cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/renderer/restricted-content/index.js

@@ -0,0 +1,4 @@
+export { encodeRestrictedJson, RESTRICTED_LIMITS } from './json.js';
+export { validateRestrictedScene } from './scene.js';
+export { mountRestrictedScene, } from './renderer.js';
+//# sourceMappingURL=index.js.map

package/dist/src/renderer/restricted-content/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAuB,MAAM,WAAW,CAAA;AACxF,OAAO,EAAkD,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpG,OAAO,EACL,oBAAoB,GAKrB,MAAM,eAAe,CAAA"}

package/dist/src/renderer/restricted-content/json.d.ts

@@ -0,0 +1,17 @@
+export type RestrictedJson = null | boolean | number | string | readonly RestrictedJson[] | {
+    readonly [key: string]: RestrictedJson;
+};
+export declare const RESTRICTED_LIMITS: Readonly<{
+    sceneBytes: number;
+    actionBytes: number;
+    publishesPerSecond: 30;
+    depth: 16;
+    nodes: 65536;
+    sceneNodes: 1024;
+    children: 400;
+    textLength: 2048;
+}>;
+/** Validate before serialization: reject getters, cycles, non-JSON values and excessive nesting. */
+export declare function encodeRestrictedJson(value: unknown, maxBytes: number, maxDepth?: number): string;
+export declare function decodeRestrictedJson(value: unknown, maxBytes: number): RestrictedJson;
+//# sourceMappingURL=json.d.ts.map

package/dist/src/renderer/restricted-content/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/json.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,cAAc,EAAE,GAAG;IAC1F,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;CACvC,CAAA;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;EAS5B,CAAA;AAEF,oGAAoG;AACpG,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAgC,GACzC,MAAM,CA6CR;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAKrF"}

package/dist/src/renderer/restricted-content/json.js

@@ -0,0 +1,80 @@
+export const RESTRICTED_LIMITS = Object.freeze({
+    sceneBytes: 64 * 1024,
+    actionBytes: 4 * 1024,
+    publishesPerSecond: 30,
+    depth: 16,
+    nodes: 65_536,
+    sceneNodes: 1024,
+    children: 400,
+    textLength: 2048,
+});
+/** Validate before serialization: reject getters, cycles, non-JSON values and excessive nesting. */
+export function encodeRestrictedJson(value, maxBytes, maxDepth = RESTRICTED_LIMITS.depth) {
+    let nodes = 0;
+    let roughBytes = 0;
+    const seen = new Set();
+    function visit(item, depth) {
+        if (++nodes > RESTRICTED_LIMITS.nodes || depth > maxDepth)
+            throw new Error('JSON complexity limit');
+        if (item === null || typeof item === 'boolean')
+            return;
+        if (typeof item === 'string') {
+            roughBytes += item.length;
+            if (roughBytes > maxBytes)
+                throw new Error('JSON size limit');
+            return;
+        }
+        if (typeof item === 'number' && Number.isFinite(item))
+            return;
+        if (typeof item !== 'object' || item === null)
+            throw new Error('Expected JSON');
+        if (seen.has(item))
+            throw new Error('Cyclic JSON');
+        const proto = Object.getPrototypeOf(item);
+        if (Array.isArray(item) && proto !== Array.prototype)
+            throw new Error('Expected JSON array prototype');
+        if (!Array.isArray(item) && proto !== Object.prototype && proto !== null)
+            throw new Error('Expected JSON object');
+        seen.add(item);
+        const keys = Reflect.ownKeys(item);
+        if (keys.length > RESTRICTED_LIMITS.nodes)
+            throw new Error('JSON complexity limit');
+        if (Array.isArray(item) && (item.length > RESTRICTED_LIMITS.nodes || keys.length !== item.length + 1)) {
+            throw new Error('Expected dense JSON array');
+        }
+        for (const key of keys) {
+            if (Array.isArray(item) && key === 'length')
+                continue;
+            if (typeof key !== 'string')
+                throw new Error('Expected JSON key');
+            if (!Array.isArray(item)) {
+                roughBytes += key.length;
+                if (roughBytes > maxBytes)
+                    throw new Error('JSON size limit');
+            }
+            if (key === '__proto__' || key === 'prototype' || key === 'constructor')
+                throw new Error('Unsafe JSON key');
+            if (Array.isArray(item) && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= item.length)) {
+                throw new Error('Expected JSON array index');
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            if (!descriptor.enumerable || !('value' in descriptor))
+                throw new Error('Expected JSON data property');
+            visit(descriptor.value, depth + 1);
+        }
+        seen.delete(item);
+    }
+    visit(value, 1);
+    const encoded = JSON.stringify(value);
+    if (new TextEncoder().encode(encoded).byteLength > maxBytes)
+        throw new Error('JSON size limit');
+    return encoded;
+}
+export function decodeRestrictedJson(value, maxBytes) {
+    if (typeof value !== 'string' || value.length > maxBytes)
+        throw new Error('Expected bounded JSON string');
+    const decoded = JSON.parse(value);
+    encodeRestrictedJson(decoded, maxBytes);
+    return decoded;
+}
+//# sourceMappingURL=json.js.map

package/dist/src/renderer/restricted-content/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/json.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,WAAW,EAAE,CAAC,GAAG,IAAI;IACrB,kBAAkB,EAAE,EAAE;IACtB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,MAAM;IACb,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,GAAG;IACb,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,QAAgB,EAChB,WAAmB,iBAAiB,CAAC,KAAK;IAE1C,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,SAAS,KAAK,CAAC,IAAa,EAAE,KAAa;QACzC,IAAI,EAAE,KAAK,GAAG,iBAAiB,CAAC,KAAK,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACnG,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,SAAS;YAAE,OAAM;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,UAAU,IAAI,IAAI,CAAC,MAAM,CAAA;YACzB,IAAI,UAAU,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;YAC7D,OAAM;QACR,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAM;QAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QAC/E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACjH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACnF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAQ;YACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;YACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,UAAU,IAAI,GAAG,CAAC,MAAM,CAAA;gBACxB,IAAI,UAAU,GAAG,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;YAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YAC9C,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAE,CAAA;YAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACtG,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACf,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/F,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,QAAgB;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACzG,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1C,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACvC,OAAO,OAAyB,CAAA;AAClC,CAAC"}

package/dist/src/renderer/restricted-content/renderer.d.ts

@@ -0,0 +1,31 @@
+import { type RestrictedJson } from './json.js';
+import { type RestrictedScene } from './scene.js';
+export type RestrictedScenePublishResult = {
+    readonly status: 'accepted';
+} | {
+    readonly status: 'rejected';
+    readonly code: 'invalid-scene' | 'stale-sequence' | 'disposed' | 'rate-limited';
+};
+export interface RestrictedSceneSeat {
+    publish(snapshot: {
+        readonly sequence: number;
+        readonly scene: RestrictedScene | null;
+    }): RestrictedScenePublishResult;
+    dispose(): void;
+}
+export interface RestrictedSceneMountOptions {
+    readonly element: HTMLElement;
+    readonly onAction: (action: {
+        readonly sequence: number;
+        readonly payload: RestrictedJson;
+    }) => RestrictedSceneActionResult | Promise<RestrictedSceneActionResult>;
+    /** Host-owned owner/generation fence. Never derived from scene or action data. */
+    readonly isCurrent: () => boolean;
+    readonly signal?: AbortSignal;
+}
+export interface RestrictedSceneActionResult {
+    readonly status: 'accepted' | 'rejected' | 'uncertain';
+}
+/** Renders only a validated data tree. No uploaded browser JavaScript or HTML runs. */
+export declare function mountRestrictedScene(options: RestrictedSceneMountOptions): RestrictedSceneSeat;
+//# sourceMappingURL=renderer.d.ts.map

package/dist/src/renderer/restricted-content/renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/renderer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,GAAG,cAAc,CAAA;CAAE,CAAA;AAEpH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,GAAG,4BAA4B,CAAA;IACtH,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,CACjB,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;KAAE,KACpE,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvE,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,CAAA;CACvD;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,mBAAmB,CAwK9F"}

package/dist/src/renderer/restricted-content/renderer.js

@@ -0,0 +1,177 @@
+import { RESTRICTED_LIMITS } from './json.js';
+import { validateRestrictedScene, validRestrictedNumber, } from './scene.js';
+/** Renders only a validated data tree. No uploaded browser JavaScript or HTML runs. */
+export function mountRestrictedScene(options) {
+    const { element } = options;
+    const doc = element.ownerDocument;
+    const surface = doc.createElement('div');
+    surface.dataset.cordisxRestrictedScene = 'v1';
+    const root = surface.attachShadow({ mode: 'closed' });
+    const style = doc.createElement('style');
+    // All selectors and values are Host-owned. No scene string enters CSS.
+    style.textContent = `
+    :host { display: block; color: inherit; font: inherit; overflow-wrap: anywhere; }
+    * { box-sizing: border-box; min-width: 0; }
+    .stack { display: flex; flex-direction: column; gap: 8px; }
+    .horizontal { flex-direction: row; flex-wrap: wrap; align-items: center; }
+    .grid { display: grid; gap: 4px; }
+    .muted { opacity: .7; }
+    .accent { font-weight: 600; }
+    .text { white-space: pre-wrap; }
+    button, input { font: inherit; color: inherit; background: transparent; border: 1px solid currentColor; border-radius: 4px; padding: 6px; }
+    button { cursor: pointer; white-space: pre-wrap; }
+    button:disabled { opacity: .5; cursor: default; }
+    button:focus-visible { outline: 2px solid currentColor; outline-offset: 2px; }
+  `;
+    const body = doc.createElement('div');
+    root.append(style, body);
+    element.append(surface);
+    let disposed = false;
+    let sequence = -1;
+    let revision = 0;
+    let acted = false;
+    let windowStart = 0;
+    let windowCount = 0;
+    let controls = [];
+    function current() {
+        return !disposed && !options.signal?.aborted && options.isCurrent();
+    }
+    function clear() {
+        revision++;
+        controls = [];
+        body.replaceChildren();
+    }
+    function dispose() {
+        if (disposed)
+            return;
+        disposed = true;
+        clear();
+        surface.remove();
+        options.signal?.removeEventListener('abort', dispose);
+    }
+    function render(node, activeRevision, activeSequence) {
+        if (node.type === 'text') {
+            const text = doc.createElement('div');
+            text.className = `text ${node.tone ?? 'default'}`;
+            text.textContent = node.text;
+            return text;
+        }
+        if (node.type === 'button' || node.type === 'number-action') {
+            const button = doc.createElement('button');
+            button.type = 'button';
+            button.textContent = node.label;
+            button.disabled = node.type === 'button' && node.disabled === true;
+            if (node.type === 'button' && node.ariaLabel !== undefined)
+                button.setAttribute('aria-label', node.ariaLabel);
+            let input;
+            let container;
+            if (node.type === 'number-action') {
+                container = doc.createElement('div');
+                container.className = 'stack';
+                const field = doc.createElement('label');
+                field.className = 'stack';
+                const label = doc.createElement('span');
+                label.textContent = node.label;
+                input = doc.createElement('input');
+                input.type = 'number';
+                input.min = String(node.min);
+                input.max = String(node.max);
+                input.step = String(node.step);
+                input.value = String(node.value);
+                input.setAttribute('aria-label', node.label);
+                field.append(label, input);
+                container.append(field, button);
+                controls.push(input);
+            }
+            button.addEventListener('click', () => {
+                if (!current() || !surface.isConnected || !button.isConnected || button.disabled || acted
+                    || activeRevision !== revision || activeSequence !== sequence)
+                    return;
+                let payload = node.action;
+                if (node.type === 'number-action') {
+                    const value = input.valueAsNumber;
+                    if (!validRestrictedNumber(node, value)) {
+                        input.setCustomValidity('Enter a whole number within the allowed range and step.');
+                        input.reportValidity();
+                        return;
+                    }
+                    input.setCustomValidity('');
+                    payload = { ...node.action, [node.valueKey]: value };
+                }
+                // Lock before invoking client code, including re-entrant callbacks.
+                acted = true;
+                const activeControls = controls.map(control => ({ control, disabled: control.disabled }));
+                for (const sibling of controls)
+                    sibling.disabled = true;
+                void (async () => {
+                    try {
+                        const result = await options.onAction({
+                            sequence: activeSequence,
+                            payload: JSON.parse(JSON.stringify(payload)),
+                        });
+                        // Only explicit rejection is safe to retry. Unknown/throw/accepted
+                        // remain locked until reconciliation publishes a fresh projection.
+                        if (result?.status !== 'rejected' || !current() || activeRevision !== revision || activeSequence !== sequence)
+                            return;
+                        acted = false;
+                        for (const { control, disabled } of activeControls)
+                            control.disabled = disabled;
+                    }
+                    catch { /* Ambiguous outcome: client must reconcile using the same idempotency key. */ }
+                })();
+            });
+            controls.push(button);
+            return container ?? button;
+        }
+        const container = doc.createElement('div');
+        if (node.type === 'grid') {
+            container.className = 'grid';
+            container.style.gridTemplateColumns = `repeat(${node.columns}, minmax(0, 1fr))`;
+        }
+        else {
+            container.className = node.direction === 'horizontal' ? 'stack horizontal' : 'stack';
+        }
+        for (const child of node.children)
+            container.append(render(child, activeRevision, activeSequence));
+        return container;
+    }
+    const seat = {
+        publish(snapshot) {
+            if (!current()) {
+                dispose();
+                return { status: 'rejected', code: 'disposed' };
+            }
+            if (!Number.isSafeInteger(snapshot.sequence) || snapshot.sequence < 0 || snapshot.sequence <= sequence) {
+                return { status: 'rejected', code: 'stale-sequence' };
+            }
+            sequence = snapshot.sequence;
+            acted = false;
+            // Invalidate prior actions even if this newer projection is malformed.
+            clear();
+            const now = performance.now();
+            if (now - windowStart >= 1000) {
+                windowStart = now;
+                windowCount = 0;
+            }
+            if (++windowCount > RESTRICTED_LIMITS.publishesPerSecond)
+                return { status: 'rejected', code: 'rate-limited' };
+            if (snapshot.scene === null)
+                return { status: 'accepted' };
+            let scene;
+            try {
+                scene = validateRestrictedScene(snapshot.scene);
+            }
+            catch {
+                return { status: 'rejected', code: 'invalid-scene' };
+            }
+            body.append(render(scene.root, revision, sequence));
+            return { status: 'accepted' };
+        },
+        dispose,
+    };
+    options.signal?.addEventListener('abort', dispose, { once: true });
+    if (!current())
+        dispose();
+    return seat;
+}
+//# sourceMappingURL=renderer.js.map

package/dist/src/renderer/restricted-content/renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.js","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/renderer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAuB,MAAM,WAAW,CAAA;AAClE,OAAO,EAGL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,YAAY,CAAA;AAyBnB,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAA;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,CAAC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAA;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACxC,uEAAuE;IACvE,KAAK,CAAC,WAAW,GAAG;;;;;;;;;;;;;GAanB,CAAA;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,QAAQ,GAA6C,EAAE,CAAA;IAE3D,SAAS,OAAO;QACd,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,SAAS,KAAK;QACZ,QAAQ,EAAE,CAAA;QACV,QAAQ,GAAG,EAAE,CAAA;QACb,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAED,SAAS,OAAO;QACd,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,KAAK,EAAE,CAAA;QACP,OAAO,CAAC,MAAM,EAAE,CAAA;QAChB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,SAAS,MAAM,CAAC,IAAyB,EAAE,cAAsB,EAAE,cAAsB;QACvF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;YACrC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAA;YACjD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAA;YAC5B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC1C,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAA;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;YAC/B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA;YAClE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC7G,IAAI,KAAmC,CAAA;YACvC,IAAI,SAAqC,CAAA;YACzC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAClC,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpC,SAAS,CAAC,SAAS,GAAG,OAAO,CAAA;gBAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;gBACxC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAA;gBACzB,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;gBACvC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;gBAC9B,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;gBAClC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAA;gBACrB,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC5B,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC5B,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC9B,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC5C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBAC1B,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBAC/B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpC,IACE,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK;uBAClF,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,QAAQ;oBAC7D,OAAM;gBACR,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;gBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBAClC,MAAM,KAAK,GAAG,KAAM,CAAC,aAAa,CAAA;oBAClC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;wBACxC,KAAM,CAAC,iBAAiB,CAAC,yDAAyD,CAAC,CAAA;wBACnF,KAAM,CAAC,cAAc,EAAE,CAAA;wBACvB,OAAM;oBACR,CAAC;oBACD,KAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;oBAC5B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAA;gBACtD,CAAC;gBACD,oEAAoE;gBACpE,KAAK,GAAG,IAAI,CAAA;gBACZ,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBACzF,KAAK,MAAM,OAAO,IAAI,QAAQ;oBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACvD,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;4BACpC,QAAQ,EAAE,cAAc;4BACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAmB;yBAC/D,CAAC,CAAA;wBACF,mEAAmE;wBACnE,mEAAmE;wBACnE,IACE,MAAM,EAAE,MAAM,KAAK,UAAU,IAAI,CAAC,OAAO,EAAE,IAAI,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,QAAQ;4BACzG,OAAM;wBACR,KAAK,GAAG,KAAK,CAAA;wBACb,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,cAAc;4BAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAA;oBACjF,CAAC;oBAAC,MAAM,CAAC,CAAC,8EAA8E,CAAC,CAAC;gBAC5F,CAAC,CAAC,EAAE,CAAA;YACN,CAAC,CAAC,CAAA;YACF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,OAAO,SAAS,IAAI,MAAM,CAAA;QAC5B,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,SAAS,CAAC,SAAS,GAAG,MAAM,CAAA;YAC5B,SAAS,CAAC,KAAK,CAAC,mBAAmB,GAAG,UAAU,IAAI,CAAC,OAAO,mBAAmB,CAAA;QACjF,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAA;QACtF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAA;QAClG,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,IAAI,GAAwB;QAChC,OAAO,CAAC,QAAQ;YACd,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBACf,OAAO,EAAE,CAAA;gBACT,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YACjD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;YACvD,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;YAC5B,KAAK,GAAG,KAAK,CAAA;YACb,uEAAuE;YACvE,KAAK,EAAE,CAAA;YACP,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YAC7B,IAAI,GAAG,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC9B,WAAW,GAAG,GAAG,CAAA;gBACjB,WAAW,GAAG,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAAC,kBAAkB;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;YAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;YAC1D,IAAI,KAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,KAAK,GAAG,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;YACtD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;YACnD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC/B,CAAC;QACD,OAAO;KACR,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,CAAA;IACzB,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/renderer/restricted-content/scene.d.ts

@@ -0,0 +1,43 @@
+import { type RestrictedJson } from './json.js';
+export type RestrictedSceneNode = {
+    readonly type: 'text';
+    readonly text: string;
+    readonly tone?: 'default' | 'muted' | 'accent';
+} | {
+    readonly type: 'stack';
+    readonly direction?: 'vertical' | 'horizontal';
+    readonly children: readonly RestrictedSceneNode[];
+} | {
+    readonly type: 'grid';
+    readonly columns: number;
+    readonly children: readonly RestrictedSceneNode[];
+} | {
+    readonly type: 'button';
+    readonly label: string;
+    readonly ariaLabel?: string;
+    readonly action: RestrictedJson;
+    readonly disabled?: boolean;
+} | {
+    readonly type: 'number-action';
+    readonly label: string;
+    readonly min: number;
+    readonly max: number;
+    readonly step: number;
+    readonly value: number;
+    readonly action: {
+        [key: string]: RestrictedJson;
+    };
+    readonly valueKey: string;
+};
+export interface RestrictedScene {
+    readonly version: 1;
+    readonly root: RestrictedSceneNode;
+}
+/** Strict schema; also returns a detached JSON copy so later caller mutation cannot change actions. */
+export declare function validateRestrictedScene(value: unknown): RestrictedScene;
+export declare function validRestrictedNumber(node: {
+    min: number;
+    max: number;
+    step: number;
+}, value: number): boolean;
+//# sourceMappingURL=scene.d.ts.map

package/dist/src/renderer/restricted-content/scene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scene.d.ts","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/scene.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAExF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,GAChG;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAClD,GACC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,GACtG;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAA;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B,CAAA;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CACnC;AAkBD,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CA6EvE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG9G"}

package/dist/src/renderer/restricted-content/scene.js

@@ -0,0 +1,103 @@
+import { encodeRestrictedJson, RESTRICTED_LIMITS } from './json.js';
+function record(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Expected scene object');
+    return value;
+}
+function exactKeys(value, required, optional = []) {
+    if (required.some(key => !Object.hasOwn(value, key)))
+        throw new Error('Missing scene field');
+    if (Object.keys(value).some(key => !required.includes(key) && !optional.includes(key))) {
+        throw new Error('Unknown scene field');
+    }
+}
+function text(value) {
+    if (typeof value !== 'string' || value.length > RESTRICTED_LIMITS.textLength)
+        throw new Error('Invalid scene text');
+}
+/** Strict schema; also returns a detached JSON copy so later caller mutation cannot change actions. */
+export function validateRestrictedScene(value) {
+    // Scene JSON nesting includes children arrays as well as nodes; schema depth
+    // below is the tighter node-depth limit. JSON depth is checked independently
+    // for each action, not for the outer scene representation.
+    const encoded = encodeScene(value);
+    const scene = record(JSON.parse(encoded));
+    exactKeys(scene, ['version', 'root']);
+    if (scene.version !== 1)
+        throw new Error('Unsupported scene version');
+    let nodes = 0;
+    function node(value, depth) {
+        if (++nodes > RESTRICTED_LIMITS.sceneNodes || depth > RESTRICTED_LIMITS.depth) {
+            throw new Error('Scene complexity limit');
+        }
+        const item = record(value);
+        switch (item.type) {
+            case 'text':
+                exactKeys(item, ['type', 'text'], ['tone']);
+                text(item.text);
+                if (Object.hasOwn(item, 'tone') && !['default', 'muted', 'accent'].includes(item.tone)) {
+                    throw new Error('Invalid tone');
+                }
+                return;
+            case 'button':
+                exactKeys(item, ['type', 'label', 'action'], ['disabled', 'ariaLabel']);
+                text(item.label);
+                if (Object.hasOwn(item, 'ariaLabel'))
+                    text(item.ariaLabel);
+                if (Object.hasOwn(item, 'disabled') && typeof item.disabled !== 'boolean') {
+                    throw new Error('Invalid disabled flag');
+                }
+                encodeRestrictedJson(item.action, RESTRICTED_LIMITS.actionBytes);
+                return;
+            case 'number-action':
+                exactKeys(item, ['type', 'label', 'min', 'max', 'step', 'value', 'action', 'valueKey']);
+                text(item.label);
+                if (!['min', 'max', 'step', 'value'].every(key => Number.isSafeInteger(item[key]))) {
+                    throw new Error('Invalid numeric bounds');
+                }
+                if (!validRestrictedNumber(item, item.value))
+                    throw new Error('Invalid numeric value');
+                if (!Number.isSafeInteger(item.max - item.min))
+                    throw new Error('Numeric range limit');
+                if (typeof item.valueKey !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(item.valueKey)
+                    || ['__proto__', 'prototype', 'constructor'].includes(item.valueKey))
+                    throw new Error('Invalid numeric action key');
+                record(item.action);
+                encodeRestrictedJson(item.action, RESTRICTED_LIMITS.actionBytes);
+                // Reserve for the longest possible integer string within the range.
+                for (const bound of [item.min, item.max]) {
+                    encodeRestrictedJson({ ...record(item.action), [item.valueKey]: bound }, RESTRICTED_LIMITS.actionBytes);
+                }
+                return;
+            case 'stack':
+                exactKeys(item, ['type', 'children'], ['direction']);
+                if (Object.hasOwn(item, 'direction') && !['vertical', 'horizontal'].includes(item.direction)) {
+                    throw new Error('Invalid direction');
+                }
+                break;
+            case 'grid':
+                exactKeys(item, ['type', 'columns', 'children']);
+                if (!Number.isInteger(item.columns) || item.columns < 1 || item.columns > 19) {
+                    throw new Error('Invalid grid columns');
+                }
+                break;
+            default:
+                throw new Error('Unknown scene node');
+        }
+        if (!Array.isArray(item.children) || item.children.length > RESTRICTED_LIMITS.children) {
+            throw new Error('Invalid scene children');
+        }
+        for (const child of item.children)
+            node(child, depth + 1);
+    }
+    node(scene.root, 1);
+    return scene;
+}
+export function validRestrictedNumber(node, value) {
+    return Number.isSafeInteger(value) && node.step > 0 && value >= node.min && value <= node.max
+        && Number.isSafeInteger(value - node.min) && (value - node.min) % node.step === 0;
+}
+function encodeScene(value) {
+    return encodeRestrictedJson(value, RESTRICTED_LIMITS.sceneBytes, 2 * RESTRICTED_LIMITS.depth + 20);
+}
+//# sourceMappingURL=scene.js.map

package/dist/src/renderer/restricted-content/scene.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scene.js","sourceRoot":"","sources":["../../../../src/renderer/restricted-content/scene.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAuB,MAAM,WAAW,CAAA;AAiCxF,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACjH,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAAkB,EAAE,WAAqB,EAAE;IAC5F,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC5F,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;AACrH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IACzC,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACrE,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;QACzC,IAAI,EAAE,KAAK,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACf,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,CAAC;oBACjG,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAM;YACR,KAAK,QAAQ;gBACX,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;gBACvE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;gBAC1C,CAAC;gBACD,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBAChE,OAAM;YACR,KAAK,eAAe;gBAClB,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;gBACvF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChB,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;gBAC3C,CAAC;gBACD,IACE,CAAC,qBAAqB,CACpB,IAA0E,EAC1E,IAAI,CAAC,KAAe,CACrB;oBACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;gBAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAE,IAAI,CAAC,GAAc,GAAI,IAAI,CAAC,GAAc,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;gBAC9G,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;uBACtF,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACnB,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBAChE,oEAAoE;gBACpE,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,oBAAoB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;gBACzG,CAAC;gBACD,OAAM;YACR,KAAK,OAAO;gBACV,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;gBACpD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAmB,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;gBACtC,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;gBAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,IAAI,CAAC,OAAkB,GAAG,CAAC,IAAK,IAAI,CAAC,OAAkB,GAAG,EAAE,EAAE,CAAC;oBACrG,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAK;YACP;gBACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACnB,OAAO,KAAmC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAgD,EAAE,KAAa;IACnG,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG;WACxF,MAAM,CAAC,aAAa,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;AACpG,CAAC"}

package/dist/src/renderer/restricted-content-service.d.ts

@@ -0,0 +1,4 @@
+import type { RestrictedContentV1 } from '@cordisx/protocol/restricted-content/v1';
+/** Per-owner facade. Renderer lifetimes and callbacks never come from author scene data. */
+export declare function createRestrictedContentService(active: () => boolean): RestrictedContentV1;
+//# sourceMappingURL=restricted-content-service.d.ts.map

package/dist/src/renderer/restricted-content-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-content-service.d.ts","sourceRoot":"","sources":["../../../src/renderer/restricted-content-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,mBAAmB,EACpB,MAAM,yCAAyC,CAAA;AAEhD,4FAA4F;AAC5F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,OAAO,GAAG,mBAAmB,CAyDzF"}

package/dist/src/renderer/restricted-content-service.js

@@ -0,0 +1,64 @@
+import { mountRestrictedScene } from './restricted-content/index.js';
+/** Per-owner facade. Renderer lifetimes and callbacks never come from author scene data. */
+export function createRestrictedContentService(active) {
+    const lifetime = new AbortController();
+    const seats = new Set();
+    const elements = new WeakSet();
+    const live = () => !lifetime.signal.aborted && active();
+    return Object.freeze({
+        contract: 'cordisx.restricted-content/v1',
+        async mount(input) {
+            if (!live())
+                return { status: 'unavailable', code: 'disposed' };
+            if (!input?.element?.ownerDocument || typeof input.onAction !== 'function' || elements.has(input.element)
+                || seats.size >= 16) {
+                return { status: 'unavailable', code: 'invalid-request' };
+            }
+            try {
+                const native = mountRestrictedScene({
+                    element: input.element,
+                    onAction: input.onAction,
+                    isCurrent: live,
+                    signal: lifetime.signal,
+                });
+                let disposed = false;
+                const seat = Object.freeze({
+                    contract: 'cordisx.restricted-content-seat/v1',
+                    publish(snapshot) {
+                        if (disposed || !live())
+                            return { status: 'unavailable', code: 'disposed' };
+                        const result = native.publish({ sequence: snapshot.sequence, scene: snapshot.payload });
+                        if (result.status === 'accepted')
+                            return { status: 'accepted', value: null };
+                        const code = result.code === 'invalid-scene' ? 'invalid-request' : result.code;
+                        try {
+                            input.onUnavailable?.(code);
+                        }
+                        catch { /* Consumer notification does not change lifetime. */ }
+                        return { status: 'unavailable', code };
+                    },
+                    dispose() {
+                        if (disposed)
+                            return;
+                        disposed = true;
+                        native.dispose();
+                        elements.delete(input.element);
+                        seats.delete(seat);
+                    },
+                });
+                seats.add(seat);
+                elements.add(input.element);
+                return { status: 'accepted', value: seat };
+            }
+            catch {
+                return { status: 'unavailable', code: 'invalid-request' };
+            }
+        },
+        dispose() {
+            lifetime.abort();
+            for (const seat of seats)
+                seat.dispose();
+        },
+    });
+}
+//# sourceMappingURL=restricted-content-service.js.map

package/dist/src/renderer/restricted-content-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-content-service.js","sourceRoot":"","sources":["../../../src/renderer/restricted-content-service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,4FAA4F;AAC5F,MAAM,UAAU,8BAA8B,CAAC,MAAqB;IAClE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAe,CAAA;IAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,EAAE,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,CAAC,KAAK,CAAC,KAAkD;YAC5D,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,IAAI,EAAE,UAAmB,EAAE,CAAA;YACjF,IACE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;mBAClG,KAAK,CAAC,IAAI,IAAI,EAAE,EACnB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,IAAI,EAAE,iBAA0B,EAAE,CAAA;YAC7E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC;oBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAA;gBACF,IAAI,QAAQ,GAAG,KAAK,CAAA;gBACpB,MAAM,IAAI,GAA4B,MAAM,CAAC,MAAM,CAAC;oBAClD,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO,CACL,QAA2D;wBAE3D,IAAI,QAAQ,IAAI,CAAC,IAAI,EAAE;4BAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;wBAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;wBACvF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;4BAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;wBAC5E,MAAM,IAAI,GAA+B,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;wBAC1G,IAAI,CAAC;4BACH,KAAK,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAA;wBAC7B,CAAC;wBAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;wBACjE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;oBACxC,CAAC;oBACD,OAAO;wBACL,IAAI,QAAQ;4BAAE,OAAM;wBACpB,QAAQ,GAAG,IAAI,CAAA;wBACf,MAAM,CAAC,OAAO,EAAE,CAAA;wBAChB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;wBAC9B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;oBACpB,CAAC;iBACF,CAAC,CAAA;gBACF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACf,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC3B,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,IAAI,EAAE,iBAA0B,EAAE,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,CAAC,KAAK,EAAE,CAAA;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QAC1C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/renderer/route-link-resolution.d.ts

@@ -0,0 +1,9 @@
+import type { RouteLinkResolutionResult } from '@cordisx/protocol/route-link-resolution/v1';
+import type { CordisXRouteReference } from '../contracts.js';
+/** Public validation and result projection around the existing authorized canonical link generator. */
+export declare function resolveRouteLink(reference: CordisXRouteReference, state: {
+    readonly disposed: boolean;
+    readonly active: () => boolean;
+    readonly deepLink: () => string;
+}): RouteLinkResolutionResult;
+//# sourceMappingURL=route-link-resolution.d.ts.map

package/dist/src/renderer/route-link-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-link-resolution.d.ts","sourceRoot":"","sources":["../../../src/renderer/route-link-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,uGAAuG;AACvG,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE;IACxE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAA;CAChC,GAAG,yBAAyB,CAmB5B"}

package/dist/src/renderer/route-link-resolution.js

@@ -0,0 +1,22 @@
+/** Public validation and result projection around the existing authorized canonical link generator. */
+export function resolveRouteLink(reference, state) {
+    if (state.disposed)
+        return { status: 'unavailable', code: 'host-unavailable' };
+    if (!state.active())
+        return { status: 'unavailable', code: 'caller-unavailable' };
+    if (reference === null || typeof reference !== 'object' || Array.isArray(reference)
+        || Object.keys(reference).some(key => key !== 'id' && key !== 'params')
+        || typeof reference.id !== 'string' || reference.id.length < 1 || [...reference.id].length > 256
+        || (reference.params !== undefined && (reference.params === null || typeof reference.params !== 'object'
+            || Array.isArray(reference.params) || Object.values(reference.params).some(value => value !== null && typeof value !== 'string' && typeof value !== 'boolean'
+            && (typeof value !== 'number' || !Number.isFinite(value))))))
+        return { status: 'unavailable', code: 'invalid-route' };
+    try {
+        const url = state.deepLink();
+        return state.active() ? { status: 'accepted', url } : { status: 'unavailable', code: 'caller-unavailable' };
+    }
+    catch {
+        return { status: 'unavailable', code: 'route-unavailable' };
+    }
+}
+//# sourceMappingURL=route-link-resolution.js.map