Made of little things.

/**
 * Can a napplet frame use SharedArrayBuffer?
 *
 * Serves a page that embeds a `sandbox="allow-scripts"` srcdoc iframe (the
 * NIP-5D frame, opaque origin) under three top-level header sets, with and
 * without `allow="cross-origin-isolated"` on the iframe, and reads back what
 * the frame sees: crossOriginIsolated, SharedArrayBuffer, a blob worker doing
 * Atomics on a shared buffer, IndexedDB and localStorage.
 *
 *   npm run probe      (PLAYWRIGHT_CHROMIUM_EXECUTABLE=... for a Chromium of your own)
 *
 * Written for docs/FORK.md §4.1. Result on 2026-09-20, Chromium
 * 1194 (Playwright 1.56): the frame is isolated only when the top level sends
 * COOP same-origin plus COEP (require-corp or credentialless) AND the iframe
 * carries allow="cross-origin-isolated". Storage stays blocked in every case.
 */
import http from 'node:http';
import { chromium } from 'playwright';

const PORT = 8765;
const MODES = {
  none: {},
  'require-corp': { 'Cross-Origin-Opener-Policy': 'same-origin', 'Cross-Origin-Embedder-Policy': 'require-corp' },
  credentialless: { 'Cross-Origin-Opener-Policy': 'same-origin', 'Cross-Origin-Embedder-Policy': 'credentialless' },
};

const PROBE = `<script>
(function () {
  const r = { coi: self.crossOriginIsolated, sab: typeof SharedArrayBuffer, origin: location.origin };
  try { new SharedArrayBuffer(8); r.sabNew = 'ok'; } catch (e) { r.sabNew = 'ERR ' + e.name; }
  try { indexedDB.open('x'); r.idb = 'ok'; } catch (e) { r.idb = 'ERR ' + e.name; }
  try { localStorage.getItem('x'); r.ls = 'ok'; } catch (e) { r.ls = 'ERR ' + e.name; }
  r.worker = 'pending';
  try {
    const src = 'self.onmessage = e => { let ok = e.data instanceof SharedArrayBuffer;'
      + ' try { Atomics.add(new Int32Array(e.data), 0, 1); } catch (x) { ok = "atomics " + x.name }'
      + ' postMessage({ ok, coi: self.crossOriginIsolated }); };';
    const w = new Worker(URL.createObjectURL(new Blob([src], { type: 'text/javascript' })));
    w.onmessage = (e) => { r.worker = JSON.stringify(e.data); parent.postMessage(r, '*'); };
    w.onerror = (e) => { r.worker = 'ERR ' + e.message; parent.postMessage(r, '*'); };
    let sab = null; try { sab = new SharedArrayBuffer(4); } catch {}
    w.postMessage(sab ?? 'no-sab');
  } catch (e) { r.worker = 'ERR ' + e.name; }
  parent.postMessage(r, '*');
})();
</script>`;

function page(allow) {
  return `<!doctype html><meta charset="utf-8"><body><script>
window.results = [];
addEventListener('message', (e) => window.results.push(e.data));
const f = document.createElement('iframe');
f.sandbox.add('allow-scripts');
${allow ? "f.setAttribute('allow', 'cross-origin-isolated');" : ''}
f.srcdoc = ${JSON.stringify(PROBE).replace(/<\/script/g, '<\\/script')};
document.body.append(f);
</script>`;
}

const server = http.createServer((req, res) => {
  const [, mode, variant] = req.url.split('/');
  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...(MODES[mode] ?? {}) });
  res.end(page(variant === 'allow'));
}).listen(PORT);

const browser = await chromium.launch({ executablePath: process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE || undefined });
const context = await browser.newContext();
const rows = [];
for (const mode of Object.keys(MODES)) {
  for (const allow of [false, true]) {
    const tab = await context.newPage();
    await tab.goto(`http://localhost:${PORT}/${mode}/${allow ? 'allow' : 'plain'}`);
    await tab.waitForTimeout(1500);
    const { top, frame } = await tab.evaluate(() => ({ top: self.crossOriginIsolated, frame: window.results.at(-1) }));
    rows.push({ mode, allow, top, ...frame });
    await tab.close();
  }
}
await browser.close();
server.close();
console.table(rows, ['mode', 'allow', 'top', 'coi', 'sab', 'sabNew', 'worker', 'idb', 'ls']);