@floegence/redevplugin-ui 3.0.31 → 3.0.33

package/dist/surface-integrity.gen.d.ts

@@ -0,0 +1 @@
+export declare const surfaceIntegrityScript = "/* @noble/hashes 2.4.0\nThe MIT License (MIT)\n\nCopyright (c) 2022 Paul Miller (https://paulmillr.com)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \u201CSoftware\u201D), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \u201CAS IS\u201D, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.*/\nvar redevpluginIntegrity=(()=>{var w=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var M=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var N=(e,t)=>{for(var n in t)w(e,n,{get:t[n],enumerable:!0})},W=(e,t,n,r)=>{if(t&&typeof t==\"object\"||typeof t==\"function\")for(let o of M(t))!R.call(e,o)&&o!==n&&w(e,o,{get:()=>t[o],enumerable:!(r=k(t,o))||r.enumerable});return e};var I=e=>W(w({},\"__esModule\",{value:!0}),e);var q={};N(q,{sha256:()=>$});var K=e=>e/2**32|0,P=e=>e>>>0;function S(e,t,n,r){let o=K(n),c=P(n);e.setUint32(t,r?c:o,r),e.setUint32(t+4,r?o:c,r)}function _(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===\"Uint8Array\"&&\"BYTES_PER_ELEMENT\"in e&&e.BYTES_PER_ELEMENT===1}var m=e=>e?`\"${e}\" `:\"\";function X(e,t=\"\"){if(typeof e!=\"number\")throw new TypeError(m(t)+\"expected number, got \"+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(m(t)+\"expected integer >= 0, got \"+e);return e}function A(e,t,n=\"\"){if(_(e)&&(t===void 0||e.length===t))return e;t!==void 0&&X(t,\"length\");let r=_(e),o=t!==void 0?` of length ${t}`:\"\",c=r?`length=${e.length}`:`type=${typeof e}`,f=m(n)+\"expected Uint8Array\"+o+\", got \"+c;throw r?new RangeError(f):new TypeError(f)}var J=(e,t)=>{if(e===null||typeof e!=\"object\"||Array.isArray(e))throw new TypeError((t===\"object\"?\"\":`\"${t}\" `)+\"expected object, got type=\"+typeof e)},T=(e,t)=>{J(e,t);let n=Object.getPrototypeOf(e);if(n!==Object.prototype&&n!==null)throw new TypeError(`\"${t}\" expected plain object`);if(Object.hasOwn(e,\"__proto__\"))throw new TypeError(`\"${t}.__proto__\" is not allowed`)};function E(e,t=!0){if(e.destroyed)throw new Error(\"hash was destroyed\");if(t&&e.finished)throw new Error(\"digest() was already called\")}function C(e,t){A(e,void 0,\"output\");let n=t.outputLen;if(!(e.length>=n))throw new RangeError('\"output\" expected length >= '+n)}function H(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function p(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function h(e,t){return e<<32-t|e>>>t}function Y(e,t,n=\"opts\"){return T(e,\"defaults\"),t!==void 0&&T(t,n),Object.assign(Object.create(null),e,t)}function F(e,t={}){if(typeof e!=\"function\")throw new TypeError('\"hashCons\" expected function, got type='+typeof e);t=Y({},t,\"info\");let n=(o,c)=>e(c).update(o).digest(),r=e(void 0);return n.outputLen=r.outputLen,n.blockLen=r.blockLen,n.canXOF=r.canXOF,n.create=o=>e(o),Object.assign(n,t),Object.freeze(n)}var D=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function O(e,t,n){return e&t^~e&n}function G(e,t,n){return e&t^e&n^t&n}var y=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(t,n,r,o){this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=p(this.buffer)}update(t){E(this),A(t);let{view:n,buffer:r,blockLen:o}=this,c=t.length,f=!1;for(let s=0;s<c;){let x=Math.min(o-this.pos,c-s);if(x===o){let a=p(t);for(;o<=c-s;s+=o)this.process(a,s);f=!0;continue}r.set(s===0&&x===c?t:t.subarray(s,s+x),this.pos),this.pos+=x,s+=x,this.pos===o&&(this.process(n,0),this.pos=0,f=!0)}return this.length+=t.length,f&&this.roundClean(),this}digestInto(t){E(this),C(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:c}=this,{pos:f}=this;n[f++]=128,n.fill(0,f),this.padOffset>o-f&&(this.process(r,0),n.fill(0)),S(r,o-8,this.length*8,c),this.process(r,0),this.roundClean();let s=t===n?r:p(t),x=this.outputLen,a=x/4,d=this.get();if(x%4||a>d.length)throw new Error(\"invalid outputLen\");for(let i=0;i<a;i++)s.setUint32(4*i,d[i],c)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneIntoMeta(t){let{buffer:n,length:r,finished:o,destroyed:c,pos:f}=this;return t.destroyed=c,t.finished=o,t.length=r,t.pos=f,f&&t.buffer.set(n),t}clone(){return this._cloneInto()}},j=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var z=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),u=new Uint32Array(64),L=class extends y{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(t,n){super(64,t,8,!1),this.A=n[0]|0,this.B=n[1]|0,this.C=n[2]|0,this.D=n[3]|0,this.E=n[4]|0,this.F=n[5]|0,this.G=n[6]|0,this.H=n[7]|0}get(){let{A:t,B:n,C:r,D:o,E:c,F:f,G:s,H:x}=this;return[t,n,r,o,c,f,s,x]}set(t,n,r,o,c,f,s,x){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=c|0,this.F=f|0,this.G=s|0,this.H=x|0}_cloneInto(t){return(t||=new this.constructor).set(...this.get()),this._cloneIntoMeta(t)}process(t,n){for(let i=0;i<16;i++,n+=4)u[i]=t.getUint32(n,!1);for(let i=16;i<64;i++){let l=u[i-15],b=u[i-2],U=h(l,7)^h(l,18)^l>>>3,g=h(b,17)^h(b,19)^b>>>10;u[i]=g+u[i-7]+U+u[i-16]|0}let{A:r,B:o,C:c,D:f,E:s,F:x,G:a,H:d}=this;for(let i=0;i<64;i++){let l=h(s,6)^h(s,11)^h(s,25),b=d+l+O(s,x,a)+z[i]+u[i]|0,g=(h(r,2)^h(r,13)^h(r,22))+G(r,o,c)|0;d=a,a=x,x=s,s=f+b|0,f=c,c=o,o=r,r=b+g|0}r=r+this.A|0,o=o+this.B|0,c=c+this.C|0,f=f+this.D|0,s=s+this.E|0,x=x+this.F|0,a=a+this.G|0,d=d+this.H|0,this.set(r,o,c,f,s,x,a,d)}roundClean(){H(u)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),H(this.buffer)}},B=class extends L{constructor(){super(32,j)}};var $=F(()=>new B,D(1));return I(q);})();\n";

package/dist/surface-integrity.gen.js

@@ -0,0 +1,2 @@
+// Code generated by scripts/build_surface_integrity.mjs; DO NOT EDIT.
+export const surfaceIntegrityScript = "/* @noble/hashes 2.4.0\nThe MIT License (MIT)\n\nCopyright (c) 2022 Paul Miller (https://paulmillr.com)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the “Software”), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.*/\nvar redevpluginIntegrity=(()=>{var w=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var M=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var N=(e,t)=>{for(var n in t)w(e,n,{get:t[n],enumerable:!0})},W=(e,t,n,r)=>{if(t&&typeof t==\"object\"||typeof t==\"function\")for(let o of M(t))!R.call(e,o)&&o!==n&&w(e,o,{get:()=>t[o],enumerable:!(r=k(t,o))||r.enumerable});return e};var I=e=>W(w({},\"__esModule\",{value:!0}),e);var q={};N(q,{sha256:()=>$});var K=e=>e/2**32|0,P=e=>e>>>0;function S(e,t,n,r){let o=K(n),c=P(n);e.setUint32(t,r?c:o,r),e.setUint32(t+4,r?o:c,r)}function _(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===\"Uint8Array\"&&\"BYTES_PER_ELEMENT\"in e&&e.BYTES_PER_ELEMENT===1}var m=e=>e?`\"${e}\" `:\"\";function X(e,t=\"\"){if(typeof e!=\"number\")throw new TypeError(m(t)+\"expected number, got \"+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(m(t)+\"expected integer >= 0, got \"+e);return e}function A(e,t,n=\"\"){if(_(e)&&(t===void 0||e.length===t))return e;t!==void 0&&X(t,\"length\");let r=_(e),o=t!==void 0?` of length ${t}`:\"\",c=r?`length=${e.length}`:`type=${typeof e}`,f=m(n)+\"expected Uint8Array\"+o+\", got \"+c;throw r?new RangeError(f):new TypeError(f)}var J=(e,t)=>{if(e===null||typeof e!=\"object\"||Array.isArray(e))throw new TypeError((t===\"object\"?\"\":`\"${t}\" `)+\"expected object, got type=\"+typeof e)},T=(e,t)=>{J(e,t);let n=Object.getPrototypeOf(e);if(n!==Object.prototype&&n!==null)throw new TypeError(`\"${t}\" expected plain object`);if(Object.hasOwn(e,\"__proto__\"))throw new TypeError(`\"${t}.__proto__\" is not allowed`)};function E(e,t=!0){if(e.destroyed)throw new Error(\"hash was destroyed\");if(t&&e.finished)throw new Error(\"digest() was already called\")}function C(e,t){A(e,void 0,\"output\");let n=t.outputLen;if(!(e.length>=n))throw new RangeError('\"output\" expected length >= '+n)}function H(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function p(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function h(e,t){return e<<32-t|e>>>t}function Y(e,t,n=\"opts\"){return T(e,\"defaults\"),t!==void 0&&T(t,n),Object.assign(Object.create(null),e,t)}function F(e,t={}){if(typeof e!=\"function\")throw new TypeError('\"hashCons\" expected function, got type='+typeof e);t=Y({},t,\"info\");let n=(o,c)=>e(c).update(o).digest(),r=e(void 0);return n.outputLen=r.outputLen,n.blockLen=r.blockLen,n.canXOF=r.canXOF,n.create=o=>e(o),Object.assign(n,t),Object.freeze(n)}var D=e=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,e])});function O(e,t,n){return e&t^~e&n}function G(e,t,n){return e&t^e&n^t&n}var y=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(t,n,r,o){this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=p(this.buffer)}update(t){E(this),A(t);let{view:n,buffer:r,blockLen:o}=this,c=t.length,f=!1;for(let s=0;s<c;){let x=Math.min(o-this.pos,c-s);if(x===o){let a=p(t);for(;o<=c-s;s+=o)this.process(a,s);f=!0;continue}r.set(s===0&&x===c?t:t.subarray(s,s+x),this.pos),this.pos+=x,s+=x,this.pos===o&&(this.process(n,0),this.pos=0,f=!0)}return this.length+=t.length,f&&this.roundClean(),this}digestInto(t){E(this),C(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:c}=this,{pos:f}=this;n[f++]=128,n.fill(0,f),this.padOffset>o-f&&(this.process(r,0),n.fill(0)),S(r,o-8,this.length*8,c),this.process(r,0),this.roundClean();let s=t===n?r:p(t),x=this.outputLen,a=x/4,d=this.get();if(x%4||a>d.length)throw new Error(\"invalid outputLen\");for(let i=0;i<a;i++)s.setUint32(4*i,d[i],c)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneIntoMeta(t){let{buffer:n,length:r,finished:o,destroyed:c,pos:f}=this;return t.destroyed=c,t.finished=o,t.length=r,t.pos=f,f&&t.buffer.set(n),t}clone(){return this._cloneInto()}},j=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var z=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),u=new Uint32Array(64),L=class extends y{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(t,n){super(64,t,8,!1),this.A=n[0]|0,this.B=n[1]|0,this.C=n[2]|0,this.D=n[3]|0,this.E=n[4]|0,this.F=n[5]|0,this.G=n[6]|0,this.H=n[7]|0}get(){let{A:t,B:n,C:r,D:o,E:c,F:f,G:s,H:x}=this;return[t,n,r,o,c,f,s,x]}set(t,n,r,o,c,f,s,x){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=c|0,this.F=f|0,this.G=s|0,this.H=x|0}_cloneInto(t){return(t||=new this.constructor).set(...this.get()),this._cloneIntoMeta(t)}process(t,n){for(let i=0;i<16;i++,n+=4)u[i]=t.getUint32(n,!1);for(let i=16;i<64;i++){let l=u[i-15],b=u[i-2],U=h(l,7)^h(l,18)^l>>>3,g=h(b,17)^h(b,19)^b>>>10;u[i]=g+u[i-7]+U+u[i-16]|0}let{A:r,B:o,C:c,D:f,E:s,F:x,G:a,H:d}=this;for(let i=0;i<64;i++){let l=h(s,6)^h(s,11)^h(s,25),b=d+l+O(s,x,a)+z[i]+u[i]|0,g=(h(r,2)^h(r,13)^h(r,22))+G(r,o,c)|0;d=a,a=x,x=s,s=f+b|0,f=c,c=o,o=r,r=b+g|0}r=r+this.A|0,o=o+this.B|0,c=c+this.C|0,f=f+this.D|0,s=s+this.E|0,x=x+this.F|0,a=a+this.G|0,d=d+this.H|0,this.set(r,o,c,f,s,x,a,d)}roundClean(){H(u)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),H(this.buffer)}},B=class extends L{constructor(){super(32,j)}};var $=F(()=>new B,D(1));return I(q);})();\n";

package/dist/surface.js

@@ -1,3 +1,6 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { surfaceIntegrityScript } from "./surface-integrity.gen.js";
 import { PluginBridgeError, PluginPlatformRequestError, PluginTransportError, pluginBridgeErrorCodes, } from "./errors.js";
 import { pluginBridgeCapabilityEffect, } from "./bridge-capability.js";
 import { opaqueSurfaceAllowedTags, opaqueSurfaceGlobalAttributes, opaqueSurfaceRenderLimits, opaqueSurfaceSafeInputTypes, opaqueSurfaceTagAttributes, } from "./opaque-surface-policy.gen.js";
@@ -680,10 +683,6 @@ export function decodePluginEventText(event) {
     throw new PluginBridgeError("PLUGIN_STREAM_FAILED", "No base64 decoder is available for plugin execution event data");
 }
 export async function trustedParentBridgeHandshakeTranscriptSHA256(handshake, bridgeChannelID) {
-    const subtle = globalThis.crypto?.subtle;
-    if (!subtle) {
-        throw new PluginBridgeError("PLUGIN_BRIDGE_HANDSHAKE_FAILED", "Web Crypto SHA-256 is unavailable for plugin bridge handshake");
-    }
     const encoder = new TextEncoder();
     const fields = [
         "redevplugin.bridge.handshake.v3",
@@ -712,8 +711,7 @@ export async function trustedParentBridgeHandshakeTranscriptSHA256(handshake, br
         transcript.set(chunk, offset);
         offset += chunk.byteLength;
     }
-    const digest = await subtle.digest("SHA-256", transcript);
-    return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+    return `sha256:${bytesToHex(sha256(transcript))}`;
 }
 const surfaceTransportInternals = new WeakMap();
 export function createReDevPluginSurfaceTransport(options = {}) {
@@ -798,6 +796,7 @@ export function createOpaquePluginBootstrapHTML(options = {}) {
     ].join("; ");
     const bootstrapScript = `(() => {
   "use strict";
+  ${surfaceIntegrityScript}
   const documentSchema = ${JSON.stringify(opaqueSurfaceDocumentSchemaVersion)};
   const workerGlobalKey = ${JSON.stringify(opaquePluginBridgeGlobalKey)};
   const scriptNonce = ${JSON.stringify(scriptNonce)};
@@ -1955,8 +1954,7 @@ export function createOpaquePluginBootstrapHTML(options = {}) {
     const binary = atob(contentBase64);
     const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
     if (bytes.byteLength !== asset.size) throw new Error("plugin asset size mismatch");
-    if (!crypto || !crypto.subtle) throw new Error("plugin asset SHA-256 verification is unavailable");
-    const digestBytes = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    const digestBytes = redevpluginIntegrity.sha256(bytes);
     const actualDigest = "sha256:" + Array.from(digestBytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
     if (actualDigest !== asset.sha256) throw new Error("plugin asset bytes failed SHA-256 verification");
     const declaredType = imageType(asset.content_type);
@@ -2305,6 +2303,7 @@ export function createOpaquePluginBootstrapHTML(options = {}) {
         sendWorkerTransfer({ type: "redevplugin.ui.canvas.ready", id, canvas_id: canvasID, canvas: offscreen, css_width: metrics.cssWidth, css_height: metrics.cssHeight, device_pixel_ratio: metrics.devicePixelRatio }, [offscreen]);
         return;
       }
+      if (runtime.metrics?.cssWidth === metrics.cssWidth && runtime.metrics?.cssHeight === metrics.cssHeight && runtime.metrics?.devicePixelRatio === metrics.devicePixelRatio) return;
       runtime.metrics = metrics;
       sendInput({ type: "resize", css_width: metrics.cssWidth, css_height: metrics.cssHeight, device_pixel_ratio: metrics.devicePixelRatio });
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/redevplugin-ui",
-  "version": "3.0.31",
+  "version": "3.0.33",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -40,7 +40,8 @@
     "dist"
   ],
   "dependencies": {
-    "@floegence/redevplugin-contracts": "3.0.31"
+    "@floegence/redevplugin-contracts": "3.0.33",
+    "@noble/hashes": "2.4.0"
   },
   "publishConfig": {
     "access": "public"