@bstage-sdk/bridge 0.0.0-stage → 0.9.1

package/dist/chunk-6LV7HEN4.js

@@ -0,0 +1,583 @@
+import {
+  bridgeRuntime,
+  createBridgeFetch
+} from "./chunk-KQMJY4ZH.js";
+
+// src/protocol/envelope.ts
+var BRIDGE_VERSION = 1;
+var BRIDGE_NAMESPACE = "bstage-bridge";
+var MAX_ENVELOPE_ID_LENGTH = 64;
+var MAX_ENVELOPE_TYPE_LENGTH = 32;
+var ENVELOPE_KINDS = ["req", "res", "evt"];
+function isNonEmptyString(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max;
+}
+function isBridgeEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const env = value;
+  return env.v === BRIDGE_VERSION && env.ns === BRIDGE_NAMESPACE && isNonEmptyString(env.id, MAX_ENVELOPE_ID_LENGTH) && ENVELOPE_KINDS.includes(env.kind) && isNonEmptyString(env.type, MAX_ENVELOPE_TYPE_LENGTH) && "payload" in env;
+}
+function createEnvelope(kind, type, id, payload) {
+  return { v: BRIDGE_VERSION, ns: BRIDGE_NAMESPACE, id, kind, type, payload };
+}
+function hasSession(payload, session) {
+  return typeof payload === "object" && payload !== null && payload.session === session;
+}
+
+// src/protocol/errors.ts
+var BRIDGE_ERROR_CODES = [
+  "FORBIDDEN_DESTINATION",
+  "FORBIDDEN_METHOD",
+  "BODY_TOO_LARGE",
+  "RATE_LIMITED",
+  "BAD_REQUEST",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "UNSUPPORTED"
+];
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "BridgeError";
+    this.code = code;
+  }
+};
+function isBridgeErrorCode(value) {
+  return BRIDGE_ERROR_CODES.includes(value);
+}
+function isBridgeErrorLike(value) {
+  return value instanceof Error && isBridgeErrorCode(value.code);
+}
+
+// src/protocol/messages.ts
+var REQUEST_TIMEOUT_MS = 15e3;
+var REQUEST_TYPES = [
+  "fetch",
+  "navigate",
+  "back",
+  "openExternal",
+  "toast",
+  "resize",
+  "track",
+  "storage",
+  "log"
+];
+var HOST_EVENT_TYPES = ["slot.context", "locale", "member", "theme", "visibility"];
+var READY_EVENT = "ready";
+var INIT_RESPONSE = "init";
+var BRIDGE_SURFACES = ["page", "slot"];
+function isBridgeSurface(value) {
+  return BRIDGE_SURFACES.includes(value);
+}
+var IFRAME_ATTRIBUTES = {
+  sandbox: "allow-scripts",
+  allow: "autoplay; fullscreen; picture-in-picture; encrypted-media; clipboard-write",
+  referrerpolicy: "no-referrer"
+};
+function isRequestType(value) {
+  return REQUEST_TYPES.includes(value);
+}
+function isHostEventType(value) {
+  return HOST_EVENT_TYPES.includes(value);
+}
+
+// src/protocol/session.ts
+var SESSION_RE = /^[0-9a-f]{32}$/;
+var NONCE_RE = /^[A-Za-z0-9+/_-]{22,}={0,2}$/;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createSession() {
+  return Array.from(randomBytes(16), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function isValidSession(value) {
+  return typeof value === "string" && SESSION_RE.test(value);
+}
+function createNonce() {
+  const binary = String.fromCharCode(...randomBytes(16));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function isValidNonce(value) {
+  return typeof value === "string" && NONCE_RE.test(value);
+}
+
+// src/host/pathSafety.ts
+var MAX_DECODE_PASSES = 3;
+var REJECT = Object.freeze({ ok: false, forms: Object.freeze([]) });
+function decodeStages(pathname) {
+  const forms = [pathname];
+  let current = pathname;
+  for (let pass = 0; pass <= MAX_DECODE_PASSES; pass += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(current);
+    } catch {
+      return void 0;
+    }
+    if (next === current) return forms;
+    if (pass === MAX_DECODE_PASSES) return void 0;
+    forms.push(next);
+    current = next;
+  }
+  return void 0;
+}
+var UNSAFE_CHARS_RE = /[\\;\u0000-\u001f\u007f]/;
+function hasDotSegment(form) {
+  return form.split("/").some((segment) => segment === "." || segment === "..");
+}
+function checkPath(pathname, options = {}) {
+  const forms = decodeStages(pathname);
+  if (!forms) return REJECT;
+  const bad = forms.some(
+    (form) => UNSAFE_CHARS_RE.test(form) || hasDotSegment(form) || options.forbidDoubleSlash === true && form.includes("//")
+  );
+  return bad ? REJECT : { ok: true, forms: Object.freeze(forms) };
+}
+
+// src/host/policy.ts
+var DEFAULT_GATEWAY_DENY_SEGMENTS = Object.freeze([
+  "auth",
+  "logout",
+  "mfa",
+  "token",
+  "oauth",
+  "sso",
+  "debug",
+  "debugger",
+  "xdebug",
+  "withdraw"
+]);
+var ALWAYS_DENIED_SEGMENT_SUBSTRINGS = Object.freeze(["token"]);
+var DEFAULT_POLICY = Object.freeze({
+  gatewayPrefixes: Object.freeze(["/gw/"]),
+  gatewayDenyPrefixes: Object.freeze(["/gw/account/v1/auth/", "/gw/account/v1/users/logout"]),
+  gatewayDenySegments: DEFAULT_GATEWAY_DENY_SEGMENTS,
+  allowExternal: false,
+  maxBodyBytes: 1024 * 1024,
+  maxRequestsPerMinute: 300,
+  maxResponseBytes: 10 * 1024 * 1024
+});
+var ALLOWED_REQUEST_HEADERS = Object.freeze([
+  "content-type",
+  "accept",
+  "accept-language",
+  // BstageClient가 보내는 앱 자격 헤더(파트너 콘솔 발급값, 브라우저 노출 전제 — 회원 토큰이 아니다).
+  // 호스트가 `pinnedHeaders`로 값을 주면 그 값이 이긴다.
+  "x-bstage-app-id",
+  "x-bstage-app-key",
+  // BstageClient가 모든 요청에 싣는 core 버전(정보용, 비밀 아님).
+  "x-bmf-sdk-version"
+]);
+var HOST_ONLY_HEADERS = Object.freeze([
+  "x-bstage-tenant-id",
+  "x-bstage-org-id",
+  "x-bstage-enterprise-id"
+]);
+var ALLOWED_METHODS = Object.freeze([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+var MAX_PARTNER_ORIGINS = 10;
+var MAX_URL_LENGTH = 8192;
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function resolvePolicy(policy) {
+  const merged = { ...DEFAULT_POLICY, ...policy ?? {} };
+  if (!Array.isArray(merged.gatewayPrefixes) || merged.gatewayPrefixes.length === 0 || !merged.gatewayPrefixes.every((p) => typeof p === "string" && /^\/[^/]/.test(p))) {
+    throw new TypeError('[bstage-bridge] gatewayPrefixes\uB294 "/"\uB85C \uC2DC\uC791\uD558\uB294 \uACBD\uB85C \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4');
+  }
+  if (!Array.isArray(merged.gatewayDenyPrefixes) || !merged.gatewayDenyPrefixes.every((p) => typeof p === "string" && /^\/[^/]/.test(p))) {
+    throw new TypeError(
+      '[bstage-bridge] gatewayDenyPrefixes\uB294 "/"\uB85C \uC2DC\uC791\uD558\uB294 \uACBD\uB85C \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4'
+    );
+  }
+  if (!Array.isArray(merged.gatewayDenySegments) || !merged.gatewayDenySegments.every(
+    (x) => typeof x === "string" && x.length > 0 && !x.includes("/")
+  )) {
+    throw new TypeError('[bstage-bridge] gatewayDenySegments\uB294 "/" \uC5C6\uB294 \uC138\uADF8\uBA3C\uD2B8 \uBAA9\uB85D\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4');
+  }
+  if (typeof merged.allowExternal !== "boolean") {
+    throw new TypeError("[bstage-bridge] allowExternal\uC740 \uBD88\uB9AC\uC5B8\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (!isPositiveInteger(merged.maxBodyBytes) || !isPositiveInteger(merged.maxRequestsPerMinute) || !isPositiveInteger(merged.maxResponseBytes)) {
+    throw new TypeError(
+      "[bstage-bridge] maxBodyBytes\xB7maxRequestsPerMinute\xB7maxResponseBytes\uB294 \uC591\uC758 \uC815\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4"
+    );
+  }
+  return Object.freeze({
+    ...merged,
+    gatewayPrefixes: Object.freeze([...merged.gatewayPrefixes]),
+    gatewayDenyPrefixes: Object.freeze([...merged.gatewayDenyPrefixes]),
+    gatewayDenySegments: Object.freeze(merged.gatewayDenySegments.map((x) => x.toLowerCase()))
+  });
+}
+var HOSTNAME_RE = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/;
+function normalizeExactOrigin(value, protocols) {
+  if (typeof value !== "string") return void 0;
+  try {
+    const url = new URL(value);
+    if (!protocols.includes(url.protocol) || !HOSTNAME_RE.test(url.hostname)) return void 0;
+    return url.origin === value ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function normalizePartnerOrigins(origins, excludeOrigin) {
+  if (!Array.isArray(origins)) return Object.freeze([]);
+  const valid = origins.map((o) => normalizeExactOrigin(o, ["https:"])).filter((o) => o !== void 0 && o !== excludeOrigin);
+  return Object.freeze([...new Set(valid)].slice(0, MAX_PARTNER_ORIGINS));
+}
+function matchesPrefix(pathname, prefix) {
+  const bare = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  return pathname === bare || pathname.startsWith(`${bare}/`);
+}
+function denyKey(form) {
+  return form.replace(/\/{2,}/g, "/").toLowerCase();
+}
+function isAllowedGatewayPath(pathname, policy) {
+  const check = checkPath(pathname);
+  if (!check.ok) return false;
+  if (!policy.gatewayPrefixes.some((p) => matchesPrefix(pathname, p))) return false;
+  const deny = policy.gatewayDenyPrefixes.map((p) => p.toLowerCase());
+  const denySegments = policy.gatewayDenySegments;
+  return !check.forms.some((form) => {
+    const key = denyKey(form);
+    return deny.some((p) => matchesPrefix(key, p)) || key.split("/").some(
+      (segment) => denySegments.includes(segment) || ALWAYS_DENIED_SEGMENT_SUBSTRINGS.some((part) => segment.includes(part))
+    );
+  });
+}
+var LOCAL_HOST_NAMES = Object.freeze([
+  "localhost",
+  "local",
+  "internal",
+  "home.arpa",
+  "test",
+  "invalid",
+  "example",
+  "lan",
+  "corp",
+  "intranet",
+  "localdomain"
+]);
+function isExternalHostAllowed(hostname, hostHostname) {
+  const name = hostname.replace(/\.+$/, "");
+  if (name === "" || name.startsWith("[") || /^[0-9.]+$/.test(name)) return false;
+  const labels = name.split(".");
+  if (labels.length < 2 || labels.some((label) => label === "")) return false;
+  if (LOCAL_HOST_NAMES.some((base) => name === base || name.endsWith(`.${base}`))) return false;
+  return name !== hostHostname.replace(/\.+$/, "");
+}
+function classifyDestination(rawUrl, ctx) {
+  if (typeof rawUrl !== "string" || rawUrl.length === 0 || rawUrl.length > MAX_URL_LENGTH) {
+    throw new BridgeError("BAD_REQUEST", "invalid url");
+  }
+  let url;
+  try {
+    url = new URL(rawUrl, ctx.hostOrigin);
+  } catch {
+    throw new BridgeError("BAD_REQUEST", "invalid url");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  const host = new URL(ctx.hostOrigin);
+  if (url.origin === host.origin) {
+    if (url.protocol === host.protocol && isAllowedGatewayPath(url.pathname, ctx.policy)) {
+      return { url: url.href, kind: "gateway" };
+    }
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  if (url.protocol !== "https:") {
+    throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+  }
+  if (ctx.partnerOrigins.includes(url.origin)) return { url: url.href, kind: "partner" };
+  if (ctx.policy.allowExternal && isExternalHostAllowed(url.hostname, host.hostname)) {
+    return { url: url.href, kind: "external" };
+  }
+  throw new BridgeError("FORBIDDEN_DESTINATION", "destination not allowed");
+}
+function resolveDestination(rawUrl, ctx) {
+  return classifyDestination(rawUrl, ctx).url;
+}
+function resolveMethod(method) {
+  if (method === void 0) return "GET";
+  if (typeof method !== "string") throw new BridgeError("BAD_REQUEST", "invalid method");
+  const upper = method.toUpperCase();
+  if (!ALLOWED_METHODS.includes(upper)) {
+    throw new BridgeError("FORBIDDEN_METHOD", "method not allowed");
+  }
+  return upper;
+}
+var UNSAFE_HEADER_VALUE_RE = /[\r\n\0]/;
+function normalizePinnedHeaders(pinned) {
+  if (pinned === void 0) return Object.freeze({});
+  if (typeof pinned !== "object" || pinned === null || Array.isArray(pinned)) {
+    throw new TypeError("[bstage-bridge] pinnedHeaders\uB294 \uAC1D\uCCB4\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
+  const entries = Object.entries(pinned).map(([k, v]) => {
+    const key = k.toLowerCase();
+    if (!ALLOWED_REQUEST_HEADERS.includes(key) && !HOST_ONLY_HEADERS.includes(key)) {
+      throw new TypeError(`[bstage-bridge] pinnedHeaders\uC5D0 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD5E4\uB354: ${k}`);
+    }
+    if (typeof v !== "string" || UNSAFE_HEADER_VALUE_RE.test(v)) {
+      throw new TypeError(`[bstage-bridge] pinnedHeaders \uAC12\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4: ${k}`);
+    }
+    return [key, v];
+  });
+  return Object.freeze(Object.fromEntries(entries));
+}
+function mergeHeaders(frameHeaders, pinned) {
+  return Object.freeze({ ...filterHeaders(frameHeaders), ...pinned });
+}
+function filterHeaders(headers) {
+  if (typeof headers !== "object" || headers === null || Array.isArray(headers)) return {};
+  const entries = Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]).filter(
+    (entry) => ALLOWED_REQUEST_HEADERS.includes(entry[0]) && typeof entry[1] === "string" && !/[\r\n\0]/.test(entry[1])
+  );
+  return Object.freeze(Object.fromEntries(entries));
+}
+function exceedsBytes(body, max) {
+  if (body.length > max) return true;
+  if (body.length * 3 <= max) return false;
+  return new TextEncoder().encode(body).length > max;
+}
+function resolveBody(body, method, maxBodyBytes) {
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body !== "string") throw new BridgeError("BAD_REQUEST", "body must be a string");
+  if (method === "GET" || method === "HEAD") {
+    throw new BridgeError("BAD_REQUEST", "GET/HEAD cannot have a body");
+  }
+  if (exceedsBytes(body, maxBodyBytes)) throw new BridgeError("BODY_TOO_LARGE", "body too large");
+  return body;
+}
+function prepareFetch(payload, ctx) {
+  if (typeof payload !== "object" || payload === null) {
+    throw new BridgeError("BAD_REQUEST", "invalid payload");
+  }
+  const req = payload;
+  const method = resolveMethod(req.method);
+  const { url, kind } = classifyDestination(req.url, ctx);
+  const body = resolveBody(req.body, method, ctx.policy.maxBodyBytes);
+  const headers = kind === "gateway" ? mergeHeaders(req.headers, ctx.pinnedHeaders ?? {}) : filterHeaders(req.headers);
+  return {
+    url,
+    kind,
+    init: {
+      method,
+      headers,
+      ...body !== void 0 ? { body } : {},
+      credentials: kind === "gateway" ? "same-origin" : "omit",
+      ...kind === "gateway" ? {} : { referrerPolicy: "no-referrer" },
+      // 브리지 프로토콜 인자에 더한 방어선: redirect를 따라가면 판정한 URL과 실제 목적지가 달라진다
+      // (파트너 origin이 같은 origin의 /gw 밖 경로로 돌려보내면 쿠키가 실린 요청이 된다).
+      redirect: "error"
+    }
+  };
+}
+
+// src/srcdoc/escape.ts
+var HTML_ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => HTML_ESCAPES[ch]);
+}
+function toScriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
+// src/srcdoc/createSrcdoc.ts
+var MAX_MEDIA_ORIGINS = 20;
+var MAX_ELEMENT_NAME_LENGTH = 100;
+var ELEMENT_NAME_RE = /^[a-z][a-z0-9._]*-[a-z0-9._-]*$/;
+function isValidElementName(value) {
+  return typeof value === "string" && value.length <= MAX_ELEMENT_NAME_LENGTH && ELEMENT_NAME_RE.test(value);
+}
+function assertOrigin(label, value) {
+  const origin = normalizeExactOrigin(value, ["https:", "http:"]);
+  if (!origin) throw new TypeError(`[bstage-bridge] ${label}\uB294 \uC815\uD655\uD55C origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
+  return origin;
+}
+function assertEntryUrl(entryUrl, assetOrigin) {
+  let parsed;
+  try {
+    parsed = new URL(entryUrl);
+  } catch {
+    throw new TypeError("[bstage-bridge] entryUrl\uC774 URL\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (parsed.origin !== assetOrigin || parsed.username || parsed.password) {
+    throw new TypeError("[bstage-bridge] entryUrl\uC740 assetOrigin\uC5D0 \uC788\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  return parsed.href;
+}
+function normalizeMediaOrigins(value) {
+  if (value === void 0) return Object.freeze([]);
+  if (!Array.isArray(value)) {
+    throw new TypeError("[bstage-bridge] mediaOrigins\uB294 \uBC30\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  }
+  if (value.length > MAX_MEDIA_ORIGINS) {
+    throw new TypeError(`[bstage-bridge] mediaOrigins\uB294 \uCD5C\uB300 ${MAX_MEDIA_ORIGINS}\uAC1C\uC785\uB2C8\uB2E4`);
+  }
+  const origins = value.map((o) => {
+    const origin = normalizeExactOrigin(o, ["https:"]);
+    if (!origin) {
+      throw new TypeError("[bstage-bridge] mediaOrigins \uD56D\uBAA9\uC740 \uC815\uD655\uD55C https origin\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+    }
+    return origin;
+  });
+  return Object.freeze([...new Set(origins)]);
+}
+function buildFrameCsp(nonce, assetOrigin, mediaOrigins = []) {
+  const media = [assetOrigin, ...normalizeMediaOrigins(mediaOrigins)].join(" ");
+  return [
+    "default-src 'none'",
+    `script-src 'nonce-${nonce}' ${assetOrigin}`,
+    `style-src 'unsafe-inline' ${assetOrigin}`,
+    `img-src ${media} data: blob:`,
+    `font-src ${assetOrigin} data:`,
+    `media-src ${media} blob:`,
+    "connect-src 'none'",
+    "frame-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'"
+  ].join("; ");
+}
+function bootstrapScript(o) {
+  return [
+    "(function () {",
+    '"use strict";',
+    `var SESSION = ${toScriptLiteral(o.session)};`,
+    `var HOST_ORIGIN = ${toScriptLiteral(o.hostOrigin)};`,
+    `var ENTRY_URL = ${toScriptLiteral(o.entryUrl)};`,
+    `var ELEMENT_NAME = ${toScriptLiteral(o.elementName)};`,
+    `var bridgeRuntime = ${bridgeRuntime.toString()};`,
+    `var createBridgeFetch = ${createBridgeFetch.toString()};`,
+    "var client = bridgeRuntime(globalThis, createBridgeFetch, { session: SESSION, hostOrigin: HOST_ORIGIN });",
+    "var lastHeight = -1;",
+    "var scheduled = false;",
+    "function reportHeight() {",
+    "  scheduled = false;",
+    "  var h = Math.ceil(document.body.getBoundingClientRect().height);",
+    "  if (h === lastHeight) return;",
+    "  lastHeight = h;",
+    "  client.request('resize', { height: h }).catch(function () {});",
+    "}",
+    "function scheduleHeight() {",
+    "  if (scheduled) return;",
+    "  scheduled = true;",
+    "  requestAnimationFrame(reportHeight);",
+    "}",
+    "client.ready.then(function () {",
+    "  var script = document.createElement('script');",
+    "  script.src = ENTRY_URL;",
+    "  script.onerror = function () {",
+    "    client.request('log', { level: 'error', message: 'template entry failed to load' }).catch(function () {});",
+    "  };",
+    "  document.head.appendChild(script);",
+    "  customElements.whenDefined(ELEMENT_NAME).then(function () {",
+    "    document.body.appendChild(document.createElement(ELEMENT_NAME));",
+    "    if (typeof ResizeObserver === 'function') {",
+    "      new ResizeObserver(scheduleHeight).observe(document.body);",
+    "    }",
+    "    scheduleHeight();",
+    "  });",
+    "}, function () {});",
+    "})();"
+  ].join("\n");
+}
+function createSrcdoc(options) {
+  const { nonce, session, title, elementName } = options;
+  if (!isValidNonce(nonce)) throw new TypeError("[bstage-bridge] nonce \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  if (!isValidSession(session)) throw new TypeError("[bstage-bridge] session \uD615\uC2DD\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4");
+  const hostOrigin = assertOrigin("hostOrigin", options.hostOrigin);
+  const assetOrigin = assertOrigin("assetOrigin", options.assetOrigin);
+  const entryUrl = assertEntryUrl(options.entryUrl, assetOrigin);
+  if (!isValidElementName(elementName)) {
+    throw new TypeError("[bstage-bridge] elementName\uC774 custom element \uC774\uB984\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+  }
+  if (typeof title !== "string") throw new TypeError("[bstage-bridge] title\uC740 \uBB38\uC790\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
+  const mediaOrigins = normalizeMediaOrigins(options.mediaOrigins);
+  const csp = buildFrameCsp(nonce, assetOrigin, mediaOrigins);
+  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName });
+  if (/<\/script|<!--/i.test(script)) {
+    throw new Error("[bstage-bridge] \uBD80\uD2B8\uC2A4\uD2B8\uB7A9 \uC2A4\uD06C\uB9BD\uD2B8\uC5D0 \uC2A4\uD06C\uB9BD\uD2B8 \uC885\uB8CC \uC2DC\uD000\uC2A4\uAC00 \uC788\uC2B5\uB2C8\uB2E4");
+  }
+  return [
+    "<!doctype html>",
+    "<html>",
+    "<head>",
+    '<meta charset="utf-8">',
+    `<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<title>${escapeHtml(title)}</title>`,
+    // body 높이를 콘텐츠 높이로 잰다 — documentElement.scrollHeight는 뷰포트 이상이라 줄어들지 못한다.
+    // flow-root는 자식 margin이 body 밖으로 접혀 나가 높이에서 빠지는 것을 막는다.
+    "<style>html,body{margin:0;padding:0;background:transparent;height:auto}body{display:flow-root}</style>",
+    `<script nonce="${escapeHtml(nonce)}">
+${script}
+</script>`,
+    "</head>",
+    "<body></body>",
+    "</html>"
+  ].join("\n");
+}
+
+export {
+  BRIDGE_VERSION,
+  BRIDGE_NAMESPACE,
+  MAX_ENVELOPE_ID_LENGTH,
+  MAX_ENVELOPE_TYPE_LENGTH,
+  isBridgeEnvelope,
+  createEnvelope,
+  hasSession,
+  BRIDGE_ERROR_CODES,
+  BridgeError,
+  isBridgeErrorCode,
+  isBridgeErrorLike,
+  REQUEST_TIMEOUT_MS,
+  REQUEST_TYPES,
+  HOST_EVENT_TYPES,
+  READY_EVENT,
+  INIT_RESPONSE,
+  BRIDGE_SURFACES,
+  isBridgeSurface,
+  IFRAME_ATTRIBUTES,
+  isRequestType,
+  isHostEventType,
+  createSession,
+  isValidSession,
+  createNonce,
+  isValidNonce,
+  MAX_DECODE_PASSES,
+  checkPath,
+  DEFAULT_GATEWAY_DENY_SEGMENTS,
+  DEFAULT_POLICY,
+  ALLOWED_REQUEST_HEADERS,
+  HOST_ONLY_HEADERS,
+  ALLOWED_METHODS,
+  MAX_PARTNER_ORIGINS,
+  resolvePolicy,
+  normalizeExactOrigin,
+  normalizePartnerOrigins,
+  isAllowedGatewayPath,
+  classifyDestination,
+  resolveDestination,
+  normalizePinnedHeaders,
+  prepareFetch,
+  MAX_MEDIA_ORIGINS,
+  MAX_ELEMENT_NAME_LENGTH,
+  buildFrameCsp,
+  createSrcdoc
+};