eui-ruby 0.1.0

data/lib/eui/component.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require_relative 'dsl'
+require_relative 'errors'
+
+module EUI
+  # One component: state, handlers, and a view that is a function of the
+  # state.
+  #
+  #     class Counter < EUI::Component
+  #       def mount(_params) = @count = 0
+  #
+  #       on "increment" { @count += 1 }
+  #
+  #       def render
+  #         column(gap: 4, pad: 8) do
+  #           [text(@count.to_s, size: "4xl"), button("+", "increment")]
+  #         end
+  #       end
+  #     end
+  #
+  # A handler changes state and returns; it never touches the tree. What
+  # reaches the client is the *difference* the change made, which is the
+  # one thing this protocol is for.
+  class Component
+    include DSL
+
+    class << self
+      def handlers
+        @handlers ||= superclass.respond_to?(:handlers) ? superclass.handlers.dup : {}
+      end
+
+      # Name an event this component answers. The name is the one the view
+      # put on a node, not the event kind: `{"on" => {"wake" => "tick"}}`
+      # arrives here as `tick`.
+      def on(name, &block)
+        handlers[name.to_s] = block
+        self
+      end
+
+      def handler_for(name) = handlers[name.to_s]
+    end
+
+    attr_reader :session, :viewport
+
+    def initialize(session: nil)
+      @session = session
+      @viewport = {}
+    end
+
+    # Called once, when the socket has said Hello. `params["viewport"]` is
+    # the window as it is right now; a `viewport` event follows every
+    # resize, so nothing has to ask.
+    def mount(params)
+      @viewport = params['viewport'] || {}
+    end
+
+    # Called when the session ends, for whatever reason.
+    def unmount; end
+
+    # The view: a hash, and a pure function of the state. It is called
+    # after every handler, so it must be cheap and must not have effects.
+    def render
+      raise NotImplementedError, "#{self.class} has no render"
+    end
+
+    # Dispatch. A block registered with `on` wins; otherwise a public
+    # method of the same name; otherwise the event is dropped with a line
+    # in the log, because a view naming a handler nobody wrote is a typo
+    # and not a reason to end somebody's session.
+    def handle(name, params)
+      @viewport = params['viewport'] if name == 'viewport' && params['viewport']
+
+      block = self.class.handler_for(name)
+      return instance_exec(params, &block) if block
+
+      method_name = name.to_sym
+      return public_send(method_name, params) if respond_to?(method_name) && method(method_name).arity != 0
+      return public_send(method_name) if respond_to?(method_name)
+      return if name == 'viewport'
+
+      raise Error, "no handler for '#{name}'"
+    end
+
+    # Render again although nothing arrived: a timer, a message from
+    # another session, anything this process knows and the client does not.
+    def refresh! = @session&.refresh!
+
+    def notify(title, body: '', tag: '') = @session&.notify(title, body: body, tag: tag)
+
+    def close(reason = 'the application closed the session') = @session&.close(reason)
+
+    # Whether the person granted this application something it asked for.
+    # Being granted is a separate act from asking, and this is the only
+    # place the answer shows up.
+    def granted?(capability) = @session ? @session.granted?(capability) : false
+
+    # The window, in device-independent pixels. Every width worth having is
+    # derived from it: a fixed one is what reads as unfinished on somebody
+    # else's screen.
+    def width  = @viewport['width'].to_i
+    def height = @viewport['height'].to_i
+    def dark?  = @viewport['mode'] == 'dark'
+  end
+end

data/lib/eui/dsl.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module EUI
+  # The view, written as Ruby.
+  #
+  # Every helper answers a plain hash — `{"k" =>, "s" =>, "c" =>}` — so a
+  # view is data all the way down: printable, comparable, testable without
+  # a socket. Style keys are the spec's own vocabulary, passed as keyword
+  # arguments; `on:`, `props:` and `key:` are the three that are not style.
+  #
+  #     column(gap: 4, pad: 6, bg: "surface.base") do
+  #       [text("Hello", size: "2xl", weight: "bold"),
+  #        button("Increment", "increment")]
+  #     end
+  module DSL
+    module_function
+
+    RESERVED = %i[on props key intern].freeze
+
+    def node(kind, children = nil, text: nil, **options)
+      style = options.reject { |k, _| RESERVED.include?(k) }
+      out = { 'k' => kind.to_s }
+      out['s'] = style unless style.empty?
+      out['t'] = text unless text.nil?
+      out['key'] = options[:key].to_s if options[:key]
+      out['intern'] = true if options[:intern]
+      out['p'] = stringify(options[:props]) if options[:props]
+      out['on'] = stringify(options[:on]) if options[:on]
+      kids = Array(children).compact
+      out['c'] = kids unless kids.empty?
+      out
+    end
+
+    def stringify(hash)
+      hash.each_with_object({}) { |(k, v), out| out[k.to_s] = v }
+    end
+
+    # ------------------------------------------------------------ primitives
+
+    def box(children = nil, **options, &block)
+      node('box', children || block&.call, **options)
+    end
+
+    def row(children = nil, **options, &block)
+      box(children || block&.call, **options.merge(display: 'row'))
+    end
+
+    def column(children = nil, **options, &block)
+      box(children || block&.call, **options.merge(display: 'column'))
+    end
+
+    # Children overlap, ordered by `z`: menus, tooltips, a badge on a
+    # corner.
+    def stack(children = nil, **options, &block)
+      box(children || block&.call, **options.merge(display: 'stack'))
+    end
+
+    def text(content, **options)
+      node('text', nil, text: content.to_s, **options)
+    end
+
+    def image(src, **options)
+      node('image', nil, **options.merge(props: (options[:props] || {}).merge('src' => src)))
+    end
+
+    def icon(name, **options)
+      node('icon', nil, **options.merge(props: (options[:props] || {}).merge('name' => name)))
+    end
+
+    def input(value, on_change: nil, **options)
+      props = (options[:props] || {}).merge('value' => value.to_s)
+      on = options[:on] || {}
+      on = on.merge('change' => on_change) if on_change
+      node('input', nil, **options.merge(props: props, on: on))
+    end
+
+    def textarea(value, on_change: nil, **options)
+      props = (options[:props] || {}).merge('value' => value.to_s)
+      on = options[:on] || {}
+      on = on.merge('change' => on_change) if on_change
+      node('textarea', nil, **options.merge(props: props, on: on))
+    end
+
+    def scroll(children = nil, **options, &block)
+      node('scroll', children || block&.call, **options)
+    end
+
+    # A virtualised list: only the window in view is laid out, and the
+    # client asks for another range with a `window` event.
+    def list(children = nil, **options, &block)
+      node('list', children || block&.call, **options)
+    end
+
+    def canvas(paths, **options)
+      node('canvas', nil, **options.merge(props: (options[:props] || {}).merge('paths' => paths)))
+    end
+
+    def overlay(children = nil, **options, &block)
+      node('overlay', children || block&.call, **options)
+    end
+
+    def sizer(children = nil, **options, &block)
+      node('sizer', children || block&.call, **options)
+    end
+
+    # Flexible empty space. Inert: no text, no props, no handlers.
+    def spacer(**options)
+      node('spacer', nil, **options.merge(grow: options.fetch(:grow, 1)))
+    end
+
+    def divider(**options)
+      node('divider', nil, **{ height: 1, bg: 'border.subtle', width: '100%' }.merge(options))
+    end
+
+    # Identity for reconciliation: a row that moved is a row that moved,
+    # rather than every row below it having changed.
+    def keyed(key, node)
+      node.merge('key' => key.to_s)
+    end
+
+    # -------------------------------------------------------------- widgets
+    #
+    # Composed from the primitives above and nothing else, which is the
+    # whole reason the catalogue can grow without shipping a new client.
+
+    TONES = {
+      'accent' => %w[accent.base accent.on],
+      'danger' => %w[danger.base danger.on],
+      'success' => %w[success.base success.on],
+      'warning' => %w[warning.base warning.on],
+      'info' => %w[info.base info.on],
+      'quiet' => %w[surface.raised text.default]
+    }.freeze
+
+    def button(label, event, tone: 'accent', size: 'md', **options)
+      bg, fg = TONES.fetch(tone.to_s) { raise ViewError, "unknown button tone '#{tone}'" }
+      pad = { 'sm' => [1, 3], 'md' => [2, 4], 'lg' => [3, 5] }.fetch(size.to_s, [2, 4])
+      style = {
+        display: 'row', justify: 'center', align: 'center',
+        bg: bg, radius: 'md', pad: pad, cursor: 'pointer', transition: 'fast'
+      }.merge(options.reject { |k, _| RESERVED.include?(k) })
+      on = (options[:on] || {}).merge('click' => event)
+      box([text(label, fg: fg, weight: 'medium')], **style, on: on, key: options[:key])
+    end
+
+    # A surface a thing sits on: raised, padded, with a hairline.
+    def card(children = nil, **options, &block)
+      style = {
+        display: 'column', bg: 'surface.raised', radius: 'md', pad: 5, gap: 4,
+        border: 1, border_color: 'border.subtle'
+      }.merge(options.reject { |k, _| RESERVED.include?(k) })
+      box(children || block&.call, **style, on: options[:on], key: options[:key])
+    end
+
+    # A label above a field, the pair kept together.
+    def field(label, value, on_change:, **options)
+      column(gap: 2, **options.reject { |k, _| RESERVED.include?(k) }) do
+        [
+          text(label, size: 'sm', fg: 'text.muted'),
+          input(value, on_change: on_change, bg: 'surface.sunken', radius: 'sm',
+                       pad: [2, 3], border: 1, border_color: 'border.default')
+        ]
+      end
+    end
+  end
+end

data/lib/eui/errors.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module EUI
+  # Anything this library raises on its own.
+  class Error < StandardError; end
+
+  # Bytes that are not a legal encoding of what they claim to be.
+  #
+  # The decoder refuses rather than repairs: a non-minimal varint, a value
+  # outside an enumeration, a length that does not account for every byte.
+  # "Ignore what you don't understand" is how one implementation's frame
+  # becomes another's smuggling channel.
+  class DecodeError < Error; end
+
+  # A view the protocol has no way to carry: an unknown style key, a colour
+  # role nobody defined, a tree deeper than the client accepts. Raised while
+  # encoding, which is the only moment at which the author can still fix it.
+  class ViewError < Error; end
+end

data/lib/eui/manifest.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'fileutils'
+require_relative 'proto'
+require_relative 'assets'
+
+module EUI
+  # The application manifest served at `/.well-known/eui`
+  # (`spec/01-transport.md` §2.1): an `EUIM` record, signed by the
+  # publisher, that a client reads before it opens a session.
+  #
+  # The signature is what makes trust-on-first-use mean anything: the
+  # client pins `publisher_key` against `app_id` on first run and refuses a
+  # different one later. So the key belongs to the *application*, not to a
+  # deployment — keep the file, and keep it out of the repository.
+  class Manifest
+    MAGIC = 'EUIM'
+    RECORD_VERSION = 1
+    MAX_STR = 256
+
+    KEY = {
+      app_id: 0, name: 1, version: 2, protocol_min: 3, protocol_max: 4,
+      publisher_key: 5, capabilities: 6, theme: 7, entry: 8, rotation: 9,
+      signature: 10
+    }.freeze
+
+    attr_accessor :app_id, :name, :version, :protocol_min, :protocol_max,
+                  :capabilities, :theme, :entry
+
+    def initialize(app_id:, name:, key:, version: '0.1.0', entry: '/_eui/session',
+                   capabilities: 0, theme: nil, protocol_min: 1, protocol_max: Proto::PROTOCOL_VERSION)
+      @app_id = app_id
+      @name = name
+      @version = version
+      @key = key
+      @entry = entry
+      @capabilities = capabilities.is_a?(Integer) ? capabilities : Proto::Caps.mask(capabilities)
+      @theme = theme
+      @protocol_min = protocol_min
+      @protocol_max = protocol_max
+    end
+
+    # An Ed25519 key kept on disk, generated on first use. Never committed:
+    # whoever holds it can publish as this application.
+    def self.publisher_key(path)
+      if File.exist?(path)
+        OpenSSL::PKey.read(File.read(path))
+      else
+        key = OpenSSL::PKey.generate_key('ED25519')
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, key.private_to_pem)
+        File.chmod(0o600, path)
+        key
+      end
+    end
+
+    def public_key_hex = @key.raw_public_key.unpack1('H*')
+
+    # The bytes the publisher signs: every field but the signature. A
+    # decoder rebuilds them exactly, because the order is fixed.
+    def signed_bytes = write(nil)
+
+    def encode
+      write(@key.sign(nil, signed_bytes))
+    end
+
+    # The capability names this application asks for. Being granted them is
+    # a separate act, and one this server never hears the answer to unless
+    # the client reports it in its Hello.
+    def capability_names = Proto::Caps.names(@capabilities)
+
+    private
+
+    def write(signature)
+      fields = [
+        [KEY[:app_id], Proto::Value.str(check(@app_id, 'app_id'))],
+        [KEY[:name], Proto::Value.str(check(@name, 'name'))],
+        [KEY[:version], Proto::Value.str(check(@version, 'version'))],
+        [KEY[:protocol_min], Proto::Value.int(@protocol_min)],
+        [KEY[:protocol_max], Proto::Value.int(@protocol_max)],
+        [KEY[:publisher_key], Proto::Value.str(public_key_hex)],
+        [KEY[:capabilities], Proto::Value.int(@capabilities)],
+        [KEY[:theme], @theme ? Proto::Value.str(Assets.hex(@theme)) : Proto::Value.null],
+        [KEY[:entry], Proto::Value.str(check(@entry, 'entry'))],
+        # No rotation: this key has never been anything else. When one is
+        # needed it is the previous key and its signature over the new one,
+        # and the client's pin moves rather than the session failing.
+        [KEY[:rotation], Proto::Value.null]
+      ]
+      fields << [KEY[:signature], Proto::Value.str(signature.unpack1('H*'))] if signature
+
+      w = Proto::Writer.new
+      w.raw(MAGIC).u8(RECORD_VERSION).varint(fields.length)
+      fields.each do |(k, v)|
+        w.varint(k)
+        v.encode(w)
+      end
+      w.to_s
+    end
+
+    def check(value, what)
+      string = value.to_s
+      raise Error, "manifest #{what} is at most #{MAX_STR} bytes" if string.bytesize > MAX_STR
+
+      string
+    end
+  end
+end

data/lib/eui/proto/frame.rb

@@ -0,0 +1,243 @@
+# frozen_string_literal: true
+
+require_relative 'op'
+
+module EUI
+  module Proto
+    # Which palette the viewer is using. A *client* fact: it reaches the
+    # server only so a server can pick a matching image, never so it can
+    # resolve a colour.
+    module ThemeMode
+      BY_CODE = { 0 => 'light', 1 => 'dark', 2 => 'high_contrast' }.freeze
+      def self.name(code)
+        BY_CODE.fetch(code) { raise DecodeError, "unknown theme mode #{code}" }
+      end
+    end
+
+    # How tightly controls are packed.
+    module Density
+      BY_CODE = { 0 => 'compact', 1 => 'cozy', 2 => 'comfortable' }.freeze
+      def self.name(code)
+        BY_CODE.fetch(code) { raise DecodeError, "unknown density #{code}" }
+      end
+    end
+
+    # Capability bits, as granted by the person and reported to the server
+    # (`spec/01-transport.md` §2.1). Nothing is granted by being asked for.
+    module Caps
+      CAMERA          = 1 << 0
+      MICROPHONE      = 1 << 1
+      CLIPBOARD_READ  = 1 << 2
+      CLIPBOARD_WRITE = 1 << 3
+      NOTIFICATIONS   = 1 << 4
+      LOCATION        = 1 << 5
+      FS_PICK         = 1 << 6
+      FS_SAVE         = 1 << 7
+      NFC             = 1 << 8
+      SCENE           = 1 << 9
+      NET_OPEN        = 1 << 10
+
+      NAMES = {
+        'camera' => CAMERA, 'microphone' => MICROPHONE,
+        'clipboard.read' => CLIPBOARD_READ, 'clipboard.write' => CLIPBOARD_WRITE,
+        'notifications' => NOTIFICATIONS, 'location' => LOCATION,
+        'fs.pick' => FS_PICK, 'fs.save' => FS_SAVE, 'nfc' => NFC,
+        'scene' => SCENE, 'net.open' => NET_OPEN
+      }.freeze
+
+      # Every bit this revision defines. A bit outside it is a decode error:
+      # a client that does not know what a bit means must not agree to it,
+      # and neither must a server.
+      ALL = 0x7FF
+
+      def self.bit(name)
+        NAMES.fetch(name.to_s) { raise Error, "unknown capability '#{name}'" }
+      end
+
+      def self.mask(names) = Array(names).reduce(0) { |acc, n| acc | bit(n) }
+
+      def self.names(mask) = NAMES.select { |_, bit| (mask & bit) != 0 }.keys
+    end
+
+    # The viewer's presentation state.
+    Viewport = Struct.new(:width, :height, :scale, :mode, :density, :font_scale) do
+      def self.default = new(0, 0, 100, 0, 1, 100)
+
+      def self.decode(reader)
+        new(reader.varint32, reader.varint32, reader.u16,
+            ThemeMode::BY_CODE.key?(m = reader.u8) ? m : (raise DecodeError, "unknown theme mode #{m}"),
+            Density::BY_CODE.key?(d = reader.u8) ? d : (raise DecodeError, "unknown density #{d}"),
+            reader.u16)
+      end
+
+      def encode(writer)
+        writer.varint(width).varint(height).u16(scale).u8(mode).u8(density).u16(font_scale)
+      end
+
+      # What a view sees: pixels, a ratio, and names rather than codes.
+      def to_h
+        {
+          'width' => width, 'height' => height, 'scale' => scale / 100.0,
+          'mode' => ThemeMode.name(mode), 'density' => Density.name(density),
+          'font_scale' => font_scale / 100.0
+        }
+      end
+    end
+
+    # A session the client still holds a tree for, offered back after the
+    # socket broke (`spec/01-transport.md` §4.1). An offer, not a claim.
+    Resume = Struct.new(:session, :acked)
+
+    Hello = Struct.new(:version, :viewport, :granted, :resume)
+    Welcome = Struct.new(:version, :session, :resumed)
+    EventFrame = Struct.new(:node, :event, :name, :payload)
+    Transfer = Struct.new(:id, :seq, :flag, :bytes) do
+      MORE = 0
+      LAST = 1
+      ABORT = 2
+
+      def self.decode(reader)
+        id = reader.varint32
+        seq = reader.varint32
+        flag = reader.u8
+        raise DecodeError, "unknown chunk flag #{flag}" if flag > ABORT
+
+        max = flag == ABORT ? Limits::MAX_ABORT_REASON : Limits::MAX_TRANSFER_CHUNK_BYTES
+        new(id, seq, flag, reader.bytes(max, 'transfer chunk'))
+      end
+
+      def encode(writer)
+        writer.varint(id).varint(seq).u8(flag).bytes(bytes)
+      end
+    end
+
+    # A whole session message (`spec/01-transport.md` §3). One frame per
+    # WebSocket binary message, and a text frame ends the session.
+    class Frame
+      HELLO    = 0x01
+      WELCOME  = 0x02
+      BATCH    = 0x03
+      EVENT    = 0x04
+      ACK      = 0x05
+      PING     = 0x06
+      PONG     = 0x07
+      ERROR    = 0x08
+      RESYNC   = 0x09
+      VIEWPORT = 0x0A
+      UPLOAD   = 0x0B
+      BLOB     = 0x0C
+
+      attr_reader :kind, :body
+
+      def initialize(kind, body = nil)
+        @kind = kind
+        @body = body
+      end
+
+      class << self
+        def hello(h)     = new(HELLO, h)
+        def welcome(w)   = new(WELCOME, w)
+        def batch(b)     = new(BATCH, b)
+        def event(e)     = new(EVENT, e)
+        def ack(seq)     = new(ACK, seq)
+        def ping(nonce)  = new(PING, nonce)
+        def pong(nonce)  = new(PONG, nonce)
+        def error(code, message) = new(ERROR, [code, message])
+        def resync       = new(RESYNC)
+        def viewport(v)  = new(VIEWPORT, v)
+        def upload(t)    = new(UPLOAD, t)
+        def blob(t)      = new(BLOB, t)
+      end
+
+      # Decode a complete WebSocket message. Trailing bytes are an error:
+      # a length that does not account for every byte of the message is how
+      # one implementation's frame becomes another's smuggling channel.
+      def self.decode(message)
+        r = Reader.new(message)
+        kind = r.u8
+        len = r.varint
+        raise DecodeError, 'frame length' if len > Limits::MAX_FRAME_BYTES
+
+        payload = r.take(len)
+        r.finish!
+        p = Reader.new(payload)
+
+        frame =
+          case kind
+          when HELLO
+            version = p.varint32
+            viewport = Viewport.decode(p)
+            granted = p.varint32
+            raise DecodeError, 'unknown capability bit' if (granted & ~Caps::ALL) != 0
+
+            resume =
+              case (tag = p.u8)
+              when 0 then nil
+              when 1 then Resume.new(p.take(16), p.varint)
+              else raise DecodeError, "unknown resume tag #{tag}"
+              end
+            hello(Hello.new(version, viewport, granted, resume))
+          when WELCOME
+            version = p.varint32
+            session = p.take(16)
+            resumed = case p.u8
+                      when 0 then false
+                      when 1 then true
+                      else raise DecodeError, 'resumed must be 0 or 1'
+                      end
+            welcome(Welcome.new(version, session, resumed))
+          when BATCH then batch(Batch.decode(p))
+          when EVENT
+            node = p.varint32
+            event = p.u8
+            EventKind.name(event)
+            event(EventFrame.new(node, event, p.varint32, Value.decode(p)))
+          when ACK then ack(p.varint)
+          when PING then ping(p.take(8))
+          when PONG then pong(p.take(8))
+          when ERROR then error(p.varint32, p.str(Limits::MAX_INLINE_STR, 'error message'))
+          when RESYNC then resync
+          when VIEWPORT then viewport(Viewport.decode(p))
+          when UPLOAD then upload(Transfer.decode(p))
+          when BLOB then blob(Transfer.decode(p))
+          else raise DecodeError, "unknown frame kind #{kind}"
+          end
+        p.finish!
+        frame
+      end
+
+      def encode
+        body = Writer.new
+        case @kind
+        when HELLO
+          body.varint(@body.version)
+          @body.viewport.encode(body)
+          body.varint(@body.granted)
+          if @body.resume
+            body.u8(1).raw(@body.resume.session).varint(@body.resume.acked)
+          else
+            body.u8(0)
+          end
+        when WELCOME
+          body.varint(@body.version).raw(@body.session).u8(@body.resumed ? 1 : 0)
+        when BATCH then @body.encode(body)
+        when EVENT
+          body.varint(@body.node).u8(@body.event).varint(@body.name)
+          @body.payload.encode(body)
+        when ACK then body.varint(@body)
+        when PING, PONG then body.raw(@body)
+        when ERROR then body.varint(@body[0]).str(@body[1])
+        when RESYNC then nil
+        when VIEWPORT then @body.encode(body)
+        when UPLOAD, BLOB then @body.encode(body)
+        else raise Error, "cannot encode frame kind #{@kind}"
+        end
+
+        payload = body.to_s
+        out = Writer.new
+        out.u8(@kind).varint(payload.bytesize).raw(payload)
+        out.to_s
+      end
+    end
+  end
+end

data/lib/eui/proto/limits.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module EUI
+  module Proto
+    # Protocol limits, normative in `spec/02-wire-format.md` §6.
+    #
+    # Every one of them is checked while decoding, before the memory it
+    # bounds is allocated: a hostile peer can be annoying, it cannot make
+    # this process exhaust itself.
+    module Limits
+      MAX_FRAME_BYTES       = 8 * 1024 * 1024
+      MAX_TREE_DEPTH        = 256
+      MAX_NODES             = 1_000_000
+      MAX_ATOMS             = 65_535
+      MAX_ATOM_BYTES        = 64 * 1024
+      MAX_ATOM_TOTAL_BYTES  = 8 * 1024 * 1024
+      MAX_STYLES            = 65_535
+      MAX_COLORS            = 4_095
+      MAX_CHUNKS            = 4_095
+      MAX_CHILDREN          = 65_535
+      MAX_PROPS             = 64
+      MAX_HANDLERS          = 16
+      MAX_OPS_PER_BATCH     = 65_535
+      MAX_INLINE_STR        = 4 * 1024
+      MAX_VALUE_DEPTH       = 4
+      MAX_VALUE_LIST        = 1_000_000
+
+      MAX_CHUNK_BYTES          = 64 * 1024
+      MAX_TRANSFER_CHUNK_BYTES = 256 * 1024
+      MAX_UPLOAD_BYTES         = 64 * 1024 * 1024
+      DEFAULT_UPLOAD_BYTES     = 16 * 1024 * 1024
+      MAX_SAVE_BYTES           = 256 * 1024 * 1024
+      MAX_ABORT_REASON         = 256
+
+      MAX_NOTIFY_TITLE     = 256
+      MAX_NOTIFY_BODY      = 1024
+      MAX_NOTIFY_TAG       = 64
+      MAX_NOTIFY_PER_BATCH = 4
+
+      STYLE_RECORD_BYTES = 64
+      HASH_BYTES         = 32
+
+      MAX_FONT_ROLE      = 9
+      MAX_FACES_PER_ROLE = 8
+    end
+  end
+end