@zaflun/lumio-sdk 0.6.3 → 0.6.6

package/dist/index.js

@@ -3,6 +3,15 @@ import { createRoot } from "react-dom/client";
 var RENDER_TIMEOUT_MS = 1e4;
 var hasRendered = false;
 var renderTimeout = null;
+function hostOrigin() {
+  try {
+    if (typeof document !== "undefined" && document.referrer) {
+      return new URL(document.referrer).origin;
+    }
+  } catch {
+  }
+  return "*";
+}
 function startRenderTimeout() {
   if (renderTimeout) return;
   renderTimeout = setTimeout(() => {
@@ -16,7 +25,7 @@ function startRenderTimeout() {
           code: "RENDER_TIMEOUT",
           message: "Extension did not render within 10 seconds"
         },
-        "*"
+        hostOrigin()
       );
     }
   }, RENDER_TIMEOUT_MS);
@@ -39,7 +48,7 @@ var Lumio = {
     }
     const root = createRoot(rootElement);
     root.render(element);
-    window.parent.postMessage({ type: "READY" }, "*");
+    window.parent.postMessage({ type: "READY" }, hostOrigin());
     void options;
   }
 };
@@ -1007,12 +1016,21 @@ function formatFromPath(path) {
   if (lower.endsWith(".woff")) return "woff";
   return "truetype";
 }
+var FAMILY_RE = /^[\w -]+$/;
+function escapeCssUrl(src) {
+  return src.replace(/[\\"\n\r\f]/g, (c) => `\\${c}`);
+}
 function buildFontFace(family, src, display, weight, style) {
+  if (!FAMILY_RE.test(family)) {
+    throw new Error(
+      `Invalid font family "${family}": only letters, digits, spaces, "-" and "_" are allowed.`
+    );
+  }
   const format = formatFromPath(src);
   const lines = [
     "@font-face {",
     `  font-family: "${family}";`,
-    `  src: url("${src}") format("${format}");`,
+    `  src: url("${escapeCssUrl(src)}") format("${format}");`,
     `  font-display: ${display};`
   ];
   if (weight !== void 0) {

package/dist/lumio-runtime.global.js

@@ -31,9 +31,9 @@
     mod
   ));
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react.production.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react.production.js
   var require_react_production = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react.production.js"(exports$1) {
       var REACT_ELEMENT_TYPE = /* @__PURE__ */ Symbol.for("react.transitional.element");
       var REACT_PORTAL_TYPE = /* @__PURE__ */ Symbol.for("react.portal");
       var REACT_FRAGMENT_TYPE = /* @__PURE__ */ Symbol.for("react.fragment");
@@ -467,22 +467,22 @@
       exports$1.useTransition = function() {
         return ReactSharedInternals.H.useTransition();
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/index.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/index.js
   var require_react = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/index.js"(exports$1, module) {
       {
         module.exports = require_react_production();
       }
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react-jsx-runtime.production.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react-jsx-runtime.production.js
   var require_react_jsx_runtime_production = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react-jsx-runtime.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react-jsx-runtime.production.js"(exports$1) {
       var REACT_ELEMENT_TYPE = /* @__PURE__ */ Symbol.for("react.transitional.element");
       var REACT_FRAGMENT_TYPE = /* @__PURE__ */ Symbol.for("react.fragment");
       function jsxProd(type, config2, maybeKey) {
@@ -509,9 +509,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/jsx-runtime.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/jsx-runtime.js
   var require_jsx_runtime = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/jsx-runtime.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/jsx-runtime.js"(exports$1, module) {
       {
         module.exports = require_react_jsx_runtime_production();
       }
@@ -799,9 +799,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom.production.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom.production.js
   var require_react_dom_production = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom.production.js"(exports$1) {
       var React33 = require_react();
       function formatProdErrorMessage(code) {
         var url2 = "https://react.dev/errors/" + code;
@@ -943,13 +943,13 @@
       exports$1.useFormStatus = function() {
         return ReactSharedInternals.H.useHostTransitionStatus();
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/index.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/index.js
   var require_react_dom = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/index.js"(exports$1, module) {
       function checkDCE() {
         if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ === "undefined" || typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE !== "function") {
           return;
@@ -967,9 +967,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom-client.production.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom-client.production.js
   var require_react_dom_client_production = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom-client.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom-client.production.js"(exports$1) {
       var Scheduler = require_scheduler();
       var React33 = require_react();
       var ReactDOM = require_react_dom();
@@ -12608,12 +12608,12 @@
         }
       };
       var isomorphicReactPackageVersion$jscomp$inline_1840 = React33.version;
-      if ("19.2.5" !== isomorphicReactPackageVersion$jscomp$inline_1840)
+      if ("19.2.8" !== isomorphicReactPackageVersion$jscomp$inline_1840)
         throw Error(
           formatProdErrorMessage(
             527,
             isomorphicReactPackageVersion$jscomp$inline_1840,
-            "19.2.5"
+            "19.2.8"
           )
         );
       ReactDOMSharedInternals.findDOMNode = function(componentOrElement) {
@@ -12631,10 +12631,10 @@
       };
       var internals$jscomp$inline_2347 = {
         bundleType: 0,
-        version: "19.2.5",
+        version: "19.2.8",
         rendererPackageName: "react-dom",
         currentDispatcherRef: ReactSharedInternals,
-        reconcilerVersion: "19.2.5"
+        reconcilerVersion: "19.2.8"
       };
       if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
         hook$jscomp$inline_2348 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
@@ -12702,13 +12702,13 @@
         listenToAllSupportedEvents(container);
         return new ReactDOMHydrationRoot(initialChildren);
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/client.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/client.js
   var require_client = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/client.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/client.js"(exports$1, module) {
       function checkDCE() {
         if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ === "undefined" || typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE !== "function") {
           return;
@@ -13007,9 +13007,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/cjs/react-reconciler.production.js
+  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/cjs/react-reconciler.production.js
   var require_react_reconciler_production = __commonJS({
-    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/cjs/react-reconciler.production.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/cjs/react-reconciler.production.js"(exports$1, module) {
       module.exports = function($$$config) {
         function createFiber(tag, pendingProps, key, mode) {
           return new FiberNode(tag, pendingProps, key, mode);
@@ -20834,9 +20834,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/index.js
+  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/index.js
   var require_react_reconciler = __commonJS({
-    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/index.js"(exports$1, module) {
       {
         module.exports = require_react_reconciler_production();
       }
@@ -20909,6 +20909,15 @@
   var RENDER_TIMEOUT_MS = 1e4;
   var hasRendered = false;
   var renderTimeout = null;
+  function hostOrigin() {
+    try {
+      if (typeof document !== "undefined" && document.referrer) {
+        return new URL(document.referrer).origin;
+      }
+    } catch {
+    }
+    return "*";
+  }
   function startRenderTimeout() {
     if (renderTimeout) return;
     renderTimeout = setTimeout(() => {
@@ -20922,7 +20931,7 @@
             code: "RENDER_TIMEOUT",
             message: "Extension did not render within 10 seconds"
           },
-          "*"
+          hostOrigin()
         );
       }
     }, RENDER_TIMEOUT_MS);
@@ -20945,7 +20954,7 @@
       }
       const root = (0, import_client.createRoot)(rootElement);
       root.render(element);
-      window.parent.postMessage({ type: "READY" }, "*");
+      window.parent.postMessage({ type: "READY" }, hostOrigin());
     }
   };
 
@@ -21360,6 +21369,7 @@
   var dist_exports = {};
   __export(dist_exports, {
     ACTION_TYPES: () => ACTION_TYPES,
+    EXTENSION_RUNTIME_LABEL_PLACEHOLDER: () => EXTENSION_RUNTIME_LABEL_PLACEHOLDER,
     HOST_METHODS: () => HOST_METHODS,
     LUMIO_COMPONENT_TYPES: () => LUMIO_COMPONENT_TYPES,
     LUMIO_EVENT_TYPES: () => LUMIO_EVENT_TYPES,
@@ -21371,7 +21381,11 @@
     errorMessageSchema: () => errorMessageSchema,
     eventMessageSchema: () => eventMessageSchema,
     extensionConfigSchema: () => extensionConfigSchema,
+    extensionRuntimeLabel: () => extensionRuntimeLabel,
+    extensionRuntimeOrigin: () => extensionRuntimeOrigin,
+    extensionRuntimeOriginLabel: () => extensionRuntimeOriginLabel,
     initMessageSchema: () => initMessageSchema,
+    isValidExtensionRuntimeOriginTemplate: () => isValidExtensionRuntimeOriginTemplate,
     lumioActionTypeSchema: () => lumioActionTypeSchema,
     lumioEventTypeSchema: () => lumioEventTypeSchema,
     lumioMessageSchema: () => lumioMessageSchema,
@@ -21387,6 +21401,50 @@
     themeSchema: () => themeSchema
   });
 
+  // ../protocol/dist/chunk-746VSR4E.js
+  var EXTENSION_RUNTIME_LABEL_PLACEHOLDER = "{label}";
+  var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+  var LABEL_PATTERN = /^[0-9a-f]{32}$/;
+  var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  var TEMPLATE_PATTERN = /^(https:\/\/|http:\/\/)\{label\}(\.[a-z0-9.-]+(?::[0-9]{1,5})?)$/;
+  function parseTemplate(template) {
+    const match = TEMPLATE_PATTERN.exec(template);
+    if (!match) return null;
+    const prefix = match[1];
+    const suffix = match[2];
+    const host = suffix.slice(1).replace(/:[0-9]+$/, "");
+    if (prefix === "http://" && host !== "localhost") return null;
+    if (!host.split(".").every((label) => DNS_LABEL_PATTERN.test(label))) return null;
+    const sample = `${prefix}${"0".repeat(32)}${suffix}`;
+    try {
+      if (new URL(sample).origin !== sample) return null;
+    } catch {
+      return null;
+    }
+    return { prefix, suffix };
+  }
+  function extensionRuntimeLabel(extensionId) {
+    if (typeof extensionId !== "string" || !UUID_PATTERN.test(extensionId)) return null;
+    return extensionId.replaceAll("-", "");
+  }
+  function extensionRuntimeOrigin(extensionId, template) {
+    const label = extensionRuntimeLabel(extensionId);
+    if (!label) return null;
+    const parsed = parseTemplate(template);
+    if (!parsed) return null;
+    return `${parsed.prefix}${label}${parsed.suffix}`;
+  }
+  function extensionRuntimeOriginLabel(origin, template) {
+    const parsed = parseTemplate(template);
+    if (!parsed) return null;
+    if (!origin.startsWith(parsed.prefix) || !origin.endsWith(parsed.suffix)) return null;
+    const label = origin.slice(parsed.prefix.length, origin.length - parsed.suffix.length);
+    return LABEL_PATTERN.test(label) ? label : null;
+  }
+  function isValidExtensionRuntimeOriginTemplate(template) {
+    return parseTemplate(template) !== null;
+  }
+
   // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.js
   var external_exports = {};
   __export(external_exports, {
@@ -35286,15 +35344,22 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "youtube:gift_membership",
     "youtube:gift_membership_received",
     "youtube:poll",
-    // Kick
+    // YouTube stream lifecycle (ZAF-1444 / ZAF-622 §75) — emitted by the poll-driven
+    // YouTube worker on the channel-status online/offline edge, mirroring Twitch/Kick.
+    "youtube:stream_online",
+    "youtube:stream_offline",
+    // Kick — the webhook receiver normalizes every Kick payload into these types
+    // (ZAF-1624): canonical fields on top, the original payload kept in `raw`.
     "kick:follower",
     "kick:subscribe",
+    "kick:resub",
     "kick:gift",
+    "kick:kicks",
+    "kick:reward",
+    "kick:reward_status",
     "kick:stream_online",
     "kick:stream_offline",
-    // Trovo
-    "trovo:subscribe",
-    "trovo:spell",
+    "kick:stream_update",
     // Spotify
     "spotify:track",
     "spotify:play",
@@ -35314,7 +35379,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "twitch:chat",
     "youtube:chat",
     "kick:chat",
-    "trovo:chat",
     // Chat (cross-platform catch-all — fires for ALL platforms)
     "chat:message"
   ];
@@ -36009,12 +36073,21 @@ ${stops}
     if (lower.endsWith(".woff")) return "woff";
     return "truetype";
   }
+  var FAMILY_RE = /^[\w -]+$/;
+  function escapeCssUrl(src) {
+    return src.replace(/[\\"\n\r\f]/g, (c) => `\\${c}`);
+  }
   function buildFontFace(family, src, display, weight, style) {
+    if (!FAMILY_RE.test(family)) {
+      throw new Error(
+        `Invalid font family "${family}": only letters, digits, spaces, "-" and "_" are allowed.`
+      );
+    }
     const format = formatFromPath(src);
     const lines = [
       "@font-face {",
       `  font-family: "${family}";`,
-      `  src: url("${src}") format("${format}");`,
+      `  src: url("${escapeCssUrl(src)}") format("${format}");`,
       `  font-display: ${display};`
     ];
     if (weight !== void 0) {
@@ -36567,7 +36640,77 @@ ${stops}
     }
   };
 
+  // src/runtime/lockdown.ts
+  var BLOCKED_GLOBAL_PROPS = [
+    // Origin-scoped storage
+    "indexedDB",
+    "caches",
+    // Cross-context channels on the shared origin
+    "BroadcastChannel",
+    // Nested workers would start with a fresh, un-locked global
+    "Worker",
+    "SharedWorker",
+    // Legacy origin-scoped file systems (Chromium)
+    "webkitRequestFileSystem",
+    "webkitRequestFileSystemSync",
+    "webkitResolveLocalFileSystemURL",
+    "webkitResolveLocalFileSystemSyncURL"
+  ];
+  var BLOCKED_NAVIGATOR_PROPS = [
+    // StorageManager — quota, persistence and the origin-private file system
+    "storage",
+    // Web Locks are shared by every context on the origin
+    "locks",
+    // Service workers are registered per origin
+    "serviceWorker",
+    // Storage Buckets (Chromium 122+) — each bucket opens its own indexedDB,
+    // caches and getDirectory(), all shared across the origin
+    "storageBuckets"
+  ];
+  function blockedError(prop) {
+    const message = `${prop} is not available in the Lumio extension sandbox`;
+    return typeof DOMException === "function" ? new DOMException(message, "SecurityError") : new Error(message);
+  }
+  function blockProperty(target, prop) {
+    const descriptor = {
+      get() {
+        throw blockedError(prop);
+      },
+      set() {
+        throw blockedError(prop);
+      },
+      enumerable: false,
+      configurable: false
+    };
+    let obj = Object.getPrototypeOf(target);
+    while (obj && obj !== Object.prototype) {
+      if (Object.prototype.hasOwnProperty.call(obj, prop)) {
+        try {
+          Object.defineProperty(obj, prop, descriptor);
+        } catch {
+        }
+      }
+      obj = Object.getPrototypeOf(obj);
+    }
+    try {
+      Object.defineProperty(target, prop, descriptor);
+    } catch {
+    }
+  }
+  function lockDownWorkerGlobal(scope = globalThis) {
+    const nav = scope.navigator;
+    for (const prop of BLOCKED_GLOBAL_PROPS) {
+      blockProperty(scope, prop);
+    }
+    if (nav && typeof nav === "object") {
+      for (const prop of BLOCKED_NAVIGATOR_PROPS) {
+        blockProperty(nav, prop);
+      }
+    }
+  }
+
   // src/runtime/worker-entry.ts
+  lockDownWorkerGlobal();
   var LumioSDK = {
     ...src_exports,
     Lumio: Lumio2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zaflun/lumio-sdk",
-  "version": "0.6.3",
-  "description": "Lumio Extension SDK — React components, hooks, and server utilities for building Lumio extensions",
+  "version": "0.6.6",
+  "description": "Lumio Extension SDK - React components, hooks, and server utilities for building Lumio extensions",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -23,8 +23,8 @@
   ],
   "dependencies": {
     "react-reconciler": "^0.32.0",
-    "@zaflun/lumio-protocol": "0.2.3",
-    "@zaflun/lumio-extension-types": "0.3.2"
+    "@zaflun/lumio-extension-types": "0.3.3",
+    "@zaflun/lumio-protocol": "0.6.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
@@ -32,17 +32,17 @@
   },
   "devDependencies": {
     "@testing-library/react": "^16.1.0",
-    "@types/react": "^19.1.0",
-    "@types/react-dom": "^19.1.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@types/react-reconciler": "^0.32.0",
     "jsdom": "^26.1.0",
-    "lucide-static": "^1.16.0",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
+    "lucide-static": "^1.30.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "tsup": "^8.4.0",
-    "typescript": "^5.8.3",
+    "typescript": "^6.0.3",
     "unicode-emoji-json": "^0.9.0",
-    "vitest": "^3.1.4"
+    "vitest": "^4.1.10"
   },
   "license": "MIT",
   "publishConfig": {