@ogygia/devtools 0.0.0 → 0.11.1

package/dist/profiler/ui/permalink.js

@@ -0,0 +1,108 @@
+// src/profiler/ui/permalink.ts
+/**
+* The `#fragment` permalink codec — a zero-knowledge, zero-infra way to SHARE a profiler report as a
+* URL instead of an `.ogp` file. The whole encrypted report rides in the URL fragment (`…/view#<blob>`),
+* which browsers NEVER send to any server — so the report lives entirely in the link (permanent, no
+* storage) and neither the profiler's server nor anyone else sees the plaintext or the password.
+*
+* BROWSER-NATIVE by necessity (encode runs in the sharer's browser, decode in the recipient's): JS has
+* no Brotli, so this uses **gzip** (`CompressionStream`) + **AES-256-GCM** with a key from **PBKDF2**
+* (Web Crypto — the Node `.ogp` path uses scrypt, which `crypto.subtle` can't do). Slightly larger than
+* the Brotli `.ogp`, but portable to Chrome / Firefox / Safari alike.
+*
+* Layout (pre-base64url):  'OGL1' (4) · salt (16) · iv (12) · AES-GCM ciphertext+tag.
+*/
+const PLUS_G = /\+/g;
+const SLASH_G = /\//g;
+const TRAILING_EQUALS_RE = /=+$/;
+const DASH_G = /-/g;
+const UNDERSCORE_G = /_/g;
+const IOS_UA_RE = /iP(hone|ad|od)/;
+const SAFARI_UA_RE = /^((?!chrome|chromium|android|crios|fxios|edg).)*safari/i;
+const MAGIC = new Uint8Array([
+	79,
+	71,
+	76,
+	49
+]);
+const PBKDF2_ITERS = 21e4;
+const subtle = () => globalThis.crypto.subtle;
+const buf = (u) => u;
+const part = (u) => u;
+async function gzip(bytes) {
+	const cs = new CompressionStream("gzip");
+	const blob = await new Response(new Blob([part(bytes)]).stream().pipeThrough(cs)).arrayBuffer();
+	return new Uint8Array(blob);
+}
+async function gunzip(bytes) {
+	const ds = new DecompressionStream("gzip");
+	const blob = await new Response(new Blob([part(bytes)]).stream().pipeThrough(ds)).arrayBuffer();
+	return new Uint8Array(blob);
+}
+async function derive_key(password, salt, usage) {
+	const base = await subtle().importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]);
+	return subtle().deriveKey({
+		name: "PBKDF2",
+		salt: buf(salt),
+		iterations: PBKDF2_ITERS,
+		hash: "SHA-256"
+	}, base, {
+		name: "AES-GCM",
+		length: 256
+	}, false, [usage]);
+}
+/** base64url (no padding) — URL-fragment safe (`+/=` → `-_` dropped). */
+function b64url_encode(bytes) {
+	let s = "";
+	for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+	return btoa(s).replace(PLUS_G, "-").replace(SLASH_G, "_").replace(TRAILING_EQUALS_RE, "");
+}
+function b64url_decode(str) {
+	const s = str.replace(DASH_G, "+").replace(UNDERSCORE_G, "/");
+	const bin = atob(s + "===".slice((s.length + 3) % 4));
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
+/** Encrypt a report dump for a permalink: gzip → AES-GCM(PBKDF2(password)) → base64url. */
+async function encode_permalink(dump, password) {
+	const plain = await gzip(new TextEncoder().encode(JSON.stringify(dump)));
+	const salt = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const iv = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const key = await derive_key(password, salt, "encrypt");
+	const ct = new Uint8Array(await subtle().encrypt({
+		name: "AES-GCM",
+		iv: buf(iv)
+	}, key, buf(plain)));
+	const out = new Uint8Array(MAGIC.length + salt.length + iv.length + ct.length);
+	out.set(MAGIC, 0);
+	out.set(salt, MAGIC.length);
+	out.set(iv, MAGIC.length + salt.length);
+	out.set(ct, MAGIC.length + salt.length + iv.length);
+	return b64url_encode(out);
+}
+/** Reverse of {@link encode_permalink}. Throws on a wrong password / tampered blob (GCM tag fails). */
+async function decode_permalink(blob, password) {
+	const bytes = b64url_decode(blob);
+	if (bytes.length < 4 || bytes[0] !== 79 || bytes[1] !== 71 || bytes[2] !== 76 || bytes[3] !== 49) throw new Error("not an ogygia share link");
+	const salt = bytes.subarray(4, 20);
+	const iv = bytes.subarray(20, 32);
+	const ct = bytes.subarray(32);
+	const key = await derive_key(password, salt, "decrypt");
+	const plain = new Uint8Array(await subtle().decrypt({
+		name: "AES-GCM",
+		iv: buf(iv)
+	}, key, buf(ct)));
+	return JSON.parse(new TextDecoder().decode(await gunzip(plain)));
+}
+/** All-WebKit browsers (desktop Safari + EVERY iOS browser) hard-error past ~80 K URL chars, too small
+*  for a real report — so universal links are disabled there. Chromium (~2 MB) and Firefox handle it. */
+function is_webkit_capped() {
+	const ua = navigator.userAgent;
+	const ios = IOS_UA_RE.test(ua);
+	const safari = SAFARI_UA_RE.test(ua);
+	return ios || safari;
+}
+/** Chromium tops out at a 2 MB URL; keep a safe margin. Fragment chars ≈ blob length (all ASCII). */
+const MAX_PERMALINK_CHARS = 15e5;
+export { MAX_PERMALINK_CHARS, decode_permalink, encode_permalink, is_webkit_capped };

package/dist/profiler/ui/press.d.ts

@@ -0,0 +1,5 @@
+import { Attachment } from "svelte/attachments";
+/** The keys alone, as an `onkeydown` handler: for an element whose markup already gives it its
+ *  role and `tabindex="0"`, so the compiler sees the keyboard path next to the click. */
+export declare const press_key: (e: Event) => void;
+export declare const pressable: Attachment<HTMLElement | SVGElement>;

package/dist/profiler/ui/press.js

@@ -0,0 +1,19 @@
+// src/profiler/ui/press.ts
+/** The keys alone, as an `onkeydown` handler: for an element whose markup already gives it its
+*  role and `tabindex="0"`, so the compiler sees the keyboard path next to the click. */
+const press_key = (e) => {
+	const node = e.currentTarget;
+	const k = e.key;
+	if (e.target !== node || k !== "Enter" && k !== " ") return;
+	e.preventDefault();
+	node.dispatchEvent(new MouseEvent("click", {
+		bubbles: true,
+		cancelable: true
+	}));
+};
+const pressable = (node) => {
+	if (node.tabIndex < 0) node.tabIndex = 0;
+	node.addEventListener("keydown", press_key);
+	return () => node.removeEventListener("keydown", press_key);
+};
+export { press_key, pressable };