@burdenoff/microfe-bigconsole 2026.1011.10 → 2026.1012.2

package/dist/bigconsole/components/widgets/gauge/GaugeConfig.js

@@ -1,6 +1,6 @@
 import { memo as e, useCallback as t } from "react";
-import { useI18n as n } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
-import { jsx as r, jsxs as i } from "react/jsx-runtime";
+import { jsx as n, jsxs as r } from "react/jsx-runtime";
+import { useI18n as i } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
 //#region src/bigconsole/components/widgets/gauge/GaugeConfig.tsx
 var a = [
 	{
@@ -16,7 +16,7 @@ var a = [
 		color: "success"
 	}
 ], o = e(function({ config: e, onChange: o }) {
-	let { t: s } = n(), c = t((t, n) => {
+	let { t: s } = i(), c = t((t, n) => {
 		o({
 			...e,
 			[t]: n
@@ -37,97 +37,97 @@ var a = [
 		};
 		c("thresholds", r);
 	}, [e.thresholds, c]);
-	return /* @__PURE__ */ i("div", {
+	return /* @__PURE__ */ r("div", {
 		className: "min-w-0 space-y-form-gap",
 		children: [
-			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
+			/* @__PURE__ */ r("div", { children: [/* @__PURE__ */ n("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: s("bigconsole.widget.config.gauge.gaugeType", "Gauge Type")
-			}), /* @__PURE__ */ i("select", {
+			}), /* @__PURE__ */ r("select", {
 				value: e.variant || "circular",
 				onChange: (e) => c("variant", e.target.value),
 				className: "\n            w-full px-3 py-2\n            text-sm text-text-primary\n            bg-bg-surface\n            border border-border-default\n            rounded-md\n            focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n          ",
-				children: [/* @__PURE__ */ r("option", {
+				children: [/* @__PURE__ */ n("option", {
 					value: "circular",
 					children: s("bigconsole.widget.config.gauge.variant.circular", "Circular")
-				}), /* @__PURE__ */ r("option", {
+				}), /* @__PURE__ */ n("option", {
 					value: "linear",
 					children: s("bigconsole.widget.config.gauge.variant.linear", "Linear")
 				})]
 			})] }),
-			/* @__PURE__ */ i("div", {
+			/* @__PURE__ */ r("div", {
 				className: "grid grid-cols-1 gap-3 sm:grid-cols-2",
-				children: [/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
+				children: [/* @__PURE__ */ r("div", { children: [/* @__PURE__ */ n("label", {
 					className: "block text-sm font-medium text-text-primary mb-1",
 					children: s("bigconsole.widget.config.gauge.minimum", "Minimum")
-				}), /* @__PURE__ */ r("input", {
+				}), /* @__PURE__ */ n("input", {
 					type: "number",
 					value: e.min ?? 0,
 					onChange: (e) => c("min", Number(e.target.value)),
 					className: "\n              w-full px-3 py-2\n              text-sm text-text-primary\n              bg-bg-surface\n              border border-border-default\n              rounded-md\n              focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n            "
-				})] }), /* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
+				})] }), /* @__PURE__ */ r("div", { children: [/* @__PURE__ */ n("label", {
 					className: "block text-sm font-medium text-text-primary mb-1",
 					children: s("bigconsole.widget.config.gauge.maximum", "Maximum")
-				}), /* @__PURE__ */ r("input", {
+				}), /* @__PURE__ */ n("input", {
 					type: "number",
 					value: e.max ?? 100,
 					onChange: (e) => c("max", Number(e.target.value)),
 					className: "\n              w-full px-3 py-2\n              text-sm text-text-primary\n              bg-bg-surface\n              border border-border-default\n              rounded-md\n              focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n            "
 				})] })]
 			}),
-			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
+			/* @__PURE__ */ r("div", { children: [/* @__PURE__ */ n("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: s("bigconsole.widget.config.gauge.unitLabel", "Unit Label")
-			}), /* @__PURE__ */ r("input", {
+			}), /* @__PURE__ */ n("input", {
 				type: "text",
 				value: e.unit || "",
 				onChange: (e) => c("unit", e.target.value),
 				placeholder: s("bigconsole.widget.config.gauge.unitPlaceholder", "e.g., %, ms, users"),
 				className: "\n            w-full px-3 py-2\n            text-sm text-text-primary\n            bg-bg-surface\n            border border-border-default\n            rounded-md\n            focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n          "
 			})] }),
-			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
+			/* @__PURE__ */ r("div", { children: [/* @__PURE__ */ n("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: s("bigconsole.widget.config.gauge.valueFormat", "Value Format")
-			}), /* @__PURE__ */ i("select", {
+			}), /* @__PURE__ */ r("select", {
 				value: e.format || "number",
 				onChange: (e) => c("format", e.target.value),
 				className: "\n            w-full px-3 py-2\n            text-sm text-text-primary\n            bg-bg-surface\n            border border-border-default\n            rounded-md\n            focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n          ",
 				children: [
-					/* @__PURE__ */ r("option", {
+					/* @__PURE__ */ n("option", {
 						value: "number",
 						children: s("bigconsole.widget.config.gauge.format.number", "Number")
 					}),
-					/* @__PURE__ */ r("option", {
+					/* @__PURE__ */ n("option", {
 						value: "percentage",
 						children: s("bigconsole.widget.config.gauge.format.percentage", "Percentage")
 					}),
-					/* @__PURE__ */ r("option", {
+					/* @__PURE__ */ n("option", {
 						value: "currency",
 						children: s("bigconsole.widget.config.gauge.format.currency", "Currency")
 					})
 				]
 			})] }),
-			/* @__PURE__ */ i("div", { children: [
-				/* @__PURE__ */ r("label", {
+			/* @__PURE__ */ r("div", { children: [
+				/* @__PURE__ */ n("label", {
 					className: "block text-sm font-medium text-text-primary mb-2",
 					children: s("bigconsole.widget.config.gauge.colorThresholds", "Color Thresholds")
 				}),
-				/* @__PURE__ */ r("p", {
+				/* @__PURE__ */ n("p", {
 					className: "text-xs text-text-secondary mb-3",
 					children: s("bigconsole.widget.config.gauge.colorThresholdsHelp", "Define color zones based on value ranges. Values up to each threshold will use that color.")
 				}),
-				/* @__PURE__ */ i("div", {
+				/* @__PURE__ */ r("div", {
 					className: "space-y-2",
 					children: [
-						/* @__PURE__ */ i("div", {
+						/* @__PURE__ */ r("div", {
 							className: "flex items-center gap-2",
 							children: [
-								/* @__PURE__ */ r("div", { className: "w-4 h-4 rounded bg-status-error-bg" }),
-								/* @__PURE__ */ r("span", {
+								/* @__PURE__ */ n("div", { className: "w-4 h-4 rounded bg-status-error-bg" }),
+								/* @__PURE__ */ n("span", {
 									className: "text-sm text-text-primary flex-1",
 									children: s("bigconsole.widget.config.gauge.threshold.danger", "Danger (Red)")
 								}),
-								/* @__PURE__ */ r("input", {
+								/* @__PURE__ */ n("input", {
 									type: "number",
 									value: e.thresholds?.[0]?.value ?? 33,
 									onChange: (e) => l(0, e.target.value),
@@ -135,15 +135,15 @@ var a = [
 								})
 							]
 						}),
-						/* @__PURE__ */ i("div", {
+						/* @__PURE__ */ r("div", {
 							className: "flex items-center gap-2",
 							children: [
-								/* @__PURE__ */ r("div", { className: "w-4 h-4 rounded bg-status-warning-bg" }),
-								/* @__PURE__ */ r("span", {
+								/* @__PURE__ */ n("div", { className: "w-4 h-4 rounded bg-status-warning-bg" }),
+								/* @__PURE__ */ n("span", {
 									className: "text-sm text-text-primary flex-1",
 									children: s("bigconsole.widget.config.gauge.threshold.warning", "Warning (Yellow)")
 								}),
-								/* @__PURE__ */ r("input", {
+								/* @__PURE__ */ n("input", {
 									type: "number",
 									value: e.thresholds?.[1]?.value ?? 66,
 									onChange: (e) => l(1, e.target.value),
@@ -151,15 +151,15 @@ var a = [
 								})
 							]
 						}),
-						/* @__PURE__ */ i("div", {
+						/* @__PURE__ */ r("div", {
 							className: "flex items-center gap-2",
 							children: [
-								/* @__PURE__ */ r("div", { className: "w-4 h-4 rounded bg-status-success-bg" }),
-								/* @__PURE__ */ r("span", {
+								/* @__PURE__ */ n("div", { className: "w-4 h-4 rounded bg-status-success-bg" }),
+								/* @__PURE__ */ n("span", {
 									className: "text-sm text-text-primary flex-1",
 									children: s("bigconsole.widget.config.gauge.threshold.good", "Good (Green)")
 								}),
-								/* @__PURE__ */ r("input", {
+								/* @__PURE__ */ n("input", {
 									type: "number",
 									value: e.thresholds?.[2]?.value ?? 100,
 									onChange: (e) => l(2, e.target.value),
@@ -170,28 +170,28 @@ var a = [
 					]
 				})
 			] }),
-			/* @__PURE__ */ i("div", {
+			/* @__PURE__ */ r("div", {
 				role: "group",
 				"aria-label": "Display options",
 				className: "space-y-3 border-t border-[var(--color-border-subtle)] pt-form-gap",
 				children: [
-					/* @__PURE__ */ r("p", {
+					/* @__PURE__ */ n("p", {
 						className: "text-xs font-bold uppercase tracking-wider text-text-secondary",
 						children: "Display options"
 					}),
-					e.variant === "linear" && /* @__PURE__ */ i("label", {
+					e.variant === "linear" && /* @__PURE__ */ r("label", {
 						className: "flex items-center gap-3",
-						children: [/* @__PURE__ */ r("input", {
+						children: [/* @__PURE__ */ n("input", {
 							type: "checkbox",
 							checked: e.showZones === !0,
 							onChange: (e) => c("showZones", e.target.checked),
 							className: "\n              w-4 h-4\n              text-action-primary-bg\n              bg-bg-surface\n              border-border-default\n              rounded\n              focus:ring-action-primary-bg\n            "
-						}), /* @__PURE__ */ r("span", {
+						}), /* @__PURE__ */ n("span", {
 							className: "text-sm text-text-primary",
 							children: s("bigconsole.widget.config.gauge.showZones", "Show color zones in background")
 						})]
 					}),
-					e.variant !== "linear" && /* @__PURE__ */ r("p", {
+					e.variant !== "linear" && /* @__PURE__ */ n("p", {
 						className: "text-xs text-text-secondary",
 						children: s("bigconsole.widget.config.gauge.noCircularOptions", "No display options for the circular gauge.")
 					})

package/dist/bigconsole/components/widgets/heatmap/HeatmapConfig.js

@@ -1,9 +1,9 @@
 import { memo as e, useCallback as t, useMemo as n } from "react";
-import { useI18n as r } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
-import { jsx as i, jsxs as a } from "react/jsx-runtime";
+import { jsx as r, jsxs as i } from "react/jsx-runtime";
+import { useI18n as a } from "@burdenoff/fe-libs/shared/providers/shell/I18nProvider";
 //#region src/bigconsole/components/widgets/heatmap/HeatmapConfig.tsx
 var o = "\n  w-full px-3 py-2\n  text-sm text-text-primary\n  bg-bg-surface\n  border border-border-default\n  rounded-md\n  focus:outline-none focus:ring-2 focus:ring-action-primary-bg\n", s = e(function({ config: e, onChange: s }) {
-	let { t: c } = r(), l = n(() => [
+	let { t: c } = a(), l = n(() => [
 		{
 			value: "blue",
 			label: c("bigconsole.widget.config.heatmap.colorScheme.blue", "Blue")
@@ -22,62 +22,62 @@ var o = "\n  w-full px-3 py-2\n  text-sm text-text-primary\n  bg-bg-surface\n  b
 			[t]: n
 		});
 	}, [e, s]);
-	return /* @__PURE__ */ a("div", {
+	return /* @__PURE__ */ i("div", {
 		className: "min-w-0 space-y-form-gap",
 		children: [
-			/* @__PURE__ */ a("div", { children: [/* @__PURE__ */ i("label", {
+			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: c("bigconsole.widget.config.heatmap.xAxisFieldLabel", "X-Axis Field")
-			}), /* @__PURE__ */ i("input", {
+			}), /* @__PURE__ */ r("input", {
 				type: "text",
 				value: e.xAxisField || "",
 				onChange: (e) => u("xAxisField", e.target.value),
 				placeholder: c("bigconsole.widget.config.heatmap.xAxisFieldPlaceholder", "e.g., hour, column"),
 				className: o
 			})] }),
-			/* @__PURE__ */ a("div", { children: [/* @__PURE__ */ i("label", {
+			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: c("bigconsole.widget.config.heatmap.yAxisFieldLabel", "Y-Axis Field")
-			}), /* @__PURE__ */ i("input", {
+			}), /* @__PURE__ */ r("input", {
 				type: "text",
 				value: e.yAxisField || "",
 				onChange: (e) => u("yAxisField", e.target.value),
 				placeholder: c("bigconsole.widget.config.heatmap.yAxisFieldPlaceholder", "e.g., day, row"),
 				className: o
 			})] }),
-			/* @__PURE__ */ a("div", { children: [
-				/* @__PURE__ */ i("label", {
+			/* @__PURE__ */ i("div", { children: [
+				/* @__PURE__ */ r("label", {
 					className: "block text-sm font-medium text-text-primary mb-1",
 					children: c("bigconsole.widget.config.heatmap.valueFieldLabel", "Value Field")
 				}),
-				/* @__PURE__ */ i("input", {
+				/* @__PURE__ */ r("input", {
 					type: "text",
 					value: e.valueField || "",
 					onChange: (e) => u("valueField", e.target.value),
 					placeholder: c("bigconsole.widget.config.heatmap.valueFieldPlaceholder", "e.g., tickets, count"),
 					className: o
 				}),
-				/* @__PURE__ */ i("p", {
+				/* @__PURE__ */ r("p", {
 					className: "mt-1 text-xs text-text-secondary",
 					children: c("bigconsole.widget.config.heatmap.valueFieldHelp", "Left empty, the widget reads the parser's rows / columns / cells output directly.")
 				})
 			] }),
-			/* @__PURE__ */ a("div", { children: [/* @__PURE__ */ i("label", {
+			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: c("bigconsole.widget.config.heatmap.colorSchemeLabel", "Color Scheme")
-			}), /* @__PURE__ */ i("select", {
+			}), /* @__PURE__ */ r("select", {
 				value: e.colorScheme || "blue",
 				onChange: (e) => u("colorScheme", e.target.value),
 				className: o,
-				children: l.map((e) => /* @__PURE__ */ i("option", {
+				children: l.map((e) => /* @__PURE__ */ r("option", {
 					value: e.value,
 					children: e.label
 				}, e.value))
 			})] }),
-			/* @__PURE__ */ a("div", { children: [/* @__PURE__ */ i("label", {
+			/* @__PURE__ */ i("div", { children: [/* @__PURE__ */ r("label", {
 				className: "block text-sm font-medium text-text-primary mb-1",
 				children: c("bigconsole.widget.config.heatmap.decimalPlacesLabel", "Decimal Places")
-			}), /* @__PURE__ */ i("input", {
+			}), /* @__PURE__ */ r("input", {
 				type: "number",
 				min: 0,
 				max: 6,
@@ -85,35 +85,35 @@ var o = "\n  w-full px-3 py-2\n  text-sm text-text-primary\n  bg-bg-surface\n  b
 				onChange: (e) => u("decimals", Number(e.target.value)),
 				className: o
 			})] }),
-			/* @__PURE__ */ a("div", {
+			/* @__PURE__ */ i("div", {
 				role: "group",
 				"aria-label": "Display options",
 				className: "space-y-3 border-t border-[var(--color-border-subtle)] pt-form-gap",
 				children: [
-					/* @__PURE__ */ i("p", {
+					/* @__PURE__ */ r("p", {
 						className: "text-xs font-bold uppercase tracking-wider text-text-secondary",
 						children: "Display options"
 					}),
-					/* @__PURE__ */ a("label", {
+					/* @__PURE__ */ i("label", {
 						className: "flex items-center gap-3",
-						children: [/* @__PURE__ */ i("input", {
+						children: [/* @__PURE__ */ r("input", {
 							type: "checkbox",
 							checked: e.showValues !== !1,
 							onChange: (e) => u("showValues", e.target.checked),
 							className: "\n            w-4 h-4\n            text-action-primary-bg\n            bg-bg-surface\n            border-border-default\n            rounded\n            focus:ring-action-primary-bg\n          "
-						}), /* @__PURE__ */ i("span", {
+						}), /* @__PURE__ */ r("span", {
 							className: "text-sm text-text-primary",
 							children: c("bigconsole.widget.config.heatmap.showValues", "Show cell values")
 						})]
 					}),
-					/* @__PURE__ */ a("label", {
+					/* @__PURE__ */ i("label", {
 						className: "flex items-center gap-3",
-						children: [/* @__PURE__ */ i("input", {
+						children: [/* @__PURE__ */ r("input", {
 							type: "checkbox",
 							checked: e.showLegend !== !1,
 							onChange: (e) => u("showLegend", e.target.checked),
 							className: "\n            w-4 h-4\n            text-action-primary-bg\n            bg-bg-surface\n            border-border-default\n            rounded\n            focus:ring-action-primary-bg\n          "
-						}), /* @__PURE__ */ i("span", {
+						}), /* @__PURE__ */ r("span", {
 							className: "text-sm text-text-primary",
 							children: c("bigconsole.widget.config.heatmap.showLegend", "Show color legend")
 						})]

package/dist/bigconsole/components/widgets/iframe-widget/IframeWidget.d.ts

@@ -1,30 +1,49 @@
 import { FC } from 'react';
 import { Widget } from '../../../types';
+import { FrameSrcContext, FrameSrcRejection } from '../../../utils/safeUrl';
+import { FRAME_REFERRER_POLICY } from './framePolicy';
 
 export interface IframeWidgetProps {
     widget: Widget;
     data?: IframeData;
 }
+/** Fields parser output may provide. Only `url` and `title` are used. */
 export interface IframeData {
     url?: string;
     title?: string;
+    /** Ignored: fullscreen is a widget configuration setting. */
     allowFullscreen?: boolean;
+    /** Ignored: the sandbox is fixed by the frame policy. */
     sandbox?: string;
+    /** Ignored: loading is a widget configuration setting. */
     loading?: 'lazy' | 'eager';
 }
+export interface ResolvedIframeConfig {
+    /** Validated frame source, or `null` when none was given or it was rejected. */
+    src: string | null;
+    title: string;
+    sandbox: string;
+    referrerPolicy: typeof FRAME_REFERRER_POLICY;
+    allowFullscreen: boolean;
+    /** Permissions Policy for the frame (`allow` attribute). */
+    allow: string | undefined;
+    loading: 'lazy' | 'eager';
+    /** Whether a URL was supplied at all. */
+    hasUrl: boolean;
+    /** Why the supplied URL cannot be embedded; `null` when it can (or none was given). */
+    rejection: FrameSrcRejection | null;
+}
 /**
  * Resolve the effective iframe configuration.
  *
- * Priority (highest first):
- * 1. Parser-provided `data` fields
- * 2. User-configured `widget.config` fields
- * 3. Safe defaults (empty URL, restricted sandbox, no fullscreen)
+ * - `url` and `title`: parser `data` first, then `widget.config`.
+ * - `allowFullscreen` and `loading`: `widget.config` only.
+ * - `sandbox`, referrer policy and permissions: fixed by the frame policy;
+ *   any `sandbox` value in data or config is ignored.
  *
- * This is the function the widget tests exercise directly; keeping the merge
- * logic pure makes the DataSink → Parser → Widget contract explicit.
+ * The URL is validated by {@link resolveFrameSrc}; `context` supplies the app
+ * origin and the optional origin allowlist.
  */
-export declare function resolveIframeConfig(widgetConfig: Record<string, unknown> | undefined, data: IframeData | undefined): Required<IframeData> & {
-    hasUrl: boolean;
-};
+export declare function resolveIframeConfig(widgetConfig: Record<string, unknown> | undefined, data: IframeData | undefined, context?: FrameSrcContext): ResolvedIframeConfig;
 export declare const IframeWidget: FC<IframeWidgetProps>;
 export default IframeWidget;

package/dist/bigconsole/components/widgets/iframe-widget/IframeWidget.js

@@ -1,57 +1,130 @@
-import { memo as e, useMemo as t } from "react";
-import { jsx as n, jsxs as r } from "react/jsx-runtime";
+import { useOptionalBigConsole as e } from "../../../context/BigConsoleContext.js";
+import "../../../context/index.js";
+import { currentAppOrigin as t, resolveFrameSrc as n } from "../../../utils/safeUrl.js";
+import { FRAME_REFERRER_POLICY as r, FRAME_SANDBOX as i, frameKey as a, framePermissions as o } from "./framePolicy.js";
+import { useTr as s } from "../../../../shared/hooks/useTr.js";
+import { memo as c, useMemo as l } from "react";
+import { jsx as u, jsxs as d } from "react/jsx-runtime";
 //#region src/bigconsole/components/widgets/iframe-widget/IframeWidget.tsx
-function i(e, t) {
-	let n = e ?? {}, r = (e) => {
-		if (typeof e == "boolean") return e;
-		if (typeof e == "string") return e.toLowerCase() === "true";
-	}, i = (e) => e === "eager" || e === "lazy" ? e : "lazy", a = t?.url ?? n.url ?? "";
+var f = "Embedded Content";
+function p(e) {
+	if (typeof e == "boolean") return e;
+	if (typeof e == "string") return e.toLowerCase() === "true";
+}
+function m(e) {
+	return e === "eager" ? "eager" : "lazy";
+}
+function h(...e) {
+	for (let t of e) if (typeof t == "string" && t.trim().length > 0) return t;
+}
+function g(e, t, a = {}) {
+	let s = e ?? {}, c = h(t?.url, s.url), l = h(t?.title, s.title) ?? f, u = p(s.allowFullscreen) ?? !1, d = m(s.loading), g = c === void 0 ? null : n(c, a);
 	return {
-		url: a,
-		title: t?.title ?? n.title ?? "Embedded Content",
-		allowFullscreen: r(t?.allowFullscreen ?? n.allowFullscreen) ?? !1,
-		sandbox: t?.sandbox ?? n.sandbox ?? "allow-scripts allow-same-origin",
-		loading: i(t?.loading ?? n.loading),
-		hasUrl: typeof a == "string" && a.length > 0
+		src: g?.ok ? g.src : null,
+		title: l,
+		sandbox: i,
+		referrerPolicy: r,
+		allowFullscreen: u,
+		allow: o(u),
+		loading: d,
+		hasUrl: c !== void 0,
+		rejection: g && !g.ok ? g.reason : null
 	};
 }
-var a = e(function({ widget: e, data: a }) {
-	let o = t(() => i(e.config, a), [e.config, a]);
-	return o.hasUrl ? /* @__PURE__ */ n("div", {
-		className: "h-full w-full",
-		children: /* @__PURE__ */ n("iframe", {
-			src: o.url,
-			title: o.title,
-			className: "w-full h-full border-0 rounded",
-			allowFullScreen: o.allowFullscreen,
-			sandbox: o.sandbox,
-			loading: o.loading
+var _ = {
+	missing: {
+		key: "bigconsole.widget.iframe.rejected.invalid",
+		fallback: "Enter a complete https:// address."
+	},
+	invalid: {
+		key: "bigconsole.widget.iframe.rejected.invalid",
+		fallback: "Enter a complete https:// address."
+	},
+	scheme: {
+		key: "bigconsole.widget.iframe.rejected.scheme",
+		fallback: "Only https:// addresses can be embedded."
+	},
+	credentials: {
+		key: "bigconsole.widget.iframe.rejected.credentials",
+		fallback: "Remove the user name or password from the address."
+	},
+	"same-origin": {
+		key: "bigconsole.widget.iframe.rejected.sameOrigin",
+		fallback: "Pages from this app cannot be embedded in a widget."
+	},
+	"origin-not-allowed": {
+		key: "bigconsole.widget.iframe.rejected.originNotAllowed",
+		fallback: "This site is not on the list of sites allowed for embedding."
+	}
+};
+function v() {
+	return /* @__PURE__ */ u("svg", {
+		className: "w-12 h-12 mx-auto mb-2 text-text-muted",
+		fill: "none",
+		stroke: "currentColor",
+		viewBox: "0 0 24 24",
+		children: /* @__PURE__ */ u("path", {
+			strokeLinecap: "round",
+			strokeLinejoin: "round",
+			strokeWidth: 1.5,
+			d: "M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
 		})
-	}) : /* @__PURE__ */ n("div", {
+	});
+}
+var y = c(function({ widget: n, data: r }) {
+	let i = s(), o = e()?.iframeAllowedOrigins, c = l(() => g(n.config, r, {
+		appOrigin: t(),
+		allowedOrigins: o
+	}), [
+		n.config,
+		r,
+		o
+	]);
+	if (!c.hasUrl) return /* @__PURE__ */ u("div", {
 		className: "flex items-center justify-center h-full text-text-secondary text-sm",
-		children: /* @__PURE__ */ r("div", {
+		children: /* @__PURE__ */ d("div", {
 			className: "text-center",
 			children: [
-				/* @__PURE__ */ n("svg", {
-					className: "w-12 h-12 mx-auto mb-2 text-text-muted",
-					fill: "none",
-					stroke: "currentColor",
-					viewBox: "0 0 24 24",
-					children: /* @__PURE__ */ n("path", {
-						strokeLinecap: "round",
-						strokeLinejoin: "round",
-						strokeWidth: 1.5,
-						d: "M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
-					})
-				}),
-				/* @__PURE__ */ n("p", { children: "No URL configured" }),
-				/* @__PURE__ */ n("p", {
+				/* @__PURE__ */ u(v, {}),
+				/* @__PURE__ */ u("p", { children: i("bigconsole.widget.iframe.empty.title", "No URL configured") }),
+				/* @__PURE__ */ u("p", {
 					className: "text-xs text-text-muted mt-1",
-					children: "Configure a URL to embed content"
+					children: i("bigconsole.widget.iframe.empty.hint", "Configure a URL to embed content")
 				})
 			]
 		})
 	});
+	if (!c.src) {
+		let e = _[c.rejection ?? "invalid"];
+		return /* @__PURE__ */ u("div", {
+			className: "flex items-center justify-center h-full text-text-secondary text-sm",
+			role: "status",
+			children: /* @__PURE__ */ d("div", {
+				className: "text-center",
+				children: [
+					/* @__PURE__ */ u(v, {}),
+					/* @__PURE__ */ u("p", { children: i("bigconsole.widget.iframe.rejected.title", "This address cannot be embedded") }),
+					/* @__PURE__ */ u("p", {
+						className: "text-xs text-text-muted mt-1",
+						children: i(e.key, e.fallback)
+					})
+				]
+			})
+		});
+	}
+	return /* @__PURE__ */ u("div", {
+		className: "h-full w-full",
+		children: /* @__PURE__ */ u("iframe", {
+			sandbox: c.sandbox,
+			referrerPolicy: c.referrerPolicy,
+			allow: c.allow,
+			allowFullScreen: c.allowFullscreen,
+			loading: c.loading,
+			title: c.title,
+			className: "w-full h-full border-0 rounded",
+			src: c.src
+		}, a(c.src, c.sandbox))
+	});
 });
 //#endregion
-export { a as default, i as resolveIframeConfig };
+export { y as default, g as resolveIframeConfig };

package/dist/bigconsole/components/widgets/iframe-widget/framePolicy.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Frame policy for widgets that embed external pages.
+ *
+ * The sandbox, referrer policy and permissions are defined here in code and
+ * are never read from widget configuration or parser output. Embedded pages
+ * always run with an opaque origin (no `allow-same-origin`), cannot navigate
+ * the top-level page, and open popups that keep the same sandbox.
+ */
+/** Sandbox flags applied to every embedded page. */
+export declare const FRAME_SANDBOX = "allow-scripts allow-popups allow-forms";
+/** Referrer policy for embedded pages: the dashboard URL is never sent. */
+export declare const FRAME_REFERRER_POLICY = "no-referrer";
+/** Permissions Policy (`allow` attribute) for an embedded page. */
+export declare function framePermissions(allowFullscreen: boolean): string | undefined;
+/**
+ * React key for an embedded frame. Keying on the source and sandbox means a
+ * new element (with its attributes already set) is created whenever either
+ * changes, instead of navigating an existing frame.
+ */
+export declare function frameKey(src: string, sandbox?: string): string;

package/dist/bigconsole/components/widgets/iframe-widget/framePolicy.js

@@ -0,0 +1,10 @@
+//#region src/bigconsole/components/widgets/iframe-widget/framePolicy.ts
+var e = "allow-scripts allow-popups allow-forms", t = "no-referrer";
+function n(e) {
+	return e ? "fullscreen" : void 0;
+}
+function r(t, n = e) {
+	return `${t}|${n}`;
+}
+//#endregion
+export { t as FRAME_REFERRER_POLICY, e as FRAME_SANDBOX, r as frameKey, n as framePermissions };

package/dist/bigconsole/components/widgets/iframe-widget/index.d.ts

@@ -1,2 +1,3 @@
-export { IframeWidget, resolveIframeConfig, type IframeWidgetProps, type IframeData } from './IframeWidget';
+export { IframeWidget, resolveIframeConfig, type IframeWidgetProps, type IframeData, type ResolvedIframeConfig, } from './IframeWidget';
+export { FRAME_SANDBOX, FRAME_REFERRER_POLICY, frameKey, framePermissions } from './framePolicy';
 export { default } from './IframeWidget';

package/dist/bigconsole/components/widgets/iframe-widget/index.js

@@ -1,2 +1,3 @@
-import e, { resolveIframeConfig as t } from "./IframeWidget.js";
-export { e as IframeWidget, e as default, t as resolveIframeConfig };
+import { FRAME_REFERRER_POLICY as e, FRAME_SANDBOX as t, frameKey as n, framePermissions as r } from "./framePolicy.js";
+import i, { resolveIframeConfig as a } from "./IframeWidget.js";
+export { e as FRAME_REFERRER_POLICY, t as FRAME_SANDBOX, i as IframeWidget, i as default, n as frameKey, r as framePermissions, a as resolveIframeConfig };