@glasshome/widget-sdk 1.27.1 → 1.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -0
- package/dist/export-history.json +145 -0
- package/dist/framework/hooks/index.d.ts +3 -1
- package/dist/framework/hooks/use-widget-context.d.ts +8 -0
- package/dist/framework/hooks/use-widget-state.d.ts +10 -0
- package/dist/framework/index.d.ts +1 -1
- package/dist/index.js +783 -677
- package/guide/widgets.md +1 -1
- package/package.json +2 -2
package/guide/widgets.md
CHANGED
|
@@ -76,7 +76,7 @@ Render `<WidgetDialog>` next to `<Widget>`, spreading the dialog parts (`Respons
|
|
|
76
76
|
Dash 1.5 previews the engine every widget will run in: QuickJS, no page access. Test there before publishing: Settings, Developer Mode, Sealed widgets (preview), reload, then `bun widget connect`. `bun widget preview` still renders in the page, so it does not prove a widget runs sealed.
|
|
77
77
|
|
|
78
78
|
- Import only `@glasshome/widget-sdk` and `solid-js` (`/store`, `/web`).
|
|
79
|
-
- No `fetch`, `XMLHttpRequest`, WebSocket, cookies, Capacitor. `localStorage` and `sessionStorage` are in memory, one pair per widget (every copy of a widget shares it), and empty on reload. They keep widgets apart but are no security boundary: widgets in one engine share its memory. Module top-level code uses its widget's store; a timer or listener set up there runs for no widget, so storage throws a catchable SecurityError in it and the engine runs on. Keep what must last
|
|
79
|
+
- No `fetch`, `XMLHttpRequest`, WebSocket, cookies, Capacitor. `localStorage` and `sessionStorage` are in memory, one pair per widget (every copy of a widget shares it), and empty on reload. They keep widgets apart but are no security boundary: widgets in one engine share its memory. Module top-level code uses its widget's store; a timer or listener set up there runs for no widget, so storage throws a catchable SecurityError in it and the engine runs on. Keep what must last with `useWidgetState(key, schema, fallback)`: for this widget on its board and this person, kept by the host (8 KB a value, 32 keys); config stays for settings the homeowner chooses. Built-ins are frozen: no `z.config`, no global patches.
|
|
80
80
|
- DOM is mirrored through an allowlist: no `<style>`, `<link>`, `<script>`, no `el.click()`; images only `data:image/…`, same-origin `blob:` or `/ha-proxy/media`.
|
|
81
81
|
- Limits: CPU 250 ms per second, setup 1.5 s per 10 s (both stop the widget until the homeowner turns it back on), 500 ms per run and 256 MB (both crash it), 20,000 elements, 512 timers, 128 observers.
|
|
82
82
|
- Refusals and CPU use: Settings > Sealed widgets (Developer Mode). Each refusal has a sentence and a code; fix every one.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@glasshome/widget-sdk",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.28.0",
|
|
4
4
|
"description": "SDK for building GlassHome dashboard widgets with SolidJS",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"dashboard",
|
|
@@ -76,7 +76,7 @@
|
|
|
76
76
|
"lint": "oxlint --type-aware . && oxfmt --check ."
|
|
77
77
|
},
|
|
78
78
|
"dependencies": {
|
|
79
|
-
"@glasshome/widget-contract": "0.
|
|
79
|
+
"@glasshome/widget-contract": "0.7.0",
|
|
80
80
|
"@tailwindcss/vite": "^4.1.13",
|
|
81
81
|
"clsx": "^2.1.1",
|
|
82
82
|
"happy-dom": "^20.0.0",
|