@lingxia/bridge 0.14.0 → 0.16.0

package/dist/es2020/protocol-v3.js

@@ -0,0 +1,191 @@
+/** Document-side framing for host-attested RequiredV3 documents. */
+export const V3_PROTOCOL = 3;
+export const DEFAULT_MAX_V3_FRAME_BYTES = 64 * 1024;
+const documentToNativeKinds = new Set([
+    "hello",
+    "req",
+    "res",
+    "notify",
+    "cancel",
+    "ch.open",
+    "ch.data",
+    "ch.close",
+    "state.ack",
+    "console",
+]);
+const nativeToDocumentKinds = new Set([
+    "helloAck",
+    "ready",
+    "req",
+    "res",
+    "event",
+    "state.snapshot",
+    "state.patch",
+    "ch.ack",
+    "ch.data",
+    "ch.close",
+]);
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasDuplicateTopLevelSecurityKey(frame) {
+    const securityKeys = new Set(["v", "kind", "sessionId", "secret"]);
+    const seen = new Set();
+    let depth = 0;
+    for (let index = 0; index < frame.length; index++) {
+        const char = frame[index];
+        if (char === "{" || char === "[") {
+            depth++;
+            continue;
+        }
+        if (char === "}" || char === "]") {
+            depth--;
+            continue;
+        }
+        if (char !== '"')
+            continue;
+        const start = index;
+        index++;
+        while (index < frame.length) {
+            if (frame[index] === "\\") {
+                index += 2;
+                continue;
+            }
+            if (frame[index] === '"')
+                break;
+            index++;
+        }
+        if (index >= frame.length)
+            return false;
+        if (depth !== 1)
+            continue;
+        let next = index + 1;
+        while (/\s/.test(frame[next] ?? ""))
+            next++;
+        if (frame[next] !== ":")
+            continue;
+        let key;
+        try {
+            key = JSON.parse(frame.slice(start, index + 1));
+        }
+        catch {
+            return false;
+        }
+        if (typeof key === "string" && securityKeys.has(key)) {
+            if (seen.has(key))
+                return true;
+            seen.add(key);
+        }
+    }
+    return false;
+}
+/**
+ * Captures the document secret in a closure. Neither the returned codec nor
+ * parsed native messages expose it.
+ */
+export function createV3DocumentCodec(binding) {
+    if (!isRecord(binding) ||
+        typeof binding.sessionId !== "string" ||
+        binding.sessionId.length === 0 ||
+        typeof binding.secret !== "string" ||
+        binding.secret.length === 0) {
+        return { ok: false, error: "INVALID_DOCUMENT_BINDING" };
+    }
+    const { sessionId, secret } = binding;
+    return {
+        ok: true,
+        value: {
+            encode(kind, payload) {
+                if (!documentToNativeKinds.has(kind) || !isRecord(payload)) {
+                    return { ok: false, error: "INVALID_DOCUMENT_PAYLOAD" };
+                }
+                if (["v", "kind", "sessionId", "secret"].some((field) => field in payload)) {
+                    return { ok: false, error: "SECURITY_FIELD_IN_PAYLOAD" };
+                }
+                return {
+                    ok: true,
+                    value: { ...payload, v: V3_PROTOCOL, kind, sessionId, secret },
+                };
+            },
+            parse(frame, maxFrameBytes = DEFAULT_MAX_V3_FRAME_BYTES) {
+                // Envelope checks deliberately precede typed payload handling.
+                if (new TextEncoder().encode(frame).byteLength > maxFrameBytes) {
+                    return { ok: false, error: "FRAME_TOO_LARGE" };
+                }
+                if (hasDuplicateTopLevelSecurityKey(frame)) {
+                    return { ok: false, error: "MALFORMED_ENVELOPE" };
+                }
+                let candidate;
+                try {
+                    candidate = JSON.parse(frame);
+                }
+                catch {
+                    return { ok: false, error: "MALFORMED_ENVELOPE" };
+                }
+                if (!isRecord(candidate))
+                    return { ok: false, error: "MALFORMED_ENVELOPE" };
+                if (candidate.v !== V3_PROTOCOL) {
+                    return { ok: false, error: "UNSUPPORTED_VERSION" };
+                }
+                if (typeof candidate.kind !== "string" ||
+                    !nativeToDocumentKinds.has(candidate.kind)) {
+                    return { ok: false, error: "UNSUPPORTED_NATIVE_KIND" };
+                }
+                if (typeof candidate.sessionId !== "string" || candidate.sessionId.length === 0) {
+                    return { ok: false, error: "MALFORMED_ENVELOPE" };
+                }
+                if (candidate.sessionId !== sessionId)
+                    return { ok: false, error: "SESSION_MISMATCH" };
+                if (Object.prototype.hasOwnProperty.call(candidate, "secret")) {
+                    return { ok: false, error: "UNEXPECTED_SECRET" };
+                }
+                const { v: _v, kind: _kind, sessionId: _sessionId, ...payload } = candidate;
+                return {
+                    ok: true,
+                    value: { kind: candidate.kind, payload },
+                };
+            },
+        },
+    };
+}
+/**
+ * Atomically takes the host-installed one-shot handoff. The secret remains in
+ * the returned codec closure and is never copied into bridge globals/config.
+ */
+export function consumeV3Bootstrap() {
+    if (typeof window === "undefined")
+        return { kind: "absent" };
+    const take = window.__LingXiaTakeControlBootstrap;
+    if (typeof take !== "function")
+        return { kind: "absent" };
+    try {
+        const bootstrap = take();
+        if (!bootstrap ||
+            bootstrap.requiredProtocol !== V3_PROTOCOL ||
+            typeof bootstrap.publicSessionId !== "string" ||
+            bootstrap.publicSessionId.length === 0 ||
+            typeof bootstrap.secret !== "string" ||
+            bootstrap.secret.length === 0) {
+            return { kind: "blocked" };
+        }
+        const codec = createV3DocumentCodec({
+            sessionId: bootstrap.publicSessionId,
+            secret: bootstrap.secret,
+        });
+        return codec.ok
+            ? { kind: "required", codec: codec.value }
+            : { kind: "blocked" };
+    }
+    catch {
+        return { kind: "blocked" };
+    }
+    finally {
+        // A malformed replacement must not leave a callable handoff for later.
+        try {
+            delete window.__LingXiaTakeControlBootstrap;
+        }
+        catch {
+            // A hostile non-configurable property has no attested secret to retain.
+        }
+    }
+}

package/dist/es2020/runtime-env.js

@@ -42,7 +42,7 @@ function applyDisplayLanguage(next) {
     current.value = normalized;
     stampDocumentLanguage();
     for (const listener of [...current.listeners])
-        listener();
+        listener(normalized);
 }
 if (typeof window !== 'undefined' && !window.__lingxiaApplyDisplayLanguage) {
     Object.defineProperty(window, '__lingxiaApplyDisplayLanguage', {
@@ -54,7 +54,14 @@ if (typeof window !== 'undefined' && !window.__lingxiaApplyDisplayLanguage) {
 export function getDisplayLanguage() {
     return store().value;
 }
-/** Subscribe to host display-language changes. Returns an unsubscribe. */
+/**
+ * Subscribe to host display-language changes. Returns an unsubscribe.
+ *
+ * Change-only, so that this composes with `useSyncExternalStore`: the listener
+ * runs when the language changes, never on subscribe. Read the current value
+ * with `getDisplayLanguage()`. Logic's `lx.app.displayLanguage.watch` differs
+ * deliberately — it has no render loop to feed, so it delivers immediately.
+ */
 export function subscribeDisplayLanguage(listener) {
     const listeners = store().listeners;
     listeners.add(listener);
@@ -65,6 +72,23 @@ export function subscribeDisplayLanguage(listener) {
 export function getPlatformOS() {
     return BRIDGE_CONFIG.os || 'unknown';
 }
+/**
+ * Which kind of machine this is, mobile or desktop. Read through `isMobile()`
+ * and `isDesktop()`; the class itself is host vocabulary, not lxapp API.
+ *
+ * Fixed for the life of the document. A shipped host is one machine; the
+ * Runner re-serves the page when its simulated device changes class, so this
+ * never has to change under a page that is already rendering.
+ *
+ * Hosts from before this config key shipped send nothing, so fall back to the
+ * OS: every one of them is the machine it names.
+ */
+function hostClass() {
+    if (BRIDGE_CONFIG.hostClass === 'mobile' || BRIDGE_CONFIG.hostClass === 'desktop') {
+        return BRIDGE_CONFIG.hostClass;
+    }
+    return BRIDGE_CONFIG.os === 'macOS' || BRIDGE_CONFIG.os === 'Windows' ? 'desktop' : 'mobile';
+}
 export function isHarmony() {
     return BRIDGE_CONFIG.os === 'Harmony';
 }
@@ -80,8 +104,13 @@ export function isMacOS() {
 export function isWindows() {
     return BRIDGE_CONFIG.os === 'Windows';
 }
+// Form factor, not OS: the Runner shows a real macOS/Windows build inside a
+// phone frame, and a page that keyed off the OS would keep its desktop layout.
 export function isDesktop() {
-    return isMacOS() || isWindows();
+    return hostClass() === 'desktop';
+}
+export function isMobile() {
+    return hostClass() === 'mobile';
 }
 // iOS and macOS share the WKWebView transport, so features scoped to it (e.g.
 // the streaming downstream) key off this rather than the two OS checks.

package/dist/es2020/types.js

@@ -13,4 +13,5 @@ export const BRIDGE_ERROR = {
     OUTBOX_FULL: 'BRIDGE_OUTBOX_FULL',
     STREAM_OVERFLOW: 'BRIDGE_STREAM_OVERFLOW',
     STREAM_CLOSED: 'BRIDGE_STREAM_CLOSED',
+    MESSAGE_TOO_LARGE: 'BRIDGE_MESSAGE_TOO_LARGE',
 };