@ethisyscore/extension-runtime 1.59.0 → 1.61.0

package/dist/host/index.d.cts

@@ -3,8 +3,8 @@ import { C as ComponentRegistry } from '../registry-DpCx_LxF.cjs';
 export { P as PrimitiveProps } from '../registry-DpCx_LxF.cjs';
 import { SduiNode } from '@ethisyscore/protocol';
 export { PrimitiveName, SduiNode } from '@ethisyscore/protocol';
-import { M as McpHttpClient } from '../transport-DJE6ljme.cjs';
-export { D as DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, I as InputEventPayload, a as McpHttpRequest, b as McpUploadRequest, W as WORKER_TRANSPORT_PROTOCOL, c as WorkerCtor, d as WorkerHandshakePayload, e as WorkerLike, f as WorkerRemoteDomTransport, g as WorkerRemoteDomTransportOptions } from '../transport-DJE6ljme.cjs';
+import { M as McpHttpClient, f as VersionSkew } from '../transport-BbSPAS_N.cjs';
+export { C as CAPABILITY_REJECTION_REASON_HEADER, D as DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, E as EXTENSION_ACTIVE_VERSION_HEADER, a as EXTENSION_VERSION_HEADER, I as InputEventPayload, b as McpHttpRequest, c as McpHttpResponse, d as McpResponseMetadata, e as McpUploadRequest, V as VERSION_MISMATCH_REASON, g as VersionSkewSource, W as WORKER_TRANSPORT_PROTOCOL, h as WorkerCtor, i as WorkerHandshakePayload, j as WorkerLike, k as WorkerRemoteDomTransport, l as WorkerRemoteDomTransportOptions, m as detectVersionSkew } from '../transport-BbSPAS_N.cjs';
 export { RemoteReceiver, RemoteReceiverComment, RemoteReceiverElement, RemoteReceiverNode, RemoteReceiverParent, RemoteReceiverRoot, RemoteReceiverText } from '@remote-dom/core/receivers';
 export { RemoteComponentRendererMap, RemoteComponentRendererProps, RemoteRootRenderer, RemoteRootRendererProps, createRemoteComponentRenderer } from '@remote-dom/react/host';
 import '../bridge-envelopes-DA6vxbyb.cjs';
@@ -273,6 +273,18 @@ interface IframeBridgeTransportOptions {
     capabilityToken: () => Promise<string>;
     /** Host-side MCP HTTP client; carries the capability token on the outbound call. */
     mcpClient: McpHttpClient;
+    /**
+     * The extension version this surface mounted at. Enables proactive skew detection — a successful
+     * response stamped with a different version means the install moved while the surface is still
+     * working, so it can remount before anything fails.
+     */
+    mountedExtensionVersion?: string;
+    /**
+     * Called at most once, when this surface is found to be running against a version that is no
+     * longer installed. The host remounts the surface; the transport does not retry, because the
+     * pending call belongs to a page about to be replaced.
+     */
+    onVersionSkew?: (skew: VersionSkew) => void;
     /** Bounded in-flight MCP requests before back-pressure. Default 8. */
     maxConcurrentMcpRequests?: number;
     /** Max inbound port messages per rolling second before drop. Default 64. */
@@ -308,6 +320,9 @@ declare class IframeBridgeTransport {
     private readonly maxConcurrentMcpRequests;
     private readonly maxMessagesPerSecond;
     private readonly onSecurityEvent;
+    private readonly mountedExtensionVersion;
+    private readonly onVersionSkew;
+    private versionSkewReported;
     private readonly abortController;
     private hostPort;
     private framePort;
@@ -343,10 +358,21 @@ declare class IframeBridgeTransport {
     private isRateLimited;
     private dispatchMcp;
     private handleInvokeTool;
+    /**
+     * Raises the skew callback the first time this surface is seen to be running against a version
+     * that is no longer installed. Latched: a page usually has several MCP calls in flight and after
+     * an upgrade every one of them reports the same skew, so firing per response would ask the host
+     * to remount the same surface repeatedly and each remount would tear down the last.
+     *
+     * The callback is host code and may throw. That must neither escape into the MCP handler's catch
+     * (replying `ok: false` for a call that succeeded) nor consume the latch (leaving the surface with
+     * no response and no further chance of being told to remount).
+     */
+    private reportVersionSkew;
     private handleGetResource;
     private replyError;
     /** Best-effort reply over the host port; tolerates post-dispose races. */
     private safePostMessage;
 }
 
-export { CONTRACT_B_PRIMITIVES, ComponentRegistry, DEFAULT_OFFSCREEN_COALESCE_MS, type EvaluatorContext, IFRAME_BRIDGE_PROTOCOL, type IframeBridgeSecurityEvent, IframeBridgeTransport, type IframeBridgeTransportOptions, type IframeHandshakePayload, type InputEventCoalescerOptions, McpHttpClient, type OffscreenCanvasTransferOptions, type OffscreenCanvasTransferResult, type OffscreenTransferMessage, SemanticComponentRegistry, type SemanticPrimitiveName, createInputEventCoalescer, createOffscreenCanvasTransfer, evaluate, interpret };
+export { CONTRACT_B_PRIMITIVES, ComponentRegistry, DEFAULT_OFFSCREEN_COALESCE_MS, type EvaluatorContext, IFRAME_BRIDGE_PROTOCOL, type IframeBridgeSecurityEvent, IframeBridgeTransport, type IframeBridgeTransportOptions, type IframeHandshakePayload, type InputEventCoalescerOptions, McpHttpClient, type OffscreenCanvasTransferOptions, type OffscreenCanvasTransferResult, type OffscreenTransferMessage, SemanticComponentRegistry, type SemanticPrimitiveName, VersionSkew, createInputEventCoalescer, createOffscreenCanvasTransfer, evaluate, interpret };

package/dist/host/index.d.ts

@@ -3,8 +3,8 @@ import { C as ComponentRegistry } from '../registry-DpCx_LxF.js';
 export { P as PrimitiveProps } from '../registry-DpCx_LxF.js';
 import { SduiNode } from '@ethisyscore/protocol';
 export { PrimitiveName, SduiNode } from '@ethisyscore/protocol';
-import { M as McpHttpClient } from '../transport-CHa8ESUx.js';
-export { D as DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, I as InputEventPayload, a as McpHttpRequest, b as McpUploadRequest, W as WORKER_TRANSPORT_PROTOCOL, c as WorkerCtor, d as WorkerHandshakePayload, e as WorkerLike, f as WorkerRemoteDomTransport, g as WorkerRemoteDomTransportOptions } from '../transport-CHa8ESUx.js';
+import { M as McpHttpClient, f as VersionSkew } from '../transport-BPwasdNz.js';
+export { C as CAPABILITY_REJECTION_REASON_HEADER, D as DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, E as EXTENSION_ACTIVE_VERSION_HEADER, a as EXTENSION_VERSION_HEADER, I as InputEventPayload, b as McpHttpRequest, c as McpHttpResponse, d as McpResponseMetadata, e as McpUploadRequest, V as VERSION_MISMATCH_REASON, g as VersionSkewSource, W as WORKER_TRANSPORT_PROTOCOL, h as WorkerCtor, i as WorkerHandshakePayload, j as WorkerLike, k as WorkerRemoteDomTransport, l as WorkerRemoteDomTransportOptions, m as detectVersionSkew } from '../transport-BPwasdNz.js';
 export { RemoteReceiver, RemoteReceiverComment, RemoteReceiverElement, RemoteReceiverNode, RemoteReceiverParent, RemoteReceiverRoot, RemoteReceiverText } from '@remote-dom/core/receivers';
 export { RemoteComponentRendererMap, RemoteComponentRendererProps, RemoteRootRenderer, RemoteRootRendererProps, createRemoteComponentRenderer } from '@remote-dom/react/host';
 import '../bridge-envelopes-DA6vxbyb.js';
@@ -273,6 +273,18 @@ interface IframeBridgeTransportOptions {
     capabilityToken: () => Promise<string>;
     /** Host-side MCP HTTP client; carries the capability token on the outbound call. */
     mcpClient: McpHttpClient;
+    /**
+     * The extension version this surface mounted at. Enables proactive skew detection — a successful
+     * response stamped with a different version means the install moved while the surface is still
+     * working, so it can remount before anything fails.
+     */
+    mountedExtensionVersion?: string;
+    /**
+     * Called at most once, when this surface is found to be running against a version that is no
+     * longer installed. The host remounts the surface; the transport does not retry, because the
+     * pending call belongs to a page about to be replaced.
+     */
+    onVersionSkew?: (skew: VersionSkew) => void;
     /** Bounded in-flight MCP requests before back-pressure. Default 8. */
     maxConcurrentMcpRequests?: number;
     /** Max inbound port messages per rolling second before drop. Default 64. */
@@ -308,6 +320,9 @@ declare class IframeBridgeTransport {
     private readonly maxConcurrentMcpRequests;
     private readonly maxMessagesPerSecond;
     private readonly onSecurityEvent;
+    private readonly mountedExtensionVersion;
+    private readonly onVersionSkew;
+    private versionSkewReported;
     private readonly abortController;
     private hostPort;
     private framePort;
@@ -343,10 +358,21 @@ declare class IframeBridgeTransport {
     private isRateLimited;
     private dispatchMcp;
     private handleInvokeTool;
+    /**
+     * Raises the skew callback the first time this surface is seen to be running against a version
+     * that is no longer installed. Latched: a page usually has several MCP calls in flight and after
+     * an upgrade every one of them reports the same skew, so firing per response would ask the host
+     * to remount the same surface repeatedly and each remount would tear down the last.
+     *
+     * The callback is host code and may throw. That must neither escape into the MCP handler's catch
+     * (replying `ok: false` for a call that succeeded) nor consume the latch (leaving the surface with
+     * no response and no further chance of being told to remount).
+     */
+    private reportVersionSkew;
     private handleGetResource;
     private replyError;
     /** Best-effort reply over the host port; tolerates post-dispose races. */
     private safePostMessage;
 }
 
-export { CONTRACT_B_PRIMITIVES, ComponentRegistry, DEFAULT_OFFSCREEN_COALESCE_MS, type EvaluatorContext, IFRAME_BRIDGE_PROTOCOL, type IframeBridgeSecurityEvent, IframeBridgeTransport, type IframeBridgeTransportOptions, type IframeHandshakePayload, type InputEventCoalescerOptions, McpHttpClient, type OffscreenCanvasTransferOptions, type OffscreenCanvasTransferResult, type OffscreenTransferMessage, SemanticComponentRegistry, type SemanticPrimitiveName, createInputEventCoalescer, createOffscreenCanvasTransfer, evaluate, interpret };
+export { CONTRACT_B_PRIMITIVES, ComponentRegistry, DEFAULT_OFFSCREEN_COALESCE_MS, type EvaluatorContext, IFRAME_BRIDGE_PROTOCOL, type IframeBridgeSecurityEvent, IframeBridgeTransport, type IframeBridgeTransportOptions, type IframeHandshakePayload, type InputEventCoalescerOptions, McpHttpClient, type OffscreenCanvasTransferOptions, type OffscreenCanvasTransferResult, type OffscreenTransferMessage, SemanticComponentRegistry, type SemanticPrimitiveName, VersionSkew, createInputEventCoalescer, createOffscreenCanvasTransfer, evaluate, interpret };

package/dist/host/index.js

@@ -285,6 +285,50 @@ function createInputEventCoalescer(sink, options = {}) {
   };
 }
 
+// src/host/version-skew.ts
+var EXTENSION_VERSION_HEADER = "x-extension-version";
+var EXTENSION_ACTIVE_VERSION_HEADER = "x-extension-active-version";
+var CAPABILITY_REJECTION_REASON_HEADER = "x-capability-token-rejection-reason";
+var VERSION_MISMATCH_REASON = "extensionversionmismatch";
+function readHeader(headers, name) {
+  if (!headers) {
+    return void 0;
+  }
+  const direct = headers[name];
+  if (direct !== void 0) {
+    return direct;
+  }
+  const lowered = name.toLowerCase();
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === lowered) {
+      return headers[key];
+    }
+  }
+  return void 0;
+}
+function trimmedOrUndefined(value) {
+  const trimmed = value?.trim();
+  return trimmed !== void 0 && trimmed.length > 0 ? trimmed : void 0;
+}
+function detectVersionSkew(response, mountedExtensionVersion) {
+  const reason = trimmedOrUndefined(readHeader(response.headers, CAPABILITY_REJECTION_REASON_HEADER));
+  if (reason !== void 0 && reason.toLowerCase() === VERSION_MISMATCH_REASON) {
+    return {
+      activeVersion: trimmedOrUndefined(readHeader(response.headers, EXTENSION_ACTIVE_VERSION_HEADER)),
+      detectedFrom: "rejection"
+    };
+  }
+  if (!response.ok) {
+    return null;
+  }
+  const mounted = trimmedOrUndefined(mountedExtensionVersion);
+  const served = trimmedOrUndefined(readHeader(response.headers, EXTENSION_VERSION_HEADER));
+  if (mounted === void 0 || served === void 0 || served === mounted) {
+    return null;
+  }
+  return { activeVersion: served, detectedFrom: "response-stamp" };
+}
+
 // src/host/worker/bridge-envelopes.ts
 var BRIDGE_PUSH_THEME = "ethisys:bridge:theme";
 var BRIDGE_PUSH_LOCALE = "ethisys:bridge:locale";
@@ -304,6 +348,9 @@ var WorkerRemoteDomTransport = class {
   workerPort;
   mcpClient;
   capabilityTokenProvider;
+  mountedExtensionVersion;
+  onVersionSkew;
+  versionSkewReported = false;
   coalesceMs;
   maxConcurrentMcpRequests;
   abortController;
@@ -326,6 +373,8 @@ var WorkerRemoteDomTransport = class {
     }
     this.mcpClient = options.mcpClient;
     this.capabilityTokenProvider = options.capabilityToken;
+    this.mountedExtensionVersion = options.mountedExtensionVersion;
+    this.onVersionSkew = options.onVersionSkew;
     this.coalesceMs = options.coalesceMs ?? 16;
     this.maxConcurrentMcpRequests = Math.max(
       1,
@@ -609,6 +658,34 @@ var WorkerRemoteDomTransport = class {
   requestSignal(id) {
     return this.inFlightAborts.get(id)?.signal ?? this.abortController.signal;
   }
+  /**
+   * Raises the skew callback the first time this surface is seen to be running against a version
+   * that is no longer installed.
+   *
+   * Latched deliberately. A page typically has several MCP calls in flight, and after an upgrade
+   * every one of them reports the same skew — firing per response would ask the host to remount
+   * the same surface repeatedly, and the second remount would tear down the first. One signal per
+   * transport is all a remount needs, and the transport is discarded along with the surface.
+   *
+   * The callback is host code, so it is assumed to be able to throw. Two consequences are guarded
+   * here: the throw must not escape into the MCP handler's catch (which would reply `ok: false`
+   * for a call that actually succeeded), and it must not consume the latch (which would leave the
+   * surface with no response AND no further chance of being told to remount).
+   */
+  reportVersionSkew(response) {
+    if (this.versionSkewReported || this.onVersionSkew === void 0) {
+      return;
+    }
+    const skew = detectVersionSkew(response, this.mountedExtensionVersion);
+    if (skew === null) {
+      return;
+    }
+    try {
+      this.onVersionSkew(skew);
+      this.versionSkewReported = true;
+    } catch {
+    }
+  }
   async handleInvokeTool(message) {
     let token;
     try {
@@ -628,6 +705,7 @@ var WorkerRemoteDomTransport = class {
         capabilityToken: token,
         signal: this.requestSignal(message.id)
       });
+      this.reportVersionSkew(result);
       this.safePostMessage({
         id: message.id,
         type: "ethisys:mcp:invokeTool:result",
@@ -657,6 +735,7 @@ var WorkerRemoteDomTransport = class {
         capabilityToken: token,
         signal: this.requestSignal(message.id)
       });
+      this.reportVersionSkew(result);
       this.safePostMessage({
         id: message.id,
         type: "ethisys:mcp:getResource:result",
@@ -687,6 +766,7 @@ var WorkerRemoteDomTransport = class {
         capabilityToken: token,
         signal: this.requestSignal(message.id)
       });
+      this.reportVersionSkew(result);
       this.safePostMessage({
         id: message.id,
         type: "ethisys:mcp:uploadDocument:result",
@@ -729,6 +809,9 @@ var IframeBridgeTransport = class {
   maxConcurrentMcpRequests;
   maxMessagesPerSecond;
   onSecurityEvent;
+  mountedExtensionVersion;
+  onVersionSkew;
+  versionSkewReported = false;
   abortController = new AbortController();
   hostPort;
   framePort;
@@ -743,6 +826,8 @@ var IframeBridgeTransport = class {
     this.targetOrigin = options.targetOrigin;
     this.capabilityTokenProvider = options.capabilityToken;
     this.mcpClient = options.mcpClient;
+    this.mountedExtensionVersion = options.mountedExtensionVersion;
+    this.onVersionSkew = options.onVersionSkew;
     this.maxConcurrentMcpRequests = Math.max(1, options.maxConcurrentMcpRequests ?? DEFAULT_MAX_CONCURRENT_MCP_REQUESTS);
     this.maxMessagesPerSecond = Math.max(1, options.maxMessagesPerSecond ?? 64);
     this.onSecurityEvent = options.onSecurityEvent;
@@ -895,6 +980,7 @@ var IframeBridgeTransport = class {
         capabilityToken: token,
         signal: this.abortController.signal
       });
+      this.reportVersionSkew(result);
       this.safePostMessage({
         id: message.id,
         type: "ethisys:mcp:invokeTool:result",
@@ -906,6 +992,30 @@ var IframeBridgeTransport = class {
       this.replyError(message.id, "ethisys:mcp:invokeTool:result", err);
     }
   }
+  /**
+   * Raises the skew callback the first time this surface is seen to be running against a version
+   * that is no longer installed. Latched: a page usually has several MCP calls in flight and after
+   * an upgrade every one of them reports the same skew, so firing per response would ask the host
+   * to remount the same surface repeatedly and each remount would tear down the last.
+   *
+   * The callback is host code and may throw. That must neither escape into the MCP handler's catch
+   * (replying `ok: false` for a call that succeeded) nor consume the latch (leaving the surface with
+   * no response and no further chance of being told to remount).
+   */
+  reportVersionSkew(response) {
+    if (this.versionSkewReported || this.onVersionSkew === void 0) {
+      return;
+    }
+    const skew = detectVersionSkew(response, this.mountedExtensionVersion);
+    if (skew === null) {
+      return;
+    }
+    try {
+      this.onVersionSkew(skew);
+      this.versionSkewReported = true;
+    } catch {
+    }
+  }
   async handleGetResource(message) {
     let token;
     try {
@@ -924,6 +1034,7 @@ var IframeBridgeTransport = class {
         capabilityToken: token,
         signal: this.abortController.signal
       });
+      this.reportVersionSkew(result);
       this.safePostMessage({
         id: message.id,
         type: "ethisys:mcp:getResource:result",
@@ -951,6 +1062,6 @@ var IframeBridgeTransport = class {
   }
 };
 
-export { CONTRACT_B_PRIMITIVES, DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, DEFAULT_OFFSCREEN_COALESCE_MS, IFRAME_BRIDGE_PROTOCOL, IframeBridgeTransport, SemanticComponentRegistry, WORKER_TRANSPORT_PROTOCOL, WorkerRemoteDomTransport, createInputEventCoalescer, createOffscreenCanvasTransfer, evaluate, interpret };
+export { CAPABILITY_REJECTION_REASON_HEADER, CONTRACT_B_PRIMITIVES, DEFAULT_MAX_CONCURRENT_MCP_REQUESTS, DEFAULT_OFFSCREEN_COALESCE_MS, EXTENSION_ACTIVE_VERSION_HEADER, EXTENSION_VERSION_HEADER, IFRAME_BRIDGE_PROTOCOL, IframeBridgeTransport, SemanticComponentRegistry, VERSION_MISMATCH_REASON, WORKER_TRANSPORT_PROTOCOL, WorkerRemoteDomTransport, createInputEventCoalescer, createOffscreenCanvasTransfer, detectVersionSkew, evaluate, interpret };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map