).toBe(0);
+  expect(buffer._pipe.size).toBe(0);
+  expect(events).toEqual(["abort", "updateend"]);
+  append(cluster);
+  expect(buffer._pipe.bytes()).toEqual(cluster);
+});
+
+test("a split retry completed after eviction cannot refund another buffer's quota", () => {
+  const { source, buffer, flush, append } = context(100);
+  const other = source.addSourceBuffer('audio/webm; codecs="opus"');
+  // An independent 50-byte Void element reserves the other buffer's quota.
+  const padding = new Uint8Array(50);
+  padding.set([0xec, 0xb0]);
+  other.appendBuffer(padding);
+  flush();
+  append(cluster);
+  append(cluster.subarray(0, 7));
+  buffer.remove(0, 2);
+  flush();
+  append(cluster.subarray(7));
+  expect(buffer._accountedBytes).toBe(0);
+  expect(other._accountedBytes).toBe(50);
+  expect(buffer._pipe.bytes()).toEqual(cluster);
+  expect(() => buffer.appendBuffer(new Uint8Array(51))).toThrow("The SourceBuffer is full.");
+});
+
+test("repeated unknown Clusters retain only the current unused prefix until abort or EOF", () => {
+  for (const finish of ["abort", "endOfStream"]) {
+    const { source, buffer, append } = context();
+    const live = cluster.slice();
+    live[4] = 0xff;
+    append(live);
+    expect(buffer._accountedBytes).toBe(live.length);
+    for (let retry = 0; retry < 3; retry++) {
+      append(live);
+      // The current prefix remains necessary if a later Block is new.
+      expect(buffer._webmStream.pendingSize).toBe(8);
+      expect(buffer._accountedBytes).toBe(live.length + 8);
+      expect(buffer._pipe.bytes()).toEqual(live);
+    }
+    if (finish === "abort") buffer.abort();
+    else source.endOfStream();
+    expect(buffer._webmStream.pendingSize).toBe(0);
+    expect(buffer._accountedBytes).toBe(live.length);
+  }
+});

package/test/media-source-webm.test.js

@@ -0,0 +1,108 @@
+import { beforeAll, expect, test } from 'bun:test';
+import wasmpeg from '../vendor/wasmpeg/src/js/index.js';
+import { floatToS16 } from '../lib/audio/pcm.js';
+import { createMediaSourceScope } from '../lib/renderer/media-source.js';
+import { createWebMStream, ebmlHeader } from '../lib/media/webm-stream.js';
+
+// Self-generated eight-second chirp, 48 kHz mono Opus, 2-second Clusters.
+// Unlike a constant tone, its PCM identifies a repeated earlier segment.
+let fixture, elements;
+beforeAll(async () => {
+  await wasmpeg.load();
+  fixture = new Uint8Array(await Bun.file(new URL('./fixtures/mse-audio-chirp.webm', import.meta.url)).arrayBuffer());
+  elements = createWebMStream().append(fixture);
+});
+function context() {
+  const tasks = [], scope = createMediaSourceScope({ origin: 'https://media.test', schedule: task => tasks.push(task), DOMException });
+  const flush = () => { while (tasks.length) tasks.shift()(); };
+  const source = new scope.MediaSource(); source.attach('blob:https://media.test/audio'); flush();
+  const buffer = source.addSourceBuffer('audio/webm; codecs="opus"');
+  return { source, buffer, append(bytes) { buffer.appendBuffer(bytes); flush(); } };
+}
+const concat = parts => new Uint8Array(Bun.concatArrayBuffers(parts));
+async function pcm(bytes) {
+  const decoder = await wasmpeg.decodeAudio(bytes, { format: 'webm' }), parts = [];
+  try { for (let samples; (samples = decoder.nextSamples());) parts.push(floatToS16(samples)); }
+  finally { decoder.close(); }
+  return concat(parts);
+}
+const cluster = element => element.id === 0x1f43b675;
+
+test('split WebM Clusters, whole retries, and mixed old/new appends preserve exact chronological PCM', async () => {
+  const c = context(), groups = elements.filter(cluster), init = concat(elements.slice(0, elements.indexOf(groups[0])).map(e => e.bytes));
+  expect(groups.length).toBeGreaterThanOrEqual(4);
+  for (let i = 0; i < init.length; i += 7) c.append(init.subarray(i, i + 7));
+  const first = groups[0].bytes;
+  // This was the live failure: a partial first Cluster understated coverage,
+  // and a later whole retry inserted its opening PCM after the second one.
+  for (let i = 0; i < first.length; i += 137) c.append(first.subarray(i, i + 137));
+  c.append(groups[1].bytes);
+  const beforeRetry = c.buffer._pipe.size;
+  c.append(first);
+  expect(c.buffer._pipe.size).toBe(beforeRetry);
+  c.append(concat([groups[0].bytes, groups[2].bytes]));
+  for (const element of elements.slice(elements.indexOf(groups[3]))) c.append(element.bytes);
+  c.source.endOfStream();
+  const actual = await pcm(c.buffer._pipe.bytes()), reference = await pcm(fixture);
+  expect(actual.length).toBe(reference.length);
+  expect(Bun.hash(actual)).toBe(Bun.hash(reference));
+  expect(c.buffer.buffered.end(0)).toBeGreaterThanOrEqual(8);
+  expect(c.buffer.buffered.end(0)).toBeLessThan(8.1);
+  expect(Bun.hash(actual.subarray(0, 48000 * 2))).not.toBe(Bun.hash(actual.subarray(4 * 48000 * 2, 5 * 48000 * 2)));
+});
+
+test('unknown-size live Clusters expose complete Blocks before the next Cluster and deduplicate retried Blocks', async () => {
+  const c = context(), groups = elements.filter(cluster);
+  for (const element of elements.slice(0, elements.indexOf(groups[0]))) c.append(element.bytes);
+  let initialSize = c.buffer._pipe.size;
+  for (const group of groups) {
+    const header = ebmlHeader(group.bytes), idLength = 4;
+    const live = group.bytes.slice();
+    // Preserve the original VINT width while replacing its value with unknown.
+    live[idLength] = (1 << (9 - (header.length - idLength))) - 1;
+    live.fill(0xff, idLength + 1, header.length);
+    for (let i = 0; i < live.length; i += 101) c.append(live.subarray(i, i + 101));
+    expect(c.buffer._pipe.size).toBeGreaterThan(initialSize);
+    initialSize = c.buffer._pipe.size;
+    // The next header closes the previous unknown Cluster. Its old Blocks
+    // must not be played again even though no finite size was available.
+    c.append(live);
+    expect(c.buffer._pipe.size).toBe(initialSize);
+  }
+  c.source.endOfStream();
+  const actual = await pcm(c.buffer._pipe.bytes()), reference = await pcm(fixture);
+  expect(actual.length).toBe(reference.length);
+  expect(Bun.hash(actual)).toBe(Bun.hash(reference));
+});
+
+test('EBML framing never treats packet payload bytes as Cluster boundaries', () => {
+  const stream = createWebMStream();
+  const bytes = Uint8Array.from([
+    0x1f, 0x43, 0xb6, 0x75, 0xff, // unknown Cluster
+    0xe7, 0x81, 0,
+    0xa3, 0x89, 0x81, 0, 0, 0, 0x1f, 0x43, 0xb6, 0x75, 0,
+  ]);
+  const emitted = [];
+  for (const byte of bytes) emitted.push(...stream.append(Uint8Array.of(byte)));
+  expect(emitted.length).toBe(1);
+  expect(emitted[0].cluster.time).toBe(0);
+  expect([...emitted[0].bytes]).toEqual([...bytes.subarray(8)]);
+  // The standalone framer still owns the prefix until a consumer accepts
+  // the Block (SourceBuffer records that on the shared cluster token).
+  expect(stream.pendingSize).toBe(8);
+  stream.reset();
+  expect(stream.pendingSize).toBe(0);
+});
+
+test('incremental muxed Clusters retain different tracks at the same presentation time', () => {
+  const c = context();
+  const bytes = Uint8Array.from([
+    0x1f, 0x43, 0xb6, 0x75, 0xff, 0xe7, 0x81, 0,
+    0xa3, 0x85, 0x81, 0, 0, 0, 1,
+    0xa3, 0x85, 0x82, 0, 0, 0, 2,
+  ]);
+  c.append(bytes);
+  expect([...c.buffer._pipe.bytes()]).toEqual([...bytes]);
+  c.append(bytes);
+  expect([...c.buffer._pipe.bytes()]).toEqual([...bytes]);
+});

package/test/navigation.test.js

@@ -58,4 +58,5 @@ test("a redirected document has the URL it ended on, and its POST form submits t
   }]);
   // The 303 after it was followed with a GET, and the document is at its URL.
   expect(await context.evaluate("location.href")).toBe(`${origin}/done`);
+  expect(await context.evaluate("document.referrer")).toBe(`${origin}/dir/form?step=1`);
 });

package/test/network-service.test.js

@@ -53,6 +53,142 @@ afterAll(() => server?.stop(true));
 const local = (path) => `http://localhost:${server.port}${path}`;
 const loopback = (path) => `http://127.0.0.1:${server.port}${path}`;
 
+test("navigation metadata distinguishes browser UI from page-initiated navigation", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    calls.push({ url, headers: new Headers(init.headers) });
+    return url.endsWith("/start") ? new Response(null, { status: 302, headers: { location: "https://other.test/end" } })
+      : new Response("ok");
+  } });
+  await network.navigate("https://example.test/start");
+  for (const { headers } of calls) {
+    expect(headers.get("sec-fetch-mode")).toBe("navigate");
+    expect(headers.get("sec-fetch-dest")).toBe("document");
+    expect(headers.get("sec-fetch-site")).toBe("none");
+    expect(headers.has("sec-fetch-user")).toBeFalse();
+  }
+  calls.length = 0;
+  await network.navigate("https://example.test/end", { referrer: "https://example.test/page#section" });
+  expect(calls[0].headers.get("sec-fetch-site")).toBe("same-origin");
+  expect(calls[0].headers.get("referer")).toBe("https://example.test/page");
+  await network.navigate("https://example.test:8443/end", { referrer: "https://example.test/page" });
+  expect(calls[1].headers.get("sec-fetch-site")).toBe("same-site");
+  expect(calls[1].headers.get("referer")).toBe("https://example.test/");
+});
+
+test("resource destinations are separated while referrer-independent cache entries survive navigation", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers);
+    calls.push(headers);
+    return new Response(headers.get("sec-fetch-dest"), { headers: { "cache-control": "max-age=60" } });
+  } });
+  await network.subresource("https://example.test/asset", "https://example.test/page", "script");
+  await network.subresource("https://example.test/asset", "https://example.test/page", "image");
+  await network.subresource("https://example.test/asset", "https://example.test/other", "image");
+  await network.subresource("https://example.test/asset", "https://example.test/other", "image");
+  expect(calls).toHaveLength(2);
+  expect(calls.map(headers => headers.get("sec-fetch-dest"))).toEqual(["script", "image"]);
+  expect(calls[0].get("sec-fetch-mode")).toBe("no-cors");
+  expect(calls[1].get("referer")).toBe("https://example.test/page");
+});
+
+test("Vary: Referer isolates representations and validators across documents", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers); calls.push(headers);
+    return new Response(headers.get("referer"), { headers: { "cache-control": "max-age=60", vary: "Referer", etag: '"page"' } });
+  } });
+  await network.subresource("https://example.test/image", "https://example.test/one", "image");
+  const other = await network.subresource("https://example.test/image", "https://example.test/two", "image");
+  await network.subresource("https://example.test/image", "https://example.test/two", "image");
+  expect(calls).toHaveLength(2);
+  expect(calls[1].has("if-none-match")).toBeFalse();
+  expect(new TextDecoder().decode(other.body)).toBe("https://example.test/two");
+});
+
+test("a cacheable final body does not cache a credential-dependent redirect", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    calls.push(url);
+    if (url.endsWith('/entry')) return new Response(null, { status:302, headers:{location:'https://asset.test/final', 'cache-control':'no-store'} });
+    return new Response(new Headers(init.headers).get('cookie') ?? 'anonymous', { headers:{'cache-control':'max-age=60'} });
+  }});
+  expect(new TextDecoder().decode((await network.subresource('https://page.test/entry','https://page.test/')).body)).toBe('anonymous');
+  network.setDocumentCookie('https://asset.test/','session=changed; SameSite=None; Secure');
+  expect(new TextDecoder().decode((await network.subresource('https://page.test/entry','https://page.test/')).body)).toBe('session=changed');
+  expect(calls.length).toBe(4);
+});
+
+test("CORS header value rules distinguish simple values from preflighted ones", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers); calls.push({method:init.method, headers});
+    return new Response('ok', {headers:{'access-control-allow-origin':'*','access-control-allow-headers':'*','access-control-max-age':'0'}});
+  }});
+  const check = async (name, value, preflight) => {
+    calls.length = 0;
+    await network.pageFetch({url:'https://asset.test/api', headers:[[name,value]]},'https://page.test/');
+    expect(calls.map(call=>call.method)).toEqual(preflight ? ['OPTIONS','GET'] : ['GET']);
+    if (preflight) expect(calls[0].headers.get('access-control-request-headers')).toBe(name);
+  };
+  await check('accept','text/html, */*;q=0.8',false);
+  await check('accept','text/html;variant="wide"',true);
+  await check('accept-language','en-US, zh-TW;q=0.8',false);
+  await check('accept-language','en_US',true);
+  await check('content-type','text/plain;charset=utf-8',false);
+  await check('content-type','text/plain;charset="utf-8"',true);
+  await check('content-type','text/plain;'+ 'a'.repeat(128),true);
+  await check('range','bytes=0-99',false);
+  await check('range','bytes=100-',false);
+  await check('range','bytes=-99',true);
+  await check('range','bytes=100-99',true);
+  await check('range','bytes=0-99,200-299',true);
+  calls.length=0;
+  await network.pageFetch({url:'https://page.test/api',mode:'no-cors',headers:[['range','bytes=0-99'],['accept-language','en_US'],['accept','text/plain']]},'https://page.test/');
+  expect(calls[0].headers.get('range')).toBeNull();
+  expect(calls[0].headers.get('accept-language')).toBeNull();
+  expect(calls[0].headers.get('accept')).toBe('text/plain');
+});
+
+test("Fetch Metadata is trustworthy-only and cannot be forged by page headers", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    calls.push(new Headers(init.headers));
+    return new Response("ok");
+  } });
+  await network.pageFetch({ url: "https://example.test/api", mode: "same-origin",
+    headers: [["sec-fetch-mode", "navigate"], ["sec-fetch-site", "none"], ["sec-fetch-user", "?1"]] }, "https://example.test/page");
+  expect(calls[0].get("sec-fetch-mode")).toBe("same-origin");
+  expect(calls[0].get("sec-fetch-site")).toBe("same-origin");
+  expect(calls[0].get("sec-fetch-dest")).toBe("empty");
+  expect(calls[0].has("sec-fetch-user")).toBeFalse();
+  await network.navigate("http://example.test/page");
+  expect(calls[1].has("sec-fetch-mode")).toBeFalse();
+  await network.navigate("http://localhost/page");
+  expect(calls[2].get("sec-fetch-mode")).toBe("navigate");
+});
+
+test("a redirect cannot regain same-origin metadata or leak a full referrer", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    calls.push(new Headers(init.headers));
+    const redirects = { "https://example.test/start": "http://localhost/middle", "http://localhost/middle": "https://example.test/end" };
+    return redirects[url] ? new Response(null, { status: 302, headers: { location: redirects[url] } }) : new Response("ok");
+  } });
+  await network.navigate("https://example.test/start", { referrer: "https://example.test/private#anchor" });
+  expect(calls.map(headers => headers.get("sec-fetch-site"))).toEqual(["same-origin", "cross-site", "cross-site"]);
+  // Loopback HTTP is potentially trustworthy. A cross-origin hop trims the
+  // path; returning to the original origin must not restore it.
+  expect(calls[1].get("referer")).toBe("https://example.test/");
+  expect(calls[2].get("referer")).toBe("https://example.test/");
+  calls.length = 0;
+  await network.navigate("https://other.test/end", { post: { body: "a=b", contentType: "application/x-www-form-urlencoded",
+    referrer: "https://example.test/private#anchor" } });
+  expect(calls[0].get("referer")).toBe("https://example.test/");
+  expect(calls[0].get("origin")).toBe("https://example.test");
+});
+
 test("follows redirects by hand and stores cookies on every hop", async () => {
   seen = [];
   const network = new NetworkService();
@@ -293,3 +429,255 @@ test("/json/new opens a target on PUT only", async () => {
     cdp.stop(true);
   }
 });
+
+test("revalidation updates cached headers and validator; no-cache overrides max-age", async () => {
+  const validators = [];
+  const network = new NetworkService({ fetch: async (_, init) => {
+    const etag = new Headers(init.headers).get('if-none-match'); validators.push(etag);
+    if (validators.length === 1) return new Response('body', { headers: { etag: '"v1"', 'cache-control': 'max-age=60, no-cache' } });
+    return new Response(null, { status: 304, headers: { etag: '"v2"', 'x-version': '2' } });
+  } });
+  for (let i = 0; i < 3; i++) {
+    const r = await network.subresource('https://a.test/style.css','https://a.test/');
+    expect(new TextDecoder().decode(r.body)).toBe('body');
+    if (i) expect(r.headers).toContainEqual(['x-version','2']);
+  }
+  expect(validators).toEqual([null,'"v1"','"v2"']);
+});
+
+test("Last-Modified validates without ETag; Vary:* and no-store responses are never retained", async () => {
+  const seen = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    seen.push([url,new Headers(init.headers).get('if-modified-since')]);
+    if (url.endsWith('/modified')) return new Response('x',{headers:{'last-modified':'Wed, 01 Jan 2025 00:00:00 GMT'}});
+    return new Response('x',{headers:{'cache-control':url.endsWith('/star')?'max-age=60':'no-store, max-age=60',vary:'*'}});
+  } });
+  for (const path of ['modified','star','store']) for(let i=0;i<2;i++)await network.subresource(`https://a.test/${path}`,'https://a.test/');
+  expect(seen).toHaveLength(6);
+  expect(seen[1][1]).toBe('Wed, 01 Jan 2025 00:00:00 GMT');
+});
+
+test("cache byte budget evicts least-recently-used data and does not retain oversized bodies", async () => {
+  const calls=[];
+  const network=new NetworkService({maxSubresourceCacheBytes:8,fetch:async url=>{
+    calls.push(url);return new Response(url.endsWith('/large')?'0123456789':'1234',{headers:{'cache-control':'max-age=60'}});
+  }});
+  const get=path=>network.subresource('https://a.test/'+path,'https://a.test/');
+  await get('a');await get('b');await get('a');await get('c');await get('a');await get('b');
+  expect(calls.map(u=>u.split('/').at(-1))).toEqual(['a','b','c','b']);
+  await get('large');await get('large');expect(calls.filter(u=>u.endsWith('/large'))).toHaveLength(2);
+});
+
+test("Age and Date reduce freshness, and immutable alone does not invent a lifetime", async () => {
+  let calls=0;
+  const network=new NetworkService({fetch:async url=>{
+    calls++;return new Response('x',{headers:url.endsWith('/immutable')?{'cache-control':'immutable'}:{'cache-control':'max-age=60',age:'120'}});
+  }});
+  for(const path of ['aged','immutable'])for(let i=0;i<2;i++)await network.subresource(`https://a.test/${path}`,'https://a.test/');
+  expect(calls).toBe(4);
+});
+
+test("aborting a queued page fetch releases it without waiting for busy host slots", async () => {
+  const gates=[];const calls=[];
+  const network=new NetworkService({fetch:async url=>{
+    calls.push(url);await new Promise(resolve=>gates.push(resolve));return new Response('ok');
+  }});
+  const document='https://busy.test/';
+  const active=Array.from({length:6},(_,i)=>network.pageFetch({url:document+i},document));
+  while(gates.length<6)await Bun.sleep(1);
+  const controller=new AbortController();
+  const queued=network.pageFetch({url:document+'aborted'},document,{signal:controller.signal});
+  controller.abort(new Error('cancelled navigation'));
+  await expect(queued).rejects.toThrow('cancelled navigation');
+  expect(calls).toHaveLength(6);
+  for(const finish of gates)finish();await Promise.all(active);
+  expect(calls.some(url=>url.endsWith('/aborted'))).toBe(false);
+});
+
+test("successful CORS preflights reuse permission without caching API responses or crossing origins", async () => {
+  const calls=[];
+  const network=new NetworkService({fetch:async (url,init)=>{
+    const headers=new Headers(init.headers);calls.push([url,init.method,headers.get('access-control-request-headers')]);
+    return new Response(init.method==='OPTIONS'?null:'live '+calls.length,{headers:{
+      'access-control-allow-origin':headers.get('origin'), 'access-control-allow-credentials':'true',
+      'access-control-allow-methods':'PUT, DELETE','access-control-allow-headers':'x-token,x-extra',
+      'access-control-max-age':'60',
+    }});
+  }});
+  const request={url:'https://api.test/items',method:'PUT',headers:[['x-token','one']]};
+  const first=await network.pageFetch(request,'https://page.test/');
+  const second=await network.pageFetch({...request,headers:[['x-token','two']]},'https://page.test/next');
+  expect(new TextDecoder().decode(first.body)).not.toBe(new TextDecoder().decode(second.body));
+  expect(calls.map(c=>c[1])).toEqual(['OPTIONS','PUT','PUT']);
+  await network.pageFetch(request,'https://other.test/');
+  await network.pageFetch({...request,credentials:'include'},'https://page.test/');
+  await network.pageFetch({...request,url:request.url+'/other'},'https://page.test/');
+  await network.pageFetch({...request,method:'DELETE'},'https://page.test/');
+  await network.pageFetch({...request,headers:[...request.headers,['x-extra','value']]},'https://page.test/');
+  expect(calls.filter(c=>c[1]==='OPTIONS')).toHaveLength(6);
+});
+
+test("CORS preflight grants expire and max-age zero does not cache", async () => {
+  let preflights=0;
+  const network=new NetworkService({fetch:async (url,init)=>{
+    if(init.method==='OPTIONS')preflights++;
+    return new Response(null,{headers:{'access-control-allow-origin':'*','access-control-allow-methods':'PUT',
+      'access-control-max-age':url.endsWith('zero')?'0':'1'}});
+  }});
+  const get=path=>network.pageFetch({url:'https://api.test/'+path,method:'PUT'},'https://page.test/');
+  await get('one');await get('one');expect(preflights).toBe(1);
+  await Bun.sleep(1050);await get('one');expect(preflights).toBe(2);
+  await get('zero');await get('zero');expect(preflights).toBe(4);
+});
+
+test("wildcard CORS permissions do not authorize Authorization, and denied grants are not cached", async () => {
+  let calls=0;
+  const network=new NetworkService({fetch:async()=>{calls++;return new Response(null,{headers:{
+    'access-control-allow-origin':'*','access-control-allow-headers':'*','access-control-max-age':'60',
+  }});}});
+  const request={url:'https://api.test/',headers:[['Authorization','Bearer example']]};
+  for(let i=0;i<2;i++)await expect(network.pageFetch(request,'https://page.test/')).rejects.toThrow('does not allow header authorization');
+  expect(calls).toBe(2);
+});
+
+test("an aborted CORS preflight does not send the API request or cache a grant",async()=>{
+  let calls=0;
+  const network=new NetworkService({fetch:async(_,init)=>{
+    calls++;await new Promise((resolve,reject)=>init.signal.addEventListener('abort',()=>reject(init.signal.reason),{once:true}));
+  }});
+  const controller=new AbortController();
+  const pending=network.pageFetch({url:'https://api.test/',method:'PUT'},'https://page.test/',{signal:controller.signal});
+  while(calls===0)await Bun.sleep(1);
+  controller.abort(new Error('cancelled preflight'));
+  await expect(pending).rejects.toThrow('cancelled preflight');expect(calls).toBe(1);
+});
+
+test("aborting a preflight after headers arrive does not retain its permission grant", async () => {
+  const calls = [];
+  let headersArrived = false;
+  const network = new NetworkService({ fetch: async (url, init) => {
+    calls.push(init.method);
+    const body = calls.length === 1 ? new ReadableStream({ start(controller) {
+      headersArrived = true;
+      init.signal.addEventListener('abort', () => controller.error(init.signal.reason), {once:true});
+    }}) : null;
+    return new Response(body,{headers:{'access-control-allow-origin':'*','access-control-allow-methods':'PUT','access-control-max-age':'60'}});
+  }});
+  const controller = new AbortController();
+  const request = {url:'https://api.test/',method:'PUT'};
+  const pending = network.pageFetch(request,'https://page.test/',{signal:controller.signal});
+  while (!headersArrived) await Bun.sleep(1);
+  controller.abort(new Error('cancelled after headers'));
+  await expect(pending).rejects.toThrow('cancelled after headers');
+  await network.pageFetch(request,'https://page.test/');
+  expect(calls).toEqual(['OPTIONS','OPTIONS','PUT']);
+});
+
+test("same-origin fetch redirects still enforce CORS, credentials and response-header filtering", async () => {
+  const calls = [];
+  let allowed = false;
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers); calls.push({ url, headers });
+    if (url === "https://source.test/start") return new Response(null, { status: 302, headers: { location: "https://target.test/data" } });
+    return new Response("public", { headers: { ...(allowed ? { "access-control-allow-origin": "https://source.test" } : {}),
+      "x-secret": "hidden", "x-public": "visible", "access-control-expose-headers": "x-public" } });
+  } });
+  network.cookies.store("https://target.test/", ["secret=credential; Secure; SameSite=None"]);
+  await expect(network.pageFetch({ url: "https://source.test/start" }, "https://source.test/page")).rejects.toThrow("CORS");
+  expect(calls[1].headers.get("cookie")).toBeNull();
+  expect(calls[1].headers.get("origin")).toBe("https://source.test");
+  allowed = true;
+  const response = await network.pageFetch({ url: "https://source.test/start" }, "https://source.test/page");
+  expect(response.type).toBe("cors");
+  expect(new Headers(response.headers).get("x-secret")).toBeNull();
+  expect(new Headers(response.headers).get("x-public")).toBe("visible");
+});
+
+test("same-origin mode blocks a cross-origin redirect before contacting its target", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async url => {
+    calls.push(url);
+    return new Response(null, { status: 302, headers: { location: "https://target.test/private" } });
+  } });
+  await expect(network.pageFetch({ url: "https://source.test/start", mode: "same-origin" }, "https://source.test/page"))
+    .rejects.toThrow("mode is same-origin");
+  expect(calls).toEqual(["https://source.test/start"]);
+});
+
+test("no-cors fetches become opaque when a redirect crosses origins", async () => {
+  const network = new NetworkService({ fetch: async url => url.includes("source.test")
+    ? new Response(null, { status: 302, headers: { location: "https://target.test/private" } })
+    : new Response("private", { headers: { "x-private": "secret" } }) });
+  const result = await network.pageFetch({ url: "https://source.test/start", mode: "no-cors" }, "https://source.test/page");
+  expect(result).toMatchObject({ type: "opaque", status: 0, url: "", headers: [], redirected: false });
+  expect(result.body.byteLength).toBe(0);
+});
+
+test("redirected non-simple requests preflight the new origin and strip Authorization", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers); calls.push({ url, method: init.method, headers });
+    if (url.includes("source.test")) return new Response(null, { status: 307, headers: { location: "https://target.test/api" } });
+    return new Response(null, { status: 204, headers: { "access-control-allow-origin": "https://source.test",
+      "access-control-allow-methods": "PUT", "access-control-allow-headers": "x-custom" } });
+  } });
+  await network.pageFetch({ url: "https://source.test/start", method: "PUT", body: new TextEncoder().encode("body"),
+    headers: [["authorization", "Bearer private"], ["x-custom", "value"]] }, "https://source.test/page");
+  expect(calls.map(call => call.method)).toEqual(["PUT", "OPTIONS", "PUT"]);
+  expect(calls[0].headers.get("authorization")).toBe("Bearer private");
+  expect(calls[1].headers.get("access-control-request-headers")).toBe("x-custom");
+  expect(calls[2].headers.has("authorization")).toBeFalse();
+});
+
+test("a cross-origin redirect chain checks each hop and taints subsequent Origin", async () => {
+  const calls = [];
+  const network = new NetworkService({ fetch: async (url, init) => {
+    const headers = new Headers(init.headers); calls.push({ url, headers });
+    if (url === "https://target.test/start") return new Response(null, { status: 302, headers: {
+      location: "https://final.test/end", "access-control-allow-origin": "https://source.test" } });
+    return new Response("done", { headers: { "access-control-allow-origin": "null" } });
+  } });
+  const result = await network.pageFetch({ url: "https://target.test/start" }, "https://source.test/page");
+  expect(result.type).toBe("cors");
+  expect(calls.map(call => call.headers.get("origin"))).toEqual(["https://source.test", "null"]);
+});
+
+test("canceling one coalesced resource consumer preserves other consumers", async () => {
+  let requests = 0, underlyingAborted = false, complete;
+  const network = new NetworkService({ fetch: async (url, init) => {
+    requests++;
+    return new Promise((resolve, reject) => {
+      complete = () => resolve(new Response("shared image"));
+      init.signal.addEventListener("abort", () => { underlyingAborted = true; reject(init.signal.reason); }, { once: true });
+    });
+  } });
+  const first = new AbortController(), second = new AbortController();
+  const one = network.subresource("https://example.test/image", "https://example.test/page", "image", { signal: first.signal });
+  const two = network.subresource("https://example.test/image", "https://example.test/page", "image", { signal: second.signal });
+  await Bun.sleep(0);
+  first.abort("first document closed");
+  await expect(one).rejects.toBe("first document closed");
+  expect(underlyingAborted).toBeFalse();
+  complete();
+  expect(new TextDecoder().decode((await two).body)).toBe("shared image");
+  expect(requests).toBe(1);
+  expect(underlyingAborted).toBeFalse();
+});
+
+test("the last resource consumer aborts its transfer and a later consumer starts fresh", async () => {
+  let requests = 0, aborts = 0;
+  const network = new NetworkService({ fetch: async (url, init) => {
+    if (++requests === 2) return new Response("fresh");
+    return new Promise((resolve, reject) => init.signal.addEventListener("abort", () => {
+      aborts++; reject(init.signal.reason);
+    }, { once: true }));
+  } });
+  const controller = new AbortController();
+  const pending = network.subresource("https://example.test/image", "https://example.test/page", "image", { signal: controller.signal });
+  await Bun.sleep(0);
+  controller.abort("document closed");
+  await expect(pending).rejects.toBe("document closed");
+  const fresh = await network.subresource("https://example.test/image", "https://example.test/page", "image");
+  expect(new TextDecoder().decode(fresh.body)).toBe("fresh");
+  expect([requests, aborts]).toEqual([2, 1]);
+});