@bstage-sdk/bridge 0.0.0-stage → 0.9.0

package/dist/host.cjs

@@ -0,0 +1,1399 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/host/index.ts
+var host_exports = {};
+__export(host_exports, {
+  ALLOWED_METHODS: () => ALLOWED_METHODS,
+  ALLOWED_REQUEST_HEADERS: () => ALLOWED_REQUEST_HEADERS,
+  BRIDGE_SURFACES: () => BRIDGE_SURFACES,
+  DEFAULT_GATEWAY_DENY_SEGMENTS: () => DEFAULT_GATEWAY_DENY_SEGMENTS,
+  DEFAULT_POLICY: () => DEFAULT_POLICY,
+  HOST_ONLY_HEADERS: () => HOST_ONLY_HEADERS,
+  IFRAME_ATTRIBUTES: () => IFRAME_ATTRIBUTES,
+  MAX_DECODE_PASSES: () => MAX_DECODE_PASSES,
+  MAX_PARTNER_ORIGINS: () => MAX_PARTNER_ORIGINS,
+  checkPath: () => checkPath,
+  classifyDestination: () => classifyDestination,
+  createBridgeHost: () => createBridgeHost,
+  createNonce: () => createNonce,
+  createSession: () => createSession,
+  createSrcdoc: () => createSrcdoc,
+  isAllowedGatewayPath: () => isAllowedGatewayPath,
+  isBridgeSurface: () => isBridgeSurface,
+  isValidSession: () => isValidSession,
+  normalizePartnerOrigins: () => normalizePartnerOrigins,
+  normalizePinnedHeaders: () => normalizePinnedHeaders,
+  prepareFetch: () => prepareFetch,
+  resolveDestination: () => resolveDestination,
+  resolvePolicy: () => resolvePolicy
+});
+module.exports = __toCommonJS(host_exports);
+
+// src/protocol/envelope.ts
+var BRIDGE_VERSION = 1;
+var BRIDGE_NAMESPACE = "bstage-bridge";
+var MAX_ENVELOPE_ID_LENGTH = 64;
+var MAX_ENVELOPE_TYPE_LENGTH = 32;
+var ENVELOPE_KINDS = ["req", "res", "evt"];
+function isNonEmptyString(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max;
+}
+function isBridgeEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const env = value;
+  return env.v === BRIDGE_VERSION && env.ns === BRIDGE_NAMESPACE && isNonEmptyString(env.id, MAX_ENVELOPE_ID_LENGTH) && ENVELOPE_KINDS.includes(env.kind) && isNonEmptyString(env.type, MAX_ENVELOPE_TYPE_LENGTH) && "payload" in env;
+}
+function createEnvelope(kind, type, id, payload) {
+  return { v: BRIDGE_VERSION, ns: BRIDGE_NAMESPACE, id, kind, type, payload };
+}
+function hasSession(payload, session) {
+  return typeof payload === "object" && payload !== null && payload.session === session;
+}
+
+// src/protocol/errors.ts
+var BRIDGE_ERROR_CODES = [
+  "FORBIDDEN_DESTINATION",
+  "FORBIDDEN_METHOD",
+  "BODY_TOO_LARGE",
+  "RATE_LIMITED",
+  "BAD_REQUEST",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "UNSUPPORTED"
+];
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "BridgeError";
+    this.code = code;
+  }
+};
+function isBridgeErrorCode(value) {
+  return BRIDGE_ERROR_CODES.includes(value);
+}
+function isBridgeErrorLike(value) {
+  return value instanceof Error && isBridgeErrorCode(value.code);
+}
+
+// src/protocol/messages.ts
+var REQUEST_TYPES = [
+  "fetch",
+  "navigate",
+  "back",
+  "openExternal",
+  "toast",
+  "resize",
+  "track",
+  "storage",
+  "log"
+];
+var HOST_EVENT_TYPES = ["slot.context", "locale", "member", "theme", "visibility"];
+var READY_EVENT = "ready";
+var INIT_RESPONSE = "init";
+var BRIDGE_SURFACES = ["page", "slot"];
+function isBridgeSurface(value) {
+  return BRIDGE_SURFACES.includes(value);
+}
+var IFRAME_ATTRIBUTES = {
+  sandbox: "allow-scripts",
+  allow: "autoplay; fullscreen; picture-in-picture; encrypted-media; clipboard-write",
+  referrerpolicy: "no-referrer"
+};
+function isRequestType(value) {
+  return REQUEST_TYPES.includes(value);
+}
+function isHostEventType(value) {
+  return HOST_EVENT_TYPES.includes(value);
+}
+
+// src/protocol/session.ts
+var SESSION_RE = /^[0-9a-f]{32}$/;
+var NONCE_RE = /^[A-Za-z0-9+/_-]{22,}={0,2}$/;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createSession() {
+  return Array.from(randomBytes(16), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function isValidSession(value) {
+  return typeof value === "string" && SESSION_RE.test(value);
+}
+function createNonce() {
+  const binary = String.fromCharCode(...randomBytes(16));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function isValidNonce(value) {
+  return typeof value === "string" && NONCE_RE.test(value);
+}
+
+// src/host/pathSafety.ts
+var MAX_DECODE_PASSES = 3;
+var REJECT = Object.freeze({ ok: false, forms: Object.freeze([]) });
+function decodeStages(pathname) {
+  const forms = [pathname];
+  let current = pathname;
+  for (let pass = 0; pass <= MAX_DECODE_PASSES; pass += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(current);
+    } catch {
+      return void 0;
+    }
+    if (next === current) return forms;
+    if (pass === MAX_DECODE_PASSES) return void 0;
+    forms.push(next);
+    current = next;
+  }
+  return void 0;
+}
+var UNSAFE_CHARS_RE = /[\\;\u0000-\u001f\u007f]/;
+function hasDotSegment(form) {
+  return form.split("/").some((segment) => segment === "." || segment === "..");
+}
+function checkPath(pathname, options = {}) {
+  const forms = decodeStages(pathname);
+  if (!forms) return REJECT;
+  const bad = forms.some(
+    (form) => UNSAFE_CHARS_RE.test(form) || hasDotSegment(form) || options.forbidDoubleSlash === true && form.includes("//")
+  );
+  return bad ? REJECT : { ok: true, forms: Object.freeze(forms) };
+}
+
+// src/host/policy.ts
+var DEFAULT_GATEWAY_DENY_SEGMENTS = Object.freeze([
+  "auth",
+  "logout",
+  "mfa",
+  "token",
+  "oauth",
+  "sso",
+  "debug",
+  "debugger",
+  "xdebug",
+  "withdraw"
+]);
+var ALWAYS_DENIED_SEGMENT_SUBSTRINGS = Object.freeze(["token"]);
+var DEFAULT_POLICY = Object.freeze({
+  gatewayPrefixes: Object.freeze(["/gw/"]),
+  gatewayDenyPrefixes: Object.freeze(["/gw/account/v1/auth/", "/gw/account/v1/users/logout"]),
+  gatewayDenySegments: DEFAULT_GATEWAY_DENY_SEGMENTS,
+  allowExternal: false,
+  maxBodyBytes: 1024 * 1024,
+  maxRequestsPerMinute: 300,
+  maxResponseBytes: 10 * 1024 * 1024
+});
+var ALLOWED_REQUEST_HEADERS = Object.freeze([
+  "content-type",
+  "accept",
+  "accept-language",
+  // BstageClient가 보내는 앱 자격 헤더(파트너 콘솔 발급값, 브라우저 노출 전제 — 회원 토큰이 아니다).
+  // 호스트가 `pinnedHeaders`로 값을 주면 그 값이 이긴다.
+  "x-bstage-app-id",
+  "x-bstage-app-key",
+  // BstageClient가 모든 요청에 싣는 core 버전(정보용, 비밀 아님).
+  "x-bmf-sdk-version"
+]);
+var HOST_ONLY_HEADERS = Object.freeze([
+  "x-bstage-tenant-id",
+  "x-bstage-org-id",
+  "x-bstage-enterprise-id"
+]);
+var ALLOWED_METHODS = Object.freeze([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+var MAX_PARTNER_ORIGINS = 10;
+var MAX_URL_LENGTH = 8192;
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function resolvePolicy(policy) {
+  const merged = { ...DEFAULT_POLICY, ...policy ?? {} };
+  if (!Array.isArray(merged.gatewayPrefixes) || merged.gatewayPrefixes.length === 0 || !merged.gatewayPrefixes.every((p) => typeof p === "string" && /^\/[^/]/.test(p))) {
+    throw new TypeError('[bstage-bridge] gatewayPrefixes\uB294 "/"\uB85C \uC2DC\uC791\uD558\uB294 \uACBD\uB85C \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4');
+  }
+  if (!Array.isArray(merged.gatewayDenyPrefixes) || !merged.gatewayDenyPrefixes.every((p) => typeof p === "string" && /^\/[^/]/.test(p))) {
+    throw new TypeError(
+      '[bstage-bridge] gatewayDenyPrefixes\uB294 "/"\uB85C \uC2DC\uC791\uD558\uB294 \uACBD\uB85C \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4'
+    );
+  }
+  if (!Array.isArray(merged.gatewayDenySegments) || !merged.gatewayDenySegments.every(
+    (x) => typeof x === "string" && x.length > 0 && !x.includes("/")
+  )) {
+    throw new TypeError('[bstage-bridge] gatewayDenySegments\uB294 "/" \uC5C6\uB294 \uC138\uADF8\uBA3C\uD2B8 \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4');
+  }
+  if (typeof merged.allowExternal !== "boolean") {
+    throw new TypeError("[bstage-bridge] allowExternal\uC740 \uBD88\uB9AC\uC5B8\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (!isPositiveInteger(merged.maxBodyBytes) || !isPositiveInteger(merged.maxRequestsPerMinute) || !isPositiveInteger(merged.maxResponseBytes)) {
+    throw new TypeError(
+      "[bstage-bridge] maxBodyBytes\xB7maxRequestsPerMinute\xB7maxResponseBytes\uB294 \uC591\uC758 \uC815\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4"
+    );
+  }
+  return Object.freeze({
+    ...merged,
+    gatewayPrefixes: Object.freeze([...merged.gatewayPrefixes]),
+    gatewayDenyPrefixes: Object.freeze([...merged.gatewayDenyPrefixes]),
+    gatewayDenySegments: Object.freeze(merged.gatewayDenySegments.map((x) => x.toLowerCase()))
+  });
+}
+var HOSTNAME_RE = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/;
+function normalizeExactOrigin(value, protocols) {
+  if (typeof value !== "string") return void 0;
+  try {
+    const url = new URL(value);
+    if (!protocols.includes(url.protocol) || !HOSTNAME_RE.test(url.hostname)) return void 0;
+    return url.origin === value ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function normalizePartnerOrigins(origins, excludeOrigin) {
+  if (!Array.isArray(origins)) return Object.freeze([]);
+  const valid = origins.map((o) => normalizeExactOrigin(o, ["https:"])).filter((o) => o !== void 0 && o !== excludeOrigin);
+  return Object.freeze([...new Set(valid)].slice(0, MAX_PARTNER_ORIGINS));
+}
+function matchesPrefix(pathname, prefix) {
+  const bare = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  return pathname === bare || pathname.startsWith(`${bare}/`);
+}
+function denyKey(form) {
+  return form.replace(/\/{2,}/g, "/").toLowerCase();
+}
+function isAllowedGatewayPath(pathname, policy) {
+  const check = checkPath(pathname);
+  if (!check.ok) return false;
+  if (!policy.gatewayPrefixes.some((p) => matchesPrefix(pathname, p))) return false;
+  const deny = policy.gatewayDenyPrefixes.map((p) => p.toLowerCase());
+  const denySegments = policy.gatewayDenySegments;
+  return !check.forms.some((form) => {
+    const key = denyKey(form);
+    return deny.some((p) => matchesPrefix(key, p)) || key.split("/").some(
+      (segment) => denySegments.includes(segment) || ALWAYS_DENIED_SEGMENT_SUBSTRINGS.some((part) => segment.includes(part))
+    );
+  });
+}
+var LOCAL_HOST_NAMES = Object.freeze([
+  "localhost",
+  "local",
+  "internal",
+  "home.arpa",
+  "test",
+  "invalid",
+  "example",
+  "lan",
+  "corp",
+  "intranet",
+  "localdomain"
+]);
+function isExternalHostAllowed(hostname, hostHostname) {
+  const name = hostname.replace(/\.+$/, "");
+  if (name === "" || name.startsWith("[") || /^[0-9.]+$/.test(name)) return false;
+  const labels = name.split(".");
+  if (labels.length < 2 || labels.some((label) => label === "")) return false;
+  if (LOCAL_HOST_NAMES.some((base) => name === base || name.endsWith(`.${base}`))) return false;
+  return name !== hostHostname.replace(/\.+$/, "");
+}
+function classifyDestination(rawUrl, ctx) {
+  if (typeof rawUrl !== "string" || rawUrl.length === 0 || rawUrl.length > MAX_URL_LENGTH) {
+    throw new BridgeError("BAD_REQUEST", "invalid url");
+  }
+  let url;
+  try {
+    url = new URL(rawUrl, ctx.hostOrigin);
+  } catch {
+    throw new BridgeError("BAD_REQUEST", "invalid url");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  const host = new URL(ctx.hostOrigin);
+  if (url.origin === host.origin) {
+    if (url.protocol === host.protocol && isAllowedGatewayPath(url.pathname, ctx.policy)) {
+      return { url: url.href, kind: "gateway" };
+    }
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  if (url.protocol !== "https:") {
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  if (ctx.partnerOrigins.includes(url.origin)) return { url: url.href, kind: "partner" };
+  if (ctx.policy.allowExternal && isExternalHostAllowed(url.hostname, host.hostname)) {
+    return { url: url.href, kind: "external" };
+  }
+  throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+}
+function resolveDestination(rawUrl, ctx) {
+  return classifyDestination(rawUrl, ctx).url;
+}
+function resolveMethod(method) {
+  if (method === void 0) return "GET";
+  if (typeof method !== "string") throw new BridgeError("BAD_REQUEST", "invalid method");
+  const upper = method.toUpperCase();
+  if (!ALLOWED_METHODS.includes(upper)) {
+    throw new BridgeError("FORBIDDEN_METHOD", "method not allowed");
+  }
+  return upper;
+}
+var UNSAFE_HEADER_VALUE_RE = /[\r\n\0]/;
+function normalizePinnedHeaders(pinned) {
+  if (pinned === void 0) return Object.freeze({});
+  if (typeof pinned !== "object" || pinned === null || Array.isArray(pinned)) {
+    throw new TypeError("[bstage-bridge] pinnedHeaders\uB294 \uAC1D\uCCB4\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
+  const entries = Object.entries(pinned).map(([k, v]) => {
+    const key = k.toLowerCase();
+    if (!ALLOWED_REQUEST_HEADERS.includes(key) && !HOST_ONLY_HEADERS.includes(key)) {
+      throw new TypeError(`[bstage-bridge] pinnedHeaders\uC5D0 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD5E4\uB354: ${k}`);
+    }
+    if (typeof v !== "string" || UNSAFE_HEADER_VALUE_RE.test(v)) {
+      throw new TypeError(`[bstage-bridge] pinnedHeaders \uAC12\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4: ${k}`);
+    }
+    return [key, v];
+  });
+  return Object.freeze(Object.fromEntries(entries));
+}
+function mergeHeaders(frameHeaders, pinned) {
+  return Object.freeze({ ...filterHeaders(frameHeaders), ...pinned });
+}
+function filterHeaders(headers) {
+  if (typeof headers !== "object" || headers === null || Array.isArray(headers)) return {};
+  const entries = Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]).filter(
+    (entry) => ALLOWED_REQUEST_HEADERS.includes(entry[0]) && typeof entry[1] === "string" && !/[\r\n\0]/.test(entry[1])
+  );
+  return Object.freeze(Object.fromEntries(entries));
+}
+function exceedsBytes(body, max) {
+  if (body.length > max) return true;
+  if (body.length * 3 <= max) return false;
+  return new TextEncoder().encode(body).length > max;
+}
+function resolveBody(body, method, maxBodyBytes) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body !== "string") throw new BridgeError("BAD_REQUEST", "body must be a string");
+  if (method === "GET" || method === "HEAD") {
+    throw new BridgeError("BAD_REQUEST", "GET/HEAD cannot have a body");
+  }
+  if (exceedsBytes(body, maxBodyBytes)) throw new BridgeError("BODY_TOO_LARGE", "body too large");
+  return body;
+}
+function prepareFetch(payload, ctx) {
+  if (typeof payload !== "object" || payload === null) {
+    throw new BridgeError("BAD_REQUEST", "invalid payload");
+  }
+  const req = payload;
+  const method = resolveMethod(req.method);
+  const { url, kind } = classifyDestination(req.url, ctx);
+  const body = resolveBody(req.body, method, ctx.policy.maxBodyBytes);
+  const headers = kind === "gateway" ? mergeHeaders(req.headers, ctx.pinnedHeaders ?? {}) : filterHeaders(req.headers);
+  return {
+    url,
+    kind,
+    init: {
+      method,
+      headers,
+      ...body !== void 0 ? { body } : {},
+      credentials: kind === "gateway" ? "same-origin" : "omit",
+      ...kind === "gateway" ? {} : { referrerPolicy: "no-referrer" },
+      // 브리지 프로토콜 인자에 더한 방어선: redirect를 따라가면 판정한 URL과 실제 목적지가 달라진다
+      // (파트너 origin이 같은 origin의 /gw 밖 경로로 돌려보내면 쿠키가 실린 요청이 된다).
+      redirect: "error"
+    }
+  };
+}
+
+// src/host/rateLimiter.ts
+var DEFAULT_WINDOW_MS = 6e4;
+function createRateLimiter(max, windowMs = DEFAULT_WINDOW_MS) {
+  let stamps = [];
+  return {
+    take(now = Date.now()) {
+      const recent = stamps.filter((t) => now - t < windowMs);
+      if (recent.length >= max) {
+        stamps = recent;
+        return false;
+      }
+      stamps = [...recent, now];
+      return true;
+    }
+  };
+}
+
+// src/host/events.ts
+function obj(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function sanitizeTheme(value) {
+  return { dark: obj(value).dark === true };
+}
+function sanitizeMember(value) {
+  const m = obj(value);
+  return {
+    signedIn: m.signedIn === true,
+    ...typeof m.nickname === "string" ? { nickname: m.nickname } : {}
+  };
+}
+function sanitizeSlot(value) {
+  const s = obj(value);
+  return typeof s.id === "string" ? { id: s.id, context: s.context } : void 0;
+}
+function sanitizeTranslations(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  return Object.freeze(
+    Object.fromEntries(
+      Object.entries(value).filter(
+        ([k, v]) => typeof v === "string" && k !== "__proto__"
+      )
+    )
+  );
+}
+function sanitizeEvent(type, payload) {
+  const p = obj(payload);
+  switch (type) {
+    case "theme":
+      return sanitizeTheme(p);
+    case "member":
+      return sanitizeMember(p);
+    case "visibility":
+      return { visible: p.visible === true };
+    case "slot.context": {
+      const slot = sanitizeSlot(p);
+      if (!slot) throw new TypeError("[bstage-bridge] slot.context\uC5D0\uB294 id\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4");
+      return slot;
+    }
+    case "locale": {
+      if (typeof p.locale !== "string") {
+        throw new TypeError("[bstage-bridge] locale \uC774\uBCA4\uD2B8\uC5D0\uB294 locale\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+      }
+      const translations = sanitizeTranslations(p.translations);
+      return { locale: p.locale, ...translations ? { translations } : {} };
+    }
+    default:
+      throw new TypeError(`[bstage-bridge] \uC54C \uC218 \uC5C6\uB294 \uC774\uBCA4\uD2B8: ${String(type)}`);
+  }
+}
+function buildInit(init, hostOrigin, partnerOrigins, policy) {
+  const slot = init.slot ? sanitizeSlot(init.slot) : void 0;
+  const translations = sanitizeTranslations(init.translations);
+  return Object.freeze({
+    placementId: String(init.placementId),
+    surface: init.surface,
+    phase: String(init.phase),
+    spaceId: String(init.spaceId),
+    hostOrigin,
+    gatewayBase: `${hostOrigin}/gw`,
+    locale: String(init.locale),
+    theme: sanitizeTheme(init.theme),
+    ...slot ? { slot } : {},
+    member: sanitizeMember(init.member),
+    limits: {
+      maxBodyBytes: policy.maxBodyBytes,
+      maxRequestsPerMinute: policy.maxRequestsPerMinute
+    },
+    partnerOrigins,
+    ...translations ? { translations } : {}
+  });
+}
+function applyEvent(init, type, payload) {
+  switch (type) {
+    case "locale": {
+      const p = payload;
+      const { translations: _drop, ...rest } = init;
+      return Object.freeze({
+        ...rest,
+        locale: p.locale,
+        ...p.translations ? { translations: p.translations } : {}
+      });
+    }
+    case "member":
+      return Object.freeze({ ...init, member: payload });
+    case "theme":
+      return Object.freeze({ ...init, theme: payload });
+    case "slot.context":
+      return Object.freeze({ ...init, slot: payload });
+    default:
+      return init;
+  }
+}
+
+// src/host/storage.ts
+var STORAGE_MAX_KEYS = 50;
+var STORAGE_MAX_VALUE_LENGTH = 4096;
+var STORAGE_MAX_KEY_LENGTH = 200;
+var stores = /* @__PURE__ */ new Map();
+function handleStorage(scope, req) {
+  const { op, key, value } = req;
+  if (typeof key !== "string" || key.length === 0 || key.length > STORAGE_MAX_KEY_LENGTH) {
+    throw new BridgeError("BAD_REQUEST", "invalid storage key");
+  }
+  const current = stores.get(scope) ?? {};
+  const has = Object.prototype.hasOwnProperty.call(current, key);
+  if (op === "get") return { value: has ? current[key] : null };
+  if (op === "remove") {
+    if (has) {
+      const next = Object.fromEntries(Object.entries(current).filter(([k]) => k !== key));
+      stores = new Map([...stores, [scope, next]]);
+    }
+    return { value: null };
+  }
+  if (op === "set") {
+    if (typeof value !== "string" || value.length > STORAGE_MAX_VALUE_LENGTH) {
+      throw new BridgeError("BAD_REQUEST", "invalid storage value");
+    }
+    if (!has && Object.keys(current).length >= STORAGE_MAX_KEYS) {
+      throw new BridgeError("BAD_REQUEST", "storage key limit reached");
+    }
+    stores = new Map([...stores, [scope, { ...current, [key]: value }]]);
+    return { value };
+  }
+  throw new BridgeError("BAD_REQUEST", "invalid storage op");
+}
+
+// src/host/validators.ts
+var MAX_PATH_LENGTH = 2048;
+var TOAST_MAX_LENGTH = 500;
+var TRACK_NAME_MAX_LENGTH = 100;
+var TRACK_PARAMS_MAX_BYTES = 4096;
+var RESIZE_MAX_HEIGHT = 2e4;
+var LOG_MAX_LENGTH = 2e3;
+var UNSAFE_KEYS = ["__proto__", "constructor", "prototype"];
+var TOAST_KINDS = ["info", "success", "warning", "error"];
+var LOG_LEVELS = ["debug", "info", "warn", "error"];
+function field(payload, key) {
+  return typeof payload === "object" && payload !== null ? payload[key] : void 0;
+}
+function validatePath(payload, hostOrigin) {
+  const path = field(payload, "path");
+  if (typeof path !== "string" || path.length === 0 || path.length > MAX_PATH_LENGTH || !path.startsWith("/") || path.startsWith("//") || // eslint-disable-next-line no-control-regex -- 제어문자를 거르는 것이 목적이다
+  /[\s\\\u0000-\u001f\u007f]/.test(path)) {
+    throw new BridgeError("BAD_REQUEST", "invalid path");
+  }
+  let resolved;
+  try {
+    resolved = new URL(path, hostOrigin);
+  } catch {
+    throw new BridgeError("BAD_REQUEST", "invalid path");
+  }
+  if (resolved.origin !== new URL(hostOrigin).origin || resolved.pathname.startsWith("//")) {
+    throw new BridgeError("BAD_REQUEST", "invalid path");
+  }
+  if (!checkPath(resolved.pathname, { forbidDoubleSlash: true }).ok) {
+    throw new BridgeError("BAD_REQUEST", "invalid path");
+  }
+  return resolved.pathname + resolved.search + resolved.hash;
+}
+function validateExternalUrl(payload) {
+  const raw = field(payload, "url");
+  if (typeof raw !== "string") throw new BridgeError("BAD_REQUEST", "invalid url");
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new BridgeError("BAD_REQUEST", "invalid url");
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "") {
+    throw new BridgeError("FORBIDDEN_DESTINATION", "only https urls can be opened");
+  }
+  return url.href;
+}
+function validateToast(payload) {
+  const message = field(payload, "message");
+  if (typeof message !== "string") throw new BridgeError("BAD_REQUEST", "invalid toast");
+  const kind = field(payload, "kind");
+  const known = TOAST_KINDS.find((k) => k === kind);
+  return { message: message.slice(0, TOAST_MAX_LENGTH), ...known ? { kind: known } : {} };
+}
+function validateHeight(payload) {
+  const height = field(payload, "height");
+  if (typeof height !== "number" || !Number.isFinite(height)) {
+    throw new BridgeError("BAD_REQUEST", "invalid height");
+  }
+  return Math.min(RESIZE_MAX_HEIGHT, Math.max(0, Math.round(height)));
+}
+function validateTrack(payload) {
+  const name = field(payload, "name");
+  const params = field(payload, "params");
+  if (typeof name !== "string" || name.length === 0 || name.length > TRACK_NAME_MAX_LENGTH) {
+    throw new BridgeError("BAD_REQUEST", "invalid track name");
+  }
+  if (params === void 0) return { name };
+  if (typeof params !== "object" || params === null || Array.isArray(params)) {
+    throw new BridgeError("BAD_REQUEST", "invalid track params");
+  }
+  let serialized;
+  try {
+    serialized = JSON.stringify(params);
+  } catch {
+    throw new BridgeError("BAD_REQUEST", "invalid track params");
+  }
+  if (new TextEncoder().encode(serialized).length > TRACK_PARAMS_MAX_BYTES) {
+    throw new BridgeError("BAD_REQUEST", "track params too large");
+  }
+  return {
+    name,
+    params: JSON.parse(
+      serialized,
+      (key, value) => UNSAFE_KEYS.includes(key) ? void 0 : value
+    )
+  };
+}
+function validateLog(payload) {
+  const level = field(payload, "level");
+  const message = field(payload, "message");
+  const known = LOG_LEVELS.find((l) => l === level);
+  if (!known || typeof message !== "string") throw new BridgeError("BAD_REQUEST", "invalid log");
+  return { level: known, message: message.slice(0, LOG_MAX_LENGTH) };
+}
+
+// src/host/createBridgeHost.ts
+var OPAQUE_ORIGIN = "null";
+var UNLIMITED_REQUESTS = ["resize"];
+var EMPTY = Object.freeze({});
+var MAX_IN_FLIGHT_FETCHES = 16;
+var TOAST_PER_MINUTE = 5;
+var READY_PER_SECOND = 2;
+var RESIZE_PER_SECOND = 30;
+var defaultUncredentialedFetch = (url, init) => globalThis.fetch(url, {
+  ...init,
+  credentials: "omit",
+  redirect: "error",
+  referrerPolicy: "no-referrer"
+});
+function unsupported() {
+  throw new BridgeError("UNSUPPORTED", "not supported by host");
+}
+var TOO_LARGE = () => new BridgeError("BODY_TOO_LARGE", "response too large");
+async function readBodyCapped(res, max) {
+  const stream = res.body;
+  if (stream === null) {
+    try {
+      return await res.text();
+    } catch {
+      throw new BridgeError("NETWORK_ERROR", "network error");
+    }
+  }
+  if (typeof stream?.getReader !== "function") {
+    throw new BridgeError("NETWORK_ERROR", "network error");
+  }
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let text = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      received += value.byteLength;
+      if (received > max) {
+        void reader.cancel().catch(() => {
+        });
+        throw TOO_LARGE();
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } catch (err) {
+    if (err instanceof BridgeError) throw err;
+    throw new BridgeError("NETWORK_ERROR", "network error");
+  }
+  return text + decoder.decode();
+}
+async function runFetch(ctx, payload) {
+  const prepared = prepareFetch(payload, ctx.destination);
+  let res;
+  try {
+    const send = prepared.kind === "gateway" ? ctx.fetchImpl : prepared.kind === "partner" ? ctx.partnerFetchImpl : ctx.externalFetchImpl;
+    res = await send(prepared.url, {
+      ...prepared.init,
+      headers: { ...prepared.init.headers }
+    });
+  } catch {
+    throw new BridgeError("NETWORK_ERROR", "network error");
+  }
+  const max = ctx.destination.policy.maxResponseBytes;
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > max) {
+    void res.body?.cancel().catch(() => {
+    });
+    throw TOO_LARGE();
+  }
+  if (prepared.init.method === "HEAD") {
+    void res.body?.cancel().catch(() => {
+    });
+  }
+  const bodyText = prepared.init.method === "HEAD" ? "" : await readBodyCapped(res, max);
+  const contentType = res.headers.get("content-type");
+  return {
+    status: res.status,
+    statusText: res.statusText,
+    headers: contentType !== null ? { "content-type": contentType } : {},
+    bodyText
+  };
+}
+function writeConsole(level, message) {
+  const write = globalThis.console?.[level];
+  if (typeof write === "function") write.call(globalThis.console, `[bstage-bridge] ${message}`);
+}
+async function dispatch(ctx, type, payload) {
+  const h = ctx.handlers;
+  switch (type) {
+    case "fetch":
+      return runFetch(ctx, payload);
+    case "navigate": {
+      const path = validatePath(payload, ctx.hostOrigin);
+      if (!h.navigate) unsupported();
+      h.navigate(path);
+      return EMPTY;
+    }
+    case "back":
+      if (!h.back) unsupported();
+      h.back();
+      return EMPTY;
+    case "openExternal": {
+      const url = validateExternalUrl(payload);
+      if (h.openExternal) h.openExternal(url);
+      else if (typeof ctx.win.open === "function")
+        ctx.win.open(url, "_blank", "noopener,noreferrer");
+      else unsupported();
+      return EMPTY;
+    }
+    case "toast": {
+      const { message, kind } = validateToast(payload);
+      if (!h.toast) unsupported();
+      if (!ctx.toastLimiter.take()) throw new BridgeError("RATE_LIMITED", "too many toasts");
+      h.toast(message, kind);
+      return EMPTY;
+    }
+    case "resize":
+      ctx.scheduleResize(validateHeight(payload));
+      return EMPTY;
+    case "track": {
+      const { name, params } = validateTrack(payload);
+      if (!h.track) unsupported();
+      h.track(name, params);
+      return EMPTY;
+    }
+    case "storage":
+      return handleStorage(ctx.storageScope, payload ?? {});
+    case "log": {
+      const { level, message } = validateLog(payload);
+      if (ctx.phase === "real") return EMPTY;
+      if (h.log) h.log(level, message);
+      else writeConsole(level, message);
+      return EMPTY;
+    }
+  }
+}
+function failure(code, message) {
+  return { ok: false, error: { code, message } };
+}
+function toFailure(err) {
+  if (err instanceof BridgeError || isBridgeErrorLike(err)) return failure(err.code, err.message);
+  return failure("BAD_REQUEST", "request failed");
+}
+function assertOptions(options) {
+  if (!options || typeof options !== "object") {
+    throw new TypeError("[bstage-bridge] createBridgeHost \uC635\uC158\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+  }
+  if (!isValidSession(options.session)) {
+    throw new TypeError("[bstage-bridge] session \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4(createSession() \uC0AC\uC6A9)");
+  }
+  const hostOrigin = normalizeExactOrigin(options.hostOrigin, ["https:", "http:"]);
+  if (!hostOrigin) throw new TypeError("[bstage-bridge] hostOrigin\uC740 \uC815\uD655\uD55C origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  if (typeof options.fetchImpl !== "function") {
+    throw new TypeError("[bstage-bridge] fetchImpl\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+  }
+  if (options.partnerFetchImpl !== void 0 && typeof options.partnerFetchImpl !== "function") {
+    throw new TypeError("[bstage-bridge] partnerFetchImpl\uC740 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (options.externalFetchImpl !== void 0 && typeof options.externalFetchImpl !== "function") {
+    throw new TypeError("[bstage-bridge] externalFetchImpl\uC740 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (options.externalFetchImpl !== void 0 && options.externalFetchImpl === options.fetchImpl) {
+    throw new TypeError(
+      "[bstage-bridge] externalFetchImpl\uC5D0 fetchImpl(\uC778\uC99D fetch)\uC744 \uC4F8 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4"
+    );
+  }
+  if (options.partnerFetchImpl !== void 0 && options.partnerFetchImpl === options.fetchImpl) {
+    throw new TypeError("[bstage-bridge] partnerFetchImpl\uC5D0 fetchImpl(\uC778\uC99D fetch)\uC744 \uC4F8 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4");
+  }
+  if (options.externalFetchImpl !== void 0 && options.externalFetchImpl === options.partnerFetchImpl) {
+    throw new TypeError(
+      "[bstage-bridge] externalFetchImpl\uC5D0 partnerFetchImpl(\uD32C \uD1A0\uD070 fetch)\uC744 \uC4F8 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4"
+    );
+  }
+  if (!options.iframe || !options.init) {
+    throw new TypeError("[bstage-bridge] iframe\xB7init\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+  }
+  if (!isBridgeSurface(options.init.surface)) {
+    throw new TypeError('[bstage-bridge] init.surface\uB294 "page" \uB610\uB294 "slot"\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4');
+  }
+  return hostOrigin;
+}
+function createBridgeHost(options) {
+  const hostOrigin = assertOptions(options);
+  const policy = resolvePolicy(options.policy);
+  const partnerOrigins = normalizePartnerOrigins(options.init.partnerOrigins, hostOrigin);
+  const pinnedHeaders = normalizePinnedHeaders(options.pinnedHeaders);
+  const { iframe, session } = options;
+  const win = iframe.ownerDocument?.defaultView ?? globalThis;
+  const handlers = options.handlers ?? {};
+  const limiter = createRateLimiter(policy.maxRequestsPerMinute);
+  const readyLimiter = createRateLimiter(READY_PER_SECOND, 1e3);
+  const resizeLimiter = createRateLimiter(RESIZE_PER_SECOND, 1e3);
+  let current = buildInit(options.init, hostOrigin, partnerOrigins, policy);
+  let inFlightFetches = 0;
+  let disposed = false;
+  let resizeHandle;
+  let pendingHeight;
+  const raf = typeof win.requestAnimationFrame === "function" ? (cb) => win.requestAnimationFrame(cb) : (cb) => setTimeout(cb, 16);
+  const cancelRaf = typeof win.cancelAnimationFrame === "function" ? (id) => win.cancelAnimationFrame(id) : (id) => clearTimeout(id);
+  function scheduleResize(height) {
+    pendingHeight = height;
+    if (resizeHandle !== void 0 || !handlers.resize) return;
+    resizeHandle = raf(() => {
+      resizeHandle = void 0;
+      const h = pendingHeight;
+      pendingHeight = void 0;
+      if (!disposed && h !== void 0) handlers.resize?.(h);
+    });
+  }
+  const ctx = {
+    options,
+    handlers,
+    win,
+    destination: { hostOrigin, partnerOrigins, policy, pinnedHeaders },
+    storageScope: `${options.init.spaceId}\0${options.init.placementId}`,
+    phase: options.init.phase,
+    fetchImpl: options.fetchImpl,
+    partnerFetchImpl: options.partnerFetchImpl ?? defaultUncredentialedFetch,
+    externalFetchImpl: options.externalFetchImpl ?? defaultUncredentialedFetch,
+    hostOrigin,
+    toastLimiter: createRateLimiter(TOAST_PER_MINUTE),
+    scheduleResize
+  };
+  function post(target, envelope) {
+    if (disposed) return;
+    target.postMessage(envelope, "*");
+  }
+  async function handleRequest(target, env) {
+    let result;
+    if (env.type === "resize" && !resizeLimiter.take()) {
+      return;
+    }
+    if (!isRequestType(env.type)) {
+      result = failure("UNSUPPORTED", "unknown request type");
+    } else if (env.type === "fetch" && inFlightFetches >= MAX_IN_FLIGHT_FETCHES) {
+      result = failure("RATE_LIMITED", "too many concurrent requests");
+    } else if (!UNLIMITED_REQUESTS.includes(env.type) && !limiter.take()) {
+      result = failure("RATE_LIMITED", "too many requests");
+    } else {
+      if (env.type === "fetch") inFlightFetches += 1;
+      try {
+        result = { ok: true, data: await dispatch(ctx, env.type, env.payload) };
+      } catch (err) {
+        result = toFailure(err);
+      } finally {
+        if (env.type === "fetch") inFlightFetches -= 1;
+      }
+    }
+    post(target, createEnvelope("res", env.type, env.id, result));
+  }
+  function onMessage(ev) {
+    if (disposed) return;
+    const frame = iframe.contentWindow;
+    if (!frame || ev.source !== frame) return;
+    if (ev.origin !== OPAQUE_ORIGIN) return;
+    const env = ev.data;
+    if (!isBridgeEnvelope(env)) return;
+    if (!hasSession(env.payload, session)) return;
+    if (env.kind === "evt" && env.type === READY_EVENT) {
+      if (!readyLimiter.take()) return;
+      post(frame, createEnvelope("res", INIT_RESPONSE, env.id, { ok: true, data: current }));
+      return;
+    }
+    if (env.kind === "req") void handleRequest(frame, env);
+  }
+  win.addEventListener("message", onMessage);
+  return {
+    send(type, payload) {
+      if (disposed) return;
+      if (!isHostEventType(type)) throw new TypeError(`[bstage-bridge] \uC54C \uC218 \uC5C6\uB294 \uC774\uBCA4\uD2B8: ${type}`);
+      if (typeof payload !== "object" || payload === null) {
+        throw new TypeError("[bstage-bridge] \uC774\uBCA4\uD2B8 payload\uB294 \uAC1D\uCCB4\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+      }
+      const clean = sanitizeEvent(type, payload);
+      current = applyEvent(current, type, clean);
+      const frame = iframe.contentWindow;
+      if (frame) post(frame, createEnvelope("evt", type, createSession(), clean));
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      win.removeEventListener("message", onMessage);
+      if (resizeHandle !== void 0) cancelRaf(resizeHandle);
+      resizeHandle = void 0;
+    }
+  };
+}
+
+// src/frame/runtime.ts
+function bridgeRuntime(g, makeFetch, config) {
+  const NS = "bstage-bridge";
+  const TIMEOUT_MS = 15e3;
+  const READY_INTERVAL_MS = 250;
+  const READY_FAST_ATTEMPTS = 40;
+  const READY_SLOW_INTERVAL_MS = 2e3;
+  const MAX_ID = 64;
+  const MAX_TYPE = 32;
+  if (g.__bstage_bridge__) return g.__bstage_bridge__;
+  const session = config.session;
+  const hostOrigin = config.hostOrigin;
+  const parent = g.parent;
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Map();
+  let init;
+  let seq = 0;
+  function randomPrefix() {
+    const bytes = new Uint8Array(8);
+    if (g.crypto && typeof g.crypto.getRandomValues === "function") {
+      g.crypto.getRandomValues(bytes);
+    } else {
+      for (let i = 0; i < bytes.length; i += 1) bytes[i] = Math.floor(Math.random() * 256);
+    }
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 1) out += (bytes[i] + 256).toString(16).slice(1);
+    return out;
+  }
+  const idPrefix = randomPrefix();
+  function nextId() {
+    seq += 1;
+    return idPrefix + "-" + seq;
+  }
+  function codeError(code, message) {
+    const err = new Error(message);
+    err.name = "BridgeError";
+    err.code = code;
+    return err;
+  }
+  function post(kind, type, id, payload) {
+    if (!parent) return;
+    const body = Object.assign({}, payload, { session });
+    parent.postMessage({ v: 1, ns: NS, id, kind, type, payload: body }, hostOrigin);
+  }
+  function isEnvelope(m) {
+    if (typeof m !== "object" || m === null) return false;
+    const e = m;
+    return e.v === 1 && e.ns === NS && typeof e.id === "string" && e.id.length > 0 && e.id.length <= MAX_ID && (e.kind === "req" || e.kind === "res" || e.kind === "evt") && typeof e.type === "string" && e.type.length > 0 && e.type.length <= MAX_TYPE && "payload" in e;
+  }
+  let resolveReady = function() {
+  };
+  const ready = new Promise(function(resolve) {
+    resolveReady = resolve;
+  });
+  function emit(type, payload) {
+    const fns = listeners.get(type);
+    if (!fns) return;
+    fns.slice().forEach(function(fn) {
+      try {
+        fn(payload);
+      } catch {
+      }
+    });
+  }
+  function applyEvent2(type, payload) {
+    if (!init || typeof payload !== "object" || payload === null) return;
+    const p = payload;
+    if (type === "locale" && typeof p.locale === "string") {
+      init = Object.assign({}, init, { locale: p.locale, translations: p.translations });
+    } else if (type === "member" && typeof p.signedIn === "boolean") {
+      init = Object.assign({}, init, { member: payload });
+    } else if (type === "theme" && typeof p.dark === "boolean") {
+      init = Object.assign({}, init, { theme: payload });
+    } else if (type === "slot.context" && typeof p.id === "string") {
+      init = Object.assign({}, init, { slot: payload });
+    }
+  }
+  function onMessage(ev) {
+    if (!parent || ev.source !== parent) return;
+    if (ev.origin !== hostOrigin) return;
+    const m = ev.data;
+    if (!isEnvelope(m)) return;
+    const result = m.payload;
+    if (m.kind === "res" && m.type === "init") {
+      if (!init && result && result.ok === true && result.data) {
+        init = result.data;
+        clearInterval(readyTimer);
+        resolveReady(init);
+      }
+      return;
+    }
+    if (m.kind === "res") {
+      const entry = pending.get(m.id);
+      if (!entry) return;
+      pending.delete(m.id);
+      clearTimeout(entry.timer);
+      if (result && result.ok === true) {
+        entry.resolve(result.data);
+      } else {
+        const error = result && result.error || {};
+        entry.reject(
+          codeError(
+            typeof error.code === "string" ? error.code : "BAD_REQUEST",
+            typeof error.message === "string" ? error.message : "bridge request failed"
+          )
+        );
+      }
+      return;
+    }
+    if (m.kind === "evt") {
+      applyEvent2(m.type, m.payload);
+      emit(m.type, m.payload);
+    }
+  }
+  g.addEventListener("message", onMessage);
+  let readyAttempts = 0;
+  function sendReady() {
+    readyAttempts += 1;
+    if (readyAttempts === READY_FAST_ATTEMPTS) {
+      clearInterval(readyTimer);
+      readyTimer = setInterval(sendReady, READY_SLOW_INTERVAL_MS);
+    }
+    post("evt", "ready", nextId(), {});
+  }
+  let readyTimer = setInterval(sendReady, READY_INTERVAL_MS);
+  sendReady();
+  function request(type, payload) {
+    return new Promise(function(resolve, reject) {
+      const id = nextId();
+      const timer = setTimeout(function() {
+        pending.delete(id);
+        reject(codeError("TIMEOUT", "bridge request timed out: " + type));
+      }, TIMEOUT_MS);
+      pending.set(id, { resolve, reject, timer });
+      post("req", type, id, payload || {});
+    });
+  }
+  function on(type, fn) {
+    const current = listeners.get(type) || [];
+    listeners.set(type, current.concat([fn]));
+    return function() {
+      const now = listeners.get(type) || [];
+      listeners.set(
+        type,
+        now.filter(function(f) {
+          return f !== fn;
+        })
+      );
+    };
+  }
+  const base = {
+    version: 1,
+    hostOrigin,
+    ready,
+    getInit: function() {
+      return init;
+    },
+    request,
+    on
+  };
+  const client = Object.freeze(Object.assign({}, base, { fetch: makeFetch(base) }));
+  Object.defineProperty(g, "__bstage_bridge__", {
+    value: client,
+    writable: false,
+    configurable: false,
+    enumerable: false
+  });
+  return client;
+}
+
+// src/frame/createBridgeFetch.ts
+function createBridgeFetch(client) {
+  const NULL_BODY_STATUS = [204, 205, 304];
+  function toHeaderRecord(h) {
+    const out = {};
+    if (!h) return out;
+    new Headers(h).forEach(function(value, key) {
+      out[key] = value;
+    });
+    return out;
+  }
+  function abortError(signal) {
+    if (signal.reason !== void 0) return signal.reason;
+    return new DOMException("The operation was aborted.", "AbortError");
+  }
+  function bridgeFetch(input, init) {
+    return new Promise(function(resolve, reject) {
+      const opts = init || {};
+      const isRequest = typeof input === "object" && input !== null && typeof input.method === "string";
+      const url = isRequest ? input.url : String(input);
+      const method = String(opts.method || (isRequest ? input.method : "GET"));
+      const headers = toHeaderRecord(
+        opts.headers || (isRequest ? input.headers : null)
+      );
+      let body = null;
+      if (isRequest && input.body !== null && opts.body == null) {
+        reject(new TypeError("bridge fetch: pass the body via init.body"));
+        return;
+      }
+      const raw = opts.body;
+      if (raw === void 0 || raw === null) {
+      } else if (typeof raw === "string") {
+        body = raw;
+      } else if (typeof URLSearchParams !== "undefined" && raw instanceof URLSearchParams) {
+        body = raw.toString();
+        if (!headers["content-type"]) {
+          headers["content-type"] = "application/x-www-form-urlencoded;charset=UTF-8";
+        }
+      } else {
+        reject(new TypeError("bridge fetch: unsupported body type"));
+        return;
+      }
+      const signal = opts.signal;
+      if (signal && signal.aborted) {
+        reject(abortError(signal));
+        return;
+      }
+      let settled = false;
+      function onAbort() {
+        if (settled || !signal) return;
+        settled = true;
+        reject(abortError(signal));
+      }
+      if (signal) signal.addEventListener("abort", onAbort);
+      const payload = { url, method, headers, body };
+      client.request("fetch", payload).then(
+        function(res) {
+          if (signal) signal.removeEventListener("abort", onAbort);
+          if (settled) return;
+          settled = true;
+          try {
+            const nullBody = method.toUpperCase() === "HEAD" || NULL_BODY_STATUS.indexOf(res.status) >= 0;
+            const responseHeaders = {};
+            if (res.headers && typeof res.headers["content-type"] === "string") {
+              responseHeaders["content-type"] = res.headers["content-type"];
+            }
+            resolve(
+              new Response(nullBody ? null : typeof res.bodyText === "string" ? res.bodyText : "", {
+                status: res.status,
+                statusText: res.statusText,
+                headers: responseHeaders
+              })
+            );
+          } catch {
+            reject(new TypeError("bridge fetch: invalid response"));
+          }
+        },
+        function(err) {
+          if (signal) signal.removeEventListener("abort", onAbort);
+          if (settled) return;
+          settled = true;
+          const code = err && typeof err === "object" ? err.code : void 0;
+          const failure2 = new TypeError("bridge fetch failed: " + String(code || "NETWORK_ERROR"));
+          failure2.code = code || "NETWORK_ERROR";
+          reject(failure2);
+        }
+      );
+    });
+  }
+  return bridgeFetch;
+}
+
+// src/srcdoc/escape.ts
+var HTML_ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => HTML_ESCAPES[ch]);
+}
+function toScriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
+// src/srcdoc/createSrcdoc.ts
+var MAX_MEDIA_ORIGINS = 20;
+var MAX_ELEMENT_NAME_LENGTH = 100;
+var ELEMENT_NAME_RE = /^[a-z][a-z0-9._]*-[a-z0-9._-]*$/;
+function isValidElementName(value) {
+  return typeof value === "string" && value.length <= MAX_ELEMENT_NAME_LENGTH && ELEMENT_NAME_RE.test(value);
+}
+function assertOrigin(label, value) {
+  const origin = normalizeExactOrigin(value, ["https:", "http:"]);
+  if (!origin) throw new TypeError(`[bstage-bridge] ${label}\uB294 \uC815\uD655\uD55C origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
+  return origin;
+}
+function assertEntryUrl(entryUrl, assetOrigin) {
+  let parsed;
+  try {
+    parsed = new URL(entryUrl);
+  } catch {
+    throw new TypeError("[bstage-bridge] entryUrl\uC774 URL\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (parsed.origin !== assetOrigin || parsed.username || parsed.password) {
+    throw new TypeError("[bstage-bridge] entryUrl\uC740 assetOrigin\uC5D0 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  return parsed.href;
+}
+function normalizeMediaOrigins(value) {
+  if (value === void 0) return Object.freeze([]);
+  if (!Array.isArray(value)) {
+    throw new TypeError("[bstage-bridge] mediaOrigins\uB294 \uBC30\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (value.length > MAX_MEDIA_ORIGINS) {
+    throw new TypeError(`[bstage-bridge] mediaOrigins\uB294 \uCD5C\uB300 ${MAX_MEDIA_ORIGINS}\uAC1C\uC785\uB2C8\uB2E4`);
+  }
+  const origins = value.map((o) => {
+    const origin = normalizeExactOrigin(o, ["https:"]);
+    if (!origin) {
+      throw new TypeError("[bstage-bridge] mediaOrigins \uD56D\uBAA9\uC740 \uC815\uD655\uD55C https origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+    }
+    return origin;
+  });
+  return Object.freeze([...new Set(origins)]);
+}
+function buildFrameCsp(nonce, assetOrigin, mediaOrigins = []) {
+  const media = [assetOrigin, ...normalizeMediaOrigins(mediaOrigins)].join(" ");
+  return [
+    "default-src 'none'",
+    `script-src 'nonce-${nonce}' ${assetOrigin}`,
+    `style-src 'unsafe-inline' ${assetOrigin}`,
+    `img-src ${media} data: blob:`,
+    `font-src ${assetOrigin} data:`,
+    `media-src ${media} blob:`,
+    "connect-src 'none'",
+    "frame-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'"
+  ].join("; ");
+}
+function bootstrapScript(o) {
+  return [
+    "(function () {",
+    '"use strict";',
+    `var SESSION = ${toScriptLiteral(o.session)};`,
+    `var HOST_ORIGIN = ${toScriptLiteral(o.hostOrigin)};`,
+    `var ENTRY_URL = ${toScriptLiteral(o.entryUrl)};`,
+    `var ELEMENT_NAME = ${toScriptLiteral(o.elementName)};`,
+    `var bridgeRuntime = ${bridgeRuntime.toString()};`,
+    `var createBridgeFetch = ${createBridgeFetch.toString()};`,
+    "var client = bridgeRuntime(globalThis, createBridgeFetch, { session: SESSION, hostOrigin: HOST_ORIGIN });",
+    "var lastHeight = -1;",
+    "var scheduled = false;",
+    "function reportHeight() {",
+    "  scheduled = false;",
+    "  var h = Math.ceil(document.body.getBoundingClientRect().height);",
+    "  if (h === lastHeight) return;",
+    "  lastHeight = h;",
+    "  client.request('resize', { height: h }).catch(function () {});",
+    "}",
+    "function scheduleHeight() {",
+    "  if (scheduled) return;",
+    "  scheduled = true;",
+    "  requestAnimationFrame(reportHeight);",
+    "}",
+    "client.ready.then(function () {",
+    "  var script = document.createElement('script');",
+    "  script.src = ENTRY_URL;",
+    "  script.onerror = function () {",
+    "    client.request('log', { level: 'error', message: 'template entry failed to load' }).catch(function () {});",
+    "  };",
+    "  document.head.appendChild(script);",
+    "  customElements.whenDefined(ELEMENT_NAME).then(function () {",
+    "    document.body.appendChild(document.createElement(ELEMENT_NAME));",
+    "    if (typeof ResizeObserver === 'function') {",
+    "      new ResizeObserver(scheduleHeight).observe(document.body);",
+    "    }",
+    "    scheduleHeight();",
+    "  });",
+    "}, function () {});",
+    "})();"
+  ].join("\n");
+}
+function createSrcdoc(options) {
+  const { nonce, session, title, elementName } = options;
+  if (!isValidNonce(nonce)) throw new TypeError("[bstage-bridge] nonce \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  if (!isValidSession(session)) throw new TypeError("[bstage-bridge] session \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  const hostOrigin = assertOrigin("hostOrigin", options.hostOrigin);
+  const assetOrigin = assertOrigin("assetOrigin", options.assetOrigin);
+  const entryUrl = assertEntryUrl(options.entryUrl, assetOrigin);
+  if (!isValidElementName(elementName)) {
+    throw new TypeError("[bstage-bridge] elementName\uC774 custom element \uC774\uB984\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (typeof title !== "string") throw new TypeError("[bstage-bridge] title\uC740 \uBB38\uC790\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  const mediaOrigins = normalizeMediaOrigins(options.mediaOrigins);
+  const csp = buildFrameCsp(nonce, assetOrigin, mediaOrigins);
+  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName });
+  if (/<\/script|<!--/i.test(script)) {
+    throw new Error("[bstage-bridge] \uBD80\uD2B8\uC2A4\uD2B8\uB7A9 \uC2A4\uD06C\uB9BD\uD2B8\uC5D0 \uC2A4\uD06C\uB9BD\uD2B8 \uC885\uB8CC \uC2DC\uD000\uC2A4\uAC00 \uC788\uC2B5\uB2C8\uB2E4");
+  }
+  return [
+    "<!doctype html>",
+    "<html>",
+    "<head>",
+    '<meta charset="utf-8">',
+    `<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<title>${escapeHtml(title)}</title>`,
+    // body 높이를 콘텐츠 높이로 잰다 — documentElement.scrollHeight는 뷰포트 이상이라 줄어들지 못한다.
+    // flow-root는 자식 margin이 body 밖으로 접혀 나가 높이에서 빠지는 것을 막는다.
+    "<style>html,body{margin:0;padding:0;background:transparent;height:auto}body{display:flow-root}</style>",
+    `<script nonce="${escapeHtml(nonce)}">
+${script}
+</script>`,
+    "</head>",
+    "<body></body>",
+    "</html>"
+  ].join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALLOWED_METHODS,
+  ALLOWED_REQUEST_HEADERS,
+  BRIDGE_SURFACES,
+  DEFAULT_GATEWAY_DENY_SEGMENTS,
+  DEFAULT_POLICY,
+  HOST_ONLY_HEADERS,
+  IFRAME_ATTRIBUTES,
+  MAX_DECODE_PASSES,
+  MAX_PARTNER_ORIGINS,
+  checkPath,
+  classifyDestination,
+  createBridgeHost,
+  createNonce,
+  createSession,
+  createSrcdoc,
+  isAllowedGatewayPath,
+  isBridgeSurface,
+  isValidSession,
+  normalizePartnerOrigins,
+  normalizePinnedHeaders,
+  prepareFetch,
+  resolveDestination,
+  resolvePolicy
+});