@paged-media/plugin-sdk 0.2.6-canary.0 → 0.2.9-canary.0

package/dist/index.js

@@ -3,13 +3,6 @@ function defineBundle(bundle) {
   return bundle;
 }
 
-// src/harness.ts
-function createHeadlessHost(_options) {
-  throw new Error(
-    "@paged-media/plugin-sdk: the headless harness is not implemented yet (tracked in plugin-draw/BREAKAGE_LOG.md). Run bundles inside the editor app, or unit-test their machines (pure, host-free) instead."
-  );
-}
-
 // src/disposables.ts
 var DisposableStore = class {
   items = [];
@@ -49,43 +42,88 @@ function toDisposable(fn) {
   };
 }
 
-// src/version.ts
-var API_VERSION = "0.2.0";
-function parse(v) {
-  const m = /^(\d+)\.(\d+)(?:\.(\d+))?$/.exec(v.trim());
-  if (!m) return null;
-  return [Number(m[1]), Number(m[2]), Number(m[3] ?? "0")];
-}
-function satisfiesApiVersion(range, version = API_VERSION) {
-  const r = range.trim();
-  if (r === "*") return true;
-  const v = parse(version);
-  if (!v) return false;
-  if (r.startsWith("^")) {
-    const base = parse(r.slice(1));
-    if (!base) return false;
-    if (base[0] > 0) {
-      if (v[0] !== base[0]) return false;
-      if (v[1] !== base[1]) return v[1] > base[1];
-      return v[2] >= base[2];
+// src/widgets-fallback.tsx
+import { createElement } from "react";
+function TextareaCodeEditor(props) {
+  return createElement("textarea", {
+    value: props.value,
+    readOnly: props.readOnly,
+    spellCheck: false,
+    "aria-label": props.ariaLabel,
+    "data-code-editor-fallback": props.language ?? "text",
+    onChange: (e) => props.onChange(e.target.value),
+    style: {
+      width: "100%",
+      minHeight: props.minHeight ?? 96,
+      resize: "vertical",
+      font: "12px/1.5 var(--font-mono, monospace)",
+      color: "var(--pg-fg)",
+      background: "var(--pg-bg)",
+      border: "1px solid var(--pg-border)",
+      borderRadius: "var(--radius-sm, 4px)",
+      padding: "var(--space-2, 8px)",
+      boxSizing: "border-box"
     }
-    return v[0] === 0 && v[1] === base[1] && v[2] >= base[2];
+  });
+}
+var FALLBACK_WIDGETS = {
+  CodeEditor: TextareaCodeEditor
+};
+
+// src/schema-panel.tsx
+import { createElement as createElement2 } from "react";
+function resolveGate(gate, lookup) {
+  if (gate === void 0) return true;
+  if (typeof gate === "boolean") return gate;
+  const raw = Boolean(lookup(gate.bind));
+  return gate.negate ? !raw : raw;
+}
+function makeSchemaPanelComponent(contribution, bindings, renderer) {
+  const { schema } = contribution;
+  if (renderer) {
+    let SchemaPanel2 = function(_props) {
+      return createElement2(Renderer, { schema, bindings });
+    };
+    var SchemaPanel = SchemaPanel2;
+    const Renderer = renderer;
+    SchemaPanel2.displayName = `SchemaPanel(${schema.id})`;
+    return SchemaPanel2;
   }
-  const exact = parse(r);
-  if (!exact) return false;
-  return v[0] === exact[0] && v[1] === exact[1] && v[2] === exact[2];
+  function SchemaPanelSeam(_props) {
+    return createElement2(
+      "div",
+      {
+        "data-schema-panel-seam": schema.id,
+        style: {
+          padding: "var(--space-3, 12px)",
+          font: "12px/1.5 var(--font-sans, sans-serif)",
+          color: "var(--pg-muted-fg)"
+        }
+      },
+      `Schema panel "${schema.title}" needs a host renderer (supports("schemaPanel.renderer@1") is false).`
+    );
+  }
+  SchemaPanelSeam.displayName = `SchemaPanelSeam(${schema.id})`;
+  return SchemaPanelSeam;
 }
 
 // src/host-impl.ts
 var HOST_FEATURES = [
   "contribute.tool@1",
   "contribute.panel@1",
+  "contribute.schemaPanel@1",
+  "bindings@1",
   "contribute.command@1",
   "contribute.keybinding@1",
   "contribute.overlay@1",
+  "contribute.editContext@1",
+  "contribute.objectType@1",
+  "contribute.importer@1",
+  "contribute.exporter@1",
   "document.mutate@1",
   "document.undo@1",
   "document.collection@1",
+  "document.frameChain@1",
   "document.meta@1",
   "document.pathAnchors@1",
   "document.hitTest@1",
@@ -98,7 +136,12 @@ var HOST_FEATURES = [
   "viewport@1",
   "overlay.toolPreview@1",
   "storage@1",
-  "diagnostics@1"
+  "diagnostics@1",
+  // C-5 / I-04 (core v42): the placed-image bytes read is engine-served
+  // through the wire (no injected source), so it is unconditionally
+  // implemented at the pinned canvas-wasm — unlike assets.fonts@1, which
+  // stays conditional on the editor's injected byte source.
+  "assets.images@1"
 ];
 var PluginApiNotImplemented = class extends Error {
   constructor(member, pointer) {
@@ -108,6 +151,21 @@ var PluginApiNotImplemented = class extends Error {
     this.name = "PluginApiNotImplemented";
   }
 };
+var PluginCapabilityError = class extends Error {
+  /** The host door that was called (e.g. `"contribute.tool"`). */
+  door;
+  /** The manifest declaration that would authorize it (e.g.
+   *  `'contributes.tools[] must include "media.paged.web.tool.pen"'`). */
+  missingDeclaration;
+  constructor(door, missingDeclaration, pluginId) {
+    super(
+      `plugin-api: ${pluginId} called ${door} without declaring it \u2014 ${missingDeclaration}. Manifest capabilities are ENFORCED (trust-line W0.11): declare the use or the host refuses it.`
+    );
+    this.name = "PluginCapabilityError";
+    this.door = door;
+    this.missingDeclaration = missingDeclaration;
+  }
+};
 function defaultStorageBacking() {
   const ls = globalThis.localStorage;
   if (ls) {
@@ -133,6 +191,59 @@ function defaultStorageBacking() {
     keys: () => Array.from(map.keys())
   };
 }
+var ASSET_BUDGETS = {
+  /** Largest font face the door will serve, in bytes (8 MiB). */
+  maxFontFaceBytes: 8 * 1024 * 1024
+};
+var BLOB_BUDGETS = {
+  /** Default per-plugin blob ceiling, in bytes (64 MiB). */
+  defaultQuotaBytes: 64 * 1024 * 1024
+};
+function createDataProviderRegistry() {
+  const providers = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Map();
+  return {
+    register(registration) {
+      providers.set(registration.id, {
+        reg: registration,
+        revision: registration.revision
+      });
+      return {
+        update(revision) {
+          const entry = providers.get(registration.id);
+          if (entry) entry.revision = revision;
+          for (const l of listeners.get(registration.id) ?? []) l(revision);
+        },
+        dispose() {
+          providers.delete(registration.id);
+        }
+      };
+    },
+    discover(category) {
+      return [...providers.values()].filter((e) => category === void 0 || e.reg.category === category).map((e) => ({
+        id: e.reg.id,
+        category: e.reg.category,
+        schema: e.reg.schema,
+        revision: e.revision
+      }));
+    },
+    async get(id) {
+      const entry = providers.get(id);
+      if (!entry) return null;
+      const records = await entry.reg.getSnapshot();
+      return { id, revision: entry.revision, records };
+    },
+    onDidChange(id, listener) {
+      let set = listeners.get(id);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        listeners.set(id, set);
+      }
+      set.add(listener);
+      return toDisposable(() => set.delete(listener));
+    }
+  };
+}
 function createBundleHost(getEditor, manifest, options) {
   const store = new DisposableStore();
   const sink = options?.console ?? console;
@@ -152,37 +263,243 @@ function createBundleHost(getEditor, manifest, options) {
     warn: (m, ...a) => sink.warn(`${tag} ${m}`, ...a),
     error: (m, ...a) => sink.error(`${tag} ${m}`, ...a)
   };
+  const capabilityMode = options?.capabilityMode ?? "enforce";
+  const caps = manifest.capabilities;
+  const declared = manifest.contributes;
+  const hasDoc = (dir) => caps?.document?.[dir] !== void 0;
+  const hasRendering = (s) => caps?.rendering?.includes(s) ?? false;
+  const hasAsset = (k) => caps?.assets?.includes(k) ?? false;
+  const hasBlobStore = () => caps?.storage?.blob === true;
+  const lists = (arr, id) => arr?.includes(id) ?? false;
+  const declaresType = (arr, type) => arr?.some((e) => e.type === type) ?? false;
+  const requireDeclared = (ok, door, missing) => {
+    if (ok) return;
+    if (capabilityMode === "warn") {
+      log.warn(
+        `${door} used without declaring it \u2014 ${missing} (capabilityMode: 'warn'; would refuse in 'enforce')`
+      );
+      return;
+    }
+    throw new PluginCapabilityError(door, missing, manifest.id);
+  };
+  const denyWrite = (ok, door, missing) => {
+    if (ok) return null;
+    const reason = `${door} requires ${missing} (trust-line W0.11)`;
+    if (capabilityMode === "warn") {
+      log.warn(`${reason} \u2014 proceeding (capabilityMode: 'warn')`);
+      return null;
+    }
+    return reason;
+  };
   const contribute = {
     tool(c) {
       assertNamespaced(c.id, "tool");
+      requireDeclared(
+        lists(declared?.tools, c.id),
+        "contribute.tool",
+        `contributes.tools[] must include "${c.id}"`
+      );
       return store.add(getEditor().registries.tools.register(c));
     },
     panel(c) {
       assertNamespaced(c.id, "panel");
+      requireDeclared(
+        lists(declared?.panels, c.id),
+        "contribute.panel",
+        `contributes.panels[] must include "${c.id}"`
+      );
       return store.add(getEditor().registries.panels.register(c));
     },
+    schemaPanel(c) {
+      assertNamespaced(c.id, "schemaPanel");
+      requireDeclared(
+        lists(declared?.panels, c.id),
+        "contribute.schemaPanel",
+        `contributes.panels[] must include "${c.id}"`
+      );
+      const panel = {
+        id: c.id,
+        title: c.title,
+        icon: c.icon,
+        defaultDock: c.defaultDock,
+        defaultGroup: c.defaultGroup,
+        closable: c.closable,
+        movable: c.movable,
+        component: makeSchemaPanelComponent(
+          c,
+          bindings,
+          options?.schemaPanelRenderer
+        )
+      };
+      const reg = store.add(getEditor().registries.panels.register(panel));
+      const recorded = options?.onSchemaPanelRegistered?.(c);
+      if (recorded) {
+        const d = store.add(recorded);
+        return toDisposable(() => {
+          reg.dispose();
+          d.dispose();
+        });
+      }
+      return reg;
+    },
     command(c) {
       assertNamespaced(c.id, "command");
+      requireDeclared(
+        lists(declared?.commands, c.id),
+        "contribute.command",
+        `contributes.commands[] must include "${c.id}"`
+      );
       return store.add(getEditor().registries.commands.register(c));
     },
     keybinding(c) {
+      requireDeclared(
+        caps?.keybindings === true,
+        "contribute.keybinding",
+        "capabilities.keybindings must be true"
+      );
       return store.add(getEditor().registries.keybindings.register(c));
     },
     overlay(c) {
       assertNamespaced(c.id, "overlay");
+      requireDeclared(
+        hasRendering("overlay"),
+        "contribute.overlay",
+        'capabilities.rendering must include "overlay"'
+      );
       return store.add(getEditor().registries.overlays.register(c));
     },
-    editContext() {
-      throw new PluginApiNotImplemented(
+    // W3.2 (un-reserved — B-02 / W-03): the last two reserved doors. The
+    // capability gate keys off the OBJECT arrays in `contributes`
+    // (`editContexts[]` / `objectTypes[]` carry `{type,…}`, not flat
+    // ids). The shell owns the stack / chrome / write-scope; the SDK
+    // adapter just hands the contribution to the editor's registry (or,
+    // when the host hasn't wired one — headless / not-yet-adopted —
+    // records it through the harness hook). The `type` is a content-type
+    // name, NOT a namespaced id, so the namespace rule does NOT apply
+    // (the capability gate is the only gate).
+    editContext(c) {
+      requireDeclared(
+        declaresType(declared?.editContexts, c.type),
         "contribute.editContext",
-        "P0 shell work \u2014 plugin-draw/BREAKAGE_LOG.md B-02"
+        `contributes.editContexts[] must declare { type: "${c.type}" }`
       );
+      const stamped = {
+        ...c,
+        metadataKey: metadataKey(manifest)
+      };
+      const reg = getEditor().registries.editContexts;
+      const recorded = options?.onEditContextRegistered?.(stamped);
+      if (reg) {
+        const d = store.add(reg.register(stamped));
+        if (recorded) {
+          const r = store.add(recorded);
+          return toDisposable(() => {
+            d.dispose();
+            r.dispose();
+          });
+        }
+        return d;
+      }
+      if (recorded) return store.add(recorded);
+      return store.add(toDisposable(() => {
+      }));
     },
-    objectType() {
-      throw new PluginApiNotImplemented(
+    objectType(c) {
+      requireDeclared(
+        declaresType(declared?.objectTypes, c.type),
         "contribute.objectType",
-        "paged.web W1 \u2014 base-idea \xA79.1.2"
+        `contributes.objectTypes[] must declare { type: "${c.type}" }`
       );
+      const stamped = {
+        ...c,
+        metadataKey: metadataKey(manifest)
+      };
+      const reg = getEditor().registries.objectTypes;
+      const recorded = options?.onObjectTypeRegistered?.(stamped);
+      if (reg) {
+        const d = store.add(reg.register(stamped));
+        if (recorded) {
+          const r = store.add(recorded);
+          return toDisposable(() => {
+            d.dispose();
+            r.dispose();
+          });
+        }
+        return d;
+      }
+      if (recorded) return store.add(recorded);
+      return store.add(toDisposable(() => {
+      }));
+    },
+    // K-2 / S-06 — document IO. Mirrors `command`: namespaced id the
+    // manifest must list, routed to the shell registry. The registry is
+    // OPTIONAL on the handle (a host that hasn't wired it stays
+    // assignable) — when absent the door is a tracked no-op; the headless
+    // harness injects a recording registry so conformance can assert it.
+    importer(c) {
+      assertNamespaced(c.id, "importer");
+      requireDeclared(
+        lists(declared?.importers, c.id),
+        "contribute.importer",
+        `contributes.importers[] must include "${c.id}"`
+      );
+      const reg = getEditor().registries.importers;
+      if (reg) return store.add(reg.register(c));
+      return store.add(toDisposable(() => {
+      }));
+    },
+    exporter(c) {
+      assertNamespaced(c.id, "exporter");
+      requireDeclared(
+        lists(declared?.exporters, c.id),
+        "contribute.exporter",
+        `contributes.exporters[] must include "${c.id}"`
+      );
+      const reg = getEditor().registries.exporters;
+      if (reg) return store.add(reg.register(c));
+      return store.add(toDisposable(() => {
+      }));
+    },
+    // C-1 — the in-frame scene-layer surface. Capability-gated on
+    // `rendering ∋ sceneLayer`; routes submit/clear to the editor's scene
+    // channel (`getEditor().sceneLayers` → canvas-wasm submit/clear). When
+    // no channel is wired (headless / older editor) the surface warns +
+    // no-ops (probe `supports("rendering.sceneLayer@1")`). Disposing the
+    // surface clears every layer it submitted (tracked so host.dispose()
+    // tears them down).
+    sceneLayer() {
+      requireDeclared(
+        hasRendering("sceneLayer"),
+        "contribute.sceneLayer",
+        'capabilities.rendering must include "sceneLayer"'
+      );
+      const submitted = /* @__PURE__ */ new Set();
+      const channel = () => getEditor().sceneLayers;
+      const surface = {
+        async submit(elementId, layer) {
+          const ch = channel();
+          if (!ch) {
+            log.warn(
+              `contribute.sceneLayer().submit("${elementId}") ignored \u2014 the host wired no scene channel (probe supports("rendering.sceneLayer@1"))`
+            );
+            return;
+          }
+          submitted.add(elementId);
+          await ch.submit(elementId, layer);
+        },
+        async clear(elementId) {
+          submitted.delete(elementId);
+          await channel()?.clear(elementId);
+        },
+        dispose() {
+          const ch = channel();
+          if (ch) {
+            for (const id of submitted) void ch.clear(id);
+          }
+          submitted.clear();
+        }
+      };
+      return store.add(surface);
     }
   };
   const foreignMetadataKey = (m) => {
@@ -197,8 +514,19 @@ function createBundleHost(getEditor, manifest, options) {
     }
     return null;
   };
+  const requireDocRead = (door) => requireDeclared(
+    hasDoc("read"),
+    door,
+    "capabilities.document.read must be declared"
+  );
   const document = {
     async mutate(mutation) {
+      const denied = denyWrite(
+        hasDoc("write"),
+        "document.mutate",
+        "capabilities.document.write"
+      );
+      if (denied !== null) return { applied: false, error: denied };
       const foreign = foreignMetadataKey(mutation);
       if (foreign !== null) {
         const error = `setPluginMetadata key "${foreign}" is outside this plugin's namespace ("${metadataKey(manifest)}")`;
@@ -223,21 +551,40 @@ function createBundleHost(getEditor, manifest, options) {
       }
     },
     async undo() {
+      requireDeclared(
+        hasDoc("write"),
+        "document.undo",
+        "capabilities.document.write"
+      );
       await getEditor().client.undo();
     },
     async redo() {
+      requireDeclared(
+        hasDoc("write"),
+        "document.redo",
+        "capabilities.document.write"
+      );
       await getEditor().client.redo();
     },
     collection(name) {
+      requireDocRead("document.collection");
       return getEditor().client.collection(name);
     },
     meta() {
+      requireDocRead("document.meta");
       return getEditor().client.documentMeta();
     },
     pathAnchors(id) {
+      requireDocRead("document.pathAnchors");
       return getEditor().client.pathAnchors(id).catch(() => null);
     },
     async hitTest(pageId, point, filter = "any") {
+      requireDocRead("document.hitTest");
+      requireDeclared(
+        hasRendering("hitTest"),
+        "document.hitTest",
+        'capabilities.rendering must include "hitTest"'
+      );
       try {
         const reply = await getEditor().client.send({
           kind: "hitTest",
@@ -249,15 +596,18 @@ function createBundleHost(getEditor, manifest, options) {
       }
     },
     elementGeometry(ids) {
+      requireDocRead("document.elementGeometry");
       return getEditor().client.elementGeometry(ids);
     },
     async tree() {
+      requireDocRead("document.tree");
       const reply = await getEditor().client.send({
         kind: "requestSceneTree"
       });
       return reply.kind === "sceneTree" ? reply.payload.roots : [];
     },
     async getMetadata(id) {
+      requireDocRead("document.getMetadata");
       const key = metadataKey(manifest);
       const reply = await getEditor().client.send({
         kind: "requestElementProperties",
@@ -284,14 +634,29 @@ function createBundleHost(getEditor, manifest, options) {
         args: {
           elementId: id,
           key: metadataKey(manifest),
-          value: envelope === null ? null : JSON.stringify(envelope)
+          value: envelope === null ? null : JSON.stringify(envelope),
+          caller: manifest.id
         }
       });
     },
+    async frameChain(storyId) {
+      requireDocRead("document.frameChain");
+      const reply = await getEditor().client.send({
+        kind: "requestFrameChain",
+        payload: { storyId }
+      });
+      return reply.kind === "frameChainResult" ? reply.payload.links : [];
+    },
     onDidChange(listener) {
+      requireDocRead("document.onDidChange");
       const off = getEditor().client.subscribe((msg) => {
         if (msg.kind === "mutationApplied" || msg.kind === "undoApplied" || msg.kind === "redoApplied") {
-          listener({ kind: msg.kind, pageIds: msg.payload.pageIds });
+          const reflow = msg.kind === "mutationApplied" ? msg.payload.reflow : void 0;
+          listener({
+            kind: msg.kind,
+            pageIds: msg.payload.pageIds,
+            ...reflow ? { reflow: { frameId: reflow.frameId, contentBox: reflow.contentBox } } : {}
+          });
         }
       });
       return store.add(toDisposable(off));
@@ -302,6 +667,11 @@ function createBundleHost(getEditor, manifest, options) {
       return getEditor().selection.elementSelection;
     },
     async set(ids, mode = "replace") {
+      requireDeclared(
+        hasDoc("write"),
+        "selection.set",
+        "capabilities.document.write"
+      );
       const editor = getEditor();
       const applied = await editor.client.setElementSelection(ids, mode);
       editor.selection.setElementSelection(applied);
@@ -326,8 +696,26 @@ function createBundleHost(getEditor, manifest, options) {
       return px / (scale > 0 ? scale : 1);
     }
   };
+  const text = {
+    async measureString(family, style, str, sizePt) {
+      const editorText = getEditor().text;
+      if (editorText) {
+        return editorText.measure(family, style, str, sizePt);
+      }
+      return {
+        advance: str.length * sizePt * 0.5,
+        ascender: sizePt * 0.8,
+        descender: -sizePt * 0.2
+      };
+    }
+  };
   const overlay = {
     setToolPreview(shape) {
+      requireDeclared(
+        hasRendering("overlay"),
+        "overlay.setToolPreview",
+        'capabilities.rendering must include "overlay"'
+      );
       getEditor().overlaySignals.setToolPreview(shape);
     }
   };
@@ -353,6 +741,98 @@ function createBundleHost(getEditor, manifest, options) {
       return backing.keys().filter((k) => k.startsWith(prefix)).map((k) => k.slice(prefix.length));
     }
   };
+  const declaredNetwork = manifest.capabilities?.network;
+  const networkDeclared = declaredNetwork === true || typeof declaredNetwork === "object" && declaredNetwork !== null;
+  const mayRequest = (origin) => {
+    if (declaredNetwork === true) return true;
+    if (typeof declaredNetwork === "object" && declaredNetwork !== null) {
+      const o = declaredNetwork.origins;
+      return o === "consent" || Array.isArray(o) && o.includes(origin);
+    }
+    return false;
+  };
+  const CONSENT_KEY = "network.consentedOrigins";
+  const granted = new Set(storage.get(CONSENT_KEY) ?? []);
+  const network = {
+    async requestConsent(origins, purpose) {
+      requireDeclared(
+        networkDeclared,
+        "network.requestConsent",
+        "capabilities.network must declare the network capability (boolean or { origins })"
+      );
+      const inScope = origins.filter(mayRequest);
+      const outOfScope = origins.filter((o) => !mayRequest(o));
+      if (outOfScope.length > 0) {
+        log.warn(
+          `network.requestConsent: ${outOfScope.length} origin(s) outside the declared capabilities.network allow-list \u2014 denied: ${outOfScope.join(", ")}`
+        );
+      }
+      const need = inScope.filter((o) => !granted.has(o));
+      let prompted = { granted: [], denied: [], remembered: false };
+      if (need.length > 0) {
+        if (options?.consent) {
+          prompted = await options.consent.request(need, purpose);
+        } else {
+          log.warn(
+            "network.requestConsent: no consent backend wired \u2014 denying (supports('network.consent@1') is false; the editor injects one)"
+          );
+          prompted = { granted: [], denied: need, remembered: false };
+        }
+      }
+      for (const o of prompted.granted) granted.add(o);
+      if (prompted.remembered) storage.set(CONSENT_KEY, [...granted]);
+      return {
+        granted: inScope.filter((o) => granted.has(o)),
+        denied: [...outOfScope, ...inScope.filter((o) => !granted.has(o))],
+        remembered: prompted.remembered
+      };
+    },
+    consentedOrigins() {
+      return [...granted];
+    }
+  };
+  const dpCap = manifest.capabilities?.dataProviders;
+  const mayPublish = (category) => Array.isArray(dpCap?.publish) && dpCap.publish.includes(category);
+  const mayConsume = (category) => Array.isArray(dpCap?.consume) && (category === void 0 || dpCap.consume.includes(category));
+  const consumeDeclared = Array.isArray(dpCap?.consume) && dpCap.consume.length > 0;
+  const dataProviders = {
+    register(registration) {
+      requireDeclared(
+        mayPublish(registration.category),
+        "dataProviders.register",
+        `capabilities.dataProviders.publish must include "${registration.category}"`
+      );
+      if (!options?.dataProviders) {
+        log.warn(
+          `dataProviders.register("${registration.id}") \u2014 no shared registry wired (supports('dataProviders@1') is false; the editor injects one)`
+        );
+        return { update() {
+        }, dispose() {
+        } };
+      }
+      return options.dataProviders.register(registration);
+    },
+    discover(category) {
+      requireDeclared(
+        mayConsume(category),
+        "dataProviders.discover",
+        "capabilities.dataProviders.consume must include the category"
+      );
+      return options?.dataProviders?.discover(category) ?? [];
+    },
+    async get(id) {
+      requireDeclared(
+        consumeDeclared,
+        "dataProviders.get",
+        "capabilities.dataProviders.consume must be declared"
+      );
+      return await options?.dataProviders?.get(id) ?? null;
+    },
+    onDidChange(id, listener) {
+      if (!options?.dataProviders) return toDisposable(() => void 0);
+      return store.add(options.dataProviders.onDidChange(id, listener));
+    }
+  };
   const diagnosticStore = /* @__PURE__ */ new Map();
   const diagnosticListeners = /* @__PURE__ */ new Set();
   const emitDiagnostics = (key) => {
@@ -367,11 +847,13 @@ function createBundleHost(getEditor, manifest, options) {
         else if (d.severity === "warning") sink.warn(line);
         else sink.info(line);
       }
+      options?.diagnosticsSink?.publish(manifest.id, key, items);
       emitDiagnostics(key);
     },
     clear(key) {
       if (key !== void 0) diagnosticStore.delete(key);
       else diagnosticStore.clear();
+      options?.diagnosticsSink?.clear(manifest.id, key);
       emitDiagnostics(key ?? "");
     },
     get(key) {
@@ -382,6 +864,27 @@ function createBundleHost(getEditor, manifest, options) {
       return store.add(toDisposable(() => diagnosticListeners.delete(listener)));
     }
   };
+  const bindingStore = /* @__PURE__ */ new Map();
+  const bindingListeners = /* @__PURE__ */ new Set();
+  const emitBinding = (name) => {
+    for (const l of bindingListeners) l(name);
+  };
+  const bindings = {
+    publish(name, value) {
+      bindingStore.set(name, value);
+      emitBinding(name);
+    },
+    get(name) {
+      return bindingStore.get(name);
+    },
+    delete(name) {
+      if (bindingStore.delete(name)) emitBinding(name);
+    },
+    onDidChange(listener) {
+      bindingListeners.add(listener);
+      return store.add(toDisposable(() => bindingListeners.delete(listener)));
+    }
+  };
   const shell = options?.shell ?? {
     openPanel(panelId) {
       log.warn(
@@ -389,11 +892,151 @@ function createBundleHost(getEditor, manifest, options) {
       );
     },
     closePanel() {
+    },
+    async pickFile() {
+      log.warn(
+        `shell.pickFile() ignored \u2014 the host app provided no shell actions (probe with supports("shell.pickFile@1"))`
+      );
+      return [];
+    }
+  };
+  const widgets = options?.widgets ?? FALLBACK_WIDGETS;
+  const assetSource = options?.assetSource;
+  const assets = {
+    async getFontFace(family, style) {
+      requireDeclared(
+        hasAsset("fonts"),
+        "assets.getFontFace",
+        'capabilities.assets must include "fonts"'
+      );
+      if (!assetSource) return null;
+      let face;
+      try {
+        face = await assetSource.getFontFace(family, style);
+      } catch {
+        return null;
+      }
+      if (!face) return null;
+      if (face.bytes.byteLength > ASSET_BUDGETS.maxFontFaceBytes) {
+        log.warn(
+          `assets.getFontFace("${family}"${style ? `, "${style}"` : ""}) served ${face.bytes.byteLength} bytes, over the ${ASSET_BUDGETS.maxFontFaceBytes}-byte per-face cap \u2014 refused`
+        );
+        return null;
+      }
+      return face;
+    },
+    // C-5 / I-04 (core v42): a placed DOCUMENT image's ORIGINAL bytes,
+    // straight from the engine's resolver/parse cache through the
+    // `requestPlacedAssetBytes` wire query — no injected source needed
+    // (the engine IS the byte holder). `found:false` and any channel
+    // failure both answer `null`, the door's honest no-bytes mode. No
+    // size clamp: document-scale originals (PSDs) are the use case and
+    // the engine only serves what the document already holds.
+    async getPlacedImage(elementId) {
+      requireDeclared(
+        hasAsset("images"),
+        "assets.getPlacedImage",
+        'capabilities.assets must include "images"'
+      );
+      try {
+        const reply = await getEditor().client.send({
+          kind: "requestPlacedAssetBytes",
+          payload: { elementId }
+        });
+        if (reply.kind !== "placedAssetBytes" || !reply.payload.found) {
+          return null;
+        }
+        const p = reply.payload;
+        return {
+          bytes: Uint8Array.from(p.encoded),
+          uri: p.uri,
+          width: p.width,
+          height: p.height
+        };
+      } catch {
+        return null;
+      }
+    }
+  };
+  const blobBackend = options?.blobStore;
+  const blobQuota = Math.min(
+    BLOB_BUDGETS.defaultQuotaBytes,
+    caps?.storage?.quotaBytes ?? BLOB_BUDGETS.defaultQuotaBytes
+  );
+  const blobGate = (door) => requireDeclared(
+    hasBlobStore(),
+    door,
+    "capabilities.storage must include { blob: true }"
+  );
+  const blob = {
+    async write(key, bytes) {
+      blobGate("blob.write");
+      if (!blobBackend) {
+        throw new Error(
+          `host.blob.write("${key}") \u2014 no blob store wired (supports("storage.blob@1") is false; the editor injects one)`
+        );
+      }
+      await blobBackend.delete(manifest.id, key);
+      const used = await blobBackend.used(manifest.id);
+      if (used + bytes.byteLength > blobQuota) {
+        throw new Error(
+          `host.blob.write("${key}") \u2014 ${bytes.byteLength} bytes would exceed the ${blobQuota}-byte quota (used ${used}) \u2014 refused`
+        );
+      }
+      await blobBackend.write(manifest.id, key, bytes);
+    },
+    async read(key) {
+      blobGate("blob.read");
+      if (!blobBackend) return null;
+      return blobBackend.read(manifest.id, key);
+    },
+    async delete(key) {
+      blobGate("blob.delete");
+      if (!blobBackend) return;
+      await blobBackend.delete(manifest.id, key);
+    },
+    async keys() {
+      blobGate("blob.keys");
+      if (!blobBackend) return [];
+      return blobBackend.keys(manifest.id);
+    },
+    async usage() {
+      blobGate("blob.usage");
+      if (!blobBackend) return { used: 0, quota: 0 };
+      return { used: await blobBackend.used(manifest.id), quota: blobQuota };
     }
   };
   const featureSet = new Set(HOST_FEATURES);
+  if (getEditor().text) {
+    featureSet.add("text.measure@1");
+  }
+  if (getEditor().sceneLayers) {
+    featureSet.add("rendering.sceneLayer@1");
+  }
   if (options?.shell) {
     featureSet.add("shell.openPanel@1");
+    featureSet.add("shell.pickFile@1");
+  }
+  if (options?.widgets) {
+    featureSet.add("widgets.codeEditor@1");
+  }
+  if (options?.schemaPanelRenderer) {
+    featureSet.add("schemaPanel.renderer@1");
+  }
+  if (options?.diagnosticsSink) {
+    featureSet.add("diagnostics.publish@1");
+  }
+  if (options?.assetSource) {
+    featureSet.add("assets.fonts@1");
+  }
+  if (options?.consent) {
+    featureSet.add("network.consent@1");
+  }
+  if (options?.dataProviders) {
+    featureSet.add("dataProviders@1");
+  }
+  if (options?.blobStore) {
+    featureSet.add("storage.blob@1");
   }
   const host = {
     manifest,
@@ -402,10 +1045,17 @@ function createBundleHost(getEditor, manifest, options) {
     document,
     selection,
     viewport,
+    text,
     overlay,
     shell,
     storage,
+    blob,
+    network,
+    dataProviders,
     diagnostics,
+    bindings,
+    widgets,
+    assets,
     supports: (feature) => featureSet.has(feature),
     get editor() {
       return getEditor();
@@ -419,10 +1069,548 @@ function createBundleHost(getEditor, manifest, options) {
   };
 }
 
+// src/version.ts
+var API_VERSION = "0.2.0";
+function parse(v) {
+  const m = /^(\d+)\.(\d+)(?:\.(\d+))?$/.exec(v.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3] ?? "0")];
+}
+function satisfiesApiVersion(range, version = API_VERSION) {
+  const r = range.trim();
+  if (r === "*") return true;
+  const v = parse(version);
+  if (!v) return false;
+  if (r.startsWith("^")) {
+    const base = parse(r.slice(1));
+    if (!base) return false;
+    if (base[0] > 0) {
+      if (v[0] !== base[0]) return false;
+      if (v[1] !== base[1]) return v[1] > base[1];
+      return v[2] >= base[2];
+    }
+    return v[0] === 0 && v[1] === base[1] && v[2] >= base[2];
+  }
+  const exact = parse(r);
+  if (!exact) return false;
+  return v[0] === exact[0] && v[1] === exact[1] && v[2] === exact[2];
+}
+
+// src/wasm-loader.ts
+var CANVAS_WASM_PKG = "@paged-media/canvas-wasm";
+async function nodeBuiltins() {
+  const [{ createRequire }, { readFileSync }, path, url] = await Promise.all([
+    import("module"),
+    import("fs"),
+    import("path"),
+    import("url")
+  ]);
+  return {
+    createRequire,
+    readFileSync,
+    dirname: path.dirname,
+    resolve: path.resolve,
+    fileURLToPath: url.fileURLToPath,
+    pathToFileURL: url.pathToFileURL
+  };
+}
+var STAMP_PREFIX = `// Synced from ${CANVAS_WASM_PKG}@`;
+async function modulePaths() {
+  const { dirname, resolve, fileURLToPath } = await nodeBuiltins();
+  const here = dirname(fileURLToPath(import.meta.url));
+  return {
+    here,
+    wireDts: resolve(here, "../../plugin-api/src/wire.d.ts")
+  };
+}
+async function readVendoredWireVersion(wireDtsPath) {
+  const { readFileSync } = await nodeBuiltins();
+  const path = wireDtsPath ?? (await modulePaths()).wireDts;
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  for (const line of text.split("\n", 8)) {
+    if (line.startsWith(STAMP_PREFIX)) {
+      return line.slice(STAMP_PREFIX.length).trim();
+    }
+  }
+  return null;
+}
+function protocolFromVersion(version) {
+  const m = /^\d+\.(\d+)\.\d+/.exec(version.trim());
+  return m ? Number(m[1]) : null;
+}
+async function resolveCanvasWasm(resolveFrom) {
+  const { createRequire, readFileSync, dirname, resolve, pathToFileURL } = await nodeBuiltins();
+  const { here } = await modulePaths();
+  const anchors = [
+    resolveFrom,
+    here,
+    resolve(here, "../../../../editor/packages/client"),
+    resolve(here, "../../..")
+  ].filter((a) => Boolean(a));
+  let lastErr;
+  for (const anchor of anchors) {
+    try {
+      const req = createRequire(pathToFileURL(resolve(anchor, "package.json")));
+      const pkgJsonPath = req.resolve(`${CANVAS_WASM_PKG}/package.json`);
+      const dir = dirname(pkgJsonPath);
+      const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+      const loaderPath = resolve(dir, pkg.main ?? "paged_canvas_wasm.js");
+      const wasmPath = resolve(dir, "paged_canvas_wasm_bg.wasm");
+      return {
+        loaderUrl: pathToFileURL(loaderPath).href,
+        wasmPath,
+        version: pkg.version ?? "unknown",
+        dir
+      };
+    } catch (err) {
+      lastErr = err;
+    }
+  }
+  throw new Error(
+    `plugin-sdk: ${CANVAS_WASM_PKG} is not resolvable for the headless harness (tried ${anchors.length} anchors). Install it as a devDependency, or run inside a workspace where the editor's packages/client provides it. No warn-skip: a headless host with no real engine is the fiction createHeadlessHost exists to prevent (B-13). Last error: ${String(lastErr)}`
+  );
+}
+async function loadHeadlessEngine(options = {}) {
+  const { readFileSync } = await nodeBuiltins();
+  const { loaderUrl, wasmPath, version } = await resolveCanvasWasm(
+    options.resolveFrom
+  );
+  const mod = await import(loaderUrl);
+  const bytes = readFileSync(wasmPath);
+  mod.initSync({
+    module: new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+  });
+  const worker = new mod.CanvasWorker();
+  const stampedVersion = await readVendoredWireVersion();
+  const expectedProtocol = options.expectedProtocol ?? (stampedVersion ? protocolFromVersion(stampedVersion) : null);
+  if (expectedProtocol !== null && worker.protocolVersion !== expectedProtocol) {
+    const booted = worker.protocolVersion;
+    try {
+      worker.free();
+    } catch {
+    }
+    throw new Error(
+      `plugin-sdk: headless engine protocol mismatch \u2014 booted ${CANVAS_WASM_PKG}@${version} reports protocol v${booted}, but the vendored wire types are stamped @${stampedVersion ?? "?"} (protocol v${expectedProtocol}). Re-run scripts/sync-wire.mjs and reinstall the matching package.`
+    );
+  }
+  return { worker, version, protocolVersion: worker.protocolVersion };
+}
+
+// src/harness.ts
+function inMemoryBlobStore() {
+  const byPlugin = /* @__PURE__ */ new Map();
+  const dir = (id) => {
+    let d = byPlugin.get(id);
+    if (!d) byPlugin.set(id, d = /* @__PURE__ */ new Map());
+    return d;
+  };
+  return {
+    async write(id, key, bytes) {
+      dir(id).set(key, bytes.slice());
+    },
+    async read(id, key) {
+      const v = dir(id).get(key);
+      return v ? v.slice() : null;
+    },
+    async delete(id, key) {
+      dir(id).delete(key);
+    },
+    async keys(id) {
+      return Array.from(dir(id).keys());
+    },
+    async used(id) {
+      let n = 0;
+      for (const v of dir(id).values()) n += v.byteLength;
+      return n;
+    }
+  };
+}
+var seqCounter = 1;
+function makeEngineEditor(worker, recorder, onToolPreview) {
+  const protocol = worker.protocolVersion;
+  const listeners = /* @__PURE__ */ new Set();
+  const fanOut = (reply) => {
+    for (const l of listeners) l(reply);
+  };
+  const dispatch = (kind, payload) => {
+    const envelope = JSON.stringify(
+      payload === void 0 ? { seq: seqCounter++, protocol, kind } : { seq: seqCounter++, protocol, kind, payload }
+    );
+    const raw = worker.handleMessage(envelope);
+    return JSON.parse(raw);
+  };
+  const recordingRegistry = (kind) => ({
+    register(contribution) {
+      const entry = {
+        kind,
+        id: contribution.id,
+        value: contribution
+      };
+      recorder.push(entry);
+      return {
+        dispose() {
+          const i = recorder.indexOf(entry);
+          if (i >= 0) recorder.splice(i, 1);
+        }
+      };
+    }
+  });
+  let keybindingSeq = 0;
+  const keybindingRegistry = {
+    register(contribution) {
+      const entry = {
+        kind: "keybinding",
+        id: `${contribution.command}#${keybindingSeq++}`,
+        value: contribution
+      };
+      recorder.push(entry);
+      return {
+        dispose() {
+          const i = recorder.indexOf(entry);
+          if (i >= 0) recorder.splice(i, 1);
+        }
+      };
+    }
+  };
+  let elementSelection = [];
+  let toolPreview = null;
+  const client = {
+    async mutate(mutation) {
+      const reply = dispatch("mutate", mutation);
+      fanOut(reply);
+      return reply;
+    },
+    async undo() {
+      const reply = dispatch("undo");
+      fanOut(reply);
+      return reply;
+    },
+    async redo() {
+      const reply = dispatch("redo");
+      fanOut(reply);
+      return reply;
+    },
+    async collection(name) {
+      const reply = dispatch("requestCollection", { name });
+      if (reply.kind === "collectionReply") {
+        const items = reply.payload.items;
+        return Array.isArray(items) ? items : [];
+      }
+      return [];
+    },
+    async documentMeta() {
+      const reply = dispatch("requestDocumentMeta");
+      if (reply.kind === "documentMetaReply") {
+        return reply.payload.meta;
+      }
+      throw new Error(`unexpected reply: ${reply.kind}`);
+    },
+    async pathAnchors(id) {
+      const reply = dispatch("requestPathAnchors", { id });
+      if (reply.kind === "pathAnchors") {
+        return reply.payload.result;
+      }
+      return null;
+    },
+    async elementGeometry(ids) {
+      const reply = dispatch("requestElementGeometry", { ids });
+      if (reply.kind === "elementGeometry") {
+        return reply.payload.items;
+      }
+      return [];
+    },
+    async setElementSelection(ids, mode) {
+      const reply = dispatch("setElementSelection", { ids, mode });
+      if (reply.kind === "elementSelectionApplied") {
+        fanOut(reply);
+        return reply.payload.ids;
+      }
+      throw new Error(`unexpected reply: ${reply.kind}`);
+    },
+    async send(message) {
+      const m = message;
+      const reply = dispatch(m.kind, m.payload);
+      return reply;
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    }
+  };
+  const editor = {
+    client,
+    registries: {
+      tools: recordingRegistry("tool"),
+      panels: recordingRegistry("panel"),
+      commands: recordingRegistry("command"),
+      keybindings: keybindingRegistry,
+      overlays: recordingRegistry("overlay"),
+      importers: recordingRegistry("importer"),
+      exporters: recordingRegistry("exporter")
+    },
+    selection: {
+      get elementSelection() {
+        return elementSelection;
+      },
+      setElementSelection(ids) {
+        elementSelection = ids;
+      },
+      setElementGeometry() {
+      }
+    },
+    camera: { camera: { scale: 1, tx: 0, ty: 0 } },
+    overlaySignals: {
+      setToolPreview(value) {
+        toolPreview = value;
+        onToolPreview(toolPreview);
+      }
+    },
+    // No tool spine + no content caret headlessly — both are inert
+    // members of the narrow handle, present so the cast is total.
+    tool: {
+      setBaseTool() {
+      }
+    },
+    contentSelection: { contentSelection: null }
+  };
+  return editor;
+}
+async function createHeadlessHost(options = {}) {
+  const engine = await loadHeadlessEngine(options);
+  const worker = engine.worker;
+  const contributions = [];
+  let lastPreview = null;
+  const editor = makeEngineEditor(worker, contributions, (value) => {
+    lastPreview = value;
+  });
+  let active = null;
+  let currentHost = null;
+  let disposed = false;
+  const blobStore = options.blobStore ?? inMemoryBlobStore();
+  const buildHost = (manifest, mode) => createBundleHost(() => editor, manifest, {
+    console: options.console,
+    storage: options.storage,
+    blobStore,
+    capabilityMode: mode,
+    // W-06 — a recordable fake asset source the conformance harness
+    // can pass so a bundle's `@font-face` byte path is exercisable
+    // headlessly (the editor's real adapter currently serves null;
+    // DESIGN.md §13.4). Absent → the no-bytes door.
+    assetSource: options.assetSource,
+    // Record the SCHEMA verbatim at registration — the panel registry
+    // only ever sees the synthesized React panel, so the conformance
+    // log gets the schema through this adapter seam (no host renderer
+    // headlessly; visibility/enabled gates are asserted off `bindings`
+    // directly, not through a mounted UI).
+    onSchemaPanelRegistered: (c) => {
+      const entry = {
+        kind: "schemaPanel",
+        id: c.id,
+        value: c
+      };
+      contributions.push(entry);
+      return {
+        dispose() {
+          const i = contributions.indexOf(entry);
+          if (i >= 0) contributions.splice(i, 1);
+        }
+      };
+    },
+    // W3.2 — the editContext/objectType registries are not wired
+    // headlessly (no shell stack / chrome), so the adapter takes the
+    // recording-stub path and these hooks ARE the registration log.
+    onEditContextRegistered: (c) => {
+      const entry = {
+        kind: "editContext",
+        id: c.type,
+        value: c
+      };
+      contributions.push(entry);
+      return {
+        dispose() {
+          const i = contributions.indexOf(entry);
+          if (i >= 0) contributions.splice(i, 1);
+        }
+      };
+    },
+    onObjectTypeRegistered: (c) => {
+      const entry = {
+        kind: "objectType",
+        id: c.type,
+        value: c
+      };
+      contributions.push(entry);
+      return {
+        dispose() {
+          const i = contributions.indexOf(entry);
+          if (i >= 0) contributions.splice(i, 1);
+        }
+      };
+    }
+  });
+  const NEUTRAL = {
+    id: "media.paged.harness",
+    name: "harness",
+    version: "0.0.0",
+    apiVersion: `^${API_VERSION.slice(0, 3)}`,
+    capabilities: {
+      document: { read: "broad", write: "broad" },
+      rendering: ["overlay", "hitTest", "sceneLayer"],
+      keybindings: true,
+      storage: { blob: true }
+    },
+    // Broad contribution declarations so the neutral DRIVER host (which
+    // registers arbitrary contributions directly in 'warn' mode) never
+    // trips the capability gate. A loaded BUNDLE is the subject — its
+    // OWN manifest is enforced.
+    contributes: {
+      editContexts: [
+        { type: "vectorGraphic", entry: "doubleClick" },
+        { type: "webFrame", entry: "doubleClick" }
+      ],
+      objectTypes: [{ type: "webFrame", bakedFallback: "rectangle" }],
+      importers: ["media.paged.harness.importer.xlsx"],
+      exporters: ["media.paged.harness.exporter.xlsx"]
+    }
+  };
+  let { host, dispose: disposeHostFacades } = buildHost(NEUTRAL, "warn");
+  currentHost = host;
+  const headless = {
+    get host() {
+      return currentHost;
+    },
+    engineVersion: engine.version,
+    protocolVersion: engine.protocolVersion,
+    contributions,
+    toolsContributed() {
+      return contributions.filter((c) => c.kind === "tool").map((c) => c.value);
+    },
+    panelsContributed() {
+      return contributions.filter((c) => c.kind === "panel").map((c) => c.value);
+    },
+    schemaPanelsContributed() {
+      return contributions.filter((c) => c.kind === "schemaPanel").map((c) => c.value);
+    },
+    editContextsContributed() {
+      return contributions.filter((c) => c.kind === "editContext").map((c) => c.value);
+    },
+    objectTypesContributed() {
+      return contributions.filter((c) => c.kind === "objectType").map((c) => c.value);
+    },
+    importersContributed() {
+      return contributions.filter((c) => c.kind === "importer").map((c) => c.value);
+    },
+    exportersContributed() {
+      return contributions.filter((c) => c.kind === "exporter").map((c) => c.value);
+    },
+    lastToolPreview() {
+      return lastPreview;
+    },
+    async load(idml) {
+      const raw = worker.loadDocumentDirect(seqCounter++, idml);
+      const reply = JSON.parse(raw);
+      if (reply.kind === "documentLoaded") {
+        try {
+          worker.runResolveJson();
+        } catch {
+        }
+        return reply.payload.pageIds;
+      }
+      const errKind = reply.kind === "loadFailed" ? reply.payload.error.kind : reply.kind;
+      throw new Error(`headless load failed (${reply.kind}: ${errKind})`);
+    },
+    loadBundle(bundle) {
+      if (active) {
+        throw new Error(
+          "headless host: a bundle is already loaded \u2014 dispose it first (one bundle per headless host in v1)"
+        );
+      }
+      const { manifest } = bundle;
+      if (!satisfiesApiVersion(manifest.apiVersion)) {
+        throw new Error(
+          `headless host: ${manifest.id}@${manifest.version} requires plugin-api "${manifest.apiVersion}", host implements ${API_VERSION}`
+        );
+      }
+      disposeHostFacades();
+      ({ host, dispose: disposeHostFacades } = buildHost(
+        manifest,
+        options.capabilityMode ?? "enforce"
+      ));
+      currentHost = host;
+      const handle = bundle.activate(host);
+      let bundleActive = true;
+      active = {
+        dispose() {
+          if (!bundleActive) return;
+          bundleActive = false;
+          try {
+            handle.dispose();
+          } finally {
+            disposeHostFacades();
+            ({ host, dispose: disposeHostFacades } = buildHost(
+              NEUTRAL,
+              "warn"
+            ));
+            currentHost = host;
+            active = null;
+          }
+        }
+      };
+      return { dispose: () => active?.dispose() };
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      try {
+        if (active) active.dispose();
+        else disposeHostFacades();
+      } finally {
+        contributions.length = 0;
+        lastPreview = null;
+        worker.free();
+      }
+    }
+  };
+  return headless;
+}
+
+// src/asset-source-fake.ts
+function createRecordableAssetSource(seeds = []) {
+  const requests = [];
+  return {
+    requests,
+    async getFontFace(family, style) {
+      requests.push(style === void 0 ? { family } : { family, style });
+      const key = family.trim().toLowerCase();
+      for (const seed of seeds) {
+        if (seed.family.trim().toLowerCase() !== key) continue;
+        if (seed.matchStyle !== void 0 && seed.matchStyle !== style) {
+          continue;
+        }
+        const { matchStyle: _unused, ...face } = seed;
+        void _unused;
+        return face;
+      }
+      return null;
+    }
+  };
+}
+
 // src/load.ts
 var ID_PATTERN = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9-]*)+$/;
 function loadBundle(getEditor, bundle, options) {
   const { manifest } = bundle;
+  const trust = options?.trust ?? "first-party";
+  if (trust !== "first-party") {
+    throw new Error(
+      `loadBundle: ${manifest.id} requested trust="${String(trust)}", but same-realm bundle execution is first-party-only during incubation. Loading non-first-party bundles is gated on the isolate/RPC host, enforced capabilities, and package signing (see plugin-trust-line.md "Gate checklist").`
+    );
+  }
   if (!ID_PATTERN.test(manifest.id)) {
     throw new Error(
       `loadBundle: manifest id "${manifest.id}" is not reverse-DNS (expected e.g. "media.paged.draw")`
@@ -457,6 +1645,88 @@ function loadBundle(getEditor, bundle, options) {
   };
 }
 
+// src/wasm-bundle-loader.ts
+var WASM_BUDGETS = {
+  /** Hard per-artifact byte ceiling. A release-optimised wasm layout
+   *  engine (Blitz-class) lands in the low-single-digit MiB; 8 MiB
+   *  rejects an accidentally-bundled debug build while leaving headroom
+   *  for one real engine. A manifest `maxBytes` may only TIGHTEN this. */
+  maxArtifactBytes: 8 * 1024 * 1024,
+  /** Total declared wasm across one bundle. Bounds a bundle that ships
+   *  several modules (engine + a codec, say). */
+  maxTotalBytes: 16 * 1024 * 1024,
+  /** Wall-clock budget for fetch + compile + instantiate. Protects the
+   *  editor's main flow from a pathological module; advisory, the loader
+   *  aborts with a clear error when exceeded. */
+  loadTimeBudgetMs: 3e3,
+  /** Linear-memory growth ceiling, in 64 KiB wasm pages (4096 = 256 MiB).
+   *  Passed as `WebAssembly.Memory({ maximum })` when the host owns the
+   *  memory; a per-page layout pass should sit far under this. */
+  maxMemoryPages: 4096
+};
+function findArtifact(bundle, name) {
+  return bundle.manifest.capabilities?.wasm?.find((a) => a.name === name);
+}
+function isGranted(grant, name) {
+  if (grant === void 0) return false;
+  if (grant === "*") return true;
+  if (Array.isArray(grant)) return grant.includes(name);
+  return grant.has(name);
+}
+async function loadBundleWasm(bundle, name, options) {
+  const id = bundle.manifest.id;
+  const artifact = findArtifact(bundle, name);
+  if (!artifact) {
+    throw new Error(
+      `loadBundleWasm: ${id} has no declared wasm artifact "${name}" \u2014 only artifacts listed in manifest.capabilities.wasm are loadable (declared-only).`
+    );
+  }
+  if (!isGranted(options.grant, name)) {
+    throw new Error(
+      `loadBundleWasm: wasm artifact "${name}" of ${id} is not granted by the host \u2014 wasm carries no ambient authority; the host must grant it explicitly (pass grant: "*" or a name set).`
+    );
+  }
+  const now = options.now ?? (() => Date.now());
+  const budgetMs = options.loadTimeBudgetMs ?? WASM_BUDGETS.loadTimeBudgetMs;
+  const started = now();
+  const overBudget = (stage) => {
+    throw new Error(
+      `loadBundleWasm: "${name}" of ${id} exceeded the ${budgetMs}ms load-time budget at ${stage} (${Math.round(now() - started)}ms).`
+    );
+  };
+  const bytes = await options.assetSource(artifact.path);
+  if (now() - started > budgetMs) overBudget("fetch");
+  const src = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  const view = new Uint8Array(src.byteLength);
+  view.set(src);
+  const ceiling = typeof artifact.maxBytes === "number" && artifact.maxBytes > 0 ? Math.min(artifact.maxBytes, WASM_BUDGETS.maxArtifactBytes) : WASM_BUDGETS.maxArtifactBytes;
+  if (view.byteLength > ceiling) {
+    throw new Error(
+      `loadBundleWasm: "${name}" of ${id} is ${view.byteLength} bytes, over its ${ceiling}-byte ceiling.`
+    );
+  }
+  let memory;
+  const imports = { ...options.imports ?? {} };
+  const provideMemory = options.provideMemory ?? true;
+  if (provideMemory) {
+    const env = { ...imports.env };
+    if (!("memory" in env)) {
+      memory = new WebAssembly.Memory({
+        initial: options.initialMemoryPages ?? 16,
+        maximum: WASM_BUDGETS.maxMemoryPages
+        // shared is intentionally absent — non-shared memory only (v1).
+      });
+      env.memory = memory;
+    }
+    imports.env = env;
+  }
+  const module = await WebAssembly.compile(view);
+  if (now() - started > budgetMs) overBudget("compile");
+  const instance = await WebAssembly.instantiate(module, imports);
+  if (now() - started > budgetMs) overBudget("instantiate");
+  return { artifact, module, instance, memory, byteLength: view.byteLength };
+}
+
 // src/gestures.ts
 var CLICK_DRAG_THRESHOLD_PX = 4;
 function beginPageDrag(e) {
@@ -520,22 +1790,51 @@ function contributeTool(host, tool) {
 function contributePanel(host, panel) {
   return host.contribute.panel(panel);
 }
+function contributeSchemaPanel(host, panel) {
+  return host.contribute.schemaPanel(panel);
+}
+
+// src/edit-context.ts
+function contributeEditContext(host, contribution) {
+  return host.contribute.editContext(contribution);
+}
+function contributeObjectType(host, contribution) {
+  return host.contribute.objectType(contribution);
+}
 export {
   API_VERSION,
+  ASSET_BUDGETS,
+  BLOB_BUDGETS,
+  CANVAS_WASM_PKG,
   CLICK_DRAG_THRESHOLD_PX,
   DisposableStore,
+  FALLBACK_WIDGETS,
   HOST_FEATURES,
   PluginApiNotImplemented,
+  PluginCapabilityError,
+  WASM_BUDGETS,
   beginPageDrag,
   commitAndSelect,
+  contributeEditContext,
+  contributeObjectType,
   contributePanel,
+  contributeSchemaPanel,
   contributeTool,
   createBundleHost,
+  createDataProviderRegistry,
   createHeadlessHost,
+  createRecordableAssetSource,
   defineBundle,
   endLocalFor,
   loadBundle,
+  loadBundleWasm,
+  loadHeadlessEngine,
+  makeSchemaPanelComponent,
+  protocolFromVersion,
   pxToPt,
+  readVendoredWireVersion,
+  resolveCanvasWasm,
+  resolveGate,
   satisfiesApiVersion,
   toDisposable
 };