@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.3

package/dist/svelte/lib/canvas-lifecycle.js

@@ -0,0 +1,99 @@
+/**
+ * Applet canvas lifecycle — pure state machine, no Svelte reactivity.
+ *
+ * The canvas transitions through these states:
+ *
+ *   loading → ready → approved → mounted → (running | crashed | unresponsive)
+ *                ↑                                  ↓
+ *                ←←← revoked / expired / disposed ←←←
+ *
+ * CRITICAL INVARIANT: no bundle URL, modulepreload, or runner document
+ * may enter the DOM before the `approved` state. The `loading` and `ready`
+ * states carry ONLY inert release metadata (digest, version, capabilities).
+ */
+export function createCanvasContext() {
+    return {
+        state: 'loading',
+        consented: false,
+        runnerMounted: false,
+        heartbeatCount: 0,
+        error: null
+    };
+}
+/** Transition to `ready` — metadata loaded, awaiting consent. */
+export function transitionToReady(ctx) {
+    if (ctx.state !== 'loading')
+        return ctx;
+    return { ...ctx, state: 'ready' };
+}
+/** Transition to `approved` — consent granted, may now mount the runner. */
+export function transitionToApproved(ctx) {
+    if (ctx.state !== 'ready')
+        return ctx;
+    return { ...ctx, state: 'approved', consented: true };
+}
+/** Transition to `mounted` — runner frame is in the DOM. */
+export function transitionToMounted(ctx) {
+    if (ctx.state !== 'approved')
+        return ctx;
+    return { ...ctx, state: 'mounted', runnerMounted: true };
+}
+/** Transition to `running` — runner handshake completed. */
+export function transitionToRunning(ctx) {
+    if (ctx.state !== 'mounted')
+        return ctx;
+    return { ...ctx, state: 'running' };
+}
+/** Record a heartbeat from the runner. */
+export function recordHeartbeat(ctx) {
+    return { ...ctx, heartbeatCount: ctx.heartbeatCount + 1 };
+}
+/** Transition to `crashed` — runner reported an error. */
+export function transitionToCrashed(ctx, error) {
+    return { ...ctx, state: 'crashed', error };
+}
+/** Transition to `unresponsive` — heartbeat timeout. */
+export function transitionToUnresponsive(ctx) {
+    return { ...ctx, state: 'unresponsive' };
+}
+/** Transition to `revoked` — capabilities revoked by user. */
+export function transitionToRevoked(ctx) {
+    return { ...ctx, state: 'revoked', consented: false };
+}
+/** Transition to `expired` — launch lease expired. */
+export function transitionToExpired(ctx) {
+    return { ...ctx, state: 'expired' };
+}
+/** Transition to `disposed` — runner destroyed, ports closed. */
+export function transitionToDisposed(ctx) {
+    return { ...ctx, state: 'disposed', runnerMounted: false };
+}
+/**
+ * Returns true if the current state permits mounting the runner.
+ * Only `approved` permits mounting — never `loading`, `ready`, `running`,
+ * `crashed`, etc.
+ */
+export function canMountRunner(ctx) {
+    return ctx.state === 'approved' && ctx.consented;
+}
+/**
+ * Returns true if the current state permits fetching the bundle bytes.
+ * Only `approved` (after consent) permits fetching — never `loading` or
+ * `ready`. This is the network assertion: zero bundle requests before
+ * consent.
+ */
+export function canFetchBundle(ctx) {
+    return ctx.state === 'approved' && ctx.consented;
+}
+/**
+ * Returns true if the current state is terminal (no further transitions).
+ */
+export function isTerminal(ctx) {
+    return ctx.state === 'disposed';
+}
+/**
+ * Returns true if the current state is an error state.
+ */
+export function isErrorState(ctx) {
+    return ctx.state === 'crashed' || ctx.state === 'unresponsive';
+}

package/dist/svelte/lib/capability-review.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Capability review — pure logic for validating requested capabilities
+ * against granted capabilities for one exact release.
+ *
+ * The user consents to a set of capability tags at the exact release
+ * (componentId + version + bundleHash). The canvas shell must reject any
+ * capability the runner requests that was not in the granted set.
+ */
+export interface CapabilityRequest {
+    tag: string;
+    /** Optional reason text supplied by the runner. */
+    reason?: string;
+}
+export interface GrantedCapability {
+    tag: string;
+    /** Reason text the user saw at consent time. */
+    reason: string;
+}
+export interface CapabilityReviewResult {
+    approved: string[];
+    rejected: string[];
+    /** True if all requests were approved. */
+    allApproved: boolean;
+}
+/**
+ * Review runner-requested capabilities against the granted set.
+ * Returns approved (in the granted set) and rejected (not granted).
+ */
+export declare function reviewCapabilities(requested: CapabilityRequest[], granted: GrantedCapability[]): CapabilityReviewResult;
+/**
+ * Returns true if the granted capabilities match the exact release
+ * (componentId + version + bundleHash). A grant from a different
+ * release is not valid — re-consent is required.
+ */
+export declare function isGrantValidForRelease(grant: {
+    componentId: string;
+    version: string;
+    bundleHash: string;
+}, release: {
+    componentId: string;
+    version: string;
+    bundleHash: string;
+}): boolean;
+/**
+ * Returns true if the bundle hash matches the expected digest.
+ * The runner must verify the bytes it received match the hash consented to.
+ */
+export declare function verifyBundleHash(actualHash: string, expectedHash: string): boolean;
+/**
+ * Normalize the registry's SHA-256 spelling.
+ *
+ * Platform currently persists the bare lowercase hex digest. Accepting the
+ * explicit `sha256:<hex>` spelling keeps the wire self-describing without
+ * weakening verification to arbitrary labels such as `sha256-test`.
+ */
+export declare function normalizeBundleSha256(value: string): string | null;
+/** Compute the digest of the exact bytes that will cross into the runner. */
+export declare function bundleSha256Hex(bytes: ArrayBuffer): Promise<string>;
+/**
+ * Bind execution to registry truth. The fetcher's reported hash is metadata;
+ * only hashing the received bytes proves what will actually execute.
+ */
+export declare function verifyBundleBytes(bytes: ArrayBuffer, expectedHash: string): Promise<boolean>;
+//# sourceMappingURL=capability-review.d.ts.map

package/dist/svelte/lib/capability-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-review.d.ts","sourceRoot":"","sources":["../../../src/svelte/lib/capability-review.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0CAA0C;IAC1C,WAAW,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,iBAAiB,EAAE,EAC9B,OAAO,EAAE,iBAAiB,EAAE,GAC1B,sBAAsB,CAkBxB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACnE,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnE,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAElF;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMlE;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACtC,KAAK,EAAE,WAAW,EAClB,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/svelte/lib/capability-review.js

@@ -0,0 +1,77 @@
+/**
+ * Capability review — pure logic for validating requested capabilities
+ * against granted capabilities for one exact release.
+ *
+ * The user consents to a set of capability tags at the exact release
+ * (componentId + version + bundleHash). The canvas shell must reject any
+ * capability the runner requests that was not in the granted set.
+ */
+/**
+ * Review runner-requested capabilities against the granted set.
+ * Returns approved (in the granted set) and rejected (not granted).
+ */
+export function reviewCapabilities(requested, granted) {
+    const grantedTags = new Set(granted.map((g) => g.tag));
+    const approved = [];
+    const rejected = [];
+    for (const req of requested) {
+        if (grantedTags.has(req.tag)) {
+            approved.push(req.tag);
+        }
+        else {
+            rejected.push(req.tag);
+        }
+    }
+    return {
+        approved,
+        rejected,
+        allApproved: rejected.length === 0
+    };
+}
+/**
+ * Returns true if the granted capabilities match the exact release
+ * (componentId + version + bundleHash). A grant from a different
+ * release is not valid — re-consent is required.
+ */
+export function isGrantValidForRelease(grant, release) {
+    return (grant.componentId === release.componentId &&
+        grant.version === release.version &&
+        grant.bundleHash === release.bundleHash);
+}
+/**
+ * Returns true if the bundle hash matches the expected digest.
+ * The runner must verify the bytes it received match the hash consented to.
+ */
+export function verifyBundleHash(actualHash, expectedHash) {
+    return actualHash === expectedHash;
+}
+const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/i;
+/**
+ * Normalize the registry's SHA-256 spelling.
+ *
+ * Platform currently persists the bare lowercase hex digest. Accepting the
+ * explicit `sha256:<hex>` spelling keeps the wire self-describing without
+ * weakening verification to arbitrary labels such as `sha256-test`.
+ */
+export function normalizeBundleSha256(value) {
+    const trimmed = value.trim();
+    const digest = trimmed.toLowerCase().startsWith('sha256:')
+        ? trimmed.slice('sha256:'.length)
+        : trimmed;
+    return SHA256_HEX_PATTERN.test(digest) ? digest.toLowerCase() : null;
+}
+/** Compute the digest of the exact bytes that will cross into the runner. */
+export async function bundleSha256Hex(bytes) {
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Bind execution to registry truth. The fetcher's reported hash is metadata;
+ * only hashing the received bytes proves what will actually execute.
+ */
+export async function verifyBundleBytes(bytes, expectedHash) {
+    const expected = normalizeBundleSha256(expectedHash);
+    if (!expected)
+        return false;
+    return (await bundleSha256Hex(bytes)) === expected;
+}

package/dist/svelte/lib/message-protocol.d.ts

@@ -0,0 +1,184 @@
+/**
+ * Versioned MessagePort protocol — the wire format between the trusted
+ * wrapper (host) and the isolated runner (frame).
+ *
+ * Every message carries a protocol version. The host rejects any message
+ * with an unsupported version. The handshake establishes the version before
+ * any code execution or capability requests.
+ *
+ * Disposal: the host sends `dispose`, the frame acks, both sides close
+ * the port. The host must persist revocation BEFORE closing ports.
+ */
+import { type JsonObject, type JsonValue } from '@vibesdotdev/kernel/schemas/json';
+export declare const PROTOCOL_VERSION: 1;
+export declare const MAX_BUNDLE_BYTES: number;
+export interface RunnerConnectionMessage {
+    type: 'vibes.applet.connect';
+    version: number;
+    launchToken: string;
+}
+export interface RunnerBootMessage {
+    type: 'vibes.applet.booted';
+    version: number;
+    launchToken: string;
+}
+/**
+ * Dispatch travels to the frame as a PORT message. The envelope shape is owned
+ * by `@vibesdotdev/applets` — imported, not restated, because this package may
+ * depend on the base package. The runner mirrors it by value and
+ * `apps/applet-runner/test/protocol-parity.test.ts` locks the two together.
+ */
+export type { AppletDispatchRequest, AppletDispatchResponse } from '@vibesdotdev/applets';
+export type HostMessage = {
+    type: 'mount';
+    version: number;
+    nonce: string;
+    capabilities: string[];
+    bundleHash: string;
+    bundleBytes: ArrayBuffer;
+    /** Stamped by the host; the frame reports it back to applet code. */
+    instanceId: string;
+    release: {
+        componentId: string;
+        version: string;
+        bundleHash: string;
+    };
+    /** Store ids the release declared. The frame refuses handles for others. */
+    declaredStorageIds: string[];
+} | {
+    type: 'state';
+    scope: 'shared' | 'viewer';
+    revision: number;
+    state: JsonObject;
+} | {
+    type: 'dispose';
+};
+export type RunnerMessage = {
+    type: 'ready';
+    version: number;
+    launchToken: string;
+} | {
+    type: 'mounted';
+    nonce: string;
+} | {
+    type: 'heartbeat';
+} | {
+    type: 'capability.request';
+    capabilities: {
+        tag: string;
+        reason?: string;
+    }[];
+} | {
+    type: 'state.mutate';
+    scope: 'shared' | 'viewer';
+    operationId: string;
+    expectedRevision: number;
+    eventType: string;
+    payload: JsonObject;
+} | {
+    type: 'event';
+    eventType: string;
+    payload: JsonObject;
+} | {
+    type: 'error';
+    nonce?: string;
+    code: string;
+    message: string;
+} | {
+    type: 'disposed';
+};
+export interface HandshakeResult {
+    success: boolean;
+    /** The version negotiated, or null on failure. */
+    version: number | null;
+    /** Error message on failure. */
+    error: string | null;
+}
+/**
+ * Validate a runner handshake message. The host rejects any version it
+ * does not support.
+ */
+export declare function validateHandshake(msg: unknown, launchToken?: string): HandshakeResult;
+export declare function createRunnerConnectionMessage(launchToken: string): RunnerConnectionMessage;
+export declare function isRunnerBootMessage(event: Pick<MessageEvent, 'data' | 'origin' | 'source'>, expectedSource: MessageEventSource, launchToken: string): event is Pick<MessageEvent, 'data' | 'origin' | 'source'> & {
+    data: RunnerBootMessage;
+};
+export interface CorrelatedRunnerUrl {
+    href: string;
+    origin: string;
+}
+/**
+ * Add one ephemeral launch capability to the runner URL. The fragment never
+ * reaches the runner server and is paired with the exact parent origin.
+ */
+export declare function createCorrelatedRunnerUrl(runnerUrl: string, launchToken: string, parentOrigin: string): CorrelatedRunnerUrl;
+/**
+ * Create a mount message — sent after handshake success and consent.
+ */
+export declare function createMountMessage(nonce: string, capabilities: string[], bundleHash: string, bundleBytes: ArrayBuffer, 
+/**
+ * Identity and declared stores, stamped by the HOST.
+ *
+ * The frame reports `applet.instanceId` back to applet code and refuses a
+ * storage handle for anything not in `declaredStorageIds`. Neither can be
+ * derived inside the frame, and an applet that names its own instance names
+ * someone else's — so they cross here, from the side that knows.
+ */
+identity?: {
+    instanceId: string;
+    release: {
+        componentId: string;
+        version: string;
+        bundleHash: string;
+    };
+    declaredStorageIds: string[];
+}): HostMessage;
+/**
+ * Create a dispose message — sent when the host is tearing down the runner.
+ */
+export declare function createDisposeMessage(): HostMessage;
+/**
+ * Recognize a dispatch result coming back from the frame.
+ *
+ * Only the correlation and the envelope are checked here. The RESULT is
+ * third-party output and is parsed by `parseAppletDispatchResponse` in
+ * `@vibesdotdev/applets` before it reaches a caller — recognizing a message is
+ * not the same as trusting its contents.
+ */
+export type RunnerMessageWire = JsonValue | undefined;
+export declare function isDispatchResult(msg: RunnerMessageWire, correlationId: string): msg is {
+    type: 'dispatch.result';
+    correlationId: string;
+    response: JsonValue;
+};
+/**
+ * Returns true if a runner message is a heartbeat.
+ */
+export declare function isHeartbeat(msg: RunnerMessageWire): msg is Extract<RunnerMessage, {
+    type: 'heartbeat';
+}>;
+/**
+ * Returns true if a runner message is a capability request.
+ */
+export declare function isCapabilityRequest(msg: RunnerMessageWire): msg is Extract<RunnerMessage, {
+    type: 'capability.request';
+}>;
+/**
+ * Returns true if a runner message is a state mutation.
+ */
+export declare function isStateMutation(msg: RunnerMessageWire): msg is Extract<RunnerMessage, {
+    type: 'state.mutate';
+}>;
+/**
+ * Returns true if a runner message is a disposed ack.
+ */
+export declare function isDisposedAck(msg: RunnerMessageWire): msg is Extract<RunnerMessage, {
+    type: 'disposed';
+}>;
+export declare function isMountedAck(msg: RunnerMessageWire, nonce: string): msg is Extract<RunnerMessage, {
+    type: 'mounted';
+}>;
+export declare function isRunnerError(msg: RunnerMessageWire): msg is Extract<RunnerMessage, {
+    type: 'error';
+}>;
+//# sourceMappingURL=message-protocol.d.ts.map

package/dist/svelte/lib/message-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-protocol.d.ts","sourceRoot":"","sources":["../../../src/svelte/lib/message-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGN,KAAK,UAAU,EACf,KAAK,SAAS,EACd,MAAM,kCAAkC,CAAC;AAE1C,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAEjD,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,MAAM,MAAM,WAAW,GACpB;IACA,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvB,MAAM,MAAM,aAAa,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAChF;IACA,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAExB,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gCAAgC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAcD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,eAAe,CA6BrF;AAED,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAK1F;AAaD,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACvD,cAAc,EAAE,kBAAkB,EAClC,WAAW,EAAE,MAAM,GACjB,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IAC9D,IAAI,EAAE,iBAAiB,CAAC;CACxB,CAQA;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,mBAAmB,CA0BrB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,WAAW;AACxB;;;;;;;GAOG;AACH,QAAQ,CAAC,EAAE;IACV,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC7B,GACC,WAAW,CAkCb;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,WAAW,CAElD;AAQD;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtD,wBAAgB,gBAAgB,CAC/B,GAAG,EAAE,iBAAiB,EACtB,aAAa,EAAE,MAAM,GACnB,GAAG,IAAI;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,CAShF;AAMD;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAExG;AAYD;;GAEG;AACH,wBAAgB,mBAAmB,CAClC,GAAG,EAAE,iBAAiB,GACpB,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAE/D;AAWD;;GAEG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,iBAAiB,GACpB,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAEzD;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAEzG;AAOD,wBAAgB,YAAY,CAC3B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,MAAM,GACX,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAMpD;AASD,wBAAgB,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAEtG"}

package/dist/svelte/lib/message-protocol.js

@@ -0,0 +1,251 @@
+/**
+ * Versioned MessagePort protocol — the wire format between the trusted
+ * wrapper (host) and the isolated runner (frame).
+ *
+ * Every message carries a protocol version. The host rejects any message
+ * with an unsupported version. The handshake establishes the version before
+ * any code execution or capability requests.
+ *
+ * Disposal: the host sends `dispose`, the frame acks, both sides close
+ * the port. The host must persist revocation BEFORE closing ports.
+ */
+import * as z from 'zod/v4';
+import { JsonObjectSchema, JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+export const PROTOCOL_VERSION = 1;
+export const MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
+const correlationIdSchema = z.string().min(32).max(128).regex(/^[a-zA-Z0-9_-]+$/);
+function isCorrelationId(value) {
+    return correlationIdSchema.safeParse(value).success;
+}
+const handshakeCandidateSchema = z.object({
+    type: z.string().optional(),
+    version: z.number().optional(),
+    launchToken: z.string().optional()
+}).passthrough();
+/**
+ * Validate a runner handshake message. The host rejects any version it
+ * does not support.
+ */
+export function validateHandshake(msg, launchToken) {
+    const parsed = handshakeCandidateSchema.safeParse(msg);
+    if (!parsed.success || parsed.data.type !== 'ready') {
+        const type = parsed.success && parsed.data.type ? parsed.data.type : 'unknown';
+        return { success: false, version: null, error: `Expected 'ready', got '${type}'` };
+    }
+    if (parsed.data.version !== PROTOCOL_VERSION) {
+        return {
+            success: false,
+            version: null,
+            error: `Unsupported protocol version ${parsed.data.version}, expected ${PROTOCOL_VERSION}`
+        };
+    }
+    const token = parsed.data.launchToken;
+    if (!token || !isCorrelationId(token)) {
+        return {
+            success: false,
+            version: null,
+            error: 'Runner handshake omitted a valid launch correlation'
+        };
+    }
+    if (launchToken !== undefined && token !== launchToken) {
+        return {
+            success: false,
+            version: null,
+            error: 'Runner launch correlation did not match'
+        };
+    }
+    return { success: true, version: parsed.data.version, error: null };
+}
+export function createRunnerConnectionMessage(launchToken) {
+    if (!isCorrelationId(launchToken)) {
+        throw new Error('Applet launch correlation must be a strong opaque identifier.');
+    }
+    return { type: 'vibes.applet.connect', version: PROTOCOL_VERSION, launchToken };
+}
+/**
+ * Authenticate the runner's data-less boot signal before transferring the one
+ * control port. An allow-scripts-only sandbox always reports origin "null", so
+ * the exact WindowProxy and fragment correlation carry the identity here.
+ */
+const runnerBootCandidateSchema = z.object({
+    type: z.literal('vibes.applet.booted'),
+    version: z.literal(PROTOCOL_VERSION),
+    launchToken: z.string().min(1)
+});
+export function isRunnerBootMessage(event, expectedSource, launchToken) {
+    const parsed = runnerBootCandidateSchema.safeParse(event.data);
+    return (event.source === expectedSource &&
+        event.origin === 'null' &&
+        parsed.success &&
+        parsed.data.launchToken === launchToken);
+}
+/**
+ * Add one ephemeral launch capability to the runner URL. The fragment never
+ * reaches the runner server and is paired with the exact parent origin.
+ */
+export function createCorrelatedRunnerUrl(runnerUrl, launchToken, parentOrigin) {
+    const url = new URL(runnerUrl);
+    if (!['https:', 'http:'].includes(url.protocol) || url.origin === 'null') {
+        throw new Error('Applet runner URL must use an HTTP(S) origin.');
+    }
+    let parent;
+    try {
+        parent = new URL(parentOrigin);
+    }
+    catch (cause) {
+        throw new Error('Applet host must have an HTTP(S) origin.', { cause });
+    }
+    if (!['https:', 'http:'].includes(parent.protocol) || parent.origin !== parentOrigin) {
+        throw new Error('Applet host must have an HTTP(S) origin.');
+    }
+    if (!isCorrelationId(launchToken)) {
+        throw new Error('Applet launch correlation must be a strong opaque identifier.');
+    }
+    if (url.origin === parent.origin) {
+        throw new Error('Applet runner must use a separate origin from its host.');
+    }
+    const fragment = new URLSearchParams({
+        launch: launchToken,
+        parent: parentOrigin
+    });
+    url.hash = fragment.toString();
+    return { href: url.href, origin: url.origin };
+}
+/**
+ * Create a mount message — sent after handshake success and consent.
+ */
+export function createMountMessage(nonce, capabilities, bundleHash, bundleBytes, 
+/**
+ * Identity and declared stores, stamped by the HOST.
+ *
+ * The frame reports `applet.instanceId` back to applet code and refuses a
+ * storage handle for anything not in `declaredStorageIds`. Neither can be
+ * derived inside the frame, and an applet that names its own instance names
+ * someone else's — so they cross here, from the side that knows.
+ */
+identity) {
+    if (!isCorrelationId(nonce)) {
+        throw new Error('Applet mount correlation must be a strong opaque identifier.');
+    }
+    if (!z.array(z.string()).safeParse(capabilities).success) {
+        throw new Error('Applet capabilities must be strings.');
+    }
+    if (!normalizeBundleSha256(bundleHash)) {
+        throw new Error('Applet bundle hash must be a SHA-256 digest.');
+    }
+    if (bundleBytes.byteLength === 0 || bundleBytes.byteLength > MAX_BUNDLE_BYTES) {
+        throw new Error(`Applet bundle must be between 1 and ${MAX_BUNDLE_BYTES} bytes.`);
+    }
+    return {
+        type: 'mount',
+        version: PROTOCOL_VERSION,
+        nonce,
+        capabilities,
+        bundleHash,
+        bundleBytes,
+        instanceId: identity?.instanceId ?? '',
+        // Rebuilt as PLAIN fields, never passed through.
+        //
+        // `release` and `declaredStorageIds` arrive as component props, which in
+        // Svelte 5 are reactive proxies — and `postMessage` cannot structured-clone
+        // a proxy. The e2e caught it as "could not be cloned" after the frame had
+        // already mounted, which is the worst place to learn it.
+        release: {
+            componentId: identity?.release.componentId ?? '',
+            version: identity?.release.version ?? '',
+            bundleHash: identity?.release.bundleHash ?? bundleHash
+        },
+        declaredStorageIds: [...(identity?.declaredStorageIds ?? [])]
+    };
+}
+/**
+ * Create a dispose message — sent when the host is tearing down the runner.
+ */
+export function createDisposeMessage() {
+    return { type: 'dispose' };
+}
+const dispatchResultCandidateSchema = z.object({
+    type: z.literal('dispatch.result'),
+    correlationId: z.string(),
+    response: JsonValueSchema
+});
+export function isDispatchResult(msg, correlationId) {
+    const parsed = dispatchResultCandidateSchema.safeParse(msg);
+    if (!parsed.success) {
+        return false;
+    }
+    return (parsed.data.correlationId === correlationId &&
+        isCorrelationId(parsed.data.correlationId));
+}
+const heartbeatSchema = z.object({
+    type: z.literal('heartbeat')
+});
+/**
+ * Returns true if a runner message is a heartbeat.
+ */
+export function isHeartbeat(msg) {
+    return heartbeatSchema.safeParse(msg).success;
+}
+const capabilityRequestSchema = z.object({
+    type: z.literal('capability.request'),
+    capabilities: z.array(z.object({
+        tag: z.string(),
+        reason: z.string().optional()
+    }))
+});
+/**
+ * Returns true if a runner message is a capability request.
+ */
+export function isCapabilityRequest(msg) {
+    return capabilityRequestSchema.safeParse(msg).success;
+}
+const stateMutationSchema = z.object({
+    type: z.literal('state.mutate'),
+    scope: z.enum(['shared', 'viewer']),
+    operationId: z.string(),
+    expectedRevision: z.number().int().nonnegative(),
+    eventType: z.string(),
+    payload: JsonObjectSchema
+});
+/**
+ * Returns true if a runner message is a state mutation.
+ */
+export function isStateMutation(msg) {
+    return stateMutationSchema.safeParse(msg).success;
+}
+const disposedAckSchema = z.object({
+    type: z.literal('disposed')
+});
+/**
+ * Returns true if a runner message is a disposed ack.
+ */
+export function isDisposedAck(msg) {
+    return disposedAckSchema.safeParse(msg).success;
+}
+const mountedAckSchema = z.object({
+    type: z.literal('mounted'),
+    nonce: z.string()
+});
+export function isMountedAck(msg, nonce) {
+    const parsed = mountedAckSchema.safeParse(msg);
+    if (!parsed.success) {
+        return false;
+    }
+    return parsed.data.nonce === nonce;
+}
+const runnerErrorSchema = z.object({
+    type: z.literal('error'),
+    code: z.string(),
+    message: z.string(),
+    nonce: z.string().optional()
+});
+export function isRunnerError(msg) {
+    return runnerErrorSchema.safeParse(msg).success;
+}
+function normalizeBundleSha256(value) {
+    const trimmed = value.trim();
+    const digest = trimmed.toLowerCase().startsWith('sha256:')
+        ? trimmed.slice('sha256:'.length)
+        : trimmed;
+    return /^[a-f0-9]{64}$/i.test(digest) ? digest.toLowerCase() : null;
+}