@paged-media/plugin-sdk 0.2.28-canary.0 → 0.2.30-canary.0

package/dist/index.js

@@ -827,7 +827,7 @@ function createBundleHost(getEditor, manifest, options) {
             return;
           }
           submitted.add(elementId);
-          await ch.submit(elementId, layer);
+          await ch.submit(elementId, layer, manifest.id);
         },
         async clear(elementId) {
           submitted.delete(elementId);
@@ -1597,7 +1597,31 @@ function createBundleHost(getEditor, manifest, options) {
     async write(path, bytes) {
       const reply = await getEditor().client.send({
         kind: "writePagedPart",
-        payload: { path: partsFull(path), bytes: Array.from(bytes) }
+        payload: {
+          path: partsFull(path),
+          bytes: Array.from(bytes),
+          // C-34 — DECLARE WHO IS WRITING, so the engine
+          // confines this to `paged/<id>/` instead of trusting that we
+          // built the path correctly. `partsFull` already scopes it;
+          // that is a convention held in THIS file, and a convention is
+          // not a boundary — a bundle reaching the raw handle bypasses
+          // it entirely. Saying the caller moves the check to the one
+          // place that cannot be routed around.
+          //
+          // Safe against an older worker: the wire has no
+          // `deny_unknown_fields`, so an engine without the gate
+          // ignores this and behaves exactly as before. No `supports()`
+          // probe needed — there is no degraded path to choose between.
+          caller: manifest.id
+        }
+        // THE CAST, named rather than left to be discovered. `wire.d.ts`
+        // is vendored from the PUBLISHED `@paged-media/canvas-wasm`
+        // (0.61.0), whose `writePagedPart` has no `caller` — the field
+        // exists in core today and reaches these types only when the
+        // next canvas-wasm publishes and `sync-wire` runs. Same escape-hatch
+        // shape the repo already uses elsewhere: a cast pointing at a
+        // contract that EXISTS AND IS COMMITTED, not at a hope. It
+        // deletes itself at the repin.
       });
       if (reply.kind !== "pagedPartWritten") {
         const err = reply.kind === "pagedPartFailed" ? reply.payload.error : `unexpected ${reply.kind}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paged-media/plugin-sdk",
-  "version": "0.2.28-canary.0",
+  "version": "0.2.30-canary.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -11,7 +11,7 @@
     }
   },
   "dependencies": {
-    "@paged-media/plugin-api": "0.2.28-canary.0"
+    "@paged-media/plugin-api": "0.2.30-canary.0"
   },
   "peerDependencies": {
     "react": "^18.3.0"
@@ -22,7 +22,7 @@
     }
   },
   "devDependencies": {
-    "@paged-media/canvas-wasm": "0.51.0",
+    "@paged-media/canvas-wasm": "0.61.0",
     "@types/node": "20.19.39",
     "@types/react": "^18.3.12",
     "react": "^18.3.0",