@bstage-sdk/bridge 0.0.0-stage → 0.9.0

package/dist/index.cjs

@@ -0,0 +1,673 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BRIDGE_ERROR_CODES: () => BRIDGE_ERROR_CODES,
+  BRIDGE_NAMESPACE: () => BRIDGE_NAMESPACE,
+  BRIDGE_SURFACES: () => BRIDGE_SURFACES,
+  BRIDGE_VERSION: () => BRIDGE_VERSION,
+  BridgeError: () => BridgeError,
+  HOST_EVENT_TYPES: () => HOST_EVENT_TYPES,
+  IFRAME_ATTRIBUTES: () => IFRAME_ATTRIBUTES,
+  INIT_RESPONSE: () => INIT_RESPONSE,
+  MAX_ELEMENT_NAME_LENGTH: () => MAX_ELEMENT_NAME_LENGTH,
+  MAX_ENVELOPE_ID_LENGTH: () => MAX_ENVELOPE_ID_LENGTH,
+  MAX_ENVELOPE_TYPE_LENGTH: () => MAX_ENVELOPE_TYPE_LENGTH,
+  MAX_MEDIA_ORIGINS: () => MAX_MEDIA_ORIGINS,
+  READY_EVENT: () => READY_EVENT,
+  REQUEST_TIMEOUT_MS: () => REQUEST_TIMEOUT_MS,
+  REQUEST_TYPES: () => REQUEST_TYPES,
+  buildFrameCsp: () => buildFrameCsp,
+  createEnvelope: () => createEnvelope,
+  createNonce: () => createNonce,
+  createSession: () => createSession,
+  createSrcdoc: () => createSrcdoc,
+  hasSession: () => hasSession,
+  isBridgeEnvelope: () => isBridgeEnvelope,
+  isBridgeErrorCode: () => isBridgeErrorCode,
+  isBridgeErrorLike: () => isBridgeErrorLike,
+  isBridgeSurface: () => isBridgeSurface,
+  isHostEventType: () => isHostEventType,
+  isRequestType: () => isRequestType,
+  isValidNonce: () => isValidNonce,
+  isValidSession: () => isValidSession
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/protocol/envelope.ts
+var BRIDGE_VERSION = 1;
+var BRIDGE_NAMESPACE = "bstage-bridge";
+var MAX_ENVELOPE_ID_LENGTH = 64;
+var MAX_ENVELOPE_TYPE_LENGTH = 32;
+var ENVELOPE_KINDS = ["req", "res", "evt"];
+function isNonEmptyString(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max;
+}
+function isBridgeEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const env = value;
+  return env.v === BRIDGE_VERSION && env.ns === BRIDGE_NAMESPACE && isNonEmptyString(env.id, MAX_ENVELOPE_ID_LENGTH) && ENVELOPE_KINDS.includes(env.kind) && isNonEmptyString(env.type, MAX_ENVELOPE_TYPE_LENGTH) && "payload" in env;
+}
+function createEnvelope(kind, type, id, payload) {
+  return { v: BRIDGE_VERSION, ns: BRIDGE_NAMESPACE, id, kind, type, payload };
+}
+function hasSession(payload, session) {
+  return typeof payload === "object" && payload !== null && payload.session === session;
+}
+
+// src/protocol/errors.ts
+var BRIDGE_ERROR_CODES = [
+  "FORBIDDEN_DESTINATION",
+  "FORBIDDEN_METHOD",
+  "BODY_TOO_LARGE",
+  "RATE_LIMITED",
+  "BAD_REQUEST",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "UNSUPPORTED"
+];
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "BridgeError";
+    this.code = code;
+  }
+};
+function isBridgeErrorCode(value) {
+  return BRIDGE_ERROR_CODES.includes(value);
+}
+function isBridgeErrorLike(value) {
+  return value instanceof Error && isBridgeErrorCode(value.code);
+}
+
+// src/protocol/messages.ts
+var REQUEST_TIMEOUT_MS = 15e3;
+var REQUEST_TYPES = [
+  "fetch",
+  "navigate",
+  "back",
+  "openExternal",
+  "toast",
+  "resize",
+  "track",
+  "storage",
+  "log"
+];
+var HOST_EVENT_TYPES = ["slot.context", "locale", "member", "theme", "visibility"];
+var READY_EVENT = "ready";
+var INIT_RESPONSE = "init";
+var BRIDGE_SURFACES = ["page", "slot"];
+function isBridgeSurface(value) {
+  return BRIDGE_SURFACES.includes(value);
+}
+var IFRAME_ATTRIBUTES = {
+  sandbox: "allow-scripts",
+  allow: "autoplay; fullscreen; picture-in-picture; encrypted-media; clipboard-write",
+  referrerpolicy: "no-referrer"
+};
+function isRequestType(value) {
+  return REQUEST_TYPES.includes(value);
+}
+function isHostEventType(value) {
+  return HOST_EVENT_TYPES.includes(value);
+}
+
+// src/protocol/session.ts
+var SESSION_RE = /^[0-9a-f]{32}$/;
+var NONCE_RE = /^[A-Za-z0-9+/_-]{22,}={0,2}$/;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createSession() {
+  return Array.from(randomBytes(16), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function isValidSession(value) {
+  return typeof value === "string" && SESSION_RE.test(value);
+}
+function createNonce() {
+  const binary = String.fromCharCode(...randomBytes(16));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function isValidNonce(value) {
+  return typeof value === "string" && NONCE_RE.test(value);
+}
+
+// src/frame/runtime.ts
+function bridgeRuntime(g, makeFetch, config) {
+  const NS = "bstage-bridge";
+  const TIMEOUT_MS = 15e3;
+  const READY_INTERVAL_MS = 250;
+  const READY_FAST_ATTEMPTS = 40;
+  const READY_SLOW_INTERVAL_MS = 2e3;
+  const MAX_ID = 64;
+  const MAX_TYPE = 32;
+  if (g.__bstage_bridge__) return g.__bstage_bridge__;
+  const session = config.session;
+  const hostOrigin = config.hostOrigin;
+  const parent = g.parent;
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Map();
+  let init;
+  let seq = 0;
+  function randomPrefix() {
+    const bytes = new Uint8Array(8);
+    if (g.crypto && typeof g.crypto.getRandomValues === "function") {
+      g.crypto.getRandomValues(bytes);
+    } else {
+      for (let i = 0; i < bytes.length; i += 1) bytes[i] = Math.floor(Math.random() * 256);
+    }
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 1) out += (bytes[i] + 256).toString(16).slice(1);
+    return out;
+  }
+  const idPrefix = randomPrefix();
+  function nextId() {
+    seq += 1;
+    return idPrefix + "-" + seq;
+  }
+  function codeError(code, message) {
+    const err = new Error(message);
+    err.name = "BridgeError";
+    err.code = code;
+    return err;
+  }
+  function post(kind, type, id, payload) {
+    if (!parent) return;
+    const body = Object.assign({}, payload, { session });
+    parent.postMessage({ v: 1, ns: NS, id, kind, type, payload: body }, hostOrigin);
+  }
+  function isEnvelope(m) {
+    if (typeof m !== "object" || m === null) return false;
+    const e = m;
+    return e.v === 1 && e.ns === NS && typeof e.id === "string" && e.id.length > 0 && e.id.length <= MAX_ID && (e.kind === "req" || e.kind === "res" || e.kind === "evt") && typeof e.type === "string" && e.type.length > 0 && e.type.length <= MAX_TYPE && "payload" in e;
+  }
+  let resolveReady = function() {
+  };
+  const ready = new Promise(function(resolve) {
+    resolveReady = resolve;
+  });
+  function emit(type, payload) {
+    const fns = listeners.get(type);
+    if (!fns) return;
+    fns.slice().forEach(function(fn) {
+      try {
+        fn(payload);
+      } catch {
+      }
+    });
+  }
+  function applyEvent(type, payload) {
+    if (!init || typeof payload !== "object" || payload === null) return;
+    const p = payload;
+    if (type === "locale" && typeof p.locale === "string") {
+      init = Object.assign({}, init, { locale: p.locale, translations: p.translations });
+    } else if (type === "member" && typeof p.signedIn === "boolean") {
+      init = Object.assign({}, init, { member: payload });
+    } else if (type === "theme" && typeof p.dark === "boolean") {
+      init = Object.assign({}, init, { theme: payload });
+    } else if (type === "slot.context" && typeof p.id === "string") {
+      init = Object.assign({}, init, { slot: payload });
+    }
+  }
+  function onMessage(ev) {
+    if (!parent || ev.source !== parent) return;
+    if (ev.origin !== hostOrigin) return;
+    const m = ev.data;
+    if (!isEnvelope(m)) return;
+    const result = m.payload;
+    if (m.kind === "res" && m.type === "init") {
+      if (!init && result && result.ok === true && result.data) {
+        init = result.data;
+        clearInterval(readyTimer);
+        resolveReady(init);
+      }
+      return;
+    }
+    if (m.kind === "res") {
+      const entry = pending.get(m.id);
+      if (!entry) return;
+      pending.delete(m.id);
+      clearTimeout(entry.timer);
+      if (result && result.ok === true) {
+        entry.resolve(result.data);
+      } else {
+        const error = result && result.error || {};
+        entry.reject(
+          codeError(
+            typeof error.code === "string" ? error.code : "BAD_REQUEST",
+            typeof error.message === "string" ? error.message : "bridge request failed"
+          )
+        );
+      }
+      return;
+    }
+    if (m.kind === "evt") {
+      applyEvent(m.type, m.payload);
+      emit(m.type, m.payload);
+    }
+  }
+  g.addEventListener("message", onMessage);
+  let readyAttempts = 0;
+  function sendReady() {
+    readyAttempts += 1;
+    if (readyAttempts === READY_FAST_ATTEMPTS) {
+      clearInterval(readyTimer);
+      readyTimer = setInterval(sendReady, READY_SLOW_INTERVAL_MS);
+    }
+    post("evt", "ready", nextId(), {});
+  }
+  let readyTimer = setInterval(sendReady, READY_INTERVAL_MS);
+  sendReady();
+  function request(type, payload) {
+    return new Promise(function(resolve, reject) {
+      const id = nextId();
+      const timer = setTimeout(function() {
+        pending.delete(id);
+        reject(codeError("TIMEOUT", "bridge request timed out: " + type));
+      }, TIMEOUT_MS);
+      pending.set(id, { resolve, reject, timer });
+      post("req", type, id, payload || {});
+    });
+  }
+  function on(type, fn) {
+    const current = listeners.get(type) || [];
+    listeners.set(type, current.concat([fn]));
+    return function() {
+      const now = listeners.get(type) || [];
+      listeners.set(
+        type,
+        now.filter(function(f) {
+          return f !== fn;
+        })
+      );
+    };
+  }
+  const base = {
+    version: 1,
+    hostOrigin,
+    ready,
+    getInit: function() {
+      return init;
+    },
+    request,
+    on
+  };
+  const client = Object.freeze(Object.assign({}, base, { fetch: makeFetch(base) }));
+  Object.defineProperty(g, "__bstage_bridge__", {
+    value: client,
+    writable: false,
+    configurable: false,
+    enumerable: false
+  });
+  return client;
+}
+
+// src/frame/createBridgeFetch.ts
+function createBridgeFetch(client) {
+  const NULL_BODY_STATUS = [204, 205, 304];
+  function toHeaderRecord(h) {
+    const out = {};
+    if (!h) return out;
+    new Headers(h).forEach(function(value, key) {
+      out[key] = value;
+    });
+    return out;
+  }
+  function abortError(signal) {
+    if (signal.reason !== void 0) return signal.reason;
+    return new DOMException("The operation was aborted.", "AbortError");
+  }
+  function bridgeFetch(input, init) {
+    return new Promise(function(resolve, reject) {
+      const opts = init || {};
+      const isRequest = typeof input === "object" && input !== null && typeof input.method === "string";
+      const url = isRequest ? input.url : String(input);
+      const method = String(opts.method || (isRequest ? input.method : "GET"));
+      const headers = toHeaderRecord(
+        opts.headers || (isRequest ? input.headers : null)
+      );
+      let body = null;
+      if (isRequest && input.body !== null && opts.body == null) {
+        reject(new TypeError("bridge fetch: pass the body via init.body"));
+        return;
+      }
+      const raw = opts.body;
+      if (raw === void 0 || raw === null) {
+      } else if (typeof raw === "string") {
+        body = raw;
+      } else if (typeof URLSearchParams !== "undefined" && raw instanceof URLSearchParams) {
+        body = raw.toString();
+        if (!headers["content-type"]) {
+          headers["content-type"] = "application/x-www-form-urlencoded;charset=UTF-8";
+        }
+      } else {
+        reject(new TypeError("bridge fetch: unsupported body type"));
+        return;
+      }
+      const signal = opts.signal;
+      if (signal && signal.aborted) {
+        reject(abortError(signal));
+        return;
+      }
+      let settled = false;
+      function onAbort() {
+        if (settled || !signal) return;
+        settled = true;
+        reject(abortError(signal));
+      }
+      if (signal) signal.addEventListener("abort", onAbort);
+      const payload = { url, method, headers, body };
+      client.request("fetch", payload).then(
+        function(res) {
+          if (signal) signal.removeEventListener("abort", onAbort);
+          if (settled) return;
+          settled = true;
+          try {
+            const nullBody = method.toUpperCase() === "HEAD" || NULL_BODY_STATUS.indexOf(res.status) >= 0;
+            const responseHeaders = {};
+            if (res.headers && typeof res.headers["content-type"] === "string") {
+              responseHeaders["content-type"] = res.headers["content-type"];
+            }
+            resolve(
+              new Response(nullBody ? null : typeof res.bodyText === "string" ? res.bodyText : "", {
+                status: res.status,
+                statusText: res.statusText,
+                headers: responseHeaders
+              })
+            );
+          } catch {
+            reject(new TypeError("bridge fetch: invalid response"));
+          }
+        },
+        function(err) {
+          if (signal) signal.removeEventListener("abort", onAbort);
+          if (settled) return;
+          settled = true;
+          const code = err && typeof err === "object" ? err.code : void 0;
+          const failure = new TypeError("bridge fetch failed: " + String(code || "NETWORK_ERROR"));
+          failure.code = code || "NETWORK_ERROR";
+          reject(failure);
+        }
+      );
+    });
+  }
+  return bridgeFetch;
+}
+
+// src/srcdoc/escape.ts
+var HTML_ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => HTML_ESCAPES[ch]);
+}
+function toScriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
+// src/host/pathSafety.ts
+var REJECT = Object.freeze({ ok: false, forms: Object.freeze([]) });
+
+// src/host/policy.ts
+var DEFAULT_GATEWAY_DENY_SEGMENTS = Object.freeze([
+  "auth",
+  "logout",
+  "mfa",
+  "token",
+  "oauth",
+  "sso",
+  "debug",
+  "debugger",
+  "xdebug",
+  "withdraw"
+]);
+var ALWAYS_DENIED_SEGMENT_SUBSTRINGS = Object.freeze(["token"]);
+var DEFAULT_POLICY = Object.freeze({
+  gatewayPrefixes: Object.freeze(["/gw/"]),
+  gatewayDenyPrefixes: Object.freeze(["/gw/account/v1/auth/", "/gw/account/v1/users/logout"]),
+  gatewayDenySegments: DEFAULT_GATEWAY_DENY_SEGMENTS,
+  allowExternal: false,
+  maxBodyBytes: 1024 * 1024,
+  maxRequestsPerMinute: 300,
+  maxResponseBytes: 10 * 1024 * 1024
+});
+var ALLOWED_REQUEST_HEADERS = Object.freeze([
+  "content-type",
+  "accept",
+  "accept-language",
+  // BstageClient가 보내는 앱 자격 헤더(파트너 콘솔 발급값, 브라우저 노출 전제 — 회원 토큰이 아니다).
+  // 호스트가 `pinnedHeaders`로 값을 주면 그 값이 이긴다.
+  "x-bstage-app-id",
+  "x-bstage-app-key",
+  // BstageClient가 모든 요청에 싣는 core 버전(정보용, 비밀 아님).
+  "x-bmf-sdk-version"
+]);
+var HOST_ONLY_HEADERS = Object.freeze([
+  "x-bstage-tenant-id",
+  "x-bstage-org-id",
+  "x-bstage-enterprise-id"
+]);
+var ALLOWED_METHODS = Object.freeze([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+var HOSTNAME_RE = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/;
+function normalizeExactOrigin(value, protocols) {
+  if (typeof value !== "string") return void 0;
+  try {
+    const url = new URL(value);
+    if (!protocols.includes(url.protocol) || !HOSTNAME_RE.test(url.hostname)) return void 0;
+    return url.origin === value ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var LOCAL_HOST_NAMES = Object.freeze([
+  "localhost",
+  "local",
+  "internal",
+  "home.arpa",
+  "test",
+  "invalid",
+  "example",
+  "lan",
+  "corp",
+  "intranet",
+  "localdomain"
+]);
+
+// src/srcdoc/createSrcdoc.ts
+var MAX_MEDIA_ORIGINS = 20;
+var MAX_ELEMENT_NAME_LENGTH = 100;
+var ELEMENT_NAME_RE = /^[a-z][a-z0-9._]*-[a-z0-9._-]*$/;
+function isValidElementName(value) {
+  return typeof value === "string" && value.length <= MAX_ELEMENT_NAME_LENGTH && ELEMENT_NAME_RE.test(value);
+}
+function assertOrigin(label, value) {
+  const origin = normalizeExactOrigin(value, ["https:", "http:"]);
+  if (!origin) throw new TypeError(`[bstage-bridge] ${label}\uB294 \uC815\uD655\uD55C origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
+  return origin;
+}
+function assertEntryUrl(entryUrl, assetOrigin) {
+  let parsed;
+  try {
+    parsed = new URL(entryUrl);
+  } catch {
+    throw new TypeError("[bstage-bridge] entryUrl\uC774 URL\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (parsed.origin !== assetOrigin || parsed.username || parsed.password) {
+    throw new TypeError("[bstage-bridge] entryUrl\uC740 assetOrigin\uC5D0 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  return parsed.href;
+}
+function normalizeMediaOrigins(value) {
+  if (value === void 0) return Object.freeze([]);
+  if (!Array.isArray(value)) {
+    throw new TypeError("[bstage-bridge] mediaOrigins\uB294 \uBC30\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (value.length > MAX_MEDIA_ORIGINS) {
+    throw new TypeError(`[bstage-bridge] mediaOrigins\uB294 \uCD5C\uB300 ${MAX_MEDIA_ORIGINS}\uAC1C\uC785\uB2C8\uB2E4`);
+  }
+  const origins = value.map((o) => {
+    const origin = normalizeExactOrigin(o, ["https:"]);
+    if (!origin) {
+      throw new TypeError("[bstage-bridge] mediaOrigins \uD56D\uBAA9\uC740 \uC815\uD655\uD55C https origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+    }
+    return origin;
+  });
+  return Object.freeze([...new Set(origins)]);
+}
+function buildFrameCsp(nonce, assetOrigin, mediaOrigins = []) {
+  const media = [assetOrigin, ...normalizeMediaOrigins(mediaOrigins)].join(" ");
+  return [
+    "default-src 'none'",
+    `script-src 'nonce-${nonce}' ${assetOrigin}`,
+    `style-src 'unsafe-inline' ${assetOrigin}`,
+    `img-src ${media} data: blob:`,
+    `font-src ${assetOrigin} data:`,
+    `media-src ${media} blob:`,
+    "connect-src 'none'",
+    "frame-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'"
+  ].join("; ");
+}
+function bootstrapScript(o) {
+  return [
+    "(function () {",
+    '"use strict";',
+    `var SESSION = ${toScriptLiteral(o.session)};`,
+    `var HOST_ORIGIN = ${toScriptLiteral(o.hostOrigin)};`,
+    `var ENTRY_URL = ${toScriptLiteral(o.entryUrl)};`,
+    `var ELEMENT_NAME = ${toScriptLiteral(o.elementName)};`,
+    `var bridgeRuntime = ${bridgeRuntime.toString()};`,
+    `var createBridgeFetch = ${createBridgeFetch.toString()};`,
+    "var client = bridgeRuntime(globalThis, createBridgeFetch, { session: SESSION, hostOrigin: HOST_ORIGIN });",
+    "var lastHeight = -1;",
+    "var scheduled = false;",
+    "function reportHeight() {",
+    "  scheduled = false;",
+    "  var h = Math.ceil(document.body.getBoundingClientRect().height);",
+    "  if (h === lastHeight) return;",
+    "  lastHeight = h;",
+    "  client.request('resize', { height: h }).catch(function () {});",
+    "}",
+    "function scheduleHeight() {",
+    "  if (scheduled) return;",
+    "  scheduled = true;",
+    "  requestAnimationFrame(reportHeight);",
+    "}",
+    "client.ready.then(function () {",
+    "  var script = document.createElement('script');",
+    "  script.src = ENTRY_URL;",
+    "  script.onerror = function () {",
+    "    client.request('log', { level: 'error', message: 'template entry failed to load' }).catch(function () {});",
+    "  };",
+    "  document.head.appendChild(script);",
+    "  customElements.whenDefined(ELEMENT_NAME).then(function () {",
+    "    document.body.appendChild(document.createElement(ELEMENT_NAME));",
+    "    if (typeof ResizeObserver === 'function') {",
+    "      new ResizeObserver(scheduleHeight).observe(document.body);",
+    "    }",
+    "    scheduleHeight();",
+    "  });",
+    "}, function () {});",
+    "})();"
+  ].join("\n");
+}
+function createSrcdoc(options) {
+  const { nonce, session, title, elementName } = options;
+  if (!isValidNonce(nonce)) throw new TypeError("[bstage-bridge] nonce \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  if (!isValidSession(session)) throw new TypeError("[bstage-bridge] session \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  const hostOrigin = assertOrigin("hostOrigin", options.hostOrigin);
+  const assetOrigin = assertOrigin("assetOrigin", options.assetOrigin);
+  const entryUrl = assertEntryUrl(options.entryUrl, assetOrigin);
+  if (!isValidElementName(elementName)) {
+    throw new TypeError("[bstage-bridge] elementName\uC774 custom element \uC774\uB984\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (typeof title !== "string") throw new TypeError("[bstage-bridge] title\uC740 \uBB38\uC790\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  const mediaOrigins = normalizeMediaOrigins(options.mediaOrigins);
+  const csp = buildFrameCsp(nonce, assetOrigin, mediaOrigins);
+  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName });
+  if (/<\/script|<!--/i.test(script)) {
+    throw new Error("[bstage-bridge] \uBD80\uD2B8\uC2A4\uD2B8\uB7A9 \uC2A4\uD06C\uB9BD\uD2B8\uC5D0 \uC2A4\uD06C\uB9BD\uD2B8 \uC885\uB8CC \uC2DC\uD000\uC2A4\uAC00 \uC788\uC2B5\uB2C8\uB2E4");
+  }
+  return [
+    "<!doctype html>",
+    "<html>",
+    "<head>",
+    '<meta charset="utf-8">',
+    `<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<title>${escapeHtml(title)}</title>`,
+    // body 높이를 콘텐츠 높이로 잰다 — documentElement.scrollHeight는 뷰포트 이상이라 줄어들지 못한다.
+    // flow-root는 자식 margin이 body 밖으로 접혀 나가 높이에서 빠지는 것을 막는다.
+    "<style>html,body{margin:0;padding:0;background:transparent;height:auto}body{display:flow-root}</style>",
+    `<script nonce="${escapeHtml(nonce)}">
+${script}
+</script>`,
+    "</head>",
+    "<body></body>",
+    "</html>"
+  ].join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BRIDGE_ERROR_CODES,
+  BRIDGE_NAMESPACE,
+  BRIDGE_SURFACES,
+  BRIDGE_VERSION,
+  BridgeError,
+  HOST_EVENT_TYPES,
+  IFRAME_ATTRIBUTES,
+  INIT_RESPONSE,
+  MAX_ELEMENT_NAME_LENGTH,
+  MAX_ENVELOPE_ID_LENGTH,
+  MAX_ENVELOPE_TYPE_LENGTH,
+  MAX_MEDIA_ORIGINS,
+  READY_EVENT,
+  REQUEST_TIMEOUT_MS,
+  REQUEST_TYPES,
+  buildFrameCsp,
+  createEnvelope,
+  createNonce,
+  createSession,
+  createSrcdoc,
+  hasSession,
+  isBridgeEnvelope,
+  isBridgeErrorCode,
+  isBridgeErrorLike,
+  isBridgeSurface,
+  isHostEventType,
+  isRequestType,
+  isValidNonce,
+  isValidSession
+});