Portable UI bridge
The bounded, capability-aware protocol shared by browser iframes, native WebViews, Workbench, and read-only replay.
The host owns the transport. Package UI owns rendering and domain interaction. Both validate every frame.
Package to host
Prop
Type
A package may report readiness, request one declared command, or request one supported correction. The message contains intent—not member authorization, trusted time, expected revision, or persistence identity. The host adds and validates those fields.
Host to package
Prop
Type
The host supplies a bounded context or state snapshot, lifecycle state, declared capabilities, acknowledgements, and safe errors. A replay/overlay host can omit command and correction capability while rendering the same artifact.
Capability checks
Prop
Type
Disable or hide actions the host did not grant. Never infer capability because the page happens to be running in Workbench, a browser, or a WebView.
Size and trust
PACKAGE_UI_MAX_MESSAGE_BYTES bounds serialized frames. Unknown, malformed, or
oversized messages are ignored or rejected. Package UI never receives browser
credentials, direct API access, account storage, or a wildcard network grant.