@assistant-ui/vscode 0.0.0-stage → 0.0.0

package/dist/webview/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","names":[],"sources":["../../src/webview/links.ts"],"sourcesContent":["import { DEFAULT_EXTERNAL_SCHEMES, parseExternalUrl } from \"../external-url\";\nimport { webviewPort, type VSCodeBridgePort } from \"./fetch\";\nimport { callHost } from \"./rpc\";\n\nexport type LinkInterceptorOptions = {\n  /** URL schemes to open outside the webview, such as `\"https:\"`. */\n  schemes?: readonly string[];\n  onError?: (error: unknown) => void;\n  port?: VSCodeBridgePort;\n};\n\n/**\n * Opens absolute links and `window.open` URLs through the extension host's\n * `openExternal`, since a webview cannot navigate away or open windows.\n * Returns a function that removes the listeners and restores `window.open`.\n */\nexport function installLinkInterceptor({\n  schemes = DEFAULT_EXTERNAL_SCHEMES,\n  onError = (error) => console.error(error),\n  port = webviewPort,\n}: LinkInterceptorOptions = {}): () => void {\n  const openExternal = (url: string) => {\n    callHost(port, \"openExternal\", [url]).catch(onError);\n  };\n\n  const onClick = (event: MouseEvent) => {\n    if (event.defaultPrevented) return;\n    if (event.button !== (event.type === \"auxclick\" ? 1 : 0)) return;\n    if (!(event.target instanceof Element)) return;\n    const anchor = event.target.closest(\"a[href]\");\n    const url = parseExternalUrl(anchor?.getAttribute(\"href\"), schemes);\n    if (!url) return;\n    event.preventDefault();\n    openExternal(url);\n  };\n\n  let installed = true;\n  const originalOpen = window.open;\n  const patchedOpen: typeof window.open = function (url, ...rest) {\n    const external = installed ? parseExternalUrl(url, schemes) : null;\n    if (!external) return originalOpen.call(window, url, ...rest);\n    openExternal(external);\n    return null;\n  };\n\n  document.addEventListener(\"click\", onClick);\n  document.addEventListener(\"auxclick\", onClick);\n  window.open = patchedOpen;\n\n  return () => {\n    installed = false;\n    document.removeEventListener(\"click\", onClick);\n    document.removeEventListener(\"auxclick\", onClick);\n    if (window.open === patchedOpen) window.open = originalOpen;\n  };\n}\n"],"mappings":";;;;;;;;;AAgBA,SAAgB,uBAAuB,EACrC,UAAU,0BACV,WAAW,UAAU,QAAQ,MAAM,KAAK,GACxC,OAAO,gBACmB,CAAC,GAAe;CAC1C,MAAM,gBAAgB,QAAgB;EACpC,SAAS,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO;CACrD;CAEA,MAAM,WAAW,UAAsB;EACrC,IAAI,MAAM,kBAAkB;EAC5B,IAAI,MAAM,YAAY,MAAM,SAAS,aAAa,IAAI,IAAI;EAC1D,IAAI,EAAE,MAAM,kBAAkB,UAAU;EACxC,MAAM,SAAS,MAAM,OAAO,QAAQ,SAAS;EAC7C,MAAM,MAAM,iBAAiB,QAAQ,aAAa,MAAM,GAAG,OAAO;EAClE,IAAI,CAAC,KAAK;EACV,MAAM,eAAe;EACrB,aAAa,GAAG;CAClB;CAEA,IAAI,YAAY;CAChB,MAAM,eAAe,OAAO;CAC5B,MAAM,cAAkC,SAAU,KAAK,GAAG,MAAM;EAC9D,MAAM,WAAW,YAAY,iBAAiB,KAAK,OAAO,IAAI;EAC9D,IAAI,CAAC,UAAU,OAAO,aAAa,KAAK,QAAQ,KAAK,GAAG,IAAI;EAC5D,aAAa,QAAQ;EACrB,OAAO;CACT;CAEA,SAAS,iBAAiB,SAAS,OAAO;CAC1C,SAAS,iBAAiB,YAAY,OAAO;CAC7C,OAAO,OAAO;CAEd,aAAa;EACX,YAAY;EACZ,SAAS,oBAAoB,SAAS,OAAO;EAC7C,SAAS,oBAAoB,YAAY,OAAO;EAChD,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO;CACjD;AACF"}

package/dist/webview/rpc.d.ts

@@ -0,0 +1,3 @@
+import type { VSCodeBridgePort } from "./fetch.js";
+export declare const callHost: (port: VSCodeBridgePort, method: string, params: unknown[]) => Promise<unknown>;
+//# sourceMappingURL=rpc.d.ts.map

package/dist/webview/rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../src/webview/rpc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAgB;AAMhD,eAAO,MAAM,QAAQ,GACnB,MAAM,gBAAgB,EACtB,QAAQ,MAAM,EACd,QAAQ,OAAO,EAAE,KAChB,OAAO,CAAC,OAAO,CAuBjB,CAAC"}

package/dist/webview/rpc.js

@@ -0,0 +1,32 @@
+import { VSCODE_BRIDGE_CHANNEL, isHostToWebviewMessage } from "../protocol.js";
+import { randomIdPrefix } from "./id.js";
+// src/webview/rpc.ts
+const idPrefix = `rpc-${randomIdPrefix()}`;
+let nextId = 0;
+const callHost = (port, method, params) => {
+	const id = `${idPrefix}-${++nextId}`;
+	return new Promise((resolve, reject) => {
+		const unsubscribe = port.onMessage((message) => {
+			if (!isHostToWebviewMessage(message) || message.id !== id) return;
+			if (message.kind !== "rpc:response") return;
+			unsubscribe();
+			if (message.ok) resolve(message.result);
+			else reject(new Error(message.message));
+		});
+		try {
+			port.postMessage({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "rpc:request",
+				id,
+				method,
+				params
+			});
+		} catch (error) {
+			unsubscribe();
+			reject(error);
+		}
+	});
+};
+export { callHost };
+
+//# sourceMappingURL=rpc.js.map

package/dist/webview/rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.js","names":[],"sources":["../../src/webview/rpc.ts"],"sourcesContent":["import { isHostToWebviewMessage, VSCODE_BRIDGE_CHANNEL } from \"../protocol\";\nimport type { VSCodeBridgePort } from \"./fetch\";\nimport { randomIdPrefix } from \"./id\";\n\nconst idPrefix = `rpc-${randomIdPrefix()}`;\nlet nextId = 0;\n\nexport const callHost = (\n  port: VSCodeBridgePort,\n  method: string,\n  params: unknown[],\n): Promise<unknown> => {\n  const id = `${idPrefix}-${++nextId}`;\n  return new Promise((resolve, reject) => {\n    const unsubscribe = port.onMessage((message) => {\n      if (!isHostToWebviewMessage(message) || message.id !== id) return;\n      if (message.kind !== \"rpc:response\") return;\n      unsubscribe();\n      if (message.ok) resolve(message.result);\n      else reject(new Error(message.message));\n    });\n    try {\n      port.postMessage({\n        channel: VSCODE_BRIDGE_CHANNEL,\n        kind: \"rpc:request\",\n        id,\n        method,\n        params,\n      });\n    } catch (error) {\n      unsubscribe();\n      reject(error);\n    }\n  });\n};\n"],"mappings":";;;AAIA,MAAM,WAAW,OAAO,eAAe;AACvC,IAAI,SAAS;AAEb,MAAa,YACX,MACA,QACA,WACqB;CACrB,MAAM,KAAK,GAAG,SAAS,GAAG,EAAE;CAC5B,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,cAAc,KAAK,WAAW,YAAY;GAC9C,IAAI,CAAC,uBAAuB,OAAO,KAAK,QAAQ,OAAO,IAAI;GAC3D,IAAI,QAAQ,SAAS,gBAAgB;GACrC,YAAY;GACZ,IAAI,QAAQ,IAAI,QAAQ,QAAQ,MAAM;QACjC,OAAO,IAAI,MAAM,QAAQ,OAAO,CAAC;EACxC,CAAC;EACD,IAAI;GACF,KAAK,YAAY;IACf,SAAS;IACT,MAAM;IACN;IACA;IACA;GACF,CAAC;EACH,SAAS,OAAO;GACd,YAAY;GACZ,OAAO,KAAK;EACd;CACF,CAAC;AACH"}

package/dist/webview/storage.d.ts

@@ -0,0 +1,8 @@
+import type { AsyncStorageLike } from "@assistant-ui/core/react";
+import { type VSCodeBridgePort } from "./fetch.js";
+/**
+ * Creates an `AsyncStorageLike` backed by the `storage` Memento passed to
+ * `serveWebviewHost`, for `createLocalStorageAdapter({ storage })`.
+ */
+export declare function createVSCodeStorage(port?: VSCodeBridgePort): AsyncStorageLike;
+//# sourceMappingURL=storage.d.ts.map

package/dist/webview/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/webview/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAe,KAAK,gBAAgB,EAAE,mBAAgB;AAG7D;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,gBAA8B,GACnC,gBAAgB,CAalB"}

package/dist/webview/storage.js

@@ -0,0 +1,24 @@
+import { webviewPort } from "./fetch.js";
+import { callHost } from "./rpc.js";
+// src/webview/storage.ts
+/**
+* Creates an `AsyncStorageLike` backed by the `storage` Memento passed to
+* `serveWebviewHost`, for `createLocalStorageAdapter({ storage })`.
+*/
+function createVSCodeStorage(port = webviewPort) {
+	return {
+		getItem: async (key) => {
+			const value = await callHost(port, "storage.getItem", [key]);
+			return typeof value === "string" ? value : null;
+		},
+		setItem: async (key, value) => {
+			await callHost(port, "storage.setItem", [key, value]);
+		},
+		removeItem: async (key) => {
+			await callHost(port, "storage.removeItem", [key]);
+		}
+	};
+}
+export { createVSCodeStorage };
+
+//# sourceMappingURL=storage.js.map

package/dist/webview/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","names":[],"sources":["../../src/webview/storage.ts"],"sourcesContent":["import type { AsyncStorageLike } from \"@assistant-ui/core/react\";\nimport { webviewPort, type VSCodeBridgePort } from \"./fetch\";\nimport { callHost } from \"./rpc\";\n\n/**\n * Creates an `AsyncStorageLike` backed by the `storage` Memento passed to\n * `serveWebviewHost`, for `createLocalStorageAdapter({ storage })`.\n */\nexport function createVSCodeStorage(\n  port: VSCodeBridgePort = webviewPort,\n): AsyncStorageLike {\n  return {\n    getItem: async (key) => {\n      const value = await callHost(port, \"storage.getItem\", [key]);\n      return typeof value === \"string\" ? value : null;\n    },\n    setItem: async (key, value) => {\n      await callHost(port, \"storage.setItem\", [key, value]);\n    },\n    removeItem: async (key) => {\n      await callHost(port, \"storage.removeItem\", [key]);\n    },\n  };\n}\n"],"mappings":";;;;;;;AAQA,SAAgB,oBACd,OAAyB,aACP;CAClB,OAAO;EACL,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,SAAS,MAAM,mBAAmB,CAAC,GAAG,CAAC;GAC3D,OAAO,OAAO,UAAU,WAAW,QAAQ;EAC7C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,SAAS,MAAM,mBAAmB,CAAC,KAAK,KAAK,CAAC;EACtD;EACA,YAAY,OAAO,QAAQ;GACzB,MAAM,SAAS,MAAM,sBAAsB,CAAC,GAAG,CAAC;EAClD;CACF;AACF"}

package/dist/webview/vscode-api.d.ts

@@ -0,0 +1,11 @@
+export type VSCodeApi<TState = unknown> = {
+    postMessage(message: unknown): void;
+    getState(): TState | undefined;
+    setState<T extends TState | undefined>(newState: T): T;
+};
+/**
+ * Returns the webview's VS Code API. `acquireVsCodeApi()` may only be called
+ * once per webview, so every caller in the webview must go through this.
+ */
+export declare function getVSCodeApi<TState = unknown>(): VSCodeApi<TState>;
+//# sourceMappingURL=vscode-api.d.ts.map

package/dist/webview/vscode-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vscode-api.d.ts","sourceRoot":"","sources":["../../src/webview/vscode-api.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,CAAC,MAAM,GAAG,OAAO,IAAI;IACxC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,QAAQ,IAAI,MAAM,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;CACxD,CAAC;AAIF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,MAAM,CAAC,CAgBlE"}

package/dist/webview/vscode-api.js

@@ -0,0 +1,22 @@
+import { VSCODE_BRIDGE_CHANNEL } from "../protocol.js";
+// src/webview/vscode-api.ts
+let api;
+/**
+* Returns the webview's VS Code API. `acquireVsCodeApi()` may only be called
+* once per webview, so every caller in the webview must go through this.
+*/
+function getVSCodeApi() {
+	if (api) return api;
+	const acquire = globalThis.acquireVsCodeApi;
+	if (typeof acquire !== "function") throw new Error("acquireVsCodeApi is not defined: getVSCodeApi() must run inside a VS Code webview.");
+	api = acquire();
+	api.postMessage({
+		channel: VSCODE_BRIDGE_CHANNEL,
+		kind: "fetch:reset",
+		id: ""
+	});
+	return api;
+}
+export { getVSCodeApi };
+
+//# sourceMappingURL=vscode-api.js.map

package/dist/webview/vscode-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vscode-api.js","names":[],"sources":["../../src/webview/vscode-api.ts"],"sourcesContent":["import { VSCODE_BRIDGE_CHANNEL } from \"../protocol\";\n\nexport type VSCodeApi<TState = unknown> = {\n  postMessage(message: unknown): void;\n  getState(): TState | undefined;\n  setState<T extends TState | undefined>(newState: T): T;\n};\n\nlet api: VSCodeApi | undefined;\n\n/**\n * Returns the webview's VS Code API. `acquireVsCodeApi()` may only be called\n * once per webview, so every caller in the webview must go through this.\n */\nexport function getVSCodeApi<TState = unknown>(): VSCodeApi<TState> {\n  if (api) return api as VSCodeApi<TState>;\n  const acquire = (globalThis as { acquireVsCodeApi?: () => VSCodeApi })\n    .acquireVsCodeApi;\n  if (typeof acquire !== \"function\") {\n    throw new Error(\n      \"acquireVsCodeApi is not defined: getVSCodeApi() must run inside a VS Code webview.\",\n    );\n  }\n  api = acquire();\n  api.postMessage({\n    channel: VSCODE_BRIDGE_CHANNEL,\n    kind: \"fetch:reset\",\n    id: \"\",\n  });\n  return api as VSCodeApi<TState>;\n}\n"],"mappings":";;AAQA,IAAI;;;;;AAMJ,SAAgB,eAAoD;CAClE,IAAI,KAAK,OAAO;CAChB,MAAM,UAAW,WACd;CACH,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MACR,oFACF;CAEF,MAAM,QAAQ;CACd,IAAI,YAAY;EACd,SAAS;EACT,MAAM;EACN,IAAI;CACN,CAAC;CACD,OAAO;AACT"}

package/dist/webview.d.ts

@@ -0,0 +1,7 @@
+export { getVSCodeApi, type VSCodeApi } from "./webview/vscode-api.js";
+export { getCspNonce } from "./webview/csp-nonce.js";
+export { createVSCodeFetch, vscodeFetch, type VSCodeBridgePort, type VSCodeFetch, } from "./webview/fetch.js";
+export { installLinkInterceptor, type LinkInterceptorOptions, } from "./webview/links.js";
+export { createVSCodeStorage } from "./webview/storage.js";
+export * from "./protocol.js";
+//# sourceMappingURL=webview.d.ts.map

package/dist/webview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webview.d.ts","sourceRoot":"","sources":["../src/webview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,SAAS,EAAE,gCAA6B;AACpE,OAAO,EAAE,WAAW,EAAE,+BAA4B;AAClD,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,2BAAwB;AACzB,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,2BAAwB;AACzB,OAAO,EAAE,mBAAmB,EAAE,6BAA0B;AACxD,8BAA2B"}

package/dist/webview.js

@@ -0,0 +1,7 @@
+import { VSCODE_BRIDGE_CHANNEL, VSCODE_VIRTUAL_ORIGIN, isHostToWebviewMessage, isWebviewToHostMessage } from "./protocol.js";
+import { getVSCodeApi } from "./webview/vscode-api.js";
+import { getCspNonce } from "./webview/csp-nonce.js";
+import { createVSCodeFetch, vscodeFetch } from "./webview/fetch.js";
+import { installLinkInterceptor } from "./webview/links.js";
+import { createVSCodeStorage } from "./webview/storage.js";
+export { VSCODE_BRIDGE_CHANNEL, VSCODE_VIRTUAL_ORIGIN, createVSCodeFetch, createVSCodeStorage, getCspNonce, getVSCodeApi, installLinkInterceptor, isHostToWebviewMessage, isWebviewToHostMessage, vscodeFetch };

package/package.json

@@ -1,6 +1,90 @@
 {
   "name": "@assistant-ui/vscode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.0",
+  "description": "Run assistant-ui inside VS Code extension webviews by tunnelling fetch to the extension host",
+  "keywords": [
+    "vscode",
+    "vscode-extension",
+    "webview",
+    "assistant-ui",
+    "ai",
+    "chat"
+  ],
+  "author": "AgentbaseAI Inc.",
+  "license": "MIT",
+  "homepage": "https://www.assistant-ui.com/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/assistant-ui/assistant-ui.git",
+    "directory": "packages/vscode"
+  },
+  "bugs": {
+    "url": "https://github.com/assistant-ui/assistant-ui/issues"
+  },
+  "type": "module",
+  "exports": {
+    "./webview": {
+      "types": "./dist/webview.d.ts",
+      "default": "./dist/webview.js"
+    },
+    "./host": {
+      "types": "./dist/host.d.ts",
+      "default": "./dist/host.js"
+    },
+    "./theme.css": {
+      "style": "./src/theme.css",
+      "default": "./src/theme.css"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/testUtils.ts",
+    "README.md"
+  ],
+  "sideEffects": [
+    "./src/theme.css"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@assistant-ui/core": "^0.3.32"
+  },
+  "peerDependencies": {
+    "@types/react": "*",
+    "react": "^18 || ^19"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@assistant-ui/store": "0.3.22",
+    "@assistant-ui/tap": "0.9.24",
+    "@assistant-ui/x-buildutils": "0.0.32",
+    "@assistant-ui/x-react18": "0.0.0",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.3.0",
+    "ai": "^7.0.153",
+    "jsdom": "^30.1.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "tailwindcss": "^4.3.3",
+    "vitest": "^5.0.5"
+  },
+  "scripts": {
+    "build": "aui-build",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage --coverage.reporter=text --coverage.reporter=html --coverage.reporter=json-summary",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "test:peer-react18": "vitest run --config vitest.peer-react18.config.ts",
+    "test:watch": "vitest",
+    "test:types:peer-react18": "aui-react18-types"
+  }
 }

package/src/external-url.ts

@@ -0,0 +1,19 @@
+export const DEFAULT_EXTERNAL_SCHEMES: readonly string[] = [
+  "http:",
+  "https:",
+  "mailto:",
+];
+
+export const parseExternalUrl = (
+  value: unknown,
+  schemes: readonly string[],
+): string | null => {
+  if (typeof value !== "string" && !(value instanceof URL)) return null;
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  return schemes.includes(url.protocol) ? url.href : null;
+};

package/src/host/html.ts

@@ -0,0 +1,224 @@
+export type WebviewCspSource = {
+  /** A source list, such as VS Code's `'self' https://*.vscode-cdn.net`. */
+  readonly cspSource: string;
+};
+
+export type WebviewResourceLike<U> = WebviewCspSource & {
+  asWebviewUri(uri: U): { toString(): string };
+};
+
+export type WebviewCspMode = "strict" | "relaxed";
+
+export type WebviewCspOptions = {
+  nonce: string;
+  /**
+   * `"relaxed"` swaps the style nonce for `'unsafe-inline'`, for libraries
+   * that inject `<style>` tags without a nonce.
+   */
+  csp?: WebviewCspMode;
+  /**
+   * Extra `script-src` sources, one host or scheme per entry. Code-split
+   * chunks need none: a module script's imports inherit its nonce.
+   */
+  scriptSrc?: readonly string[];
+  connectSrc?: readonly string[];
+  /**
+   * Extra `img-src` sources, such as `"https:"`. Remote images are blocked by
+   * default, because an image URL in model output can carry chat data away.
+   */
+  imgSrc?: readonly string[];
+  /** Extra `media-src` sources, blocked by default like `imgSrc`. */
+  mediaSrc?: readonly string[];
+  frameSrc?: readonly string[];
+  /** Adds `'wasm-unsafe-eval'` to `script-src` for WebAssembly modules. */
+  wasmUnsafeEval?: boolean;
+};
+
+export type WebviewSurface = "sidebar" | "editor" | "panel";
+
+export type RenderWebviewHtmlOptions<U> = Omit<WebviewCspOptions, "nonce"> & {
+  scripts: readonly U[];
+  styles?: readonly U[];
+  title?: string;
+  lang?: string;
+  /** Defaults to a fresh random nonce per render. */
+  nonce?: string;
+  /** Sets `data-aui-vscode-surface` for `@assistant-ui/vscode/theme.css`. */
+  surface?: WebviewSurface;
+  /** Id of the empty mount element; `null` omits it. */
+  rootId?: string | null;
+  /** `"module"` (default) or `"classic"` deferred scripts. */
+  scriptType?: "module" | "classic";
+  htmlAttributes?: Readonly<Record<string, string>>;
+  bodyAttributes?: Readonly<Record<string, string>>;
+};
+
+const NONCE_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
+const ATTRIBUTE_NAME_PATTERN = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;
+const INVALID_SOURCE_PATTERN = /[\s;,'"]/;
+
+const HTML_ESCAPES: Record<string, string> = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;",
+};
+
+const escapeHtml = (value: string) =>
+  value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char] ?? char);
+
+const assertNonce = (nonce: string) => {
+  if (!NONCE_PATTERN.test(nonce)) {
+    throw new Error(`Invalid CSP nonce: ${JSON.stringify(nonce)}`);
+  }
+};
+
+const sources = (directive: string, values: readonly string[]) => {
+  for (const value of values) {
+    if (value === "" || INVALID_SOURCE_PATTERN.test(value)) {
+      throw new Error(
+        `Invalid ${directive} source: ${JSON.stringify(value)}. Pass one host or scheme source per entry.`,
+      );
+    }
+  }
+  return values;
+};
+
+const cspSourceList = (cspSource: string) => {
+  const list = cspSource.split(/\s+/).filter((value) => value !== "");
+  if (list.length === 0) throw new Error("Invalid cspSource: empty");
+  sources(
+    "cspSource",
+    list.filter((value) => value !== "'self'"),
+  );
+  return list.join(" ");
+};
+
+const attributes = (values: Readonly<Record<string, string>>) =>
+  Object.entries(values)
+    .map(([name, value]) => {
+      if (!ATTRIBUTE_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid attribute name: ${JSON.stringify(name)}`);
+      }
+      return ` ${name}="${escapeHtml(value)}"`;
+    })
+    .join("");
+
+/** Returns a base64 nonce from 16 cryptographically random bytes. */
+export function createCspNonce(): string {
+  const crypto = globalThis.crypto;
+  if (typeof crypto?.getRandomValues !== "function") {
+    throw new Error(
+      "createCspNonce() needs globalThis.crypto.getRandomValues (Node.js 19 or later).",
+    );
+  }
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return btoa(String.fromCharCode(...bytes));
+}
+
+/**
+ * Returns the Content-Security-Policy for a webview whose scripts carry
+ * `nonce` and whose other resources load through `asWebviewUri`.
+ */
+export function createWebviewCsp(
+  webview: WebviewCspSource,
+  options: WebviewCspOptions,
+): string {
+  const { nonce, csp = "strict" } = options;
+  assertNonce(nonce);
+  const cspSource = cspSourceList(webview.cspSource);
+  const frameSrc = sources("frame-src", options.frameSrc ?? []);
+
+  const directives: [string, ...string[]][] = [
+    ["default-src", "'none'"],
+    [
+      "script-src",
+      `'nonce-${nonce}'`,
+      ...sources("script-src", options.scriptSrc ?? []),
+      ...(options.wasmUnsafeEval ? ["'wasm-unsafe-eval'"] : []),
+    ],
+    [
+      "style-src",
+      cspSource,
+      csp === "relaxed" ? "'unsafe-inline'" : `'nonce-${nonce}'`,
+    ],
+    [
+      "img-src",
+      cspSource,
+      "blob:",
+      "data:",
+      ...sources("img-src", options.imgSrc ?? []),
+    ],
+    [
+      "media-src",
+      cspSource,
+      "blob:",
+      "data:",
+      ...sources("media-src", options.mediaSrc ?? []),
+    ],
+    ["font-src", cspSource, "data:"],
+    [
+      "connect-src",
+      cspSource,
+      ...sources("connect-src", options.connectSrc ?? []),
+    ],
+    ["frame-src", ...(frameSrc.length > 0 ? frameSrc : ["'none'"])],
+  ];
+
+  return directives.map((directive) => directive.join(" ")).join("; ");
+}
+
+/**
+ * Renders the HTML document for a webview: a CSP meta tag, the nonce in
+ * `<meta property="csp-nonce">` for `getCspNonce()`, the stylesheets, a mount
+ * element, and the scripts, each carrying the nonce.
+ */
+export function renderWebviewHtml<U>(
+  webview: WebviewResourceLike<U>,
+  options: RenderWebviewHtmlOptions<U>,
+): string {
+  const {
+    scripts,
+    styles = [],
+    title = "",
+    lang = "en",
+    nonce = createCspNonce(),
+    surface,
+    rootId = "root",
+    scriptType = "module",
+    htmlAttributes = {},
+    bodyAttributes = {},
+    ...cspOptions
+  } = options;
+
+  const csp = createWebviewCsp(webview, { ...cspOptions, nonce });
+  const url = (uri: U) => escapeHtml(webview.asWebviewUri(uri).toString());
+  const scriptAttributes =
+    scriptType === "module" ? ' type="module"' : " defer";
+
+  return [
+    "<!doctype html>",
+    `<html${attributes({ lang, ...htmlAttributes })}>`,
+    "<head>",
+    '<meta charset="utf-8">',
+    `<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<meta property="csp-nonce" nonce="${nonce}">`,
+    `<title>${escapeHtml(title)}</title>`,
+    ...styles.map((uri) => `<link rel="stylesheet" href="${url(uri)}">`),
+    "</head>",
+    `<body${attributes({
+      ...(surface ? { "data-aui-vscode-surface": surface } : {}),
+      ...bodyAttributes,
+    })}>`,
+    ...(rootId === null ? [] : [`<div id="${escapeHtml(rootId)}"></div>`]),
+    ...scripts.map(
+      (uri) =>
+        `<script${scriptAttributes} nonce="${nonce}" src="${url(uri)}"></script>`,
+    ),
+    "</body>",
+    "</html>",
+    "",
+  ].join("\n");
+}