@braidlabs/core 0.7.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@braidlabs/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Braid client runtime — compose independently deployed frontend apps into one page. This build ships the compat adapter (the contained web-fragments-style emulation layer) as the default adapter.",
   "keywords": [
     "micro-frontends",

package/src/adapters/compat-adapter.js

@@ -1,8 +1,9 @@
 import { compatMetadataSymbol } from '../compat/metadata.js';
 import { initializeRealmContext } from '../compat/realm-patches.js';
-import { executeScriptsInFragmentContent } from '../compat/script-execution.js';
+import { executeScriptsInFragmentContent, markStartedInPlace } from '../compat/script-execution.js';
 import { installRealmGlobals } from '../compat/shared-globals.js';
 import { isDevMode } from '../config.js';
+import { trustedHTML, trustedScript } from '../trusted-types.js';
 /**
  * The compat adapter — the emulation layer, contained.
  *
@@ -88,17 +89,63 @@ export const compatAdapter = {
  * saw a bare markup snippet.
  */
 export function parseFragmentContent(html, mainDocument) {
-    const parsed = new DOMParser().parseFromString(html, 'text/html');
+    // markup the gateway prepared, parsed where nothing runs: Braid's own write (see trusted-types.ts)
+    const parsed = new DOMParser().parseFromString(trustedHTML(html), 'text/html');
     const braidHtml = parsed.body.querySelector('braid-html');
     if (braidHtml) {
-        return mainDocument.importNode(braidHtml, true);
+        return readyScripts(mainDocument.importNode(braidHtml, true));
     }
     const wrapper = mainDocument.createElement('braid-html');
     const braidBody = mainDocument.createElement('braid-body');
     braidBody.append(...[...parsed.body.childNodes].map((node) => mainDocument.importNode(node, true)));
     wrapper.append(braidBody);
-    return wrapper;
+    return readyScripts(wrapper);
 }
+/**
+ * Readies the fragment's scripts in markup imported from the parser's document, before any of it
+ * reaches the page.
+ *
+ * - **Only what the gateway neutralized is kept.** The gateway gives every script `type="inert"`,
+ *   an SVG one included; one without it slipped past the rewriter, and nothing here can tell what
+ *   it would do in the host, so it is dropped (in dev, with a warning).
+ * - **Each inline script gets its own text back through Braid's Trusted Types policy.** Imported
+ *   from another document, a script no longer counts as parser-written, and a host enforcing
+ *   Trusted Types would refuse to mark it started below. Without a policy nothing changes.
+ * - **Each is marked started now, while the tree is detached**, so there is no moment at which a
+ *   blessed script is in the page unmarked. The fragment's realm runs fresh copies; these never run.
+ */
+function readyScripts(root) {
+    for (const script of root.querySelectorAll('script')) {
+        if (script.getAttribute('type') !== 'inert') {
+            if (isDevMode())
+                console.warn('[braid] a fragment script was not neutralized by the gateway and is dropped', script);
+            script.remove();
+            continue;
+        }
+        if (script.hasAttribute('src'))
+            continue;
+        const text = script.textContent ?? '';
+        const trusted = trustedScript(text);
+        if (trusted === text)
+            continue;
+        if (script.namespaceURI === XHTML) {
+            script.textContent = trusted;
+        }
+        else if (!script.hasAttribute('href') && !script.hasAttribute('xlink:href')) {
+            // An SVG script's text cannot be given back through a policy (only an HTML script's setters
+            // take one), so a host enforcing Trusted Types would report it. Its realm runs an HTML copy
+            // whatever it is here, so the inert one in the page becomes an HTML script too.
+            const html = root.ownerDocument.createElement('script');
+            for (const attribute of script.attributes)
+                html.setAttribute(attribute.name, attribute.value);
+            html.textContent = trusted;
+            script.replaceWith(html);
+        }
+    }
+    markStartedInPlace(root);
+    return root;
+}
+const XHTML = 'http://www.w3.org/1999/xhtml';
 /**
  * Resolves once every image that holds a document's load event has loaded or failed.
  *

package/src/adapters/compat-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"compat-adapter.js","sourceRoot":"","sources":["../../../../../libs/core/src/adapters/compat-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB;IAC7C,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,aAAa;IACxB,oBAAoB,EAAE,IAAI;IAE1B,KAAK,CAAC,IAAI,CAAC,GAAuB;QAChC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAC3I,GAAG,CAAC;QAEN,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YACnD,CAAC,oBAAoB,CAAC,EAAE,EAAE,kBAAkB,EAAE,SAA+B,EAAE;SAChF,CAAqB,CAAC;QAEvB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,uFAAuF;YACvF,uFAAuF;YACvF,yFAAyF;YACzF,uFAAuF;YACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;YAE5E,uFAAuF;YACvF,wEAAwE;YACxE,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,uBAAuB,GAAG,IAAI,eAAe,EAAE,CAAC;QACtD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAExF,oFAAoF;QACpF,0CAA0C;QAC1C,MAAM,YAAY,GAAG,sBAAsB,CACzC,KAAK,EACL,kBAAkB,EAClB,WAAW,EACX,KAAK,EACL,uBAAuB,EACvB,aAAa,IAAI,EAAE,EACnB,gBAAgB,EAChB,UAAU,CACX,CAAC;QAEF,6FAA6F;QAC7F,IAAI,YAAY;YAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9E,qFAAqF;QACrF,+BAA+B,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7D,4FAA4F;QAC5F,6FAA6F;QAC7F,oBAAoB;QACpB,YAAY,CAAC,YAAY,EAAE,CAAC;QAE5B,0EAA0E;QAC1E,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,GAAG,aAAa,CAAC;QAC5E,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAChG,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE/F,8FAA8F;QAC9F,+FAA+F;QAC/F,EAAE;QACF,4FAA4F;QAC5F,0FAA0F;QAC1F,mFAAmF;QACnF,KAAK,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACxC,wFAAwF;YACxF,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO;gBAC3B,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,GAAG,UAAU,CAAC;gBACzE,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAErF,IAAI,SAAS,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,UAAU,UAAU,0BAA0B,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,YAAsB;IACvE,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAgB,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC3D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAwB;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAmB,6BAA6B,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"compat-adapter.js","sourceRoot":"","sources":["../../../../../libs/core/src/adapters/compat-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB;IAC7C,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,aAAa;IACxB,oBAAoB,EAAE,IAAI;IAE1B,KAAK,CAAC,IAAI,CAAC,GAAuB;QAChC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAC3I,GAAG,CAAC;QAEN,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;YACnD,CAAC,oBAAoB,CAAC,EAAE,EAAE,kBAAkB,EAAE,SAA+B,EAAE;SAChF,CAAqB,CAAC;QAEvB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,uFAAuF;YACvF,uFAAuF;YACvF,yFAAyF;YACzF,uFAAuF;YACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;YAE5E,uFAAuF;YACvF,wEAAwE;YACxE,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,uBAAuB,GAAG,IAAI,eAAe,EAAE,CAAC;QACtD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAExF,oFAAoF;QACpF,0CAA0C;QAC1C,MAAM,YAAY,GAAG,sBAAsB,CACzC,KAAK,EACL,kBAAkB,EAClB,WAAW,EACX,KAAK,EACL,uBAAuB,EACvB,aAAa,IAAI,EAAE,EACnB,gBAAgB,EAChB,UAAU,CACX,CAAC;QAEF,6FAA6F;QAC7F,IAAI,YAAY;YAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAE9E,qFAAqF;QACrF,+BAA+B,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7D,4FAA4F;QAC5F,6FAA6F;QAC7F,oBAAoB;QACpB,YAAY,CAAC,YAAY,EAAE,CAAC;QAE5B,0EAA0E;QAC1E,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,GAAG,aAAa,CAAC;QAC5E,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAChG,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE/F,8FAA8F;QAC9F,+FAA+F;QAC/F,EAAE;QACF,4FAA4F;QAC5F,0FAA0F;QAC1F,mFAAmF;QACnF,KAAK,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACxC,wFAAwF;YACxF,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO;gBAC3B,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,GAAG,UAAU,CAAC;gBACzE,WAAW,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAErF,IAAI,SAAS,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,UAAU,UAAU,0BAA0B,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,YAAsB;IACvE,mGAAmG;IACnG,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;IAE/E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAgB,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC3D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAoB,IAAO;IAC9C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,6EAA6E,EAAE,MAAM,CAAC,CAAC;YACrH,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC;QAC/B,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9E,4FAA4F;YAC5F,4FAA4F;YAC5F,gFAAgF;YAChF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU;gBAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAwB;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAmB,6BAA6B,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC"}

package/src/compat/database-partition.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Per-fragment IndexedDB and Cache Storage, for a compat fragment granted
+ * `capabilities.storage: { databases: true }`.
+ *
+ * A compat realm is a same-origin iframe, so its `indexedDB` and `caches` are the origin's: two
+ * fragments that both open a database called `app` open the same one, and the host sees it too.
+ * `compat/storage-partition.ts` already gives each partition its own Web Storage and cookies; this
+ * does the same for the databases.
+ *
+ * - **Where the browser has Storage Buckets** (Chromium), the realm gets a bucket of its own —
+ *   `navigator.storageBuckets.open()` — and that bucket's `indexedDB` and `caches`. The browser
+ *   keeps the data apart, and evicts, quotas and deletes it per bucket, so one fragment filling its
+ *   store does not cost another its data.
+ * - **Elsewhere**, the realm's own factory and cache storage are wrapped to prefix every name with
+ *   the partition, and to list only the partition's own. `IDBDatabase.name` and a cache's key
+ *   still show the prefix: an accident barrier, like the rest of the trusted tier, not a boundary.
+ *
+ * Installed before any fragment code runs. Opt-in, so a fragment's existing databases stay where
+ * they are until it asks.
+ */
+export type DatabasePartitionKind = 'bucket' | 'prefixed';
+/** Gives the realm window its partition's `indexedDB` and `caches`; resolves with which kind. */
+export declare function installDatabasePartition(realm: Window, partition: string): Promise<DatabasePartitionKind>;
+/**
+ * A bucket name for a partition: lowercase letters, digits, `-` and `_`, at most 64 characters, as
+ * the API requires. The readable part may collide after that folding; the hash of the exact
+ * partition keeps two partitions apart.
+ */
+export declare function bucketName(partition: string): string;
+/** An `IDBFactory` whose databases are the partition's: same prototype, so `instanceof` holds. */
+export declare function prefixedFactory(native: IDBFactory, prefix: string): IDBFactory;
+/** A `CacheStorage` whose caches are the partition's. `match` looks only in those. */
+export declare function prefixedCacheStorage(native: CacheStorage, prefix: string): CacheStorage;
+/**
+ * Deletes every fragment's partitioned IndexedDB and Cache Storage on this origin — the buckets,
+ * and the prefixed databases and caches of a browser without them. For sign-out on a shared device:
+ * a partitioned fragment's data lives where the origin's own `indexedDB.databases()` and
+ * `caches.keys()` do not list it, so a sign-out routine that clears those leaves it behind.
+ *
+ * Only Braid's own: realm buckets matched by their full name format, databases and caches by their
+ * `braid:<partition>:` prefix.
+ */
+export declare function clearBraidDatabases(scope?: Window): Promise<void>;

package/src/compat/database-partition.js

@@ -0,0 +1,165 @@
+/**
+ * Per-fragment IndexedDB and Cache Storage, for a compat fragment granted
+ * `capabilities.storage: { databases: true }`.
+ *
+ * A compat realm is a same-origin iframe, so its `indexedDB` and `caches` are the origin's: two
+ * fragments that both open a database called `app` open the same one, and the host sees it too.
+ * `compat/storage-partition.ts` already gives each partition its own Web Storage and cookies; this
+ * does the same for the databases.
+ *
+ * - **Where the browser has Storage Buckets** (Chromium), the realm gets a bucket of its own —
+ *   `navigator.storageBuckets.open()` — and that bucket's `indexedDB` and `caches`. The browser
+ *   keeps the data apart, and evicts, quotas and deletes it per bucket, so one fragment filling its
+ *   store does not cost another its data.
+ * - **Elsewhere**, the realm's own factory and cache storage are wrapped to prefix every name with
+ *   the partition, and to list only the partition's own. `IDBDatabase.name` and a cache's key
+ *   still show the prefix: an accident barrier, like the rest of the trusted tier, not a boundary.
+ *
+ * Installed before any fragment code runs. Opt-in, so a fragment's existing databases stay where
+ * they are until it asks.
+ */
+/** Gives the realm window its partition's `indexedDB` and `caches`; resolves with which kind. */
+export async function installDatabasePartition(realm, partition) {
+    const realmWindow = realm;
+    const buckets = realmWindow.navigator.storageBuckets;
+    const prefix = `braid:${encodeURIComponent(partition)}:`;
+    // Where a partition's data already is, it stays: a browser that gains buckets, or a bucket that
+    // was refused once, would otherwise hand the fragment an empty store and strand the old one.
+    if (typeof buckets?.open === 'function' && !(await hasPrefixedData(realmWindow, prefix))) {
+        try {
+            const bucket = await buckets.open(bucketName(partition));
+            define(realm, 'indexedDB', bucket.indexedDB);
+            define(realm, 'caches', bucket.caches);
+            return 'bucket';
+        }
+        catch {
+            // refused (an opaque origin, a quota policy): fall back to prefixing
+        }
+    }
+    if (realmWindow.indexedDB)
+        define(realm, 'indexedDB', prefixedFactory(realmWindow.indexedDB, prefix));
+    if (realmWindow.caches)
+        define(realm, 'caches', prefixedCacheStorage(realmWindow.caches, prefix));
+    return 'prefixed';
+}
+/**
+ * A bucket name for a partition: lowercase letters, digits, `-` and `_`, at most 64 characters, as
+ * the API requires. The readable part may collide after that folding; the hash of the exact
+ * partition keeps two partitions apart.
+ */
+export function bucketName(partition) {
+    const readable = partition.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40);
+    return `${BUCKET_NAMESPACE}${readable || 'p'}_${fnv1a(partition)}`;
+}
+/**
+ * Realm database buckets, and only them: a fixed namespace no other bucket of Braid's uses (the
+ * service worker's are `braid-sw-…`), matched in full, so clearing never takes an app's own bucket.
+ */
+const BUCKET_NAMESPACE = 'braid-db_';
+const BUCKET_FORMAT = /^braid-db_[a-z0-9-]{1,40}_[0-9a-f]{8}$/;
+const PREFIX_FORMAT = /^braid:[^:]+:/;
+function fnv1a(text) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, '0');
+}
+function define(realm, name, value) {
+    Object.defineProperty(realm, name, { configurable: true, enumerable: true, get: () => value });
+}
+/** An `IDBFactory` whose databases are the partition's: same prototype, so `instanceof` holds. */
+export function prefixedFactory(native, prefix) {
+    return Object.create(Object.getPrototypeOf(native), {
+        open: {
+            value: (name, version) => (version === undefined ? native.open(prefix + name) : native.open(prefix + name, version)),
+        },
+        deleteDatabase: { value: (name) => native.deleteDatabase(prefix + name) },
+        // only where the native factory has it, so feature detection tells the truth
+        ...(typeof native.databases === 'function'
+            ? {
+                databases: {
+                    value: async () => (await native.databases())
+                        .filter((info) => info.name?.startsWith(prefix))
+                        .map((info) => ({ ...info, name: info.name.slice(prefix.length) })),
+                },
+            }
+            : // shadowing the prototype's, which would throw on this object anyway
+                { databases: { value: undefined } }),
+        cmp: { value: (first, second) => native.cmp(first, second) },
+    });
+}
+/** A `CacheStorage` whose caches are the partition's. `match` looks only in those. */
+export function prefixedCacheStorage(native, prefix) {
+    const own = async () => (await native.keys()).filter((name) => name.startsWith(prefix));
+    return Object.create(Object.getPrototypeOf(native), {
+        open: { value: (name) => native.open(prefix + name) },
+        has: { value: (name) => native.has(prefix + name) },
+        delete: { value: (name) => native.delete(prefix + name) },
+        keys: { value: async () => (await own()).map((name) => name.slice(prefix.length)) },
+        match: {
+            value: async (request, options) => {
+                if (options?.cacheName !== undefined)
+                    return native.match(request, { ...options, cacheName: prefix + options.cacheName });
+                for (const name of await own()) {
+                    const found = await (await native.open(name)).match(request, options);
+                    if (found)
+                        return found;
+                }
+                return undefined;
+            },
+        },
+    });
+}
+/** Whether the partition already keeps databases or caches under prefixed names. */
+async function hasPrefixedData(realm, prefix) {
+    const has = async (names) => {
+        try {
+            return (await names()).some((name) => name?.startsWith(prefix));
+        }
+        catch {
+            return false;
+        }
+    };
+    const factory = realm.indexedDB;
+    const caches = realm.caches;
+    return ((typeof factory?.databases === 'function' && (await has(async () => (await factory.databases()).map((info) => info.name)))) ||
+        (caches !== undefined && (await has(() => caches.keys()))));
+}
+/**
+ * Deletes every fragment's partitioned IndexedDB and Cache Storage on this origin — the buckets,
+ * and the prefixed databases and caches of a browser without them. For sign-out on a shared device:
+ * a partitioned fragment's data lives where the origin's own `indexedDB.databases()` and
+ * `caches.keys()` do not list it, so a sign-out routine that clears those leaves it behind.
+ *
+ * Only Braid's own: realm buckets matched by their full name format, databases and caches by their
+ * `braid:<partition>:` prefix.
+ */
+export async function clearBraidDatabases(scope = window) {
+    const realmWindow = scope;
+    const buckets = realmWindow.navigator.storageBuckets;
+    if (buckets && typeof buckets.keys === 'function') {
+        for (const name of await buckets.keys())
+            if (BUCKET_FORMAT.test(name))
+                await buckets.delete(name);
+    }
+    const factory = realmWindow.indexedDB;
+    if (factory && typeof factory.databases === 'function') {
+        for (const { name } of await factory.databases()) {
+            if (name && PREFIX_FORMAT.test(name)) {
+                await new Promise((resolve) => {
+                    const request = factory.deleteDatabase(name);
+                    request.onsuccess = request.onerror = request.onblocked = () => resolve();
+                });
+            }
+        }
+    }
+    const cacheStorage = realmWindow.caches;
+    if (cacheStorage) {
+        for (const name of await cacheStorage.keys())
+            if (PREFIX_FORMAT.test(name))
+                await cacheStorage.delete(name);
+    }
+}
+//# sourceMappingURL=database-partition.js.map

package/src/compat/database-partition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-partition.js","sourceRoot":"","sources":["../../../../../libs/core/src/compat/database-partition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAa,EAAE,SAAiB;IAC7E,MAAM,WAAW,GAAG,KAAmC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC;IACzD,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,OAAO,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,SAAS;QAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACtG,IAAI,WAAW,CAAC,MAAM;QAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,oBAAoB,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3G,OAAO,GAAG,gBAAgB,GAAG,QAAQ,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAC/D,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAA4B,EAAE,KAAc;IACzE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,MAAc;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE;QAClD,IAAI,EAAE;YACJ,KAAK,EAAE,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;SACtI;QACD,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE;QACjF,6EAA6E;QAC7E,GAAG,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU;YACxC,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK,EAAE,KAAK,IAAI,EAAE,CAChB,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;yBACvB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;yBAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iBACzE;aACF;YACH,CAAC,CAAC,qEAAqE;gBACrE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QACxC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,KAAc,EAAE,MAAe,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;KAC/E,CAAe,CAAC;AACnB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE;QAClD,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE;QAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE;QAC3D,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE;QACjE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;QACnF,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,EAAE,OAA0B,EAAE,OAAgC,EAAE,EAAE;gBAC5E,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC1H,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,KAAK;wBAAE,OAAO,KAAK,CAAC;gBAC1B,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;SACF;KACF,CAAiB,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAAC,KAAsB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,KAAK,EAAE,KAAqD,EAAE,EAAE;QAC1E,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,OAAO,CACL,CAAC,OAAO,OAAO,EAAE,SAAS,KAAK,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3H,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,MAAM;IAC9D,MAAM,WAAW,GAAG,KAEnB,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC;IACrD,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE;YAAE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC;IACtC,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACjD,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;oBAC7C,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;gBAC5E,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC;IACxC,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE;YAAE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC"}

package/src/compat/fragment-boundary.js

@@ -48,12 +48,112 @@ const native = {
     elementAfter: Element.prototype.after,
     shadowRootInnerHTML: Object.getOwnPropertyDescriptor(ShadowRoot.prototype, 'innerHTML'),
 };
+/**
+ * Every boundary's stamped prototypes and installed wrappers, page-wide. A node that moves between
+ * fragments carries a stamp from each, and delegation has to see past all of them.
+ */
+const allStampedProtos = new WeakSet();
+const allBoundaryWrappers = new WeakSet();
+/**
+ * The built-in prototypes the intercepted methods are defined on. A method found on one of these is
+ * the platform's — or a host page's later patch of it, which fragment nodes have never run.
+ */
+const PLATFORM_PROTOTYPES = new Set([Node.prototype, Element.prototype, HTMLElement.prototype, DocumentFragment.prototype]);
+/**
+ * The method a node would have without any boundary's stamp: whatever its prototype chain defines
+ * below the lowest stamp, read at call time — or the native method, when that is the platform's.
+ *
+ * A custom element may override insertion on its own class — Stencil's scoped components do, to
+ * move light-DOM children into the element's inner slot. The stamp sits above that class, so
+ * calling the native method unconditionally would skip the override: children land on the host
+ * instead of in the slot, and an `insertBefore` whose reference the component had relocated throws
+ * `NotFoundError`.
+ *
+ * Past the *lowest* stamp, of any boundary, so a node stamped by fragment A, then B, then A again
+ * never delegates from one boundary's wrapper to another's and back. Unstamped receivers (a shadow
+ * root's own-property overrides) get the native method.
+ */
+function unstampedMethod(node, name, nativeMethod) {
+    let belowStamps;
+    for (let proto = Object.getPrototypeOf(node); proto !== null; proto = Object.getPrototypeOf(proto)) {
+        if (allStampedProtos.has(proto))
+            belowStamps = Object.getPrototypeOf(proto);
+    }
+    for (let owner = belowStamps; owner; owner = Object.getPrototypeOf(owner)) {
+        if (!Object.hasOwn(owner, name))
+            continue;
+        if (PLATFORM_PROTOTYPES.has(owner))
+            return nativeMethod;
+        const method = Object.getOwnPropertyDescriptor(owner, name)?.value;
+        return typeof method === 'function' && !allBoundaryWrappers.has(method) ? method : nativeMethod;
+    }
+    return nativeMethod;
+}
+/**
+ * Custom elements stamped before their definition existed, page-wide by tag name, and what restamps
+ * each one.
+ *
+ * Upgrading an element replaces its prototype with the definition's, which drops the stamp. Most
+ * upgrades happen during an insertion the boundary stamps after anyway; this catches the rest — an
+ * element already in a fragment's DOM when its definition arrives *in the host's registry*, which is
+ * the one that upgrades fragment DOM: a shared component bundle the host loads. A compat fragment's
+ * own `customElements.define` goes to its realm's registry and never resolves here.
+ *
+ * Many dashed names are never defined at all (every Angular component host), so nothing here may
+ * keep a boundary alive: one `whenDefined` per name for the page, closing over only the waiting
+ * set, and each element's restamper held weakly by the element.
+ */
+const awaitingDefinition = new Map();
+const restampers = new WeakMap();
+function restampWhenDefined(element, restamp) {
+    const alreadyWaiting = restampers.has(element);
+    restampers.set(element, restamp);
+    if (alreadyWaiting)
+        return;
+    const name = element.localName;
+    let waiting = awaitingDefinition.get(name);
+    if (!waiting) {
+        const entry = { elements: new Set(), pruneAt: 1024 };
+        awaitingDefinition.set(name, (waiting = entry));
+        customElements.whenDefined(name).then(() => {
+            awaitingDefinition.delete(name);
+            for (const ref of entry.elements) {
+                const defined = ref.deref();
+                if (defined)
+                    restampers.get(defined)?.(defined);
+            }
+        }, () => awaitingDefinition.delete(name));
+    }
+    // a long-lived list of a never-defined element leaves dead refs behind; sweep them as it grows
+    if (waiting.elements.size >= waiting.pruneAt) {
+        for (const ref of waiting.elements)
+            if (!ref.deref())
+                waiting.elements.delete(ref);
+        waiting.pruneAt = Math.max(1024, waiting.elements.size * 2);
+    }
+    waiting.elements.add(new WeakRef(element));
+}
 export function createFragmentBoundary(options) {
     const { realmDocument, shadowRoot, braidDocumentElement, abortSignal, htmlPolicy } = options;
     const stampedNodes = new WeakSet();
     const stampedProtos = new Map();
     const stampedProtoSet = new WeakSet();
     let warnedAboutUnstampedEntry = false;
+    /** Restamps an upgraded element, unless it has left this fragment or the fragment is gone. */
+    function restampIfStillInFragment(element) {
+        if (!abortSignal.aborted && isInFragmentDom(element))
+            stampNode(element);
+    }
+    /**
+     * Stamps what an insertion put in place: anything in the fragment's DOM, or in a detached tree,
+     * which may enter it later. Not a node a component's own insertion override placed in the host's
+     * DOM instead (a portal, an overlay) — that is the host's, and stays on pristine prototypes.
+     */
+    function stampInserted(node) {
+        if (node.isConnected && !isInFragmentDom(node))
+            return;
+        stampTree(node);
+    }
     /** A node is inside this fragment's DOM iff its plain root is the fragment's shadow root. */
     function isInFragmentDom(node) {
         return native.getRootNode.call(node) === shadowRoot;
@@ -174,13 +274,13 @@ export function createFragmentBoundary(options) {
      * `compatDomInsertion`). In all cases the inserted subtree is stamped so the stamped set
      * stays closed.
      */
-    function makeSingleNodeInsertion(nativeFn) {
+    function makeSingleNodeInsertion(name, nativeFn) {
         return function boundaryInsertion(childNode) {
             const args = arguments;
             const futureStamps = nodesToStampAfterInsertion(childNode);
             const doInsertTheNode = () => {
-                const result = nativeFn.apply(this, args);
-                futureStamps.forEach(stampTree);
+                const result = unstampedMethod(this, name, nativeFn).apply(this, args);
+                futureStamps.forEach(stampInserted);
                 return result;
             };
             if (!isInFragmentDom(this)) {
@@ -195,8 +295,8 @@ export function createFragmentBoundary(options) {
         const args = arguments;
         const futureStamps = nodesToStampAfterInsertion(newChild);
         const doInsertTheNode = () => {
-            const result = native.replaceChild.apply(this, args);
-            futureStamps.forEach(stampTree);
+            const result = unstampedMethod(this, 'replaceChild', native.replaceChild).apply(this, args);
+            futureStamps.forEach(stampInserted);
             return result;
         };
         if (!isInFragmentDom(this)) {
@@ -210,8 +310,8 @@ export function createFragmentBoundary(options) {
     function boundaryInsertAdjacentElement(where, element) {
         const args = arguments;
         const doInsertTheNode = () => {
-            const result = native.insertAdjacentElement.apply(this, args);
-            stampTree(element);
+            const result = unstampedMethod(this, 'insertAdjacentElement', native.insertAdjacentElement).apply(this, args);
+            stampInserted(element);
             return result;
         };
         if (!isInFragmentDom(this)) {
@@ -224,14 +324,14 @@ export function createFragmentBoundary(options) {
      * replaceWith): the native insertion runs once, after every node argument has been
      * preprocessed.
      */
-    function makeMultiNodeInsertion(nativeFn) {
+    function makeMultiNodeInsertion(name, nativeFn) {
         return function boundaryMultiInsertion(...nodes) {
             const args = arguments;
             const nodeArgs = nodes.filter((node) => typeof node !== 'string');
             const futureStamps = nodeArgs.flatMap(nodesToStampAfterInsertion);
             const doInsertTheNodes = () => {
-                nativeFn.apply(this, args);
-                futureStamps.forEach(stampTree);
+                unstampedMethod(this, name, nativeFn).apply(this, args);
+                futureStamps.forEach(stampInserted);
             };
             if (!isInFragmentDom(this)) {
                 return doInsertTheNodes();
@@ -272,18 +372,18 @@ export function createFragmentBoundary(options) {
         };
     }
     const elementOverrides = {
-        appendChild: { configurable: true, writable: true, value: makeSingleNodeInsertion(native.appendChild) },
-        insertBefore: { configurable: true, writable: true, value: makeSingleNodeInsertion(native.insertBefore) },
+        appendChild: { configurable: true, writable: true, value: makeSingleNodeInsertion('appendChild', native.appendChild) },
+        insertBefore: { configurable: true, writable: true, value: makeSingleNodeInsertion('insertBefore', native.insertBefore) },
         replaceChild: { configurable: true, writable: true, value: boundaryReplaceChild },
         insertAdjacentElement: { configurable: true, writable: true, value: boundaryInsertAdjacentElement },
-        append: { configurable: true, writable: true, value: makeMultiNodeInsertion(native.elementAppend) },
-        prepend: { configurable: true, writable: true, value: makeMultiNodeInsertion(native.elementPrepend) },
+        append: { configurable: true, writable: true, value: makeMultiNodeInsertion('append', native.elementAppend) },
+        prepend: { configurable: true, writable: true, value: makeMultiNodeInsertion('prepend', native.elementPrepend) },
         replaceChildren: {
             configurable: true,
             writable: true,
-            value: makeMultiNodeInsertion(native.elementReplaceChildren),
+            value: makeMultiNodeInsertion('replaceChildren', native.elementReplaceChildren),
         },
-        replaceWith: { configurable: true, writable: true, value: makeMultiNodeInsertion(native.elementReplaceWith) },
+        replaceWith: { configurable: true, writable: true, value: makeMultiNodeInsertion('replaceWith', native.elementReplaceWith) },
         insertAdjacentHTML: {
             configurable: true,
             writable: true,
@@ -314,7 +414,7 @@ export function createFragmentBoundary(options) {
                 }
                 else {
                     // also what throws for an unknown position, or outside an element with no parent
-                    native.insertAdjacentHTML.call(this, position, text);
+                    unstampedMethod(this, 'insertAdjacentHTML', native.insertAdjacentHTML).call(this, position, text);
                 }
                 stampTree(inside ? this : this.parentNode ?? this);
             },
@@ -323,7 +423,7 @@ export function createFragmentBoundary(options) {
             configurable: true,
             writable: true,
             value: function boundaryCloneNode(deep) {
-                const clone = native.cloneNode.call(this, deep);
+                const clone = unstampedMethod(this, 'cloneNode', native.cloneNode).call(this, deep);
                 inheritProvenance(this, clone, Boolean(deep));
                 stampTree(clone);
                 return clone;
@@ -350,6 +450,10 @@ export function createFragmentBoundary(options) {
         },
         ...makeHtmlParsingOverrides(native.elementInnerHTML),
     };
+    for (const descriptor of Object.values(elementOverrides)) {
+        if (typeof descriptor.value === 'function')
+            allBoundaryWrappers.add(descriptor.value);
+    }
     /**
      * What a URL set from fragment script resolves against, read when it is set: the namespace from
      * the realm's base, and the fragment's own `<base href>` from its markup — the two the gateway
@@ -362,13 +466,16 @@ export function createFragmentBoundary(options) {
     function stampNode(node) {
         if (node.nodeType !== Node.ELEMENT_NODE)
             return;
-        if (stampedNodes.has(node))
-            return;
+        // by prototype, not by membership: an upgrade replaces a stamped element's prototype, and the
+        // next stamping pass that reaches it should put the stamp back
         const proto = Object.getPrototypeOf(node);
         if (proto === null || stampedProtoSet.has(proto)) {
             stampedNodes.add(node);
             return;
         }
+        if (proto === HTMLElement.prototype && node.localName.includes('-')) {
+            restampWhenDefined(node, restampIfStillInFragment);
+        }
         let stampedProto = stampedProtos.get(proto);
         if (!stampedProto) {
             // a subresource URL the fragment's code sets resolves into its namespace, as one in its
@@ -379,6 +486,7 @@ export function createFragmentBoundary(options) {
             });
             stampedProtos.set(proto, stampedProto);
             stampedProtoSet.add(stampedProto);
+            allStampedProtos.add(stampedProto);
         }
         Object.setPrototypeOf(node, stampedProto);
         stampedNodes.add(node);
@@ -399,15 +507,15 @@ export function createFragmentBoundary(options) {
      * (reporting the main document) — only insertions are intercepted.
      */
     Object.defineProperties(shadowRoot, {
-        appendChild: { configurable: true, writable: true, value: makeSingleNodeInsertion(native.appendChild) },
-        insertBefore: { configurable: true, writable: true, value: makeSingleNodeInsertion(native.insertBefore) },
+        appendChild: { configurable: true, writable: true, value: makeSingleNodeInsertion('appendChild', native.appendChild) },
+        insertBefore: { configurable: true, writable: true, value: makeSingleNodeInsertion('insertBefore', native.insertBefore) },
         replaceChild: { configurable: true, writable: true, value: boundaryReplaceChild },
-        append: { configurable: true, writable: true, value: makeMultiNodeInsertion(native.fragmentAppend) },
-        prepend: { configurable: true, writable: true, value: makeMultiNodeInsertion(native.fragmentPrepend) },
+        append: { configurable: true, writable: true, value: makeMultiNodeInsertion('append', native.fragmentAppend) },
+        prepend: { configurable: true, writable: true, value: makeMultiNodeInsertion('prepend', native.fragmentPrepend) },
         replaceChildren: {
             configurable: true,
             writable: true,
-            value: makeMultiNodeInsertion(native.fragmentReplaceChildren),
+            value: makeMultiNodeInsertion('replaceChildren', native.fragmentReplaceChildren),
         },
         ...makeHtmlParsingOverrides(native.shadowRootInnerHTML),
     });