@horizonmedia/blu-sdk 0.0.0-stage → 1.8.4

package/chunks/chunk-M7GVSOGQ.js

@@ -0,0 +1,179 @@
+// src/signin.ts
+var STORAGE_KEY = "blu.signin";
+var MAX_AGE_MS = 10 * 6e4;
+var b64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var random = (n) => b64url(crypto.getRandomValues(new Uint8Array(n)));
+async function beginBluSignIn({ hostApi, clientId, redirectUri }) {
+  const verifier = random(32);
+  const state = random(16);
+  const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+  sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ state, verifier, hostApi, clientId, redirectUri, at: Date.now() }));
+  const url = new URL("/oauth/authorize", hostApi);
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256"
+  }).toString();
+  window.location.assign(url.toString());
+}
+var completion = null;
+function completeBluSignIn() {
+  completion ??= finish();
+  return completion;
+}
+async function finish() {
+  const params = new URLSearchParams(window.location.search);
+  if (!params.has("code") && !params.has("error")) return { kind: "none" };
+  window.history.replaceState(null, "", window.location.pathname);
+  const raw = sessionStorage.getItem(STORAGE_KEY);
+  sessionStorage.removeItem(STORAGE_KEY);
+  const saved = raw ? JSON.parse(raw) : null;
+  const fail = (error, description) => ({ kind: "error", error, description });
+  if (!saved) return fail("no_pending_sign_in", "This tab didn't start a Blu sign-in. Start again.");
+  if (params.get("state") !== saved.state) return fail("state_mismatch", "The sign-in response doesn't belong to this tab's request (possible login CSRF). Start again.");
+  if (params.get("iss") !== saved.hostApi) return fail("issuer_mismatch", `Response issuer ${params.get("iss")} \u2260 ${saved.hostApi}.`);
+  if (params.has("error")) return fail(params.get("error"), params.get("error_description") ?? "Blu refused the sign-in.");
+  if (Date.now() - saved.at > MAX_AGE_MS) return fail("expired", "The sign-in took too long. Start again.");
+  const res = await fetch(`${saved.hostApi}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: params.get("code"),
+      client_id: saved.clientId,
+      redirect_uri: saved.redirectUri,
+      code_verifier: saved.verifier
+    }),
+    credentials: "omit"
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) return fail(body.error ?? "token_error", body.detail ?? `Blu token endpoint returned ${res.status}.`);
+  return { kind: "signed-in", tokens: body, hostApi: saved.hostApi };
+}
+
+// src/core.tsx
+import { createContext, useContext, useMemo } from "react";
+import { jsx } from "react/jsx-runtime";
+var CONTRACT_VERSION = "1.3.0";
+function assertHostContext(value) {
+  const v = value;
+  const problems = [];
+  if (!v || typeof v !== "object") throw new Error("[@blu/sdk] host context is missing");
+  const [major] = String(v.contractVersion ?? "").split(".");
+  if (major !== CONTRACT_VERSION.split(".")[0]) {
+    problems.push(`contract major mismatch: host=${v.contractVersion} sdk=${CONTRACT_VERSION}`);
+  }
+  if (!v.user?.id) problems.push("user.id");
+  if (!v.client?.id) problems.push("client.id");
+  if (!v.environment?.apiBaseUrl) problems.push("environment.apiBaseUrl");
+  if (typeof v.getToken !== "function") problems.push("getToken()");
+  if (!v.events || typeof v.events.emit !== "function") problems.push("events");
+  if (problems.length) {
+    throw new Error(`[@blu/sdk] invalid host context: ${problems.join(", ")}`);
+  }
+}
+var HostContext = createContext(null);
+function BluHostProvider({ value, children }) {
+  assertHostContext(value);
+  return /* @__PURE__ */ jsx(HostContext.Provider, { value, children });
+}
+function useHost() {
+  const ctx = useContext(HostContext);
+  if (!ctx) {
+    throw new Error(
+      "[@blu/sdk] useHost() called outside <BluHostProvider>. If this is a remote, check that @blu/sdk is shared as a singleton (two copies = two contexts)."
+    );
+  }
+  return ctx;
+}
+function useOptionalHost() {
+  return useContext(HostContext);
+}
+var useUser = () => useHost().user;
+var useClient = () => useHost().client;
+var useRoles = () => useHost().roles;
+var useEnvironment = () => useHost().environment;
+var useTheme = () => useHost().theme;
+var useEventBus = () => useHost().events;
+var useShell = () => useHost().shell;
+var useAuthToken = () => useHost().getToken;
+var useRoute = () => useHost().route ?? NO_ROUTE;
+var NO_ROUTE = { path: "/", search: "", navigate: () => {
+} };
+var ApiError = class extends Error {
+  constructor(status, body, url) {
+    super(`${status} from ${url}`);
+    this.status = status;
+    this.body = body;
+    this.url = url;
+  }
+  status;
+  body;
+  url;
+};
+function createApiClient(env, getToken) {
+  const base = new URL(env.apiBaseUrl);
+  async function request(method, path, body, init = {}) {
+    const target = new URL(path, base);
+    if (target.origin !== base.origin) {
+      throw new Error(`[@blu/sdk] refused to send this module's token to ${target.origin}: the API client only calls the module's own API (${base.origin}).`);
+    }
+    const url = target.toString();
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${await getToken()}`);
+    if (body !== void 0) headers.set("Content-Type", "application/json");
+    const res = await fetch(url, {
+      ...init,
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      credentials: "omit",
+      redirect: "error"
+      // a token-bearing call has no business being sent on elsewhere
+    });
+    const text = await res.text();
+    const parsed = text ? safeJson(text) : null;
+    if (!res.ok) throw new ApiError(res.status, parsed, url);
+    return parsed;
+  }
+  return {
+    baseUrl: env.apiBaseUrl,
+    get: (path, init) => request("GET", path, void 0, init),
+    post: (path, body, init) => request("POST", path, body, init)
+  };
+}
+function useApiClient() {
+  const { environment, getToken } = useHost();
+  return useMemo(() => createApiClient(environment, getToken), [environment, getToken]);
+}
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+export {
+  beginBluSignIn,
+  completeBluSignIn,
+  CONTRACT_VERSION,
+  assertHostContext,
+  BluHostProvider,
+  useHost,
+  useOptionalHost,
+  useUser,
+  useClient,
+  useRoles,
+  useEnvironment,
+  useTheme,
+  useEventBus,
+  useShell,
+  useAuthToken,
+  useRoute,
+  ApiError,
+  useApiClient
+};

package/dev.js

@@ -0,0 +1,374 @@
+import {
+  BluHostProvider,
+  CONTRACT_VERSION,
+  beginBluSignIn,
+  completeBluSignIn
+} from "./chunks/chunk-M7GVSOGQ.js";
+
+// src/dev/index.tsx
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { createRoot } from "react-dom/client";
+
+// src/dev/auth.ts
+async function postJson(url, body, token) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...token ? { Authorization: `Bearer ${token}` } : {} },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(json.detail ?? json.error ?? `HTTP ${res.status}`);
+  return json;
+}
+function teamProvider(label, baseUrl) {
+  return {
+    id: "team",
+    label,
+    issuer: baseUrl,
+    flow: "personas",
+    async personas() {
+      const res = await fetch(`${baseUrl}/personas`);
+      if (!res.ok) throw new Error(`team IdP unreachable (${res.status})`);
+      const { personas } = await res.json();
+      return personas.map((p) => ({ id: p.username, label: p.label }));
+    },
+    login: (username) => postJson(`${baseUrl}/login`, { username }),
+    // The simulated team IdP has no refresh grant: the user signs in again.
+    refresh: async () => null,
+    switchClient: (current, clientId) => postJson(`${baseUrl}/switch-client`, { clientId }, current.accessToken),
+    async clientNames() {
+      const res = await fetch(`${baseUrl}/clients`);
+      return res.ok ? res.json() : {};
+    },
+    describe: (c) => ({
+      name: String(c.name ?? c.sub),
+      email: String(c.email ?? ""),
+      clientId: String(c.cid),
+      clients: c.clients ?? [],
+      roles: c.role ? [String(c.role)] : []
+    })
+  };
+}
+function fromBluTokens(t) {
+  return { accessToken: t.access_token, expiresAt: Date.now() + t.expires_in * 1e3, refreshToken: t.refresh_token, clients: t.blu_clients };
+}
+function bluProvider(label, hostApi, moduleId) {
+  const token = async (params) => {
+    const res = await fetch(`${hostApi}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ client_id: moduleId, ...params }),
+      credentials: "omit"
+    });
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(json.detail ?? json.error ?? `HTTP ${res.status}`);
+    return fromBluTokens(json);
+  };
+  return {
+    id: "blu",
+    label,
+    issuer: hostApi,
+    flow: "redirect",
+    personas: async () => [],
+    login: async () => {
+      throw new Error("Sign in with Blu happens on Blu's sign-in page");
+    },
+    beginRedirect: () => beginBluSignIn({ hostApi, clientId: moduleId, redirectUri: `${window.location.origin}/` }),
+    refresh: async (current) => current.refreshToken ? token({ grant_type: "refresh_token", refresh_token: current.refreshToken }) : null,
+    switchClient: (current, clientId) => token({ grant_type: "refresh_token", refresh_token: current.refreshToken ?? "", blu_client_id: clientId }),
+    clientNames: async (current) => Object.fromEntries((current.clients ?? []).map((c) => [c.id, c.name])),
+    describe: (c) => ({
+      name: String(c.name ?? c.sub),
+      email: String(c.email ?? ""),
+      clientId: String(c.cid),
+      clients: c.tenant_scope ?? [],
+      roles: c.roles ?? []
+    })
+  };
+}
+function decodeClaims(token) {
+  try {
+    return JSON.parse(atob(token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")));
+  } catch {
+    return {};
+  }
+}
+
+// src/dev/index.tsx
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var DEFAULT_THEME = {
+  primary: "#3b5bdb",
+  surface: "#ffffff",
+  surfaceAlt: "#f4f6fb",
+  text: "#1b1f2a",
+  textMuted: "#5c6478",
+  border: "#dde2ee",
+  danger: "#c92a2a",
+  success: "#2b8a3e",
+  radius: "10px",
+  font: "ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif"
+};
+async function mountStandalone({ Page, rootId = "root" }) {
+  const [config, deployment] = await Promise.all(
+    ["./standalone.config.json", "./deployment.json"].map(async (u) => (await fetch(u, { cache: "no-store" })).json())
+  );
+  document.title = `${config.title} \u2014 standalone (${deployment.stage})`;
+  createRoot(document.getElementById(rootId)).render(/* @__PURE__ */ jsx(Standalone, { config, deployment, Page }));
+}
+function Standalone({ config, deployment, Page }) {
+  const providers = useMemo(() => {
+    const list = [];
+    if (config.auth.team) list.push(teamProvider(config.auth.team.label, deployment.teamAuthUrl));
+    if (config.auth.blu) list.push(bluProvider(config.auth.blu.label, deployment.bluHostApi, config.moduleId));
+    return list;
+  }, [config, deployment]);
+  const [session, setSession] = useState(null);
+  const [notice, setNotice] = useState(null);
+  const [returning, setReturning] = useState(() => new URLSearchParams(window.location.search).has("code"));
+  useEffect(() => {
+    const blu = providers.find((p) => p.id === "blu");
+    if (!blu) return;
+    completeBluSignIn().then((r) => {
+      setReturning(false);
+      if (r.kind === "signed-in") setSession({ provider: blu, tokens: fromBluTokens(r.tokens) });
+      else if (r.kind === "error") setNotice(`Sign in with Blu didn't complete: ${r.description}`);
+    });
+  }, [providers]);
+  if (returning && !session) return /* @__PURE__ */ jsx("div", { style: styles.page, children: "Finishing sign-in with Blu\u2026" });
+  if (!session) {
+    return /* @__PURE__ */ jsx(
+      Login,
+      {
+        config,
+        deployment,
+        providers,
+        notice,
+        onSession: (s) => {
+          setNotice(null);
+          setSession(s);
+        }
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx(
+    Signed,
+    {
+      config,
+      deployment,
+      session,
+      setSession,
+      onSignOut: (why) => {
+        setNotice(why ?? null);
+        setSession(null);
+      },
+      Page
+    }
+  );
+}
+function Login({
+  config,
+  deployment,
+  providers,
+  notice,
+  onSession
+}) {
+  const [personas, setPersonas] = useState({});
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    providers.filter((p) => p.flow === "personas").forEach(
+      (p) => p.personas().then((list) => setPersonas((s) => ({ ...s, [p.id]: list }))).catch((e) => setPersonas((s) => ({ ...s, [p.id]: String(e.message ?? e) })))
+    );
+  }, [providers]);
+  return /* @__PURE__ */ jsx("div", { style: styles.page, children: /* @__PURE__ */ jsxs("div", { style: styles.card, children: [
+    /* @__PURE__ */ jsxs("div", { style: styles.kicker, children: [
+      config.moduleId,
+      " \xB7 standalone \xB7 ",
+      deployment.stage
+    ] }),
+    /* @__PURE__ */ jsx("h1", { style: { fontSize: 22, margin: "4px 0 8px" }, children: config.title }),
+    /* @__PURE__ */ jsxs("p", { style: styles.muted, children: [
+      "Running on its own origin (",
+      /* @__PURE__ */ jsx("code", { children: window.location.origin }),
+      ") without the Blu host. Sign in with",
+      " ",
+      providers.map((p) => p.label).join(" or "),
+      "; either way you get a token this module's API accepts."
+    ] }),
+    notice && /* @__PURE__ */ jsx("p", { style: styles.warn, children: notice }),
+    error && /* @__PURE__ */ jsx("p", { style: styles.warn, children: error }),
+    providers.length === 0 && /* @__PURE__ */ jsx("p", { style: styles.warn, children: "No sign-in providers are enabled in standalone.config.json." }),
+    providers.map((p) => {
+      const list = personas[p.id];
+      return /* @__PURE__ */ jsxs("section", { style: styles.section, "data-provider": p.id, children: [
+        /* @__PURE__ */ jsx("h2", { style: { fontSize: 15, margin: "0 0 4px" }, children: p.label }),
+        /* @__PURE__ */ jsxs("div", { style: { ...styles.muted, fontSize: 12, marginBottom: 8 }, children: [
+          "issuer ",
+          /* @__PURE__ */ jsx("code", { children: p.issuer })
+        ] }),
+        p.flow === "redirect" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+          /* @__PURE__ */ jsxs("p", { style: { ...styles.muted, fontSize: 13, margin: "0 0 6px" }, children: [
+            "You'll sign in on Blu's own page and come back here. This app gets a token for",
+            " ",
+            /* @__PURE__ */ jsx("strong", { children: config.title }),
+            " only \u2014 never your Blu session \u2014 with the role Blu gives you. No",
+            " ",
+            config.title,
+            " account needed."
+          ] }),
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              style: { ...styles.persona, ...styles.badgeBlu, fontWeight: 600 },
+              onClick: () => p.beginRedirect?.().catch((e) => setError(`${p.label}: ${e.message}`)),
+              children: "Continue with Blu \u2192"
+            }
+          )
+        ] }) : typeof list === "string" ? /* @__PURE__ */ jsx("p", { style: styles.warn, children: list }) : !list ? /* @__PURE__ */ jsx("p", { style: styles.muted, children: "Loading\u2026" }) : list.map((persona) => /* @__PURE__ */ jsx(
+          "button",
+          {
+            style: styles.persona,
+            onClick: async () => {
+              try {
+                onSession({ provider: p, tokens: await p.login(persona.id) });
+              } catch (e) {
+                setError(`${p.label}: ${e.message}`);
+              }
+            },
+            children: persona.label
+          },
+          persona.id
+        ))
+      ] }, p.id);
+    })
+  ] }) });
+}
+function Signed({
+  config,
+  deployment,
+  session,
+  setSession,
+  onSignOut,
+  Page
+}) {
+  const latest = useRef({ session, setSession, onSignOut });
+  latest.current = { session, setSession, onSignOut };
+  const [events, setEvents] = useState([]);
+  const [routePath, setRoutePath] = useState("/");
+  const claims = decodeClaims(session.tokens.accessToken);
+  const who = session.provider.describe(claims);
+  const [names, setNames] = useState({});
+  useEffect(() => {
+    session.provider.clientNames(session.tokens).then(setNames, () => setNames({}));
+  }, [session.provider]);
+  const clientName = (id) => names[id] ?? id;
+  const getToken = useCallback(async () => {
+    const { session: s, setSession: set, onSignOut: signOut } = latest.current;
+    if (s.tokens.expiresAt - Date.now() > 3e4) return s.tokens.accessToken;
+    const next = await s.provider.refresh(s.tokens).catch(() => null);
+    if (!next) {
+      signOut(`Your ${s.provider.label} session expired \u2014 sign in again.`);
+      throw new Error("session expired");
+    }
+    set({ ...s, tokens: next });
+    return next.accessToken;
+  }, []);
+  const bus = useMemo(() => {
+    const handlers = /* @__PURE__ */ new Map();
+    return {
+      emit(type, payload) {
+        const e = { type, source: config.moduleId, payload, at: (/* @__PURE__ */ new Date()).toISOString() };
+        setEvents((list) => [e, ...list].slice(0, 5));
+        for (const key of [type, "*"]) handlers.get(key)?.forEach((h) => h(e));
+      },
+      on(type, h) {
+        if (!handlers.has(type)) handlers.set(type, /* @__PURE__ */ new Set());
+        handlers.get(type).add(h);
+        return () => void handlers.get(type)?.delete(h);
+      }
+    };
+  }, [config.moduleId]);
+  const value = useMemo(
+    () => ({
+      contractVersion: CONTRACT_VERSION,
+      user: { id: String(claims.sub), email: who.email, displayName: who.name, provider: session.provider.id },
+      client: { id: who.clientId, name: clientName(who.clientId) },
+      roles: who.roles,
+      // Same descriptor shape the Blu shell provides; here the stage + API come from deployment.json.
+      environment: { stage: deployment.stage, apiBaseUrl: deployment.apiBaseUrl, moduleId: config.moduleId },
+      theme: DEFAULT_THEME,
+      embedded: { inIframe: false, parentOrigin: null },
+      shell: { kind: "standalone", label: `${config.title} standalone app (${deployment.stage})`, clientChosenBy: "standalone", mount: "standalone" },
+      route: { path: routePath, navigate: (p) => setRoutePath(p.startsWith("/") ? p : `/${p}`) },
+      getToken,
+      navigate: (path) => console.info(`[standalone] navigate(${path}) \u2014 no host nav outside Blu`),
+      events: bus
+    }),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [claims.sub, who.clientId, who.roles.join(), session.provider.id, config, deployment, names, getToken, bus, routePath]
+  );
+  return /* @__PURE__ */ jsxs("div", { style: { minHeight: "100%", background: DEFAULT_THEME.surfaceAlt, fontFamily: DEFAULT_THEME.font }, children: [
+    /* @__PURE__ */ jsxs("header", { style: styles.bar, children: [
+      /* @__PURE__ */ jsx("strong", { children: config.title }),
+      /* @__PURE__ */ jsxs("span", { style: styles.badge, children: [
+        "standalone \xB7 ",
+        window.location.host
+      ] }),
+      /* @__PURE__ */ jsx("span", { style: { ...styles.badge, fontWeight: 700 }, "data-stage": deployment.stage, children: deployment.stage }),
+      /* @__PURE__ */ jsxs("span", { style: { ...styles.badge, ...session.provider.id === "team" ? styles.badgeTeam : styles.badgeBlu }, "data-auth-mode": session.provider.id, children: [
+        "signed in via ",
+        session.provider.label
+      ] }),
+      /* @__PURE__ */ jsx("span", { style: { flex: 1 } }),
+      /* @__PURE__ */ jsxs("label", { "data-standalone-client": who.clientId, style: { fontSize: 12, color: DEFAULT_THEME.textMuted, display: "flex", gap: 6, alignItems: "center" }, children: [
+        "Client",
+        /* @__PURE__ */ jsx(
+          "select",
+          {
+            value: who.clientId,
+            onChange: async (e) => {
+              try {
+                setSession({ ...session, tokens: await session.provider.switchClient(session.tokens, e.target.value) });
+              } catch (err) {
+                alert(err.message);
+              }
+            },
+            children: who.clients.map((c) => /* @__PURE__ */ jsx("option", { value: c, children: clientName(c) }, c))
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxs("span", { style: { fontSize: 13 }, children: [
+        who.name,
+        " ",
+        /* @__PURE__ */ jsxs("span", { style: styles.muted, children: [
+          "(",
+          who.roles.join(", "),
+          ")"
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx("button", { style: styles.button, onClick: () => onSignOut(), children: "Sign out" })
+    ] }),
+    /* @__PURE__ */ jsx(BluHostProvider, { value, children: /* @__PURE__ */ jsx(Page, {}, `${session.provider.id}:${who.clientId}`) }),
+    events.length > 0 && /* @__PURE__ */ jsxs("footer", { style: { padding: "8px 24px", fontSize: 12, color: DEFAULT_THEME.textMuted }, children: [
+      "Local event bus (no host to receive them):",
+      " ",
+      events.map((e, i) => /* @__PURE__ */ jsx("code", { style: { marginRight: 8 }, children: e.type }, i))
+    ] })
+  ] });
+}
+var styles = {
+  page: { minHeight: "100vh", display: "grid", placeItems: "center", padding: 16, background: DEFAULT_THEME.surfaceAlt, fontFamily: DEFAULT_THEME.font, color: DEFAULT_THEME.text },
+  card: { background: "#fff", border: `1px solid ${DEFAULT_THEME.border}`, borderRadius: 14, padding: 24, width: "100%", maxWidth: 560 },
+  kicker: { fontSize: 12, textTransform: "uppercase", letterSpacing: "0.06em", color: DEFAULT_THEME.textMuted },
+  muted: { color: DEFAULT_THEME.textMuted, fontSize: 14 },
+  warn: { color: "#b35c00", background: "#fff4e6", padding: "8px 12px", borderRadius: 8, fontSize: 13 },
+  section: { borderTop: `1px solid ${DEFAULT_THEME.border}`, paddingTop: 12, marginTop: 12 },
+  persona: { display: "block", width: "100%", textAlign: "left", font: "inherit", fontSize: 14, padding: "10px 12px", margin: "6px 0", border: `1px solid ${DEFAULT_THEME.border}`, borderRadius: 10, background: "#fff", cursor: "pointer" },
+  bar: { display: "flex", alignItems: "center", gap: 10, flexWrap: "wrap", padding: "10px 24px", background: "#fff", borderBottom: `1px solid ${DEFAULT_THEME.border}`, fontSize: 14 },
+  badge: { fontSize: 11, padding: "3px 8px", borderRadius: 99, background: "#eef1f8", color: DEFAULT_THEME.textMuted },
+  badgeTeam: { background: "#f3f0ff", color: "#6741d9" },
+  badgeBlu: { background: "#e7f5ff", color: "#1c7ed6" },
+  button: { font: "inherit", fontSize: 13, border: `1px solid ${DEFAULT_THEME.border}`, background: "#fff", borderRadius: 8, padding: "5px 10px", cursor: "pointer" }
+};
+export {
+  mountStandalone
+};

package/frame.js

@@ -0,0 +1,134 @@
+import {
+  BluHostProvider,
+  CONTRACT_VERSION,
+  assertHostContext
+} from "./chunks/chunk-M7GVSOGQ.js";
+
+// src/frame.tsx
+import { createRoot } from "react-dom/client";
+import { useEffect, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+var V = 1;
+async function mountIsolated({ Page, rootId = "root" }) {
+  const root = createRoot(document.getElementById(rootId));
+  if (window.parent === window) {
+    root.render(/* @__PURE__ */ jsx(Notice, { text: "This page is a Blu module's isolated frame. Open it from the Blu shell (or use the module's standalone app)." }));
+    return;
+  }
+  const { hostOrigins } = await (await fetch("./deployment.json", { cache: "no-store" })).json();
+  const allowed = Array.isArray(hostOrigins) ? hostOrigins : String(hostOrigins ?? "").split(",").filter(Boolean);
+  root.render(/* @__PURE__ */ jsx(Isolated, { Page, hostOrigins: new Set(allowed) }));
+}
+function Isolated({ Page, hostOrigins }) {
+  const [bridge] = useState(() => connectToBluShell(hostOrigins));
+  const [context, setContext] = useState(null);
+  useEffect(() => bridge.onContext(setContext), [bridge]);
+  if (!context) return /* @__PURE__ */ jsx(Notice, { text: "Waiting for the Blu shell\u2026" });
+  return /* @__PURE__ */ jsx(BluHostProvider, { value: context, children: /* @__PURE__ */ jsx(Page, {}, context.client.id) });
+}
+function connectToBluShell(hostOrigins) {
+  return createBridge(new Set(hostOrigins));
+}
+function createBridge(hostOrigins) {
+  let shellOrigin = null;
+  let token = null;
+  let seq = 0;
+  const pending = /* @__PURE__ */ new Map();
+  const contextListeners = /* @__PURE__ */ new Set();
+  const localHandlers = /* @__PURE__ */ new Map();
+  let latest = null;
+  const post = (msg) => {
+    window.parent.postMessage({ ...msg, v: V }, shellOrigin ?? "*");
+  };
+  let inflight = null;
+  const getToken = () => {
+    if (token && token.expiresAt - Date.now() > 1e4) return Promise.resolve(token.value);
+    inflight ??= new Promise((resolve, reject) => {
+      const id = ++seq;
+      pending.set(id, { resolve, reject });
+      post({ type: "blu.frame.token", id });
+    }).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+  const events = {
+    emit(type, payload) {
+      post({ type: "blu.frame.event", event: { type, payload } });
+      const e = { type, source: latest?.environment.moduleId ?? "module", payload, at: (/* @__PURE__ */ new Date()).toISOString() };
+      for (const key of [type, "*"]) localHandlers.get(key)?.forEach((h) => h(e));
+    },
+    on(type, h) {
+      if (!localHandlers.has(type)) localHandlers.set(type, /* @__PURE__ */ new Set());
+      localHandlers.get(type).add(h);
+      return () => void localHandlers.get(type)?.delete(h);
+    }
+  };
+  window.addEventListener("message", (event) => {
+    if (event.source !== window.parent || !hostOrigins.has(event.origin)) return;
+    if (shellOrigin && event.origin !== shellOrigin) return;
+    const msg = event.data;
+    if (!msg || msg.v !== V) return;
+    if (msg.type === "blu.frame.context") {
+      shellOrigin = event.origin;
+      token = null;
+      const c = msg.context;
+      const value = {
+        ...c,
+        route: { path: c.route?.path ?? "/", navigate: (path) => post({ type: "blu.frame.route", path }) },
+        getToken,
+        navigate: (path) => post({ type: "blu.frame.navigate", path }),
+        events
+      };
+      try {
+        assertHostContext(value);
+      } catch (e) {
+        console.error(e);
+        return;
+      }
+      latest = value;
+      contextListeners.forEach((l) => l(value));
+    } else if (msg.type === "blu.frame.token.result") {
+      const p = pending.get(msg.id);
+      if (!p) return;
+      pending.delete(msg.id);
+      if (typeof msg.token === "string") {
+        token = { value: msg.token, expiresAt: Date.now() + Number(msg.expiresIn ?? 60) * 1e3 };
+        p.resolve(msg.token);
+      } else p.reject(new Error(String(msg.error ?? "the shell refused a token")));
+    }
+  });
+  let last = 0;
+  const report = () => {
+    const height = Math.ceil(document.body.getBoundingClientRect().height);
+    if (height === last || !shellOrigin) return;
+    post({ type: "blu.frame.resize", height });
+    last = height;
+  };
+  new ResizeObserver(() => requestAnimationFrame(report)).observe(document.body);
+  post({ type: "blu.frame.ready", contract: CONTRACT_VERSION });
+  return {
+    /**
+     * The app moved (its own router): Blu updates its URL. Pass `replace: true`
+     * when your router already added a browser-history entry (it did, if it uses
+     * pushState) — then Blu replaces its URL instead of adding a second entry, and
+     * the back button steps once.
+     */
+    reportRoute(path, opts = {}) {
+      if (shellOrigin) post({ type: "blu.frame.route", path, replace: Boolean(opts.replace) });
+    },
+    onContext(l) {
+      contextListeners.add(l);
+      if (latest) l(latest);
+      requestAnimationFrame(report);
+      return () => void contextListeners.delete(l);
+    }
+  };
+}
+function Notice({ text }) {
+  return /* @__PURE__ */ jsx("p", { style: { font: "14px ui-sans-serif, system-ui, sans-serif", color: "#5c6478", padding: 24, margin: 0 }, children: text });
+}
+export {
+  connectToBluShell,
+  mountIsolated
+};