@burdenoff/microfe-bigconsole 2026.1005.4 → 2026.1006.1

package/dist/bigconsole/components/widgets/chart/charts/referenceElements.js

@@ -45,5 +45,3 @@ function i(i, a) {
 }
 //#endregion
 export { i as buildReferenceElements };
-
-//# sourceMappingURL=referenceElements.js.map

package/dist/bigconsole/components/widgets/chart/charts/types.d.ts

@@ -86,4 +86,3 @@ export interface ChartConfig {
     /** Field used to split scatter points into colored groups (optional) */
     colorField?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/bigconsole/components/widgets/chart/index.d.ts

@@ -8,4 +8,3 @@ export { ChartConfig, type ChartConfigProps } from './ChartConfig';
 export { ChartTooltip, type ChartTooltipProps, type ChartTooltipPayload } from './ChartTooltip';
 export { ChartLegend, type ChartLegendProps, type LegendItem } from './ChartLegend';
 export { LineChart, BarChart, AreaChart, PieChart, FunnelChart, type LineChartProps, type BarChartProps, type AreaChartProps, type PieChartProps, type FunnelChartProps, type ChartType, type ChartConfig as ChartTypeConfig, type ChartData, type CurveType, } from './charts';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/comments/WidgetComments.d.ts

@@ -7,4 +7,3 @@ export interface WidgetCommentsProps {
 }
 export declare const WidgetComments: FC<WidgetCommentsProps>;
 export default WidgetComments;
-//# sourceMappingURL=WidgetComments.d.ts.map

package/dist/bigconsole/components/widgets/comments/WidgetComments.js

@@ -223,5 +223,3 @@ var v = ({ comment: e, isReply: t, busy: n, onResolve: r, onDelete: i, onReply:
 };
 //#endregion
 export { b as WidgetComments };
-
-//# sourceMappingURL=WidgetComments.js.map

package/dist/bigconsole/components/widgets/custom/CustomWidget.d.ts

@@ -10,4 +10,3 @@ export interface CustomWidgetProps {
 }
 export declare const CustomWidget: FC<CustomWidgetProps>;
 export default CustomWidget;
-//# sourceMappingURL=CustomWidget.d.ts.map

package/dist/bigconsole/components/widgets/custom/CustomWidget.js

@@ -1,145 +1,87 @@
-import { asNonEmptyString as e, asRecord as t } from "./utils.js";
-import { getCustomConfigContent as n } from "./config.js";
-import { memo as r, useMemo as i } from "react";
-import { jsx as a, jsxs as o } from "react/jsx-runtime";
+import { useOptionalBigConsole as e } from "../../../context/BigConsoleContext.js";
+import "../../../context/index.js";
+import { currentAppOrigin as t, resolveFrameSrc as n } from "../../../utils/safeUrl.js";
+import { asNonEmptyString as r, asRecord as i } from "./utils.js";
+import { getCustomConfigContent as a } from "./config.js";
+import { sanitizeWidgetHtml as o } from "../../../utils/sanitizeHtml.js";
+import { FRAME_REFERRER_POLICY as s, FRAME_SANDBOX as c, frameKey as l } from "../iframe-widget/framePolicy.js";
+import { memo as u, useMemo as d } from "react";
+import { jsx as f, jsxs as p } from "react/jsx-runtime";
 //#region src/bigconsole/components/widgets/custom/CustomWidget.tsx
-var s = "allow-scripts", c = new Set([
-	"allow-forms",
-	"allow-modals",
-	"allow-orientation-lock",
-	"allow-pointer-lock",
-	"allow-popups",
-	"allow-popups-to-escape-sandbox",
-	"allow-presentation",
-	"allow-same-origin",
-	"allow-scripts",
-	"allow-storage-access-by-user-activation"
-]);
-function l(e) {
-	let t = e.trim();
-	if (!t) return !1;
-	if (t.startsWith("#")) return !0;
-	if (t.startsWith("/")) return !t.startsWith("//");
-	try {
-		let e = new URL(t, window.location.origin);
-		return e.protocol === "http:" || e.protocol === "https:";
-	} catch {
-		return !1;
-	}
-}
-function u(e) {
-	return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
-}
-function d(e) {
-	if (typeof window > "u") return u(e);
-	let t = new DOMParser().parseFromString(e, "text/html");
-	return t.body.querySelectorAll("script, style, iframe, object, embed, link, meta, base, form").forEach((e) => {
-		e.remove();
-	}), t.body.querySelectorAll("*").forEach((e) => {
-		Array.from(e.attributes).forEach((t) => {
-			let n = t.name.toLowerCase(), r = t.value.trim();
-			if (n.startsWith("on")) {
-				e.removeAttribute(t.name);
-				return;
-			}
-			if (n === "style") {
-				e.removeAttribute(t.name);
-				return;
-			}
-			[
-				"src",
-				"href",
-				"xlink:href"
-			].includes(n) && !l(r) && e.removeAttribute(t.name);
+var m = u(function({ widget: u, data: m, render: h, onClick: g }) {
+	let _ = u.config, v = !!(g && u.drilldowns?.length), y = d(() => i(m), [m]), b = d(() => i(_), [_]), x = d(() => i(b?.props), [b]), S = d(() => a(_), [_]), C = S.componentId, w = e()?.iframeAllowedOrigins, T = d(() => {
+		let e = r(y?.html) ?? r(y?.contentHtml) ?? S.html;
+		if (!e) return null;
+		let t = o(e);
+		return t.trim().length > 0 ? t : null;
+	}, [y, S]), E = d(() => {
+		let e = r(y?.iframeUrl) ?? r(y?.url) ?? S.iframeUrl;
+		if (!e) return null;
+		let i = n(e, {
+			appOrigin: t(),
+			allowedOrigins: w
 		});
-	}), t.body.innerHTML;
-}
-function f(e) {
-	let t = e.trim();
-	if (!t || t.startsWith("//")) return null;
-	if (t.startsWith("/")) return t;
-	try {
-		let e = new URL(t);
-		if (e.protocol === "http:" || e.protocol === "https:") return e.href;
-	} catch {
-		return null;
-	}
-	return null;
-}
-function p(e) {
-	if (!e) return s;
-	let t = new Set(e.split(/\s+/).filter(Boolean)), n = Array.from(t).filter((e) => c.has(e)), r = n.includes("allow-scripts"), i = n.includes("allow-same-origin"), a = r && i ? n.filter((e) => e !== "allow-same-origin") : n;
-	return a.length > 0 ? a.join(" ") : s;
-}
-var m = r(function({ widget: r, data: s, render: c, onClick: l }) {
-	let u = r.config, m = !!(l && r.drilldowns?.length), h = i(() => t(s), [s]), g = i(() => t(u), [u]), _ = i(() => t(g?.props), [g]), v = i(() => n(u), [u]), y = v.componentId, b = i(() => {
-		let t = e(h?.html) ?? e(h?.contentHtml) ?? v.html;
-		if (!t) return null;
-		let n = d(t);
-		return n.trim().length > 0 ? n : null;
-	}, [h, v]), x = i(() => {
-		let t = e(h?.iframeUrl) ?? e(h?.url) ?? v.iframeUrl;
-		if (!t) return null;
-		let n = f(t);
-		return n ? {
-			url: n,
-			title: e(h?.title) ?? e(_?.iframeTitle) ?? e(_?.title) ?? r.title ?? "Custom widget content",
-			sandbox: p(e(g?.sandbox) ?? e(_?.sandbox))
-		} : null;
+		if (!i.ok) return null;
+		let a = r(y?.title) ?? r(x?.iframeTitle) ?? r(x?.title) ?? u.title ?? "Custom widget content";
+		return {
+			url: i.src,
+			title: a
+		};
 	}, [
-		h,
-		v,
-		_,
-		g,
-		r.title
+		y,
+		S,
+		x,
+		u.title,
+		w
 	]);
-	if (c) return /* @__PURE__ */ a("div", {
+	if (h) return /* @__PURE__ */ f("div", {
 		className: `
           h-full
-          ${m ? "cursor-pointer" : ""}
+          ${v ? "cursor-pointer" : ""}
         `,
-		onClick: l,
-		children: c(r, s)
+		onClick: g,
+		children: h(u, m)
 	});
-	if (b) return /* @__PURE__ */ a("div", {
+	if (T) return /* @__PURE__ */ f("div", {
 		className: "h-full overflow-auto p-4",
-		children: /* @__PURE__ */ a("div", {
+		children: /* @__PURE__ */ f("div", {
 			className: "prose prose-sm max-w-none text-text-primary",
-			dangerouslySetInnerHTML: { __html: b }
+			dangerouslySetInnerHTML: { __html: T }
 		})
 	});
-	if (x) return /* @__PURE__ */ a("div", {
+	if (E) return /* @__PURE__ */ f("div", {
 		className: "h-full w-full",
-		children: /* @__PURE__ */ a("iframe", {
-			src: x.url,
-			title: x.title,
+		children: /* @__PURE__ */ f("iframe", {
+			sandbox: c,
+			referrerPolicy: s,
+			loading: "lazy",
+			title: E.title,
 			className: "h-full w-full rounded border-0",
-			sandbox: x.sandbox,
-			loading: "lazy"
-		})
+			src: E.url
+		}, l(E.url, c))
 	});
-	if (h && "value" in h) {
-		let e = h.value, t = h.label || r.title, n = h.data;
-		return /* @__PURE__ */ o("div", {
-			className: `flex flex-col items-center justify-center h-full p-4 ${m ? "cursor-pointer hover:bg-bg-sunken/50 transition-colors" : ""}`,
-			onClick: l,
+	if (y && "value" in y) {
+		let e = y.value, t = y.label || u.title, n = y.data;
+		return /* @__PURE__ */ p("div", {
+			className: `flex flex-col items-center justify-center h-full p-4 ${v ? "cursor-pointer hover:bg-bg-sunken/50 transition-colors" : ""}`,
+			onClick: g,
 			children: [
-				/* @__PURE__ */ a("div", {
+				/* @__PURE__ */ f("div", {
 					className: "text-4xl font-bold text-text-primary tabular-nums",
 					children: typeof e == "number" ? e.toLocaleString() : String(e)
 				}),
-				/* @__PURE__ */ a("div", {
+				/* @__PURE__ */ f("div", {
 					className: "text-sm text-text-secondary mt-1",
 					children: t
 				}),
-				n && /* @__PURE__ */ a("div", {
+				n && /* @__PURE__ */ f("div", {
 					className: "mt-3 w-full grid grid-cols-2 gap-2 text-xs text-text-secondary",
-					children: Object.entries(n).filter(([e]) => e !== "value" && e !== "label" && typeof n[e] != "object").slice(0, 4).map(([e, t]) => /* @__PURE__ */ o("div", {
+					children: Object.entries(n).filter(([e]) => e !== "value" && e !== "label" && typeof n[e] != "object").slice(0, 4).map(([e, t]) => /* @__PURE__ */ p("div", {
 						className: "flex justify-between px-2 py-1 bg-bg-sunken rounded",
-						children: [/* @__PURE__ */ a("span", {
+						children: [/* @__PURE__ */ f("span", {
 							className: "capitalize",
 							children: e.replace(/([A-Z])/g, " $1").trim()
-						}), /* @__PURE__ */ a("span", {
+						}), /* @__PURE__ */ f("span", {
 							className: "font-medium",
 							children: typeof t == "number" ? t.toLocaleString() : String(t)
 						})]
@@ -148,21 +90,21 @@ var m = r(function({ widget: r, data: s, render: c, onClick: l }) {
 			]
 		});
 	}
-	return /* @__PURE__ */ o("div", {
+	return /* @__PURE__ */ p("div", {
 		className: `
         flex flex-col items-center justify-center h-full p-4
-        ${m ? "cursor-pointer hover:bg-bg-sunken/50 transition-colors" : ""}
+        ${v ? "cursor-pointer hover:bg-bg-sunken/50 transition-colors" : ""}
       `,
-		onClick: l,
+		onClick: g,
 		children: [
-			/* @__PURE__ */ a("div", {
+			/* @__PURE__ */ f("div", {
 				className: "w-16 h-16 mb-4 flex items-center justify-center rounded-lg bg-bg-sunken",
-				children: /* @__PURE__ */ a("svg", {
+				children: /* @__PURE__ */ f("svg", {
 					className: "w-8 h-8 text-text-secondary",
 					fill: "none",
 					stroke: "currentColor",
 					viewBox: "0 0 24 24",
-					children: /* @__PURE__ */ a("path", {
+					children: /* @__PURE__ */ f("path", {
 						strokeLinecap: "round",
 						strokeLinejoin: "round",
 						strokeWidth: 2,
@@ -170,26 +112,26 @@ var m = r(function({ widget: r, data: s, render: c, onClick: l }) {
 					})
 				})
 			}),
-			/* @__PURE__ */ a("h4", {
+			/* @__PURE__ */ f("h4", {
 				className: "text-sm font-medium text-text-primary mb-1",
 				children: "Custom Widget"
 			}),
-			/* @__PURE__ */ a("p", {
+			/* @__PURE__ */ f("p", {
 				className: "text-xs text-text-secondary text-center max-w-[200px]",
-				children: u?.description || "Provide HTML, an iframe URL, or a registered custom component."
+				children: _?.description || "Provide HTML, an iframe URL, or a registered custom component."
 			}),
-			y ? /* @__PURE__ */ o("p", {
+			C ? /* @__PURE__ */ p("p", {
 				className: "text-xs text-text-secondary mt-2",
-				children: ["Component: ", /* @__PURE__ */ a("code", {
+				children: ["Component: ", /* @__PURE__ */ f("code", {
 					className: "font-mono",
-					children: y
+					children: C
 				})]
 			}) : null,
-			s ? /* @__PURE__ */ a("div", {
+			m ? /* @__PURE__ */ f("div", {
 				className: "mt-4 w-full max-h-[100px] overflow-auto",
-				children: /* @__PURE__ */ a("pre", {
+				children: /* @__PURE__ */ f("pre", {
 					className: "text-xs text-text-secondary bg-bg-sunken p-2 rounded",
-					children: JSON.stringify(s, null, 2)
+					children: JSON.stringify(m, null, 2)
 				})
 			}) : null
 		]
@@ -197,5 +139,3 @@ var m = r(function({ widget: r, data: s, render: c, onClick: l }) {
 });
 //#endregion
 export { m as default };
-
-//# sourceMappingURL=CustomWidget.js.map

package/dist/bigconsole/components/widgets/custom/config.d.ts

@@ -6,4 +6,3 @@ export interface CustomConfigContent {
 export declare function getCustomConfigContent(config: unknown): CustomConfigContent;
 export declare function hasRenderableCustomConfig(config: unknown): boolean;
 export declare function hasCustomIframeConfig(config: unknown): boolean;
-//# sourceMappingURL=config.d.ts.map

package/dist/bigconsole/components/widgets/custom/config.js

@@ -17,5 +17,3 @@ function i(e) {
 }
 //#endregion
 export { n as getCustomConfigContent, i as hasCustomIframeConfig, r as hasRenderableCustomConfig };
-
-//# sourceMappingURL=config.js.map

package/dist/bigconsole/components/widgets/custom/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { getCustomConfigContent, hasRenderableCustomConfig, hasCustomIframeConfig, type CustomConfigContent, } from './config';
 export { CustomWidget, type CustomWidgetProps } from './CustomWidget';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/custom/utils.d.ts

@@ -1,4 +1,3 @@
 export type JsonRecord = Record<string, unknown>;
 export declare function asRecord(value: unknown): JsonRecord | null;
 export declare function asNonEmptyString(value: unknown): string | null;
-//# sourceMappingURL=utils.d.ts.map

package/dist/bigconsole/components/widgets/custom/utils.js

@@ -9,5 +9,3 @@ function t(e) {
 }
 //#endregion
 export { t as asNonEmptyString, e as asRecord };
-
-//# sourceMappingURL=utils.js.map

package/dist/bigconsole/components/widgets/event-logs/EventLogViewer.d.ts

@@ -13,4 +13,3 @@ export interface EventLogViewerProps {
 }
 export declare const EventLogViewer: React.FC<EventLogViewerProps>;
 export default EventLogViewer;
-//# sourceMappingURL=EventLogViewer.d.ts.map

package/dist/bigconsole/components/widgets/event-logs/EventLogViewer.js

@@ -426,5 +426,3 @@ var m = i(function({ log: e, onRetry: i, retrying: a, expanded: o, onToggleExpan
 });
 //#endregion
 export { h as default };
-
-//# sourceMappingURL=EventLogViewer.js.map

package/dist/bigconsole/components/widgets/event-logs/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { EventLogViewer, type EventLogViewerProps } from './EventLogViewer';
 export { default } from './EventLogViewer';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/form/FormWidget.d.ts

@@ -43,4 +43,3 @@ export interface NormalizedFormData {
 export declare function normalizeFormData(data: Record<string, unknown> | undefined, fields: FormField[]): NormalizedFormData;
 export declare const FormWidget: FC<FormWidgetProps>;
 export default FormWidget;
-//# sourceMappingURL=FormWidget.d.ts.map

package/dist/bigconsole/components/widgets/form/FormWidget.js

@@ -524,5 +524,3 @@ var g = {
 });
 //#endregion
 export { _ as default, h as normalizeFormData };
-
-//# sourceMappingURL=FormWidget.js.map

package/dist/bigconsole/components/widgets/form/index.d.ts

@@ -3,4 +3,3 @@
  */
 export { FormWidget, normalizeFormData, type FormWidgetProps, type FormConfig, type FormField, type FieldType, type SelectOption, type ValidationRule, type NormalizedFormData, } from './FormWidget';
 export { default } from './FormWidget';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/funnel/index.d.ts

@@ -9,4 +9,3 @@ export interface FunnelWidgetProps {
 }
 export declare const FunnelWidget: FC<FunnelWidgetProps>;
 export default FunnelWidget;
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/funnel/index.js

@@ -18,5 +18,3 @@ var r = t(function({ widget: t, data: r, onClick: i }) {
 });
 //#endregion
 export { r as FunnelWidget, r as default };
-
-//# sourceMappingURL=index.js.map

package/dist/bigconsole/components/widgets/gauge/CircularGauge.d.ts

@@ -39,4 +39,3 @@ export interface CircularGaugeProps {
 export declare function gaugeSpan(min: number, max: number): number;
 export declare const CircularGauge: FC<CircularGaugeProps>;
 export default CircularGauge;
-//# sourceMappingURL=CircularGauge.d.ts.map

package/dist/bigconsole/components/widgets/gauge/CircularGauge.js

@@ -77,5 +77,3 @@ var o = e(function({ value: e, min: o = 0, max: s = 100, size: c = 120, strokeWi
 });
 //#endregion
 export { o as default, i as gaugeSpan };
-
-//# sourceMappingURL=CircularGauge.js.map

package/dist/bigconsole/components/widgets/gauge/GaugeConfig.d.ts

@@ -9,4 +9,3 @@ export interface GaugeConfigProps {
 }
 export declare const GaugeConfig: FC<GaugeConfigProps>;
 export default GaugeConfig;
-//# sourceMappingURL=GaugeConfig.d.ts.map

package/dist/bigconsole/components/widgets/gauge/GaugeConfig.js

@@ -202,5 +202,3 @@ var a = [
 });
 //#endregion
 export { o as default };
-
-//# sourceMappingURL=GaugeConfig.js.map

package/dist/bigconsole/components/widgets/gauge/GaugeWidget.d.ts

@@ -19,4 +19,3 @@ export interface GaugeData {
 }
 export declare const GaugeWidget: FC<GaugeWidgetProps>;
 export default GaugeWidget;
-//# sourceMappingURL=GaugeWidget.d.ts.map

package/dist/bigconsole/components/widgets/gauge/GaugeWidget.js

@@ -242,5 +242,3 @@ var g = r(function({ widget: r, data: c, onClick: l, onDrilldown: u }) {
 });
 //#endregion
 export { g as default };
-
-//# sourceMappingURL=GaugeWidget.js.map

package/dist/bigconsole/components/widgets/gauge/LinearGauge.d.ts

@@ -25,4 +25,3 @@ export interface LinearGaugeProps {
 }
 export declare const LinearGauge: FC<LinearGaugeProps>;
 export default LinearGauge;
-//# sourceMappingURL=LinearGauge.d.ts.map

package/dist/bigconsole/components/widgets/gauge/LinearGauge.js

@@ -89,5 +89,3 @@ var o = t(function({ value: t, min: o = 0, max: s = 100, height: c = 12, thresho
 });
 //#endregion
 export { o as default };
-
-//# sourceMappingURL=LinearGauge.js.map

package/dist/bigconsole/components/widgets/gauge/index.d.ts

@@ -7,4 +7,3 @@ export { GaugeWidget, type GaugeWidgetProps, type GaugeData } from './GaugeWidge
 export { GaugeConfig, type GaugeConfigProps } from './GaugeConfig';
 export { CircularGauge, type CircularGaugeProps, type ThresholdConfig } from './CircularGauge';
 export { LinearGauge, type LinearGaugeProps } from './LinearGauge';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/heatmap/HeatmapConfig.d.ts

@@ -9,4 +9,3 @@ export interface HeatmapConfigProps {
 }
 export declare const HeatmapConfig: FC<HeatmapConfigProps>;
 export default HeatmapConfig;
-//# sourceMappingURL=HeatmapConfig.d.ts.map

package/dist/bigconsole/components/widgets/heatmap/HeatmapConfig.js

@@ -125,5 +125,3 @@ var o = "\n  w-full px-3 py-2\n  text-sm text-text-primary\n  bg-bg-surface\n  b
 });
 //#endregion
 export { s as default };
-
-//# sourceMappingURL=HeatmapConfig.js.map

package/dist/bigconsole/components/widgets/heatmap/HeatmapWidget.d.ts

@@ -35,4 +35,3 @@ declare const COLOR_RAMPS: {
 export type HeatmapColorScheme = keyof typeof COLOR_RAMPS;
 export declare const HeatmapWidget: FC<HeatmapWidgetProps>;
 export default HeatmapWidget;
-//# sourceMappingURL=HeatmapWidget.d.ts.map

package/dist/bigconsole/components/widgets/heatmap/HeatmapWidget.js

@@ -114,5 +114,3 @@ var c = e(function({ widget: e, data: a, onClick: c }) {
 });
 //#endregion
 export { c as default };
-
-//# sourceMappingURL=HeatmapWidget.js.map

package/dist/bigconsole/components/widgets/heatmap/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { HeatmapWidget, type HeatmapWidgetProps, type HeatmapData, type HeatmapCell } from './HeatmapWidget';
 export { HeatmapConfig, type HeatmapConfigProps } from './HeatmapConfig';
-//# sourceMappingURL=index.d.ts.map

package/dist/bigconsole/components/widgets/iframe-widget/IframeWidget.d.ts

@@ -1,31 +1,49 @@
 import { FC } from 'react';
 import { Widget } from '../../../types';
+import { FrameSrcContext, FrameSrcRejection } from '../../../utils/safeUrl';
+import { FRAME_REFERRER_POLICY } from './framePolicy';
 
 export interface IframeWidgetProps {
     widget: Widget;
     data?: IframeData;
 }
+/** Fields parser output may provide. Only `url` and `title` are used. */
 export interface IframeData {
     url?: string;
     title?: string;
+    /** Ignored: fullscreen is a widget configuration setting. */
     allowFullscreen?: boolean;
+    /** Ignored: the sandbox is fixed by the frame policy. */
     sandbox?: string;
+    /** Ignored: loading is a widget configuration setting. */
     loading?: 'lazy' | 'eager';
 }
+export interface ResolvedIframeConfig {
+    /** Validated frame source, or `null` when none was given or it was rejected. */
+    src: string | null;
+    title: string;
+    sandbox: string;
+    referrerPolicy: typeof FRAME_REFERRER_POLICY;
+    allowFullscreen: boolean;
+    /** Permissions Policy for the frame (`allow` attribute). */
+    allow: string | undefined;
+    loading: 'lazy' | 'eager';
+    /** Whether a URL was supplied at all. */
+    hasUrl: boolean;
+    /** Why the supplied URL cannot be embedded; `null` when it can (or none was given). */
+    rejection: FrameSrcRejection | null;
+}
 /**
  * Resolve the effective iframe configuration.
  *
- * Priority (highest first):
- * 1. Parser-provided `data` fields
- * 2. User-configured `widget.config` fields
- * 3. Safe defaults (empty URL, restricted sandbox, no fullscreen)
+ * - `url` and `title`: parser `data` first, then `widget.config`.
+ * - `allowFullscreen` and `loading`: `widget.config` only.
+ * - `sandbox`, referrer policy and permissions: fixed by the frame policy;
+ *   any `sandbox` value in data or config is ignored.
  *
- * This is the function the widget tests exercise directly; keeping the merge
- * logic pure makes the DataSink → Parser → Widget contract explicit.
+ * The URL is validated by {@link resolveFrameSrc}; `context` supplies the app
+ * origin and the optional origin allowlist.
  */
-export declare function resolveIframeConfig(widgetConfig: Record<string, unknown> | undefined, data: IframeData | undefined): Required<IframeData> & {
-    hasUrl: boolean;
-};
+export declare function resolveIframeConfig(widgetConfig: Record<string, unknown> | undefined, data: IframeData | undefined, context?: FrameSrcContext): ResolvedIframeConfig;
 export declare const IframeWidget: FC<IframeWidgetProps>;
 export default IframeWidget;
-//# sourceMappingURL=IframeWidget.d.ts.map