@bstage-sdk/bridge 0.11.0 → 0.13.0

package/dist/host.cjs

@@ -29,6 +29,7 @@ __export(host_exports, {
   IFRAME_ATTRIBUTES: () => IFRAME_ATTRIBUTES,
   MAX_DECODE_PASSES: () => MAX_DECODE_PASSES,
   MAX_PARTNER_ORIGINS: () => MAX_PARTNER_ORIGINS,
+  REPORTS_PER_SESSION: () => REPORTS_PER_SESSION,
   checkPath: () => checkPath,
   classifyDestination: () => classifyDestination,
   createBridgeHost: () => createBridgeHost,
@@ -102,7 +103,8 @@ var REQUEST_TYPES = [
   "resize",
   "track",
   "storage",
-  "log"
+  "log",
+  "report"
 ];
 var HOST_EVENT_TYPES = ["slot.context", "locale", "member", "theme", "visibility"];
 var READY_EVENT = "ready";
@@ -112,6 +114,12 @@ var BRIDGE_SURFACES = ["page", "slot"];
 function isBridgeSurface(value) {
   return BRIDGE_SURFACES.includes(value);
 }
+var TEMPLATE_REPORT_KINDS = ["error", "rejection", "load"];
+var REPORT_MESSAGE_MAX_LENGTH = 300;
+var REPORT_MAX_FRAMES = 10;
+var REPORT_FRAME_MAX_LENGTH = 200;
+var REPORT_COUNT_MAX = 100;
+var REPORTS_PER_SESSION = 5;
 var IFRAME_ATTRIBUTES = {
   sandbox: "allow-scripts",
   allow: "autoplay; fullscreen; picture-in-picture; encrypted-media; clipboard-write",
@@ -669,6 +677,32 @@ function validateLog(payload) {
   if (!known || typeof message !== "string") throw new BridgeError("BAD_REQUEST", "invalid log");
   return { level: known, message: message.slice(0, LOG_MAX_LENGTH) };
 }
+function framesCopy(frames) {
+  if (!Array.isArray(frames) || frames.length > REPORT_MAX_FRAMES) return null;
+  const out = [];
+  for (let i = 0; i < frames.length; i += 1) {
+    if (!(i in frames)) return null;
+    const f = frames[i];
+    if (typeof f !== "string" || f.length > REPORT_FRAME_MAX_LENGTH) return null;
+    out.push(f);
+  }
+  return out;
+}
+function validateReport(payload) {
+  const kind = TEMPLATE_REPORT_KINDS.find((k) => k === field(payload, "kind"));
+  const message = field(payload, "message");
+  const frames = framesCopy(field(payload, "frames"));
+  const count = field(payload, "count");
+  if (!kind || typeof message !== "string" || message.length > REPORT_MESSAGE_MAX_LENGTH || frames === null || typeof count !== "number" || !Number.isInteger(count) || count < 1 || count > REPORT_COUNT_MAX) {
+    throw new BridgeError("BAD_REQUEST", "invalid report");
+  }
+  return Object.freeze({
+    kind,
+    message,
+    frames: Object.freeze(frames),
+    count
+  });
+}
 
 // src/host/createBridgeHost.ts
 var OPAQUE_ORIGIN = "null";
@@ -806,6 +840,16 @@ async function dispatch(ctx, type, payload) {
       else writeConsole(level, message);
       return EMPTY;
     }
+    case "report": {
+      const report = validateReport(payload);
+      const onReport = ctx.options.onTemplateReport;
+      if (!onReport || !ctx.takeReportSlot()) return EMPTY;
+      try {
+        onReport(report);
+      } catch {
+      }
+      return EMPTY;
+    }
   }
 }
 function failure(code, message) {
@@ -849,6 +893,9 @@ function assertOptions(options) {
   if (options.onDispose !== void 0 && typeof options.onDispose !== "function") {
     throw new TypeError("[bstage-bridge] onDispose\uB294 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
   }
+  if (options.onTemplateReport !== void 0 && typeof options.onTemplateReport !== "function") {
+    throw new TypeError("[bstage-bridge] onTemplateReport\uB294 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
   if (!options.iframe || !options.init) {
     throw new TypeError("[bstage-bridge] iframe\xB7init\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
   }
@@ -870,6 +917,7 @@ function createBridgeHost(options) {
   const resizeLimiter = createRateLimiter(RESIZE_PER_SECOND, 1e3);
   let current = buildInit(options.init, hostOrigin, partnerOrigins, policy);
   let inFlightFetches = 0;
+  let reportsTaken = 0;
   let disposed = false;
   let boundFrame;
   let pendingVisibility;
@@ -899,7 +947,12 @@ function createBridgeHost(options) {
     externalFetchImpl: options.externalFetchImpl ?? defaultUncredentialedFetch,
     hostOrigin,
     toastLimiter: createRateLimiter(TOAST_PER_MINUTE),
-    scheduleResize
+    scheduleResize,
+    takeReportSlot() {
+      if (reportsTaken >= REPORTS_PER_SESSION) return false;
+      reportsTaken += 1;
+      return true;
+    }
   };
   function post(target, envelope) {
     if (disposed) return;
@@ -1459,6 +1512,112 @@ function installDirectFetch(g, client, config) {
   return bstageFetch;
 }
 
+// src/frame/errorReport.ts
+function installErrorReport(g, client, config) {
+  const schedule = typeof g.setTimeout === "function" ? g.setTimeout : void 0;
+  const entries = /* @__PURE__ */ new Map();
+  let admitted = 0;
+  function toText(value) {
+    if (typeof value === "string") return value;
+    try {
+      return String(value);
+    } catch {
+      return "";
+    }
+  }
+  function framesOf(stack) {
+    const out = [];
+    if (typeof stack !== "string") return out;
+    const lines = stack.split("\n");
+    for (let i = 0; i < lines.length && out.length < config.maxFrames; i += 1) {
+      const line = lines[i].trim();
+      if (/^at\s/.test(line) || /^[^@]*@(?:[a-z][\w+.-]*:\/\/|\/)\S*:\d+:\d+$/i.test(line) || /^(?:[a-z][\w+.-]*:\/\/|\/)\S*:\d+:\d+$/i.test(line))
+        out.push(line.slice(0, config.maxFrameLength));
+    }
+    return out;
+  }
+  function send(key) {
+    const entry = entries.get(key);
+    if (!entry || entry.sent) return;
+    entries.set(key, {
+      kind: entry.kind,
+      message: entry.message,
+      frames: entry.frames,
+      count: entry.count,
+      sent: true
+    });
+    try {
+      client.request("report", {
+        kind: entry.kind,
+        message: entry.message,
+        frames: entry.frames,
+        count: entry.count
+      }).catch(function() {
+      });
+    } catch {
+    }
+  }
+  function record(kind, message, stack) {
+    try {
+      const text = toText(message).slice(0, config.maxMessageLength);
+      const frames = framesOf(stack);
+      const key = kind + "|" + text.replace(/\d+/g, "") + "|" + (frames[0] || "");
+      const entry = entries.get(key);
+      if (entry) {
+        if (!entry.sent && entry.count < config.maxCount) {
+          entries.set(key, {
+            kind: entry.kind,
+            message: entry.message,
+            frames: entry.frames,
+            count: entry.count + 1,
+            sent: false
+          });
+        }
+        return;
+      }
+      if (admitted >= config.maxReports) return;
+      admitted += 1;
+      entries.set(key, { kind, message: text, frames, count: 1, sent: false });
+      if (admitted >= config.maxReports) stop();
+      if (schedule) {
+        schedule(function() {
+          send(key);
+        }, config.flushDelayMs);
+      } else {
+        send(key);
+      }
+    } catch {
+    }
+  }
+  function onError(ev) {
+    const err = ev && ev.error;
+    if (err && typeof err === "object") {
+      record("error", typeof err.message === "string" ? err.message : ev.message, err.stack);
+      return;
+    }
+    const where = ev && typeof ev.filename === "string" && ev.filename !== "" ? "at " + ev.filename + ":" + toText(ev.lineno) + ":" + toText(ev.colno) : "";
+    record("error", ev ? ev.message : "", where);
+  }
+  function onRejection(ev) {
+    const reason = ev ? ev.reason : void 0;
+    if (reason && typeof reason === "object" && typeof reason.message === "string") {
+      record("rejection", reason.message, reason.stack);
+      return;
+    }
+    record("rejection", reason, "");
+  }
+  function stop() {
+    if (typeof g.removeEventListener !== "function") return;
+    g.removeEventListener("error", onError);
+    g.removeEventListener("unhandledrejection", onRejection);
+  }
+  if (typeof g.addEventListener === "function") {
+    g.addEventListener("error", onError);
+    g.addEventListener("unhandledrejection", onRejection);
+  }
+  return record;
+}
+
 // src/srcdoc/escape.ts
 var HTML_ESCAPES = {
   "&": "&amp;",
@@ -1476,6 +1635,7 @@ function toScriptLiteral(value) {
 
 // src/srcdoc/createSrcdoc.ts
 var MAX_MEDIA_ORIGINS = 20;
+var REPORT_FLUSH_DELAY_MS = 1e3;
 var MAX_ELEMENT_NAME_LENGTH = 100;
 var ELEMENT_NAME_RE = /^[a-z][a-z0-9._]*-[a-z0-9._-]*$/;
 function isValidElementName(value) {
@@ -1544,6 +1704,16 @@ function bootstrapScript(o) {
     // 라우터는 항상 심는다. ready.then이 엔트리 로드(아래 client.ready.then)보다 먼저 등록돼야 템플릿보다 먼저 스냅샷을 잡는다.
     `var installDirectFetch = ${installDirectFetch.toString()};`,
     "installDirectFetch(globalThis, client, { hostOrigin: HOST_ORIGIN });",
+    // 에러 수집기는 엔트리(템플릿)보다 먼저 리스너를 건다. 상한은 호스트 검증기와 같은 프로토콜 값이다.
+    `var installErrorReport = ${installErrorReport.toString()};`,
+    "var reportError = installErrorReport(globalThis, client, {",
+    `  maxReports: ${REPORTS_PER_SESSION},`,
+    `  maxMessageLength: ${REPORT_MESSAGE_MAX_LENGTH},`,
+    `  maxFrames: ${REPORT_MAX_FRAMES},`,
+    `  maxFrameLength: ${REPORT_FRAME_MAX_LENGTH},`,
+    `  maxCount: ${REPORT_COUNT_MAX},`,
+    `  flushDelayMs: ${REPORT_FLUSH_DELAY_MS}`,
+    "});",
     "var lastHeight = -1;",
     "var scheduled = false;",
     "function reportHeight() {",
@@ -1560,9 +1730,12 @@ function bootstrapScript(o) {
     "}",
     "client.ready.then(function () {",
     "  var script = document.createElement('script');",
+    // crossOrigin은 src보다 먼저 둔다(요청 모드가 src 대입 시점에 정해지는 브라우저가 있다). 주지 않으면 줄 자체가 없다.
+    ...o.crossOrigin === "anonymous" ? ["  script.crossOrigin = 'anonymous';"] : [],
     "  script.src = ENTRY_URL;",
     "  script.onerror = function () {",
     "    client.request('log', { level: 'error', message: 'template entry failed to load' }).catch(function () {});",
+    "    reportError('load', 'template entry failed to load', '');",
     "  };",
     "  document.head.appendChild(script);",
     "  customElements.whenDefined(ELEMENT_NAME).then(function () {",
@@ -1588,8 +1761,12 @@ function createSrcdoc(options) {
   }
   if (typeof title !== "string") throw new TypeError("[bstage-bridge] title\uC740 \uBB38\uC790\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
   const mediaOrigins = normalizeMediaOrigins(options.mediaOrigins);
+  const { crossOrigin } = options;
+  if (crossOrigin !== void 0 && crossOrigin !== "anonymous") {
+    throw new TypeError("[bstage-bridge] crossOrigin\uC740 'anonymous'\uB9CC \uBC1B\uC2B5\uB2C8\uB2E4");
+  }
   const csp = buildFrameCsp(nonce, assetOrigin, mediaOrigins);
-  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName });
+  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName, crossOrigin });
   if (/<\/script|<!--/i.test(script)) {
     throw new Error("[bstage-bridge] \uBD80\uD2B8\uC2A4\uD2B8\uB7A9 \uC2A4\uD06C\uB9BD\uD2B8\uC5D0 \uC2A4\uD06C\uB9BD\uD2B8 \uC885\uB8CC \uC2DC\uD000\uC2A4\uAC00 \uC788\uC2B5\uB2C8\uB2E4");
   }
@@ -1623,6 +1800,7 @@ ${script}
   IFRAME_ATTRIBUTES,
   MAX_DECODE_PASSES,
   MAX_PARTNER_ORIGINS,
+  REPORTS_PER_SESSION,
   checkPath,
   classifyDestination,
   createBridgeHost,

package/dist/host.d.cts

@@ -1,6 +1,6 @@
-import { f as BridgeHostEventType, e as BridgeEventMap, t as ToastKind, L as LogLevel, l as BridgeSurface, T as ThemeState, S as SlotState, M as MemberState, m as BridgeTranslations } from './messages-BjpZyiLy.cjs';
-export { a as BRIDGE_SURFACES, I as IFRAME_ATTRIBUTES, w as isBridgeSurface } from './messages-BjpZyiLy.cjs';
-export { C as CreateSrcdocOptions, c as createNonce, d as createSession, e as createSrcdoc, f as isValidSession } from './createSrcdoc-DgQyvIjG.cjs';
+import { f as BridgeHostEventType, e as BridgeEventMap, C as ToastKind, L as LogLevel, l as BridgeSurface, A as ThemeState, S as SlotState, M as MemberState, m as BridgeTranslations, y as TemplateReport } from './messages-Cdjpvu2S.cjs';
+export { a as BRIDGE_SURFACES, I as IFRAME_ATTRIBUTES, q as REPORTS_PER_SESSION, z as TemplateReportKind, G as isBridgeSurface } from './messages-Cdjpvu2S.cjs';
+export { C as CreateSrcdocOptions, c as createNonce, d as createSession, e as createSrcdoc, f as isValidSession } from './createSrcdoc-DYZk6dDJ.cjs';
 
 /** 호스트 fetch 정책. */
 interface BridgePolicy {
@@ -219,6 +219,14 @@ interface CreateBridgeHostOptions {
      * 바로 걷어 내는 데 쓴다. 이 콜백의 예외는 삼킨다.
      */
     readonly onDispose?: (reason: BridgeDisposeReason) => void;
+    /**
+     * 프레임의 `report`(템플릿 에러 보고)를 검증한 뒤 부른다. phase와 무관하게(real 포함) 불린다.
+     * 프레임 세션(이 호스트)당 `REPORTS_PER_SESSION`(5)건까지만 부르고 넘치는 보고는 조용히 버린다.
+     * 넘기는 값은 `{ kind, message, frames, count }`뿐이다 — 어느 템플릿인지는 프레임이 보낸 값이 아니라
+     * 호스트가 띄운 templateUrl로 임베더가 귀속한다. message·frames는 템플릿이 만든 문자열이라 텍스트로만 다루고,
+     * 밖으로 보내기 전 스크러빙은 임베더 몫이다. 이 콜백의 예외는 삼킨다.
+     */
+    readonly onTemplateReport?: (report: TemplateReport) => void;
 }
 /** `onDispose` 사유. */
 type BridgeDisposeReason = 'frame-unload' | 'frame-mismatch' | 'manual';
@@ -277,4 +285,4 @@ interface PathCheck {
  */
 declare function checkPath(pathname: string, options?: PathCheckOptions): PathCheck;
 
-export { ALLOWED_METHODS, ALLOWED_REQUEST_HEADERS, type BridgeDisposeReason, type BridgeHost, type BridgeHostHandlers, type BridgeInitInput, type BridgePolicy, BridgeSurface, type CreateBridgeHostOptions, DEFAULT_GATEWAY_DENY_SEGMENTS, DEFAULT_POLICY, type Destination, type DestinationContext, type DestinationKind, type FrameWindow, HOST_ONLY_HEADERS, type HostFetch, type HostWindow, type IframeLike, MAX_DECODE_PASSES, MAX_PARTNER_ORIGINS, type MessageEventLike, type PathCheck, type PathCheckOptions, type PreparedFetch, checkPath, classifyDestination, createBridgeHost, isAllowedGatewayPath, normalizePartnerOrigins, normalizePinnedHeaders, prepareFetch, resolveDestination, resolvePolicy };
+export { ALLOWED_METHODS, ALLOWED_REQUEST_HEADERS, type BridgeDisposeReason, type BridgeHost, type BridgeHostHandlers, type BridgeInitInput, type BridgePolicy, BridgeSurface, type CreateBridgeHostOptions, DEFAULT_GATEWAY_DENY_SEGMENTS, DEFAULT_POLICY, type Destination, type DestinationContext, type DestinationKind, type FrameWindow, HOST_ONLY_HEADERS, type HostFetch, type HostWindow, type IframeLike, MAX_DECODE_PASSES, MAX_PARTNER_ORIGINS, type MessageEventLike, type PathCheck, type PathCheckOptions, type PreparedFetch, TemplateReport, checkPath, classifyDestination, createBridgeHost, isAllowedGatewayPath, normalizePartnerOrigins, normalizePinnedHeaders, prepareFetch, resolveDestination, resolvePolicy };

package/dist/host.d.ts

@@ -1,6 +1,6 @@
-import { f as BridgeHostEventType, e as BridgeEventMap, t as ToastKind, L as LogLevel, l as BridgeSurface, T as ThemeState, S as SlotState, M as MemberState, m as BridgeTranslations } from './messages-BjpZyiLy.js';
-export { a as BRIDGE_SURFACES, I as IFRAME_ATTRIBUTES, w as isBridgeSurface } from './messages-BjpZyiLy.js';
-export { C as CreateSrcdocOptions, c as createNonce, d as createSession, e as createSrcdoc, f as isValidSession } from './createSrcdoc-DgQyvIjG.js';
+import { f as BridgeHostEventType, e as BridgeEventMap, C as ToastKind, L as LogLevel, l as BridgeSurface, A as ThemeState, S as SlotState, M as MemberState, m as BridgeTranslations, y as TemplateReport } from './messages-Cdjpvu2S.js';
+export { a as BRIDGE_SURFACES, I as IFRAME_ATTRIBUTES, q as REPORTS_PER_SESSION, z as TemplateReportKind, G as isBridgeSurface } from './messages-Cdjpvu2S.js';
+export { C as CreateSrcdocOptions, c as createNonce, d as createSession, e as createSrcdoc, f as isValidSession } from './createSrcdoc-DYZk6dDJ.js';
 
 /** 호스트 fetch 정책. */
 interface BridgePolicy {
@@ -219,6 +219,14 @@ interface CreateBridgeHostOptions {
      * 바로 걷어 내는 데 쓴다. 이 콜백의 예외는 삼킨다.
      */
     readonly onDispose?: (reason: BridgeDisposeReason) => void;
+    /**
+     * 프레임의 `report`(템플릿 에러 보고)를 검증한 뒤 부른다. phase와 무관하게(real 포함) 불린다.
+     * 프레임 세션(이 호스트)당 `REPORTS_PER_SESSION`(5)건까지만 부르고 넘치는 보고는 조용히 버린다.
+     * 넘기는 값은 `{ kind, message, frames, count }`뿐이다 — 어느 템플릿인지는 프레임이 보낸 값이 아니라
+     * 호스트가 띄운 templateUrl로 임베더가 귀속한다. message·frames는 템플릿이 만든 문자열이라 텍스트로만 다루고,
+     * 밖으로 보내기 전 스크러빙은 임베더 몫이다. 이 콜백의 예외는 삼킨다.
+     */
+    readonly onTemplateReport?: (report: TemplateReport) => void;
 }
 /** `onDispose` 사유. */
 type BridgeDisposeReason = 'frame-unload' | 'frame-mismatch' | 'manual';
@@ -277,4 +285,4 @@ interface PathCheck {
  */
 declare function checkPath(pathname: string, options?: PathCheckOptions): PathCheck;
 
-export { ALLOWED_METHODS, ALLOWED_REQUEST_HEADERS, type BridgeDisposeReason, type BridgeHost, type BridgeHostHandlers, type BridgeInitInput, type BridgePolicy, BridgeSurface, type CreateBridgeHostOptions, DEFAULT_GATEWAY_DENY_SEGMENTS, DEFAULT_POLICY, type Destination, type DestinationContext, type DestinationKind, type FrameWindow, HOST_ONLY_HEADERS, type HostFetch, type HostWindow, type IframeLike, MAX_DECODE_PASSES, MAX_PARTNER_ORIGINS, type MessageEventLike, type PathCheck, type PathCheckOptions, type PreparedFetch, checkPath, classifyDestination, createBridgeHost, isAllowedGatewayPath, normalizePartnerOrigins, normalizePinnedHeaders, prepareFetch, resolveDestination, resolvePolicy };
+export { ALLOWED_METHODS, ALLOWED_REQUEST_HEADERS, type BridgeDisposeReason, type BridgeHost, type BridgeHostHandlers, type BridgeInitInput, type BridgePolicy, BridgeSurface, type CreateBridgeHostOptions, DEFAULT_GATEWAY_DENY_SEGMENTS, DEFAULT_POLICY, type Destination, type DestinationContext, type DestinationKind, type FrameWindow, HOST_ONLY_HEADERS, type HostFetch, type HostWindow, type IframeLike, MAX_DECODE_PASSES, MAX_PARTNER_ORIGINS, type MessageEventLike, type PathCheck, type PathCheckOptions, type PreparedFetch, TemplateReport, checkPath, classifyDestination, createBridgeHost, isAllowedGatewayPath, normalizePartnerOrigins, normalizePinnedHeaders, prepareFetch, resolveDestination, resolvePolicy };

package/dist/host.js

@@ -12,6 +12,12 @@ import {
   MAX_DECODE_PASSES,
   MAX_PARTNER_ORIGINS,
   READY_EVENT,
+  REPORTS_PER_SESSION,
+  REPORT_COUNT_MAX,
+  REPORT_FRAME_MAX_LENGTH,
+  REPORT_MAX_FRAMES,
+  REPORT_MESSAGE_MAX_LENGTH,
+  TEMPLATE_REPORT_KINDS,
   checkPath,
   classifyDestination,
   createEnvelope,
@@ -32,8 +38,8 @@ import {
   prepareFetch,
   resolveDestination,
   resolvePolicy
-} from "./chunk-ND2HFYBP.js";
-import "./chunk-CSAW3L7P.js";
+} from "./chunk-NXB47KPE.js";
+import "./chunk-TPKNGW34.js";
 
 // src/host/rateLimiter.ts
 var DEFAULT_WINDOW_MS = 6e4;
@@ -278,6 +284,32 @@ function validateLog(payload) {
   if (!known || typeof message !== "string") throw new BridgeError("BAD_REQUEST", "invalid log");
   return { level: known, message: message.slice(0, LOG_MAX_LENGTH) };
 }
+function framesCopy(frames) {
+  if (!Array.isArray(frames) || frames.length > REPORT_MAX_FRAMES) return null;
+  const out = [];
+  for (let i = 0; i < frames.length; i += 1) {
+    if (!(i in frames)) return null;
+    const f = frames[i];
+    if (typeof f !== "string" || f.length > REPORT_FRAME_MAX_LENGTH) return null;
+    out.push(f);
+  }
+  return out;
+}
+function validateReport(payload) {
+  const kind = TEMPLATE_REPORT_KINDS.find((k) => k === field(payload, "kind"));
+  const message = field(payload, "message");
+  const frames = framesCopy(field(payload, "frames"));
+  const count = field(payload, "count");
+  if (!kind || typeof message !== "string" || message.length > REPORT_MESSAGE_MAX_LENGTH || frames === null || typeof count !== "number" || !Number.isInteger(count) || count < 1 || count > REPORT_COUNT_MAX) {
+    throw new BridgeError("BAD_REQUEST", "invalid report");
+  }
+  return Object.freeze({
+    kind,
+    message,
+    frames: Object.freeze(frames),
+    count
+  });
+}
 
 // src/host/createBridgeHost.ts
 var OPAQUE_ORIGIN = "null";
@@ -415,6 +447,16 @@ async function dispatch(ctx, type, payload) {
       else writeConsole(level, message);
       return EMPTY;
     }
+    case "report": {
+      const report = validateReport(payload);
+      const onReport = ctx.options.onTemplateReport;
+      if (!onReport || !ctx.takeReportSlot()) return EMPTY;
+      try {
+        onReport(report);
+      } catch {
+      }
+      return EMPTY;
+    }
   }
 }
 function failure(code, message) {
@@ -458,6 +500,9 @@ function assertOptions(options) {
   if (options.onDispose !== void 0 && typeof options.onDispose !== "function") {
     throw new TypeError("[bstage-bridge] onDispose\uB294 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
   }
+  if (options.onTemplateReport !== void 0 && typeof options.onTemplateReport !== "function") {
+    throw new TypeError("[bstage-bridge] onTemplateReport\uB294 \uD568\uC218\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+  }
   if (!options.iframe || !options.init) {
     throw new TypeError("[bstage-bridge] iframe\xB7init\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
   }
@@ -479,6 +524,7 @@ function createBridgeHost(options) {
   const resizeLimiter = createRateLimiter(RESIZE_PER_SECOND, 1e3);
   let current = buildInit(options.init, hostOrigin, partnerOrigins, policy);
   let inFlightFetches = 0;
+  let reportsTaken = 0;
   let disposed = false;
   let boundFrame;
   let pendingVisibility;
@@ -508,7 +554,12 @@ function createBridgeHost(options) {
     externalFetchImpl: options.externalFetchImpl ?? defaultUncredentialedFetch,
     hostOrigin,
     toastLimiter: createRateLimiter(TOAST_PER_MINUTE),
-    scheduleResize
+    scheduleResize,
+    takeReportSlot() {
+      if (reportsTaken >= REPORTS_PER_SESSION) return false;
+      reportsTaken += 1;
+      return true;
+    }
   };
   function post(target, envelope) {
     if (disposed) return;
@@ -615,6 +666,7 @@ export {
   IFRAME_ATTRIBUTES,
   MAX_DECODE_PASSES,
   MAX_PARTNER_ORIGINS,
+  REPORTS_PER_SESSION,
   checkPath,
   classifyDestination,
   createBridgeHost,

package/dist/index.cjs

@@ -34,8 +34,15 @@ __export(src_exports, {
   MAX_ENVELOPE_TYPE_LENGTH: () => MAX_ENVELOPE_TYPE_LENGTH,
   MAX_MEDIA_ORIGINS: () => MAX_MEDIA_ORIGINS,
   READY_EVENT: () => READY_EVENT,
+  REPORTS_PER_SESSION: () => REPORTS_PER_SESSION,
+  REPORT_COUNT_MAX: () => REPORT_COUNT_MAX,
+  REPORT_FLUSH_DELAY_MS: () => REPORT_FLUSH_DELAY_MS,
+  REPORT_FRAME_MAX_LENGTH: () => REPORT_FRAME_MAX_LENGTH,
+  REPORT_MAX_FRAMES: () => REPORT_MAX_FRAMES,
+  REPORT_MESSAGE_MAX_LENGTH: () => REPORT_MESSAGE_MAX_LENGTH,
   REQUEST_TIMEOUT_MS: () => REQUEST_TIMEOUT_MS,
   REQUEST_TYPES: () => REQUEST_TYPES,
+  TEMPLATE_REPORT_KINDS: () => TEMPLATE_REPORT_KINDS,
   buildFrameCsp: () => buildFrameCsp,
   createEnvelope: () => createEnvelope,
   createNonce: () => createNonce,
@@ -110,7 +117,8 @@ var REQUEST_TYPES = [
   "resize",
   "track",
   "storage",
-  "log"
+  "log",
+  "report"
 ];
 var HOST_EVENT_TYPES = ["slot.context", "locale", "member", "theme", "visibility"];
 var READY_EVENT = "ready";
@@ -120,6 +128,12 @@ var BRIDGE_SURFACES = ["page", "slot"];
 function isBridgeSurface(value) {
   return BRIDGE_SURFACES.includes(value);
 }
+var TEMPLATE_REPORT_KINDS = ["error", "rejection", "load"];
+var REPORT_MESSAGE_MAX_LENGTH = 300;
+var REPORT_MAX_FRAMES = 10;
+var REPORT_FRAME_MAX_LENGTH = 200;
+var REPORT_COUNT_MAX = 100;
+var REPORTS_PER_SESSION = 5;
 var IFRAME_ATTRIBUTES = {
   sandbox: "allow-scripts",
   allow: "autoplay; fullscreen; picture-in-picture; encrypted-media; clipboard-write",
@@ -616,6 +630,112 @@ function installDirectFetch(g, client, config) {
   return bstageFetch;
 }
 
+// src/frame/errorReport.ts
+function installErrorReport(g, client, config) {
+  const schedule = typeof g.setTimeout === "function" ? g.setTimeout : void 0;
+  const entries = /* @__PURE__ */ new Map();
+  let admitted = 0;
+  function toText(value) {
+    if (typeof value === "string") return value;
+    try {
+      return String(value);
+    } catch {
+      return "";
+    }
+  }
+  function framesOf(stack) {
+    const out = [];
+    if (typeof stack !== "string") return out;
+    const lines = stack.split("\n");
+    for (let i = 0; i < lines.length && out.length < config.maxFrames; i += 1) {
+      const line = lines[i].trim();
+      if (/^at\s/.test(line) || /^[^@]*@(?:[a-z][\w+.-]*:\/\/|\/)\S*:\d+:\d+$/i.test(line) || /^(?:[a-z][\w+.-]*:\/\/|\/)\S*:\d+:\d+$/i.test(line))
+        out.push(line.slice(0, config.maxFrameLength));
+    }
+    return out;
+  }
+  function send(key) {
+    const entry = entries.get(key);
+    if (!entry || entry.sent) return;
+    entries.set(key, {
+      kind: entry.kind,
+      message: entry.message,
+      frames: entry.frames,
+      count: entry.count,
+      sent: true
+    });
+    try {
+      client.request("report", {
+        kind: entry.kind,
+        message: entry.message,
+        frames: entry.frames,
+        count: entry.count
+      }).catch(function() {
+      });
+    } catch {
+    }
+  }
+  function record(kind, message, stack) {
+    try {
+      const text = toText(message).slice(0, config.maxMessageLength);
+      const frames = framesOf(stack);
+      const key = kind + "|" + text.replace(/\d+/g, "") + "|" + (frames[0] || "");
+      const entry = entries.get(key);
+      if (entry) {
+        if (!entry.sent && entry.count < config.maxCount) {
+          entries.set(key, {
+            kind: entry.kind,
+            message: entry.message,
+            frames: entry.frames,
+            count: entry.count + 1,
+            sent: false
+          });
+        }
+        return;
+      }
+      if (admitted >= config.maxReports) return;
+      admitted += 1;
+      entries.set(key, { kind, message: text, frames, count: 1, sent: false });
+      if (admitted >= config.maxReports) stop();
+      if (schedule) {
+        schedule(function() {
+          send(key);
+        }, config.flushDelayMs);
+      } else {
+        send(key);
+      }
+    } catch {
+    }
+  }
+  function onError(ev) {
+    const err = ev && ev.error;
+    if (err && typeof err === "object") {
+      record("error", typeof err.message === "string" ? err.message : ev.message, err.stack);
+      return;
+    }
+    const where = ev && typeof ev.filename === "string" && ev.filename !== "" ? "at " + ev.filename + ":" + toText(ev.lineno) + ":" + toText(ev.colno) : "";
+    record("error", ev ? ev.message : "", where);
+  }
+  function onRejection(ev) {
+    const reason = ev ? ev.reason : void 0;
+    if (reason && typeof reason === "object" && typeof reason.message === "string") {
+      record("rejection", reason.message, reason.stack);
+      return;
+    }
+    record("rejection", reason, "");
+  }
+  function stop() {
+    if (typeof g.removeEventListener !== "function") return;
+    g.removeEventListener("error", onError);
+    g.removeEventListener("unhandledrejection", onRejection);
+  }
+  if (typeof g.addEventListener === "function") {
+    g.addEventListener("error", onError);
+    g.addEventListener("unhandledrejection", onRejection);
+  }
+  return record;
+}
+
 // src/srcdoc/escape.ts
 var HTML_ESCAPES = {
   "&": "&amp;",
@@ -708,6 +828,7 @@ var LOCAL_HOST_NAMES = Object.freeze([
 
 // src/srcdoc/createSrcdoc.ts
 var MAX_MEDIA_ORIGINS = 20;
+var REPORT_FLUSH_DELAY_MS = 1e3;
 var MAX_ELEMENT_NAME_LENGTH = 100;
 var ELEMENT_NAME_RE = /^[a-z][a-z0-9._]*-[a-z0-9._-]*$/;
 function isValidElementName(value) {
@@ -776,6 +897,16 @@ function bootstrapScript(o) {
     // 라우터는 항상 심는다. ready.then이 엔트리 로드(아래 client.ready.then)보다 먼저 등록돼야 템플릿보다 먼저 스냅샷을 잡는다.
     `var installDirectFetch = ${installDirectFetch.toString()};`,
     "installDirectFetch(globalThis, client, { hostOrigin: HOST_ORIGIN });",
+    // 에러 수집기는 엔트리(템플릿)보다 먼저 리스너를 건다. 상한은 호스트 검증기와 같은 프로토콜 값이다.
+    `var installErrorReport = ${installErrorReport.toString()};`,
+    "var reportError = installErrorReport(globalThis, client, {",
+    `  maxReports: ${REPORTS_PER_SESSION},`,
+    `  maxMessageLength: ${REPORT_MESSAGE_MAX_LENGTH},`,
+    `  maxFrames: ${REPORT_MAX_FRAMES},`,
+    `  maxFrameLength: ${REPORT_FRAME_MAX_LENGTH},`,
+    `  maxCount: ${REPORT_COUNT_MAX},`,
+    `  flushDelayMs: ${REPORT_FLUSH_DELAY_MS}`,
+    "});",
     "var lastHeight = -1;",
     "var scheduled = false;",
     "function reportHeight() {",
@@ -792,9 +923,12 @@ function bootstrapScript(o) {
     "}",
     "client.ready.then(function () {",
     "  var script = document.createElement('script');",
+    // crossOrigin은 src보다 먼저 둔다(요청 모드가 src 대입 시점에 정해지는 브라우저가 있다). 주지 않으면 줄 자체가 없다.
+    ...o.crossOrigin === "anonymous" ? ["  script.crossOrigin = 'anonymous';"] : [],
     "  script.src = ENTRY_URL;",
     "  script.onerror = function () {",
     "    client.request('log', { level: 'error', message: 'template entry failed to load' }).catch(function () {});",
+    "    reportError('load', 'template entry failed to load', '');",
     "  };",
     "  document.head.appendChild(script);",
     "  customElements.whenDefined(ELEMENT_NAME).then(function () {",
@@ -820,8 +954,12 @@ function createSrcdoc(options) {
   }
   if (typeof title !== "string") throw new TypeError("[bstage-bridge] title\uC740 \uBB38\uC790\uC5F4\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4");
   const mediaOrigins = normalizeMediaOrigins(options.mediaOrigins);
+  const { crossOrigin } = options;
+  if (crossOrigin !== void 0 && crossOrigin !== "anonymous") {
+    throw new TypeError("[bstage-bridge] crossOrigin\uC740 'anonymous'\uB9CC \uBC1B\uC2B5\uB2C8\uB2E4");
+  }
   const csp = buildFrameCsp(nonce, assetOrigin, mediaOrigins);
-  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName });
+  const script = bootstrapScript({ session, hostOrigin, entryUrl, elementName, crossOrigin });
   if (/<\/script|<!--/i.test(script)) {
     throw new Error("[bstage-bridge] \uBD80\uD2B8\uC2A4\uD2B8\uB7A9 \uC2A4\uD06C\uB9BD\uD2B8\uC5D0 \uC2A4\uD06C\uB9BD\uD2B8 \uC885\uB8CC \uC2DC\uD000\uC2A4\uAC00 \uC788\uC2B5\uB2C8\uB2E4");
   }
@@ -860,8 +998,15 @@ ${script}
   MAX_ENVELOPE_TYPE_LENGTH,
   MAX_MEDIA_ORIGINS,
   READY_EVENT,
+  REPORTS_PER_SESSION,
+  REPORT_COUNT_MAX,
+  REPORT_FLUSH_DELAY_MS,
+  REPORT_FRAME_MAX_LENGTH,
+  REPORT_MAX_FRAMES,
+  REPORT_MESSAGE_MAX_LENGTH,
   REQUEST_TIMEOUT_MS,
   REQUEST_TYPES,
+  TEMPLATE_REPORT_KINDS,
   buildFrameCsp,
   createEnvelope,
   createNonce,