buninu-browser 0.5.1 → 0.6.0

package/lib/media/mp4-keyframes.js

@@ -0,0 +1,144 @@
+// Fragmented MP4 sync-sample decode times are seek candidates, not decoded
+// presentation timestamps. The caller must verify them against its decoder.
+// Unsupported layouts return null and retain the ordinary seek search.
+const cache = new WeakMap();
+const MAX_BOXES = 32768, MAX_SAMPLES = 250000, MAX_KEYS = 16384;
+
+export function mp4KeyframeBefore(bytes, seconds) {
+  if (!(bytes instanceof Uint8Array) || !Number.isFinite(seconds)) return null;
+  let index = cache.get(bytes);
+  if (index === undefined) {
+    try { index = inspect(bytes); } catch { index = null; }
+    cache.set(bytes, index);
+  }
+  if (!index?.length) return null;
+  let low = 0, high = index.length;
+  while (low < high) {
+    const mid = (low + high) >>> 1;
+    if (index[mid] <= seconds) low = mid + 1;
+    else high = mid;
+  }
+  return low ? index[low - 1] : null;
+}
+
+function inspect(bytes) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let boxesSeen = 0, samplesSeen = 0;
+  const u32 = (at, end) => {
+    if (at < 0 || at + 4 > end) throw Error('short MP4 field');
+    return view.getUint32(at);
+  };
+  const u64 = (at, end) => {
+    const value = u32(at, end) * 0x100000000 + u32(at + 4, end);
+    if (!Number.isSafeInteger(value)) throw Error('large MP4 timestamp');
+    return value;
+  };
+  const boxes = (from, end) => {
+    const result = [];
+    for (let at = from; at < end;) {
+      if (++boxesSeen > MAX_BOXES) throw Error('too many MP4 boxes');
+      let size = u32(at, end), header = 8;
+      const type = String.fromCharCode(...bytes.subarray(at + 4, at + 8));
+      if (at + header > end) throw Error('short MP4 box');
+      if (size === 1) { size = u64(at + 8, end); header = 16; }
+      else if (size === 0) size = end - at;
+      if (size < header || size > end - at) throw Error('invalid MP4 box size');
+      result.push({ type, data: at + header, end: at + size });
+      at += size;
+    }
+    return result;
+  };
+  const children = box => boxes(box.data, box.end);
+  const one = (list, type) => {
+    const matches = list.filter(box => box.type === type);
+    if (matches.length !== 1) throw Error(`missing/duplicate ${type}`);
+    return matches[0];
+  };
+  const version = box => {
+    u32(box.data, box.end);
+    if (bytes[box.data] > 1) throw Error('unknown MP4 version');
+    return bytes[box.data];
+  };
+  const flags = box => u32(box.data, box.end) & 0xffffff;
+  const top = boxes(0, bytes.length), movie = children(one(top, 'moov'));
+  const defaults = new Map();
+  for (const box of children(one(movie, 'mvex'))) if (box.type === 'trex') {
+    if (version(box) !== 0 || defaults.size >= 32) return null;
+    const id = u32(box.data + 4, box.end);
+    if (defaults.has(id) || u32(box.data + 8, box.end) !== 1) return null;
+    defaults.set(id, { duration: u32(box.data + 12, box.end), flags: u32(box.data + 20, box.end) });
+  }
+  let track = null;
+  for (const box of movie) if (box.type === 'trak') {
+    const nodes = children(box), media = children(one(nodes, 'mdia'));
+    const handler = one(media, 'hdlr');
+    if (u32(handler.data + 8, handler.end) !== 0x76696465) continue; // vide
+    if (track) return null;
+    const edits = nodes.filter(box => box.type === 'edts');
+    if (edits.length > 1) return null;
+    if (edits.length) {
+      const edit = one(children(edits[0]), 'elst'), wide = version(edit) === 1;
+      if (u32(edit.data + 4, edit.end) !== 1) return null;
+      const mediaTimeAt = edit.data + (wide ? 16 : 12), rateAt = edit.data + (wide ? 24 : 16);
+      if (u32(mediaTimeAt, edit.end) & 0x80000000 || u32(rateAt, edit.end) !== 0x00010000) return null;
+      // Only a single forward unit-rate edit is considered. Its offset is
+      // deliberately not presented as a decoder timestamp: seek boundary
+      // verification must still succeed before this candidate can be used.
+    }
+    const header = one(nodes, 'tkhd'), timing = one(media, 'mdhd');
+    const id = u32(header.data + (version(header) ? 20 : 12), header.end);
+    const timescale = u32(timing.data + (version(timing) ? 20 : 12), timing.end);
+    if (!timescale || !defaults.has(id)) return null;
+    track = { id, timescale, ...defaults.get(id) };
+  }
+  if (!track) return null;
+  const keys = [];
+  let lastDecodeTime = -1;
+  for (const moof of top) if (moof.type === 'moof') {
+    for (const traf of children(moof)) if (traf.type === 'traf') {
+      const nodes = children(traf), header = one(nodes, 'tfhd');
+      if (u32(header.data + 4, header.end) !== track.id) continue;
+      if (version(header) !== 0 || nodes.some(box => box.type === 'sbgp' || box.type === 'sgpd')) return null;
+      const hf = flags(header);
+      if (hf & ~0x02003b) return null;
+      let cursor = header.data + 8, duration = track.duration, sampleFlags = track.flags;
+      if (hf & 1) cursor += 8;
+      if (hf & 2) { if (u32(cursor, header.end) !== 1) return null; cursor += 4; }
+      if (hf & 8) { duration = u32(cursor, header.end); cursor += 4; }
+      if (hf & 16) cursor += 4;
+      if (hf & 32) { sampleFlags = u32(cursor, header.end); cursor += 4; }
+      if (cursor > header.end) return null;
+      const timing = one(nodes, 'tfdt');
+      let time = version(timing) ? u64(timing.data + 4, timing.end) : u32(timing.data + 4, timing.end);
+      for (const run of nodes) if (run.type === 'trun') {
+        version(run);
+        const rf = flags(run), count = u32(run.data + 4, run.end);
+        if (rf & ~0xf05 || (rf & 4) && (rf & 0x400)) return null;
+        samplesSeen += count;
+        if (samplesSeen > MAX_SAMPLES) return null;
+        cursor = run.data + 8;
+        if (rf & 1) cursor += 4;
+        let firstFlags = sampleFlags;
+        if (rf & 4) { firstFlags = u32(cursor, run.end); cursor += 4; }
+        for (let i = 0; i < count; i++) {
+          let step = duration, sf = i === 0 ? firstFlags : sampleFlags;
+          if (rf & 0x100) { step = u32(cursor, run.end); cursor += 4; }
+          if (rf & 0x200) cursor += 4;
+          if (rf & 0x400) { sf = u32(cursor, run.end); cursor += 4; }
+          if (rf & 0x800) cursor += 4; // composition offset does not change decode time
+          if (cursor > run.end || !step || time < lastDecodeTime) return null;
+          const depends = (sf >>> 24) & 3;
+          if (depends === 3) return null;
+          if (!(sf & 0x10000) && depends !== 1) {
+            if (keys.length >= MAX_KEYS) return null;
+            keys.push(time / track.timescale);
+          }
+          lastDecodeTime = time;
+          time += step;
+          if (!Number.isSafeInteger(time)) return null;
+        }
+      }
+    }
+  }
+  return keys;
+}

package/lib/media/video-keyframe.js

@@ -1,20 +1,48 @@
 // wasmpeg seeks to a keyframe without returning its timestamp. Locate it by
 // comparing tiny decoded probes, then rewind before delivering full frames.
-export function seekVideoKeyframe(decoder, seconds, startTime = 0) {
+import { mp4KeyframeBefore } from './mp4-keyframes.js';
+
+export function seekVideoKeyframe(decoder, seconds, startTime = 0, bytes = null) {
   const start = Math.max(0, startTime);
   seconds = Math.max(start, seconds);
   const seek = time => decoder.seek(Math.max(1, time * 1000));
   const frame = 1 / (decoder.fps || 30);
   if (!(seconds >= start + frame)) { seek(start); return start; }
+  let lastPixels = null;
   const probe = time => {
     seek(time);
     const pixels = decoder.nextFrame(32, 18);
+    lastPixels = pixels;
     if (!pixels) return null;
     let hash = 0x811c9dc5;
     for (let i = 0; i < pixels.length; i += 3) hash = Math.imul(hash ^ pixels[i], 0x01000193);
     return hash >>> 0;
   };
   const target = probe(seconds);
+  const candidate = bytes && mp4KeyframeBefore(bytes, seconds);
+  if (target !== null && candidate !== null && candidate >= start && frame >= 0.001) {
+    // A container index narrows the search; it cannot establish what a
+    // decoder actually returned. Require the same complete tiny picture at
+    // the candidate and a different one just before its seek boundary.
+    // This preserves the existing decode-time convention, not guessed PTS.
+    const targetPixels = lastPixels.slice();
+    const samePicture = () => lastPixels?.length === targetPixels.length
+      && targetPixels.every((byte, i) => byte === lastPixels[i]);
+    // The decoder's seek API rounds to integer milliseconds; do not round
+    // a fractional keyframe time down into the preceding GOP.
+    const candidateSeek = Math.ceil(candidate * 1000) / 1000;
+    try {
+      probe(candidateSeek);
+      if (samePicture()) {
+        const atStart = candidate === start;
+        if (!atStart) probe(Math.max(start, candidate - frame));
+        if (atStart || (lastPixels && !samePicture())) { seek(candidateSeek); return candidate; }
+      }
+    } catch {
+      // An optional index hint must not turn a working decoder search into
+      // an open failure. Errors from the original search still propagate.
+    }
+  }
   let keyframe = seconds;
   if (target !== null) {
     let distance = 10;

package/lib/media/webm-snapshots.js

@@ -0,0 +1,282 @@
+import { ebmlHeader } from './webm-stream.js';
+
+const CLUSTER = 0x1f43b675;
+const MAX_RECORDS = 250_000;
+const OPUS_RATE = 48_000;
+const join = parts => parts.length === 1 ? parts[0] : new Uint8Array(Bun.concatArrayBuffers(parts));
+
+// Decode-time snapshots for a single Opus track. A PCM-only decoder cannot
+// represent holes in a WebM timeline: concatenating 0..2s and 6..8s produces
+// four seconds of samples, not eight. Keep each contiguous run independently
+// decodable, without changing any packet or inventing samples for the hole.
+export function createWebMAudioSnapshots() {
+  const headers = [], records = [];
+  let scale = 1_000_000, track = null, valid = true, runs = null, serial = 0, ordered = true;
+  let preroll = 1, cached = null, initHeaders = null;
+  const uint = (bytes, from, size) => {
+    if (size < 1 || size > 6 || from + size > bytes.length) throw Error('invalid integer');
+    let value = 0;
+    for (let i = 0; i < size; i++) value = value * 256 + bytes[from + i];
+    return value;
+  };
+  const children = (bytes, from, end) => {
+    const result = [];
+    for (let at = from; at < end;) {
+      if (result.length >= 65_536) throw Error('too many elements');
+      const head = ebmlHeader(bytes, at);
+      if (!head || !Number.isFinite(head.size) || head.size > end - at - head.length) throw Error('incomplete element');
+      const data = at + head.length;
+      result.push({ id: head.id, start: at, data, size: head.size, end: data + head.size });
+      at = data + head.size;
+    }
+    return result;
+  };
+  const payload = bytes => {
+    const head = ebmlHeader(bytes);
+    if (!head || head.size !== bytes.length - head.length) throw Error('incomplete element');
+    return children(bytes, head.length, bytes.length);
+  };
+  const opusSamples = (bytes, at, end) => {
+    if (at >= end) throw Error('empty packet');
+    const toc = bytes[at], config = toc >> 3;
+    const frame = config >= 16 ? 2.5 * 2 ** (config & 3)
+      : config >= 12 ? 10 * 2 ** (config & 1) : [10, 20, 40, 60][config & 3];
+    const code = toc & 3;
+    if (code === 3 && at + 1 >= end) throw Error('incomplete packet');
+    const count = code === 0 ? 1 : code === 3 ? bytes[at + 1] & 63 : 2;
+    const samples = frame * count * 48;
+    if (!count || samples > 5760) throw Error('invalid Opus duration');
+    return samples;
+  };
+  const blockRange = (bytes, block, origin) => {
+    const from = block.data;
+    if (!bytes[from]) throw Error('invalid track');
+    let length = 1, marker = 0x80;
+    while (!(bytes[from] & marker)) { length++; marker >>= 1; }
+    if (length > 6 || from + length + 3 > block.end) throw Error('invalid block');
+    let number = bytes[from] & (marker - 1);
+    for (let i = 1; i < length; i++) number = number * 256 + bytes[from + i];
+    if (number !== track) throw Error('another track');
+    const at = from + length;
+    // Lacing requires a separate packet table; leave that format on the
+    // ordinary decoder path until its timing can be proved as well.
+    if (bytes[at + 2] & 6) throw Error('laced block');
+    const relative = new DataView(bytes.buffer, bytes.byteOffset + at, 2).getInt16(0);
+    const start = (origin + relative) * scale / 1e9;
+    if (!Number.isFinite(start) || start < 0) throw Error('invalid timestamp');
+    const samples = opusSamples(bytes, at + 3, block.end);
+    return { start, end: start + samples / OPUS_RATE, samples };
+  };
+  const record = (element) => {
+    const { bytes, cluster } = element;
+    const items = cluster ? children(bytes, 0, bytes.length) : payload(bytes);
+    if (!cluster) {
+      // A finite Cluster can contain many seconds of Opus. Index its complete
+      // packets just like a live Cluster, so reopening keeps the requested
+      // preroll instead of decoding everything from the Cluster's beginning.
+      // Only the size field changes; timestamps and encoded Blocks stay intact.
+      const head = ebmlHeader(bytes), header = bytes.slice(0, head.length);
+      const width = head.length - 4; // Cluster ID is always four bytes.
+      header[4] = (1 << (9 - width)) - 1;
+      header.fill(0xff, 5);
+      const prefix = [header], blocks = [];
+      let time = null;
+      for (const item of items) {
+        if (item.id === 0xa3 || item.id === 0xa0) {
+          blocks.push(bytes.subarray(item.start, item.end));
+        } else if (!blocks.length && (item.id === 0xec || (item.id === 0xe7 && time == null))) {
+          if (item.id === 0xe7) time = uint(bytes, item.data, item.size);
+          prefix.push(bytes.subarray(item.start, item.end));
+        } else {
+          // CRC/Position/PrevSize describe the original complete Cluster;
+          // encrypted or unknown metadata cannot safely survive this cut.
+          throw Error('unsupported finite cluster metadata');
+        }
+      }
+      if (time == null) throw Error('missing cluster time');
+      // This prefix cannot grow, unlike a live Cluster's mutable metadata.
+      // Share it across packet records instead of copying metadata N times.
+      Object.freeze(prefix);
+      const token = {};
+      for (const block of blocks) record({ bytes: block, cluster: { token, time, prefix, sharedPrefix: true } });
+      return;
+    }
+    let origin = cluster?.time;
+    if (origin == null) {
+      const time = items.find(item => item.id === 0xe7);
+      if (!time) throw Error('missing cluster time');
+      origin = uint(bytes, time.data, time.size);
+    }
+    let start = null, end = null, samples = 0, padded = false;
+    for (const item of items) {
+      let block = item, padding = 0;
+      if (item.id === 0xa0) {
+        const group = children(bytes, item.data, item.end);
+        block = group.find(child => child.id === 0xa1);
+        const discard = group.find(child => child.id === 0x75a2);
+        if (discard) {
+          if (bytes[discard.data] & 0x80) throw Error('negative discard padding');
+          padding = uint(bytes, discard.data, discard.size) / 1e9;
+        }
+      } else if (item.id !== 0xa3) continue;
+      if (!block) throw Error('missing block');
+      const range = blockRange(bytes, block, origin);
+      range.end -= padding;
+      if (range.end <= range.start) throw Error('invalid padding');
+      if (end != null && Math.abs(range.start - end) > scale / 1e9 + 1e-6) throw Error('discontinuous cluster');
+      start ??= range.start;
+      end = range.end;
+      samples += range.samples;
+      padded ||= padding > 0;
+    }
+    if (start == null) return;
+    if (records.length >= MAX_RECORDS) throw Error('too many blocks');
+    if ((cluster?.prefix.length ?? 0) > 65_536) throw Error('too much cluster metadata');
+    initHeaders ??= headers.slice();
+    const inOrder = !records.length || start >= records.at(-1).start;
+    if (!inOrder) ordered = false;
+    const entry = { id: ++serial, start, end, samples, padded, bytes, token: cluster?.token,
+      prefix: cluster && (cluster.sharedPrefix ? cluster.prefix : cluster.prefix.slice()) };
+    records.push(entry);
+    // Ordered appends update only the final run, even for live Clusters which
+    // emit one record per packet. An out-of-order append rebuilds once on use.
+    if (runs && inOrder && start >= runs.at(-1).end - scale / 1e9 - 1e-6) addEntry(runs, entry);
+    else runs = null;
+    cached = null;
+  };
+  const addEntry = (result, entry) => {
+    let run = result.at(-1);
+    const tolerance = scale / 1e9 + 1e-6;
+    if (run && entry.start < run.end - tolerance) throw Error('overlapping clusters');
+    if (!run || entry.start > run.end + tolerance) {
+      run = { id: entry.id, startTime: entry.start, end: entry.end,
+        startSample: Math.round(entry.start * OPUS_RATE), headers: initHeaders, entries: [], samples: 0, exact: true };
+      result.push(run);
+    }
+    // Packet sample counts are exact; millisecond Block timestamps are not.
+    // Reopening reapplies Opus pre-skip, cancelling the initial decoder's
+    // pre-skip, so the new origin advances by encoded samples, not rounded PTS.
+    const timestamp = run.startTime + run.samples / OPUS_RATE;
+    // Round the initial cursor once, as openAudioDecoder does, then add integer
+    // samples. Rounding (fractional origin + elapsed time) can move a sample.
+    entry.origin = (run.startSample + run.samples) / OPUS_RATE;
+    entry.seekable = run.exact && Math.abs(entry.start - timestamp) <= tolerance;
+    run.samples += entry.samples;
+    run.exact &&= entry.seekable && !entry.padded && Number.isSafeInteger(run.samples);
+    run.entries.push(entry);
+    run.end = entry.end;
+  };
+  const buildRuns = () => {
+    const sorted = ordered ? records : records.slice().sort((a, b) => a.start - b.start);
+    const result = [];
+    for (const entry of sorted) addEntry(result, entry);
+    return result;
+  };
+  return {
+    // Called only after SourceBuffer's existing retry/deduplication checks.
+    append(element) {
+      if (!valid) return;
+      try {
+        const { id, bytes } = element;
+        if (id === CLUSTER) {
+          if (track == null) throw Error('missing supported track');
+          record(element);
+          return;
+        }
+        if (records.length) {
+          // Metadata at EOF does not belong in a run; a new initialization
+          // needs a separate codec epoch, which this small index declines.
+          if ([0x1a45dfa3, 0x18538067, 0x1549a966, 0x1654ae6b].includes(id)) throw Error('new initialization');
+          return;
+        }
+        if (id === 0x1549a966) {
+          const time = payload(bytes).find(item => item.id === 0x2ad7b1);
+          if (time) scale = uint(bytes, time.data, time.size);
+          if (!(scale > 0)) throw Error('invalid timestamp scale');
+        } else if (id === 0x1654ae6b) {
+          const tracks = payload(bytes).filter(item => item.id === 0xae);
+          if (tracks.length !== 1 || track != null) throw Error('multiple tracks');
+          const fields = children(bytes, tracks[0].data, tracks[0].end);
+          const field = id => fields.find(item => item.id === id);
+          if (field(0x6d80)) throw Error('encoded or encrypted track');
+          const number = field(0xd7), type = field(0x83), codec = field(0x86), priv = field(0x63a2), delay = field(0x56aa);
+          if (!number || !type || !codec || !priv || !delay || uint(bytes, type.data, type.size) !== 2
+            || new TextDecoder().decode(bytes.subarray(codec.data, codec.end)) !== 'A_OPUS'
+            || priv.size < 19 || new TextDecoder().decode(bytes.subarray(priv.data, priv.data + 8)) !== 'OpusHead') throw Error('unsupported audio track');
+          const skip = bytes[priv.data + 10] | (bytes[priv.data + 11] << 8);
+          // Opening a new run reapplies Opus pre-skip. CodecDelay must match
+          // that skip, making the first decoded sample's origin its original
+          // Block timestamp; later cuts advance by exact packet sample counts.
+          if (Math.abs(uint(bytes, delay.data, delay.size) - skip * 1e9 / 48000) > 1) throw Error('inconsistent codec delay');
+          const seek = field(0x56bb);
+          // Matroska's Opus SeekPreRoll recommends 80ms. Keep at least one
+          // second to restore decoder state before returning audible PCM.
+          if (seek) preroll = Math.max(preroll, uint(bytes, seek.data, seek.size) / 1e9);
+          track = uint(bytes, number.data, number.size);
+          if (!(track > 0)) throw Error('invalid track');
+        }
+        if (headers.length >= 65_536) throw Error('too many headers');
+        headers.push(bytes);
+      } catch {
+        valid = false;
+        headers.length = records.length = 0;
+        runs = cached = initHeaders = null;
+      }
+    },
+    at(seconds, fallback) {
+      const ordinary = () => ({ id: 0, startTime: 0, endTime: Infinity, bytes: fallback() });
+      if (!valid || !records.length) return ordinary();
+      try {
+        runs ??= buildRuns();
+        let low = 0, high = runs.length;
+        while (low + 1 < high) {
+          const mid = (low + high) >>> 1;
+          if (runs[mid].startTime <= seconds + 1e-6) low = mid;
+          else high = mid;
+        }
+        const selected = runs[low], endTime = runs[low + 1]?.startTime ?? Infinity;
+        const entries = selected.entries, count = entries.length;
+        let first = 0;
+        high = count;
+        const latest = seconds - preroll;
+        while (first + 1 < high) {
+          const mid = (first + high) >>> 1;
+          if (entries[mid].origin <= latest) first = mid;
+          else high = mid;
+        }
+        if (!entries[first].seekable) first = 0;
+        if (!first && runs.length === 1 && ordered) {
+          // Keep the initial full-file path, pre-skip and trailing metadata.
+          return { id: selected.id, startTime: selected.startTime, endTime, bytes: fallback() };
+        }
+        if (cached?.run === selected && cached.first === first && cached.count === count && cached.endTime === endTime) return cached.snapshot;
+        let bytes;
+        const snapshot = { id: selected.id, startTime: first ? entries[first].origin : selected.startTime, endTime,
+          get bytes() {
+            if (!bytes) {
+              const parts = selected.headers.slice();
+              let token = null;
+              for (let i = first; i < count; i++) {
+                const entry = entries[i];
+                if (entry.token && entry.token !== token) for (const part of entry.prefix) parts.push(part);
+                parts.push(entry.bytes);
+                token = entry.token;
+              }
+              bytes = join(parts);
+            }
+            return bytes;
+          } };
+        // Metadata notifications only read id/endTime; do not copy the audio
+        // there. The getter's fixed record count keeps its snapshot immutable
+        // if more packets append before decoding. Cache only the latest view.
+        cached = { run: selected, first, count, endTime, snapshot };
+        return snapshot;
+      } catch {
+        valid = false;
+        headers.length = records.length = 0;
+        runs = cached = initHeaders = null;
+        return ordinary();
+      }
+    },
+  };
+}

package/lib/network/cookie-jar.js

@@ -16,10 +16,10 @@ export class CookieJar {
   }
 
   /** Stores Set-Cookie header values received for `url`. `fromScript` rejects HttpOnly (document.cookie). */
-  store(url, setCookies, { fromScript = false } = {}) {
+  store(url, setCookies, { fromScript = false, receivedAt = this.#now() } = {}) {
     const target = new URL(url);
     for (const header of setCookies) {
-      const cookie = parseSetCookie(header, target, this.#now());
+      const cookie = parseSetCookie(header, target, receivedAt);
       if (!cookie) continue;
       if (fromScript && cookie.httpOnly) continue;
       if (cookie.secure && target.protocol !== "https:" && !isLocalhost(target.hostname)) continue;
@@ -69,6 +69,22 @@ export class CookieJar {
     return this.header(url, { includeHttpOnly: false });
   }
 
+  /** Non-HttpOnly records a renderer of this origin may mirror, including all paths. */
+  scriptSnapshot(url) {
+    const target = new URL(url), now = this.#now();
+    return this.#cookies.filter(cookie => !cookie.httpOnly && cookie.expires > now
+      && domainMatches(cookie, target.hostname)
+      && (!cookie.secure || target.protocol === "https:" || isLocalhost(target.hostname)))
+      .map(cookie => ({ ...cookie }));
+  }
+
+  /** Replace a renderer's script-only mirror with a trusted controller snapshot. */
+  replaceScriptSnapshot(cookies) {
+    const now = this.#now();
+    this.#cookies = cookies.filter(cookie => !cookie.httpOnly && cookie.expires > now)
+      .map(cookie => ({ ...cookie, httpOnly: false }));
+  }
+
   get size() {
     return this.#cookies.length;
   }

package/lib/paint/display-list.js

@@ -405,7 +405,8 @@ function paintEffects(layout, tree, scrollOffsetOf = null) {
         if (!style) continue;
         if (style.position === "fixed") fixed = true;
         opacity *= style.opacity ?? 1;
-        clips.push([node, shapeClip(node)]);
+        const shape = shapeClip(node);
+        if (shape) clips.push([node, shape]);
         const ownContent = kind === "text" || node !== owner;
         if (ownContent && escaping !== "fixed") {
           const positioned = style.position && style.position !== "static";
@@ -415,7 +416,7 @@ function paintEffects(layout, tree, scrollOffsetOf = null) {
             if (radii) {
               radii = insetRadii(radii, style.borderWidths ?? [0, 0, 0, 0]);
             }
-            clips.push([node, clip, radii]);
+            if (clip) clips.push([node, clip, radii]);
             if (isScroller(style) && boxes.has(node.id)) {
               if (!scrolledBy.size) outOfFlow = positionedOut;
               scrolledBy.add(node);
@@ -435,7 +436,7 @@ function paintEffects(layout, tree, scrollOffsetOf = null) {
         const node = chain[index];
         const own = ownTransform(node);
         if (own) transform = transform ? composeTransforms(transform, own) : own;
-        transforms.set(node, transform);
+        if (transform) transforms.set(node, transform);
         const offset = scrolledBy.has(node) ? scrollOffsetOf?.(node.domNode) : null;
         if (offset && (offset.x || offset.y)) {
           const scrolled = { a: 1, d: 1, e: 0 - offset.x, f: 0 - offset.y };

package/lib/paint/frame.js

@@ -117,11 +117,18 @@ export function backgroundBytes(color) {
 }
 
 /** Raw screenshot payload, owned independently of a recyclable raster tile. */
-export function rawFrame(pixels, width, height, format) {
-  if (!['rgba', 'bgra'].includes(format) || width * height > 16777216) throw Error('Invalid raw screenshot');
-  const data = new Uint8Array(pixels);
-  if (format === 'bgra') {
-    for (let i=0; i<data.length; i+=4) { const red=data[i]; data[i]=data[i+2]; data[i+2]=red; }
+export function rawFrame(pixels, width, height, format, { takeOwnership = false, inputFormat = "rgba" } = {}) {
+  if (!['rgba', 'bgra'].includes(format) || !['rgba', 'bgra'].includes(inputFormat) || width * height > 16777216) throw Error('Invalid raw screenshot');
+  // Only private composition/crop snapshots may be consumed in place. The
+  // default keeps raw captures independent of immutable/recyclable tiles.
+  const data = takeOwnership && pixels.buffer instanceof ArrayBuffer && pixels.byteOffset % 4 === 0 ? pixels : new Uint8Array(pixels);
+  if (format !== inputFormat) {
+    // Swap R/B as packed pixels, preserving G and alpha (Bun targets are little-endian).
+    const words = new Uint32Array(data.buffer, data.byteOffset, Math.floor(data.byteLength / 4));
+    for (let i = 0; i < words.length; i++) {
+      const p = words[i];
+      words[i] = (p & 0xff00ff00) | ((p & 0xff) << 16) | ((p >>> 16) & 0xff);
+    }
   }
   return {format, width, height, pixels:data};
 }

package/lib/render-tree/index.js

@@ -315,6 +315,9 @@ function sameNodeProperties(previous, type, properties) {
   for (const [key, value] of Object.entries(properties)) {
     const old = previous[key];
     if (old === value) continue;
+    // Extraction makes fresh immutable SVG values even when their paint is
+    // unchanged. Retain the node so its ancestors can reuse layout results.
+    if (key === "svg" && Bun.deepEquals(old, value, true)) continue;
     if (key !== "children" || old.length !== value.length) return false;
     for (let index = 0; index < old.length; index++) if (old[index] !== value[index]) return false;
   }

package/lib/renderer/animation-frames.js

@@ -0,0 +1,76 @@
+import { drainMicrotasks } from "bun:jsc";
+import { createTimers } from "./timers.js";
+
+// Older Bun checkpoints also dispatched queued event-loop tasks. Although
+// 1.4.3 stable fixed this, Bun.version hides the suffix of unsafe 1.4.3
+// canaries. Require the later 1.4.4 branch and keep unknown channels on timers.
+export function supportsFrameCheckpoint(version = Bun.version) {
+  const match = typeof version === "string"
+    && /^((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?:-canary(?:\.(?:0|[1-9]\d*))?)?$/.exec(version);
+  return !!match && Bun.semver.order(match[1], "1.4.4") >= 0;
+}
+
+/** One callback collection per document, with a checkpoint between callbacks. */
+export function createAnimationFrames({ invoke, now, checkpoint = drainMicrotasks,
+  frameTimers = null }) {
+  let nextWakeId = 1;
+  // A private timer collection keeps frame handles separate from Window timers.
+  // timerTask=false also prevents a frame inheriting a timer's nesting clamp.
+  const timers = frameTimers ?? createTimers({ invoke: callback => callback(), nextId: () => nextWakeId++ });
+  const callbacks = new Map();
+  let nextHandle = 0, wake = null, running = false, disposed = false;
+
+  function arm(delay) {
+    if (!disposed && wake === null && !running && callbacks.size) {
+      wake = timers.schedule(deliver, delay, false, false);
+    }
+  }
+  function deliver() {
+    wake = null;
+    if (disposed) return;
+    running = true;
+    const timestamp = now(), handles = [...callbacks.keys()];
+    try {
+      for (const handle of handles) {
+        if (disposed) break;
+        const callback = callbacks.get(handle);
+        if (callback === undefined) continue;
+        callbacks.delete(handle);
+        // invoke reports page exceptions. Drain the complete promise/microtask
+        // queue here, without yielding unrelated timers or I/O between callbacks.
+        try { invoke(callback, timestamp); }
+        finally { checkpoint(); }
+      }
+    } finally {
+      running = false;
+      // Callbacks registered during delivery, including its microtasks, belong
+      // to the next frame. Long callbacks do not add another fixed 16 ms delay.
+      arm(Math.max(0, Math.ceil(16 - (now() - timestamp))));
+    }
+  }
+  return {
+    request(callback) {
+      if (typeof callback !== "function") throw new TypeError("requestAnimationFrame callback must be a function");
+      do { nextHandle = (nextHandle + 1) >>> 0; } while (callbacks.has(nextHandle));
+      const handle = nextHandle;
+      if (!disposed) {
+        callbacks.set(handle, callback);
+        arm(16);
+      }
+      return handle;
+    },
+    cancel(handle) {
+      callbacks.delete(+handle >>> 0);
+      if (!callbacks.size && wake !== null) {
+        timers.cancel(wake);
+        wake = null;
+      }
+    },
+    dispose() {
+      disposed = true;
+      callbacks.clear();
+      timers.dispose();
+      wake = null;
+    },
+  };
+}

package/lib/renderer/bindings.js

@@ -777,6 +777,7 @@ class ElementBinding extends ParentBinding {
   load() {
     if (!isMedia(this)) return;
     realmOf(this).hooks.pauseMedia?.(nodeOf(this));
+    realmOf(this).hooks.reselectMedia?.(nodeOf(this));
     void realmOf(this).hooks.seekMedia?.(nodeOf(this), 0);
   }
 
@@ -918,6 +919,7 @@ class ElementBinding extends ParentBinding {
       if (resetsCanvas) resetCanvas(node);
       touch(this);
     }
+    if (attribute.toLowerCase() === "src" && isMedia(this)) realmOf(this).hooks.attachMediaSrc?.(node, node.src);
   }
 
   removeAttribute(name) {