feat(embed): versioned loader with postMessage whitelist

packages/embed-loader：手写零依赖加载器（esbuild bundle+minify→dist/v1/loader.js， IIFE target es2018 4.7KB）。自发现 EMBED_ORIGIN（currentScript 兜底扫描）、 data-slot 必填缺失静默 no-op、__photoliveEmbedV1 标记去重+同槽去重、窄屏 <480px 强制 sm+默认收起、postMessage 双向白名单（source+origin 严格校验，resize 夹取 60-640）、sessionStorage 收起记忆、零全局零 console 全静默。sync 脚本携 sha256 校验拷贝至 viewer publicDir（两份产物入库）； src/params.js 为 loader/单测共用参数源（11 vitest 用例）。 Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-09-20 22:31:40 +08:00
parent aee4b7ac46
commit ddb4c8175f
10 changed files with 637 additions and 0 deletions
@@ -0,0 +1,31 @@
+// packages/embed-loader/sync-to-viewer.js
+// 复制构建产物到 viewer 静态目录：vite publicDir（apps/viewer/public/）在 dev
+// 直接可访问、build 自动携带进 dist/。拷贝后 sha256 校验，不一致即失败（构建脚本
+// 级检查，非生产路径，允许 console）。用法：pnpm --filter @photo/embed-loader sync。
+import { createHash } from 'node:crypto';
+import { cpSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const src = resolve(here, 'dist/v1/loader.js');
+const dest = resolve(here, '../../apps/viewer/public/embed/v1/loader.js');
+
+if (!existsSync(src)) {
+  console.error('[sync] missing dist/v1/loader.js — run `pnpm build` first');
+  process.exit(1);
+}
+
+mkdirSync(dirname(dest), { recursive: true });
+cpSync(src, dest);
+
+function sha256(p) {
+  return createHash('sha256').update(readFileSync(p)).digest('hex');
+}
+
+const srcHash = sha256(src);
+if (srcHash !== sha256(dest)) {
+  console.error('[sync] hash mismatch after copy — viewer copy diverged');
+  process.exit(1);
+}
+console.log(`[sync] dist/v1/loader.js -> apps/viewer/public/embed/v1/loader.js (sha256 ${srcHash.slice(0, 12)}…)`);