@paged-media/plugin-api 0.2.49-canary.0 → 0.2.50-canary.0

package/dist/host.d.ts

@@ -5,7 +5,7 @@ import type { AssetSurface } from "./assets";
 import type { BindingProvider, BindingProviderHandle } from "./binding-provider";
 import type { ClipboardSurface } from "./clipboard";
 import type { MutationInput } from "./mutations";
-import type { PluginManifest } from "./manifest";
+import type { PluginManifest, WasmArtifact } from "./manifest";
 import type { SchemaPanelContribution } from "./panel-schema";
 import type { WidgetSurface } from "./widgets";
 import type { ObjectModelContribution, ObjectModelHandle, ObjectsSurface } from "./object-model";
@@ -687,6 +687,38 @@ export interface WorkersSurface {
      *  this rather than guessing. */
     concurrency(): number;
 }
+/** Where the host serves one declared wasm artifact (`host.modules.resolve`). */
+export interface HostedModule {
+    /** Absolute URL of the artifact's bytes. */
+    url: string;
+    /** Subresource Integrity for the bytes (`sha384-…`), or `null` when
+     *  neither the manifest nor the host vouches for them. The manifest's own
+     *  `integrity` wins; a host answer that contradicts it is refused. */
+    integrity: string | null;
+    /** The declared artifact the answer is for (straight off the manifest). */
+    artifact: WasmArtifact;
+}
+/**
+ * The MODULE door (ADR 326). Resolves a DECLARED `capabilities.wasm`
+ * artifact by `name` to a URL the host serves, with Subresource Integrity.
+ * Always present — with no host backend every answer is `null` and
+ * `supports("modules@1")` is false; the bundle falls back to its
+ * bundle-relative URL (plugin-sdk's `resolveWasm` / `fetchWasm` do the
+ * fallback). An undeclared name rejects (capability gate).
+ */
+export interface ModulesSurface {
+    /** The host's answer for `name`: URL + integrity, or `null` when the host
+     *  does not serve it. */
+    resolve(name: string): Promise<HostedModule | null>;
+    /** `resolve(name)`'s URL alone, or `null`. */
+    url(name: string): Promise<string | null>;
+    /** Fetch the hosted artifact — `fetch(url, { integrity })` when an
+     *  integrity is known, so a byte that differs fails the fetch instead of
+     *  reaching `WebAssembly`. `null` when the host does not serve it. Hand
+     *  the response to `WebAssembly.instantiateStreaming` or to a
+     *  wasm-bindgen `init({ module_or_path })`. */
+    fetch(name: string): Promise<Response | null>;
+}
 /** The secret a `host.secrets.set` carries (D-11). v1 is a connection
  *  string / token / password as a UTF-8 string — opaque to the contract;
  *  the host stores it under the `ref` and injects it at attach/fetch time.
@@ -1844,6 +1876,12 @@ export interface BundleHost {
      *  Capability-gated on `capabilities.workers`. The host facade tracks
      *  every spawned worker for automatic teardown on bundle dispose. */
     readonly workers: WorkersSurface;
+    /** The MODULE door (ADR 326): resolve a DECLARED `capabilities.wasm`
+     *  artifact through the host — a URL it serves (a first-party module host,
+     *  immutable per version) plus Subresource Integrity. Always present; with
+     *  no host backend every answer is `null` (load the bundle-relative copy)
+     *  and `supports("modules@1")` is false. An undeclared name rejects. */
+    readonly modules: ModulesSurface;
     /** The capability-gated, REFERENCE-ONLY CREDENTIAL STORE (D-11;
      *  rfc-credential-store): `set` (host-UI-prompted) / `exists` / `forget`
      *  a `credentialRef` — and DELIBERATELY NO `get` (secret bytes never

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export type { PluginId, PluginManifest, PluginCapabilities, PluginContributions, NetworkCapability, DataProvidersCapability, StorageCapability, WasmArtifact, WasmPurpose, WorkersCapability, SecretsCapability, DocumentsCapability, GpuCapability, ObjectModelDeclaration, } from "./manifest";
 export type { Address, Selector, PropertyPathName, PageItemKind, StyleFamily, ParsedAddress, AddressKind, ValueType, StructField, ValueTypeKind, PropertySchema, ContentSchema, ObjectErrorCode, ObjectValue, ObjectOp, PartChange, ObjectWrite, ObjectQuery, ObjectPredicate, ObjectKindContribution, TypedCommandContribution, ObjectModelContribution, ObjectModelHandle, ObjectWriteResult, ObjectCommandResult, ObjectChange, ObjectKindInfo, ObjectCommandInfo, ObjectsSurface, ListEdit, StructEdit, ValueEdit, } from "./object-model";
 export type { BundleHandle, PagedBundle } from "./bundle";
-export type { BundleHost, ContributionSurface, SceneLayerSurface, SceneLayerSubmitResult, SceneImage, SceneImageTile, SceneImageSubmitOptions, WillSaveEvent, ToolsSurface, ToolSettingValue, ImagesSurface, ImageResourceClaimOptions, TileBytes, WorkersSurface, BundleWorker, SpawnWorkerOptions, SecretsSurface, SecretMaterial, DocumentSurface, MutateWithBytesOptions, SelectionSurface, ViewportSurface, TextRange, RenderSurface, RenderSnapshotOptions, RenderedPage, TextSurface, TextMetrics, TextCaret, FrameChainLink, PlanarFace, PlanarRegionsResult, StoryContent, ParagraphContent, RunContent, OverlaySurface, OverlayLayer, ShellSurface, FilePickerOptions, PickedFile, SaveFileOptions, StorageSurface, BlobSurface, BlobUsage, PartsSurface, NativeDocumentSurface, DocumentsSurface, OpenDocumentOptions, OpenDocumentResult, NetworkSurface, ConsentResult, DataProvidersSurface, DataProviderRegistration, DataProviderHandle, DataProviderInfo, DataProviderSnapshot, ProviderSchema, ProviderField, ProviderRecordSet, DiagnosticsSurface, JournalSurface, JournalRecord, BindingsSurface, Diagnostic, DocumentChangeEvent, DocumentOpenedEvent, MutationOutcome, Disposable, PluginLogger, EditContextContribution, ObjectTypeContribution, EditContextCandidate, EnteredEditContext, ContentPointerEvent, ContentWheelEvent, EditContextDescriptor, ObjectTypeDescriptor, PluginMetadataEnvelope, ObjectTypeBaker, BakeContext, MenuContribution, } from "./host";
+export type { BundleHost, ContributionSurface, SceneLayerSurface, SceneLayerSubmitResult, SceneImage, SceneImageTile, SceneImageSubmitOptions, WillSaveEvent, ToolsSurface, ToolSettingValue, ImagesSurface, ImageResourceClaimOptions, TileBytes, WorkersSurface, BundleWorker, SpawnWorkerOptions, ModulesSurface, HostedModule, SecretsSurface, SecretMaterial, DocumentSurface, MutateWithBytesOptions, SelectionSurface, ViewportSurface, TextRange, RenderSurface, RenderSnapshotOptions, RenderedPage, TextSurface, TextMetrics, TextCaret, FrameChainLink, PlanarFace, PlanarRegionsResult, StoryContent, ParagraphContent, RunContent, OverlaySurface, OverlayLayer, ShellSurface, FilePickerOptions, PickedFile, SaveFileOptions, StorageSurface, BlobSurface, BlobUsage, PartsSurface, NativeDocumentSurface, DocumentsSurface, OpenDocumentOptions, OpenDocumentResult, NetworkSurface, ConsentResult, DataProvidersSurface, DataProviderRegistration, DataProviderHandle, DataProviderInfo, DataProviderSnapshot, ProviderSchema, ProviderField, ProviderRecordSet, DiagnosticsSurface, JournalSurface, JournalRecord, BindingsSurface, Diagnostic, DocumentChangeEvent, DocumentOpenedEvent, MutationOutcome, Disposable, PluginLogger, EditContextContribution, ObjectTypeContribution, EditContextCandidate, EnteredEditContext, ContentPointerEvent, ContentWheelEvent, EditContextDescriptor, ObjectTypeDescriptor, PluginMetadataEnvelope, ObjectTypeBaker, BakeContext, MenuContribution, } from "./host";
 export type { PanelSchema, PanelSchemaSection, PanelSchemaRow, SchemaPanelContribution, SchemaPanelRenderer, SchemaPanelRendererProps, WidgetValueBinding, BindingRef, SchemaGate, WidgetCollectionBinding, SchemaRowAction, SchemaListAction, SchemaListSpec, PanelSchemaWidgetRow, PanelSchemaPropertyRow, PropertyFieldAddress, PropertyFieldStyle, PropertyFieldOption, PropertySubField, PropertyListPresentation, } from "./panel-schema";
 export type { WidgetSurface, ColorPickerProps, CodeEditorProps, CodeEditorDiagnostic, CodeEditorLanguage, PropertyFieldProps, PropertyFrameProps, PropertyFieldTarget, } from "./widgets";
 export type { BindingTarget, BindingPropertyRequest, BindingPropertyWrite, BindingCollectionRequest, BindingRead, BindingResolved, BindingDecline, BindingWrite, BindingCollection, BindingOp, BindingProvider, BindingProviderScope, BindingProviderHandle, BindingReadResult, BindingWriteResult, BindingCollectionResult, ActiveBindingProvider, } from "./binding-provider";

package/dist/manifest.d.ts

@@ -289,6 +289,13 @@ export interface WasmArtifact {
      *  be ≤ the host's hard per-artifact ceiling; the loader enforces the
      *  stricter of the two. */
     maxBytes?: number;
+    /** Optional Subresource Integrity of the shipped bytes
+     *  (`sha384-<base64>`; `sha256-` / `sha512-` are accepted). Stamped at
+     *  build time by `paged-plugin integrity <bundle-dir>`; the CLI fails a
+     *  manifest whose stamp does not match the file next to it. When present
+     *  it is what `host.modules` hands `fetch(url, { integrity })` — the
+     *  bundle vouches for its own bytes, wherever the host serves them. */
+    integrity?: string;
 }
 export interface PluginContributions {
     /** Tool ids the bundle registers. Must be namespaced by `id`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paged-media/plugin-api",
-  "version": "0.2.49-canary.0",
+  "version": "0.2.50-canary.0",
   "description": "The Paged plugin contract: manifest, bundle lifecycle, the BundleHost surface, and the contribution + engine wire types. Type-only.",
   "license": "MPL-2.0 OR LicenseRef-PMEL",
   "type": "module",

package/src/manifest.schema.json

@@ -240,6 +240,11 @@
                 "minimum": 1,
                 "maximum": 100000000,
                 "description": "Per-artifact byte ceiling (tightens, never widens, the host cap). Host cap: 100 MB, the app-wide envelope (whole editor + every plugin, 2026-08-19). Enforced as a SUM by the editor's scripts/wasm-budget.mjs; this per-artifact value is a hard upper stop a manifest may only tighten."
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha(256|384|512)-[A-Za-z0-9+/]+={0,2}$",
+                "description": "Subresource Integrity of the shipped bytes (sha384- recommended). Stamped by `paged-plugin integrity`; the CLI fails a stamp that does not match the file. host.modules passes it to fetch (ADR 326)."
               }
             }
           }