@elmethis/core 0.17.0 → 0.19.0

package/dist/a2ui/v0_9/block_catalog.json

@@ -889,16 +889,23 @@
             },
             "html": {
               "type": "string",
-              "description": "Raw HTML markup to render inside a sandboxed iframe."
+              "description": "Raw HTML markup to render inside a sandboxed iframe. Mutually exclusive with `src` — provide exactly one of the two."
+            },
+            "src": {
+              "type": "string",
+              "description": "URL of a remote document to render inside the iframe instead of inline `html` (e.g. a presigned, time-limited link). Mutually exclusive with `html` — provide exactly one of the two. `autoHeight` doesn't apply here since cross-origin content can't be measured, and a time-limited URL isn't refreshed automatically — the caller is responsible for keeping it current."
             },
             "autoHeight": {
               "type": "boolean",
-              "description": "Stretch the iframe to fit its content height. Defaults to true."
+              "description": "Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content."
+            },
+            "allowScripts": {
+              "type": "boolean",
+              "description": "Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled."
             }
           },
           "required": [
-            "component",
-            "html"
+            "component"
           ]
         }
       ],

package/dist/index.cjs

@@ -267,15 +267,19 @@ const BlockImageApi = {
 	}).strict()
 };
 /**
-* Sandboxed raw-HTML embed. Renders `html` inside an iframe (e.g. a
-* Claude-authored artifact or a Notion page export).
+* Sandboxed HTML embed, rendered inside an iframe. Provide exactly one of
+* `html` (inline markup, e.g. a Claude-authored artifact or a Notion page
+* export) or `src` (a remote document URL) — this catalog doesn't validate
+* cross-field constraints, so the contract is documentation-only.
 */
 const HtmlApi = {
 	name: "Html",
 	schema: zod.z.object({
 		...CommonProps,
-		html: zod.z.string().describe("Raw HTML markup to render inside a sandboxed iframe."),
-		autoHeight: zod.z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true.").optional()
+		html: zod.z.string().describe("Raw HTML markup to render inside a sandboxed iframe. Mutually exclusive with `src` — provide exactly one of the two.").optional(),
+		src: zod.z.string().describe("URL of a remote document to render inside the iframe instead of inline `html` (e.g. a presigned, time-limited link). Mutually exclusive with `html` — provide exactly one of the two. `autoHeight` doesn't apply here since cross-origin content can't be measured, and a time-limited URL isn't refreshed automatically — the caller is responsible for keeping it current.").optional(),
+		autoHeight: zod.z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional(),
+		allowScripts: zod.z.boolean().describe("Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled.").optional()
 	}).strict()
 };
 const CodeBlockApi = {

package/dist/index.d.cts

@@ -2556,14 +2556,18 @@ declare const BlockImageApi: {
   }>;
 };
 /**
- * Sandboxed raw-HTML embed. Renders `html` inside an iframe (e.g. a
- * Claude-authored artifact or a Notion page export).
+ * Sandboxed HTML embed, rendered inside an iframe. Provide exactly one of
+ * `html` (inline markup, e.g. a Claude-authored artifact or a Notion page
+ * export) or `src` (a remote document URL) — this catalog doesn't validate
+ * cross-field constraints, so the contract is documentation-only.
  */
 declare const HtmlApi: {
   name: string;
   schema: z.ZodObject<{
-    html: z.ZodString;
+    html: z.ZodOptional<z.ZodString>;
+    src: z.ZodOptional<z.ZodString>;
     autoHeight: z.ZodOptional<z.ZodBoolean>;
+    allowScripts: z.ZodOptional<z.ZodBoolean>;
     accessibility: z.ZodOptional<z.ZodObject<{
       label: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodObject<{
         path: z.ZodString;
@@ -2636,7 +2640,6 @@ declare const HtmlApi: {
     }>>;
     weight: z.ZodOptional<z.ZodNumber>;
   }, "strict", z.ZodTypeAny, {
-    html: string;
     accessibility?: {
       description?: string | {
         path: string;
@@ -2654,9 +2657,11 @@ declare const HtmlApi: {
       } | undefined;
     } | undefined;
     weight?: number | undefined;
+    src?: string | undefined;
+    html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }, {
-    html: string;
     accessibility?: {
       description?: string | {
         path: string;
@@ -2674,7 +2679,10 @@ declare const HtmlApi: {
       } | undefined;
     } | undefined;
     weight?: number | undefined;
+    src?: string | undefined;
+    html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }>;
 };
 declare const CodeBlockApi: {

package/dist/index.d.mts

@@ -2556,14 +2556,18 @@ declare const BlockImageApi: {
   }>;
 };
 /**
- * Sandboxed raw-HTML embed. Renders `html` inside an iframe (e.g. a
- * Claude-authored artifact or a Notion page export).
+ * Sandboxed HTML embed, rendered inside an iframe. Provide exactly one of
+ * `html` (inline markup, e.g. a Claude-authored artifact or a Notion page
+ * export) or `src` (a remote document URL) — this catalog doesn't validate
+ * cross-field constraints, so the contract is documentation-only.
  */
 declare const HtmlApi: {
   name: string;
   schema: z.ZodObject<{
-    html: z.ZodString;
+    html: z.ZodOptional<z.ZodString>;
+    src: z.ZodOptional<z.ZodString>;
     autoHeight: z.ZodOptional<z.ZodBoolean>;
+    allowScripts: z.ZodOptional<z.ZodBoolean>;
     accessibility: z.ZodOptional<z.ZodObject<{
       label: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodObject<{
         path: z.ZodString;
@@ -2636,7 +2640,6 @@ declare const HtmlApi: {
     }>>;
     weight: z.ZodOptional<z.ZodNumber>;
   }, "strict", z.ZodTypeAny, {
-    html: string;
     accessibility?: {
       description?: string | {
         path: string;
@@ -2654,9 +2657,11 @@ declare const HtmlApi: {
       } | undefined;
     } | undefined;
     weight?: number | undefined;
+    src?: string | undefined;
+    html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }, {
-    html: string;
     accessibility?: {
       description?: string | {
         path: string;
@@ -2674,7 +2679,10 @@ declare const HtmlApi: {
       } | undefined;
     } | undefined;
     weight?: number | undefined;
+    src?: string | undefined;
+    html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }>;
 };
 declare const CodeBlockApi: {

package/dist/index.mjs

@@ -266,15 +266,19 @@ const BlockImageApi = {
 	}).strict()
 };
 /**
-* Sandboxed raw-HTML embed. Renders `html` inside an iframe (e.g. a
-* Claude-authored artifact or a Notion page export).
+* Sandboxed HTML embed, rendered inside an iframe. Provide exactly one of
+* `html` (inline markup, e.g. a Claude-authored artifact or a Notion page
+* export) or `src` (a remote document URL) — this catalog doesn't validate
+* cross-field constraints, so the contract is documentation-only.
 */
 const HtmlApi = {
 	name: "Html",
 	schema: z.object({
 		...CommonProps,
-		html: z.string().describe("Raw HTML markup to render inside a sandboxed iframe."),
-		autoHeight: z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true.").optional()
+		html: z.string().describe("Raw HTML markup to render inside a sandboxed iframe. Mutually exclusive with `src` — provide exactly one of the two.").optional(),
+		src: z.string().describe("URL of a remote document to render inside the iframe instead of inline `html` (e.g. a presigned, time-limited link). Mutually exclusive with `html` — provide exactly one of the two. `autoHeight` doesn't apply here since cross-origin content can't be measured, and a time-limited URL isn't refreshed automatically — the caller is responsible for keeping it current.").optional(),
+		autoHeight: z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional(),
+		allowScripts: z.boolean().describe("Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled.").optional()
 	}).strict()
 };
 const CodeBlockApi = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elmethis/core",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "author": {
     "name": "Ikuma Yamashita",
     "url": "https://www.ikuma.cloud/"