chrome-in-iframe 2.0.0 → 2.1.0

package/dist/index.js

@@ -1,6 +1,32 @@
 import { nanoid } from 'nanoid';
 import { LRUCache } from 'lru-cache';
 
+const TRANSPORT_DETACHED = Symbol.for('chrome-in-iframe.transport-detached');
+function isTransportDetachedError(err) {
+    return err instanceof Error && err[TRANSPORT_DETACHED] === true;
+}
+function createTransportDetachedError(message) {
+    const err = new Error(message);
+    Object.defineProperty(err, TRANSPORT_DETACHED, { value: true, enumerable: false });
+    return err;
+}
+
+const PREFIX = 'chrome-in-iframe';
+const defaultLogger = (scope, ...args) => {
+    if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+        console.warn(`[${PREFIX}] ${scope}`, ...args);
+    }
+};
+let activeLogger = defaultLogger;
+function setLogger(logger) {
+    activeLogger = logger;
+}
+function warn(scope, ...args) {
+    if (!activeLogger)
+        return;
+    activeLogger(scope, ...args);
+}
+
 const WELL_KNOWN_SYMBOLS = {
     asyncIterator: Symbol.asyncIterator,
     hasInstance: Symbol.hasInstance,
@@ -16,22 +42,52 @@ const WELL_KNOWN_SYMBOLS = {
     toStringTag: Symbol.toStringTag,
     unscopables: Symbol.unscopables,
 };
+const WELL_KNOWN_SYMBOL_NAMES = new Map(Object.entries(WELL_KNOWN_SYMBOLS).map(([name, symbol]) => [symbol, name]));
 function getWellKnownSymbolName(value) {
-    for (const [name, symbol] of Object.entries(WELL_KNOWN_SYMBOLS)) {
-        if (symbol === value)
-            return name;
-    }
-    return undefined;
+    return WELL_KNOWN_SYMBOL_NAMES.get(value);
 }
 function getWellKnownSymbol(name) {
     return WELL_KNOWN_SYMBOLS[name];
 }
+function encodeSymbolToken(value, context) {
+    const globalKey = Symbol.keyFor(value);
+    if (globalKey)
+        return `global:${globalKey}`;
+    const wellKnownName = getWellKnownSymbolName(value);
+    if (wellKnownName)
+        return `wellKnown:${wellKnownName}`;
+    throw new TypeError(context ? `Cannot serialize non-global symbol ${context}` : 'Cannot serialize non-global symbol');
+}
+function decodeSymbolToken(value, context) {
+    if (value.startsWith('global:')) {
+        return Symbol.for(value.slice('global:'.length));
+    }
+    if (value.startsWith('wellKnown:')) {
+        const symbol = getWellKnownSymbol(value.slice('wellKnown:'.length));
+        if (symbol)
+            return symbol;
+    }
+    throw new TypeError(context ? `Cannot deserialize symbol ${context}` : 'Cannot deserialize symbol');
+}
+function setOwnProperty(target, key, value) {
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+}
 function serializeThrownError(err) {
     if (err instanceof Error) {
         return { message: err.message, stack: err.stack };
     }
     return { message: String(err) };
 }
+function isPromiseLike(value) {
+    return (value !== null &&
+        (typeof value === 'object' || typeof value === 'function') &&
+        typeof value.then === 'function');
+}
 
 function serializePath(path) {
     return path.map((key) => {
@@ -39,7 +95,7 @@ function serializePath(path) {
             return key;
         return {
             $type: 'symbol',
-            value: serializeSymbol$1(key),
+            value: encodeSymbolToken(key, 'path key'),
         };
     });
 }
@@ -47,7 +103,7 @@ function deserializePath(path) {
     return path.map((key) => {
         if (typeof key === 'string')
             return key;
-        return deserializeSymbol$1(key.value);
+        return decodeSymbolToken(key.value, 'path key');
     });
 }
 function isSerializedPath(value) {
@@ -61,26 +117,6 @@ function isSerializedPathKey(value) {
     const record = value;
     return record.$type === 'symbol' && typeof record.value === 'string';
 }
-function serializeSymbol$1(value) {
-    const globalKey = Symbol.keyFor(value);
-    if (globalKey)
-        return `global:${globalKey}`;
-    const wellKnownName = getWellKnownSymbolName(value);
-    if (wellKnownName)
-        return `wellKnown:${wellKnownName}`;
-    throw new TypeError('Cannot serialize non-global symbol path key');
-}
-function deserializeSymbol$1(value) {
-    if (value.startsWith('global:')) {
-        return Symbol.for(value.slice('global:'.length));
-    }
-    if (value.startsWith('wellKnown:')) {
-        const symbol = getWellKnownSymbol(value.slice('wellKnown:'.length));
-        if (symbol)
-            return symbol;
-    }
-    throw new TypeError('Cannot deserialize symbol path key');
-}
 
 function createMessageSender(poster, key, instanceId) {
     return {
@@ -91,7 +127,7 @@ function createMessageSender(poster, key, instanceId) {
                 data: serializeMessageData(type, data),
                 senderInstanceId: instanceId,
             };
-            if (targetInstanceId)
+            if (targetInstanceId !== undefined)
                 body.targetInstanceId = targetInstanceId;
             poster.postMessage(JSON.stringify(body));
         },
@@ -115,17 +151,58 @@ function serializeMessageData(type, data) {
     return data;
 }
 
+const MAX_PATH_LENGTH = 64;
+const MAX_INVOKE_ARGS = 1024;
+const MAX_MESSAGE_LENGTH = 1000000;
+const MAX_RELEASE_IDS = 10000;
+const MAX_ID_LENGTH = 200;
+const MAX_TYPE_LENGTH = 64;
+const MESSAGE_SPECS = {
+    connectRequest: { validate: isConnectMessage },
+    connectResponse: { validate: isConnectMessage },
+    invokeRequest: {
+        validate: isInvokeRequest,
+        preDeserialize: (data) => ({ ...data, path: deserializePath(data.path) }),
+        errorResponse: { type: 'invokeResponse', extractId: (data) => data.id },
+    },
+    invokeResponse: { validate: isResponse },
+    accessPropertyRequest: {
+        validate: isAccessPropertyRequest,
+        preDeserialize: (data) => ({ ...data, path: deserializePath(data.path) }),
+        errorResponse: { type: 'accessPropertyResponse', extractId: (data) => data.id },
+    },
+    accessPropertyResponse: { validate: isResponse },
+    invokeFunctionByIdRequest: {
+        validate: isCallbackRequest,
+        errorResponse: { type: 'invokeFunctionByIdResponse', extractId: (data) => data.callId },
+    },
+    invokeFunctionByIdResponse: { validate: isResponse },
+    releaseCallbacks: { validate: isReleaseCallbacks },
+    destroyEndpoint: { validate: isDestroyEndpoint },
+};
 function createMessageChannel(poster, key, instanceId, context, processorRegistry) {
     const sender = createMessageSender(poster, key, instanceId);
+    const keyMatch = `"key":${JSON.stringify(key)}`;
     const listener = (event) => {
+        if (typeof event.data !== 'string')
+            return;
+        if (event.data.length === 0 || event.data.charCodeAt(0) !== 123)
+            return;
+        if (event.data.length > MAX_MESSAGE_LENGTH) {
+            warn('createMessageChannel', `dropping oversized message (${event.data.length} > ${MAX_MESSAGE_LENGTH})`);
+            return;
+        }
+        if (event.data.indexOf(keyMatch) === -1)
+            return;
         let body;
         try {
             body = JSON.parse(event.data);
         }
-        catch {
+        catch (err) {
+            warn('createMessageChannel', 'failed to parse incoming message as JSON', err);
             return;
         }
-        if (!isMessageBody(body))
+        if (!isMessageEnvelope(body))
             return;
         if (body.key !== key)
             return;
@@ -136,7 +213,10 @@ function createMessageChannel(poster, key, instanceId, context, processorRegistr
         const handler = processorRegistry.get(body.type);
         if (!handler)
             return;
+        if (!isValidMessagePayload(body))
+            return;
         const meta = { senderInstanceId: body.senderInstanceId };
+        context.noteRemoteSeen(body.senderInstanceId);
         try {
             handler(deserializeMessageData(body), context, meta);
         }
@@ -149,63 +229,55 @@ function createMessageChannel(poster, key, instanceId, context, processorRegistr
         getSender() {
             return sender;
         },
-        getContext() {
-            return context;
-        },
-        getPoster() {
-            return poster;
-        },
-        getKey() {
-            return key;
-        },
-        getInstanceId() {
-            return instanceId;
-        },
         destroy() {
             poster.removeEventListener('message', listener);
         },
     };
 }
-function isMessageBody(value) {
+function isMessageEnvelope(value) {
     if (!isRecord(value))
         return false;
-    if (typeof value.type !== 'string')
+    if (typeof value.type !== 'string' || value.type.length === 0 || value.type.length > MAX_TYPE_LENGTH)
         return false;
     if (typeof value.key !== 'string')
         return false;
-    if (typeof value.senderInstanceId !== 'string')
+    if (typeof value.senderInstanceId !== 'string' ||
+        value.senderInstanceId.length === 0 ||
+        value.senderInstanceId.length > MAX_ID_LENGTH)
         return false;
-    if ('targetInstanceId' in value && typeof value.targetInstanceId !== 'string' && value.targetInstanceId !== undefined)
+    if ('targetInstanceId' in value &&
+        value.targetInstanceId !== undefined &&
+        (typeof value.targetInstanceId !== 'string' || value.targetInstanceId.length > MAX_ID_LENGTH))
         return false;
-    switch (value.type) {
-        case 'invokeRequest':
-            return isInvokeRequest(value.data);
-        case 'invokeResponse':
-            return isResponse(value.data);
-        case 'accessPropertyRequest':
-            return isAccessPropertyRequest(value.data);
-        case 'accessPropertyResponse':
-            return isResponse(value.data);
-        case 'invokeFunctionByIdRequest':
-            return isCallbackRequest(value.data);
-        case 'invokeFunctionByIdResponse':
-            return isResponse(value.data);
-        case 'releaseCallbacks':
-            return isReleaseCallbacks(value.data);
-        case 'destroyEndpoint':
-            return isDestroyEndpoint(value.data);
-        default:
-            return false;
-    }
+    return true;
+}
+function isValidMessagePayload(value) {
+    const spec = MESSAGE_SPECS[value.type];
+    return spec ? spec.validate(value.data) : false;
+}
+function isConnectMessage(value) {
+    return isRecord(value) && isMessageId(value.instanceId);
 }
 function isInvokeRequest(value) {
-    return isRecord(value) && isMessageId(value.id) && isSerializedPath(value.path) && Array.isArray(value.args);
+    return (isRecord(value) &&
+        isMessageId(value.id) &&
+        isSerializedPath(value.path) &&
+        value.path.length <= MAX_PATH_LENGTH &&
+        Array.isArray(value.args) &&
+        value.args.length <= MAX_INVOKE_ARGS);
 }
 function isAccessPropertyRequest(value) {
-    return isRecord(value) && isMessageId(value.id) && isSerializedPath(value.path);
+    return (isRecord(value) &&
+        isMessageId(value.id) &&
+        isSerializedPath(value.path) &&
+        value.path.length <= MAX_PATH_LENGTH);
 }
 function isCallbackRequest(value) {
-    return isRecord(value) && isMessageId(value.id) && isMessageId(value.callId) && Array.isArray(value.args);
+    return (isRecord(value) &&
+        isMessageId(value.id) &&
+        isMessageId(value.callId) &&
+        Array.isArray(value.args) &&
+        value.args.length <= MAX_INVOKE_ARGS);
 }
 function isResponse(value) {
     return (isRecord(value) &&
@@ -214,31 +286,21 @@ function isResponse(value) {
         ('data' in value || 'error' in value));
 }
 function isReleaseCallbacks(value) {
-    return isRecord(value) && Array.isArray(value.ids) && value.ids.every((id) => typeof id === 'string');
+    return (isRecord(value) && Array.isArray(value.ids) && value.ids.length <= MAX_RELEASE_IDS && value.ids.every(isMessageId));
 }
 function isDestroyEndpoint(value) {
-    return isRecord(value) && typeof value.instanceId === 'string';
+    return isRecord(value) && isMessageId(value.instanceId);
 }
 function isSerializedError(value) {
     return (isRecord(value) && typeof value.message === 'string' && (!('stack' in value) || typeof value.stack === 'string'));
 }
 function isMessageId(value) {
-    return typeof value === 'string' && value.length > 0;
+    return typeof value === 'string' && value.length > 0 && value.length <= MAX_ID_LENGTH;
 }
 function deserializeMessageData(body) {
-    if (body.type === 'invokeRequest') {
-        const data = body.data;
-        return {
-            ...data,
-            path: deserializePath(data.path),
-        };
-    }
-    if (body.type === 'accessPropertyRequest') {
-        const data = body.data;
-        return {
-            ...data,
-            path: deserializePath(data.path),
-        };
+    const spec = MESSAGE_SPECS[body.type];
+    if (spec.preDeserialize) {
+        return spec.preDeserialize(body.data);
     }
     return body.data;
 }
@@ -246,38 +308,39 @@ function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function sendProcessorError(body, sender, err) {
-    if (body.type === 'invokeRequest') {
-        const data = body.data;
-        sender.sendMessage('invokeResponse', {
-            id: data.id,
-            error: serializeThrownError(err),
-        }, body.senderInstanceId);
-        return;
-    }
-    if (body.type === 'accessPropertyRequest') {
-        const data = body.data;
-        sender.sendMessage('accessPropertyResponse', {
-            id: data.id,
-            error: serializeThrownError(err),
-        }, body.senderInstanceId);
+    const spec = MESSAGE_SPECS[body.type];
+    if (!spec.errorResponse)
         return;
-    }
+    const error = serializeThrownError(err);
     if (body.type === 'invokeFunctionByIdRequest') {
         const data = body.data;
-        const error = serializeThrownError(err);
-        console.warn(`chrome-in-iframe: callback '${data.id}' failed: ${error.message}`);
-        sender.sendMessage('invokeFunctionByIdResponse', {
-            id: data.callId,
-            error,
-        }, body.senderInstanceId);
+        warn('sendProcessorError', `callback '${data.id}' failed: ${error.message}`);
     }
+    sender.sendMessage(spec.errorResponse.type, { id: spec.errorResponse.extractId(body.data), error }, body.senderInstanceId);
+}
+
+function isListenerRegistrationPath(path) {
+    const last = path[path.length - 1];
+    return last === 'addListener';
+}
+function isListenerRemovalPath(path) {
+    const last = path[path.length - 1];
+    return last === 'removeListener';
+}
+function isLikelyListenerPath(path) {
+    const last = path[path.length - 1];
+    return typeof last === 'string' && /^on[A-Z]/.test(last);
 }
 
 const TYPE_KEY = '$cii$';
+const MAX_SERIALIZE_DEPTH = 200;
 function serialize(arg, registerFunction, options = {}) {
-    return serialize0(arg, undefined, registerFunction, options, new WeakSet());
+    return serialize0(arg, undefined, registerFunction, options, new WeakSet(), 0);
 }
-function serialize0(arg, owner, registerFunction, options, seen) {
+function serialize0(arg, owner, registerFunction, options, seen, depth) {
+    if (depth > MAX_SERIALIZE_DEPTH) {
+        throw new TypeError(`Serialization exceeded maximum depth of ${MAX_SERIALIZE_DEPTH}`);
+    }
     if (arg === undefined)
         return { [TYPE_KEY]: 'undef' };
     if (arg === null)
@@ -296,15 +359,22 @@ function serialize0(arg, owner, registerFunction, options, seen) {
         return options.persistent ? { [TYPE_KEY]: 'fn', id, persistent: true } : { [TYPE_KEY]: 'fn', id };
     }
     if (typeOf === 'symbol')
-        return { [TYPE_KEY]: 'sym', v: serializeSymbol(arg) };
+        return { [TYPE_KEY]: 'sym', v: encodeSymbolToken(arg) };
     if (typeOf === 'object') {
         if (seen.has(arg)) {
             throw new TypeError('Cannot serialize circular structure');
         }
         seen.add(arg);
         try {
+            if (Array.isArray(arg)) {
+                return arg.map((item) => serialize0(item, arg, registerFunction, options, seen, depth + 1));
+            }
+            const proto = Object.getPrototypeOf(arg);
+            if (proto === Object.prototype || proto === null) {
+                return serializePlainObject(arg, registerFunction, options, seen, depth);
+            }
             if (arg instanceof Error)
-                return serializeError(arg, owner, registerFunction, options, seen);
+                return serializeError(arg, owner, registerFunction, options, seen, depth);
             if (arg instanceof Date)
                 return { [TYPE_KEY]: 'date', v: arg.getTime() };
             if (arg instanceof RegExp)
@@ -313,8 +383,8 @@ function serialize0(arg, owner, registerFunction, options, seen) {
                 const entries = [];
                 for (const [k, v] of arg.entries()) {
                     entries.push([
-                        serialize0(k, arg, registerFunction, options, seen),
-                        serialize0(v, arg, registerFunction, options, seen),
+                        serialize0(k, arg, registerFunction, options, seen, depth + 1),
+                        serialize0(v, arg, registerFunction, options, seen, depth + 1),
                     ]);
                 }
                 return { [TYPE_KEY]: 'map', entries };
@@ -322,14 +392,11 @@ function serialize0(arg, owner, registerFunction, options, seen) {
             if (arg instanceof Set) {
                 const values = [];
                 for (const v of arg.values()) {
-                    values.push(serialize0(v, arg, registerFunction, options, seen));
+                    values.push(serialize0(v, arg, registerFunction, options, seen, depth + 1));
                 }
                 return { [TYPE_KEY]: 'set', values };
             }
-            if (Array.isArray(arg)) {
-                return arg.map((item) => serialize0(item, arg, registerFunction, options, seen));
-            }
-            return serializePlainObject(arg, registerFunction, options, seen);
+            return serializePlainObject(arg, registerFunction, options, seen, depth);
         }
         finally {
             seen.delete(arg);
@@ -337,7 +404,7 @@ function serialize0(arg, owner, registerFunction, options, seen) {
     }
     return null;
 }
-function serializeError(err, owner, registerFunction, options, seen) {
+function serializeError(err, owner, registerFunction, options, seen, depth) {
     const result = { [TYPE_KEY]: 'err', message: err.message };
     if (err.name && err.name !== 'Error')
         result.name = err.name;
@@ -345,7 +412,7 @@ function serializeError(err, owner, registerFunction, options, seen) {
         result.stack = err.stack;
     const cause = err.cause;
     if (cause !== undefined) {
-        result.cause = serialize0(cause, owner, registerFunction, options, seen);
+        result.cause = serialize0(cause, owner, registerFunction, options, seen, depth + 1);
     }
     const RESERVED_ERROR_KEYS = new Set(['message', 'name', 'stack', 'cause']);
     const extras = [];
@@ -354,14 +421,16 @@ function serializeError(err, owner, registerFunction, options, seen) {
             continue;
         if (RESERVED_ERROR_KEYS.has(k))
             continue;
+        if (!isEnumerable(err, k))
+            continue;
         const value = err[k];
-        extras.push([k, serialize0(value, owner, registerFunction, options, seen)]);
+        extras.push([k, serialize0(value, owner, registerFunction, options, seen, depth + 1)]);
     }
     if (extras.length > 0)
         result.extras = extras;
     return result;
 }
-function serializePlainObject(source, registerFunction, options, seen) {
+function serializePlainObject(source, registerFunction, options, seen, depth) {
     const record = source;
     const ownKeys = Reflect.ownKeys(source).filter((k) => isEnumerable(source, k));
     const symbolKeys = [];
@@ -379,19 +448,25 @@ function serializePlainObject(source, registerFunction, options, seen) {
     if (symbolKeys.length > 0 || hasReservedKey) {
         const entries = [];
         for (const k of stringKeys) {
-            entries.push([k, serialize0(record[k], source, registerFunction, options, seen)]);
+            entries.push([k, serialize0(record[k], source, registerFunction, options, seen, depth + 1)]);
         }
         for (const k of symbolKeys) {
             entries.push([
-                { [TYPE_KEY]: 'sym', v: serializeSymbol(k) },
-                serialize0(record[k], source, registerFunction, options, seen),
+                { [TYPE_KEY]: 'sym', v: encodeSymbolToken(k) },
+                serialize0(record[k], source, registerFunction, options, seen, depth + 1),
             ]);
         }
         return { [TYPE_KEY]: 'obj', entries };
     }
     const result = {};
     for (const k of stringKeys) {
-        setOwnProperty$1(result, k, serialize0(record[k], source, registerFunction, options, seen));
+        const value = serialize0(record[k], source, registerFunction, options, seen, depth + 1);
+        if (k === '__proto__') {
+            setOwnProperty(result, k, value);
+        }
+        else {
+            result[k] = value;
+        }
     }
     return result;
 }
@@ -415,56 +490,61 @@ function serializeNumber(value) {
         return { [TYPE_KEY]: 'num', v: '-0' };
     return value;
 }
-function setOwnProperty$1(target, key, value) {
-    Object.defineProperty(target, key, {
-        value,
-        enumerable: true,
-        configurable: true,
-        writable: true,
-    });
-}
-function serializeSymbol(value) {
-    const globalKey = Symbol.keyFor(value);
-    if (globalKey)
-        return `global:${globalKey}`;
-    const wellKnownName = getWellKnownSymbolName(value);
-    if (wellKnownName)
-        return `wellKnown:${wellKnownName}`;
-    throw new TypeError('Cannot serialize non-global symbol');
-}
 
-const ERROR_CONSTRUCTORS = {
-    Error,
-    TypeError: TypeError,
-    RangeError: RangeError,
-    SyntaxError: SyntaxError,
-    ReferenceError: ReferenceError,
-    URIError: URIError,
-    EvalError: EvalError,
+const MAX_DESERIALIZE_DEPTH = 200;
+const ERROR_FACTORIES = {
+    Error: (m) => new Error(m),
+    TypeError: (m) => new TypeError(m),
+    RangeError: (m) => new RangeError(m),
+    SyntaxError: (m) => new SyntaxError(m),
+    ReferenceError: (m) => new ReferenceError(m),
+    URIError: (m) => new URIError(m),
+    EvalError: (m) => new EvalError(m),
 };
+const globalScope = globalThis;
+const AggregateErrorCtorRef = globalScope.AggregateError;
+if (typeof AggregateErrorCtorRef === 'function') {
+    ERROR_FACTORIES.AggregateError = (m) => new AggregateErrorCtorRef([], m);
+}
+const DOMExceptionCtorRef = globalScope.DOMException;
+if (typeof DOMExceptionCtorRef === 'function') {
+    ERROR_FACTORIES.DOMException = (m) => new DOMExceptionCtorRef(m);
+}
 function deserialize(arg, generateCallback, getRemoteCallback) {
-    return deserialize0(arg, generateCallback, getRemoteCallback);
+    return deserialize0(arg, generateCallback, getRemoteCallback, 0);
 }
-function deserialize0(arg, generateCallback, getRemoteCallback) {
+function deserialize0(arg, generateCallback, getRemoteCallback, depth) {
+    if (depth > MAX_DESERIALIZE_DEPTH) {
+        throw new TypeError(`Deserialization exceeded maximum depth of ${MAX_DESERIALIZE_DEPTH}`);
+    }
     if (arg === null)
         return null;
     if (typeof arg !== 'object')
         return arg;
     if (Array.isArray(arg)) {
-        return arg.map((item) => deserialize0(item, generateCallback, getRemoteCallback));
+        return arg.map((item) => deserialize0(item, generateCallback, getRemoteCallback, depth + 1));
     }
     const source = arg;
     const tag = source[TYPE_KEY];
     if (typeof tag === 'string') {
-        return deserializeTagged(tag, source, generateCallback, getRemoteCallback);
+        return deserializeTagged(tag, source, generateCallback, getRemoteCallback, depth);
     }
+    return deserializePlainObject(source, generateCallback, getRemoteCallback, depth);
+}
+function deserializePlainObject(source, generateCallback, getRemoteCallback, depth) {
     const result = {};
     for (const key of Object.keys(source)) {
-        setOwnProperty(result, key, deserialize0(source[key], generateCallback, getRemoteCallback));
+        const value = deserialize0(source[key], generateCallback, getRemoteCallback, depth + 1);
+        if (key === '__proto__') {
+            setOwnProperty(result, key, value);
+        }
+        else {
+            result[key] = value;
+        }
     }
     return result;
 }
-function deserializeTagged(tag, source, generateCallback, getRemoteCallback) {
+function deserializeTagged(tag, source, generateCallback, getRemoteCallback, depth) {
     switch (tag) {
         case 'undef':
             return undefined;
@@ -475,26 +555,21 @@ function deserializeTagged(tag, source, generateCallback, getRemoteCallback) {
         case 'num':
             return deserializeNumber(expectString(source.v, 'number'));
         case 'err':
-            return deserializeError(source, generateCallback, getRemoteCallback);
+            return deserializeError(source, generateCallback, getRemoteCallback, depth);
         case 'date':
             return deserializeDate(source.v);
         case 're':
             return deserializeRegExp(source.source, source.flags);
         case 'map':
-            return deserializeMap(source.entries, generateCallback, getRemoteCallback);
+            return deserializeMap(source.entries, generateCallback, getRemoteCallback, depth);
         case 'set':
-            return deserializeSet(source.values, generateCallback, getRemoteCallback);
+            return deserializeSet(source.values, generateCallback, getRemoteCallback, depth);
         case 'fn':
             return deserializeFunction(source, generateCallback, getRemoteCallback);
         case 'obj':
-            return deserializeWrappedObject(source.entries, generateCallback, getRemoteCallback);
-        default: {
-            const result = {};
-            for (const key of Object.keys(source)) {
-                setOwnProperty(result, key, deserialize0(source[key], generateCallback, getRemoteCallback));
-            }
-            return result;
-        }
+            return deserializeWrappedObject(source.entries, generateCallback, getRemoteCallback, depth);
+        default:
+            return deserializePlainObject(source, generateCallback, getRemoteCallback, depth);
     }
 }
 function deserializeBigInt(raw) {
@@ -525,25 +600,25 @@ function deserializeRegExp(rawSource, rawFlags) {
         throw new TypeError(`Invalid regexp payload: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-function deserializeMap(entries, generateCallback, getRemoteCallback) {
+function deserializeMap(entries, generateCallback, getRemoteCallback, depth) {
     const result = new Map();
     if (!Array.isArray(entries))
         return result;
     for (const entry of entries) {
         if (!Array.isArray(entry) || entry.length !== 2)
             continue;
-        const k = deserialize0(entry[0], generateCallback, getRemoteCallback);
-        const v = deserialize0(entry[1], generateCallback, getRemoteCallback);
+        const k = deserialize0(entry[0], generateCallback, getRemoteCallback, depth + 1);
+        const v = deserialize0(entry[1], generateCallback, getRemoteCallback, depth + 1);
         result.set(k, v);
     }
     return result;
 }
-function deserializeSet(values, generateCallback, getRemoteCallback) {
+function deserializeSet(values, generateCallback, getRemoteCallback, depth) {
     const result = new Set();
     if (!Array.isArray(values))
         return result;
     for (const v of values) {
-        result.add(deserialize0(v, generateCallback, getRemoteCallback));
+        result.add(deserialize0(v, generateCallback, getRemoteCallback, depth + 1));
     }
     return result;
 }
@@ -561,23 +636,35 @@ function deserializeFunction(source, generateCallback, getRemoteCallback) {
     };
     return getRemoteCallback ? getRemoteCallback(id, invoke, fnOptions) : (...args) => invoke(args);
 }
-function deserializeError(source, generateCallback, getRemoteCallback) {
-    const message = typeof source.message === 'string' ? source.message : '';
-    const name = typeof source.name === 'string' ? source.name : 'Error';
-    const Ctor = ERROR_CONSTRUCTORS[name] ?? Error;
-    const error = new Ctor(message);
-    if (name && name !== Ctor.name) {
+function rebuildErrorFromSerialized(serialized) {
+    const name = typeof serialized.name === 'string' && serialized.name ? serialized.name : 'Error';
+    const factory = ERROR_FACTORIES[name] ?? ERROR_FACTORIES.Error;
+    const error = factory(serialized.message);
+    if (name && error.name !== name) {
         try {
             error.name = name;
         }
         catch {
-            // ignore non-writable name
+            try {
+                Object.defineProperty(error, 'name', { value: name, configurable: true, writable: true });
+            }
+            catch (err) {
+                warn('rebuildErrorFromSerialized', 'failed to set error.name', name, err);
+            }
         }
     }
-    if (typeof source.stack === 'string')
-        error.stack = source.stack;
+    if (typeof serialized.stack === 'string')
+        error.stack = serialized.stack;
+    return error;
+}
+function deserializeError(source, generateCallback, getRemoteCallback, depth) {
+    const error = rebuildErrorFromSerialized({
+        message: typeof source.message === 'string' ? source.message : '',
+        name: typeof source.name === 'string' ? source.name : undefined,
+        stack: typeof source.stack === 'string' ? source.stack : undefined,
+    });
     if (source.cause !== undefined) {
-        error.cause = deserialize0(source.cause, generateCallback, getRemoteCallback);
+        error.cause = deserialize0(source.cause, generateCallback, getRemoteCallback, depth + 1);
     }
     if (Array.isArray(source.extras)) {
         for (const entry of source.extras) {
@@ -587,16 +674,16 @@ function deserializeError(source, generateCallback, getRemoteCallback) {
             if (typeof rawKey !== 'string')
                 continue;
             try {
-                error[rawKey] = deserialize0(rawValue, generateCallback, getRemoteCallback);
+                setOwnProperty(error, rawKey, deserialize0(rawValue, generateCallback, getRemoteCallback, depth + 1));
             }
-            catch {
-                // ignore non-writable property
+            catch (err) {
+                warn('deserializeError', 'failed to set error property', rawKey, err);
             }
         }
     }
     return error;
 }
-function deserializeWrappedObject(entries, generateCallback, getRemoteCallback) {
+function deserializeWrappedObject(entries, generateCallback, getRemoteCallback, depth) {
     const result = {};
     if (!Array.isArray(entries))
         return result;
@@ -604,18 +691,13 @@ function deserializeWrappedObject(entries, generateCallback, getRemoteCallback)
         if (!Array.isArray(entry) || entry.length !== 2)
             continue;
         const rawKey = entry[0];
-        const value = deserialize0(entry[1], generateCallback, getRemoteCallback);
+        const value = deserialize0(entry[1], generateCallback, getRemoteCallback, depth + 1);
         const key = resolveObjectKey(rawKey);
         if (key === undefined) {
-            console.warn('chrome-in-iframe: dropping wrapped-object entry with unresolvable key', rawKey);
+            warn('deserializeWrappedObject', 'dropping wrapped-object entry with unresolvable key', rawKey);
             continue;
         }
-        Object.defineProperty(result, key, {
-            value,
-            enumerable: true,
-            configurable: true,
-            writable: true,
-        });
+        setOwnProperty(result, key, value);
     }
     return result;
 }
@@ -628,7 +710,8 @@ function resolveObjectKey(raw) {
             try {
                 return deserializeSymbol(tagged.v);
             }
-            catch {
+            catch (err) {
+                warn('resolveObjectKey', 'failed to deserialize symbol key', tagged.v, err);
                 return undefined;
             }
         }
@@ -652,39 +735,88 @@ function deserializeNumber(raw) {
     return Number(raw);
 }
 function deserializeSymbol(value) {
-    if (value.startsWith('global:')) {
-        return Symbol.for(value.slice('global:'.length));
-    }
-    if (value.startsWith('wellKnown:')) {
-        const symbol = getWellKnownSymbol(value.slice('wellKnown:'.length));
-        if (symbol)
-            return symbol;
-    }
-    throw new TypeError('Cannot deserialize symbol');
-}
-function setOwnProperty(target, key, value) {
-    Object.defineProperty(target, key, {
-        value,
-        enumerable: true,
-        configurable: true,
-        writable: true,
-    });
+    return decodeSymbolToken(value);
 }
 
-function isListenerRegistrationPath(path) {
-    const last = path[path.length - 1];
-    return last === 'addListener' || last === 'hasListener';
+function createResponder(ctx, targetInstanceId, responseType, id) {
+    const sender = () => ctx.getMessageChannel().getSender();
+    const sendError = (error) => {
+        sender().sendMessage(responseType, { id, error }, targetInstanceId);
+    };
+    return {
+        respondError(message) {
+            sendError({ message });
+        },
+        respondThrown(err) {
+            sendError(serializeThrownError(err));
+        },
+        respondSuccess(value) {
+            try {
+                sender().sendMessage(responseType, { id, data: ctx.serializeForRemote(value, targetInstanceId) }, targetInstanceId);
+            }
+            catch (err) {
+                sendError(serializeThrownError(err));
+            }
+        },
+    };
 }
-function isListenerRemovalPath(path) {
-    const last = path[path.length - 1];
-    return last === 'removeListener';
+function createScopedRemoteCallback(ctx, remoteInstanceId) {
+    return (id, invoke, options) => ctx.getRemoteCallback(id, invoke, options, remoteInstanceId);
 }
-function isLikelyListenerPath(path) {
-    const last = path[path.length - 1];
-    return typeof last === 'string' && /^on[A-Z]/.test(last);
+function createGenerateCallback(ctx, remoteInstanceId) {
+    return (id, args, options) => ctx.invokeFunctionById(id, args, options, remoteInstanceId);
+}
+function safeInvokeReject(callbacks, scope, warn) {
+    if (!callbacks.onReject)
+        return;
+    try {
+        callbacks.onReject();
+    }
+    catch (err) {
+        warn(scope, 'onReject hook threw', err);
+    }
+}
+function safeInvokeResolve(callbacks, scope, warn) {
+    if (!callbacks.onResolve)
+        return;
+    try {
+        callbacks.onResolve();
+    }
+    catch (err) {
+        warn(scope, 'onResolve hook threw', err);
+    }
+}
+function createResponseHandler(scope, warn) {
+    return function handleResponse(data, ctx, meta) {
+        const pending = ctx.getAndRemovePendingPromise(data.id, meta.senderInstanceId);
+        if (!pending)
+            return;
+        if (data.error) {
+            const err = rebuildErrorFromSerialized(data.error);
+            safeInvokeReject(pending, scope, warn);
+            pending.reject(err);
+            return;
+        }
+        try {
+            safeInvokeResolve(pending, scope, warn);
+            pending.resolve(deserialize(data.data, createGenerateCallback(ctx, meta.senderInstanceId), createScopedRemoteCallback(ctx, meta.senderInstanceId)));
+        }
+        catch (err) {
+            safeInvokeReject(pending, scope, warn);
+            pending.reject(err instanceof Error ? err : new Error(String(err)));
+        }
+    };
 }
 
-const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const DANGEROUS_KEYS = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+]);
 function readProperty(target, key) {
     if (typeof key === 'string' && DANGEROUS_KEYS.has(key)) {
         throw new Error(`Access to dangerous property '${key}' is denied`);
@@ -694,135 +826,89 @@ function readProperty(target, key) {
     return target[key];
 }
 
-const boundCache = new WeakMap();
-function bindMethod(fn, owner) {
-    if (owner === null || typeof owner !== 'object') {
-        return (...args) => Reflect.apply(fn, owner, args);
-    }
-    let perOwner = boundCache.get(fn);
-    if (!perOwner) {
-        perOwner = new WeakMap();
-        boundCache.set(fn, perOwner);
-    }
-    const cached = perOwner.get(owner);
-    if (cached)
-        return cached;
-    const bound = (...args) => Reflect.apply(fn, owner, args);
-    perOwner.set(owner, bound);
-    return bound;
-}
 function handleAccessPropertyRequest(data, ctx, meta) {
+    if (ctx.isDestroyed())
+        return;
     const target = ctx.getDelegateTarget();
-    const channel = ctx.getMessageChannel();
+    const { respondError, respondThrown } = createResponder(ctx, meta.senderInstanceId, 'accessPropertyResponse', data.id);
     if (data.path.length === 0) {
-        channel.getSender().sendMessage('accessPropertyResponse', {
-            id: data.id,
-            error: { message: 'Property path must not be empty' },
-        }, meta.senderInstanceId);
+        respondError('Property path must not be empty');
         return;
     }
-    if (!target) {
-        channel.getSender().sendMessage('accessPropertyResponse', {
-            id: data.id,
-            error: { message: 'No delegate target is configured' },
-        }, meta.senderInstanceId);
+    if (target === undefined || target === null) {
+        respondError('No delegate target is configured');
         return;
     }
     try {
         let current = target;
         let owner = target;
-        for (const key of data.path) {
+        for (let i = 0; i < data.path.length; i++) {
+            const key = data.path[i];
             if (current === undefined || current === null) {
-                channel.getSender().sendMessage('accessPropertyResponse', {
-                    id: data.id,
-                    data: serialize(current, ctx.registerFunction),
-                }, meta.senderInstanceId);
+                respondError(`Cannot read property '${String(key)}' of ${current === null ? 'null' : 'undefined'} (at '${data.path
+                    .slice(0, i)
+                    .map(String)
+                    .join('.')}')`);
                 return;
             }
             owner = current;
             current = readProperty(current, key);
         }
-        const value = typeof current === 'function' ? bindMethod(current, owner) : current;
-        channel.getSender().sendMessage('accessPropertyResponse', {
-            id: data.id,
-            data: serialize(value, ctx.registerFunction, { persistent: isLikelyListenerPath(data.path) }),
-        }, meta.senderInstanceId);
-    }
-    catch (err) {
-        channel.getSender().sendMessage('accessPropertyResponse', {
+        const value = typeof current === 'function' ? ctx.bindMethod(current, owner) : current;
+        ctx
+            .getMessageChannel()
+            .getSender()
+            .sendMessage('accessPropertyResponse', {
             id: data.id,
-            error: serializeThrownError(err),
+            data: ctx.serializeForRemote(value, meta.senderInstanceId, {
+                persistent: isLikelyListenerPath(data.path),
+            }),
         }, meta.senderInstanceId);
     }
-}
-function handleAccessPropertyResponse(data, ctx, meta) {
-    const pending = ctx.getAndRemovePendingPromise(data.id);
-    if (!pending)
-        return;
-    if (data.error) {
-        const err = new Error(data.error.message);
-        err.stack = data.error.stack;
-        pending.reject(err);
-        return;
-    }
-    const scopedRemoteCallback = createScopedRemoteCallback$2(ctx, meta.senderInstanceId);
-    try {
-        pending.resolve(deserialize(data.data, (id, args, options) => {
-            return ctx.invokeFunctionById(id, args, options);
-        }, scopedRemoteCallback));
-    }
     catch (err) {
-        pending.reject(err instanceof Error ? err : new Error(String(err)));
+        respondThrown(err);
     }
 }
-function createScopedRemoteCallback$2(ctx, remoteInstanceId) {
-    return (id, invoke, options) => ctx.getRemoteCallback(id, invoke, options, remoteInstanceId);
-}
+const handleAccessPropertyResponse = createResponseHandler('handleAccessPropertyResponse', warn);
 
 function handleInvokeRequest(data, ctx, meta) {
+    if (ctx.isDestroyed())
+        return;
     const target = ctx.getDelegateTarget();
-    const channel = ctx.getMessageChannel();
-    const scopedRemoteCallback = createScopedRemoteCallback$1(ctx, meta.senderInstanceId);
-    if (!target) {
-        channel.getSender().sendMessage('invokeResponse', {
-            id: data.id,
-            error: { message: 'No delegate target is configured' },
-        }, meta.senderInstanceId);
+    const scopedRemoteCallback = createScopedRemoteCallback(ctx, meta.senderInstanceId);
+    const generateCallback = createGenerateCallback(ctx, meta.senderInstanceId);
+    const { respondError, respondThrown, respondSuccess } = createResponder(ctx, meta.senderInstanceId, 'invokeResponse', data.id);
+    if (target === undefined || target === null) {
+        respondError('No delegate target is configured');
+        return;
+    }
+    if (data.path.length === 0) {
+        respondError('Invocation path must not be empty');
         return;
     }
     let current = target;
     for (let i = 0; i < data.path.length - 1; i++) {
         current = readProperty(current, data.path[i]);
         if (current === undefined || current === null) {
-            channel.getSender().sendMessage('invokeResponse', {
-                id: data.id,
-                error: {
-                    message: `Cannot read property '${String(data.path[i + 1])}' of ${String(data.path[i])}`,
-                },
-            }, meta.senderInstanceId);
+            respondError(`Cannot read property '${String(data.path[i + 1])}' of ${current === null ? 'null' : 'undefined'} (at '${data.path
+                .slice(0, i + 1)
+                .map(String)
+                .join('.')}')`);
             return;
         }
     }
     const lastKey = data.path[data.path.length - 1];
     const fn = readProperty(current, lastKey);
     if (typeof fn !== 'function') {
-        channel.getSender().sendMessage('invokeResponse', {
-            id: data.id,
-            error: { message: `'${String(lastKey)}' is not a function` },
-        }, meta.senderInstanceId);
+        respondError(`'${String(lastKey)}' is not a function`);
         return;
     }
     let deserializedArgs;
     try {
-        deserializedArgs = data.args.map((arg) => deserialize(arg, (id, args, options) => {
-            return ctx.invokeFunctionById(id, args, options);
-        }, scopedRemoteCallback));
+        deserializedArgs = data.args.map((arg) => deserialize(arg, generateCallback, scopedRemoteCallback));
     }
     catch (err) {
-        channel.getSender().sendMessage('invokeResponse', {
-            id: data.id,
-            error: serializeThrownError(err),
-        }, meta.senderInstanceId);
+        respondThrown(err);
         return;
     }
     let result;
@@ -830,165 +916,98 @@ function handleInvokeRequest(data, ctx, meta) {
         result = Reflect.apply(fn, current, deserializedArgs);
     }
     catch (err) {
-        channel.getSender().sendMessage('invokeResponse', {
-            id: data.id,
-            error: serializeThrownError(err),
-        }, meta.senderInstanceId);
+        respondThrown(err);
         return;
     }
-    if (result instanceof Promise) {
-        result
+    if (isPromiseLike(result)) {
+        Promise.resolve(result)
             .then((value) => {
-            sendInvokeSuccess(data.id, value, ctx, meta.senderInstanceId);
+            respondSuccess(value);
         })
             .catch((err) => {
-            channel.getSender().sendMessage('invokeResponse', {
-                id: data.id,
-                error: serializeThrownError(err),
-            }, meta.senderInstanceId);
+            respondThrown(err);
         });
-    }
-    else {
-        sendInvokeSuccess(data.id, result, ctx, meta.senderInstanceId);
-    }
-}
-function handleInvokeResponse(data, ctx, meta) {
-    const pending = ctx.getAndRemovePendingPromise(data.id);
-    if (!pending)
         return;
-    if (data.error) {
-        const err = new Error(data.error.message);
-        err.stack = data.error.stack;
-        pending.reject(err);
-    }
-    else {
-        const scopedRemoteCallback = createScopedRemoteCallback$1(ctx, meta.senderInstanceId);
-        try {
-            pending.resolve(deserialize(data.data, (id, args, options) => {
-                return ctx.invokeFunctionById(id, args, options);
-            }, scopedRemoteCallback));
-        }
-        catch (err) {
-            pending.reject(err instanceof Error ? err : new Error(String(err)));
-        }
-    }
-}
-function sendInvokeSuccess(id, value, ctx, targetInstanceId) {
-    const channel = ctx.getMessageChannel();
-    try {
-        channel.getSender().sendMessage('invokeResponse', {
-            id,
-            data: serialize(value, ctx.registerFunction),
-        }, targetInstanceId);
-    }
-    catch (err) {
-        channel.getSender().sendMessage('invokeResponse', {
-            id,
-            error: serializeThrownError(err),
-        }, targetInstanceId);
     }
+    respondSuccess(result);
 }
-function createScopedRemoteCallback$1(ctx, remoteInstanceId) {
-    return (id, invoke, options) => ctx.getRemoteCallback(id, invoke, options, remoteInstanceId);
-}
+const handleInvokeResponse = createResponseHandler('handleInvokeResponse', warn);
 
 function handleCallbackInvoke(data, ctx, meta) {
-    const channel = ctx.getMessageChannel();
+    if (ctx.isDestroyed())
+        return;
+    const { respondError, respondThrown, respondSuccess } = createResponder(ctx, meta.senderInstanceId, 'invokeFunctionByIdResponse', data.callId);
     const persistentEntry = ctx.getPersistentFunctionCache().get(data.id);
     const entry = persistentEntry ?? ctx.getFunctionCache().get(data.id);
     if (!entry) {
-        const error = { message: `Callback '${data.id}' is not available or has expired` };
-        console.warn(`chrome-in-iframe: ${error.message}`);
-        channel.getSender().sendMessage('invokeFunctionByIdResponse', {
-            id: data.callId,
-            error,
-        }, meta.senderInstanceId);
+        const message = `Callback '${data.id}' is not available or has expired`;
+        warn('handleCallbackInvoke', message);
+        respondError(message);
         return;
     }
     const scopedRemoteCallback = createScopedRemoteCallback(ctx, meta.senderInstanceId);
+    const generateCallback = createGenerateCallback(ctx, meta.senderInstanceId);
     let deserializedArgs;
     try {
-        deserializedArgs = data.args.map((arg) => deserialize(arg, (id, args, options) => {
-            return ctx.invokeFunctionById(id, args, options);
-        }, scopedRemoteCallback));
+        deserializedArgs = data.args.map((arg) => deserialize(arg, generateCallback, scopedRemoteCallback));
     }
     catch (err) {
-        sendCallbackError(data.callId, err, ctx, meta.senderInstanceId);
+        respondThrown(err);
         return;
     }
     try {
         const result = Reflect.apply(entry.fn, entry.thisArg, deserializedArgs);
-        if (result instanceof Promise) {
-            result
+        if (isPromiseLike(result)) {
+            Promise.resolve(result)
                 .then((value) => {
-                sendCallbackSuccess(data.callId, value, ctx, meta.senderInstanceId);
+                respondSuccess(value);
             })
                 .catch((err) => {
-                sendCallbackError(data.callId, err, ctx, meta.senderInstanceId);
+                respondThrown(err);
             });
             return;
         }
-        sendCallbackSuccess(data.callId, result, ctx, meta.senderInstanceId);
+        respondSuccess(result);
     }
     catch (err) {
-        sendCallbackError(data.callId, err, ctx, meta.senderInstanceId);
+        respondThrown(err);
     }
 }
-function handleCallbackInvokeResponse(data, ctx, meta) {
-    const pending = ctx.getAndRemovePendingPromise(data.id);
-    if (!pending)
-        return;
-    if (data.error) {
-        const err = new Error(data.error.message);
-        err.stack = data.error.stack;
-        pending.reject(err);
-        return;
-    }
-    const scopedRemoteCallback = createScopedRemoteCallback(ctx, meta.senderInstanceId);
-    try {
-        pending.resolve(deserialize(data.data, (id, args, options) => {
-            return ctx.invokeFunctionById(id, args, options);
-        }, scopedRemoteCallback));
-    }
-    catch (err) {
-        pending.reject(err instanceof Error ? err : new Error(String(err)));
-    }
-}
-function sendCallbackSuccess(id, value, ctx, targetInstanceId) {
-    const channel = ctx.getMessageChannel();
-    try {
-        channel.getSender().sendMessage('invokeFunctionByIdResponse', {
-            id,
-            data: serialize(value, ctx.registerFunction),
-        }, targetInstanceId);
-    }
-    catch (err) {
-        sendCallbackError(id, err, ctx, targetInstanceId);
-    }
-}
-function sendCallbackError(id, err, ctx, targetInstanceId) {
-    ctx
-        .getMessageChannel()
-        .getSender()
-        .sendMessage('invokeFunctionByIdResponse', {
-        id,
-        error: serializeThrownError(err),
-    }, targetInstanceId);
-}
-function createScopedRemoteCallback(ctx, remoteInstanceId) {
-    return (id, invoke, options) => ctx.getRemoteCallback(id, invoke, options, remoteInstanceId);
-}
+const handleCallbackInvokeResponse = createResponseHandler('handleCallbackInvokeResponse', warn);
 
-const MAX_RELEASE_BATCH = 10000;
-function handleReleaseCallbacks(data, ctx, _meta) {
-    if (data.ids.length > MAX_RELEASE_BATCH)
-        return;
-    for (const id of data.ids) {
-        ctx.getFunctionCache().delete(id);
-        ctx.getPersistentFunctionCache().delete(id);
-    }
+const RELEASE_CHUNK_SIZE = 1000;
+const scheduleNextChunk = typeof queueMicrotask === 'function' ? (cb) => queueMicrotask(cb) : (cb) => setTimeout(cb, 0);
+function handleConnectRequest(_data, ctx, meta) {
+    ctx.noteFreshConnect(meta.senderInstanceId);
+    ctx.getMessageChannel().getSender().sendMessage('connectResponse', {
+        instanceId: ctx.getInstanceId(),
+    }, meta.senderInstanceId);
+}
+function handleConnectResponse(_data, ctx, meta) {
+    ctx.bindRemote(meta.senderInstanceId);
+}
+function handleReleaseCallbacks(data, ctx, meta) {
+    const ids = data.ids;
+    const total = ids.length;
+    ctx.releaseRemoteCallbacks(meta.senderInstanceId, ids);
+    let cursor = 0;
+    const sender = meta.senderInstanceId;
+    const processChunk = () => {
+        if (ctx.isDestroyed())
+            return;
+        const end = Math.min(cursor + RELEASE_CHUNK_SIZE, total);
+        for (let i = cursor; i < end; i++) {
+            ctx.dropLocalCallback(ids[i], sender);
+        }
+        cursor = end;
+        if (cursor < total)
+            scheduleNextChunk(processChunk);
+    };
+    processChunk();
 }
-function handleDestroyEndpoint(_data, ctx, meta) {
+function handleDestroyEndpoint(data, ctx, meta) {
+    if (data.instanceId !== meta.senderInstanceId)
+        return;
     ctx.handleRemoteDestroy(meta.senderInstanceId);
 }
 
@@ -1009,24 +1028,130 @@ const DEFAULT_FUNCTION_CACHE_MAX = 100;
 const DEFAULT_FUNCTION_CACHE_TTL = 5 * 60 * 1000;
 const DEFAULT_REMOTE_CALLBACK_CACHE_MAX = 500;
 const DEFAULT_REMOTE_CALLBACK_CACHE_TTL = 5 * 60 * 1000;
+const RELEASE_CALLBACKS_CHUNK_SIZE = 10000;
+const BROADCAST_OWNER = Symbol('chrome-in-iframe.broadcast-owner');
+function resolveTimeout(raw) {
+    if (raw === undefined)
+        return DEFAULT_TIMEOUT;
+    if (typeof raw !== 'number')
+        return DEFAULT_TIMEOUT;
+    if (raw === Infinity)
+        return Infinity;
+    if (!Number.isFinite(raw) || raw <= 0)
+        return DEFAULT_TIMEOUT;
+    return raw;
+}
 function createClientContext(getMessageChannel, instanceId, options = {}) {
     const remoteCacheMax = options.remoteCallbackCacheMax ?? DEFAULT_REMOTE_CALLBACK_CACHE_MAX;
     const remoteCacheTtl = options.remoteCallbackCacheTtl ?? DEFAULT_REMOTE_CALLBACK_CACHE_TTL;
+    const callTimeout = resolveTimeout(options.timeout);
     const pending = new Map();
-    const functionIds = new Map();
+    const functionIds = new WeakMap();
+    const persistentFunctionCache = new Map();
+    const persistentRefcount = new Map();
     const functionCache = new LRUCache({
         max: options.functionCacheMax ?? DEFAULT_FUNCTION_CACHE_MAX,
         ttl: options.functionCacheTtl ?? DEFAULT_FUNCTION_CACHE_TTL,
-        dispose: (value, _key, reason) => {
+        dispose: (value, key, reason) => {
             if (reason === 'set' || reason === 'delete')
                 return;
-            functionIds.delete(value.fn);
+            if (persistentFunctionCache.has(key))
+                return;
+            removeFunctionIdMapping(value.fn, value.thisArg);
         },
     });
-    const persistentFunctionCache = new Map();
     const remoteCallbacksByOwner = new Map();
     const persistentRemoteCallbacksByOwner = new Map();
+    const boundMethodCache = new WeakMap();
+    const callbackOwners = new Map();
+    const knownRemotes = new Set();
+    const remoteTargetWaiters = new Set();
+    let boundRemoteInstanceId;
+    let remoteTargetWaitDisabled = false;
     let destroyed = false;
+    const armTimer = (onTimeout) => {
+        if (callTimeout === Infinity)
+            return null;
+        return setTimeout(onTimeout, callTimeout);
+    };
+    const cancelTimer = (timer) => {
+        if (timer !== null)
+            clearTimeout(timer);
+    };
+    const getPreferredRemote = () => {
+        if (boundRemoteInstanceId !== undefined)
+            return boundRemoteInstanceId;
+        if (knownRemotes.size !== 1)
+            return undefined;
+        return knownRemotes.values().next().value;
+    };
+    const resolveRemoteTargetWaiters = (remoteInstanceId) => {
+        if (remoteTargetWaiters.size === 0)
+            return;
+        const waiters = Array.from(remoteTargetWaiters);
+        remoteTargetWaiters.clear();
+        for (const resolve of waiters)
+            resolve(remoteInstanceId);
+    };
+    const waitForRemoteTarget = () => {
+        const preferred = getPreferredRemote();
+        if (preferred !== undefined)
+            return Promise.resolve(preferred);
+        if (destroyed)
+            return Promise.resolve(undefined);
+        return new Promise((resolve) => {
+            remoteTargetWaiters.add(resolve);
+        });
+    };
+    const recordCallbackOwners = (ids, owner) => {
+        if (ids.length === 0)
+            return;
+        if (owner === 'broadcast') {
+            for (const id of ids)
+                callbackOwners.set(id, BROADCAST_OWNER);
+            return;
+        }
+        for (const id of ids) {
+            const cur = callbackOwners.get(id);
+            if (cur === BROADCAST_OWNER)
+                continue;
+            if (cur === undefined) {
+                callbackOwners.set(id, owner);
+                continue;
+            }
+            if (typeof cur === 'string') {
+                if (cur === owner)
+                    continue;
+                callbackOwners.set(id, new Set([cur, owner]));
+                continue;
+            }
+            cur.add(owner);
+        }
+    };
+    const bindMethod = (fn, owner) => {
+        if (owner === null || typeof owner !== 'object') {
+            return (...args) => Reflect.apply(fn, owner, args);
+        }
+        let perOwner = boundMethodCache.get(fn);
+        if (!perOwner) {
+            perOwner = new WeakMap();
+            boundMethodCache.set(fn, perOwner);
+        }
+        const cached = perOwner.get(owner);
+        if (cached)
+            return cached;
+        const bound = (...args) => Reflect.apply(fn, owner, args);
+        perOwner.set(owner, bound);
+        return bound;
+    };
+    const removeFunctionIdMapping = (fn, thisArg) => {
+        const perOwner = functionIds.get(fn);
+        if (!perOwner)
+            return;
+        perOwner.delete(thisArg);
+        if (perOwner.size === 0)
+            functionIds.delete(fn);
+    };
     const getOrCreateRemoteLru = (remoteId) => {
         let lru = remoteCallbacksByOwner.get(remoteId);
         if (!lru) {
@@ -1044,21 +1169,88 @@ function createClientContext(getMessageChannel, instanceId, options = {}) {
         return map;
     };
     const registerFunction = (fn, thisArg, callbackOptions = {}) => {
-        let id = functionIds.get(fn);
+        let perOwner = functionIds.get(fn);
+        if (!perOwner) {
+            perOwner = new Map();
+            functionIds.set(fn, perOwner);
+        }
+        let id = perOwner.get(thisArg);
         if (!id) {
             id = createId('cb');
-            functionIds.set(fn, id);
+            perOwner.set(thisArg, id);
         }
         const entry = { fn, thisArg };
         if (callbackOptions.persistent) {
             persistentFunctionCache.set(id, entry);
             functionCache.delete(id);
+            persistentRefcount.set(id, (persistentRefcount.get(id) ?? 0) + 1);
         }
         else if (!persistentFunctionCache.has(id)) {
             functionCache.set(id, entry);
         }
         return id;
     };
+    const releasePersistentRegistrationById = (id) => {
+        if (!persistentRefcount.has(id))
+            return undefined;
+        const next = (persistentRefcount.get(id) ?? 0) - 1;
+        if (next > 0) {
+            persistentRefcount.set(id, next);
+            return undefined;
+        }
+        persistentRefcount.delete(id);
+        const entry = persistentFunctionCache.get(id);
+        persistentFunctionCache.delete(id);
+        functionCache.delete(id);
+        if (entry)
+            removeFunctionIdMapping(entry.fn, entry.thisArg);
+        return id;
+    };
+    const dropLocalCallback = (id, requesterInstanceId) => {
+        if (requesterInstanceId !== undefined) {
+            const cur = callbackOwners.get(id);
+            if (cur === BROADCAST_OWNER) {
+                const remaining = new Set();
+                for (const r of knownRemotes) {
+                    if (r !== requesterInstanceId)
+                        remaining.add(r);
+                }
+                if (remaining.size > 0) {
+                    callbackOwners.set(id, remaining.size === 1 ? remaining.values().next().value : remaining);
+                    return;
+                }
+            }
+            else if (typeof cur === 'string') {
+                if (cur !== requesterInstanceId)
+                    return;
+            }
+            else if (cur instanceof Set) {
+                if (!cur.has(requesterInstanceId))
+                    return;
+                cur.delete(requesterInstanceId);
+                if (cur.size > 1)
+                    return;
+                if (cur.size === 1) {
+                    callbackOwners.set(id, cur.values().next().value);
+                    return;
+                }
+            }
+        }
+        if (persistentRefcount.has(id)) {
+            const next = (persistentRefcount.get(id) ?? 0) - 1;
+            if (next > 0) {
+                persistentRefcount.set(id, next);
+                return;
+            }
+        }
+        callbackOwners.delete(id);
+        const entry = persistentFunctionCache.get(id) ?? functionCache.get(id);
+        persistentRefcount.delete(id);
+        persistentFunctionCache.delete(id);
+        functionCache.delete(id);
+        if (entry)
+            removeFunctionIdMapping(entry.fn, entry.thisArg);
+    };
     const getRemoteCallback = (id, invoke, callbackOptions, remoteInstanceId) => {
         const opts = callbackOptions ?? {};
         const lru = remoteCallbacksByOwner.get(remoteInstanceId);
@@ -1083,12 +1275,34 @@ function createClientContext(getMessageChannel, instanceId, options = {}) {
         if (ids.length === 0)
             return;
         try {
-            getMessageChannel().getSender().sendMessage('releaseCallbacks', { ids });
+            const sender = getMessageChannel().getSender();
+            for (let cursor = 0; cursor < ids.length; cursor += RELEASE_CALLBACKS_CHUNK_SIZE) {
+                sender.sendMessage('releaseCallbacks', { ids: ids.slice(cursor, cursor + RELEASE_CALLBACKS_CHUNK_SIZE) });
+            }
         }
-        catch {
-            // channel may not be available yet
+        catch (err) {
+            warn('notifyReleaseCallbacks', 'failed to release callbacks', err);
         }
     };
+    const safeOnReject = (callbacks) => {
+        if (!callbacks.onReject)
+            return;
+        try {
+            callbacks.onReject();
+        }
+        catch (err) {
+            warn('rejectPending', 'onReject hook threw', err);
+        }
+    };
+    const rejectPending = (id, error) => {
+        const callbacks = pending.get(id);
+        if (!callbacks)
+            return;
+        cancelTimer(callbacks.timer);
+        pending.delete(id);
+        safeOnReject(callbacks);
+        callbacks.reject(error);
+    };
     return {
         getDelegateTarget() {
             return options.delegateTarget;
@@ -1108,20 +1322,33 @@ function createClientContext(getMessageChannel, instanceId, options = {}) {
         registerFunction(fn, thisArg, callbackOptions) {
             return registerFunction(fn, thisArg, callbackOptions);
         },
+        serializeForRemote(value, target, callbackOptions) {
+            const ids = [];
+            const tracking = (fn, thisArg, opts) => {
+                const id = registerFunction(fn, thisArg, opts);
+                ids.push(id);
+                return id;
+            };
+            const result = serialize(value, tracking, callbackOptions);
+            recordCallbackOwners(ids, target);
+            return result;
+        },
         getRemoteCallback(id, invoke, callbackOptions, remoteInstanceId) {
             return getRemoteCallback(id, invoke, callbackOptions, remoteInstanceId);
         },
-        getAndRemovePendingPromise(id) {
+        getAndRemovePendingPromise(id, senderInstanceId) {
             const callbacks = pending.get(id);
-            if (callbacks) {
-                clearTimeout(callbacks.timer);
-                pending.delete(id);
+            if (!callbacks)
+                return undefined;
+            if (callbacks.expectedRemote !== undefined &&
+                senderInstanceId !== undefined &&
+                callbacks.expectedRemote !== senderInstanceId) {
+                return undefined;
             }
+            cancelTimer(callbacks.timer);
+            pending.delete(id);
             return callbacks;
         },
-        registerPendingPromise(id, callbacks) {
-            pending.set(id, callbacks);
-        },
         invoke(path, args) {
             return new Promise((resolve, reject) => {
                 if (destroyed) {
@@ -1129,35 +1356,114 @@ function createClientContext(getMessageChannel, instanceId, options = {}) {
                     return;
                 }
                 const id = createId('req');
-                const timeout = options.timeout ?? DEFAULT_TIMEOUT;
-                const timer = setTimeout(() => {
-                    pending.delete(id);
-                    reject(new Error(`Call timed out: ${String(path.join('.'))}`));
-                }, timeout);
-                pending.set(id, { resolve, reject, timer });
-                const channel = getMessageChannel();
                 const persistent = isListenerRegistrationPath(path);
-                const serializedArgs = args.map((arg) => serialize(arg, registerFunction, { persistent }));
-                if (isListenerRemovalPath(path)) {
-                    const releasedIds = [];
-                    for (const original of args) {
-                        if (typeof original !== 'function')
-                            continue;
-                        const fnId = functionIds.get(original);
-                        if (fnId) {
-                            releasedIds.push(fnId);
-                            functionCache.delete(fnId);
-                            persistentFunctionCache.delete(fnId);
-                            functionIds.delete(original);
+                const registeredIds = [];
+                const collectingRegister = (fn, thisArg, opts) => {
+                    const cbId = registerFunction(fn, thisArg, opts);
+                    registeredIds.push(cbId);
+                    return cbId;
+                };
+                const releaseRegisteredPersistents = () => {
+                    const released = [];
+                    for (const cbId of registeredIds) {
+                        const releasedId = releasePersistentRegistrationById(cbId);
+                        if (releasedId)
+                            released.push(releasedId);
+                    }
+                    return released;
+                };
+                const cleanupRegisteredOnFailure = () => {
+                    const released = [];
+                    for (const cbId of registeredIds) {
+                        if (persistentRefcount.has(cbId)) {
+                            const releasedId = releasePersistentRegistrationById(cbId);
+                            if (releasedId)
+                                released.push(releasedId);
+                        }
+                        else {
+                            const entry = functionCache.get(cbId);
+                            if (entry) {
+                                functionCache.delete(cbId);
+                                removeFunctionIdMapping(entry.fn, entry.thisArg);
+                            }
                         }
+                        callbackOwners.delete(cbId);
                     }
-                    notifyReleaseCallbacks(releasedIds);
+                    return released;
+                };
+                const timer = armTimer(() => {
+                    rejectPending(id, new Error(`Call timed out: ${String(path.join('.'))}`));
+                });
+                let serializedArgs;
+                try {
+                    serializePath(path);
+                    serializedArgs = args.map((arg) => serialize(arg, collectingRegister, { persistent }));
+                }
+                catch (err) {
+                    cancelTimer(timer);
+                    const released = cleanupRegisteredOnFailure();
+                    if (released.length > 0)
+                        notifyReleaseCallbacks(released);
+                    reject(err);
+                    return;
                 }
-                channel.getSender().sendMessage('invokeRequest', {
-                    id,
-                    path,
-                    args: serializedArgs,
+                pending.set(id, {
+                    resolve,
+                    reject,
+                    timer,
+                    onResolve: () => {
+                        if (isListenerRemovalPath(path)) {
+                            const released = releaseRegisteredPersistents();
+                            if (released.length > 0)
+                                notifyReleaseCallbacks(released);
+                        }
+                    },
+                    onReject: () => {
+                        if (isListenerRegistrationPath(path)) {
+                            const released = releaseRegisteredPersistents();
+                            if (released.length > 0)
+                                notifyReleaseCallbacks(released);
+                        }
+                    },
                 });
+                const sendRequest = (targetInstanceId, requireTarget = true) => {
+                    const callbacks = pending.get(id);
+                    if (!callbacks)
+                        return;
+                    if (targetInstanceId === undefined && requireTarget) {
+                        rejectPending(id, new Error('No remote endpoint is available'));
+                        return;
+                    }
+                    if (targetInstanceId !== undefined)
+                        callbacks.expectedRemote = targetInstanceId;
+                    try {
+                        const channel = getMessageChannel();
+                        recordCallbackOwners(registeredIds, targetInstanceId ?? 'broadcast');
+                        channel.getSender().sendMessage('invokeRequest', {
+                            id,
+                            path,
+                            args: serializedArgs,
+                        }, targetInstanceId);
+                    }
+                    catch (err) {
+                        cancelTimer(timer);
+                        pending.delete(id);
+                        const released = cleanupRegisteredOnFailure();
+                        if (released.length > 0)
+                            notifyReleaseCallbacks(released);
+                        reject(err);
+                    }
+                };
+                const targetInstanceId = getPreferredRemote();
+                if (targetInstanceId !== undefined) {
+                    sendRequest(targetInstanceId);
+                }
+                else if (remoteTargetWaitDisabled) {
+                    sendRequest(undefined, false);
+                }
+                else {
+                    void waitForRemoteTarget().then(sendRequest);
+                }
             });
         },
         accessProperty(path) {
@@ -1167,64 +1473,236 @@ function createClientContext(getMessageChannel, instanceId, options = {}) {
                     return;
                 }
                 const id = createId('req');
-                const timeout = options.timeout ?? DEFAULT_TIMEOUT;
-                const timer = setTimeout(() => {
-                    pending.delete(id);
-                    reject(new Error(`Property access timed out: ${String(path.join('.'))}`));
-                }, timeout);
-                pending.set(id, { resolve, reject, timer });
-                getMessageChannel().getSender().sendMessage('accessPropertyRequest', {
-                    id,
-                    path,
+                const timer = armTimer(() => {
+                    rejectPending(id, new Error(`Property access timed out: ${String(path.join('.'))}`));
                 });
+                pending.set(id, { resolve, reject, timer });
+                let pathSerializationError;
+                try {
+                    serializePath(path);
+                }
+                catch (err) {
+                    pathSerializationError = err;
+                }
+                if (pathSerializationError !== undefined) {
+                    cancelTimer(timer);
+                    pending.delete(id);
+                    reject(pathSerializationError);
+                    return;
+                }
+                const sendRequest = (targetInstanceId, requireTarget = true) => {
+                    const callbacks = pending.get(id);
+                    if (!callbacks)
+                        return;
+                    if (targetInstanceId === undefined && requireTarget) {
+                        rejectPending(id, new Error('No remote endpoint is available'));
+                        return;
+                    }
+                    if (targetInstanceId !== undefined)
+                        callbacks.expectedRemote = targetInstanceId;
+                    try {
+                        getMessageChannel().getSender().sendMessage('accessPropertyRequest', {
+                            id,
+                            path,
+                        }, targetInstanceId);
+                    }
+                    catch (err) {
+                        cancelTimer(timer);
+                        pending.delete(id);
+                        reject(err);
+                    }
+                };
+                const targetInstanceId = getPreferredRemote();
+                if (targetInstanceId !== undefined) {
+                    sendRequest(targetInstanceId);
+                }
+                else if (remoteTargetWaitDisabled) {
+                    sendRequest(undefined, false);
+                }
+                else {
+                    void waitForRemoteTarget().then(sendRequest);
+                }
             });
         },
-        invokeFunctionById(callbackId, args, callbackOptions = {}) {
+        invokeFunctionById(callbackId, args, callbackOptions = {}, remoteInstanceId) {
             return new Promise((resolve, reject) => {
                 if (destroyed) {
                     reject(new Error('Channel has been destroyed'));
                     return;
                 }
                 const callId = createId('cbcall');
-                const timeout = options.timeout ?? DEFAULT_TIMEOUT;
-                const timer = setTimeout(() => {
-                    pending.delete(callId);
-                    reject(new Error(`Callback call timed out: ${callbackId}`));
-                }, timeout);
-                pending.set(callId, { resolve, reject, timer });
-                getMessageChannel()
-                    .getSender()
-                    .sendMessage('invokeFunctionByIdRequest', {
-                    id: callbackId,
-                    callId,
-                    args: args.map((arg) => serialize(arg, registerFunction, callbackOptions)),
+                const timer = armTimer(() => {
+                    rejectPending(callId, new Error(`Callback call timed out: ${callbackId}`));
                 });
+                pending.set(callId, { resolve, reject, timer, expectedRemote: remoteInstanceId });
+                const registeredIds = [];
+                const collectingRegister = (fn, thisArg, opts) => {
+                    const cbId = registerFunction(fn, thisArg, opts);
+                    registeredIds.push(cbId);
+                    return cbId;
+                };
+                try {
+                    const serializedArgs = args.map((arg) => serialize(arg, collectingRegister, callbackOptions));
+                    const targetInstanceId = remoteInstanceId ?? getPreferredRemote();
+                    recordCallbackOwners(registeredIds, targetInstanceId ?? 'broadcast');
+                    getMessageChannel().getSender().sendMessage('invokeFunctionByIdRequest', {
+                        id: callbackId,
+                        callId,
+                        args: serializedArgs,
+                    }, targetInstanceId);
+                }
+                catch (err) {
+                    cancelTimer(timer);
+                    pending.delete(callId);
+                    for (const cbId of registeredIds) {
+                        if (persistentRefcount.has(cbId)) {
+                            releasePersistentRegistrationById(cbId);
+                        }
+                        else {
+                            const entry = functionCache.get(cbId);
+                            if (entry) {
+                                functionCache.delete(cbId);
+                                removeFunctionIdMapping(entry.fn, entry.thisArg);
+                            }
+                        }
+                        callbackOwners.delete(cbId);
+                    }
+                    reject(err);
+                }
             });
         },
         handleRemoteDestroy(remoteInstanceId) {
             remoteCallbacksByOwner.delete(remoteInstanceId);
             persistentRemoteCallbacksByOwner.delete(remoteInstanceId);
+            knownRemotes.delete(remoteInstanceId);
+            if (boundRemoteInstanceId === remoteInstanceId) {
+                boundRemoteInstanceId = undefined;
+                const preferred = getPreferredRemote();
+                if (preferred !== undefined)
+                    boundRemoteInstanceId = preferred;
+            }
+            for (const [id, owners] of callbackOwners) {
+                if (owners === remoteInstanceId) {
+                    callbackOwners.delete(id);
+                }
+                else if (owners instanceof Set && owners.has(remoteInstanceId)) {
+                    owners.delete(remoteInstanceId);
+                    if (owners.size === 0)
+                        callbackOwners.delete(id);
+                    else if (owners.size === 1)
+                        callbackOwners.set(id, owners.values().next().value);
+                }
+            }
+            const reason = new Error(`Remote endpoint ${remoteInstanceId} was destroyed`);
+            const noKnownRemotesLeft = knownRemotes.size === 0;
+            for (const [id, callbacks] of pending) {
+                const targeted = callbacks.expectedRemote === remoteInstanceId;
+                const stranded = callbacks.expectedRemote === undefined && noKnownRemotesLeft;
+                if (!targeted && !stranded)
+                    continue;
+                cancelTimer(callbacks.timer);
+                pending.delete(id);
+                safeOnReject(callbacks);
+                callbacks.reject(reason);
+            }
+        },
+        bindRemote(remoteInstanceId) {
+            if (!remoteInstanceId || remoteInstanceId === instanceId)
+                return;
+            knownRemotes.add(remoteInstanceId);
+            if (boundRemoteInstanceId === undefined) {
+                boundRemoteInstanceId = remoteInstanceId;
+                resolveRemoteTargetWaiters(remoteInstanceId);
+            }
+        },
+        noteFreshConnect(remoteInstanceId) {
+            if (!remoteInstanceId || remoteInstanceId === instanceId)
+                return;
+            const isNew = !knownRemotes.has(remoteInstanceId);
+            knownRemotes.add(remoteInstanceId);
+            if (boundRemoteInstanceId === remoteInstanceId)
+                return;
+            if (boundRemoteInstanceId === undefined || isNew) {
+                boundRemoteInstanceId = remoteInstanceId;
+                resolveRemoteTargetWaiters(remoteInstanceId);
+            }
+        },
+        disableRemoteTargetWait() {
+            remoteTargetWaitDisabled = true;
+            resolveRemoteTargetWaiters(undefined);
+        },
+        releaseRemoteCallbacks(remoteInstanceId, ids) {
+            const lru = remoteCallbacksByOwner.get(remoteInstanceId);
+            const pmap = persistentRemoteCallbacksByOwner.get(remoteInstanceId);
+            if (!lru && !pmap)
+                return;
+            for (const id of ids) {
+                lru?.delete(id);
+                pmap?.delete(id);
+            }
+        },
+        dropLocalCallback(id, requesterInstanceId) {
+            dropLocalCallback(id, requesterInstanceId);
+        },
+        noteRemoteSeen(remoteInstanceId) {
+            if (remoteInstanceId && remoteInstanceId !== instanceId) {
+                knownRemotes.add(remoteInstanceId);
+                const preferred = getPreferredRemote();
+                if (preferred !== undefined)
+                    resolveRemoteTargetWaiters(preferred);
+            }
+        },
+        bindMethod(fn, owner) {
+            return bindMethod(fn, owner);
+        },
+        getRemoteCallbackCounts(remoteInstanceId) {
+            return {
+                lru: remoteCallbacksByOwner.get(remoteInstanceId)?.size ?? 0,
+                persistent: persistentRemoteCallbacksByOwner.get(remoteInstanceId)?.size ?? 0,
+            };
+        },
+        isDestroyed() {
+            return destroyed;
         },
         destroy(notifyRemote = true) {
             if (destroyed)
                 return;
             destroyed = true;
             if (notifyRemote) {
+                const heldRemoteIdSet = new Set();
+                for (const lru of remoteCallbacksByOwner.values()) {
+                    for (const id of lru.keys())
+                        heldRemoteIdSet.add(id);
+                }
+                for (const map of persistentRemoteCallbacksByOwner.values()) {
+                    for (const id of map.keys())
+                        heldRemoteIdSet.add(id);
+                }
+                if (heldRemoteIdSet.size > 0) {
+                    notifyReleaseCallbacks(Array.from(heldRemoteIdSet));
+                }
                 try {
                     getMessageChannel().getSender().sendMessage('destroyEndpoint', { instanceId });
                 }
-                catch {
-                    // channel may already be torn down
+                catch (err) {
+                    if (!isTransportDetachedError(err)) {
+                        warn('destroy', 'failed to notify remote of destroy', err);
+                    }
                 }
             }
             for (const [id, callbacks] of pending) {
-                clearTimeout(callbacks.timer);
+                cancelTimer(callbacks.timer);
+                safeOnReject(callbacks);
                 callbacks.reject(new Error(`Channel has been destroyed before call ${id} completed`));
             }
             pending.clear();
             functionCache.clear();
             persistentFunctionCache.clear();
-            functionIds.clear();
+            persistentRefcount.clear();
+            callbackOwners.clear();
+            knownRemotes.clear();
+            boundRemoteInstanceId = undefined;
+            resolveRemoteTargetWaiters(undefined);
             remoteCallbacksByOwner.clear();
             persistentRemoteCallbacksByOwner.clear();
         },
@@ -1296,38 +1774,55 @@ function createClientProxy(invoke, accessProperty) {
         });
         return [...basePath, ...extraPath];
     };
-    function createHandler(node) {
-        return {
+    function createNode(node) {
+        const stringChildren = new Map();
+        const symbolChildren = new Map();
+        let getCache;
+        const handler = {
             get(_target, prop) {
                 if (typeof prop === 'string') {
                     if (INTERCEPTED_STRING_PROPS.has(prop))
                         return undefined;
                     if (prop === '$get') {
-                        return (...parts) => {
-                            if (!accessProperty) {
-                                return Promise.reject(new Error('Property access is not configured'));
-                            }
-                            const basePath = node ? resolvePath(node) : [];
-                            return accessProperty(normalizePropertyPath(basePath, parts));
-                        };
+                        if (!getCache) {
+                            getCache = (...parts) => {
+                                if (!accessProperty) {
+                                    return Promise.reject(new Error('Property access is not configured'));
+                                }
+                                const basePath = node ? resolvePath(node) : [];
+                                return accessProperty(normalizePropertyPath(basePath, parts));
+                            };
+                        }
+                        return getCache;
                     }
+                    const cached = stringChildren.get(prop);
+                    if (cached !== undefined)
+                        return cached;
+                    const childNode = node ? { parent: node, key: prop } : { key: prop };
+                    const child = createNode(childNode);
+                    stringChildren.set(prop, child);
+                    return child;
                 }
-                else if (prop === Symbol.toPrimitive) {
+                if (prop === Symbol.toPrimitive)
                     return toPrimitiveDescriptor();
-                }
-                else if (INTERCEPTED_NONE_SYMBOLS.has(prop)) {
+                if (INTERCEPTED_NONE_SYMBOLS.has(prop))
                     return undefined;
-                }
+                const cached = symbolChildren.get(prop);
+                if (cached !== undefined)
+                    return cached;
                 const childNode = node ? { parent: node, key: prop } : { key: prop };
-                return new Proxy(EMPTY_TARGET, createHandler(childNode));
+                const child = createNode(childNode);
+                symbolChildren.set(prop, child);
+                return child;
             },
             apply(_target, _thisArg, argArray) {
                 const path = node ? resolvePath(node) : [];
                 return invoke(path, argArray);
             },
         };
+        return new Proxy(EMPTY_TARGET, handler);
     }
-    return new Proxy(EMPTY_TARGET, createHandler());
+    return createNode();
 }
 function isPathKey(value) {
     return typeof value === 'string' || typeof value === 'symbol';
@@ -1346,6 +1841,8 @@ function createEndpoint(options) {
     const context = createClientContext(getChannel, instanceId, options.contextOptions);
     const channel = createMessageChannel(options.poster, options.key ?? 'default', instanceId, context, processorRegistry);
     channelRef.current = channel;
+    processorRegistry.register('connectRequest', handleConnectRequest);
+    processorRegistry.register('connectResponse', handleConnectResponse);
     processorRegistry.register('invokeRequest', handleInvokeRequest);
     processorRegistry.register('invokeResponse', handleInvokeResponse);
     processorRegistry.register('accessPropertyRequest', handleAccessPropertyRequest);
@@ -1355,61 +1852,64 @@ function createEndpoint(options) {
     processorRegistry.register('releaseCallbacks', handleReleaseCallbacks);
     processorRegistry.register('destroyEndpoint', handleDestroyEndpoint);
     const proxy = createClientProxy((path, args) => context.invoke(path, args), (path) => context.accessProperty(path));
+    try {
+        channel.getSender().sendMessage('connectRequest', { instanceId });
+    }
+    catch {
+        context.disableRemoteTargetWait();
+    }
+    let destroyed = false;
     return {
         proxy,
         getContext: () => context,
+        isDestroyed: () => destroyed,
         destroy() {
-            context.destroy(true);
+            if (destroyed)
+                return;
+            destroyed = true;
             channel.destroy();
+            context.destroy(true);
         },
     };
 }
 
 function setupInMainWindow(options) {
-    const resolveTargetOrigin = createTargetOriginResolver(() => options.iframe, options.targetOrigin);
-    const poster = createWindowPoster({
+    const resolveTargetOrigin = createTargetOriginResolver(() => options.iframe, options.targetOrigin, options.strictOrigin === true);
+    return setupConnection(options, {
+        resolveTargetOrigin,
         postMessage: (message) => {
             const contentWindow = options.iframe.contentWindow;
             if (!contentWindow) {
-                throw new Error('chrome-in-iframe: iframe contentWindow is not available');
+                throw createTransportDetachedError('chrome-in-iframe: iframe contentWindow is not available');
             }
             contentWindow.postMessage(message, resolveTargetOrigin());
         },
         getExpectedSource: () => options.iframe.contentWindow,
-        allowedOrigin: options.allowedOrigin,
-    });
-    const endpoint = createEndpoint({
-        poster,
-        key: options.key,
-        contextOptions: {
-            delegateTarget: options.delegateTarget,
-            timeout: options.timeout,
-            functionCacheMax: options.functionCacheMax,
-            functionCacheTtl: options.functionCacheTtl,
-            remoteCallbackCacheMax: options.remoteCallbackCacheMax,
-            remoteCallbackCacheTtl: options.remoteCallbackCacheTtl,
-        },
+        delegateTarget: options.delegateTarget,
     });
-    const proxy = endpoint.proxy;
-    return {
-        proxy,
-        get: proxy.$get,
-        destroy: endpoint.destroy,
-    };
 }
 function setupInIframe(options = {}) {
-    const resolveTargetOrigin = createParentTargetOriginResolver(options.targetOrigin);
-    const poster = createWindowPoster({
+    const resolveTargetOrigin = createParentTargetOriginResolver(options.targetOrigin, options.strictOrigin === true);
+    return setupConnection(options, {
+        resolveTargetOrigin,
         postMessage: (message) => {
             window.parent.postMessage(message, resolveTargetOrigin());
         },
         getExpectedSource: () => window.parent,
-        allowedOrigin: options.allowedOrigin,
+    });
+}
+function setupConnection(options, sides) {
+    const allowedOrigin = createAllowedOrigin(options.allowedOrigin, sides.resolveTargetOrigin);
+    const poster = createWindowPoster({
+        postMessage: sides.postMessage,
+        getExpectedSource: sides.getExpectedSource,
+        allowedOrigin,
     });
     const endpoint = createEndpoint({
         poster,
         key: options.key,
         contextOptions: {
+            delegateTarget: sides.delegateTarget,
             timeout: options.timeout,
             functionCacheMax: options.functionCacheMax,
             functionCacheTtl: options.functionCacheTtl,
@@ -1422,6 +1922,7 @@ function setupInIframe(options = {}) {
         proxy,
         get: proxy.$get,
         destroy: endpoint.destroy,
+        isDestroyed: endpoint.isDestroyed,
     };
 }
 function exposeChromeInIframe(options) {
@@ -1438,34 +1939,90 @@ function connectChromeInIframe(options = {}) {
     };
 }
 function createWindowPoster(options) {
-    const listenerMap = new Map();
+    const subscriptions = new Map();
     return {
         postMessage(message) {
             options.postMessage(message);
         },
         addEventListener(name, callback) {
-            const listener = (event) => {
-                const messageEvent = event;
-                if (messageEvent.source !== options.getExpectedSource())
-                    return;
-                if (!isAllowedOrigin(messageEvent.origin, options.allowedOrigin))
-                    return;
-                callback(messageEvent);
+            const existing = subscriptions.get(callback);
+            if (existing)
+                windowDispatcher.remove(name, existing);
+            const sub = {
+                isExpectedSource: (source) => source === options.getExpectedSource(),
+                isAllowedOrigin: (origin) => isAllowedOrigin(origin, options.allowedOrigin),
+                deliver: callback,
             };
-            listenerMap.set(callback, listener);
-            window.addEventListener(name, listener);
+            subscriptions.set(callback, sub);
+            windowDispatcher.add(name, sub);
         },
         removeEventListener(name, callback) {
-            const listener = listenerMap.get(callback);
-            if (!listener)
+            const sub = subscriptions.get(callback);
+            if (!sub)
+                return;
+            windowDispatcher.remove(name, sub);
+            subscriptions.delete(callback);
+        },
+    };
+}
+const windowDispatcher = createWindowDispatcher();
+function createWindowDispatcher() {
+    const perName = new Map();
+    const domListeners = new Map();
+    const ensureDomListener = (name) => {
+        if (domListeners.has(name))
+            return;
+        if (typeof window === 'undefined')
+            return;
+        const handler = (event) => {
+            const messageEvent = event;
+            const subs = perName.get(name);
+            if (!subs || subs.size === 0)
+                return;
+            for (const sub of subs) {
+                if (!sub.isExpectedSource(messageEvent.source))
+                    continue;
+                if (!sub.isAllowedOrigin(messageEvent.origin))
+                    continue;
+                try {
+                    sub.deliver({ data: messageEvent.data });
+                }
+                catch (err) {
+                    warn('windowDispatcher', 'subscriber threw while delivering message', err);
+                }
+            }
+        };
+        domListeners.set(name, handler);
+        window.addEventListener(name, handler);
+    };
+    return {
+        add(name, sub) {
+            let subs = perName.get(name);
+            if (!subs) {
+                subs = new Set();
+                perName.set(name, subs);
+            }
+            subs.add(sub);
+            ensureDomListener(name);
+        },
+        remove(name, sub) {
+            const subs = perName.get(name);
+            if (!subs)
+                return;
+            subs.delete(sub);
+            if (subs.size > 0)
                 return;
-            window.removeEventListener(name, listener);
-            listenerMap.delete(callback);
+            perName.delete(name);
+            const handler = domListeners.get(name);
+            if (handler && typeof window !== 'undefined') {
+                window.removeEventListener(name, handler);
+            }
+            domListeners.delete(name);
         },
     };
 }
 function isAllowedOrigin(origin, allowedOrigin) {
-    if (!allowedOrigin)
+    if (allowedOrigin === undefined)
         return true;
     if (typeof allowedOrigin === 'function')
         return allowedOrigin(origin);
@@ -1473,24 +2030,51 @@ function isAllowedOrigin(origin, allowedOrigin) {
         return allowedOrigin.includes(origin);
     return allowedOrigin === origin;
 }
+function createAllowedOrigin(explicit, resolveTargetOrigin) {
+    if (explicit !== undefined)
+        return explicit;
+    return (origin) => {
+        const targetOrigin = resolveTargetOrigin();
+        if (targetOrigin === '*') {
+            if (typeof location !== 'undefined' && location.origin && location.origin !== 'null') {
+                return origin === location.origin;
+            }
+            return false;
+        }
+        return targetOrigin === origin;
+    };
+}
 function getGlobalChrome() {
     const chromeApi = globalThis.chrome;
     if (!chromeApi) {
-        throw new Error('chrome-in-iframe: global chrome API is not available');
+        throw new Error('chrome-in-iframe: global `chrome` API is not available. ' +
+            'Make sure this runs inside a Chrome extension page, or pass a custom ' +
+            '`chromeApi` option (e.g. for tests / non-extension environments).');
     }
     return chromeApi;
 }
-function createTargetOriginResolver(getIframe, explicit) {
+function createTargetOriginResolver(getIframe, explicit, strict) {
     if (explicit)
         return () => explicit;
-    return () => deriveOriginFromIframe(getIframe());
+    return freezeResolvedOrigin(() => deriveOriginFromIframe(getIframe(), strict === true));
 }
-function createParentTargetOriginResolver(explicit) {
+function createParentTargetOriginResolver(explicit, strict) {
     if (explicit)
         return () => explicit;
-    return () => deriveParentOrigin();
+    return freezeResolvedOrigin(() => deriveParentOrigin(strict === true));
+}
+function freezeResolvedOrigin(resolve) {
+    let frozen;
+    return () => {
+        if (frozen !== undefined)
+            return frozen;
+        const resolved = resolve();
+        if (resolved !== '*')
+            frozen = resolved;
+        return resolved;
+    };
 }
-function deriveOriginFromIframe(iframe) {
+function deriveOriginFromIframe(iframe, strict) {
     const src = iframe.src || iframe.getAttribute('src') || '';
     const origin = parseOrigin(src);
     if (origin)
@@ -1502,16 +2086,17 @@ function deriveOriginFromIframe(iframe) {
                 return loc.origin;
         }
     }
-    catch {
-        // cross-origin contentWindow.location access throws — fall through
+    catch (err) {
+        warn('deriveOriginFromIframe', 'unable to access cross-origin contentWindow.location', err);
     }
-    if (typeof console !== 'undefined') {
-        console.warn("chrome-in-iframe: unable to derive iframe origin automatically; falling back to '*'. " +
-            'Pass `targetOrigin` explicitly to lock the destination.');
+    if (strict) {
+        throw new Error('chrome-in-iframe: unable to derive iframe origin automatically; pass `targetOrigin` explicitly or set `strictOrigin: false`.');
     }
+    warn('deriveOriginFromIframe', "unable to derive iframe origin automatically; falling back to '*'. " +
+        'Pass `targetOrigin` explicitly to lock the destination.');
     return '*';
 }
-function deriveParentOrigin() {
+function deriveParentOrigin(strict) {
     if (typeof document !== 'undefined') {
         const referrer = document.referrer;
         const origin = parseOrigin(referrer);
@@ -1523,10 +2108,11 @@ function deriveParentOrigin() {
         if (first && first !== 'null')
             return first;
     }
-    if (typeof console !== 'undefined') {
-        console.warn("chrome-in-iframe: unable to derive parent origin automatically; falling back to '*'. " +
-            'Pass `targetOrigin` explicitly to lock the destination.');
+    if (strict) {
+        throw new Error('chrome-in-iframe: unable to derive parent origin automatically; pass `targetOrigin` explicitly or set `strictOrigin: false`.');
     }
+    warn('deriveParentOrigin', "unable to derive parent origin automatically; falling back to '*'. " +
+        'Pass `targetOrigin` explicitly to lock the destination.');
     return '*';
 }
 function parseOrigin(url) {
@@ -1537,10 +2123,11 @@ function parseOrigin(url) {
         if (parsed.origin && parsed.origin !== 'null')
             return parsed.origin;
     }
-    catch {
+    catch (err) {
+        warn('parseOrigin', 'failed to parse URL', url, err);
         return null;
     }
     return null;
 }
 
-export { connectChromeInIframe, exposeChromeInIframe, setupInIframe, setupInMainWindow };
+export { TRANSPORT_DETACHED, connectChromeInIframe, exposeChromeInIframe, isTransportDetachedError, setLogger, setupInIframe, setupInMainWindow };