@stackable-labs/sdk-extension-react 1.20.0 → 1.22.0

package/dist/rpc-client.d.ts

@@ -1,12 +1,21 @@
 /**
  * RPC Client — sends capability requests from sandbox to host via postMessage.
+ * Handles transparent AES-256-GCM encryption for data.fetch payloads when
+ * an encryption key is provided by the host.
  */
 import type { CapabilityType } from '@stackable-labs/sdk-extension-contracts';
+/**
+ * Set the encryption key from a base64-encoded string.
+ * Called when the host sends an 'extension-encryption-key' message.
+ */
+export declare const setEncryptionKey: (keyBase64: string) => Promise<void>;
 /**
  * Initialize the RPC listener for responses from the host.
  */
 export declare const initRpcListener: (extensionId: string) => void;
 /**
  * Send a capability request to the host and await the response.
+ * For data.fetch, transparently encrypts the request payload and
+ * decrypts the response when an encryption key is available.
  */
 export declare const callCapability: <T = unknown>(capability: CapabilityType, payload?: unknown) => Promise<T>;

package/dist/rpc-client.js

@@ -1,10 +1,27 @@
 /**
  * RPC Client — sends capability requests from sandbox to host via postMessage.
+ * Handles transparent AES-256-GCM encryption for data.fetch payloads when
+ * an encryption key is provided by the host.
  */
+import { WebCrypto } from '@agnostack/verifyd';
+import { importKeyForEncryption } from '@stackable-labs/lib-utils-js';
+// Lazy-init to avoid accessing globalThis.crypto at module load time.
+// Uses native crypto to ensure CryptoKey compatibility with importKeyForEncryption.
+let _webCrypto = null;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const getWebCrypto = () => (_webCrypto ??= new WebCrypto({ crypto: globalThis.crypto }));
 let requestCounter = 0;
 let registeredExtensionId = 'unknown';
+let encryptionKey = null;
 const pendingRequests = new Map();
 const generateRequestId = () => `req_${++requestCounter}_${Date.now()}`;
+/**
+ * Set the encryption key from a base64-encoded string.
+ * Called when the host sends an 'extension-encryption-key' message.
+ */
+export const setEncryptionKey = async (keyBase64) => {
+    encryptionKey = await importKeyForEncryption(keyBase64);
+};
 /**
  * Initialize the RPC listener for responses from the host.
  */
@@ -12,6 +29,11 @@ export const initRpcListener = (extensionId) => {
     registeredExtensionId = extensionId;
     window.addEventListener('message', (event) => {
         const msg = event.data;
+        // Handle encryption key distribution from host
+        if (msg?.type === 'extension-encryption-key') {
+            setEncryptionKey(msg.encryptionKey);
+            return;
+        }
         if (msg?.type === 'capability-response') {
             const response = msg;
             const pending = pendingRequests.get(response.id);
@@ -27,10 +49,36 @@ export const initRpcListener = (extensionId) => {
         }
     });
 };
+const isEncryptedPayload = (value) => typeof value === 'object' && value !== null && value.encrypted === true && Array.isArray(value.data);
 /**
  * Send a capability request to the host and await the response.
+ * For data.fetch, transparently encrypts the request payload and
+ * decrypts the response when an encryption key is available.
+ */
+export const callCapability = async (capability, payload) => {
+    let actualPayload = payload;
+    // Encrypt data.fetch payloads if we have an encryption key
+    if (capability === 'data.fetch' && encryptionKey) {
+        const encrypted = await getWebCrypto().encryptMessage(JSON.stringify(payload), encryptionKey);
+        if (!encrypted)
+            throw new Error('Failed to encrypt data.fetch payload');
+        actualPayload = { encrypted: true, data: encrypted };
+    }
+    const result = await sendCapabilityRequest(capability, actualPayload);
+    // Decrypt data.fetch response if it came back encrypted
+    if (capability === 'data.fetch' && encryptionKey) {
+        const fetchResult = result;
+        if (isEncryptedPayload(fetchResult.data)) {
+            const decrypted = await getWebCrypto().decryptMessage(fetchResult.data.data, encryptionKey);
+            fetchResult.data = JSON.parse(decrypted);
+        }
+    }
+    return result;
+};
+/**
+ * Low-level: send a capability request to the host and await the response via postMessage.
  */
-export const callCapability = (capability, payload) => (new Promise((resolve, reject) => {
+const sendCapabilityRequest = (capability, payload) => (new Promise((resolve, reject) => {
     const id = generateRequestId();
     pendingRequests.set(id, {
         resolve: resolve,

package/dist/rpc-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-client.js","sourceRoot":"","sources":["../src/rpc-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,IAAI,cAAc,GAAG,CAAC,CAAA;AACtB,IAAI,qBAAqB,GAAG,SAAS,CAAA;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAG3B,CAAA;AAEJ,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAQ,EAAE;IAC3D,qBAAqB,GAAG,WAAW,CAAA;IACnC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAmB,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAA;QACtB,IAAI,GAAG,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,GAAyB,CAAA;YAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACnC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBAChC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAA;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAc,UAA0B,EAAE,OAAiB,EAAc,EAAE,CAAC,CACxG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE;QACtB,OAAO,EAAE,OAAkC;QAC3C,MAAM;KACP,CAAC,CAAA;IAEF,MAAM,OAAO,GAAsB;QACjC,IAAI,EAAE,oBAAoB;QAC1B,EAAE;QACF,WAAW,EAAE,qBAAqB;QAClC,UAAU;QACV,OAAO;KACR,CAAA;IAED,+BAA+B;IAC/B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvC,2BAA2B;IAC3B,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,UAAU,aAAa,CAAC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAA;AACX,CAAC,CAAC,CACH,CAAA"}
+{"version":3,"file":"rpc-client.js","sourceRoot":"","sources":["../src/rpc-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAErE,sEAAsE;AACtE,oFAAoF;AACpF,IAAI,UAAU,GAA0C,IAAI,CAAA;AAC5D,8DAA8D;AAC9D,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAS,CAAC,CAAC,CAAA;AAE/F,IAAI,cAAc,GAAG,CAAC,CAAA;AACtB,IAAI,qBAAqB,GAAG,SAAS,CAAA;AACrC,IAAI,aAAa,GAAqB,IAAI,CAAA;AAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,EAG3B,CAAA;AAEJ,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;IACzE,aAAa,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAA;AACzD,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAQ,EAAE;IAC3D,qBAAqB,GAAG,WAAW,CAAA;IACnC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAmB,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAA;QAEtB,+CAA+C;QAC/C,IAAI,GAAG,EAAE,IAAI,KAAK,0BAA0B,EAAE,CAAC;YAC7C,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAED,IAAI,GAAG,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,GAAyB,CAAA;YAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACnC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBAChC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAA;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA0B,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAA;AAElJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAe,UAA0B,EAAE,OAAiB,EAAc,EAAE;IAC7G,IAAI,aAAa,GAAG,OAAO,CAAA;IAE3B,2DAA2D;IAC3D,IAAI,UAAU,KAAK,YAAY,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAA;QAC7F,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACvE,aAAa,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAA6B,CAAA;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAI,UAAU,EAAE,aAAa,CAAC,CAAA;IAExE,wDAAwD;IACxD,IAAI,UAAU,KAAK,YAAY,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAiC,CAAA;QACrD,IAAI,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAC3F,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAc,UAA0B,EAAE,OAAiB,EAAc,EAAE,CAAC,CACxG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE;QACtB,OAAO,EAAE,OAAkC;QAC3C,MAAM;KACP,CAAC,CAAA;IAEF,MAAM,OAAO,GAAsB;QACjC,IAAI,EAAE,oBAAoB;QAC1B,EAAE;QACF,WAAW,EAAE,qBAAqB;QAClC,UAAU;QACV,OAAO;KACR,CAAA;IAED,+BAA+B;IAC/B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvC,2BAA2B;IAC3B,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,UAAU,aAAa,CAAC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAA;AACX,CAAC,CAAC,CACH,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackable-labs/sdk-extension-react",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -12,7 +12,9 @@
     }
   },
   "dependencies": {
-    "@stackable-labs/sdk-extension-contracts": "1.20.0",
+    "@agnostack/verifyd": "2.x",
+    "@stackable-labs/lib-utils-js": "workspace:*",
+    "@stackable-labs/sdk-extension-contracts": "1.22.0",
     "@remote-dom/core": "1.x",
     "@remote-dom/react": "1.x"
   },