@aglyn/aglyn 1.0.0-beta.211 → 1.0.0-beta.213

package/src/lib/plugin-manager/realm-host-aglyn.generated.js

@@ -0,0 +1,101 @@
+/**
+ * GENERATED FILE — do not edit. Regenerate with:
+ *   node tools/scripts/generate-realm-host-exports.mjs
+ *
+ * The realm plugin surface of `@aglyn/aglyn` (AGL-3392): what a signed
+ * bundle reads from core. Imported only by the lazily loaded host module.
+ */ /* eslint-disable */ import * as m0 from "../aglyn.js";
+import * as m1 from "../app-utils/binding-tokens.js";
+import * as m2 from "../app-utils/enabled-plugins-context.js";
+import * as m3 from "../app-utils/functions.js";
+import * as m4 from "../app-utils/node-identity.js";
+import * as m5 from "../app-utils/screen-link-context-value.js";
+import * as m6 from "../app-utils/site-context.js";
+import * as m7 from "../app-utils/variables.js";
+import * as m8 from "../foundation/constants/components.js";
+import * as m9 from "../foundation/constants/shared.js";
+import * as m10 from "../foundation/definitions/components.types.js";
+import * as m11 from "./feature-plugins.js";
+import * as m12 from "../types/nodes.js";
+export const AGLYN_HOST_SURFACE = Object.freeze({
+    Aglyn: m0.Aglyn,
+    aglyn: m0.aglyn,
+    canvas: m0.canvas,
+    components: m0.components,
+    emitter: m0.emitter,
+    logger: m0.logger,
+    plugins: m0.plugins,
+    FUNCTION_TOKEN_PATTERN: m1.FUNCTION_TOKEN_PATTERN,
+    MISSING_BINDING_LABEL: m1.MISSING_BINDING_LABEL,
+    NAME_TOKEN_PATTERN: m1.NAME_TOKEN_PATTERN,
+    VARIABLE_ID_TOKEN_PATTERN: m1.VARIABLE_ID_TOKEN_PATTERN,
+    bindingTokenNeedsDeep: m1.bindingTokenNeedsDeep,
+    displayBindingTokens: m1.displayBindingTokens,
+    editableBindingTokens: m1.editableBindingTokens,
+    formatFunctionIdToken: m1.formatFunctionIdToken,
+    formatVariableIdToken: m1.formatVariableIdToken,
+    keyById: m1.keyById,
+    nodesReferenceBinding: m1.nodesReferenceBinding,
+    normalizeBindingTokens: m1.normalizeBindingTokens,
+    rewriteBindingTokensDeep: m1.rewriteBindingTokensDeep,
+    textReferencesBinding: m1.textReferencesBinding,
+    CATEGORY_REQUIRED_CAPABILITY: m2.CATEGORY_REQUIRED_CAPABILITY,
+    EnabledPluginsContext: m2.EnabledPluginsContext,
+    isCategoryCapabilityEnabled: m2.isCategoryCapabilityEnabled,
+    isFromEnabledPlugin: m2.isFromEnabledPlugin,
+    isSwitchedOffForRenderedSite: m2.isSwitchedOffForRenderedSite,
+    useEnabledPlugins: m2.useEnabledPlugins,
+    FUNCTION_BUILTIN_NAMES: m3.FUNCTION_BUILTIN_NAMES,
+    FUNCTION_MAX_OPERATIONS: m3.FUNCTION_MAX_OPERATIONS,
+    evaluateExpression: m3.evaluateExpression,
+    evaluateHostFunction: m3.evaluateHostFunction,
+    expressionIdentifiers: m3.expressionIdentifiers,
+    formatFunctionParameterOptions: m3.formatFunctionParameterOptions,
+    functionReferencedNames: m3.functionReferencedNames,
+    parseFunctionParameterOptions: m3.parseFunctionParameterOptions,
+    NodeIdentityContext: m4.NodeIdentityContext,
+    useNodeId: m4.useNodeId,
+    ScreenLinkContext: m5.ScreenLinkContext,
+    PREVIEW_REFUSED_STATUS: m6.PREVIEW_REFUSED_STATUS,
+    PREVIEW_WRITE_BLOCKED_EVENT: m6.PREVIEW_WRITE_BLOCKED_EVENT,
+    SiteContext: m6.SiteContext,
+    isPreviewRefusal: m6.isPreviewRefusal,
+    useSite: m6.useSite,
+    useSiteFetch: m6.useSiteFetch,
+    HOST_VARIABLE_TYPE_LABELS: m7.HOST_VARIABLE_TYPE_LABELS,
+    VARIABLE_NAME_PATTERN: m7.VARIABLE_NAME_PATTERN,
+    attachFunctionDefinitions: m7.attachFunctionDefinitions,
+    formatVariableValue: m7.formatVariableValue,
+    functionGlobals: m7.functionGlobals,
+    hasBindings: m7.hasBindings,
+    resolveBindings: m7.resolveBindings,
+    resolveNodesBindings: m7.resolveNodesBindings,
+    COMPONENT_CATEGORY_ORDER: m8.COMPONENT_CATEGORY_ORDER,
+    ComponentCategory: m8.ComponentCategory,
+    REUSABLE_COMPONENT_CATEGORY: m8.REUSABLE_COMPONENT_CATEGORY,
+    REUSABLE_EMAIL_BLOCK_CATEGORY: m8.REUSABLE_EMAIL_BLOCK_CATEGORY,
+    FEATURE_FLAG: m9.FEATURE_FLAG,
+    RICH_TEXT_COMMANDS: m9.RICH_TEXT_COMMANDS,
+    FieldComponentType: m10.FieldComponentType,
+    FieldValidatorType: m10.FieldValidatorType,
+    LinealDirectiveFlag: m10.LinealDirectiveFlag,
+    CONSOLE_STAFF_WIDGET_SLOTS: m11.CONSOLE_STAFF_WIDGET_SLOTS,
+    CONSOLE_WIDGET_SLOTS: m11.CONSOLE_WIDGET_SLOTS,
+    MUI_BUNDLE_ID: m11.MUI_BUNDLE_ID,
+    defineUiFeatureBundle: m11.defineUiFeatureBundle,
+    isConsoleStaffWidgetSlot: m11.isConsoleStaffWidgetSlot,
+    listConsoleExtensions: m11.listConsoleExtensions,
+    listConsoleNavItems: m11.listConsoleNavItems,
+    listConsoleOrgNavItems: m11.listConsoleOrgNavItems,
+    listConsoleProviders: m11.listConsoleProviders,
+    listConsoleStaffPages: m11.listConsoleStaffPages,
+    listConsoleWidgets: m11.listConsoleWidgets,
+    registerConsoleExtension: m11.registerConsoleExtension,
+    resolveConsoleOrgPluginPage: m11.resolveConsoleOrgPluginPage,
+    resolveConsolePluginPage: m11.resolveConsolePluginPage,
+    resolveConsoleStaffPage: m11.resolveConsoleStaffPage,
+    unregisterConsoleExtension: m11.unregisterConsoleExtension,
+    NodeType: m12.NodeType
+});
+
+//# sourceMappingURL=realm-host-aglyn.generated.js.map

package/src/lib/plugin-manager/realm-host-aglyn.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/realm-host-aglyn.generated.ts"],"sourcesContent":["/**\n * GENERATED FILE — do not edit. Regenerate with:\n *   node tools/scripts/generate-realm-host-exports.mjs\n *\n * The realm plugin surface of `@aglyn/aglyn` (AGL-3392): what a signed\n * bundle reads from core. Imported only by the lazily loaded host module.\n */\n/* eslint-disable */\n\nimport * as m0 from \"../aglyn\"\nimport * as m1 from \"../app-utils/binding-tokens\"\nimport * as m2 from \"../app-utils/enabled-plugins-context\"\nimport * as m3 from \"../app-utils/functions\"\nimport * as m4 from \"../app-utils/node-identity\"\nimport * as m5 from \"../app-utils/screen-link-context-value\"\nimport * as m6 from \"../app-utils/site-context\"\nimport * as m7 from \"../app-utils/variables\"\nimport * as m8 from \"../foundation/constants/components\"\nimport * as m9 from \"../foundation/constants/shared\"\nimport * as m10 from \"../foundation/definitions/components.types\"\nimport * as m11 from \"./feature-plugins\"\nimport * as m12 from \"../types/nodes\"\n\nexport const AGLYN_HOST_SURFACE: Readonly<Record<string, unknown>> = Object.freeze({\n  Aglyn: m0.Aglyn,\n  aglyn: m0.aglyn,\n  canvas: m0.canvas,\n  components: m0.components,\n  emitter: m0.emitter,\n  logger: m0.logger,\n  plugins: m0.plugins,\n  FUNCTION_TOKEN_PATTERN: m1.FUNCTION_TOKEN_PATTERN,\n  MISSING_BINDING_LABEL: m1.MISSING_BINDING_LABEL,\n  NAME_TOKEN_PATTERN: m1.NAME_TOKEN_PATTERN,\n  VARIABLE_ID_TOKEN_PATTERN: m1.VARIABLE_ID_TOKEN_PATTERN,\n  bindingTokenNeedsDeep: m1.bindingTokenNeedsDeep,\n  displayBindingTokens: m1.displayBindingTokens,\n  editableBindingTokens: m1.editableBindingTokens,\n  formatFunctionIdToken: m1.formatFunctionIdToken,\n  formatVariableIdToken: m1.formatVariableIdToken,\n  keyById: m1.keyById,\n  nodesReferenceBinding: m1.nodesReferenceBinding,\n  normalizeBindingTokens: m1.normalizeBindingTokens,\n  rewriteBindingTokensDeep: m1.rewriteBindingTokensDeep,\n  textReferencesBinding: m1.textReferencesBinding,\n  CATEGORY_REQUIRED_CAPABILITY: m2.CATEGORY_REQUIRED_CAPABILITY,\n  EnabledPluginsContext: m2.EnabledPluginsContext,\n  isCategoryCapabilityEnabled: m2.isCategoryCapabilityEnabled,\n  isFromEnabledPlugin: m2.isFromEnabledPlugin,\n  isSwitchedOffForRenderedSite: m2.isSwitchedOffForRenderedSite,\n  useEnabledPlugins: m2.useEnabledPlugins,\n  FUNCTION_BUILTIN_NAMES: m3.FUNCTION_BUILTIN_NAMES,\n  FUNCTION_MAX_OPERATIONS: m3.FUNCTION_MAX_OPERATIONS,\n  evaluateExpression: m3.evaluateExpression,\n  evaluateHostFunction: m3.evaluateHostFunction,\n  expressionIdentifiers: m3.expressionIdentifiers,\n  formatFunctionParameterOptions: m3.formatFunctionParameterOptions,\n  functionReferencedNames: m3.functionReferencedNames,\n  parseFunctionParameterOptions: m3.parseFunctionParameterOptions,\n  NodeIdentityContext: m4.NodeIdentityContext,\n  useNodeId: m4.useNodeId,\n  ScreenLinkContext: m5.ScreenLinkContext,\n  PREVIEW_REFUSED_STATUS: m6.PREVIEW_REFUSED_STATUS,\n  PREVIEW_WRITE_BLOCKED_EVENT: m6.PREVIEW_WRITE_BLOCKED_EVENT,\n  SiteContext: m6.SiteContext,\n  isPreviewRefusal: m6.isPreviewRefusal,\n  useSite: m6.useSite,\n  useSiteFetch: m6.useSiteFetch,\n  HOST_VARIABLE_TYPE_LABELS: m7.HOST_VARIABLE_TYPE_LABELS,\n  VARIABLE_NAME_PATTERN: m7.VARIABLE_NAME_PATTERN,\n  attachFunctionDefinitions: m7.attachFunctionDefinitions,\n  formatVariableValue: m7.formatVariableValue,\n  functionGlobals: m7.functionGlobals,\n  hasBindings: m7.hasBindings,\n  resolveBindings: m7.resolveBindings,\n  resolveNodesBindings: m7.resolveNodesBindings,\n  COMPONENT_CATEGORY_ORDER: m8.COMPONENT_CATEGORY_ORDER,\n  ComponentCategory: m8.ComponentCategory,\n  REUSABLE_COMPONENT_CATEGORY: m8.REUSABLE_COMPONENT_CATEGORY,\n  REUSABLE_EMAIL_BLOCK_CATEGORY: m8.REUSABLE_EMAIL_BLOCK_CATEGORY,\n  FEATURE_FLAG: m9.FEATURE_FLAG,\n  RICH_TEXT_COMMANDS: m9.RICH_TEXT_COMMANDS,\n  FieldComponentType: m10.FieldComponentType,\n  FieldValidatorType: m10.FieldValidatorType,\n  LinealDirectiveFlag: m10.LinealDirectiveFlag,\n  CONSOLE_STAFF_WIDGET_SLOTS: m11.CONSOLE_STAFF_WIDGET_SLOTS,\n  CONSOLE_WIDGET_SLOTS: m11.CONSOLE_WIDGET_SLOTS,\n  MUI_BUNDLE_ID: m11.MUI_BUNDLE_ID,\n  defineUiFeatureBundle: m11.defineUiFeatureBundle,\n  isConsoleStaffWidgetSlot: m11.isConsoleStaffWidgetSlot,\n  listConsoleExtensions: m11.listConsoleExtensions,\n  listConsoleNavItems: m11.listConsoleNavItems,\n  listConsoleOrgNavItems: m11.listConsoleOrgNavItems,\n  listConsoleProviders: m11.listConsoleProviders,\n  listConsoleStaffPages: m11.listConsoleStaffPages,\n  listConsoleWidgets: m11.listConsoleWidgets,\n  registerConsoleExtension: m11.registerConsoleExtension,\n  resolveConsoleOrgPluginPage: m11.resolveConsoleOrgPluginPage,\n  resolveConsolePluginPage: m11.resolveConsolePluginPage,\n  resolveConsoleStaffPage: m11.resolveConsoleStaffPage,\n  unregisterConsoleExtension: m11.unregisterConsoleExtension,\n  NodeType: m12.NodeType,\n})\n"],"names":["m0","m1","m2","m3","m4","m5","m6","m7","m8","m9","m10","m11","m12","AGLYN_HOST_SURFACE","Object","freeze","Aglyn","aglyn","canvas","components","emitter","logger","plugins","FUNCTION_TOKEN_PATTERN","MISSING_BINDING_LABEL","NAME_TOKEN_PATTERN","VARIABLE_ID_TOKEN_PATTERN","bindingTokenNeedsDeep","displayBindingTokens","editableBindingTokens","formatFunctionIdToken","formatVariableIdToken","keyById","nodesReferenceBinding","normalizeBindingTokens","rewriteBindingTokensDeep","textReferencesBinding","CATEGORY_REQUIRED_CAPABILITY","EnabledPluginsContext","isCategoryCapabilityEnabled","isFromEnabledPlugin","isSwitchedOffForRenderedSite","useEnabledPlugins","FUNCTION_BUILTIN_NAMES","FUNCTION_MAX_OPERATIONS","evaluateExpression","evaluateHostFunction","expressionIdentifiers","formatFunctionParameterOptions","functionReferencedNames","parseFunctionParameterOptions","NodeIdentityContext","useNodeId","ScreenLinkContext","PREVIEW_REFUSED_STATUS","PREVIEW_WRITE_BLOCKED_EVENT","SiteContext","isPreviewRefusal","useSite","useSiteFetch","HOST_VARIABLE_TYPE_LABELS","VARIABLE_NAME_PATTERN","attachFunctionDefinitions","formatVariableValue","functionGlobals","hasBindings","resolveBindings","resolveNodesBindings","COMPONENT_CATEGORY_ORDER","ComponentCategory","REUSABLE_COMPONENT_CATEGORY","REUSABLE_EMAIL_BLOCK_CATEGORY","FEATURE_FLAG","RICH_TEXT_COMMANDS","FieldComponentType","FieldValidatorType","LinealDirectiveFlag","CONSOLE_STAFF_WIDGET_SLOTS","CONSOLE_WIDGET_SLOTS","MUI_BUNDLE_ID","defineUiFeatureBundle","isConsoleStaffWidgetSlot","listConsoleExtensions","listConsoleNavItems","listConsoleOrgNavItems","listConsoleProviders","listConsoleStaffPages","listConsoleWidgets","registerConsoleExtension","resolveConsoleOrgPluginPage","resolveConsolePluginPage","resolveConsoleStaffPage","unregisterConsoleExtension","NodeType"],"mappings":"AAAA;;;;;;CAMC,GACD,kBAAkB,GAElB,YAAYA,QAAQ,cAAU;AAC9B,YAAYC,QAAQ,iCAA6B;AACjD,YAAYC,QAAQ,0CAAsC;AAC1D,YAAYC,QAAQ,4BAAwB;AAC5C,YAAYC,QAAQ,gCAA4B;AAChD,YAAYC,QAAQ,4CAAwC;AAC5D,YAAYC,QAAQ,+BAA2B;AAC/C,YAAYC,QAAQ,4BAAwB;AAC5C,YAAYC,QAAQ,wCAAoC;AACxD,YAAYC,QAAQ,oCAAgC;AACpD,YAAYC,SAAS,gDAA4C;AACjE,YAAYC,SAAS,uBAAmB;AACxC,YAAYC,SAAS,oBAAgB;AAErC,OAAO,MAAMC,qBAAwDC,OAAOC,MAAM,CAAC;IACjFC,OAAOhB,GAAGgB,KAAK;IACfC,OAAOjB,GAAGiB,KAAK;IACfC,QAAQlB,GAAGkB,MAAM;IACjBC,YAAYnB,GAAGmB,UAAU;IACzBC,SAASpB,GAAGoB,OAAO;IACnBC,QAAQrB,GAAGqB,MAAM;IACjBC,SAAStB,GAAGsB,OAAO;IACnBC,wBAAwBtB,GAAGsB,sBAAsB;IACjDC,uBAAuBvB,GAAGuB,qBAAqB;IAC/CC,oBAAoBxB,GAAGwB,kBAAkB;IACzCC,2BAA2BzB,GAAGyB,yBAAyB;IACvDC,uBAAuB1B,GAAG0B,qBAAqB;IAC/CC,sBAAsB3B,GAAG2B,oBAAoB;IAC7CC,uBAAuB5B,GAAG4B,qBAAqB;IAC/CC,uBAAuB7B,GAAG6B,qBAAqB;IAC/CC,uBAAuB9B,GAAG8B,qBAAqB;IAC/CC,SAAS/B,GAAG+B,OAAO;IACnBC,uBAAuBhC,GAAGgC,qBAAqB;IAC/CC,wBAAwBjC,GAAGiC,sBAAsB;IACjDC,0BAA0BlC,GAAGkC,wBAAwB;IACrDC,uBAAuBnC,GAAGmC,qBAAqB;IAC/CC,8BAA8BnC,GAAGmC,4BAA4B;IAC7DC,uBAAuBpC,GAAGoC,qBAAqB;IAC/CC,6BAA6BrC,GAAGqC,2BAA2B;IAC3DC,qBAAqBtC,GAAGsC,mBAAmB;IAC3CC,8BAA8BvC,GAAGuC,4BAA4B;IAC7DC,mBAAmBxC,GAAGwC,iBAAiB;IACvCC,wBAAwBxC,GAAGwC,sBAAsB;IACjDC,yBAAyBzC,GAAGyC,uBAAuB;IACnDC,oBAAoB1C,GAAG0C,kBAAkB;IACzCC,sBAAsB3C,GAAG2C,oBAAoB;IAC7CC,uBAAuB5C,GAAG4C,qBAAqB;IAC/CC,gCAAgC7C,GAAG6C,8BAA8B;IACjEC,yBAAyB9C,GAAG8C,uBAAuB;IACnDC,+BAA+B/C,GAAG+C,6BAA6B;IAC/DC,qBAAqB/C,GAAG+C,mBAAmB;IAC3CC,WAAWhD,GAAGgD,SAAS;IACvBC,mBAAmBhD,GAAGgD,iBAAiB;IACvCC,wBAAwBhD,GAAGgD,sBAAsB;IACjDC,6BAA6BjD,GAAGiD,2BAA2B;IAC3DC,aAAalD,GAAGkD,WAAW;IAC3BC,kBAAkBnD,GAAGmD,gBAAgB;IACrCC,SAASpD,GAAGoD,OAAO;IACnBC,cAAcrD,GAAGqD,YAAY;IAC7BC,2BAA2BrD,GAAGqD,yBAAyB;IACvDC,uBAAuBtD,GAAGsD,qBAAqB;IAC/CC,2BAA2BvD,GAAGuD,yBAAyB;IACvDC,qBAAqBxD,GAAGwD,mBAAmB;IAC3CC,iBAAiBzD,GAAGyD,eAAe;IACnCC,aAAa1D,GAAG0D,WAAW;IAC3BC,iBAAiB3D,GAAG2D,eAAe;IACnCC,sBAAsB5D,GAAG4D,oBAAoB;IAC7CC,0BAA0B5D,GAAG4D,wBAAwB;IACrDC,mBAAmB7D,GAAG6D,iBAAiB;IACvCC,6BAA6B9D,GAAG8D,2BAA2B;IAC3DC,+BAA+B/D,GAAG+D,6BAA6B;IAC/DC,cAAc/D,GAAG+D,YAAY;IAC7BC,oBAAoBhE,GAAGgE,kBAAkB;IACzCC,oBAAoBhE,IAAIgE,kBAAkB;IAC1CC,oBAAoBjE,IAAIiE,kBAAkB;IAC1CC,qBAAqBlE,IAAIkE,mBAAmB;IAC5CC,4BAA4BlE,IAAIkE,0BAA0B;IAC1DC,sBAAsBnE,IAAImE,oBAAoB;IAC9CC,eAAepE,IAAIoE,aAAa;IAChCC,uBAAuBrE,IAAIqE,qBAAqB;IAChDC,0BAA0BtE,IAAIsE,wBAAwB;IACtDC,uBAAuBvE,IAAIuE,qBAAqB;IAChDC,qBAAqBxE,IAAIwE,mBAAmB;IAC5CC,wBAAwBzE,IAAIyE,sBAAsB;IAClDC,sBAAsB1E,IAAI0E,oBAAoB;IAC9CC,uBAAuB3E,IAAI2E,qBAAqB;IAChDC,oBAAoB5E,IAAI4E,kBAAkB;IAC1CC,0BAA0B7E,IAAI6E,wBAAwB;IACtDC,6BAA6B9E,IAAI8E,2BAA2B;IAC5DC,0BAA0B/E,IAAI+E,wBAAwB;IACtDC,yBAAyBhF,IAAIgF,uBAAuB;IACpDC,4BAA4BjF,IAAIiF,0BAA0B;IAC1DC,UAAUjF,IAAIiF,QAAQ;AACxB,GAAE"}

package/src/lib/plugin-manager/realm-plugins.d.ts

@@ -99,8 +99,9 @@ export declare function verifyRealmBundle(bytes: ArrayBuffer, install: RealmPlug
 }>;
 /**
  * Publishes the host ABI realm bundles build against. The APP composes it
- * (React/jsxRuntime must come from the app bundle so singletons hold) —
- * core only owns the slot and the version stamp.
+ * (React/jsxRuntime/MUI must come from the app bundle so singletons hold) —
+ * core only owns the slot, the version stamp and the key list
+ * (`PLUGIN_HOST_ABI_KEYS`).
  */
 export declare function setRealmPluginHost(host: Record<string, unknown>): void;
 /**

package/src/lib/plugin-manager/realm-plugins.js

@@ -109,11 +109,16 @@ export async function sha256Hex(bytes) {
 // ---------------------------------------------------------------------------
 // Host ABI + client loader (browser only past this point).
 // ---------------------------------------------------------------------------
-const HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__';
+/**
+ * `PLUGIN_HOST_GLOBAL` (`app-utils/plugin-host-abi.ts`), spelled out: this
+ * module ships on every published page and the ABI module's key lists would
+ * ride along for one string. `realm-plugins.spec.ts` holds the two equal.
+ */ const HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__';
 /**
  * Publishes the host ABI realm bundles build against. The APP composes it
- * (React/jsxRuntime must come from the app bundle so singletons hold) —
- * core only owns the slot and the version stamp.
+ * (React/jsxRuntime/MUI must come from the app bundle so singletons hold) —
+ * core only owns the slot, the version stamp and the key list
+ * (`PLUGIN_HOST_ABI_KEYS`).
  */ export function setRealmPluginHost(host) {
     ;
     globalThis[HOST_GLOBAL] = _extends({

package/src/lib/plugin-manager/realm-plugins.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/realm-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { pluginArtifactPath } from '../app-utils/plugin-artifact-path'\nimport type { PluginContributions } from './plugin-contributions'\nimport { capturePluginStyles } from './plugin-styles'\n\n/**\n * Trusted-realm remote plugins (AGL-420). Marketplace bundles normally run\n * inside the cross-origin sandboxed PluginFrame; listings a staff member\n * has REVIEWED AND SIGNED (`trust: 'realm'`) may instead load into the app\n * realm and register real components/runtimes — first-party-grade\n * extensions installed from the marketplace.\n *\n * Trust chain, all of which must hold before a byte executes:\n * 1. The install doc pins {version, sha256}; the fetched bundle's SHA-256\n *    must match (content-addressing — a swapped artifact can't load).\n * 2. The version doc carries an Ed25519 `signature` over the sha256 hex,\n *    made by the platform signing key (staff publish flow). When a public\n *    key is configured, verification is MANDATORY and fails closed —\n *    including on runtimes without WebCrypto Ed25519 support.\n * 3. Bundles import nothing: the host injects its React/registry\n *    singletons through `globalThis.__AGLYN_PLUGIN_HOST__` (see\n *    {@link setRealmPluginHost}), so there is exactly one registry/React\n *    instance — the same invariant that keeps first-party canvases from\n *    rendering blank.\n *\n * Everything here is isomorphic (WebCrypto only, no node imports) so the\n * client barrel stays browser-safe; the server-side loader for API\n * handler bundles lives in realm-server.ts (node-only, /server entry).\n */\n\nexport const PLUGIN_HOST_ABI_VERSION = 1\n\n/** The pinned install shape the loaders consume (installs + version doc). */\nexport interface RealmPluginInstall {\n  listingId: string\n  version: string\n  sha256: string\n  /** Staff-granted tier; anything but 'realm' never realm-loads. */\n  trust?: string\n  /** Ed25519 signature (base64) over the sha256 hex string. */\n  signature?: string\n  /** Host ABI the bundle targets (AGL-429); mismatches never load. */\n  hostAbi?: number\n  /**\n   * The pinned version's manifest id (AGL-3116): the `pluginId` its own\n   * elements carry, which is how a page shows it uses an undeclared plugin.\n   */\n  pluginId?: string\n  /**\n   * What the pinned version declares it contributes (AGL-3116); absent when\n   * it declares nothing, and then the default in `plugin-contributions.ts`\n   * decides where it loads.\n   */\n  contributes?: PluginContributions\n}\n\n/**\n * ABI gate (AGL-429): a declared `hostAbi` must equal the running host's\n * generation; absent = pre-compat bundle, allowed (with a loader warning)\n * so existing installs keep working across the introduction of the field.\n */\nexport function isCompatibleHostAbi(hostAbi: number | undefined): boolean {\n  return hostAbi === undefined || hostAbi === PLUGIN_HOST_ABI_VERSION\n}\n\nexport interface LoadRealmPluginsOptions {\n  /** Base URL of the content-addressed artifacts origin. */\n  artifactsBase: string\n  /**\n   * Base64 raw Ed25519 public key. When set, unsigned or badly-signed\n   * bundles are rejected; when unset, signature checking is skipped and\n   * the Firestore trust flag + sha pinning are the whole gate (dev mode).\n   */\n  publicKeyBase64?: string\n}\n\nconst decodeBase64 = (value: string): Uint8Array => {\n  if (typeof atob === 'function') {\n    return Uint8Array.from(atob(value), (char) => char.charCodeAt(0))\n  }\n  // Node without atob (never in practice on the pinned runtime, kept for\n  // safety). Reached through `globalThis` rather than as a bare global: a\n  // free `Buffer` identifier makes a browser bundler inject its 22 KB\n  // polyfill for a branch no browser can enter.\n  return new Uint8Array(globalThis.Buffer.from(value, 'base64'))\n}\n\nexport async function sha256Hex(bytes: ArrayBuffer): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Verifies the platform Ed25519 signature over a sha256 hex string.\n * Fails CLOSED: any import/verify error (including runtimes without\n * WebCrypto Ed25519) returns false.\n */\nexport async function verifyRealmSignature(\n  shaHex: string,\n  signatureBase64: string,\n  publicKeyBase64: string,\n): Promise<boolean> {\n  try {\n    const key = await globalThis.crypto.subtle.importKey(\n      'raw',\n      decodeBase64(publicKeyBase64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n    return await globalThis.crypto.subtle.verify(\n      { name: 'Ed25519' },\n      key,\n      decodeBase64(signatureBase64) as unknown as ArrayBuffer,\n      new TextEncoder().encode(shaHex),\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Verifies fetched bundle bytes against a pinned install: content hash\n * always; platform signature when a public key is configured. Returns the\n * reason on failure so callers can log precisely.\n */\nexport async function verifyRealmBundle(\n  bytes: ArrayBuffer,\n  install: RealmPluginInstall,\n  publicKeyBase64?: string,\n): Promise<{ ok: true } | { ok: false; reason: string }> {\n  const digest = await sha256Hex(bytes)\n  if (digest !== install.sha256) {\n    return { ok: false, reason: `sha256 mismatch (got ${digest.slice(0, 12)}…)` }\n  }\n  if (publicKeyBase64) {\n    if (!install.signature) return { ok: false, reason: 'missing signature' }\n    const valid = await verifyRealmSignature(\n      install.sha256,\n      install.signature,\n      publicKeyBase64,\n    )\n    if (!valid) return { ok: false, reason: 'invalid signature' }\n  }\n  return { ok: true }\n}\n\n// ---------------------------------------------------------------------------\n// Host ABI + client loader (browser only past this point).\n// ---------------------------------------------------------------------------\n\nconst HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__'\n\n/**\n * Publishes the host ABI realm bundles build against. The APP composes it\n * (React/jsxRuntime must come from the app bundle so singletons hold) —\n * core only owns the slot and the version stamp.\n */\nexport function setRealmPluginHost(host: Record<string, unknown>): void {\n  ;(globalThis as Record<string, unknown>)[HOST_GLOBAL] = {\n    version: PLUGIN_HOST_ABI_VERSION,\n    ...host,\n  }\n}\n\nconst loaded = new Map<string, Promise<void>>()\n\n/**\n * Fetches, verifies, and executes realm bundles in the app realm. Each\n * bundle default-exports (or exports) `register(host)`; failures are\n * logged and skipped — a broken marketplace plugin must never take the\n * console or a site down. Idempotent per listing@version.\n */\nexport async function loadRealmPlugins(\n  installs: readonly RealmPluginInstall[],\n  options: LoadRealmPluginsOptions,\n): Promise<void> {\n  const host = (globalThis as Record<string, unknown>)[HOST_GLOBAL]\n  const realmInstalls = installs.filter((install) => install.trust === 'realm')\n  // Fail closed (AGL-507): without the trust public key we cannot verify\n  // bundle signatures, so refuse to load any realm plugin rather than fall\n  // back to sha256-only — mirroring the mandatory server-side key check\n  // (realm-server.ts). Silently degrading here contradicted the documented\n  // \"verification is MANDATORY and fails closed\" contract.\n  if (realmInstalls.length > 0 && !options.publicKeyBase64) {\n    console.error(\n      `realm plugins: refusing to load ${realmInstalls.length} bundle(s) — ` +\n        'NEXT_PUBLIC_PLUGIN_TRUST_PUBLIC_KEY is not configured, so signatures ' +\n        'cannot be verified',\n    )\n    return\n  }\n  await Promise.all(\n    realmInstalls.map((install) => {\n        const key = `${install.listingId}@${install.version}`\n        let promise = loaded.get(key)\n        if (!promise) {\n          promise = (async () => {\n            const url = `${options.artifactsBase.replace(/\\/+$/, '')}/${pluginArtifactPath(\n              install.listingId,\n              install.version,\n              install.sha256,\n            )}`\n            const response = await fetch(url)\n            if (!response.ok) throw new Error(`fetch ${response.status}`)\n            if (!isCompatibleHostAbi(install.hostAbi)) {\n              throw new Error(\n                `built for host ABI ${install.hostAbi}, host is ${PLUGIN_HOST_ABI_VERSION}`,\n              )\n            }\n            if (install.hostAbi === undefined) {\n              console.warn(\n                `realm plugin ${key}: no hostAbi declared (pre-AGL-429 bundle)`,\n              )\n            }\n            const bytes = await response.arrayBuffer()\n            const verdict = await verifyRealmBundle(\n              bytes,\n              install,\n              options.publicKeyBase64,\n            )\n            if (verdict.ok === false) throw new Error(verdict.reason)\n            const blobUrl = URL.createObjectURL(\n              new Blob([bytes], { type: 'text/javascript' }),\n            )\n            try {\n              // AGL-2486: module evaluation and `register()` both run inside\n              // the style capture, because a bundler's `import './x.css'`\n              // compiles to a `document.head.appendChild(<style>)` at module\n              // EVAL time — before `register` is ever called. Anything the\n              // bundle injects in that window is mirrored into the besigner\n              // canvas's closed shadow root, which a document-level rule\n              // otherwise cannot reach at all (measured: no effect on the\n              // canvas, wins outright on the published page). See\n              // `plugin-styles.tsx`.\n              await capturePluginStyles(install.listingId, async () => {\n                const mod = (await import(\n                  /* webpackIgnore: true */ blobUrl\n                )) as {\n                  register?: (host: unknown) => void\n                  default?: { register?: (host: unknown) => void }\n                }\n                const register = mod.register ?? mod.default?.register\n                if (typeof register !== 'function') {\n                  throw new Error('bundle exports no register(host)')\n                }\n                register(host)\n              })\n            } finally {\n              URL.revokeObjectURL(blobUrl)\n            }\n          })().catch((error) => {\n            loaded.delete(key)\n            console.error(`realm plugin ${key} failed to load:`, error)\n          })\n          loaded.set(key, promise)\n        }\n        return promise\n      }),\n  )\n}\n"],"names":["pluginArtifactPath","capturePluginStyles","PLUGIN_HOST_ABI_VERSION","isCompatibleHostAbi","hostAbi","undefined","decodeBase64","value","atob","Uint8Array","from","char","charCodeAt","globalThis","Buffer","sha256Hex","bytes","digest","crypto","subtle","Array","map","byte","toString","padStart","join","verifyRealmSignature","shaHex","signatureBase64","publicKeyBase64","key","importKey","name","verify","TextEncoder","encode","verifyRealmBundle","install","sha256","ok","reason","slice","signature","valid","HOST_GLOBAL","setRealmPluginHost","host","version","loaded","Map","loadRealmPlugins","installs","options","realmInstalls","filter","trust","length","console","error","Promise","all","listingId","promise","get","url","artifactsBase","replace","response","fetch","Error","status","warn","arrayBuffer","verdict","blobUrl","URL","createObjectURL","Blob","type","mod","register","default","revokeObjectURL","catch","delete","set"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,uCAAmC;AAEtE,SAASC,mBAAmB,QAAQ,qBAAiB;AAErD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,OAAO,MAAMC,0BAA0B,EAAC;AA0BxC;;;;CAIC,GACD,OAAO,SAASC,oBAAoBC,OAA2B;IAC7D,OAAOA,YAAYC,aAAaD,YAAYF;AAC9C;AAaA,MAAMI,eAAe,CAACC;IACpB,IAAI,OAAOC,SAAS,YAAY;QAC9B,OAAOC,WAAWC,IAAI,CAACF,KAAKD,QAAQ,CAACI,OAASA,KAAKC,UAAU,CAAC;IAChE;IACA,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,8CAA8C;IAC9C,OAAO,IAAIH,WAAWI,WAAWC,MAAM,CAACJ,IAAI,CAACH,OAAO;AACtD;AAEA,OAAO,eAAeQ,UAAUC,KAAkB;IAChD,MAAMC,SAAS,MAAMJ,WAAWK,MAAM,CAACC,MAAM,CAACF,MAAM,CAAC,WAAWD;IAChE,OAAOI,MAAMV,IAAI,CAAC,IAAID,WAAWQ,SAC9BI,GAAG,CAAC,CAACC,OAASA,KAAKC,QAAQ,CAAC,IAAIC,QAAQ,CAAC,GAAG,MAC5CC,IAAI,CAAC;AACV;AAEA;;;;CAIC,GACD,OAAO,eAAeC,qBACpBC,MAAc,EACdC,eAAuB,EACvBC,eAAuB;IAEvB,IAAI;QACF,MAAMC,MAAM,MAAMjB,WAAWK,MAAM,CAACC,MAAM,CAACY,SAAS,CAClD,OACAzB,aAAauB,kBACb;YAAEG,MAAM;QAAU,GAClB,OACA;YAAC;SAAS;QAEZ,OAAO,MAAMnB,WAAWK,MAAM,CAACC,MAAM,CAACc,MAAM,CAC1C;YAAED,MAAM;QAAU,GAClBF,KACAxB,aAAasB,kBACb,IAAIM,cAAcC,MAAM,CAACR;IAE7B,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeS,kBACpBpB,KAAkB,EAClBqB,OAA2B,EAC3BR,eAAwB;IAExB,MAAMZ,SAAS,MAAMF,UAAUC;IAC/B,IAAIC,WAAWoB,QAAQC,MAAM,EAAE;QAC7B,OAAO;YAAEC,IAAI;YAAOC,QAAQ,CAAC,qBAAqB,EAAEvB,OAAOwB,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;QAAC;IAC9E;IACA,IAAIZ,iBAAiB;QACnB,IAAI,CAACQ,QAAQK,SAAS,EAAE,OAAO;YAAEH,IAAI;YAAOC,QAAQ;QAAoB;QACxE,MAAMG,QAAQ,MAAMjB,qBAClBW,QAAQC,MAAM,EACdD,QAAQK,SAAS,EACjBb;QAEF,IAAI,CAACc,OAAO,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;QAAoB;IAC9D;IACA,OAAO;QAAED,IAAI;IAAK;AACpB;AAEA,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAMK,cAAc;AAEpB;;;;CAIC,GACD,OAAO,SAASC,mBAAmBC,IAA6B;;IAC5DjC,UAAsC,CAAC+B,YAAY,GAAG;QACtDG,SAAS7C;OACN4C;AAEP;AAEA,MAAME,SAAS,IAAIC;AAEnB;;;;;CAKC,GACD,OAAO,eAAeC,iBACpBC,QAAuC,EACvCC,OAAgC;IAEhC,MAAMN,OAAO,AAACjC,UAAsC,CAAC+B,YAAY;IACjE,MAAMS,gBAAgBF,SAASG,MAAM,CAAC,CAACjB,UAAYA,QAAQkB,KAAK,KAAK;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,IAAIF,cAAcG,MAAM,GAAG,KAAK,CAACJ,QAAQvB,eAAe,EAAE;QACxD4B,QAAQC,KAAK,CACX,CAAC,gCAAgC,EAAEL,cAAcG,MAAM,CAAC,aAAa,CAAC,GACpE,0EACA;QAEJ;IACF;IACA,MAAMG,QAAQC,GAAG,CACfP,cAAchC,GAAG,CAAC,CAACgB;QACf,MAAMP,MAAM,GAAGO,QAAQwB,SAAS,CAAC,CAAC,EAAExB,QAAQU,OAAO,EAAE;QACrD,IAAIe,UAAUd,OAAOe,GAAG,CAACjC;QACzB,IAAI,CAACgC,SAAS;YACZA,UAAU,AAAC,CAAA;gBACT,MAAME,MAAM,GAAGZ,QAAQa,aAAa,CAACC,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAElE,mBAC1DqC,QAAQwB,SAAS,EACjBxB,QAAQU,OAAO,EACfV,QAAQC,MAAM,GACb;gBACH,MAAM6B,WAAW,MAAMC,MAAMJ;gBAC7B,IAAI,CAACG,SAAS5B,EAAE,EAAE,MAAM,IAAI8B,MAAM,CAAC,MAAM,EAAEF,SAASG,MAAM,EAAE;gBAC5D,IAAI,CAACnE,oBAAoBkC,QAAQjC,OAAO,GAAG;oBACzC,MAAM,IAAIiE,MACR,CAAC,mBAAmB,EAAEhC,QAAQjC,OAAO,CAAC,UAAU,EAAEF,yBAAyB;gBAE/E;gBACA,IAAImC,QAAQjC,OAAO,KAAKC,WAAW;oBACjCoD,QAAQc,IAAI,CACV,CAAC,aAAa,EAAEzC,IAAI,0CAA0C,CAAC;gBAEnE;gBACA,MAAMd,QAAQ,MAAMmD,SAASK,WAAW;gBACxC,MAAMC,UAAU,MAAMrC,kBACpBpB,OACAqB,SACAe,QAAQvB,eAAe;gBAEzB,IAAI4C,QAAQlC,EAAE,KAAK,OAAO,MAAM,IAAI8B,MAAMI,QAAQjC,MAAM;gBACxD,MAAMkC,UAAUC,IAAIC,eAAe,CACjC,IAAIC,KAAK;oBAAC7D;iBAAM,EAAE;oBAAE8D,MAAM;gBAAkB;gBAE9C,IAAI;oBACF,+DAA+D;oBAC/D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,oDAAoD;oBACpD,uBAAuB;oBACvB,MAAM7E,oBAAoBoC,QAAQwB,SAAS,EAAE;4BAO1BkB;4BAAgBA;wBANjC,MAAMA,MAAO,MAAM,MAAM,CACvB,uBAAuB,GAAGL;wBAK5B,MAAMM,YAAWD,gBAAAA,IAAIC,QAAQ,YAAZD,iBAAgBA,eAAAA,IAAIE,OAAO,qBAAXF,aAAaC,QAAQ;wBACtD,IAAI,OAAOA,aAAa,YAAY;4BAClC,MAAM,IAAIX,MAAM;wBAClB;wBACAW,SAASlC;oBACX;gBACF,SAAU;oBACR6B,IAAIO,eAAe,CAACR;gBACtB;YACF,CAAA,IAAKS,KAAK,CAAC,CAACzB;gBACVV,OAAOoC,MAAM,CAACtD;gBACd2B,QAAQC,KAAK,CAAC,CAAC,aAAa,EAAE5B,IAAI,gBAAgB,CAAC,EAAE4B;YACvD;YACAV,OAAOqC,GAAG,CAACvD,KAAKgC;QAClB;QACA,OAAOA;IACT;AAEN"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/realm-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { pluginArtifactPath } from '../app-utils/plugin-artifact-path'\nimport type { PluginContributions } from './plugin-contributions'\nimport { capturePluginStyles } from './plugin-styles'\n\n/**\n * Trusted-realm remote plugins (AGL-420). Marketplace bundles normally run\n * inside the cross-origin sandboxed PluginFrame; listings a staff member\n * has REVIEWED AND SIGNED (`trust: 'realm'`) may instead load into the app\n * realm and register real components/runtimes — first-party-grade\n * extensions installed from the marketplace.\n *\n * Trust chain, all of which must hold before a byte executes:\n * 1. The install doc pins {version, sha256}; the fetched bundle's SHA-256\n *    must match (content-addressing — a swapped artifact can't load).\n * 2. The version doc carries an Ed25519 `signature` over the sha256 hex,\n *    made by the platform signing key (staff publish flow). When a public\n *    key is configured, verification is MANDATORY and fails closed —\n *    including on runtimes without WebCrypto Ed25519 support.\n * 3. Bundles import nothing: the host injects its React/registry\n *    singletons through `globalThis.__AGLYN_PLUGIN_HOST__` (see\n *    {@link setRealmPluginHost}), so there is exactly one registry/React\n *    instance — the same invariant that keeps first-party canvases from\n *    rendering blank.\n *\n * Everything here is isomorphic (WebCrypto only, no node imports) so the\n * client barrel stays browser-safe; the server-side loader for API\n * handler bundles lives in realm-server.ts (node-only, /server entry).\n */\n\nexport const PLUGIN_HOST_ABI_VERSION = 1\n\n/** The pinned install shape the loaders consume (installs + version doc). */\nexport interface RealmPluginInstall {\n  listingId: string\n  version: string\n  sha256: string\n  /** Staff-granted tier; anything but 'realm' never realm-loads. */\n  trust?: string\n  /** Ed25519 signature (base64) over the sha256 hex string. */\n  signature?: string\n  /** Host ABI the bundle targets (AGL-429); mismatches never load. */\n  hostAbi?: number\n  /**\n   * The pinned version's manifest id (AGL-3116): the `pluginId` its own\n   * elements carry, which is how a page shows it uses an undeclared plugin.\n   */\n  pluginId?: string\n  /**\n   * What the pinned version declares it contributes (AGL-3116); absent when\n   * it declares nothing, and then the default in `plugin-contributions.ts`\n   * decides where it loads.\n   */\n  contributes?: PluginContributions\n}\n\n/**\n * ABI gate (AGL-429): a declared `hostAbi` must equal the running host's\n * generation; absent = pre-compat bundle, allowed (with a loader warning)\n * so existing installs keep working across the introduction of the field.\n */\nexport function isCompatibleHostAbi(hostAbi: number | undefined): boolean {\n  return hostAbi === undefined || hostAbi === PLUGIN_HOST_ABI_VERSION\n}\n\nexport interface LoadRealmPluginsOptions {\n  /** Base URL of the content-addressed artifacts origin. */\n  artifactsBase: string\n  /**\n   * Base64 raw Ed25519 public key. When set, unsigned or badly-signed\n   * bundles are rejected; when unset, signature checking is skipped and\n   * the Firestore trust flag + sha pinning are the whole gate (dev mode).\n   */\n  publicKeyBase64?: string\n}\n\nconst decodeBase64 = (value: string): Uint8Array => {\n  if (typeof atob === 'function') {\n    return Uint8Array.from(atob(value), (char) => char.charCodeAt(0))\n  }\n  // Node without atob (never in practice on the pinned runtime, kept for\n  // safety). Reached through `globalThis` rather than as a bare global: a\n  // free `Buffer` identifier makes a browser bundler inject its 22 KB\n  // polyfill for a branch no browser can enter.\n  return new Uint8Array(globalThis.Buffer.from(value, 'base64'))\n}\n\nexport async function sha256Hex(bytes: ArrayBuffer): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Verifies the platform Ed25519 signature over a sha256 hex string.\n * Fails CLOSED: any import/verify error (including runtimes without\n * WebCrypto Ed25519) returns false.\n */\nexport async function verifyRealmSignature(\n  shaHex: string,\n  signatureBase64: string,\n  publicKeyBase64: string,\n): Promise<boolean> {\n  try {\n    const key = await globalThis.crypto.subtle.importKey(\n      'raw',\n      decodeBase64(publicKeyBase64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n    return await globalThis.crypto.subtle.verify(\n      { name: 'Ed25519' },\n      key,\n      decodeBase64(signatureBase64) as unknown as ArrayBuffer,\n      new TextEncoder().encode(shaHex),\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Verifies fetched bundle bytes against a pinned install: content hash\n * always; platform signature when a public key is configured. Returns the\n * reason on failure so callers can log precisely.\n */\nexport async function verifyRealmBundle(\n  bytes: ArrayBuffer,\n  install: RealmPluginInstall,\n  publicKeyBase64?: string,\n): Promise<{ ok: true } | { ok: false; reason: string }> {\n  const digest = await sha256Hex(bytes)\n  if (digest !== install.sha256) {\n    return { ok: false, reason: `sha256 mismatch (got ${digest.slice(0, 12)}…)` }\n  }\n  if (publicKeyBase64) {\n    if (!install.signature) return { ok: false, reason: 'missing signature' }\n    const valid = await verifyRealmSignature(\n      install.sha256,\n      install.signature,\n      publicKeyBase64,\n    )\n    if (!valid) return { ok: false, reason: 'invalid signature' }\n  }\n  return { ok: true }\n}\n\n// ---------------------------------------------------------------------------\n// Host ABI + client loader (browser only past this point).\n// ---------------------------------------------------------------------------\n\n/**\n * `PLUGIN_HOST_GLOBAL` (`app-utils/plugin-host-abi.ts`), spelled out: this\n * module ships on every published page and the ABI module's key lists would\n * ride along for one string. `realm-plugins.spec.ts` holds the two equal.\n */\nconst HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__'\n\n/**\n * Publishes the host ABI realm bundles build against. The APP composes it\n * (React/jsxRuntime/MUI must come from the app bundle so singletons hold) —\n * core only owns the slot, the version stamp and the key list\n * (`PLUGIN_HOST_ABI_KEYS`).\n */\nexport function setRealmPluginHost(host: Record<string, unknown>): void {\n  ;(globalThis as Record<string, unknown>)[HOST_GLOBAL] = {\n    version: PLUGIN_HOST_ABI_VERSION,\n    ...host,\n  }\n}\n\nconst loaded = new Map<string, Promise<void>>()\n\n/**\n * Fetches, verifies, and executes realm bundles in the app realm. Each\n * bundle default-exports (or exports) `register(host)`; failures are\n * logged and skipped — a broken marketplace plugin must never take the\n * console or a site down. Idempotent per listing@version.\n */\nexport async function loadRealmPlugins(\n  installs: readonly RealmPluginInstall[],\n  options: LoadRealmPluginsOptions,\n): Promise<void> {\n  const host = (globalThis as Record<string, unknown>)[HOST_GLOBAL]\n  const realmInstalls = installs.filter((install) => install.trust === 'realm')\n  // Fail closed (AGL-507): without the trust public key we cannot verify\n  // bundle signatures, so refuse to load any realm plugin rather than fall\n  // back to sha256-only — mirroring the mandatory server-side key check\n  // (realm-server.ts). Silently degrading here contradicted the documented\n  // \"verification is MANDATORY and fails closed\" contract.\n  if (realmInstalls.length > 0 && !options.publicKeyBase64) {\n    console.error(\n      `realm plugins: refusing to load ${realmInstalls.length} bundle(s) — ` +\n        'NEXT_PUBLIC_PLUGIN_TRUST_PUBLIC_KEY is not configured, so signatures ' +\n        'cannot be verified',\n    )\n    return\n  }\n  await Promise.all(\n    realmInstalls.map((install) => {\n        const key = `${install.listingId}@${install.version}`\n        let promise = loaded.get(key)\n        if (!promise) {\n          promise = (async () => {\n            const url = `${options.artifactsBase.replace(/\\/+$/, '')}/${pluginArtifactPath(\n              install.listingId,\n              install.version,\n              install.sha256,\n            )}`\n            const response = await fetch(url)\n            if (!response.ok) throw new Error(`fetch ${response.status}`)\n            if (!isCompatibleHostAbi(install.hostAbi)) {\n              throw new Error(\n                `built for host ABI ${install.hostAbi}, host is ${PLUGIN_HOST_ABI_VERSION}`,\n              )\n            }\n            if (install.hostAbi === undefined) {\n              console.warn(\n                `realm plugin ${key}: no hostAbi declared (pre-AGL-429 bundle)`,\n              )\n            }\n            const bytes = await response.arrayBuffer()\n            const verdict = await verifyRealmBundle(\n              bytes,\n              install,\n              options.publicKeyBase64,\n            )\n            if (verdict.ok === false) throw new Error(verdict.reason)\n            const blobUrl = URL.createObjectURL(\n              new Blob([bytes], { type: 'text/javascript' }),\n            )\n            try {\n              // AGL-2486: module evaluation and `register()` both run inside\n              // the style capture, because a bundler's `import './x.css'`\n              // compiles to a `document.head.appendChild(<style>)` at module\n              // EVAL time — before `register` is ever called. Anything the\n              // bundle injects in that window is mirrored into the besigner\n              // canvas's closed shadow root, which a document-level rule\n              // otherwise cannot reach at all (measured: no effect on the\n              // canvas, wins outright on the published page). See\n              // `plugin-styles.tsx`.\n              await capturePluginStyles(install.listingId, async () => {\n                const mod = (await import(\n                  /* webpackIgnore: true */ blobUrl\n                )) as {\n                  register?: (host: unknown) => void\n                  default?: { register?: (host: unknown) => void }\n                }\n                const register = mod.register ?? mod.default?.register\n                if (typeof register !== 'function') {\n                  throw new Error('bundle exports no register(host)')\n                }\n                register(host)\n              })\n            } finally {\n              URL.revokeObjectURL(blobUrl)\n            }\n          })().catch((error) => {\n            loaded.delete(key)\n            console.error(`realm plugin ${key} failed to load:`, error)\n          })\n          loaded.set(key, promise)\n        }\n        return promise\n      }),\n  )\n}\n"],"names":["pluginArtifactPath","capturePluginStyles","PLUGIN_HOST_ABI_VERSION","isCompatibleHostAbi","hostAbi","undefined","decodeBase64","value","atob","Uint8Array","from","char","charCodeAt","globalThis","Buffer","sha256Hex","bytes","digest","crypto","subtle","Array","map","byte","toString","padStart","join","verifyRealmSignature","shaHex","signatureBase64","publicKeyBase64","key","importKey","name","verify","TextEncoder","encode","verifyRealmBundle","install","sha256","ok","reason","slice","signature","valid","HOST_GLOBAL","setRealmPluginHost","host","version","loaded","Map","loadRealmPlugins","installs","options","realmInstalls","filter","trust","length","console","error","Promise","all","listingId","promise","get","url","artifactsBase","replace","response","fetch","Error","status","warn","arrayBuffer","verdict","blobUrl","URL","createObjectURL","Blob","type","mod","register","default","revokeObjectURL","catch","delete","set"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,uCAAmC;AAEtE,SAASC,mBAAmB,QAAQ,qBAAiB;AAErD;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,OAAO,MAAMC,0BAA0B,EAAC;AA0BxC;;;;CAIC,GACD,OAAO,SAASC,oBAAoBC,OAA2B;IAC7D,OAAOA,YAAYC,aAAaD,YAAYF;AAC9C;AAaA,MAAMI,eAAe,CAACC;IACpB,IAAI,OAAOC,SAAS,YAAY;QAC9B,OAAOC,WAAWC,IAAI,CAACF,KAAKD,QAAQ,CAACI,OAASA,KAAKC,UAAU,CAAC;IAChE;IACA,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,8CAA8C;IAC9C,OAAO,IAAIH,WAAWI,WAAWC,MAAM,CAACJ,IAAI,CAACH,OAAO;AACtD;AAEA,OAAO,eAAeQ,UAAUC,KAAkB;IAChD,MAAMC,SAAS,MAAMJ,WAAWK,MAAM,CAACC,MAAM,CAACF,MAAM,CAAC,WAAWD;IAChE,OAAOI,MAAMV,IAAI,CAAC,IAAID,WAAWQ,SAC9BI,GAAG,CAAC,CAACC,OAASA,KAAKC,QAAQ,CAAC,IAAIC,QAAQ,CAAC,GAAG,MAC5CC,IAAI,CAAC;AACV;AAEA;;;;CAIC,GACD,OAAO,eAAeC,qBACpBC,MAAc,EACdC,eAAuB,EACvBC,eAAuB;IAEvB,IAAI;QACF,MAAMC,MAAM,MAAMjB,WAAWK,MAAM,CAACC,MAAM,CAACY,SAAS,CAClD,OACAzB,aAAauB,kBACb;YAAEG,MAAM;QAAU,GAClB,OACA;YAAC;SAAS;QAEZ,OAAO,MAAMnB,WAAWK,MAAM,CAACC,MAAM,CAACc,MAAM,CAC1C;YAAED,MAAM;QAAU,GAClBF,KACAxB,aAAasB,kBACb,IAAIM,cAAcC,MAAM,CAACR;IAE7B,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeS,kBACpBpB,KAAkB,EAClBqB,OAA2B,EAC3BR,eAAwB;IAExB,MAAMZ,SAAS,MAAMF,UAAUC;IAC/B,IAAIC,WAAWoB,QAAQC,MAAM,EAAE;QAC7B,OAAO;YAAEC,IAAI;YAAOC,QAAQ,CAAC,qBAAqB,EAAEvB,OAAOwB,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;QAAC;IAC9E;IACA,IAAIZ,iBAAiB;QACnB,IAAI,CAACQ,QAAQK,SAAS,EAAE,OAAO;YAAEH,IAAI;YAAOC,QAAQ;QAAoB;QACxE,MAAMG,QAAQ,MAAMjB,qBAClBW,QAAQC,MAAM,EACdD,QAAQK,SAAS,EACjBb;QAEF,IAAI,CAACc,OAAO,OAAO;YAAEJ,IAAI;YAAOC,QAAQ;QAAoB;IAC9D;IACA,OAAO;QAAED,IAAI;IAAK;AACpB;AAEA,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E;;;;CAIC,GACD,MAAMK,cAAc;AAEpB;;;;;CAKC,GACD,OAAO,SAASC,mBAAmBC,IAA6B;;IAC5DjC,UAAsC,CAAC+B,YAAY,GAAG;QACtDG,SAAS7C;OACN4C;AAEP;AAEA,MAAME,SAAS,IAAIC;AAEnB;;;;;CAKC,GACD,OAAO,eAAeC,iBACpBC,QAAuC,EACvCC,OAAgC;IAEhC,MAAMN,OAAO,AAACjC,UAAsC,CAAC+B,YAAY;IACjE,MAAMS,gBAAgBF,SAASG,MAAM,CAAC,CAACjB,UAAYA,QAAQkB,KAAK,KAAK;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,IAAIF,cAAcG,MAAM,GAAG,KAAK,CAACJ,QAAQvB,eAAe,EAAE;QACxD4B,QAAQC,KAAK,CACX,CAAC,gCAAgC,EAAEL,cAAcG,MAAM,CAAC,aAAa,CAAC,GACpE,0EACA;QAEJ;IACF;IACA,MAAMG,QAAQC,GAAG,CACfP,cAAchC,GAAG,CAAC,CAACgB;QACf,MAAMP,MAAM,GAAGO,QAAQwB,SAAS,CAAC,CAAC,EAAExB,QAAQU,OAAO,EAAE;QACrD,IAAIe,UAAUd,OAAOe,GAAG,CAACjC;QACzB,IAAI,CAACgC,SAAS;YACZA,UAAU,AAAC,CAAA;gBACT,MAAME,MAAM,GAAGZ,QAAQa,aAAa,CAACC,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAElE,mBAC1DqC,QAAQwB,SAAS,EACjBxB,QAAQU,OAAO,EACfV,QAAQC,MAAM,GACb;gBACH,MAAM6B,WAAW,MAAMC,MAAMJ;gBAC7B,IAAI,CAACG,SAAS5B,EAAE,EAAE,MAAM,IAAI8B,MAAM,CAAC,MAAM,EAAEF,SAASG,MAAM,EAAE;gBAC5D,IAAI,CAACnE,oBAAoBkC,QAAQjC,OAAO,GAAG;oBACzC,MAAM,IAAIiE,MACR,CAAC,mBAAmB,EAAEhC,QAAQjC,OAAO,CAAC,UAAU,EAAEF,yBAAyB;gBAE/E;gBACA,IAAImC,QAAQjC,OAAO,KAAKC,WAAW;oBACjCoD,QAAQc,IAAI,CACV,CAAC,aAAa,EAAEzC,IAAI,0CAA0C,CAAC;gBAEnE;gBACA,MAAMd,QAAQ,MAAMmD,SAASK,WAAW;gBACxC,MAAMC,UAAU,MAAMrC,kBACpBpB,OACAqB,SACAe,QAAQvB,eAAe;gBAEzB,IAAI4C,QAAQlC,EAAE,KAAK,OAAO,MAAM,IAAI8B,MAAMI,QAAQjC,MAAM;gBACxD,MAAMkC,UAAUC,IAAIC,eAAe,CACjC,IAAIC,KAAK;oBAAC7D;iBAAM,EAAE;oBAAE8D,MAAM;gBAAkB;gBAE9C,IAAI;oBACF,+DAA+D;oBAC/D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,6DAA6D;oBAC7D,8DAA8D;oBAC9D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,oDAAoD;oBACpD,uBAAuB;oBACvB,MAAM7E,oBAAoBoC,QAAQwB,SAAS,EAAE;4BAO1BkB;4BAAgBA;wBANjC,MAAMA,MAAO,MAAM,MAAM,CACvB,uBAAuB,GAAGL;wBAK5B,MAAMM,YAAWD,gBAAAA,IAAIC,QAAQ,YAAZD,iBAAgBA,eAAAA,IAAIE,OAAO,qBAAXF,aAAaC,QAAQ;wBACtD,IAAI,OAAOA,aAAa,YAAY;4BAClC,MAAM,IAAIX,MAAM;wBAClB;wBACAW,SAASlC;oBACX;gBACF,SAAU;oBACR6B,IAAIO,eAAe,CAACR;gBACtB;YACF,CAAA,IAAKS,KAAK,CAAC,CAACzB;gBACVV,OAAOoC,MAAM,CAACtD;gBACd2B,QAAQC,KAAK,CAAC,CAAC,aAAa,EAAE5B,IAAI,gBAAgB,CAAC,EAAE4B;YACvD;YACAV,OAAOqC,GAAG,CAACvD,KAAKgC;QAClB;QACA,OAAOA;IACT;AAEN"}