buninu-browser 0.5.0 → 0.6.0

package/lib/paint/frame.js

@@ -117,11 +117,18 @@ export function backgroundBytes(color) {
 }
 
 /** Raw screenshot payload, owned independently of a recyclable raster tile. */
-export function rawFrame(pixels, width, height, format) {
-  if (!['rgba', 'bgra'].includes(format) || width * height > 16777216) throw Error('Invalid raw screenshot');
-  const data = new Uint8Array(pixels);
-  if (format === 'bgra') {
-    for (let i=0; i<data.length; i+=4) { const red=data[i]; data[i]=data[i+2]; data[i+2]=red; }
+export function rawFrame(pixels, width, height, format, { takeOwnership = false, inputFormat = "rgba" } = {}) {
+  if (!['rgba', 'bgra'].includes(format) || !['rgba', 'bgra'].includes(inputFormat) || width * height > 16777216) throw Error('Invalid raw screenshot');
+  // Only private composition/crop snapshots may be consumed in place. The
+  // default keeps raw captures independent of immutable/recyclable tiles.
+  const data = takeOwnership && pixels.buffer instanceof ArrayBuffer && pixels.byteOffset % 4 === 0 ? pixels : new Uint8Array(pixels);
+  if (format !== inputFormat) {
+    // Swap R/B as packed pixels, preserving G and alpha (Bun targets are little-endian).
+    const words = new Uint32Array(data.buffer, data.byteOffset, Math.floor(data.byteLength / 4));
+    for (let i = 0; i < words.length; i++) {
+      const p = words[i];
+      words[i] = (p & 0xff00ff00) | ((p & 0xff) << 16) | ((p >>> 16) & 0xff);
+    }
   }
   return {format, width, height, pixels:data};
 }

package/lib/render-tree/index.js

@@ -315,6 +315,9 @@ function sameNodeProperties(previous, type, properties) {
   for (const [key, value] of Object.entries(properties)) {
     const old = previous[key];
     if (old === value) continue;
+    // Extraction makes fresh immutable SVG values even when their paint is
+    // unchanged. Retain the node so its ancestors can reuse layout results.
+    if (key === "svg" && Bun.deepEquals(old, value, true)) continue;
     if (key !== "children" || old.length !== value.length) return false;
     for (let index = 0; index < old.length; index++) if (old[index] !== value[index]) return false;
   }

package/lib/renderer/animation-frames.js

@@ -0,0 +1,76 @@
+import { drainMicrotasks } from "bun:jsc";
+import { createTimers } from "./timers.js";
+
+// Older Bun checkpoints also dispatched queued event-loop tasks. Although
+// 1.4.3 stable fixed this, Bun.version hides the suffix of unsafe 1.4.3
+// canaries. Require the later 1.4.4 branch and keep unknown channels on timers.
+export function supportsFrameCheckpoint(version = Bun.version) {
+  const match = typeof version === "string"
+    && /^((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?:-canary(?:\.(?:0|[1-9]\d*))?)?$/.exec(version);
+  return !!match && Bun.semver.order(match[1], "1.4.4") >= 0;
+}
+
+/** One callback collection per document, with a checkpoint between callbacks. */
+export function createAnimationFrames({ invoke, now, checkpoint = drainMicrotasks,
+  frameTimers = null }) {
+  let nextWakeId = 1;
+  // A private timer collection keeps frame handles separate from Window timers.
+  // timerTask=false also prevents a frame inheriting a timer's nesting clamp.
+  const timers = frameTimers ?? createTimers({ invoke: callback => callback(), nextId: () => nextWakeId++ });
+  const callbacks = new Map();
+  let nextHandle = 0, wake = null, running = false, disposed = false;
+
+  function arm(delay) {
+    if (!disposed && wake === null && !running && callbacks.size) {
+      wake = timers.schedule(deliver, delay, false, false);
+    }
+  }
+  function deliver() {
+    wake = null;
+    if (disposed) return;
+    running = true;
+    const timestamp = now(), handles = [...callbacks.keys()];
+    try {
+      for (const handle of handles) {
+        if (disposed) break;
+        const callback = callbacks.get(handle);
+        if (callback === undefined) continue;
+        callbacks.delete(handle);
+        // invoke reports page exceptions. Drain the complete promise/microtask
+        // queue here, without yielding unrelated timers or I/O between callbacks.
+        try { invoke(callback, timestamp); }
+        finally { checkpoint(); }
+      }
+    } finally {
+      running = false;
+      // Callbacks registered during delivery, including its microtasks, belong
+      // to the next frame. Long callbacks do not add another fixed 16 ms delay.
+      arm(Math.max(0, Math.ceil(16 - (now() - timestamp))));
+    }
+  }
+  return {
+    request(callback) {
+      if (typeof callback !== "function") throw new TypeError("requestAnimationFrame callback must be a function");
+      do { nextHandle = (nextHandle + 1) >>> 0; } while (callbacks.has(nextHandle));
+      const handle = nextHandle;
+      if (!disposed) {
+        callbacks.set(handle, callback);
+        arm(16);
+      }
+      return handle;
+    },
+    cancel(handle) {
+      callbacks.delete(+handle >>> 0);
+      if (!callbacks.size && wake !== null) {
+        timers.cancel(wake);
+        wake = null;
+      }
+    },
+    dispose() {
+      disposed = true;
+      callbacks.clear();
+      timers.dispose();
+      wake = null;
+    },
+  };
+}

package/lib/renderer/bindings.js

@@ -10,6 +10,8 @@
  *
  * Coverage is the commonly used subset of DOM, not the full WebIDL surface.
  */
+import { replaceNode, replaceWithNodes } from '../happy-dom/node-replacement.js';
+import { observeIteratorRemoval } from '../happy-dom/node-iterator-removal.js';
 import { renderedText, setRenderedText } from "./rendered-text.js";
 import { assignedSlot, slotAssignedNodes, assignSlotNodes } from "./slot-assignment.js";
 import { scrollIntoViewOptions, scrollAlignmentDelta } from "./scroll-into-view.js";
@@ -503,7 +505,7 @@ class NodeBinding {
   replaceChild(child, old) {
     const node = requireNode(child);
     const list = insertionList([node]);
-    this.#node.replaceChild(node, requireNode(old));
+    replaceNode(this.#node, node, requireNode(old));
     inserted(this, list);
     return old;
   }
@@ -775,6 +777,7 @@ class ElementBinding extends ParentBinding {
   load() {
     if (!isMedia(this)) return;
     realmOf(this).hooks.pauseMedia?.(nodeOf(this));
+    realmOf(this).hooks.reselectMedia?.(nodeOf(this));
     void realmOf(this).hooks.seekMedia?.(nodeOf(this), 0);
   }
 
@@ -916,6 +919,7 @@ class ElementBinding extends ParentBinding {
       if (resetsCanvas) resetCanvas(node);
       touch(this);
     }
+    if (attribute.toLowerCase() === "src" && isMedia(this)) realmOf(this).hooks.attachMediaSrc?.(node, node.src);
   }
 
   removeAttribute(name) {
@@ -1053,7 +1057,7 @@ class ElementBinding extends ParentBinding {
   replaceWith(...values) {
     const nodes = values.map((value) => toNode(this, value));
     const list = insertionList(nodes);
-    nodeOf(this).replaceWith(...nodes);
+    replaceWithNodes(nodeOf(this), nodes);
     inserted(this, list);
   }
 
@@ -1690,6 +1694,10 @@ class DocumentBinding extends ParentBinding {
     return realmOf(this).wrap(nodeOf(this).createComment(String(text)));
   }
 
+  createNodeIterator(root, whatToShow = NodeFilter.SHOW_ALL, filter = null) {
+    return new NodeIteratorBinding(CONSTRUCT, realmOf(this), requireNode(root), whatToShow, filter);
+  }
+
   createTreeWalker(root, whatToShow = NodeFilter.SHOW_ALL, filter = null) {
     return new TreeWalkerBinding(CONSTRUCT, realmOf(this), requireNode(root), whatToShow, filter);
   }
@@ -2033,6 +2041,101 @@ export const NodeFilter = Object.freeze({
 });
 const { FILTER_ACCEPT, FILTER_REJECT, FILTER_SKIP } = NodeFilter;
 
+/** DOM §6.1: a cursor between nodes, including the root; REJECT skips
+ * only that node, unlike TreeWalker where it also prunes descendants. */
+class NodeIteratorBinding {
+  #realm; #root; #reference; #before = true; #whatToShow; #filter; #active = false;
+  #candidate = null;
+  constructor(key, realm, root, whatToShow, filter) {
+    if (key !== CONSTRUCT) throw new TypeError("Illegal constructor");
+    this.#realm = realm; this.#root = this.#reference = root;
+    this.#whatToShow = +whatToShow >>> 0; this.#filter = filter ?? null;
+    // WebIDL callback interfaces accept objects/functions or null, but no
+    // primitives; validate even when whatToShow would skip every node.
+    if (this.#filter !== null && typeof filter !== "object" && typeof filter !== "function") {
+      throw new TypeError("NodeIterator filter must be an object or null");
+    }
+    // Keep the internal removal callback off the page-visible interface.
+    observeIteratorRemoval(root, this.#removal);
+  }
+  #removal = { preRemove: node => this.#preRemove(node) };
+  get root() { return this.#realm.wrap(this.#root); }
+  get referenceNode() { return this.#realm.wrap(this.#reference); }
+  get pointerBeforeReferenceNode() { return this.#before; }
+  get whatToShow() { return this.#whatToShow; }
+  get filter() { return this.#filter; }
+  detach() {} // Legacy no-op, as required by DOM.
+  nextNode() { return this.#traverse(true); }
+  previousNode() { return this.#traverse(false); }
+  #following(node, children = true) {
+    if (children && node.firstChild) return node.firstChild;
+    while (node && node !== this.#root) {
+      if (node.nextSibling) return node.nextSibling;
+      node = node.parentNode;
+    }
+    return null;
+  }
+  #preceding(node) {
+    if (node === this.#root) return null;
+    if (!node.previousSibling) return node.parentNode;
+    node = node.previousSibling;
+    while (node.lastChild) node = node.lastChild;
+    return node;
+  }
+  #accept(node) {
+    if (this.#active) throw new DOMException("The iterator filter is already active", "InvalidStateError");
+    if (!(this.#whatToShow & (1 << (node.nodeType - 1)))) return FILTER_SKIP;
+    if (this.#filter === null) return FILTER_ACCEPT;
+    this.#active = true;
+    try {
+      const filter = this.#filter, wrapper = this.#realm.wrap(node);
+      return +(typeof filter === "function" ? Reflect.apply(filter, undefined, [wrapper])
+        : Reflect.apply(filter.acceptNode, filter, [wrapper])) & 0xffff;
+    } finally { this.#active = false; }
+  }
+  #traverse(forward) {
+    if (this.#active) throw new DOMException("The iterator filter is already active", "InvalidStateError");
+    // A filter can remove its candidate or an ancestor synchronously. Track
+    // the traversal cursor separately so pre-removal adjusts both positions.
+    const cursor = this.#candidate = { node: this.#reference, before: this.#before };
+    try {
+      for (;;) {
+        if (forward) {
+          if (cursor.before) cursor.before = false;
+          else cursor.node = this.#following(cursor.node);
+        } else {
+          if (!cursor.before) cursor.before = true;
+          else cursor.node = this.#preceding(cursor.node);
+        }
+        const node = cursor.node;
+        if (!node) return null;
+        if (this.#accept(node) === FILTER_ACCEPT) {
+          this.#reference = cursor.node; this.#before = cursor.before;
+          // Return the accepted node even if the filter removed it; the next
+          // traversal resumes at the repaired position in the remaining tree.
+          return this.#realm.wrap(node);
+        }
+      }
+    } finally { this.#candidate = null; }
+  }
+  #preRemove(node) {
+    if (node === this.#root) return;
+    const adjust = cursor => {
+      if (!cursor?.node || !node.contains(cursor.node)) return;
+      if (cursor.before) {
+        const next = this.#following(node, false);
+        if (next) { cursor.node = next; return; }
+        cursor.before = false;
+      }
+      cursor.node = this.#preceding(node);
+    };
+    const reference = { node: this.#reference, before: this.#before };
+    adjust(reference);
+    this.#reference = reference.node; this.#before = reference.before;
+    adjust(this.#candidate);
+  }
+}
+
 /**
  * DOM §6.2 TreeWalker over the real nodes. The page's filter (a function or
  * an object with acceptNode) sees node wrappers, and its exceptions reach the
@@ -2833,7 +2936,7 @@ function cssEscape(value) {
  * Must run after SES lockdown() (which provides `harden`).
  */
 const BINDINGS = [NodeBinding, CharacterDataBinding, TextBinding, ParentBinding, FragmentBinding, ShadowRootBinding, ElementBinding,
-  DocumentBinding, EventBinding, ClassListBinding, TreeWalkerBinding, RangeBinding];
+  DocumentBinding, EventBinding, ClassListBinding, TreeWalkerBinding, NodeIteratorBinding, RangeBinding];
 
 // Members defined with Object.defineProperty({ get() {...} }) are named
 // "get"; Web IDL names an attribute's accessors "get x" / "set x" and an
@@ -2869,5 +2972,6 @@ export const INTERFACES = Object.freeze({
   DocumentFragment: FragmentBinding,
   ShadowRoot: ShadowRootBinding,
   TreeWalker: TreeWalkerBinding,
+  NodeIterator: NodeIteratorBinding,
   DOMTokenList: ClassListBinding,
 });

package/lib/renderer/compositor-channel.js

@@ -12,7 +12,7 @@ export function encodePacket(message, pixels = null) {
   const json = Buffer.from(JSON.stringify(message));
   const size = pixels?.byteLength ?? 0;
   if (json.length > MAX_JSON || size > MAX_PIXELS || json.length + size > MAX_QUEUE) throw Error('Compositor packet too large');
-  const packet = Buffer.allocUnsafe(8 + json.length + size);
+  const packet = Buffer.allocUnsafeSlow(8 + json.length + size);
   packet.writeUInt32LE(json.length, 0); packet.writeUInt32LE(size, 4);
   packet.set(json, 8); if (size) packet.set(pixels, 8 + json.length);
   return packet;
@@ -34,7 +34,7 @@ export class PacketReader {
         const binaryLength = this.header.readUInt32LE(4);
         const total = this.jsonLength + binaryLength;
         if (!this.jsonLength || this.jsonLength > MAX_JSON || binaryLength > MAX_PIXELS || total > this.limit) throw Error('Invalid compositor packet size');
-        this.packet = Buffer.allocUnsafe(total);
+        this.packet = Buffer.allocUnsafeSlow(total);
       } else {
         const packet = this.packet; this.packet = null;
         const message = JSON.parse(packet.subarray(0, this.jsonLength).toString());
@@ -45,21 +45,106 @@ export class PacketReader {
   }
 }
 
+// Serialize complete packets, including their two writes, so control messages
+// cannot land between an owned frame's header and pixels. Do not cork these
+// writes: Bun's node:net _writev joins chunks with Buffer.concat.
+export class PacketWriter {
+  constructor(socket, limit = MAX_QUEUE) {
+    this.socket = socket; this.limit = limit; this.queue = []; this.bytes = 0;
+    this.current = null; this.waiting = false; this.pumping = false; this.closed = false;
+    socket.on('error', () => this.close());
+    socket.once('close', () => {
+      this.close();
+      // A destroyed socket can still have a pending native write until its
+      // callback/close event. Only now is its last borrowed buffer disposable.
+      this.release(this.current); this.current = null;
+    });
+  }
+  release(entry) {
+    if (!entry || entry.released) return;
+    entry.released = true;
+    if (entry.queued) this.bytes -= entry.size;
+    for (const buffer of entry.buffers) buffer.transfer(0);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const entry of this.queue) this.release(entry);
+    this.queue.length = 0;
+    this.socket.destroy();
+  }
+  pump() {
+    if (this.pumping || this.waiting || this.closed) return;
+    this.pumping = true;
+    try {
+      while (!this.waiting && !this.closed) {
+        this.current ??= this.queue.shift();
+        const entry = this.current;
+        if (!entry) break;
+        if (entry.index === entry.parts.length) {
+          this.release(entry); this.current = null; continue;
+        }
+        this.waiting = true;
+        try {
+          this.socket.write(entry.parts[entry.index++], error => {
+            if (entry !== this.current || entry.released) return;
+            this.waiting = false;
+            if (error || this.closed || this.socket.destroyed) {
+              this.close(); this.release(entry); this.current = null;
+            } else this.pump();
+          });
+        } catch (error) {
+          // Some header bytes may already be on the wire. Closing is required
+          // even when write throws synchronously, or the next packet is corrupt.
+          this.close();
+          return error;
+        }
+      }
+    } finally { this.pumping = false; }
+  }
+  send(message, pixels, {takeOwnership = false} = {}) {
+    const entry = {parts:[], buffers:[], index:0, size:0, queued:false, released:false};
+    try {
+      if (takeOwnership) {
+        if (!(pixels instanceof Uint8Array) || !(pixels.buffer instanceof ArrayBuffer))
+          throw TypeError('Owned compositor pixels must have a private ArrayBuffer');
+        // The caller gives up this entire buffer, including on a rejected send.
+        entry.buffers.push(pixels.buffer);
+      }
+      if (this.closed || this.socket.destroyed) throw Error('Compositor channel closed');
+      const packet = encodePacket(message, takeOwnership ? null : pixels);
+      entry.buffers.push(packet.buffer);
+      entry.parts.push(packet);
+      if (takeOwnership) {
+        const size = pixels.byteLength;
+        if (size > MAX_PIXELS || packet.length - 8 + size > MAX_QUEUE) throw Error('Compositor packet too large');
+        packet.writeUInt32LE(size, 4);
+        if (size) entry.parts.push(pixels);
+      }
+      entry.size = entry.parts.reduce((size, part) => size + part.byteLength, 0);
+      if (this.bytes + entry.size > this.limit) {
+        this.close(); throw Error('Compositor channel backpressure limit');
+      }
+      entry.queued = true; this.bytes += entry.size; this.queue.push(entry);
+      const error = this.pump();
+      if (error) throw error;
+    } catch (error) {
+      if (!entry.queued) this.release(entry);
+      throw error;
+    }
+  }
+}
+
 function attach(socket, receive, closed, limit) {
   socket.setNoDelay(true);
   const reader = new PacketReader(receive, limit);
+  const writer = new PacketWriter(socket);
   socket.on('data', chunk => { try { reader.push(chunk); } catch { socket.destroy(); } });
-  socket.on('error', () => {});
   socket.once('close', closed);
   return {
     reader,
-    send(message, pixels) {
-      if (socket.destroyed) throw Error('Compositor channel closed');
-      const packet = encodePacket(message, pixels);
-      if (socket.writableLength + packet.length > MAX_QUEUE) { socket.destroy(); throw Error('Compositor channel backpressure limit'); }
-      socket.write(packet);
-    },
-    close() { socket.destroy(); },
+    send(message, pixels, options) { writer.send(message, pixels, options); },
+    close() { writer.close(); },
   };
 }
 

package/lib/renderer/compositor.js

@@ -11,7 +11,7 @@
  *   controller -> compositor  { id, method: "screenshot" | "scroll" | "scrollOffset", params }
  *                             (screenshot params: [{ format?: "png" | "jpeg" | "webp", quality? }])
  *   compositor -> controller  { id, result } | { id, error }
- *                             { type: "frame" }   (what the viewport shows changed)
+ *                             { type: "frame", scrollOffset: { x, y } }   (the viewport changed)
  *
  * Messages with the main thread (postMessage):
  *   main -> compositor  { type: "frame", serial, tile, viewport, content, scroll, scrollEpoch }
@@ -25,8 +25,8 @@ import { ScrollViewport } from "../layout/scroll-viewport.js";
 import { rawFrame, captureViewport, encodeImage, encodeImageBase64 } from "../paint/frame.js";
 import { FrameCaptureCache } from "../paint/frame-cache.js";
 import { FrameLeaseTracker } from "../paint/shared-frame-pool.js";
-import wasmpeg from "../../vendor/wasmpeg/src/js/index.js";
-import { VideoPresentation, compositeVideo } from "./video-presentation.js";
+import { startVideoChannel } from "./video-channel.js";
+import { compositeVideo, captureVideoViewport } from "./video-presentation.js";
 
 import {connectCompositor} from './compositor-channel.js';
 
@@ -36,9 +36,14 @@ let scrollEpoch = -1;
 let frameSerial = 0;
 const captures = new FrameCaptureCache();
 const frameLeases = new FrameLeaseTracker(serial => postMessage({ type: "frame-release", serial }));
-const video = new VideoPresentation(wasmpeg, () => {
+// Register before awaiting decoder startup: the parent's connect message may
+// arrive while the media worker is loading WASM.
+const endpointReady = new Promise(resolve => {
+  self.onmessage = ({data}) => { if (data?.type === 'connect') resolve(data.endpoint); };
+});
+const video = await startVideoChannel(() => {
   frameSerial++;
-  send({ type: "frame" });
+  notifyFrame();
 }, report => postMessage({ type: "video-report", ...report }));
 
 let channel;
@@ -46,16 +51,23 @@ function send(message) {
   const result = message.result;
   if (result?.pixels instanceof Uint8Array) {
     const {pixels,...metadata} = result;
-    channel.send({...message,result:metadata},pixels);
+    // This raw result is exclusively owned here. The transport borrows it
+    // directly, then releases it after the write completes (or the socket
+    // closes); do not detach bytes while a native socket may still use them.
+    channel.send({...message,result:metadata},pixels,{takeOwnership:true});
   } else channel.send(message);
 }
-const endpoint = await new Promise(resolve => {
-  self.onmessage = ({data}) => { if (data?.type === 'connect') resolve(data.endpoint); };
-});
+function notifyFrame() {
+  // Snapshot the compositor-owned position with its invalidation. A zero-area
+  // screencast needs no pixels and can use this without another socket request.
+  send({ type: "frame", scrollOffset: { x: viewport.x, y: viewport.y } });
+}
+const endpoint = await endpointReady;
 channel = await connectCompositor(endpoint, request => { void handleRequest(request); }, () => process.exit(1));
 
 self.onmessage = ({ data }) => {
   if (data?.type === "video-open") { void video.open(data); return; }
+  if (data?.type === "video-extend") { video.extend(data); return; }
   if (data?.type === "video-stop") { video.stop(data.id); frameSerial++; return; }
   if (data?.type === "video-bind") { video.bind(data.id, data.audioId, data.audioStart, data.time, data.endTime); return; }
   if (data?.type !== "frame") return;
@@ -75,33 +87,58 @@ self.onmessage = ({ data }) => {
       postMessage({ type: "scroll", x: viewport.x, y: viewport.y });
     }
   }
-  send({ type: "frame" });
+  notifyFrame();
   // Lets the main thread answer the call that produced this frame only once
   // screenshots taken after it will show it.
   postMessage({ type: "frame-ack", serial: data.serial });
 };
 
+// Only private composition/crop buffers are disposable. A full-width crop
+// may borrow the immutable raster tile, which remains protected by its lease.
+function releaseCapture(frame, composited, captured, retained = null) {
+  if (captured && captured.pixels.buffer !== retained && captured.pixels.buffer !== composited.pixels.buffer)
+    captured.pixels.buffer.transfer(0);
+  if (composited !== frame && composited.pixels.buffer !== retained) composited.pixels.buffer.transfer(0);
+}
+
 const methods = {
   async screenshot({ format = "png", quality = 80, optimizeForSpeed = false, clip } = {}) {
     if (!tile) return "";
     if (format === 'rgba' || format === 'bgra') {
       return frameLeases.capture(frame => {
-        const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
-        const {pixels,width,height} = captureViewport(composited,viewport.x,viewport.y,viewport.width,viewport.height,clip);
-        return rawFrame(pixels,width,height,format);
+        const visible = frame.videoLayer?.id === video.config?.id
+          ? captureVideoViewport(frame, video.frame, viewport.x, viewport.y, viewport.width, viewport.height, clip, format) : null;
+        if (visible) {
+          // This crop owns its bytes. The normal transport releases them
+          // after the socket write completes; the raster tile's lease stays intact.
+          try { return rawFrame(visible.pixels, visible.width, visible.height, format,
+            {takeOwnership: true, inputFormat: visible.pixelFormat}); }
+          catch (error) { visible.pixels.buffer.transfer(0); throw error; }
+        }
+        const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame, format) : frame;
+        let captured, result;
+        try {
+          captured = captureViewport(composited,viewport.x,viewport.y,viewport.width,viewport.height,clip);
+          const takeOwnership = captured.pixels.buffer !== frame.pixels.buffer;
+          result = rawFrame(captured.pixels,captured.width,captured.height,format,{takeOwnership,inputFormat:composited.pixelFormat ?? "rgba"});
+          return result;
+        } finally { releaseCapture(frame, composited, captured, result?.pixels.buffer); }
       });
     }
     const key = `${frameSerial}:${viewport.x}:${viewport.y}:${format}:${quality}:${optimizeForSpeed}:${JSON.stringify(clip)}`;
-    return captures.get(key, () => frameLeases.capture(frame => {
+    return captures.get(key, () => frameLeases.capture(async frame => {
       const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
-      const { pixels, width, height } = captureViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height,clip);
-      return encodeImageBase64(pixels, width, height, { format, quality, optimizeForSpeed });
+      let captured;
+      try {
+        captured = captureViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height,clip);
+        return await encodeImageBase64(captured.pixels, captured.width, captured.height, { format, quality, optimizeForSpeed });
+      } finally { releaseCapture(frame, composited, captured); }
     }));
   },
   scroll(deltaX, deltaY) {
     if (viewport.scrollBy(deltaX, deltaY)) {
       postMessage({ type: "scroll", x: viewport.x, y: viewport.y });
-      send({ type: "frame" });
+      notifyFrame();
     }
     return { x: viewport.x, y: viewport.y };
   },
@@ -128,5 +165,4 @@ async function handleRequest(request) {
 // renderer installs seccomp, which forbids opening files.
 await encodeImage(new Uint8Array(4), 1, 1);
 await encodeImage(new Uint8Array(4), 1, 1, { format: "jpeg" });
-await wasmpeg.load();
 postMessage({ type: "ready" });

package/lib/renderer/document-cookies.js

@@ -0,0 +1,87 @@
+import { CookieJar } from "../network/cookie-jar.js";
+
+/** Shared by the document and its same-origin frames; the controller remains authoritative. */
+export class DocumentCookies {
+  #jar;
+  #now;
+  #send;
+  #nextSequence = 1;
+  #revision = -1;
+  #acknowledged = 0;
+  #pending = new Map();
+  #legacyCookie = "";
+
+  constructor(send = () => {}, now = () => Date.now()) {
+    this.#send = send;
+    this.#now = now;
+    this.#jar = new CookieJar({ now });
+  }
+
+  get(url) {
+    return this.#revision < 0 ? this.#legacyCookie : this.#jar.documentCookie(url);
+  }
+
+  set(url, value) {
+    const assignment = String(value);
+    // The controller imposes the same IPC limit; rejected writes cannot
+    // temporarily create a cookie which the controller will never accept.
+    if (assignment.length > 4096) return;
+    const sequence = this.#nextSequence++;
+    // Legacy embedders need not acknowledge setters. Only retain mutations
+    // after the controller has established the versioned snapshot protocol.
+    if (this.#revision < 0) {
+      this.#legacyCookie = mergeLegacyCookie(this.#legacyCookie, assignment, this.#now());
+    } else {
+      const mutation = { sequence, url, value: assignment, receivedAt: this.#now() };
+      this.#pending.set(sequence, mutation);
+      this.#jar.store(url, [assignment], { fromScript: true, receivedAt: mutation.receivedAt });
+    }
+    this.#send(assignment, url, sequence);
+  }
+
+  accept(state) {
+    if (!state || !Number.isSafeInteger(state.revision) || state.revision <= this.#revision
+        || !Number.isSafeInteger(state.acknowledged) || state.acknowledged < this.#acknowledged
+        || !Array.isArray(state.cookies)) return false;
+    this.#revision = state.revision;
+    this.#acknowledged = state.acknowledged;
+    this.#legacyCookie = "";
+    for (const sequence of this.#pending.keys()) {
+      if (sequence <= state.acknowledged) this.#pending.delete(sequence);
+    }
+    this.#jar.replaceScriptSnapshot(state.cookies);
+    // A response may have been queued before a newer synchronous setter ran.
+    // Replay only those setters, retaining unrelated server cookies and the
+    // original Max-Age start time rather than extending it on each snapshot.
+    for (const mutation of this.#pending.values()) {
+      this.#jar.store(mutation.url, [mutation.value], { fromScript: true, receivedAt: mutation.receivedAt });
+    }
+    return true;
+  }
+
+  /** Compatibility for embedders providing only the old documentCookie string. */
+  seed(url, value, replace = false) {
+    if (this.#revision >= 0 || typeof value !== "string") return;
+    // A header has no Path/Domain metadata, so preserve it verbatim instead of
+    // inventing records (which would collapse legitimate duplicate names).
+    // An embedded about:blank initial load must not erase its parent's value.
+    if (replace || value) this.#legacyCookie = value;
+  }
+}
+
+/** Preserve the string-only embedder API until a controller snapshot arrives. */
+function mergeLegacyCookie(current, assignment, now) {
+  const [pair, ...attributes] = assignment.split(";");
+  const equals = pair.indexOf("=");
+  if (equals < 1) return current;
+  const name = pair.slice(0, equals).trim();
+  const value = pair.slice(equals + 1).trim();
+  const expired = attributes.some(attribute => {
+    const [key, argument = ""] = attribute.split("=").map(part => part.trim().toLowerCase());
+    return (key === "max-age" && Number(argument) <= 0)
+      || (key === "expires" && Date.parse(argument) <= now);
+  });
+  const entries = current ? current.split("; ").filter(entry => !entry.startsWith(`${name}=`)) : [];
+  if (!expired) entries.push(`${name}=${value}`);
+  return entries.join("; ");
+}