@graview/guest 0.0.0-stage → 0.1.2

package/LICENSE

@@ -0,0 +1,96 @@
+Elastic License 2.0
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key
+functionality in the software, and you may not remove or obscure any
+functionality in the software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf
+of your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not
+licensed, and your licenses will automatically terminate. If the licensor
+provides you with a notice of your violation, and you cease all violation of
+this license no later than 30 days after you receive that notice, your
+licenses will be reinstated retroactively. However, if you violate these
+terms after such reinstatement, any additional violation of these terms will
+cause your licenses to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control
+over, are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of
+an entity, or the power to direct its management and policies by vote,
+contract, or otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your
+licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
+
+---
+
+Copyright 2025-2026 En Dash Consulting

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @graview/guest
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A view somebody else wrote — a recipe card, a bespoke dashboard, React or
+plain script — drawn in an iframe that can see only what the viewer may see
+and can only ask. The host pushes the view's props as the viewer sees them;
+the guest asks for an act by name, and the host applies it as the viewer, so
+the policy refuses on the guest's behalf exactly as it would refuse a click.
+The rail says the act came through the view.
+
+## In the host
+
+```ts
+import { guestView, mountGuestView } from "@graview/guest/host";
+
+views.register("recipe", { fidelity: "full", cardinality: "one" },
+  guestView({ url: "https://cards.example/recipe.html", name: "recipe-card" }));
+
+// Or without React, into any element:
+const frame = mountGuestView(element, { url, view: "recipe-card", store, principal, input: () => ({ node: { id } }) });
+frame.update();   // the input moved
+frame.dispose();
+```
+
+`mountGuestView` gives the frame `sandbox="allow-scripts"` and never
+`allow-same-origin`, so its origin is opaque and no cookie, storage or store
+of the host's is reachable from it. A `guest-ready` is answered only from
+that frame's own window and from the opaque origin, with a fresh nonce and a
+MessageChannel; every request over the port carries the nonce. Acts are
+rate-limited per frame (30 a minute by default, `limits`), and a flood of
+messages past 120 a second is dropped unread. `createGuestHost` is the same
+host without the DOM. Where the frame is served from, and its CSP, are the
+host's business: a separate registrable domain with `connect-src 'none'` is
+the shape the protocol assumes. It matters where the host's session rides a
+cookie: in Firefox and WebKit a guest with no CSP can send a credentialed
+request to the host that carries a cookie without SameSite. It cannot
+read the answer, but the request is made. Set the cookie SameSite=Lax or
+Strict, or serve guests with `connect-src 'none'`
+(`scripts/guest-sandbox.mjs` checks both in all three engines).
+
+## In the guest
+
+```ts
+import { connectGuest } from "@graview/guest";
+
+const guest = connectGuest();
+guest.subscribe((props) => render(props.node, props.acts));
+const answer = await guest.act("mark-cooked", { recipeId: props.node.id });
+if (!answer.ok) show(answer.message);   // the policy's own sentence
+guest.navigate(id);
+guest.autoSize();
+```
+
+In React, `useGuest()` from `@graview/guest/react` is the same connection:
+`{ props, act, navigate, size }`, re-rendering on every push. The guest
+entries import nothing of the framework, so a guest bundle carries none of it.
+
+`GuestProps` is the plain-data half of `ViewProps` — `node`, `nodes`, the
+`edges` among them, `label`, `fidelity`, `cardinality`, `mode`, `selected`,
+`implicated`, `flagged` — and `acts`, the acts the viewer may run. A record
+the viewer may not see is in none of them.

package/dist/guest.d.ts

@@ -0,0 +1,46 @@
+import { type GuestAnswer, type GuestProps } from "./protocol.js";
+/** The window a guest runs in, as far as the SDK reads it. */
+interface GuestWindow {
+    readonly parent: {
+        postMessage(message: unknown, targetOrigin: string): void;
+    } | null;
+    addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+    removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+}
+export interface ConnectGuestOptions {
+    /**
+     * The host's origin, when the guest knows it: a hello from any other
+     * origin is ignored. Without it the hello is still taken only from the
+     * parent window, which is the frame's host by construction.
+     */
+    readonly hostOrigin?: string;
+    /** The window to connect from. The global one by default. */
+    readonly window?: GuestWindow;
+}
+/**
+ * A GUEST'S ONE CHANNEL to the page that framed it. It can read what the
+ * host pushed and ask; it cannot reach the store, and an act it asks for
+ * is the viewer's to be refused.
+ */
+export interface Guest {
+    /** What the host last pushed, or undefined until the first push. */
+    readonly props: GuestProps | undefined;
+    /** Called with every push. Returns the unsubscribe. */
+    subscribe(listener: (props: GuestProps) => void): () => void;
+    /** Ask for an act by name. Resolves with the host's answer; never rejects for a refusal. */
+    act(name: string, args?: Readonly<Record<string, unknown>>): Promise<GuestAnswer>;
+    /** Ask the host to go to a record. A record the viewer may not see goes nowhere. */
+    navigate(to: string): void;
+    /** Ask for a height, in CSS pixels. */
+    size(height: number): void;
+    /** Ask for the height of an element whenever it changes. Returns the stop. */
+    autoSize(element?: Element): () => void;
+    close(): void;
+}
+/**
+ * Connect a guest view to its host: say it is ready, take the first hello
+ * from the parent, and talk only over the port that came with it.
+ */
+export declare function connectGuest(options?: ConnectGuestOptions): Guest;
+export {};
+//# sourceMappingURL=guest.d.ts.map

package/dist/guest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest.d.ts","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAGhB,MAAM,eAAe,CAAC;AAEvB,8DAA8D;AAC9D,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACtF,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;IACjF,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;CACrF;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;IACvC,uDAAuD;IACvD,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC7D,4FAA4F;IAC5F,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClF,oFAAoF;IACpF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,uCAAuC;IACvC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,IAAI,CAAC;IACxC,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,KAAK,CAoFrE"}

package/dist/guest.js

@@ -0,0 +1,98 @@
+import { GUEST_PROTOCOL, isHostHello, } from "./protocol.js";
+/**
+ * Connect a guest view to its host: say it is ready, take the first hello
+ * from the parent, and talk only over the port that came with it.
+ */
+export function connectGuest(options = {}) {
+    const at = options.window ?? globalThis;
+    let port;
+    let nonce = "";
+    let props;
+    let next = 0;
+    const listeners = new Set();
+    const waiting = new Map();
+    const queued = [];
+    const send = (request) => {
+        if (!port)
+            queued.push(request);
+        else
+            port.postMessage({ ...request, nonce });
+    };
+    const fromHost = (event) => {
+        const message = event.data;
+        if (!message || typeof message !== "object")
+            return;
+        if (message.type === "props") {
+            props = message.props;
+            for (const listener of listeners)
+                listener(message.props);
+        }
+        else if (message.type === "answer") {
+            waiting.get(message.id)?.(message);
+            waiting.delete(message.id);
+        }
+    };
+    const hello = (event) => {
+        if (port)
+            return;
+        if (event.source !== at.parent)
+            return;
+        if (options.hostOrigin !== undefined && event.origin !== options.hostOrigin)
+            return;
+        if (!isHostHello(event.data) || event.data.protocol !== GUEST_PROTOCOL)
+            return;
+        const given = event.ports[0];
+        if (!given)
+            return;
+        port = given;
+        nonce = event.data.nonce;
+        port.onmessage = fromHost;
+        port.start?.();
+        at.removeEventListener("message", hello);
+        for (const request of queued.splice(0))
+            send(request);
+    };
+    at.addEventListener("message", hello);
+    at.parent?.postMessage({ graview: "guest-ready", protocol: GUEST_PROTOCOL }, "*");
+    let observer;
+    return {
+        get props() {
+            return props;
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        act(name, args = {}) {
+            const id = (next += 1);
+            return new Promise((resolve) => {
+                waiting.set(id, resolve);
+                send({ type: "act", id, name, args });
+            });
+        },
+        navigate(to) {
+            send({ type: "navigate", to });
+        },
+        size(height) {
+            send({ type: "size", height });
+        },
+        autoSize(element) {
+            const target = element ?? globalThis.document?.documentElement;
+            const Observer = globalThis.ResizeObserver;
+            if (!target || !Observer)
+                return () => { };
+            observer?.disconnect();
+            const watching = new Observer(() => this.size(Math.ceil(target.getBoundingClientRect().height)));
+            watching.observe(target);
+            observer = watching;
+            return () => watching.disconnect();
+        },
+        close() {
+            observer?.disconnect();
+            at.removeEventListener("message", hello);
+            port?.close();
+            listeners.clear();
+        },
+    };
+}
+//# sourceMappingURL=guest.js.map

package/dist/guest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest.js","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,GAKZ,MAAM,eAAe,CAAC;AAyCvB;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAK,UAAqC,CAAC;IACpE,IAAI,IAA6B,CAAC;IAClC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,KAA6B,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkD,CAAC;IAE1E,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;YAC3B,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAmB,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACpD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACtB,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAE,EAAE;QACpC,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,KAAK,CAAC,MAAM,KAAM,EAAE,CAAC,MAAkB;YAAE,OAAO;QACpD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU;YAAE,OAAO;QACpF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,cAAc;YAAE,OAAO;QAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,GAAG,KAAK,CAAC;QACb,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACf,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAElF,IAAI,QAA4C,CAAC;IACjD,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE;YACjB,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACvB,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;gBAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACzB,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAE;YACT,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,OAAO;YACd,MAAM,MAAM,GAAG,OAAO,IAAK,UAAsC,CAAC,QAAQ,EAAE,eAAe,CAAC;YAC5F,MAAM,QAAQ,GAAI,UAAyD,CAAC,cAAc,CAAC;YAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1C,QAAQ,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzB,QAAQ,GAAG,QAAQ,CAAC;YACpB,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACrC,CAAC;QACD,KAAK;YACH,QAAQ,EAAE,UAAU,EAAE,CAAC;YACvB,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,EAAE,KAAK,EAAE,CAAC;YACd,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/host/frame.d.ts

@@ -0,0 +1,41 @@
+import type { AnySchema, Principal, Store } from "@graview/core";
+import { type GuestLimits, type GuestStats, type GuestViewInput } from "./session.js";
+export interface MountGuestViewOptions<S extends AnySchema> {
+    /** Where the guest's code is served. Where that is, and its CSP, are the host's business. */
+    readonly url: string;
+    /** The view's registered name: what the rail says an act came through (`via: "view:<name>"`). */
+    readonly view: string;
+    readonly store: Store<S>;
+    /** The viewer: what is pushed is what they may see, and what is asked for is applied as them. */
+    readonly principal: Principal;
+    /** What is drawn where the guest is. */
+    readonly input?: () => GuestViewInput;
+    readonly onNavigate?: (id: string) => void;
+    /** The guest asked for a height. By default the frame takes it. */
+    readonly onSize?: (height: number) => void;
+    readonly limits?: GuestLimits;
+    /** The frame's accessible name. The view's name by default. */
+    readonly title?: string;
+}
+export interface GuestFrame {
+    readonly iframe: HTMLIFrameElement;
+    /** Push again: the view's input moved. */
+    update(): void;
+    /** What this frame has been refused or had dropped, across every document it has loaded. */
+    readonly stats: Readonly<GuestStats>;
+    dispose(): void;
+}
+/**
+ * MOUNT A GUEST VIEW: an iframe sandboxed to scripts alone, so its origin
+ * is opaque and nothing of the host's is reachable from it, and one
+ * MessageChannel handed over when it says it is ready.
+ *
+ * A `guest-ready` is answered only when it comes from this frame's own
+ * window and from the opaque origin — a frame that somehow had an origin of
+ * its own is not a guest. Each one gets a fresh nonce and port, and the one
+ * before is closed, so a document the frame navigated away from keeps
+ * nothing. Requests ride the port with the nonce, and the host applies an
+ * act as the viewer, never as the guest.
+ */
+export declare function mountGuestView<S extends AnySchema>(element: HTMLElement, options: MountGuestViewOptions<S>): GuestFrame;
+//# sourceMappingURL=frame.d.ts.map

package/dist/host/frame.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../src/host/frame.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAuD,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3I,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,SAAS;IACxD,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,cAAc,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,0CAA0C;IAC1C,MAAM,IAAI,IAAI,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC;CACjB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAAG,UAAU,CAgGvH"}

package/dist/host/frame.js

@@ -0,0 +1,116 @@
+import { GUEST_PROTOCOL, GUEST_SANDBOX, OPAQUE_ORIGIN, isGuestReady } from "../protocol.js";
+import { createGuestHost, createGuestLimiter } from "./session.js";
+/** A nonce no other frame and no other load of this one shares. */
+function mintNonce() {
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+ * MOUNT A GUEST VIEW: an iframe sandboxed to scripts alone, so its origin
+ * is opaque and nothing of the host's is reachable from it, and one
+ * MessageChannel handed over when it says it is ready.
+ *
+ * A `guest-ready` is answered only when it comes from this frame's own
+ * window and from the opaque origin — a frame that somehow had an origin of
+ * its own is not a guest. Each one gets a fresh nonce and port, and the one
+ * before is closed, so a document the frame navigated away from keeps
+ * nothing. Requests ride the port with the nonce, and the host applies an
+ * act as the viewer, never as the guest.
+ */
+export function mountGuestView(element, options) {
+    const document = element.ownerDocument;
+    const window = document.defaultView;
+    const iframe = document.createElement("iframe");
+    iframe.setAttribute("sandbox", GUEST_SANDBOX);
+    iframe.setAttribute("referrerpolicy", "no-referrer");
+    /* No camera, microphone, geolocation, payment or fullscreen: a guest asks the host, it does not get features. */
+    iframe.setAttribute("allow", "");
+    iframe.setAttribute("title", options.title ?? options.view);
+    iframe.setAttribute("data-guest-view", options.view);
+    iframe.style.border = "0";
+    iframe.style.width = "100%";
+    iframe.style.display = "block";
+    iframe.src = options.url;
+    const stats = { applied: 0, refused: 0, dropped: 0 };
+    /* The frame's, not a session's: saying "ready" again buys a new nonce, never a new allowance. */
+    const limiter = createGuestLimiter(options.limits);
+    let session;
+    let port;
+    let counted = { applied: 0, refused: 0, dropped: 0 };
+    const tally = () => {
+        if (!session)
+            return;
+        const now = session.stats;
+        stats.applied += now.applied - counted.applied;
+        stats.refused += now.refused - counted.refused;
+        stats.dropped += now.dropped - counted.dropped;
+        counted = { ...now };
+    };
+    const end = () => {
+        tally();
+        session?.dispose();
+        port?.close();
+        session = undefined;
+        port = undefined;
+        counted = { applied: 0, refused: 0, dropped: 0 };
+    };
+    const onMessage = (event) => {
+        /* Only this frame's window, and only the opaque origin: anything else is not this guest. */
+        if (event.source === null || event.source !== iframe.contentWindow)
+            return;
+        if (event.origin !== OPAQUE_ORIGIN || !limiter.message()) {
+            stats.dropped += 1;
+            return;
+        }
+        if (!isGuestReady(event.data) || event.data.protocol !== GUEST_PROTOCOL) {
+            stats.dropped += 1;
+            return;
+        }
+        end();
+        const nonce = mintNonce();
+        const channel = new MessageChannel();
+        port = channel.port1;
+        const live = createGuestHost({
+            store: options.store,
+            principal: options.principal,
+            view: options.view,
+            nonce,
+            send: (message) => channel.port1.postMessage(message),
+            ...(options.input ? { input: options.input } : {}),
+            ...(options.onNavigate ? { onNavigate: options.onNavigate } : {}),
+            onSize: options.onSize ?? ((height) => (iframe.style.height = `${height}px`)),
+            ...(options.limits ? { limits: options.limits } : {}),
+            limiter,
+        });
+        session = live;
+        channel.port1.onmessage = (message) => {
+            live.receive(message.data);
+            tally();
+        };
+        const hello = { graview: "host-hello", protocol: GUEST_PROTOCOL, nonce, view: options.view };
+        /*
+         * "*" because an opaque origin cannot be named as a target. It goes to
+         * this frame's window alone, and carries nothing but the port and the
+         * nonce: what the viewer may see comes over the port.
+         */
+        iframe.contentWindow.postMessage(hello, "*", [channel.port2]);
+        live.push();
+    };
+    window.addEventListener("message", onMessage);
+    element.appendChild(iframe);
+    return {
+        iframe,
+        update: () => session?.push(),
+        get stats() {
+            tally();
+            return stats;
+        },
+        dispose() {
+            end();
+            window.removeEventListener("message", onMessage);
+            iframe.remove();
+        },
+    };
+}
+//# sourceMappingURL=frame.js.map

package/dist/host/frame.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frame.js","sourceRoot":"","sources":["../../src/host/frame.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAA0E,MAAM,cAAc,CAAC;AA6B3I,mEAAmE;AACnE,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAsB,OAAoB,EAAE,OAAiC;IACzG,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAY,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACrD,iHAAiH;IACjH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAC/B,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAEzB,MAAM,KAAK,GAAe,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjE,iGAAiG;IACjG,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAA8B,CAAC;IACnC,IAAI,IAA6B,CAAC;IAClC,IAAI,OAAO,GAAe,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/C,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/C,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/C,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,EAAE,KAAK,EAAE,CAAC;QACd,OAAO,GAAG,SAAS,CAAC;QACpB,IAAI,GAAG,SAAS,CAAC;QACjB,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;QACxC,4FAA4F;QAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa;YAAE,OAAO;QAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,GAAG,EAAE,CAAC;QACN,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO;SACR,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,EAAE;YACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,EAAE,CAAC;QACV,CAAC,CAAC;QACF,MAAM,KAAK,GAAc,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACxG;;;;WAIG;QACH,MAAM,CAAC,aAAc,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO;QACL,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE;QAC7B,IAAI,KAAK;YACP,KAAK,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO;YACL,GAAG,EAAE,CAAC;YACN,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/host/index.d.ts

@@ -0,0 +1,9 @@
+export { mountGuestView } from "./frame.js";
+export type { GuestFrame, MountGuestViewOptions } from "./frame.js";
+export { createGuestHost, createGuestLimiter } from "./session.js";
+export type { GuestHost, GuestHostOptions, GuestLimiter, GuestLimits, GuestStats, GuestViewInput } from "./session.js";
+export { guestView } from "./react.js";
+export type { GuestViewOptions } from "./react.js";
+export { GUEST_PROTOCOL, GUEST_SANDBOX, OPAQUE_ORIGIN } from "../protocol.js";
+export type { GuestProps } from "../protocol.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/host/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9E,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/host/index.js

@@ -0,0 +1,5 @@
+export { mountGuestView } from "./frame.js";
+export { createGuestHost, createGuestLimiter } from "./session.js";
+export { guestView } from "./react.js";
+export { GUEST_PROTOCOL, GUEST_SANDBOX, OPAQUE_ORIGIN } from "../protocol.js";
+//# sourceMappingURL=index.js.map

package/dist/host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/host/react.d.ts

@@ -0,0 +1,24 @@
+import type { AnySchema } from "@graview/core";
+import { type ViewComponent } from "@graview/react";
+import type { GuestLimits } from "./session.js";
+export interface GuestViewOptions {
+    /** Where the guest's code is served. */
+    readonly url: string;
+    /** The view's name: what the rail says an act came through. */
+    readonly name: string;
+    /** Where the frame first stands before the guest asks for a height. 160px by default. */
+    readonly height?: number;
+    readonly limits?: GuestLimits;
+}
+/**
+ * A VIEW SOMEBODY ELSE WROTE, registered like any other:
+ *
+ *   views.register("recipe", { fidelity: "full", cardinality: "one" },
+ *     guestView({ url: "https://recipes.example/card.html", name: "recipe-card" }));
+ *
+ * It draws an iframe sandboxed to scripts alone, pushes the view's props as
+ * the seat at the keyboard sees them, applies what the guest asks for as
+ * that seat, and goes to a record by selecting it.
+ */
+export declare function guestView(options: GuestViewOptions): ViewComponent<AnySchema>;
+//# sourceMappingURL=react.d.ts.map

package/dist/host/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../src/host/react.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAc,KAAK,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAGhF,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,cAAc,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAcD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CA+B7E"}

package/dist/host/react.js

@@ -0,0 +1,59 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useGraview } from "@graview/react";
+import { useEffect, useRef } from "react";
+import { mountGuestView } from "./frame.js";
+const inputOf = (props) => ({
+    ...(props.node ? { node: { id: props.node.id } } : {}),
+    ...(props.nodes ? { nodes: props.nodes.map((node) => ({ id: node.id })) } : {}),
+    ...(props.label !== undefined ? { label: props.label } : {}),
+    fidelity: props.fidelity,
+    cardinality: props.cardinality,
+    mode: props.mode,
+    selected: props.selected,
+    ...(props.implicated ? { implicated: props.implicated } : {}),
+    ...(props.flagged ? { flagged: props.flagged } : {}),
+});
+/**
+ * A VIEW SOMEBODY ELSE WROTE, registered like any other:
+ *
+ *   views.register("recipe", { fidelity: "full", cardinality: "one" },
+ *     guestView({ url: "https://recipes.example/card.html", name: "recipe-card" }));
+ *
+ * It draws an iframe sandboxed to scripts alone, pushes the view's props as
+ * the seat at the keyboard sees them, applies what the guest asks for as
+ * that seat, and goes to a record by selecting it.
+ */
+export function guestView(options) {
+    function GuestView(props) {
+        const { store, principal, setSelection } = useGraview();
+        const holder = useRef(null);
+        const frame = useRef(null);
+        const latest = useRef(props);
+        latest.current = props;
+        useEffect(() => {
+            const element = holder.current;
+            if (!element)
+                return;
+            const mounted = mountGuestView(element, {
+                url: options.url,
+                view: options.name,
+                store,
+                principal,
+                input: () => inputOf(latest.current),
+                onNavigate: (id) => setSelection([id]),
+                ...(options.limits ? { limits: options.limits } : {}),
+            });
+            mounted.iframe.style.height = `${options.height ?? 160}px`;
+            frame.current = mounted;
+            return () => {
+                mounted.dispose();
+                frame.current = null;
+            };
+        }, [store, principal, setSelection]);
+        useEffect(() => frame.current?.update(), [props]);
+        return _jsx("div", { ref: holder, "data-guest": options.name });
+    }
+    GuestView.displayName = `GuestView(${options.name})`;
+    return GuestView;
+}
+//# sourceMappingURL=react.js.map

package/dist/host/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../../src/host/react.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAsC,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAa7D,MAAM,OAAO,GAAG,CAAC,KAA2B,EAAkB,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,SAAS,SAAS,CAAC,KAA2B;QAC5C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,UAAU,EAAa,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAoB,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,SAAS,CAAC,GAAG,EAAE;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE;gBACtC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK;gBACL,SAAS;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBACpC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC;YAC3D,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC;QACJ,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACrC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,OAAO,cAAK,GAAG,EAAE,MAAM,gBAAc,OAAO,CAAC,IAAI,GAAI,CAAC;IACxD,CAAC;IACD,SAAS,CAAC,WAAW,GAAG,aAAa,OAAO,CAAC,IAAI,GAAG,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/host/session.d.ts

@@ -0,0 +1,93 @@
+import { type AnySchema, type Principal, type Store } from "@graview/core";
+import type { GuestProps, HostMessage } from "../protocol.js";
+/**
+ * What the host knows of the place a guest view is drawn: `ViewProps` as
+ * the framework hands any view, by id. The host reads every record again
+ * from the store as the viewer sees it, so an id here the viewer may not
+ * see goes no further.
+ */
+export interface GuestViewInput {
+    readonly node?: {
+        readonly id: string;
+    };
+    readonly nodes?: readonly {
+        readonly id: string;
+    }[];
+    readonly label?: string;
+    readonly fidelity?: GuestProps["fidelity"];
+    readonly cardinality?: GuestProps["cardinality"];
+    readonly mode?: GuestProps["mode"];
+    readonly selected?: boolean;
+    readonly implicated?: readonly string[];
+    readonly flagged?: readonly string[];
+}
+/** How much a frame may ask, per frame. Past either, the host stops listening until the window moves. */
+export interface GuestLimits {
+    /** Acts a frame may ask for in `actWindowMs`. 30 by default. */
+    readonly acts?: number;
+    /** 60 000 (a minute) by default. */
+    readonly actWindowMs?: number;
+    /** Messages of any kind a frame may send in `messageWindowMs`; the rest are dropped unread. 120 by default. */
+    readonly messages?: number;
+    /** 1 000 by default. */
+    readonly messageWindowMs?: number;
+    /** The tallest a guest may ask to be, in CSS pixels. 4 000 by default. */
+    readonly maxHeight?: number;
+}
+export interface GuestHostOptions<S extends AnySchema> {
+    /** The store, or the store as the viewer sees it: the host reads it through `seenBy(principal)` either way. */
+    readonly store: Store<S>;
+    /** The viewer. Every act the guest asks for is applied as them, and only what they may see is pushed. */
+    readonly principal: Principal;
+    /** The view's registered name. Acts it asks for are recorded `via: "view:<name>"`. */
+    readonly view: string;
+    /** This frame's nonce. A request without it is dropped. */
+    readonly nonce: string;
+    /** Where messages to the guest go: the host's end of the frame's port. */
+    send(message: HostMessage): void;
+    /** What is drawn where the guest is, read on every push. */
+    readonly input?: () => GuestViewInput;
+    /** The guest asked to go to a record the viewer may see. */
+    readonly onNavigate?: (id: string) => void;
+    /** The guest asked for a height. */
+    readonly onSize?: (height: number) => void;
+    readonly limits?: GuestLimits;
+    /**
+     * The frame's limiter, when the frame outlives this session: a guest
+     * that says it is ready again gets a new nonce, not a new allowance.
+     */
+    readonly limiter?: GuestLimiter;
+    /** The clock, for tests. */
+    readonly now?: () => number;
+}
+/** How much one frame may still ask: each call spends one, and says whether there was one to spend. */
+export interface GuestLimiter {
+    act(): boolean;
+    message(): boolean;
+}
+/** What a frame has been refused, for a host that wants to show or log it. */
+export interface GuestStats {
+    /** Acts applied. */
+    applied: number;
+    /** Acts asked for and not applied, for any reason. */
+    refused: number;
+    /** Messages dropped unread: a wrong nonce, a shape the protocol does not know, or past the message limit. */
+    dropped: number;
+}
+export interface GuestHost {
+    /** Hand the host one message from the frame's port. */
+    receive(data: unknown): void;
+    /** Push what the viewer sees now. Called on every change to the store, and by a host when the view's input moves. */
+    push(): void;
+    readonly stats: Readonly<GuestStats>;
+    dispose(): void;
+}
+/** One frame's allowance, per `GuestLimits`. */
+export declare function createGuestLimiter(limits?: GuestLimits, now?: () => number): GuestLimiter;
+/**
+ * THE HOST'S HALF OF ONE FRAME, without the DOM: what to push, and what to
+ * make of what comes back. `mountGuestView` wires it to an iframe; a test
+ * can drive it with plain objects.
+ */
+export declare function createGuestHost<S extends AnySchema>(options: GuestHostOptions<S>): GuestHost;
+//# sourceMappingURL=session.d.ts.map

package/dist/host/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/host/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,KAAK,EAA+C,UAAU,EAAgB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEzH;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,yGAAyG;AACzG,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,+GAA+G;IAC/G,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wBAAwB;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,SAAS;IACnD,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,cAAc,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,OAAO,CAAC;IACf,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,6GAA6G;IAC7G,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,qHAAqH;IACrH,IAAI,IAAI,IAAI,CAAC;IACb,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC;CACjB;AAcD,gDAAgD;AAChD,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,WAAgB,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,YAAY,CAKvG;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,CA0H5F"}

package/dist/host/session.js

@@ -0,0 +1,156 @@
+import { PermissionDeniedError } from "@graview/core";
+/** A count over a sliding window: true while under the limit. */
+function windowed(limit, span, now) {
+    const times = [];
+    return () => {
+        const at = now();
+        while (times.length > 0 && times[0] <= at - span)
+            times.shift();
+        if (times.length >= limit)
+            return false;
+        times.push(at);
+        return true;
+    };
+}
+/** One frame's allowance, per `GuestLimits`. */
+export function createGuestLimiter(limits = {}, now = Date.now) {
+    return {
+        act: windowed(limits.acts ?? 30, limits.actWindowMs ?? 60_000, now),
+        message: windowed(limits.messages ?? 120, limits.messageWindowMs ?? 1_000, now),
+    };
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * THE HOST'S HALF OF ONE FRAME, without the DOM: what to push, and what to
+ * make of what comes back. `mountGuestView` wires it to an iframe; a test
+ * can drive it with plain objects.
+ */
+export function createGuestHost(options) {
+    const limiter = options.limiter ?? createGuestLimiter(options.limits, options.now);
+    const maxHeight = options.limits?.maxHeight ?? 4_000;
+    const via = `view:${options.view}`;
+    const stats = { applied: 0, refused: 0, dropped: 0 };
+    /* Read through the viewer's sight every time: the store moves, and what they may see moves with it. */
+    const seen = () => options.store.seenBy(options.principal);
+    const plain = (node) => structuredClone(node);
+    const props = () => {
+        const store = seen();
+        const graph = store.graph;
+        const input = options.input?.() ?? {};
+        const node = input.node ? graph.getNode(input.node.id) : undefined;
+        const nodes = input.nodes?.flatMap((member) => {
+            const found = graph.getNode(member.id);
+            return found ? [found] : [];
+        });
+        const shown = new Set([...(node ? [node.id] : []), ...(nodes ?? []).map((member) => member.id)]);
+        const edges = [];
+        for (const id of shown) {
+            for (const edge of graph.outEdges(id)) {
+                if (shown.has(edge.to))
+                    edges.push({ kind: edge.kind, from: edge.from, to: edge.to });
+            }
+        }
+        const visible = (ids) => ids?.filter((id) => graph.has(id));
+        const acts = store.permittedMutations(options.principal).map((mutation) => ({
+            name: mutation.name,
+            title: mutation.title ?? mutation.name,
+            ...(mutation.description !== undefined ? { description: mutation.description } : {}),
+            ...(mutation.subject ? { subject: { kinds: mutation.subject.kinds, arg: mutation.subject.arg } } : {}),
+        }));
+        return {
+            view: options.view,
+            ...(node ? { node: plain(node) } : {}),
+            ...(nodes ? { nodes: nodes.map(plain) } : {}),
+            edges,
+            ...(input.label !== undefined ? { label: input.label } : {}),
+            ...(input.fidelity !== undefined ? { fidelity: input.fidelity } : {}),
+            ...(input.cardinality !== undefined ? { cardinality: input.cardinality } : {}),
+            ...(input.mode !== undefined ? { mode: input.mode } : {}),
+            ...(input.selected !== undefined ? { selected: input.selected } : {}),
+            ...(input.implicated ? { implicated: visible(input.implicated) } : {}),
+            ...(input.flagged ? { flagged: visible(input.flagged) } : {}),
+            acts,
+        };
+    };
+    let disposed = false;
+    const push = () => {
+        if (!disposed)
+            options.send({ type: "props", props: props() });
+    };
+    /* Every change to the store is a push, coalesced: a batch of five ops is one message, not five. */
+    let pending = false;
+    const off = options.store.subscribe(() => {
+        if (pending)
+            return;
+        pending = true;
+        queueMicrotask(() => {
+            pending = false;
+            push();
+        });
+    });
+    const answer = (id, reason, message) => {
+        stats.refused += 1;
+        options.send({ type: "answer", id, ok: false, reason, message });
+    };
+    const act = (id, name, args) => {
+        if (typeof name !== "string" || !isRecord(args))
+            return answer(id, "malformed", "An act is asked for by name, with its arguments as an object.");
+        if (!limiter.act())
+            return answer(id, "rate-limited", "Too many acts asked for at once; this one was not applied.");
+        if (!options.store.allMutations().some((mutation) => mutation.name === name))
+            return answer(id, "unknown-act", "There is no act by that name here.");
+        try {
+            /*
+             * THE VIEWER'S CLICK, NOT THE GUEST'S: the store judges the viewer's
+             * principal, refuses a record they may not see before any grant is
+             * read, and the op says it came through this view.
+             */
+            const result = options.store.apply({ name, args }, { author: options.principal, via });
+            stats.applied += 1;
+            options.send({ type: "answer", id, ok: true, intent: result.intent });
+        }
+        catch (error) {
+            if (error instanceof PermissionDeniedError)
+                return answer(id, "refused", error.refusal.message);
+            /* An act's own error can name what it read; the guest is told only that it did not happen. */
+            return answer(id, "failed", "The act could not be applied.");
+        }
+    };
+    return {
+        receive(data) {
+            if (disposed)
+                return;
+            if (!limiter.message()) {
+                stats.dropped += 1;
+                return;
+            }
+            if (!isRecord(data) || data.nonce !== options.nonce) {
+                stats.dropped += 1;
+                return;
+            }
+            if (data.type === "act" && (typeof data.id === "string" || typeof data.id === "number"))
+                return act(data.id, data.name, data.args);
+            if (data.type === "navigate" && typeof data.to === "string") {
+                if (seen().graph.has(data.to))
+                    options.onNavigate?.(data.to);
+                else
+                    stats.dropped += 1;
+                return;
+            }
+            if (data.type === "size" && typeof data.height === "number" && Number.isFinite(data.height)) {
+                options.onSize?.(Math.max(0, Math.min(maxHeight, Math.round(data.height))));
+                return;
+            }
+            stats.dropped += 1;
+        },
+        push,
+        get stats() {
+            return stats;
+        },
+        dispose() {
+            disposed = true;
+            off();
+        },
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/host/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/host/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAA8C,MAAM,eAAe,CAAC;AAuFlG,iEAAiE;AACjE,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,GAAiB;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,GAAG,EAAE;QACV,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,GAAG,IAAI;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,kBAAkB,CAAC,SAAsB,EAAE,EAAE,MAAoB,IAAI,CAAC,GAAG;IACvF,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,GAAG,CAAC;QACnE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,MAAM,CAAC,eAAe,IAAI,KAAK,EAAE,GAAG,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAsB,OAA4B;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,QAAQ,OAAO,CAAC,IAAI,EAAW,CAAC;IAC5C,MAAM,KAAK,GAAe,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACjE,uGAAuG;IACvG,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,CAAC,IAAa,EAAa,EAAE,CAAC,eAAe,CAAC,IAAI,CAAc,CAAC;IAE/E,MAAM,KAAK,GAAG,GAAe,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAkC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAe,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI;YACtC,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAgC,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClI,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI;SACL,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,mGAAmG;IACnG,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACvC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,cAAc,CAAC,GAAG,EAAE;YAClB,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,EAAmB,EAAE,MAAoB,EAAE,OAAe,EAAE,EAAE;QAC5E,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAwB,CAAC,CAAC;IACzF,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,EAAmB,EAAE,IAAa,EAAE,IAAa,EAAE,EAAE;QAChE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,CAAC,CAAC;QACjJ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,4DAA4D,CAAC,CAAC;QACpH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,oCAAoC,CAAC,CAAC;QACrJ,IAAI,CAAC;YACH;;;;eAIG;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBAAE,OAAO,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChG,8FAA8F;YAC9F,OAAO,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,+BAA+B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,CAAC,IAAI;YACV,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACvB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC5D,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;oBACxD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5F,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,IAAI;QACJ,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO;YACL,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,EAAE,CAAC;QACR,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { connectGuest } from "./guest.js";
+export type { ConnectGuestOptions, Guest } from "./guest.js";
+export { GUEST_PROTOCOL, GUEST_SANDBOX, OPAQUE_ORIGIN, isGuestReady, isHostHello } from "./protocol.js";
+export type { GuestAct, GuestAnswer, GuestEdge, GuestNode, GuestProps, GuestReady, GuestRefusal, GuestRequest, HostHello, HostMessage, } from "./protocol.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACxG,YAAY,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,SAAS,EACT,UAAU,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,WAAW,GACZ,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { connectGuest } from "./guest.js";
+export { GUEST_PROTOCOL, GUEST_SANDBOX, OPAQUE_ORIGIN, isGuestReady, isHostHello } from "./protocol.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,138 @@
+/**
+ * THE GUEST-VIEW PROTOCOL (FR-04): what a host and a view written by
+ * somebody the viewer does not trust may say to each other.
+ *
+ * The guest runs in `<iframe sandbox="allow-scripts">` and never with
+ * `allow-same-origin`, so its origin is opaque ("null"): no cookie, no
+ * storage, no store, no token of the host's is reachable from it. It has
+ * one way out, a MessageChannel the host hands it once it says it is ready:
+ *
+ *   guest → parent   { graview: "guest-ready", protocol }            (window.postMessage, once per document)
+ *   host  → guest    { graview: "host-hello", protocol, nonce, view } (window.postMessage, with the port)
+ *   host  → guest    { type: "props", props }                        (over the port, whenever what it sees moves)
+ *   guest → host     { type: "act", nonce, id, name, args }          (over the port: ask for an act)
+ *   guest → host     { type: "navigate", nonce, to }                 (over the port: go to a record)
+ *   guest → host     { type: "size", nonce, height }                 (over the port: the height it wants)
+ *   host  → guest    { type: "answer", id, ok, … }                   (over the port: what became of an act)
+ *
+ * The host answers a `guest-ready` only from its own frame's window and
+ * only from the opaque origin, and every request over the port carries the
+ * nonce of that hello. What the guest is pushed is the store as the viewer
+ * sees it; an act it asks for is applied under the viewer's principal, so
+ * the policy refuses on its behalf exactly as it would refuse a click.
+ *
+ * This module has no imports: a guest bundle carries it and nothing of the
+ * framework.
+ */
+/** Moves only when a guest of the previous protocol can no longer be served. */
+export declare const GUEST_PROTOCOL = 1;
+/** The only sandbox token a guest frame is given. Never `allow-same-origin`. */
+export declare const GUEST_SANDBOX = "allow-scripts";
+/** The origin a sandboxed frame without `allow-same-origin` posts from. */
+export declare const OPAQUE_ORIGIN = "null";
+/** A record as a guest receives it: plain data, only ever one the viewer may see. */
+export interface GuestNode {
+    readonly id: string;
+    readonly kind: string;
+    readonly label?: string;
+    readonly [field: string]: unknown;
+}
+/** A link between two records the viewer may both see. */
+export interface GuestEdge {
+    readonly kind: string;
+    readonly from: string;
+    readonly to: string;
+}
+/** An act the viewer may run, by name, as the guest may ask for it. */
+export interface GuestAct {
+    readonly name: string;
+    readonly title: string;
+    readonly description?: string;
+    /** The kinds the act is done to, when it is done to a record. */
+    readonly subject?: {
+        readonly kinds: readonly string[] | "*";
+        readonly arg: string;
+    };
+}
+/**
+ * WHAT A GUEST VIEW IS HANDED: the plain-data half of `ViewProps`, read
+ * from the store as the viewer sees it. A record the viewer may not see is
+ * not in it — not as a node, a member, an edge or an id in `implicated`.
+ */
+export interface GuestProps {
+    /** The view's registered name: what the rail says an act came through. */
+    readonly view: string;
+    /** The record, for a `one` view. Absent when the viewer may not see it. */
+    readonly node?: GuestNode;
+    /** The members, for a `many` view. */
+    readonly nodes?: readonly GuestNode[];
+    /** The links among the records above. */
+    readonly edges: readonly GuestEdge[];
+    readonly label?: string;
+    readonly fidelity?: "full" | "summary" | "glyph";
+    readonly cardinality?: "one" | "many";
+    readonly mode?: "scene" | "fullscreen";
+    readonly selected?: boolean;
+    readonly implicated?: readonly string[];
+    readonly flagged?: readonly string[];
+    /** The acts the viewer may run here: what the guest may ask for. */
+    readonly acts: readonly GuestAct[];
+}
+/** Why the host did not apply an act the guest asked for. */
+export type GuestRefusal = 
+/** The policy refused it, in the policy's sentence: the same answer a click would get. */
+"refused"
+/** More acts than the frame is allowed in the window. */
+ | "rate-limited"
+/** No act by that name. */
+ | "unknown-act"
+/** The request was not one the protocol knows. */
+ | "malformed"
+/** The act ran and threw: its arguments did not fit, or its own rule said no. */
+ | "failed";
+export type GuestAnswer = {
+    readonly type: "answer";
+    readonly id: string | number;
+    readonly ok: true;
+    readonly intent: string;
+} | {
+    readonly type: "answer";
+    readonly id: string | number;
+    readonly ok: false;
+    readonly reason: GuestRefusal;
+    readonly message: string;
+};
+export interface GuestReady {
+    readonly graview: "guest-ready";
+    readonly protocol: number;
+}
+export interface HostHello {
+    readonly graview: "host-hello";
+    readonly protocol: number;
+    readonly nonce: string;
+    readonly view: string;
+}
+export type HostMessage = {
+    readonly type: "props";
+    readonly props: GuestProps;
+} | GuestAnswer;
+export type GuestRequest = {
+    readonly type: "act";
+    readonly nonce: string;
+    readonly id: string | number;
+    readonly name: string;
+    readonly args: Readonly<Record<string, unknown>>;
+} | {
+    readonly type: "navigate";
+    readonly nonce: string;
+    readonly to: string;
+} | {
+    readonly type: "size";
+    readonly nonce: string;
+    readonly height: number;
+};
+/** Whether a window message is a guest saying it is ready. */
+export declare function isGuestReady(data: unknown): data is GuestReady;
+/** Whether a window message is the host's hello. */
+export declare function isHostHello(data: unknown): data is HostHello;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,gFAAgF;AAChF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,gFAAgF;AAChF,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,qFAAqF;AACrF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACtF;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CACpC;AAED,6DAA6D;AAC7D,MAAM,MAAM,YAAY;AACtB,0FAA0F;AACxF,SAAS;AACX,yDAAyD;GACvD,cAAc;AAChB,2BAA2B;GACzB,aAAa;AACf,kDAAkD;GAChD,WAAW;AACb,iFAAiF;GAC/E,QAAQ,CAAC;AAEb,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrG;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3I,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,WAAW,CAAC;AAE/F,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,GACvJ;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,CAE9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,SAAS,CAG5D"}

package/dist/protocol.js

@@ -0,0 +1,42 @@
+/**
+ * THE GUEST-VIEW PROTOCOL (FR-04): what a host and a view written by
+ * somebody the viewer does not trust may say to each other.
+ *
+ * The guest runs in `<iframe sandbox="allow-scripts">` and never with
+ * `allow-same-origin`, so its origin is opaque ("null"): no cookie, no
+ * storage, no store, no token of the host's is reachable from it. It has
+ * one way out, a MessageChannel the host hands it once it says it is ready:
+ *
+ *   guest → parent   { graview: "guest-ready", protocol }            (window.postMessage, once per document)
+ *   host  → guest    { graview: "host-hello", protocol, nonce, view } (window.postMessage, with the port)
+ *   host  → guest    { type: "props", props }                        (over the port, whenever what it sees moves)
+ *   guest → host     { type: "act", nonce, id, name, args }          (over the port: ask for an act)
+ *   guest → host     { type: "navigate", nonce, to }                 (over the port: go to a record)
+ *   guest → host     { type: "size", nonce, height }                 (over the port: the height it wants)
+ *   host  → guest    { type: "answer", id, ok, … }                   (over the port: what became of an act)
+ *
+ * The host answers a `guest-ready` only from its own frame's window and
+ * only from the opaque origin, and every request over the port carries the
+ * nonce of that hello. What the guest is pushed is the store as the viewer
+ * sees it; an act it asks for is applied under the viewer's principal, so
+ * the policy refuses on its behalf exactly as it would refuse a click.
+ *
+ * This module has no imports: a guest bundle carries it and nothing of the
+ * framework.
+ */
+/** Moves only when a guest of the previous protocol can no longer be served. */
+export const GUEST_PROTOCOL = 1;
+/** The only sandbox token a guest frame is given. Never `allow-same-origin`. */
+export const GUEST_SANDBOX = "allow-scripts";
+/** The origin a sandboxed frame without `allow-same-origin` posts from. */
+export const OPAQUE_ORIGIN = "null";
+/** Whether a window message is a guest saying it is ready. */
+export function isGuestReady(data) {
+    return typeof data === "object" && data !== null && data.graview === "guest-ready";
+}
+/** Whether a window message is the host's hello. */
+export function isHostHello(data) {
+    const hello = data;
+    return typeof data === "object" && data !== null && hello.graview === "host-hello" && typeof hello.nonce === "string";
+}
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAuFpC,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAAmB,CAAC,OAAO,KAAK,aAAa,CAAC;AACrG,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,KAAK,GAAG,IAAiB,CAAC;IAChC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;AACxH,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,17 @@
+import { type ConnectGuestOptions, type Guest } from "./guest.js";
+import type { GuestProps } from "./protocol.js";
+/** The one connection this frame has, made on first use. */
+export declare function guest(options?: ConnectGuestOptions): Guest;
+/**
+ * WHAT THE HOST PUSHED, in a React guest: undefined until the first push,
+ * then every push re-renders. `act`, `navigate` and `size` are the
+ * connection's own.
+ */
+export declare function useGuest(options?: ConnectGuestOptions): {
+    readonly props: GuestProps | undefined;
+    readonly act: Guest["act"];
+    readonly navigate: Guest["navigate"];
+    readonly size: Guest["size"];
+};
+export type { Guest, GuestProps };
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,mBAAmB,EAAE,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG;IACvD,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC9B,CAQA;AAED,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC"}

package/dist/react.js

@@ -0,0 +1,18 @@
+import { useSyncExternalStore } from "react";
+import { connectGuest } from "./guest.js";
+let shared;
+/** The one connection this frame has, made on first use. */
+export function guest(options) {
+    return (shared ??= connectGuest(options));
+}
+/**
+ * WHAT THE HOST PUSHED, in a React guest: undefined until the first push,
+ * then every push re-renders. `act`, `navigate` and `size` are the
+ * connection's own.
+ */
+export function useGuest(options) {
+    const connection = guest(options);
+    const props = useSyncExternalStore((changed) => connection.subscribe(changed), () => connection.props, () => undefined);
+    return { props, act: connection.act, navigate: connection.navigate, size: connection.size };
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAwC,MAAM,YAAY,CAAC;AAGhF,IAAI,MAAyB,CAAC;AAE9B,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,OAA6B;IACjD,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAA6B;IAMpD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,oBAAoB,CAChC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,EAC1C,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EACtB,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC"}

package/package.json

@@ -1,6 +1,67 @@
 {
   "name": "@graview/guest",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.2",
+  "type": "module",
+  "description": "Guest views: somebody else's React or plain script in a sandboxed frame, shown only what the viewer may see, able only to ask for acts the viewer's seat then applies.",
+  "keywords": [
+    "graview",
+    "context-graph",
+    "typed-graph",
+    "interface",
+    "iframe",
+    "sandbox",
+    "guest-view"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "default": "./dist/react.js"
+    },
+    "./host": {
+      "types": "./dist/host/index.d.ts",
+      "default": "./dist/host/index.js"
+    }
+  },
+  "dependencies": {
+    "@graview/core": "0.1.2",
+    "@graview/react": "0.1.2"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/en-dash-consulting/graview.git",
+    "directory": "packages/guest"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Elastic-2.0",
+  "homepage": "https://graview.dev/docs/packages/guest.html",
+  "bugs": {
+    "url": "https://github.com/en-dash-consulting/graview/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  }
 }