npm - @nativewindow/ipc - Versions diffs - 0.1.1 - Mend

@nativewindow/ipc 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/LICENSE ADDED Viewed

@@ -0,0 +1,21 @@
+MIT License
+Copyright (c) 2026 Francesco Saverio Cannizzaro
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md ADDED Viewed

@@ -0,0 +1,131 @@
+# @nativewindow/ipc
+[![npm](https://img.shields.io/npm/v/@nativewindow/ipc)](https://www.npmjs.com/package/@nativewindow/ipc)
+> [!WARNING]
+> This project is in **alpha**. APIs may change without notice.
+Pure TypeScript typesafe IPC channel layer for [native-window](https://github.com/nativewindow/webview). Schema-based validation with compile-time checked event maps.
+## Install
+```bash
+bun add @nativewindow/ipc
+# or
+deno add npm:@nativewindow/ipc
+```
+## Host side (Bun/Deno/Node)
+```ts
+import { z } from "zod";
+import { createWindow } from "@nativewindow/ipc";
+const ch = createWindow(
+  { title: "Typed IPC" },
+  {
+    schemas: {
+      "user-click": z.object({ x: z.number(), y: z.number() }),
+      "update-title": z.string(),
+      counter: z.number(),
+    },
+  },
+);
+ch.on("user-click", (pos) => {
+  // pos: { x: number; y: number }
+  console.log(`Click at ${pos.x}, ${pos.y}`);
+});
+ch.on("counter", (n) => {
+  // n: number
+  ch.send("update-title", `Count: ${n}`);
+});
+// ch.send("counter", "wrong");      // Type error!
+// ch.send("typo", 123);             // Type error!
+ch.window.loadHtml(`<html>...</html>`);
+```
+## Webview side (inline HTML)
+The `__channel__` object is auto-injected by `createWindow` / `createChannel`:
+```html
+<script>
+  __channel__.send("user-click", { x: 10, y: 20 });
+  __channel__.on("update-title", (title) => {
+    document.title = title;
+  });
+</script>
+```
+## Webview side (bundled app)
+For webview apps bundled with their own build step, import the client directly:
+```ts
+import { z } from "zod";
+import { createChannelClient } from "@nativewindow/ipc/client";
+const ch = createChannelClient({
+  schemas: {
+    counter: z.number(),
+    "update-title": z.string(),
+  },
+});
+ch.send("counter", 42); // Typed!
+ch.on("update-title", (t) => {
+  // t: string
+  document.title = t;
+});
+```
+## API
+### `createChannel(win, options)`
+Wrap an existing `NativeWindow` with a typed message channel. Auto-injects the webview client script.
+### `createWindow(windowOptions, channelOptions)`
+Convenience: creates a `NativeWindow` and wraps it with `createChannel`.
+### `getClientScript(options?)`
+Returns the webview-side client as a self-contained JS string for manual injection.
+### `createChannelClient(options)` (from `/client`)
+Create a typed channel client inside the webview for use in bundled apps.
+### Channel Options
+| Option                 | Type        | Default    | Description                            |
+| ---------------------- | ----------- | ---------- | -------------------------------------- |
+| `schemas`              | `SchemaMap` | _required_ | Schema definitions for each event type |
+| `injectClient`         | `boolean`   | `true`     | Auto-inject client script into webview |
+| `onValidationError`    | `function`  | —          | Called when a payload fails validation |
+| `trustedOrigins`       | `string[]`  | —          | Restrict IPC to specific origins       |
+| `maxMessageSize`       | `number`    | `1048576`  | Max message size in bytes              |
+| `rateLimit`            | `number`    | —          | Max messages per second                |
+| `maxListenersPerEvent` | `number`    | —          | Max listeners per event type           |
+| `channelId`            | `string`    | —          | Unique channel identifier              |
+### Schema Support
+Any schema library implementing the [Standard Schema](https://github.com/standard-schema/standard-schema) interface is supported, including:
+- [Zod](https://zod.dev) v4
+- [Valibot](https://valibot.dev) v1
+- [ArkType](https://arktype.io) v2
+## Documentation
+Full documentation at [nativewindow.fcannizzaro.com](https://nativewindow.fcannizzaro.com)
+## License
+MIT

package/dist/client.d.ts ADDED Viewed

@@ -0,0 +1,58 @@
+import { TypedChannel, ValidationErrorHandler, SchemaMap, InferSchemaMap } from '.';
+declare global {
+    interface Window {
+        __channel__?: TypedChannel<any>;
+        __native_message__?: (msg: string) => void;
+        __native_message_listeners__?: {
+            add(fn: (msg: string) => void): void;
+            remove(fn: (msg: string) => void): void;
+        };
+        ipc: {
+            postMessage(msg: string): void;
+        };
+    }
+}
+/**
+ * Options for {@link createChannelClient}.
+ * The `schemas` field is required — it provides both TypeScript types
+ * and runtime validation for incoming payloads from the host.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * const ch = createChannelClient({
+ *   schemas: { counter: z.number(), title: z.string() },
+ * });
+ * ```
+ */
+export interface ChannelClientOptions<S extends SchemaMap> {
+    /** Schemas for incoming events. Provides types and runtime validation. */
+    schemas: S;
+    /**
+     * Called when an incoming payload fails schema validation.
+     * If not provided, failed payloads are silently dropped.
+     */
+    onValidationError?: ValidationErrorHandler;
+}
+/**
+ * Create a typed channel client for use inside the webview.
+ * Call this once; it hooks into the native IPC bridge.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import { createChannelClient } from "native-window-ipc/client";
+ *
+ * const ch = createChannelClient({
+ *   schemas: {
+ *     "user-click": z.object({ x: z.number(), y: z.number() }),
+ *     "update-title": z.string(),
+ *   },
+ * });
+ *
+ * ch.on("update-title", (title) => {
+ *   document.title = title;
+ * });
+ * ```
+ */
+export declare function createChannelClient<S extends SchemaMap>(options: ChannelClientOptions<S>): TypedChannel<InferSchemaMap<S>>;

package/dist/client.js ADDED Viewed

@@ -0,0 +1,127 @@
+const MAX_MESSAGE_SIZE = 1048576;
+function encode(type, payload) {
+  return JSON.stringify({ $ch: type, p: payload });
+}
+const DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function decode(raw) {
+  if (raw.length > MAX_MESSAGE_SIZE) return null;
+  try {
+    const parsed = JSON.parse(
+      raw,
+      (key, value) => DANGEROUS_KEYS.has(key) ? void 0 : value
+    );
+    if (typeof parsed === "object" && parsed !== null && "$ch" in parsed && typeof parsed.$ch === "string") {
+      return parsed;
+    }
+  } catch {
+  }
+  return null;
+}
+function validatePayload(schema, data) {
+  const result = schema.safeParse(data);
+  return result.success ? { success: true, data: result.data } : { success: false };
+}
+function createChannelClient(options) {
+  const { schemas, onValidationError } = options;
+  const _push = Array.prototype.push;
+  const _indexOf = Array.prototype.indexOf;
+  const _splice = Array.prototype.splice;
+  const listeners = /* @__PURE__ */ new Map();
+  const channel = {
+    send(...args) {
+      const [type, payload] = args;
+      window.ipc.postMessage(encode(type, payload));
+    },
+    on(type, handler) {
+      let set = listeners.get(type);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        listeners.set(type, set);
+      }
+      set.add(handler);
+    },
+    off(type, handler) {
+      const set = listeners.get(type);
+      if (set) set.delete(handler);
+    }
+  };
+  const externalListeners = [];
+  const orig = window.__native_message__;
+  try {
+    Object.defineProperty(window, "__native_message__", {
+      value(msg) {
+        const env = decode(msg);
+        if (env) {
+          if (!(env.$ch in schemas)) {
+            for (const fn of externalListeners) {
+              try {
+                fn(msg);
+              } catch {
+              }
+            }
+            orig?.(msg);
+            return;
+          }
+          const set = listeners.get(env.$ch);
+          if (set) {
+            const schema = schemas[env.$ch];
+            let validatedPayload = env.p;
+            if (schema) {
+              const result = validatePayload(schema, env.p);
+              if (!result.success) {
+                onValidationError?.(env.$ch, env.p);
+                return;
+              }
+              validatedPayload = result.data;
+            }
+            for (const fn of set) {
+              try {
+                fn(validatedPayload);
+              } catch {
+              }
+            }
+            return;
+          }
+        }
+        for (const fn of externalListeners) {
+          try {
+            fn(msg);
+          } catch {
+          }
+        }
+        orig?.(msg);
+      },
+      writable: false,
+      configurable: false
+    });
+  } catch {
+  }
+  try {
+    Object.defineProperty(window, "__native_message_listeners__", {
+      value: Object.freeze({
+        add(fn) {
+          if (typeof fn === "function") _push.call(externalListeners, fn);
+        },
+        remove(fn) {
+          const idx = _indexOf.call(externalListeners, fn);
+          if (idx !== -1) _splice.call(externalListeners, idx, 1);
+        }
+      }),
+      writable: false,
+      configurable: false
+    });
+  } catch {
+  }
+  try {
+    Object.defineProperty(window, "__channel__", {
+      value: channel,
+      writable: false,
+      configurable: false
+    });
+  } catch {
+  }
+  return channel;
+}
+export {
+  createChannelClient
+};

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,270 @@
+import { NativeWindow, WindowOptions } from '@nativewindow/webview';
+/** User-defined map of event name -> payload type. */
+export type EventMap = Record<string, unknown>;
+/**
+ * A schema that can validate data at runtime via `safeParse()`.
+ * Compatible with Zod v4, Valibot v1, and any library exposing
+ * a `safeParse` method returning `{ success: boolean; data?: T }`.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * const schema: SchemaLike = z.string(); // compatible
+ * ```
+ */
+export interface SchemaLike {
+    safeParse(data: unknown): {
+        success: true;
+        data: unknown;
+    } | {
+        success: false;
+        error?: unknown;
+    };
+}
+/**
+ * Map of event names to schemas.
+ * TypeScript types are derived from the schemas via {@link InferSchemaMap}.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * const schemas = {
+ *   ping: z.string(),
+ *   pong: z.number(),
+ *   data: z.object({ x: z.number(), y: z.number() }),
+ * } satisfies SchemaMap;
+ * ```
+ */
+export type SchemaMap = Record<string, SchemaLike>;
+/**
+ * Infer the output type from a single schema.
+ * Supports Zod v4 (`_zod.output`), Valibot v1 (`_types.output`),
+ * and the Standard Schema spec (`~standard.types.output`).
+ * Falls back to `unknown` for unrecognized schema shapes.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * type S = InferOutput<typeof z.string()>; // string
+ * ```
+ */
+export type InferOutput<S> = S extends {
+    _zod: {
+        output: infer T;
+    };
+} ? T : S extends {
+    _types?: {
+        output: infer T;
+    };
+} ? T : S extends {
+    "~standard": {
+        types?: {
+            output: infer T;
+        };
+    };
+} ? T : unknown;
+/**
+ * Derive an {@link EventMap} from a {@link SchemaMap}.
+ * Each key maps to the inferred output type of its schema.
+ *
+ * @example
+ * ```ts
+ * const schemas = { ping: z.string(), pong: z.number() };
+ * type Events = InferSchemaMap<typeof schemas>;
+ * // ^? { ping: string; pong: number }
+ * ```
+ */
+export type InferSchemaMap<S extends SchemaMap> = {
+    [K in keyof S & string]: InferOutput<S[K]>;
+};
+/**
+ * Called when a payload fails runtime validation.
+ *
+ * @example
+ * ```ts
+ * const onError: ValidationErrorHandler = (type, payload) => {
+ *   console.warn(`Invalid payload for "${type}":`, payload);
+ * };
+ * ```
+ */
+export type ValidationErrorHandler = (type: string, payload: unknown) => void;
+/**
+ * Argument tuple for {@link TypedChannel.send}.
+ * When the payload type is `void` or `never`, the payload argument is
+ * optional — callers can write `send("ping")` instead of `send("ping", undefined)`.
+ *
+ * @internal
+ */
+export type SendArgs<T extends EventMap, K extends keyof T & string> = [T[K]] extends [void | never] ? [type: K] | [type: K, payload: T[K]] : [type: K, payload: T[K]];
+/** Typed channel interface (shared shape for both host and webview sides). */
+export interface TypedChannel<T extends EventMap> {
+    /** Send a typed message. */
+    send<K extends keyof T & string>(...args: SendArgs<T, K>): void;
+    /** Register a handler for a typed message. */
+    on<K extends keyof T & string>(type: K, handler: (payload: T[K]) => void): void;
+    /** Remove a handler for a typed message. */
+    off<K extends keyof T & string>(type: K, handler: (payload: T[K]) => void): void;
+}
+/** Host-side channel wrapping a NativeWindow. */
+export interface NativeWindowChannel<T extends EventMap> extends TypedChannel<T> {
+    /** The underlying NativeWindow instance. */
+    readonly window: NativeWindow;
+}
+/**
+ * Options for {@link createChannel}.
+ * The `schemas` field is required — it provides both TypeScript types
+ * and runtime validation for each event.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * const ch = createChannel(win, {
+ *   schemas: { ping: z.string(), pong: z.number() },
+ * });
+ * ch.send("ping", "hello"); // typed from schema
+ * ```
+ */
+export interface ChannelOptions<S extends SchemaMap> {
+    /** Schemas for each event. Provides both TypeScript types and runtime validation. */
+    schemas: S;
+    /** Inject the client script into the webview automatically. Default: true */
+    injectClient?: boolean;
+    /**
+     * Called when an incoming payload fails schema validation.
+     * If not provided, failed payloads are silently dropped.
+     */
+    onValidationError?: ValidationErrorHandler;
+    /**
+     * Restrict client script injection to pages from these origins.
+     * Each entry should be an origin string (e.g. `"https://example.com"`).
+     * When set and `injectClient` is true, the client script is only
+     * re-injected on page load if the page URL's origin matches.
+     * When set, the initial injection is deferred until the first
+     * trusted page load to prevent exposing the IPC bridge to
+     * untrusted origins.
+     *
+     * Origins should not include a trailing slash. The `about:blank` and
+     * `data:` URLs have an origin of `"null"` — they will not match unless
+     * `"null"` is explicitly listed.
+     *
+     * @security Use this to prevent the IPC bridge from being available on
+     * untrusted pages after navigation.
+     *
+     * @example
+     * ```ts
+     * createChannel(win, {
+     *   schemas: { ping: z.string() },
+     *   trustedOrigins: ["https://myapp.com", "https://cdn.myapp.com"],
+     * });
+     * ```
+     */
+    trustedOrigins?: string[];
+    /**
+     * Maximum allowed size (in characters) for incoming IPC messages.
+     * Messages exceeding this limit are silently dropped.
+     * Default: 1 MB (1_048_576 characters).
+     *
+     * @security Prevents memory exhaustion from oversized payloads.
+     */
+    maxMessageSize?: number;
+    /**
+     * Maximum number of incoming messages allowed per second.
+     * When the limit is exceeded, additional messages are silently dropped
+     * until the window slides forward. Default: unlimited.
+     *
+     * @security Prevents flooding from malicious webview content.
+     */
+    rateLimit?: number;
+    /**
+     * Maximum number of listeners allowed per event type.
+     * Calls to `on()` that would exceed this limit are silently ignored.
+     * Default: unlimited.
+     *
+     * @security Prevents unbounded memory growth from listener leaks.
+     */
+    maxListenersPerEvent?: number;
+    /**
+     * Channel namespace identifier. When set, all `$ch` values in the IPC
+     * envelope are prefixed with `channelId:`, preventing malicious scripts
+     * from sending messages that match known event types.
+     *
+     * - Pass a string to use a fixed namespace.
+     * - Pass `true` to auto-generate a random 8-character nonce.
+     * - Leave undefined to use the original (unprefixed) envelope format.
+     *
+     * The injected client script (via `getClientScript`) will include the
+     * same prefix, so host and client stay in sync automatically.
+     *
+     * @security Prevents channel name collision / namespace squatting
+     * from untrusted scripts in the webview.
+     */
+    channelId?: string | true;
+}
+/**
+ * Returns the webview-side channel client as a self-contained JS string.
+ * This is the same logic as `client.ts`, minified for injection.
+ * Can also be embedded in a `<script>` tag manually.
+ *
+ * When `options.channelId` is provided, the injected script prefixes all
+ * `$ch` values with the channel ID, matching the host-side behavior.
+ *
+ * **Note:** The injected client does not support payload validation.
+ * For client-side validation, use the bundled {@link createChannelClient}
+ * import from `native-window-ipc/client` with the `schemas` option.
+ *
+ * @example
+ * ```ts
+ * // Without namespace (default)
+ * const script = getClientScript();
+ *
+ * // With namespace
+ * const script = getClientScript({ channelId: "abc123" });
+ * ```
+ */
+export declare function getClientScript(options?: {
+    channelId?: string;
+}): string;
+/**
+ * Wrap an existing NativeWindow with a typed message channel.
+ *
+ * Schemas are required — they provide both TypeScript types and runtime
+ * validation for each event. Compatible with Zod v4, Valibot v1, and
+ * any schema library implementing the `safeParse()` interface.
+ *
+ * @security **Origin restriction:** When `trustedOrigins` is configured,
+ * both client script injection and incoming IPC messages are restricted to
+ * pages whose URL origin matches the whitelist. The native `onMessage`
+ * callback now includes the source page URL, enabling the channel to reject
+ * messages from untrusted origins. Empty source URLs (e.g. `about:blank`,
+ * `data:` URIs) are treated as untrusted when `trustedOrigins` is set.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import { createChannel } from "native-window-ipc";
+ *
+ * const ch = createChannel(win, {
+ *   schemas: { ping: z.string(), pong: z.number() },
+ * });
+ * ch.send("ping", "hello");       // typed from schema
+ * ch.on("pong", (n) => {});       // n: number
+ * ```
+ */
+export declare function createChannel<S extends SchemaMap>(win: NativeWindow, options: ChannelOptions<S>): NativeWindowChannel<InferSchemaMap<S>>;
+/**
+ * Create a new NativeWindow and immediately wrap it with a typed channel.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod";
+ * import { createWindow } from "native-window-ipc";
+ *
+ * const ch = createWindow(
+ *   { title: "My App" },
+ *   { schemas: { counter: z.number(), title: z.string() } },
+ * );
+ * ch.send("counter", 42); // typed from schema
+ * ch.window.loadHtml("<html>...</html>");
+ * ```
+ */
+export declare function createWindow<S extends SchemaMap>(windowOptions: WindowOptions | undefined, channelOptions: ChannelOptions<S>): NativeWindowChannel<InferSchemaMap<S>>;

package/dist/index.js ADDED Viewed

@@ -0,0 +1,175 @@
+import { NativeWindow } from "@nativewindow/webview";
+const MAX_MESSAGE_SIZE = 1048576;
+function validatePayload(schema, data) {
+  const result = schema.safeParse(data);
+  return result.success ? { success: true, data: result.data } : { success: false };
+}
+function isEnvelope(data) {
+  return typeof data === "object" && data !== null && "$ch" in data && typeof data.$ch === "string";
+}
+function encode(type, payload) {
+  return JSON.stringify({ $ch: type, p: payload });
+}
+const DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function decode(raw, maxSize = MAX_MESSAGE_SIZE) {
+  if (raw.length > maxSize) return null;
+  try {
+    const parsed = JSON.parse(
+      raw,
+      (key, value) => DANGEROUS_KEYS.has(key) ? void 0 : value
+    );
+    return isEnvelope(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOrigin(origin) {
+  try {
+    const o = new URL(origin).origin;
+    return o === "null" ? null : o;
+  } catch {
+    return null;
+  }
+}
+function isOriginTrusted(url, trustedOrigins) {
+  try {
+    const parsed = new URL(url);
+    return trustedOrigins.includes(parsed.origin);
+  } catch {
+    return false;
+  }
+}
+function getClientScript(options) {
+  const prefix = options?.channelId ?? "";
+  const prefixLiteral = JSON.stringify(prefix);
+  return `(function(){
+var _slice=Array.prototype.slice;
+var _filter=Array.prototype.filter;
+var _push=Array.prototype.push;
+var _indexOf=Array.prototype.indexOf;
+var _splice=Array.prototype.splice;
+var _pfx=${prefixLiteral};
+var _l=Object.create(null);
+var _el=[];
+function _e(t,p){return JSON.stringify({$ch:_pfx?_pfx+":"+t:t,p:p})}
+function _d(r){if(r.length>1048576)return null;var _dk={__proto__:1,constructor:1,prototype:1};try{var o=JSON.parse(r,function(k,v){return _dk[k]?void 0:v});if(o&&typeof o.$ch==="string")return o}catch(e){}return null}
+function _uch(ch){if(!_pfx)return ch;if(ch.indexOf(_pfx+":")===0)return ch.slice(_pfx.length+1);return null}
+var ch={
+send:function(t,p){window.ipc.postMessage(_e(t,p))},
+on:function(t,h){if(!_l[t])_l[t]=[];_push.call(_l[t],h)},
+off:function(t,h){if(!_l[t])return;_l[t]=_filter.call(_l[t],function(f){return f!==h})}
+};
+var _orig=window.__native_message__;
+try{Object.defineProperty(window,'__native_message__',{value:function(msg){
+var env=_d(msg);
+if(env){var key=_uch(env.$ch);if(key!==null&&_l[key]){var fns=_slice.call(_l[key]);for(var i=0;i<fns.length;i++){try{fns[i](env.p)}catch(e){}}}
+else{for(var j=0;j<_el.length;j++){try{_el[j](msg)}catch(e){}}if(_orig){_orig(msg)}}}
+else{for(var j=0;j<_el.length;j++){try{_el[j](msg)}catch(e){}}if(_orig){_orig(msg)}}
+},writable:false,configurable:false})}catch(e){console.error('[native-window] Failed to define __native_message__:',e)}
+try{Object.defineProperty(window,'__native_message_listeners__',{value:Object.freeze({add:function(fn){if(typeof fn==='function')_push.call(_el,fn)},remove:function(fn){var i=_indexOf.call(_el,fn);if(i!==-1)_splice.call(_el,i,1)}}),writable:false,configurable:false})}catch(e){console.error('[native-window] Failed to define __native_message_listeners__:',e)}
+try{Object.defineProperty(window,'__channel__',{value:Object.freeze(ch),writable:false,configurable:false})}catch(e){console.error('[native-window] Failed to define __channel__:',e)}
+})();`;
+}
+function createChannel(win, options) {
+  const {
+    schemas,
+    injectClient = true,
+    onValidationError,
+    trustedOrigins,
+    maxMessageSize,
+    rateLimit,
+    maxListenersPerEvent,
+    channelId: channelIdOpt
+  } = options;
+  const channelId = channelIdOpt === true ? crypto.randomUUID().replace(/-/g, "").slice(0, 16) : channelIdOpt ?? "";
+  const normalizedOrigins = trustedOrigins?.map(normalizeOrigin).filter((o) => o !== null);
+  const prefixCh = (type) => channelId ? `${channelId}:${type}` : type;
+  const unprefixCh = (ch) => {
+    if (!channelId) return ch;
+    const pfx = `${channelId}:`;
+    return ch.startsWith(pfx) ? ch.slice(pfx.length) : null;
+  };
+  const listeners = /* @__PURE__ */ new Map();
+  let _bucketTokens = rateLimit ?? 0;
+  let _bucketLastRefill = Date.now();
+  win.onMessage((raw, sourceUrl) => {
+    if (rateLimit !== void 0 && rateLimit > 0) {
+      const now = Date.now();
+      const elapsed = now - _bucketLastRefill;
+      if (elapsed >= 1e3) {
+        _bucketTokens = rateLimit;
+        _bucketLastRefill = now;
+      }
+      if (_bucketTokens <= 0) return;
+      _bucketTokens--;
+    }
+    const env = decode(raw, maxMessageSize);
+    if (!env) return;
+    const eventType = unprefixCh(env.$ch);
+    if (eventType === null) return;
+    if (normalizedOrigins && normalizedOrigins.length > 0) {
+      if (!isOriginTrusted(sourceUrl, normalizedOrigins)) return;
+    }
+    const set = listeners.get(eventType);
+    if (!set) return;
+    if (!(eventType in schemas)) return;
+    const schema = schemas[eventType];
+    let validatedPayload = env.p;
+    if (schema) {
+      const result = validatePayload(schema, env.p);
+      if (!result.success) {
+        onValidationError?.(eventType, env.p);
+        return;
+      }
+      validatedPayload = result.data;
+    }
+    for (const fn of set) {
+      try {
+        fn(validatedPayload);
+      } catch {
+      }
+    }
+  });
+  if (injectClient) {
+    if (!normalizedOrigins || normalizedOrigins.length === 0) {
+      win.unsafe.evaluateJs(getClientScript({ channelId: channelId || void 0 }));
+    }
+    win.onPageLoad((event, url) => {
+      if (event !== "finished") return;
+      if (normalizedOrigins && normalizedOrigins.length > 0) {
+        if (!isOriginTrusted(url, normalizedOrigins)) return;
+      }
+      win.unsafe.evaluateJs(getClientScript({ channelId: channelId || void 0 }));
+    });
+  }
+  return {
+    window: win,
+    send(...args) {
+      const [type, payload] = args;
+      win.postMessage(encode(prefixCh(type), payload));
+    },
+    on(type, handler) {
+      if (!(type in schemas)) return;
+      let set = listeners.get(type);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        listeners.set(type, set);
+      }
+      if (maxListenersPerEvent !== void 0 && set.size >= maxListenersPerEvent) return;
+      set.add(handler);
+    },
+    off(type, handler) {
+      const set = listeners.get(type);
+      if (set) set.delete(handler);
+    }
+  };
+}
+function createWindow(windowOptions, channelOptions) {
+  const win = new NativeWindow(windowOptions);
+  return createChannel(win, channelOptions);
+}
+export {
+  createChannel,
+  createWindow,
+  getClientScript
+};

package/package.json ADDED Viewed

@@ -0,0 +1,66 @@
+{
+  "name": "@nativewindow/ipc",
+  "version": "0.1.1",
+  "description": "Typesafe IPC channels for native-window (alpha)",
+  "homepage": "https://nativewindow.fcannizzaro.com",
+  "bugs": {
+    "url": "https://github.com/nativewindow/webview/issues"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Francesco Saverio Cannizzaro (fcannizzaro)",
+    "url": "https://fcannizzaro.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nativewindow/webview/tree/main/packages/ipc"
+  },
+  "funding": [
+    {
+      "type": "patreon",
+      "url": "https://www.patreon.com/fcannizzaro"
+    }
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    }
+  },
+  "scripts": {
+    "test": "vitest run",
+    "build": "vite build",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.9",
+    "arktype": "^2.1.20",
+    "valibot": "^1.2.0",
+    "vite": "^7.3.1",
+    "vite-plugin-dts": "^4.5.4",
+    "vitest": "^4.0.18",
+    "zod": "^4.3.6"
+  },
+  "peerDependencies": {
+    "@nativewindow/webview": "workspace:*",
+    "typescript": "^5",
+    "zod": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "zod": {
+      "optional": true
+    }
+  }
+}