@elmethis/core 0.18.0 → 0.19.0

package/dist/a2ui/v0_9/block_catalog.json

@@ -898,6 +898,10 @@
             "autoHeight": {
               "type": "boolean",
               "description": "Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content."
+            },
+            "allowScripts": {
+              "type": "boolean",
+              "description": "Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled."
             }
           },
           "required": [

package/dist/index.cjs

@@ -278,7 +278,8 @@ const HtmlApi = {
 		...CommonProps,
 		html: zod.z.string().describe("Raw HTML markup to render inside a sandboxed iframe. Mutually exclusive with `src` — provide exactly one of the two.").optional(),
 		src: zod.z.string().describe("URL of a remote document to render inside the iframe instead of inline `html` (e.g. a presigned, time-limited link). Mutually exclusive with `html` — provide exactly one of the two. `autoHeight` doesn't apply here since cross-origin content can't be measured, and a time-limited URL isn't refreshed automatically — the caller is responsible for keeping it current.").optional(),
-		autoHeight: zod.z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional()
+		autoHeight: zod.z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional(),
+		allowScripts: zod.z.boolean().describe("Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled.").optional()
 	}).strict()
 };
 const CodeBlockApi = {

package/dist/index.d.cts

@@ -2567,6 +2567,7 @@ declare const HtmlApi: {
     html: z.ZodOptional<z.ZodString>;
     src: z.ZodOptional<z.ZodString>;
     autoHeight: z.ZodOptional<z.ZodBoolean>;
+    allowScripts: z.ZodOptional<z.ZodBoolean>;
     accessibility: z.ZodOptional<z.ZodObject<{
       label: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodObject<{
         path: z.ZodString;
@@ -2659,6 +2660,7 @@ declare const HtmlApi: {
     src?: string | undefined;
     html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }, {
     accessibility?: {
       description?: string | {
@@ -2680,6 +2682,7 @@ declare const HtmlApi: {
     src?: string | undefined;
     html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }>;
 };
 declare const CodeBlockApi: {

package/dist/index.d.mts

@@ -2567,6 +2567,7 @@ declare const HtmlApi: {
     html: z.ZodOptional<z.ZodString>;
     src: z.ZodOptional<z.ZodString>;
     autoHeight: z.ZodOptional<z.ZodBoolean>;
+    allowScripts: z.ZodOptional<z.ZodBoolean>;
     accessibility: z.ZodOptional<z.ZodObject<{
       label: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodObject<{
         path: z.ZodString;
@@ -2659,6 +2660,7 @@ declare const HtmlApi: {
     src?: string | undefined;
     html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }, {
     accessibility?: {
       description?: string | {
@@ -2680,6 +2682,7 @@ declare const HtmlApi: {
     src?: string | undefined;
     html?: string | undefined;
     autoHeight?: boolean | undefined;
+    allowScripts?: boolean | undefined;
   }>;
 };
 declare const CodeBlockApi: {

package/dist/index.mjs

@@ -277,7 +277,8 @@ const HtmlApi = {
 		...CommonProps,
 		html: z.string().describe("Raw HTML markup to render inside a sandboxed iframe. Mutually exclusive with `src` — provide exactly one of the two.").optional(),
 		src: z.string().describe("URL of a remote document to render inside the iframe instead of inline `html` (e.g. a presigned, time-limited link). Mutually exclusive with `html` — provide exactly one of the two. `autoHeight` doesn't apply here since cross-origin content can't be measured, and a time-limited URL isn't refreshed automatically — the caller is responsible for keeping it current.").optional(),
-		autoHeight: z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional()
+		autoHeight: z.boolean().describe("Stretch the iframe to fit its content height. Defaults to true. Only takes effect for `html`-rendered content.").optional(),
+		allowScripts: z.boolean().describe("Allow the embedded content to run JavaScript (adds the iframe sandbox's `allow-scripts` token). Defaults to false — script execution is disabled by default. `allow-same-origin` is never granted together with this, in `html` or `src` mode, so the embedded document can never escape the sandbox even with scripts enabled.").optional()
 	}).strict()
 };
 const CodeBlockApi = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elmethis/core",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "author": {
     "name": "Ikuma Yamashita",
     "url": "https://www.ikuma.cloud/"