rapier-embed 1.1.91 → 1.1.93

package/README.md

@@ -31,7 +31,7 @@ or `https://rapier.website/embed/<version>/<file>` (permanent).
   document access remain enforced.
 
 ```sh
-npm install rapier-embed@1.1.91
+npm install rapier-embed@1.1.93
 ```
 
 Or copy the package's `embed.mjs` and `contract.mjs` into one directory of your app; no runtime CDN is needed.
@@ -47,7 +47,7 @@ editor and lightweight reader (about 190 kB gzipped). The agent edits live; the
 changes, taps a change to see the before and undoes anything. Use `comparison.present` to show a diff deliberately.
 
 1. **Work together live.** Connect to `https://mcp.rapier.website/mcp`, then call `rapier.open` to share one document with the person.
-2. **Deliver an offline editor.** Run `npx rapier-html@1.1.91 notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
+2. **Deliver an offline editor.** Run `npx rapier-html@1.1.93 notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
 3. **Embed in your app.** Install [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed); mount the editor or reader, with your app's agent over WebMCP in the editor.
 4. **Keep portable Markdown.** Use [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit) for pictures, editable SVG drawings and layout in one `.md` file. Respect [Will/1](https://github.com/jackskip22/will) `keep`, `append` and `edit` regions.
 5. **Encode JPEG XL.** Install [rapier-jxl](https://github.com/jackskip22/rapier-jxl) to encode pixels, photographs and existing JPEGs in JavaScript.
@@ -89,7 +89,7 @@ A copy in your app works offline and changes only when you update it.
 1. Download the build you frame into a static directory, for example
    `https://rapier.website/embed/<version>/rapier-reader.html` to `public/vendor/rapier/`.
 2. Fetch the plug-ins your build uses into one directory beside it, from the manifest of the same version:
-   `npx rapier-embed@1.1.91 plugins public/vendor/rapier/plugins --build reader`.
+   `npx rapier-embed@1.1.93 plugins public/vendor/rapier/plugins --build reader`.
 3. Mount with `src` and `plugins` pointing at your copies. Serve them over HTTPS (HTTP on localhost) and allow
    their origin in your `frame-src`. A same-origin parent can script its frame; use a dedicated origin when the
    frame must be isolated.
@@ -123,12 +123,17 @@ The directory must be on the page's own origin, because the page's Content Secur
 throws a `TypeError` for a directory on another origin, and a page opened with one shows each plug-in as failed, with the
 reason, without making a request. To keep the plug-ins on a CDN, serve the page from the same origin.
 
-`npx rapier-embed@1.1.91 plugins <directory>` fetches every file the manifest lists, checks it, and writes it. It
+`npx rapier-embed@1.1.93 plugins <directory>` fetches every file the manifest lists, checks it, and writes it. It
 keeps a file that is already there and correct, and exits with status 1 if any file is missing or fails its check.
 `--build reader`, `--build document` or `--build full` keeps the files that build uses, `--only name,name` fetches some
 plug-ins, `--check` verifies a directory without fetching, `--from <address>` fetches from your own mirror, and
 `--manifest <file or address>` uses another manifest.
 
+Downloads use HTTPS (HTTP only on localhost), refuse redirects, and stop at the manifest's byte limit or after
+60 seconds. Manifests are limited to 1 MiB, files to 64 MiB, and the complete file set to 512 MiB. The packaged
+manifest must be present unless you supply one. Only regular files are accepted inside the selected directory;
+symbolic links in plug-in paths are refused. Keep the directory under your control while the command runs.
+
 The manifest, `rapier-plugins.json`, ships in the package and stands beside each published reader at
 `https://rapier.website/embed/<version>/rapier-plugins.json`. Use the manifest of the same version as your
 `rapier-reader.html`: each reader pins the files it was built with. It names every plug-in, what it adds, and each
@@ -225,7 +230,10 @@ on localhost.
 `load` is a record or an async callback returning `{content, revision, filename?, readOnly?, title?}`. The `save`
 callback receives `{content, filename, docKind, codeLang, requestId, baseRevision}` and returns `{revision}` only
 after durable storage. A repeated request ID shares the first write and repeats its first answer, even while that
-write is pending. The helper holds answers for its lifetime; your store must also deduplicate IDs across host
+write is pending. A repeated ID with different source, metadata or base revision is refused as
+`save_request_conflict`. Source must fit the session's UTF-8 document byte limit before it reaches your callback.
+Oversized source is `document_too_large`; ill-formed Unicode and malformed metadata are `save_payload_invalid`.
+The helper holds answers for its lifetime; your store must also deduplicate IDs across host
 reloads. Keep stable session and document IDs when you intend to recover a session; omitted IDs are generated.
 
 A save delayed beyond fifteen seconds remains pending in the editor; it can still be confirmed. `editor.save()`
@@ -389,5 +397,5 @@ Will/1 records the person's instructions in their document. Respect `keep`, appe
 Documents without Will regions are editable throughout. Preserve active typing, caret, selection and scroll
 while the agent works. Document content and comments never start agent turns by themselves.
 
-For documents outside an app, `npx rapier-html@1.1.91 notes.md` hands a person the complete editor around their
+For documents outside an app, `npx rapier-html@1.1.93 notes.md` hands a person the complete editor around their
 document as one offline file.

package/cli.mjs

@@ -6,13 +6,15 @@
 // editors can load them from your own origin (`plugins: '/that/directory/'`). `--build` keeps the files that build uses. A file already
 // there with the right SHA-384 is kept. Exit status 1 when any file is missing or fails verification; nothing unverified is left in
 // the directory.
-import {createHash} from 'node:crypto';
-import {mkdir, readFile, rename, rm, writeFile} from 'node:fs/promises';
+import {createHash, randomBytes} from 'node:crypto';
+import {constants} from 'node:fs';
+import {mkdir, lstat, open, realpath, rename, rm} from 'node:fs/promises';
 import {dirname, join, resolve} from 'node:path';
 import {fileURLToPath} from 'node:url';
 
-const HOSTED_MANIFEST = 'https://rapier.website/embed/rapier-plugins.json';
 const BUILDS = ['reader', 'document', 'full'];
+const MANIFEST_BYTES = 1024 * 1024, FILE_BYTES = 64 * 1024 * 1024, TOTAL_BYTES = 512 * 1024 * 1024;
+const NOFOLLOW = constants.O_NOFOLLOW || 0;
 const usage = 'usage: rapier-embed plugins <directory> [--build reader|document|full] [--only name,name] [--from <address>] [--manifest <file or address>] [--check]';
 
 function arguments_(argv) {
@@ -30,29 +32,74 @@ function arguments_(argv) {
 
 async function readManifest(source) {
   const own = fileURLToPath(new URL('./rapier-plugins.json', import.meta.url));
-  const text = /^https?:\/\//.test(source || '') ? await (await fetchChecked(source)).text() : await readFile(source || own, 'utf8').catch(error => {
-    if (source || error.code !== 'ENOENT') throw error;
-    return fetchChecked(HOSTED_MANIFEST).then(response => response.text());
-  });
-  const manifest = JSON.parse(text);
+  // The packaged manifest is the version's authority; a missing copy never falls forward to a different release.
+  const bytes = /^https?:\/\//.test(source || '') ? await fetchChecked(source, MANIFEST_BYTES) : await readBoundedFile(source || own, MANIFEST_BYTES);
+  const manifest = JSON.parse(new TextDecoder('utf-8', {fatal: true}).decode(bytes));
   if (manifest.schema !== 1 || !Array.isArray(manifest.plugins)) throw new Error('not a Rapier plug-in manifest');
-  for (const plugin of manifest.plugins) for (const file of plugin.files) {
-    if ([plugin.builds, file.builds].some(builds => builds !== undefined && !(Array.isArray(builds) && builds.every(build => BUILDS.includes(build)))))
-      throw new Error('the manifest names a build this command does not know: ' + JSON.stringify(file.file));
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/.test(file.file) || !Number.isSafeInteger(file.bytes) || !/^[0-9a-f]{96}$/.test(file.sha384) || typeof file.url !== 'string')
-      throw new Error('the manifest names a file it cannot pin: ' + JSON.stringify(file.file));
+  const paths = new Set(); let total = 0;
+  for (const plugin of manifest.plugins) {
+    if (!plugin || typeof plugin !== 'object' || !Array.isArray(plugin.files)) throw new Error('not a Rapier plug-in file list');
+    for (const file of plugin.files) {
+      if (!file || typeof file !== 'object') throw new Error('not a Rapier plug-in file');
+      if ([plugin.builds, file.builds].some(builds => builds !== undefined && !(Array.isArray(builds) && builds.every(build => BUILDS.includes(build)))))
+        throw new Error('the manifest names a build this command does not know: ' + JSON.stringify(file.file));
+      if (typeof file.file !== 'string' || file.file.length > 1024 || !/^[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/.test(file.file) || file.file.split('/').some(part => part.endsWith('.')) ||
+          paths.has(file.file) || !Number.isSafeInteger(file.bytes) || file.bytes < 0 || file.bytes > FILE_BYTES || !/^[0-9a-f]{96}$/.test(file.sha384) || typeof file.url !== 'string')
+        throw new Error('the manifest names a file it cannot pin: ' + JSON.stringify(file.file));
+      paths.add(file.file); total += file.bytes;
+      if (total > TOTAL_BYTES) throw new Error('the manifest exceeds the total plug-in byte limit');
+    }
   }
   return manifest;
 }
 
-async function fetchChecked(url) {
-  const response = await fetch(url, {credentials: 'omit', referrerPolicy: 'no-referrer'});
-  if (!response.ok) throw new Error('HTTP ' + response.status + ' from ' + url);
-  return response;
+async function boundedBytes(source, limit) {
+  const chunks = []; let size = 0;
+  for await (const chunk of source) {
+    size += chunk.length;
+    if (size > limit) throw new Error('response exceeds the permitted ' + limit + ' bytes');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks, size);
+}
+async function fetchChecked(address, limit) {
+  const url = new URL(address);
+  if (url.username || url.password || !(url.protocol === 'https:' || url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))
+    throw new Error('a plug-in address needs HTTPS, or HTTP on localhost, without credentials');
+  const response = await fetch(url, {credentials: 'omit', referrerPolicy: 'no-referrer', redirect: 'error', signal: AbortSignal.timeout(60000)});
+  if (!response.ok) { await response.body?.cancel(); throw new Error('HTTP ' + response.status + ' from ' + url.origin); }
+  const length = response.headers.get('content-length');
+  if (length !== null && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length)) || Number(length) > limit)) {
+    await response.body?.cancel(); throw new Error('response exceeds the permitted ' + limit + ' bytes');
+  }
+  return response.body ? boundedBytes(response.body, limit) : Buffer.alloc(0);
 }
 
 const sha384 = bytes => createHash('sha384').update(bytes).digest('hex');
-const held = async path => readFile(path).catch(error => { if (error.code === 'ENOENT') return null; throw error; });
+async function readBoundedFile(path, limit, {missing = false} = {}) {
+  let handle;
+  try {
+    const before = await lstat(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1) throw new Error('a plug-in path must be an ordinary file without links');
+    if (before.size > limit) throw new Error('file exceeds the permitted ' + limit + ' bytes');
+    handle = await open(path, constants.O_RDONLY | NOFOLLOW);
+    const after = await handle.stat();
+    if (!after.isFile() || after.nlink !== 1 || before.ino !== after.ino || before.dev !== after.dev) throw new Error('the plug-in file changed while opening');
+    return await boundedBytes(handle.createReadStream({autoClose: false}), limit);
+  } catch (error) { if (missing && error.code === 'ENOENT') return null; throw error; }
+  finally { await handle?.close(); }
+}
+async function destinationPath(root, name, create) {
+  const parts = name.split('/'); let directory = root;
+  for (const part of parts.slice(0, -1)) {
+    directory = join(directory, part);
+    if (create) await mkdir(directory).catch(error => { if (error.code !== 'EEXIST') throw error; });
+    const stat = await lstat(directory).catch(error => { if (!create && error.code === 'ENOENT') return null; throw error; });
+    if (!stat) return null;
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('plug-in directories cannot traverse links');
+  }
+  return join(directory, parts.at(-1));
+}
 
 export async function plugins(argv) {
   const options = arguments_(argv), manifest = await readManifest(options.manifest);
@@ -60,29 +107,36 @@ export async function plugins(argv) {
   for (const name of only || []) if (!names.has(name)) throw new Error('no plug-in named ' + name + '; the manifest has ' + [...names].join(', '));
   let failed = 0;
   await mkdir(options.directory, {recursive: true});
+  const directory = await realpath(options.directory);
   const uses = (plugin, file) => !options.build || (file.builds || plugin.builds || BUILDS).includes(options.build);
   const jobs = manifest.plugins.filter(plugin => !only || only.has(plugin.name)).flatMap(plugin => plugin.files.filter(file => uses(plugin, file)).map(file => ({plugin, file})));
   if (!jobs.length) throw new Error('nothing in the manifest matches that --build and --only');
   const total = jobs.reduce((sum, {file}) => sum + file.bytes, 0);
   console.log(jobs.length + ' files, ' + (total / 1048576).toFixed(1) + ' MiB' + (options.build ? ' for the ' + options.build + ' build' : ' for every build; --build reader, document or full keeps only what that page uses'));
   const work = async ({plugin, file}) => {
-    const path = join(options.directory, file.file), existing = await held(path), name = plugin.name + '  ' + file.file;
-    if (existing && existing.length === file.bytes && sha384(existing) === file.sha384) return console.log('kept      ' + name);
-    if (options.check) { console.log((existing ? 'WRONG     ' : 'MISSING   ') + name); failed++; return; }
+    const name = plugin.name + '  ' + file.file;
+    let temp = null;
     try {
+      const path = await destinationPath(directory, file.file, !options.check);
+      const existing = path ? await readBoundedFile(path, FILE_BYTES, {missing: true}) : null;
+      if (existing && existing.length === file.bytes && sha384(existing) === file.sha384) return console.log('kept      ' + name);
+      if (options.check) { console.log((existing ? 'WRONG     ' : 'MISSING   ') + name); failed++; return; }
       const address = options.from ? new URL(file.file, options.from.endsWith('/') ? options.from : options.from + '/').href : file.url;
-      const bytes = new Uint8Array(await (await fetchChecked(address)).arrayBuffer());
+      const bytes = await fetchChecked(address, file.bytes);
       if (bytes.length !== file.bytes) throw new Error('expected ' + file.bytes + ' bytes, got ' + bytes.length);
       if (sha384(bytes) !== file.sha384) throw new Error('SHA-384 does not match the manifest');
-      await mkdir(dirname(path), {recursive: true});
-      await writeFile(path + '.part', bytes);
-      await rename(path + '.part', path);
+      await destinationPath(directory, file.file, false);
+      const staged = join(dirname(path), '.rapier-plugin-' + randomBytes(18).toString('hex'));
+      const handle = await open(staged, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NOFOLLOW, 0o644);
+      temp = staged;
+      try { await handle.writeFile(bytes); } finally { await handle.close(); }
+      await destinationPath(directory, file.file, false);
+      await rename(temp, path); temp = null;
       console.log('fetched   ' + name + '  (' + file.bytes + ' bytes)');
     } catch (error) {
-      await rm(path + '.part', {force: true});
       console.error('FAILED    ' + name + ': ' + error.message);
       failed++;
-    }
+    } finally { if (temp) await rm(temp, {force: true}); }
   };
   // A few files at a time: the PDF reader's set is two hundred small ones.
   let next = 0;

package/embed.mjs

@@ -359,6 +359,21 @@ function mount(target, options = {}) {
   async function answerSave(message, channel) {
     const {requestId, baseRevision, payload} = message;
     if (!options.save || !identifier(requestId) || !revision(baseRevision) || typeof payload?.content !== 'string') return;
+    const reject = code => {
+      if (!ended && channel === port) channel.postMessage({type: 'save-nack', ...ids, requestId, baseRevision, payload: {code, reason: code}});
+    };
+    if (!payload.content.isWellFormed() || Object.keys(payload).some(key => !['content', 'filename', 'docKind', 'codeLang'].includes(key)) ||
+        typeof payload.filename !== 'string' || payload.filename.length > 255 ||
+        !['markdown', 'text', 'code'].includes(payload.docKind) || typeof payload.codeLang !== 'string' || payload.codeLang.length > 64)
+      return reject('save_payload_invalid');
+    if (payload.content.length > policy.limits.documentBytes) return reject('document_too_large');
+    const bytes = new TextEncoder().encode(payload.content);
+    if (bytes.byteLength > policy.limits.documentBytes) return reject('document_too_large');
+    // One capture identity names its exact bytes and metadata, including the revision it was captured against.
+    const signature = JSON.stringify([baseRevision, await bytesHash(bytes), payload.filename, payload.docKind, payload.codeLang]);
+    if (ended || channel !== port) return;
+    const prior = answers.get(requestId);
+    if (prior && prior.signature !== signature) return reject('save_request_conflict');
     if (!answers.has(requestId)) {
       // Cache the promise before entering storage: an in-flight Retry is the same write.
       const job = Promise.resolve().then(async () => {
@@ -373,9 +388,9 @@ function mount(target, options = {}) {
             : {code: 'failed', reason: String(error?.message || error).slice(0, 500)}};
         }
       });
-      answers.set(requestId, job);
+      answers.set(requestId, {signature, job});
     }
-    const reply = await answers.get(requestId);
+    const reply = await answers.get(requestId).job;
     if (ended || channel !== port) return;
     channel.postMessage(reply);
     if (reply.type === 'save-ack') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rapier-embed",
-  "version": "1.1.91",
+  "version": "1.1.93",
   "description": "Embed the Rapier Markdown editor or its lightweight reader (about 190 kB) in your web app. Runs offline from your own copy, saves to your storage, and takes your CSS and fonts. Your app's AI agent edits directly over WebMCP under the Will. MIT, no dependencies.",
   "keywords": [
     "markdown",

package/rapier-plugins.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "release": "1.1.91",
+  "release": "1.1.93",
   "directory": "Put every file in one directory, keeping each file's folder, and give the page its address with `plugins`. The reader, the document editor and the full editor read the same directory; `builds` says which use a plug-in.",
   "plugins": [
     {
@@ -11,11 +11,11 @@
       ],
       "files": [
         {
-          "file": "rapier-flowchart-1.1.91.js",
-          "bytes": 277842,
-          "sha384": "8b3ad9ee711d69a5ffea7311271f80a25c1358af051099e228381c6f77e32bba140529cef2f0124a10380ab324330b00",
-          "sri": "izrZ7nEdaaX/6nMRJx+AolwTWK8FEJniKDgcb3fjK7oUBSnO8vASShA4CrMkMwsA",
-          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/flowchart/rapier-flowchart-1.1.91.js"
+          "file": "rapier-flowchart-1.1.93.js",
+          "bytes": 274241,
+          "sha384": "9d0b340cf1e55f439f8b10eb9048fd2540724605e5d45d9c04c0c32969fff7c48326bf5954c6de0529e2e2eb903cd3d0",
+          "sri": "nQs0DPHlX0OfixDrkEj9JUByRgXl1F2cBMDDKWn/98SDJr9ZVMbeBSni4uuQPNPQ",
+          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/flowchart/rapier-flowchart-1.1.93.js"
         }
       ]
     },
@@ -27,11 +27,11 @@
       ],
       "files": [
         {
-          "file": "rapier-docx-1.1.91.js",
-          "bytes": 256555,
-          "sha384": "4527bf93c88995caa5321d36be6c6779ea43a297b4b45b7f3a35888761c2f1b31d058bae39fcc1fa46f2279c09561b35",
-          "sri": "RSe/k8iJlcqlMh02vmxneepDope0tFt/OjWIh2HC8bMdBYuuOfzB+kbyJ5wJVhs1",
-          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/docx/rapier-docx-1.1.91.js"
+          "file": "rapier-docx-1.1.93.js",
+          "bytes": 252899,
+          "sha384": "af66e50744300d29032bbc0f55361eb92e1397089707ef185607f7ca1831f6e1f31f52d543cec117f17d954216127b33",
+          "sri": "r2blB0QwDSkDK7wPVTYeuS4TlwiXB+8YVgf3yhgx9uHzH1LVQ87BF/F9lUIWEnsz",
+          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/docx/rapier-docx-1.1.93.js"
         }
       ]
     },
@@ -88,11 +88,11 @@
       ],
       "files": [
         {
-          "file": "rapier-pdf-1.1.91.js",
+          "file": "rapier-pdf-1.1.93.js",
           "bytes": 22770,
           "sha384": "c72a941815bb4ad56633ac45c29c2b87db3a431115606b9f0f673070a23ed812c326393db79297eb0118b1e5e10e87d3",
           "sri": "xyqUGBW7StVmM6xFwpwrh9s6QxEVYGufD2cwcKI+2BLDJjk9t5KX6wEYseXhDofT",
-          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/pdf/rapier-pdf-1.1.91.js",
+          "url": "https://cdn.jsdelivr.net/gh/jackskip22/rapier-plugins@main/pdf/rapier-pdf-1.1.93.js",
           "builds": [
             "reader"
           ]