@paged-media/plugin-sdk 0.2.8-canary.0 → 0.2.10-canary.0

package/dist/index.d.ts

@@ -129,7 +129,31 @@ interface DataProviderBackend {
  *  providers and consumers (different plugin hosts) meet through it. Reference
  *  implementation — an RPC/isolate host swaps a proxy with the same contract. */
 declare function createDataProviderRegistry(): DataProviderBackend;
+/**
+ * Trust posture the HOST asserts for a bundle at the load path
+ * (`plugin-trust-line.md`). Same-realm execution — full `BundleHost`
+ * + the raw `PagedEditor` via `host.editor` — is FIRST-PARTY-ONLY
+ * during incubation. There is no sound *cryptographic* identity signal
+ * yet (package signing is the last unchecked gate box), and the
+ * manifest `id` namespace (`media.paged.*`) is SELF-ASSERTED — a
+ * foreign bundle could claim it — so the trust signal cannot come from
+ * the bundle. It comes from the HOST vouching, here: a value the
+ * caller supplies, defaulting to `'first-party'`. The loader refuses
+ * anything else (`load.ts`), turning the drift-by-default the trust
+ * line warns about (a quiet dynamic-import of foreign code on the
+ * same-realm path) into a deliberate, greppable, reviewable act that
+ * still does not load until the isolate/RPC host gate is built.
+ */
+type BundleTrust = "first-party";
 interface CreateBundleHostOptions {
+    /**
+     * The host's trust assertion for this bundle (`plugin-trust-line.md`).
+     * Defaults to `'first-party'` — the only value the loader accepts
+     * today. Passing any other value (e.g. via a future dynamic-import
+     * experiment) is refused loudly at the load path, gated on the
+     * isolate/RPC host + capability enforcement + signing.
+     */
+    trust?: BundleTrust;
     storage?: StorageBacking;
     /** Host-provided network consent (paged.data D-03; base-idea §11): the editor
      *  injects the consent prompt + the data-source-manifest UI. When absent,
@@ -553,4 +577,4 @@ declare function contributeEditContext(host: BundleHost, contribution: EditConte
  *  descent. Capability-gated on `contributes.objectTypes`. */
 declare function contributeObjectType(host: BundleHost, contribution: ObjectTypeContribution): Disposable;
 
-export { API_VERSION, ASSET_BUDGETS, BLOB_BUDGETS, type BlobStore, type BundleAssetProvider, type BundleAssetSource, type BundleHostHandle, CANVAS_WASM_PKG, CLICK_DRAG_THRESHOLD_PX, type ConsentBackend, type CreateBundleHostOptions, type DataProviderBackend, type DiagnosticsSink, DisposableStore, FALLBACK_WIDGETS, HOST_FEATURES, type HarnessOptions, type HeadlessCanvasWorker, type HeadlessHost, type HeadlessHostHandle, type LoadBundleWasmOptions, type LoadHeadlessEngineOptions, type LoadedBundle, type LoadedBundleWasm, type LoadedEngine, type PageDrag, PluginApiNotImplemented, PluginCapabilityError, type RecordableAssetSource, type RecordedContribution, type RecordedFontFaceRequest, type SeededFace, type StorageBacking, WASM_BUDGETS, beginPageDrag, commitAndSelect, contributeEditContext, contributeObjectType, contributePanel, contributeSchemaPanel, contributeTool, createBundleHost, createDataProviderRegistry, createHeadlessHost, createRecordableAssetSource, defineBundle, endLocalFor, loadBundle, loadBundleWasm, loadHeadlessEngine, makeSchemaPanelComponent, protocolFromVersion, pxToPt, readVendoredWireVersion, resolveCanvasWasm, resolveGate, satisfiesApiVersion, toDisposable };
+export { API_VERSION, ASSET_BUDGETS, BLOB_BUDGETS, type BlobStore, type BundleAssetProvider, type BundleAssetSource, type BundleHostHandle, type BundleTrust, CANVAS_WASM_PKG, CLICK_DRAG_THRESHOLD_PX, type ConsentBackend, type CreateBundleHostOptions, type DataProviderBackend, type DiagnosticsSink, DisposableStore, FALLBACK_WIDGETS, HOST_FEATURES, type HarnessOptions, type HeadlessCanvasWorker, type HeadlessHost, type HeadlessHostHandle, type LoadBundleWasmOptions, type LoadHeadlessEngineOptions, type LoadedBundle, type LoadedBundleWasm, type LoadedEngine, type PageDrag, PluginApiNotImplemented, PluginCapabilityError, type RecordableAssetSource, type RecordedContribution, type RecordedFontFaceRequest, type SeededFace, type StorageBacking, WASM_BUDGETS, beginPageDrag, commitAndSelect, contributeEditContext, contributeObjectType, contributePanel, contributeSchemaPanel, contributeTool, createBundleHost, createDataProviderRegistry, createHeadlessHost, createRecordableAssetSource, defineBundle, endLocalFor, loadBundle, loadBundleWasm, loadHeadlessEngine, makeSchemaPanelComponent, protocolFromVersion, pxToPt, readVendoredWireVersion, resolveCanvasWasm, resolveGate, satisfiesApiVersion, toDisposable };

package/dist/index.js

@@ -136,7 +136,12 @@ var HOST_FEATURES = [
   "viewport@1",
   "overlay.toolPreview@1",
   "storage@1",
-  "diagnostics@1"
+  "diagnostics@1",
+  // C-5 / I-04 (core v42): the placed-image bytes read is engine-served
+  // through the wire (no injected source), so it is unconditionally
+  // implemented at the pinned canvas-wasm — unlike assets.fonts@1, which
+  // stays conditional on the editor's injected byte source.
+  "assets.images@1"
 ];
 var PluginApiNotImplemented = class extends Error {
   constructor(member, pointer) {
@@ -919,6 +924,38 @@ function createBundleHost(getEditor, manifest, options) {
         return null;
       }
       return face;
+    },
+    // C-5 / I-04 (core v42): a placed DOCUMENT image's ORIGINAL bytes,
+    // straight from the engine's resolver/parse cache through the
+    // `requestPlacedAssetBytes` wire query — no injected source needed
+    // (the engine IS the byte holder). `found:false` and any channel
+    // failure both answer `null`, the door's honest no-bytes mode. No
+    // size clamp: document-scale originals (PSDs) are the use case and
+    // the engine only serves what the document already holds.
+    async getPlacedImage(elementId) {
+      requireDeclared(
+        hasAsset("images"),
+        "assets.getPlacedImage",
+        'capabilities.assets must include "images"'
+      );
+      try {
+        const reply = await getEditor().client.send({
+          kind: "requestPlacedAssetBytes",
+          payload: { elementId }
+        });
+        if (reply.kind !== "placedAssetBytes" || !reply.payload.found) {
+          return null;
+        }
+        const p = reply.payload;
+        return {
+          bytes: Uint8Array.from(p.encoded),
+          uri: p.uri,
+          width: p.width,
+          height: p.height
+        };
+      } catch {
+        return null;
+      }
     }
   };
   const blobBackend = options?.blobStore;
@@ -1568,6 +1605,12 @@ function createRecordableAssetSource(seeds = []) {
 var ID_PATTERN = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9-]*)+$/;
 function loadBundle(getEditor, bundle, options) {
   const { manifest } = bundle;
+  const trust = options?.trust ?? "first-party";
+  if (trust !== "first-party") {
+    throw new Error(
+      `loadBundle: ${manifest.id} requested trust="${String(trust)}", but same-realm bundle execution is first-party-only during incubation. Loading non-first-party bundles is gated on the isolate/RPC host, enforced capabilities, and package signing (see plugin-trust-line.md "Gate checklist").`
+    );
+  }
   if (!ID_PATTERN.test(manifest.id)) {
     throw new Error(
       `loadBundle: manifest id "${manifest.id}" is not reverse-DNS (expected e.g. "media.paged.draw")`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paged-media/plugin-sdk",
-  "version": "0.2.8-canary.0",
+  "version": "0.2.10-canary.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -11,7 +11,7 @@
     }
   },
   "dependencies": {
-    "@paged-media/plugin-api": "0.2.8-canary.0"
+    "@paged-media/plugin-api": "0.2.10-canary.0"
   },
   "peerDependencies": {
     "react": "^18.3.0"
@@ -22,7 +22,7 @@
     }
   },
   "devDependencies": {
-    "@paged-media/canvas-wasm": "0.40.0",
+    "@paged-media/canvas-wasm": "0.42.0",
     "@types/node": "20.19.39",
     "@types/react": "^18.3.12",
     "react": "^18.3.0",