diff --git a/.depcheckrc.yml b/.depcheckrc.yml
index 115a7ce4d..d33658e87 100644
--- a/.depcheckrc.yml
+++ b/.depcheckrc.yml
@@ -11,5 +11,6 @@ ignores:
   - 'jsdom'
   - 'prettier-plugin-*'
   - 'typedoc'
+  - 'vite-tsconfig-paths'
   - 'vite'
   - 'vitest'
diff --git a/.eslintrc.js b/.eslintrc.cjs
similarity index 88%
rename from .eslintrc.js
rename to .eslintrc.cjs
index 31d833a3a..597f96f9a 100644
--- a/.eslintrc.js
+++ b/.eslintrc.cjs
@@ -12,7 +12,7 @@ module.exports = {
   },
 
   ignorePatterns: [
-    '!.eslintrc.js',
+    '!.eslintrc.cjs',
     '!vite.config.mts',
     '!vitest.config.mts',
     'node_modules',
@@ -27,6 +27,14 @@ module.exports = {
     // in `@metamask/eslint-config-nodejs` in the future.
     'import/no-nodejs-modules': 'off',
 
+    'import/no-useless-path-segments': [
+      'error',
+      {
+        // Enabling this causes false errors in ESM files.
+        noUselessIndex: false,
+      },
+    ],
+
     // This prevents using Node.js and/or browser specific globals. We
     // currently use both in our codebase, so this rule is disabled.
     'no-restricted-globals': 'off',
@@ -34,7 +42,7 @@ module.exports = {
 
   overrides: [
     {
-      files: ['*.js', '*.cjs'],
+      files: ['*.cjs'],
       parserOptions: {
         sourceType: 'script',
         ecmaVersion: '2020',
@@ -42,7 +50,7 @@ module.exports = {
     },
 
     {
-      files: ['*.mjs'],
+      files: ['*.js', '*.mjs'],
       parserOptions: {
         sourceType: 'module',
         ecmaVersion: '2020',
@@ -70,8 +78,8 @@ module.exports = {
       rules: {
         '@typescript-eslint/no-explicit-any': 'error',
 
-        // This rule is broken, and without the `allowAny` option, it causes
-        // a lot of false positives.
+        // This rule is broken, and without the `allowAny` option, it reports a lot
+        // of false errors.
         '@typescript-eslint/restrict-template-expressions': [
           'error',
           {
@@ -98,6 +106,15 @@ module.exports = {
       },
     },
 
+    {
+      // Overrides of overrides.
+      files: ['*'],
+      rules: {
+        // This prevents pretty formatting of comments with multi-line lists entries.
+        'jsdoc/check-indentation': 'off',
+      },
+    },
+
     {
       // @metamask/eslint-plugin-vitest does not exist, so this is copied from the
       // jest-equivalent. All of the rules we specify are the same. Ref:
diff --git a/.prettierrc.js b/.prettierrc.cjs
similarity index 100%
rename from .prettierrc.js
rename to .prettierrc.cjs
diff --git a/constraints.pro b/constraints.pro
index be0347393..7ac5e7b93 100644
--- a/constraints.pro
+++ b/constraints.pro
@@ -209,9 +209,11 @@ gen_enforced_field(WorkspaceCwd, 'module', './dist/index.mjs') :-
 % Non-published packages must not specify an entrypoint.
 gen_enforced_field(WorkspaceCwd, 'main', null) :-
   WorkspaceCwd \= 'packages/shims',
+  WorkspaceCwd \= 'packages/streams',
   workspace_field(WorkspaceCwd, 'private', true).
 gen_enforced_field(WorkspaceCwd, 'module', null) :-
   WorkspaceCwd \= 'packages/shims',
+  WorkspaceCwd \= 'packages/streams',
   workspace_field(WorkspaceCwd, 'private', true).
 
 % The type definitions entrypoint for all publishable packages must be the same.
@@ -220,6 +222,7 @@ gen_enforced_field(WorkspaceCwd, 'types', './dist/index.d.cts') :-
 % Non-published packages must not specify a type definitions entrypoint.
 gen_enforced_field(WorkspaceCwd, 'types', null) :-
   WorkspaceCwd \= 'packages/shims',
+  WorkspaceCwd \= 'packages/streams',
   workspace_field(WorkspaceCwd, 'private', true).
 
 % The exports for all published packages must be the same.
@@ -235,11 +238,11 @@ gen_enforced_field(WorkspaceCwd, 'exports["."].import.types', './dist/index.d.mt
   \+ workspace_field(WorkspaceCwd, 'private', true).
 % package.json
 gen_enforced_field(WorkspaceCwd, 'exports["./package.json"]', './package.json') :-
-  \+ workspace_field(WorkspaceCwd, 'private', true).
-% Non-published packages must not specify exports.
+  WorkspaceCwd \= 'packages/extension',
+  WorkspaceCwd \= '.'.
+% The root package must not specify exports.
 gen_enforced_field(WorkspaceCwd, 'exports', null) :-
-  WorkspaceCwd \= 'packages/shims',
-  workspace_field(WorkspaceCwd, 'private', true).
+  WorkspaceCwd = '.'.
 
 % Published packages must not have side effects.
 gen_enforced_field(WorkspaceCwd, 'sideEffects', false) :-
@@ -247,6 +250,7 @@ gen_enforced_field(WorkspaceCwd, 'sideEffects', false) :-
 % Non-published packages must not specify side effects.
 gen_enforced_field(WorkspaceCwd, 'sideEffects', null) :-
   WorkspaceCwd \= 'packages/shims',
+  WorkspaceCwd \= 'packages/streams',
   workspace_field(WorkspaceCwd, 'private', true).
 
 % The list of files included in published packages must only include files
@@ -265,9 +269,14 @@ gen_enforced_field(WorkspaceCwd, 'files', []) :-
 % gen_enforced_field(WorkspaceCwd, 'scripts.build', '') :-
 %   WorkspaceCwd \= '.'.
 
-% All packages except the root and extension must have the same "build:docs" script.
+% All packages except the root and other exceptions must have the same "build:docs" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.build:docs', 'typedoc') :-
   WorkspaceCwd \= 'packages/extension',
+  WorkspaceCwd \= 'packages/test-utils',
+  WorkspaceCwd \= '.'.
+
+% All packages except the root must have the same "clean" script.
+gen_enforced_field(WorkspaceCwd, 'scripts.clean', 'rimraf ./dist \'./*.tsbuildinfo\'') :-
   WorkspaceCwd \= '.'.
 
 % All published packages must have the same "publish:preview" script.
@@ -301,53 +310,56 @@ gen_enforced_field(WorkspaceCwd, 'scripts.changelog:update', CorrectChangelogUpd
 % All non-root packages must have the same "test" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.test', 'vitest run --config vitest.config.mts') :-
   WorkspaceCwd \= 'packages/shims',
+  WorkspaceCwd \= 'packages/test-utils',
   WorkspaceCwd \= '.'.
 
 % All non-root packages must have the same "test:clean" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.test:clean', 'yarn test --no-cache --coverage.clean') :-
+  WorkspaceCwd \= 'packages/test-utils',
   WorkspaceCwd \= '.'.
 
 % All non-root packages must have the same "test:dev" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.test:dev', 'yarn test --coverage false') :-
+  WorkspaceCwd \= 'packages/test-utils',
   WorkspaceCwd \= '.'.
 
 % All non-root packages must have the same "test:verbose" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.test:verbose', 'yarn test --reporter verbose') :-
+  WorkspaceCwd \= 'packages/test-utils',
   WorkspaceCwd \= '.'.
 
 % All non-root packages must have the same "test:watch" script.
 gen_enforced_field(WorkspaceCwd, 'scripts.test:watch', 'vitest --config vitest.config.mts') :-
+  WorkspaceCwd \= 'packages/test-utils',
   WorkspaceCwd \= '.'.
 
 % All dependency ranges must be recognizable (this makes it possible to apply
 % the next two rules effectively).
 gen_enforced_dependency(WorkspaceCwd, DependencyIdent, 'a range optionally starting with ^ or ~', DependencyType) :-
   workspace_has_dependency(WorkspaceCwd, DependencyIdent, DependencyRange, DependencyType),
-  \+ is_valid_version_range(DependencyRange).
-
-% All version ranges used to reference one workspace package in another
-% workspace package's `dependencies` or `devDependencies` must be the same.
-% Among all references to the same dependency across the monorepo, the one with
-% the smallest version range will win. (We handle `peerDependencies` in another
-% constraint, as it has slightly different logic.)
+  \+ (
+      DependencyRange = '^1.0.0-rc.12'; % is_valid_version_range does not handle rc suffixes
+      is_valid_version_range(DependencyRange)
+    ).
+
+% All dependency ranges for a package must be synchronized across the monorepo
+% (the least version range wins), regardless of which "*dependencies" field
+% where the package appears.
 gen_enforced_dependency(WorkspaceCwd, DependencyIdent, OtherDependencyRange, DependencyType) :-
   workspace_has_dependency(WorkspaceCwd, DependencyIdent, DependencyRange, DependencyType),
   workspace_has_dependency(OtherWorkspaceCwd, DependencyIdent, OtherDependencyRange, OtherDependencyType),
   WorkspaceCwd \= OtherWorkspaceCwd,
   DependencyRange \= OtherDependencyRange,
-  npm_version_range_out_of_sync(DependencyRange, OtherDependencyRange),
-  DependencyType \= 'peerDependencies',
-  OtherDependencyType \= 'peerDependencies'.
-
-% All version ranges used to reference one workspace package in another
-% workspace package's `dependencies` or `devDependencies` must match the current
-% version of that package. (We handle `peerDependencies` in another rule.)
-gen_enforced_dependency(WorkspaceCwd, DependencyIdent, CorrectDependencyRange, DependencyType) :-
-  DependencyType \= 'peerDependencies',
+  npm_version_range_out_of_sync(DependencyRange, OtherDependencyRange).
+
+% If a dependency is listed under "dependencies", it should not be listed under
+% "devDependencies". We match on the same dependency range so that if a
+% dependency is listed under both lists, their versions are synchronized and
+% then this constraint will apply and remove the "right" duplicate.
+gen_enforced_dependency(WorkspaceCwd, DependencyIdent, null, DependencyType) :-
+  workspace_has_dependency(WorkspaceCwd, DependencyIdent, DependencyRange, 'dependencies'),
   workspace_has_dependency(WorkspaceCwd, DependencyIdent, DependencyRange, DependencyType),
-  workspace_ident(OtherWorkspaceCwd, DependencyIdent),
-  workspace_version(OtherWorkspaceCwd, OtherWorkspaceVersion),
-  atomic_list_concat(['^', OtherWorkspaceVersion], CorrectDependencyRange).
+  DependencyType == 'devDependencies'.
 
 % If a workspace package is listed under another workspace package's
 % `dependencies`, it should not also be listed under its `devDependencies`.
diff --git a/package.json b/package.json
index 978c610e4..2f7a4fa67 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,7 @@
     "type": "git",
     "url": "https://github.com/MetaMask/ocap-kernel.git"
   },
+  "type": "module",
   "files": [],
   "workspaces": [
     "packages/*"
@@ -19,13 +20,13 @@
     "build:watch": "yarn run build --watch",
     "changelog:update": "yarn workspaces foreach --all --no-private --parallel --interlaced --verbose run changelog:update",
     "changelog:validate": "yarn workspaces foreach --all --no-private --parallel --interlaced --verbose run changelog:validate",
-    "clean": "rimraf dist '**/*.tsbuildinfo'",
+    "clean": "rimraf '**/*.tsbuildinfo' && yarn workspaces foreach --all --parallel --interlaced --verbose run clean",
     "lint": "yarn lint:eslint && yarn lint:misc --check && yarn constraints && yarn lint:dependencies",
     "lint:dependencies": "depcheck && yarn dedupe --check",
     "lint:dependencies:fix": "depcheck && yarn dedupe",
     "lint:eslint": "eslint . --cache --ext js,mjs,cjs,ts,mts,cts",
     "lint:fix": "yarn lint:eslint --fix && yarn lint:misc --write && yarn constraints --fix && yarn lint:dependencies:fix",
-    "lint:misc": "prettier '**/*.json' '**/*.md' '!**/CHANGELOG.old.md' '**/*.yml' '!.yarnrc.yml' '!merged-packages/**' --ignore-path .gitignore",
+    "lint:misc": "prettier '**/*.json' '**/*.md' '**/*.html' '!**/CHANGELOG.old.md' '**/*.yml' '!.yarnrc.yml' '!merged-packages/**' --ignore-path .gitignore",
     "prepack": "./scripts/prepack.sh",
     "test": "yarn workspaces foreach --all --parallel --verbose run test",
     "test:clean": "yarn workspaces foreach --all --parallel --verbose run test:clean && yarn test",
@@ -39,7 +40,7 @@
     "@metamask/eslint-config": "^12.2.0",
     "@metamask/eslint-config-nodejs": "^12.1.0",
     "@metamask/eslint-config-typescript": "^12.1.0",
-    "@ts-bridge/cli": "^0.1.4",
+    "@ts-bridge/cli": "^0.3.0",
     "@ts-bridge/shims": "^0.1.1",
     "@types/node": "^18.18.14",
     "@typescript-eslint/eslint-plugin": "^5.43.0",
@@ -60,7 +61,8 @@
     "typedoc": "^0.24.8",
     "typescript": "~4.9.5",
     "vite": "^5.3.5",
-    "vitest": "^2.0.4"
+    "vite-tsconfig-paths": "^4.3.2",
+    "vitest": "^2.0.5"
   },
   "packageManager": "yarn@4.2.2",
   "engines": {
diff --git a/packages/extension/.eslintrc.js b/packages/extension/.eslintrc.cjs
similarity index 94%
rename from packages/extension/.eslintrc.js
rename to packages/extension/.eslintrc.cjs
index 13900fb6d..1ff55a970 100644
--- a/packages/extension/.eslintrc.js
+++ b/packages/extension/.eslintrc.cjs
@@ -1,5 +1,5 @@
 module.exports = {
-  extends: ['../../.eslintrc.js'],
+  extends: ['../../.eslintrc.cjs'],
 
   overrides: [
     {
diff --git a/packages/extension/package.json b/packages/extension/package.json
index 08af11d5b..b9ce4d54e 100644
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -7,6 +7,7 @@
     "type": "git",
     "url": "https://github.com/MetaMask/ocap-kernel.git"
   },
+  "type": "module",
   "files": [
     "dist/"
   ],
@@ -15,6 +16,7 @@
     "build:types": "tsc --project tsconfig.build.json",
     "build:vite": "vite build --config vite.config.mts",
     "changelog:validate": "../../scripts/validate-changelog.sh @ocap/extension",
+    "clean": "rimraf ./dist './*.tsbuildinfo'",
     "publish:preview": "yarn npm publish --tag preview",
     "start": "vite --config vite.config.mts & vite build --watch --config vite.config.mts",
     "test": "vitest run --config vitest.config.mts",
@@ -28,22 +30,26 @@
     "@endo/promise-kit": "^1.1.2",
     "@metamask/snaps-utils": "^7.8.0",
     "@metamask/utils": "^9.1.0",
-    "@ocap/shims": "^0.0.0",
-    "ses": "^1.5.0"
+    "@ocap/shims": "workspace:^",
+    "@ocap/streams": "workspace:^",
+    "ses": "^1.7.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.15.3",
     "@metamask/auto-changelog": "^3.4.4",
+    "@ocap/test-utils": "workspace:^",
     "@types/chrome": "^0.0.268",
-    "@vitest/coverage-v8": "^2.0.4",
+    "@vitest/coverage-v8": "^2.0.5",
+    "cheerio": "^1.0.0-rc.12",
     "deepmerge": "^4.3.1",
     "jsdom": "^24.1.1",
+    "prettier": "^2.7.1",
     "typedoc": "^0.24.8",
     "typedoc-plugin-missing-exports": "^2.0.0",
     "typescript": "~4.9.5",
     "vite": "^5.3.5",
     "vite-plugin-static-copy": "^1.0.6",
-    "vitest": "^2.0.4"
+    "vitest": "^2.0.5"
   },
   "engines": {
     "node": "^18.18 || >=20"
diff --git a/packages/extension/src/background.ts b/packages/extension/src/background.ts
index d04913a8d..f1213e891 100644
--- a/packages/extension/src/background.ts
+++ b/packages/extension/src/background.ts
@@ -3,8 +3,8 @@ import './dev-console.mjs';
 import './endoify.mjs';
 /* eslint-enable import/extensions,import/no-unassigned-import */
 
-import type { ExtensionMessage } from './shared';
-import { Command, makeHandledCallback } from './shared';
+import type { ExtensionMessage } from './shared.js';
+import { Command, makeHandledCallback } from './shared.js';
 
 // globalThis.kernel will exist due to dev-console.mjs
 Object.defineProperties(globalThis.kernel, {
diff --git a/packages/extension/src/iframe-manager.test.ts b/packages/extension/src/iframe-manager.test.ts
index a5c621570..2a5c5bf29 100644
--- a/packages/extension/src/iframe-manager.test.ts
+++ b/packages/extension/src/iframe-manager.test.ts
@@ -1,53 +1,21 @@
 import * as snapsUtils from '@metamask/snaps-utils';
-import { vi, beforeEach, describe, it, expect } from 'vitest';
+import { delay, makePromiseKitMock } from '@ocap/test-utils';
+import { vi, describe, it, expect } from 'vitest';
 
-import { Command } from './shared';
+import { IframeManager } from './iframe-manager.js';
+import { Command } from './shared.js';
 
-vi.mock('@endo/promise-kit', () => ({
-  makePromiseKit: () => {
-    let resolve: (value: unknown) => void, reject: (reason?: unknown) => void;
-    const promise = new Promise((_resolve, _reject) => {
-      resolve = _resolve;
-      reject = _reject;
-    });
-    // @ts-expect-error We have in fact assigned resolve and reject.
-    return { promise, resolve, reject };
-  },
-}));
+vi.mock('@endo/promise-kit', () => makePromiseKitMock());
 
 vi.mock('@metamask/snaps-utils', () => ({
   createWindow: vi.fn(),
 }));
 
 describe('IframeManager', () => {
-  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-  let IframeManager: typeof import('./iframe-manager').IframeManager;
-
-  beforeEach(async () => {
-    vi.resetModules();
-    IframeManager = (await import('./iframe-manager')).IframeManager;
-  });
-
-  describe('getInstance', () => {
-    it('is a singleton', () => {
-      expect(IframeManager.getInstance()).toBe(IframeManager.getInstance());
-    });
-
-    it('sets up event listener on construction', () => {
-      const addEventListenerSpy = vi.spyOn(window, 'addEventListener');
-      let manager = IframeManager.getInstance();
-
-      expect(manager).toBeInstanceOf(IframeManager);
-      expect(addEventListenerSpy).toHaveBeenCalledOnce();
-      expect(addEventListenerSpy).toHaveBeenCalledWith(
-        'message',
-        expect.any(Function),
-      );
-
-      manager = IframeManager.getInstance();
-      expect(addEventListenerSpy).toHaveBeenCalledOnce();
-    });
-  });
+  const makeGetPort =
+    (port: MessagePort = new MessageChannel().port1) =>
+    async (_window: Window) =>
+      Promise.resolve(port);
 
   describe('create', () => {
     it('creates a new iframe', async () => {
@@ -55,12 +23,11 @@ describe('IframeManager', () => {
       vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce(
         mockWindow as Window,
       );
-
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       const sendMessageSpy = vi
         .spyOn(manager, 'sendMessage')
         .mockImplementation(vi.fn());
-      const [newWindow, id] = await manager.create();
+      const [newWindow, id] = await manager.create({ getPort: makeGetPort() });
 
       expect(newWindow).toBe(mockWindow);
       expect(id).toBeTypeOf('string');
@@ -77,12 +44,15 @@ describe('IframeManager', () => {
         mockWindow as Window,
       );
 
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       const sendMessageSpy = vi
         .spyOn(manager, 'sendMessage')
         .mockImplementation(vi.fn());
       const id = 'foo';
-      const [newWindow, returnedId] = await manager.create(id);
+      const [newWindow, returnedId] = await manager.create({
+        id,
+        getPort: makeGetPort(),
+      });
 
       expect(newWindow).toBe(mockWindow);
       expect(returnedId).toBe(id);
@@ -92,6 +62,35 @@ describe('IframeManager', () => {
         data: null,
       });
     });
+
+    it('creates a new iframe with the default getPort function', async () => {
+      vi.resetModules();
+      vi.doMock('@ocap/streams', () => ({
+        initializeMessageChannel: vi.fn(),
+        MessagePortReader: class Mock1 {},
+        MessagePortWriter: class Mock2 {},
+      }));
+      const IframeManager2 = (await import('./iframe-manager.js'))
+        .IframeManager;
+
+      const mockWindow = {};
+      vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce(
+        mockWindow as Window,
+      );
+      const manager = new IframeManager2();
+      const sendMessageSpy = vi
+        .spyOn(manager, 'sendMessage')
+        .mockImplementation(vi.fn());
+      const [newWindow, id] = await manager.create();
+
+      expect(newWindow).toBe(mockWindow);
+      expect(id).toBeTypeOf('string');
+      expect(sendMessageSpy).toHaveBeenCalledOnce();
+      expect(sendMessageSpy).toHaveBeenCalledWith(id, {
+        type: 'ping',
+        data: null,
+      });
+    });
   });
 
   describe('delete', () => {
@@ -106,22 +105,22 @@ describe('IframeManager', () => {
         return iframe.contentWindow as Window;
       });
 
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       vi.spyOn(manager, 'sendMessage').mockImplementation(vi.fn());
 
-      await manager.create(id);
-      manager.delete(id);
+      await manager.create({ id, getPort: makeGetPort() });
+      await manager.delete(id);
 
       expect(removeSpy).toHaveBeenCalledOnce();
     });
 
     it('ignores attempt to delete unrecognized iframe', async () => {
       const id = 'foo';
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       const iframe = document.createElement('iframe');
 
       const removeSpy = vi.spyOn(iframe, 'remove');
-      manager.delete(id);
+      await manager.delete(id);
 
       expect(removeSpy).not.toHaveBeenCalled();
     });
@@ -129,72 +128,98 @@ describe('IframeManager', () => {
 
   describe('sendMessage', () => {
     it('sends a message to an iframe', async () => {
-      const iframeWindow = { postMessage: vi.fn() };
-      vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce(
-        iframeWindow as unknown as Window,
-      );
+      vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce({} as Window);
 
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       const sendMessageSpy = vi.spyOn(manager, 'sendMessage');
+      // Intercept the ping message in create()
       sendMessageSpy.mockImplementationOnce(async () => Promise.resolve());
 
+      const { port1, port2 } = new MessageChannel();
+      const portPostMessageSpy = vi.spyOn(port1, 'postMessage');
       const id = 'foo';
-      await manager.create(id);
+      await manager.create({ id, getPort: makeGetPort(port1) });
 
       const message = { type: Command.Evaluate, data: '2+2' };
 
       const messagePromise = manager.sendMessage(id, message);
       const messageId: string | undefined =
-        iframeWindow.postMessage.mock.lastCall?.[0]?.id;
+        portPostMessageSpy.mock.lastCall?.[0]?.id;
       expect(messageId).toBeTypeOf('string');
 
-      window.dispatchEvent(
-        new MessageEvent('message', {
-          data: {
-            id: messageId,
-            message: {
-              type: Command.Evaluate,
-              data: '4',
-            },
-          },
-        }),
-      );
+      port2.postMessage({
+        id: messageId,
+        message: {
+          type: Command.Evaluate,
+          data: '4',
+        },
+      });
 
-      expect(iframeWindow.postMessage).toHaveBeenCalledOnce();
-      expect(iframeWindow.postMessage).toHaveBeenCalledWith(
-        { id: messageId, message },
-        '*',
-      );
+      expect(portPostMessageSpy).toHaveBeenCalledOnce();
+      expect(portPostMessageSpy).toHaveBeenCalledWith({
+        id: messageId,
+        message,
+      });
       expect(await messagePromise).toBe('4');
     });
 
     it('throws if iframe not found', async () => {
-      const manager = IframeManager.getInstance();
+      const manager = new IframeManager();
       const id = 'foo';
       const message = { type: Command.Ping, data: null };
 
       await expect(manager.sendMessage(id, message)).rejects.toThrow(
-        `No iframe with id "${id}"`,
+        `No vat with id "${id}"`,
       );
     });
   });
 
-  describe('warnings', () => {
-    it('calls console.warn when receiving unexpected message', () => {
-      // Initialize manager
-      IframeManager.getInstance();
+  describe('miscellaneous', () => {
+    it('calls console.warn when receiving unexpected message', async () => {
+      vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce({} as Window);
+
+      const manager = new IframeManager();
       const warnSpy = vi.spyOn(console, 'warn');
+      const sendMessageSpy = vi.spyOn(manager, 'sendMessage');
+      // Intercept the ping message in create()
+      sendMessageSpy.mockImplementationOnce(async () => Promise.resolve());
 
-      window.dispatchEvent(
-        new MessageEvent('message', {
-          data: 'foo',
-        }),
-      );
+      const { port1, port2 } = new MessageChannel();
+      await manager.create({ getPort: makeGetPort(port1) });
+
+      port2.postMessage('foo');
+      await delay(10);
 
       expect(warnSpy).toHaveBeenCalledWith(
         'Offscreen received message with unexpected format',
         'foo',
       );
     });
+
+    it('calls console.error when receiving message with unknown id', async () => {
+      vi.mocked(snapsUtils.createWindow).mockResolvedValueOnce({} as Window);
+
+      const manager = new IframeManager();
+      const errorSpy = vi.spyOn(console, 'error');
+      const sendMessageSpy = vi.spyOn(manager, 'sendMessage');
+      // Intercept the ping message in create()
+      sendMessageSpy.mockImplementationOnce(async () => Promise.resolve());
+
+      const { port1, port2 } = new MessageChannel();
+      await manager.create({ getPort: makeGetPort(port1) });
+
+      port2.postMessage({
+        id: 'foo',
+        message: {
+          type: Command.Evaluate,
+          data: '"bar"',
+        },
+      });
+      await delay(10);
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        'No unresolved message with id "foo".',
+      );
+    });
   });
 });
diff --git a/packages/extension/src/iframe-manager.ts b/packages/extension/src/iframe-manager.ts
index 6e7148b2c..5d8c0608e 100644
--- a/packages/extension/src/iframe-manager.ts
+++ b/packages/extension/src/iframe-manager.ts
@@ -1,96 +1,107 @@
 import type { PromiseKit } from '@endo/promise-kit';
 import { makePromiseKit } from '@endo/promise-kit';
 import { createWindow } from '@metamask/snaps-utils';
-
-import type { IframeMessage } from './shared';
-import { Command, isWrappedIframeMessage } from './shared';
+import {
+  initializeMessageChannel,
+  MessagePortReader,
+  MessagePortWriter,
+} from '@ocap/streams';
+
+import type {
+  IframeMessage,
+  PortStreams,
+  WrappedIframeMessage,
+} from './shared.js';
+import { Command, isWrappedIframeMessage } from './shared.js';
 
 const IFRAME_URI = 'iframe.html';
 
-// The actual <iframe> id, for greater collision resistance.
+/**
+ * Get a DOM id for our iframes, for greater collision resistance.
+ * @param id - The id to base the DOM id on.
+ * @returns The DOM id.
+ */
 const getHtmlId = (id: string) => `ocap-iframe-${id}`;
 
 type PromiseCallbacks = Omit<PromiseKit<unknown>, 'promise'>;
 
+type GetPort = (targetWindow: Window) => Promise<MessagePort>;
+
 /**
  * A singleton class to manage and message iframes.
  */
 export class IframeManager {
-  static #instance: IframeManager;
-
   #currentId: number;
 
   #unresolvedMessages: Map<string, PromiseCallbacks>;
 
-  #iframes: Map<string, Window>;
+  #vats: Map<string, PortStreams>;
 
   /**
    * Create a new IframeManager.
    */
-  // Our lint config wants #-private, but we can't do that to the constructor.
-  // eslint-disable-next-line no-restricted-syntax
-  private constructor() {
-    /* v8 ignore next 3: We're just not going to do this to ourselves. */
-    if (IframeManager.#instance !== undefined) {
-      throw new Error('IframeManager is a singleton');
-    }
-
+  constructor() {
     this.#currentId = 0;
-    this.#iframes = new Map();
+    this.#vats = new Map();
     this.#unresolvedMessages = new Map();
-
-    window.addEventListener('message', (event: MessageEvent) =>
-      this.#handleMessage(event),
-    );
-
-    IframeManager.#instance = this;
   }
 
   /**
-   * Get the singleton instance of IframeManager.
-   * @returns The singleton instance of IframeManager.
+   * Create a new vat, in the form of an iframe.
+   * @param args - Options bag.
+   * @param args.id - The id of the vat to create.
+   * @param args.getPort - A function to get the message port for the iframe.
+   * @returns The iframe's content window, and its internal id.
    */
-  public static getInstance(): IframeManager {
-    if (!IframeManager.#instance) {
-      IframeManager.#instance = new IframeManager();
-    }
-    return IframeManager.#instance;
-  }
-
-  /**
-   * Create a new iframe.
-   * @param id - The id of the iframe to create.
-   * @returns The iframe's content window, and its id.
-   */
-  async create(id?: string): Promise<readonly [Window, string]> {
-    const actualId = id === undefined ? this.#nextId() : id;
-    const newWindow = await createWindow(IFRAME_URI, getHtmlId(actualId));
-    this.#iframes.set(actualId, newWindow);
-    await this.sendMessage(actualId, { type: Command.Ping, data: null });
-    console.debug(`Created iframe with id "${actualId}"`);
-    return [newWindow, actualId] as const;
+  async create(
+    args: { id?: string; getPort?: GetPort } = {},
+  ): Promise<readonly [Window, string]> {
+    const id = args.id ?? this.#nextId();
+    const getPort = args.getPort ?? initializeMessageChannel;
+
+    const newWindow = await createWindow(IFRAME_URI, getHtmlId(id));
+    const port = await getPort(newWindow);
+    const streams: PortStreams = harden({
+      reader: new MessagePortReader(port),
+      writer: new MessagePortWriter(port),
+    });
+    this.#vats.set(id, streams);
+    /* v8 ignore next 4: Not known to be possible. */
+    this.#receiveMessages(streams.reader).catch((error) => {
+      console.error(`Unexpected read error from vat "${id}"`, error);
+      this.delete(id).catch(() => undefined);
+    });
+
+    await this.sendMessage(id, { type: Command.Ping, data: null });
+    console.debug(`Created vat with id "${id}"`);
+    return [newWindow, id] as const;
   }
 
   /**
    * Delete an iframe.
    * @param id - The id of the iframe to delete.
+   * @returns A promise that resolves when the iframe is deleted.
    */
-  delete(id: string) {
-    if (this.#iframes.has(id)) {
+  async delete(id: string): Promise<void> {
+    if (this.#vats.has(id)) {
+      const { reader, writer } = this.#vats.get(id) as PortStreams;
+      const closeP = Promise.all([reader.return(), writer.return()]).then(
+        () => undefined,
+      );
       // TODO: Handle orphaned messages
-      this.#iframes.delete(id);
+      this.#vats.delete(id);
 
       const iframe = document.getElementById(getHtmlId(id));
-      /* v8 ignore next 6: Currently impossible. */
+      /* v8 ignore next 6: Not known to be possible. */
       if (iframe === null) {
-        console.error(
-          `Registered iframe with id "${id}" already removed from DOM`,
-        );
-        return;
+        console.error(`iframe of vat with id "${id}" already removed from DOM`);
+        return undefined;
       }
-
       iframe.remove();
+
+      return closeP;
     }
+    return undefined;
   }
 
   /**
@@ -102,37 +113,39 @@ export class IframeManager {
     id: string,
     message: IframeMessage<Command, string | null>,
   ) {
-    const iframeWindow = this.#get(id);
-    if (iframeWindow === undefined) {
-      throw new Error(`No iframe with id "${id}"`);
+    const streams = this.#vats.get(id);
+    if (streams === undefined) {
+      throw new Error(`No vat with id "${id}"`);
     }
 
     const { promise, reject, resolve } = makePromiseKit();
     const messageId = this.#nextId();
     this.#unresolvedMessages.set(messageId, { reject, resolve });
-    iframeWindow.postMessage({ id: messageId, message }, '*');
+    await streams.writer.next({ id: messageId, message });
     return promise;
   }
 
-  #handleMessage(event: MessageEvent) {
-    console.debug('Offscreen received message', event);
+  async #receiveMessages(reader: MessagePortReader<WrappedIframeMessage>) {
+    for await (const rawMessage of reader) {
+      console.debug('Offscreen received message', rawMessage);
 
-    if (!isWrappedIframeMessage(event.data)) {
-      console.warn(
-        'Offscreen received message with unexpected format',
-        event.data,
-      );
-      return;
-    }
+      if (!isWrappedIframeMessage(rawMessage)) {
+        console.warn(
+          'Offscreen received message with unexpected format',
+          rawMessage,
+        );
+        return;
+      }
 
-    const { id, message } = event.data;
-    const promiseCallbacks = this.#unresolvedMessages.get(id);
-    if (promiseCallbacks === undefined) {
-      console.error(`No unresolved message with id "${id}".`);
-      return;
-    }
+      const { id, message } = rawMessage;
+      const promiseCallbacks = this.#unresolvedMessages.get(id);
+      if (promiseCallbacks === undefined) {
+        console.error(`No unresolved message with id "${id}".`);
+        continue;
+      }
 
-    promiseCallbacks.resolve(message.data);
+      promiseCallbacks.resolve(message.data);
+    }
   }
 
   #nextId() {
@@ -140,8 +153,4 @@ export class IframeManager {
     this.#currentId += 1;
     return String(id);
   }
-
-  #get(id: string) {
-    return this.#iframes.get(id);
-  }
 }
diff --git a/packages/extension/src/iframe.html b/packages/extension/src/iframe.html
index 0f2fd2476..a90a1d487 100644
--- a/packages/extension/src/iframe.html
+++ b/packages/extension/src/iframe.html
@@ -5,7 +5,5 @@
     <title>Ocap Iframe</title>
     <script src="iframe.ts" type="module"></script>
   </head>
-  <body>
-  </body>
+  <body></body>
 </html>
-
diff --git a/packages/extension/src/iframe.ts b/packages/extension/src/iframe.ts
index 308e831ec..51943e5ae 100644
--- a/packages/extension/src/iframe.ts
+++ b/packages/extension/src/iframe.ts
@@ -1,94 +1,104 @@
-// eslint-disable-next-line import/extensions,import/no-unassigned-import
-import './endoify.mjs';
+import {
+  receiveMessagePort,
+  MessagePortReader,
+  MessagePortWriter,
+} from '@ocap/streams';
 
+import type { PortStreams } from './shared.js';
 import { Command, isWrappedIframeMessage } from './shared.js';
 
 const defaultCompartment = new Compartment({ URL });
 
-type MessageEventWithSource = Omit<MessageEvent, 'source'> & {
-  source: NonNullable<MessageEvent['source']>;
-};
+main().catch(console.error);
 
-const isEventWithSource = (
-  event: MessageEvent,
-): event is MessageEventWithSource => event.source !== null;
+/**
+ * The main function for the iframe.
+ */
+async function main() {
+  const port = await receiveMessagePort();
+  const streams: PortStreams = harden({
+    reader: new MessagePortReader(port),
+    writer: new MessagePortWriter(port),
+  });
 
-window.addEventListener('message', (event: MessageEvent) => {
-  console.debug('iframe received message', event);
+  for await (const wrappedMessage of streams.reader) {
+    console.debug('iframe received message', wrappedMessage);
 
-  if (!isEventWithSource(event)) {
-    console.warn('iframe received message with null source');
-    return;
-  }
-  if (!isWrappedIframeMessage(event.data)) {
-    console.warn('iframe received message with unexpected format', event.data);
-    return;
-  }
+    if (!isWrappedIframeMessage(wrappedMessage)) {
+      console.error(
+        'iframe received message with unexpected format',
+        wrappedMessage,
+      );
+      return;
+    }
 
-  const { id, message } = event.data;
+    const { id, message } = wrappedMessage;
 
-  switch (message.type) {
-    case Command.Evaluate: {
-      const result = safelyEvaluate(message.data);
-      reply(event, id, Command.Evaluate, stringifyResult(result));
-      break;
+    switch (message.type) {
+      case Command.Evaluate: {
+        if (typeof message.data !== 'string') {
+          console.error(
+            'iframe received message with unexpected data type',
+            message.data,
+          );
+          return;
+        }
+        const result = safelyEvaluate(message.data);
+        await reply(id, Command.Evaluate, stringifyResult(result));
+        break;
+      }
+      case Command.Ping:
+        await reply(id, Command.Ping, 'pong');
+        break;
+      default:
+        console.error(
+          // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+          `iframe received unexpected message type: "${message.type}"`,
+        );
     }
-    case Command.Ping:
-      reply(event, id, Command.Ping, 'pong');
-      break;
-    default:
-      console.error(
-        // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-        `iframe received unexpected message type: "${message.type}"`,
-      );
   }
-});
 
-/**
- * Evaluate a string in the default compartment.
- * @param source - The source string to evaluate.
- * @returns The result of the evaluation, or an error message.
- */
-function safelyEvaluate(source: string) {
-  try {
-    return defaultCompartment.evaluate(source);
-  } catch (error) {
-    if (error instanceof Error) {
-      return `Error: ${error.message}`;
-    }
-    return `Error: Unknown error during evaluation.`;
+  await Promise.all([streams.reader.return(), streams.writer.return()]).catch(
+    () => undefined,
+  );
+  throw new Error('MessagePortReader ended unexpectedly.');
+
+  /**
+   * Reply to the parent window.
+   * @param id - The id of the message to reply to.
+   * @param messageType - The message type.
+   * @param data - The message data.
+   */
+  async function reply(id: string, messageType: Command, data: string) {
+    await streams.writer.next({ id, message: { type: messageType, data } });
   }
-}
 
-/**
- * Stringify an evaluation result.
- * @param result - The result to stringify.
- * @returns The stringified result.
- */
-function stringifyResult(result: unknown) {
-  try {
-    return JSON.stringify(result, null, 2);
-  } catch {
-    return String(result);
+  /**
+   * Evaluate a string in the default compartment.
+   * @param source - The source string to evaluate.
+   * @returns The result of the evaluation, or an error message.
+   */
+  function safelyEvaluate(source: string) {
+    try {
+      return defaultCompartment.evaluate(source);
+    } catch (error) {
+      if (error instanceof Error) {
+        return `Error: ${error.message}`;
+      }
+      return `Error: Unknown error during evaluation.`;
+    }
   }
-}
 
-/**
- * Reply to the parent window.
- * @param event - The message event to respond to.
- * @param id - The id of the message to reply to.
- * @param messageType - The message type.
- * @param data - The message data.
- */
-function reply(
-  event: MessageEventWithSource,
-  id: string,
-  messageType: Command,
-  data: string,
-) {
-  event.source.postMessage(
-    { id, message: { type: messageType, data } },
-    // @ts-expect-error Incorrect DOM types
-    event.origin,
-  );
+  /**
+   * Stringify an evaluation result.
+   * @param result - The result to stringify.
+   * @returns The stringified result.
+   */
+  function stringifyResult(result: unknown) {
+    try {
+      return JSON.stringify(result, null, 2);
+    } catch {
+      return String(result);
+    }
+  }
 }
diff --git a/packages/extension/src/offscreen.html b/packages/extension/src/offscreen.html
index f9d736a9a..f538d3459 100644
--- a/packages/extension/src/offscreen.html
+++ b/packages/extension/src/offscreen.html
@@ -5,7 +5,5 @@
     <title>Ocap Offscreen Document</title>
     <script src="offscreen.ts" type="module"></script>
   </head>
-  <body>
-  </body>
+  <body></body>
 </html>
-
diff --git a/packages/extension/src/offscreen.ts b/packages/extension/src/offscreen.ts
index 1ee16f560..e9a9331f0 100644
--- a/packages/extension/src/offscreen.ts
+++ b/packages/extension/src/offscreen.ts
@@ -2,71 +2,82 @@
 import './endoify.mjs';
 
 import { IframeManager } from './iframe-manager.js';
-import type { ExtensionMessage } from './shared';
-import { Command, makeHandledCallback } from './shared';
+import type { ExtensionMessage } from './shared.js';
+import { Command, makeHandledCallback } from './shared.js';
 
-// Handle messages from the background service worker
-chrome.runtime.onMessage.addListener(
-  makeHandledCallback(async (message: ExtensionMessage<Command, string>) => {
-    if (message.target !== 'offscreen') {
-      console.warn(
-        `Offscreen received message with unexpected target: "${message.target}"`,
-      );
-      return;
-    }
+main().catch(console.error);
 
-    switch (message.type) {
-      case Command.Evaluate:
-        await reply(Command.Evaluate, await evaluate(message.data));
-        break;
-      case Command.Ping:
-        await reply(Command.Ping, 'pong');
-        break;
-      default:
-        console.error(
-          // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-          `Offscreen received unexpected message type: "${message.type}"`,
+/**
+ * The main function for the offscreen script.
+ */
+async function main() {
+  // Hard-code a single iframe for now.
+  const IFRAME_ID = 'default';
+  const iframeManager = new IframeManager();
+  const iframeReadyP = iframeManager
+    .create({ id: IFRAME_ID })
+    .catch((error) => {
+      throw error;
+    });
+
+  // Handle messages from the background service worker
+  chrome.runtime.onMessage.addListener(
+    makeHandledCallback(async (message: ExtensionMessage<Command, string>) => {
+      if (message.target !== 'offscreen') {
+        console.warn(
+          `Offscreen received message with unexpected target: "${message.target}"`,
         );
-    }
-  }),
-);
+        return;
+      }
 
-// Hard-code a single iframe for now.
-const IFRAME_ID = 'default';
-const iframeManager = IframeManager.getInstance();
-iframeManager.create(IFRAME_ID).catch((error) => {
-  throw error;
-});
+      await iframeReadyP;
 
-/**
- * Reply to the background script.
- * @param type - The message type.
- * @param data - The message data.
- */
-async function reply(type: Command, data?: string) {
-  await chrome.runtime.sendMessage({
-    data: data ?? null,
-    target: 'background',
-    type,
-  });
-}
+      switch (message.type) {
+        case Command.Evaluate:
+          await reply(Command.Evaluate, await evaluate(message.data));
+          break;
+        case Command.Ping:
+          await reply(Command.Ping, 'pong');
+          break;
+        default:
+          console.error(
+            // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+            `Offscreen received unexpected message type: "${message.type}"`,
+          );
+      }
+    }),
+  );
 
-/**
- * Evaluate a string in the default iframe.
- * @param source - The source string to evaluate.
- * @returns The result of the evaluation, or an error message.
- */
-async function evaluate(source: string) {
-  try {
-    const result = await iframeManager.sendMessage(IFRAME_ID, {
-      type: Command.Evaluate,
-      data: source,
+  /**
+   * Reply to the background script.
+   * @param type - The message type.
+   * @param data - The message data.
+   */
+  async function reply(type: Command, data?: string) {
+    await chrome.runtime.sendMessage({
+      data: data ?? null,
+      target: 'background',
+      type,
     });
-    return String(result);
-  } catch (error) {
-    if (error instanceof Error) {
-      return `Error: ${error.message}`;
+  }
+
+  /**
+   * Evaluate a string in the default iframe.
+   * @param source - The source string to evaluate.
+   * @returns The result of the evaluation, or an error message.
+   */
+  async function evaluate(source: string) {
+    try {
+      const result = await iframeManager.sendMessage(IFRAME_ID, {
+        type: Command.Evaluate,
+        data: source,
+      });
+      return String(result);
+    } catch (error) {
+      if (error instanceof Error) {
+        return `Error: ${error.message}`;
+      }
+      return `Error: Unknown error during evaluation.`;
     }
-    return `Error: Unknown error during evaluation.`;
   }
 }
diff --git a/packages/extension/src/shared.test.ts b/packages/extension/src/shared.test.ts
index 1616a8f0c..2412a8716 100644
--- a/packages/extension/src/shared.test.ts
+++ b/packages/extension/src/shared.test.ts
@@ -1,6 +1,7 @@
+import { delay } from '@ocap/test-utils';
 import { vi, describe, it, expect } from 'vitest';
 
-import { isWrappedIframeMessage, makeHandledCallback } from './shared';
+import { isWrappedIframeMessage, makeHandledCallback } from './shared.js';
 
 describe('shared', () => {
   describe('isWrappedIframeMessage', () => {
@@ -52,8 +53,7 @@ describe('shared', () => {
 
       // eslint-disable-next-line n/callback-return
       callback();
-      // eslint-disable-next-line @typescript-eslint/await-thenable
-      await null;
+      await delay();
 
       expect(consoleErrorSpy).toHaveBeenCalledOnce();
       expect(consoleErrorSpy).toHaveBeenCalledWith(
diff --git a/packages/extension/src/shared.ts b/packages/extension/src/shared.ts
index b88196b43..1182f3d51 100644
--- a/packages/extension/src/shared.ts
+++ b/packages/extension/src/shared.ts
@@ -1,4 +1,5 @@
 import { isObject } from '@metamask/utils';
+import type { MessagePortReader, MessagePortWriter } from '@ocap/streams';
 
 export enum Command {
   Evaluate = 'evaluate',
@@ -24,9 +25,14 @@ export type IframeMessage<
 
 export type WrappedIframeMessage = {
   id: string;
-  message: IframeMessage<Command, string>;
+  message: IframeMessage<Command, string | null>;
 };
 
+export type PortStreams = Readonly<{
+  reader: MessagePortReader<WrappedIframeMessage>;
+  writer: MessagePortWriter<WrappedIframeMessage>;
+}>;
+
 export const isWrappedIframeMessage = (
   value: unknown,
 ): value is WrappedIframeMessage =>
diff --git a/packages/extension/tsconfig.build.json b/packages/extension/tsconfig.build.json
index f13391519..3534b4411 100644
--- a/packages/extension/tsconfig.build.json
+++ b/packages/extension/tsconfig.build.json
@@ -9,6 +9,9 @@
     "rootDir": "./src",
     "types": ["chrome", "ses"]
   },
-  "references": [{ "path": "../shims/tsconfig.build.json" }],
+  "references": [
+    { "path": "../shims/tsconfig.build.json" },
+    { "path": "../streams/tsconfig.build.json" }
+  ],
   "include": ["./src/**/*.ts", "./src/dev-console.mjs"]
 }
diff --git a/packages/extension/tsconfig.json b/packages/extension/tsconfig.json
index ce25d4837..ae8becee7 100644
--- a/packages/extension/tsconfig.json
+++ b/packages/extension/tsconfig.json
@@ -7,7 +7,8 @@
     "lib": ["DOM", "ES2020"],
     "noEmit": true,
     "skipLibCheck": true,
-    "types": ["chrome", "ses", "vitest"]
+    "types": ["chrome", "ses", "vitest", "vitest/jsdom"]
   },
+  "references": [{ "path": "../streams" }, { "path": "../test-utils" }],
   "include": ["./src/**/*.ts", "./src/dev-console.mjs"]
 }
diff --git a/packages/extension/vite.config.mts b/packages/extension/vite.config.mts
index 37e41c83f..27affcda0 100644
--- a/packages/extension/vite.config.mts
+++ b/packages/extension/vite.config.mts
@@ -1,7 +1,10 @@
 // eslint-disable-next-line spaced-comment
 /// <reference types="vitest" />
 
+import { load as loadHtml } from 'cheerio';
 import path from 'path';
+import { format as prettierFormat } from 'prettier';
+import type { Plugin } from 'vite';
 import { defineConfig } from 'vite';
 import { viteStaticCopy } from 'vite-plugin-static-copy';
 
@@ -9,7 +12,7 @@ const projectRoot = './src';
 
 /**
  * Module specifiers that will be ignored by Rollup if imported, and therefore
- * not transformed.
+ * not transformed. **Only applies to JavaScript and TypeScript files.**
  */
 const externalModules: Readonly<string[]> = [
   './dev-console.mjs',
@@ -55,9 +58,44 @@ export default defineConfig({
   },
 
   plugins: [
+    endoifyHtmlFilesPlugin(),
     viteStaticCopy({
       targets: staticCopyTargets.map((src) => ({ src, dest: './' })),
       watch: { reloadPageOnChange: true },
     }),
   ],
 });
+
+/**
+ * Vite plugin to insert the endoify script before the first script in the head element.
+ * @throws If the HTML document already references the endoify script or lacks the expected
+ * structure.
+ * @returns The Vite plugin.
+ */
+function endoifyHtmlFilesPlugin(): Plugin {
+  const endoifyElement = '<script src="endoify.mjs" type="module"></script>';
+
+  return {
+    name: 'externalize-plugin',
+    async transformIndexHtml(htmlString) {
+      if (htmlString.includes('endoify.mjs')) {
+        throw new Error(
+          `HTML document already references endoify script:\n${htmlString}`,
+        );
+      }
+
+      const htmlDoc = loadHtml(htmlString);
+      if (htmlDoc('head').length !== 1 || htmlDoc('head script').length < 1) {
+        throw new Error(
+          `Expected HTML document with a single <head> containing at least one <script>. Received:\n${htmlString}`,
+        );
+      }
+
+      htmlDoc(endoifyElement).insertBefore('head:first script:first');
+      return await prettierFormat(htmlDoc.html(), {
+        parser: 'html',
+        tabWidth: 2,
+      });
+    },
+  };
+}
diff --git a/packages/extension/vitest.config.mts b/packages/extension/vitest.config.mts
index b5bac6053..59d7da169 100644
--- a/packages/extension/vitest.config.mts
+++ b/packages/extension/vitest.config.mts
@@ -1,7 +1,7 @@
 // eslint-disable-next-line spaced-comment
 /// <reference types="vitest" />
 
-import { mergeConfig } from 'vitest/config';
+import { defineConfig, mergeConfig } from 'vitest/config';
 
 import { getDefaultConfig } from '../../vitest.config.packages.mjs';
 import viteConfig from './vite.config.mjs';
@@ -10,4 +10,14 @@ const defaultConfig = getDefaultConfig();
 // @ts-expect-error We can and will delete this.
 delete defaultConfig.test.coverage.thresholds;
 
-export default mergeConfig(viteConfig, defaultConfig);
+export default mergeConfig(
+  viteConfig,
+  mergeConfig(
+    defaultConfig,
+    defineConfig({
+      test: {
+        setupFiles: '../test-utils/src/env/mock-endo.ts',
+      },
+    }),
+  ),
+);
diff --git a/packages/shims/.eslintrc.js b/packages/shims/.eslintrc.cjs
similarity index 89%
rename from packages/shims/.eslintrc.js
rename to packages/shims/.eslintrc.cjs
index 4bdcd0aca..f285480cc 100644
--- a/packages/shims/.eslintrc.js
+++ b/packages/shims/.eslintrc.cjs
@@ -1,5 +1,5 @@
 module.exports = {
-  extends: ['../../.eslintrc.js'],
+  extends: ['../../.eslintrc.cjs'],
 
   ignorePatterns: ['src/eventual-send.mjs'],
 
diff --git a/packages/shims/package.json b/packages/shims/package.json
index 7d4cdb1ad..054a63979 100644
--- a/packages/shims/package.json
+++ b/packages/shims/package.json
@@ -8,6 +8,7 @@
     "url": "https://github.com/MetaMask/ocap-kernel.git"
   },
   "sideEffects": false,
+  "type": "module",
   "exports": {
     "./apply-lockdown": "./dist/apply-lockdown.mjs",
     "./endoify": "./dist/endoify.mjs",
@@ -23,7 +24,7 @@
     "build": "node scripts/bundle.mjs",
     "build:docs": "typedoc",
     "changelog:validate": "../../scripts/validate-changelog.sh @ocap/shims",
-    "clean": "rimraf ./dist",
+    "clean": "rimraf ./dist './*.tsbuildinfo'",
     "publish:preview": "yarn npm publish --tag preview",
     "test": "vitest run --config vitest.config.mts --passWithNoTests",
     "test:clean": "yarn test --no-cache --coverage.clean",
@@ -34,14 +35,14 @@
   "dependencies": {
     "@endo/eventual-send": "^1.2.2",
     "@endo/lockdown": "^1.0.7",
-    "ses": "^1.5.0"
+    "ses": "^1.7.0"
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^3.4.4",
     "deepmerge": "^4.3.1",
     "mkdirp": "^3.0.1",
     "rimraf": "^6.0.1",
-    "vitest": "^2.0.4"
+    "vitest": "^2.0.5"
   },
   "engines": {
     "node": "^18.18 || >=20"
diff --git a/packages/streams/CHANGELOG.md b/packages/streams/CHANGELOG.md
new file mode 100644
index 000000000..0c82cb1ed
--- /dev/null
+++ b/packages/streams/CHANGELOG.md
@@ -0,0 +1,10 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+[Unreleased]: https://github.com/MetaMask/ocap-kernel/
diff --git a/packages/streams/README.md b/packages/streams/README.md
new file mode 100644
index 000000000..c0aa9d831
--- /dev/null
+++ b/packages/streams/README.md
@@ -0,0 +1,7 @@
+# `streams`
+
+Ocap Kernel streams, compatible with `@endo/stream`, and therefore assumed to run under SES.
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
diff --git a/packages/streams/package.json b/packages/streams/package.json
new file mode 100644
index 000000000..421fdf7ac
--- /dev/null
+++ b/packages/streams/package.json
@@ -0,0 +1,67 @@
+{
+  "name": "@ocap/streams",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Ocap Kernel streams",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MetaMask/ocap-kernel.git"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.cts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "ts-bridge --project tsconfig.build.json --clean",
+    "build:docs": "typedoc",
+    "changelog:validate": "../../scripts/validate-changelog.sh streams",
+    "clean": "rimraf ./dist './*.tsbuildinfo'",
+    "publish:preview": "yarn npm publish --tag preview",
+    "test": "vitest run --config vitest.config.mts",
+    "test:clean": "yarn test --no-cache --coverage.clean",
+    "test:dev": "yarn test --coverage false",
+    "test:verbose": "yarn test --reporter verbose",
+    "test:watch": "vitest --config vitest.config.mts"
+  },
+  "dependencies": {
+    "@endo/promise-kit": "^1.1.2",
+    "@endo/stream": "^1.2.2",
+    "@metamask/utils": "^9.1.0"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.15.3",
+    "@metamask/auto-changelog": "^3.4.4",
+    "@ocap/test-utils": "workspace:^",
+    "@ts-bridge/cli": "^0.3.0",
+    "@ts-bridge/shims": "^0.1.1",
+    "@types/jsdom": "^21.1.7",
+    "@vitest/coverage-v8": "^2.0.5",
+    "deepmerge": "^4.3.1",
+    "jsdom": "^24.1.1",
+    "typedoc": "^0.24.8",
+    "typedoc-plugin-missing-exports": "^2.0.0",
+    "typescript": "~4.9.5",
+    "vite": "^5.3.5",
+    "vitest": "^2.0.5"
+  },
+  "engines": {
+    "node": "^18.18 || >=20"
+  }
+}
diff --git a/packages/streams/src/index.test.ts b/packages/streams/src/index.test.ts
new file mode 100644
index 000000000..36695bd9c
--- /dev/null
+++ b/packages/streams/src/index.test.ts
@@ -0,0 +1,16 @@
+import { describe, it, expect } from 'vitest';
+
+import * as indexModule from './index.js';
+
+describe('index', () => {
+  it('has the expected exports', () => {
+    expect(Object.keys(indexModule)).toStrictEqual(
+      expect.arrayContaining([
+        'MessagePortReader',
+        'MessagePortWriter',
+        'initializeMessageChannel',
+        'receiveMessagePort',
+      ]),
+    );
+  });
+});
diff --git a/packages/streams/src/index.ts b/packages/streams/src/index.ts
new file mode 100644
index 000000000..bf89703c7
--- /dev/null
+++ b/packages/streams/src/index.ts
@@ -0,0 +1,5 @@
+export {
+  initializeMessageChannel,
+  receiveMessagePort,
+} from './message-channel.js';
+export { MessagePortReader, MessagePortWriter } from './streams.js';
diff --git a/packages/streams/src/message-channel.test.ts b/packages/streams/src/message-channel.test.ts
new file mode 100644
index 000000000..1c843c7ff
--- /dev/null
+++ b/packages/streams/src/message-channel.test.ts
@@ -0,0 +1,216 @@
+import { delay, makePromiseKitMock } from '@ocap/test-utils';
+import { JSDOM } from 'jsdom';
+import { vi, describe, it, beforeEach, afterEach, beforeAll } from 'vitest';
+
+import {
+  initializeMessageChannel,
+  MessageType,
+  receiveMessagePort,
+} from './message-channel.js';
+
+vi.mock('@endo/promise-kit', () => makePromiseKitMock());
+
+describe.concurrent('initializeMessageChannel', () => {
+  it('calls targetWindow.postMessage', async ({ expect }) => {
+    const targetWindow = new JSDOM().window;
+    const postMessageSpy = vi.spyOn(targetWindow, 'postMessage');
+    // We intentionally let this one go. It will never settle.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    initializeMessageChannel(targetWindow as unknown as Window);
+
+    expect(postMessageSpy).toHaveBeenCalledOnce();
+    expect(postMessageSpy).toHaveBeenCalledWith(
+      {
+        type: MessageType.Initialize,
+      },
+      '*',
+      [expect.any(MessagePort)],
+    );
+  });
+
+  it('resolves a port with no message handler once sent acknowledgment via message channel', async ({
+    expect,
+  }) => {
+    const targetWindow = new JSDOM().window;
+    const postMessageSpy = vi.spyOn(targetWindow, 'postMessage');
+    const messageChannelP = initializeMessageChannel(
+      targetWindow as unknown as Window,
+    );
+
+    // @ts-expect-error Wrong types for window.postMessage()
+    const remotePort: MessagePort = postMessageSpy.mock.lastCall[2][0];
+    remotePort.postMessage({ type: MessageType.Acknowledge });
+
+    const resolvedValue = await messageChannelP;
+    expect(resolvedValue).toBeInstanceOf(MessagePort);
+    expect(resolvedValue.onmessage).toBe(null);
+  });
+
+  it.for([
+    { type: MessageType.Initialize },
+    { type: 'foo' },
+    { foo: 'bar' },
+    {},
+    [],
+    'foo',
+    400,
+    null,
+    undefined,
+  ])(
+    'rejects if sent unexpected message via message channel: %#',
+    async (unexpectedMessage, { expect }) => {
+      const targetWindow = new JSDOM().window;
+      const postMessageSpy = vi.spyOn(targetWindow, 'postMessage');
+      const messageChannelP = initializeMessageChannel(
+        targetWindow as unknown as Window,
+      );
+
+      // @ts-expect-error Wrong types for window.postMessage()
+      const remotePort: MessagePort = postMessageSpy.mock.lastCall[2][0];
+      remotePort.postMessage(unexpectedMessage);
+
+      await expect(messageChannelP).rejects.toThrow(
+        /^Received unexpected message via message port/u,
+      );
+    },
+  );
+});
+
+describe('receiveMessagePort', () => {
+  let messageEventListeners: [string, EventListenerOrEventListenerObject][] =
+    [];
+  let originalAddEventListener: typeof window.addEventListener;
+
+  beforeAll(() => {
+    originalAddEventListener = window.addEventListener;
+  });
+
+  beforeEach(() => {
+    // JSDOM apparently affords no way to clear all event listeners between test runs,
+    // so we have to do it manually.
+    window.addEventListener = (
+      ...args: Parameters<typeof window.addEventListener>
+    ) => {
+      messageEventListeners.push([args[0], args[1]]);
+      originalAddEventListener.call(window, ...args);
+    };
+  });
+
+  afterEach(() => {
+    messageEventListeners.forEach(([messageType, listener]) => {
+      window.removeEventListener(messageType, listener);
+    });
+    messageEventListeners = [];
+    window.addEventListener = originalAddEventListener;
+  });
+
+  it('receives and acknowledges a message port', async ({ expect }) => {
+    const messagePortP = receiveMessagePort();
+
+    const { port2 } = new MessageChannel();
+    const portPostMessageSpy = vi.spyOn(port2, 'postMessage');
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { type: MessageType.Initialize },
+        ports: [port2],
+      }),
+    );
+
+    const resolvedValue = await messagePortP;
+
+    expect(resolvedValue).toBe(port2);
+    expect(portPostMessageSpy).toHaveBeenCalledOnce();
+    expect(portPostMessageSpy).toHaveBeenCalledWith({
+      type: MessageType.Acknowledge,
+    });
+  });
+
+  it('cleans up event listeners', async ({ expect }) => {
+    const addEventListenerSpy = vi.spyOn(window, 'addEventListener');
+    const removeEventListenerSpy = vi.spyOn(window, 'removeEventListener');
+
+    const messagePortP = receiveMessagePort();
+
+    const { port2 } = new MessageChannel();
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { type: MessageType.Initialize },
+        ports: [port2],
+      }),
+    );
+
+    await messagePortP;
+
+    expect(addEventListenerSpy).toHaveBeenCalledOnce();
+    expect(addEventListenerSpy).toHaveBeenCalledWith(
+      'message',
+      expect.any(Function),
+    );
+    expect(removeEventListenerSpy).toHaveBeenCalledOnce();
+    expect(removeEventListenerSpy).toHaveBeenCalledWith(
+      'message',
+      expect.any(Function),
+    );
+  });
+
+  it.for([
+    { type: MessageType.Acknowledge },
+    { type: 'foo' },
+    { foo: 'bar' },
+    {},
+    [],
+    'foo',
+    400,
+    null,
+    undefined,
+  ])(
+    'ignores message events with unexpected data dispatched on window: %#',
+    async (unexpectedMessage, { expect }) => {
+      const messagePortP = receiveMessagePort();
+
+      const { port2 } = new MessageChannel();
+      const portPostMessageSpy = vi.spyOn(port2, 'postMessage');
+
+      const fulfillmentDetector = vi.fn();
+      messagePortP.finally(fulfillmentDetector);
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: unexpectedMessage,
+        }),
+      );
+
+      await delay();
+
+      expect(fulfillmentDetector).not.toHaveBeenCalled();
+      expect(portPostMessageSpy).not.toHaveBeenCalled();
+    },
+  );
+
+  it.for([{}, { ports: [] }, { ports: [{}, {}] }])(
+    'ignores message events with unexpected ports dispatched on window: %#',
+    async (unexpectedPorts, { expect }) => {
+      const messagePortP = receiveMessagePort();
+
+      const { port2 } = new MessageChannel();
+      const portPostMessageSpy = vi.spyOn(port2, 'postMessage');
+
+      const fulfillmentDetector = vi.fn();
+      messagePortP.finally(fulfillmentDetector);
+
+      window.dispatchEvent(
+        // @ts-expect-error Intentionally destructive testing.
+        new MessageEvent('message', {
+          data: { type: MessageType.Initialize },
+          ...unexpectedPorts,
+        }),
+      );
+
+      await delay();
+
+      expect(fulfillmentDetector).not.toHaveBeenCalled();
+      expect(portPostMessageSpy).not.toHaveBeenCalled();
+    },
+  );
+});
diff --git a/packages/streams/src/message-channel.ts b/packages/streams/src/message-channel.ts
new file mode 100644
index 000000000..9c043be28
--- /dev/null
+++ b/packages/streams/src/message-channel.ts
@@ -0,0 +1,104 @@
+/**
+ * This module establishes a simple protocol for establishing a MessageChannel between
+ * a parent window and its iframe, as follows:
+ * 1. The parent window creates an iframe and appends it to the DOM. The iframe must be
+ *    loaded and the `contentWindow` property must be accessible.
+ * 2. The iframe calls `receiveMessagePort()` on startup in one of its scripts. The script
+ *    element in question should not have the `async` attribute.
+ * 3. The parent window calls `initializeMessageChannel()` which sends a message port to
+ *    the iframe. When the returned promise resolves, the parent window and the iframe have
+ *    established a message channel.
+ * @module MessageChannel utilities
+ */
+
+import { makePromiseKit } from '@endo/promise-kit';
+import { isObject } from '@metamask/utils';
+
+export enum MessageType {
+  Initialize = 'INIT_MESSAGE_CHANNEL',
+  Acknowledge = 'ACK_MESSAGE_CHANNEL',
+}
+
+type InitializeMessage = { type: MessageType.Initialize };
+type AcknowledgeMessage = { type: MessageType.Acknowledge };
+
+const isInitMessage = (
+  event: MessageEvent,
+): event is MessageEvent<InitializeMessage> =>
+  isObject(event.data) &&
+  event.data.type === MessageType.Initialize &&
+  Array.isArray(event.ports) &&
+  event.ports.length === 1 &&
+  event.ports[0] instanceof MessagePort;
+
+const isAckMessage = (value: unknown): value is AcknowledgeMessage =>
+  isObject(value) && value.type === MessageType.Acknowledge;
+
+const stringify = (value: unknown) => JSON.stringify(value, null, 2);
+
+/**
+ * Creates a message channel and sends one of the ports to the target window. The iframe
+ * associated with the target window must be loaded, and it must have called
+ * {@link receiveMessagePort} to receive the remote message port. Rejects if the first
+ * message received over the channel is not an {@link AcknowledgeMessage}.
+ * @param targetWindow - The iframe window to send the message port to.
+ * @returns A promise that resolves with the local message port, once the target window
+ * has acknowledged its receipt of the remote port.
+ */
+export async function initializeMessageChannel(
+  targetWindow: Window,
+): Promise<MessagePort> {
+  const { port1, port2 } = new MessageChannel();
+
+  const { promise, resolve, reject } = makePromiseKit<MessagePort>();
+  // Assigning to the `onmessage` property initializes the port's message queue.
+  port1.onmessage = (message: MessageEvent) => {
+    if (!isAckMessage(message.data)) {
+      reject(
+        new Error(
+          `Received unexpected message via message port:\n${stringify(
+            message.data,
+          )}`,
+        ),
+      );
+      return;
+    }
+
+    resolve(port1);
+  };
+  promise.catch(() => port1.close()).finally(() => (port1.onmessage = null));
+
+  const initMessage: InitializeMessage = {
+    type: MessageType.Initialize,
+  };
+  targetWindow.postMessage(initMessage, '*', [port2]);
+  return promise;
+}
+
+/**
+ * Receives a message port from the parent window, and sends an {@link AcknowledgeMessage}
+ * over the port. Should be called in a script _without_ the `async` attribute on startup.
+ * The parent window must call {@link initializeMessageChannel} to send the message port
+ * after this iframe has loaded. Ignores any message events dispatched on the local
+ * `window` that are not an {@link InitializeMessage}.
+ * @returns A promise that resolves with a message port that can be used to communicate
+ * with the parent window.
+ */
+export async function receiveMessagePort(): Promise<MessagePort> {
+  const { promise, resolve } = makePromiseKit<MessagePort>();
+
+  const listener = (message: MessageEvent) => {
+    if (!isInitMessage(message)) {
+      return;
+    }
+
+    const port = message.ports[0] as MessagePort;
+    const ackMessage: AcknowledgeMessage = { type: MessageType.Acknowledge };
+    port.postMessage(ackMessage);
+    resolve(port);
+  };
+
+  window.addEventListener('message', listener);
+  promise.finally(() => window.removeEventListener('message', listener));
+  return promise;
+}
diff --git a/packages/streams/src/streams.test.ts b/packages/streams/src/streams.test.ts
new file mode 100644
index 000000000..819444a6a
--- /dev/null
+++ b/packages/streams/src/streams.test.ts
@@ -0,0 +1,166 @@
+import { delay, makePromiseKitMock } from '@ocap/test-utils';
+import { describe, expect, it, vi } from 'vitest';
+
+import { MessagePortReader, MessagePortWriter } from './streams.js';
+
+vi.mock('@endo/promise-kit', () => makePromiseKitMock());
+
+describe.concurrent('MessagePortReader', () => {
+  it('constructs a MessagePortReader', () => {
+    const { port1 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    expect(reader).toBeInstanceOf(MessagePortReader);
+    expect(reader[Symbol.asyncIterator]()).toBe(reader);
+    expect(port1.onmessage).toBeInstanceOf(Function);
+  });
+
+  it('emits message port message received before next()', async () => {
+    const { port1, port2 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const message = { foo: 'bar' };
+    port2.postMessage(message);
+    await delay(100);
+
+    expect(await reader.next()).toStrictEqual({
+      done: false,
+      value: message,
+    });
+  });
+
+  it('emits message port message received after next()', async () => {
+    const { port1, port2 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+    const nextP = reader.next();
+
+    const message = { foo: 'bar' };
+    port2.postMessage(message);
+
+    expect(await nextP).toStrictEqual({ done: false, value: message });
+  });
+
+  it('iterates over multiple port messages', async () => {
+    const { port1, port2 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const messages = [{ foo: 'bar' }, { bar: 'baz' }, { baz: 'qux' }];
+    messages.forEach((message) => port2.postMessage(message));
+
+    for (const message of messages) {
+      expect(await reader.next()).toStrictEqual({
+        done: false,
+        value: message,
+      });
+    }
+  });
+
+  it('ends after returning', async () => {
+    const { port1 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const result = reader.return();
+    expect(await result).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(port1.onmessage).toBeNull();
+  });
+
+  it('resolves pending promises after returning', async () => {
+    const { port1 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const nextP = reader.next();
+    const returnP = reader.return();
+
+    expect(await nextP).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(await returnP).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+  });
+
+  it('ends after throwing', async () => {
+    const { port1 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const result = reader.throw();
+    expect(await result).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(port1.onmessage).toBeNull();
+  });
+
+  it('resolves pending promises after throwing', async () => {
+    const { port1 } = new MessageChannel();
+    const reader = new MessagePortReader(port1);
+
+    const nextP = reader.next();
+    const returnP = reader.throw();
+
+    expect(await nextP).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(await returnP).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+  });
+});
+
+describe.concurrent('MessagePortWriter', () => {
+  it('constructs a MessagePortWriter', () => {
+    const { port1 } = new MessageChannel();
+    const writer = new MessagePortWriter(port1);
+
+    expect(writer).toBeInstanceOf(MessagePortWriter);
+    expect(writer[Symbol.asyncIterator]()).toBe(writer);
+  });
+
+  it('posts messages to the port', async () => {
+    const { port1, port2 } = new MessageChannel();
+    const writer = new MessagePortWriter(port1);
+
+    const message = { foo: 'bar' };
+    const messageP = new Promise((resolve) => {
+      port2.onmessage = (messageEvent) => resolve(messageEvent.data);
+    });
+    const nextP = writer.next(message);
+
+    expect(await nextP).toStrictEqual({
+      done: false,
+      value: undefined,
+    });
+    expect(await messageP).toStrictEqual(message);
+  });
+
+  it('ends after returning', async () => {
+    const { port1 } = new MessageChannel();
+    const writer = new MessagePortWriter(port1);
+
+    const result = writer.return();
+    expect(await result).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(port1.onmessage).toBeNull();
+  });
+
+  it('ends after throwing', async () => {
+    const { port1 } = new MessageChannel();
+    const writer = new MessagePortWriter(port1);
+
+    const result = writer.throw();
+    expect(await result).toStrictEqual({
+      done: true,
+      value: undefined,
+    });
+    expect(port1.onmessage).toBeNull();
+  });
+});
diff --git a/packages/streams/src/streams.ts b/packages/streams/src/streams.ts
new file mode 100644
index 000000000..ffd5d7b4a
--- /dev/null
+++ b/packages/streams/src/streams.ts
@@ -0,0 +1,182 @@
+/**
+ * This module provides a pair of classes for creating readable and writable streams
+ * over a [MessagePort](https://developer.mozilla.org/en-US/docs/Web/API/MessagePort).
+ * The classes are naive passthrough mechanisms for data. Because there is no ergonomic
+ * way to detect the closure of a message port at the time of writing, closure must be
+ * handled at a higher level of abstraction. The lifetime of the underlying message port
+ * is expected to be coextensive with "the other side".
+ *
+ * In addition, the message port mechanism is assumed to be 100% reliable, and the classes
+ * therefore have no concept of errors or error handling. This is instead also delegated
+ * to a higher level of abstraction.
+ *
+ * Regarding limitations around detecting `MessagePort` closure, see:
+ * - https://github.com/fergald/explainer-messageport-close
+ * - https://github.com/whatwg/html/issues/10201
+ * @module MessagePort streams
+ */
+
+import { makePromiseKit } from '@endo/promise-kit';
+import type { Reader, Writer } from '@endo/stream';
+
+type PromiseCallbacks = {
+  resolve: (value: unknown) => void;
+  reject: (reason: unknown) => void;
+};
+
+const makeDoneResult = () =>
+  ({ done: true, value: undefined } as { done: true; value: undefined });
+
+/**
+ * A readable stream over a {@link MessagePort}.
+ *
+ * This class is a naive passthrough mechanism for data over a pair of linked message
+ * ports. The message port mechanism is assumed to be completely reliable, and this
+ * class therefore has no concept of errors or error handling. Errors and closure
+ * are expected to be handled at a higher level of abstraction.
+ *
+ * @see
+ * - {@link MessagePortWriter} for the corresponding writable stream.
+ * - The module-level documentation for more details.
+ */
+export class MessagePortReader<Yield> implements Reader<Yield> {
+  #port: MessagePort;
+
+  /**
+   * For buffering messages to manage backpressure.
+   */
+  #messageQueue: MessageEvent[];
+
+  /**
+   * For buffering reads to manage drain.
+   */
+  #readQueue: PromiseCallbacks[];
+
+  constructor(port: MessagePort) {
+    this.#port = port;
+    this.#messageQueue = [];
+    this.#readQueue = [];
+
+    // Assigning to the `onmessage` property initializes the port's message queue.
+    this.#port.onmessage = this.#handleMessage.bind(this);
+    harden(this);
+  }
+
+  [Symbol.asyncIterator]() {
+    return this;
+  }
+
+  #handleMessage(message: MessageEvent): void {
+    if (this.#readQueue.length > 0) {
+      const { resolve } = this.#readQueue.shift() as PromiseCallbacks;
+      resolve({ done: false, value: message.data });
+    } else {
+      this.#messageQueue.push(message);
+    }
+  }
+
+  /**
+   * Reads the next message from the port.
+   * @returns The next message from the port.
+   */
+  async next(): Promise<IteratorResult<Yield, undefined>> {
+    const { promise, resolve, reject } = makePromiseKit();
+    if (this.#messageQueue.length > 0) {
+      const message = this.#messageQueue.shift() as MessageEvent;
+      resolve({ done: false, value: message.data });
+    } else {
+      this.#readQueue.push({ resolve, reject });
+    }
+    return promise as Promise<IteratorResult<Yield, undefined>>;
+  }
+
+  /**
+   * Closes the underlying port and returns.
+   * @returns The final result for this stream.
+   */
+  async return(): Promise<IteratorResult<Yield, undefined>> {
+    while (this.#readQueue.length > 0) {
+      const { resolve } = this.#readQueue.shift() as PromiseCallbacks;
+      resolve(makeDoneResult());
+    }
+    return this.#end();
+  }
+
+  /**
+   * Alias for {@link return}.
+   * @deprecated This method only exists for interface conformance. Due to limitations
+   * of the underlying communication mechanism, this class has no concept of errors.
+   * Use {@link return} instead.
+   * @returns The final result for this stream.
+   */
+  async throw(): Promise<IteratorResult<Yield, undefined>> {
+    return this.return();
+  }
+
+  #end(): IteratorResult<Yield, undefined> {
+    this.#port.close();
+    this.#port.onmessage = null;
+    return makeDoneResult();
+  }
+}
+harden(MessagePortReader);
+
+/**
+ * A writable stream over a {@link MessagePort}.
+ *
+ * This class is a naive passthrough mechanism for data over a pair of linked message
+ * ports. The message port mechanism is assumed to be completely reliable, and this
+ * class therefore has no concept of errors or error handling. Errors and closure
+ * are expected to be handled at a higher level of abstraction.
+ *
+ * @see
+ * - {@link MessagePortReader} for the corresponding readable stream.
+ * - The module-level documentation for more details.
+ */
+export class MessagePortWriter<Yield> implements Writer<Yield> {
+  #port: MessagePort;
+
+  constructor(port: MessagePort) {
+    this.#port = port;
+    harden(this);
+  }
+
+  [Symbol.asyncIterator]() {
+    return this;
+  }
+
+  /**
+   * Writes the next message to the port.
+   * @param value - The next message to write to the port.
+   * @returns The result of writing the message.
+   */
+  async next(value: Yield): Promise<IteratorResult<undefined, undefined>> {
+    this.#port.postMessage(value);
+    return { done: false, value: undefined };
+  }
+
+  /**
+   * Closes the underlying port and returns.
+   * @returns The final result for this stream.
+   */
+  async return(): Promise<IteratorResult<undefined, undefined>> {
+    return this.#end();
+  }
+
+  /**
+   * Alias for {@link return}.
+   * @deprecated This method only exists for interface conformance. Due to limitations
+   * of the underlying communication mechanism, this class has no concept of errors.
+   * Use {@link return} instead.
+   * @returns The final result for this stream.
+   */
+  async throw(): Promise<IteratorResult<undefined, undefined>> {
+    return this.#end();
+  }
+
+  #end(): IteratorResult<undefined, undefined> {
+    this.#port.close();
+    return makeDoneResult();
+  }
+}
+harden(MessagePortWriter);
diff --git a/packages/streams/tsconfig.build.json b/packages/streams/tsconfig.build.json
new file mode 100644
index 000000000..b1e6f4092
--- /dev/null
+++ b/packages/streams/tsconfig.build.json
@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.packages.build.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "lib": ["DOM", "ES2020"],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "types": ["ses"]
+  },
+  "references": [],
+  "include": ["./src"]
+}
diff --git a/packages/streams/tsconfig.json b/packages/streams/tsconfig.json
new file mode 100644
index 000000000..076246c94
--- /dev/null
+++ b/packages/streams/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.packages.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "lib": ["DOM", "ES2020"],
+    "types": ["ses", "vitest", "vitest/jsdom"]
+  },
+  "references": [{ "path": "../test-utils" }],
+  "include": ["./src"]
+}
diff --git a/packages/streams/typedoc.json b/packages/streams/typedoc.json
new file mode 100644
index 000000000..3d60644d9
--- /dev/null
+++ b/packages/streams/typedoc.json
@@ -0,0 +1,7 @@
+{
+  "entryPoints": ["./src/streams.ts", "./src/message-channel.ts"],
+  "excludePrivate": true,
+  "hideGenerator": true,
+  "out": "docs",
+  "tsconfig": "./tsconfig.build.json"
+}
diff --git a/packages/streams/vitest.config.mts b/packages/streams/vitest.config.mts
index 8cf26eb08..2548b743e 100644
--- a/packages/streams/vitest.config.mts
+++ b/packages/streams/vitest.config.mts
@@ -1,6 +1,17 @@
 // eslint-disable-next-line spaced-comment
 /// <reference types="vitest" />
 
+import { defineConfig, mergeConfig } from 'vite';
+
 import { getDefaultConfig } from '../../vitest.config.packages.mjs';
 
-export default getDefaultConfig();
+const defaultConfig = getDefaultConfig();
+
+export default mergeConfig(
+  defaultConfig,
+  defineConfig({
+    test: {
+      setupFiles: '../test-utils/src/env/mock-endo.ts',
+    },
+  }),
+);
diff --git a/packages/test-utils/README.md b/packages/test-utils/README.md
new file mode 100644
index 000000000..98623a7db
--- /dev/null
+++ b/packages/test-utils/README.md
@@ -0,0 +1,7 @@
+# `test-utils`
+
+Internal testing utilities.
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
diff --git a/packages/test-utils/package.json b/packages/test-utils/package.json
new file mode 100644
index 000000000..12f8b0c34
--- /dev/null
+++ b/packages/test-utils/package.json
@@ -0,0 +1,27 @@
+{
+  "name": "@ocap/test-utils",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Internal testing utilities",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MetaMask/ocap-kernel.git"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "clean": "rimraf ./dist './*.tsbuildinfo'",
+    "test": "echo 'No tests.' && exit 0"
+  },
+  "devDependencies": {
+    "ses": "^1.7.0",
+    "typescript": "~4.9.5",
+    "vitest": "^2.0.5"
+  },
+  "engines": {
+    "node": "^18.18 || >=20"
+  }
+}
diff --git a/packages/test-utils/src/env/mock-endo.ts b/packages/test-utils/src/env/mock-endo.ts
new file mode 100644
index 000000000..9f2e2c0a2
--- /dev/null
+++ b/packages/test-utils/src/env/mock-endo.ts
@@ -0,0 +1,7 @@
+// eslint-disable-next-line spaced-comment
+/// <reference types="ses"/>
+
+globalThis.lockdown = () => undefined;
+globalThis.harden = <Value>(value: Value): Readonly<Value> => value;
+
+export {};
diff --git a/packages/test-utils/src/index.ts b/packages/test-utils/src/index.ts
new file mode 100644
index 000000000..6aa734f18
--- /dev/null
+++ b/packages/test-utils/src/index.ts
@@ -0,0 +1,2 @@
+export * from './mocks.js';
+export * from './utils.js';
diff --git a/packages/test-utils/src/mocks.ts b/packages/test-utils/src/mocks.ts
new file mode 100644
index 000000000..f2bc54532
--- /dev/null
+++ b/packages/test-utils/src/mocks.ts
@@ -0,0 +1,15 @@
+/**
+ * Create a module mock for `@endo/promise-kit`.
+ * @returns The mock.
+ */
+export const makePromiseKitMock = () => ({
+  makePromiseKit: () => {
+    let resolve: (value: unknown) => void, reject: (reason?: unknown) => void;
+    const promise = new Promise((_resolve, _reject) => {
+      resolve = _resolve;
+      reject = _reject;
+    });
+    // @ts-expect-error We have in fact assigned resolve and reject.
+    return { promise, resolve, reject };
+  },
+});
diff --git a/packages/test-utils/src/utils.ts b/packages/test-utils/src/utils.ts
new file mode 100644
index 000000000..35adf6fad
--- /dev/null
+++ b/packages/test-utils/src/utils.ts
@@ -0,0 +1,7 @@
+/**
+ * Delay execution by the specified number of milliseconds.
+ * @param ms - The number of milliseconds to delay.
+ * @returns A promise that resolves after the specified delay.
+ */
+export const delay = async (ms = 1) =>
+  new Promise((resolve) => setTimeout(resolve, ms));
diff --git a/packages/test-utils/tsconfig.build.json b/packages/test-utils/tsconfig.build.json
new file mode 100644
index 000000000..c622f4091
--- /dev/null
+++ b/packages/test-utils/tsconfig.build.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.packages.build.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "references": [],
+  "include": ["./src"]
+}
diff --git a/packages/test-utils/tsconfig.json b/packages/test-utils/tsconfig.json
new file mode 100644
index 000000000..b61928cb9
--- /dev/null
+++ b/packages/test-utils/tsconfig.json
@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.packages.json",
+  "compilerOptions": {
+    "baseUrl": "./"
+  },
+  "references": [],
+  "include": ["./src"],
+  "types": ["ses", "vitest", "vitest/jsdom"]
+}
diff --git a/tsconfig.build.json b/tsconfig.build.json
index 5107ebe6e..34acb2854 100644
--- a/tsconfig.build.json
+++ b/tsconfig.build.json
@@ -3,6 +3,7 @@
   "include": [],
   "references": [
     { "path": "./packages/extension/tsconfig.build.json" },
-    { "path": "./packages/shims/tsconfig.build.json" }
+    { "path": "./packages/shims/tsconfig.build.json" },
+    { "path": "./packages/streams/tsconfig.build.json" }
   ]
 }
diff --git a/tsconfig.json b/tsconfig.json
index 1e0c7163e..2cd76ded6 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,6 +1,8 @@
 {
   "compilerOptions": {
     "esModuleInterop": true,
+    "module": "Node16",
+    "moduleResolution": "Node16",
     "noEmit": true,
     "resolveJsonModule": true
   },
@@ -8,6 +10,8 @@
   "include": [],
   "references": [
     { "path": "./packages/extension" },
-    { "path": "./packages/shims" }
+    { "path": "./packages/shims" },
+    { "path": "./packages/streams" },
+    { "path": "./packages/test-utils" }
   ]
 }
diff --git a/tsconfig.packages.json b/tsconfig.packages.json
index 11ff16e94..0dd744a1e 100644
--- a/tsconfig.packages.json
+++ b/tsconfig.packages.json
@@ -4,8 +4,8 @@
     "exactOptionalPropertyTypes": true,
     "forceConsistentCasingInFileNames": true,
     "lib": ["ES2020"],
-    "module": "CommonJS",
-    "moduleResolution": "Node",
+    "module": "Node16",
+    "moduleResolution": "Node16",
     "noErrorTruncation": true,
     "noUncheckedIndexedAccess": true,
     /**
diff --git a/vitest.config.packages.mjs b/vitest.config.packages.mjs
index 209023248..54e00c0f7 100644
--- a/vitest.config.packages.mjs
+++ b/vitest.config.packages.mjs
@@ -5,6 +5,7 @@
 /* eslint-disable jsdoc/valid-types, import/namespace */
 import path from 'path';
 import { defineConfig } from 'vite';
+import tsconfigPathsPlugin from 'vite-tsconfig-paths';
 
 /**
  * Get the default vitest config. See https://vitest.dev/config/ for details.
@@ -15,6 +16,12 @@ export const getDefaultConfig = (projectRoot = './src') =>
   defineConfig({
     root: projectRoot,
 
+    plugins: [
+      // Resolve imports using the "paths" property of the relevant tsconfig.json,
+      // if possible.
+      tsconfigPathsPlugin(),
+    ],
+
     test: {
       environment: 'jsdom',
       restoreMocks: true,
@@ -29,5 +36,6 @@ export const getDefaultConfig = (projectRoot = './src') =>
       },
       reporters: ['basic'],
       silent: true,
+      testTimeout: 2000,
     },
   });
diff --git a/yarn.lock b/yarn.lock
index a75f7d43b..01fda9eed 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -312,10 +312,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@endo/env-options@npm:^1.1.4":
-  version: 1.1.4
-  resolution: "@endo/env-options@npm:1.1.4"
-  checksum: 10/718c15ae91b5e3d00c8b90f64d07930cc6bc58297cbda55097c339121a8c63045cd909f4bd7a4c39635354d228fa68f6182eb43ac0b0eaa62b05618484ec8209
+"@endo/env-options@npm:^1.1.4, @endo/env-options@npm:^1.1.5":
+  version: 1.1.5
+  resolution: "@endo/env-options@npm:1.1.5"
+  checksum: 10/ce4cb29ecf387f52f7d1c9e7e43b0a1064326587ebac62e7c239bf2df71aa4c3296d2a05cf169d1efcd8c1ddf73aeede8afd86e7b5c9387b80e8e0939d1af0f6
   languageName: node
   linkType: hard
 
@@ -346,6 +346,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@endo/stream@npm:^1.2.2":
+  version: 1.2.2
+  resolution: "@endo/stream@npm:1.2.2"
+  dependencies:
+    "@endo/eventual-send": "npm:^1.2.2"
+    "@endo/promise-kit": "npm:^1.1.2"
+    ses: "npm:^1.5.0"
+  checksum: 10/2c0ebea133c7a184672679dd1597903fd14df1d6ddd3103f44ef476d9b86a58a8c04ecf42f960a79c8ba85f138e2020bf86ae1cd9a483633326bfc2d874473a4
+  languageName: node
+  linkType: hard
+
 "@es-joy/jsdoccomment@npm:~0.36.1":
   version: 0.36.1
   resolution: "@es-joy/jsdoccomment@npm:0.36.1"
@@ -1233,18 +1244,22 @@ __metadata:
     "@metamask/auto-changelog": "npm:^3.4.4"
     "@metamask/snaps-utils": "npm:^7.8.0"
     "@metamask/utils": "npm:^9.1.0"
-    "@ocap/shims": "npm:^0.0.0"
+    "@ocap/shims": "workspace:^"
+    "@ocap/streams": "workspace:^"
+    "@ocap/test-utils": "workspace:^"
     "@types/chrome": "npm:^0.0.268"
-    "@vitest/coverage-v8": "npm:^2.0.4"
+    "@vitest/coverage-v8": "npm:^2.0.5"
+    cheerio: "npm:^1.0.0-rc.12"
     deepmerge: "npm:^4.3.1"
     jsdom: "npm:^24.1.1"
-    ses: "npm:^1.5.0"
+    prettier: "npm:^2.7.1"
+    ses: "npm:^1.7.0"
     typedoc: "npm:^0.24.8"
     typedoc-plugin-missing-exports: "npm:^2.0.0"
     typescript: "npm:~4.9.5"
     vite: "npm:^5.3.5"
     vite-plugin-static-copy: "npm:^1.0.6"
-    vitest: "npm:^2.0.4"
+    vitest: "npm:^2.0.5"
   languageName: unknown
   linkType: soft
 
@@ -1259,7 +1274,7 @@ __metadata:
     "@metamask/eslint-config": "npm:^12.2.0"
     "@metamask/eslint-config-nodejs": "npm:^12.1.0"
     "@metamask/eslint-config-typescript": "npm:^12.1.0"
-    "@ts-bridge/cli": "npm:^0.1.4"
+    "@ts-bridge/cli": "npm:^0.3.0"
     "@ts-bridge/shims": "npm:^0.1.1"
     "@types/node": "npm:^18.18.14"
     "@typescript-eslint/eslint-plugin": "npm:^5.43.0"
@@ -1280,11 +1295,12 @@ __metadata:
     typedoc: "npm:^0.24.8"
     typescript: "npm:~4.9.5"
     vite: "npm:^5.3.5"
-    vitest: "npm:^2.0.4"
+    vite-tsconfig-paths: "npm:^4.3.2"
+    vitest: "npm:^2.0.5"
   languageName: unknown
   linkType: soft
 
-"@ocap/shims@npm:^0.0.0, @ocap/shims@workspace:packages/shims":
+"@ocap/shims@workspace:^, @ocap/shims@workspace:packages/shims":
   version: 0.0.0-use.local
   resolution: "@ocap/shims@workspace:packages/shims"
   dependencies:
@@ -1294,8 +1310,42 @@ __metadata:
     deepmerge: "npm:^4.3.1"
     mkdirp: "npm:^3.0.1"
     rimraf: "npm:^6.0.1"
-    ses: "npm:^1.5.0"
-    vitest: "npm:^2.0.4"
+    ses: "npm:^1.7.0"
+    vitest: "npm:^2.0.5"
+  languageName: unknown
+  linkType: soft
+
+"@ocap/streams@workspace:^, @ocap/streams@workspace:packages/streams":
+  version: 0.0.0-use.local
+  resolution: "@ocap/streams@workspace:packages/streams"
+  dependencies:
+    "@arethetypeswrong/cli": "npm:^0.15.3"
+    "@endo/promise-kit": "npm:^1.1.2"
+    "@endo/stream": "npm:^1.2.2"
+    "@metamask/auto-changelog": "npm:^3.4.4"
+    "@metamask/utils": "npm:^9.1.0"
+    "@ocap/test-utils": "workspace:^"
+    "@ts-bridge/cli": "npm:^0.3.0"
+    "@ts-bridge/shims": "npm:^0.1.1"
+    "@types/jsdom": "npm:^21.1.7"
+    "@vitest/coverage-v8": "npm:^2.0.5"
+    deepmerge: "npm:^4.3.1"
+    jsdom: "npm:^24.1.1"
+    typedoc: "npm:^0.24.8"
+    typedoc-plugin-missing-exports: "npm:^2.0.0"
+    typescript: "npm:~4.9.5"
+    vite: "npm:^5.3.5"
+    vitest: "npm:^2.0.5"
+  languageName: unknown
+  linkType: soft
+
+"@ocap/test-utils@workspace:^, @ocap/test-utils@workspace:packages/test-utils":
+  version: 0.0.0-use.local
+  resolution: "@ocap/test-utils@workspace:packages/test-utils"
+  dependencies:
+    ses: "npm:^1.7.0"
+    typescript: "npm:~4.9.5"
+    vitest: "npm:^2.0.5"
   languageName: unknown
   linkType: soft
 
@@ -1472,12 +1522,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@ts-bridge/cli@npm:^0.1.4":
-  version: 0.1.4
-  resolution: "@ts-bridge/cli@npm:0.1.4"
+"@ts-bridge/cli@npm:^0.3.0":
+  version: 0.3.0
+  resolution: "@ts-bridge/cli@npm:0.3.0"
   dependencies:
+    "@ts-bridge/resolver": "npm:^0.1.0"
     chalk: "npm:^5.3.0"
-    resolve.exports: "npm:^2.0.2"
     yargs: "npm:^17.7.2"
   peerDependencies:
     "@ts-bridge/shims": ^0.1.1
@@ -1488,7 +1538,14 @@ __metadata:
   bin:
     ts-bridge: ./dist/index.js
     tsbridge: ./dist/index.js
-  checksum: 10/db83db5d283d7341f53f042f115884f514acd1ce6c7e14975b821b39cc4852f3cd6e41790a8cbb2b8615f0e5de77e5bdcec0745935b41267b2af4db031400c84
+  checksum: 10/0940e808b5cc4b8d67a7e7e976505a5fdef7f032f5962a82e0e90c66c660c2cbaae4a597c5e68c0fff05c03493c7caf344572da1d2077503fb498f928c254f83
+  languageName: node
+  linkType: hard
+
+"@ts-bridge/resolver@npm:^0.1.0":
+  version: 0.1.0
+  resolution: "@ts-bridge/resolver@npm:0.1.0"
+  checksum: 10/564a00cba7ccc327fc88e5c9ac3066198ae7995899fbe3b197d42c0721a8e5195045919cca955e6cab3ce9ff0f3915701bf68f4d5ce39d602a5daa99b435c929
   languageName: node
   linkType: hard
 
@@ -1581,6 +1638,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/jsdom@npm:^21.1.7":
+  version: 21.1.7
+  resolution: "@types/jsdom@npm:21.1.7"
+  dependencies:
+    "@types/node": "npm:*"
+    "@types/tough-cookie": "npm:*"
+    parse5: "npm:^7.0.0"
+  checksum: 10/a5ee54aec813ac928ef783f69828213af4d81325f584e1fe7573a9ae139924c40768d1d5249237e62d51b9a34ed06bde059c86c6b0248d627457ec5e5d532dfa
+  languageName: node
+  linkType: hard
+
 "@types/json-schema@npm:^7.0.9":
   version: 7.0.11
   resolution: "@types/json-schema@npm:7.0.11"
@@ -1632,6 +1700,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/tough-cookie@npm:*":
+  version: 4.0.5
+  resolution: "@types/tough-cookie@npm:4.0.5"
+  checksum: 10/01fd82efc8202670865928629697b62fe9bf0c0dcbc5b1c115831caeb073a2c0abb871ff393d7df1ae94ea41e256cb87d2a5a91fd03cdb1b0b4384e08d4ee482
+  languageName: node
+  linkType: hard
+
 "@typescript-eslint/eslint-plugin@npm:^5.43.0":
   version: 5.43.0
   resolution: "@typescript-eslint/eslint-plugin@npm:5.43.0"
@@ -1819,9 +1894,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@vitest/coverage-v8@npm:^2.0.4":
-  version: 2.0.4
-  resolution: "@vitest/coverage-v8@npm:2.0.4"
+"@vitest/coverage-v8@npm:^2.0.5":
+  version: 2.0.5
+  resolution: "@vitest/coverage-v8@npm:2.0.5"
   dependencies:
     "@ampproject/remapping": "npm:^2.3.0"
     "@bcoe/v8-coverage": "npm:^0.2.3"
@@ -1836,8 +1911,8 @@ __metadata:
     test-exclude: "npm:^7.0.1"
     tinyrainbow: "npm:^1.2.0"
   peerDependencies:
-    vitest: 2.0.4
-  checksum: 10/de23ca9c8e7cd704d889475af9a8282a1d29e4ca05909edc28df3f55b65a10cba344ab350ab255d0ad1b8a3dc6d98ebb12d5c2614bc8d92b03b645f15912ae61
+    vitest: 2.0.5
+  checksum: 10/bb774d1a52b85adf94dcf62dc9684c59bd6aba6f8d43ce4d4afa06e3ca85651ec217f74842c0c4a81ea0158f029e484055207869e5d741cfbc3119257399fb83
   languageName: node
   linkType: hard
 
@@ -2318,6 +2393,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"boolbase@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "boolbase@npm:1.0.0"
+  checksum: 10/3e25c80ef626c3a3487c73dbfc70ac322ec830666c9ad915d11b701142fab25ec1e63eff2c450c74347acfd2de854ccde865cd79ef4db1683f7c7b046ea43bb0
+  languageName: node
+  linkType: hard
+
 "brace-expansion@npm:^1.1.7":
   version: 1.1.11
   resolution: "brace-expansion@npm:1.1.11"
@@ -2531,6 +2613,35 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cheerio-select@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "cheerio-select@npm:2.1.0"
+  dependencies:
+    boolbase: "npm:^1.0.0"
+    css-select: "npm:^5.1.0"
+    css-what: "npm:^6.1.0"
+    domelementtype: "npm:^2.3.0"
+    domhandler: "npm:^5.0.3"
+    domutils: "npm:^3.0.1"
+  checksum: 10/b5d89208c23468c3a32d1e04f88b9e8c6e332e3649650c5cd29255e2cebc215071ae18563f58c3dc3f6ef4c234488fc486035490fceb78755572288245e2931a
+  languageName: node
+  linkType: hard
+
+"cheerio@npm:^1.0.0-rc.12":
+  version: 1.0.0-rc.12
+  resolution: "cheerio@npm:1.0.0-rc.12"
+  dependencies:
+    cheerio-select: "npm:^2.1.0"
+    dom-serializer: "npm:^2.0.0"
+    domhandler: "npm:^5.0.3"
+    domutils: "npm:^3.0.1"
+    htmlparser2: "npm:^8.0.1"
+    parse5: "npm:^7.0.0"
+    parse5-htmlparser2-tree-adapter: "npm:^7.0.0"
+  checksum: 10/812fed61aa4b669bbbdd057d0d7f73ba4649cabfd4fc3a8f1d5c7499e4613b430636102716369cbd6bbed8f1bdcb06387ae8342289fb908b2743184775f94f18
+  languageName: node
+  linkType: hard
+
 "chokidar@npm:>=3.0.0 <4.0.0, chokidar@npm:^3.5.3":
   version: 3.6.0
   resolution: "chokidar@npm:3.6.0"
@@ -2733,6 +2844,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"css-select@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "css-select@npm:5.1.0"
+  dependencies:
+    boolbase: "npm:^1.0.0"
+    css-what: "npm:^6.1.0"
+    domhandler: "npm:^5.0.2"
+    domutils: "npm:^3.0.1"
+    nth-check: "npm:^2.0.1"
+  checksum: 10/d486b1e7eb140468218a5ab5af53257e01f937d2173ac46981f6b7de9c5283d55427a36715dc8decfc0c079cf89259ac5b41ef58f6e1a422eee44ab8bfdc78da
+  languageName: node
+  linkType: hard
+
+"css-what@npm:^6.1.0":
+  version: 6.1.0
+  resolution: "css-what@npm:6.1.0"
+  checksum: 10/c67a3a2d0d81843af87f8bf0a4d0845b0f952377714abbb2884e48942409d57a2110eabee003609d02ee487b054614bdfcfc59ee265728ff105bd5aa221c1d0e
+  languageName: node
+  linkType: hard
+
 "cssstyle@npm:^4.0.1":
   version: 4.0.1
   resolution: "cssstyle@npm:4.0.1"
@@ -2955,6 +3086,44 @@ __metadata:
   languageName: node
   linkType: hard
 
+"dom-serializer@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "dom-serializer@npm:2.0.0"
+  dependencies:
+    domelementtype: "npm:^2.3.0"
+    domhandler: "npm:^5.0.2"
+    entities: "npm:^4.2.0"
+  checksum: 10/e3bf9027a64450bca0a72297ecdc1e3abb7a2912268a9f3f5d33a2e29c1e2c3502c6e9f860fc6625940bfe0cfb57a44953262b9e94df76872fdfb8151097eeb3
+  languageName: node
+  linkType: hard
+
+"domelementtype@npm:^2.3.0":
+  version: 2.3.0
+  resolution: "domelementtype@npm:2.3.0"
+  checksum: 10/ee837a318ff702622f383409d1f5b25dd1024b692ef64d3096ff702e26339f8e345820f29a68bcdcea8cfee3531776b3382651232fbeae95612d6f0a75efb4f6
+  languageName: node
+  linkType: hard
+
+"domhandler@npm:^5.0.2, domhandler@npm:^5.0.3":
+  version: 5.0.3
+  resolution: "domhandler@npm:5.0.3"
+  dependencies:
+    domelementtype: "npm:^2.3.0"
+  checksum: 10/809b805a50a9c6884a29f38aec0a4e1b4537f40e1c861950ed47d10b049febe6b79ab72adaeeebb3cc8fc1cd33f34e97048a72a9265103426d93efafa78d3e96
+  languageName: node
+  linkType: hard
+
+"domutils@npm:^3.0.1":
+  version: 3.1.0
+  resolution: "domutils@npm:3.1.0"
+  dependencies:
+    dom-serializer: "npm:^2.0.0"
+    domelementtype: "npm:^2.3.0"
+    domhandler: "npm:^5.0.3"
+  checksum: 10/9a169a6e57ac4c738269a73ab4caf785114ed70e46254139c1bbc8144ac3102aacb28a6149508395ae34aa5d6a40081f4fa5313855dc8319c6d8359866b6dfea
+  languageName: node
+  linkType: hard
+
 "eastasianwidth@npm:^0.2.0":
   version: 0.2.0
   resolution: "eastasianwidth@npm:0.2.0"
@@ -2999,7 +3168,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"entities@npm:^4.4.0":
+"entities@npm:^4.2.0, entities@npm:^4.4.0":
   version: 4.5.0
   resolution: "entities@npm:4.5.0"
   checksum: 10/ede2a35c9bce1aeccd055a1b445d41c75a14a2bb1cd22e242f20cf04d236cdcd7f9c859eb83f76885327bfae0c25bf03303665ee1ce3d47c5927b98b0e3e3d48
@@ -4068,6 +4237,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"globrex@npm:^0.1.2":
+  version: 0.1.2
+  resolution: "globrex@npm:0.1.2"
+  checksum: 10/81ce62ee6f800d823d6b7da7687f841676d60ee8f51f934ddd862e4057316d26665c4edc0358d4340a923ac00a514f8b67c787e28fe693aae16350f4e60d55e9
+  languageName: node
+  linkType: hard
+
 "gopd@npm:^1.0.1":
   version: 1.0.1
   resolution: "gopd@npm:1.0.1"
@@ -4194,6 +4370,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"htmlparser2@npm:^8.0.1":
+  version: 8.0.2
+  resolution: "htmlparser2@npm:8.0.2"
+  dependencies:
+    domelementtype: "npm:^2.3.0"
+    domhandler: "npm:^5.0.3"
+    domutils: "npm:^3.0.1"
+    entities: "npm:^4.4.0"
+  checksum: 10/ea5512956eee06f5835add68b4291d313c745e8407efa63848f4b8a90a2dee45f498a698bca8614e436f1ee0cfdd609938b71d67c693794545982b76e53e6f11
+  languageName: node
+  linkType: hard
+
 "http-cache-semantics@npm:^4.1.0, http-cache-semantics@npm:^4.1.1":
   version: 4.1.1
   resolution: "http-cache-semantics@npm:4.1.1"
@@ -5543,6 +5731,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"nth-check@npm:^2.0.1":
+  version: 2.1.1
+  resolution: "nth-check@npm:2.1.1"
+  dependencies:
+    boolbase: "npm:^1.0.0"
+  checksum: 10/5afc3dafcd1573b08877ca8e6148c52abd565f1d06b1eb08caf982e3fa289a82f2cae697ffb55b5021e146d60443f1590a5d6b944844e944714a5b549675bcd3
+  languageName: node
+  linkType: hard
+
 "nwsapi@npm:^2.2.12":
   version: 2.2.12
   resolution: "nwsapi@npm:2.2.12"
@@ -5683,7 +5880,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse5@npm:^7.1.2":
+"parse5-htmlparser2-tree-adapter@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "parse5-htmlparser2-tree-adapter@npm:7.0.0"
+  dependencies:
+    domhandler: "npm:^5.0.2"
+    parse5: "npm:^7.0.0"
+  checksum: 10/23dbe45fdd338fe726cf5c55b236e1f403aeb0c1b926e18ab8ef0aa580980a25f8492d160fe2ed0ec906c3c8e38b51e68ef5620a3b9460d9458ea78946a3f7c0
+  languageName: node
+  linkType: hard
+
+"parse5@npm:^7.0.0, parse5@npm:^7.1.2":
   version: 7.1.2
   resolution: "parse5@npm:7.1.2"
   dependencies:
@@ -6026,13 +6233,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"resolve.exports@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "resolve.exports@npm:2.0.2"
-  checksum: 10/f1cc0b6680f9a7e0345d783e0547f2a5110d8336b3c2a4227231dd007271ffd331fd722df934f017af90bae0373920ca0d4005da6f76cb3176c8ae426370f893
-  languageName: node
-  linkType: hard
-
 "resolve@npm:1.22.8, resolve@npm:^1.18.1, resolve@npm:^1.22.0, resolve@npm:^1.22.1, resolve@npm:^1.22.4":
   version: 1.22.8
   resolution: "resolve@npm:1.22.8"
@@ -6283,12 +6483,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ses@npm:^1.1.0, ses@npm:^1.5.0":
-  version: 1.5.0
-  resolution: "ses@npm:1.5.0"
+"ses@npm:^1.1.0, ses@npm:^1.5.0, ses@npm:^1.7.0":
+  version: 1.7.0
+  resolution: "ses@npm:1.7.0"
   dependencies:
-    "@endo/env-options": "npm:^1.1.4"
-  checksum: 10/6f2cd8f3607f98838d6458cc4b77e6c1cffe8fc30b923212c1dde73c89e9a0e1eaa8f44ac38811d73a6961560e5be4155a0e58879f6dfe69d3319433251891da
+    "@endo/env-options": "npm:^1.1.5"
+  checksum: 10/8d1227fadcd06653d1b49083c067ae07e55164af984c9e8b393238fbbd315f47216472e3ac65a78638955f3f1a2537e9c9865f0ab142639a6862b902cb1cf6f2
   languageName: node
   linkType: hard
 
@@ -6842,6 +7042,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tsconfck@npm:^3.0.3":
+  version: 3.1.1
+  resolution: "tsconfck@npm:3.1.1"
+  peerDependencies:
+    typescript: ^5.0.0
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  bin:
+    tsconfck: bin/tsconfck.js
+  checksum: 10/a4456577f540212516d7eb530005893739aadd6da00787914a8ed9aa19c3f2f306b8912920aa440b9b8978f10c9dadbd062b8c2a2f0ff1f6c2d4272b5be2ef34
+  languageName: node
+  linkType: hard
+
 "tsconfig-paths@npm:^3.14.1":
   version: 3.14.1
   resolution: "tsconfig-paths@npm:3.14.1"
@@ -7187,6 +7401,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"vite-tsconfig-paths@npm:^4.3.2":
+  version: 4.3.2
+  resolution: "vite-tsconfig-paths@npm:4.3.2"
+  dependencies:
+    debug: "npm:^4.1.1"
+    globrex: "npm:^0.1.2"
+    tsconfck: "npm:^3.0.3"
+  peerDependencies:
+    vite: "*"
+  peerDependenciesMeta:
+    vite:
+      optional: true
+  checksum: 10/c12e2087fd01ac8a694850c649b79d5b9798cdba0ef9ab4116f669d8ffa1a9a3195c5a14410d3d9a12d2f08cd35ddd74f03d9c7b13a2d590d002055cdaab45c0
+  languageName: node
+  linkType: hard
+
 "vite@npm:^5.0.0, vite@npm:^5.3.5":
   version: 5.3.5
   resolution: "vite@npm:5.3.5"
@@ -7227,7 +7457,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vitest@npm:^2.0.4":
+"vitest@npm:^2.0.5":
   version: 2.0.5
   resolution: "vitest@npm:2.0.5"
   dependencies: