@fluid-app/widget-runtime 0.1.0 → 0.1.1

package/README.md

@@ -55,7 +55,16 @@ function Greeting({ name }: { readonly name: string }) {
 startRemoteDomWidgetWorker({ widgets: { Greeting } });
 ```
 
-Workers can render arbitrary supported HTML and CSS through upstream Remote DOM. The runtime disables selected network, storage, nested-worker, and fresh-realm globals where the worker environment permits it. Host calls are limited to capabilities declared by the widget package descriptor.
+Workers can render arbitrary supported HTML and CSS through upstream Remote DOM. The runtime disables storage, nested-worker, fresh-realm, and non-fetch network globals where the worker environment permits it. Host calls are limited to capabilities declared by the widget package descriptor.
+
+`fetch` is denied unless the selected widget declares `networkAccess` version
+`1` and the host supplies an exact persisted grant. Granted calls go directly
+through the preserved native worker fetch; the runtime does not inject Fluid
+credentials or headers. The initial URL cannot address `fluid.app`, the host
+portal origin, loopback, or a private-network IP. DNS resolution and redirect
+destinations are not inspected. A redirect can therefore reach a target that
+would have been rejected as the initial URL. WebSocket, EventSource,
+WebTransport, and streaming-specific APIs remain unavailable in v1.
 
 ## Threat model
 
@@ -68,6 +77,11 @@ do not constitute a complete network sandbox or a substitute for package
 review, catalog authorization, browser isolation, or server-side access
 control.
 
+Network-enabled code can send any portal data available to that widget to an
+external service. Worker isolation does not protect the reputation of Fluid
+domains from package behavior; catalog, builder, and CLI approval must treat
+network access as a publisher trust decision.
+
 ## Non-goals
 
 - No classic script loading or browser globals.

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_remote_dom_renderer = require("./remote-dom-renderer-DUQf80Nu.cjs");
+const require_remote_dom_renderer = require("./remote-dom-renderer-f7OWlvvv.cjs");
 const require_remote_dom_values = require("./remote-dom-values-DbgIedSg.cjs");
 exports.isRemoteDomSerializableValue = require_remote_dom_values.isRemoteDomSerializableValue;
 exports.mountRemoteDomWidget = require_remote_dom_renderer.mountRemoteDomWidget;

package/dist/index.d.cts

@@ -1,3 +1,3 @@
 import { a as isRemoteDomSerializableValue, i as RemoteDomUrlOriginPolicyInput, n as RemoteDomSerializableValue, o as toRemoteDomSerializableValue, r as RemoteDomUrlOriginPolicy, t as RemoteDomNavigationIntent } from "./remote-dom-values-D4AgBNWr.cjs";
-import { a as RemoteDomWidgetHandle, c as mountRemoteDomWidget, d as RemoteDomStyleAttachment, f as RemoteDomThemeBridgeOptions, i as RemoteDomWidgetArtifact, l as RemoteDomCssFetcher, n as RemoteDomCapabilityDeclaration, o as RemoteDomWorkerFactory, r as RemoteDomFullscreenRequest, s as RemoteDomWorkerLike, t as MountRemoteDomWidgetOptions, u as RemoteDomCssUrlInput } from "./remote-dom-renderer-DSHFetvm.cjs";
+import { a as RemoteDomWidgetHandle, c as mountRemoteDomWidget, d as RemoteDomStyleAttachment, f as RemoteDomThemeBridgeOptions, i as RemoteDomWidgetArtifact, l as RemoteDomCssFetcher, n as RemoteDomCapabilityDeclaration, o as RemoteDomWorkerFactory, r as RemoteDomFullscreenRequest, s as RemoteDomWorkerLike, t as MountRemoteDomWidgetOptions, u as RemoteDomCssUrlInput } from "./remote-dom-renderer-CeYSItkU.cjs";
 export { type MountRemoteDomWidgetOptions, type RemoteDomCapabilityDeclaration, type RemoteDomCssFetcher, type RemoteDomCssUrlInput, type RemoteDomFullscreenRequest, type RemoteDomNavigationIntent, type RemoteDomSerializableValue, type RemoteDomStyleAttachment, type RemoteDomThemeBridgeOptions, type RemoteDomUrlOriginPolicy, type RemoteDomUrlOriginPolicyInput, type RemoteDomWidgetArtifact, type RemoteDomWidgetHandle, type RemoteDomWorkerFactory, type RemoteDomWorkerLike, isRemoteDomSerializableValue, mountRemoteDomWidget, toRemoteDomSerializableValue };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
 import { a as isRemoteDomSerializableValue, i as RemoteDomUrlOriginPolicyInput, n as RemoteDomSerializableValue, o as toRemoteDomSerializableValue, r as RemoteDomUrlOriginPolicy, t as RemoteDomNavigationIntent } from "./remote-dom-values-EwoLXnSn.mjs";
-import { a as RemoteDomWidgetHandle, c as mountRemoteDomWidget, d as RemoteDomStyleAttachment, f as RemoteDomThemeBridgeOptions, i as RemoteDomWidgetArtifact, l as RemoteDomCssFetcher, n as RemoteDomCapabilityDeclaration, o as RemoteDomWorkerFactory, r as RemoteDomFullscreenRequest, s as RemoteDomWorkerLike, t as MountRemoteDomWidgetOptions, u as RemoteDomCssUrlInput } from "./remote-dom-renderer-BU-73KvK.mjs";
+import { a as RemoteDomWidgetHandle, c as mountRemoteDomWidget, d as RemoteDomStyleAttachment, f as RemoteDomThemeBridgeOptions, i as RemoteDomWidgetArtifact, l as RemoteDomCssFetcher, n as RemoteDomCapabilityDeclaration, o as RemoteDomWorkerFactory, r as RemoteDomFullscreenRequest, s as RemoteDomWorkerLike, t as MountRemoteDomWidgetOptions, u as RemoteDomCssUrlInput } from "./remote-dom-renderer-CKvnUH8G.mjs";
 export { type MountRemoteDomWidgetOptions, type RemoteDomCapabilityDeclaration, type RemoteDomCssFetcher, type RemoteDomCssUrlInput, type RemoteDomFullscreenRequest, type RemoteDomNavigationIntent, type RemoteDomSerializableValue, type RemoteDomStyleAttachment, type RemoteDomThemeBridgeOptions, type RemoteDomUrlOriginPolicy, type RemoteDomUrlOriginPolicyInput, type RemoteDomWidgetArtifact, type RemoteDomWidgetHandle, type RemoteDomWorkerFactory, type RemoteDomWorkerLike, isRemoteDomSerializableValue, mountRemoteDomWidget, toRemoteDomSerializableValue };

package/dist/index.mjs

@@ -1,3 +1,3 @@
 import { c as isRemoteDomSerializableValue, u as toRemoteDomSerializableValue } from "./remote-dom-values-BSAxrOE7.mjs";
-import { t as mountRemoteDomWidget } from "./remote-dom-renderer-DcwcNPsu.mjs";
+import { t as mountRemoteDomWidget } from "./remote-dom-renderer-CpdKWANy.mjs";
 export { isRemoteDomSerializableValue, mountRemoteDomWidget, toRemoteDomSerializableValue };

package/dist/{remote-dom-renderer-BU-73KvK.d.mts → remote-dom-renderer-CKvnUH8G.d.mts}

@@ -37,6 +37,7 @@ interface RemoteDomCapabilityDeclaration {
 interface RemoteDomWidgetArtifact extends RemoteDomStyleArtifact {
   readonly widgetType: string;
   readonly capabilities: readonly RemoteDomCapabilityDeclaration[];
+  readonly networkAccessGranted?: boolean | undefined;
 }
 interface RemoteDomFullscreenRequest {
   readonly method: string;
@@ -55,6 +56,8 @@ interface MountRemoteDomWidgetOptions {
   readonly workerFactory?: RemoteDomWorkerFactory | undefined;
   readonly hostOrigin?: string | undefined;
   readonly mediaOrigins?: readonly string[] | undefined;
+  /** Canonical absolute HTTP(S) URLs registered for native new-tab anchors. */
+  readonly allowedAnchorUrls?: ReadonlySet<string> | undefined;
   readonly maxMutationBatchSize?: number | undefined;
   readonly maxDomNodeCount?: number | undefined;
   readonly cssText?: string | undefined;
@@ -87,4 +90,4 @@ type RemoteDomWorkerFactory = (workerEntryUrl: string, options: WorkerOptions) =
 declare function mountRemoteDomWidget(options: MountRemoteDomWidgetOptions): RemoteDomWidgetHandle;
 //#endregion
 export { RemoteDomWidgetHandle as a, mountRemoteDomWidget as c, RemoteDomStyleAttachment as d, RemoteDomThemeBridgeOptions as f, RemoteDomWidgetArtifact as i, RemoteDomCssFetcher as l, RemoteDomCapabilityDeclaration as n, RemoteDomWorkerFactory as o, RemoteDomFullscreenRequest as r, RemoteDomWorkerLike as s, MountRemoteDomWidgetOptions as t, RemoteDomCssUrlInput as u };
-//# sourceMappingURL=remote-dom-renderer-BU-73KvK.d.mts.map
+//# sourceMappingURL=remote-dom-renderer-CKvnUH8G.d.mts.map

package/dist/remote-dom-renderer-CKvnUH8G.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-dom-renderer-CKvnUH8G.d.mts","names":[],"sources":["../src/remote-dom-styles.ts","../src/remote-dom-renderer.ts"],"mappings":";;;UASiB,wBAAA;EAAA,SACN,KAAA,EAAO,OAAA;EAAA,SACP,OAAA;AAAA;AAAA,UAGM,sBAAA;EAAA,SACN,SAAA;EAAA,SACA,OAAA;EAAA,SACA,cAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;AAAA;AAAA,UAGM,qBAAA;EAAA,SACN,GAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGC,oBAAA,YAAgC,qBAAA;AAAA,KAEhC,mBAAA,IAAuB,GAAA,aAAgB,OAAA;AAAA,UAOlC,2BAAA;EAAA,SACN,IAAA,EAAM,UAAA;EAAA,SACN,aAAA,GAAgB,OAAA;EAAA,SAChB,aAAA,GAAgB,IAAA;EAAA,SAChB,OAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,UAAA;EAAA,SACA,qBAAA;AAAA;;;UCDM,8BAAA;EAAA,SACN,IAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGM,uBAAA,SAAgC,sBAAA;EAAA,SACtC,UAAA;EAAA,SACA,YAAA,WAAuB,8BAAA;EAAA,SACvB,oBAAA;AAAA;AAAA,UAGM,0BAAA;EAAA,SACN,MAAA;EAAA,SACA,OAAA,GAAU,0BAAA;EAAA,SACV,IAAA,EAAM,WAAA;EAAA,SACN,UAAA,EAAY,UAAA;AAAA;AAAA,UAGN,2BAAA;EAAA,SACN,IAAA,EAAM,WAAA;EAAA,SACN,QAAA,EAAU,uBAAA;EAAA,SACV,KAAA,GAAQ,0BAAA;EAAA,SACR,cAAA,KAEH,UAAA,UACA,MAAA,UACA,OAAA,GAAU,0BAAA,KACP,0BAAA,GAA6B,OAAA,CAAQ,0BAAA;EAAA,SAErC,UAAA,KACH,MAAA,EAAQ,yBAAA,YAAqC,OAAA;EAAA,SAE1C,YAAA,KAEH,OAAA,EAAS,0BAAA,KACN,0BAAA,GAA6B,OAAA,CAAQ,0BAAA;EAAA,SAErC,OAAA,KAAY,KAAA,EAAO,KAAA;EAAA,SACnB,aAAA,GAAgB,sBAAA;EAAA,SAChB,UAAA;EAAA,SACA,YAAA;EDxDqB;EAAA,SC0DrB,iBAAA,GAAoB,WAAA;EAAA,SACpB,oBAAA;EAAA,SACA,eAAA;EAAA,SACA,OAAA;EAAA,SACA,aAAA;EAAA,SACA,OAAA,YAAmB,oBAAA;EAAA,SACnB,qBAAA;EAAA,SACA,qBAAA,YAAiC,oBAAA;EAAA,SACjC,kBAAA;EAAA,SACA,WAAA,GACL,IAAA,CAAK,2BAAA;EAAA,SAGA,QAAA,GAAW,mBAAA;EAAA,SACX,2BAAA;AAAA;AAAA,UAGM,qBAAA;EAAA,SACN,UAAA,EAAY,UAAA;EAAA,SACZ,MAAA,EAAQ,wBAAA;EAAA,SACR,KAAA,EAAO,OAAA;EAChB,WAAA,CAAY,KAAA,EAAO,0BAAA;EACnB,OAAA;AAAA;AAAA,UAGe,mBAAA;EACf,SAAA,IAAa,KAAA,EAAO,YAAA;EACpB,OAAA,IAAW,KAAA,EAAO,UAAA;EAClB,WAAA,CAAY,OAAA,WAAkB,QAAA,GAAW,YAAA;EACzC,SAAA;EACA,gBAAA,IACE,IAAA,aACA,QAAA,GAAW,KAAA,EAAO,YAAA,oBAClB,OAAA;IAAY,MAAA,GAAS,WAAA;EAAA;AAAA;AAAA,KAIb,sBAAA,IACV,cAAA,UACA,OAAA,EAAS,aAAA,KACN,mBAAA;AAAA,iBAqCW,oBAAA,CACd,OAAA,EAAS,2BAAA,GACR,qBAAA"}

package/dist/{remote-dom-renderer-DSHFetvm.d.cts → remote-dom-renderer-CeYSItkU.d.cts}

@@ -37,6 +37,7 @@ interface RemoteDomCapabilityDeclaration {
 interface RemoteDomWidgetArtifact extends RemoteDomStyleArtifact {
   readonly widgetType: string;
   readonly capabilities: readonly RemoteDomCapabilityDeclaration[];
+  readonly networkAccessGranted?: boolean | undefined;
 }
 interface RemoteDomFullscreenRequest {
   readonly method: string;
@@ -55,6 +56,8 @@ interface MountRemoteDomWidgetOptions {
   readonly workerFactory?: RemoteDomWorkerFactory | undefined;
   readonly hostOrigin?: string | undefined;
   readonly mediaOrigins?: readonly string[] | undefined;
+  /** Canonical absolute HTTP(S) URLs registered for native new-tab anchors. */
+  readonly allowedAnchorUrls?: ReadonlySet<string> | undefined;
   readonly maxMutationBatchSize?: number | undefined;
   readonly maxDomNodeCount?: number | undefined;
   readonly cssText?: string | undefined;
@@ -87,4 +90,4 @@ type RemoteDomWorkerFactory = (workerEntryUrl: string, options: WorkerOptions) =
 declare function mountRemoteDomWidget(options: MountRemoteDomWidgetOptions): RemoteDomWidgetHandle;
 //#endregion
 export { RemoteDomWidgetHandle as a, mountRemoteDomWidget as c, RemoteDomStyleAttachment as d, RemoteDomThemeBridgeOptions as f, RemoteDomWidgetArtifact as i, RemoteDomCssFetcher as l, RemoteDomCapabilityDeclaration as n, RemoteDomWorkerFactory as o, RemoteDomFullscreenRequest as r, RemoteDomWorkerLike as s, MountRemoteDomWidgetOptions as t, RemoteDomCssUrlInput as u };
-//# sourceMappingURL=remote-dom-renderer-DSHFetvm.d.cts.map
+//# sourceMappingURL=remote-dom-renderer-CeYSItkU.d.cts.map

package/dist/remote-dom-renderer-CeYSItkU.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-dom-renderer-CeYSItkU.d.cts","names":[],"sources":["../src/remote-dom-styles.ts","../src/remote-dom-renderer.ts"],"mappings":";;;UASiB,wBAAA;EAAA,SACN,KAAA,EAAO,OAAA;EAAA,SACP,OAAA;AAAA;AAAA,UAGM,sBAAA;EAAA,SACN,SAAA;EAAA,SACA,OAAA;EAAA,SACA,cAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;AAAA;AAAA,UAGM,qBAAA;EAAA,SACN,GAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGC,oBAAA,YAAgC,qBAAA;AAAA,KAEhC,mBAAA,IAAuB,GAAA,aAAgB,OAAA;AAAA,UAOlC,2BAAA;EAAA,SACN,IAAA,EAAM,UAAA;EAAA,SACN,aAAA,GAAgB,OAAA;EAAA,SAChB,aAAA,GAAgB,IAAA;EAAA,SAChB,OAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,UAAA;EAAA,SACA,qBAAA;AAAA;;;UCDM,8BAAA;EAAA,SACN,IAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGM,uBAAA,SAAgC,sBAAA;EAAA,SACtC,UAAA;EAAA,SACA,YAAA,WAAuB,8BAAA;EAAA,SACvB,oBAAA;AAAA;AAAA,UAGM,0BAAA;EAAA,SACN,MAAA;EAAA,SACA,OAAA,GAAU,0BAAA;EAAA,SACV,IAAA,EAAM,WAAA;EAAA,SACN,UAAA,EAAY,UAAA;AAAA;AAAA,UAGN,2BAAA;EAAA,SACN,IAAA,EAAM,WAAA;EAAA,SACN,QAAA,EAAU,uBAAA;EAAA,SACV,KAAA,GAAQ,0BAAA;EAAA,SACR,cAAA,KAEH,UAAA,UACA,MAAA,UACA,OAAA,GAAU,0BAAA,KACP,0BAAA,GAA6B,OAAA,CAAQ,0BAAA;EAAA,SAErC,UAAA,KACH,MAAA,EAAQ,yBAAA,YAAqC,OAAA;EAAA,SAE1C,YAAA,KAEH,OAAA,EAAS,0BAAA,KACN,0BAAA,GAA6B,OAAA,CAAQ,0BAAA;EAAA,SAErC,OAAA,KAAY,KAAA,EAAO,KAAA;EAAA,SACnB,aAAA,GAAgB,sBAAA;EAAA,SAChB,UAAA;EAAA,SACA,YAAA;EDxDqB;EAAA,SC0DrB,iBAAA,GAAoB,WAAA;EAAA,SACpB,oBAAA;EAAA,SACA,eAAA;EAAA,SACA,OAAA;EAAA,SACA,aAAA;EAAA,SACA,OAAA,YAAmB,oBAAA;EAAA,SACnB,qBAAA;EAAA,SACA,qBAAA,YAAiC,oBAAA;EAAA,SACjC,kBAAA;EAAA,SACA,WAAA,GACL,IAAA,CAAK,2BAAA;EAAA,SAGA,QAAA,GAAW,mBAAA;EAAA,SACX,2BAAA;AAAA;AAAA,UAGM,qBAAA;EAAA,SACN,UAAA,EAAY,UAAA;EAAA,SACZ,MAAA,EAAQ,wBAAA;EAAA,SACR,KAAA,EAAO,OAAA;EAChB,WAAA,CAAY,KAAA,EAAO,0BAAA;EACnB,OAAA;AAAA;AAAA,UAGe,mBAAA;EACf,SAAA,IAAa,KAAA,EAAO,YAAA;EACpB,OAAA,IAAW,KAAA,EAAO,UAAA;EAClB,WAAA,CAAY,OAAA,WAAkB,QAAA,GAAW,YAAA;EACzC,SAAA;EACA,gBAAA,IACE,IAAA,aACA,QAAA,GAAW,KAAA,EAAO,YAAA,oBAClB,OAAA;IAAY,MAAA,GAAS,WAAA;EAAA;AAAA;AAAA,KAIb,sBAAA,IACV,cAAA,UACA,OAAA,EAAS,aAAA,KACN,mBAAA;AAAA,iBAqCW,oBAAA,CACd,OAAA,EAAS,2BAAA,GACR,qBAAA"}

package/dist/{remote-dom-renderer-DcwcNPsu.mjs → remote-dom-renderer-CpdKWANy.mjs}

@@ -398,7 +398,7 @@ function sanitizeRemoteDomAttribute(tagName, rawName, rawValue, options = {}) {
 		} : void 0;
 	}
 	if (URL_VALUED_ATTRIBUTES.has(name)) {
-		const value = sanitizeUrlValuedAttribute(normalizedTagName, name, rawValue, options.urlOriginPolicy);
+		const value = sanitizeUrlValuedAttribute(normalizedTagName, name, rawValue, options.allowedAnchorUrls, options.urlOriginPolicy);
 		return value ? {
 			name,
 			value
@@ -452,7 +452,10 @@ function sanitizeRemoteDomUrl(value, options) {
 	} catch {
 		return;
 	}
-	if (parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:") return isAllowedHttpOrigin(parsedUrl.origin, options.originPolicy, options.allowedHttpOriginGroups ?? []) ? trimmedValue : void 0;
+	if (parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:") {
+		if (options.allowedHttpUrls?.has(parsedUrl.href)) return parsedUrl.href;
+		return isAllowedHttpOrigin(parsedUrl.origin, options.originPolicy, options.allowedHttpOriginGroups ?? []) ? trimmedValue : void 0;
+	}
 	if (options.allowMailTo && parsedUrl.protocol === "mailto:") return trimmedValue;
 	if (options.allowTel && parsedUrl.protocol === "tel:") return trimmedValue;
 }
@@ -503,17 +506,14 @@ function readCustomEventDetail(event) {
 		return {};
 	}
 }
-function sanitizeUrlValuedAttribute(tagName, name, value, originPolicy) {
-	if (name === "href") return sanitizeRemoteDomUrl(value, {
+function sanitizeUrlValuedAttribute(tagName, name, value, allowedAnchorUrls, originPolicy) {
+	if (name === "href" && tagName === "a") return sanitizeRemoteDomUrl(value, {
 		allowHashOnly: true,
-		allowMailTo: true,
+		allowMailTo: false,
 		allowRelative: true,
-		allowTel: true,
-		allowedHttpOriginGroups: [
-			"artifact",
-			"media",
-			"navigation"
-		],
+		allowTel: false,
+		allowedHttpOriginGroups: ["navigation"],
+		...allowedAnchorUrls ? { allowedHttpUrls: allowedAnchorUrls } : {},
 		originPolicy,
 		relativeUrlBase: "navigation"
 	});
@@ -630,9 +630,75 @@ function sanitizeCssComponentValueUrlReferences(cssValue, originPolicy) {
 	const parsed = valueParser(cssValue);
 	return sanitizeParsedCssValue(parsed.nodes, originPolicy) ? valueParser.stringify(parsed.nodes) : void 0;
 }
+/** True when a word token ends in a hex escape that CSS would terminate
+*  with the following whitespace.
+*
+*  CSS Syntax §4.3.7: a hex escape consumes one trailing whitespace
+*  character, so `\75 rl(…)` is a SINGLE function token named `url`.
+*  postcss-value-parser instead splits on that whitespace and hands us
+*  [word "\75", space, function "rl"] — a function whose name decodes
+*  to `rl`, which is in neither the url nor the rejected-function set,
+*  so the value sails past the origin policy and Chromium then fetches
+*  the attacker's URL. Same for `u\72 l(`, `ur\6c (`, `\69 mage-set(`
+*  and `image-se\74 (`, and for tab/newline/form-feed as the
+*  terminator.
+*
+*  We cannot re-join the tokens without reimplementing the tokenizer,
+*  so we fail closed on the shape instead. Escapes inside strings are
+*  unaffected — those are `string` nodes, so `content: "\201C "` and
+*  friends still round-trip. */
+function hasWhitespaceTerminatedEscape(node) {
+	return node.type === "word" && /\\[0-9a-fA-F]{1,6}$/.test(node.value);
+}
+/** True when `nodes[index]` is the first half of a function name that
+*  CSS will re-join across the whitespace the escape consumes.
+*
+*  Narrower than "any word ending in an escape", deliberately. Only a
+*  FUNCTION can fetch anything, so the shape that matters is
+*  word-escape → single whitespace → function: `\75 rl(…)` re-joins to
+*  `url(…)`. Re-joining a word onto another WORD just yields an
+*  identifier, which is inert — and rejecting those took ordinary
+*  declarations like `color: \72 ed` down with them. Since one rejected
+*  declaration invalidates the entire source, that discarded whole
+*  stylesheets over a value that could never fetch.
+*
+*  The whitespace run must be exactly ONE CSS whitespace: §4.3.7 has
+*  the escape consume one, so `\75  rl(` (two spaces) leaves a real
+*  separator behind and is two tokens, not a disguised function.
+*
+*  Counted after normalizing newlines, not in raw code units. CSS
+*  preprocessing (§3.3) folds CRLF and a lone CR into a single LF
+*  BEFORE tokenizing, so `\75\r\nrl(` is one whitespace to the browser
+*  and resolves to `url(...)`. Measuring the raw string made that two
+*  characters, which skipped the rejection entirely and handed the
+*  attacker back the bypass. */
+function startsDisguisedFunction(nodes, index) {
+	let name = "";
+	let i = index;
+	for (;;) {
+		const word = nodes[i];
+		if (!word || !hasWhitespaceTerminatedEscape(word)) return false;
+		const separator = nodes[i + 1];
+		if (separator?.type !== "space") return false;
+		if (separator.value.replace(/\r\n?|\f/g, "\n").length !== 1) return false;
+		const decodedWord = decodeCssEscapes(word.value);
+		if (decodedWord === void 0) return true;
+		name += decodedWord;
+		const next = nodes[i + 2];
+		if (next?.type === "function") {
+			const decodedSuffix = decodeCssEscapes(next.value);
+			if (decodedSuffix === void 0) return true;
+			const reconstructed = `${name}${decodedSuffix}`.toLowerCase();
+			return reconstructed === CSS_URL_FUNCTION_NAME || CSS_REJECTED_URL_FUNCTION_NAMES.has(reconstructed);
+		}
+		if (next?.type !== "word") return false;
+		i += 2;
+	}
+}
 function sanitizeParsedCssValue(nodes, originPolicy) {
-	for (const node of nodes) {
+	for (const [index, node] of nodes.entries()) {
 		if ("unclosed" in node && node.unclosed === true) return false;
+		if (startsDisguisedFunction(nodes, index)) return false;
 		if (node.type !== "function") continue;
 		const decodedFunctionName = decodeCssEscapes(node.value);
 		if (decodedFunctionName === void 0) return false;
@@ -952,7 +1018,10 @@ function normalizeUpdatePropertyRecordForHost(options, state, mutation, pendingE
 			message: `Remote DOM property "${property}" had an invalid value for "${node.localName}".`
 		};
 	}
-	const [attribute] = sanitizeRemoteDomAttributes(node.localName, { [property]: value }, { urlOriginPolicy: options.urlOriginPolicy });
+	const [attribute] = sanitizeRemoteDomAttributes(node.localName, { [property]: value }, {
+		...options.allowedAnchorUrls ? { allowedAnchorUrls: options.allowedAnchorUrls } : {},
+		urlOriginPolicy: options.urlOriginPolicy
+	});
 	if (attribute) return {
 		ok: true,
 		record: [
@@ -1044,7 +1113,10 @@ function normalizeRemoteNodeForHost(options, state, value, seen, pendingEventLis
 			};
 		}
 	}
-	const attributes = sanitizeRemoteDomAttributes(tagName, attributeProperties, { urlOriginPolicy: options.urlOriginPolicy });
+	const attributes = sanitizeRemoteDomAttributes(tagName, attributeProperties, {
+		...options.allowedAnchorUrls ? { allowedAnchorUrls: options.allowedAnchorUrls } : {},
+		urlOriginPolicy: options.urlOriginPolicy
+	});
 	const remoteAttributes = {};
 	for (const attribute of attributes) remoteAttributes[attribute.name] = attribute.value;
 	if (tagName === "button" && remoteAttributes.type === void 0) remoteAttributes.type = "button";
@@ -1664,6 +1736,7 @@ function mountRemoteDomWidget(options) {
 				throw new RemoteDomConnectionCallDeniedError("remote element method");
 			}
 		}).connection,
+		...options.allowedAnchorUrls ? { allowedAnchorUrls: options.allowedAnchorUrls } : {},
 		urlOriginPolicy,
 		maxMutationBatchSize: options.maxMutationBatchSize ?? DEFAULT_MAX_MUTATION_BATCH_SIZE,
 		maxDomNodeCount: options.maxDomNodeCount ?? DEFAULT_MAX_DOM_NODE_COUNT,
@@ -1703,18 +1776,17 @@ function mountRemoteDomWidget(options) {
 	shadowRoot.addEventListener("submit", submitListener, { capture: true });
 	shadowRoot.addEventListener("click", navigationListener, { capture: true });
 	worker.onerror = (event) => {
+		event.preventDefault?.();
 		if (state.disposed) return;
 		reportError(options, event.message || "Remote DOM widget worker failed", event.error);
 		disposeAfterFailure(state, false);
 	};
-	const ready = Promise.all([styles.ready, thread.imports.mount({
-		widgetType: options.artifact.widgetType,
-		props: initialProps
-	}, {
+	const hostApi = {
 		mutate(records) {
 			if (state.disposed) return;
 			connection.mutate(records);
 			rebuildNodeIndex(state);
+			enforceAllowedAnchorSafety(state);
 			flushPendingListenerUpdates(state);
 		},
 		callCapability(capability, method, payload) {
@@ -1723,7 +1795,15 @@ function mountRemoteDomWidget(options) {
 		reportError(error) {
 			reportError(options, error.message);
 		}
-	})]).then(() => void 0);
+	};
+	const ready = Promise.all([styles.ready, thread.imports.mount({
+		widgetType: options.artifact.widgetType,
+		props: initialProps,
+		...options.artifact.networkAccessGranted === true ? {
+			networkAccessGranted: true,
+			hostOrigin: options.hostOrigin
+		} : {}
+	}, hostApi)]).then(() => void 0);
 	ready.catch((error) => {
 		if (state.disposed) return;
 		reportError(options, "Remote DOM widget failed to mount", error);
@@ -1849,6 +1929,10 @@ function handleNavigationIntent(state, event) {
 	const anchor = (event.target instanceof Element ? event.target : event.target instanceof Text ? event.target.parentElement : null)?.closest("a[href]");
 	if (!(anchor instanceof HTMLAnchorElement)) return;
 	if (!state.shadowRoot.contains(anchor)) return;
+	if (resolveAllowedAnchorUrl(anchor.getAttribute("href"), state.options.allowedAnchorUrls)) {
+		enforceAllowedAnchorSafetyAttributes(anchor);
+		return;
+	}
 	if (event.cancelable) event.preventDefault();
 	const href = sanitizeRemoteDomUrl(anchor.getAttribute("href"), {
 		allowHashOnly: true,
@@ -1944,6 +2028,31 @@ function normalizeNavigationOrigin(value) {
 		return;
 	}
 }
+function resolveAllowedAnchorUrl(href, allowedAnchorUrls) {
+	if (!href || !allowedAnchorUrls) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(href);
+	} catch {
+		return;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return;
+	return allowedAnchorUrls.has(parsed.href) ? parsed.href : void 0;
+}
+function enforceAllowedAnchorSafety(state) {
+	for (const anchor of state.shadowRoot.querySelectorAll("a[href]")) {
+		if (!resolveAllowedAnchorUrl(anchor.getAttribute("href"), state.options.allowedAnchorUrls)) continue;
+		enforceAllowedAnchorSafetyAttributes(anchor);
+	}
+}
+function enforceAllowedAnchorSafetyAttributes(anchor) {
+	anchor.target = "_blank";
+	const relTokens = new Set(anchor.rel.split(/\s+/u).filter(Boolean));
+	relTokens.add("noopener");
+	relTokens.add("noreferrer");
+	anchor.rel = Array.from(relTokens).join(" ");
+	anchor.removeAttribute("download");
+}
 function resolveInternalNavigationUrl(href, navigationOrigin) {
 	if (href.startsWith("#")) return href;
 	if (href.startsWith("//") || /^https?:(?!\/\/)/iu.test(href)) return;
@@ -2078,4 +2187,4 @@ function isPromiseLike(value) {
 //#endregion
 export { mountRemoteDomWidget as t };
 
-//# sourceMappingURL=remote-dom-renderer-DcwcNPsu.mjs.map
+//# sourceMappingURL=remote-dom-renderer-CpdKWANy.mjs.map