@jini-ai/agent-plugins 0.4.7 → 0.6.10

package/dist/admin-surfaces/descriptor.js

@@ -0,0 +1,196 @@
+import { checkAdminSurfaceActionSchema } from './action-schema.js';
+import { parseAdminSurfaceCapabilityDeclarations } from './capability-declarations.js';
+/** The CSP directives a descriptor may extend. Everything else stays at the strict default. */
+export const ADMIN_SURFACE_CSP_DIRECTIVES = ['script-src', 'style-src', 'img-src', 'font-src', 'connect-src', 'frame-src'];
+const ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const MAX_ID_LENGTH = 64;
+const MAX_TITLE_LENGTH = 100;
+const MAX_SURFACES = 16;
+const MAX_FILES = 32;
+const MAX_ACTIONS = 32;
+const MAX_SOURCES = 8;
+const MAX_LINK_ORIGINS = 8;
+const MAX_RAW_BYTES = 64 * 1024;
+/** One path segment: no `.`/`..`, no separators, no `%` (no encoded traversal), no leading dot. */
+const SEGMENT_PATTERN = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+const FILE_EXTENSIONS = ['.mjs', '.js', '.css', '.json'];
+/** A bare https origin with a DNS host name: no wildcard, path, query, credentials, IP or scheme keyword. */
+const CSP_SOURCE_PATTERN = /^https:\/\/(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}(?::\d{1,5})?$/;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const isId = (value) => typeof value === 'string' && value.length <= MAX_ID_LENGTH && ID_PATTERN.test(value);
+/** True when `value` is a relative POSIX path whose every segment is plain and that ends in one of
+ * `extensions`. @complexity O(n) in the path length. */
+export function isContainedAdminSurfacePath(required, _optional = {}) {
+    const { value, extensions } = required;
+    if (typeof value !== 'string' || value.length > 200)
+        return false;
+    return value.split('/').every((segment) => SEGMENT_PATTERN.test(segment)) && extensions.some((extension) => value.endsWith(extension));
+}
+/** True when `value` is a CSP source this protocol allows a plugin to add.
+ * @complexity O(n) in the source length. */
+export function isAllowedAdminSurfaceCspSource(required, _optional = {}) {
+    const { value } = required;
+    if (typeof value !== 'string' || !CSP_SOURCE_PATTERN.test(value))
+        return false;
+    // The URL parser normalizes default ports and IDNA forms; anything it rewrites is not a bare origin.
+    return new URL(value).origin === value;
+}
+/**
+ * Parses the contribution file. One invalid surface refuses the whole file (the loader reports it).
+ * @complexity O(s * (f + a + c)) surfaces with their files, actions and CSP sources; input bounded to 64 KiB.
+ */
+export function parseAdminSurfacesFile(required, _optional = {}) {
+    if (required.raw.length > MAX_RAW_BYTES)
+        return { ok: false, reason: 'larger than 64 KiB' };
+    let value;
+    try {
+        value = JSON.parse(required.raw);
+    }
+    catch {
+        return { ok: false, reason: 'not valid JSON' };
+    }
+    if (!isPlainObject(value) || value.schemaVersion !== 1)
+        return { ok: false, reason: 'schemaVersion must be 1' };
+    const descriptors = parseSurfaces(value.surfaces);
+    return typeof descriptors === 'string' ? { ok: false, reason: descriptors } : { ok: true, descriptors };
+}
+function parseSurfaces(surfaces) {
+    if (!Array.isArray(surfaces) || surfaces.length > MAX_SURFACES)
+        return `surfaces must be an array of at most ${MAX_SURFACES}`;
+    const descriptors = [];
+    for (const [index, entry] of surfaces.entries()) {
+        const parsed = parseSurface(entry, `surfaces[${index}]`);
+        if (typeof parsed === 'string')
+            return parsed;
+        if (descriptors.some((seen) => seen.id === parsed.id))
+            return `surfaces[${index}].id '${parsed.id}' is declared twice`;
+        descriptors.push(parsed);
+    }
+    return descriptors;
+}
+function parseSurface(entry, at) {
+    if (!isPlainObject(entry))
+        return `${at} must be an object`;
+    const identity = parseIdentity(entry, at);
+    if (typeof identity === 'string')
+        return identity;
+    const files = parseFiles(entry.files ?? [], at);
+    if (typeof files === 'string')
+        return files;
+    const actions = parseActions(entry.actions ?? [], at);
+    if (typeof actions === 'string')
+        return actions;
+    return parseSurfaceExtras(entry, { ...identity, files, actions }, at);
+}
+/** The CSP extensions, the optional link origins and the optional handler fields, after the core fields parsed. */
+function parseSurfaceExtras(entry, surface, at) {
+    const csp = parseCsp(entry.csp ?? {}, at);
+    if (typeof csp === 'string')
+        return csp;
+    const linkOrigins = entry.linkOrigins === undefined ? undefined : parseLinkOrigins(entry.linkOrigins, `${at}.linkOrigins`);
+    if (typeof linkOrigins === 'string')
+        return linkOrigins;
+    const handler = parseHandler(entry, surface, at);
+    return typeof handler === 'string' ? handler : { ...surface, csp, ...(linkOrigins && { linkOrigins }), ...handler };
+}
+/** At most 8 unique bare https origins, by the CSP source rule: a link the host opens leaves the sandbox. */
+function parseLinkOrigins(value, at) {
+    if (!Array.isArray(value) || value.length > MAX_LINK_ORIGINS)
+        return `${at} must be an array of at most ${MAX_LINK_ORIGINS}`;
+    const bad = value.findIndex((origin, index) => !isAllowedAdminSurfaceCspSource({ value: origin }) || value.indexOf(origin) !== index);
+    return bad === -1 ? value : `${at}[${bad}] must be a unique bare https origin (no wildcards, paths or keywords)`;
+}
+function parseHandler(entry, surface, at) {
+    const { handlerModule } = entry;
+    if (handlerModule === undefined)
+        return handlerOnlyFieldRefusal(entry, at) ?? {};
+    if (!isContainedAdminSurfacePath({ value: handlerModule, extensions: ['.mjs'] }))
+        return `${at}.handlerModule must be a plain relative path ending in .mjs`;
+    if (surface.files.includes(handlerModule))
+        return `${at}.handlerModule is server code and may not also be served to the frame`;
+    const unchecked = surface.actions.findIndex((action) => action.result === undefined);
+    if (unchecked !== -1)
+        return `${at}.actions[${unchecked}] must declare a result schema when the surface has a handlerModule`;
+    const declarations = parseAdminSurfaceCapabilityDeclarations({ entry, at });
+    if (typeof declarations === 'string')
+        return declarations;
+    const handler = parseBootstrap(entry.bootstrap, handlerModule, at);
+    return typeof handler === 'string' ? handler : { ...handler, ...declarations };
+}
+/** Fields only a handler module can use; without one they would be dead declarations. */
+function handlerOnlyFieldRefusal(entry, at) {
+    if (entry.bootstrap !== undefined)
+        return `${at}.bootstrap needs a handlerModule that provides it`;
+    const declared = ['connections', 'publicConfig', 'deliveryAdapters', 'forms'].find((name) => entry[name] !== undefined);
+    return declared === undefined ? null : `${at}.${declared} needs a handlerModule that uses it`;
+}
+function parseBootstrap(bootstrap, handlerModule, at) {
+    if (bootstrap === undefined)
+        return { handlerModule };
+    const reason = checkAdminSurfaceActionSchema({ schema: bootstrap });
+    return reason === null ? { handlerModule, bootstrap: bootstrap } : `${at}.bootstrap ${reason}`;
+}
+function parseIdentity(entry, at) {
+    const { id, title, entry: html } = entry;
+    if (!isId(id))
+        return `${at}.id must be a lowercase hyphenated id`;
+    if (typeof title !== 'string' || !title.trim() || title.length > MAX_TITLE_LENGTH)
+        return `${at}.title must be a non-empty string of at most ${MAX_TITLE_LENGTH} characters`;
+    if (!isContainedAdminSurfacePath({ value: html, extensions: ['.html'] }))
+        return `${at}.entry must be a plain relative path ending in .html`;
+    return { id, title, entry: html };
+}
+function parseFiles(value, at) {
+    if (!Array.isArray(value) || value.length > MAX_FILES)
+        return `${at}.files must be an array of at most ${MAX_FILES}`;
+    const bad = value.findIndex((file) => !isContainedAdminSurfacePath({ value: file, extensions: FILE_EXTENSIONS }));
+    return bad === -1 ? value : `${at}.files[${bad}] must be a plain relative path ending in ${FILE_EXTENSIONS.join(', ')}`;
+}
+function parseActions(value, at) {
+    if (!Array.isArray(value) || value.length > MAX_ACTIONS)
+        return `${at}.actions must be an array of at most ${MAX_ACTIONS}`;
+    const actions = [];
+    for (const [index, action] of value.entries()) {
+        const parsed = parseAction(action, `${at}.actions[${index}]`);
+        if (typeof parsed === 'string')
+            return parsed;
+        if (actions.some((seen) => seen.name === parsed.name))
+            return `${at}.actions[${index}].name '${parsed.name}' is declared twice`;
+        actions.push(parsed);
+    }
+    return actions;
+}
+function parseAction(action, at) {
+    if (!isPlainObject(action))
+        return `${at} must be an object`;
+    if (!isId(action.name))
+        return `${at}.name must be a lowercase hyphenated id`;
+    const effect = action.effect === undefined ? 'write' : action.effect;
+    if (effect !== 'read' && effect !== 'write' && effect !== 'destructive')
+        return `${at}.effect must be read, write or destructive`;
+    const input = checkAdminSurfaceActionSchema({ schema: action.input });
+    if (input !== null)
+        return `${at}.input ${input}`;
+    if (action.result === undefined)
+        return { name: action.name, effect, input: action.input };
+    const result = checkAdminSurfaceActionSchema({ schema: action.result });
+    if (result !== null)
+        return `${at}.result ${result}`;
+    return { name: action.name, effect, input: action.input, result: action.result };
+}
+function parseCsp(value, at) {
+    if (!isPlainObject(value))
+        return `${at}.csp must be an object`;
+    for (const [directive, sources] of Object.entries(value)) {
+        if (!ADMIN_SURFACE_CSP_DIRECTIVES.includes(directive))
+            return `${at}.csp may not extend '${directive.slice(0, 32)}'`;
+        if (!Array.isArray(sources) || sources.length > MAX_SOURCES)
+            return `${at}.csp['${directive}'] must be an array of at most ${MAX_SOURCES}`;
+        if (!sources.every((source) => isAllowedAdminSurfaceCspSource({ value: source })))
+            return `${at}.csp['${directive}'] may only list bare https origins (no wildcards, paths or keywords)`;
+    }
+    return value;
+}
+//# sourceMappingURL=descriptor.js.map

package/dist/admin-surfaces/descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptor.js","sourceRoot":"","sources":["../../src/admin-surfaces/descriptor.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,6BAA6B,EAAiC,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,uCAAuC,EAA2C,MAAM,8BAA8B,CAAC;AAEhI,+FAA+F;AAC/F,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAU,CAAC;AAkCpI,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,mGAAmG;AACnG,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACzD,6GAA6G;AAC7G,MAAM,kBAAkB,GAAG,iFAAiF,CAAC;AAE7G,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEvI;wDACwD;AACxD,MAAM,UAAU,2BAA2B,CAAC,QAA6E,EAAE,YAAmC,EAAE;IAC9J,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACzI,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,8BAA8B,CAAC,QAAqC,EAAE,YAAmC,EAAE;IACzH,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,qGAAqG;IACrG,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkC,EAAE,YAAmC,EAAE;IAC9G,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC5F,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAAC,CAAC;IACnG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAChH,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY;QAAE,OAAO,wCAAwC,YAAY,EAAE,CAAC;IAC9H,MAAM,WAAW,GAA6B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,KAAK,GAAG,CAAC,CAAC;QACzD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,YAAY,KAAK,SAAS,MAAM,CAAC,EAAE,qBAAqB,CAAC;QACvH,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,EAAU;IAC9C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,oBAAoB,CAAC;IAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mHAAmH;AACnH,SAAS,kBAAkB,CAAC,KAAY,EAAE,OAA4C,EAAE,EAAU;IAChG,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3H,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACtH,CAAC;AAED,6GAA6G;AAC7G,SAAS,gBAAgB,CAAC,KAAc,EAAE,EAAU;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,GAAG,EAAE,gCAAgC,gBAAgB,EAAE,CAAC;IAC7H,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;IACtI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,KAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,wEAAwE,CAAC;AACjI,CAAC;AASD,SAAS,YAAY,CAAC,KAAY,EAAE,OAA0D,EAAE,EAAU;IACxG,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,CAAC,2BAA2B,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,GAAG,EAAE,6DAA6D,CAAC;IAC5J,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAuB,CAAC;QAAE,OAAO,GAAG,EAAE,uEAAuE,CAAC;IACzI,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACrF,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,EAAE,YAAY,SAAS,qEAAqE,CAAC;IAC7H,MAAM,YAAY,GAAG,uCAAuC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,aAAuB,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;AACjF,CAAC;AAED,yFAAyF;AACzF,SAAS,uBAAuB,CAAC,KAAY,EAAE,EAAU;IACvD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,mDAAmD,CAAC;IACnG,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACxH,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,qCAAqC,CAAC;AAChG,CAAC;AAED,SAAS,cAAc,CAAC,SAAkB,EAAE,aAAqB,EAAE,EAAU;IAC3E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,6BAA6B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,SAAqC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,MAAM,EAAE,CAAC;AAC7H,CAAC;AAED,SAAS,aAAa,CAAC,KAAY,EAAE,EAAU;IAC7C,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,GAAG,EAAE,uCAAuC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,GAAG,EAAE,gDAAgD,gBAAgB,aAAa,CAAC;IAC7K,IAAI,CAAC,2BAA2B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,GAAG,EAAE,sDAAsD,CAAC;IAC7I,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAc,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,EAAU;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,GAAG,EAAE,sCAAsC,SAAS,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAClH,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,KAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,GAAG,6CAA6C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxI,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,EAAU;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,GAAG,EAAE,wCAAwC,WAAW,EAAE,CAAC;IAC3H,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,EAAE,YAAY,KAAK,WAAW,MAAM,CAAC,IAAI,qBAAqB,CAAC;QAChI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAe,EAAE,EAAU;IAC9C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,EAAE,oBAAoB,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,EAAE,yCAAyC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACrE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,EAAE,4CAA4C,CAAC;IAClI,MAAM,KAAK,GAAG,6BAA6B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,EAAE,UAAU,KAAK,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAiC,EAAE,CAAC;IACvH,MAAM,MAAM,GAAG,6BAA6B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,GAAG,EAAE,WAAW,MAAM,EAAE,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAkC,EAAE,CAAC;AAC3I,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,EAAU;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,wBAAwB,CAAC;IAChE,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,CAAE,4BAAkD,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,GAAG,EAAE,wBAAwB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAC5I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;YAAE,OAAO,GAAG,EAAE,SAAS,SAAS,kCAAkC,WAAW,EAAE,CAAC;QAC3I,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAAE,OAAO,GAAG,EAAE,SAAS,SAAS,uEAAuE,CAAC;IAC3L,CAAC;IACD,OAAO,KAAsC,CAAC;AAChD,CAAC"}

package/dist/admin-surfaces/external-links.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @file Host-mediated external links: a surface declares the https origins it may link to
+ * (`linkOrigins`, parsed in `./descriptor.ts`), and asks the host page to open a URL with an `open-link` message; the host page
+ * passes that message to `openAdminSurfaceLink`, which opens it through the host's own opener only
+ * when it comes from this mount and names a declared https origin.
+ *
+ * Why the host opens links: a surface frame is sandboxed without `allow-popups` or top navigation,
+ * so it cannot open anything itself, and must not: the host decides HOW (a new tab with `noopener`
+ * on the web, the system browser on desktop). Why the gate is this strict: a link the host opens
+ * leaves the sandbox entirely, so the destination is limited to what the shipped, digest-checked
+ * surfaces file declared, and the opener receives the URL parser's normalized form so it never
+ * re-parses a string this gate judged differently.
+ */
+import { type AdminSurfaceMessageEvent, type AdminSurfaceMountRecord } from './host-validator.js';
+import { type AdminSurfaceActionResponse } from './protocol.js';
+/** Host port: opens an already-checked https URL however the host decides (new tab with `noopener`, system browser). */
+export type AdminSurfaceOpenLinkPort = (required: {
+    readonly url: string;
+}, optional?: Record<string, never>) => void | Promise<void>;
+/** `ignored`: not this mount's open-link message; drop silently. Otherwise post `response` back to the frame. */
+export type AdminSurfaceLinkVerdict = {
+    readonly ok: true;
+    readonly url: string;
+    readonly response: AdminSurfaceActionResponse;
+} | {
+    readonly ok: false;
+    readonly ignored: string;
+} | {
+    readonly ok: false;
+    readonly refused: string;
+    readonly response: AdminSurfaceActionResponse;
+};
+/**
+ * Judges one `message` event as an open-link request for one mount and, when it passes, opens it
+ * through the host's port. Pass every message event here as well as to `validateAdminSurfaceMessage`;
+ * each ignores the other's messages.
+ * @param required.openLink - The host's opener; called at most once, with the normalized URL.
+ * @complexity O(n) in the URL length, plus the opener.
+ */
+export declare function openAdminSurfaceLink(required: {
+    readonly event: AdminSurfaceMessageEvent;
+    readonly mount: AdminSurfaceMountRecord;
+    readonly openLink: AdminSurfaceOpenLinkPort;
+}, _optional?: Record<string, never>): Promise<AdminSurfaceLinkVerdict>;
+//# sourceMappingURL=external-links.d.ts.map

package/dist/admin-surfaces/external-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-links.d.ts","sourceRoot":"","sources":["../../src/admin-surfaces/external-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAA6C,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC7I,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,eAAe,CAAC;AAKvB,wHAAwH;AACxH,MAAM,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtI,iHAAiH;AACjH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAuBpG;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAA;CAAE,EAC5I,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAYlC"}

package/dist/admin-surfaces/external-links.js

@@ -0,0 +1,70 @@
+/**
+ * @file Host-mediated external links: a surface declares the https origins it may link to
+ * (`linkOrigins`, parsed in `./descriptor.ts`), and asks the host page to open a URL with an `open-link` message; the host page
+ * passes that message to `openAdminSurfaceLink`, which opens it through the host's own opener only
+ * when it comes from this mount and names a declared https origin.
+ *
+ * Why the host opens links: a surface frame is sandboxed without `allow-popups` or top navigation,
+ * so it cannot open anything itself, and must not: the host decides HOW (a new tab with `noopener`
+ * on the web, the system browser on desktop). Why the gate is this strict: a link the host opens
+ * leaves the sandbox entirely, so the destination is limited to what the shipped, digest-checked
+ * surfaces file declared, and the opener receives the URL parser's normalized form so it never
+ * re-parses a string this gate judged differently.
+ */
+import { frameTransportRefusal, REQUEST_ID_PATTERN } from './host-validator.js';
+import { ADMIN_SURFACE_PROTOCOL, ADMIN_SURFACE_PROTOCOL_VERSION, adminSurfaceActionResponse, } from './protocol.js';
+/** Longer URLs are refused, not cut: a truncated link would open somewhere the plugin did not mean. */
+const MAX_LINK_URL_LENGTH = 2048;
+function isOpenLinkEnvelope(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const message = data;
+    const isProtocol = message.protocol === ADMIN_SURFACE_PROTOCOL && message.version === ADMIN_SURFACE_PROTOCOL_VERSION && message.kind === 'open-link';
+    return isProtocol && typeof message.mountId === 'string' && typeof message.requestId === 'string' && REQUEST_ID_PATTERN.test(message.requestId) && typeof message.url === 'string';
+}
+/** The normalized URL when `raw` may be opened, or why not. Messages never echo the URL. @complexity O(n) in the URL length. */
+function checkLink(raw, origins) {
+    if (raw.length > MAX_LINK_URL_LENGTH)
+        return { code: 'link-too-long', message: 'The link is too long.' };
+    if (!URL.canParse(raw))
+        return { code: 'link-invalid', message: 'That link is not a valid web address.' };
+    const parsed = new URL(raw);
+    if (parsed.protocol !== 'https:')
+        return { code: 'link-not-https', message: 'Only https links can be opened.' };
+    // Credentials in a link are a phishing shape (`https://trusted@elsewhere`) and never needed to open a page.
+    if (parsed.username !== '' || parsed.password !== '')
+        return { code: 'link-invalid', message: 'That link is not a valid web address.' };
+    if (!origins.includes(parsed.origin))
+        return { code: 'link-undeclared', message: 'This surface did not declare that link destination.' };
+    return { url: parsed.href };
+}
+/**
+ * Judges one `message` event as an open-link request for one mount and, when it passes, opens it
+ * through the host's port. Pass every message event here as well as to `validateAdminSurfaceMessage`;
+ * each ignores the other's messages.
+ * @param required.openLink - The host's opener; called at most once, with the normalized URL.
+ * @complexity O(n) in the URL length, plus the opener.
+ */
+export async function openAdminSurfaceLink(required, _optional = {}) {
+    const { event, mount, openLink } = required;
+    const transport = frameTransportRefusal({ event, mount });
+    if (transport !== null)
+        return { ok: false, ignored: transport };
+    if (!isOpenLinkEnvelope(event.data))
+        return { ok: false, ignored: 'not-an-open-link' };
+    const request = event.data;
+    if (request.mountId !== mount.mountId)
+        return { ok: false, ignored: 'mount-mismatch' };
+    const refuse = (refusal, retryable = false) => ({ ok: false, refused: refusal.code, response: adminSurfaceActionResponse({ request, outcome: { ok: false, error: { ...refusal, retryable } } }) });
+    const checked = checkLink(request.url, mount.descriptor.linkOrigins ?? []);
+    if (!('url' in checked))
+        return refuse(checked);
+    try {
+        await openLink({ url: checked.url });
+    }
+    catch {
+        return refuse({ code: 'link-failed', message: 'The host could not open the link. Try again.' }, true);
+    }
+    return { ok: true, url: checked.url, response: adminSurfaceActionResponse({ request, outcome: { ok: true, result: null } }) };
+}
+//# sourceMappingURL=external-links.js.map

package/dist/admin-surfaces/external-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-links.js","sourceRoot":"","sources":["../../src/admin-surfaces/external-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAA+D,MAAM,qBAAqB,CAAC;AAC7I,OAAO,EACL,sBAAsB,EAAE,8BAA8B,EAAE,0BAA0B,GAEnF,MAAM,eAAe,CAAC;AAEvB,uGAAuG;AACvG,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAWjC,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAyC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,sBAAsB,IAAI,OAAO,CAAC,OAAO,KAAK,8BAA8B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;IACrJ,OAAO,UAAU,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC;AACrL,CAAC;AAID,gIAAgI;AAChI,SAAS,SAAS,CAAC,GAAW,EAAE,OAA0B;IACxD,IAAI,GAAG,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACzG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IAC1G,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IAChH,4GAA4G;IAC5G,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACxI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACzI,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAA4I,EAC5I,YAAmC,EAAE;IAErC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACjE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,OAAoB,EAAE,SAAS,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,0BAA0B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzN,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9J,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,0BAA0B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AAChI,CAAC"}

package/dist/admin-surfaces/host-validator.d.ts

@@ -0,0 +1,62 @@
+import type { AdminSurfaceDescriptor } from './descriptor.js';
+import { type AdminSurfaceActionRequest, type AdminSurfaceActionResponse } from './protocol.js';
+/** The fields of a `MessageEvent` the gate reads; a real event satisfies it structurally. */
+export interface AdminSurfaceMessageEvent {
+    readonly origin: string;
+    readonly source: unknown;
+    readonly data: unknown;
+}
+export interface AdminSurfaceMountRecord {
+    readonly mountId: string;
+    /** The frame's `contentWindow`; the event's `source` must be this exact object. */
+    readonly frame: unknown;
+    /** `linkOrigins` matters only to `openAdminSurfaceLink`; a record without it opens no links. */
+    readonly descriptor: Pick<AdminSurfaceDescriptor, 'actions' | 'linkOrigins'>;
+}
+/** `ignored`: not addressed to this mount; drop silently. `refused`: this mount's request was invalid;
+ * post `response` back so the surface can show why. */
+export type AdminSurfaceMessageVerdict = {
+    readonly ok: true;
+    readonly request: AdminSurfaceActionRequest;
+} | {
+    readonly ok: false;
+    readonly ignored: string;
+} | {
+    readonly ok: false;
+    readonly refused: string;
+    readonly response: AdminSurfaceActionResponse;
+};
+export declare const REQUEST_ID_PATTERN: RegExp;
+/** Character length of the payload as JSON, or Infinity when it is not JSON-serializable. */
+/** Whether `event` comes from `mount`'s frame at all (origin and window), for every inbound message kind.
+ * @returns The failed check, or `null`. @complexity O(1). */
+export declare function frameTransportRefusal(required: {
+    readonly event: AdminSurfaceMessageEvent;
+    readonly mount: Pick<AdminSurfaceMountRecord, 'frame'>;
+}, _optional?: Record<string, never>): string | null;
+/**
+ * Judges one `message` event against one mount.
+ * @complexity O(p) in the payload size (one JSON measure plus one schema walk).
+ */
+export declare function validateAdminSurfaceMessage(required: {
+    readonly event: AdminSurfaceMessageEvent;
+    readonly mount: AdminSurfaceMountRecord;
+}, _optional?: Record<string, never>): AdminSurfaceMessageVerdict;
+/** Frame heights a host accepts by default (CSS px): tall enough for a notice, short enough that a
+ *  surface cannot push the admin page out of reach. */
+export declare const ADMIN_SURFACE_MIN_HEIGHT = 96;
+export declare const ADMIN_SURFACE_MAX_HEIGHT = 4000;
+/**
+ * The frame height `event` asks for when it is `mount`'s own `resize` message (same origin, window and
+ * mount as every other inbound message), clamped to `[min, max]`; null for anything else, which the
+ * caller ignores. A size is cosmetic, so a bad one is dropped rather than answered.
+ * @complexity O(1).
+ */
+export declare function readAdminSurfaceResize(required: {
+    readonly event: AdminSurfaceMessageEvent;
+    readonly mount: Pick<AdminSurfaceMountRecord, 'mountId' | 'frame'>;
+}, optional?: {
+    readonly min?: number;
+    readonly max?: number;
+}): number | null;
+//# sourceMappingURL=host-validator.d.ts.map

package/dist/admin-surfaces/host-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-validator.d.ts","sourceRoot":"","sources":["../../src/admin-surfaces/host-validator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAEuB,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EAC5F,MAAM,eAAe,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,CAAC;CAC9E;AAED;uDACuD;AACvD,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAEpG,eAAO,MAAM,kBAAkB,QAA0B,CAAC;AAc1D,6FAA6F;AAC7F;6DAC6D;AAC7D,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAA;CAAE,EAAE,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GAAG,MAAM,GAAG,IAAI,CAK1M;AAUD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,EAAE,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM,GAAG,0BAA0B,CAY9M;AAED;uDACuD;AACvD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAS7C;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,OAAO,CAAC,CAAA;CAAE,EAC1H,QAAQ,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,MAAM,GAAG,IAAI,CAMf"}

package/dist/admin-surfaces/host-validator.js

@@ -0,0 +1,87 @@
+/**
+ * @file The host page's gate for messages arriving from a mounted admin surface frame.
+ *
+ * Why every check is needed: all sandboxed frames share the origin "null", so the origin check only
+ * proves "some sandboxed frame"; the window identity proves it is THIS mount's
+ * frame; the nonce proves the frame still runs the document the host initialized (a navigated frame
+ * never received it). Action and schema checks here are an early refusal for the person using the
+ * surface; the server-side dispatcher repeats them because a host route can be called directly.
+ */
+import { exceedsAdminSurfacePayloadLimit, validateAdminSurfaceActionValue } from './action-schema.js';
+import { ADMIN_SURFACE_PROTOCOL, ADMIN_SURFACE_PROTOCOL_VERSION, SANDBOXED_FRAME_ORIGIN, adminSurfaceActionResponse, } from './protocol.js';
+export const REQUEST_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function isRequestEnvelope(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const message = data;
+    const isProtocol = message.protocol === ADMIN_SURFACE_PROTOCOL && message.version === ADMIN_SURFACE_PROTOCOL_VERSION && message.kind === 'action-request';
+    return isProtocol && hasRequestFields(message);
+}
+function hasRequestFields(message) {
+    return typeof message.mountId === 'string' && typeof message.requestId === 'string' && REQUEST_ID_PATTERN.test(message.requestId)
+        && typeof message.action === 'string' && Object.hasOwn(message, 'payload');
+}
+/** Character length of the payload as JSON, or Infinity when it is not JSON-serializable. */
+/** Whether `event` comes from `mount`'s frame at all (origin and window), for every inbound message kind.
+ * @returns The failed check, or `null`. @complexity O(1). */
+export function frameTransportRefusal(required, _optional = {}) {
+    const { event, mount } = required;
+    // "null" is the origin of every frame sandboxed with `allow-scripts` only; nothing else may speak for a mount.
+    if (event.origin !== SANDBOXED_FRAME_ORIGIN)
+        return 'origin-mismatch';
+    return event.source === mount.frame ? null : 'source-mismatch';
+}
+/** Which transport check `event` fails for `mount`, or `null` when it is this mount's well-formed request. */
+function transportRefusal(event, mount) {
+    const frame = frameTransportRefusal({ event, mount });
+    if (frame !== null)
+        return frame;
+    if (!isRequestEnvelope(event.data))
+        return 'not-an-action-request';
+    return event.data.mountId === mount.mountId ? null : 'mount-mismatch';
+}
+/**
+ * Judges one `message` event against one mount.
+ * @complexity O(p) in the payload size (one JSON measure plus one schema walk).
+ */
+export function validateAdminSurfaceMessage(required, _optional = {}) {
+    const { event, mount } = required;
+    const ignored = transportRefusal(event, mount);
+    if (ignored !== null)
+        return { ok: false, ignored };
+    const request = event.data;
+    const refuse = (code, message) => ({ ok: false, refused: code, response: adminSurfaceActionResponse({ request, outcome: { ok: false, error: { code, message, retryable: false } } }) });
+    const action = mount.descriptor.actions.find((declared) => declared.name === request.action);
+    if (action === undefined)
+        return refuse('action-undeclared', 'This surface did not declare that action.');
+    if (exceedsAdminSurfacePayloadLimit({ payload: request.payload }))
+        return refuse('invalid-payload', 'The request is too large.');
+    const violation = validateAdminSurfaceActionValue({ schema: action.input, value: request.payload });
+    if (violation !== null)
+        return refuse('invalid-payload', `The request does not match the action's input: ${violation}.`);
+    return { ok: true, request };
+}
+/** Frame heights a host accepts by default (CSS px): tall enough for a notice, short enough that a
+ *  surface cannot push the admin page out of reach. */
+export const ADMIN_SURFACE_MIN_HEIGHT = 96;
+export const ADMIN_SURFACE_MAX_HEIGHT = 4000;
+function isResizeForMount({ message, mountId }, _options = {}) {
+    const isResize = message.protocol === ADMIN_SURFACE_PROTOCOL && message.version === ADMIN_SURFACE_PROTOCOL_VERSION && message.kind === 'resize';
+    return isResize && message.mountId === mountId;
+}
+/**
+ * The frame height `event` asks for when it is `mount`'s own `resize` message (same origin, window and
+ * mount as every other inbound message), clamped to `[min, max]`; null for anything else, which the
+ * caller ignores. A size is cosmetic, so a bad one is dropped rather than answered.
+ * @complexity O(1).
+ */
+export function readAdminSurfaceResize(required, optional = {}) {
+    const { event, mount } = required;
+    if (frameTransportRefusal({ event, mount }) !== null || typeof event.data !== 'object' || event.data === null)
+        return null;
+    const message = event.data;
+    if (!isResizeForMount({ message, mountId: mount.mountId }) || typeof message.height !== 'number' || !Number.isFinite(message.height))
+        return null;
+    return Math.min(optional.max ?? ADMIN_SURFACE_MAX_HEIGHT, Math.max(optional.min ?? ADMIN_SURFACE_MIN_HEIGHT, Math.ceil(message.height)));
+}
+//# sourceMappingURL=host-validator.js.map

package/dist/admin-surfaces/host-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-validator.js","sourceRoot":"","sources":["../../src/admin-surfaces/host-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAEtG,OAAO,EACL,sBAAsB,EAAE,8BAA8B,EAAE,sBAAsB,EAC9E,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAwBvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAyC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,sBAAsB,IAAI,OAAO,CAAC,OAAO,KAAK,8BAA8B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC;IAC1J,OAAO,UAAU,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0C;IAClE,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;WAC5H,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,6FAA6F;AAC7F;6DAC6D;AAC7D,MAAM,UAAU,qBAAqB,CAAC,QAA8G,EAAE,YAAmC,EAAE;IACzL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAClC,+GAA+G;IAC/G,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB;QAAE,OAAO,iBAAiB,CAAC;IACtE,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACjE,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CAAC,KAA+B,EAAE,KAA8B;IACvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA+F,EAAE,YAAmC,EAAE;IAChL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAiC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,0BAA0B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACjN,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;IAC1G,IAAI,+BAA+B,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,SAAS,GAAG,CAAC,CAAC;IACzH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;uDACuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,SAAS,gBAAgB,CACvB,EAAE,OAAO,EAAE,OAAO,EAAmE,EAAE,QAAQ,GAAG,EAAE;IAEpG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,sBAAsB,IAAI,OAAO,CAAC,OAAO,KAAK,8BAA8B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC;IAChJ,OAAO,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA0H,EAC1H,WAA6D,EAAE;IAE/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAClC,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3H,MAAM,OAAO,GAAG,KAAK,CAAC,IAAyC,CAAC;IAChE,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClJ,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,wBAAwB,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3I,CAAC"}

package/dist/admin-surfaces/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @file Public barrel for `@jini-ai/agent-plugins/admin-surfaces`: plugin-owned admin surfaces
+ * (sandboxed iframes) and the host-mediated action protocol. See `./README.md`.
+ *
+ * Explicit on purpose: only what a host composes is public. The parsers, checkers and message
+ * constants behind these entry points stay internal, so they can change without a host noticing.
+ */
+export { adminSurfaceInitMessage, adminSurfaceActionResponse, type AdminSurfaceBootstrap, type AdminSurfaceInitMessage, type AdminSurfaceActionRequest, type AdminSurfaceActionFailure, type AdminSurfaceActionOutcome, type AdminSurfaceActionResponse, type AdminSurfaceOpenLinkRequest, type AdminSurfaceResizeMessage, } from './protocol.js';
+export { readAdminSurfaceTheme, adminSurfaceThemeMessage, ADMIN_SURFACE_THEME_TOKENS, type AdminSurfaceTheme, type AdminSurfaceThemeToken, type AdminSurfaceColorScheme, type AdminSurfaceThemeMessage, } from './theme.js';
+export type { AdminSurfaceActionSchema } from './action-schema.js';
+export { parseAdminSurfacesFile, type AdminSurfaceCspDirective, type AdminSurfaceAction, type AdminSurfaceDescriptor } from './descriptor.js';
+export { adminSurfaceFrameAttributes, createAdminSurfaceMount, createAdminSurfaceBootstrap, adminSurfaceBootstrapHeaders } from './sandbox.js';
+export { validateAdminSurfaceMessage, readAdminSurfaceResize, ADMIN_SURFACE_MIN_HEIGHT, ADMIN_SURFACE_MAX_HEIGHT, type AdminSurfaceMessageEvent, type AdminSurfaceMountRecord, type AdminSurfaceMessageVerdict, } from './host-validator.js';
+export { createAdminSurfaceActionDispatcher, AdminSurfaceActionError, type AdminSurfaceActionHandler } from './action-dispatcher.js';
+export { defineAdminSurfaceContribution, readAdminSurfaceFile, type LoadedAdminSurface } from './contribution.js';
+export { defineAdminSurfaceHandlerContribution, createAdminSurfaceHandlerHost, type AdminSurfaceHandlerContext, type AdminSurfacePluginContext, type AdminSurfaceBootstrapCall, type AdminSurfaceHandlerCall, type AdminSurfaceHandlerModule, type LoadedAdminSurfaceHandlers, type AdminSurfaceHostKind, } from './surface-handlers.js';
+export type { AdminSurfaceConnectionDeclaration, AdminSurfaceCapabilityDeclarations } from './capability-declarations.js';
+export { ADMIN_SURFACE_ACTION_INTENTS, ADMIN_SURFACE_STATE_LIMITS, type AdminSurfaceConnectionState, type AdminSurfaceConnectionAction, type AdminSurfaceRevocationOutcome, type AdminSurfaceConnectionStatus, type AdminSurfaceSignInAttempt, type AdminSurfaceAuthorizationStart, type AdminSurfaceConnections, type AdminSurfaceStateValue, type AdminSurfaceState, type AdminSurfacePublicConfig, type AdminSurfaceForm, type AdminSurfaceForms, type AdminSurfaceCapabilities, type AdminSurfaceCapabilitiesPort, } from './surface-capabilities.js';
+export type { AdminSurfaceDeliveryBinding, AdminSurfaceDeliveryBindingDraft, AdminSurfaceDeliveryBindingForms, AdminSurfaceDeliveryBindings, } from './delivery-bindings.js';
+export { openAdminSurfaceLink, type AdminSurfaceOpenLinkPort, type AdminSurfaceLinkVerdict } from './external-links.js';
+export { createAdminSurfaceCallbackInbox, type AdminSurfaceCallbackFieldKey } from './callback-field-inbox.js';
+export { buildAdminSurfaceActionTools, type AdminSurfaceToolSource, type AdminSurfaceToolContext } from './action-tools.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/admin-surfaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin-surfaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,uBAAuB,EAAE,0BAA0B,EACnD,KAAK,qBAAqB,EAAE,KAAK,uBAAuB,EAAE,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EACxH,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,KAAK,2BAA2B,EAAE,KAAK,yBAAyB,GAClI,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EAAE,wBAAwB,EAAE,0BAA0B,EAC3E,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,GACjH,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,KAAK,wBAAwB,EAAE,KAAK,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9I,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC/I,OAAO,EACL,2BAA2B,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,EACvG,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,GAC7F,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACrI,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClH,OAAO,EACL,qCAAqC,EAAE,6BAA6B,EACpE,KAAK,0BAA0B,EAAE,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,KAAK,uBAAuB,EAC7H,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,KAAK,oBAAoB,GAC3F,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,iCAAiC,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAC1H,OAAO,EACL,4BAA4B,EAAE,0BAA0B,EACxD,KAAK,2BAA2B,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAAE,KAAK,4BAA4B,EAAE,KAAK,yBAAyB,EAC1K,KAAK,8BAA8B,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EACtH,KAAK,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,KAAK,4BAA4B,GAC/I,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,4BAA4B,GAC9H,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxH,OAAO,EAAE,+BAA+B,EAAE,KAAK,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE/G,OAAO,EAAE,4BAA4B,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/admin-surfaces/index.js

@@ -0,0 +1,21 @@
+/**
+ * @file Public barrel for `@jini-ai/agent-plugins/admin-surfaces`: plugin-owned admin surfaces
+ * (sandboxed iframes) and the host-mediated action protocol. See `./README.md`.
+ *
+ * Explicit on purpose: only what a host composes is public. The parsers, checkers and message
+ * constants behind these entry points stay internal, so they can change without a host noticing.
+ */
+export { adminSurfaceInitMessage, adminSurfaceActionResponse, } from './protocol.js';
+export { readAdminSurfaceTheme, adminSurfaceThemeMessage, ADMIN_SURFACE_THEME_TOKENS, } from './theme.js';
+export { parseAdminSurfacesFile } from './descriptor.js';
+export { adminSurfaceFrameAttributes, createAdminSurfaceMount, createAdminSurfaceBootstrap, adminSurfaceBootstrapHeaders } from './sandbox.js';
+export { validateAdminSurfaceMessage, readAdminSurfaceResize, ADMIN_SURFACE_MIN_HEIGHT, ADMIN_SURFACE_MAX_HEIGHT, } from './host-validator.js';
+// AdminSurfaceActionError stays public: a host's OWN handlers throw it to send a code the surface can show.
+export { createAdminSurfaceActionDispatcher, AdminSurfaceActionError } from './action-dispatcher.js';
+export { defineAdminSurfaceContribution, readAdminSurfaceFile } from './contribution.js';
+export { defineAdminSurfaceHandlerContribution, createAdminSurfaceHandlerHost, } from './surface-handlers.js';
+export { ADMIN_SURFACE_ACTION_INTENTS, ADMIN_SURFACE_STATE_LIMITS, } from './surface-capabilities.js';
+export { openAdminSurfaceLink } from './external-links.js';
+export { createAdminSurfaceCallbackInbox } from './callback-field-inbox.js';
+export { buildAdminSurfaceActionTools } from './action-tools.js';
+//# sourceMappingURL=index.js.map

package/dist/admin-surfaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin-surfaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,uBAAuB,EAAE,0BAA0B,GAGpD,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EAAE,wBAAwB,EAAE,0BAA0B,GAE5E,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,sBAAsB,EAAuF,MAAM,iBAAiB,CAAC;AAC9I,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC/I,OAAO,EACL,2BAA2B,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,GAExG,MAAM,qBAAqB,CAAC;AAC7B,4GAA4G;AAC5G,OAAO,EAAE,kCAAkC,EAAE,uBAAuB,EAAkC,MAAM,wBAAwB,CAAC;AACrI,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAA2B,MAAM,mBAAmB,CAAC;AAClH,OAAO,EACL,qCAAqC,EAAE,6BAA6B,GAGrE,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,4BAA4B,EAAE,0BAA0B,GAIzD,MAAM,2BAA2B,CAAC;AAInC,OAAO,EAAE,oBAAoB,EAA+D,MAAM,qBAAqB,CAAC;AACxH,OAAO,EAAE,+BAA+B,EAAqC,MAAM,2BAA2B,CAAC;AAE/G,OAAO,EAAE,4BAA4B,EAA6D,MAAM,mBAAmB,CAAC"}