@hyperfrontend/questions 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0](https://github.com/AndrewRedican/hyperfrontend/compare/5f116abb8ba6355dfb283fa03b7481e5eb029480...7e783d3d9e6b6b3a42d226b44256b943958a5813) - 2026-08-04
+
+### Features
+
+- support clipboard paste and resize-aware redraw
+
 ## [0.2.1](https://github.com/AndrewRedican/hyperfrontend/compare/926d40cab470e589fc30a1ef3a61ca764ff047bd...466c0388c4cd516b9c704214140b4df1004098e6) - 2026-06-23
 
 ### Other

package/README.md

@@ -48,6 +48,8 @@ A terminal prompting library built on functional programming principles. Create
 - **Type-Safe** — Full TypeScript support with discriminated unions for prompt outcomes
 - **Zero External Dependencies** — Uses only Node.js built-ins and `@hyperfrontend` utilities
 - **Searchable Multiselect** — Type-to-filter functionality for large option lists
+- **Clipboard Paste** — Bracketed paste mode on TTYs (with a multi-character-chunk fallback elsewhere); pasted text is sanitized and never auto-submits
+- **Resize-Aware Rendering** — Prompts hard-wrap to the terminal width and repaint on resize, preserving value, cursor, selection, and validation state
 
 ### Architecture Highlights
 
@@ -56,6 +58,8 @@ Each prompt follows a functional state machine pattern:
 - **Immutable State** — All prompt state is frozen; updates create new state objects
 - **Explicit Outcomes** — Prompts return either `{ result: 'submitted', value: T }` or `{ result: 'cancelled', value: undefined }`
 - **Terminal Abstraction** — Low-level I/O is encapsulated in a `Terminal` interface for testability
+- **Token Input Stream** — Raw input is tokenized into keys, pastes, and resize notifications by a persistent listener, with raw mode held for the whole prompt session and restored on close
+- **Frame Renderer** — A width-aware screen helper erases and repaints exact frames; on resize it recomputes the previous frame's height at the new width (assumes a reflowing terminal; display width is code-point based, east-asian double width out of scope)
 
 ## Why Use @hyperfrontend/questions?
 
@@ -148,11 +152,16 @@ type PromptOutcome<T> = { result: 'submitted'; value: T } | { result: 'cancelled
 
 ## Compatibility
 
-| Environment    | Supported |
-| -------------- | --------- |
-| Node.js >= 18  | ✅        |
-| TTY Terminal   | ✅        |
-| Tree Shakeable | ✅        |
+| Environment                    | Supported |
+| ------------------------------ | --------- |
+| Node.js >= 18                  | ✅        |
+| TTY Terminal                   | ✅        |
+| Bracketed paste (TTY)          | ✅        |
+| Resize redraw (SIGWINCH)       | ✅        |
+| Non-TTY streams (tests, pipes) | ✅        |
+| Tree Shakeable                 | ✅        |
+
+On TTY inputs a prompt session enables bracketed paste mode (`ESC[?2004h`) and restores it on close; terminals without bracketed paste still paste correctly because multi-character input chunks are treated as pastes. Single-line prompts collapse pasted newlines into spaces, so pasting can never submit a value.
 
 ## License
 

package/SECURITY.md

@@ -1,5 +1,28 @@
 # Security Policy
 
+## The Security Model
+
+Before reporting or reviewing, read the model this project is built on:
+**[Security Model](https://www.hyperfrontend.dev/docs/core-concepts/security)**. It is the canonical
+statement of what hyperfrontend defends against and what it does not, and it is the reference every
+other security claim in these docs points back to. In short:
+
+- **The named adversary is co-resident script** — an analytics snippet, tag manager, compromised
+  dependency, or unknown page that embeds a feature URL. A host that deliberately installs a feature
+  is trusting it, the way it trusts any dependency; the controls exist to bound a trusted
+  feature's bad day, not to treat its authors as hostile.
+- **Origin checks authenticate rooms, not speakers.** Once arbitrary script runs inside a page, no
+  message check distinguishes it from the application. Threats inside a page need Content Security
+  Policy, Trusted Types, dependency provenance, and server-side authorisation — a different
+  treatment, deliberately outside this model.
+- **Three parties carry the security of an integration.** The browser enforces document isolation
+  and the frame's capability attributes; the protocol enforces the relationship (pinned
+  counterparts, gated handshake, validated payloads, versioned contracts, an optional encrypted
+  envelope); and **you** decide authorisation — `frame-ancestors`, backend checks, HTTPS, the
+  envelope you choose, and the containment posture you set.
+
+A vulnerability report is most useful when it names which of those three the issue defeats.
+
 ## Reporting a Vulnerability
 
 We take the security of hyperfrontend seriously. If you discover a security vulnerability, please help us protect our users by following responsible disclosure practices.
@@ -58,14 +81,30 @@ Thank you for helping keep hyperfrontend and its users safe!
 
 ## Security Best Practices
 
-When using hyperfrontend in your applications:
-
-1. **Keep Dependencies Updated**: Regularly update to the latest version to receive security patches
-2. **Content Security Policy**: Implement appropriate CSP headers when embedding features
-3. **Input Validation**: Validate and sanitize all data passed between features
-4. **Origin Verification**: Always verify the origin of messages in cross-frame communication
-5. **Authentication**: Implement proper authentication and authorization for sensitive features
-6. **HTTPS**: Always serve hyperfrontend features over HTTPS in production
+These are the decisions the SDK cannot make for you. Everything the protocol already enforces —
+origin pinning, window binding, instance identity, the gated handshake, payload validation on both
+ends — is on by default and is not something you should be re-implementing by hand.
+
+1. **Restrict who may embed the feature.** Send
+   `Content-Security-Policy: frame-ancestors <hosts>` on the response that serves the feature
+   document. Origin pinning keeps a conversation consistent; only `frame-ancestors` decides whether
+   a page was ever allowed to frame you.
+2. **Authorise on the server.** A message that crossed the boundary is not an authorised operation.
+   Protected work needs credentials the feature's own backend validates.
+3. **Choose the envelope deliberately.** `v2` with a pre-shared key is the confidentiality control;
+   `v1` is time-window obfuscation and buys deterrence only. Provision and rotate the `v2` key
+   yourself — a key is never baked into a built artifact. A handshake that cannot agree on an
+   encrypted transport falls back to plaintext; where that would be unacceptable, drive
+   `@hyperfrontend/nexus` directly and set `security.mode: 'fail-closed'` on the channel so the
+   connection is denied instead.
+4. **Declare schemas and a contract version.** Actions without a schema pass unvalidated, and a side
+   without a version always passes the compatibility gate. Both are how drift is caught early.
+5. **Grant capability narrowly.** Delegate only the Permissions-Policy features the integration
+   needs, and price a `sandbox` posture against what the product actually requires.
+6. **Serve everything over HTTPS**, host and feature alike.
+7. **Keep dependencies updated** on both sides of the boundary, and pair that with the page-integrity
+   controls this model deliberately leaves to you: Content Security Policy, Trusted Types,
+   Subresource Integrity, and dependency provenance.
 
 ## Security Updates
 
@@ -73,10 +112,6 @@ Security updates will be released as patch versions and documented in the [CHANG
 
 ## Supported Versions
 
-We currently provide security updates for:
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.0.x   | :white_check_mark: |
-
-As the project matures, we will update this table to reflect our long-term support policy.
+Security updates are provided for the latest published version of each `@hyperfrontend/*` package.
+Older releases receive no backports. A long-term support policy will replace this section once the
+packages settle on a stable release cadence.

package/_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/math/index.cjs.js

@@ -1,7 +1,11 @@
 'use strict';
 
 const _Math = globalThis.Math;
+const ceil = _Math.ceil;
+const floor = _Math.floor;
 const max = _Math.max;
 const min = _Math.min;
+exports.ceil = ceil;
+exports.floor = floor;
 exports.max = max;
 exports.min = min;

package/_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/math/index.esm.js

@@ -1,5 +1,7 @@
 const _Math = globalThis.Math;
+const ceil = _Math.ceil;
+const floor = _Math.floor;
 const max = _Math.max;
 const min = _Math.min;
 
-export { max, min };
+export { ceil, floor, max, min };

package/_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/promise/index.cjs.js

@@ -3,4 +3,6 @@
 const _Promise = globalThis.Promise;
 const _Reflect = globalThis.Reflect;
 const createPromise = (executor) => _Reflect.construct(_Promise, [executor]);
+const promiseResolve = _Promise.resolve.bind(_Promise);
 exports.createPromise = createPromise;
+exports.promiseResolve = promiseResolve;

package/_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/promise/index.esm.js

@@ -1,5 +1,6 @@
 const _Promise = globalThis.Promise;
 const _Reflect = globalThis.Reflect;
 const createPromise = (executor) => _Reflect.construct(_Promise, [executor]);
+const promiseResolve = _Promise.resolve.bind(_Promise);
 
-export { createPromise };
+export { createPromise, promiseResolve };