@farm.js/islx 0.0.6 → 0.0.7

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.0.7
+
+Cloudflare Workers start, and sealed captured values name their key with 4 bytes.
+
+- `@farm.js/islx/react/server` no longer generates random values while it loads. It made the
+  promise-name prefix with `crypto.getRandomValues` at module scope, which Workers reject
+  ("Disallowed operation called within global scope"), so no islx app started on Cloudflare
+  since promise props (0.0.4). The prefix is made at the first render now.
+- An inline `"use server"` function's captured values are sealed with format version 2: the key id
+  is the first 4 bytes of the key's SHA-256 instead of the first byte. With one byte, a deploy that
+  changed keys without keeping the old one gave the new key the same id one time in 256, and
+  values from pages rendered before it failed as invalid (`400`) instead of stale (the page
+  reloads). An app that does not set `ISLX_ACTIONS_KEY` gets a new key on every build, so this hit
+  about one deploy in 256.
+- Values sealed by 0.0.6 or earlier (format version 1) are stale: forms on pages open across the
+  upgrade reload once.
+
 ## 0.0.6
 
 Server action interceptor, early clicks on TanStack Start, library islands under pnpm.

package/README.md

@@ -13,7 +13,7 @@ islx started as [Farm.js](https://github.com/farming-labs/farm.js)'s islands mod
 replaces React Server Components' Flight payload. On a 300-page docs app it ships 26% less
 JavaScript, and a client navigation sends 2.5 KB instead of 12 KB.
 
-> Status: 0.0.6. React, Vite and TanStack Start are supported; other renderers and framework
+> Status: 0.0.7. React, Vite and TanStack Start are supported; other renderers and framework
 > integrations follow. The wire format is in [SPEC.md](./SPEC.md), changes in
 > [CHANGELOG.md](./CHANGELOG.md).
 

package/SPEC.md

@@ -198,14 +198,17 @@ travel with the action, sealed, so the browser can neither read nor change them:
 sealed = base64url( version ‖ key id ‖ IV ‖ AES-256-GCM(ciphertext ‖ tag) )
 ```
 
-- `version` is `1`; `key id` is the first byte of SHA-256 of the key; the IV is 12 random bytes;
+- `version` is `2` (one byte); `key id` is the first 4 bytes of SHA-256 of the key, big-endian;
+  the IV is 12 random bytes;
 - the additional data is `islx:action:<id>`, so values sealed for one action never open for
   another;
 - the plaintext is the captured values as a tagged JSON array.
 
-A value sealed with a key the server does not have is **stale** (the page reloads); anything that
-does not open is **invalid** (`400`). Servers may hold previous keys, so pages rendered before a
-key rotation keep working. Every server instance must share the keys.
+A value sealed with a key the server does not have, or in another `version`, is **stale** (the
+page reloads); anything that does not open is **invalid** (`400`). Servers may hold previous keys,
+so pages rendered before a key rotation keep working. Every server instance must share the keys.
+Version 1 named the key with one byte, so one key rotation in 256 made values from open pages
+invalid instead of stale; its values are stale now.
 
 ## Integration model
 

package/dist/_chunks/{actions-BuS5jDi0.mjs → actions-CvQ0-zjg.mjs}

@@ -24,10 +24,11 @@ import { a as encode, r as decode, t as EncodeError } from "./codec-C8to-RQW.mjs
 * Sealing is asynchronous. React's server renderer waits for it: a form whose action's values
 * are still sealing suspends, and renders once they are ready.
 *
-*   sealed = base64url( version (1 byte) ‖ key id (1 byte) ‖ IV (12 bytes) ‖ ciphertext+tag )
+*   sealed = base64url( version (1 byte) ‖ key id (4 bytes) ‖ IV (12 bytes) ‖ ciphertext+tag )
 */
-const VERSION = 1;
+const VERSION = 2;
 const IV_BYTES = 12;
+const HEADER_BYTES = 5;
 const KEY_BYTES = 32;
 /** Thrown when a sealed value does not open: changed, made for another action, or stale. */
 var SealError = class extends Error {
@@ -58,7 +59,7 @@ function fromBase64url(text) {
 		return null;
 	}
 }
-/** A new random key, as base64url: what `FURROW_ACTIONS_KEY` holds. */
+/** A new random key, as base64url: what `ISLX_ACTIONS_KEY` holds. */
 function generateActionKey() {
 	return base64url(crypto.getRandomValues(new Uint8Array(KEY_BYTES)));
 }
@@ -67,10 +68,10 @@ async function importKey(secret) {
 	if (!bytes || bytes.length !== KEY_BYTES) throw new TypeError("an actions key must be 32 random bytes as base64url; create one with generateActionKey() from @farm.js/islx/server");
 	return crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
 }
-/** The key's id: its first byte of SHA-256, so a value names the key that sealed it. */
+/** The key's id: the first 4 bytes of its SHA-256, so a value names the key that sealed it. */
 async function keyId(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret.trim()));
-	return new Uint8Array(digest)[0];
+	return new DataView(digest).getUint32(0);
 }
 /**
 * The keys values are sealed and opened with. `current` seals; `previous` keys still open
@@ -128,11 +129,11 @@ async function sealBound(keys, actionId, values, options = {}) {
 		iv,
 		additionalData: additionalData(actionId)
 	}, keys.current, new TextEncoder().encode(json)));
-	const sealed = new Uint8Array(14 + ciphertext.length);
+	const sealed = new Uint8Array(17 + ciphertext.length);
 	sealed[0] = VERSION;
-	sealed[1] = keys.currentId;
-	sealed.set(iv, 2);
-	sealed.set(ciphertext, 14);
+	new DataView(sealed.buffer).setUint32(1, keys.currentId);
+	sealed.set(iv, HEADER_BYTES);
+	sealed.set(ciphertext, 17);
 	return base64url(sealed);
 }
 /**
@@ -141,17 +142,17 @@ async function sealBound(keys, actionId, values, options = {}) {
 */
 async function unsealBound(keys, actionId, sealed, options = {}) {
 	const bytes = fromBase64url(sealed);
-	if (!bytes || bytes.length < 30) throw new SealError("invalid", "sealed action values are malformed");
-	if (bytes[0] !== VERSION) throw new SealError("stale", "sealed action values use another format version");
-	const candidates = keys.byId.get(bytes[1]);
+	if (bytes && bytes.length > 0 && bytes[0] !== VERSION) throw new SealError("stale", "sealed action values use another format version");
+	if (!bytes || bytes.length < 33) throw new SealError("invalid", "sealed action values are malformed");
+	const candidates = keys.byId.get(new DataView(bytes.buffer).getUint32(1));
 	if (!candidates) throw new SealError("stale", "sealed action values use a key this server does not have");
 	let plaintext;
 	for (const key of candidates) try {
 		plaintext = await crypto.subtle.decrypt({
 			name: "AES-GCM",
-			iv: bytes.subarray(2, 14),
+			iv: bytes.subarray(HEADER_BYTES, 17),
 			additionalData: additionalData(actionId)
-		}, key, bytes.subarray(14));
+		}, key, bytes.subarray(17));
 		break;
 	} catch {}
 	if (!plaintext) throw new SealError("invalid", "sealed action values do not open for this action");

package/dist/react/server.mjs

@@ -1,7 +1,7 @@
 import { a as encode } from "../_chunks/codec-C8to-RQW.mjs";
 import { f as FORM_STATE_SCRIPT_TYPE } from "../_chunks/wire-QEQWBr5s.mjs";
 import { r as PREHYDRATION_SCRIPT } from "../_chunks/prehydration-B1GLTLdk.mjs";
-import { i as encodeActionReference } from "../_chunks/actions-BuS5jDi0.mjs";
+import { i as encodeActionReference } from "../_chunks/actions-CvQ0-zjg.mjs";
 import { t as getBuildDefaults } from "../_chunks/build-COIcs7wm.mjs";
 import { a as parseHeldValues, n as addressValues, o as selectValuesToSend, r as escapeScriptJson } from "../_chunks/values-37UIzxM0.mjs";
 import { c as setIslandServerHook, i as getContexts, l as setRenderStateResolver, n as createIsland, o as isolateIslands, r as getClientReference, s as runtimeTagged, t as IslandsProvider, u as withinClientRoot } from "../_chunks/island-DVOr-OUw.mjs";
@@ -12,8 +12,12 @@ import * as React from "react";
 * @farm.js/islx/react/server: rendering a React page with islands. Importing it gives islands the
 * server code they need (values, action references); `renderToStream` renders a page.
 */
-const PROMISE_PREFIX = `${Array.from(crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(2)), (part) => part.toString(36)).join("")}.`;
+let promisePrefix;
 let promiseCount = 0;
+function nextPromiseName() {
+	promisePrefix ??= `${Array.from(crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(2)), (part) => part.toString(36)).join("")}.`;
+	return promisePrefix + (promiseCount++).toString(36);
+}
 function isThenable(value) {
 	return value !== null && (typeof value === "object" || typeof value === "function") && typeof value.then === "function";
 }
@@ -23,7 +27,7 @@ setIslandServerHook({
 		const addressed = addressValues(props, { encodeSpecial: (value) => {
 			if (value && typeof value === "object" && runtimeTagged.has(value)) return value;
 			if (isThenable(value)) {
-				const name = PROMISE_PREFIX + (promiseCount++).toString(36);
+				const name = nextPromiseName();
 				promises.push({
 					name,
 					promise: value

package/dist/server.d.mts

@@ -71,15 +71,15 @@ declare class SealError extends Error {
 interface ActionKeys {
   /** The key new values are sealed with. */
   current: CryptoKey;
-  /** Its id, written into each sealed value (0-255). */
+  /** Its id, written into each sealed value (a 32-bit unsigned integer). */
   currentId: number;
   /**
-   * Every key that opens a value, by id: the current one and earlier ones still accepted. Ids are
-   * one byte, so two keys can share one; each is tried.
+   * Every key that opens a value, by id: the current one and earlier ones still accepted. Two keys
+   * may still share an id; each is tried.
    */
   byId: ReadonlyMap<number, readonly CryptoKey[]>;
 }
-/** A new random key, as base64url: what `FURROW_ACTIONS_KEY` holds. */
+/** A new random key, as base64url: what `ISLX_ACTIONS_KEY` holds. */
 declare function generateActionKey(): string;
 /**
  * The keys values are sealed and opened with. `current` seals; `previous` keys still open

package/dist/server.mjs

@@ -1,5 +1,5 @@
 import { a as parseHeldValues, i as hashValue, n as addressValues, o as selectValuesToSend, r as escapeScriptJson, t as VALUE_MIN_LENGTH } from "./_chunks/values-37UIzxM0.mjs";
-import { a as getActionReference, c as resolveAction, d as generateActionKey, f as sealBound, i as encodeActionReference, l as SealError, n as configureActionKeys, o as registerInlineAction, p as unsealBound, r as decodeActionReference, s as registerServerReference, t as bindInlineAction, u as createActionKeys } from "./_chunks/actions-BuS5jDi0.mjs";
+import { a as getActionReference, c as resolveAction, d as generateActionKey, f as sealBound, i as encodeActionReference, l as SealError, n as configureActionKeys, o as registerInlineAction, p as unsealBound, r as decodeActionReference, s as registerServerReference, t as bindInlineAction, u as createActionKeys } from "./_chunks/actions-CvQ0-zjg.mjs";
 import { a as encode, r as decode } from "./_chunks/codec-C8to-RQW.mjs";
 import { I as readPostedAction, L as stripRuntimeFields, N as attachmentField, n as ACTION_KEY_FIELD, o as BOUND_FIELD, r as ACTION_STALE_HEADER, s as CALL_FIELD, t as ACTION_HEADER } from "./_chunks/wire-QEQWBr5s.mjs";
 import { n as setBuildDefaults, t as getBuildDefaults } from "./_chunks/build-COIcs7wm.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/islx",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "A renderer-agnostic wire format for server-rendered islands: typed props, values sent once, server actions, and partial navigations.",
   "keywords": [
     "islands",