sliccy 5.5.0 → 5.6.0

package/dist/node-server/_shared/base64.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Decode a base64 string to `Uint8Array`.
+ *
+ * Prefers Node's `Buffer.from(b64, 'base64')` when available — measurably
+ * faster than the per-byte `atob` loop for the multi-MB S3 mount and
+ * federated-VFS payloads the CLI float moves. The browser / extension
+ * service-worker fallback round-trips through `atob`, which is a
+ * universal global.
+ *
+ * Two normalizations bridge the platform gap so both paths are
+ * observationally identical:
+ *   - the Node path copies the `Buffer` into a fresh `Uint8Array` so the
+ *     caller gets a plain prototype backed by a standalone `ArrayBuffer`
+ *     (not Node's slab pool, which `Buffer.from` draws from for small
+ *     inputs) — callers that read `.buffer` downstream and tests that
+ *     deep-equal the bytes both need this;
+ *   - the Node path validates against {@link STRICT_BASE64_RE} first and
+ *     throws on invalid input. `atob` already throws; `Buffer.from`
+ *     silently strips invalid characters, which would let bad payloads
+ *     through callers that rely on the decoder rejecting them.
+ */
+export declare function base64ToUint8(b64: string): Uint8Array<ArrayBuffer>;
+/**
+ * Encode a `Uint8Array` to a base64 string.
+ *
+ * Prefers Node's `Buffer.from(bytes).toString('base64')` when available.
+ * Otherwise builds the binary string in {@link CHUNK_SIZE}-byte chunks
+ * through `String.fromCharCode.apply` — the unchunked spread overflows
+ * the call stack on inputs larger than ~64 KiB.
+ */
+export declare function uint8ToBase64(bytes: Uint8Array): string;
+//# sourceMappingURL=base64.d.ts.map

package/dist/node-server/_shared/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../src/base64.ts"],"names":[],"mappings":"AAiDA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAclE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAWvD"}

package/dist/node-server/_shared/base64.js

@@ -0,0 +1,90 @@
+// Universal Uint8Array ↔ base64 codec.
+//
+// One implementation shared across the browser, the extension service
+// worker, and Node 22+ — same correctness, same chunk size, same Node
+// fast-path. Replaces 13+ hand-rolled copies that had drifted on chunk
+// size (8192 vs 0x8000) and on whether they used `Buffer` at all; see
+// the inventory in issue #1087.
+//
+// Conforms to `packages/shared-ts/CLAUDE.md` "universal globals" rule:
+// `atob` / `btoa` are global in every runtime we target; the Node
+// `Buffer` fast-path is feature-detected via `globalThis` and the
+// structural type is declared locally so this package keeps building
+// without `@types/node` (the same pattern `sign-and-forward.ts` uses).
+// `0x8000` (32 KiB) matches the chunk size in
+// `kernel/transport-binary-codec.ts` and the rationale comment there:
+// the naive `String.fromCharCode(...bytes)` overflows the call stack on
+// inputs larger than ~64 KiB; chunking keeps the worst case bounded.
+const CHUNK_SIZE = 0x8000;
+function nodeBuffer() {
+    return globalThis.Buffer;
+}
+// Strict base64 grammar (no URL-safe variants — matches `atob`). Used to
+// gate Node's lenient `Buffer.from('base64')` so a malformed input throws
+// here instead of being silently stripped: the signed-fetch transport
+// surfaces a malformed reply as a clean "decode failed" EIO and relies
+// on the decoder being strict.
+//
+// Alphabet alone is not enough — `Buffer.from('abcde', 'base64')` and
+// `Buffer.from('abcd=', 'base64')` both decode successfully (and silently
+// drop or pad the trailing junk), while `atob` throws. Enforce the full
+// shape: a run of 4-char groups, optionally followed by one final group
+// of 2+`==`, 3+`=`, or 4 alphabet chars. Empty string is valid.
+const STRICT_BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})?$/;
+/**
+ * Decode a base64 string to `Uint8Array`.
+ *
+ * Prefers Node's `Buffer.from(b64, 'base64')` when available — measurably
+ * faster than the per-byte `atob` loop for the multi-MB S3 mount and
+ * federated-VFS payloads the CLI float moves. The browser / extension
+ * service-worker fallback round-trips through `atob`, which is a
+ * universal global.
+ *
+ * Two normalizations bridge the platform gap so both paths are
+ * observationally identical:
+ *   - the Node path copies the `Buffer` into a fresh `Uint8Array` so the
+ *     caller gets a plain prototype backed by a standalone `ArrayBuffer`
+ *     (not Node's slab pool, which `Buffer.from` draws from for small
+ *     inputs) — callers that read `.buffer` downstream and tests that
+ *     deep-equal the bytes both need this;
+ *   - the Node path validates against {@link STRICT_BASE64_RE} first and
+ *     throws on invalid input. `atob` already throws; `Buffer.from`
+ *     silently strips invalid characters, which would let bad payloads
+ *     through callers that rely on the decoder rejecting them.
+ */
+export function base64ToUint8(b64) {
+    const B = nodeBuffer();
+    if (B) {
+        if (!STRICT_BASE64_RE.test(b64)) {
+            throw new Error('Invalid base64 string');
+        }
+        return new Uint8Array(B.from(b64, 'base64'));
+    }
+    const binary = atob(b64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Encode a `Uint8Array` to a base64 string.
+ *
+ * Prefers Node's `Buffer.from(bytes).toString('base64')` when available.
+ * Otherwise builds the binary string in {@link CHUNK_SIZE}-byte chunks
+ * through `String.fromCharCode.apply` — the unchunked spread overflows
+ * the call stack on inputs larger than ~64 KiB.
+ */
+export function uint8ToBase64(bytes) {
+    const B = nodeBuffer();
+    if (B) {
+        return B.from(bytes).toString('base64');
+    }
+    let binary = '';
+    for (let i = 0; i < bytes.byteLength; i += CHUNK_SIZE) {
+        const slice = bytes.subarray(i, Math.min(i + CHUNK_SIZE, bytes.byteLength));
+        binary += String.fromCharCode.apply(null, slice);
+    }
+    return btoa(binary);
+}
+//# sourceMappingURL=base64.js.map

package/dist/node-server/_shared/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../src/base64.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AAEvE,8CAA8C;AAC9C,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,UAAU,GAAG,MAAM,CAAC;AAa1B,SAAS,UAAU;IACjB,OAAQ,UAA0C,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,+BAA+B;AAC/B,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,MAAM,gBAAgB,GACpB,mFAAmF,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/dist/node-server/_shared/index.d.ts

@@ -1,3 +1,4 @@
+export * from './base64.js';
 export * from './cdp-frame-unmask.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './secret-masking.js';

package/dist/node-server/_shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/node-server/_shared/index.js

@@ -1,4 +1,5 @@
 // Re-exports added in Task 1.2 (secret-masking) and Task 1.3 (secrets-pipeline).
+export * from './base64.js';
 export * from './cdp-frame-unmask.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './secret-masking.js';

package/dist/node-server/_shared/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/node-server/_shared/sign-and-forward.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-and-forward.d.ts","sourceRoot":"","sources":["../src/sign-and-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,QAAA,MAAM,eAAe,mDAAoD,CAAC;AAC1E,KAAK,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAiBrD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,uBAAuB,GAC/B,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,cAAc,GACd,UAAU,CAAC;AAEf,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC/C;AA2ID;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,EAClD,KAAK,EAAE,YAAY,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAsF9B;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,EAClD,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA6D9B"}
+{"version":3,"file":"sign-and-forward.d.ts","sourceRoot":"","sources":["../src/sign-and-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,QAAA,MAAM,eAAe,mDAAoD,CAAC;AAC1E,KAAK,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAiBrD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,uBAAuB,GAC/B,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,cAAc,GACd,UAAU,CAAC;AAEf,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC/C;AA+FD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,EAClD,KAAK,EAAE,YAAY,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAsF9B;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,EAClD,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA6D9B"}

package/dist/node-server/_shared/sign-and-forward.js

@@ -16,6 +16,7 @@
  *     wraps these in Express handlers via a SecretStore adapter)
  *   - tests in `packages/shared-ts/tests/sign-and-forward.test.ts`
  */
+import { base64ToUint8, uint8ToBase64 } from './base64.js';
 import { signSigV4 } from './sigv4.js';
 // ---------------- envelope contract ----------------
 const ALLOWED_METHODS = ['GET', 'PUT', 'POST', 'DELETE', 'HEAD'];
@@ -31,38 +32,7 @@ const HOP_BY_HOP = new Set([
     'upgrade',
 ]);
 const DA_ORIGIN = 'https://admin.da.live';
-function nodeBuffer() {
-    return globalThis.Buffer;
-}
-function decodeBase64(b64) {
-    // Node fast-path: Buffer.from decodes the multi-MB S3 mount payloads the CLI
-    // float moves far faster than the per-byte atob loop. Feature-detected so the
-    // browser and extension service-worker bundles (no Buffer global) fall back to
-    // the universal path. Buffer extends Uint8Array, so the return type holds.
-    const B = nodeBuffer();
-    if (B) {
-        return B.from(b64, 'base64');
-    }
-    // atob is a global in browsers, extension service workers, and Node 22+.
-    const binary = atob(b64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-}
-function encodeBase64(bytes) {
-    // Node fast-path — see decodeBase64.
-    const B = nodeBuffer();
-    if (B) {
-        return B.from(bytes).toString('base64');
-    }
-    let binary = '';
-    for (let i = 0; i < bytes.length; i++) {
-        binary += String.fromCharCode(bytes[i]);
-    }
-    return btoa(binary);
-}
+// ---------------- helpers ----------------
 function isAllowedMethod(m) {
     return typeof m === 'string' && ALLOWED_METHODS.includes(m);
 }
@@ -175,7 +145,7 @@ export async function executeS3SignAndForward(env, store, fetchImpl = fetch) {
         };
     }
     const body = typeof env.bodyBase64 === 'string' && env.bodyBase64.length > 0
-        ? decodeBase64(env.bodyBase64)
+        ? base64ToUint8(env.bodyBase64)
         : undefined;
     const signed = await signSigV4({
         method: env.method,
@@ -207,7 +177,7 @@ export async function executeS3SignAndForward(env, store, fetchImpl = fetch) {
         ok: true,
         status: upstream.status,
         headers: passthroughHeaders(upstream),
-        bodyBase64: encodeBase64(upstreamBody),
+        bodyBase64: uint8ToBase64(upstreamBody),
     };
 }
 /**
@@ -247,7 +217,7 @@ export async function executeDaSignAndForward(env, fetchImpl = fetch) {
         };
     }
     const body = typeof env.bodyBase64 === 'string' && env.bodyBase64.length > 0
-        ? decodeBase64(env.bodyBase64)
+        ? base64ToUint8(env.bodyBase64)
         : undefined;
     let upstream;
     try {
@@ -272,7 +242,7 @@ export async function executeDaSignAndForward(env, fetchImpl = fetch) {
         ok: true,
         status: upstream.status,
         headers: passthroughHeaders(upstream),
-        bodyBase64: encodeBase64(upstreamBody),
+        bodyBase64: uint8ToBase64(upstreamBody),
     };
 }
 //# sourceMappingURL=sign-and-forward.js.map

package/dist/node-server/_shared/sign-and-forward.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-and-forward.js","sourceRoot":"","sources":["../src/sign-and-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,sDAAsD;AAEtD,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAG1E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAwE1C,SAAS,UAAU;IACjB,OAAQ,UAA0C,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,qCAAqC;IACrC,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,yBAA0B,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAmB;IAC/D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;IAExE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,YAAY,IAAI,4CAA4C;YAC1D,6BAA6B,IAAI,wBAAwB,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,YAAY,IAAI,gDAAgD;YAC9D,6BAA6B,IAAI,4BAA4B,CAChE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW;QACX,eAAe;QACf,YAAY,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACzD,MAAM,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,WAAW;QAC7D,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC;QAChD,SAAS,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,MAAM;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,OAAkB,EAClB,MAAc,EACd,GAAW,EACX,KAA8B;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,gBAAgB,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAEvD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB;IAC5C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAkD,EAClD,KAAmB,EACnB,YAA0B,KAAK;IAE/B,IACE,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ;QAChC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uEAAuE;YAC9E,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;YACjE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B;QACE,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG;QACH,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACnD,IAAI;KACL,EACD;QACE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,EACD,OAAO,CAAC,MAAM,EACd,IAAI,CACL,CAAC;IAEF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAA2B;SACzC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7E,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAkD,EAClD,YAA0B,KAAK;IAE/B,IAAI,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC;YAC9C,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;YACjE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBACtB,aAAa,EAAE,UAAU,GAAG,CAAC,QAAQ,EAAE;aACxC;YACD,IAAI,EAAE,IAA2B;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7E,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-and-forward.js","sourceRoot":"","sources":["../src/sign-and-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,sDAAsD;AAEtD,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAG1E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC;AA6D1C,4CAA4C;AAE5C,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,yBAA0B,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAmB;IAC/D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC;IAExE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,YAAY,IAAI,4CAA4C;YAC1D,6BAA6B,IAAI,wBAAwB,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,YAAY,IAAI,gDAAgD;YAC9D,6BAA6B,IAAI,4BAA4B,CAChE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW;QACX,eAAe;QACf,YAAY,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC;QACzD,MAAM,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,WAAW;QAC7D,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC;QAChD,SAAS,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,MAAM;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,OAAkB,EAClB,MAAc,EACd,GAAW,EACX,KAA8B;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,gBAAgB,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAEvD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB;IAC5C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAkD,EAClD,KAAmB,EACnB,YAA0B,KAAK;IAE/B,IACE,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ;QAChC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EACrC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uEAAuE;YAC9E,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;YACjE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B;QACE,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG;QACH,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACnD,IAAI;KACL,EACD;QACE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,EACD,OAAO,CAAC,MAAM,EACd,IAAI,CACL,CAAC;IAEF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAA2B;SACzC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7E,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAkD,EAClD,YAA0B,KAAK;IAE/B,IAAI,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC;YAC9C,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;YACjE,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE;gBACP,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBACtB,aAAa,EAAE,UAAU,GAAG,CAAC,QAAQ,EAAE;aACxC;YACD,IAAI,EAAE,IAA2B;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7E,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/node-server/electron-controller.d.ts

@@ -116,12 +116,25 @@ export interface ThinBootstrapSet {
  * 'no-src' / 'blank:<href>'`.
  */
 export declare const OVERLAY_LOADED_PROBE_EXPRESSION = "(function() {\n          var host = document.getElementById('slicc-electron-overlay-root');\n          if (!host || !host.shadowRoot) return 'no-host';\n          var iframe = host.shadowRoot.querySelector('iframe');\n          if (!iframe) return 'no-iframe';\n          if (!iframe.src) return 'no-src';\n          try {\n            // Thin-bridge overlay is ALWAYS cross-origin (hosted webapp) vs the app\n            // document. A committed cross-origin navigation makes this access THROW.\n            // Any READABLE href means the cross-origin nav did NOT commit \u2014 still\n            // about:blank, or swapped to chrome-error://chromewebdata/ by a CSP block \u2014\n            // so the overlay did NOT load and the setBypassCSP escalation must fire.\n            var href = iframe.contentWindow && iframe.contentWindow.location ? iframe.contentWindow.location.href : '';\n            return 'blank:' + href;\n          } catch (e) {\n            return 'ok';\n          }\n        })()";
+/**
+ * JS probe that reports whether the overlay was *evicted* — i.e. the
+ * `window.__SLICC_ELECTRON_OVERLAY__` marker is still present (the bootstrap
+ * ran at least once on this document) but the `#slicc-electron-overlay-root`
+ * host element is gone, which happens when an SPA framework (React/Vue)
+ * re-renders the DOM root out from under it on an in-page route change.
+ * Returns `'evicted'` only in that exact state so re-injection is gated to the
+ * genuine eviction case and never loops while the host element is still
+ * attached. A full document replacement wipes the marker too, so that case
+ * reports `'ok'` here and is covered by the new-document hook instead.
+ */
+export declare const OVERLAY_EVICTED_PROBE_EXPRESSION = "(function() {\n          try {\n            var hasMarker = typeof window.__SLICC_ELECTRON_OVERLAY__ !== 'undefined';\n            var hasRoot = !!document.getElementById('slicc-electron-overlay-root');\n            return (hasMarker && !hasRoot) ? 'evicted' : 'ok';\n          } catch (e) {\n            return 'ok';\n          }\n        })()";
 export declare class ElectronOverlayInjector {
     private readonly cdpPort;
     private readonly servePort;
     /** Thin-mode bootstrap pair — the only overlay path. */
     private readonly thinBootstraps;
     private readonly probeDelayMs;
+    private readonly presenceCheckIntervalMs;
     private readonly connections;
     private readonly cspBypassedTargets;
     /**
@@ -156,6 +169,7 @@ export declare class ElectronOverlayInjector {
         servePort: number;
         thinBootstraps?: ThinBootstrapSet;
         probeDelayMs?: number;
+        presenceCheckIntervalMs?: number;
     }): ElectronOverlayInjector;
     /** Test-only: snapshot the elected leader target URL (null when no leader). */
     _testingLeaderTargetUrl(): string | null;
@@ -199,6 +213,33 @@ export declare class ElectronOverlayInjector {
      * bootstrap is target-specific (leader vs. follower).
      */
     private buildThemedBootstrap;
+    /**
+     * Wrap the target's role bootstrap in a top-frame guard for use as a
+     * `Page.addScriptToEvaluateOnNewDocument` source. The hook fires in every
+     * frame of a new document, so without the guard the overlay iframe (the
+     * hosted webapp, which also ships `__SLICC_ELECTRON_OVERLAY__`) would re-run
+     * the bootstrap inside itself and recurse. Re-using `resolveBootstrapForTarget`
+     * keeps the re-injected overlay's leader/follower role stable.
+     */
+    private buildNewDocumentBootstrap;
+    /**
+     * Evaluate {@link OVERLAY_EVICTED_PROBE_EXPRESSION} on the target and resolve
+     * `true` only when the overlay marker is present but the host element is gone
+     * — the SPA-DOM-root eviction case that re-injection must repair. Mirrors
+     * {@link probeOverlayIframeLoaded}'s one-shot message-listener pattern.
+     */
+    private probeOverlayEvicted;
+    /**
+     * Re-inject the overlay if (and only if) it was evicted from an
+     * already-connected target — an in-page SPA route change or DOM-root
+     * re-render that removed `#slicc-electron-overlay-root` while the
+     * `__SLICC_ELECTRON_OVERLAY__` marker persists. Gated on the eviction probe
+     * so it is idempotent and never loops while the host element is still
+     * attached, and skipped while the CSP-bypass reload / Fetch-proxy escalation
+     * owns injection (`pendingReload`). Re-uses the target's existing role
+     * bootstrap, so no leader/follower re-election occurs.
+     */
+    private reinjectIfEvicted;
     /**
      * Handle the initial CDP `ws.on('open', ...)` event for a target: enable
      * Runtime/Page, set CSP bypass, detect theme, inject the overlay, and (on a

package/dist/node-server/electron-controller.js

@@ -10,6 +10,12 @@ import { BRIDGE_TOKEN_QUERY_PARAM, BRIDGE_WS_QUERY_PARAM } from './bridge-securi
 import { buildElectronAppLaunchSpec, buildElectronOverlayBootstrapScript, buildElectronOverlayEntryUrl, ELECTRON_OVERLAY_APP_PATH, getElectronOverlayEntryDistPath, getElectronServeOrigin, selectBestOverlayTargets, } from './electron-runtime.js';
 const execFile = promisify(nodeExecFile);
 const ELECTRON_OVERLAY_SYNC_INTERVAL_MS = 1500;
+/**
+ * Cadence of the per-connection overlay presence re-check. Covers SPAs that
+ * re-render their DOM root (evicting `#slicc-electron-overlay-root`) without
+ * emitting any navigation event for the event-driven re-injection to hook.
+ */
+const ELECTRON_OVERLAY_PRESENCE_CHECK_INTERVAL_MS = 2000;
 /**
  * Query param name used to mark the role of an overlay tab on the hosted
  * launcher URL. The pinned leader carries `role=leader`; auto-follow
@@ -516,12 +522,33 @@ export const OVERLAY_LOADED_PROBE_EXPRESSION = `(function() {
             return 'ok';
           }
         })()`;
+/**
+ * JS probe that reports whether the overlay was *evicted* — i.e. the
+ * `window.__SLICC_ELECTRON_OVERLAY__` marker is still present (the bootstrap
+ * ran at least once on this document) but the `#slicc-electron-overlay-root`
+ * host element is gone, which happens when an SPA framework (React/Vue)
+ * re-renders the DOM root out from under it on an in-page route change.
+ * Returns `'evicted'` only in that exact state so re-injection is gated to the
+ * genuine eviction case and never loops while the host element is still
+ * attached. A full document replacement wipes the marker too, so that case
+ * reports `'ok'` here and is covered by the new-document hook instead.
+ */
+export const OVERLAY_EVICTED_PROBE_EXPRESSION = `(function() {
+          try {
+            var hasMarker = typeof window.__SLICC_ELECTRON_OVERLAY__ !== 'undefined';
+            var hasRoot = !!document.getElementById('slicc-electron-overlay-root');
+            return (hasMarker && !hasRoot) ? 'evicted' : 'ok';
+          } catch (e) {
+            return 'ok';
+          }
+        })()`;
 export class ElectronOverlayInjector {
     cdpPort;
     servePort;
     /** Thin-mode bootstrap pair — the only overlay path. */
     thinBootstraps;
     probeDelayMs;
+    presenceCheckIntervalMs;
     connections = new Map();
     cspBypassedTargets = new Set();
     /**
@@ -532,11 +559,12 @@ export class ElectronOverlayInjector {
     leaderTargetUrl = null;
     syncTimer = null;
     syncing = false;
-    constructor(cdpPort, servePort, thinBootstraps, probeDelayMs = 1500) {
+    constructor(cdpPort, servePort, thinBootstraps, probeDelayMs = 1500, presenceCheckIntervalMs = ELECTRON_OVERLAY_PRESENCE_CHECK_INTERVAL_MS) {
         this.cdpPort = cdpPort;
         this.servePort = servePort;
         this.thinBootstraps = thinBootstraps;
         this.probeDelayMs = probeDelayMs;
+        this.presenceCheckIntervalMs = presenceCheckIntervalMs;
     }
     static async create(options) {
         const bundleSource = await loadElectronOverlayBundleSource(options);
@@ -558,7 +586,7 @@ export class ElectronOverlayInjector {
      * `_testing_*` hooks on `ElectronOverlayInjector`.
      */
     static _createForTesting(options) {
-        return new ElectronOverlayInjector(options.cdpPort ?? 9223, options.servePort, options.thinBootstraps ?? { leader: '/* test-leader */', follower: '/* test-follower */' }, options.probeDelayMs ?? 1500);
+        return new ElectronOverlayInjector(options.cdpPort ?? 9223, options.servePort, options.thinBootstraps ?? { leader: '/* test-leader */', follower: '/* test-follower */' }, options.probeDelayMs ?? 1500, options.presenceCheckIntervalMs ?? ELECTRON_OVERLAY_PRESENCE_CHECK_INTERVAL_MS);
     }
     /** Test-only: snapshot the elected leader target URL (null when no leader). */
     _testingLeaderTargetUrl() {
@@ -739,6 +767,76 @@ export class ElectronOverlayInjector {
         const themeScript = `try{localStorage.setItem('slicc-theme',${JSON.stringify(theme)})}catch(e){}`;
         return `${themeScript}\n${this.resolveBootstrapForTarget(target)}`;
     }
+    /**
+     * Wrap the target's role bootstrap in a top-frame guard for use as a
+     * `Page.addScriptToEvaluateOnNewDocument` source. The hook fires in every
+     * frame of a new document, so without the guard the overlay iframe (the
+     * hosted webapp, which also ships `__SLICC_ELECTRON_OVERLAY__`) would re-run
+     * the bootstrap inside itself and recurse. Re-using `resolveBootstrapForTarget`
+     * keeps the re-injected overlay's leader/follower role stable.
+     */
+    buildNewDocumentBootstrap(target) {
+        const bootstrap = this.resolveBootstrapForTarget(target);
+        return `(function(){try{if(window.top!==window.self)return;}catch(e){return;}\n${bootstrap}\n})();`;
+    }
+    /**
+     * Evaluate {@link OVERLAY_EVICTED_PROBE_EXPRESSION} on the target and resolve
+     * `true` only when the overlay marker is present but the host element is gone
+     * — the SPA-DOM-root eviction case that re-injection must repair. Mirrors
+     * {@link probeOverlayIframeLoaded}'s one-shot message-listener pattern.
+     */
+    async probeOverlayEvicted(ws, send) {
+        return new Promise((resolve) => {
+            const probeId = send('Runtime.evaluate', {
+                expression: OVERLAY_EVICTED_PROBE_EXPRESSION,
+                awaitPromise: false,
+                returnByValue: true,
+            });
+            const timeout = setTimeout(() => {
+                cleanup();
+                resolve(false);
+            }, 3000);
+            const onMessage = (data) => {
+                try {
+                    const msg = JSON.parse(data.toString());
+                    if (msg.id === probeId) {
+                        cleanup();
+                        resolve(msg.result?.result?.value === 'evicted');
+                    }
+                }
+                catch {
+                    /* ignore */
+                }
+            };
+            const cleanup = () => {
+                clearTimeout(timeout);
+                ws.off('message', onMessage);
+            };
+            ws.on('message', onMessage);
+        });
+    }
+    /**
+     * Re-inject the overlay if (and only if) it was evicted from an
+     * already-connected target — an in-page SPA route change or DOM-root
+     * re-render that removed `#slicc-electron-overlay-root` while the
+     * `__SLICC_ELECTRON_OVERLAY__` marker persists. Gated on the eviction probe
+     * so it is idempotent and never loops while the host element is still
+     * attached, and skipped while the CSP-bypass reload / Fetch-proxy escalation
+     * owns injection (`pendingReload`). Re-uses the target's existing role
+     * bootstrap, so no leader/follower re-election occurs.
+     */
+    async reinjectIfEvicted(ws, send, target, state) {
+        if (ws.readyState !== WebSocket.OPEN || state.pendingReload)
+            return;
+        const evicted = await this.probeOverlayEvicted(ws, send);
+        if (!evicted || ws.readyState !== WebSocket.OPEN || state.pendingReload)
+            return;
+        console.log(`[electron-float] Overlay evicted, re-injecting: ${target.url}`);
+        send('Runtime.evaluate', {
+            expression: this.resolveBootstrapForTarget(target),
+            awaitPromise: false,
+        });
+    }
     /**
      * Handle the initial CDP `ws.on('open', ...)` event for a target: enable
      * Runtime/Page, set CSP bypass, detect theme, inject the overlay, and (on a
@@ -755,6 +853,16 @@ export class ElectronOverlayInjector {
         console.log(`[electron-float] Connected to target, bypassed=${alreadyBypassed}, url=${target.url}`);
         send('Runtime.enable');
         send('Page.enable');
+        // Install the role bootstrap as a permanent new-document hook (parity with
+        // swift-server) so a full document reload / load-driven navigation of this
+        // already-connected target re-injects the overlay automatically. Without
+        // this, `syncTargets` only injects into brand-new CDP targets, so a reload
+        // of an existing target would lose the overlay permanently (the marker is
+        // wiped along with the host element, so the eviction re-check below can't
+        // recover it).
+        send('Page.addScriptToEvaluateOnNewDocument', {
+            source: this.buildNewDocumentBootstrap(target),
+        });
         // Set CSP bypass — affects future resource loads on the current page
         send('Page.setBypassCSP', { enabled: true });
         if (alreadyBypassed) {
@@ -939,8 +1047,24 @@ export class ElectronOverlayInjector {
             pendingCspEscalation: false,
             fetchProxyActive: false,
         };
+        // Periodic presence re-check: covers SPAs that re-render their DOM root
+        // (evicting the overlay) without firing a navigation event. Cleared on
+        // close/error so it never outlives the connection.
+        let presenceTimer = null;
+        const clearPresenceTimer = () => {
+            if (presenceTimer) {
+                clearInterval(presenceTimer);
+                presenceTimer = null;
+            }
+        };
         ws.on('open', () => {
             this.handleSocketOpen(ws, send, target, state);
+            presenceTimer = setInterval(() => {
+                void this.reinjectIfEvicted(ws, send, target, state).catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    console.warn(`[electron-float] Presence-check re-injection failed: ${message}`);
+                });
+            }, this.presenceCheckIntervalMs);
         });
         // Handle CDP events: lifecycle events and Fetch interception
         ws.on('message', (data) => {
@@ -950,6 +1074,19 @@ export class ElectronOverlayInjector {
                 if (msg.method === 'Page.loadEventFired' && state.pendingReload) {
                     this.handlePageLoadAfterReload(ws, send, target, state);
                 }
+                // In-page SPA route change (history.pushState / hashchange) — no new
+                // document is created, so the new-document hook never fires. Re-inject
+                // the role bootstrap if the host element was evicted. `Page.frameNavigated`
+                // is handled only for the main frame (subframe navs never touch the
+                // top-level overlay), and the eviction probe keeps the main-frame full
+                // navigation a no-op (its marker is wiped, so the new-document hook owns it).
+                const isMainFrameNavigated = msg.method === 'Page.frameNavigated' && !msg.params?.frame?.parentId;
+                if (msg.method === 'Page.navigatedWithinDocument' || isMainFrameNavigated) {
+                    void this.reinjectIfEvicted(ws, send, target, state).catch((error) => {
+                        const message = error instanceof Error ? error.message : String(error);
+                        console.warn(`[electron-float] Navigation re-injection failed: ${message}`);
+                    });
+                }
                 if (msg.method === 'Fetch.requestPaused' && state.fetchProxyActive) {
                     this.handleFetchRequestPaused(ws, send, msg);
                 }
@@ -959,11 +1096,13 @@ export class ElectronOverlayInjector {
             }
         });
         ws.on('close', () => {
+            clearPresenceTimer();
             if (this.connections.get(targetId) === ws) {
                 this.connections.delete(targetId);
             }
         });
         ws.on('error', (error) => {
+            clearPresenceTimer();
             const message = error instanceof Error ? error.message : String(error);
             console.error(`[electron-float] Overlay target connection failed for ${target.url}:`, message);
             if (this.connections.get(targetId) === ws) {