Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

62 files changed, 7494 insertions, 0 deletions

diff --git a/dom/clients/manager/ClientChannelHelper.cpp b/dom/clients/manager/ClientChannelHelper.cpp
new file mode 100644
index 0000000000..f36cbb5319
--- /dev/null
+++ b/dom/clients/manager/ClientChannelHelper.cpp
@@ -0,0 +1,423 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientChannelHelper.h"
+
+#include "ClientManager.h"
+#include "ClientSource.h"
+#include "MainThreadUtils.h"
+#include "mozilla/dom/ClientsBinding.h"
+#include "mozilla/dom/ServiceWorkerDescriptor.h"
+#include "mozilla/ipc/BackgroundUtils.h"
+#include "mozilla/StaticPrefs_privacy.h"
+#include "mozilla/StoragePrincipalHelper.h"
+#include "nsContentUtils.h"
+#include "nsIAsyncVerifyRedirectCallback.h"
+#include "nsIChannel.h"
+#include "nsIChannelEventSink.h"
+#include "nsIHttpChannelInternal.h"
+#include "nsIInterfaceRequestor.h"
+#include "nsIInterfaceRequestorUtils.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::PrincipalInfoToPrincipal;
+
+namespace {
+
+// In the default mode, ClientChannelHelper runs in the content process and
+// handles all redirects. When we use DocumentChannel, redirects aren't exposed
+// to the content process, so we run an instance of this in both processes, one
+// to handle redirects in the parent and one to handle the final channel
+// replacement (DocumentChannelChild 'redirects' to the final channel) in the
+// child.
+
+class ClientChannelHelper : public nsIInterfaceRequestor,
+                            public nsIChannelEventSink {
+ protected:
+  nsCOMPtr<nsIInterfaceRequestor> mOuter;
+  nsCOMPtr<nsISerialEventTarget> mEventTarget;
+
+  virtual ~ClientChannelHelper() = default;
+
+  NS_IMETHOD
+  GetInterface(const nsIID& aIID, void** aResultOut) override {
+    if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
+      *aResultOut = static_cast<nsIChannelEventSink*>(this);
+      NS_ADDREF_THIS();
+      return NS_OK;
+    }
+
+    if (mOuter) {
+      return mOuter->GetInterface(aIID, aResultOut);
+    }
+
+    return NS_ERROR_NO_INTERFACE;
+  }
+
+  virtual void CreateClient(nsILoadInfo* aLoadInfo, nsIPrincipal* aPrincipal) {
+    CreateClientForPrincipal(aLoadInfo, aPrincipal, mEventTarget);
+  }
+
+  NS_IMETHOD
+  AsyncOnChannelRedirect(nsIChannel* aOldChannel, nsIChannel* aNewChannel,
+                         uint32_t aFlags,
+                         nsIAsyncVerifyRedirectCallback* aCallback) override {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    nsresult rv = nsContentUtils::CheckSameOrigin(aOldChannel, aNewChannel);
+    if (NS_WARN_IF(NS_FAILED(rv) && rv != NS_ERROR_DOM_BAD_URI)) {
+      return rv;
+    }
+
+    nsCOMPtr<nsILoadInfo> oldLoadInfo = aOldChannel->LoadInfo();
+    nsCOMPtr<nsILoadInfo> newLoadInfo = aNewChannel->LoadInfo();
+
+    UniquePtr<ClientSource> reservedClient =
+        oldLoadInfo->TakeReservedClientSource();
+
+    // If its a same-origin redirect we just move our reserved client to the
+    // new channel.
+    if (NS_SUCCEEDED(rv)) {
+      if (reservedClient) {
+        newLoadInfo->GiveReservedClientSource(std::move(reservedClient));
+      }
+
+      // It seems sometimes necko passes two channels with the same LoadInfo.
+      // We only need to move the reserved/initial ClientInfo over if we
+      // actually have a different LoadInfo.
+      else if (oldLoadInfo != newLoadInfo) {
+        const Maybe<ClientInfo>& reservedClientInfo =
+            oldLoadInfo->GetReservedClientInfo();
+
+        const Maybe<ClientInfo>& initialClientInfo =
+            oldLoadInfo->GetInitialClientInfo();
+
+        MOZ_DIAGNOSTIC_ASSERT(reservedClientInfo.isNothing() ||
+                              initialClientInfo.isNothing());
+
+        if (reservedClientInfo.isSome()) {
+          // Create a new client for the case the controller is cleared for the
+          // new loadInfo. ServiceWorkerManager::DispatchFetchEvent() called
+          // ServiceWorkerManager::StartControllingClient() making the old
+          // client to be controlled eventually. However, the controller setting
+          // propagation to the child process could happen later than
+          // nsGlobalWindowInner::EnsureClientSource(), such that
+          // nsGlobalWindowInner will be controlled as unexpected.
+          if (oldLoadInfo->GetController().isSome() &&
+              newLoadInfo->GetController().isNothing()) {
+            nsCOMPtr<nsIPrincipal> foreignPartitionedPrincipal;
+            rv = StoragePrincipalHelper::GetPrincipal(
+                aNewChannel,
+                StaticPrefs::privacy_partition_serviceWorkers()
+                    ? StoragePrincipalHelper::eForeignPartitionedPrincipal
+                    : StoragePrincipalHelper::eRegularPrincipal,
+                getter_AddRefs(foreignPartitionedPrincipal));
+            NS_ENSURE_SUCCESS(rv, rv);
+            reservedClient.reset();
+            CreateClient(newLoadInfo, foreignPartitionedPrincipal);
+          } else {
+            newLoadInfo->SetReservedClientInfo(reservedClientInfo.ref());
+          }
+        }
+
+        if (initialClientInfo.isSome()) {
+          newLoadInfo->SetInitialClientInfo(initialClientInfo.ref());
+        }
+      }
+    }
+
+    // If it's a cross-origin redirect then we discard the old reserved client
+    // and create a new one.
+    else {
+      nsCOMPtr<nsIPrincipal> foreignPartitionedPrincipal;
+      rv = StoragePrincipalHelper::GetPrincipal(
+          aNewChannel,
+          StaticPrefs::privacy_partition_serviceWorkers()
+              ? StoragePrincipalHelper::eForeignPartitionedPrincipal
+              : StoragePrincipalHelper::eRegularPrincipal,
+          getter_AddRefs(foreignPartitionedPrincipal));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      reservedClient.reset();
+      CreateClient(newLoadInfo, foreignPartitionedPrincipal);
+    }
+
+    uint32_t redirectMode = nsIHttpChannelInternal::REDIRECT_MODE_MANUAL;
+    nsCOMPtr<nsIHttpChannelInternal> http = do_QueryInterface(aOldChannel);
+    if (http) {
+      MOZ_ALWAYS_SUCCEEDS(http->GetRedirectMode(&redirectMode));
+    }
+
+    // Normally we keep the controller across channel redirects, but we must
+    // clear it when a document load redirects.  Only do this for real
+    // redirects, however.
+    //
+    // This is effectively described in step 4.2 of:
+    //
+    //  https://fetch.spec.whatwg.org/#http-fetch
+    //
+    // The spec sets the service-workers mode to none when the request is
+    // configured to *not* follow redirects.  This prevents any further
+    // service workers from intercepting.  The first service worker that
+    // had a shot at the FetchEvent remains the controller in this case.
+    if (!(aFlags & nsIChannelEventSink::REDIRECT_INTERNAL) &&
+        redirectMode != nsIHttpChannelInternal::REDIRECT_MODE_FOLLOW) {
+      newLoadInfo->ClearController();
+    }
+
+    nsCOMPtr<nsIChannelEventSink> outerSink = do_GetInterface(mOuter);
+    if (outerSink) {
+      return outerSink->AsyncOnChannelRedirect(aOldChannel, aNewChannel, aFlags,
+                                               aCallback);
+    }
+
+    aCallback->OnRedirectVerifyCallback(NS_OK);
+    return NS_OK;
+  }
+
+ public:
+  ClientChannelHelper(nsIInterfaceRequestor* aOuter,
+                      nsISerialEventTarget* aEventTarget)
+      : mOuter(aOuter), mEventTarget(aEventTarget) {}
+
+  NS_DECL_ISUPPORTS
+
+  virtual void CreateClientForPrincipal(nsILoadInfo* aLoadInfo,
+                                        nsIPrincipal* aPrincipal,
+                                        nsISerialEventTarget* aEventTarget) {
+    // Create the new ClientSource.  This should only happen for window
+    // Clients since support cross-origin redirects are blocked by the
+    // same-origin security policy.
+    UniquePtr<ClientSource> reservedClient = ClientManager::CreateSource(
+        ClientType::Window, aEventTarget, aPrincipal);
+    MOZ_DIAGNOSTIC_ASSERT(reservedClient);
+
+    aLoadInfo->GiveReservedClientSource(std::move(reservedClient));
+  }
+};
+
+NS_IMPL_ISUPPORTS(ClientChannelHelper, nsIInterfaceRequestor,
+                  nsIChannelEventSink);
+
+class ClientChannelHelperParent final : public ClientChannelHelper {
+  ~ClientChannelHelperParent() {
+    // This requires that if a load completes, the associated ClientSource is
+    // created and registers itself before this ClientChannelHelperParent is
+    // destroyed. Otherwise, we may incorrectly "forget" a future ClientSource
+    // which will actually be created.
+    SetFutureSourceInfo(Nothing());
+  }
+
+  void CreateClient(nsILoadInfo* aLoadInfo, nsIPrincipal* aPrincipal) override {
+    CreateClientForPrincipal(aLoadInfo, aPrincipal, mEventTarget);
+  }
+
+  void SetFutureSourceInfo(Maybe<ClientInfo>&& aClientInfo) {
+    if (mRecentFutureSourceInfo) {
+      // No-op if the corresponding ClientSource has alrady been created, but
+      // it's not known if that's the case here.
+      ClientManager::ForgetFutureSource(*mRecentFutureSourceInfo);
+    }
+
+    if (aClientInfo) {
+      Unused << NS_WARN_IF(!ClientManager::ExpectFutureSource(*aClientInfo));
+    }
+
+    mRecentFutureSourceInfo = std::move(aClientInfo);
+  }
+
+  // Keep track of the most recent ClientInfo created which isn't backed by a
+  // ClientSource, which is used to notify ClientManagerService that the
+  // ClientSource won't ever actually be constructed.
+  Maybe<ClientInfo> mRecentFutureSourceInfo;
+
+ public:
+  void CreateClientForPrincipal(nsILoadInfo* aLoadInfo,
+                                nsIPrincipal* aPrincipal,
+                                nsISerialEventTarget* aEventTarget) override {
+    // If we're managing redirects in the parent, then we don't want
+    // to create a new ClientSource (since those need to live with
+    // the global), so just allocate a new ClientInfo/id and we can
+    // create a ClientSource when the final channel propagates back
+    // to the child.
+    Maybe<ClientInfo> reservedInfo =
+        ClientManager::CreateInfo(ClientType::Window, aPrincipal);
+    if (reservedInfo) {
+      aLoadInfo->SetReservedClientInfo(*reservedInfo);
+      SetFutureSourceInfo(std::move(reservedInfo));
+    }
+  }
+  ClientChannelHelperParent(nsIInterfaceRequestor* aOuter,
+                            nsISerialEventTarget* aEventTarget)
+      : ClientChannelHelper(aOuter, nullptr) {}
+};
+
+class ClientChannelHelperChild final : public ClientChannelHelper {
+  ~ClientChannelHelperChild() = default;
+
+  NS_IMETHOD
+  AsyncOnChannelRedirect(nsIChannel* aOldChannel, nsIChannel* aNewChannel,
+                         uint32_t aFlags,
+                         nsIAsyncVerifyRedirectCallback* aCallback) override {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    // All ClientInfo allocation should have been handled in the parent process
+    // by ClientChannelHelperParent, so the only remaining thing to do is to
+    // allocate a ClientSource around the ClientInfo on the channel.
+    CreateReservedSourceIfNeeded(aNewChannel, mEventTarget);
+
+    nsCOMPtr<nsIChannelEventSink> outerSink = do_GetInterface(mOuter);
+    if (outerSink) {
+      return outerSink->AsyncOnChannelRedirect(aOldChannel, aNewChannel, aFlags,
+                                               aCallback);
+    }
+
+    aCallback->OnRedirectVerifyCallback(NS_OK);
+    return NS_OK;
+  }
+
+ public:
+  ClientChannelHelperChild(nsIInterfaceRequestor* aOuter,
+                           nsISerialEventTarget* aEventTarget)
+      : ClientChannelHelper(aOuter, aEventTarget) {}
+};
+
+}  // anonymous namespace
+
+template <typename T>
+nsresult AddClientChannelHelperInternal(nsIChannel* aChannel,
+                                        Maybe<ClientInfo>&& aReservedClientInfo,
+                                        Maybe<ClientInfo>&& aInitialClientInfo,
+                                        nsISerialEventTarget* aEventTarget) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  Maybe<ClientInfo> initialClientInfo(std::move(aInitialClientInfo));
+  Maybe<ClientInfo> reservedClientInfo(std::move(aReservedClientInfo));
+  MOZ_DIAGNOSTIC_ASSERT(reservedClientInfo.isNothing() ||
+                        initialClientInfo.isNothing());
+
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo();
+
+  nsCOMPtr<nsIPrincipal> channelForeignPartitionedPrincipal;
+  nsresult rv = StoragePrincipalHelper::GetPrincipal(
+      aChannel,
+      StaticPrefs::privacy_partition_serviceWorkers()
+          ? StoragePrincipalHelper::eForeignPartitionedPrincipal
+          : StoragePrincipalHelper::eRegularPrincipal,
+      getter_AddRefs(channelForeignPartitionedPrincipal));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Only allow the initial ClientInfo to be set if the current channel
+  // principal matches.
+  if (initialClientInfo.isSome()) {
+    auto initialPrincipalOrErr =
+        PrincipalInfoToPrincipal(initialClientInfo.ref().PrincipalInfo());
+
+    bool equals = false;
+    rv = initialPrincipalOrErr.isErr()
+             ? initialPrincipalOrErr.unwrapErr()
+             : initialPrincipalOrErr.unwrap()->Equals(
+                   channelForeignPartitionedPrincipal, &equals);
+    if (NS_FAILED(rv) || !equals) {
+      initialClientInfo.reset();
+    }
+  }
+
+  // Only allow the reserved ClientInfo to be set if the current channel
+  // principal matches.
+  if (reservedClientInfo.isSome()) {
+    auto reservedPrincipalOrErr =
+        PrincipalInfoToPrincipal(reservedClientInfo.ref().PrincipalInfo());
+
+    bool equals = false;
+    rv = reservedPrincipalOrErr.isErr()
+             ? reservedPrincipalOrErr.unwrapErr()
+             : reservedPrincipalOrErr.unwrap()->Equals(
+                   channelForeignPartitionedPrincipal, &equals);
+    if (NS_FAILED(rv) || !equals) {
+      reservedClientInfo.reset();
+    }
+  }
+
+  nsCOMPtr<nsIInterfaceRequestor> outerCallbacks;
+  rv = aChannel->GetNotificationCallbacks(getter_AddRefs(outerCallbacks));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  RefPtr<ClientChannelHelper> helper = new T(outerCallbacks, aEventTarget);
+
+  if (initialClientInfo.isNothing() && reservedClientInfo.isNothing()) {
+    helper->CreateClientForPrincipal(
+        loadInfo, channelForeignPartitionedPrincipal, aEventTarget);
+  }
+
+  // Only set the callbacks helper if we are able to reserve the client
+  // successfully.
+  rv = aChannel->SetNotificationCallbacks(helper);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (initialClientInfo.isSome()) {
+    loadInfo->SetInitialClientInfo(initialClientInfo.ref());
+  }
+
+  if (reservedClientInfo.isSome()) {
+    loadInfo->SetReservedClientInfo(reservedClientInfo.ref());
+  }
+
+  return NS_OK;
+}
+
+nsresult AddClientChannelHelper(nsIChannel* aChannel,
+                                Maybe<ClientInfo>&& aReservedClientInfo,
+                                Maybe<ClientInfo>&& aInitialClientInfo,
+                                nsISerialEventTarget* aEventTarget) {
+  return AddClientChannelHelperInternal<ClientChannelHelper>(
+      aChannel, std::move(aReservedClientInfo), std::move(aInitialClientInfo),
+      aEventTarget);
+}
+
+nsresult AddClientChannelHelperInParent(
+    nsIChannel* aChannel, Maybe<ClientInfo>&& aInitialClientInfo) {
+  Maybe<ClientInfo> emptyReservedInfo;
+  return AddClientChannelHelperInternal<ClientChannelHelperParent>(
+      aChannel, std::move(emptyReservedInfo), std::move(aInitialClientInfo),
+      nullptr);
+}
+
+nsresult AddClientChannelHelperInChild(nsIChannel* aChannel,
+                                       nsISerialEventTarget* aEventTarget) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsCOMPtr<nsIInterfaceRequestor> outerCallbacks;
+  nsresult rv =
+      aChannel->GetNotificationCallbacks(getter_AddRefs(outerCallbacks));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  RefPtr<ClientChannelHelper> helper =
+      new ClientChannelHelperChild(outerCallbacks, aEventTarget);
+
+  // Only set the callbacks helper if we are able to reserve the client
+  // successfully.
+  rv = aChannel->SetNotificationCallbacks(helper);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+void CreateReservedSourceIfNeeded(nsIChannel* aChannel,
+                                  nsISerialEventTarget* aEventTarget) {
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo();
+  const Maybe<ClientInfo>& reservedClientInfo =
+      loadInfo->GetReservedClientInfo();
+
+  if (reservedClientInfo) {
+    UniquePtr<ClientSource> reservedClient =
+        ClientManager::CreateSourceFromInfo(*reservedClientInfo, aEventTarget);
+    loadInfo->GiveReservedClientSource(std::move(reservedClient));
+  }
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientChannelHelper.h b/dom/clients/manager/ClientChannelHelper.h
new file mode 100644
index 0000000000..e02285cd1c
--- /dev/null
+++ b/dom/clients/manager/ClientChannelHelper.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientChannelHelper_h
+#define _mozilla_dom_ClientChannelHelper_h
+
+#include "mozilla/Maybe.h"
+#include "nsError.h"
+
+class nsIChannel;
+class nsISerialEventTarget;
+
+namespace mozilla::dom {
+
+class ClientInfo;
+
+// Attach a redirect listener to the given nsIChannel that will manage
+// the various client values on the channel's LoadInfo.  This will
+// properly handle creating a new ClientSource on cross-origin redirect
+// and propagate the current reserved/initial client on same-origin
+// redirect.
+nsresult AddClientChannelHelper(nsIChannel* aChannel,
+                                Maybe<ClientInfo>&& aReservedClientInfo,
+                                Maybe<ClientInfo>&& aInitialClientInfo,
+                                nsISerialEventTarget* aEventTarget);
+
+// Use this variant in the content process if redirects will be handled in the
+// parent process (by a channel with AddClientChannelHelperInParent),
+// and this process only sees a single switch to the final channel,
+// as done by DocumentChannel.
+// This variant just handles allocating a ClientSource around an existing
+// ClientInfo allocated in the parent process.
+nsresult AddClientChannelHelperInChild(nsIChannel* aChannel,
+                                       nsISerialEventTarget* aEventTarget);
+
+// Use this variant in the parent process if redirects are handled there.
+// Does the same as the default variant, except just allocates a ClientInfo
+// and lets the content process create the corresponding ClientSource once
+// it becomes available there.
+nsresult AddClientChannelHelperInParent(nsIChannel* aChannel,
+                                        Maybe<ClientInfo>&& aInitialClientInfo);
+
+// If the channel's LoadInfo has a reserved ClientInfo, but no reserved
+// ClientSource, then allocates a ClientSource using that existing
+// ClientInfo.
+void CreateReservedSourceIfNeeded(nsIChannel* aChannel,
+                                  nsISerialEventTarget* aEventTarget);
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientChannelHelper_h
diff --git a/dom/clients/manager/ClientHandle.cpp b/dom/clients/manager/ClientHandle.cpp
new file mode 100644
index 0000000000..eebffae4c7
--- /dev/null
+++ b/dom/clients/manager/ClientHandle.cpp
@@ -0,0 +1,195 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientHandle.h"
+
+#include "ClientHandleChild.h"
+#include "ClientHandleOpChild.h"
+#include "ClientManager.h"
+#include "ClientPrincipalUtils.h"
+#include "ClientState.h"
+#include "mozilla/dom/PClientManagerChild.h"
+#include "mozilla/dom/ServiceWorkerDescriptor.h"
+#include "mozilla/dom/ipc/StructuredCloneData.h"
+
+namespace mozilla::dom {
+
+using mozilla::dom::ipc::StructuredCloneData;
+
+ClientHandle::~ClientHandle() { Shutdown(); }
+
+void ClientHandle::Shutdown() {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (IsShutdown()) {
+    return;
+  }
+
+  ShutdownThing();
+
+  mManager = nullptr;
+}
+
+void ClientHandle::StartOp(const ClientOpConstructorArgs& aArgs,
+                           const ClientOpCallback&& aResolveCallback,
+                           const ClientOpCallback&& aRejectCallback) {
+  // Hold a ref to the client until the remote operation completes.  Otherwise
+  // the ClientHandle might get de-refed and teardown the actor before we
+  // get an answer.
+  RefPtr<ClientHandle> kungFuGrip = this;
+
+  MaybeExecute(
+      [&aArgs, kungFuGrip, aRejectCallback,
+       resolve = std::move(aResolveCallback)](ClientHandleChild* aActor) {
+        MOZ_DIAGNOSTIC_ASSERT(aActor);
+        ClientHandleOpChild* actor = new ClientHandleOpChild(
+            kungFuGrip, aArgs, std::move(resolve), std::move(aRejectCallback));
+        if (!aActor->SendPClientHandleOpConstructor(actor, aArgs)) {
+          // Constructor failure will call reject callback via ActorDestroy()
+          return;
+        }
+      },
+      [aRejectCallback] {
+        MOZ_DIAGNOSTIC_ASSERT(aRejectCallback);
+        CopyableErrorResult rv;
+        rv.ThrowInvalidStateError("Client has been destroyed");
+        aRejectCallback(rv);
+      });
+}
+
+void ClientHandle::OnShutdownThing() {
+  NS_ASSERT_OWNINGTHREAD(ClientHandle);
+  if (!mDetachPromise) {
+    return;
+  }
+  mDetachPromise->Resolve(true, __func__);
+}
+
+ClientHandle::ClientHandle(ClientManager* aManager,
+                           nsISerialEventTarget* aSerialEventTarget,
+                           const ClientInfo& aClientInfo)
+    : mManager(aManager),
+      mSerialEventTarget(aSerialEventTarget),
+      mClientInfo(aClientInfo) {
+  MOZ_DIAGNOSTIC_ASSERT(mManager);
+  MOZ_DIAGNOSTIC_ASSERT(mSerialEventTarget);
+  MOZ_ASSERT(mSerialEventTarget->IsOnCurrentThread());
+}
+
+void ClientHandle::Activate(PClientManagerChild* aActor) {
+  NS_ASSERT_OWNINGTHREAD(ClientHandle);
+
+  if (IsShutdown()) {
+    return;
+  }
+
+  PClientHandleChild* actor =
+      aActor->SendPClientHandleConstructor(mClientInfo.ToIPC());
+  if (!actor) {
+    Shutdown();
+    return;
+  }
+
+  ActivateThing(static_cast<ClientHandleChild*>(actor));
+}
+
+void ClientHandle::ExecutionReady(const ClientInfo& aClientInfo) {
+  mClientInfo = aClientInfo;
+}
+
+const ClientInfo& ClientHandle::Info() const { return mClientInfo; }
+
+RefPtr<GenericErrorResultPromise> ClientHandle::Control(
+    const ServiceWorkerDescriptor& aServiceWorker) {
+  RefPtr<GenericErrorResultPromise::Private> outerPromise =
+      new GenericErrorResultPromise::Private(__func__);
+
+  // We should never have a cross-origin controller.  Since this would be
+  // same-origin policy violation we do a full release assertion here.
+  MOZ_RELEASE_ASSERT(ClientMatchPrincipalInfo(mClientInfo.PrincipalInfo(),
+                                              aServiceWorker.PrincipalInfo()));
+
+  StartOp(
+      ClientControlledArgs(aServiceWorker.ToIPC()),
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Resolve(true, __func__);
+      },
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+      });
+
+  return outerPromise;
+}
+
+RefPtr<ClientStatePromise> ClientHandle::Focus(CallerType aCallerType) {
+  RefPtr<ClientStatePromise::Private> outerPromise =
+      new ClientStatePromise::Private(__func__);
+
+  StartOp(
+      ClientFocusArgs(aCallerType),
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Resolve(
+            ClientState::FromIPC(aResult.get_IPCClientState()), __func__);
+      },
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+      });
+
+  return outerPromise;
+}
+
+RefPtr<GenericErrorResultPromise> ClientHandle::PostMessage(
+    StructuredCloneData& aData, const ServiceWorkerDescriptor& aSource) {
+  if (IsShutdown()) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Client has been destroyed");
+    return GenericErrorResultPromise::CreateAndReject(rv, __func__);
+  }
+
+  ClientPostMessageArgs args;
+  args.serviceWorker() = aSource.ToIPC();
+
+  if (!aData.BuildClonedMessageData(args.clonedData())) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Failed to clone data");
+    return GenericErrorResultPromise::CreateAndReject(rv, __func__);
+  }
+
+  RefPtr<GenericErrorResultPromise::Private> outerPromise =
+      new GenericErrorResultPromise::Private(__func__);
+
+  StartOp(
+      std::move(args),
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Resolve(true, __func__);
+      },
+      [outerPromise](const ClientOpResult& aResult) {
+        outerPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+      });
+
+  return outerPromise;
+}
+
+RefPtr<GenericPromise> ClientHandle::OnDetach() {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  if (!mDetachPromise) {
+    mDetachPromise = new GenericPromise::Private(__func__);
+    if (IsShutdown()) {
+      mDetachPromise->Resolve(true, __func__);
+    }
+  }
+
+  return mDetachPromise;
+}
+
+void ClientHandle::EvictFromBFCache() {
+  ClientEvictBFCacheArgs args;
+  StartOp(
+      std::move(args), [](const ClientOpResult& aResult) {},
+      [](const ClientOpResult& aResult) {});
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientHandle.h b/dom/clients/manager/ClientHandle.h
new file mode 100644
index 0000000000..33fa2bd1a5
--- /dev/null
+++ b/dom/clients/manager/ClientHandle.h
@@ -0,0 +1,112 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientHandle_h
+#define _mozilla_dom_ClientHandle_h
+
+#include "mozilla/dom/ClientInfo.h"
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/ClientThing.h"
+#include "mozilla/MozPromise.h"
+
+#ifdef XP_WIN
+#  undef PostMessage
+#endif
+
+namespace mozilla::dom {
+
+class ClientManager;
+class ClientHandleChild;
+class ClientOpConstructorArgs;
+class PClientManagerChild;
+class ServiceWorkerDescriptor;
+enum class CallerType : uint32_t;
+
+namespace ipc {
+class StructuredCloneData;
+}
+
+// The ClientHandle allows code to take a simple ClientInfo struct and
+// convert it into a live actor-backed object attached to a particular
+// ClientSource somewhere in the browser.  If the ClientSource is
+// destroyed then the ClientHandle will simply begin to reject operations.
+// We do not currently provide a way to be notified when the ClientSource
+// is destroyed, but this could be added in the future.
+class ClientHandle final : public ClientThing<ClientHandleChild> {
+  friend class ClientManager;
+  friend class ClientHandleChild;
+
+  RefPtr<ClientManager> mManager;
+  nsCOMPtr<nsISerialEventTarget> mSerialEventTarget;
+  RefPtr<GenericPromise::Private> mDetachPromise;
+  ClientInfo mClientInfo;
+
+  ~ClientHandle();
+
+  void Shutdown();
+
+  void StartOp(const ClientOpConstructorArgs& aArgs,
+               const ClientOpCallback&& aResolveCallback,
+               const ClientOpCallback&& aRejectCallback);
+
+  // ClientThing interface
+  void OnShutdownThing() override;
+
+  // Private methods called by ClientHandleChild
+  void ExecutionReady(const ClientInfo& aClientInfo);
+
+  // Private methods called by ClientManager
+  ClientHandle(ClientManager* aManager,
+               nsISerialEventTarget* aSerialEventTarget,
+               const ClientInfo& aClientInfo);
+
+  void Activate(PClientManagerChild* aActor);
+
+ public:
+  const ClientInfo& Info() const;
+
+  // Mark the ClientSource attached to this handle as controlled by the
+  // given service worker.  The promise will resolve true if the ClientSource
+  // is successfully marked or reject if the operation could not be completed.
+  RefPtr<GenericErrorResultPromise> Control(
+      const ServiceWorkerDescriptor& aServiceWorker);
+
+  // Focus the Client if possible.  If successful the promise will resolve with
+  // a new ClientState snapshot after focus has completed.  If focusing fails
+  // for any reason then the promise will reject.
+  RefPtr<ClientStatePromise> Focus(CallerType aCallerType);
+
+  // Send a postMessage() call to the target Client.  Currently this only
+  // supports sending from a ServiceWorker source and the MessageEvent is
+  // dispatched to the Client's navigator.serviceWorker event target.  The
+  // returned promise will resolve if the MessageEvent is dispatched or if
+  // it triggers an error handled in the Client's context.  Other errors
+  // will result in the promise rejecting.
+  RefPtr<GenericErrorResultPromise> PostMessage(
+      ipc::StructuredCloneData& aData, const ServiceWorkerDescriptor& aSource);
+
+  // Return a Promise that resolves when the ClientHandle object is detached
+  // from its remote actors.  This will happen if the ClientSource is destroyed
+  // and triggers the cleanup of the handle actors.  It will also naturally
+  // happen when the ClientHandle is de-referenced and tears down its own
+  // actors.
+  //
+  // Note: This method can only be called on the ClientHandle owning thread,
+  //       but the MozPromise lets you Then() to another thread.
+  RefPtr<GenericPromise> OnDetach();
+
+  // This is intended to allow the ServiceWorkerManager to evict controlled
+  // clients when their controlling registration changes. This should not be
+  // used by other holders of ClientHandles. This method can probably be removed
+  // when ServiceWorkerManager and ClientManagerService both live on the same
+  // thread.
+  void EvictFromBFCache();
+
+  NS_INLINE_DECL_REFCOUNTING(ClientHandle);
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientHandle_h
diff --git a/dom/clients/manager/ClientHandleChild.cpp b/dom/clients/manager/ClientHandleChild.cpp
new file mode 100644
index 0000000000..a0717a9954
--- /dev/null
+++ b/dom/clients/manager/ClientHandleChild.cpp
@@ -0,0 +1,70 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientHandleChild.h"
+
+#include "ClientHandle.h"
+#include "ClientHandleOpChild.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+IPCResult ClientHandleChild::RecvExecutionReady(
+    const IPCClientInfo& aClientInfo) {
+  if (mHandle) {
+    mHandle->ExecutionReady(ClientInfo(aClientInfo));
+  }
+  return IPC_OK();
+}
+
+void ClientHandleChild::ActorDestroy(ActorDestroyReason aReason) {
+  if (mHandle) {
+    mHandle->RevokeActor(this);
+
+    // Revoking the actor link should automatically cause the owner
+    // to call RevokeOwner() as well.
+    MOZ_DIAGNOSTIC_ASSERT(!mHandle);
+  }
+}
+
+PClientHandleOpChild* ClientHandleChild::AllocPClientHandleOpChild(
+    const ClientOpConstructorArgs& aArgs) {
+  MOZ_ASSERT_UNREACHABLE("ClientHandleOpChild must be explicitly constructed.");
+  return nullptr;
+}
+
+bool ClientHandleChild::DeallocPClientHandleOpChild(
+    PClientHandleOpChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+ClientHandleChild::ClientHandleChild()
+    : mHandle(nullptr), mTeardownStarted(false) {}
+
+void ClientHandleChild::SetOwner(ClientThing<ClientHandleChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(!mHandle);
+  mHandle = static_cast<ClientHandle*>(aThing);
+  MOZ_DIAGNOSTIC_ASSERT(mHandle);
+}
+
+void ClientHandleChild::RevokeOwner(ClientThing<ClientHandleChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(mHandle);
+  MOZ_DIAGNOSTIC_ASSERT(mHandle == static_cast<ClientHandle*>(aThing));
+  mHandle = nullptr;
+}
+
+void ClientHandleChild::MaybeStartTeardown() {
+  if (mTeardownStarted) {
+    return;
+  }
+  mTeardownStarted = true;
+  Unused << SendTeardown();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientHandleChild.h b/dom/clients/manager/ClientHandleChild.h
new file mode 100644
index 0000000000..8aeba96712
--- /dev/null
+++ b/dom/clients/manager/ClientHandleChild.h
@@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientHandleChild_h
+#define _mozilla_dom_ClientHandleChild_h
+
+#include "ClientThing.h"
+#include "mozilla/dom/PClientHandleChild.h"
+
+namespace mozilla::dom {
+
+class ClientHandle;
+class ClientInfo;
+
+template <typename ActorType>
+class ClientThing;
+
+class ClientHandleChild final : public PClientHandleChild {
+  ClientHandle* mHandle;
+  bool mTeardownStarted;
+
+  // PClientHandleChild interface
+  mozilla::ipc::IPCResult RecvExecutionReady(
+      const IPCClientInfo& aClientInfo) override;
+
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientHandleOpChild* AllocPClientHandleOpChild(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientHandleOpChild(PClientHandleOpChild* aActor) override;
+
+ public:
+  ClientHandleChild();
+
+  void SetOwner(ClientThing<ClientHandleChild>* aThing);
+
+  void RevokeOwner(ClientThing<ClientHandleChild>* aThing);
+
+  void MaybeStartTeardown();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientHandleChild_h
diff --git a/dom/clients/manager/ClientHandleOpChild.cpp b/dom/clients/manager/ClientHandleOpChild.cpp
new file mode 100644
index 0000000000..0370d5512b
--- /dev/null
+++ b/dom/clients/manager/ClientHandleOpChild.cpp
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientHandleOpChild.h"
+
+#include "ClientHandle.h"
+
+namespace mozilla::dom {
+
+void ClientHandleOpChild::ActorDestroy(ActorDestroyReason aReason) {
+  mClientHandle = nullptr;
+  CopyableErrorResult rv;
+  rv.ThrowAbortError("Client load aborted");
+  mRejectCallback(rv);
+}
+
+mozilla::ipc::IPCResult ClientHandleOpChild::Recv__delete__(
+    const ClientOpResult& aResult) {
+  mClientHandle = nullptr;
+  if (aResult.type() == ClientOpResult::TCopyableErrorResult &&
+      aResult.get_CopyableErrorResult().Failed()) {
+    mRejectCallback(aResult.get_CopyableErrorResult());
+    return IPC_OK();
+  }
+  mResolveCallback(aResult);
+  return IPC_OK();
+}
+
+ClientHandleOpChild::ClientHandleOpChild(
+    ClientHandle* aClientHandle, const ClientOpConstructorArgs& aArgs,
+    const ClientOpCallback&& aResolveCallback,
+    const ClientOpCallback&& aRejectCallback)
+    : mClientHandle(aClientHandle),
+      mResolveCallback(std::move(aResolveCallback)),
+      mRejectCallback(std::move(aRejectCallback)) {
+  MOZ_DIAGNOSTIC_ASSERT(mClientHandle);
+  MOZ_DIAGNOSTIC_ASSERT(mResolveCallback);
+  MOZ_DIAGNOSTIC_ASSERT(mRejectCallback);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientHandleOpChild.h b/dom/clients/manager/ClientHandleOpChild.h
new file mode 100644
index 0000000000..220636ca57
--- /dev/null
+++ b/dom/clients/manager/ClientHandleOpChild.h
@@ -0,0 +1,38 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientHandleOpChild_h
+#define _mozilla_dom_ClientHandleOpChild_h
+
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/PClientHandleOpChild.h"
+
+namespace mozilla::dom {
+
+class ClientHandle;
+
+class ClientHandleOpChild final : public PClientHandleOpChild {
+  RefPtr<ClientHandle> mClientHandle;
+  const ClientOpCallback mResolveCallback;
+  const ClientOpCallback mRejectCallback;
+
+  // PClientHandleOpChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  mozilla::ipc::IPCResult Recv__delete__(
+      const ClientOpResult& aResult) override;
+
+ public:
+  ClientHandleOpChild(ClientHandle* aClientHandle,
+                      const ClientOpConstructorArgs& aArgs,
+                      const ClientOpCallback&& aResolveCallback,
+                      const ClientOpCallback&& aRejectCallback);
+
+  ~ClientHandleOpChild() = default;
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientHandleOpChild_h
diff --git a/dom/clients/manager/ClientHandleOpParent.cpp b/dom/clients/manager/ClientHandleOpParent.cpp
new file mode 100644
index 0000000000..37f1c6258b
--- /dev/null
+++ b/dom/clients/manager/ClientHandleOpParent.cpp
@@ -0,0 +1,96 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientHandleOpParent.h"
+
+#include "ClientHandleParent.h"
+#include "ClientSourceParent.h"
+#include "mozilla/dom/ipc/StructuredCloneData.h"
+#include "mozilla/dom/PClientManagerParent.h"
+
+namespace mozilla::dom {
+
+ClientSourceParent* ClientHandleOpParent::GetSource() const {
+  auto handle = static_cast<ClientHandleParent*>(Manager());
+  return handle->GetSource();
+}
+
+void ClientHandleOpParent::ActorDestroy(ActorDestroyReason aReason) {
+  mPromiseRequestHolder.DisconnectIfExists();
+  mSourcePromiseRequestHolder.DisconnectIfExists();
+}
+
+void ClientHandleOpParent::Init(ClientOpConstructorArgs&& aArgs) {
+  auto handle = static_cast<ClientHandleParent*>(Manager());
+  handle->EnsureSource()
+      ->Then(
+          GetCurrentSerialEventTarget(), __func__,
+          [this, handle, args = std::move(aArgs)](bool) mutable {
+            mSourcePromiseRequestHolder.Complete();
+
+            auto source = handle->GetSource();
+            if (!source) {
+              CopyableErrorResult rv;
+              rv.ThrowAbortError("Client has been destroyed");
+              Unused << PClientHandleOpParent::Send__delete__(this, rv);
+              return;
+            }
+            RefPtr<ClientOpPromise> p;
+
+            // ClientPostMessageArgs can contain PBlob actors.  This means we
+            // can't just forward the args from one PBackground manager to
+            // another.  Instead, unpack the structured clone data and repack
+            // it into a new set of arguments.
+            if (args.type() ==
+                ClientOpConstructorArgs::TClientPostMessageArgs) {
+              const ClientPostMessageArgs& orig =
+                  args.get_ClientPostMessageArgs();
+
+              ClientPostMessageArgs rebuild;
+              rebuild.serviceWorker() = orig.serviceWorker();
+
+              ipc::StructuredCloneData data;
+              data.BorrowFromClonedMessageData(orig.clonedData());
+              if (!data.BuildClonedMessageData(rebuild.clonedData())) {
+                CopyableErrorResult rv;
+                rv.ThrowAbortError("Aborting client operation");
+                Unused << PClientHandleOpParent::Send__delete__(this, rv);
+                return;
+              }
+
+              p = source->StartOp(std::move(rebuild));
+            }
+
+            // Other argument types can just be forwarded straight through.
+            else {
+              p = source->StartOp(std::move(args));
+            }
+
+            // Capturing 'this' is safe here because we disconnect the promise
+            // in ActorDestroy() which ensures neither lambda is called if the
+            // actor is destroyed before the source operation completes.
+            p->Then(
+                 GetCurrentSerialEventTarget(), __func__,
+                 [this](const ClientOpResult& aResult) {
+                   mPromiseRequestHolder.Complete();
+                   Unused << PClientHandleOpParent::Send__delete__(this,
+                                                                   aResult);
+                 },
+                 [this](const CopyableErrorResult& aRv) {
+                   mPromiseRequestHolder.Complete();
+                   Unused << PClientHandleOpParent::Send__delete__(this, aRv);
+                 })
+                ->Track(mPromiseRequestHolder);
+          },
+          [=](const CopyableErrorResult& failure) {
+            mSourcePromiseRequestHolder.Complete();
+            Unused << PClientHandleOpParent::Send__delete__(this, failure);
+            return;
+          })
+      ->Track(mSourcePromiseRequestHolder);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientHandleOpParent.h b/dom/clients/manager/ClientHandleOpParent.h
new file mode 100644
index 0000000000..f8e7cfb89f
--- /dev/null
+++ b/dom/clients/manager/ClientHandleOpParent.h
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientHandleOpParent_h
+#define _mozilla_dom_ClientHandleOpParent_h
+
+#include "ClientOpPromise.h"
+#include "mozilla/dom/PClientHandleOpParent.h"
+#include "ClientHandleParent.h"
+
+namespace mozilla::dom {
+
+class ClientSourceParent;
+
+class ClientHandleOpParent final : public PClientHandleOpParent {
+  MozPromiseRequestHolder<ClientOpPromise> mPromiseRequestHolder;
+  MozPromiseRequestHolder<SourcePromise> mSourcePromiseRequestHolder;
+
+  ClientSourceParent* GetSource() const;
+
+  // PClientHandleOpParent interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+ public:
+  ClientHandleOpParent() = default;
+  ~ClientHandleOpParent() = default;
+
+  void Init(ClientOpConstructorArgs&& aArgs);
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientHandleOpParent_h
diff --git a/dom/clients/manager/ClientHandleParent.cpp b/dom/clients/manager/ClientHandleParent.cpp
new file mode 100644
index 0000000000..037a496544
--- /dev/null
+++ b/dom/clients/manager/ClientHandleParent.cpp
@@ -0,0 +1,115 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientHandleParent.h"
+
+#include "ClientHandleOpParent.h"
+#include "ClientManagerService.h"
+#include "ClientPrincipalUtils.h"
+#include "ClientSourceParent.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+IPCResult ClientHandleParent::RecvTeardown() {
+  Unused << Send__delete__(this);
+  return IPC_OK();
+}
+
+void ClientHandleParent::ActorDestroy(ActorDestroyReason aReason) {
+  if (mSource) {
+    mSource->DetachHandle(this);
+    mSource = nullptr;
+  } else {
+    if (!mSourcePromiseHolder.IsEmpty()) {
+      CopyableErrorResult rv;
+      rv.ThrowAbortError("Client aborted");
+      mSourcePromiseHolder.Reject(rv, __func__);
+    }
+
+    mSourcePromiseRequestHolder.DisconnectIfExists();
+  }
+}
+
+PClientHandleOpParent* ClientHandleParent::AllocPClientHandleOpParent(
+    const ClientOpConstructorArgs& aArgs) {
+  return new ClientHandleOpParent();
+}
+
+bool ClientHandleParent::DeallocPClientHandleOpParent(
+    PClientHandleOpParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+IPCResult ClientHandleParent::RecvPClientHandleOpConstructor(
+    PClientHandleOpParent* aActor, const ClientOpConstructorArgs& aArgs) {
+  auto actor = static_cast<ClientHandleOpParent*>(aActor);
+  actor->Init(std::move(const_cast<ClientOpConstructorArgs&>(aArgs)));
+  return IPC_OK();
+}
+
+ClientHandleParent::ClientHandleParent()
+    : mService(ClientManagerService::GetOrCreateInstance()), mSource(nullptr) {}
+
+ClientHandleParent::~ClientHandleParent() { MOZ_DIAGNOSTIC_ASSERT(!mSource); }
+
+void ClientHandleParent::Init(const IPCClientInfo& aClientInfo) {
+  mClientId = aClientInfo.id();
+  mPrincipalInfo = aClientInfo.principalInfo();
+
+  // Callbacks are disconnected in ActorDestroy, so capturing `this` is safe.
+  mService->FindSource(aClientInfo.id(), aClientInfo.principalInfo())
+      ->Then(
+          GetCurrentSerialEventTarget(), __func__,
+          [this](bool) {
+            mSourcePromiseRequestHolder.Complete();
+            ClientSourceParent* source =
+                mService->FindExistingSource(mClientId, mPrincipalInfo);
+            if (source) {
+              FoundSource(source);
+            }
+          },
+          [this](const CopyableErrorResult&) {
+            mSourcePromiseRequestHolder.Complete();
+            Unused << Send__delete__(this);
+          })
+      ->Track(mSourcePromiseRequestHolder);
+}
+
+ClientSourceParent* ClientHandleParent::GetSource() const { return mSource; }
+
+RefPtr<SourcePromise> ClientHandleParent::EnsureSource() {
+  if (mSource) {
+    return SourcePromise::CreateAndResolve(mSource, __func__);
+  }
+
+  return mSourcePromiseHolder.Ensure(__func__);
+}
+
+void ClientHandleParent::FoundSource(ClientSourceParent* aSource) {
+  MOZ_ASSERT(aSource);
+  MOZ_ASSERT(aSource->Info().Id() == mClientId);
+  if (!ClientMatchPrincipalInfo(aSource->Info().PrincipalInfo(),
+                                mPrincipalInfo)) {
+    if (mSourcePromiseHolder.IsEmpty()) {
+      CopyableErrorResult rv;
+      rv.ThrowAbortError("Client aborted");
+      mSourcePromiseHolder.Reject(rv, __func__);
+    }
+    Unused << Send__delete__(this);
+    return;
+  }
+
+  mSource = aSource;
+  mSource->AttachHandle(this);
+  mSourcePromiseHolder.ResolveIfExists(true, __func__);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientHandleParent.h b/dom/clients/manager/ClientHandleParent.h
new file mode 100644
index 0000000000..9272972f11
--- /dev/null
+++ b/dom/clients/manager/ClientHandleParent.h
@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientHandleParent_h
+#define _mozilla_dom_ClientHandleParent_h
+
+#include "mozilla/dom/PClientHandleParent.h"
+
+namespace mozilla::dom {
+
+class ClientManagerService;
+class ClientSourceParent;
+
+using SourcePromise =
+    MozPromise<bool, CopyableErrorResult, /* IsExclusive = */ false>;
+
+class ClientHandleParent final : public PClientHandleParent {
+  RefPtr<ClientManagerService> mService;
+
+  // mSource and mSourcePromiseHolder are mutually exclusive.
+  ClientSourceParent* mSource;
+
+  // Operations will wait on this promise while mSource is null.
+  MozPromiseHolder<SourcePromise> mSourcePromiseHolder;
+
+  MozPromiseRequestHolder<SourcePromise> mSourcePromiseRequestHolder;
+
+  nsID mClientId;
+  mozilla::ipc::PrincipalInfo mPrincipalInfo;
+
+  // PClientHandleParent interface
+  mozilla::ipc::IPCResult RecvTeardown() override;
+
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientHandleOpParent* AllocPClientHandleOpParent(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientHandleOpParent(PClientHandleOpParent* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientHandleOpConstructor(
+      PClientHandleOpParent* aActor,
+      const ClientOpConstructorArgs& aArgs) override;
+
+ public:
+  ClientHandleParent();
+  ~ClientHandleParent();
+
+  void Init(const IPCClientInfo& aClientInfo);
+
+  void FoundSource(ClientSourceParent* aSource);
+
+  // Should be called only once EnsureSource() has resolved. May return nullptr.
+  ClientSourceParent* GetSource() const;
+
+  RefPtr<SourcePromise> EnsureSource();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientHandleParent_h
diff --git a/dom/clients/manager/ClientIPCTypes.ipdlh b/dom/clients/manager/ClientIPCTypes.ipdlh
new file mode 100644
index 0000000000..46097c1342
--- /dev/null
+++ b/dom/clients/manager/ClientIPCTypes.ipdlh
@@ -0,0 +1,165 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientSource;
+include DOMTypes;
+include PBackgroundSharedTypes;
+include IPCServiceWorkerDescriptor;
+include ProtocolTypes;
+
+include "mozilla/dom/BindingIPCUtils.h";
+include "mozilla/dom/ClientIPCUtils.h";
+include "ipc/ErrorIPCUtils.h";
+
+using mozilla::TimeStamp from "mozilla/TimeStamp.h";
+using mozilla::dom::ClientType from "mozilla/dom/ClientsBinding.h";
+using mozilla::dom::FrameType from "mozilla/dom/ClientBinding.h";
+using mozilla::StorageAccess from "mozilla/StorageAccess.h";
+using mozilla::dom::VisibilityState from "mozilla/dom/DocumentBinding.h";
+using mozilla::dom::CallerType from "mozilla/dom/BindingDeclarations.h";
+using mozilla::CopyableErrorResult from "mozilla/ErrorResult.h";
+
+namespace mozilla {
+namespace dom {
+
+struct ClientSourceConstructorArgs
+{
+  nsID id;
+  ClientType type;
+  PrincipalInfo principalInfo;
+  TimeStamp creationTime;
+};
+
+[Comparable] struct IPCClientInfo
+{
+  nsID id;
+  nsID? agentClusterId;
+  ClientType type;
+  PrincipalInfo principalInfo;
+  TimeStamp creationTime;
+  nsCString url;
+  FrameType frameType;
+  CSPInfo? cspInfo;
+  CSPInfo? preloadCspInfo;
+};
+
+struct IPCClientWindowState
+{
+  VisibilityState visibilityState;
+  TimeStamp lastFocusTime;
+  StorageAccess storageAccess;
+  bool focused;
+};
+
+struct IPCClientWorkerState
+{
+  StorageAccess storageAccess;
+};
+
+union IPCClientState
+{
+  IPCClientWindowState;
+  IPCClientWorkerState;
+};
+
+struct ClientInfoAndState
+{
+  IPCClientInfo info;
+  IPCClientState state;
+};
+
+struct ClientSourceExecutionReadyArgs
+{
+  nsCString url;
+  FrameType frameType;
+};
+
+struct ClientControlledArgs
+{
+  IPCServiceWorkerDescriptor serviceWorker;
+};
+
+struct ClientFocusArgs
+{
+  CallerType callerType;
+};
+
+struct ClientNavigateArgs
+{
+  IPCClientInfo target;
+  nsCString url;
+  nsCString baseURL;
+  IPCServiceWorkerDescriptor serviceWorker;
+};
+
+struct ClientPostMessageArgs
+{
+  ClonedMessageData clonedData;
+  IPCServiceWorkerDescriptor serviceWorker;
+};
+
+struct ClientMatchAllArgs
+{
+  IPCServiceWorkerDescriptor serviceWorker;
+  ClientType type;
+  bool includeUncontrolled;
+};
+
+struct ClientClaimArgs
+{
+  IPCServiceWorkerDescriptor serviceWorker;
+};
+
+struct ClientGetInfoAndStateArgs
+{
+  nsID id;
+  PrincipalInfo principalInfo;
+};
+
+struct ClientOpenWindowArgs
+{
+  PrincipalInfo principalInfo;
+  CSPInfo? cspInfo;
+  nsCString url;
+  nsCString baseURL;
+};
+
+struct ClientEvictBFCacheArgs
+{};
+
+union ClientOpConstructorArgs
+{
+  ClientControlledArgs;
+  ClientFocusArgs;
+  ClientNavigateArgs;
+  ClientPostMessageArgs;
+  ClientMatchAllArgs;
+  ClientClaimArgs;
+  ClientGetInfoAndStateArgs;
+  ClientOpenWindowArgs;
+  ClientEvictBFCacheArgs;
+};
+
+struct ClientList
+{
+  ClientInfoAndState[] values;
+};
+
+struct ClientNavigateOpConstructorArgs
+{
+  PClientSource target;
+  nsCString url;
+  nsCString baseURL;
+};
+
+union ClientOpResult
+{
+  CopyableErrorResult;
+  IPCClientState;
+  ClientInfoAndState;
+  ClientList;
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/ClientIPCUtils.h b/dom/clients/manager/ClientIPCUtils.h
new file mode 100644
index 0000000000..7f8cf35c1b
--- /dev/null
+++ b/dom/clients/manager/ClientIPCUtils.h
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientIPCUtils_h
+#define _mozilla_dom_ClientIPCUtils_h
+
+#include "ipc/EnumSerializer.h"
+
+#include "X11UndefineNone.h"
+#include "mozilla/dom/ClientBinding.h"
+#include "mozilla/dom/ClientsBinding.h"
+#include "mozilla/dom/DocumentBinding.h"
+#include "mozilla/StorageAccess.h"
+
+namespace IPC {
+template <>
+struct ParamTraits<mozilla::dom::ClientType>
+    : public ContiguousEnumSerializer<mozilla::dom::ClientType,
+                                      mozilla::dom::ClientType::Window,
+                                      mozilla::dom::ClientType::EndGuard_> {};
+
+template <>
+struct ParamTraits<mozilla::dom::FrameType>
+    : public ContiguousEnumSerializer<mozilla::dom::FrameType,
+                                      mozilla::dom::FrameType::Auxiliary,
+                                      mozilla::dom::FrameType::EndGuard_> {};
+
+template <>
+struct ParamTraits<mozilla::dom::VisibilityState>
+    : public ContiguousEnumSerializer<
+          mozilla::dom::VisibilityState, mozilla::dom::VisibilityState::Hidden,
+          mozilla::dom::VisibilityState::EndGuard_> {};
+
+template <>
+struct ParamTraits<mozilla::StorageAccess>
+    : public ContiguousEnumSerializer<
+          mozilla::StorageAccess,
+          mozilla::StorageAccess::ePartitionForeignOrDeny,
+          mozilla::StorageAccess::eNumValues> {};
+}  // namespace IPC
+
+#endif  // _mozilla_dom_ClientIPCUtils_h
diff --git a/dom/clients/manager/ClientInfo.cpp b/dom/clients/manager/ClientInfo.cpp
new file mode 100644
index 0000000000..a87d337f1f
--- /dev/null
+++ b/dom/clients/manager/ClientInfo.cpp
@@ -0,0 +1,131 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientInfo.h"
+
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/ipc/BackgroundUtils.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::PrincipalInfo;
+using mozilla::ipc::PrincipalInfoToPrincipal;
+
+ClientInfo::ClientInfo(const nsID& aId, ClientType aType,
+                       const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
+                       const TimeStamp& aCreationTime)
+    : mData(MakeUnique<IPCClientInfo>(aId, mozilla::Nothing(), aType,
+                                      aPrincipalInfo, aCreationTime, ""_ns,
+                                      mozilla::dom::FrameType::None,
+                                      mozilla::Nothing(), mozilla::Nothing())) {
+}
+
+ClientInfo::ClientInfo(const IPCClientInfo& aData)
+    : mData(MakeUnique<IPCClientInfo>(aData)) {}
+
+ClientInfo::ClientInfo(const ClientInfo& aRight) { operator=(aRight); }
+
+ClientInfo& ClientInfo::operator=(const ClientInfo& aRight) {
+  mData.reset();
+  mData = MakeUnique<IPCClientInfo>(*aRight.mData);
+  return *this;
+}
+
+ClientInfo::ClientInfo(ClientInfo&& aRight) : mData(std::move(aRight.mData)) {}
+
+ClientInfo& ClientInfo::operator=(ClientInfo&& aRight) {
+  mData.reset();
+  mData = std::move(aRight.mData);
+  return *this;
+}
+
+ClientInfo::~ClientInfo() = default;
+
+bool ClientInfo::operator==(const ClientInfo& aRight) const {
+  return *mData == *aRight.mData;
+}
+
+bool ClientInfo::operator!=(const ClientInfo& aRight) const {
+  return *mData != *aRight.mData;
+}
+
+const nsID& ClientInfo::Id() const { return mData->id(); }
+
+void ClientInfo::SetAgentClusterId(const nsID& aId) {
+  MOZ_ASSERT(mData->agentClusterId().isNothing() ||
+             mData->agentClusterId().ref().Equals(aId));
+  mData->agentClusterId() = Some(aId);
+}
+
+const Maybe<nsID>& ClientInfo::AgentClusterId() const {
+  return mData->agentClusterId();
+}
+
+ClientType ClientInfo::Type() const { return mData->type(); }
+
+const mozilla::ipc::PrincipalInfo& ClientInfo::PrincipalInfo() const {
+  return mData->principalInfo();
+}
+
+const TimeStamp& ClientInfo::CreationTime() const {
+  return mData->creationTime();
+}
+
+const nsCString& ClientInfo::URL() const { return mData->url(); }
+
+void ClientInfo::SetURL(const nsACString& aURL) { mData->url() = aURL; }
+
+FrameType ClientInfo::FrameType() const { return mData->frameType(); }
+
+void ClientInfo::SetFrameType(mozilla::dom::FrameType aFrameType) {
+  mData->frameType() = aFrameType;
+}
+
+const IPCClientInfo& ClientInfo::ToIPC() const { return *mData; }
+
+bool ClientInfo::IsPrivateBrowsing() const {
+  switch (PrincipalInfo().type()) {
+    case PrincipalInfo::TContentPrincipalInfo: {
+      auto& p = PrincipalInfo().get_ContentPrincipalInfo();
+      return p.attrs().mPrivateBrowsingId != 0;
+    }
+    case PrincipalInfo::TSystemPrincipalInfo: {
+      return false;
+    }
+    case PrincipalInfo::TNullPrincipalInfo: {
+      auto& p = PrincipalInfo().get_NullPrincipalInfo();
+      return p.attrs().mPrivateBrowsingId != 0;
+    }
+    default: {
+      // clients should never be expanded principals
+      MOZ_CRASH("unexpected principal type!");
+    }
+  }
+}
+
+Result<nsCOMPtr<nsIPrincipal>, nsresult> ClientInfo::GetPrincipal() const {
+  MOZ_ASSERT(NS_IsMainThread());
+  return PrincipalInfoToPrincipal(PrincipalInfo());
+}
+
+const Maybe<mozilla::ipc::CSPInfo>& ClientInfo::GetCspInfo() const {
+  return mData->cspInfo();
+}
+
+void ClientInfo::SetCspInfo(const mozilla::ipc::CSPInfo& aCSPInfo) {
+  mData->cspInfo() = Some(aCSPInfo);
+}
+
+const Maybe<mozilla::ipc::CSPInfo>& ClientInfo::GetPreloadCspInfo() const {
+  return mData->preloadCspInfo();
+}
+
+void ClientInfo::SetPreloadCspInfo(
+    const mozilla::ipc::CSPInfo& aPreloadCSPInfo) {
+  mData->preloadCspInfo() = Some(aPreloadCSPInfo);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientInfo.h b/dom/clients/manager/ClientInfo.h
new file mode 100644
index 0000000000..fd5f874b09
--- /dev/null
+++ b/dom/clients/manager/ClientInfo.h
@@ -0,0 +1,117 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _mozilla_dom_ClientInfo_h
+#define _mozilla_dom_ClientInfo_h
+
+#include "X11UndefineNone.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
+#include "nsCOMPtr.h"
+#include "nsString.h"
+
+class nsIPrincipal;
+struct nsID;
+
+namespace mozilla {
+
+namespace ipc {
+class CSPInfo;
+class PrincipalInfo;
+}  // namespace ipc
+
+namespace dom {
+
+class IPCClientInfo;
+enum class FrameType : uint8_t;
+enum class ClientType : uint8_t;
+
+// This class provides a simple structure that represents a global living
+// in the system.  Its thread safe and can be transferred across process
+// boundaries.  A ClientInfo object can represent either a window or a worker.
+class ClientInfo final {
+  UniquePtr<IPCClientInfo> mData;
+
+ public:
+  ClientInfo(const nsID& aId, ClientType aType,
+             const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
+             const TimeStamp& aCreationTime);
+
+  ClientInfo(const ClientInfo& aRight);
+
+  ClientInfo& operator=(const ClientInfo& aRight);
+
+  ClientInfo(ClientInfo&& aRight);
+
+  ClientInfo& operator=(ClientInfo&& aRight);
+
+  explicit ClientInfo(const IPCClientInfo& aData);
+
+  ~ClientInfo();
+
+  bool operator==(const ClientInfo& aRight) const;
+  bool operator!=(const ClientInfo& aRight) const;
+
+  // Get the unique identifier chosen at the time of the global's creation.
+  const nsID& Id() const;
+
+  // This function should only be called on EnsureClientSource().
+  // XXX Bug 1579785 will merge this into the constructor (requiring pass a
+  // AgentClusterId)
+  void SetAgentClusterId(const nsID& aId);
+  const Maybe<nsID>& AgentClusterId() const;
+
+  // Determine what kind of global this is; e.g. Window, Worker, SharedWorker,
+  // etc.
+  ClientType Type() const;
+
+  // Every global must have a principal that cannot change.
+  const mozilla::ipc::PrincipalInfo& PrincipalInfo() const;
+
+  // The time at which the global was created.
+  const TimeStamp& CreationTime() const;
+
+  // Each global has the concept of a creation URL.  For the most part this
+  // does not change.  The one exception is for about:blank replacement
+  // iframes.  In this case the URL starts as "about:blank", but is later
+  // overriden with the final URL.
+  const nsCString& URL() const;
+
+  // Override the creation URL.  This should only be used for about:blank
+  // replacement iframes.
+  void SetURL(const nsACString& aURL);
+
+  // The frame type is largely a window concept, but we track it as part
+  // of the global here because of the way the Clients WebAPI was designed.
+  // This is set at the time the global becomes execution ready.  Workers
+  // will always return None.
+  mozilla::dom::FrameType FrameType() const;
+
+  // Set the frame type for the global.  This should only happen once the
+  // global has become execution ready.
+  void SetFrameType(mozilla::dom::FrameType aFrameType);
+
+  // Convert to the ipdl generated type.
+  const IPCClientInfo& ToIPC() const;
+
+  // Determine if the client is in private browsing mode.
+  bool IsPrivateBrowsing() const;
+
+  // Get a main-thread nsIPrincipal for the client.
+  Result<nsCOMPtr<nsIPrincipal>, nsresult> GetPrincipal() const;
+
+  const Maybe<mozilla::ipc::CSPInfo>& GetCspInfo() const;
+  void SetCspInfo(const mozilla::ipc::CSPInfo& aCSPInfo);
+
+  const Maybe<mozilla::ipc::CSPInfo>& GetPreloadCspInfo() const;
+  void SetPreloadCspInfo(const mozilla::ipc::CSPInfo& aPreloadCSPInfo);
+};
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientInfo_h
diff --git a/dom/clients/manager/ClientManager.cpp b/dom/clients/manager/ClientManager.cpp
new file mode 100644
index 0000000000..a2b442f9f4
--- /dev/null
+++ b/dom/clients/manager/ClientManager.cpp
@@ -0,0 +1,394 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManager.h"
+
+#include "ClientHandle.h"
+#include "ClientManagerChild.h"
+#include "ClientManagerOpChild.h"
+#include "ClientSource.h"
+#include "mozilla/dom/WorkerPrivate.h"
+#include "mozilla/ipc/BackgroundChild.h"
+#include "mozilla/ipc/PBackgroundChild.h"
+#include "mozilla/ClearOnShutdown.h"  // PastShutdownPhase
+#include "mozilla/StaticPrefs_dom.h"
+#include "prthread.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::BackgroundChild;
+using mozilla::ipc::PBackgroundChild;
+using mozilla::ipc::PrincipalInfo;
+
+namespace {
+
+const uint32_t kBadThreadLocalIndex = -1;
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+const uint32_t kThreadLocalMagic1 = 0x8d57eea6;
+const uint32_t kThreadLocalMagic2 = 0x59f375c9;
+#endif
+
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+uint32_t sClientManagerThreadLocalMagic1 = kThreadLocalMagic1;
+#endif
+
+uint32_t sClientManagerThreadLocalIndex = kBadThreadLocalIndex;
+
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+uint32_t sClientManagerThreadLocalMagic2 = kThreadLocalMagic2;
+uint32_t sClientManagerThreadLocalIndexDuplicate = kBadThreadLocalIndex;
+#endif
+
+}  // anonymous namespace
+
+ClientManager::ClientManager() {
+  PBackgroundChild* parentActor =
+      BackgroundChild::GetOrCreateForCurrentThread();
+  if (NS_WARN_IF(!parentActor)) {
+    Shutdown();
+    return;
+  }
+
+  ClientManagerChild* actor = ClientManagerChild::Create();
+  if (NS_WARN_IF(!actor)) {
+    Shutdown();
+    return;
+  }
+
+  PClientManagerChild* sentActor =
+      parentActor->SendPClientManagerConstructor(actor);
+  if (NS_WARN_IF(!sentActor)) {
+    Shutdown();
+    return;
+  }
+  MOZ_DIAGNOSTIC_ASSERT(sentActor == actor);
+
+  ActivateThing(actor);
+}
+
+ClientManager::~ClientManager() {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+
+  Shutdown();
+
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic1 == kThreadLocalMagic1);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic2 == kThreadLocalMagic2);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex != kBadThreadLocalIndex);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex ==
+                        sClientManagerThreadLocalIndexDuplicate);
+  MOZ_DIAGNOSTIC_ASSERT(this ==
+                        PR_GetThreadPrivate(sClientManagerThreadLocalIndex));
+
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  PRStatus status =
+#endif
+      PR_SetThreadPrivate(sClientManagerThreadLocalIndex, nullptr);
+  MOZ_DIAGNOSTIC_ASSERT(status == PR_SUCCESS);
+}
+
+void ClientManager::Shutdown() {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+
+  if (IsShutdown()) {
+    return;
+  }
+
+  ShutdownThing();
+}
+
+UniquePtr<ClientSource> ClientManager::CreateSourceInternal(
+    ClientType aType, nsISerialEventTarget* aEventTarget,
+    const PrincipalInfo& aPrincipal) {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+
+  nsID id;
+  nsresult rv = nsID::GenerateUUIDInPlace(id);
+  MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    // If we can't even get a UUID, at least make sure not to use a garbage
+    // value.  Instead return a shutdown ClientSource with a zero'd id.
+    // This should be exceptionally rare, if it happens at all.
+    id.Clear();
+    ClientSourceConstructorArgs args(id, aType, aPrincipal, TimeStamp::Now());
+    UniquePtr<ClientSource> source(new ClientSource(this, aEventTarget, args));
+    source->Shutdown();
+    return source;
+  }
+
+  ClientSourceConstructorArgs args(id, aType, aPrincipal, TimeStamp::Now());
+  UniquePtr<ClientSource> source(new ClientSource(this, aEventTarget, args));
+
+  if (IsShutdown()) {
+    source->Shutdown();
+    return source;
+  }
+
+  source->Activate(GetActor());
+
+  return source;
+}
+
+UniquePtr<ClientSource> ClientManager::CreateSourceInternal(
+    const ClientInfo& aClientInfo, nsISerialEventTarget* aEventTarget) {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+
+  ClientSourceConstructorArgs args(aClientInfo.Id(), aClientInfo.Type(),
+                                   aClientInfo.PrincipalInfo(),
+                                   aClientInfo.CreationTime());
+  UniquePtr<ClientSource> source(new ClientSource(this, aEventTarget, args));
+
+  if (IsShutdown()) {
+    source->Shutdown();
+    return source;
+  }
+
+  source->Activate(GetActor());
+
+  return source;
+}
+
+already_AddRefed<ClientHandle> ClientManager::CreateHandleInternal(
+    const ClientInfo& aClientInfo, nsISerialEventTarget* aSerialEventTarget) {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+  MOZ_DIAGNOSTIC_ASSERT(aSerialEventTarget);
+
+  RefPtr<ClientHandle> handle =
+      new ClientHandle(this, aSerialEventTarget, aClientInfo);
+
+  if (IsShutdown()) {
+    handle->Shutdown();
+    return handle.forget();
+  }
+
+  handle->Activate(GetActor());
+
+  return handle.forget();
+}
+
+RefPtr<ClientOpPromise> ClientManager::StartOp(
+    const ClientOpConstructorArgs& aArgs,
+    nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  // Hold a ref to the client until the remote operation completes.  Otherwise
+  // the ClientHandle might get de-refed and teardown the actor before we
+  // get an answer.
+  RefPtr<ClientManager> kungFuGrip = this;
+
+  MaybeExecute(
+      [&aArgs, promise, kungFuGrip](ClientManagerChild* aActor) {
+        ClientManagerOpChild* actor =
+            new ClientManagerOpChild(kungFuGrip, aArgs, promise);
+        if (!aActor->SendPClientManagerOpConstructor(actor, aArgs)) {
+          // Constructor failure will reject promise via ActorDestroy()
+          return;
+        }
+      },
+      [promise] {
+        CopyableErrorResult rv;
+        rv.ThrowInvalidStateError("Client has been destroyed");
+        promise->Reject(rv, __func__);
+      });
+
+  return promise;
+}
+
+// static
+already_AddRefed<ClientManager> ClientManager::GetOrCreateForCurrentThread() {
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic1 == kThreadLocalMagic1);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic2 == kThreadLocalMagic2);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex != kBadThreadLocalIndex);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex ==
+                        sClientManagerThreadLocalIndexDuplicate);
+  RefPtr<ClientManager> cm = static_cast<ClientManager*>(
+      PR_GetThreadPrivate(sClientManagerThreadLocalIndex));
+
+  if (!cm) {
+    cm = new ClientManager();
+
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+    PRStatus status =
+#endif
+        PR_SetThreadPrivate(sClientManagerThreadLocalIndex, cm.get());
+    MOZ_DIAGNOSTIC_ASSERT(status == PR_SUCCESS);
+  }
+
+  MOZ_DIAGNOSTIC_ASSERT(cm);
+
+  if (StaticPrefs::dom_workers_testing_enabled()) {
+    // Check that the ClientManager instance associated to the current thread
+    // has not been kept alive when it was expected to have been already
+    // deallocated (e.g. due to a leak ClientManager's mShutdown can have ben
+    // set to true from its RevokeActor method but never fully deallocated and
+    // unset from the thread locals).
+    MOZ_DIAGNOSTIC_ASSERT(!cm->IsShutdown());
+  }
+  return cm.forget();
+}
+
+WorkerPrivate* ClientManager::GetWorkerPrivate() const {
+  NS_ASSERT_OWNINGTHREAD(ClientManager);
+  MOZ_DIAGNOSTIC_ASSERT(GetActor());
+  return GetActor()->GetWorkerPrivate();
+}
+
+// Used to share logic between ExpectFutureSource and ForgetFutureSource.
+/* static */ bool ClientManager::ExpectOrForgetFutureSource(
+    const ClientInfo& aClientInfo,
+    bool (PClientManagerChild::*aMethod)(const IPCClientInfo&)) {
+  // Return earlier if called late in the XPCOM shutdown path,
+  // ClientManager would be already shutdown at the point.
+  if (NS_WARN_IF(PastShutdownPhase(ShutdownPhase::XPCOMShutdown))) {
+    return false;
+  }
+
+  bool rv = true;
+
+  RefPtr<ClientManager> mgr = ClientManager::GetOrCreateForCurrentThread();
+  mgr->MaybeExecute(
+      [&](ClientManagerChild* aActor) {
+        if (!(aActor->*aMethod)(aClientInfo.ToIPC())) {
+          rv = false;
+        }
+      },
+      [&] { rv = false; });
+
+  return rv;
+}
+
+/* static */ bool ClientManager::ExpectFutureSource(
+    const ClientInfo& aClientInfo) {
+  return ExpectOrForgetFutureSource(
+      aClientInfo, &PClientManagerChild::SendExpectFutureClientSource);
+}
+
+/* static */ bool ClientManager::ForgetFutureSource(
+    const ClientInfo& aClientInfo) {
+  return ExpectOrForgetFutureSource(
+      aClientInfo, &PClientManagerChild::SendForgetFutureClientSource);
+}
+
+// static
+void ClientManager::Startup() {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic1 == kThreadLocalMagic1);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalMagic2 == kThreadLocalMagic2);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex == kBadThreadLocalIndex);
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex ==
+                        sClientManagerThreadLocalIndexDuplicate);
+
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  PRStatus status =
+#endif
+      PR_NewThreadPrivateIndex(&sClientManagerThreadLocalIndex, nullptr);
+  MOZ_DIAGNOSTIC_ASSERT(status == PR_SUCCESS);
+
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerThreadLocalIndex != kBadThreadLocalIndex);
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  sClientManagerThreadLocalIndexDuplicate = sClientManagerThreadLocalIndex;
+#endif
+}
+
+// static
+UniquePtr<ClientSource> ClientManager::CreateSource(
+    ClientType aType, nsISerialEventTarget* aEventTarget,
+    nsIPrincipal* aPrincipal) {
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aPrincipal);
+
+  PrincipalInfo principalInfo;
+  nsresult rv = PrincipalToPrincipalInfo(aPrincipal, &principalInfo);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    MOZ_CRASH("ClientManager::CreateSource() cannot serialize bad principal");
+  }
+
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->CreateSourceInternal(aType, aEventTarget, principalInfo);
+}
+
+// static
+UniquePtr<ClientSource> ClientManager::CreateSource(
+    ClientType aType, nsISerialEventTarget* aEventTarget,
+    const PrincipalInfo& aPrincipal) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->CreateSourceInternal(aType, aEventTarget, aPrincipal);
+}
+
+// static
+UniquePtr<ClientSource> ClientManager::CreateSourceFromInfo(
+    const ClientInfo& aClientInfo, nsISerialEventTarget* aEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->CreateSourceInternal(aClientInfo, aEventTarget);
+}
+
+Maybe<ClientInfo> ClientManager::CreateInfo(ClientType aType,
+                                            nsIPrincipal* aPrincipal) {
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aPrincipal);
+
+  PrincipalInfo principalInfo;
+  nsresult rv = PrincipalToPrincipalInfo(aPrincipal, &principalInfo);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    MOZ_CRASH("ClientManager::CreateSource() cannot serialize bad principal");
+  }
+
+  nsID id;
+  rv = nsID::GenerateUUIDInPlace(id);
+  MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return Nothing();
+  }
+
+  return Some(ClientInfo(id, aType, principalInfo, TimeStamp::Now()));
+}
+
+// static
+already_AddRefed<ClientHandle> ClientManager::CreateHandle(
+    const ClientInfo& aClientInfo, nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->CreateHandleInternal(aClientInfo, aSerialEventTarget);
+}
+
+// static
+RefPtr<ClientOpPromise> ClientManager::MatchAll(
+    const ClientMatchAllArgs& aArgs, nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->StartOp(aArgs, aSerialEventTarget);
+}
+
+// static
+RefPtr<ClientOpPromise> ClientManager::Claim(
+    const ClientClaimArgs& aArgs, nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->StartOp(aArgs, aSerialEventTarget);
+}
+
+// static
+RefPtr<ClientOpPromise> ClientManager::GetInfoAndState(
+    const ClientGetInfoAndStateArgs& aArgs,
+    nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->StartOp(aArgs, aSerialEventTarget);
+}
+
+// static
+RefPtr<ClientOpPromise> ClientManager::Navigate(
+    const ClientNavigateArgs& aArgs, nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->StartOp(aArgs, aSerialEventTarget);
+}
+
+// static
+RefPtr<ClientOpPromise> ClientManager::OpenWindow(
+    const ClientOpenWindowArgs& aArgs,
+    nsISerialEventTarget* aSerialEventTarget) {
+  RefPtr<ClientManager> mgr = GetOrCreateForCurrentThread();
+  return mgr->StartOp(aArgs, aSerialEventTarget);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManager.h b/dom/clients/manager/ClientManager.h
new file mode 100644
index 0000000000..94504aaee8
--- /dev/null
+++ b/dom/clients/manager/ClientManager.h
@@ -0,0 +1,151 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManager_h
+#define _mozilla_dom_ClientManager_h
+
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/ClientThing.h"
+#include "mozilla/dom/PClientManagerChild.h"
+
+class nsIPrincipal;
+
+namespace mozilla {
+namespace ipc {
+class PBackgroundChild;
+class PrincipalInfo;
+}  // namespace ipc
+namespace dom {
+
+class ClientClaimArgs;
+class ClientGetInfoAndStateArgs;
+class ClientHandle;
+class ClientInfo;
+class ClientManagerChild;
+class ClientMatchAllArgs;
+class ClientNavigateArgs;
+class ClientOpConstructorArgs;
+class ClientOpenWindowArgs;
+class ClientSource;
+enum class ClientType : uint8_t;
+class WorkerPrivate;
+
+// The ClientManager provides a per-thread singleton interface workering
+// with the client subsystem.  It allows globals to create ClientSource
+// objects.  It allows other parts of the system to attach to this globals
+// by creating ClientHandle objects.  The ClientManager also provides
+// methods for querying the list of clients active in the system.
+class ClientManager final : public ClientThing<ClientManagerChild> {
+  friend class ClientManagerChild;
+  friend class ClientSource;
+
+  ClientManager();
+  ~ClientManager();
+
+  // Utility method to trigger a shutdown of the ClientManager.  This
+  // is called in various error conditions or when the last reference
+  // is dropped.
+  void Shutdown();
+
+  UniquePtr<ClientSource> CreateSourceInternal(
+      ClientType aType, nsISerialEventTarget* aEventTarget,
+      const mozilla::ipc::PrincipalInfo& aPrincipal);
+
+  UniquePtr<ClientSource> CreateSourceInternal(
+      const ClientInfo& aClientInfo, nsISerialEventTarget* aEventTarget);
+
+  already_AddRefed<ClientHandle> CreateHandleInternal(
+      const ClientInfo& aClientInfo, nsISerialEventTarget* aSerialEventTarget);
+
+  // Utility method to perform an IPC operation.  This will create a
+  // PClientManagerOp actor tied to a MozPromise.  The promise will
+  // resolve or reject with the result of the remote operation.
+  [[nodiscard]] RefPtr<ClientOpPromise> StartOp(
+      const ClientOpConstructorArgs& aArgs,
+      nsISerialEventTarget* aSerialEventTarget);
+
+  // Get or create the TLS singleton.  Currently this is only used
+  // internally and external code indirectly calls it by invoking
+  // static methods.
+  static already_AddRefed<ClientManager> GetOrCreateForCurrentThread();
+
+  // Private methods called by ClientSource
+  mozilla::dom::WorkerPrivate* GetWorkerPrivate() const;
+
+  // Don't use - use {Expect,Forget}FutureSource instead.
+  static bool ExpectOrForgetFutureSource(
+      const ClientInfo& aClientInfo,
+      bool (PClientManagerChild::*aMethod)(const IPCClientInfo&));
+
+ public:
+  // Asynchronously declare that a ClientSource will possibly be constructed
+  // from an equivalent ClientInfo in the future. This must be called before any
+  // any ClientHandles are created with the ClientInfo to avoid race conditions
+  // when ClientHandles query the ClientManagerService.
+  //
+  // This method exists so that the ClientManagerService can determine if a
+  // particular ClientSource can be expected to exist in the future or has
+  // already existed and been destroyed.
+  //
+  // If it's later known that the expected ClientSource will not be
+  // constructed, ForgetFutureSource must be called.
+  static bool ExpectFutureSource(const ClientInfo& aClientInfo);
+
+  // May also be called even when the "future" source has become a "real"
+  // source, in which case this is a no-op.
+  static bool ForgetFutureSource(const ClientInfo& aClientInfo);
+
+  // Initialize the ClientManager at process start.  This
+  // does book-keeping like creating a TLS identifier, etc.
+  // This should only be called by process startup code.
+  static void Startup();
+
+  static UniquePtr<ClientSource> CreateSource(
+      ClientType aType, nsISerialEventTarget* aEventTarget,
+      nsIPrincipal* aPrincipal);
+
+  static UniquePtr<ClientSource> CreateSource(
+      ClientType aType, nsISerialEventTarget* aEventTarget,
+      const mozilla::ipc::PrincipalInfo& aPrincipal);
+
+  // Construct a new ClientSource from an existing ClientInfo (and id) rather
+  // than allocating a new id.
+  static UniquePtr<ClientSource> CreateSourceFromInfo(
+      const ClientInfo& aClientInfo, nsISerialEventTarget* aSerialEventTarget);
+
+  // Allocate a new ClientInfo and id without creating a ClientSource. Used
+  // when we have a redirect that isn't exposed to the process that owns
+  // the global/ClientSource.
+  static Maybe<ClientInfo> CreateInfo(ClientType aType,
+                                      nsIPrincipal* aPrincipal);
+
+  static already_AddRefed<ClientHandle> CreateHandle(
+      const ClientInfo& aClientInfo, nsISerialEventTarget* aSerialEventTarget);
+
+  static RefPtr<ClientOpPromise> MatchAll(const ClientMatchAllArgs& aArgs,
+                                          nsISerialEventTarget* aTarget);
+
+  static RefPtr<ClientOpPromise> Claim(
+      const ClientClaimArgs& aArgs, nsISerialEventTarget* aSerialEventTarget);
+
+  static RefPtr<ClientOpPromise> GetInfoAndState(
+      const ClientGetInfoAndStateArgs& aArgs,
+      nsISerialEventTarget* aSerialEventTarget);
+
+  static RefPtr<ClientOpPromise> Navigate(
+      const ClientNavigateArgs& aArgs,
+      nsISerialEventTarget* aSerialEventTarget);
+
+  static RefPtr<ClientOpPromise> OpenWindow(
+      const ClientOpenWindowArgs& aArgs,
+      nsISerialEventTarget* aSerialEventTarget);
+
+  NS_INLINE_DECL_REFCOUNTING(mozilla::dom::ClientManager)
+};
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientManager_h
diff --git a/dom/clients/manager/ClientManagerActors.cpp b/dom/clients/manager/ClientManagerActors.cpp
new file mode 100644
index 0000000000..6ec08bf399
--- /dev/null
+++ b/dom/clients/manager/ClientManagerActors.cpp
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerChild.h"
+#include "ClientManagerParent.h"
+
+namespace mozilla::dom {
+
+PClientManagerChild* AllocClientManagerChild() {
+  MOZ_ASSERT_UNREACHABLE(
+      "Default ClientManagerChild allocator should not be invoked");
+  return nullptr;
+}
+
+bool DeallocClientManagerChild(PClientManagerChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+PClientManagerParent* AllocClientManagerParent() {
+  return new ClientManagerParent();
+}
+
+bool DeallocClientManagerParent(PClientManagerParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+void InitClientManagerParent(PClientManagerParent* aActor) {
+  auto actor = static_cast<ClientManagerParent*>(aActor);
+  actor->Init();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerActors.h b/dom/clients/manager/ClientManagerActors.h
new file mode 100644
index 0000000000..b977149014
--- /dev/null
+++ b/dom/clients/manager/ClientManagerActors.h
@@ -0,0 +1,28 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerActors_h
+#define _mozilla_dom_ClientManagerActors_h
+
+namespace mozilla {
+namespace dom {
+
+class PClientManagerChild;
+class PClientManagerParent;
+
+PClientManagerChild* AllocClientManagerChild();
+
+bool DeallocClientManagerChild(PClientManagerChild* aActor);
+
+PClientManagerParent* AllocClientManagerParent();
+
+bool DeallocClientManagerParent(PClientManagerParent* aActor);
+
+void InitClientManagerParent(PClientManagerParent* aActor);
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientManagerActors_h
diff --git a/dom/clients/manager/ClientManagerChild.cpp b/dom/clients/manager/ClientManagerChild.cpp
new file mode 100644
index 0000000000..b51ff11897
--- /dev/null
+++ b/dom/clients/manager/ClientManagerChild.cpp
@@ -0,0 +1,137 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerChild.h"
+
+#include "ClientHandleChild.h"
+#include "ClientManagerOpChild.h"
+#include "ClientNavigateOpChild.h"
+#include "ClientSourceChild.h"
+
+#include "mozilla/dom/WorkerCommon.h"
+#include "mozilla/dom/WorkerRef.h"
+
+namespace mozilla::dom {
+
+void ClientManagerChild::ActorDestroy(ActorDestroyReason aReason) {
+  mIPCWorkerRef = nullptr;
+
+  if (mManager) {
+    mManager->RevokeActor(this);
+
+    // Revoking the actor link should automatically cause the owner
+    // to call RevokeOwner() as well.
+    MOZ_DIAGNOSTIC_ASSERT(!mManager);
+  }
+}
+
+PClientHandleChild* ClientManagerChild::AllocPClientHandleChild(
+    const IPCClientInfo& aClientInfo) {
+  return new ClientHandleChild();
+}
+
+bool ClientManagerChild::DeallocPClientHandleChild(PClientHandleChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+PClientManagerOpChild* ClientManagerChild::AllocPClientManagerOpChild(
+    const ClientOpConstructorArgs& aArgs) {
+  MOZ_ASSERT_UNREACHABLE(
+      "ClientManagerOpChild must be explicitly constructed.");
+  return nullptr;
+}
+
+bool ClientManagerChild::DeallocPClientManagerOpChild(
+    PClientManagerOpChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+PClientNavigateOpChild* ClientManagerChild::AllocPClientNavigateOpChild(
+    const ClientNavigateOpConstructorArgs& aArgs) {
+  return new ClientNavigateOpChild();
+}
+
+bool ClientManagerChild::DeallocPClientNavigateOpChild(
+    PClientNavigateOpChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+mozilla::ipc::IPCResult ClientManagerChild::RecvPClientNavigateOpConstructor(
+    PClientNavigateOpChild* aActor,
+    const ClientNavigateOpConstructorArgs& aArgs) {
+  auto actor = static_cast<ClientNavigateOpChild*>(aActor);
+  actor->Init(aArgs);
+  return IPC_OK();
+}
+
+PClientSourceChild* ClientManagerChild::AllocPClientSourceChild(
+    const ClientSourceConstructorArgs& aArgs) {
+  return new ClientSourceChild(aArgs);
+}
+
+bool ClientManagerChild::DeallocPClientSourceChild(PClientSourceChild* aActor) {
+  delete aActor;
+  return true;
+}
+
+// static
+ClientManagerChild* ClientManagerChild::Create() {
+  ClientManagerChild* actor = new ClientManagerChild();
+
+  if (!NS_IsMainThread()) {
+    WorkerPrivate* workerPrivate = GetCurrentThreadWorkerPrivate();
+    MOZ_DIAGNOSTIC_ASSERT(workerPrivate);
+
+    RefPtr<IPCWorkerRefHelper<ClientManagerChild>> helper =
+        new IPCWorkerRefHelper<ClientManagerChild>(actor);
+
+    actor->mIPCWorkerRef = IPCWorkerRef::Create(
+        workerPrivate, "ClientManagerChild",
+        [helper] { helper->Actor()->MaybeStartTeardown(); });
+
+    if (NS_WARN_IF(!actor->mIPCWorkerRef)) {
+      delete actor;
+      return nullptr;
+    }
+  }
+
+  return actor;
+}
+
+ClientManagerChild::ClientManagerChild()
+    : mManager(nullptr), mTeardownStarted(false) {}
+
+void ClientManagerChild::SetOwner(ClientThing<ClientManagerChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(aThing);
+  MOZ_DIAGNOSTIC_ASSERT(!mManager);
+  mManager = aThing;
+}
+
+void ClientManagerChild::RevokeOwner(ClientThing<ClientManagerChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(mManager);
+  MOZ_DIAGNOSTIC_ASSERT(mManager == aThing);
+  mManager = nullptr;
+}
+
+void ClientManagerChild::MaybeStartTeardown() {
+  if (mTeardownStarted) {
+    return;
+  }
+  mTeardownStarted = true;
+  SendTeardown();
+}
+
+WorkerPrivate* ClientManagerChild::GetWorkerPrivate() const {
+  if (!mIPCWorkerRef) {
+    return nullptr;
+  }
+  return mIPCWorkerRef->Private();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerChild.h b/dom/clients/manager/ClientManagerChild.h
new file mode 100644
index 0000000000..30a0885a10
--- /dev/null
+++ b/dom/clients/manager/ClientManagerChild.h
@@ -0,0 +1,66 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerChild_h
+#define _mozilla_dom_ClientManagerChild_h
+
+#include "ClientThing.h"
+#include "mozilla/dom/PClientManagerChild.h"
+
+namespace mozilla::dom {
+
+class IPCWorkerRef;
+class WorkerPrivate;
+
+class ClientManagerChild final : public PClientManagerChild {
+  ClientThing<ClientManagerChild>* mManager;
+
+  RefPtr<IPCWorkerRef> mIPCWorkerRef;
+  bool mTeardownStarted;
+
+  ClientManagerChild();
+
+  // PClientManagerChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientHandleChild* AllocPClientHandleChild(
+      const IPCClientInfo& aClientInfo) override;
+
+  bool DeallocPClientHandleChild(PClientHandleChild* aActor) override;
+
+  PClientManagerOpChild* AllocPClientManagerOpChild(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientManagerOpChild(PClientManagerOpChild* aActor) override;
+
+  PClientNavigateOpChild* AllocPClientNavigateOpChild(
+      const ClientNavigateOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientNavigateOpChild(PClientNavigateOpChild* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientNavigateOpConstructor(
+      PClientNavigateOpChild* aActor,
+      const ClientNavigateOpConstructorArgs& aArgs) override;
+
+  PClientSourceChild* AllocPClientSourceChild(
+      const ClientSourceConstructorArgs& aArgs) override;
+
+  bool DeallocPClientSourceChild(PClientSourceChild* aActor) override;
+
+ public:
+  static ClientManagerChild* Create();
+
+  void SetOwner(ClientThing<ClientManagerChild>* aThing);
+
+  void RevokeOwner(ClientThing<ClientManagerChild>* aThing);
+
+  void MaybeStartTeardown();
+
+  mozilla::dom::WorkerPrivate* GetWorkerPrivate() const;
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientManagerChild_h
diff --git a/dom/clients/manager/ClientManagerOpChild.cpp b/dom/clients/manager/ClientManagerOpChild.cpp
new file mode 100644
index 0000000000..19ed22f0f1
--- /dev/null
+++ b/dom/clients/manager/ClientManagerOpChild.cpp
@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerOpChild.h"
+
+#include "mozilla/dom/ClientManager.h"
+#include "mozilla/ipc/ProtocolUtils.h"
+
+namespace mozilla::dom {
+
+void ClientManagerOpChild::ActorDestroy(ActorDestroyReason aReason) {
+  mClientManager = nullptr;
+  if (mPromise) {
+    CopyableErrorResult rv;
+    rv.ThrowAbortError("Client aborted");
+    mPromise->Reject(rv, __func__);
+    mPromise = nullptr;
+  }
+}
+
+mozilla::ipc::IPCResult ClientManagerOpChild::Recv__delete__(
+    const ClientOpResult& aResult) {
+  mClientManager = nullptr;
+  if (aResult.type() == ClientOpResult::TCopyableErrorResult &&
+      aResult.get_CopyableErrorResult().Failed()) {
+    mPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+    mPromise = nullptr;
+    return IPC_OK();
+  }
+  mPromise->Resolve(aResult, __func__);
+  mPromise = nullptr;
+  return IPC_OK();
+}
+
+ClientManagerOpChild::ClientManagerOpChild(ClientManager* aClientManager,
+                                           const ClientOpConstructorArgs& aArgs,
+                                           ClientOpPromise::Private* aPromise)
+    : mClientManager(aClientManager), mPromise(aPromise) {
+  MOZ_DIAGNOSTIC_ASSERT(mClientManager);
+  MOZ_DIAGNOSTIC_ASSERT(mPromise);
+}
+
+ClientManagerOpChild::~ClientManagerOpChild() {
+  MOZ_DIAGNOSTIC_ASSERT(!mPromise);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerOpChild.h b/dom/clients/manager/ClientManagerOpChild.h
new file mode 100644
index 0000000000..1d13efd5be
--- /dev/null
+++ b/dom/clients/manager/ClientManagerOpChild.h
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerOpChild_h
+#define _mozilla_dom_ClientManagerOpChild_h
+
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/PClientManagerOpChild.h"
+#include "mozilla/MozPromise.h"
+
+namespace mozilla::dom {
+
+class ClientManager;
+
+class ClientManagerOpChild final : public PClientManagerOpChild {
+  RefPtr<ClientManager> mClientManager;
+  RefPtr<ClientOpPromise::Private> mPromise;
+
+  // PClientManagerOpChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  mozilla::ipc::IPCResult Recv__delete__(
+      const ClientOpResult& aResult) override;
+
+ public:
+  ClientManagerOpChild(ClientManager* aClientManager,
+                       const ClientOpConstructorArgs& aArgs,
+                       ClientOpPromise::Private* aPromise);
+
+  ~ClientManagerOpChild();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientManagerOpChild_h
diff --git a/dom/clients/manager/ClientManagerOpParent.cpp b/dom/clients/manager/ClientManagerOpParent.cpp
new file mode 100644
index 0000000000..43e57b7178
--- /dev/null
+++ b/dom/clients/manager/ClientManagerOpParent.cpp
@@ -0,0 +1,85 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerOpParent.h"
+
+#include "ClientManagerService.h"
+#include "mozilla/dom/PClientManagerParent.h"
+#include "mozilla/ipc/BackgroundParent.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::BackgroundParent;
+
+template <typename Method, typename... Args>
+void ClientManagerOpParent::DoServiceOp(Method aMethod, Args&&... aArgs) {
+  ThreadsafeContentParentHandle* originContent =
+      BackgroundParent::GetContentParentHandle(Manager()->Manager());
+
+  // Note, we need perfect forarding of the template type in order
+  // to allow already_AddRefed<> to be passed as an arg.
+  RefPtr<ClientOpPromise> p =
+      (mService->*aMethod)(originContent, std::forward<Args>(aArgs)...);
+
+  // Capturing `this` is safe here because we disconnect the promise in
+  // ActorDestroy() which ensures neither lambda is called if the actor
+  // is destroyed before the source operation completes.
+  p->Then(
+       GetCurrentSerialEventTarget(), __func__,
+       [this](const mozilla::dom::ClientOpResult& aResult) {
+         mPromiseRequestHolder.Complete();
+         Unused << PClientManagerOpParent::Send__delete__(this, aResult);
+       },
+       [this](const CopyableErrorResult& aRv) {
+         mPromiseRequestHolder.Complete();
+         Unused << PClientManagerOpParent::Send__delete__(this, aRv);
+       })
+      ->Track(mPromiseRequestHolder);
+}
+
+void ClientManagerOpParent::ActorDestroy(ActorDestroyReason aReason) {
+  mPromiseRequestHolder.DisconnectIfExists();
+}
+
+ClientManagerOpParent::ClientManagerOpParent(ClientManagerService* aService)
+    : mService(aService) {
+  MOZ_DIAGNOSTIC_ASSERT(mService);
+}
+
+void ClientManagerOpParent::Init(const ClientOpConstructorArgs& aArgs) {
+  switch (aArgs.type()) {
+    case ClientOpConstructorArgs::TClientNavigateArgs: {
+      DoServiceOp(&ClientManagerService::Navigate,
+                  aArgs.get_ClientNavigateArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientMatchAllArgs: {
+      DoServiceOp(&ClientManagerService::MatchAll,
+                  aArgs.get_ClientMatchAllArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientClaimArgs: {
+      DoServiceOp(&ClientManagerService::Claim, aArgs.get_ClientClaimArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientGetInfoAndStateArgs: {
+      DoServiceOp(&ClientManagerService::GetInfoAndState,
+                  aArgs.get_ClientGetInfoAndStateArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientOpenWindowArgs: {
+      DoServiceOp(&ClientManagerService::OpenWindow,
+                  aArgs.get_ClientOpenWindowArgs());
+      break;
+    }
+    default: {
+      MOZ_ASSERT_UNREACHABLE("Unknown Client operation!");
+      break;
+    }
+  }
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerOpParent.h b/dom/clients/manager/ClientManagerOpParent.h
new file mode 100644
index 0000000000..0bb8257310
--- /dev/null
+++ b/dom/clients/manager/ClientManagerOpParent.h
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerOpParent_h
+#define _mozilla_dom_ClientManagerOpParent_h
+
+#include "mozilla/dom/PClientManagerOpParent.h"
+#include "ClientOpPromise.h"
+
+namespace mozilla::dom {
+
+class ClientManagerService;
+
+class ClientManagerOpParent final : public PClientManagerOpParent {
+  RefPtr<ClientManagerService> mService;
+  MozPromiseRequestHolder<ClientOpPromise> mPromiseRequestHolder;
+
+  template <typename Method, typename... Args>
+  void DoServiceOp(Method aMethod, Args&&... aArgs);
+
+  // PClientManagerOpParent interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+ public:
+  explicit ClientManagerOpParent(ClientManagerService* aService);
+  ~ClientManagerOpParent() = default;
+
+  void Init(const ClientOpConstructorArgs& aArgs);
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientManagerOpParent_h
diff --git a/dom/clients/manager/ClientManagerParent.cpp b/dom/clients/manager/ClientManagerParent.cpp
new file mode 100644
index 0000000000..1ee0eddcb0
--- /dev/null
+++ b/dom/clients/manager/ClientManagerParent.cpp
@@ -0,0 +1,125 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerParent.h"
+
+#include "mozilla/ipc/BackgroundParent.h"
+#include "ClientHandleParent.h"
+#include "ClientManagerOpParent.h"
+#include "ClientManagerService.h"
+#include "ClientSourceParent.h"
+#include "ClientValidation.h"
+#include "mozilla/dom/PClientNavigateOpParent.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+IPCResult ClientManagerParent::RecvTeardown() {
+  Unused << Send__delete__(this);
+  return IPC_OK();
+}
+
+void ClientManagerParent::ActorDestroy(ActorDestroyReason aReason) {}
+
+PClientHandleParent* ClientManagerParent::AllocPClientHandleParent(
+    const IPCClientInfo& aClientInfo) {
+  return new ClientHandleParent();
+}
+
+bool ClientManagerParent::DeallocPClientHandleParent(
+    PClientHandleParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+IPCResult ClientManagerParent::RecvPClientHandleConstructor(
+    PClientHandleParent* aActor, const IPCClientInfo& aClientInfo) {
+  ClientHandleParent* actor = static_cast<ClientHandleParent*>(aActor);
+  actor->Init(aClientInfo);
+  return IPC_OK();
+}
+
+PClientManagerOpParent* ClientManagerParent::AllocPClientManagerOpParent(
+    const ClientOpConstructorArgs& aArgs) {
+  return new ClientManagerOpParent(mService);
+}
+
+bool ClientManagerParent::DeallocPClientManagerOpParent(
+    PClientManagerOpParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+IPCResult ClientManagerParent::RecvPClientManagerOpConstructor(
+    PClientManagerOpParent* aActor, const ClientOpConstructorArgs& aArgs) {
+  ClientManagerOpParent* actor = static_cast<ClientManagerOpParent*>(aActor);
+  actor->Init(aArgs);
+  return IPC_OK();
+}
+
+PClientNavigateOpParent* ClientManagerParent::AllocPClientNavigateOpParent(
+    const ClientNavigateOpConstructorArgs& aArgs) {
+  MOZ_ASSERT_UNREACHABLE(
+      "ClientNavigateOpParent should be explicitly constructed.");
+  return nullptr;
+}
+
+bool ClientManagerParent::DeallocPClientNavigateOpParent(
+    PClientNavigateOpParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+PClientSourceParent* ClientManagerParent::AllocPClientSourceParent(
+    const ClientSourceConstructorArgs& aArgs) {
+  Maybe<ContentParentId> contentParentId;
+
+  uint64_t childID = ::mozilla::ipc::BackgroundParent::GetChildID(Manager());
+  if (childID) {
+    contentParentId = Some(ContentParentId(childID));
+  }
+
+  return new ClientSourceParent(aArgs, contentParentId);
+}
+
+bool ClientManagerParent::DeallocPClientSourceParent(
+    PClientSourceParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+IPCResult ClientManagerParent::RecvPClientSourceConstructor(
+    PClientSourceParent* aActor, const ClientSourceConstructorArgs& aArgs) {
+  ClientSourceParent* actor = static_cast<ClientSourceParent*>(aActor);
+  actor->Init();
+  return IPC_OK();
+}
+
+ClientManagerParent::ClientManagerParent()
+    : mService(ClientManagerService::GetOrCreateInstance()) {}
+
+ClientManagerParent::~ClientManagerParent() { mService->RemoveManager(this); }
+
+void ClientManagerParent::Init() { mService->AddManager(this); }
+
+IPCResult ClientManagerParent::RecvExpectFutureClientSource(
+    const IPCClientInfo& aClientInfo) {
+  RefPtr<ClientManagerService> cms =
+      ClientManagerService::GetOrCreateInstance();
+  Unused << NS_WARN_IF(!cms->ExpectFutureSource(aClientInfo));
+  return IPC_OK();
+}
+
+IPCResult ClientManagerParent::RecvForgetFutureClientSource(
+    const IPCClientInfo& aClientInfo) {
+  RefPtr<ClientManagerService> cms = ClientManagerService::GetInstance();
+  cms->ForgetFutureSource(aClientInfo);
+  return IPC_OK();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerParent.h b/dom/clients/manager/ClientManagerParent.h
new file mode 100644
index 0000000000..5991f2ff59
--- /dev/null
+++ b/dom/clients/manager/ClientManagerParent.h
@@ -0,0 +1,69 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerParent_h
+#define _mozilla_dom_ClientManagerParent_h
+
+#include "mozilla/dom/PClientManagerParent.h"
+
+namespace mozilla::dom {
+
+class ClientManagerService;
+
+class ClientManagerParent final : public PClientManagerParent {
+  RefPtr<ClientManagerService> mService;
+
+  // PClientManagerParent interface
+  mozilla::ipc::IPCResult RecvTeardown() override;
+
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientHandleParent* AllocPClientHandleParent(
+      const IPCClientInfo& aClientInfo) override;
+
+  bool DeallocPClientHandleParent(PClientHandleParent* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientHandleConstructor(
+      PClientHandleParent* aActor, const IPCClientInfo& aClientInfo) override;
+
+  PClientManagerOpParent* AllocPClientManagerOpParent(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientManagerOpParent(PClientManagerOpParent* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientManagerOpConstructor(
+      PClientManagerOpParent* aActor,
+      const ClientOpConstructorArgs& aArgs) override;
+
+  PClientNavigateOpParent* AllocPClientNavigateOpParent(
+      const ClientNavigateOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientNavigateOpParent(PClientNavigateOpParent* aActor) override;
+
+  PClientSourceParent* AllocPClientSourceParent(
+      const ClientSourceConstructorArgs& aArgs) override;
+
+  bool DeallocPClientSourceParent(PClientSourceParent* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientSourceConstructor(
+      PClientSourceParent* aActor,
+      const ClientSourceConstructorArgs& aArgs) override;
+
+  mozilla::ipc::IPCResult RecvExpectFutureClientSource(
+      const IPCClientInfo& aClientInfo) override;
+
+  mozilla::ipc::IPCResult RecvForgetFutureClientSource(
+      const IPCClientInfo& aClientInfo) override;
+
+ public:
+  ClientManagerParent();
+  ~ClientManagerParent();
+
+  void Init();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientManagerParent_h
diff --git a/dom/clients/manager/ClientManagerService.cpp b/dom/clients/manager/ClientManagerService.cpp
new file mode 100644
index 0000000000..b2d4cada95
--- /dev/null
+++ b/dom/clients/manager/ClientManagerService.cpp
@@ -0,0 +1,745 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientManagerService.h"
+
+#include "ClientHandleParent.h"
+#include "ClientManagerParent.h"
+#include "ClientNavigateOpParent.h"
+#include "ClientOpenWindowUtils.h"
+#include "ClientPrincipalUtils.h"
+#include "ClientSourceParent.h"
+#include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/ServiceWorkerManager.h"
+#include "mozilla/dom/ServiceWorkerUtils.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/ipc/PBackgroundSharedTypes.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/ScopeExit.h"
+#include "jsfriendapi.h"
+#include "nsIAsyncShutdown.h"
+#include "nsIXULRuntime.h"
+#include "nsProxyRelease.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::AssertIsOnBackgroundThread;
+using mozilla::ipc::PrincipalInfo;
+
+namespace {
+
+ClientManagerService* sClientManagerServiceInstance = nullptr;
+bool sClientManagerServiceShutdownRegistered = false;
+
+class ClientShutdownBlocker final : public nsIAsyncShutdownBlocker {
+  RefPtr<GenericPromise::Private> mPromise;
+
+  ~ClientShutdownBlocker() = default;
+
+ public:
+  explicit ClientShutdownBlocker(GenericPromise::Private* aPromise)
+      : mPromise(aPromise) {
+    MOZ_DIAGNOSTIC_ASSERT(mPromise);
+  }
+
+  NS_IMETHOD
+  GetName(nsAString& aNameOut) override {
+    aNameOut = nsLiteralString(
+        u"ClientManagerService: start destroying IPC actors early");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  BlockShutdown(nsIAsyncShutdownClient* aClient) override {
+    mPromise->Resolve(true, __func__);
+    aClient->RemoveBlocker(this);
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  GetState(nsIPropertyBag**) override { return NS_OK; }
+
+  NS_DECL_ISUPPORTS
+};
+
+NS_IMPL_ISUPPORTS(ClientShutdownBlocker, nsIAsyncShutdownBlocker)
+
+// Helper function the resolves a MozPromise when we detect that the browser
+// has begun to shutdown.
+RefPtr<GenericPromise> OnShutdown() {
+  RefPtr<GenericPromise::Private> ref = new GenericPromise::Private(__func__);
+
+  nsCOMPtr<nsIRunnable> r =
+      NS_NewRunnableFunction("ClientManagerServer::OnShutdown", [ref]() {
+        nsCOMPtr<nsIAsyncShutdownService> svc =
+            services::GetAsyncShutdownService();
+        if (!svc) {
+          ref->Resolve(true, __func__);
+          return;
+        }
+
+        nsCOMPtr<nsIAsyncShutdownClient> phase;
+        MOZ_ALWAYS_SUCCEEDS(svc->GetXpcomWillShutdown(getter_AddRefs(phase)));
+        if (!phase) {
+          ref->Resolve(true, __func__);
+          return;
+        }
+
+        nsCOMPtr<nsIAsyncShutdownBlocker> blocker =
+            new ClientShutdownBlocker(ref);
+        nsresult rv =
+            phase->AddBlocker(blocker, NS_LITERAL_STRING_FROM_CSTRING(__FILE__),
+                              __LINE__, u"ClientManagerService shutdown"_ns);
+
+        if (NS_FAILED(rv)) {
+          ref->Resolve(true, __func__);
+          return;
+        }
+      });
+
+  MOZ_ALWAYS_SUCCEEDS(
+      SchedulerGroup::Dispatch(TaskCategory::Other, r.forget()));
+
+  return ref;
+}
+
+}  // anonymous namespace
+
+ClientManagerService::FutureClientSourceParent::FutureClientSourceParent(
+    const IPCClientInfo& aClientInfo)
+    : mPrincipalInfo(aClientInfo.principalInfo()), mAssociated(false) {}
+
+ClientManagerService::ClientManagerService() : mShutdown(false) {
+  AssertIsOnBackgroundThread();
+
+  // Only register one shutdown handler at a time.  If a previous service
+  // instance did this, but shutdown has not come, then we can avoid
+  // doing it again.
+  if (!sClientManagerServiceShutdownRegistered) {
+    sClientManagerServiceShutdownRegistered = true;
+
+    // While the ClientManagerService will be gracefully terminated as windows
+    // and workers are naturally killed, this can cause us to do extra work
+    // relatively late in the shutdown process.  To avoid this we eagerly begin
+    // shutdown at the first sign it has begun.  Since we handle normal shutdown
+    // gracefully we don't really need to block anything here.  We just begin
+    // destroying our IPC actors immediately.
+    OnShutdown()->Then(GetCurrentSerialEventTarget(), __func__, []() {
+      // Look up the latest service instance, if it exists.  This may
+      // be different from the instance that registered the shutdown
+      // handler.
+      RefPtr<ClientManagerService> svc = ClientManagerService::GetInstance();
+      if (svc) {
+        svc->Shutdown();
+      }
+    });
+  }
+}
+
+ClientManagerService::~ClientManagerService() {
+  AssertIsOnBackgroundThread();
+  MOZ_DIAGNOSTIC_ASSERT(mSourceTable.Count() == 0);
+  MOZ_DIAGNOSTIC_ASSERT(mManagerList.IsEmpty());
+
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerServiceInstance == this);
+  sClientManagerServiceInstance = nullptr;
+}
+
+void ClientManagerService::Shutdown() {
+  AssertIsOnBackgroundThread();
+  MOZ_DIAGNOSTIC_ASSERT(sClientManagerServiceShutdownRegistered);
+
+  // If many ClientManagerService are created and destroyed quickly we can
+  // in theory get more than one shutdown listener calling us.
+  if (mShutdown) {
+    return;
+  }
+  mShutdown = true;
+
+  // Begin destroying our various manager actors which will in turn destroy
+  // all source, handle, and operation actors.
+  for (auto actor :
+       CopyableAutoTArray<ClientManagerParent*, 16>(mManagerList)) {
+    Unused << PClientManagerParent::Send__delete__(actor);
+  }
+
+  // Destroying manager actors should've also destroyed all source actors, so
+  // the only sources left will be future sources, which need to be aborted.
+  for (auto& entry : mSourceTable) {
+    MOZ_RELEASE_ASSERT(entry.GetData().is<FutureClientSourceParent>());
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Client creation aborted.");
+    entry.GetModifiableData()
+        ->as<FutureClientSourceParent>()
+        .RejectPromiseIfExists(rv);
+  }
+  mSourceTable.Clear();
+}
+
+ClientSourceParent* ClientManagerService::MaybeUnwrapAsExistingSource(
+    const SourceTableEntry& aEntry) const {
+  AssertIsOnBackgroundThread();
+
+  if (aEntry.is<FutureClientSourceParent>()) {
+    return nullptr;
+  }
+
+  return aEntry.as<ClientSourceParent*>();
+}
+
+ClientSourceParent* ClientManagerService::FindExistingSource(
+    const nsID& aID, const PrincipalInfo& aPrincipalInfo) const {
+  AssertIsOnBackgroundThread();
+
+  auto entry = mSourceTable.Lookup(aID);
+
+  if (!entry) {
+    return nullptr;
+  }
+
+  ClientSourceParent* source = MaybeUnwrapAsExistingSource(entry.Data());
+
+  if (!source || NS_WARN_IF(!ClientMatchPrincipalInfo(
+                     source->Info().PrincipalInfo(), aPrincipalInfo))) {
+    return nullptr;
+  }
+  return source;
+}
+
+// static
+already_AddRefed<ClientManagerService>
+ClientManagerService::GetOrCreateInstance() {
+  AssertIsOnBackgroundThread();
+
+  if (!sClientManagerServiceInstance) {
+    sClientManagerServiceInstance = new ClientManagerService();
+  }
+
+  RefPtr<ClientManagerService> ref(sClientManagerServiceInstance);
+  return ref.forget();
+}
+
+// static
+already_AddRefed<ClientManagerService> ClientManagerService::GetInstance() {
+  AssertIsOnBackgroundThread();
+
+  if (!sClientManagerServiceInstance) {
+    return nullptr;
+  }
+
+  RefPtr<ClientManagerService> ref(sClientManagerServiceInstance);
+  return ref.forget();
+}
+
+namespace {
+
+bool IsNullPrincipalInfo(const PrincipalInfo& aPrincipalInfo) {
+  return aPrincipalInfo.type() == PrincipalInfo::TNullPrincipalInfo;
+}
+
+bool AreBothNullPrincipals(const PrincipalInfo& aPrincipalInfo1,
+                           const PrincipalInfo& aPrincipalInfo2) {
+  return IsNullPrincipalInfo(aPrincipalInfo1) &&
+         IsNullPrincipalInfo(aPrincipalInfo2);
+}
+
+}  // anonymous namespace
+
+bool ClientManagerService::AddSource(ClientSourceParent* aSource) {
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(aSource);
+
+  auto entry = mSourceTable.Lookup(aSource->Info().Id());
+  if (entry) {
+    // Do not permit overwriting an existing ClientSource with the same
+    // UUID.  This would allow a spoofed ClientParentSource actor to
+    // intercept postMessage() intended for the real actor.
+    if (entry.Data().is<ClientSourceParent*>()) {
+      return false;
+    }
+    FutureClientSourceParent& placeHolder =
+        entry.Data().as<FutureClientSourceParent>();
+
+    const PrincipalInfo& placeHolderPrincipalInfo = placeHolder.PrincipalInfo();
+    const PrincipalInfo& sourcePrincipalInfo = aSource->Info().PrincipalInfo();
+
+    // The placeholder FutureClientSourceParent's PrincipalInfo must match the
+    // real ClientSourceParent's PrincipalInfo. The only exception is if both
+    // are null principals (two null principals are considered unequal).
+    if (!AreBothNullPrincipals(placeHolderPrincipalInfo, sourcePrincipalInfo) &&
+        NS_WARN_IF(!ClientMatchPrincipalInfo(placeHolderPrincipalInfo,
+                                             sourcePrincipalInfo))) {
+      return false;
+    }
+
+    placeHolder.ResolvePromiseIfExists();
+    *entry = AsVariant(aSource);
+    return true;
+  }
+  if (!mSourceTable.WithEntryHandle(aSource->Info().Id(),
+                                    [aSource](auto&& entry) {
+                                      if (NS_WARN_IF(entry.HasEntry())) {
+                                        return false;
+                                      }
+                                      entry.Insert(AsVariant(aSource));
+                                      return true;
+                                    })) {
+    return false;
+  }
+  return true;
+}
+
+bool ClientManagerService::RemoveSource(ClientSourceParent* aSource) {
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(aSource);
+  auto entry = mSourceTable.Lookup(aSource->Info().Id());
+  if (NS_WARN_IF(!entry)) {
+    return false;
+  }
+  entry.Remove();
+  return true;
+}
+
+bool ClientManagerService::ExpectFutureSource(
+    const IPCClientInfo& aClientInfo) {
+  AssertIsOnBackgroundThread();
+
+  if (!mSourceTable.WithEntryHandle(
+          aClientInfo.id(), [&aClientInfo](auto&& entry) {
+            // Prevent overwrites.
+            if (entry.HasEntry()) {
+              return false;
+            }
+            entry.Insert(SourceTableEntry(
+                VariantIndex<0>(), FutureClientSourceParent(aClientInfo)));
+            return true;
+          })) {
+    return false;
+  }
+
+  return true;
+}
+
+void ClientManagerService::ForgetFutureSource(
+    const IPCClientInfo& aClientInfo) {
+  AssertIsOnBackgroundThread();
+
+  auto entry = mSourceTable.Lookup(aClientInfo.id());
+
+  if (entry) {
+    if (entry.Data().is<ClientSourceParent*>()) {
+      return;
+    }
+
+    // For non-e10s case, ClientChannelHelperParent will be freed before real
+    // ClientSourceParnet be created. In the end this methoed will be called to
+    // release the FutureClientSourceParent. That means a ClientHandle operation
+    // which waits for the FutureClientSourceParent will have no chance to
+    // connect to the ClientSourceParent. So the FutureClientSourceParent should
+    // be keep in this case.
+    // IsAssociated() makes sure there is a ClientHandle operation associated
+    // with it.
+    // More details please refer
+    // https://bugzilla.mozilla.org/show_bug.cgi?id=1730350#c2
+    if (!XRE_IsE10sParentProcess() &&
+        entry.Data().as<FutureClientSourceParent>().IsAssociated()) {
+      return;
+    }
+
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Client creation aborted.");
+    entry.Data().as<FutureClientSourceParent>().RejectPromiseIfExists(rv);
+
+    entry.Remove();
+  }
+}
+
+RefPtr<SourcePromise> ClientManagerService::FindSource(
+    const nsID& aID, const PrincipalInfo& aPrincipalInfo) {
+  AssertIsOnBackgroundThread();
+
+  auto entry = mSourceTable.Lookup(aID);
+  if (!entry) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Unknown client.");
+    return SourcePromise::CreateAndReject(rv, __func__);
+  }
+
+  if (entry.Data().is<FutureClientSourceParent>()) {
+    entry.Data().as<FutureClientSourceParent>().SetAsAssociated();
+    return entry.Data().as<FutureClientSourceParent>().Promise();
+  }
+
+  ClientSourceParent* source = entry.Data().as<ClientSourceParent*>();
+  if (NS_WARN_IF(!ClientMatchPrincipalInfo(source->Info().PrincipalInfo(),
+                                           aPrincipalInfo))) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Unknown client.");
+    return SourcePromise::CreateAndReject(rv, __func__);
+  }
+
+  return SourcePromise::CreateAndResolve(true, __func__);
+}
+
+void ClientManagerService::AddManager(ClientManagerParent* aManager) {
+  AssertIsOnBackgroundThread();
+  MOZ_DIAGNOSTIC_ASSERT(aManager);
+  MOZ_ASSERT(!mManagerList.Contains(aManager));
+  mManagerList.AppendElement(aManager);
+
+  // If shutdown has already begun then immediately destroy the actor.
+  if (mShutdown) {
+    Unused << PClientManagerParent::Send__delete__(aManager);
+  }
+}
+
+void ClientManagerService::RemoveManager(ClientManagerParent* aManager) {
+  AssertIsOnBackgroundThread();
+  MOZ_DIAGNOSTIC_ASSERT(aManager);
+  DebugOnly<bool> removed = mManagerList.RemoveElement(aManager);
+  MOZ_ASSERT(removed);
+}
+
+RefPtr<ClientOpPromise> ClientManagerService::Navigate(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientNavigateArgs& aArgs) {
+  ClientSourceParent* source =
+      FindExistingSource(aArgs.target().id(), aArgs.target().principalInfo());
+  if (!source) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Unknown client");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+
+  const IPCServiceWorkerDescriptor& serviceWorker = aArgs.serviceWorker();
+
+  // Per https://w3c.github.io/ServiceWorker/#dom-windowclient-navigate step 4,
+  // if the service worker does not control the client, reject with a TypeError.
+  const Maybe<ServiceWorkerDescriptor>& controller = source->GetController();
+  if (controller.isNothing() ||
+      controller.ref().Scope() != serviceWorker.scope() ||
+      controller.ref().Id() != serviceWorker.id()) {
+    CopyableErrorResult rv;
+    rv.ThrowTypeError("Client is not controlled by this Service Worker");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+
+  PClientManagerParent* manager = source->Manager();
+  MOZ_DIAGNOSTIC_ASSERT(manager);
+
+  // This is safe to do because the ClientSourceChild cannot directly delete
+  // itself.  Instead it sends a Teardown message to the parent which then
+  // calls delete.  That means we can be sure that we are not racing with
+  // source destruction here.
+  ClientNavigateOpConstructorArgs args(WrapNotNull(source), aArgs.url(),
+                                       aArgs.baseURL());
+
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  ClientNavigateOpParent* op = new ClientNavigateOpParent(args, promise);
+  PClientNavigateOpParent* result =
+      manager->SendPClientNavigateOpConstructor(op, args);
+  if (!result) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Client is aborted");
+    promise->Reject(rv, __func__);
+  }
+
+  return promise;
+}
+
+namespace {
+
+class PromiseListHolder final {
+  RefPtr<ClientOpPromise::Private> mResultPromise;
+  nsTArray<RefPtr<ClientOpPromise>> mPromiseList;
+  nsTArray<ClientInfoAndState> mResultList;
+  uint32_t mOutstandingPromiseCount;
+
+  void ProcessSuccess(const ClientInfoAndState& aResult) {
+    mResultList.AppendElement(aResult);
+    ProcessCompletion();
+  }
+
+  void ProcessCompletion() {
+    MOZ_DIAGNOSTIC_ASSERT(mOutstandingPromiseCount > 0);
+    mOutstandingPromiseCount -= 1;
+    MaybeFinish();
+  }
+
+  ~PromiseListHolder() = default;
+
+ public:
+  PromiseListHolder()
+      : mResultPromise(new ClientOpPromise::Private(__func__)),
+        mOutstandingPromiseCount(0) {}
+
+  RefPtr<ClientOpPromise> GetResultPromise() {
+    RefPtr<PromiseListHolder> kungFuDeathGrip = this;
+    return mResultPromise->Then(
+        GetCurrentSerialEventTarget(), __func__,
+        [kungFuDeathGrip](const ClientOpPromise::ResolveOrRejectValue& aValue) {
+          return ClientOpPromise::CreateAndResolveOrReject(aValue, __func__);
+        });
+  }
+
+  void AddPromise(RefPtr<ClientOpPromise>&& aPromise) {
+    mPromiseList.AppendElement(std::move(aPromise));
+    MOZ_DIAGNOSTIC_ASSERT(mPromiseList.LastElement());
+    mOutstandingPromiseCount += 1;
+
+    RefPtr<PromiseListHolder> self(this);
+    mPromiseList.LastElement()->Then(
+        GetCurrentSerialEventTarget(), __func__,
+        [self](const ClientOpResult& aResult) {
+          // TODO: This is pretty clunky.  Try to figure out a better
+          //       wait for MatchAll() and Claim() to share this code
+          //       even though they expect different return values.
+          if (aResult.type() == ClientOpResult::TClientInfoAndState) {
+            self->ProcessSuccess(aResult.get_ClientInfoAndState());
+          } else {
+            self->ProcessCompletion();
+          }
+        },
+        [self](const CopyableErrorResult& aResult) {
+          self->ProcessCompletion();
+        });
+  }
+
+  void MaybeFinish() {
+    if (!mOutstandingPromiseCount) {
+      mResultPromise->Resolve(CopyableTArray(mResultList.Clone()), __func__);
+    }
+  }
+
+  NS_INLINE_DECL_REFCOUNTING(PromiseListHolder)
+};
+
+}  // anonymous namespace
+
+RefPtr<ClientOpPromise> ClientManagerService::MatchAll(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientMatchAllArgs& aArgs) {
+  AssertIsOnBackgroundThread();
+
+  ServiceWorkerDescriptor swd(aArgs.serviceWorker());
+  const PrincipalInfo& principalInfo = swd.PrincipalInfo();
+
+  RefPtr<PromiseListHolder> promiseList = new PromiseListHolder();
+
+  for (const auto& entry : mSourceTable) {
+    ClientSourceParent* source = MaybeUnwrapAsExistingSource(entry.GetData());
+
+    if (!source || source->IsFrozen() || !source->ExecutionReady()) {
+      continue;
+    }
+
+    if (aArgs.type() != ClientType::All &&
+        source->Info().Type() != aArgs.type()) {
+      continue;
+    }
+
+    if (!ClientMatchPrincipalInfo(source->Info().PrincipalInfo(),
+                                  principalInfo)) {
+      continue;
+    }
+
+    if (!aArgs.includeUncontrolled()) {
+      const Maybe<ServiceWorkerDescriptor>& controller =
+          source->GetController();
+      if (controller.isNothing()) {
+        continue;
+      }
+
+      if (controller.ref().Id() != swd.Id() ||
+          controller.ref().Scope() != swd.Scope()) {
+        continue;
+      }
+    }
+
+    promiseList->AddPromise(source->StartOp(ClientGetInfoAndStateArgs(
+        source->Info().Id(), source->Info().PrincipalInfo())));
+  }
+
+  // Maybe finish the promise now in case we didn't find any matching clients.
+  promiseList->MaybeFinish();
+
+  return promiseList->GetResultPromise();
+}
+
+namespace {
+
+RefPtr<ClientOpPromise> ClaimOnMainThread(
+    const ClientInfo& aClientInfo, const ServiceWorkerDescriptor& aDescriptor) {
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  nsCOMPtr<nsIRunnable> r = NS_NewRunnableFunction(
+      __func__, [promise, clientInfo = std::move(aClientInfo),
+                 desc = std::move(aDescriptor)]() {
+        auto scopeExit = MakeScopeExit([&] {
+          // This will truncate the URLs if they have embedded nulls, if that
+          // can happen, but for // our purposes here that's OK.
+          nsPrintfCString err(
+              "Service worker at <%s> can't claim Client at <%s>",
+              desc.ScriptURL().get(), clientInfo.URL().get());
+          CopyableErrorResult rv;
+          rv.ThrowInvalidStateError(err);
+          promise->Reject(rv, __func__);
+        });
+
+        RefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+        NS_ENSURE_TRUE_VOID(swm);
+
+        RefPtr<GenericErrorResultPromise> inner =
+            swm->MaybeClaimClient(clientInfo, desc);
+        inner->Then(
+            GetMainThreadSerialEventTarget(), __func__,
+            [promise](bool aResult) {
+              promise->Resolve(CopyableErrorResult(), __func__);
+            },
+            [promise](const CopyableErrorResult& aRv) {
+              promise->Reject(aRv, __func__);
+            });
+
+        scopeExit.release();
+      });
+
+  MOZ_ALWAYS_SUCCEEDS(
+      SchedulerGroup::Dispatch(TaskCategory::Other, r.forget()));
+
+  return promise;
+}
+
+}  // anonymous namespace
+
+RefPtr<ClientOpPromise> ClientManagerService::Claim(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientClaimArgs& aArgs) {
+  AssertIsOnBackgroundThread();
+
+  const IPCServiceWorkerDescriptor& serviceWorker = aArgs.serviceWorker();
+  const PrincipalInfo& principalInfo = serviceWorker.principalInfo();
+
+  RefPtr<PromiseListHolder> promiseList = new PromiseListHolder();
+
+  for (const auto& entry : mSourceTable) {
+    ClientSourceParent* source = MaybeUnwrapAsExistingSource(entry.GetData());
+
+    if (!source) {
+      continue;
+    }
+
+    if (!ClientMatchPrincipalInfo(source->Info().PrincipalInfo(),
+                                  principalInfo)) {
+      continue;
+    }
+
+    const Maybe<ServiceWorkerDescriptor>& controller = source->GetController();
+    if (controller.isSome() &&
+        controller.ref().Scope() == serviceWorker.scope() &&
+        controller.ref().Id() == serviceWorker.id()) {
+      continue;
+    }
+
+    // TODO: This logic to determine if a service worker should control
+    //       a particular client should be moved to the ServiceWorkerManager.
+    //       This can't happen until the SWM is moved to the parent process,
+    //       though.
+    if (!source->ExecutionReady() ||
+        source->Info().Type() == ClientType::Serviceworker ||
+        source->Info().URL().Find(serviceWorker.scope()) != 0) {
+      continue;
+    }
+
+    if (source->IsFrozen()) {
+      Unused << source->SendEvictFromBFCache();
+      continue;
+    }
+
+    promiseList->AddPromise(ClaimOnMainThread(
+        source->Info(), ServiceWorkerDescriptor(serviceWorker)));
+  }
+
+  // Maybe finish the promise now in case we didn't find any matching clients.
+  promiseList->MaybeFinish();
+
+  return promiseList->GetResultPromise();
+}
+
+RefPtr<ClientOpPromise> ClientManagerService::GetInfoAndState(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientGetInfoAndStateArgs& aArgs) {
+  ClientSourceParent* source =
+      FindExistingSource(aArgs.id(), aArgs.principalInfo());
+
+  if (!source) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Unknown client");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+
+  if (!source->ExecutionReady()) {
+    RefPtr<ClientManagerService> self = this;
+
+    // rejection ultimately converted to `undefined` in Clients::Get
+    return source->ExecutionReadyPromise()->Then(
+        GetCurrentSerialEventTarget(), __func__,
+        [self = std::move(self), aArgs]() -> RefPtr<ClientOpPromise> {
+          ClientSourceParent* source =
+              self->FindExistingSource(aArgs.id(), aArgs.principalInfo());
+
+          if (!source) {
+            CopyableErrorResult rv;
+            rv.ThrowInvalidStateError("Unknown client");
+            return ClientOpPromise::CreateAndReject(rv, __func__);
+          }
+
+          return source->StartOp(aArgs);
+        });
+  }
+
+  return source->StartOp(aArgs);
+}
+
+RefPtr<ClientOpPromise> ClientManagerService::OpenWindow(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientOpenWindowArgs& aArgs) {
+  return InvokeAsync(GetMainThreadSerialEventTarget(), __func__,
+                     [originContent = RefPtr{aOriginContent}, aArgs]() {
+                       return ClientOpenWindow(originContent, aArgs);
+                     });
+}
+
+bool ClientManagerService::HasWindow(
+    const Maybe<ContentParentId>& aContentParentId,
+    const PrincipalInfo& aPrincipalInfo, const nsID& aClientId) {
+  AssertIsOnBackgroundThread();
+
+  ClientSourceParent* source = FindExistingSource(aClientId, aPrincipalInfo);
+  if (!source) {
+    return false;
+  }
+
+  if (!source->ExecutionReady()) {
+    return false;
+  }
+
+  if (source->Info().Type() != ClientType::Window) {
+    return false;
+  }
+
+  if (aContentParentId && !source->IsOwnedByProcess(aContentParentId.value())) {
+    return false;
+  }
+
+  return true;
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientManagerService.h b/dom/clients/manager/ClientManagerService.h
new file mode 100644
index 0000000000..5d8a4b73f6
--- /dev/null
+++ b/dom/clients/manager/ClientManagerService.h
@@ -0,0 +1,166 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientManagerService_h
+#define _mozilla_dom_ClientManagerService_h
+
+#include "ClientHandleParent.h"
+#include "ClientOpPromise.h"
+#include "mozilla/AlreadyAddRefed.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/Variant.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/dom/ipc/IdType.h"
+#include "nsTHashMap.h"
+#include "nsHashKeys.h"
+#include "nsISupports.h"
+#include "nsTArray.h"
+
+struct nsID;
+
+namespace mozilla {
+
+namespace ipc {
+
+class PrincipalInfo;
+
+}  // namespace ipc
+
+namespace dom {
+
+class ClientManagerParent;
+class ClientSourceParent;
+class ClientHandleParent;
+class ThreadsafeContentParentHandle;
+
+// Define a singleton service to manage client activity throughout the
+// browser.  This service runs on the PBackground thread.  To interact
+// it with it please use the ClientManager and ClientHandle classes.
+class ClientManagerService final {
+  // Placeholder type that represents a ClientSourceParent that may be created
+  // in the future (e.g. while a redirect chain is being resolved).
+  //
+  // Each FutureClientSourceParent has a promise that callbacks may be chained
+  // to; the promise will be resolved when the associated ClientSourceParent is
+  // created or rejected when it's known that it'll never be created.
+  class FutureClientSourceParent {
+   public:
+    explicit FutureClientSourceParent(const IPCClientInfo& aClientInfo);
+
+    const mozilla::ipc::PrincipalInfo& PrincipalInfo() const {
+      return mPrincipalInfo;
+    }
+
+    already_AddRefed<SourcePromise> Promise() {
+      return mPromiseHolder.Ensure(__func__);
+    }
+
+    void ResolvePromiseIfExists() {
+      mPromiseHolder.ResolveIfExists(true, __func__);
+    }
+
+    void RejectPromiseIfExists(const CopyableErrorResult& aRv) {
+      MOZ_ASSERT(aRv.Failed());
+      mPromiseHolder.RejectIfExists(aRv, __func__);
+    }
+
+    void SetAsAssociated() { mAssociated = true; }
+
+    bool IsAssociated() const { return mAssociated; }
+
+   private:
+    const mozilla::ipc::PrincipalInfo mPrincipalInfo;
+    MozPromiseHolder<SourcePromise> mPromiseHolder;
+    RefPtr<ClientManagerService> mService = ClientManagerService::GetInstance();
+    bool mAssociated;
+  };
+
+  using SourceTableEntry =
+      Variant<FutureClientSourceParent, ClientSourceParent*>;
+
+  // Store the possible ClientSourceParent objects in a hash table.  We want to
+  // optimize for insertion, removal, and lookup by UUID.
+  nsTHashMap<nsIDHashKey, SourceTableEntry> mSourceTable;
+
+  nsTArray<ClientManagerParent*> mManagerList;
+
+  bool mShutdown;
+
+  ClientManagerService();
+  ~ClientManagerService();
+
+  void Shutdown();
+
+  // Returns nullptr if aEntry isn't a ClientSourceParent (i.e. it's a
+  // FutureClientSourceParent).
+  ClientSourceParent* MaybeUnwrapAsExistingSource(
+      const SourceTableEntry& aEntry) const;
+
+ public:
+  static already_AddRefed<ClientManagerService> GetOrCreateInstance();
+
+  // Returns nullptr if the service is not already created.
+  static already_AddRefed<ClientManagerService> GetInstance();
+
+  bool AddSource(ClientSourceParent* aSource);
+
+  bool RemoveSource(ClientSourceParent* aSource);
+
+  // Returns true when a FutureClientSourceParent is successfully added.
+  bool ExpectFutureSource(const IPCClientInfo& aClientInfo);
+
+  // May still be called if it's possible that the FutureClientSourceParent
+  // no longer exists.
+  void ForgetFutureSource(const IPCClientInfo& aClientInfo);
+
+  // Returns a promise that resolves if/when the ClientSourceParent exists and
+  // rejects if/when it's known that the ClientSourceParent will never exist or
+  // if it's frozen. Note that the ClientSourceParent may not exist anymore
+  // by the time promise callbacks run.
+  RefPtr<SourcePromise> FindSource(
+      const nsID& aID, const mozilla::ipc::PrincipalInfo& aPrincipalInfo);
+
+  // Returns nullptr if the ClientSourceParent doesn't exist yet (i.e. it's a
+  // FutureClientSourceParent or has already been destroyed) or is frozen.
+  ClientSourceParent* FindExistingSource(
+      const nsID& aID, const mozilla::ipc::PrincipalInfo& aPrincipalInfo) const;
+
+  void AddManager(ClientManagerParent* aManager);
+
+  void RemoveManager(ClientManagerParent* aManager);
+
+  RefPtr<ClientOpPromise> Navigate(
+      ThreadsafeContentParentHandle* aOriginContent,
+      const ClientNavigateArgs& aArgs);
+
+  RefPtr<ClientOpPromise> MatchAll(
+      ThreadsafeContentParentHandle* aOriginContent,
+      const ClientMatchAllArgs& aArgs);
+
+  RefPtr<ClientOpPromise> Claim(ThreadsafeContentParentHandle* aOriginContent,
+                                const ClientClaimArgs& aArgs);
+
+  RefPtr<ClientOpPromise> GetInfoAndState(
+      ThreadsafeContentParentHandle* aOriginContent,
+      const ClientGetInfoAndStateArgs& aArgs);
+
+  RefPtr<ClientOpPromise> OpenWindow(
+      ThreadsafeContentParentHandle* aOriginContent,
+      const ClientOpenWindowArgs& aArgs);
+
+  bool HasWindow(const Maybe<ContentParentId>& aContentParentId,
+                 const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
+                 const nsID& aClientId);
+
+  NS_INLINE_DECL_REFCOUNTING(mozilla::dom::ClientManagerService)
+};
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientManagerService_h
diff --git a/dom/clients/manager/ClientNavigateOpChild.cpp b/dom/clients/manager/ClientNavigateOpChild.cpp
new file mode 100644
index 0000000000..b1fd5fb36f
--- /dev/null
+++ b/dom/clients/manager/ClientNavigateOpChild.cpp
@@ -0,0 +1,334 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientNavigateOpChild.h"
+
+#include "ClientState.h"
+#include "ClientSource.h"
+#include "ClientSourceChild.h"
+#include "mozilla/dom/Document.h"
+#include "mozilla/Unused.h"
+#include "nsIDocShell.h"
+#include "nsDocShellLoadState.h"
+#include "nsIWebNavigation.h"
+#include "nsIWebProgress.h"
+#include "nsIWebProgressListener.h"
+#include "nsNetUtil.h"
+#include "nsPIDOMWindow.h"
+#include "nsURLHelper.h"
+#include "ReferrerInfo.h"
+
+namespace mozilla::dom {
+
+namespace {
+
+class NavigateLoadListener final : public nsIWebProgressListener,
+                                   public nsSupportsWeakReference {
+  RefPtr<ClientOpPromise::Private> mPromise;
+  RefPtr<nsPIDOMWindowOuter> mOuterWindow;
+  nsCOMPtr<nsIURI> mBaseURL;
+
+  ~NavigateLoadListener() = default;
+
+ public:
+  NavigateLoadListener(ClientOpPromise::Private* aPromise,
+                       nsPIDOMWindowOuter* aOuterWindow, nsIURI* aBaseURL)
+      : mPromise(aPromise), mOuterWindow(aOuterWindow), mBaseURL(aBaseURL) {
+    MOZ_DIAGNOSTIC_ASSERT(mPromise);
+    MOZ_DIAGNOSTIC_ASSERT(mOuterWindow);
+    MOZ_DIAGNOSTIC_ASSERT(mBaseURL);
+  }
+
+  NS_IMETHOD
+  OnStateChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                uint32_t aStateFlags, nsresult aResult) override {
+    if (!(aStateFlags & STATE_IS_DOCUMENT) ||
+        !(aStateFlags & (STATE_STOP | STATE_TRANSFERRING))) {
+      return NS_OK;
+    }
+
+    aWebProgress->RemoveProgressListener(this);
+
+    nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
+    if (!channel) {
+      // This is not going to happen; how could it?
+      CopyableErrorResult result;
+      result.ThrowInvalidStateError("Bad request");
+      mPromise->Reject(result, __func__);
+      return NS_OK;
+    }
+
+    nsCOMPtr<nsIURI> channelURL;
+    nsresult rv = NS_GetFinalChannelURI(channel, getter_AddRefs(channelURL));
+    if (NS_FAILED(rv)) {
+      CopyableErrorResult result;
+      // XXXbz We can't actually get here; NS_GetFinalChannelURI never fails in
+      // practice!
+      result.Throw(rv);
+      mPromise->Reject(result, __func__);
+      return NS_OK;
+    }
+
+    nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
+    MOZ_DIAGNOSTIC_ASSERT(ssm);
+
+    // If the resulting window is not same origin, then resolve immediately
+    // without returning any information about the new Client.  This is
+    // step 6.10 in the Client.navigate(url) spec.
+    // todo: if you intend to update CheckSameOriginURI to log the error to the
+    // console you also need to update the 'aFromPrivateWindow' argument.
+    rv = ssm->CheckSameOriginURI(mBaseURL, channelURL, false, false);
+    if (NS_FAILED(rv)) {
+      mPromise->Resolve(CopyableErrorResult(), __func__);
+      return NS_OK;
+    }
+
+    nsPIDOMWindowInner* innerWindow = mOuterWindow->GetCurrentInnerWindow();
+    MOZ_DIAGNOSTIC_ASSERT(innerWindow);
+
+    Maybe<ClientInfo> clientInfo = innerWindow->GetClientInfo();
+    MOZ_DIAGNOSTIC_ASSERT(clientInfo.isSome());
+
+    Maybe<ClientState> clientState = innerWindow->GetClientState();
+    MOZ_DIAGNOSTIC_ASSERT(clientState.isSome());
+
+    // Otherwise, if the new window is same-origin we want to return a
+    // ClientInfoAndState object so we can provide a Client snapshot
+    // to the caller.  This is step 6.11 and 6.12 in the Client.navigate(url)
+    // spec.
+    mPromise->Resolve(
+        ClientInfoAndState(clientInfo.ref().ToIPC(), clientState.ref().ToIPC()),
+        __func__);
+
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnProgressChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   int32_t aCurSelfProgress, int32_t aMaxSelfProgress,
+                   int32_t aCurTotalProgress,
+                   int32_t aMaxTotalProgress) override {
+    MOZ_CRASH("Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnLocationChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   nsIURI* aLocation, uint32_t aFlags) override {
+    MOZ_CRASH("Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnStatusChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                 nsresult aStatus, const char16_t* aMessage) override {
+    MOZ_CRASH("Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnSecurityChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   uint32_t aState) override {
+    MOZ_CRASH("Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnContentBlockingEvent(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                         uint32_t aEvent) override {
+    MOZ_CRASH("Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_DECL_ISUPPORTS
+};
+
+NS_IMPL_ISUPPORTS(NavigateLoadListener, nsIWebProgressListener,
+                  nsISupportsWeakReference);
+
+}  // anonymous namespace
+
+RefPtr<ClientOpPromise> ClientNavigateOpChild::DoNavigate(
+    const ClientNavigateOpConstructorArgs& aArgs) {
+  nsCOMPtr<nsPIDOMWindowInner> window;
+
+  // Navigating the target client window will result in the original
+  // ClientSource being destroyed.  To avoid potential UAF mistakes
+  // we use a small scope to access the ClientSource object.  Once
+  // we have a strong reference to the window object we should not
+  // access the ClientSource again.
+  {
+    ClientSourceChild* targetActor =
+        static_cast<ClientSourceChild*>(aArgs.target().AsChild().get());
+    MOZ_DIAGNOSTIC_ASSERT(targetActor);
+
+    ClientSource* target = targetActor->GetSource();
+    if (!target) {
+      CopyableErrorResult rv;
+      rv.ThrowInvalidStateError("Unknown Client");
+      return ClientOpPromise::CreateAndReject(rv, __func__);
+    }
+
+    window = target->GetInnerWindow();
+    if (!window) {
+      CopyableErrorResult rv;
+      rv.ThrowInvalidStateError("Client load for a destroyed Window");
+      return ClientOpPromise::CreateAndReject(rv, __func__);
+    }
+  }
+
+  MOZ_ASSERT(NS_IsMainThread());
+
+  mSerialEventTarget = window->EventTargetFor(TaskCategory::Other);
+
+  // In theory we could do the URL work before paying the IPC overhead
+  // cost, but in practice its easier to do it here.  The ClientHandle
+  // may be off-main-thread while this method is guaranteed to always
+  // be main thread.
+  nsCOMPtr<nsIURI> baseURL;
+  nsresult rv = NS_NewURI(getter_AddRefs(baseURL), aArgs.baseURL());
+  if (NS_FAILED(rv)) {
+    // This is rather unexpected: This is the worker URL we passed from the
+    // parent, so we expect this to parse fine!
+    CopyableErrorResult result;
+    result.ThrowInvalidStateError("Invalid worker URL");
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  // There is an edge case for view-source url here. According to the wpt test
+  // windowclient-navigate.https.html, a view-source URL with a relative inner
+  // URL should be treated as an invalid URL. However, we will still resolve it
+  // into a valid view-source URL since the baseURL is involved while creating
+  // the URI. So, an invalid view-source URL will be treated as a valid URL
+  // in this case. To address this, we should not take the baseURL into account
+  // for the view-source URL.
+  bool shouldUseBaseURL = true;
+  nsAutoCString scheme;
+  if (NS_SUCCEEDED(net_ExtractURLScheme(aArgs.url(), scheme)) &&
+      scheme.LowerCaseEqualsLiteral("view-source")) {
+    shouldUseBaseURL = false;
+  }
+
+  nsCOMPtr<nsIURI> url;
+  rv = NS_NewURI(getter_AddRefs(url), aArgs.url(), nullptr,
+                 shouldUseBaseURL ? baseURL.get() : nullptr);
+  if (NS_FAILED(rv)) {
+    // Per https://w3c.github.io/ServiceWorker/#dom-windowclient-navigate step
+    // 2, if the URL fails to parse, we reject with a TypeError.
+    nsPrintfCString err("Invalid URL \"%s\"", aArgs.url().get());
+    CopyableErrorResult result;
+    result.ThrowTypeError(err);
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  if (url->GetSpecOrDefault().EqualsLiteral("about:blank")) {
+    CopyableErrorResult result;
+    result.ThrowTypeError("Navigation to \"about:blank\" is not allowed");
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  RefPtr<Document> doc = window->GetExtantDoc();
+  if (!doc || !doc->IsActive()) {
+    CopyableErrorResult result;
+    result.ThrowInvalidStateError("Document is not active.");
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  nsCOMPtr<nsIPrincipal> principal = doc->NodePrincipal();
+
+  nsCOMPtr<nsIDocShell> docShell = window->GetDocShell();
+  nsCOMPtr<nsIWebProgress> webProgress = do_GetInterface(docShell);
+  if (!docShell || !webProgress) {
+    CopyableErrorResult result;
+    result.ThrowInvalidStateError(
+        "Document's browsing context has been discarded");
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  RefPtr<nsDocShellLoadState> loadState = new nsDocShellLoadState(url);
+  loadState->SetTriggeringPrincipal(principal);
+  loadState->SetTriggeringSandboxFlags(doc->GetSandboxFlags());
+  loadState->SetCsp(doc->GetCsp());
+
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
+  loadState->SetReferrerInfo(referrerInfo);
+  loadState->SetLoadType(LOAD_STOP_CONTENT);
+  loadState->SetSourceBrowsingContext(docShell->GetBrowsingContext());
+  loadState->SetLoadFlags(nsIWebNavigation::LOAD_FLAGS_NONE);
+  loadState->SetFirstParty(true);
+  loadState->SetHasValidUserGestureActivation(
+      doc->HasValidTransientUserGestureActivation());
+  rv = docShell->LoadURI(loadState, false);
+  if (NS_FAILED(rv)) {
+    /// There are tests that try sending file:/// and mixed-content URLs
+    /// in here and expect them to reject with a TypeError.  This does not match
+    /// the spec, but does match the current behavior of both us and Chrome.
+    /// https://github.com/w3c/ServiceWorker/issues/1500 tracks sorting that
+    /// out.
+    /// We now run security checks asynchronously, so these tests now
+    /// just fail to load rather than hitting this failure path. I've
+    /// marked them as failing for now until they get fixed to match the
+    /// spec.
+    nsPrintfCString err("Invalid URL \"%s\"", aArgs.url().get());
+    CopyableErrorResult result;
+    result.ThrowTypeError(err);
+    return ClientOpPromise::CreateAndReject(result, __func__);
+  }
+
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  nsCOMPtr<nsIWebProgressListener> listener =
+      new NavigateLoadListener(promise, window->GetOuterWindow(), baseURL);
+
+  rv = webProgress->AddProgressListener(listener,
+                                        nsIWebProgress::NOTIFY_STATE_DOCUMENT);
+  if (NS_FAILED(rv)) {
+    CopyableErrorResult result;
+    // XXXbz Can we throw something better here?
+    result.Throw(rv);
+    promise->Reject(result, __func__);
+    return promise;
+  }
+
+  return promise->Then(
+      mSerialEventTarget, __func__,
+      [listener](const ClientOpPromise::ResolveOrRejectValue& aValue) {
+        return ClientOpPromise::CreateAndResolveOrReject(aValue, __func__);
+      });
+}
+
+void ClientNavigateOpChild::ActorDestroy(ActorDestroyReason aReason) {
+  mPromiseRequestHolder.DisconnectIfExists();
+}
+
+void ClientNavigateOpChild::Init(const ClientNavigateOpConstructorArgs& aArgs) {
+  RefPtr<ClientOpPromise> promise = DoNavigate(aArgs);
+
+  // Normally we get the event target from the window in DoNavigate().  If a
+  // failure occurred, though, we may need to fall back to the current thread
+  // target.
+  if (!mSerialEventTarget) {
+    mSerialEventTarget = GetCurrentSerialEventTarget();
+  }
+
+  // Capturing `this` is safe here since we clear the mPromiseRequestHolder in
+  // ActorDestroy.
+  promise
+      ->Then(
+          mSerialEventTarget, __func__,
+          [this](const ClientOpResult& aResult) {
+            mPromiseRequestHolder.Complete();
+            PClientNavigateOpChild::Send__delete__(this, aResult);
+          },
+          [this](const CopyableErrorResult& aResult) {
+            mPromiseRequestHolder.Complete();
+            PClientNavigateOpChild::Send__delete__(this, aResult);
+          })
+      ->Track(mPromiseRequestHolder);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientNavigateOpChild.h b/dom/clients/manager/ClientNavigateOpChild.h
new file mode 100644
index 0000000000..9f48748b9a
--- /dev/null
+++ b/dom/clients/manager/ClientNavigateOpChild.h
@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientNavigateOpChild_h
+#define _mozilla_dom_ClientNavigateOpChild_h
+
+#include "mozilla/dom/PClientNavigateOpChild.h"
+#include "ClientOpPromise.h"
+
+namespace mozilla::dom {
+
+class ClientNavigateOpChild final : public PClientNavigateOpChild {
+  MozPromiseRequestHolder<ClientOpPromise> mPromiseRequestHolder;
+  nsCOMPtr<nsISerialEventTarget> mSerialEventTarget;
+
+  [[nodiscard]] RefPtr<ClientOpPromise> DoNavigate(
+      const ClientNavigateOpConstructorArgs& aArgs);
+
+  // PClientNavigateOpChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+ public:
+  ClientNavigateOpChild() = default;
+  ~ClientNavigateOpChild() = default;
+
+  void Init(const ClientNavigateOpConstructorArgs& aArgs);
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientNavigateOpChild_h
diff --git a/dom/clients/manager/ClientNavigateOpParent.cpp b/dom/clients/manager/ClientNavigateOpParent.cpp
new file mode 100644
index 0000000000..2c52d73480
--- /dev/null
+++ b/dom/clients/manager/ClientNavigateOpParent.cpp
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientNavigateOpParent.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+void ClientNavigateOpParent::ActorDestroy(ActorDestroyReason aReason) {
+  if (mPromise) {
+    CopyableErrorResult rv;
+    rv.ThrowAbortError("Client aborted");
+    mPromise->Reject(rv, __func__);
+    mPromise = nullptr;
+  }
+}
+
+IPCResult ClientNavigateOpParent::Recv__delete__(
+    const ClientOpResult& aResult) {
+  if (aResult.type() == ClientOpResult::TCopyableErrorResult &&
+      aResult.get_CopyableErrorResult().Failed()) {
+    mPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+    mPromise = nullptr;
+    return IPC_OK();
+  }
+  mPromise->Resolve(aResult, __func__);
+  mPromise = nullptr;
+  return IPC_OK();
+}
+
+ClientNavigateOpParent::ClientNavigateOpParent(
+    const ClientNavigateOpConstructorArgs& aArgs,
+    ClientOpPromise::Private* aPromise)
+    : mPromise(aPromise) {
+  MOZ_DIAGNOSTIC_ASSERT(mPromise);
+}
+
+ClientNavigateOpParent::~ClientNavigateOpParent() {
+  MOZ_DIAGNOSTIC_ASSERT(!mPromise);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientNavigateOpParent.h b/dom/clients/manager/ClientNavigateOpParent.h
new file mode 100644
index 0000000000..c1a226dcbc
--- /dev/null
+++ b/dom/clients/manager/ClientNavigateOpParent.h
@@ -0,0 +1,32 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientNavigateOpParent_h
+#define _mozilla_dom_ClientNavigateOpParent_h
+
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/PClientNavigateOpParent.h"
+
+namespace mozilla::dom {
+
+class ClientNavigateOpParent final : public PClientNavigateOpParent {
+  RefPtr<ClientOpPromise::Private> mPromise;
+
+  // PClientNavigateOpParent interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  mozilla::ipc::IPCResult Recv__delete__(
+      const ClientOpResult& aResult) override;
+
+ public:
+  ClientNavigateOpParent(const ClientNavigateOpConstructorArgs& aArgs,
+                         ClientOpPromise::Private* aPromise);
+
+  ~ClientNavigateOpParent();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientNavigateOpParent_h
diff --git a/dom/clients/manager/ClientOpPromise.h b/dom/clients/manager/ClientOpPromise.h
new file mode 100644
index 0000000000..b838e04d1f
--- /dev/null
+++ b/dom/clients/manager/ClientOpPromise.h
@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientOpPromise_h
+#define _mozilla_dom_ClientOpPromise_h
+
+#include "mozilla/MozPromise.h"
+
+namespace mozilla {
+class CopyableErrorResult;
+
+namespace dom {
+
+class ClientOpResult;
+class ClientState;
+
+using ClientOpPromise = MozPromise<ClientOpResult, CopyableErrorResult, false>;
+
+using ClientStatePromise = MozPromise<ClientState, CopyableErrorResult, false>;
+
+using GenericErrorResultPromise =
+    MozPromise<bool, CopyableErrorResult, /* IsExclusive = */ true>;
+
+using ClientOpCallback = std::function<void(const ClientOpResult&)>;
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientOpPromise_h
diff --git a/dom/clients/manager/ClientOpenWindowUtils.cpp b/dom/clients/manager/ClientOpenWindowUtils.cpp
new file mode 100644
index 0000000000..e741a266fd
--- /dev/null
+++ b/dom/clients/manager/ClientOpenWindowUtils.cpp
@@ -0,0 +1,464 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientOpenWindowUtils.h"
+
+#include "ClientInfo.h"
+#include "ClientManager.h"
+#include "ClientState.h"
+#include "mozilla/ResultExtensions.h"
+#include "mozilla/dom/ContentParent.h"
+#include "nsContentUtils.h"
+#include "nsDocShell.h"
+#include "nsDocShellLoadState.h"
+#include "nsFocusManager.h"
+#include "nsIBrowserDOMWindow.h"
+#include "nsIDocShell.h"
+#include "nsIDocShellTreeOwner.h"
+#include "nsIDOMChromeWindow.h"
+#include "nsIURI.h"
+#include "nsIBrowser.h"
+#include "nsIWebProgress.h"
+#include "nsIWebProgressListener.h"
+#include "nsIWindowWatcher.h"
+#include "nsIXPConnect.h"
+#include "nsNetUtil.h"
+#include "nsPIDOMWindow.h"
+#include "nsPIWindowWatcher.h"
+#include "nsPrintfCString.h"
+#include "nsWindowWatcher.h"
+#include "nsOpenWindowInfo.h"
+
+#include "mozilla/dom/BrowserParent.h"
+#include "mozilla/dom/BrowsingContext.h"
+#include "mozilla/dom/CanonicalBrowsingContext.h"
+#include "mozilla/dom/nsCSPContext.h"
+#include "mozilla/dom/WindowGlobalParent.h"
+
+#ifdef MOZ_WIDGET_ANDROID
+#  include "mozilla/java/GeckoResultWrappers.h"
+#  include "mozilla/java/GeckoRuntimeWrappers.h"
+#endif
+
+namespace mozilla::dom {
+
+namespace {
+
+class WebProgressListener final : public nsIWebProgressListener,
+                                  public nsSupportsWeakReference {
+ public:
+  NS_DECL_ISUPPORTS
+
+  WebProgressListener(BrowsingContext* aBrowsingContext, nsIURI* aBaseURI,
+                      already_AddRefed<ClientOpPromise::Private> aPromise)
+      : mPromise(aPromise),
+        mBaseURI(aBaseURI),
+        mBrowserId(aBrowsingContext->GetBrowserId()) {
+    MOZ_ASSERT(mBrowserId != 0);
+    MOZ_ASSERT(aBaseURI);
+    MOZ_ASSERT(NS_IsMainThread());
+  }
+
+  NS_IMETHOD
+  OnStateChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                uint32_t aStateFlags, nsresult aStatus) override {
+    if (!(aStateFlags & STATE_IS_WINDOW) ||
+        !(aStateFlags & (STATE_STOP | STATE_TRANSFERRING))) {
+      return NS_OK;
+    }
+
+    // Our browsing context may have been discarded before finishing the load,
+    // this is a navigation error.
+    RefPtr<CanonicalBrowsingContext> browsingContext =
+        CanonicalBrowsingContext::Cast(
+            BrowsingContext::GetCurrentTopByBrowserId(mBrowserId));
+    if (!browsingContext || browsingContext->IsDiscarded()) {
+      CopyableErrorResult rv;
+      rv.ThrowInvalidStateError("Unable to open window");
+      mPromise->Reject(rv, __func__);
+      mPromise = nullptr;
+      return NS_OK;
+    }
+
+    // Our caller keeps a strong reference, so it is safe to remove the listener
+    // from the BrowsingContext's nsIWebProgress.
+    auto RemoveListener = [&] {
+      nsCOMPtr<nsIWebProgress> webProgress = browsingContext->GetWebProgress();
+      webProgress->RemoveProgressListener(this);
+    };
+
+    RefPtr<dom::WindowGlobalParent> wgp =
+        browsingContext->GetCurrentWindowGlobal();
+    if (NS_WARN_IF(!wgp)) {
+      CopyableErrorResult rv;
+      rv.ThrowInvalidStateError("Unable to open window");
+      mPromise->Reject(rv, __func__);
+      mPromise = nullptr;
+      RemoveListener();
+      return NS_OK;
+    }
+
+    if (NS_WARN_IF(wgp->IsInitialDocument())) {
+      // This is the load of the initial document, which is not the document we
+      // care about for the purposes of checking same-originness of the URL.
+      return NS_OK;
+    }
+
+    RemoveListener();
+
+    // Check same origin. If the origins do not match, resolve with null (per
+    // step 7.2.7.1 of the openWindow spec).
+    nsCOMPtr<nsIScriptSecurityManager> securityManager =
+        nsContentUtils::GetSecurityManager();
+    bool isPrivateWin =
+        wgp->DocumentPrincipal()->OriginAttributesRef().mPrivateBrowsingId > 0;
+    nsresult rv = securityManager->CheckSameOriginURI(
+        wgp->GetDocumentURI(), mBaseURI, false, isPrivateWin);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      mPromise->Resolve(CopyableErrorResult(), __func__);
+      mPromise = nullptr;
+      return NS_OK;
+    }
+
+    Maybe<ClientInfo> info = wgp->GetClientInfo();
+    if (info.isNothing()) {
+      CopyableErrorResult rv;
+      rv.ThrowInvalidStateError("Unable to open window");
+      mPromise->Reject(rv, __func__);
+      mPromise = nullptr;
+      return NS_OK;
+    }
+
+    const nsID& id = info.ref().Id();
+    const mozilla::ipc::PrincipalInfo& principal = info.ref().PrincipalInfo();
+    ClientManager::GetInfoAndState(ClientGetInfoAndStateArgs(id, principal),
+                                   GetCurrentSerialEventTarget())
+        ->ChainTo(mPromise.forget(), __func__);
+
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnProgressChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   int32_t aCurSelfProgress, int32_t aMaxSelfProgress,
+                   int32_t aCurTotalProgress,
+                   int32_t aMaxTotalProgress) override {
+    MOZ_ASSERT(false, "Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnLocationChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   nsIURI* aLocation, uint32_t aFlags) override {
+    MOZ_ASSERT(false, "Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnStatusChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                 nsresult aStatus, const char16_t* aMessage) override {
+    MOZ_ASSERT(false, "Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnSecurityChange(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                   uint32_t aState) override {
+    MOZ_ASSERT(false, "Unexpected notification.");
+    return NS_OK;
+  }
+
+  NS_IMETHOD
+  OnContentBlockingEvent(nsIWebProgress* aWebProgress, nsIRequest* aRequest,
+                         uint32_t aEvent) override {
+    MOZ_ASSERT(false, "Unexpected notification.");
+    return NS_OK;
+  }
+
+ private:
+  ~WebProgressListener() {
+    if (mPromise) {
+      CopyableErrorResult rv;
+      rv.ThrowAbortError("openWindow aborted");
+      mPromise->Reject(rv, __func__);
+      mPromise = nullptr;
+    }
+  }
+
+  RefPtr<ClientOpPromise::Private> mPromise;
+  nsCOMPtr<nsIURI> mBaseURI;
+  uint64_t mBrowserId;
+};
+
+NS_IMPL_ISUPPORTS(WebProgressListener, nsIWebProgressListener,
+                  nsISupportsWeakReference);
+
+struct ClientOpenWindowArgsParsed {
+  nsCOMPtr<nsIURI> uri;
+  nsCOMPtr<nsIURI> baseURI;
+  nsCOMPtr<nsIPrincipal> principal;
+  nsCOMPtr<nsIContentSecurityPolicy> csp;
+  RefPtr<ThreadsafeContentParentHandle> originContent;
+};
+
+void OpenWindow(const ClientOpenWindowArgsParsed& aArgsValidated,
+                nsOpenWindowInfo* aOpenInfo, BrowsingContext** aBC,
+                ErrorResult& aRv) {
+  MOZ_DIAGNOSTIC_ASSERT(aBC);
+
+  // [[6.1 Open Window]]
+
+  // Find the most recent browser window and open a new tab in it.
+  nsCOMPtr<nsPIDOMWindowOuter> browserWindow =
+      nsContentUtils::GetMostRecentNonPBWindow();
+  if (!browserWindow) {
+    // It is possible to be running without a browser window on Mac OS, so
+    // we need to open a new chrome window.
+    // TODO(catalinb): open new chrome window. Bug 1218080
+    aRv.ThrowTypeError("Unable to open window");
+    return;
+  }
+
+  nsCOMPtr<nsIDOMChromeWindow> chromeWin = do_QueryInterface(browserWindow);
+  if (NS_WARN_IF(!chromeWin)) {
+    // XXXbz Can this actually happen?  Seems unlikely.
+    aRv.ThrowTypeError("Unable to open window");
+    return;
+  }
+
+  nsCOMPtr<nsIBrowserDOMWindow> bwin;
+  chromeWin->GetBrowserDOMWindow(getter_AddRefs(bwin));
+
+  if (NS_WARN_IF(!bwin)) {
+    aRv.ThrowTypeError("Unable to open window");
+    return;
+  }
+  nsresult rv = bwin->CreateContentWindow(
+      nullptr, aOpenInfo, nsIBrowserDOMWindow::OPEN_DEFAULTWINDOW,
+      nsIBrowserDOMWindow::OPEN_NEW, aArgsValidated.principal,
+      aArgsValidated.csp, aBC);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aRv.ThrowTypeError("Unable to open window");
+    return;
+  }
+}
+
+void WaitForLoad(const ClientOpenWindowArgsParsed& aArgsValidated,
+                 BrowsingContext* aBrowsingContext,
+                 ClientOpPromise::Private* aPromise) {
+  MOZ_DIAGNOSTIC_ASSERT(aBrowsingContext);
+
+  RefPtr<ClientOpPromise::Private> promise = aPromise;
+  // We can get a WebProgress off of
+  // the BrowsingContext for the <xul:browser> to listen for content
+  // events. Note that this WebProgress filters out events which don't have
+  // STATE_IS_NETWORK or STATE_IS_REDIRECTED_DOCUMENT set on them, and so this
+  // listener will only see some web progress events.
+  nsCOMPtr<nsIWebProgress> webProgress =
+      aBrowsingContext->Canonical()->GetWebProgress();
+  if (NS_WARN_IF(!webProgress)) {
+    CopyableErrorResult result;
+    result.ThrowInvalidStateError("Unable to watch window for navigation");
+    promise->Reject(result, __func__);
+    return;
+  }
+
+  // Add a progress listener before we start the load of the service worker URI
+  RefPtr<WebProgressListener> listener = new WebProgressListener(
+      aBrowsingContext, aArgsValidated.baseURI, do_AddRef(promise));
+
+  nsresult rv = webProgress->AddProgressListener(
+      listener, nsIWebProgress::NOTIFY_STATE_WINDOW);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    CopyableErrorResult result;
+    // XXXbz Can we throw something better here?
+    result.Throw(rv);
+    promise->Reject(result, __func__);
+    return;
+  }
+
+  // Load the service worker URI
+  RefPtr<nsDocShellLoadState> loadState =
+      new nsDocShellLoadState(aArgsValidated.uri);
+  loadState->SetTriggeringPrincipal(aArgsValidated.principal);
+  loadState->SetFirstParty(true);
+  loadState->SetLoadFlags(
+      nsIWebNavigation::LOAD_FLAGS_DISALLOW_INHERIT_PRINCIPAL);
+  loadState->SetTriggeringRemoteType(
+      aArgsValidated.originContent
+          ? aArgsValidated.originContent->GetRemoteType()
+          : NOT_REMOTE_TYPE);
+
+  rv = aBrowsingContext->LoadURI(loadState, true);
+  if (NS_FAILED(rv)) {
+    CopyableErrorResult result;
+    result.ThrowInvalidStateError("Unable to start the load of the actual URI");
+    promise->Reject(result, __func__);
+    return;
+  }
+
+  // Hold the listener alive until the promise settles.
+  promise->Then(
+      GetMainThreadSerialEventTarget(), __func__,
+      [listener](const ClientOpResult& aResult) {},
+      [listener](const CopyableErrorResult& aResult) {});
+}
+
+#ifdef MOZ_WIDGET_ANDROID
+
+void GeckoViewOpenWindow(const ClientOpenWindowArgsParsed& aArgsValidated,
+                         ClientOpPromise::Private* aPromise) {
+  RefPtr<ClientOpPromise::Private> promise = aPromise;
+
+  // passes the request to open a new window to GeckoView. Allowing the
+  // application to decide how to hand the open window request.
+  nsAutoCString uri;
+  MOZ_ALWAYS_SUCCEEDS(aArgsValidated.uri->GetSpec(uri));
+  auto genericResult = java::GeckoRuntime::ServiceWorkerOpenWindow(uri);
+  auto typedResult = java::GeckoResult::LocalRef(std::move(genericResult));
+
+  // MozPromise containing the ID for the handling GeckoSession
+  auto promiseResult =
+      mozilla::MozPromise<nsString, nsString, false>::FromGeckoResult(
+          typedResult);
+
+  promiseResult->Then(
+      GetMainThreadSerialEventTarget(), __func__,
+      [aArgsValidated, promise](nsString sessionId) {
+        // Retrieve the primary content BrowsingContext using the GeckoSession
+        // ID. The chrome window is named the same as the ID of the GeckoSession
+        // it is associated with.
+        RefPtr<BrowsingContext> browsingContext;
+        nsresult rv = [&sessionId, &browsingContext]() -> nsresult {
+          nsresult rv;
+          nsCOMPtr<nsIWindowWatcher> wwatch =
+              do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
+          NS_ENSURE_SUCCESS(rv, rv);
+          nsCOMPtr<mozIDOMWindowProxy> chromeWindow;
+          rv = wwatch->GetWindowByName(sessionId, getter_AddRefs(chromeWindow));
+          NS_ENSURE_SUCCESS(rv, rv);
+          NS_ENSURE_TRUE(chromeWindow, NS_ERROR_FAILURE);
+          nsCOMPtr<nsIDocShellTreeOwner> treeOwner =
+              nsPIDOMWindowOuter::From(chromeWindow)->GetTreeOwner();
+          NS_ENSURE_TRUE(treeOwner, NS_ERROR_FAILURE);
+          rv = treeOwner->GetPrimaryContentBrowsingContext(
+              getter_AddRefs(browsingContext));
+          NS_ENSURE_SUCCESS(rv, rv);
+          NS_ENSURE_TRUE(browsingContext, NS_ERROR_FAILURE);
+          return NS_OK;
+        }();
+        if (NS_WARN_IF(NS_FAILED(rv))) {
+          promise->Reject(rv, __func__);
+          return rv;
+        }
+
+        WaitForLoad(aArgsValidated, browsingContext, promise);
+        return NS_OK;
+      },
+      [promise](nsString aResult) {
+        promise->Reject(NS_ERROR_FAILURE, __func__);
+      });
+}
+
+#endif  // MOZ_WIDGET_ANDROID
+
+}  // anonymous namespace
+
+RefPtr<ClientOpPromise> ClientOpenWindow(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientOpenWindowArgs& aArgs) {
+  MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess());
+
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  // [[1. Let url be the result of parsing url with entry settings object's API
+  //   base URL.]]
+  nsCOMPtr<nsIURI> baseURI;
+  nsresult rv = NS_NewURI(getter_AddRefs(baseURI), aArgs.baseURL());
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    nsPrintfCString err("Invalid base URL \"%s\"", aArgs.baseURL().get());
+    CopyableErrorResult errResult;
+    errResult.ThrowTypeError(err);
+    promise->Reject(errResult, __func__);
+    return promise;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  rv = NS_NewURI(getter_AddRefs(uri), aArgs.url(), nullptr, baseURI);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    nsPrintfCString err("Invalid URL \"%s\"", aArgs.url().get());
+    CopyableErrorResult errResult;
+    errResult.ThrowTypeError(err);
+    promise->Reject(errResult, __func__);
+    return promise;
+  }
+
+  auto principalOrErr = PrincipalInfoToPrincipal(aArgs.principalInfo());
+  if (NS_WARN_IF(principalOrErr.isErr())) {
+    CopyableErrorResult errResult;
+    errResult.ThrowTypeError("Failed to obtain principal");
+    promise->Reject(errResult, __func__);
+    return promise;
+  }
+  nsCOMPtr<nsIPrincipal> principal = principalOrErr.unwrap();
+  MOZ_DIAGNOSTIC_ASSERT(principal);
+
+  nsCOMPtr<nsIContentSecurityPolicy> csp;
+  if (aArgs.cspInfo().isSome()) {
+    csp = CSPInfoToCSP(aArgs.cspInfo().ref(), nullptr);
+  }
+  ClientOpenWindowArgsParsed argsValidated{
+      .uri = uri,
+      .baseURI = baseURI,
+      .principal = principal,
+      .csp = csp,
+      .originContent = aOriginContent,
+  };
+
+#ifdef MOZ_WIDGET_ANDROID
+  // If we are on Android we are GeckoView.
+  GeckoViewOpenWindow(argsValidated, promise);
+  return promise.forget();
+#endif  // MOZ_WIDGET_ANDROID
+
+  RefPtr<BrowsingContextCallbackReceivedPromise::Private>
+      browsingContextReadyPromise =
+          new BrowsingContextCallbackReceivedPromise::Private(__func__);
+  RefPtr<nsIBrowsingContextReadyCallback> callback =
+      new nsBrowsingContextReadyCallback(browsingContextReadyPromise);
+
+  RefPtr<nsOpenWindowInfo> openInfo = new nsOpenWindowInfo();
+  openInfo->mBrowsingContextReadyCallback = callback;
+  openInfo->mOriginAttributes = principal->OriginAttributesRef();
+  openInfo->mIsRemote = true;
+
+  RefPtr<BrowsingContext> bc;
+  ErrorResult errResult;
+  OpenWindow(argsValidated, openInfo, getter_AddRefs(bc), errResult);
+  if (NS_WARN_IF(errResult.Failed())) {
+    promise->Reject(errResult, __func__);
+    return promise;
+  }
+
+  browsingContextReadyPromise->Then(
+      GetCurrentSerialEventTarget(), __func__,
+      [argsValidated, promise](const RefPtr<BrowsingContext>& aBC) {
+        WaitForLoad(argsValidated, aBC, promise);
+      },
+      [promise]() {
+        // in case of failure, reject the original promise
+        CopyableErrorResult result;
+        result.ThrowTypeError("Unable to open window");
+        promise->Reject(result, __func__);
+      });
+  if (bc) {
+    browsingContextReadyPromise->Resolve(bc, __func__);
+  }
+  return promise;
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientOpenWindowUtils.h b/dom/clients/manager/ClientOpenWindowUtils.h
new file mode 100644
index 0000000000..7f404f1311
--- /dev/null
+++ b/dom/clients/manager/ClientOpenWindowUtils.h
@@ -0,0 +1,25 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientOpenWindowUtils_h
+#define _mozilla_dom_ClientOpenWindowUtils_h
+
+#include "ClientOpPromise.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+
+namespace mozilla::dom {
+
+class ThreadsafeContentParentHandle;
+
+using BrowsingContextCallbackReceivedPromise =
+    MozPromise<RefPtr<BrowsingContext>, CopyableErrorResult, false>;
+
+[[nodiscard]] RefPtr<ClientOpPromise> ClientOpenWindow(
+    ThreadsafeContentParentHandle* aOriginContent,
+    const ClientOpenWindowArgs& aArgs);
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientOpenWindowUtils_h
diff --git a/dom/clients/manager/ClientPrincipalUtils.cpp b/dom/clients/manager/ClientPrincipalUtils.cpp
new file mode 100644
index 0000000000..25a25b2ee9
--- /dev/null
+++ b/dom/clients/manager/ClientPrincipalUtils.cpp
@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientPrincipalUtils.h"
+
+#include "mozilla/ipc/PBackgroundSharedTypes.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::ContentPrincipalInfo;
+using mozilla::ipc::PrincipalInfo;
+
+bool ClientMatchPrincipalInfo(const PrincipalInfo& aLeft,
+                              const PrincipalInfo& aRight) {
+  if (aLeft.type() != aRight.type()) {
+    return false;
+  }
+
+  switch (aLeft.type()) {
+    case PrincipalInfo::TContentPrincipalInfo: {
+      const ContentPrincipalInfo& leftContent =
+          aLeft.get_ContentPrincipalInfo();
+      const ContentPrincipalInfo& rightContent =
+          aRight.get_ContentPrincipalInfo();
+      return leftContent.attrs() == rightContent.attrs() &&
+             leftContent.originNoSuffix() == rightContent.originNoSuffix();
+    }
+    case PrincipalInfo::TSystemPrincipalInfo: {
+      // system principal always matches
+      return true;
+    }
+    case PrincipalInfo::TNullPrincipalInfo: {
+      // null principal never matches
+      return false;
+    }
+    default: {
+      break;
+    }
+  }
+
+  // Clients (windows/workers) should never have an expanded principal type.
+  MOZ_CRASH("unexpected principal type!");
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientPrincipalUtils.h b/dom/clients/manager/ClientPrincipalUtils.h
new file mode 100644
index 0000000000..2f8aa92123
--- /dev/null
+++ b/dom/clients/manager/ClientPrincipalUtils.h
@@ -0,0 +1,23 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientPrincipaltils_h
+#define _mozilla_dom_ClientPrincipaltils_h
+
+namespace mozilla {
+
+namespace ipc {
+class PrincipalInfo;
+}  // namespace ipc
+
+namespace dom {
+
+bool ClientMatchPrincipalInfo(const mozilla::ipc::PrincipalInfo& aLeft,
+                              const mozilla::ipc::PrincipalInfo& aRight);
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientPrincipalUtils_h
diff --git a/dom/clients/manager/ClientSource.cpp b/dom/clients/manager/ClientSource.cpp
new file mode 100644
index 0000000000..871de5af23
--- /dev/null
+++ b/dom/clients/manager/ClientSource.cpp
@@ -0,0 +1,710 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientSource.h"
+
+#include "ClientManager.h"
+#include "ClientManagerChild.h"
+#include "ClientPrincipalUtils.h"
+#include "ClientSourceChild.h"
+#include "ClientState.h"
+#include "ClientValidation.h"
+#include "mozilla/dom/BlobURLProtocolHandler.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/dom/DOMMozPromiseRequestHolder.h"
+#include "mozilla/dom/ipc/StructuredCloneData.h"
+#include "mozilla/dom/JSExecutionManager.h"
+#include "mozilla/dom/MessageEvent.h"
+#include "mozilla/dom/MessageEventBinding.h"
+#include "mozilla/dom/Navigator.h"
+#include "mozilla/dom/WorkerScope.h"
+#include "mozilla/dom/WorkerRef.h"
+#include "mozilla/dom/ServiceWorker.h"
+#include "mozilla/dom/ServiceWorkerContainer.h"
+#include "mozilla/dom/ServiceWorkerManager.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/StaticPrefs_privacy.h"
+#include "mozilla/StorageAccess.h"
+#include "nsIContentSecurityPolicy.h"
+#include "nsContentUtils.h"
+#include "nsFocusManager.h"
+#include "nsIDocShell.h"
+#include "nsPIDOMWindow.h"
+
+#include "mozilla/ipc/BackgroundUtils.h"
+
+namespace mozilla::dom {
+
+using mozilla::dom::ipc::StructuredCloneData;
+using mozilla::ipc::CSPInfo;
+using mozilla::ipc::CSPToCSPInfo;
+using mozilla::ipc::PrincipalInfo;
+using mozilla::ipc::PrincipalInfoToPrincipal;
+
+void ClientSource::Shutdown() {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (IsShutdown()) {
+    return;
+  }
+
+  ShutdownThing();
+
+  mManager = nullptr;
+}
+
+void ClientSource::ExecutionReady(const ClientSourceExecutionReadyArgs& aArgs) {
+  // Fast fail if we don't understand this particular principal/URL combination.
+  // This can happen since we use MozURL for validation which does not handle
+  // some of the more obscure internal principal/url combinations.  Normal
+  // content pages will pass this check.
+  if (NS_WARN_IF(!ClientIsValidCreationURL(mClientInfo.PrincipalInfo(),
+                                           aArgs.url()))) {
+    Shutdown();
+    return;
+  }
+
+  mClientInfo.SetURL(aArgs.url());
+  mClientInfo.SetFrameType(aArgs.frameType());
+  MaybeExecute([aArgs](PClientSourceChild* aActor) {
+    aActor->SendExecutionReady(aArgs);
+  });
+}
+
+Result<ClientState, ErrorResult> ClientSource::SnapshotWindowState() {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsPIDOMWindowInner* window = GetInnerWindow();
+  if (!window || !window->IsCurrentInnerWindow() ||
+      !window->HasActiveDocument()) {
+    return ClientState(ClientWindowState(VisibilityState::Hidden, TimeStamp(),
+                                         StorageAccess::eDeny, false));
+  }
+
+  Document* doc = window->GetExtantDoc();
+  ErrorResult rv;
+  if (NS_WARN_IF(!doc)) {
+    rv.ThrowInvalidStateError("Document not active");
+    return Err(std::move(rv));
+  }
+
+  bool focused = doc->HasFocus(rv);
+  if (NS_WARN_IF(rv.Failed())) {
+    return Err(std::move(rv));
+  }
+
+  StorageAccess storage = StorageAllowedForDocument(doc);
+
+  return ClientState(ClientWindowState(doc->VisibilityState(),
+                                       doc->LastFocusTime(), storage, focused));
+}
+
+WorkerPrivate* ClientSource::GetWorkerPrivate() const {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (!mOwner.is<WorkerPrivate*>()) {
+    return nullptr;
+  }
+  return mOwner.as<WorkerPrivate*>();
+}
+
+nsIDocShell* ClientSource::GetDocShell() const {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (!mOwner.is<nsCOMPtr<nsIDocShell>>()) {
+    return nullptr;
+  }
+  return mOwner.as<nsCOMPtr<nsIDocShell>>();
+}
+
+nsIGlobalObject* ClientSource::GetGlobal() const {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  nsPIDOMWindowInner* win = GetInnerWindow();
+  if (win) {
+    return win->AsGlobal();
+  }
+
+  WorkerPrivate* wp = GetWorkerPrivate();
+  if (wp) {
+    return wp->GlobalScope();
+  }
+
+  // Note, ClientSource objects attached to docshell for conceptual
+  // initial about:blank will get nullptr here.  The caller should
+  // use MaybeCreateIntitialDocument() to create the window before
+  // GetGlobal() if it wants this before.
+
+  return nullptr;
+}
+
+// We want to be explicit about possible invalid states and
+// return them as errors.
+Result<bool, ErrorResult> ClientSource::MaybeCreateInitialDocument() {
+  // If there is not even a docshell, we do not expect to have a document
+  nsIDocShell* docshell = GetDocShell();
+  if (!docshell) {
+    return false;
+  }
+
+  // Force the creation of the initial document if it does not yet exist.
+  if (!docshell->GetDocument()) {
+    ErrorResult rv;
+    rv.ThrowInvalidStateError("No document available.");
+    return Err(std::move(rv));
+  }
+
+  return true;
+}
+
+ClientSource::ClientSource(ClientManager* aManager,
+                           nsISerialEventTarget* aEventTarget,
+                           const ClientSourceConstructorArgs& aArgs)
+    : mManager(aManager),
+      mEventTarget(aEventTarget),
+      mOwner(AsVariant(Nothing())),
+      mClientInfo(aArgs.id(), aArgs.type(), aArgs.principalInfo(),
+                  aArgs.creationTime()) {
+  MOZ_ASSERT(mManager);
+  MOZ_ASSERT(mEventTarget);
+}
+
+void ClientSource::Activate(PClientManagerChild* aActor) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  MOZ_ASSERT(!GetActor());
+
+  if (IsShutdown()) {
+    return;
+  }
+
+  // Fast fail if we don't understand this particular kind of PrincipalInfo.
+  // This can happen since we use MozURL for validation which does not handle
+  // some of the more obscure internal principal/url combinations.  Normal
+  // content pages will pass this check.
+  if (NS_WARN_IF(!ClientIsValidPrincipalInfo(mClientInfo.PrincipalInfo()))) {
+    Shutdown();
+    return;
+  }
+
+  ClientSourceConstructorArgs args(mClientInfo.Id(), mClientInfo.Type(),
+                                   mClientInfo.PrincipalInfo(),
+                                   mClientInfo.CreationTime());
+  PClientSourceChild* actor = aActor->SendPClientSourceConstructor(args);
+  if (!actor) {
+    Shutdown();
+    return;
+  }
+
+  ActivateThing(static_cast<ClientSourceChild*>(actor));
+}
+
+ClientSource::~ClientSource() { Shutdown(); }
+
+nsPIDOMWindowInner* ClientSource::GetInnerWindow() const {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (!mOwner.is<RefPtr<nsPIDOMWindowInner>>()) {
+    return nullptr;
+  }
+  return mOwner.as<RefPtr<nsPIDOMWindowInner>>();
+}
+
+void ClientSource::WorkerExecutionReady(WorkerPrivate* aWorkerPrivate) {
+  MOZ_DIAGNOSTIC_ASSERT(aWorkerPrivate);
+  aWorkerPrivate->AssertIsOnWorkerThread();
+
+  if (IsShutdown()) {
+    return;
+  }
+
+  // A client without access to storage should never be controlled by
+  // a service worker.  Check this here in case we were controlled before
+  // execution ready.  We can't reliably determine what our storage policy
+  // is before execution ready, unfortunately.
+  if (mController.isSome()) {
+    MOZ_DIAGNOSTIC_ASSERT(
+        aWorkerPrivate->StorageAccess() > StorageAccess::ePrivateBrowsing ||
+        (ShouldPartitionStorage(aWorkerPrivate->StorageAccess()) &&
+         StoragePartitioningEnabled(aWorkerPrivate->StorageAccess(),
+                                    aWorkerPrivate->CookieJarSettings())) ||
+        StringBeginsWith(aWorkerPrivate->ScriptURL(), u"blob:"_ns));
+  }
+
+  // Its safe to store the WorkerPrivate* here because the ClientSource
+  // is explicitly destroyed by WorkerPrivate before exiting its run loop.
+  MOZ_DIAGNOSTIC_ASSERT(mOwner.is<Nothing>());
+  mOwner = AsVariant(aWorkerPrivate);
+
+  ClientSourceExecutionReadyArgs args(aWorkerPrivate->GetLocationInfo().mHref,
+                                      FrameType::None);
+
+  ExecutionReady(args);
+}
+
+nsresult ClientSource::WindowExecutionReady(nsPIDOMWindowInner* aInnerWindow) {
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_DIAGNOSTIC_ASSERT(aInnerWindow);
+  MOZ_ASSERT(aInnerWindow->IsCurrentInnerWindow());
+  MOZ_ASSERT(aInnerWindow->HasActiveDocument());
+
+  if (IsShutdown()) {
+    return NS_OK;
+  }
+
+  Document* doc = aInnerWindow->GetExtantDoc();
+  NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
+
+  nsIURI* uri = doc->GetOriginalURI();
+  NS_ENSURE_TRUE(uri, NS_ERROR_UNEXPECTED);
+
+  // Don't use nsAutoCString here since IPC requires a full nsCString anyway.
+  nsCString spec;
+  nsresult rv = uri->GetSpec(spec);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // A client without access to storage should never be controlled by
+  // a service worker.  Check this here in case we were controlled before
+  // execution ready.  We can't reliably determine what our storage policy
+  // is before execution ready, unfortunately.
+  //
+  // Note, explicitly avoid checking storage policy for windows that inherit
+  // service workers from their parent.  If a user opens a controlled window
+  // and then blocks storage, that window will continue to be controlled by
+  // the SW until the window is closed.  Any about:blank or blob URL should
+  // continue to inherit the SW as well.  We need to avoid triggering the
+  // assertion in this corner case.
+#ifdef DEBUG
+  if (mController.isSome()) {
+    auto storageAccess = StorageAllowedForWindow(aInnerWindow);
+    bool isAboutBlankURL = spec.LowerCaseEqualsLiteral("about:blank");
+    bool isBlobURL = StringBeginsWith(spec, "blob:"_ns);
+    bool isStorageAllowed = storageAccess == StorageAccess::eAllow;
+    bool isPartitionEnabled =
+        StoragePartitioningEnabled(storageAccess, doc->CookieJarSettings());
+    MOZ_ASSERT(isAboutBlankURL || isBlobURL || isStorageAllowed ||
+               (StaticPrefs::privacy_partition_serviceWorkers() &&
+                isPartitionEnabled));
+  }
+#endif
+
+  nsPIDOMWindowOuter* outer = aInnerWindow->GetOuterWindow();
+  NS_ENSURE_TRUE(outer, NS_ERROR_UNEXPECTED);
+
+  FrameType frameType = FrameType::Top_level;
+  if (!outer->GetBrowsingContext()->IsTop()) {
+    frameType = FrameType::Nested;
+  } else if (outer->GetBrowsingContext()->HadOriginalOpener()) {
+    frameType = FrameType::Auxiliary;
+  }
+
+  // We should either be setting a window execution ready for the
+  // first time or setting the same window execution ready again.
+  // The secondary calls are due to initial about:blank replacement.
+  MOZ_DIAGNOSTIC_ASSERT(mOwner.is<Nothing>() ||
+                        mOwner.is<nsCOMPtr<nsIDocShell>>() ||
+                        GetInnerWindow() == aInnerWindow);
+
+  // This creates a cycle with the window.  It is broken when
+  // nsGlobalWindow::FreeInnerObjects() deletes the ClientSource.
+  mOwner = AsVariant(RefPtr<nsPIDOMWindowInner>(aInnerWindow));
+
+  ClientSourceExecutionReadyArgs args(spec, frameType);
+  ExecutionReady(args);
+
+  return NS_OK;
+}
+
+nsresult ClientSource::DocShellExecutionReady(nsIDocShell* aDocShell) {
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_DIAGNOSTIC_ASSERT(aDocShell);
+
+  if (IsShutdown()) {
+    return NS_OK;
+  }
+
+  nsPIDOMWindowOuter* outer = aDocShell->GetWindow();
+  if (NS_WARN_IF(!outer)) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  // Note: We don't assert storage access for a controlled client.  If
+  // the about:blank actually gets used then WindowExecutionReady() will
+  // get called which asserts storage access.
+
+  // TODO: dedupe this with WindowExecutionReady
+  FrameType frameType = FrameType::Top_level;
+  if (!outer->GetBrowsingContext()->IsTop()) {
+    frameType = FrameType::Nested;
+  } else if (outer->GetBrowsingContext()->HadOriginalOpener()) {
+    frameType = FrameType::Auxiliary;
+  }
+
+  MOZ_DIAGNOSTIC_ASSERT(mOwner.is<Nothing>());
+
+  // This creates a cycle with the docshell.  It is broken when
+  // nsDocShell::Destroy() deletes the ClientSource.
+  mOwner = AsVariant(nsCOMPtr<nsIDocShell>(aDocShell));
+
+  ClientSourceExecutionReadyArgs args("about:blank"_ns, frameType);
+  ExecutionReady(args);
+
+  return NS_OK;
+}
+
+void ClientSource::Freeze() {
+  MaybeExecute([](PClientSourceChild* aActor) { aActor->SendFreeze(); });
+}
+
+void ClientSource::Thaw() {
+  MaybeExecute([](PClientSourceChild* aActor) { aActor->SendThaw(); });
+}
+
+void ClientSource::EvictFromBFCache() {
+  if (nsCOMPtr<nsPIDOMWindowInner> win = GetInnerWindow()) {
+    win->RemoveFromBFCacheSync();
+  } else if (WorkerPrivate* vp = GetWorkerPrivate()) {
+    vp->EvictFromBFCache();
+  }
+}
+
+RefPtr<ClientOpPromise> ClientSource::EvictFromBFCacheOp() {
+  EvictFromBFCache();
+  return ClientOpPromise::CreateAndResolve(CopyableErrorResult(), __func__);
+}
+
+const ClientInfo& ClientSource::Info() const { return mClientInfo; }
+
+void ClientSource::WorkerSyncPing(WorkerPrivate* aWorkerPrivate) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  MOZ_DIAGNOSTIC_ASSERT(aWorkerPrivate);
+
+  if (IsShutdown()) {
+    return;
+  }
+
+  // We need to make sure the mainthread is unblocked.
+  AutoYieldJSThreadExecution yield;
+
+  MOZ_DIAGNOSTIC_ASSERT(aWorkerPrivate == mManager->GetWorkerPrivate());
+  aWorkerPrivate->AssertIsOnWorkerThread();
+  MOZ_DIAGNOSTIC_ASSERT(GetActor());
+
+  GetActor()->SendWorkerSyncPing();
+}
+
+void ClientSource::SetController(
+    const ServiceWorkerDescriptor& aServiceWorker) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  // We should never have a cross-origin controller.  Since this would be
+  // same-origin policy violation we do a full release assertion here.
+  MOZ_RELEASE_ASSERT(ClientMatchPrincipalInfo(mClientInfo.PrincipalInfo(),
+                                              aServiceWorker.PrincipalInfo()));
+
+  // A client in private browsing mode should never be controlled by
+  // a service worker.  The principal origin attributes should guarantee
+  // this invariant.
+  MOZ_DIAGNOSTIC_ASSERT(!mClientInfo.IsPrivateBrowsing());
+
+  // A client without access to storage should never be controlled a
+  // a service worker.  If we are already execution ready with a real
+  // window or worker, then verify assert the storage policy is correct.
+  //
+  // Note, explicitly avoid checking storage policy for clients that inherit
+  // service workers from their parent.  This basically means blob: URLs
+  // and about:blank windows.
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  if (GetInnerWindow()) {
+    auto storageAccess = StorageAllowedForWindow(GetInnerWindow());
+    bool IsAboutBlankURL = Info().URL().LowerCaseEqualsLiteral("about:blank");
+    bool IsBlobURL = StringBeginsWith(Info().URL(), "blob:"_ns);
+    bool IsStorageAllowed = storageAccess == StorageAccess::eAllow;
+    bool IsPartitionEnabled =
+        GetInnerWindow()->GetExtantDoc()
+            ? StoragePartitioningEnabled(
+                  storageAccess,
+                  GetInnerWindow()->GetExtantDoc()->CookieJarSettings())
+            : false;
+    MOZ_DIAGNOSTIC_ASSERT(IsAboutBlankURL || IsBlobURL || IsStorageAllowed ||
+                          (StaticPrefs::privacy_partition_serviceWorkers() &&
+                           IsPartitionEnabled));
+  } else if (GetWorkerPrivate()) {
+    MOZ_DIAGNOSTIC_ASSERT(
+        GetWorkerPrivate()->StorageAccess() > StorageAccess::ePrivateBrowsing ||
+        StringBeginsWith(GetWorkerPrivate()->ScriptURL(), u"blob:"_ns));
+  }
+#endif
+
+  if (mController.isSome() && mController.ref() == aServiceWorker) {
+    return;
+  }
+
+  mController.reset();
+  mController.emplace(aServiceWorker);
+
+  RefPtr<ServiceWorkerContainer> swc;
+  nsPIDOMWindowInner* window = GetInnerWindow();
+  if (window) {
+    swc = window->Navigator()->ServiceWorker();
+  }
+
+  // TODO: Also self.navigator.serviceWorker on workers when its exposed there
+
+  if (swc && nsContentUtils::IsSafeToRunScript()) {
+    swc->ControllerChanged(IgnoreErrors());
+  }
+}
+
+RefPtr<ClientOpPromise> ClientSource::Control(
+    const ClientControlledArgs& aArgs) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  // Determine if the client is allowed to be controlled.  Currently we
+  // prevent service workers from controlling clients that cannot access
+  // storage.  We exempt this restriction for local URL clients, like
+  // about:blank and blob:, since access to service workers is dictated by their
+  // parent.
+  //
+  // Note, we default to allowing the client to be controlled in the case
+  // where we are not execution ready yet.  This can only happen if the
+  // the non-subresource load is intercepted by a service worker.  Since
+  // ServiceWorkerInterceptController() uses StorageAllowedForChannel()
+  // it should be fine to accept these control messages.
+  //
+  // Its also fine to default to allowing ClientSource attached to a docshell
+  // to be controlled.  These clients represent inital about:blank windows
+  // that do not have an inner window created yet.  We explicitly allow initial
+  // about:blank.
+  bool controlAllowed = true;
+  if (GetInnerWindow()) {
+    // Local URL windows and windows with access to storage can be controlled.
+    auto storageAccess = StorageAllowedForWindow(GetInnerWindow());
+    bool isAboutBlankURL = Info().URL().LowerCaseEqualsLiteral("about:blank");
+    bool isBlobURL = StringBeginsWith(Info().URL(), "blob:"_ns);
+    bool isStorageAllowed = storageAccess == StorageAccess::eAllow;
+    bool isPartitionEnabled =
+        GetInnerWindow()->GetExtantDoc()
+            ? StoragePartitioningEnabled(
+                  storageAccess,
+                  GetInnerWindow()->GetExtantDoc()->CookieJarSettings())
+            : false;
+    controlAllowed =
+        isAboutBlankURL || isBlobURL || isStorageAllowed ||
+        (StaticPrefs::privacy_partition_serviceWorkers() && isPartitionEnabled);
+  } else if (GetWorkerPrivate()) {
+    // Local URL workers and workers with access to storage cna be controlled.
+    controlAllowed =
+        GetWorkerPrivate()->StorageAccess() > StorageAccess::ePrivateBrowsing ||
+        StringBeginsWith(GetWorkerPrivate()->ScriptURL(), u"blob:"_ns);
+  }
+
+  if (NS_WARN_IF(!controlAllowed)) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Client cannot be controlled");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+
+  SetController(ServiceWorkerDescriptor(aArgs.serviceWorker()));
+
+  return ClientOpPromise::CreateAndResolve(CopyableErrorResult(), __func__);
+}
+
+void ClientSource::InheritController(
+    const ServiceWorkerDescriptor& aServiceWorker) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  // Tell the parent-side ClientManagerService that the controller was
+  // inherited.  This is necessary for clients.matchAll() to work properly.
+  // In parent-side intercept mode this will also note the inheritance in
+  // the parent-side SWM.
+  MaybeExecute([aServiceWorker](PClientSourceChild* aActor) {
+    aActor->SendInheritController(ClientControlledArgs(aServiceWorker.ToIPC()));
+  });
+
+  // Finally, record the new controller in our local ClientSource for any
+  // immediate synchronous access.
+  SetController(aServiceWorker);
+}
+
+const Maybe<ServiceWorkerDescriptor>& ClientSource::GetController() const {
+  return mController;
+}
+
+void ClientSource::NoteDOMContentLoaded() {
+  MaybeExecute(
+      [](PClientSourceChild* aActor) { aActor->SendNoteDOMContentLoaded(); });
+}
+
+RefPtr<ClientOpPromise> ClientSource::Focus(const ClientFocusArgs& aArgs) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  if (mClientInfo.Type() != ClientType::Window) {
+    CopyableErrorResult rv;
+    rv.ThrowNotSupportedError("Not a Window client");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+  nsCOMPtr<nsPIDOMWindowOuter> outer;
+  nsPIDOMWindowInner* inner = GetInnerWindow();
+  if (inner) {
+    outer = inner->GetOuterWindow();
+  } else {
+    nsIDocShell* docshell = GetDocShell();
+    if (docshell) {
+      outer = docshell->GetWindow();
+    }
+  }
+
+  if (!outer) {
+    CopyableErrorResult rv;
+    rv.ThrowInvalidStateError("Browsing context discarded");
+    return ClientOpPromise::CreateAndReject(rv, __func__);
+  }
+
+  MOZ_ASSERT(NS_IsMainThread());
+  nsFocusManager::FocusWindow(outer, aArgs.callerType());
+
+  Result<ClientState, ErrorResult> state = SnapshotState();
+  if (state.isErr()) {
+    return ClientOpPromise::CreateAndReject(
+        CopyableErrorResult(state.unwrapErr()), __func__);
+  }
+
+  return ClientOpPromise::CreateAndResolve(state.inspect().ToIPC(), __func__);
+}
+
+RefPtr<ClientOpPromise> ClientSource::PostMessage(
+    const ClientPostMessageArgs& aArgs) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  // TODO: Currently this function only supports clients whose global
+  // object is a Window; it should also support those whose global
+  // object is a WorkerGlobalScope.
+  if (nsPIDOMWindowInner* const window = GetInnerWindow()) {
+    const RefPtr<ServiceWorkerContainer> container =
+        window->Navigator()->ServiceWorker();
+
+    // Note, EvictFromBFCache() may delete the ClientSource object
+    // when bfcache lives in the child process.
+    EvictFromBFCache();
+    container->ReceiveMessage(aArgs);
+    return ClientOpPromise::CreateAndResolve(CopyableErrorResult(), __func__);
+  }
+
+  CopyableErrorResult rv;
+  rv.ThrowNotSupportedError(
+      "postMessage to non-Window clients is not supported yet");
+  return ClientOpPromise::CreateAndReject(rv, __func__);
+}
+
+RefPtr<ClientOpPromise> ClientSource::GetInfoAndState(
+    const ClientGetInfoAndStateArgs& aArgs) {
+  Result<ClientState, ErrorResult> state = SnapshotState();
+  if (state.isErr()) {
+    return ClientOpPromise::CreateAndReject(
+        CopyableErrorResult(state.unwrapErr()), __func__);
+  }
+
+  return ClientOpPromise::CreateAndResolve(
+      ClientInfoAndState(mClientInfo.ToIPC(), state.inspect().ToIPC()),
+      __func__);
+}
+
+Result<ClientState, ErrorResult> ClientSource::SnapshotState() {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+
+  if (mClientInfo.Type() == ClientType::Window) {
+    // If there is a docshell, try to create a document, too.
+    MOZ_TRY(MaybeCreateInitialDocument());
+    // SnapshotWindowState can deal with a missing inner window
+    return SnapshotWindowState();
+  }
+
+  WorkerPrivate* workerPrivate = GetWorkerPrivate();
+  if (!workerPrivate) {
+    ErrorResult rv;
+    rv.ThrowInvalidStateError("Worker terminated");
+    return Err(std::move(rv));
+  }
+
+  return ClientState(ClientWorkerState(workerPrivate->StorageAccess()));
+}
+
+nsISerialEventTarget* ClientSource::EventTarget() const { return mEventTarget; }
+
+void ClientSource::SetCsp(nsIContentSecurityPolicy* aCsp) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (!aCsp) {
+    return;
+  }
+
+  CSPInfo cspInfo;
+  nsresult rv = CSPToCSPInfo(aCsp, &cspInfo);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return;
+  }
+  mClientInfo.SetCspInfo(cspInfo);
+}
+
+void ClientSource::SetPreloadCsp(nsIContentSecurityPolicy* aPreloadCsp) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  if (!aPreloadCsp) {
+    return;
+  }
+
+  CSPInfo cspPreloadInfo;
+  nsresult rv = CSPToCSPInfo(aPreloadCsp, &cspPreloadInfo);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return;
+  }
+  mClientInfo.SetPreloadCspInfo(cspPreloadInfo);
+}
+
+void ClientSource::SetCspInfo(const CSPInfo& aCSPInfo) {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  mClientInfo.SetCspInfo(aCSPInfo);
+}
+
+const Maybe<mozilla::ipc::CSPInfo>& ClientSource::GetCspInfo() {
+  NS_ASSERT_OWNINGTHREAD(ClientSource);
+  return mClientInfo.GetCspInfo();
+}
+
+void ClientSource::Traverse(nsCycleCollectionTraversalCallback& aCallback,
+                            const char* aName, uint32_t aFlags) {
+  if (mOwner.is<RefPtr<nsPIDOMWindowInner>>()) {
+    ImplCycleCollectionTraverse(
+        aCallback, mOwner.as<RefPtr<nsPIDOMWindowInner>>(), aName, aFlags);
+  } else if (mOwner.is<nsCOMPtr<nsIDocShell>>()) {
+    ImplCycleCollectionTraverse(aCallback, mOwner.as<nsCOMPtr<nsIDocShell>>(),
+                                aName, aFlags);
+  }
+}
+
+void ClientSource::NoteCalledRegisterForServiceWorkerScope(
+    const nsACString& aScope) {
+  if (mRegisteringScopeList.Contains(aScope)) {
+    return;
+  }
+  mRegisteringScopeList.AppendElement(aScope);
+}
+
+bool ClientSource::CalledRegisterForServiceWorkerScope(
+    const nsACString& aScope) {
+  return mRegisteringScopeList.Contains(aScope);
+}
+
+nsIPrincipal* ClientSource::GetPrincipal() {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // We only create the principal if necessary because creating a principal is
+  // expensive.
+  if (!mPrincipal) {
+    auto principalOrErr = Info().GetPrincipal();
+    nsCOMPtr<nsIPrincipal> prin =
+        principalOrErr.isOk() ? principalOrErr.unwrap() : nullptr;
+
+    mPrincipal.emplace(prin);
+  }
+
+  return mPrincipal.ref();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientSource.h b/dom/clients/manager/ClientSource.h
new file mode 100644
index 0000000000..dc89a61175
--- /dev/null
+++ b/dom/clients/manager/ClientSource.h
@@ -0,0 +1,193 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientSource_h
+#define _mozilla_dom_ClientSource_h
+
+#include "mozilla/dom/ClientInfo.h"
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/ClientThing.h"
+#include "mozilla/dom/ServiceWorkerDescriptor.h"
+#include "mozilla/ResultVariant.h"
+#include "mozilla/Variant.h"
+
+#ifdef XP_WIN
+#  undef PostMessage
+#endif
+
+class nsIContentSecurityPolicy;
+class nsIDocShell;
+class nsIGlobalObject;
+class nsISerialEventTarget;
+class nsPIDOMWindowInner;
+
+namespace mozilla {
+class ErrorResult;
+
+namespace dom {
+
+class ClientControlledArgs;
+class ClientFocusArgs;
+class ClientGetInfoAndStateArgs;
+class ClientManager;
+class ClientPostMessageArgs;
+class ClientSourceChild;
+class ClientSourceConstructorArgs;
+class ClientSourceExecutionReadyArgs;
+class ClientState;
+class ClientWindowState;
+class PClientManagerChild;
+class WorkerPrivate;
+
+// ClientSource is an RAII style class that is designed to be held via
+// a UniquePtr<>.  When created ClientSource will register the existence
+// of a client in the cross-process ClientManagerService.  When the
+// ClientSource is destroyed then client entry will be removed.  Code
+// that represents globals or browsing environments, such as nsGlobalWindow
+// or WorkerPrivate, should use ClientManager to create a ClientSource.
+class ClientSource final : public ClientThing<ClientSourceChild> {
+  friend class ClientManager;
+
+  NS_DECL_OWNINGTHREAD
+
+  RefPtr<ClientManager> mManager;
+  nsCOMPtr<nsISerialEventTarget> mEventTarget;
+
+  Variant<Nothing, RefPtr<nsPIDOMWindowInner>, nsCOMPtr<nsIDocShell>,
+          WorkerPrivate*>
+      mOwner;
+
+  ClientInfo mClientInfo;
+  Maybe<ServiceWorkerDescriptor> mController;
+  Maybe<nsCOMPtr<nsIPrincipal>> mPrincipal;
+
+  // Contained a de-duplicated list of ServiceWorker scope strings
+  // for which this client has called navigator.serviceWorker.register().
+  // Typically there will be either be zero or one scope strings, but
+  // there could be more.  We keep this list until the client is closed.
+  AutoTArray<nsCString, 1> mRegisteringScopeList;
+
+  void Shutdown();
+
+  void ExecutionReady(const ClientSourceExecutionReadyArgs& aArgs);
+
+  WorkerPrivate* GetWorkerPrivate() const;
+
+  nsIDocShell* GetDocShell() const;
+
+  nsIGlobalObject* GetGlobal() const;
+
+  Result<bool, ErrorResult> MaybeCreateInitialDocument();
+
+  Result<ClientState, ErrorResult> SnapshotWindowState();
+
+  // Private methods called by ClientManager
+  ClientSource(ClientManager* aManager, nsISerialEventTarget* aEventTarget,
+               const ClientSourceConstructorArgs& aArgs);
+
+  void Activate(PClientManagerChild* aActor);
+
+ public:
+  ~ClientSource();
+
+  nsPIDOMWindowInner* GetInnerWindow() const;
+
+  void WorkerExecutionReady(WorkerPrivate* aWorkerPrivate);
+
+  nsresult WindowExecutionReady(nsPIDOMWindowInner* aInnerWindow);
+
+  nsresult DocShellExecutionReady(nsIDocShell* aDocShell);
+
+  void Freeze();
+
+  void Thaw();
+
+  void EvictFromBFCache();
+
+  RefPtr<ClientOpPromise> EvictFromBFCacheOp();
+
+  const ClientInfo& Info() const;
+
+  // Trigger a synchronous IPC ping to the parent process to confirm that
+  // the ClientSource actor has been created.  This should only be used
+  // by the WorkerPrivate startup code to deal with a ClientHandle::Control()
+  // call racing on the main thread.  Do not call this in other circumstances!
+  void WorkerSyncPing(WorkerPrivate* aWorkerPrivate);
+
+  // Synchronously mark the ClientSource as controlled by the given service
+  // worker.  This can happen as a result of a remote operation or directly
+  // by local code.  For example, if a client's initial network load is
+  // intercepted by a controlling service worker then this should be called
+  // immediately.
+  //
+  // Note, there is no way to clear the controlling service worker because
+  // the specification does not allow that operation.
+  void SetController(const ServiceWorkerDescriptor& aServiceWorker);
+
+  // Mark the ClientSource as controlled using the remote operation arguments.
+  // This will in turn call SetController().
+  RefPtr<ClientOpPromise> Control(const ClientControlledArgs& aArgs);
+
+  // Inherit the controller from a local parent client.  This requires both
+  // setting our immediate controller field and also updating the parent-side
+  // data structure.
+  void InheritController(const ServiceWorkerDescriptor& aServiceWorker);
+
+  // Get the ClientSource's current controlling service worker, if one has
+  // been set.
+  const Maybe<ServiceWorkerDescriptor>& GetController() const;
+
+  // Note that the client has reached DOMContentLoaded.  Only applies to window
+  // clients.
+  void NoteDOMContentLoaded();
+
+  // TODO: Convert Focus() to MOZ_CAN_RUN_SCRIPT
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY RefPtr<ClientOpPromise> Focus(
+      const ClientFocusArgs& aArgs);
+
+  RefPtr<ClientOpPromise> PostMessage(const ClientPostMessageArgs& aArgs);
+
+  RefPtr<ClientOpPromise> GetInfoAndState(
+      const ClientGetInfoAndStateArgs& aArgs);
+
+  Result<ClientState, ErrorResult> SnapshotState();
+
+  nsISerialEventTarget* EventTarget() const;
+
+  void SetCsp(nsIContentSecurityPolicy* aCsp);
+  void SetPreloadCsp(nsIContentSecurityPolicy* aPreloadCSP);
+  void SetCspInfo(const mozilla::ipc::CSPInfo& aCSPInfo);
+  const Maybe<mozilla::ipc::CSPInfo>& GetCspInfo();
+
+  void SetAgentClusterId(const nsID& aId) {
+    mClientInfo.SetAgentClusterId(aId);
+  }
+
+  void Traverse(nsCycleCollectionTraversalCallback& aCallback,
+                const char* aName, uint32_t aFlags);
+
+  void NoteCalledRegisterForServiceWorkerScope(const nsACString& aScope);
+
+  bool CalledRegisterForServiceWorkerScope(const nsACString& aScope);
+
+  nsIPrincipal* GetPrincipal();
+};
+
+inline void ImplCycleCollectionUnlink(UniquePtr<ClientSource>& aField) {
+  aField.reset();
+}
+
+inline void ImplCycleCollectionTraverse(
+    nsCycleCollectionTraversalCallback& aCallback,
+    UniquePtr<ClientSource>& aField, const char* aName, uint32_t aFlags) {
+  if (aField) {
+    aField->Traverse(aCallback, aName, aFlags);
+  }
+}
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientSource_h
diff --git a/dom/clients/manager/ClientSourceChild.cpp b/dom/clients/manager/ClientSourceChild.cpp
new file mode 100644
index 0000000000..7aef60518c
--- /dev/null
+++ b/dom/clients/manager/ClientSourceChild.cpp
@@ -0,0 +1,79 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientSourceChild.h"
+
+#include "ClientSource.h"
+#include "ClientSourceOpChild.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+void ClientSourceChild::ActorDestroy(ActorDestroyReason aReason) {
+  if (mSource) {
+    mSource->RevokeActor(this);
+
+    // Revoking the actor link should automatically cause the owner
+    // to call RevokeOwner() as well.
+    MOZ_DIAGNOSTIC_ASSERT(!mSource);
+  }
+}
+
+PClientSourceOpChild* ClientSourceChild::AllocPClientSourceOpChild(
+    const ClientOpConstructorArgs& aArgs) {
+  return new ClientSourceOpChild();
+}
+
+bool ClientSourceChild::DeallocPClientSourceOpChild(
+    PClientSourceOpChild* aActor) {
+  static_cast<ClientSourceOpChild*>(aActor)->ScheduleDeletion();
+  return true;
+}
+
+IPCResult ClientSourceChild::RecvPClientSourceOpConstructor(
+    PClientSourceOpChild* aActor, const ClientOpConstructorArgs& aArgs) {
+  auto actor = static_cast<ClientSourceOpChild*>(aActor);
+  actor->Init(aArgs);
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult ClientSourceChild::RecvEvictFromBFCache() {
+  if (mSource) {
+    mSource->EvictFromBFCache();
+  }
+
+  return IPC_OK();
+}
+
+ClientSourceChild::ClientSourceChild(const ClientSourceConstructorArgs& aArgs)
+    : mSource(nullptr), mTeardownStarted(false) {}
+
+void ClientSourceChild::SetOwner(ClientThing<ClientSourceChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(aThing);
+  MOZ_DIAGNOSTIC_ASSERT(!mSource);
+  mSource = static_cast<ClientSource*>(aThing);
+}
+
+void ClientSourceChild::RevokeOwner(ClientThing<ClientSourceChild>* aThing) {
+  MOZ_DIAGNOSTIC_ASSERT(mSource);
+  MOZ_DIAGNOSTIC_ASSERT(mSource == static_cast<ClientSource*>(aThing));
+  mSource = nullptr;
+}
+
+ClientSource* ClientSourceChild::GetSource() const { return mSource; }
+
+void ClientSourceChild::MaybeStartTeardown() {
+  if (mTeardownStarted) {
+    return;
+  }
+  mTeardownStarted = true;
+  Unused << SendTeardown();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientSourceChild.h b/dom/clients/manager/ClientSourceChild.h
new file mode 100644
index 0000000000..4c08701710
--- /dev/null
+++ b/dom/clients/manager/ClientSourceChild.h
@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientSourceChild_h
+#define _mozilla_dom_ClientSourceChild_h
+
+#include "mozilla/dom/PClientSourceChild.h"
+
+namespace mozilla::dom {
+
+class ClientSource;
+class ClientSourceConstructorArgs;
+template <typename ActorType>
+class ClientThing;
+
+class ClientSourceChild final : public PClientSourceChild {
+  ClientSource* mSource;
+  bool mTeardownStarted;
+
+  // PClientSourceChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientSourceOpChild* AllocPClientSourceOpChild(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientSourceOpChild(PClientSourceOpChild* aActor) override;
+
+  mozilla::ipc::IPCResult RecvPClientSourceOpConstructor(
+      PClientSourceOpChild* aActor,
+      const ClientOpConstructorArgs& aArgs) override;
+
+  mozilla::ipc::IPCResult RecvEvictFromBFCache() override;
+
+ public:
+  explicit ClientSourceChild(const ClientSourceConstructorArgs& aArgs);
+
+  void SetOwner(ClientThing<ClientSourceChild>* aThing);
+
+  void RevokeOwner(ClientThing<ClientSourceChild>* aThing);
+
+  ClientSource* GetSource() const;
+
+  void MaybeStartTeardown();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientSourceChild_h
diff --git a/dom/clients/manager/ClientSourceOpChild.cpp b/dom/clients/manager/ClientSourceOpChild.cpp
new file mode 100644
index 0000000000..01176d7dca
--- /dev/null
+++ b/dom/clients/manager/ClientSourceOpChild.cpp
@@ -0,0 +1,136 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientSourceOpChild.h"
+
+#include "ClientSource.h"
+#include "ClientSourceChild.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla::dom {
+
+ClientSource* ClientSourceOpChild::GetSource() const {
+  auto actor = static_cast<ClientSourceChild*>(Manager());
+  return actor->GetSource();
+}
+
+template <typename Method, typename... Args>
+void ClientSourceOpChild::DoSourceOp(Method aMethod, Args&&... aArgs) {
+  RefPtr<ClientOpPromise> promise;
+  nsCOMPtr<nsISerialEventTarget> target;
+
+  // Some ClientSource operations can cause the ClientSource to be destroyed.
+  // This means we should reference the ClientSource pointer for the minimum
+  // possible to start the operation.  Use an extra block scope here to help
+  // enforce this and prevent accidental usage later in the method.
+  {
+    ClientSource* source = GetSource();
+    if (!source) {
+      CopyableErrorResult rv;
+      rv.ThrowAbortError("Unknown Client");
+      Unused << PClientSourceOpChild::Send__delete__(this, rv);
+      return;
+    }
+
+    target = source->EventTarget();
+
+    // This may cause the ClientSource object to be destroyed.  Do not
+    // use the source variable after this call.
+    promise = (source->*aMethod)(std::forward<Args>(aArgs)...);
+  }
+
+  // The ClientSource methods are required to always return a promise.  If
+  // they encounter an error they should just immediately resolve or reject
+  // the promise as appropriate.
+  MOZ_DIAGNOSTIC_ASSERT(promise);
+
+  // Capture 'this' is safe here because we disconnect the promise
+  // ActorDestroy() which ensures neither lambda is called if the
+  // actor is destroyed before the source operation completes.
+  //
+  // Also capture the promise to ensure it lives until we get a reaction
+  // or the actor starts shutting down and we disconnect our Thenable.
+  // If the ClientSource is doing something async it may throw away the
+  // promise on its side if the global is closed.
+  promise
+      ->Then(
+          target, __func__,
+          [this, promise](const mozilla::dom::ClientOpResult& aResult) {
+            mPromiseRequestHolder.Complete();
+            Unused << PClientSourceOpChild::Send__delete__(this, aResult);
+          },
+          [this, promise](const CopyableErrorResult& aRv) {
+            mPromiseRequestHolder.Complete();
+            Unused << PClientSourceOpChild::Send__delete__(this, aRv);
+          })
+      ->Track(mPromiseRequestHolder);
+}
+
+void ClientSourceOpChild::ActorDestroy(ActorDestroyReason aReason) {
+  Cleanup();
+}
+
+void ClientSourceOpChild::Init(const ClientOpConstructorArgs& aArgs) {
+  switch (aArgs.type()) {
+    case ClientOpConstructorArgs::TClientControlledArgs: {
+      DoSourceOp(&ClientSource::Control, aArgs.get_ClientControlledArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientFocusArgs: {
+      DoSourceOp(&ClientSource::Focus, aArgs.get_ClientFocusArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientPostMessageArgs: {
+      DoSourceOp(&ClientSource::PostMessage, aArgs.get_ClientPostMessageArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientClaimArgs: {
+      MOZ_ASSERT_UNREACHABLE("shouldn't happen with parent intercept");
+      break;
+    }
+    case ClientOpConstructorArgs::TClientGetInfoAndStateArgs: {
+      DoSourceOp(&ClientSource::GetInfoAndState,
+                 aArgs.get_ClientGetInfoAndStateArgs());
+      break;
+    }
+    case ClientOpConstructorArgs::TClientEvictBFCacheArgs: {
+      DoSourceOp(&ClientSource::EvictFromBFCacheOp);
+      break;
+    }
+    default: {
+      MOZ_ASSERT_UNREACHABLE("unknown client operation!");
+      break;
+    }
+  }
+
+  mInitialized.Flip();
+
+  if (mDeletionRequested) {
+    Cleanup();
+    delete this;
+  }
+}
+
+void ClientSourceOpChild::ScheduleDeletion() {
+  if (mInitialized) {
+    Cleanup();
+    delete this;
+    return;
+  }
+
+  mDeletionRequested.Flip();
+}
+
+ClientSourceOpChild::~ClientSourceOpChild() {
+  MOZ_DIAGNOSTIC_ASSERT(mInitialized);
+}
+
+void ClientSourceOpChild::Cleanup() {
+  mPromiseRequestHolder.DisconnectIfExists();
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientSourceOpChild.h b/dom/clients/manager/ClientSourceOpChild.h
new file mode 100644
index 0000000000..4b475cac1b
--- /dev/null
+++ b/dom/clients/manager/ClientSourceOpChild.h
@@ -0,0 +1,45 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientSourceOpChild_h
+#define _mozilla_dom_ClientSourceOpChild_h
+
+#include "mozilla/dom/FlippedOnce.h"
+#include "mozilla/dom/PClientSourceOpChild.h"
+#include "ClientOpPromise.h"
+
+namespace mozilla::dom {
+
+class ClientSource;
+
+class ClientSourceOpChild final : public PClientSourceOpChild {
+ public:
+  void Init(const ClientOpConstructorArgs& aArgs);
+
+  // Deletes "this" after initialization (or immediately if already
+  // initialized.) It's UB to use "this" after calling ScheduleDeletion.
+  void ScheduleDeletion();
+
+ private:
+  ~ClientSourceOpChild();
+
+  void Cleanup();
+
+  ClientSource* GetSource() const;
+
+  template <typename Method, typename... Args>
+  void DoSourceOp(Method aMethod, Args&&... aArgs);
+
+  // PClientSourceOpChild interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  MozPromiseRequestHolder<ClientOpPromise> mPromiseRequestHolder;
+  FlippedOnce<false> mDeletionRequested;
+  FlippedOnce<false> mInitialized;
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientSourceOpChild_h
diff --git a/dom/clients/manager/ClientSourceOpParent.cpp b/dom/clients/manager/ClientSourceOpParent.cpp
new file mode 100644
index 0000000000..b5da421c07
--- /dev/null
+++ b/dom/clients/manager/ClientSourceOpParent.cpp
@@ -0,0 +1,57 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientSourceOpParent.h"
+
+#include "ClientSourceParent.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::IPCResult;
+
+void ClientSourceOpParent::ActorDestroy(ActorDestroyReason aReason) {
+  if (mPromise) {
+    CopyableErrorResult rv;
+    rv.ThrowAbortError("Client torn down");
+    mPromise->Reject(rv, __func__);
+    mPromise = nullptr;
+  }
+}
+
+IPCResult ClientSourceOpParent::Recv__delete__(const ClientOpResult& aResult) {
+  if (aResult.type() == ClientOpResult::TCopyableErrorResult &&
+      aResult.get_CopyableErrorResult().Failed()) {
+    // If a control message fails then clear the controller from
+    // the ClientSourceParent.  We eagerly marked it controlled at
+    // the start of the operation.
+    if (mArgs.type() == ClientOpConstructorArgs::TClientControlledArgs) {
+      auto source = static_cast<ClientSourceParent*>(Manager());
+      if (source) {
+        source->ClearController();
+      }
+    }
+
+    mPromise->Reject(aResult.get_CopyableErrorResult(), __func__);
+    mPromise = nullptr;
+    return IPC_OK();
+  }
+
+  mPromise->Resolve(aResult, __func__);
+  mPromise = nullptr;
+  return IPC_OK();
+}
+
+ClientSourceOpParent::ClientSourceOpParent(ClientOpConstructorArgs&& aArgs,
+                                           ClientOpPromise::Private* aPromise)
+    : mArgs(std::move(aArgs)), mPromise(aPromise) {
+  MOZ_DIAGNOSTIC_ASSERT(mPromise);
+}
+
+ClientSourceOpParent::~ClientSourceOpParent() {
+  MOZ_DIAGNOSTIC_ASSERT(!mPromise);
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientSourceOpParent.h b/dom/clients/manager/ClientSourceOpParent.h
new file mode 100644
index 0000000000..e3fe22b5d1
--- /dev/null
+++ b/dom/clients/manager/ClientSourceOpParent.h
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientSourceOpParent_h
+#define _mozilla_dom_ClientSourceOpParent_h
+
+#include "mozilla/dom/ClientOpPromise.h"
+#include "mozilla/dom/PClientSourceOpParent.h"
+
+namespace mozilla::dom {
+
+class ClientSourceOpParent final : public PClientSourceOpParent {
+  const ClientOpConstructorArgs mArgs;
+  RefPtr<ClientOpPromise::Private> mPromise;
+
+  // PClientSourceOpParent interface
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  mozilla::ipc::IPCResult Recv__delete__(
+      const ClientOpResult& aResult) override;
+
+ public:
+  ClientSourceOpParent(ClientOpConstructorArgs&& aArgs,
+                       ClientOpPromise::Private* aPromise);
+
+  const ClientOpConstructorArgs& Args() const { return mArgs; }
+
+  ~ClientSourceOpParent();
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientSourceOpParent_h
diff --git a/dom/clients/manager/ClientSourceParent.cpp b/dom/clients/manager/ClientSourceParent.cpp
new file mode 100644
index 0000000000..8d94a501d4
--- /dev/null
+++ b/dom/clients/manager/ClientSourceParent.cpp
@@ -0,0 +1,297 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientSourceParent.h"
+
+#include "ClientHandleParent.h"
+#include "ClientManagerService.h"
+#include "ClientSourceOpParent.h"
+#include "ClientValidation.h"
+#include "mozilla/dom/ClientIPCTypes.h"
+#include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/PClientManagerParent.h"
+#include "mozilla/dom/ServiceWorkerManager.h"
+#include "mozilla/dom/ServiceWorkerUtils.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/SchedulerGroup.h"
+#include "mozilla/Unused.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::AssertIsOnBackgroundThread;
+using mozilla::ipc::BackgroundParent;
+using mozilla::ipc::IPCResult;
+using mozilla::ipc::PrincipalInfo;
+
+namespace {
+
+// It would be nice to use a lambda instead of this class, but we cannot
+// move capture in lambdas yet and ContentParent cannot be AddRef'd off
+// the main thread.
+class KillContentParentRunnable final : public Runnable {
+  RefPtr<ThreadsafeContentParentHandle> mHandle;
+
+ public:
+  explicit KillContentParentRunnable(
+      RefPtr<ThreadsafeContentParentHandle>&& aHandle)
+      : Runnable("KillContentParentRunnable"), mHandle(std::move(aHandle)) {
+    MOZ_ASSERT(mHandle);
+  }
+
+  NS_IMETHOD
+  Run() override {
+    AssertIsOnMainThread();
+    if (RefPtr<ContentParent> contentParent = mHandle->GetContentParent()) {
+      contentParent->KillHard("invalid ClientSourceParent actor");
+    }
+    return NS_OK;
+  }
+};
+
+}  // anonymous namespace
+
+void ClientSourceParent::KillInvalidChild() {
+  // Try to get the content process before we destroy the actor below.
+  RefPtr<ThreadsafeContentParentHandle> process =
+      BackgroundParent::GetContentParentHandle(Manager()->Manager());
+
+  // First, immediately teardown the ClientSource actor.  No matter what
+  // we want to start this process as soon as possible.
+  Unused << ClientSourceParent::Send__delete__(this);
+
+  // If we are running in non-e10s, then there is nothing else to do here.
+  // There is no child process and we don't want to crash the entire browser
+  // in release builds.  In general, though, this should not happen in non-e10s
+  // so we do assert this condition.
+  if (!process) {
+    MOZ_DIAGNOSTIC_ASSERT(false, "invalid ClientSourceParent in non-e10s");
+    return;
+  }
+
+  // In e10s mode we also want to kill the child process.  Validation failures
+  // typically mean someone sent us bogus data over the IPC link.  We can't
+  // trust that process any more.  We have to do this on the main thread, so
+  // there is a small window of time before we kill the process.  This is why
+  // we start the actor destruction immediately above.
+  nsCOMPtr<nsIRunnable> r = new KillContentParentRunnable(std::move(process));
+  MOZ_ALWAYS_SUCCEEDS(
+      SchedulerGroup::Dispatch(TaskCategory::Other, r.forget()));
+}
+
+mozilla::ipc::IPCResult ClientSourceParent::RecvWorkerSyncPing() {
+  AssertIsOnBackgroundThread();
+  // Do nothing here.  This is purely a sync message allowing the child to
+  // confirm that the actor has been created on the parent process.
+  return IPC_OK();
+}
+
+IPCResult ClientSourceParent::RecvTeardown() {
+  Unused << Send__delete__(this);
+  return IPC_OK();
+}
+
+IPCResult ClientSourceParent::RecvExecutionReady(
+    const ClientSourceExecutionReadyArgs& aArgs) {
+  // Now that we have the creation URL for the Client we can do some validation
+  // to make sure the child actor is not giving us garbage.  Since we validate
+  // on the child side as well we treat a failure here as fatal.
+  if (!ClientIsValidCreationURL(mClientInfo.PrincipalInfo(), aArgs.url())) {
+    KillInvalidChild();
+    return IPC_OK();
+  }
+
+  mClientInfo.SetURL(aArgs.url());
+  mClientInfo.SetFrameType(aArgs.frameType());
+  mExecutionReady = true;
+
+  for (ClientHandleParent* handle : mHandleList) {
+    Unused << handle->SendExecutionReady(mClientInfo.ToIPC());
+  }
+
+  mExecutionReadyPromise.ResolveIfExists(true, __func__);
+
+  return IPC_OK();
+};
+
+IPCResult ClientSourceParent::RecvFreeze() {
+#ifdef FUZZING_SNAPSHOT
+  if (mFrozen) {
+    return IPC_FAIL(this, "Freezing when already frozen");
+  }
+#endif
+  MOZ_DIAGNOSTIC_ASSERT(!mFrozen);
+  mFrozen = true;
+
+  return IPC_OK();
+}
+
+IPCResult ClientSourceParent::RecvThaw() {
+#ifdef FUZZING_SNAPSHOT
+  if (!mFrozen) {
+    return IPC_FAIL(this, "Thawing when not already frozen");
+  }
+#endif
+  MOZ_DIAGNOSTIC_ASSERT(mFrozen);
+  mFrozen = false;
+  return IPC_OK();
+}
+
+IPCResult ClientSourceParent::RecvInheritController(
+    const ClientControlledArgs& aArgs) {
+  mController.reset();
+  mController.emplace(aArgs.serviceWorker());
+
+  // We must tell the parent-side SWM about this controller inheritance.
+  nsCOMPtr<nsIRunnable> r = NS_NewRunnableFunction(
+      "ClientSourceParent::RecvInheritController",
+      [clientInfo = mClientInfo, controller = mController.ref()]() {
+        RefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+        NS_ENSURE_TRUE_VOID(swm);
+
+        swm->NoteInheritedController(clientInfo, controller);
+      });
+
+  MOZ_ALWAYS_SUCCEEDS(
+      SchedulerGroup::Dispatch(TaskCategory::Other, r.forget()));
+
+  return IPC_OK();
+}
+
+IPCResult ClientSourceParent::RecvNoteDOMContentLoaded() {
+  if (mController.isSome()) {
+    nsCOMPtr<nsIRunnable> r =
+        NS_NewRunnableFunction("ClientSourceParent::RecvNoteDOMContentLoaded",
+                               [clientInfo = mClientInfo]() {
+                                 RefPtr<ServiceWorkerManager> swm =
+                                     ServiceWorkerManager::GetInstance();
+                                 NS_ENSURE_TRUE_VOID(swm);
+
+                                 swm->MaybeCheckNavigationUpdate(clientInfo);
+                               });
+
+    MOZ_ALWAYS_SUCCEEDS(
+        SchedulerGroup::Dispatch(TaskCategory::Other, r.forget()));
+  }
+  return IPC_OK();
+}
+
+void ClientSourceParent::ActorDestroy(ActorDestroyReason aReason) {
+  DebugOnly<bool> removed = mService->RemoveSource(this);
+  MOZ_ASSERT(removed);
+
+  for (ClientHandleParent* handle : mHandleList.Clone()) {
+    // This should trigger DetachHandle() to be called removing
+    // the entry from the mHandleList.
+    Unused << ClientHandleParent::Send__delete__(handle);
+  }
+  MOZ_DIAGNOSTIC_ASSERT(mHandleList.IsEmpty());
+}
+
+PClientSourceOpParent* ClientSourceParent::AllocPClientSourceOpParent(
+    const ClientOpConstructorArgs& aArgs) {
+  MOZ_ASSERT_UNREACHABLE(
+      "ClientSourceOpParent should be explicitly constructed.");
+  return nullptr;
+}
+
+bool ClientSourceParent::DeallocPClientSourceOpParent(
+    PClientSourceOpParent* aActor) {
+  delete aActor;
+  return true;
+}
+
+ClientSourceParent::ClientSourceParent(
+    const ClientSourceConstructorArgs& aArgs,
+    const Maybe<ContentParentId>& aContentParentId)
+    : mClientInfo(aArgs.id(), aArgs.type(), aArgs.principalInfo(),
+                  aArgs.creationTime()),
+      mContentParentId(aContentParentId),
+      mService(ClientManagerService::GetOrCreateInstance()),
+      mExecutionReady(false),
+      mFrozen(false) {}
+
+ClientSourceParent::~ClientSourceParent() {
+  MOZ_DIAGNOSTIC_ASSERT(mHandleList.IsEmpty());
+
+  mExecutionReadyPromise.RejectIfExists(NS_ERROR_FAILURE, __func__);
+}
+
+void ClientSourceParent::Init() {
+  // Ensure the principal is reasonable before adding ourself to the service.
+  // Since we validate the principal on the child side as well, any failure
+  // here is treated as fatal.
+  if (NS_WARN_IF(!ClientIsValidPrincipalInfo(mClientInfo.PrincipalInfo()))) {
+    mService->ForgetFutureSource(mClientInfo.ToIPC());
+    KillInvalidChild();
+    return;
+  }
+
+  // Its possible for AddSource() to fail if there is already an entry for
+  // our UUID.  This should not normally happen, but could if someone is
+  // spoofing IPC messages.
+  if (NS_WARN_IF(!mService->AddSource(this))) {
+    KillInvalidChild();
+    return;
+  }
+}
+
+const ClientInfo& ClientSourceParent::Info() const { return mClientInfo; }
+
+bool ClientSourceParent::IsFrozen() const { return mFrozen; }
+
+bool ClientSourceParent::ExecutionReady() const { return mExecutionReady; }
+
+RefPtr<GenericNonExclusivePromise> ClientSourceParent::ExecutionReadyPromise() {
+  // Only call if ClientSourceParent::ExecutionReady() is false; otherwise,
+  // the promise will never resolve
+  MOZ_ASSERT(!mExecutionReady);
+  return mExecutionReadyPromise.Ensure(__func__);
+}
+
+const Maybe<ServiceWorkerDescriptor>& ClientSourceParent::GetController()
+    const {
+  return mController;
+}
+
+void ClientSourceParent::ClearController() { mController.reset(); }
+
+void ClientSourceParent::AttachHandle(ClientHandleParent* aClientHandle) {
+  MOZ_DIAGNOSTIC_ASSERT(aClientHandle);
+  MOZ_ASSERT(!mHandleList.Contains(aClientHandle));
+  mHandleList.AppendElement(aClientHandle);
+}
+
+void ClientSourceParent::DetachHandle(ClientHandleParent* aClientHandle) {
+  MOZ_DIAGNOSTIC_ASSERT(aClientHandle);
+  MOZ_ASSERT(mHandleList.Contains(aClientHandle));
+  mHandleList.RemoveElement(aClientHandle);
+}
+
+RefPtr<ClientOpPromise> ClientSourceParent::StartOp(
+    ClientOpConstructorArgs&& aArgs) {
+  RefPtr<ClientOpPromise::Private> promise =
+      new ClientOpPromise::Private(__func__);
+
+  // If we are being controlled, remember that data before propagating
+  // on to the ClientSource.  This must be set prior to triggering
+  // the controllerchange event from the ClientSource since some tests
+  // expect matchAll() to find the controlled client immediately after.
+  // If the control operation fails, then we reset the controller value
+  // to reflect the final state.
+  if (aArgs.type() == ClientOpConstructorArgs::TClientControlledArgs) {
+    mController.reset();
+    mController.emplace(aArgs.get_ClientControlledArgs().serviceWorker());
+  }
+
+  // Constructor failure will reject the promise via ActorDestroy().
+  ClientSourceOpParent* actor =
+      new ClientSourceOpParent(std::move(aArgs), promise);
+  Unused << SendPClientSourceOpConstructor(actor, actor->Args());
+
+  return promise;
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientSourceParent.h b/dom/clients/manager/ClientSourceParent.h
new file mode 100644
index 0000000000..17841b0c8b
--- /dev/null
+++ b/dom/clients/manager/ClientSourceParent.h
@@ -0,0 +1,89 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientSourceParent_h
+#define _mozilla_dom_ClientSourceParent_h
+
+#include "ClientInfo.h"
+#include "ClientOpPromise.h"
+#include "mozilla/dom/PClientSourceParent.h"
+#include "mozilla/dom/ServiceWorkerDescriptor.h"
+#include "mozilla/dom/ipc/IdType.h"
+#include "mozilla/MozPromise.h"
+
+namespace mozilla::dom {
+
+class ClientHandleParent;
+class ClientManagerService;
+
+class ClientSourceParent final : public PClientSourceParent {
+  ClientInfo mClientInfo;
+  Maybe<ServiceWorkerDescriptor> mController;
+  const Maybe<ContentParentId> mContentParentId;
+  RefPtr<ClientManagerService> mService;
+  nsTArray<ClientHandleParent*> mHandleList;
+  MozPromiseHolder<GenericNonExclusivePromise> mExecutionReadyPromise;
+  bool mExecutionReady;
+  bool mFrozen;
+
+  void KillInvalidChild();
+
+  // PClientSourceParent
+  mozilla::ipc::IPCResult RecvWorkerSyncPing() override;
+
+  mozilla::ipc::IPCResult RecvTeardown() override;
+
+  mozilla::ipc::IPCResult RecvExecutionReady(
+      const ClientSourceExecutionReadyArgs& aArgs) override;
+
+  mozilla::ipc::IPCResult RecvFreeze() override;
+
+  mozilla::ipc::IPCResult RecvThaw() override;
+
+  mozilla::ipc::IPCResult RecvInheritController(
+      const ClientControlledArgs& aArgs) override;
+
+  mozilla::ipc::IPCResult RecvNoteDOMContentLoaded() override;
+
+  void ActorDestroy(ActorDestroyReason aReason) override;
+
+  PClientSourceOpParent* AllocPClientSourceOpParent(
+      const ClientOpConstructorArgs& aArgs) override;
+
+  bool DeallocPClientSourceOpParent(PClientSourceOpParent* aActor) override;
+
+ public:
+  explicit ClientSourceParent(const ClientSourceConstructorArgs& aArgs,
+                              const Maybe<ContentParentId>& aContentParentId);
+  ~ClientSourceParent();
+
+  void Init();
+
+  const ClientInfo& Info() const;
+
+  bool IsFrozen() const;
+
+  bool ExecutionReady() const;
+
+  RefPtr<GenericNonExclusivePromise> ExecutionReadyPromise();
+
+  const Maybe<ServiceWorkerDescriptor>& GetController() const;
+
+  void ClearController();
+
+  bool IsOwnedByProcess(ContentParentId aContentParentId) const {
+    return mContentParentId && mContentParentId.value() == aContentParentId;
+  }
+
+  void AttachHandle(ClientHandleParent* aClientSource);
+
+  void DetachHandle(ClientHandleParent* aClientSource);
+
+  RefPtr<ClientOpPromise> StartOp(ClientOpConstructorArgs&& aArgs);
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientSourceParent_h
diff --git a/dom/clients/manager/ClientState.cpp b/dom/clients/manager/ClientState.cpp
new file mode 100644
index 0000000000..89e43465d7
--- /dev/null
+++ b/dom/clients/manager/ClientState.cpp
@@ -0,0 +1,167 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientState.h"
+
+#include "mozilla/dom/ClientIPCTypes.h"
+
+namespace mozilla::dom {
+
+ClientWindowState::ClientWindowState(
+    mozilla::dom::VisibilityState aVisibilityState,
+    const TimeStamp& aLastFocusTime, StorageAccess aStorageAccess,
+    bool aFocused)
+    : mData(MakeUnique<IPCClientWindowState>(aVisibilityState, aLastFocusTime,
+                                             aStorageAccess, aFocused)) {}
+
+ClientWindowState::ClientWindowState(const IPCClientWindowState& aData)
+    : mData(MakeUnique<IPCClientWindowState>(aData)) {}
+
+ClientWindowState::ClientWindowState(const ClientWindowState& aRight) {
+  operator=(aRight);
+}
+
+ClientWindowState::ClientWindowState(ClientWindowState&& aRight)
+    : mData(std::move(aRight.mData)) {}
+
+ClientWindowState& ClientWindowState::operator=(
+    const ClientWindowState& aRight) {
+  mData.reset();
+  mData = MakeUnique<IPCClientWindowState>(*aRight.mData);
+  return *this;
+}
+
+ClientWindowState& ClientWindowState::operator=(ClientWindowState&& aRight) {
+  mData.reset();
+  mData = std::move(aRight.mData);
+  return *this;
+}
+
+ClientWindowState::~ClientWindowState() = default;
+
+mozilla::dom::VisibilityState ClientWindowState::VisibilityState() const {
+  return mData->visibilityState();
+}
+
+const TimeStamp& ClientWindowState::LastFocusTime() const {
+  return mData->lastFocusTime();
+}
+
+bool ClientWindowState::Focused() const { return mData->focused(); }
+
+StorageAccess ClientWindowState::GetStorageAccess() const {
+  return mData->storageAccess();
+}
+
+const IPCClientWindowState& ClientWindowState::ToIPC() const { return *mData; }
+
+ClientWorkerState::ClientWorkerState(StorageAccess aStorageAccess)
+    : mData(MakeUnique<IPCClientWorkerState>(aStorageAccess)) {}
+
+ClientWorkerState::ClientWorkerState(const IPCClientWorkerState& aData)
+    : mData(MakeUnique<IPCClientWorkerState>(aData)) {}
+
+ClientWorkerState::ClientWorkerState(ClientWorkerState&& aRight)
+    : mData(std::move(aRight.mData)) {}
+
+ClientWorkerState::ClientWorkerState(const ClientWorkerState& aRight) {
+  operator=(aRight);
+}
+
+ClientWorkerState& ClientWorkerState::operator=(
+    const ClientWorkerState& aRight) {
+  mData.reset();
+  mData = MakeUnique<IPCClientWorkerState>(*aRight.mData);
+  return *this;
+}
+
+ClientWorkerState& ClientWorkerState::operator=(ClientWorkerState&& aRight) {
+  mData.reset();
+  mData = std::move(aRight.mData);
+  return *this;
+}
+
+ClientWorkerState::~ClientWorkerState() = default;
+
+StorageAccess ClientWorkerState::GetStorageAccess() const {
+  return mData->storageAccess();
+}
+
+const IPCClientWorkerState& ClientWorkerState::ToIPC() const { return *mData; }
+
+ClientState::ClientState() = default;
+
+ClientState::ClientState(const ClientWindowState& aWindowState) {
+  mData.emplace(AsVariant(aWindowState));
+}
+
+ClientState::ClientState(const ClientWorkerState& aWorkerState) {
+  mData.emplace(AsVariant(aWorkerState));
+}
+
+ClientState::ClientState(const IPCClientWindowState& aData) {
+  mData.emplace(AsVariant(ClientWindowState(aData)));
+}
+
+ClientState::ClientState(const IPCClientWorkerState& aData) {
+  mData.emplace(AsVariant(ClientWorkerState(aData)));
+}
+
+ClientState::ClientState(ClientState&& aRight)
+    : mData(std::move(aRight.mData)) {}
+
+ClientState& ClientState::operator=(ClientState&& aRight) {
+  mData = std::move(aRight.mData);
+  return *this;
+}
+
+ClientState::~ClientState() = default;
+
+// static
+ClientState ClientState::FromIPC(const IPCClientState& aData) {
+  switch (aData.type()) {
+    case IPCClientState::TIPCClientWindowState:
+      return ClientState(aData.get_IPCClientWindowState());
+    case IPCClientState::TIPCClientWorkerState:
+      return ClientState(aData.get_IPCClientWorkerState());
+    default:
+      MOZ_CRASH("unexpected IPCClientState type");
+  }
+}
+
+bool ClientState::IsWindowState() const {
+  return mData.isSome() && mData.ref().is<ClientWindowState>();
+}
+
+const ClientWindowState& ClientState::AsWindowState() const {
+  return mData.ref().as<ClientWindowState>();
+}
+
+bool ClientState::IsWorkerState() const {
+  return mData.isSome() && mData.ref().is<ClientWorkerState>();
+}
+
+const ClientWorkerState& ClientState::AsWorkerState() const {
+  return mData.ref().as<ClientWorkerState>();
+}
+
+StorageAccess ClientState::GetStorageAccess() const {
+  if (IsWindowState()) {
+    return AsWindowState().GetStorageAccess();
+  }
+
+  return AsWorkerState().GetStorageAccess();
+}
+
+const IPCClientState ClientState::ToIPC() const {
+  if (IsWindowState()) {
+    return IPCClientState(AsWindowState().ToIPC());
+  }
+
+  return IPCClientState(AsWorkerState().ToIPC());
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientState.h b/dom/clients/manager/ClientState.h
new file mode 100644
index 0000000000..2cd5a601ad
--- /dev/null
+++ b/dom/clients/manager/ClientState.h
@@ -0,0 +1,125 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _mozilla_dom_ClientState_h
+#define _mozilla_dom_ClientState_h
+
+#include "mozilla/dom/DocumentBinding.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/StorageAccess.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/Variant.h"
+#include "nsContentUtils.h"
+
+namespace mozilla::dom {
+
+class IPCClientState;
+class IPCClientWindowState;
+class IPCClientWorkerState;
+
+// This class defines the mutable nsGlobalWindow state we support querying
+// through the ClientManagerService.  It is a snapshot of the state and
+// is not live updated.
+class ClientWindowState final {
+  UniquePtr<IPCClientWindowState> mData;
+
+ public:
+  ClientWindowState(mozilla::dom::VisibilityState aVisibilityState,
+                    const TimeStamp& aLastFocusTime,
+                    StorageAccess aStorageAccess, bool aFocused);
+
+  explicit ClientWindowState(const IPCClientWindowState& aData);
+
+  ClientWindowState(const ClientWindowState& aRight);
+  ClientWindowState(ClientWindowState&& aRight);
+
+  ClientWindowState& operator=(const ClientWindowState& aRight);
+
+  ClientWindowState& operator=(ClientWindowState&& aRight);
+
+  ~ClientWindowState();
+
+  mozilla::dom::VisibilityState VisibilityState() const;
+
+  const TimeStamp& LastFocusTime() const;
+
+  bool Focused() const;
+
+  StorageAccess GetStorageAccess() const;
+
+  const IPCClientWindowState& ToIPC() const;
+};
+
+// This class defines the mutable worker state we support querying
+// through the ClientManagerService.  It is a snapshot of the state and
+// is not live updated.  Right now, we don't actually providate any
+// worker specific state values, but we may in the future.  This
+// class also services as a placeholder that the state is referring
+// to a worker in ClientState.
+class ClientWorkerState final {
+  UniquePtr<IPCClientWorkerState> mData;
+
+ public:
+  explicit ClientWorkerState(StorageAccess aStorageAccess);
+
+  explicit ClientWorkerState(const IPCClientWorkerState& aData);
+
+  ClientWorkerState(const ClientWorkerState& aRight);
+  ClientWorkerState(ClientWorkerState&& aRight);
+
+  ClientWorkerState& operator=(const ClientWorkerState& aRight);
+
+  ClientWorkerState& operator=(ClientWorkerState&& aRight);
+
+  ~ClientWorkerState();
+
+  StorageAccess GetStorageAccess() const;
+
+  const IPCClientWorkerState& ToIPC() const;
+};
+
+// This is a union of the various types of mutable state we support
+// querying in ClientManagerService.  Right now it can contain either
+// window or worker states.
+class ClientState final {
+  Maybe<Variant<ClientWindowState, ClientWorkerState>> mData;
+
+ public:
+  ClientState();
+
+  explicit ClientState(const ClientWindowState& aWindowState);
+  explicit ClientState(const ClientWorkerState& aWorkerState);
+  explicit ClientState(const IPCClientWindowState& aData);
+  explicit ClientState(const IPCClientWorkerState& aData);
+
+  ClientState(const ClientState& aRight) = default;
+  ClientState(ClientState&& aRight);
+
+  ClientState& operator=(const ClientState& aRight) = default;
+
+  ClientState& operator=(ClientState&& aRight);
+
+  ~ClientState();
+
+  static ClientState FromIPC(const IPCClientState& aData);
+
+  bool IsWindowState() const;
+
+  const ClientWindowState& AsWindowState() const;
+
+  bool IsWorkerState() const;
+
+  const ClientWorkerState& AsWorkerState() const;
+
+  StorageAccess GetStorageAccess() const;
+
+  const IPCClientState ToIPC() const;
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientState_h
diff --git a/dom/clients/manager/ClientThing.h b/dom/clients/manager/ClientThing.h
new file mode 100644
index 0000000000..9b2bfcc52d
--- /dev/null
+++ b/dom/clients/manager/ClientThing.h
@@ -0,0 +1,138 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientThing_h
+#define _mozilla_dom_ClientThing_h
+
+#include "nsTArray.h"
+
+namespace mozilla::dom {
+
+// Base class representing various Client "things" such as ClientHandle,
+// ClientSource, and ClientManager.  Currently it provides a common set
+// of code for handling activation and shutdown of IPC actors.
+template <typename ActorType>
+class ClientThing {
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  static const uint32_t kMagic1 = 0xC9FE2C9C;
+  static const uint32_t kMagic2 = 0x832072D4;
+#endif
+
+  ActorType* mActor;
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+  uint32_t mMagic1;
+  uint32_t mMagic2;
+#endif
+  bool mShutdown;
+
+ protected:
+  ClientThing()
+      : mActor(nullptr)
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+        ,
+        mMagic1(kMagic1),
+        mMagic2(kMagic2)
+#endif
+        ,
+        mShutdown(false) {
+  }
+
+  ~ClientThing() {
+    AssertIsValid();
+    ShutdownThing();
+#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
+    mMagic1 = 0;
+    mMagic2 = 0;
+#endif
+  }
+
+  void AssertIsValid() const {
+    MOZ_DIAGNOSTIC_ASSERT(mMagic1 == kMagic1);
+    MOZ_DIAGNOSTIC_ASSERT(mMagic2 == kMagic2);
+  }
+
+  // Return the current actor.
+  ActorType* GetActor() const {
+    AssertIsValid();
+    return mActor;
+  }
+
+  // Returns true if ShutdownThing() has been called.
+  bool IsShutdown() const {
+    AssertIsValid();
+    return mShutdown;
+  }
+
+  // Conditionally execute the given callable based on the current state.
+  template <typename Callable>
+  void MaybeExecute(
+      const Callable& aSuccess, const std::function<void()>& aFailure = [] {}) {
+    AssertIsValid();
+    if (mShutdown) {
+      aFailure();
+      return;
+    }
+    MOZ_DIAGNOSTIC_ASSERT(mActor);
+    aSuccess(mActor);
+  }
+
+  // Attach activate the thing by attaching its underlying IPC actor.  This
+  // will make the thing register as the actor's owner as well.  The actor
+  // must call RevokeActor() to clear this weak back reference before its
+  // destroyed.
+  void ActivateThing(ActorType* aActor) {
+    AssertIsValid();
+    MOZ_DIAGNOSTIC_ASSERT(aActor);
+    MOZ_DIAGNOSTIC_ASSERT(!mActor);
+    MOZ_DIAGNOSTIC_ASSERT(!mShutdown);
+    mActor = aActor;
+    mActor->SetOwner(this);
+  }
+
+  // Start destroying the underlying actor and disconnect the thing.
+  void ShutdownThing() {
+    AssertIsValid();
+    if (mShutdown) {
+      return;
+    }
+    mShutdown = true;
+
+    // If we are shutdown before the actor, then clear the weak references
+    // between the actor and the thing.
+    if (mActor) {
+      mActor->RevokeOwner(this);
+      mActor->MaybeStartTeardown();
+      mActor = nullptr;
+    }
+
+    OnShutdownThing();
+  }
+
+  // Allow extending classes to take action when shutdown.
+  virtual void OnShutdownThing() {
+    // by default do nothing
+  }
+
+ public:
+  // Clear the weak references between the thing and its IPC actor.
+  void RevokeActor(ActorType* aActor) {
+    AssertIsValid();
+    MOZ_DIAGNOSTIC_ASSERT(mActor);
+    MOZ_DIAGNOSTIC_ASSERT(mActor == aActor);
+    mActor->RevokeOwner(this);
+    mActor = nullptr;
+
+    // Also consider the ClientThing shutdown.  We simply set the flag
+    // instead of calling ShutdownThing() to avoid calling MaybeStartTeardown()
+    // on the destroyed actor.
+    mShutdown = true;
+
+    OnShutdownThing();
+  }
+};
+
+}  // namespace mozilla::dom
+
+#endif  // _mozilla_dom_ClientThing_h
diff --git a/dom/clients/manager/ClientValidation.cpp b/dom/clients/manager/ClientValidation.cpp
new file mode 100644
index 0000000000..61e9338e12
--- /dev/null
+++ b/dom/clients/manager/ClientValidation.cpp
@@ -0,0 +1,170 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ClientValidation.h"
+
+#include "mozilla/ipc/PBackgroundSharedTypes.h"
+#include "mozilla/StaticPrefs_security.h"
+#include "mozilla/net/MozURL.h"
+
+namespace mozilla::dom {
+
+using mozilla::ipc::ContentPrincipalInfo;
+using mozilla::ipc::PrincipalInfo;
+using mozilla::net::MozURL;
+
+bool ClientIsValidPrincipalInfo(const PrincipalInfo& aPrincipalInfo) {
+  // Ideally we would verify that the source process has permission to
+  // create a window or worker with the given principal, but we don't
+  // currently have any such restriction in place.  Instead, at least
+  // verify the PrincipalInfo is an expected type and has a parsable
+  // origin/spec.
+  switch (aPrincipalInfo.type()) {
+    // Any system and null principal is acceptable.
+    case PrincipalInfo::TSystemPrincipalInfo:
+    case PrincipalInfo::TNullPrincipalInfo: {
+      return true;
+    }
+
+    // Validate content principals to ensure that the origin and spec are sane.
+    case PrincipalInfo::TContentPrincipalInfo: {
+      const ContentPrincipalInfo& content =
+          aPrincipalInfo.get_ContentPrincipalInfo();
+
+      // Verify the principal spec parses.
+      RefPtr<MozURL> specURL;
+      nsresult rv = MozURL::Init(getter_AddRefs(specURL), content.spec());
+      NS_ENSURE_SUCCESS(rv, false);
+
+      // Verify the principal originNoSuffix parses.
+      RefPtr<MozURL> originURL;
+      rv = MozURL::Init(getter_AddRefs(originURL), content.originNoSuffix());
+      NS_ENSURE_SUCCESS(rv, false);
+
+      nsAutoCString originOrigin;
+      originURL->Origin(originOrigin);
+
+      nsAutoCString specOrigin;
+      specURL->Origin(specOrigin);
+
+      // Linkable about URIs end up with a nested inner scheme of moz-safe-about
+      // which will have been captured in the originNoSuffix but the spec and
+      // its resulting specOrigin will not have this transformed scheme, so
+      // ignore the "moz-safe-" prefix when the originURL has that transformed
+      // scheme.
+      if (originURL->Scheme().Equals("moz-safe-about")) {
+        return specOrigin == originOrigin ||
+               specOrigin == Substring(originOrigin, 9 /*moz-safe-*/,
+                                       specOrigin.Length());
+      }
+
+      // For now require Clients to have a principal where both its
+      // originNoSuffix and spec have the same origin.  This will
+      // exclude a variety of unusual combinations within the browser
+      // but its adequate for the features need to support right now.
+      // If necessary we could expand this function to handle more
+      // cases in the future.
+
+      return specOrigin == originOrigin;
+    }
+    default: {
+      break;
+    }
+  }
+
+  // Windows and workers should not have expanded URLs, etc.
+  return false;
+}
+
+bool ClientIsValidCreationURL(const PrincipalInfo& aPrincipalInfo,
+                              const nsACString& aURL) {
+  RefPtr<MozURL> url;
+  nsresult rv = MozURL::Init(getter_AddRefs(url), aURL);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  switch (aPrincipalInfo.type()) {
+    case PrincipalInfo::TContentPrincipalInfo: {
+      // Any origin can create an about:blank or about:srcdoc Client.
+      if (aURL.LowerCaseEqualsLiteral("about:blank") ||
+          aURL.LowerCaseEqualsLiteral("about:srcdoc")) {
+        return true;
+      }
+
+      const ContentPrincipalInfo& content =
+          aPrincipalInfo.get_ContentPrincipalInfo();
+
+      // Parse the principal origin URL as well.  This ensures any MozURL
+      // parser issues effect both URLs equally.
+      RefPtr<MozURL> principalURL;
+      rv = MozURL::Init(getter_AddRefs(principalURL), content.originNoSuffix());
+      NS_ENSURE_SUCCESS(rv, false);
+
+      nsAutoCString origin;
+      url->Origin(origin);
+
+      nsAutoCString principalOrigin;
+      principalURL->Origin(principalOrigin);
+
+      // The vast majority of sites should simply result in the same principal
+      // and URL origin.
+      if (principalOrigin == origin) {
+        return true;
+      }
+
+      nsDependentCSubstring scheme = url->Scheme();
+
+      // Generally any origin can also open javascript: windows and workers.
+      if (scheme.LowerCaseEqualsLiteral("javascript")) {
+        return true;
+      }
+
+      // Linkable about URIs end up with a nested inner scheme of moz-safe-about
+      // but the url and its resulting origin will not have this transformed
+      // scheme, so ignore the "moz-safe-" prefix when the principal has that
+      // transformed scheme.
+      if (principalURL->Scheme().Equals("moz-safe-about")) {
+        return origin == principalOrigin ||
+               origin ==
+                   Substring(principalOrigin, 9 /*moz-safe-*/, origin.Length());
+      }
+
+      // Otherwise don't support this URL type in the clients sub-system for
+      // now.  This will exclude a variety of internal browser clients, but
+      // currently we don't need to support those.  This function can be
+      // expanded to handle more cases as necessary.
+      return false;
+    }
+    case PrincipalInfo::TSystemPrincipalInfo: {
+      nsDependentCSubstring scheme = url->Scheme();
+
+      // While many types of documents can be created with a system principal,
+      // there are only a few that can reasonably become windows.  We attempt
+      // to validate the list of known cases here with a simple scheme check.
+      return scheme.LowerCaseEqualsLiteral("about") ||
+             scheme.LowerCaseEqualsLiteral("chrome") ||
+             scheme.LowerCaseEqualsLiteral("resource") ||
+             scheme.LowerCaseEqualsLiteral("blob") ||
+             scheme.LowerCaseEqualsLiteral("javascript") ||
+             scheme.LowerCaseEqualsLiteral("view-source");
+    }
+    case PrincipalInfo::TNullPrincipalInfo: {
+      // A wide variety of clients can have a null principal.  For example,
+      // sandboxed iframes can have a normal content URL.  For now allow
+      // any parsable URL for null principals.  This is relatively safe since
+      // null principals have unique origins and won't most ClientManagerService
+      // queries anyway.
+      return true;
+    }
+    default: {
+      break;
+    }
+  }
+
+  // Clients (windows/workers) should never have an expanded principal type.
+  return false;
+}
+
+}  // namespace mozilla::dom
diff --git a/dom/clients/manager/ClientValidation.h b/dom/clients/manager/ClientValidation.h
new file mode 100644
index 0000000000..46278ad02e
--- /dev/null
+++ b/dom/clients/manager/ClientValidation.h
@@ -0,0 +1,28 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _mozilla_dom_ClientValidation_h
+#define _mozilla_dom_ClientValidation_h
+
+#include "nsStringFwd.h"
+
+namespace mozilla {
+
+namespace ipc {
+class PrincipalInfo;
+}  // namespace ipc
+
+namespace dom {
+
+bool ClientIsValidPrincipalInfo(
+    const mozilla::ipc::PrincipalInfo& aPrincipalInfo);
+
+bool ClientIsValidCreationURL(const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
+                              const nsACString& aURL);
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif  // _mozilla_dom_ClientValidation_h
diff --git a/dom/clients/manager/PClientHandle.ipdl b/dom/clients/manager/PClientHandle.ipdl
new file mode 100644
index 0000000000..eb6a182390
--- /dev/null
+++ b/dom/clients/manager/PClientHandle.ipdl
@@ -0,0 +1,33 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientManager;
+include protocol PClientHandleOp;
+include ClientIPCTypes;
+
+include "mozilla/ipc/ProtocolMessageUtils.h";
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+protocol PClientHandle
+{
+  manager PClientManager;
+
+  manages PClientHandleOp;
+
+parent:
+  async Teardown();
+
+  async PClientHandleOp(ClientOpConstructorArgs aArgs);
+
+child:
+  async ExecutionReady(IPCClientInfo aClientInfo);
+
+  async __delete__();
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientHandleOp.ipdl b/dom/clients/manager/PClientHandleOp.ipdl
new file mode 100644
index 0000000000..2962d6380f
--- /dev/null
+++ b/dom/clients/manager/PClientHandleOp.ipdl
@@ -0,0 +1,21 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientHandle;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+protocol PClientHandleOp
+{
+  manager PClientHandle;
+
+child:
+  async __delete__(ClientOpResult aResult);
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientManager.ipdl b/dom/clients/manager/PClientManager.ipdl
new file mode 100644
index 0000000000..a67985083f
--- /dev/null
+++ b/dom/clients/manager/PClientManager.ipdl
@@ -0,0 +1,42 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PBackground;
+include protocol PClientHandle;
+include protocol PClientManagerOp;
+include protocol PClientNavigateOp;
+include protocol PClientSource;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+sync protocol PClientManager
+{
+  manager PBackground;
+
+  manages PClientHandle;
+  manages PClientManagerOp;
+  manages PClientNavigateOp;
+  manages PClientSource;
+
+parent:
+  async Teardown();
+
+  async PClientHandle(IPCClientInfo aClientInfo);
+  async PClientManagerOp(ClientOpConstructorArgs aArgs);
+  async PClientSource(ClientSourceConstructorArgs aArgs);
+
+  async ExpectFutureClientSource(IPCClientInfo aClientInfo);
+  async ForgetFutureClientSource(IPCClientInfo aClientInfo);
+
+child:
+  async PClientNavigateOp(ClientNavigateOpConstructorArgs aArgs);
+
+  async __delete__();
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientManagerOp.ipdl b/dom/clients/manager/PClientManagerOp.ipdl
new file mode 100644
index 0000000000..21583db06a
--- /dev/null
+++ b/dom/clients/manager/PClientManagerOp.ipdl
@@ -0,0 +1,21 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientManager;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+protocol PClientManagerOp
+{
+  manager PClientManager;
+
+child:
+  async __delete__(ClientOpResult aResult);
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientNavigateOp.ipdl b/dom/clients/manager/PClientNavigateOp.ipdl
new file mode 100644
index 0000000000..6544c838c0
--- /dev/null
+++ b/dom/clients/manager/PClientNavigateOp.ipdl
@@ -0,0 +1,21 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientManager;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+protocol PClientNavigateOp
+{
+  manager PClientManager;
+
+parent:
+  async __delete__(ClientOpResult aResult);
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientSource.ipdl b/dom/clients/manager/PClientSource.ipdl
new file mode 100644
index 0000000000..869cdf9504
--- /dev/null
+++ b/dom/clients/manager/PClientSource.ipdl
@@ -0,0 +1,37 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientManager;
+include protocol PClientSourceOp;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+sync protocol PClientSource
+{
+  manager PClientManager;
+
+  manages PClientSourceOp;
+
+parent:
+  sync WorkerSyncPing();
+  async Teardown();
+  async ExecutionReady(ClientSourceExecutionReadyArgs aArgs);
+  async Freeze();
+  async Thaw();
+  async InheritController(ClientControlledArgs aArgs);
+  async NoteDOMContentLoaded();
+
+child:
+  async PClientSourceOp(ClientOpConstructorArgs aArgs);
+
+  async EvictFromBFCache();
+
+  async __delete__();
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/PClientSourceOp.ipdl b/dom/clients/manager/PClientSourceOp.ipdl
new file mode 100644
index 0000000000..e3186bc00b
--- /dev/null
+++ b/dom/clients/manager/PClientSourceOp.ipdl
@@ -0,0 +1,21 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PClientSource;
+include ClientIPCTypes;
+
+namespace mozilla {
+namespace dom {
+
+[ManualDealloc, ChildImpl=virtual, ParentImpl=virtual]
+protocol PClientSourceOp
+{
+  manager PClientSource;
+
+parent:
+  async __delete__(ClientOpResult aResult);
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/clients/manager/moz.build b/dom/clients/manager/moz.build
new file mode 100644
index 0000000000..92eca6087c
--- /dev/null
+++ b/dom/clients/manager/moz.build
@@ -0,0 +1,70 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+EXPORTS.mozilla.dom += [
+    "ClientChannelHelper.h",
+    "ClientHandle.h",
+    "ClientHandleParent.h",
+    "ClientInfo.h",
+    "ClientIPCUtils.h",
+    "ClientManager.h",
+    "ClientManagerActors.h",
+    "ClientManagerService.h",
+    "ClientOpenWindowUtils.h",
+    "ClientOpPromise.h",
+    "ClientSource.h",
+    "ClientState.h",
+    "ClientThing.h",
+]
+
+UNIFIED_SOURCES += [
+    "ClientChannelHelper.cpp",
+    "ClientHandle.cpp",
+    "ClientHandleChild.cpp",
+    "ClientHandleOpChild.cpp",
+    "ClientHandleOpParent.cpp",
+    "ClientHandleParent.cpp",
+    "ClientInfo.cpp",
+    "ClientManager.cpp",
+    "ClientManagerActors.cpp",
+    "ClientManagerChild.cpp",
+    "ClientManagerOpChild.cpp",
+    "ClientManagerOpParent.cpp",
+    "ClientManagerParent.cpp",
+    "ClientManagerService.cpp",
+    "ClientNavigateOpChild.cpp",
+    "ClientNavigateOpParent.cpp",
+    "ClientOpenWindowUtils.cpp",
+    "ClientPrincipalUtils.cpp",
+    "ClientSource.cpp",
+    "ClientSourceChild.cpp",
+    "ClientSourceOpChild.cpp",
+    "ClientSourceOpParent.cpp",
+    "ClientSourceParent.cpp",
+    "ClientState.cpp",
+    "ClientValidation.cpp",
+]
+
+IPDL_SOURCES += [
+    "ClientIPCTypes.ipdlh",
+    "PClientHandle.ipdl",
+    "PClientHandleOp.ipdl",
+    "PClientManager.ipdl",
+    "PClientManagerOp.ipdl",
+    "PClientNavigateOp.ipdl",
+    "PClientSource.ipdl",
+    "PClientSourceOp.ipdl",
+]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
+
+MOCHITEST_MANIFESTS += []
+
+BROWSER_CHROME_MANIFESTS += []
+
+XPCSHELL_TESTS_MANIFESTS += []