Seeded Random Generation and Cross-Origin Isolation Safety for Windowed Modes

[AndrewRedican]

Description

Two independent additions land together in this PR:

1. Seeded random generation for @hyperfrontend/random-generator-utils — every distribution (uniform, gaussian, exponential, logarithmic, power-law, pseudo, uuid-v4) can now be driven from a seed via a new seeded source, giving reproducible draws. The koi pond demo adopts this in a follow-up PR: the demos install @hyperfrontend/random-generator-utils from npm, and the seeded API is not on the registry until this PR merges and the publish job runs.
2. Cross-origin isolation safety for windowed display modes in @hyperfrontend/features — the host now detects when a declared windowed mode (e.g. popup) would silently break due to the origin's opener policy (COOP) or missing isolation headers, warns at config/build time, and fails a windowed mount fast when its window becomes unreachable instead of hanging silently.

Supporting work: all koi-pond demo apps, clock, and heartbeat were repacked/re-vendored against @hyperfrontend/features@0.9.0; demo source files across koi-pond, clock, and heartbeat received documentation/comment cleanup; a related showcase finding on seeded randomness was closed and a new one on isolated-origin popup breakage was opened/updated.

Type of Change

✨ Feature
📝 Docs
♻️ Refactor
🔒 Security

Changes Made

• Add seeded random generation (create-random-generator, create-seeded-source) to lib-random-generator-utils, covering every existing distribution and uuid-v4
• Repack the vendored demo-koi-lib tarball and refresh its nine consumer lockfiles, which had drifted from the koi lib source since the demo freeze
• Add opener-policy/isolation detection to lib-features: declare cross-origin isolation in feature config, expand it into served-origin headers, warn when declared modes outlive the origin's opener policy, and fail a windowed mount fast when its window stops being reachable
• Publish the feature config JSON schema on docs-site and document the isolation constraint on windowed display modes
• Repack/re-vendor demo shells (clock, heartbeat, koi-pond fish + host) against @hyperfrontend/features@0.9.0 with the v3 envelope
• Document and rename inline shapes/exports across all koi-pond demo apps (host, lib, workbench, all framework fish apps) and clock/heartbeat demos; no behavioral change
• Exempt demos from three lint rules affecting the above comment/doc-only refactors; fix no-unsafe-builtin-methods/directive detection in eslint-rules for hf:feature and triple-slash comments
• Close the "no seeded randomness" showcase finding; update the "isolated-origin breaks popup mode silently" finding

Testing

• Added specs for create-random-generator/create-seeded-source and existing distribution generators (seeded determinism)
• Added specs for lib-features isolation/opener-policy behavior: serve-reconciliation, serve-config, config-types, lifecycle.timeout, external-window.browser
• Added e2e coverage for the seeded generator in e2e-lib-random-generator-utils
• Added coverage for the no-plain-inline-comments eslint rule and comment-analysis util fixes

AI Assistance

Claude was used to make these changes, following instructions and direct supervision.

Additional Notes

@hyperfrontend/features bumped to 0.9.0 (feature warnings/isolation headers are additive but consumers relying on windowed modes on isolated origins should review the new warnings). @hyperfrontend/random-generator-utils gains a new seeded API surface (additive, non-breaking) and bumps to 0.2.0.

The koi pond's use of that API was reverted out of this PR. The demos are self-contained npm consumers, so pinning an unpublished 0.2.0 failed npm install, and because publish on main is gated on ci-status, which needs typecheck, leaving it in would have blocked the publish that makes 0.2.0 real. The demo work re-lands once the package is on the registry.

---

📝 CLA Requirement

By submitting this pull request, you acknowledge that:

• You have read and agree to sign our Contributor License Agreement (CLA)
• The CLA Assistant bot will automatically check your signature status
• If you haven't signed yet, the bot will provide instructions in the comments
• By signing, you grant the project maintainer exclusive rights to your contributions

For more information, see our Contributing Guide.

---

Thank you for contributing to hyperfrontend! 🚀

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-site	Ready	Preview	Sep 8, 2026 5:06am UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit a309818

Command	Status	Duration	Result
nx run-many -t=e2e --projects=@hyperfrontend/wo...	✅ Succeeded	2m 41s	View ↗
nx run-many -t=build --projects=@hyperfrontend/...	✅ Succeeded	40m 54s	View ↗
nx run-many -t=test --projects=@hyperfrontend/w...	✅ Succeeded	4m 52s	View ↗
nx run-many -t=typecheck --projects=@hyperfront...	✅ Succeeded	1m 4s	View ↗
nx run-many -t=lint --projects=@hyperfrontend/w...	✅ Succeeded	3s	View ↗
nx version-check lib-function-utils	✅ Succeeded	1s	View ↗
nx version-check lib-questions	✅ Succeeded	1s	View ↗
nx version-check lib-time-utils	✅ Succeeded	1s	View ↗
Additional runs (16)	✅ Succeeded	...	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-09-08 05:55:11 UTC