@fluid-app/widget-runtime 0.1.2 → 0.1.3

package/dist/worker.cjs

@@ -111,8 +111,23 @@ function assertMetadataPart(value, part) {
 //#endregion
 //#region src/worker-network-access.ts
 const guards = /* @__PURE__ */ new WeakMap();
+/** Registered symbol so every module instance of this file sees the same
+*  brand — a module-local `Symbol()` would duplicate exactly like the
+*  WeakMap above and detect nothing. The brand carries no capability:
+*  forging or stripping it never opens a network grant (every branch
+*  still fails closed); it only keeps the duplicate-instance vs
+*  native-pre-seal diagnosis trustworthy. */
+const GUARDED_FETCH_BRAND = Symbol.for("fluid.remote-dom.guarded-fetch");
+var RemoteDomDuplicateNetworkGuardError = class extends Error {
+	constructor() {
+		super("Remote DOM worker network guard is already installed by another module instance of @fluid-app/widget-runtime. The dev server served the worker SDK subgraph under two module URLs; previews must resolve it to a single module instance.");
+		this.name = "RemoteDomDuplicateNetworkGuardError";
+	}
+};
 function prepareRemoteDomWorkerNetworkAccess(globals = globalThis) {
 	if (guards.has(globals)) return;
+	const existingFetch = Reflect.get(globals, "fetch");
+	if (typeof existingFetch === "function" && Reflect.get(existingFetch, GUARDED_FETCH_BRAND) === true) throw new RemoteDomDuplicateNetworkGuardError();
 	const nativeFetch = readNativeFetch(globals);
 	const NativeUrl = readNativeUrl(globals);
 	const baseUrl = readBaseUrl(globals);
@@ -124,6 +139,12 @@ function prepareRemoteDomWorkerNetworkAccess(globals = globalThis) {
 		if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) return Promise.reject(/* @__PURE__ */ new Error(`Remote DOM worker cannot fetch ${target.origin}.`));
 		return nativeFetch.call(globals, input, init);
 	};
+	Object.defineProperty(guardedFetch, GUARDED_FETCH_BRAND, {
+		configurable: false,
+		enumerable: false,
+		value: true,
+		writable: false
+	});
 	Object.defineProperty(globals, "fetch", {
 		configurable: false,
 		enumerable: false,
@@ -237,11 +258,8 @@ function startRemoteDomWidgetWorkerInternal(options, testEnvironment) {
 	const networkGuardEnabled = testEnvironment?.disableLockdown !== true;
 	if (networkGuardEnabled) try {
 		prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);
-	} catch {
-		failClosedWorker(workerSelf, {
-			lockedGlobals: [],
-			failedGlobals: ["fetch"]
-		});
+	} catch (error) {
+		failClosedWorkerOnNetworkGuardError(workerSelf, error);
 	}
 	if (testEnvironment?.disableLockdown !== true) {
 		const lockdownResult = lockdownRemoteDomWorkerGlobals({ globals: lockdownGlobals });
@@ -424,11 +442,18 @@ function reportWorkerError(host, error, fallbackMessage) {
 	} catch {}
 }
 function failClosedWorker(workerSelf, result) {
+	shutdownWorkerScope(workerSelf);
+	throw new Error(`Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(", ")}.`);
+}
+function failClosedWorkerOnNetworkGuardError(workerSelf, error) {
+	shutdownWorkerScope(workerSelf);
+	throw new Error(`Remote DOM worker network guard install failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+}
+function shutdownWorkerScope(workerSelf) {
 	try {
 		workerSelf.onmessage = null;
 	} catch {}
 	workerSelf.close?.();
-	throw new Error(`Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(", ")}.`);
 }
 function readGlobalWorkerSelf() {
 	const candidate = globalThis;

package/dist/worker.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"worker.cjs","names":["isRemoteDomSerializableValue","isRemoteDomSerializableValue","Thread"],"sources":["../src/worker-lockdown.ts","../src/worker-capability-function.ts","../src/worker-network-access.ts","../src/worker-runtime.ts"],"sourcesContent":["export interface RemoteDomWorkerLockdownOptions {\n  readonly globals?: object | undefined;\n  readonly mode?: \"throw\" | \"undefined\" | undefined;\n}\n\nexport interface RemoteDomWorkerLockdownResult {\n  readonly lockedGlobals: readonly string[];\n  readonly failedGlobals: readonly string[];\n}\n\nconst DISALLOWED_GLOBAL_NAMES = [\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"EventSource\",\n  \"WebSocketStream\",\n  \"WebTransport\",\n  \"RTCPeerConnection\",\n  \"importScripts\",\n  \"localStorage\",\n  \"sessionStorage\",\n  \"indexedDB\",\n  \"caches\",\n  \"BroadcastChannel\",\n  \"Worker\",\n  \"SharedWorker\",\n  \"ShadowRealm\",\n] as const;\n\nexport function lockdownRemoteDomWorkerGlobals(\n  options: RemoteDomWorkerLockdownOptions = {},\n): RemoteDomWorkerLockdownResult {\n  const globals = options.globals ?? globalThis;\n  const mode = options.mode ?? \"throw\";\n  const lockedGlobals: string[] = [];\n  const failedGlobals: string[] = [];\n\n  for (const name of DISALLOWED_GLOBAL_NAMES) {\n    if (lockdownGlobal(globals, name, mode)) {\n      lockedGlobals.push(name);\n    } else {\n      failedGlobals.push(name);\n    }\n  }\n\n  return { lockedGlobals, failedGlobals };\n}\n\nfunction lockdownGlobal(\n  globals: object,\n  name: string,\n  mode: \"throw\" | \"undefined\",\n): boolean {\n  const replacement =\n    mode === \"throw\" ? createFailClosedGlobal(name) : undefined;\n\n  try {\n    Object.defineProperty(globals, name, {\n      configurable: false,\n      enumerable: false,\n      value: replacement,\n      writable: false,\n    });\n    return true;\n  } catch {\n    try {\n      delete (globals as Record<string, unknown>)[name];\n      return !(name in globals);\n    } catch {\n      return false;\n    }\n  }\n}\n\nfunction createFailClosedGlobal(name: string): () => never {\n  return function failClosedGlobal(): never {\n    throw new Error(`Remote DOM worker global ${name} is unavailable.`);\n  };\n}\n","import { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\n\nexport interface RemoteDomCapabilityDeclaration {\n  readonly name: string;\n  readonly version: string;\n}\n\nexport interface RemoteDomCapabilityFunctionMetadata {\n  readonly capability: string;\n  readonly version: string;\n  readonly method: string;\n}\n\nexport type RemoteDomCapabilityFunctionErrorCode =\n  | \"NOT_MOUNTED\"\n  | \"NOT_DECLARED\"\n  | \"INVALID_ARGUMENT\"\n  | \"INVALID_RESPONSE\";\n\nexport class RemoteDomCapabilityFunctionError extends Error {\n  override readonly name = \"RemoteDomCapabilityFunctionError\";\n  readonly code: RemoteDomCapabilityFunctionErrorCode;\n\n  constructor(code: RemoteDomCapabilityFunctionErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport type RemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n> = [Input] extends [void]\n  ? () => Promise<Output>\n  : (input: Input) => Promise<Output>;\n\ninterface RemoteDomCapabilitySession {\n  readonly widgetType: string;\n  readonly declarations: readonly RemoteDomCapabilityFunctionMetadata[];\n  readonly callCapability: (\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ) => Promise<RemoteDomSerializableValue>;\n}\n\nconst REMOTE_DOM_CAPABILITY_FUNCTION_METADATA = Symbol(\n  \"fluid.remote-dom-capability-function-metadata\",\n);\n\nlet activeCapabilitySession: RemoteDomCapabilitySession | undefined;\n\nexport function defineRemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n>(\n  metadata: RemoteDomCapabilityFunctionMetadata,\n): RemoteDomCapabilityFunction<Output, Input> {\n  assertMetadataPart(metadata.capability, \"capability\");\n  assertMetadataPart(metadata.version, \"version\");\n  assertMetadataPart(metadata.method, \"method\");\n\n  const stableMetadata = { ...metadata };\n  const capabilityFunction = async (\n    ...args: readonly (RemoteDomSerializableValue | undefined)[]\n  ): Promise<Output> => {\n    const [input] = args;\n    const session = activeCapabilitySession;\n    if (!session) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_MOUNTED\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" can only be called while a Remote DOM widget is mounted.`,\n      );\n    }\n\n    const isDeclared = session.declarations.some(\n      ({ capability, version, method }) =>\n        capability === stableMetadata.capability &&\n        method === stableMetadata.method &&\n        version === stableMetadata.version,\n    );\n    if (!isDeclared) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_DECLARED\",\n        `Capability \"${stableMetadata.capability}\" version \"${stableMetadata.version}\" is not declared for widget \"${session.widgetType}\". Add this function to defineWidget({ uses: [...] }).`,\n      );\n    }\n\n    if (\n      args.length > 1 ||\n      (args.length === 1 &&\n        (input === undefined || !isRemoteDomSerializableValue(input)))\n    ) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_ARGUMENT\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received an argument that is not JSON-serializable.`,\n      );\n    }\n\n    const response = await session.callCapability(\n      stableMetadata.capability,\n      stableMetadata.method,\n      input,\n    );\n    if (!isRemoteDomSerializableValue(response)) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_RESPONSE\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received a host response that is not JSON-serializable.`,\n      );\n    }\n\n    return response as Output;\n  };\n\n  Object.defineProperty(\n    capabilityFunction,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n    {\n      value: stableMetadata,\n    },\n  );\n\n  return capabilityFunction as RemoteDomCapabilityFunction<Output, Input>;\n}\n\nexport function getRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): RemoteDomCapabilityFunctionMetadata | undefined {\n  if (typeof value !== \"function\") return undefined;\n\n  const descriptor = Object.getOwnPropertyDescriptor(\n    value,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n  );\n  const metadata = descriptor?.value;\n  if (!isRemoteDomCapabilityFunctionMetadata(metadata)) return undefined;\n\n  return { ...metadata };\n}\n\n/** @internal Used by the worker lifecycle to scope direct capability calls. */\nexport function bindRemoteDomCapabilitySession(\n  session: RemoteDomCapabilitySession,\n): () => void {\n  if (activeCapabilitySession) {\n    throw new Error(\"A Remote DOM capability session is already active.\");\n  }\n\n  activeCapabilitySession = session;\n  return () => {\n    if (activeCapabilitySession === session) {\n      activeCapabilitySession = undefined;\n    }\n  };\n}\n\nfunction isRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): value is RemoteDomCapabilityFunctionMetadata {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  return (\n    \"capability\" in value &&\n    typeof value.capability === \"string\" &&\n    value.capability.length > 0 &&\n    \"version\" in value &&\n    typeof value.version === \"string\" &&\n    value.version.length > 0 &&\n    \"method\" in value &&\n    typeof value.method === \"string\" &&\n    value.method.length > 0\n  );\n}\n\nfunction assertMetadataPart(value: string, part: string): void {\n  if (value.length === 0) {\n    throw new Error(`Remote DOM capability function ${part} cannot be empty.`);\n  }\n}\n","type NativeFetch = typeof fetch;\n\nexport interface RemoteDomWorkerNetworkAccessSession {\n  readonly granted: boolean;\n  readonly hostOrigin?: string | undefined;\n}\n\ninterface NetworkAccessGuard {\n  setSession(session: RemoteDomWorkerNetworkAccessSession): void;\n  clearSession(): void;\n}\n\nconst guards = new WeakMap<object, NetworkAccessGuard>();\n\nexport function prepareRemoteDomWorkerNetworkAccess(\n  globals: object = globalThis,\n): void {\n  if (guards.has(globals)) return;\n\n  const nativeFetch = readNativeFetch(globals);\n  const NativeUrl = readNativeUrl(globals);\n  const baseUrl = readBaseUrl(globals);\n  let session: RemoteDomWorkerNetworkAccessSession = { granted: false };\n  const guardedFetch: NativeFetch = (input, init) => {\n    if (!session.granted) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker network access is not granted.\"),\n      );\n    }\n\n    const target = getFetchTarget(input, NativeUrl, baseUrl);\n    if (!target) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker cannot validate the fetch target.\"),\n      );\n    }\n    if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) {\n      return Promise.reject(\n        new Error(`Remote DOM worker cannot fetch ${target.origin}.`),\n      );\n    }\n    return nativeFetch.call(globals, input, init);\n  };\n\n  Object.defineProperty(globals, \"fetch\", {\n    configurable: false,\n    enumerable: false,\n    value: guardedFetch,\n    writable: false,\n  });\n  guards.set(globals, {\n    setSession(nextSession) {\n      session = nextSession;\n    },\n    clearSession() {\n      session = { granted: false };\n    },\n  });\n}\n\nexport function bindRemoteDomWorkerNetworkAccessSession(\n  session: RemoteDomWorkerNetworkAccessSession,\n  globals: object = globalThis,\n): () => void {\n  prepareRemoteDomWorkerNetworkAccess(globals);\n  const guard = guards.get(globals);\n  if (!guard) {\n    throw new Error(\"Remote DOM worker network guard failed to initialize.\");\n  }\n  guard.setSession(session);\n  return () => guard.clearSession();\n}\n\nfunction readNativeFetch(globals: object): NativeFetch {\n  const candidate = Reflect.get(globals, \"fetch\") as unknown;\n  if (typeof candidate !== \"function\") {\n    return () =>\n      Promise.reject(\n        new Error(\"Remote DOM worker native fetch is unavailable.\"),\n      );\n  }\n  return candidate as NativeFetch;\n}\n\nfunction readNativeUrl(globals: object): typeof URL {\n  const candidate = Reflect.get(globals, \"URL\") as unknown;\n  return typeof candidate === \"function\" ? (candidate as typeof URL) : URL;\n}\n\nfunction readBaseUrl(globals: object): string | undefined {\n  const location = Reflect.get(globals, \"location\") as\n    | { href?: unknown }\n    | undefined;\n  return typeof location?.href === \"string\" ? location.href : undefined;\n}\n\nfunction getFetchTarget(\n  input: RequestInfo | URL,\n  NativeUrl: typeof URL,\n  baseUrl: string | undefined,\n): URL | undefined {\n  let value: string;\n  if (typeof input === \"string\") value = input;\n  else if (input instanceof NativeUrl) value = input.href;\n  else if (typeof input.url === \"string\") value = input.url;\n  else return undefined;\n\n  try {\n    return new NativeUrl(value, baseUrl);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isBlockedTarget(\n  target: URL,\n  hostOrigin: string | undefined,\n  NativeUrl: typeof URL,\n): boolean {\n  if (target.protocol !== \"http:\" && target.protocol !== \"https:\") return false;\n\n  if (hostOrigin) {\n    try {\n      const host = new NativeUrl(hostOrigin);\n      if (\n        target.protocol === host.protocol &&\n        normalizeHostname(target.hostname) ===\n          normalizeHostname(host.hostname) &&\n        target.port === host.port\n      ) {\n        return true;\n      }\n    } catch {\n      return true;\n    }\n  }\n\n  const hostname = normalizeHostname(target.hostname);\n  if (\n    hostname === \"fluid.app\" ||\n    hostname.endsWith(\".fluid.app\") ||\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return isPrivateIpv4(hostname) || isPrivateIpv6(hostname);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\")\n    .replace(/\\.$/, \"\");\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) return false;\n  const octets = parts.map(Number);\n  if (\n    octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return false;\n  }\n  const first = octets[0];\n  const second = octets[1];\n  if (first === undefined || second === undefined) return false;\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n}\n\nfunction isPrivateIpv6(hostname: string): boolean {\n  if (!hostname.includes(\":\")) return false;\n  const normalized = hostname.toLowerCase();\n  if (normalized === \"::\" || normalized === \"::1\") return true;\n  const firstGroup = normalized.split(\":\")[0] ?? \"\";\n  const firstValue = Number.parseInt(firstGroup || \"0\", 16);\n  if ((firstValue & 0xfe00) === 0xfc00 || (firstValue & 0xffc0) === 0xfe80) {\n    return true;\n  }\n  const mappedIpv4 = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(normalized)?.[1];\n  if (mappedIpv4) return isPrivateIpv4(mappedIpv4);\n\n  const mappedHex = /^::ffff:([\\da-f]{1,4}):([\\da-f]{1,4})$/.exec(normalized);\n  if (!mappedHex) return false;\n  const high = Number.parseInt(mappedHex[1] ?? \"\", 16);\n  const low = Number.parseInt(mappedHex[2] ?? \"\", 16);\n  return isPrivateIpv4(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);\n}\n","import { release, retain, Thread } from \"@quilted/threads\";\nimport type { ThreadMessageTarget } from \"@quilted/threads\";\nimport type { RemoteMutationRecord } from \"@remote-dom/core\";\nimport type { RemoteConnection } from \"@remote-dom/core/elements\";\nimport {\n  createContext,\n  createElement,\n  useContext,\n  useMemo,\n  type ComponentType,\n} from \"react\";\n\nimport { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\nimport { lockdownRemoteDomWorkerGlobals } from \"./worker-lockdown\";\nimport type { RemoteDomWorkerLockdownResult } from \"./worker-lockdown\";\nimport { bindRemoteDomCapabilitySession } from \"./worker-capability-function\";\nimport type {\n  RemoteDomCapabilityDeclaration,\n  RemoteDomCapabilityFunctionMetadata,\n} from \"./worker-capability-function\";\nimport {\n  bindRemoteDomWorkerNetworkAccessSession,\n  prepareRemoteDomWorkerNetworkAccess,\n} from \"./worker-network-access\";\n\ntype RemoteDomReactWorkerRendererModule =\n  typeof import(\"./worker-react-renderer\");\n\nexport interface RemoteDomWorkerGlobalScopeLike {\n  onmessage: ((event: MessageEvent<unknown>) => void) | null;\n  postMessage(message: unknown, transfer?: Transferable[]): void;\n  addEventListener?: (\n    type: \"message\",\n    listener: (event: MessageEvent<unknown>) => void,\n    options?: { signal?: AbortSignal },\n  ) => void;\n  close?: () => void;\n}\n\nexport interface RemoteDomWidgetWorkerHostApi {\n  mutate(records: readonly RemoteMutationRecord[]): void;\n  callCapability(\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n  reportError(error: { readonly message: string }): void;\n}\n\nexport interface RemoteDomWidgetWorkerMountOptions {\n  readonly widgetType: string;\n  readonly props: RemoteDomSerializableValue;\n  readonly networkAccessGranted?: boolean | undefined;\n  readonly hostOrigin?: string | undefined;\n}\n\nexport interface RemoteDomWidgetWorkerApi {\n  mount(\n    options: RemoteDomWidgetWorkerMountOptions,\n    host: RemoteDomWidgetWorkerHostApi,\n  ): Promise<void>;\n  updateProps(props: RemoteDomSerializableValue): Promise<void>;\n  dispose(): Promise<void>;\n}\n\ntype RemoteDomWidgetComponent = ComponentType<\n  Readonly<Record<string, unknown>>\n>;\n\nexport interface RemoteDomWidgetWorkerDefinition {\n  readonly component: RemoteDomWidgetComponent;\n  readonly capabilities: readonly RemoteDomCapabilityDeclaration[];\n  /** @internal Exact functions authorized for direct worker calls. */\n  readonly functions?: readonly RemoteDomCapabilityFunctionMetadata[];\n}\n\nexport type RemoteDomWidgetWorkerEntry =\n  | RemoteDomWidgetComponent\n  | RemoteDomWidgetWorkerDefinition;\n\nexport interface RemoteDomWidgetWorkerOptions {\n  readonly widgets: Readonly<Record<string, RemoteDomWidgetWorkerEntry>>;\n}\n\ninterface RemoteDomWidgetWorkerTestEnvironment {\n  readonly self: RemoteDomWorkerGlobalScopeLike;\n  readonly disableLockdown?: boolean;\n  readonly lockdownGlobals?: object;\n}\n\nexport interface RemoteDomWidgetWorkerController {\n  dispose(): void;\n}\n\nexport interface RemoteDomCapability {\n  call(\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n}\n\ntype CallCapability = RemoteDomWidgetWorkerHostApi[\"callCapability\"];\n\nconst RemoteDomCapabilityContext = createContext<CallCapability | undefined>(\n  undefined,\n);\n\nlet remoteDomReactWorkerRendererModulePromise:\n  | Promise<RemoteDomReactWorkerRendererModule>\n  | undefined;\n\nexport function useRemoteDomCapability(name: string): RemoteDomCapability {\n  const callCapability = useContext(RemoteDomCapabilityContext);\n  if (!callCapability) {\n    throw new Error(\n      \"useRemoteDomCapability must be used inside a Remote DOM widget.\",\n    );\n  }\n  if (name.length === 0) {\n    throw new Error(\"Remote DOM capability names cannot be empty.\");\n  }\n\n  return useMemo(\n    () => ({\n      call(method: string, payload?: RemoteDomSerializableValue) {\n        if (method.length === 0) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability method names cannot be empty.\"),\n          );\n        }\n        if (payload !== undefined && !isRemoteDomSerializableValue(payload)) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability payload must be serializable.\"),\n          );\n        }\n        return callCapability(name, method, payload);\n      },\n    }),\n    [callCapability, name],\n  );\n}\n\nexport function startRemoteDomWidgetWorker(\n  options: RemoteDomWidgetWorkerOptions,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options);\n}\n\nexport function prepareRemoteDomWidgetWorker(): void {\n  prepareRemoteDomWorkerNetworkAccess();\n}\n\n/** @internal Test-only injection; not exported from the package worker entry. */\nexport function startRemoteDomWidgetWorkerForTest(\n  options: RemoteDomWidgetWorkerOptions,\n  environment: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options, environment);\n}\n\nfunction startRemoteDomWidgetWorkerInternal(\n  options: RemoteDomWidgetWorkerOptions,\n  testEnvironment?: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  const workerSelf = testEnvironment?.self ?? readGlobalWorkerSelf();\n  const lockdownGlobals = testEnvironment?.lockdownGlobals ?? globalThis;\n  const networkGuardEnabled = testEnvironment?.disableLockdown !== true;\n\n  if (networkGuardEnabled) {\n    try {\n      prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);\n    } catch {\n      failClosedWorker(workerSelf, {\n        lockedGlobals: [],\n        failedGlobals: [\"fetch\"],\n      });\n    }\n  }\n\n  if (testEnvironment?.disableLockdown !== true) {\n    const lockdownResult = lockdownRemoteDomWorkerGlobals({\n      globals: lockdownGlobals,\n    });\n    if (lockdownResult.failedGlobals.length > 0) {\n      failClosedWorker(workerSelf, lockdownResult);\n    }\n  }\n\n  let disposed = false;\n  let mounted = false;\n  let renderer:\n    | ReturnType<\n        RemoteDomReactWorkerRendererModule[\"createRemoteDomReactWorkerRenderer\"]\n      >\n    | undefined;\n  let host: RemoteDomWidgetWorkerHostApi | undefined;\n  let props: RemoteDomSerializableValue | undefined;\n  let widget: RemoteDomWidgetComponent | undefined;\n  let clearCapabilitySession: (() => void) | undefined;\n  let clearNetworkAccessSession: (() => void) | undefined;\n  /** One stable context value per MOUNT, not per render.\n   *\n   *  `host` is fixed for the whole mount, so this closure is\n   *  semantically constant — but building it inline in render() gave it\n   *  a fresh identity every time. useRemoteDomCapability memoizes on\n   *  `[callCapability, name]`, so every render handed consumers a brand\n   *  new capability object and re-fired any effect keyed on it. Paired\n   *  with the portal calling updateProps on every parent re-render\n   *  (build-widget-registry serializes props into a fresh object each\n   *  time), that turned into one host RPC per re-render even when no\n   *  value changed. */\n  let capabilityValue: CallCapability | undefined;\n\n  const render = (): void => {\n    assertWorkerActive(disposed);\n    if (!mounted || !renderer || !host || !widget || props === undefined) {\n      throw new Error(\"Remote DOM widget worker has not been mounted.\");\n    }\n\n    const currentWidget = widget;\n    const node = createElement(currentWidget, toComponentProps(props));\n    renderer.render(\n      createElement(\n        RemoteDomCapabilityContext.Provider,\n        { value: capabilityValue },\n        node,\n      ),\n    );\n  };\n\n  const disposeMount = (): void => {\n    if (\n      !mounted &&\n      !renderer &&\n      !host &&\n      !clearCapabilitySession &&\n      !clearNetworkAccessSession\n    )\n      return;\n\n    const mountedRenderer = renderer;\n    const retainedHost = host;\n    const clearMountedCapabilitySession = clearCapabilitySession;\n    const clearMountedNetworkAccessSession = clearNetworkAccessSession;\n    renderer = undefined;\n    host = undefined;\n    props = undefined;\n    widget = undefined;\n    clearCapabilitySession = undefined;\n    clearNetworkAccessSession = undefined;\n    // Released with the mount it belongs to, so a remount cannot hand\n    // the next widget a closure over the previous host.\n    capabilityValue = undefined;\n    mounted = false;\n\n    const errors: unknown[] = [];\n    try {\n      clearMountedCapabilitySession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      clearMountedNetworkAccessSession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      mountedRenderer?.dispose();\n    } catch (error) {\n      errors.push(error);\n    }\n    if (retainedHost) {\n      try {\n        release(retainedHost);\n      } catch (error) {\n        errors.push(error);\n      }\n    }\n    if (errors.length > 0) {\n      throw new AggregateError(\n        errors,\n        \"Remote DOM widget worker cleanup failed.\",\n      );\n    }\n  };\n\n  const workerApi: RemoteDomWidgetWorkerApi = {\n    async mount(init, nextHost) {\n      assertWorkerActive(disposed);\n      if (mounted || renderer || host) {\n        throw new Error(\"Remote DOM widget worker is already mounted.\");\n      }\n      if (init.widgetType.length === 0) {\n        throw new Error(\"Remote DOM widget type cannot be empty.\");\n      }\n      if (!isRemoteDomSerializableValue(init.props)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      const selectedEntry = options.widgets[init.widgetType];\n      if (!selectedEntry) {\n        throw new Error(\n          `Remote DOM worker does not contain widget type ${init.widgetType}.`,\n        );\n      }\n      const selectedWidget = normalizeWidgetEntry(selectedEntry);\n\n      try {\n        retain(nextHost);\n        host = nextHost;\n        // Built once here, not per render — see capabilityValue above.\n        capabilityValue = (capability, method, payload) =>\n          nextHost.callCapability(capability, method, payload);\n        props = init.props;\n        widget = selectedWidget.component;\n        clearCapabilitySession = bindRemoteDomCapabilitySession({\n          widgetType: init.widgetType,\n          declarations: selectedWidget.functions ?? [],\n          callCapability: (capability, method, payload) =>\n            nextHost.callCapability(capability, method, payload),\n        });\n        if (networkGuardEnabled) {\n          clearNetworkAccessSession = bindRemoteDomWorkerNetworkAccessSession(\n            {\n              granted: init.networkAccessGranted === true,\n              hostOrigin: init.hostOrigin,\n            },\n            lockdownGlobals,\n          );\n        }\n        mounted = true;\n\n        const rendererModule = await loadRemoteDomWorkerReactRendererModule();\n        assertWorkerActive(disposed);\n        const connection: RemoteConnection = {\n          mutate(records) {\n            void Promise.resolve(nextHost.mutate(records)).catch(\n              () => undefined,\n            );\n          },\n          call() {\n            throw new Error(\n              \"Remote DOM worker widgets cannot invoke host element methods.\",\n            );\n          },\n        };\n        renderer = rendererModule.createRemoteDomReactWorkerRenderer({\n          connection,\n        });\n        render();\n      } catch (error) {\n        reportWorkerError(nextHost, error, \"Remote DOM widget mount failed.\");\n        try {\n          disposeMount();\n        } catch (cleanupError) {\n          reportWorkerError(\n            nextHost,\n            cleanupError,\n            \"Remote DOM widget cleanup failed.\",\n          );\n        }\n        throw error;\n      }\n    },\n    async updateProps(nextProps) {\n      assertWorkerActive(disposed);\n      if (!mounted) {\n        throw new Error(\"Remote DOM widget worker has not been mounted.\");\n      }\n      if (!isRemoteDomSerializableValue(nextProps)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      props = nextProps;\n      // The mount sets `mounted` before awaiting the renderer module, so\n      // there is a real window where the widget is mounting but has no\n      // renderer yet. Storing the props is the whole job in that window:\n      // the in-flight mount ends in its own render() call and picks them\n      // up, so the newer props win either way.\n      //\n      // Rendering here instead would throw \"has not been mounted\",\n      // report a fatal error to the host, and reject — for a widget that\n      // goes on to paint correctly. The portal calls updateProps from an\n      // effect keyed on a freshly-serialized props object every parent\n      // render (build-widget-registry.ts), and wires onError straight\n      // into setError, so that lands as a permanent \"Unable to render\"\n      // alert over a working widget.\n      if (!renderer) return;\n      try {\n        render();\n      } catch (error) {\n        if (host) {\n          reportWorkerError(host, error, \"Remote DOM widget render failed.\");\n        }\n        throw error;\n      }\n    },\n    async dispose() {\n      disposeMount();\n    },\n  };\n\n  const thread = new Thread<Record<string, never>, RemoteDomWidgetWorkerApi>(\n    toThreadMessageTarget(workerSelf),\n    { exports: workerApi },\n  );\n\n  return {\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      const errors: unknown[] = [];\n      try {\n        disposeMount();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        thread.close();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        workerSelf.onmessage = null;\n      } catch (error) {\n        errors.push(error);\n      }\n      if (errors.length > 0) {\n        throw new AggregateError(\n          errors,\n          \"Remote DOM widget worker shutdown failed.\",\n        );\n      }\n    },\n  };\n}\n\nfunction normalizeWidgetEntry(\n  entry: RemoteDomWidgetWorkerEntry,\n): RemoteDomWidgetWorkerDefinition {\n  if (typeof entry === \"function\") {\n    return { component: entry, capabilities: [] };\n  }\n\n  return entry;\n}\n\nfunction toComponentProps(\n  props: RemoteDomSerializableValue,\n): Readonly<Record<string, unknown>> {\n  return isObjectRecord(props) ? props : { value: props };\n}\n\nfunction assertWorkerActive(disposed: boolean): void {\n  if (disposed) {\n    throw new Error(\"Remote DOM widget worker has been disposed.\");\n  }\n}\n\nfunction loadRemoteDomWorkerReactRendererModule(): Promise<RemoteDomReactWorkerRendererModule> {\n  if (!remoteDomReactWorkerRendererModulePromise) {\n    remoteDomReactWorkerRendererModulePromise = (async () => {\n      await import(\"./worker-react-bootstrap\");\n      return import(\"./worker-react-renderer\");\n    })().catch((error: unknown) => {\n      remoteDomReactWorkerRendererModulePromise = undefined;\n      throw error;\n    });\n  }\n  return remoteDomReactWorkerRendererModulePromise;\n}\n\nfunction reportWorkerError(\n  host: RemoteDomWidgetWorkerHostApi,\n  error: unknown,\n  fallbackMessage: string,\n): void {\n  try {\n    host.reportError({\n      message: error instanceof Error ? error.message : fallbackMessage,\n    });\n  } catch {\n    // The host proxy may already be closed during teardown.\n  }\n}\n\nfunction failClosedWorker(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  result: RemoteDomWorkerLockdownResult,\n): never {\n  try {\n    workerSelf.onmessage = null;\n  } catch {\n    // The error below still prevents the worker runtime from starting.\n  }\n  workerSelf.close?.();\n  throw new Error(\n    `Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(\", \")}.`,\n  );\n}\n\nfunction readGlobalWorkerSelf(): RemoteDomWorkerGlobalScopeLike {\n  const candidate = globalThis as Partial<RemoteDomWorkerGlobalScopeLike>;\n  if (typeof candidate.postMessage !== \"function\") {\n    throw new Error(\n      \"Remote DOM widget runtime requires a Worker global scope.\",\n    );\n  }\n  if (candidate.onmessage === undefined) {\n    candidate.onmessage = null;\n  }\n  return candidate as RemoteDomWorkerGlobalScopeLike;\n}\n\nfunction toThreadMessageTarget(\n  scope: RemoteDomWorkerGlobalScopeLike,\n): ThreadMessageTarget {\n  return {\n    send(message, transferables) {\n      scope.postMessage(message, transferables ?? []);\n    },\n    listen(listener, { signal }) {\n      if (scope.addEventListener) {\n        scope.addEventListener(\"message\", (event) => listener(event.data), {\n          signal,\n        });\n        return;\n      }\n\n      scope.onmessage = (event) => listener(event.data);\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          scope.onmessage = null;\n        },\n        { once: true },\n      );\n    },\n  };\n}\n\nfunction isObjectRecord(\n  value: unknown,\n): value is Readonly<Record<string, RemoteDomSerializableValue>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;;;;;AAUA,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAgB,+BACd,UAA0C,EAAE,EACb;CAC/B,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,gBAA0B,EAAE;CAClC,MAAM,gBAA0B,EAAE;AAElC,MAAK,MAAM,QAAQ,wBACjB,KAAI,eAAe,SAAS,MAAM,KAAK,CACrC,eAAc,KAAK,KAAK;KAExB,eAAc,KAAK,KAAK;AAI5B,QAAO;EAAE;EAAe;EAAe;;AAGzC,SAAS,eACP,SACA,MACA,MACS;CACT,MAAM,cACJ,SAAS,UAAU,uBAAuB,KAAK,GAAG,KAAA;AAEpD,KAAI;AACF,SAAO,eAAe,SAAS,MAAM;GACnC,cAAc;GACd,YAAY;GACZ,OAAO;GACP,UAAU;GACX,CAAC;AACF,SAAO;SACD;AACN,MAAI;AACF,UAAQ,QAAoC;AAC5C,UAAO,EAAE,QAAQ;UACX;AACN,UAAO;;;;AAKb,SAAS,uBAAuB,MAA2B;AACzD,QAAO,SAAS,mBAA0B;AACxC,QAAM,IAAI,MAAM,4BAA4B,KAAK,kBAAkB;;;;;ACvDvE,IAAa,mCAAb,cAAsD,MAAM;CAC1D,OAAyB;CACzB;CAEA,YAAY,MAA4C,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;;;AAqBhB,MAAM,0CAA0C,OAC9C,gDACD;AAED,IAAI;AAEJ,SAAgB,kCAId,UAC4C;AAC5C,oBAAmB,SAAS,YAAY,aAAa;AACrD,oBAAmB,SAAS,SAAS,UAAU;AAC/C,oBAAmB,SAAS,QAAQ,SAAS;CAE7C,MAAM,iBAAiB,EAAE,GAAG,UAAU;CACtC,MAAM,qBAAqB,OACzB,GAAG,SACiB;EACpB,MAAM,CAAC,SAAS;EAChB,MAAM,UAAU;AAChB,MAAI,CAAC,QACH,OAAM,IAAI,iCACR,eACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,4DAC5E;AASH,MAAI,CANe,QAAQ,aAAa,MACrC,EAAE,YAAY,SAAS,aACtB,eAAe,eAAe,cAC9B,WAAW,eAAe,UAC1B,YAAY,eAAe,QAC9B,CAEC,OAAM,IAAI,iCACR,gBACA,eAAe,eAAe,WAAW,aAAa,eAAe,QAAQ,gCAAgC,QAAQ,WAAW,wDACjI;AAGH,MACE,KAAK,SAAS,KACb,KAAK,WAAW,MACd,UAAU,KAAA,KAAa,CAACA,0BAAAA,6BAA6B,MAAM,EAE9D,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,uDAC5E;EAGH,MAAM,WAAW,MAAM,QAAQ,eAC7B,eAAe,YACf,eAAe,QACf,MACD;AACD,MAAI,CAACA,0BAAAA,6BAA6B,SAAS,CACzC,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,2DAC5E;AAGH,SAAO;;AAGT,QAAO,eACL,oBACA,yCACA,EACE,OAAO,gBACR,CACF;AAED,QAAO;;AAGT,SAAgB,uCACd,OACiD;AACjD,KAAI,OAAO,UAAU,WAAY,QAAO,KAAA;CAMxC,MAAM,WAJa,OAAO,yBACxB,OACA,wCACD,EAC4B;AAC7B,KAAI,CAAC,sCAAsC,SAAS,CAAE,QAAO,KAAA;AAE7D,QAAO,EAAE,GAAG,UAAU;;;AAIxB,SAAgB,+BACd,SACY;AACZ,KAAI,wBACF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,2BAA0B;AAC1B,cAAa;AACX,MAAI,4BAA4B,QAC9B,2BAA0B,KAAA;;;AAKhC,SAAS,sCACP,OAC8C;AAC9C,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,QAAO;AAGT,QACE,gBAAgB,SAChB,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS,KACvB,YAAY,SACZ,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS;;AAI1B,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MAAM,kCAAkC,KAAK,mBAAmB;;;;ACvK9E,MAAM,yBAAS,IAAI,SAAqC;AAExD,SAAgB,oCACd,UAAkB,YACZ;AACN,KAAI,OAAO,IAAI,QAAQ,CAAE;CAEzB,MAAM,cAAc,gBAAgB,QAAQ;CAC5C,MAAM,YAAY,cAAc,QAAQ;CACxC,MAAM,UAAU,YAAY,QAAQ;CACpC,IAAI,UAA+C,EAAE,SAAS,OAAO;CACrE,MAAM,gBAA6B,OAAO,SAAS;AACjD,MAAI,CAAC,QAAQ,QACX,QAAO,QAAQ,uBACb,IAAI,MAAM,mDAAmD,CAC9D;EAGH,MAAM,SAAS,eAAe,OAAO,WAAW,QAAQ;AACxD,MAAI,CAAC,OACH,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,gBAAgB,QAAQ,QAAQ,YAAY,UAAU,CACxD,QAAO,QAAQ,uBACb,IAAI,MAAM,kCAAkC,OAAO,OAAO,GAAG,CAC9D;AAEH,SAAO,YAAY,KAAK,SAAS,OAAO,KAAK;;AAG/C,QAAO,eAAe,SAAS,SAAS;EACtC,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,IAAI,SAAS;EAClB,WAAW,aAAa;AACtB,aAAU;;EAEZ,eAAe;AACb,aAAU,EAAE,SAAS,OAAO;;EAE/B,CAAC;;AAGJ,SAAgB,wCACd,SACA,UAAkB,YACN;AACZ,qCAAoC,QAAQ;CAC5C,MAAM,QAAQ,OAAO,IAAI,QAAQ;AACjC,KAAI,CAAC,MACH,OAAM,IAAI,MAAM,wDAAwD;AAE1E,OAAM,WAAW,QAAQ;AACzB,cAAa,MAAM,cAAc;;AAGnC,SAAS,gBAAgB,SAA8B;CACrD,MAAM,YAAY,QAAQ,IAAI,SAAS,QAAQ;AAC/C,KAAI,OAAO,cAAc,WACvB,cACE,QAAQ,uBACN,IAAI,MAAM,iDAAiD,CAC5D;AAEL,QAAO;;AAGT,SAAS,cAAc,SAA6B;CAClD,MAAM,YAAY,QAAQ,IAAI,SAAS,MAAM;AAC7C,QAAO,OAAO,cAAc,aAAc,YAA2B;;AAGvE,SAAS,YAAY,SAAqC;CACxD,MAAM,WAAW,QAAQ,IAAI,SAAS,WAAW;AAGjD,QAAO,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,KAAA;;AAG9D,SAAS,eACP,OACA,WACA,SACiB;CACjB,IAAI;AACJ,KAAI,OAAO,UAAU,SAAU,SAAQ;UAC9B,iBAAiB,UAAW,SAAQ,MAAM;UAC1C,OAAO,MAAM,QAAQ,SAAU,SAAQ,MAAM;KACjD,QAAO,KAAA;AAEZ,KAAI;AACF,SAAO,IAAI,UAAU,OAAO,QAAQ;SAC9B;AACN;;;AAIJ,SAAS,gBACP,QACA,YACA,WACS;AACT,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AAExE,KAAI,WACF,KAAI;EACF,MAAM,OAAO,IAAI,UAAU,WAAW;AACtC,MACE,OAAO,aAAa,KAAK,YACzB,kBAAkB,OAAO,SAAS,KAChC,kBAAkB,KAAK,SAAS,IAClC,OAAO,SAAS,KAAK,KAErB,QAAO;SAEH;AACN,SAAO;;CAIX,MAAM,WAAW,kBAAkB,OAAO,SAAS;AACnD,KACE,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,SAAS,SAAS,aAAa,CAE/B,QAAO;AAET,QAAO,cAAc,SAAS,IAAI,cAAc,SAAS;;AAG3D,SAAS,kBAAkB,UAA0B;AACnD,QAAO,SACJ,aAAa,CACb,QAAQ,YAAY,GAAG,CACvB,QAAQ,OAAO,GAAG;;AAGvB,SAAS,cAAc,UAA2B;CAChD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,SAAS,MAAM,IAAI,OAAO;AAChC,KACE,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAExE,QAAO;CAET,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,OAAO;AACtB,KAAI,UAAU,KAAA,KAAa,WAAW,KAAA,EAAW,QAAO;AACxD,QACE,UAAU,KACV,UAAU,MACV,UAAU,OACT,UAAU,OAAO,WAAW,OAC5B,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW;;AAIjC,SAAS,cAAc,UAA2B;AAChD,KAAI,CAAC,SAAS,SAAS,IAAI,CAAE,QAAO;CACpC,MAAM,aAAa,SAAS,aAAa;AACzC,KAAI,eAAe,QAAQ,eAAe,MAAO,QAAO;CACxD,MAAM,aAAa,WAAW,MAAM,IAAI,CAAC,MAAM;CAC/C,MAAM,aAAa,OAAO,SAAS,cAAc,KAAK,GAAG;AACzD,MAAK,aAAa,WAAY,UAAW,aAAa,WAAY,MAChE,QAAO;CAET,MAAM,aAAa,gCAAgC,KAAK,WAAW,GAAG;AACtE,KAAI,WAAY,QAAO,cAAc,WAAW;CAEhD,MAAM,YAAY,yCAAyC,KAAK,WAAW;AAC3E,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,OAAO,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;CACpD,MAAM,MAAM,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;AACnD,QAAO,cAAc,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAK,GAAG,OAAO,EAAE,GAAG,MAAM,MAAO;;;;AC1F/E,MAAM,8BAAA,GAAA,MAAA,eACJ,KAAA,EACD;AAED,IAAI;AAIJ,SAAgB,uBAAuB,MAAmC;CACxE,MAAM,kBAAA,GAAA,MAAA,YAA4B,2BAA2B;AAC7D,KAAI,CAAC,eACH,OAAM,IAAI,MACR,kEACD;AAEH,KAAI,KAAK,WAAW,EAClB,OAAM,IAAI,MAAM,+CAA+C;AAGjE,SAAA,GAAA,MAAA,gBACS,EACL,KAAK,QAAgB,SAAsC;AACzD,MAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,YAAY,KAAA,KAAa,CAACC,0BAAAA,6BAA6B,QAAQ,CACjE,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,SAAO,eAAe,MAAM,QAAQ,QAAQ;IAE/C,GACD,CAAC,gBAAgB,KAAK,CACvB;;AAGH,SAAgB,2BACd,SACiC;AACjC,QAAO,mCAAmC,QAAQ;;AAGpD,SAAgB,+BAAqC;AACnD,sCAAqC;;AAWvC,SAAS,mCACP,SACA,iBACiC;CACjC,MAAM,aAAa,iBAAiB,QAAQ,sBAAsB;CAClE,MAAM,kBAAkB,iBAAiB,mBAAmB;CAC5D,MAAM,sBAAsB,iBAAiB,oBAAoB;AAEjE,KAAI,oBACF,KAAI;AACF,sCAAoC,gBAAgB;SAC9C;AACN,mBAAiB,YAAY;GAC3B,eAAe,EAAE;GACjB,eAAe,CAAC,QAAQ;GACzB,CAAC;;AAIN,KAAI,iBAAiB,oBAAoB,MAAM;EAC7C,MAAM,iBAAiB,+BAA+B,EACpD,SAAS,iBACV,CAAC;AACF,MAAI,eAAe,cAAc,SAAS,EACxC,kBAAiB,YAAY,eAAe;;CAIhD,IAAI,WAAW;CACf,IAAI,UAAU;CACd,IAAI;CAKJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;;;;;;;;;;;CAYJ,IAAI;CAEJ,MAAM,eAAqB;AACzB,qBAAmB,SAAS;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,UAAU,KAAA,EACzD,OAAM,IAAI,MAAM,iDAAiD;EAInE,MAAM,QAAA,GAAA,MAAA,eADgB,QACoB,iBAAiB,MAAM,CAAC;AAClE,WAAS,QAAA,GAAA,MAAA,eAEL,2BAA2B,UAC3B,EAAE,OAAO,iBAAiB,EAC1B,KACD,CACF;;CAGH,MAAM,qBAA2B;AAC/B,MACE,CAAC,WACD,CAAC,YACD,CAAC,QACD,CAAC,0BACD,CAAC,0BAED;EAEF,MAAM,kBAAkB;EACxB,MAAM,eAAe;EACrB,MAAM,gCAAgC;EACtC,MAAM,mCAAmC;AACzC,aAAW,KAAA;AACX,SAAO,KAAA;AACP,UAAQ,KAAA;AACR,WAAS,KAAA;AACT,2BAAyB,KAAA;AACzB,8BAA4B,KAAA;AAG5B,oBAAkB,KAAA;AAClB,YAAU;EAEV,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,oCAAiC;WAC1B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,uCAAoC;WAC7B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,oBAAiB,SAAS;WACnB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,aACF,KAAI;AACF,kBAAA,QAAQ,aAAa;WACd,OAAO;AACd,UAAO,KAAK,MAAM;;AAGtB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,2CACD;;CAwHL,MAAM,SAAS,IAAIC,eAAAA,OACjB,sBAAsB,WAAW,EACjC,EAAE,SAtHwC;EAC1C,MAAM,MAAM,MAAM,UAAU;AAC1B,sBAAmB,SAAS;AAC5B,OAAI,WAAW,YAAY,KACzB,OAAM,IAAI,MAAM,+CAA+C;AAEjE,OAAI,KAAK,WAAW,WAAW,EAC7B,OAAM,IAAI,MAAM,0CAA0C;AAE5D,OAAI,CAACD,0BAAAA,6BAA6B,KAAK,MAAM,CAC3C,OAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM,gBAAgB,QAAQ,QAAQ,KAAK;AAC3C,OAAI,CAAC,cACH,OAAM,IAAI,MACR,kDAAkD,KAAK,WAAW,GACnE;GAEH,MAAM,iBAAiB,qBAAqB,cAAc;AAE1D,OAAI;AACF,mBAAA,OAAO,SAAS;AAChB,WAAO;AAEP,uBAAmB,YAAY,QAAQ,YACrC,SAAS,eAAe,YAAY,QAAQ,QAAQ;AACtD,YAAQ,KAAK;AACb,aAAS,eAAe;AACxB,6BAAyB,+BAA+B;KACtD,YAAY,KAAK;KACjB,cAAc,eAAe,aAAa,EAAE;KAC5C,iBAAiB,YAAY,QAAQ,YACnC,SAAS,eAAe,YAAY,QAAQ,QAAQ;KACvD,CAAC;AACF,QAAI,oBACF,6BAA4B,wCAC1B;KACE,SAAS,KAAK,yBAAyB;KACvC,YAAY,KAAK;KAClB,EACD,gBACD;AAEH,cAAU;IAEV,MAAM,iBAAiB,MAAM,wCAAwC;AACrE,uBAAmB,SAAS;AAa5B,eAAW,eAAe,mCAAmC,EAC3D,YAbmC;KACnC,OAAO,SAAS;AACT,cAAQ,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,YACvC,KAAA,EACP;;KAEH,OAAO;AACL,YAAM,IAAI,MACR,gEACD;;KAEJ,EAGA,CAAC;AACF,YAAQ;YACD,OAAO;AACd,sBAAkB,UAAU,OAAO,kCAAkC;AACrE,QAAI;AACF,mBAAc;aACP,cAAc;AACrB,uBACE,UACA,cACA,oCACD;;AAEH,UAAM;;;EAGV,MAAM,YAAY,WAAW;AAC3B,sBAAmB,SAAS;AAC5B,OAAI,CAAC,QACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,OAAI,CAACA,0BAAAA,6BAA6B,UAAU,CAC1C,OAAM,IAAI,MAAM,gDAAgD;AAGlE,WAAQ;AAcR,OAAI,CAAC,SAAU;AACf,OAAI;AACF,YAAQ;YACD,OAAO;AACd,QAAI,KACF,mBAAkB,MAAM,OAAO,mCAAmC;AAEpE,UAAM;;;EAGV,MAAM,UAAU;AACd,iBAAc;;EAEjB,EAIuB,CACvB;AAED,QAAO,EACL,UAAU;AACR,MAAI,SAAU;AACd,aAAW;EACX,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,iBAAc;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,UAAO,OAAO;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,cAAW,YAAY;WAChB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,4CACD;IAGN;;AAGH,SAAS,qBACP,OACiC;AACjC,KAAI,OAAO,UAAU,WACnB,QAAO;EAAE,WAAW;EAAO,cAAc,EAAE;EAAE;AAG/C,QAAO;;AAGT,SAAS,iBACP,OACmC;AACnC,QAAO,eAAe,MAAM,GAAG,QAAQ,EAAE,OAAO,OAAO;;AAGzD,SAAS,mBAAmB,UAAyB;AACnD,KAAI,SACF,OAAM,IAAI,MAAM,8CAA8C;;AAIlE,SAAS,yCAAsF;AAC7F,KAAI,CAAC,0CACH,8CAA6C,YAAY;AACvD,QAAA,QAAA,SAAA,CAAA,WAAA,QAAM,wCAAA,CAAA;AACN,SAAA,QAAA,SAAA,CAAA,WAAA,QAAO,uCAAA,CAAA;KACL,CAAC,OAAO,UAAmB;AAC7B,8CAA4C,KAAA;AAC5C,QAAM;GACN;AAEJ,QAAO;;AAGT,SAAS,kBACP,MACA,OACA,iBACM;AACN,KAAI;AACF,OAAK,YAAY,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,iBACnD,CAAC;SACI;;AAKV,SAAS,iBACP,YACA,QACO;AACP,KAAI;AACF,aAAW,YAAY;SACjB;AAGR,YAAW,SAAS;AACpB,OAAM,IAAI,MACR,kDAAkD,OAAO,cAAc,KAAK,KAAK,CAAC,GACnF;;AAGH,SAAS,uBAAuD;CAC9D,MAAM,YAAY;AAClB,KAAI,OAAO,UAAU,gBAAgB,WACnC,OAAM,IAAI,MACR,4DACD;AAEH,KAAI,UAAU,cAAc,KAAA,EAC1B,WAAU,YAAY;AAExB,QAAO;;AAGT,SAAS,sBACP,OACqB;AACrB,QAAO;EACL,KAAK,SAAS,eAAe;AAC3B,SAAM,YAAY,SAAS,iBAAiB,EAAE,CAAC;;EAEjD,OAAO,UAAU,EAAE,UAAU;AAC3B,OAAI,MAAM,kBAAkB;AAC1B,UAAM,iBAAiB,YAAY,UAAU,SAAS,MAAM,KAAK,EAAE,EACjE,QACD,CAAC;AACF;;AAGF,SAAM,aAAa,UAAU,SAAS,MAAM,KAAK;AACjD,WAAQ,iBACN,eACM;AACJ,UAAM,YAAY;MAEpB,EAAE,MAAM,MAAM,CACf;;EAEJ;;AAGH,SAAS,eACP,OAC+D;AAC/D,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}
+{"version":3,"file":"worker.cjs","names":["isRemoteDomSerializableValue","isRemoteDomSerializableValue","Thread"],"sources":["../src/worker-lockdown.ts","../src/worker-capability-function.ts","../src/worker-network-access.ts","../src/worker-runtime.ts"],"sourcesContent":["export interface RemoteDomWorkerLockdownOptions {\n  readonly globals?: object | undefined;\n  readonly mode?: \"throw\" | \"undefined\" | undefined;\n}\n\nexport interface RemoteDomWorkerLockdownResult {\n  readonly lockedGlobals: readonly string[];\n  readonly failedGlobals: readonly string[];\n}\n\nconst DISALLOWED_GLOBAL_NAMES = [\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"EventSource\",\n  \"WebSocketStream\",\n  \"WebTransport\",\n  \"RTCPeerConnection\",\n  \"importScripts\",\n  \"localStorage\",\n  \"sessionStorage\",\n  \"indexedDB\",\n  \"caches\",\n  \"BroadcastChannel\",\n  \"Worker\",\n  \"SharedWorker\",\n  \"ShadowRealm\",\n] as const;\n\nexport function lockdownRemoteDomWorkerGlobals(\n  options: RemoteDomWorkerLockdownOptions = {},\n): RemoteDomWorkerLockdownResult {\n  const globals = options.globals ?? globalThis;\n  const mode = options.mode ?? \"throw\";\n  const lockedGlobals: string[] = [];\n  const failedGlobals: string[] = [];\n\n  for (const name of DISALLOWED_GLOBAL_NAMES) {\n    if (lockdownGlobal(globals, name, mode)) {\n      lockedGlobals.push(name);\n    } else {\n      failedGlobals.push(name);\n    }\n  }\n\n  return { lockedGlobals, failedGlobals };\n}\n\nfunction lockdownGlobal(\n  globals: object,\n  name: string,\n  mode: \"throw\" | \"undefined\",\n): boolean {\n  const replacement =\n    mode === \"throw\" ? createFailClosedGlobal(name) : undefined;\n\n  try {\n    Object.defineProperty(globals, name, {\n      configurable: false,\n      enumerable: false,\n      value: replacement,\n      writable: false,\n    });\n    return true;\n  } catch {\n    try {\n      delete (globals as Record<string, unknown>)[name];\n      return !(name in globals);\n    } catch {\n      return false;\n    }\n  }\n}\n\nfunction createFailClosedGlobal(name: string): () => never {\n  return function failClosedGlobal(): never {\n    throw new Error(`Remote DOM worker global ${name} is unavailable.`);\n  };\n}\n","import { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\n\nexport interface RemoteDomCapabilityDeclaration {\n  readonly name: string;\n  readonly version: string;\n}\n\nexport interface RemoteDomCapabilityFunctionMetadata {\n  readonly capability: string;\n  readonly version: string;\n  readonly method: string;\n}\n\nexport type RemoteDomCapabilityFunctionErrorCode =\n  | \"NOT_MOUNTED\"\n  | \"NOT_DECLARED\"\n  | \"INVALID_ARGUMENT\"\n  | \"INVALID_RESPONSE\";\n\nexport class RemoteDomCapabilityFunctionError extends Error {\n  override readonly name = \"RemoteDomCapabilityFunctionError\";\n  readonly code: RemoteDomCapabilityFunctionErrorCode;\n\n  constructor(code: RemoteDomCapabilityFunctionErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport type RemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n> = [Input] extends [void]\n  ? () => Promise<Output>\n  : (input: Input) => Promise<Output>;\n\ninterface RemoteDomCapabilitySession {\n  readonly widgetType: string;\n  readonly declarations: readonly RemoteDomCapabilityFunctionMetadata[];\n  readonly callCapability: (\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ) => Promise<RemoteDomSerializableValue>;\n}\n\nconst REMOTE_DOM_CAPABILITY_FUNCTION_METADATA = Symbol(\n  \"fluid.remote-dom-capability-function-metadata\",\n);\n\nlet activeCapabilitySession: RemoteDomCapabilitySession | undefined;\n\nexport function defineRemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n>(\n  metadata: RemoteDomCapabilityFunctionMetadata,\n): RemoteDomCapabilityFunction<Output, Input> {\n  assertMetadataPart(metadata.capability, \"capability\");\n  assertMetadataPart(metadata.version, \"version\");\n  assertMetadataPart(metadata.method, \"method\");\n\n  const stableMetadata = { ...metadata };\n  const capabilityFunction = async (\n    ...args: readonly (RemoteDomSerializableValue | undefined)[]\n  ): Promise<Output> => {\n    const [input] = args;\n    const session = activeCapabilitySession;\n    if (!session) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_MOUNTED\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" can only be called while a Remote DOM widget is mounted.`,\n      );\n    }\n\n    const isDeclared = session.declarations.some(\n      ({ capability, version, method }) =>\n        capability === stableMetadata.capability &&\n        method === stableMetadata.method &&\n        version === stableMetadata.version,\n    );\n    if (!isDeclared) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_DECLARED\",\n        `Capability \"${stableMetadata.capability}\" version \"${stableMetadata.version}\" is not declared for widget \"${session.widgetType}\". Add this function to defineWidget({ uses: [...] }).`,\n      );\n    }\n\n    if (\n      args.length > 1 ||\n      (args.length === 1 &&\n        (input === undefined || !isRemoteDomSerializableValue(input)))\n    ) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_ARGUMENT\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received an argument that is not JSON-serializable.`,\n      );\n    }\n\n    const response = await session.callCapability(\n      stableMetadata.capability,\n      stableMetadata.method,\n      input,\n    );\n    if (!isRemoteDomSerializableValue(response)) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_RESPONSE\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received a host response that is not JSON-serializable.`,\n      );\n    }\n\n    return response as Output;\n  };\n\n  Object.defineProperty(\n    capabilityFunction,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n    {\n      value: stableMetadata,\n    },\n  );\n\n  return capabilityFunction as RemoteDomCapabilityFunction<Output, Input>;\n}\n\nexport function getRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): RemoteDomCapabilityFunctionMetadata | undefined {\n  if (typeof value !== \"function\") return undefined;\n\n  const descriptor = Object.getOwnPropertyDescriptor(\n    value,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n  );\n  const metadata = descriptor?.value;\n  if (!isRemoteDomCapabilityFunctionMetadata(metadata)) return undefined;\n\n  return { ...metadata };\n}\n\n/** @internal Used by the worker lifecycle to scope direct capability calls. */\nexport function bindRemoteDomCapabilitySession(\n  session: RemoteDomCapabilitySession,\n): () => void {\n  if (activeCapabilitySession) {\n    throw new Error(\"A Remote DOM capability session is already active.\");\n  }\n\n  activeCapabilitySession = session;\n  return () => {\n    if (activeCapabilitySession === session) {\n      activeCapabilitySession = undefined;\n    }\n  };\n}\n\nfunction isRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): value is RemoteDomCapabilityFunctionMetadata {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  return (\n    \"capability\" in value &&\n    typeof value.capability === \"string\" &&\n    value.capability.length > 0 &&\n    \"version\" in value &&\n    typeof value.version === \"string\" &&\n    value.version.length > 0 &&\n    \"method\" in value &&\n    typeof value.method === \"string\" &&\n    value.method.length > 0\n  );\n}\n\nfunction assertMetadataPart(value: string, part: string): void {\n  if (value.length === 0) {\n    throw new Error(`Remote DOM capability function ${part} cannot be empty.`);\n  }\n}\n","type NativeFetch = typeof fetch;\n\nexport interface RemoteDomWorkerNetworkAccessSession {\n  readonly granted: boolean;\n  readonly hostOrigin?: string | undefined;\n}\n\ninterface NetworkAccessGuard {\n  setSession(session: RemoteDomWorkerNetworkAccessSession): void;\n  clearSession(): void;\n}\n\nconst guards = new WeakMap<object, NetworkAccessGuard>();\n\n/** Registered symbol so every module instance of this file sees the same\n *  brand — a module-local `Symbol()` would duplicate exactly like the\n *  WeakMap above and detect nothing. The brand carries no capability:\n *  forging or stripping it never opens a network grant (every branch\n *  still fails closed); it only keeps the duplicate-instance vs\n *  native-pre-seal diagnosis trustworthy. */\nconst GUARDED_FETCH_BRAND = Symbol.for(\"fluid.remote-dom.guarded-fetch\");\n\nexport class RemoteDomDuplicateNetworkGuardError extends Error {\n  constructor() {\n    super(\n      \"Remote DOM worker network guard is already installed by another \" +\n        \"module instance of @fluid-app/widget-runtime. The dev server \" +\n        \"served the worker SDK subgraph under two module URLs; previews \" +\n        \"must resolve it to a single module instance.\",\n    );\n    this.name = \"RemoteDomDuplicateNetworkGuardError\";\n  }\n}\n\nexport function prepareRemoteDomWorkerNetworkAccess(\n  globals: object = globalThis,\n): void {\n  if (guards.has(globals)) return;\n\n  const existingFetch = Reflect.get(globals, \"fetch\") as unknown;\n  if (\n    typeof existingFetch === \"function\" &&\n    Reflect.get(existingFetch, GUARDED_FETCH_BRAND) === true\n  ) {\n    throw new RemoteDomDuplicateNetworkGuardError();\n  }\n\n  const nativeFetch = readNativeFetch(globals);\n  const NativeUrl = readNativeUrl(globals);\n  const baseUrl = readBaseUrl(globals);\n  let session: RemoteDomWorkerNetworkAccessSession = { granted: false };\n  const guardedFetch: NativeFetch = (input, init) => {\n    if (!session.granted) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker network access is not granted.\"),\n      );\n    }\n\n    const target = getFetchTarget(input, NativeUrl, baseUrl);\n    if (!target) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker cannot validate the fetch target.\"),\n      );\n    }\n    if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) {\n      return Promise.reject(\n        new Error(`Remote DOM worker cannot fetch ${target.origin}.`),\n      );\n    }\n    return nativeFetch.call(globals, input, init);\n  };\n\n  // The sealed `fetch` property on globals does not freeze the guarded\n  // function object itself, so the brand needs its own immutable\n  // descriptor — a plain assignment could be deleted or forged by\n  // same-realm widget code.\n  Object.defineProperty(guardedFetch, GUARDED_FETCH_BRAND, {\n    configurable: false,\n    enumerable: false,\n    value: true,\n    writable: false,\n  });\n  Object.defineProperty(globals, \"fetch\", {\n    configurable: false,\n    enumerable: false,\n    value: guardedFetch,\n    writable: false,\n  });\n  guards.set(globals, {\n    setSession(nextSession) {\n      session = nextSession;\n    },\n    clearSession() {\n      session = { granted: false };\n    },\n  });\n}\n\nexport function bindRemoteDomWorkerNetworkAccessSession(\n  session: RemoteDomWorkerNetworkAccessSession,\n  globals: object = globalThis,\n): () => void {\n  prepareRemoteDomWorkerNetworkAccess(globals);\n  const guard = guards.get(globals);\n  if (!guard) {\n    throw new Error(\"Remote DOM worker network guard failed to initialize.\");\n  }\n  guard.setSession(session);\n  return () => guard.clearSession();\n}\n\nfunction readNativeFetch(globals: object): NativeFetch {\n  const candidate = Reflect.get(globals, \"fetch\") as unknown;\n  if (typeof candidate !== \"function\") {\n    return () =>\n      Promise.reject(\n        new Error(\"Remote DOM worker native fetch is unavailable.\"),\n      );\n  }\n  return candidate as NativeFetch;\n}\n\nfunction readNativeUrl(globals: object): typeof URL {\n  const candidate = Reflect.get(globals, \"URL\") as unknown;\n  return typeof candidate === \"function\" ? (candidate as typeof URL) : URL;\n}\n\nfunction readBaseUrl(globals: object): string | undefined {\n  const location = Reflect.get(globals, \"location\") as\n    | { href?: unknown }\n    | undefined;\n  return typeof location?.href === \"string\" ? location.href : undefined;\n}\n\nfunction getFetchTarget(\n  input: RequestInfo | URL,\n  NativeUrl: typeof URL,\n  baseUrl: string | undefined,\n): URL | undefined {\n  let value: string;\n  if (typeof input === \"string\") value = input;\n  else if (input instanceof NativeUrl) value = input.href;\n  else if (typeof input.url === \"string\") value = input.url;\n  else return undefined;\n\n  try {\n    return new NativeUrl(value, baseUrl);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isBlockedTarget(\n  target: URL,\n  hostOrigin: string | undefined,\n  NativeUrl: typeof URL,\n): boolean {\n  if (target.protocol !== \"http:\" && target.protocol !== \"https:\") return false;\n\n  if (hostOrigin) {\n    try {\n      const host = new NativeUrl(hostOrigin);\n      if (\n        target.protocol === host.protocol &&\n        normalizeHostname(target.hostname) ===\n          normalizeHostname(host.hostname) &&\n        target.port === host.port\n      ) {\n        return true;\n      }\n    } catch {\n      return true;\n    }\n  }\n\n  const hostname = normalizeHostname(target.hostname);\n  if (\n    hostname === \"fluid.app\" ||\n    hostname.endsWith(\".fluid.app\") ||\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return isPrivateIpv4(hostname) || isPrivateIpv6(hostname);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\")\n    .replace(/\\.$/, \"\");\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) return false;\n  const octets = parts.map(Number);\n  if (\n    octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return false;\n  }\n  const first = octets[0];\n  const second = octets[1];\n  if (first === undefined || second === undefined) return false;\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n}\n\nfunction isPrivateIpv6(hostname: string): boolean {\n  if (!hostname.includes(\":\")) return false;\n  const normalized = hostname.toLowerCase();\n  if (normalized === \"::\" || normalized === \"::1\") return true;\n  const firstGroup = normalized.split(\":\")[0] ?? \"\";\n  const firstValue = Number.parseInt(firstGroup || \"0\", 16);\n  if ((firstValue & 0xfe00) === 0xfc00 || (firstValue & 0xffc0) === 0xfe80) {\n    return true;\n  }\n  const mappedIpv4 = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(normalized)?.[1];\n  if (mappedIpv4) return isPrivateIpv4(mappedIpv4);\n\n  const mappedHex = /^::ffff:([\\da-f]{1,4}):([\\da-f]{1,4})$/.exec(normalized);\n  if (!mappedHex) return false;\n  const high = Number.parseInt(mappedHex[1] ?? \"\", 16);\n  const low = Number.parseInt(mappedHex[2] ?? \"\", 16);\n  return isPrivateIpv4(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);\n}\n","import { release, retain, Thread } from \"@quilted/threads\";\nimport type { ThreadMessageTarget } from \"@quilted/threads\";\nimport type { RemoteMutationRecord } from \"@remote-dom/core\";\nimport type { RemoteConnection } from \"@remote-dom/core/elements\";\nimport {\n  createContext,\n  createElement,\n  useContext,\n  useMemo,\n  type ComponentType,\n} from \"react\";\n\nimport { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\nimport { lockdownRemoteDomWorkerGlobals } from \"./worker-lockdown\";\nimport type { RemoteDomWorkerLockdownResult } from \"./worker-lockdown\";\nimport { bindRemoteDomCapabilitySession } from \"./worker-capability-function\";\nimport type {\n  RemoteDomCapabilityDeclaration,\n  RemoteDomCapabilityFunctionMetadata,\n} from \"./worker-capability-function\";\nimport {\n  bindRemoteDomWorkerNetworkAccessSession,\n  prepareRemoteDomWorkerNetworkAccess,\n} from \"./worker-network-access\";\n\ntype RemoteDomReactWorkerRendererModule =\n  typeof import(\"./worker-react-renderer\");\n\nexport interface RemoteDomWorkerGlobalScopeLike {\n  onmessage: ((event: MessageEvent<unknown>) => void) | null;\n  postMessage(message: unknown, transfer?: Transferable[]): void;\n  addEventListener?: (\n    type: \"message\",\n    listener: (event: MessageEvent<unknown>) => void,\n    options?: { signal?: AbortSignal },\n  ) => void;\n  close?: () => void;\n}\n\nexport interface RemoteDomWidgetWorkerHostApi {\n  mutate(records: readonly RemoteMutationRecord[]): void;\n  callCapability(\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n  reportError(error: { readonly message: string }): void;\n}\n\nexport interface RemoteDomWidgetWorkerMountOptions {\n  readonly widgetType: string;\n  readonly props: RemoteDomSerializableValue;\n  readonly networkAccessGranted?: boolean | undefined;\n  readonly hostOrigin?: string | undefined;\n}\n\nexport interface RemoteDomWidgetWorkerApi {\n  mount(\n    options: RemoteDomWidgetWorkerMountOptions,\n    host: RemoteDomWidgetWorkerHostApi,\n  ): Promise<void>;\n  updateProps(props: RemoteDomSerializableValue): Promise<void>;\n  dispose(): Promise<void>;\n}\n\ntype RemoteDomWidgetComponent = ComponentType<\n  Readonly<Record<string, unknown>>\n>;\n\nexport interface RemoteDomWidgetWorkerDefinition {\n  readonly component: RemoteDomWidgetComponent;\n  readonly capabilities: readonly RemoteDomCapabilityDeclaration[];\n  /** @internal Exact functions authorized for direct worker calls. */\n  readonly functions?: readonly RemoteDomCapabilityFunctionMetadata[];\n}\n\nexport type RemoteDomWidgetWorkerEntry =\n  | RemoteDomWidgetComponent\n  | RemoteDomWidgetWorkerDefinition;\n\nexport interface RemoteDomWidgetWorkerOptions {\n  readonly widgets: Readonly<Record<string, RemoteDomWidgetWorkerEntry>>;\n}\n\ninterface RemoteDomWidgetWorkerTestEnvironment {\n  readonly self: RemoteDomWorkerGlobalScopeLike;\n  readonly disableLockdown?: boolean;\n  readonly lockdownGlobals?: object;\n}\n\nexport interface RemoteDomWidgetWorkerController {\n  dispose(): void;\n}\n\nexport interface RemoteDomCapability {\n  call(\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n}\n\ntype CallCapability = RemoteDomWidgetWorkerHostApi[\"callCapability\"];\n\nconst RemoteDomCapabilityContext = createContext<CallCapability | undefined>(\n  undefined,\n);\n\nlet remoteDomReactWorkerRendererModulePromise:\n  | Promise<RemoteDomReactWorkerRendererModule>\n  | undefined;\n\nexport function useRemoteDomCapability(name: string): RemoteDomCapability {\n  const callCapability = useContext(RemoteDomCapabilityContext);\n  if (!callCapability) {\n    throw new Error(\n      \"useRemoteDomCapability must be used inside a Remote DOM widget.\",\n    );\n  }\n  if (name.length === 0) {\n    throw new Error(\"Remote DOM capability names cannot be empty.\");\n  }\n\n  return useMemo(\n    () => ({\n      call(method: string, payload?: RemoteDomSerializableValue) {\n        if (method.length === 0) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability method names cannot be empty.\"),\n          );\n        }\n        if (payload !== undefined && !isRemoteDomSerializableValue(payload)) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability payload must be serializable.\"),\n          );\n        }\n        return callCapability(name, method, payload);\n      },\n    }),\n    [callCapability, name],\n  );\n}\n\nexport function startRemoteDomWidgetWorker(\n  options: RemoteDomWidgetWorkerOptions,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options);\n}\n\nexport function prepareRemoteDomWidgetWorker(): void {\n  prepareRemoteDomWorkerNetworkAccess();\n}\n\n/** @internal Test-only injection; not exported from the package worker entry. */\nexport function startRemoteDomWidgetWorkerForTest(\n  options: RemoteDomWidgetWorkerOptions,\n  environment: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options, environment);\n}\n\nfunction startRemoteDomWidgetWorkerInternal(\n  options: RemoteDomWidgetWorkerOptions,\n  testEnvironment?: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  const workerSelf = testEnvironment?.self ?? readGlobalWorkerSelf();\n  const lockdownGlobals = testEnvironment?.lockdownGlobals ?? globalThis;\n  const networkGuardEnabled = testEnvironment?.disableLockdown !== true;\n\n  if (networkGuardEnabled) {\n    try {\n      prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);\n    } catch (error) {\n      failClosedWorkerOnNetworkGuardError(workerSelf, error);\n    }\n  }\n\n  if (testEnvironment?.disableLockdown !== true) {\n    const lockdownResult = lockdownRemoteDomWorkerGlobals({\n      globals: lockdownGlobals,\n    });\n    if (lockdownResult.failedGlobals.length > 0) {\n      failClosedWorker(workerSelf, lockdownResult);\n    }\n  }\n\n  let disposed = false;\n  let mounted = false;\n  let renderer:\n    | ReturnType<\n        RemoteDomReactWorkerRendererModule[\"createRemoteDomReactWorkerRenderer\"]\n      >\n    | undefined;\n  let host: RemoteDomWidgetWorkerHostApi | undefined;\n  let props: RemoteDomSerializableValue | undefined;\n  let widget: RemoteDomWidgetComponent | undefined;\n  let clearCapabilitySession: (() => void) | undefined;\n  let clearNetworkAccessSession: (() => void) | undefined;\n  /** One stable context value per MOUNT, not per render.\n   *\n   *  `host` is fixed for the whole mount, so this closure is\n   *  semantically constant — but building it inline in render() gave it\n   *  a fresh identity every time. useRemoteDomCapability memoizes on\n   *  `[callCapability, name]`, so every render handed consumers a brand\n   *  new capability object and re-fired any effect keyed on it. Paired\n   *  with the portal calling updateProps on every parent re-render\n   *  (build-widget-registry serializes props into a fresh object each\n   *  time), that turned into one host RPC per re-render even when no\n   *  value changed. */\n  let capabilityValue: CallCapability | undefined;\n\n  const render = (): void => {\n    assertWorkerActive(disposed);\n    if (!mounted || !renderer || !host || !widget || props === undefined) {\n      throw new Error(\"Remote DOM widget worker has not been mounted.\");\n    }\n\n    const currentWidget = widget;\n    const node = createElement(currentWidget, toComponentProps(props));\n    renderer.render(\n      createElement(\n        RemoteDomCapabilityContext.Provider,\n        { value: capabilityValue },\n        node,\n      ),\n    );\n  };\n\n  const disposeMount = (): void => {\n    if (\n      !mounted &&\n      !renderer &&\n      !host &&\n      !clearCapabilitySession &&\n      !clearNetworkAccessSession\n    )\n      return;\n\n    const mountedRenderer = renderer;\n    const retainedHost = host;\n    const clearMountedCapabilitySession = clearCapabilitySession;\n    const clearMountedNetworkAccessSession = clearNetworkAccessSession;\n    renderer = undefined;\n    host = undefined;\n    props = undefined;\n    widget = undefined;\n    clearCapabilitySession = undefined;\n    clearNetworkAccessSession = undefined;\n    // Released with the mount it belongs to, so a remount cannot hand\n    // the next widget a closure over the previous host.\n    capabilityValue = undefined;\n    mounted = false;\n\n    const errors: unknown[] = [];\n    try {\n      clearMountedCapabilitySession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      clearMountedNetworkAccessSession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      mountedRenderer?.dispose();\n    } catch (error) {\n      errors.push(error);\n    }\n    if (retainedHost) {\n      try {\n        release(retainedHost);\n      } catch (error) {\n        errors.push(error);\n      }\n    }\n    if (errors.length > 0) {\n      throw new AggregateError(\n        errors,\n        \"Remote DOM widget worker cleanup failed.\",\n      );\n    }\n  };\n\n  const workerApi: RemoteDomWidgetWorkerApi = {\n    async mount(init, nextHost) {\n      assertWorkerActive(disposed);\n      if (mounted || renderer || host) {\n        throw new Error(\"Remote DOM widget worker is already mounted.\");\n      }\n      if (init.widgetType.length === 0) {\n        throw new Error(\"Remote DOM widget type cannot be empty.\");\n      }\n      if (!isRemoteDomSerializableValue(init.props)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      const selectedEntry = options.widgets[init.widgetType];\n      if (!selectedEntry) {\n        throw new Error(\n          `Remote DOM worker does not contain widget type ${init.widgetType}.`,\n        );\n      }\n      const selectedWidget = normalizeWidgetEntry(selectedEntry);\n\n      try {\n        retain(nextHost);\n        host = nextHost;\n        // Built once here, not per render — see capabilityValue above.\n        capabilityValue = (capability, method, payload) =>\n          nextHost.callCapability(capability, method, payload);\n        props = init.props;\n        widget = selectedWidget.component;\n        clearCapabilitySession = bindRemoteDomCapabilitySession({\n          widgetType: init.widgetType,\n          declarations: selectedWidget.functions ?? [],\n          callCapability: (capability, method, payload) =>\n            nextHost.callCapability(capability, method, payload),\n        });\n        if (networkGuardEnabled) {\n          clearNetworkAccessSession = bindRemoteDomWorkerNetworkAccessSession(\n            {\n              granted: init.networkAccessGranted === true,\n              hostOrigin: init.hostOrigin,\n            },\n            lockdownGlobals,\n          );\n        }\n        mounted = true;\n\n        const rendererModule = await loadRemoteDomWorkerReactRendererModule();\n        assertWorkerActive(disposed);\n        const connection: RemoteConnection = {\n          mutate(records) {\n            void Promise.resolve(nextHost.mutate(records)).catch(\n              () => undefined,\n            );\n          },\n          call() {\n            throw new Error(\n              \"Remote DOM worker widgets cannot invoke host element methods.\",\n            );\n          },\n        };\n        renderer = rendererModule.createRemoteDomReactWorkerRenderer({\n          connection,\n        });\n        render();\n      } catch (error) {\n        reportWorkerError(nextHost, error, \"Remote DOM widget mount failed.\");\n        try {\n          disposeMount();\n        } catch (cleanupError) {\n          reportWorkerError(\n            nextHost,\n            cleanupError,\n            \"Remote DOM widget cleanup failed.\",\n          );\n        }\n        throw error;\n      }\n    },\n    async updateProps(nextProps) {\n      assertWorkerActive(disposed);\n      if (!mounted) {\n        throw new Error(\"Remote DOM widget worker has not been mounted.\");\n      }\n      if (!isRemoteDomSerializableValue(nextProps)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      props = nextProps;\n      // The mount sets `mounted` before awaiting the renderer module, so\n      // there is a real window where the widget is mounting but has no\n      // renderer yet. Storing the props is the whole job in that window:\n      // the in-flight mount ends in its own render() call and picks them\n      // up, so the newer props win either way.\n      //\n      // Rendering here instead would throw \"has not been mounted\",\n      // report a fatal error to the host, and reject — for a widget that\n      // goes on to paint correctly. The portal calls updateProps from an\n      // effect keyed on a freshly-serialized props object every parent\n      // render (build-widget-registry.ts), and wires onError straight\n      // into setError, so that lands as a permanent \"Unable to render\"\n      // alert over a working widget.\n      if (!renderer) return;\n      try {\n        render();\n      } catch (error) {\n        if (host) {\n          reportWorkerError(host, error, \"Remote DOM widget render failed.\");\n        }\n        throw error;\n      }\n    },\n    async dispose() {\n      disposeMount();\n    },\n  };\n\n  const thread = new Thread<Record<string, never>, RemoteDomWidgetWorkerApi>(\n    toThreadMessageTarget(workerSelf),\n    { exports: workerApi },\n  );\n\n  return {\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      const errors: unknown[] = [];\n      try {\n        disposeMount();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        thread.close();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        workerSelf.onmessage = null;\n      } catch (error) {\n        errors.push(error);\n      }\n      if (errors.length > 0) {\n        throw new AggregateError(\n          errors,\n          \"Remote DOM widget worker shutdown failed.\",\n        );\n      }\n    },\n  };\n}\n\nfunction normalizeWidgetEntry(\n  entry: RemoteDomWidgetWorkerEntry,\n): RemoteDomWidgetWorkerDefinition {\n  if (typeof entry === \"function\") {\n    return { component: entry, capabilities: [] };\n  }\n\n  return entry;\n}\n\nfunction toComponentProps(\n  props: RemoteDomSerializableValue,\n): Readonly<Record<string, unknown>> {\n  return isObjectRecord(props) ? props : { value: props };\n}\n\nfunction assertWorkerActive(disposed: boolean): void {\n  if (disposed) {\n    throw new Error(\"Remote DOM widget worker has been disposed.\");\n  }\n}\n\nfunction loadRemoteDomWorkerReactRendererModule(): Promise<RemoteDomReactWorkerRendererModule> {\n  if (!remoteDomReactWorkerRendererModulePromise) {\n    remoteDomReactWorkerRendererModulePromise = (async () => {\n      await import(\"./worker-react-bootstrap\");\n      return import(\"./worker-react-renderer\");\n    })().catch((error: unknown) => {\n      remoteDomReactWorkerRendererModulePromise = undefined;\n      throw error;\n    });\n  }\n  return remoteDomReactWorkerRendererModulePromise;\n}\n\nfunction reportWorkerError(\n  host: RemoteDomWidgetWorkerHostApi,\n  error: unknown,\n  fallbackMessage: string,\n): void {\n  try {\n    host.reportError({\n      message: error instanceof Error ? error.message : fallbackMessage,\n    });\n  } catch {\n    // The host proxy may already be closed during teardown.\n  }\n}\n\nfunction failClosedWorker(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  result: RemoteDomWorkerLockdownResult,\n): never {\n  shutdownWorkerScope(workerSelf);\n  throw new Error(\n    `Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(\", \")}.`,\n  );\n}\n\nfunction failClosedWorkerOnNetworkGuardError(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  error: unknown,\n): never {\n  shutdownWorkerScope(workerSelf);\n  throw new Error(\n    `Remote DOM worker network guard install failed: ${\n      error instanceof Error ? error.message : String(error)\n    }`,\n    { cause: error },\n  );\n}\n\nfunction shutdownWorkerScope(workerSelf: RemoteDomWorkerGlobalScopeLike): void {\n  try {\n    workerSelf.onmessage = null;\n  } catch {\n    // The fail-closed error still prevents the worker runtime from starting.\n  }\n  workerSelf.close?.();\n}\n\nfunction readGlobalWorkerSelf(): RemoteDomWorkerGlobalScopeLike {\n  const candidate = globalThis as Partial<RemoteDomWorkerGlobalScopeLike>;\n  if (typeof candidate.postMessage !== \"function\") {\n    throw new Error(\n      \"Remote DOM widget runtime requires a Worker global scope.\",\n    );\n  }\n  if (candidate.onmessage === undefined) {\n    candidate.onmessage = null;\n  }\n  return candidate as RemoteDomWorkerGlobalScopeLike;\n}\n\nfunction toThreadMessageTarget(\n  scope: RemoteDomWorkerGlobalScopeLike,\n): ThreadMessageTarget {\n  return {\n    send(message, transferables) {\n      scope.postMessage(message, transferables ?? []);\n    },\n    listen(listener, { signal }) {\n      if (scope.addEventListener) {\n        scope.addEventListener(\"message\", (event) => listener(event.data), {\n          signal,\n        });\n        return;\n      }\n\n      scope.onmessage = (event) => listener(event.data);\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          scope.onmessage = null;\n        },\n        { once: true },\n      );\n    },\n  };\n}\n\nfunction isObjectRecord(\n  value: unknown,\n): value is Readonly<Record<string, RemoteDomSerializableValue>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;;;;;AAUA,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAgB,+BACd,UAA0C,EAAE,EACb;CAC/B,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,gBAA0B,EAAE;CAClC,MAAM,gBAA0B,EAAE;AAElC,MAAK,MAAM,QAAQ,wBACjB,KAAI,eAAe,SAAS,MAAM,KAAK,CACrC,eAAc,KAAK,KAAK;KAExB,eAAc,KAAK,KAAK;AAI5B,QAAO;EAAE;EAAe;EAAe;;AAGzC,SAAS,eACP,SACA,MACA,MACS;CACT,MAAM,cACJ,SAAS,UAAU,uBAAuB,KAAK,GAAG,KAAA;AAEpD,KAAI;AACF,SAAO,eAAe,SAAS,MAAM;GACnC,cAAc;GACd,YAAY;GACZ,OAAO;GACP,UAAU;GACX,CAAC;AACF,SAAO;SACD;AACN,MAAI;AACF,UAAQ,QAAoC;AAC5C,UAAO,EAAE,QAAQ;UACX;AACN,UAAO;;;;AAKb,SAAS,uBAAuB,MAA2B;AACzD,QAAO,SAAS,mBAA0B;AACxC,QAAM,IAAI,MAAM,4BAA4B,KAAK,kBAAkB;;;;;ACvDvE,IAAa,mCAAb,cAAsD,MAAM;CAC1D,OAAyB;CACzB;CAEA,YAAY,MAA4C,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;;;AAqBhB,MAAM,0CAA0C,OAC9C,gDACD;AAED,IAAI;AAEJ,SAAgB,kCAId,UAC4C;AAC5C,oBAAmB,SAAS,YAAY,aAAa;AACrD,oBAAmB,SAAS,SAAS,UAAU;AAC/C,oBAAmB,SAAS,QAAQ,SAAS;CAE7C,MAAM,iBAAiB,EAAE,GAAG,UAAU;CACtC,MAAM,qBAAqB,OACzB,GAAG,SACiB;EACpB,MAAM,CAAC,SAAS;EAChB,MAAM,UAAU;AAChB,MAAI,CAAC,QACH,OAAM,IAAI,iCACR,eACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,4DAC5E;AASH,MAAI,CANe,QAAQ,aAAa,MACrC,EAAE,YAAY,SAAS,aACtB,eAAe,eAAe,cAC9B,WAAW,eAAe,UAC1B,YAAY,eAAe,QAC9B,CAEC,OAAM,IAAI,iCACR,gBACA,eAAe,eAAe,WAAW,aAAa,eAAe,QAAQ,gCAAgC,QAAQ,WAAW,wDACjI;AAGH,MACE,KAAK,SAAS,KACb,KAAK,WAAW,MACd,UAAU,KAAA,KAAa,CAACA,0BAAAA,6BAA6B,MAAM,EAE9D,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,uDAC5E;EAGH,MAAM,WAAW,MAAM,QAAQ,eAC7B,eAAe,YACf,eAAe,QACf,MACD;AACD,MAAI,CAACA,0BAAAA,6BAA6B,SAAS,CACzC,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,2DAC5E;AAGH,SAAO;;AAGT,QAAO,eACL,oBACA,yCACA,EACE,OAAO,gBACR,CACF;AAED,QAAO;;AAGT,SAAgB,uCACd,OACiD;AACjD,KAAI,OAAO,UAAU,WAAY,QAAO,KAAA;CAMxC,MAAM,WAJa,OAAO,yBACxB,OACA,wCACD,EAC4B;AAC7B,KAAI,CAAC,sCAAsC,SAAS,CAAE,QAAO,KAAA;AAE7D,QAAO,EAAE,GAAG,UAAU;;;AAIxB,SAAgB,+BACd,SACY;AACZ,KAAI,wBACF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,2BAA0B;AAC1B,cAAa;AACX,MAAI,4BAA4B,QAC9B,2BAA0B,KAAA;;;AAKhC,SAAS,sCACP,OAC8C;AAC9C,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,QAAO;AAGT,QACE,gBAAgB,SAChB,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS,KACvB,YAAY,SACZ,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS;;AAI1B,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MAAM,kCAAkC,KAAK,mBAAmB;;;;ACvK9E,MAAM,yBAAS,IAAI,SAAqC;;;;;;;AAQxD,MAAM,sBAAsB,OAAO,IAAI,iCAAiC;AAExE,IAAa,sCAAb,cAAyD,MAAM;CAC7D,cAAc;AACZ,QACE,2OAID;AACD,OAAK,OAAO;;;AAIhB,SAAgB,oCACd,UAAkB,YACZ;AACN,KAAI,OAAO,IAAI,QAAQ,CAAE;CAEzB,MAAM,gBAAgB,QAAQ,IAAI,SAAS,QAAQ;AACnD,KACE,OAAO,kBAAkB,cACzB,QAAQ,IAAI,eAAe,oBAAoB,KAAK,KAEpD,OAAM,IAAI,qCAAqC;CAGjD,MAAM,cAAc,gBAAgB,QAAQ;CAC5C,MAAM,YAAY,cAAc,QAAQ;CACxC,MAAM,UAAU,YAAY,QAAQ;CACpC,IAAI,UAA+C,EAAE,SAAS,OAAO;CACrE,MAAM,gBAA6B,OAAO,SAAS;AACjD,MAAI,CAAC,QAAQ,QACX,QAAO,QAAQ,uBACb,IAAI,MAAM,mDAAmD,CAC9D;EAGH,MAAM,SAAS,eAAe,OAAO,WAAW,QAAQ;AACxD,MAAI,CAAC,OACH,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,gBAAgB,QAAQ,QAAQ,YAAY,UAAU,CACxD,QAAO,QAAQ,uBACb,IAAI,MAAM,kCAAkC,OAAO,OAAO,GAAG,CAC9D;AAEH,SAAO,YAAY,KAAK,SAAS,OAAO,KAAK;;AAO/C,QAAO,eAAe,cAAc,qBAAqB;EACvD,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,eAAe,SAAS,SAAS;EACtC,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,IAAI,SAAS;EAClB,WAAW,aAAa;AACtB,aAAU;;EAEZ,eAAe;AACb,aAAU,EAAE,SAAS,OAAO;;EAE/B,CAAC;;AAGJ,SAAgB,wCACd,SACA,UAAkB,YACN;AACZ,qCAAoC,QAAQ;CAC5C,MAAM,QAAQ,OAAO,IAAI,QAAQ;AACjC,KAAI,CAAC,MACH,OAAM,IAAI,MAAM,wDAAwD;AAE1E,OAAM,WAAW,QAAQ;AACzB,cAAa,MAAM,cAAc;;AAGnC,SAAS,gBAAgB,SAA8B;CACrD,MAAM,YAAY,QAAQ,IAAI,SAAS,QAAQ;AAC/C,KAAI,OAAO,cAAc,WACvB,cACE,QAAQ,uBACN,IAAI,MAAM,iDAAiD,CAC5D;AAEL,QAAO;;AAGT,SAAS,cAAc,SAA6B;CAClD,MAAM,YAAY,QAAQ,IAAI,SAAS,MAAM;AAC7C,QAAO,OAAO,cAAc,aAAc,YAA2B;;AAGvE,SAAS,YAAY,SAAqC;CACxD,MAAM,WAAW,QAAQ,IAAI,SAAS,WAAW;AAGjD,QAAO,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,KAAA;;AAG9D,SAAS,eACP,OACA,WACA,SACiB;CACjB,IAAI;AACJ,KAAI,OAAO,UAAU,SAAU,SAAQ;UAC9B,iBAAiB,UAAW,SAAQ,MAAM;UAC1C,OAAO,MAAM,QAAQ,SAAU,SAAQ,MAAM;KACjD,QAAO,KAAA;AAEZ,KAAI;AACF,SAAO,IAAI,UAAU,OAAO,QAAQ;SAC9B;AACN;;;AAIJ,SAAS,gBACP,QACA,YACA,WACS;AACT,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AAExE,KAAI,WACF,KAAI;EACF,MAAM,OAAO,IAAI,UAAU,WAAW;AACtC,MACE,OAAO,aAAa,KAAK,YACzB,kBAAkB,OAAO,SAAS,KAChC,kBAAkB,KAAK,SAAS,IAClC,OAAO,SAAS,KAAK,KAErB,QAAO;SAEH;AACN,SAAO;;CAIX,MAAM,WAAW,kBAAkB,OAAO,SAAS;AACnD,KACE,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,SAAS,SAAS,aAAa,CAE/B,QAAO;AAET,QAAO,cAAc,SAAS,IAAI,cAAc,SAAS;;AAG3D,SAAS,kBAAkB,UAA0B;AACnD,QAAO,SACJ,aAAa,CACb,QAAQ,YAAY,GAAG,CACvB,QAAQ,OAAO,GAAG;;AAGvB,SAAS,cAAc,UAA2B;CAChD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,SAAS,MAAM,IAAI,OAAO;AAChC,KACE,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAExE,QAAO;CAET,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,OAAO;AACtB,KAAI,UAAU,KAAA,KAAa,WAAW,KAAA,EAAW,QAAO;AACxD,QACE,UAAU,KACV,UAAU,MACV,UAAU,OACT,UAAU,OAAO,WAAW,OAC5B,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW;;AAIjC,SAAS,cAAc,UAA2B;AAChD,KAAI,CAAC,SAAS,SAAS,IAAI,CAAE,QAAO;CACpC,MAAM,aAAa,SAAS,aAAa;AACzC,KAAI,eAAe,QAAQ,eAAe,MAAO,QAAO;CACxD,MAAM,aAAa,WAAW,MAAM,IAAI,CAAC,MAAM;CAC/C,MAAM,aAAa,OAAO,SAAS,cAAc,KAAK,GAAG;AACzD,MAAK,aAAa,WAAY,UAAW,aAAa,WAAY,MAChE,QAAO;CAET,MAAM,aAAa,gCAAgC,KAAK,WAAW,GAAG;AACtE,KAAI,WAAY,QAAO,cAAc,WAAW;CAEhD,MAAM,YAAY,yCAAyC,KAAK,WAAW;AAC3E,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,OAAO,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;CACpD,MAAM,MAAM,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;AACnD,QAAO,cAAc,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAK,GAAG,OAAO,EAAE,GAAG,MAAM,MAAO;;;;AChI/E,MAAM,8BAAA,GAAA,MAAA,eACJ,KAAA,EACD;AAED,IAAI;AAIJ,SAAgB,uBAAuB,MAAmC;CACxE,MAAM,kBAAA,GAAA,MAAA,YAA4B,2BAA2B;AAC7D,KAAI,CAAC,eACH,OAAM,IAAI,MACR,kEACD;AAEH,KAAI,KAAK,WAAW,EAClB,OAAM,IAAI,MAAM,+CAA+C;AAGjE,SAAA,GAAA,MAAA,gBACS,EACL,KAAK,QAAgB,SAAsC;AACzD,MAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,YAAY,KAAA,KAAa,CAACC,0BAAAA,6BAA6B,QAAQ,CACjE,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,SAAO,eAAe,MAAM,QAAQ,QAAQ;IAE/C,GACD,CAAC,gBAAgB,KAAK,CACvB;;AAGH,SAAgB,2BACd,SACiC;AACjC,QAAO,mCAAmC,QAAQ;;AAGpD,SAAgB,+BAAqC;AACnD,sCAAqC;;AAWvC,SAAS,mCACP,SACA,iBACiC;CACjC,MAAM,aAAa,iBAAiB,QAAQ,sBAAsB;CAClE,MAAM,kBAAkB,iBAAiB,mBAAmB;CAC5D,MAAM,sBAAsB,iBAAiB,oBAAoB;AAEjE,KAAI,oBACF,KAAI;AACF,sCAAoC,gBAAgB;UAC7C,OAAO;AACd,sCAAoC,YAAY,MAAM;;AAI1D,KAAI,iBAAiB,oBAAoB,MAAM;EAC7C,MAAM,iBAAiB,+BAA+B,EACpD,SAAS,iBACV,CAAC;AACF,MAAI,eAAe,cAAc,SAAS,EACxC,kBAAiB,YAAY,eAAe;;CAIhD,IAAI,WAAW;CACf,IAAI,UAAU;CACd,IAAI;CAKJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;;;;;;;;;;;CAYJ,IAAI;CAEJ,MAAM,eAAqB;AACzB,qBAAmB,SAAS;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,UAAU,KAAA,EACzD,OAAM,IAAI,MAAM,iDAAiD;EAInE,MAAM,QAAA,GAAA,MAAA,eADgB,QACoB,iBAAiB,MAAM,CAAC;AAClE,WAAS,QAAA,GAAA,MAAA,eAEL,2BAA2B,UAC3B,EAAE,OAAO,iBAAiB,EAC1B,KACD,CACF;;CAGH,MAAM,qBAA2B;AAC/B,MACE,CAAC,WACD,CAAC,YACD,CAAC,QACD,CAAC,0BACD,CAAC,0BAED;EAEF,MAAM,kBAAkB;EACxB,MAAM,eAAe;EACrB,MAAM,gCAAgC;EACtC,MAAM,mCAAmC;AACzC,aAAW,KAAA;AACX,SAAO,KAAA;AACP,UAAQ,KAAA;AACR,WAAS,KAAA;AACT,2BAAyB,KAAA;AACzB,8BAA4B,KAAA;AAG5B,oBAAkB,KAAA;AAClB,YAAU;EAEV,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,oCAAiC;WAC1B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,uCAAoC;WAC7B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,oBAAiB,SAAS;WACnB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,aACF,KAAI;AACF,kBAAA,QAAQ,aAAa;WACd,OAAO;AACd,UAAO,KAAK,MAAM;;AAGtB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,2CACD;;CAwHL,MAAM,SAAS,IAAIC,eAAAA,OACjB,sBAAsB,WAAW,EACjC,EAAE,SAtHwC;EAC1C,MAAM,MAAM,MAAM,UAAU;AAC1B,sBAAmB,SAAS;AAC5B,OAAI,WAAW,YAAY,KACzB,OAAM,IAAI,MAAM,+CAA+C;AAEjE,OAAI,KAAK,WAAW,WAAW,EAC7B,OAAM,IAAI,MAAM,0CAA0C;AAE5D,OAAI,CAACD,0BAAAA,6BAA6B,KAAK,MAAM,CAC3C,OAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM,gBAAgB,QAAQ,QAAQ,KAAK;AAC3C,OAAI,CAAC,cACH,OAAM,IAAI,MACR,kDAAkD,KAAK,WAAW,GACnE;GAEH,MAAM,iBAAiB,qBAAqB,cAAc;AAE1D,OAAI;AACF,mBAAA,OAAO,SAAS;AAChB,WAAO;AAEP,uBAAmB,YAAY,QAAQ,YACrC,SAAS,eAAe,YAAY,QAAQ,QAAQ;AACtD,YAAQ,KAAK;AACb,aAAS,eAAe;AACxB,6BAAyB,+BAA+B;KACtD,YAAY,KAAK;KACjB,cAAc,eAAe,aAAa,EAAE;KAC5C,iBAAiB,YAAY,QAAQ,YACnC,SAAS,eAAe,YAAY,QAAQ,QAAQ;KACvD,CAAC;AACF,QAAI,oBACF,6BAA4B,wCAC1B;KACE,SAAS,KAAK,yBAAyB;KACvC,YAAY,KAAK;KAClB,EACD,gBACD;AAEH,cAAU;IAEV,MAAM,iBAAiB,MAAM,wCAAwC;AACrE,uBAAmB,SAAS;AAa5B,eAAW,eAAe,mCAAmC,EAC3D,YAbmC;KACnC,OAAO,SAAS;AACT,cAAQ,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,YACvC,KAAA,EACP;;KAEH,OAAO;AACL,YAAM,IAAI,MACR,gEACD;;KAEJ,EAGA,CAAC;AACF,YAAQ;YACD,OAAO;AACd,sBAAkB,UAAU,OAAO,kCAAkC;AACrE,QAAI;AACF,mBAAc;aACP,cAAc;AACrB,uBACE,UACA,cACA,oCACD;;AAEH,UAAM;;;EAGV,MAAM,YAAY,WAAW;AAC3B,sBAAmB,SAAS;AAC5B,OAAI,CAAC,QACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,OAAI,CAACA,0BAAAA,6BAA6B,UAAU,CAC1C,OAAM,IAAI,MAAM,gDAAgD;AAGlE,WAAQ;AAcR,OAAI,CAAC,SAAU;AACf,OAAI;AACF,YAAQ;YACD,OAAO;AACd,QAAI,KACF,mBAAkB,MAAM,OAAO,mCAAmC;AAEpE,UAAM;;;EAGV,MAAM,UAAU;AACd,iBAAc;;EAEjB,EAIuB,CACvB;AAED,QAAO,EACL,UAAU;AACR,MAAI,SAAU;AACd,aAAW;EACX,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,iBAAc;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,UAAO,OAAO;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,cAAW,YAAY;WAChB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,4CACD;IAGN;;AAGH,SAAS,qBACP,OACiC;AACjC,KAAI,OAAO,UAAU,WACnB,QAAO;EAAE,WAAW;EAAO,cAAc,EAAE;EAAE;AAG/C,QAAO;;AAGT,SAAS,iBACP,OACmC;AACnC,QAAO,eAAe,MAAM,GAAG,QAAQ,EAAE,OAAO,OAAO;;AAGzD,SAAS,mBAAmB,UAAyB;AACnD,KAAI,SACF,OAAM,IAAI,MAAM,8CAA8C;;AAIlE,SAAS,yCAAsF;AAC7F,KAAI,CAAC,0CACH,8CAA6C,YAAY;AACvD,QAAA,QAAA,SAAA,CAAA,WAAA,QAAM,wCAAA,CAAA;AACN,SAAA,QAAA,SAAA,CAAA,WAAA,QAAO,uCAAA,CAAA;KACL,CAAC,OAAO,UAAmB;AAC7B,8CAA4C,KAAA;AAC5C,QAAM;GACN;AAEJ,QAAO;;AAGT,SAAS,kBACP,MACA,OACA,iBACM;AACN,KAAI;AACF,OAAK,YAAY,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,iBACnD,CAAC;SACI;;AAKV,SAAS,iBACP,YACA,QACO;AACP,qBAAoB,WAAW;AAC/B,OAAM,IAAI,MACR,kDAAkD,OAAO,cAAc,KAAK,KAAK,CAAC,GACnF;;AAGH,SAAS,oCACP,YACA,OACO;AACP,qBAAoB,WAAW;AAC/B,OAAM,IAAI,MACR,mDACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAExD,EAAE,OAAO,OAAO,CACjB;;AAGH,SAAS,oBAAoB,YAAkD;AAC7E,KAAI;AACF,aAAW,YAAY;SACjB;AAGR,YAAW,SAAS;;AAGtB,SAAS,uBAAuD;CAC9D,MAAM,YAAY;AAClB,KAAI,OAAO,UAAU,gBAAgB,WACnC,OAAM,IAAI,MACR,4DACD;AAEH,KAAI,UAAU,cAAc,KAAA,EAC1B,WAAU,YAAY;AAExB,QAAO;;AAGT,SAAS,sBACP,OACqB;AACrB,QAAO;EACL,KAAK,SAAS,eAAe;AAC3B,SAAM,YAAY,SAAS,iBAAiB,EAAE,CAAC;;EAEjD,OAAO,UAAU,EAAE,UAAU;AAC3B,OAAI,MAAM,kBAAkB;AAC1B,UAAM,iBAAiB,YAAY,UAAU,SAAS,MAAM,KAAK,EAAE,EACjE,QACD,CAAC;AACF;;AAGF,SAAM,aAAa,UAAU,SAAS,MAAM,KAAK;AACjD,WAAQ,iBACN,eACM;AACJ,UAAM,YAAY;MAEpB,EAAE,MAAM,MAAM,CACf;;EAEJ;;AAGH,SAAS,eACP,OAC+D;AAC/D,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}

package/dist/worker.mjs

@@ -109,8 +109,23 @@ function assertMetadataPart(value, part) {
 //#endregion
 //#region src/worker-network-access.ts
 const guards = /* @__PURE__ */ new WeakMap();
+/** Registered symbol so every module instance of this file sees the same
+*  brand — a module-local `Symbol()` would duplicate exactly like the
+*  WeakMap above and detect nothing. The brand carries no capability:
+*  forging or stripping it never opens a network grant (every branch
+*  still fails closed); it only keeps the duplicate-instance vs
+*  native-pre-seal diagnosis trustworthy. */
+const GUARDED_FETCH_BRAND = Symbol.for("fluid.remote-dom.guarded-fetch");
+var RemoteDomDuplicateNetworkGuardError = class extends Error {
+	constructor() {
+		super("Remote DOM worker network guard is already installed by another module instance of @fluid-app/widget-runtime. The dev server served the worker SDK subgraph under two module URLs; previews must resolve it to a single module instance.");
+		this.name = "RemoteDomDuplicateNetworkGuardError";
+	}
+};
 function prepareRemoteDomWorkerNetworkAccess(globals = globalThis) {
 	if (guards.has(globals)) return;
+	const existingFetch = Reflect.get(globals, "fetch");
+	if (typeof existingFetch === "function" && Reflect.get(existingFetch, GUARDED_FETCH_BRAND) === true) throw new RemoteDomDuplicateNetworkGuardError();
 	const nativeFetch = readNativeFetch(globals);
 	const NativeUrl = readNativeUrl(globals);
 	const baseUrl = readBaseUrl(globals);
@@ -122,6 +137,12 @@ function prepareRemoteDomWorkerNetworkAccess(globals = globalThis) {
 		if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) return Promise.reject(/* @__PURE__ */ new Error(`Remote DOM worker cannot fetch ${target.origin}.`));
 		return nativeFetch.call(globals, input, init);
 	};
+	Object.defineProperty(guardedFetch, GUARDED_FETCH_BRAND, {
+		configurable: false,
+		enumerable: false,
+		value: true,
+		writable: false
+	});
 	Object.defineProperty(globals, "fetch", {
 		configurable: false,
 		enumerable: false,
@@ -235,11 +256,8 @@ function startRemoteDomWidgetWorkerInternal(options, testEnvironment) {
 	const networkGuardEnabled = testEnvironment?.disableLockdown !== true;
 	if (networkGuardEnabled) try {
 		prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);
-	} catch {
-		failClosedWorker(workerSelf, {
-			lockedGlobals: [],
-			failedGlobals: ["fetch"]
-		});
+	} catch (error) {
+		failClosedWorkerOnNetworkGuardError(workerSelf, error);
 	}
 	if (testEnvironment?.disableLockdown !== true) {
 		const lockdownResult = lockdownRemoteDomWorkerGlobals({ globals: lockdownGlobals });
@@ -422,11 +440,18 @@ function reportWorkerError(host, error, fallbackMessage) {
 	} catch {}
 }
 function failClosedWorker(workerSelf, result) {
+	shutdownWorkerScope(workerSelf);
+	throw new Error(`Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(", ")}.`);
+}
+function failClosedWorkerOnNetworkGuardError(workerSelf, error) {
+	shutdownWorkerScope(workerSelf);
+	throw new Error(`Remote DOM worker network guard install failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+}
+function shutdownWorkerScope(workerSelf) {
 	try {
 		workerSelf.onmessage = null;
 	} catch {}
 	workerSelf.close?.();
-	throw new Error(`Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(", ")}.`);
 }
 function readGlobalWorkerSelf() {
 	const candidate = globalThis;

package/dist/worker.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"worker.mjs","names":[],"sources":["../src/worker-lockdown.ts","../src/worker-capability-function.ts","../src/worker-network-access.ts","../src/worker-runtime.ts"],"sourcesContent":["export interface RemoteDomWorkerLockdownOptions {\n  readonly globals?: object | undefined;\n  readonly mode?: \"throw\" | \"undefined\" | undefined;\n}\n\nexport interface RemoteDomWorkerLockdownResult {\n  readonly lockedGlobals: readonly string[];\n  readonly failedGlobals: readonly string[];\n}\n\nconst DISALLOWED_GLOBAL_NAMES = [\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"EventSource\",\n  \"WebSocketStream\",\n  \"WebTransport\",\n  \"RTCPeerConnection\",\n  \"importScripts\",\n  \"localStorage\",\n  \"sessionStorage\",\n  \"indexedDB\",\n  \"caches\",\n  \"BroadcastChannel\",\n  \"Worker\",\n  \"SharedWorker\",\n  \"ShadowRealm\",\n] as const;\n\nexport function lockdownRemoteDomWorkerGlobals(\n  options: RemoteDomWorkerLockdownOptions = {},\n): RemoteDomWorkerLockdownResult {\n  const globals = options.globals ?? globalThis;\n  const mode = options.mode ?? \"throw\";\n  const lockedGlobals: string[] = [];\n  const failedGlobals: string[] = [];\n\n  for (const name of DISALLOWED_GLOBAL_NAMES) {\n    if (lockdownGlobal(globals, name, mode)) {\n      lockedGlobals.push(name);\n    } else {\n      failedGlobals.push(name);\n    }\n  }\n\n  return { lockedGlobals, failedGlobals };\n}\n\nfunction lockdownGlobal(\n  globals: object,\n  name: string,\n  mode: \"throw\" | \"undefined\",\n): boolean {\n  const replacement =\n    mode === \"throw\" ? createFailClosedGlobal(name) : undefined;\n\n  try {\n    Object.defineProperty(globals, name, {\n      configurable: false,\n      enumerable: false,\n      value: replacement,\n      writable: false,\n    });\n    return true;\n  } catch {\n    try {\n      delete (globals as Record<string, unknown>)[name];\n      return !(name in globals);\n    } catch {\n      return false;\n    }\n  }\n}\n\nfunction createFailClosedGlobal(name: string): () => never {\n  return function failClosedGlobal(): never {\n    throw new Error(`Remote DOM worker global ${name} is unavailable.`);\n  };\n}\n","import { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\n\nexport interface RemoteDomCapabilityDeclaration {\n  readonly name: string;\n  readonly version: string;\n}\n\nexport interface RemoteDomCapabilityFunctionMetadata {\n  readonly capability: string;\n  readonly version: string;\n  readonly method: string;\n}\n\nexport type RemoteDomCapabilityFunctionErrorCode =\n  | \"NOT_MOUNTED\"\n  | \"NOT_DECLARED\"\n  | \"INVALID_ARGUMENT\"\n  | \"INVALID_RESPONSE\";\n\nexport class RemoteDomCapabilityFunctionError extends Error {\n  override readonly name = \"RemoteDomCapabilityFunctionError\";\n  readonly code: RemoteDomCapabilityFunctionErrorCode;\n\n  constructor(code: RemoteDomCapabilityFunctionErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport type RemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n> = [Input] extends [void]\n  ? () => Promise<Output>\n  : (input: Input) => Promise<Output>;\n\ninterface RemoteDomCapabilitySession {\n  readonly widgetType: string;\n  readonly declarations: readonly RemoteDomCapabilityFunctionMetadata[];\n  readonly callCapability: (\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ) => Promise<RemoteDomSerializableValue>;\n}\n\nconst REMOTE_DOM_CAPABILITY_FUNCTION_METADATA = Symbol(\n  \"fluid.remote-dom-capability-function-metadata\",\n);\n\nlet activeCapabilitySession: RemoteDomCapabilitySession | undefined;\n\nexport function defineRemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n>(\n  metadata: RemoteDomCapabilityFunctionMetadata,\n): RemoteDomCapabilityFunction<Output, Input> {\n  assertMetadataPart(metadata.capability, \"capability\");\n  assertMetadataPart(metadata.version, \"version\");\n  assertMetadataPart(metadata.method, \"method\");\n\n  const stableMetadata = { ...metadata };\n  const capabilityFunction = async (\n    ...args: readonly (RemoteDomSerializableValue | undefined)[]\n  ): Promise<Output> => {\n    const [input] = args;\n    const session = activeCapabilitySession;\n    if (!session) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_MOUNTED\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" can only be called while a Remote DOM widget is mounted.`,\n      );\n    }\n\n    const isDeclared = session.declarations.some(\n      ({ capability, version, method }) =>\n        capability === stableMetadata.capability &&\n        method === stableMetadata.method &&\n        version === stableMetadata.version,\n    );\n    if (!isDeclared) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_DECLARED\",\n        `Capability \"${stableMetadata.capability}\" version \"${stableMetadata.version}\" is not declared for widget \"${session.widgetType}\". Add this function to defineWidget({ uses: [...] }).`,\n      );\n    }\n\n    if (\n      args.length > 1 ||\n      (args.length === 1 &&\n        (input === undefined || !isRemoteDomSerializableValue(input)))\n    ) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_ARGUMENT\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received an argument that is not JSON-serializable.`,\n      );\n    }\n\n    const response = await session.callCapability(\n      stableMetadata.capability,\n      stableMetadata.method,\n      input,\n    );\n    if (!isRemoteDomSerializableValue(response)) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_RESPONSE\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received a host response that is not JSON-serializable.`,\n      );\n    }\n\n    return response as Output;\n  };\n\n  Object.defineProperty(\n    capabilityFunction,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n    {\n      value: stableMetadata,\n    },\n  );\n\n  return capabilityFunction as RemoteDomCapabilityFunction<Output, Input>;\n}\n\nexport function getRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): RemoteDomCapabilityFunctionMetadata | undefined {\n  if (typeof value !== \"function\") return undefined;\n\n  const descriptor = Object.getOwnPropertyDescriptor(\n    value,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n  );\n  const metadata = descriptor?.value;\n  if (!isRemoteDomCapabilityFunctionMetadata(metadata)) return undefined;\n\n  return { ...metadata };\n}\n\n/** @internal Used by the worker lifecycle to scope direct capability calls. */\nexport function bindRemoteDomCapabilitySession(\n  session: RemoteDomCapabilitySession,\n): () => void {\n  if (activeCapabilitySession) {\n    throw new Error(\"A Remote DOM capability session is already active.\");\n  }\n\n  activeCapabilitySession = session;\n  return () => {\n    if (activeCapabilitySession === session) {\n      activeCapabilitySession = undefined;\n    }\n  };\n}\n\nfunction isRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): value is RemoteDomCapabilityFunctionMetadata {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  return (\n    \"capability\" in value &&\n    typeof value.capability === \"string\" &&\n    value.capability.length > 0 &&\n    \"version\" in value &&\n    typeof value.version === \"string\" &&\n    value.version.length > 0 &&\n    \"method\" in value &&\n    typeof value.method === \"string\" &&\n    value.method.length > 0\n  );\n}\n\nfunction assertMetadataPart(value: string, part: string): void {\n  if (value.length === 0) {\n    throw new Error(`Remote DOM capability function ${part} cannot be empty.`);\n  }\n}\n","type NativeFetch = typeof fetch;\n\nexport interface RemoteDomWorkerNetworkAccessSession {\n  readonly granted: boolean;\n  readonly hostOrigin?: string | undefined;\n}\n\ninterface NetworkAccessGuard {\n  setSession(session: RemoteDomWorkerNetworkAccessSession): void;\n  clearSession(): void;\n}\n\nconst guards = new WeakMap<object, NetworkAccessGuard>();\n\nexport function prepareRemoteDomWorkerNetworkAccess(\n  globals: object = globalThis,\n): void {\n  if (guards.has(globals)) return;\n\n  const nativeFetch = readNativeFetch(globals);\n  const NativeUrl = readNativeUrl(globals);\n  const baseUrl = readBaseUrl(globals);\n  let session: RemoteDomWorkerNetworkAccessSession = { granted: false };\n  const guardedFetch: NativeFetch = (input, init) => {\n    if (!session.granted) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker network access is not granted.\"),\n      );\n    }\n\n    const target = getFetchTarget(input, NativeUrl, baseUrl);\n    if (!target) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker cannot validate the fetch target.\"),\n      );\n    }\n    if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) {\n      return Promise.reject(\n        new Error(`Remote DOM worker cannot fetch ${target.origin}.`),\n      );\n    }\n    return nativeFetch.call(globals, input, init);\n  };\n\n  Object.defineProperty(globals, \"fetch\", {\n    configurable: false,\n    enumerable: false,\n    value: guardedFetch,\n    writable: false,\n  });\n  guards.set(globals, {\n    setSession(nextSession) {\n      session = nextSession;\n    },\n    clearSession() {\n      session = { granted: false };\n    },\n  });\n}\n\nexport function bindRemoteDomWorkerNetworkAccessSession(\n  session: RemoteDomWorkerNetworkAccessSession,\n  globals: object = globalThis,\n): () => void {\n  prepareRemoteDomWorkerNetworkAccess(globals);\n  const guard = guards.get(globals);\n  if (!guard) {\n    throw new Error(\"Remote DOM worker network guard failed to initialize.\");\n  }\n  guard.setSession(session);\n  return () => guard.clearSession();\n}\n\nfunction readNativeFetch(globals: object): NativeFetch {\n  const candidate = Reflect.get(globals, \"fetch\") as unknown;\n  if (typeof candidate !== \"function\") {\n    return () =>\n      Promise.reject(\n        new Error(\"Remote DOM worker native fetch is unavailable.\"),\n      );\n  }\n  return candidate as NativeFetch;\n}\n\nfunction readNativeUrl(globals: object): typeof URL {\n  const candidate = Reflect.get(globals, \"URL\") as unknown;\n  return typeof candidate === \"function\" ? (candidate as typeof URL) : URL;\n}\n\nfunction readBaseUrl(globals: object): string | undefined {\n  const location = Reflect.get(globals, \"location\") as\n    | { href?: unknown }\n    | undefined;\n  return typeof location?.href === \"string\" ? location.href : undefined;\n}\n\nfunction getFetchTarget(\n  input: RequestInfo | URL,\n  NativeUrl: typeof URL,\n  baseUrl: string | undefined,\n): URL | undefined {\n  let value: string;\n  if (typeof input === \"string\") value = input;\n  else if (input instanceof NativeUrl) value = input.href;\n  else if (typeof input.url === \"string\") value = input.url;\n  else return undefined;\n\n  try {\n    return new NativeUrl(value, baseUrl);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isBlockedTarget(\n  target: URL,\n  hostOrigin: string | undefined,\n  NativeUrl: typeof URL,\n): boolean {\n  if (target.protocol !== \"http:\" && target.protocol !== \"https:\") return false;\n\n  if (hostOrigin) {\n    try {\n      const host = new NativeUrl(hostOrigin);\n      if (\n        target.protocol === host.protocol &&\n        normalizeHostname(target.hostname) ===\n          normalizeHostname(host.hostname) &&\n        target.port === host.port\n      ) {\n        return true;\n      }\n    } catch {\n      return true;\n    }\n  }\n\n  const hostname = normalizeHostname(target.hostname);\n  if (\n    hostname === \"fluid.app\" ||\n    hostname.endsWith(\".fluid.app\") ||\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return isPrivateIpv4(hostname) || isPrivateIpv6(hostname);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\")\n    .replace(/\\.$/, \"\");\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) return false;\n  const octets = parts.map(Number);\n  if (\n    octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return false;\n  }\n  const first = octets[0];\n  const second = octets[1];\n  if (first === undefined || second === undefined) return false;\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n}\n\nfunction isPrivateIpv6(hostname: string): boolean {\n  if (!hostname.includes(\":\")) return false;\n  const normalized = hostname.toLowerCase();\n  if (normalized === \"::\" || normalized === \"::1\") return true;\n  const firstGroup = normalized.split(\":\")[0] ?? \"\";\n  const firstValue = Number.parseInt(firstGroup || \"0\", 16);\n  if ((firstValue & 0xfe00) === 0xfc00 || (firstValue & 0xffc0) === 0xfe80) {\n    return true;\n  }\n  const mappedIpv4 = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(normalized)?.[1];\n  if (mappedIpv4) return isPrivateIpv4(mappedIpv4);\n\n  const mappedHex = /^::ffff:([\\da-f]{1,4}):([\\da-f]{1,4})$/.exec(normalized);\n  if (!mappedHex) return false;\n  const high = Number.parseInt(mappedHex[1] ?? \"\", 16);\n  const low = Number.parseInt(mappedHex[2] ?? \"\", 16);\n  return isPrivateIpv4(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);\n}\n","import { release, retain, Thread } from \"@quilted/threads\";\nimport type { ThreadMessageTarget } from \"@quilted/threads\";\nimport type { RemoteMutationRecord } from \"@remote-dom/core\";\nimport type { RemoteConnection } from \"@remote-dom/core/elements\";\nimport {\n  createContext,\n  createElement,\n  useContext,\n  useMemo,\n  type ComponentType,\n} from \"react\";\n\nimport { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\nimport { lockdownRemoteDomWorkerGlobals } from \"./worker-lockdown\";\nimport type { RemoteDomWorkerLockdownResult } from \"./worker-lockdown\";\nimport { bindRemoteDomCapabilitySession } from \"./worker-capability-function\";\nimport type {\n  RemoteDomCapabilityDeclaration,\n  RemoteDomCapabilityFunctionMetadata,\n} from \"./worker-capability-function\";\nimport {\n  bindRemoteDomWorkerNetworkAccessSession,\n  prepareRemoteDomWorkerNetworkAccess,\n} from \"./worker-network-access\";\n\ntype RemoteDomReactWorkerRendererModule =\n  typeof import(\"./worker-react-renderer\");\n\nexport interface RemoteDomWorkerGlobalScopeLike {\n  onmessage: ((event: MessageEvent<unknown>) => void) | null;\n  postMessage(message: unknown, transfer?: Transferable[]): void;\n  addEventListener?: (\n    type: \"message\",\n    listener: (event: MessageEvent<unknown>) => void,\n    options?: { signal?: AbortSignal },\n  ) => void;\n  close?: () => void;\n}\n\nexport interface RemoteDomWidgetWorkerHostApi {\n  mutate(records: readonly RemoteMutationRecord[]): void;\n  callCapability(\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n  reportError(error: { readonly message: string }): void;\n}\n\nexport interface RemoteDomWidgetWorkerMountOptions {\n  readonly widgetType: string;\n  readonly props: RemoteDomSerializableValue;\n  readonly networkAccessGranted?: boolean | undefined;\n  readonly hostOrigin?: string | undefined;\n}\n\nexport interface RemoteDomWidgetWorkerApi {\n  mount(\n    options: RemoteDomWidgetWorkerMountOptions,\n    host: RemoteDomWidgetWorkerHostApi,\n  ): Promise<void>;\n  updateProps(props: RemoteDomSerializableValue): Promise<void>;\n  dispose(): Promise<void>;\n}\n\ntype RemoteDomWidgetComponent = ComponentType<\n  Readonly<Record<string, unknown>>\n>;\n\nexport interface RemoteDomWidgetWorkerDefinition {\n  readonly component: RemoteDomWidgetComponent;\n  readonly capabilities: readonly RemoteDomCapabilityDeclaration[];\n  /** @internal Exact functions authorized for direct worker calls. */\n  readonly functions?: readonly RemoteDomCapabilityFunctionMetadata[];\n}\n\nexport type RemoteDomWidgetWorkerEntry =\n  | RemoteDomWidgetComponent\n  | RemoteDomWidgetWorkerDefinition;\n\nexport interface RemoteDomWidgetWorkerOptions {\n  readonly widgets: Readonly<Record<string, RemoteDomWidgetWorkerEntry>>;\n}\n\ninterface RemoteDomWidgetWorkerTestEnvironment {\n  readonly self: RemoteDomWorkerGlobalScopeLike;\n  readonly disableLockdown?: boolean;\n  readonly lockdownGlobals?: object;\n}\n\nexport interface RemoteDomWidgetWorkerController {\n  dispose(): void;\n}\n\nexport interface RemoteDomCapability {\n  call(\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n}\n\ntype CallCapability = RemoteDomWidgetWorkerHostApi[\"callCapability\"];\n\nconst RemoteDomCapabilityContext = createContext<CallCapability | undefined>(\n  undefined,\n);\n\nlet remoteDomReactWorkerRendererModulePromise:\n  | Promise<RemoteDomReactWorkerRendererModule>\n  | undefined;\n\nexport function useRemoteDomCapability(name: string): RemoteDomCapability {\n  const callCapability = useContext(RemoteDomCapabilityContext);\n  if (!callCapability) {\n    throw new Error(\n      \"useRemoteDomCapability must be used inside a Remote DOM widget.\",\n    );\n  }\n  if (name.length === 0) {\n    throw new Error(\"Remote DOM capability names cannot be empty.\");\n  }\n\n  return useMemo(\n    () => ({\n      call(method: string, payload?: RemoteDomSerializableValue) {\n        if (method.length === 0) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability method names cannot be empty.\"),\n          );\n        }\n        if (payload !== undefined && !isRemoteDomSerializableValue(payload)) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability payload must be serializable.\"),\n          );\n        }\n        return callCapability(name, method, payload);\n      },\n    }),\n    [callCapability, name],\n  );\n}\n\nexport function startRemoteDomWidgetWorker(\n  options: RemoteDomWidgetWorkerOptions,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options);\n}\n\nexport function prepareRemoteDomWidgetWorker(): void {\n  prepareRemoteDomWorkerNetworkAccess();\n}\n\n/** @internal Test-only injection; not exported from the package worker entry. */\nexport function startRemoteDomWidgetWorkerForTest(\n  options: RemoteDomWidgetWorkerOptions,\n  environment: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options, environment);\n}\n\nfunction startRemoteDomWidgetWorkerInternal(\n  options: RemoteDomWidgetWorkerOptions,\n  testEnvironment?: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  const workerSelf = testEnvironment?.self ?? readGlobalWorkerSelf();\n  const lockdownGlobals = testEnvironment?.lockdownGlobals ?? globalThis;\n  const networkGuardEnabled = testEnvironment?.disableLockdown !== true;\n\n  if (networkGuardEnabled) {\n    try {\n      prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);\n    } catch {\n      failClosedWorker(workerSelf, {\n        lockedGlobals: [],\n        failedGlobals: [\"fetch\"],\n      });\n    }\n  }\n\n  if (testEnvironment?.disableLockdown !== true) {\n    const lockdownResult = lockdownRemoteDomWorkerGlobals({\n      globals: lockdownGlobals,\n    });\n    if (lockdownResult.failedGlobals.length > 0) {\n      failClosedWorker(workerSelf, lockdownResult);\n    }\n  }\n\n  let disposed = false;\n  let mounted = false;\n  let renderer:\n    | ReturnType<\n        RemoteDomReactWorkerRendererModule[\"createRemoteDomReactWorkerRenderer\"]\n      >\n    | undefined;\n  let host: RemoteDomWidgetWorkerHostApi | undefined;\n  let props: RemoteDomSerializableValue | undefined;\n  let widget: RemoteDomWidgetComponent | undefined;\n  let clearCapabilitySession: (() => void) | undefined;\n  let clearNetworkAccessSession: (() => void) | undefined;\n  /** One stable context value per MOUNT, not per render.\n   *\n   *  `host` is fixed for the whole mount, so this closure is\n   *  semantically constant — but building it inline in render() gave it\n   *  a fresh identity every time. useRemoteDomCapability memoizes on\n   *  `[callCapability, name]`, so every render handed consumers a brand\n   *  new capability object and re-fired any effect keyed on it. Paired\n   *  with the portal calling updateProps on every parent re-render\n   *  (build-widget-registry serializes props into a fresh object each\n   *  time), that turned into one host RPC per re-render even when no\n   *  value changed. */\n  let capabilityValue: CallCapability | undefined;\n\n  const render = (): void => {\n    assertWorkerActive(disposed);\n    if (!mounted || !renderer || !host || !widget || props === undefined) {\n      throw new Error(\"Remote DOM widget worker has not been mounted.\");\n    }\n\n    const currentWidget = widget;\n    const node = createElement(currentWidget, toComponentProps(props));\n    renderer.render(\n      createElement(\n        RemoteDomCapabilityContext.Provider,\n        { value: capabilityValue },\n        node,\n      ),\n    );\n  };\n\n  const disposeMount = (): void => {\n    if (\n      !mounted &&\n      !renderer &&\n      !host &&\n      !clearCapabilitySession &&\n      !clearNetworkAccessSession\n    )\n      return;\n\n    const mountedRenderer = renderer;\n    const retainedHost = host;\n    const clearMountedCapabilitySession = clearCapabilitySession;\n    const clearMountedNetworkAccessSession = clearNetworkAccessSession;\n    renderer = undefined;\n    host = undefined;\n    props = undefined;\n    widget = undefined;\n    clearCapabilitySession = undefined;\n    clearNetworkAccessSession = undefined;\n    // Released with the mount it belongs to, so a remount cannot hand\n    // the next widget a closure over the previous host.\n    capabilityValue = undefined;\n    mounted = false;\n\n    const errors: unknown[] = [];\n    try {\n      clearMountedCapabilitySession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      clearMountedNetworkAccessSession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      mountedRenderer?.dispose();\n    } catch (error) {\n      errors.push(error);\n    }\n    if (retainedHost) {\n      try {\n        release(retainedHost);\n      } catch (error) {\n        errors.push(error);\n      }\n    }\n    if (errors.length > 0) {\n      throw new AggregateError(\n        errors,\n        \"Remote DOM widget worker cleanup failed.\",\n      );\n    }\n  };\n\n  const workerApi: RemoteDomWidgetWorkerApi = {\n    async mount(init, nextHost) {\n      assertWorkerActive(disposed);\n      if (mounted || renderer || host) {\n        throw new Error(\"Remote DOM widget worker is already mounted.\");\n      }\n      if (init.widgetType.length === 0) {\n        throw new Error(\"Remote DOM widget type cannot be empty.\");\n      }\n      if (!isRemoteDomSerializableValue(init.props)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      const selectedEntry = options.widgets[init.widgetType];\n      if (!selectedEntry) {\n        throw new Error(\n          `Remote DOM worker does not contain widget type ${init.widgetType}.`,\n        );\n      }\n      const selectedWidget = normalizeWidgetEntry(selectedEntry);\n\n      try {\n        retain(nextHost);\n        host = nextHost;\n        // Built once here, not per render — see capabilityValue above.\n        capabilityValue = (capability, method, payload) =>\n          nextHost.callCapability(capability, method, payload);\n        props = init.props;\n        widget = selectedWidget.component;\n        clearCapabilitySession = bindRemoteDomCapabilitySession({\n          widgetType: init.widgetType,\n          declarations: selectedWidget.functions ?? [],\n          callCapability: (capability, method, payload) =>\n            nextHost.callCapability(capability, method, payload),\n        });\n        if (networkGuardEnabled) {\n          clearNetworkAccessSession = bindRemoteDomWorkerNetworkAccessSession(\n            {\n              granted: init.networkAccessGranted === true,\n              hostOrigin: init.hostOrigin,\n            },\n            lockdownGlobals,\n          );\n        }\n        mounted = true;\n\n        const rendererModule = await loadRemoteDomWorkerReactRendererModule();\n        assertWorkerActive(disposed);\n        const connection: RemoteConnection = {\n          mutate(records) {\n            void Promise.resolve(nextHost.mutate(records)).catch(\n              () => undefined,\n            );\n          },\n          call() {\n            throw new Error(\n              \"Remote DOM worker widgets cannot invoke host element methods.\",\n            );\n          },\n        };\n        renderer = rendererModule.createRemoteDomReactWorkerRenderer({\n          connection,\n        });\n        render();\n      } catch (error) {\n        reportWorkerError(nextHost, error, \"Remote DOM widget mount failed.\");\n        try {\n          disposeMount();\n        } catch (cleanupError) {\n          reportWorkerError(\n            nextHost,\n            cleanupError,\n            \"Remote DOM widget cleanup failed.\",\n          );\n        }\n        throw error;\n      }\n    },\n    async updateProps(nextProps) {\n      assertWorkerActive(disposed);\n      if (!mounted) {\n        throw new Error(\"Remote DOM widget worker has not been mounted.\");\n      }\n      if (!isRemoteDomSerializableValue(nextProps)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      props = nextProps;\n      // The mount sets `mounted` before awaiting the renderer module, so\n      // there is a real window where the widget is mounting but has no\n      // renderer yet. Storing the props is the whole job in that window:\n      // the in-flight mount ends in its own render() call and picks them\n      // up, so the newer props win either way.\n      //\n      // Rendering here instead would throw \"has not been mounted\",\n      // report a fatal error to the host, and reject — for a widget that\n      // goes on to paint correctly. The portal calls updateProps from an\n      // effect keyed on a freshly-serialized props object every parent\n      // render (build-widget-registry.ts), and wires onError straight\n      // into setError, so that lands as a permanent \"Unable to render\"\n      // alert over a working widget.\n      if (!renderer) return;\n      try {\n        render();\n      } catch (error) {\n        if (host) {\n          reportWorkerError(host, error, \"Remote DOM widget render failed.\");\n        }\n        throw error;\n      }\n    },\n    async dispose() {\n      disposeMount();\n    },\n  };\n\n  const thread = new Thread<Record<string, never>, RemoteDomWidgetWorkerApi>(\n    toThreadMessageTarget(workerSelf),\n    { exports: workerApi },\n  );\n\n  return {\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      const errors: unknown[] = [];\n      try {\n        disposeMount();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        thread.close();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        workerSelf.onmessage = null;\n      } catch (error) {\n        errors.push(error);\n      }\n      if (errors.length > 0) {\n        throw new AggregateError(\n          errors,\n          \"Remote DOM widget worker shutdown failed.\",\n        );\n      }\n    },\n  };\n}\n\nfunction normalizeWidgetEntry(\n  entry: RemoteDomWidgetWorkerEntry,\n): RemoteDomWidgetWorkerDefinition {\n  if (typeof entry === \"function\") {\n    return { component: entry, capabilities: [] };\n  }\n\n  return entry;\n}\n\nfunction toComponentProps(\n  props: RemoteDomSerializableValue,\n): Readonly<Record<string, unknown>> {\n  return isObjectRecord(props) ? props : { value: props };\n}\n\nfunction assertWorkerActive(disposed: boolean): void {\n  if (disposed) {\n    throw new Error(\"Remote DOM widget worker has been disposed.\");\n  }\n}\n\nfunction loadRemoteDomWorkerReactRendererModule(): Promise<RemoteDomReactWorkerRendererModule> {\n  if (!remoteDomReactWorkerRendererModulePromise) {\n    remoteDomReactWorkerRendererModulePromise = (async () => {\n      await import(\"./worker-react-bootstrap\");\n      return import(\"./worker-react-renderer\");\n    })().catch((error: unknown) => {\n      remoteDomReactWorkerRendererModulePromise = undefined;\n      throw error;\n    });\n  }\n  return remoteDomReactWorkerRendererModulePromise;\n}\n\nfunction reportWorkerError(\n  host: RemoteDomWidgetWorkerHostApi,\n  error: unknown,\n  fallbackMessage: string,\n): void {\n  try {\n    host.reportError({\n      message: error instanceof Error ? error.message : fallbackMessage,\n    });\n  } catch {\n    // The host proxy may already be closed during teardown.\n  }\n}\n\nfunction failClosedWorker(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  result: RemoteDomWorkerLockdownResult,\n): never {\n  try {\n    workerSelf.onmessage = null;\n  } catch {\n    // The error below still prevents the worker runtime from starting.\n  }\n  workerSelf.close?.();\n  throw new Error(\n    `Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(\", \")}.`,\n  );\n}\n\nfunction readGlobalWorkerSelf(): RemoteDomWorkerGlobalScopeLike {\n  const candidate = globalThis as Partial<RemoteDomWorkerGlobalScopeLike>;\n  if (typeof candidate.postMessage !== \"function\") {\n    throw new Error(\n      \"Remote DOM widget runtime requires a Worker global scope.\",\n    );\n  }\n  if (candidate.onmessage === undefined) {\n    candidate.onmessage = null;\n  }\n  return candidate as RemoteDomWorkerGlobalScopeLike;\n}\n\nfunction toThreadMessageTarget(\n  scope: RemoteDomWorkerGlobalScopeLike,\n): ThreadMessageTarget {\n  return {\n    send(message, transferables) {\n      scope.postMessage(message, transferables ?? []);\n    },\n    listen(listener, { signal }) {\n      if (scope.addEventListener) {\n        scope.addEventListener(\"message\", (event) => listener(event.data), {\n          signal,\n        });\n        return;\n      }\n\n      scope.onmessage = (event) => listener(event.data);\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          scope.onmessage = null;\n        },\n        { once: true },\n      );\n    },\n  };\n}\n\nfunction isObjectRecord(\n  value: unknown,\n): value is Readonly<Record<string, RemoteDomSerializableValue>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;;;AAUA,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAgB,+BACd,UAA0C,EAAE,EACb;CAC/B,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,gBAA0B,EAAE;CAClC,MAAM,gBAA0B,EAAE;AAElC,MAAK,MAAM,QAAQ,wBACjB,KAAI,eAAe,SAAS,MAAM,KAAK,CACrC,eAAc,KAAK,KAAK;KAExB,eAAc,KAAK,KAAK;AAI5B,QAAO;EAAE;EAAe;EAAe;;AAGzC,SAAS,eACP,SACA,MACA,MACS;CACT,MAAM,cACJ,SAAS,UAAU,uBAAuB,KAAK,GAAG,KAAA;AAEpD,KAAI;AACF,SAAO,eAAe,SAAS,MAAM;GACnC,cAAc;GACd,YAAY;GACZ,OAAO;GACP,UAAU;GACX,CAAC;AACF,SAAO;SACD;AACN,MAAI;AACF,UAAQ,QAAoC;AAC5C,UAAO,EAAE,QAAQ;UACX;AACN,UAAO;;;;AAKb,SAAS,uBAAuB,MAA2B;AACzD,QAAO,SAAS,mBAA0B;AACxC,QAAM,IAAI,MAAM,4BAA4B,KAAK,kBAAkB;;;;;ACvDvE,IAAa,mCAAb,cAAsD,MAAM;CAC1D,OAAyB;CACzB;CAEA,YAAY,MAA4C,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;;;AAqBhB,MAAM,0CAA0C,OAC9C,gDACD;AAED,IAAI;AAEJ,SAAgB,kCAId,UAC4C;AAC5C,oBAAmB,SAAS,YAAY,aAAa;AACrD,oBAAmB,SAAS,SAAS,UAAU;AAC/C,oBAAmB,SAAS,QAAQ,SAAS;CAE7C,MAAM,iBAAiB,EAAE,GAAG,UAAU;CACtC,MAAM,qBAAqB,OACzB,GAAG,SACiB;EACpB,MAAM,CAAC,SAAS;EAChB,MAAM,UAAU;AAChB,MAAI,CAAC,QACH,OAAM,IAAI,iCACR,eACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,4DAC5E;AASH,MAAI,CANe,QAAQ,aAAa,MACrC,EAAE,YAAY,SAAS,aACtB,eAAe,eAAe,cAC9B,WAAW,eAAe,UAC1B,YAAY,eAAe,QAC9B,CAEC,OAAM,IAAI,iCACR,gBACA,eAAe,eAAe,WAAW,aAAa,eAAe,QAAQ,gCAAgC,QAAQ,WAAW,wDACjI;AAGH,MACE,KAAK,SAAS,KACb,KAAK,WAAW,MACd,UAAU,KAAA,KAAa,CAAC,6BAA6B,MAAM,EAE9D,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,uDAC5E;EAGH,MAAM,WAAW,MAAM,QAAQ,eAC7B,eAAe,YACf,eAAe,QACf,MACD;AACD,MAAI,CAAC,6BAA6B,SAAS,CACzC,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,2DAC5E;AAGH,SAAO;;AAGT,QAAO,eACL,oBACA,yCACA,EACE,OAAO,gBACR,CACF;AAED,QAAO;;AAGT,SAAgB,uCACd,OACiD;AACjD,KAAI,OAAO,UAAU,WAAY,QAAO,KAAA;CAMxC,MAAM,WAJa,OAAO,yBACxB,OACA,wCACD,EAC4B;AAC7B,KAAI,CAAC,sCAAsC,SAAS,CAAE,QAAO,KAAA;AAE7D,QAAO,EAAE,GAAG,UAAU;;;AAIxB,SAAgB,+BACd,SACY;AACZ,KAAI,wBACF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,2BAA0B;AAC1B,cAAa;AACX,MAAI,4BAA4B,QAC9B,2BAA0B,KAAA;;;AAKhC,SAAS,sCACP,OAC8C;AAC9C,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,QAAO;AAGT,QACE,gBAAgB,SAChB,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS,KACvB,YAAY,SACZ,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS;;AAI1B,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MAAM,kCAAkC,KAAK,mBAAmB;;;;ACvK9E,MAAM,yBAAS,IAAI,SAAqC;AAExD,SAAgB,oCACd,UAAkB,YACZ;AACN,KAAI,OAAO,IAAI,QAAQ,CAAE;CAEzB,MAAM,cAAc,gBAAgB,QAAQ;CAC5C,MAAM,YAAY,cAAc,QAAQ;CACxC,MAAM,UAAU,YAAY,QAAQ;CACpC,IAAI,UAA+C,EAAE,SAAS,OAAO;CACrE,MAAM,gBAA6B,OAAO,SAAS;AACjD,MAAI,CAAC,QAAQ,QACX,QAAO,QAAQ,uBACb,IAAI,MAAM,mDAAmD,CAC9D;EAGH,MAAM,SAAS,eAAe,OAAO,WAAW,QAAQ;AACxD,MAAI,CAAC,OACH,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,gBAAgB,QAAQ,QAAQ,YAAY,UAAU,CACxD,QAAO,QAAQ,uBACb,IAAI,MAAM,kCAAkC,OAAO,OAAO,GAAG,CAC9D;AAEH,SAAO,YAAY,KAAK,SAAS,OAAO,KAAK;;AAG/C,QAAO,eAAe,SAAS,SAAS;EACtC,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,IAAI,SAAS;EAClB,WAAW,aAAa;AACtB,aAAU;;EAEZ,eAAe;AACb,aAAU,EAAE,SAAS,OAAO;;EAE/B,CAAC;;AAGJ,SAAgB,wCACd,SACA,UAAkB,YACN;AACZ,qCAAoC,QAAQ;CAC5C,MAAM,QAAQ,OAAO,IAAI,QAAQ;AACjC,KAAI,CAAC,MACH,OAAM,IAAI,MAAM,wDAAwD;AAE1E,OAAM,WAAW,QAAQ;AACzB,cAAa,MAAM,cAAc;;AAGnC,SAAS,gBAAgB,SAA8B;CACrD,MAAM,YAAY,QAAQ,IAAI,SAAS,QAAQ;AAC/C,KAAI,OAAO,cAAc,WACvB,cACE,QAAQ,uBACN,IAAI,MAAM,iDAAiD,CAC5D;AAEL,QAAO;;AAGT,SAAS,cAAc,SAA6B;CAClD,MAAM,YAAY,QAAQ,IAAI,SAAS,MAAM;AAC7C,QAAO,OAAO,cAAc,aAAc,YAA2B;;AAGvE,SAAS,YAAY,SAAqC;CACxD,MAAM,WAAW,QAAQ,IAAI,SAAS,WAAW;AAGjD,QAAO,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,KAAA;;AAG9D,SAAS,eACP,OACA,WACA,SACiB;CACjB,IAAI;AACJ,KAAI,OAAO,UAAU,SAAU,SAAQ;UAC9B,iBAAiB,UAAW,SAAQ,MAAM;UAC1C,OAAO,MAAM,QAAQ,SAAU,SAAQ,MAAM;KACjD,QAAO,KAAA;AAEZ,KAAI;AACF,SAAO,IAAI,UAAU,OAAO,QAAQ;SAC9B;AACN;;;AAIJ,SAAS,gBACP,QACA,YACA,WACS;AACT,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AAExE,KAAI,WACF,KAAI;EACF,MAAM,OAAO,IAAI,UAAU,WAAW;AACtC,MACE,OAAO,aAAa,KAAK,YACzB,kBAAkB,OAAO,SAAS,KAChC,kBAAkB,KAAK,SAAS,IAClC,OAAO,SAAS,KAAK,KAErB,QAAO;SAEH;AACN,SAAO;;CAIX,MAAM,WAAW,kBAAkB,OAAO,SAAS;AACnD,KACE,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,SAAS,SAAS,aAAa,CAE/B,QAAO;AAET,QAAO,cAAc,SAAS,IAAI,cAAc,SAAS;;AAG3D,SAAS,kBAAkB,UAA0B;AACnD,QAAO,SACJ,aAAa,CACb,QAAQ,YAAY,GAAG,CACvB,QAAQ,OAAO,GAAG;;AAGvB,SAAS,cAAc,UAA2B;CAChD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,SAAS,MAAM,IAAI,OAAO;AAChC,KACE,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAExE,QAAO;CAET,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,OAAO;AACtB,KAAI,UAAU,KAAA,KAAa,WAAW,KAAA,EAAW,QAAO;AACxD,QACE,UAAU,KACV,UAAU,MACV,UAAU,OACT,UAAU,OAAO,WAAW,OAC5B,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW;;AAIjC,SAAS,cAAc,UAA2B;AAChD,KAAI,CAAC,SAAS,SAAS,IAAI,CAAE,QAAO;CACpC,MAAM,aAAa,SAAS,aAAa;AACzC,KAAI,eAAe,QAAQ,eAAe,MAAO,QAAO;CACxD,MAAM,aAAa,WAAW,MAAM,IAAI,CAAC,MAAM;CAC/C,MAAM,aAAa,OAAO,SAAS,cAAc,KAAK,GAAG;AACzD,MAAK,aAAa,WAAY,UAAW,aAAa,WAAY,MAChE,QAAO;CAET,MAAM,aAAa,gCAAgC,KAAK,WAAW,GAAG;AACtE,KAAI,WAAY,QAAO,cAAc,WAAW;CAEhD,MAAM,YAAY,yCAAyC,KAAK,WAAW;AAC3E,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,OAAO,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;CACpD,MAAM,MAAM,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;AACnD,QAAO,cAAc,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAK,GAAG,OAAO,EAAE,GAAG,MAAM,MAAO;;;;AC1F/E,MAAM,6BAA6B,cACjC,KAAA,EACD;AAED,IAAI;AAIJ,SAAgB,uBAAuB,MAAmC;CACxE,MAAM,iBAAiB,WAAW,2BAA2B;AAC7D,KAAI,CAAC,eACH,OAAM,IAAI,MACR,kEACD;AAEH,KAAI,KAAK,WAAW,EAClB,OAAM,IAAI,MAAM,+CAA+C;AAGjE,QAAO,eACE,EACL,KAAK,QAAgB,SAAsC;AACzD,MAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,YAAY,KAAA,KAAa,CAAC,6BAA6B,QAAQ,CACjE,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,SAAO,eAAe,MAAM,QAAQ,QAAQ;IAE/C,GACD,CAAC,gBAAgB,KAAK,CACvB;;AAGH,SAAgB,2BACd,SACiC;AACjC,QAAO,mCAAmC,QAAQ;;AAGpD,SAAgB,+BAAqC;AACnD,sCAAqC;;AAWvC,SAAS,mCACP,SACA,iBACiC;CACjC,MAAM,aAAa,iBAAiB,QAAQ,sBAAsB;CAClE,MAAM,kBAAkB,iBAAiB,mBAAmB;CAC5D,MAAM,sBAAsB,iBAAiB,oBAAoB;AAEjE,KAAI,oBACF,KAAI;AACF,sCAAoC,gBAAgB;SAC9C;AACN,mBAAiB,YAAY;GAC3B,eAAe,EAAE;GACjB,eAAe,CAAC,QAAQ;GACzB,CAAC;;AAIN,KAAI,iBAAiB,oBAAoB,MAAM;EAC7C,MAAM,iBAAiB,+BAA+B,EACpD,SAAS,iBACV,CAAC;AACF,MAAI,eAAe,cAAc,SAAS,EACxC,kBAAiB,YAAY,eAAe;;CAIhD,IAAI,WAAW;CACf,IAAI,UAAU;CACd,IAAI;CAKJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;;;;;;;;;;;CAYJ,IAAI;CAEJ,MAAM,eAAqB;AACzB,qBAAmB,SAAS;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,UAAU,KAAA,EACzD,OAAM,IAAI,MAAM,iDAAiD;EAInE,MAAM,OAAO,cADS,QACoB,iBAAiB,MAAM,CAAC;AAClE,WAAS,OACP,cACE,2BAA2B,UAC3B,EAAE,OAAO,iBAAiB,EAC1B,KACD,CACF;;CAGH,MAAM,qBAA2B;AAC/B,MACE,CAAC,WACD,CAAC,YACD,CAAC,QACD,CAAC,0BACD,CAAC,0BAED;EAEF,MAAM,kBAAkB;EACxB,MAAM,eAAe;EACrB,MAAM,gCAAgC;EACtC,MAAM,mCAAmC;AACzC,aAAW,KAAA;AACX,SAAO,KAAA;AACP,UAAQ,KAAA;AACR,WAAS,KAAA;AACT,2BAAyB,KAAA;AACzB,8BAA4B,KAAA;AAG5B,oBAAkB,KAAA;AAClB,YAAU;EAEV,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,oCAAiC;WAC1B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,uCAAoC;WAC7B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,oBAAiB,SAAS;WACnB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,aACF,KAAI;AACF,WAAQ,aAAa;WACd,OAAO;AACd,UAAO,KAAK,MAAM;;AAGtB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,2CACD;;CAwHL,MAAM,SAAS,IAAI,OACjB,sBAAsB,WAAW,EACjC,EAAE,SAtHwC;EAC1C,MAAM,MAAM,MAAM,UAAU;AAC1B,sBAAmB,SAAS;AAC5B,OAAI,WAAW,YAAY,KACzB,OAAM,IAAI,MAAM,+CAA+C;AAEjE,OAAI,KAAK,WAAW,WAAW,EAC7B,OAAM,IAAI,MAAM,0CAA0C;AAE5D,OAAI,CAAC,6BAA6B,KAAK,MAAM,CAC3C,OAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM,gBAAgB,QAAQ,QAAQ,KAAK;AAC3C,OAAI,CAAC,cACH,OAAM,IAAI,MACR,kDAAkD,KAAK,WAAW,GACnE;GAEH,MAAM,iBAAiB,qBAAqB,cAAc;AAE1D,OAAI;AACF,WAAO,SAAS;AAChB,WAAO;AAEP,uBAAmB,YAAY,QAAQ,YACrC,SAAS,eAAe,YAAY,QAAQ,QAAQ;AACtD,YAAQ,KAAK;AACb,aAAS,eAAe;AACxB,6BAAyB,+BAA+B;KACtD,YAAY,KAAK;KACjB,cAAc,eAAe,aAAa,EAAE;KAC5C,iBAAiB,YAAY,QAAQ,YACnC,SAAS,eAAe,YAAY,QAAQ,QAAQ;KACvD,CAAC;AACF,QAAI,oBACF,6BAA4B,wCAC1B;KACE,SAAS,KAAK,yBAAyB;KACvC,YAAY,KAAK;KAClB,EACD,gBACD;AAEH,cAAU;IAEV,MAAM,iBAAiB,MAAM,wCAAwC;AACrE,uBAAmB,SAAS;AAa5B,eAAW,eAAe,mCAAmC,EAC3D,YAbmC;KACnC,OAAO,SAAS;AACT,cAAQ,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,YACvC,KAAA,EACP;;KAEH,OAAO;AACL,YAAM,IAAI,MACR,gEACD;;KAEJ,EAGA,CAAC;AACF,YAAQ;YACD,OAAO;AACd,sBAAkB,UAAU,OAAO,kCAAkC;AACrE,QAAI;AACF,mBAAc;aACP,cAAc;AACrB,uBACE,UACA,cACA,oCACD;;AAEH,UAAM;;;EAGV,MAAM,YAAY,WAAW;AAC3B,sBAAmB,SAAS;AAC5B,OAAI,CAAC,QACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,OAAI,CAAC,6BAA6B,UAAU,CAC1C,OAAM,IAAI,MAAM,gDAAgD;AAGlE,WAAQ;AAcR,OAAI,CAAC,SAAU;AACf,OAAI;AACF,YAAQ;YACD,OAAO;AACd,QAAI,KACF,mBAAkB,MAAM,OAAO,mCAAmC;AAEpE,UAAM;;;EAGV,MAAM,UAAU;AACd,iBAAc;;EAEjB,EAIuB,CACvB;AAED,QAAO,EACL,UAAU;AACR,MAAI,SAAU;AACd,aAAW;EACX,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,iBAAc;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,UAAO,OAAO;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,cAAW,YAAY;WAChB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,4CACD;IAGN;;AAGH,SAAS,qBACP,OACiC;AACjC,KAAI,OAAO,UAAU,WACnB,QAAO;EAAE,WAAW;EAAO,cAAc,EAAE;EAAE;AAG/C,QAAO;;AAGT,SAAS,iBACP,OACmC;AACnC,QAAO,eAAe,MAAM,GAAG,QAAQ,EAAE,OAAO,OAAO;;AAGzD,SAAS,mBAAmB,UAAyB;AACnD,KAAI,SACF,OAAM,IAAI,MAAM,8CAA8C;;AAIlE,SAAS,yCAAsF;AAC7F,KAAI,CAAC,0CACH,8CAA6C,YAAY;AACvD,QAAM,OAAO;AACb,SAAO,OAAO;KACZ,CAAC,OAAO,UAAmB;AAC7B,8CAA4C,KAAA;AAC5C,QAAM;GACN;AAEJ,QAAO;;AAGT,SAAS,kBACP,MACA,OACA,iBACM;AACN,KAAI;AACF,OAAK,YAAY,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,iBACnD,CAAC;SACI;;AAKV,SAAS,iBACP,YACA,QACO;AACP,KAAI;AACF,aAAW,YAAY;SACjB;AAGR,YAAW,SAAS;AACpB,OAAM,IAAI,MACR,kDAAkD,OAAO,cAAc,KAAK,KAAK,CAAC,GACnF;;AAGH,SAAS,uBAAuD;CAC9D,MAAM,YAAY;AAClB,KAAI,OAAO,UAAU,gBAAgB,WACnC,OAAM,IAAI,MACR,4DACD;AAEH,KAAI,UAAU,cAAc,KAAA,EAC1B,WAAU,YAAY;AAExB,QAAO;;AAGT,SAAS,sBACP,OACqB;AACrB,QAAO;EACL,KAAK,SAAS,eAAe;AAC3B,SAAM,YAAY,SAAS,iBAAiB,EAAE,CAAC;;EAEjD,OAAO,UAAU,EAAE,UAAU;AAC3B,OAAI,MAAM,kBAAkB;AAC1B,UAAM,iBAAiB,YAAY,UAAU,SAAS,MAAM,KAAK,EAAE,EACjE,QACD,CAAC;AACF;;AAGF,SAAM,aAAa,UAAU,SAAS,MAAM,KAAK;AACjD,WAAQ,iBACN,eACM;AACJ,UAAM,YAAY;MAEpB,EAAE,MAAM,MAAM,CACf;;EAEJ;;AAGH,SAAS,eACP,OAC+D;AAC/D,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}
+{"version":3,"file":"worker.mjs","names":[],"sources":["../src/worker-lockdown.ts","../src/worker-capability-function.ts","../src/worker-network-access.ts","../src/worker-runtime.ts"],"sourcesContent":["export interface RemoteDomWorkerLockdownOptions {\n  readonly globals?: object | undefined;\n  readonly mode?: \"throw\" | \"undefined\" | undefined;\n}\n\nexport interface RemoteDomWorkerLockdownResult {\n  readonly lockedGlobals: readonly string[];\n  readonly failedGlobals: readonly string[];\n}\n\nconst DISALLOWED_GLOBAL_NAMES = [\n  \"XMLHttpRequest\",\n  \"WebSocket\",\n  \"EventSource\",\n  \"WebSocketStream\",\n  \"WebTransport\",\n  \"RTCPeerConnection\",\n  \"importScripts\",\n  \"localStorage\",\n  \"sessionStorage\",\n  \"indexedDB\",\n  \"caches\",\n  \"BroadcastChannel\",\n  \"Worker\",\n  \"SharedWorker\",\n  \"ShadowRealm\",\n] as const;\n\nexport function lockdownRemoteDomWorkerGlobals(\n  options: RemoteDomWorkerLockdownOptions = {},\n): RemoteDomWorkerLockdownResult {\n  const globals = options.globals ?? globalThis;\n  const mode = options.mode ?? \"throw\";\n  const lockedGlobals: string[] = [];\n  const failedGlobals: string[] = [];\n\n  for (const name of DISALLOWED_GLOBAL_NAMES) {\n    if (lockdownGlobal(globals, name, mode)) {\n      lockedGlobals.push(name);\n    } else {\n      failedGlobals.push(name);\n    }\n  }\n\n  return { lockedGlobals, failedGlobals };\n}\n\nfunction lockdownGlobal(\n  globals: object,\n  name: string,\n  mode: \"throw\" | \"undefined\",\n): boolean {\n  const replacement =\n    mode === \"throw\" ? createFailClosedGlobal(name) : undefined;\n\n  try {\n    Object.defineProperty(globals, name, {\n      configurable: false,\n      enumerable: false,\n      value: replacement,\n      writable: false,\n    });\n    return true;\n  } catch {\n    try {\n      delete (globals as Record<string, unknown>)[name];\n      return !(name in globals);\n    } catch {\n      return false;\n    }\n  }\n}\n\nfunction createFailClosedGlobal(name: string): () => never {\n  return function failClosedGlobal(): never {\n    throw new Error(`Remote DOM worker global ${name} is unavailable.`);\n  };\n}\n","import { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\n\nexport interface RemoteDomCapabilityDeclaration {\n  readonly name: string;\n  readonly version: string;\n}\n\nexport interface RemoteDomCapabilityFunctionMetadata {\n  readonly capability: string;\n  readonly version: string;\n  readonly method: string;\n}\n\nexport type RemoteDomCapabilityFunctionErrorCode =\n  | \"NOT_MOUNTED\"\n  | \"NOT_DECLARED\"\n  | \"INVALID_ARGUMENT\"\n  | \"INVALID_RESPONSE\";\n\nexport class RemoteDomCapabilityFunctionError extends Error {\n  override readonly name = \"RemoteDomCapabilityFunctionError\";\n  readonly code: RemoteDomCapabilityFunctionErrorCode;\n\n  constructor(code: RemoteDomCapabilityFunctionErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n\nexport type RemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n> = [Input] extends [void]\n  ? () => Promise<Output>\n  : (input: Input) => Promise<Output>;\n\ninterface RemoteDomCapabilitySession {\n  readonly widgetType: string;\n  readonly declarations: readonly RemoteDomCapabilityFunctionMetadata[];\n  readonly callCapability: (\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ) => Promise<RemoteDomSerializableValue>;\n}\n\nconst REMOTE_DOM_CAPABILITY_FUNCTION_METADATA = Symbol(\n  \"fluid.remote-dom-capability-function-metadata\",\n);\n\nlet activeCapabilitySession: RemoteDomCapabilitySession | undefined;\n\nexport function defineRemoteDomCapabilityFunction<\n  Output extends RemoteDomSerializableValue,\n  Input extends RemoteDomSerializableValue | void = void,\n>(\n  metadata: RemoteDomCapabilityFunctionMetadata,\n): RemoteDomCapabilityFunction<Output, Input> {\n  assertMetadataPart(metadata.capability, \"capability\");\n  assertMetadataPart(metadata.version, \"version\");\n  assertMetadataPart(metadata.method, \"method\");\n\n  const stableMetadata = { ...metadata };\n  const capabilityFunction = async (\n    ...args: readonly (RemoteDomSerializableValue | undefined)[]\n  ): Promise<Output> => {\n    const [input] = args;\n    const session = activeCapabilitySession;\n    if (!session) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_MOUNTED\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" can only be called while a Remote DOM widget is mounted.`,\n      );\n    }\n\n    const isDeclared = session.declarations.some(\n      ({ capability, version, method }) =>\n        capability === stableMetadata.capability &&\n        method === stableMetadata.method &&\n        version === stableMetadata.version,\n    );\n    if (!isDeclared) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"NOT_DECLARED\",\n        `Capability \"${stableMetadata.capability}\" version \"${stableMetadata.version}\" is not declared for widget \"${session.widgetType}\". Add this function to defineWidget({ uses: [...] }).`,\n      );\n    }\n\n    if (\n      args.length > 1 ||\n      (args.length === 1 &&\n        (input === undefined || !isRemoteDomSerializableValue(input)))\n    ) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_ARGUMENT\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received an argument that is not JSON-serializable.`,\n      );\n    }\n\n    const response = await session.callCapability(\n      stableMetadata.capability,\n      stableMetadata.method,\n      input,\n    );\n    if (!isRemoteDomSerializableValue(response)) {\n      throw new RemoteDomCapabilityFunctionError(\n        \"INVALID_RESPONSE\",\n        `Capability function \"${stableMetadata.capability}.${stableMetadata.method}\" received a host response that is not JSON-serializable.`,\n      );\n    }\n\n    return response as Output;\n  };\n\n  Object.defineProperty(\n    capabilityFunction,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n    {\n      value: stableMetadata,\n    },\n  );\n\n  return capabilityFunction as RemoteDomCapabilityFunction<Output, Input>;\n}\n\nexport function getRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): RemoteDomCapabilityFunctionMetadata | undefined {\n  if (typeof value !== \"function\") return undefined;\n\n  const descriptor = Object.getOwnPropertyDescriptor(\n    value,\n    REMOTE_DOM_CAPABILITY_FUNCTION_METADATA,\n  );\n  const metadata = descriptor?.value;\n  if (!isRemoteDomCapabilityFunctionMetadata(metadata)) return undefined;\n\n  return { ...metadata };\n}\n\n/** @internal Used by the worker lifecycle to scope direct capability calls. */\nexport function bindRemoteDomCapabilitySession(\n  session: RemoteDomCapabilitySession,\n): () => void {\n  if (activeCapabilitySession) {\n    throw new Error(\"A Remote DOM capability session is already active.\");\n  }\n\n  activeCapabilitySession = session;\n  return () => {\n    if (activeCapabilitySession === session) {\n      activeCapabilitySession = undefined;\n    }\n  };\n}\n\nfunction isRemoteDomCapabilityFunctionMetadata(\n  value: unknown,\n): value is RemoteDomCapabilityFunctionMetadata {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  return (\n    \"capability\" in value &&\n    typeof value.capability === \"string\" &&\n    value.capability.length > 0 &&\n    \"version\" in value &&\n    typeof value.version === \"string\" &&\n    value.version.length > 0 &&\n    \"method\" in value &&\n    typeof value.method === \"string\" &&\n    value.method.length > 0\n  );\n}\n\nfunction assertMetadataPart(value: string, part: string): void {\n  if (value.length === 0) {\n    throw new Error(`Remote DOM capability function ${part} cannot be empty.`);\n  }\n}\n","type NativeFetch = typeof fetch;\n\nexport interface RemoteDomWorkerNetworkAccessSession {\n  readonly granted: boolean;\n  readonly hostOrigin?: string | undefined;\n}\n\ninterface NetworkAccessGuard {\n  setSession(session: RemoteDomWorkerNetworkAccessSession): void;\n  clearSession(): void;\n}\n\nconst guards = new WeakMap<object, NetworkAccessGuard>();\n\n/** Registered symbol so every module instance of this file sees the same\n *  brand — a module-local `Symbol()` would duplicate exactly like the\n *  WeakMap above and detect nothing. The brand carries no capability:\n *  forging or stripping it never opens a network grant (every branch\n *  still fails closed); it only keeps the duplicate-instance vs\n *  native-pre-seal diagnosis trustworthy. */\nconst GUARDED_FETCH_BRAND = Symbol.for(\"fluid.remote-dom.guarded-fetch\");\n\nexport class RemoteDomDuplicateNetworkGuardError extends Error {\n  constructor() {\n    super(\n      \"Remote DOM worker network guard is already installed by another \" +\n        \"module instance of @fluid-app/widget-runtime. The dev server \" +\n        \"served the worker SDK subgraph under two module URLs; previews \" +\n        \"must resolve it to a single module instance.\",\n    );\n    this.name = \"RemoteDomDuplicateNetworkGuardError\";\n  }\n}\n\nexport function prepareRemoteDomWorkerNetworkAccess(\n  globals: object = globalThis,\n): void {\n  if (guards.has(globals)) return;\n\n  const existingFetch = Reflect.get(globals, \"fetch\") as unknown;\n  if (\n    typeof existingFetch === \"function\" &&\n    Reflect.get(existingFetch, GUARDED_FETCH_BRAND) === true\n  ) {\n    throw new RemoteDomDuplicateNetworkGuardError();\n  }\n\n  const nativeFetch = readNativeFetch(globals);\n  const NativeUrl = readNativeUrl(globals);\n  const baseUrl = readBaseUrl(globals);\n  let session: RemoteDomWorkerNetworkAccessSession = { granted: false };\n  const guardedFetch: NativeFetch = (input, init) => {\n    if (!session.granted) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker network access is not granted.\"),\n      );\n    }\n\n    const target = getFetchTarget(input, NativeUrl, baseUrl);\n    if (!target) {\n      return Promise.reject(\n        new Error(\"Remote DOM worker cannot validate the fetch target.\"),\n      );\n    }\n    if (isBlockedTarget(target, session.hostOrigin, NativeUrl)) {\n      return Promise.reject(\n        new Error(`Remote DOM worker cannot fetch ${target.origin}.`),\n      );\n    }\n    return nativeFetch.call(globals, input, init);\n  };\n\n  // The sealed `fetch` property on globals does not freeze the guarded\n  // function object itself, so the brand needs its own immutable\n  // descriptor — a plain assignment could be deleted or forged by\n  // same-realm widget code.\n  Object.defineProperty(guardedFetch, GUARDED_FETCH_BRAND, {\n    configurable: false,\n    enumerable: false,\n    value: true,\n    writable: false,\n  });\n  Object.defineProperty(globals, \"fetch\", {\n    configurable: false,\n    enumerable: false,\n    value: guardedFetch,\n    writable: false,\n  });\n  guards.set(globals, {\n    setSession(nextSession) {\n      session = nextSession;\n    },\n    clearSession() {\n      session = { granted: false };\n    },\n  });\n}\n\nexport function bindRemoteDomWorkerNetworkAccessSession(\n  session: RemoteDomWorkerNetworkAccessSession,\n  globals: object = globalThis,\n): () => void {\n  prepareRemoteDomWorkerNetworkAccess(globals);\n  const guard = guards.get(globals);\n  if (!guard) {\n    throw new Error(\"Remote DOM worker network guard failed to initialize.\");\n  }\n  guard.setSession(session);\n  return () => guard.clearSession();\n}\n\nfunction readNativeFetch(globals: object): NativeFetch {\n  const candidate = Reflect.get(globals, \"fetch\") as unknown;\n  if (typeof candidate !== \"function\") {\n    return () =>\n      Promise.reject(\n        new Error(\"Remote DOM worker native fetch is unavailable.\"),\n      );\n  }\n  return candidate as NativeFetch;\n}\n\nfunction readNativeUrl(globals: object): typeof URL {\n  const candidate = Reflect.get(globals, \"URL\") as unknown;\n  return typeof candidate === \"function\" ? (candidate as typeof URL) : URL;\n}\n\nfunction readBaseUrl(globals: object): string | undefined {\n  const location = Reflect.get(globals, \"location\") as\n    | { href?: unknown }\n    | undefined;\n  return typeof location?.href === \"string\" ? location.href : undefined;\n}\n\nfunction getFetchTarget(\n  input: RequestInfo | URL,\n  NativeUrl: typeof URL,\n  baseUrl: string | undefined,\n): URL | undefined {\n  let value: string;\n  if (typeof input === \"string\") value = input;\n  else if (input instanceof NativeUrl) value = input.href;\n  else if (typeof input.url === \"string\") value = input.url;\n  else return undefined;\n\n  try {\n    return new NativeUrl(value, baseUrl);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isBlockedTarget(\n  target: URL,\n  hostOrigin: string | undefined,\n  NativeUrl: typeof URL,\n): boolean {\n  if (target.protocol !== \"http:\" && target.protocol !== \"https:\") return false;\n\n  if (hostOrigin) {\n    try {\n      const host = new NativeUrl(hostOrigin);\n      if (\n        target.protocol === host.protocol &&\n        normalizeHostname(target.hostname) ===\n          normalizeHostname(host.hostname) &&\n        target.port === host.port\n      ) {\n        return true;\n      }\n    } catch {\n      return true;\n    }\n  }\n\n  const hostname = normalizeHostname(target.hostname);\n  if (\n    hostname === \"fluid.app\" ||\n    hostname.endsWith(\".fluid.app\") ||\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return isPrivateIpv4(hostname) || isPrivateIpv6(hostname);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return hostname\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\")\n    .replace(/\\.$/, \"\");\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\");\n  if (parts.length !== 4) return false;\n  const octets = parts.map(Number);\n  if (\n    octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return false;\n  }\n  const first = octets[0];\n  const second = octets[1];\n  if (first === undefined || second === undefined) return false;\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n}\n\nfunction isPrivateIpv6(hostname: string): boolean {\n  if (!hostname.includes(\":\")) return false;\n  const normalized = hostname.toLowerCase();\n  if (normalized === \"::\" || normalized === \"::1\") return true;\n  const firstGroup = normalized.split(\":\")[0] ?? \"\";\n  const firstValue = Number.parseInt(firstGroup || \"0\", 16);\n  if ((firstValue & 0xfe00) === 0xfc00 || (firstValue & 0xffc0) === 0xfe80) {\n    return true;\n  }\n  const mappedIpv4 = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(normalized)?.[1];\n  if (mappedIpv4) return isPrivateIpv4(mappedIpv4);\n\n  const mappedHex = /^::ffff:([\\da-f]{1,4}):([\\da-f]{1,4})$/.exec(normalized);\n  if (!mappedHex) return false;\n  const high = Number.parseInt(mappedHex[1] ?? \"\", 16);\n  const low = Number.parseInt(mappedHex[2] ?? \"\", 16);\n  return isPrivateIpv4(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);\n}\n","import { release, retain, Thread } from \"@quilted/threads\";\nimport type { ThreadMessageTarget } from \"@quilted/threads\";\nimport type { RemoteMutationRecord } from \"@remote-dom/core\";\nimport type { RemoteConnection } from \"@remote-dom/core/elements\";\nimport {\n  createContext,\n  createElement,\n  useContext,\n  useMemo,\n  type ComponentType,\n} from \"react\";\n\nimport { isRemoteDomSerializableValue } from \"./remote-dom-values\";\nimport type { RemoteDomSerializableValue } from \"./remote-dom-values\";\nimport { lockdownRemoteDomWorkerGlobals } from \"./worker-lockdown\";\nimport type { RemoteDomWorkerLockdownResult } from \"./worker-lockdown\";\nimport { bindRemoteDomCapabilitySession } from \"./worker-capability-function\";\nimport type {\n  RemoteDomCapabilityDeclaration,\n  RemoteDomCapabilityFunctionMetadata,\n} from \"./worker-capability-function\";\nimport {\n  bindRemoteDomWorkerNetworkAccessSession,\n  prepareRemoteDomWorkerNetworkAccess,\n} from \"./worker-network-access\";\n\ntype RemoteDomReactWorkerRendererModule =\n  typeof import(\"./worker-react-renderer\");\n\nexport interface RemoteDomWorkerGlobalScopeLike {\n  onmessage: ((event: MessageEvent<unknown>) => void) | null;\n  postMessage(message: unknown, transfer?: Transferable[]): void;\n  addEventListener?: (\n    type: \"message\",\n    listener: (event: MessageEvent<unknown>) => void,\n    options?: { signal?: AbortSignal },\n  ) => void;\n  close?: () => void;\n}\n\nexport interface RemoteDomWidgetWorkerHostApi {\n  mutate(records: readonly RemoteMutationRecord[]): void;\n  callCapability(\n    capability: string,\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n  reportError(error: { readonly message: string }): void;\n}\n\nexport interface RemoteDomWidgetWorkerMountOptions {\n  readonly widgetType: string;\n  readonly props: RemoteDomSerializableValue;\n  readonly networkAccessGranted?: boolean | undefined;\n  readonly hostOrigin?: string | undefined;\n}\n\nexport interface RemoteDomWidgetWorkerApi {\n  mount(\n    options: RemoteDomWidgetWorkerMountOptions,\n    host: RemoteDomWidgetWorkerHostApi,\n  ): Promise<void>;\n  updateProps(props: RemoteDomSerializableValue): Promise<void>;\n  dispose(): Promise<void>;\n}\n\ntype RemoteDomWidgetComponent = ComponentType<\n  Readonly<Record<string, unknown>>\n>;\n\nexport interface RemoteDomWidgetWorkerDefinition {\n  readonly component: RemoteDomWidgetComponent;\n  readonly capabilities: readonly RemoteDomCapabilityDeclaration[];\n  /** @internal Exact functions authorized for direct worker calls. */\n  readonly functions?: readonly RemoteDomCapabilityFunctionMetadata[];\n}\n\nexport type RemoteDomWidgetWorkerEntry =\n  | RemoteDomWidgetComponent\n  | RemoteDomWidgetWorkerDefinition;\n\nexport interface RemoteDomWidgetWorkerOptions {\n  readonly widgets: Readonly<Record<string, RemoteDomWidgetWorkerEntry>>;\n}\n\ninterface RemoteDomWidgetWorkerTestEnvironment {\n  readonly self: RemoteDomWorkerGlobalScopeLike;\n  readonly disableLockdown?: boolean;\n  readonly lockdownGlobals?: object;\n}\n\nexport interface RemoteDomWidgetWorkerController {\n  dispose(): void;\n}\n\nexport interface RemoteDomCapability {\n  call(\n    method: string,\n    payload?: RemoteDomSerializableValue,\n  ): Promise<RemoteDomSerializableValue>;\n}\n\ntype CallCapability = RemoteDomWidgetWorkerHostApi[\"callCapability\"];\n\nconst RemoteDomCapabilityContext = createContext<CallCapability | undefined>(\n  undefined,\n);\n\nlet remoteDomReactWorkerRendererModulePromise:\n  | Promise<RemoteDomReactWorkerRendererModule>\n  | undefined;\n\nexport function useRemoteDomCapability(name: string): RemoteDomCapability {\n  const callCapability = useContext(RemoteDomCapabilityContext);\n  if (!callCapability) {\n    throw new Error(\n      \"useRemoteDomCapability must be used inside a Remote DOM widget.\",\n    );\n  }\n  if (name.length === 0) {\n    throw new Error(\"Remote DOM capability names cannot be empty.\");\n  }\n\n  return useMemo(\n    () => ({\n      call(method: string, payload?: RemoteDomSerializableValue) {\n        if (method.length === 0) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability method names cannot be empty.\"),\n          );\n        }\n        if (payload !== undefined && !isRemoteDomSerializableValue(payload)) {\n          return Promise.reject(\n            new Error(\"Remote DOM capability payload must be serializable.\"),\n          );\n        }\n        return callCapability(name, method, payload);\n      },\n    }),\n    [callCapability, name],\n  );\n}\n\nexport function startRemoteDomWidgetWorker(\n  options: RemoteDomWidgetWorkerOptions,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options);\n}\n\nexport function prepareRemoteDomWidgetWorker(): void {\n  prepareRemoteDomWorkerNetworkAccess();\n}\n\n/** @internal Test-only injection; not exported from the package worker entry. */\nexport function startRemoteDomWidgetWorkerForTest(\n  options: RemoteDomWidgetWorkerOptions,\n  environment: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  return startRemoteDomWidgetWorkerInternal(options, environment);\n}\n\nfunction startRemoteDomWidgetWorkerInternal(\n  options: RemoteDomWidgetWorkerOptions,\n  testEnvironment?: RemoteDomWidgetWorkerTestEnvironment,\n): RemoteDomWidgetWorkerController {\n  const workerSelf = testEnvironment?.self ?? readGlobalWorkerSelf();\n  const lockdownGlobals = testEnvironment?.lockdownGlobals ?? globalThis;\n  const networkGuardEnabled = testEnvironment?.disableLockdown !== true;\n\n  if (networkGuardEnabled) {\n    try {\n      prepareRemoteDomWorkerNetworkAccess(lockdownGlobals);\n    } catch (error) {\n      failClosedWorkerOnNetworkGuardError(workerSelf, error);\n    }\n  }\n\n  if (testEnvironment?.disableLockdown !== true) {\n    const lockdownResult = lockdownRemoteDomWorkerGlobals({\n      globals: lockdownGlobals,\n    });\n    if (lockdownResult.failedGlobals.length > 0) {\n      failClosedWorker(workerSelf, lockdownResult);\n    }\n  }\n\n  let disposed = false;\n  let mounted = false;\n  let renderer:\n    | ReturnType<\n        RemoteDomReactWorkerRendererModule[\"createRemoteDomReactWorkerRenderer\"]\n      >\n    | undefined;\n  let host: RemoteDomWidgetWorkerHostApi | undefined;\n  let props: RemoteDomSerializableValue | undefined;\n  let widget: RemoteDomWidgetComponent | undefined;\n  let clearCapabilitySession: (() => void) | undefined;\n  let clearNetworkAccessSession: (() => void) | undefined;\n  /** One stable context value per MOUNT, not per render.\n   *\n   *  `host` is fixed for the whole mount, so this closure is\n   *  semantically constant — but building it inline in render() gave it\n   *  a fresh identity every time. useRemoteDomCapability memoizes on\n   *  `[callCapability, name]`, so every render handed consumers a brand\n   *  new capability object and re-fired any effect keyed on it. Paired\n   *  with the portal calling updateProps on every parent re-render\n   *  (build-widget-registry serializes props into a fresh object each\n   *  time), that turned into one host RPC per re-render even when no\n   *  value changed. */\n  let capabilityValue: CallCapability | undefined;\n\n  const render = (): void => {\n    assertWorkerActive(disposed);\n    if (!mounted || !renderer || !host || !widget || props === undefined) {\n      throw new Error(\"Remote DOM widget worker has not been mounted.\");\n    }\n\n    const currentWidget = widget;\n    const node = createElement(currentWidget, toComponentProps(props));\n    renderer.render(\n      createElement(\n        RemoteDomCapabilityContext.Provider,\n        { value: capabilityValue },\n        node,\n      ),\n    );\n  };\n\n  const disposeMount = (): void => {\n    if (\n      !mounted &&\n      !renderer &&\n      !host &&\n      !clearCapabilitySession &&\n      !clearNetworkAccessSession\n    )\n      return;\n\n    const mountedRenderer = renderer;\n    const retainedHost = host;\n    const clearMountedCapabilitySession = clearCapabilitySession;\n    const clearMountedNetworkAccessSession = clearNetworkAccessSession;\n    renderer = undefined;\n    host = undefined;\n    props = undefined;\n    widget = undefined;\n    clearCapabilitySession = undefined;\n    clearNetworkAccessSession = undefined;\n    // Released with the mount it belongs to, so a remount cannot hand\n    // the next widget a closure over the previous host.\n    capabilityValue = undefined;\n    mounted = false;\n\n    const errors: unknown[] = [];\n    try {\n      clearMountedCapabilitySession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      clearMountedNetworkAccessSession?.();\n    } catch (error) {\n      errors.push(error);\n    }\n    try {\n      mountedRenderer?.dispose();\n    } catch (error) {\n      errors.push(error);\n    }\n    if (retainedHost) {\n      try {\n        release(retainedHost);\n      } catch (error) {\n        errors.push(error);\n      }\n    }\n    if (errors.length > 0) {\n      throw new AggregateError(\n        errors,\n        \"Remote DOM widget worker cleanup failed.\",\n      );\n    }\n  };\n\n  const workerApi: RemoteDomWidgetWorkerApi = {\n    async mount(init, nextHost) {\n      assertWorkerActive(disposed);\n      if (mounted || renderer || host) {\n        throw new Error(\"Remote DOM widget worker is already mounted.\");\n      }\n      if (init.widgetType.length === 0) {\n        throw new Error(\"Remote DOM widget type cannot be empty.\");\n      }\n      if (!isRemoteDomSerializableValue(init.props)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      const selectedEntry = options.widgets[init.widgetType];\n      if (!selectedEntry) {\n        throw new Error(\n          `Remote DOM worker does not contain widget type ${init.widgetType}.`,\n        );\n      }\n      const selectedWidget = normalizeWidgetEntry(selectedEntry);\n\n      try {\n        retain(nextHost);\n        host = nextHost;\n        // Built once here, not per render — see capabilityValue above.\n        capabilityValue = (capability, method, payload) =>\n          nextHost.callCapability(capability, method, payload);\n        props = init.props;\n        widget = selectedWidget.component;\n        clearCapabilitySession = bindRemoteDomCapabilitySession({\n          widgetType: init.widgetType,\n          declarations: selectedWidget.functions ?? [],\n          callCapability: (capability, method, payload) =>\n            nextHost.callCapability(capability, method, payload),\n        });\n        if (networkGuardEnabled) {\n          clearNetworkAccessSession = bindRemoteDomWorkerNetworkAccessSession(\n            {\n              granted: init.networkAccessGranted === true,\n              hostOrigin: init.hostOrigin,\n            },\n            lockdownGlobals,\n          );\n        }\n        mounted = true;\n\n        const rendererModule = await loadRemoteDomWorkerReactRendererModule();\n        assertWorkerActive(disposed);\n        const connection: RemoteConnection = {\n          mutate(records) {\n            void Promise.resolve(nextHost.mutate(records)).catch(\n              () => undefined,\n            );\n          },\n          call() {\n            throw new Error(\n              \"Remote DOM worker widgets cannot invoke host element methods.\",\n            );\n          },\n        };\n        renderer = rendererModule.createRemoteDomReactWorkerRenderer({\n          connection,\n        });\n        render();\n      } catch (error) {\n        reportWorkerError(nextHost, error, \"Remote DOM widget mount failed.\");\n        try {\n          disposeMount();\n        } catch (cleanupError) {\n          reportWorkerError(\n            nextHost,\n            cleanupError,\n            \"Remote DOM widget cleanup failed.\",\n          );\n        }\n        throw error;\n      }\n    },\n    async updateProps(nextProps) {\n      assertWorkerActive(disposed);\n      if (!mounted) {\n        throw new Error(\"Remote DOM widget worker has not been mounted.\");\n      }\n      if (!isRemoteDomSerializableValue(nextProps)) {\n        throw new Error(\"Remote DOM widget props must be serializable.\");\n      }\n\n      props = nextProps;\n      // The mount sets `mounted` before awaiting the renderer module, so\n      // there is a real window where the widget is mounting but has no\n      // renderer yet. Storing the props is the whole job in that window:\n      // the in-flight mount ends in its own render() call and picks them\n      // up, so the newer props win either way.\n      //\n      // Rendering here instead would throw \"has not been mounted\",\n      // report a fatal error to the host, and reject — for a widget that\n      // goes on to paint correctly. The portal calls updateProps from an\n      // effect keyed on a freshly-serialized props object every parent\n      // render (build-widget-registry.ts), and wires onError straight\n      // into setError, so that lands as a permanent \"Unable to render\"\n      // alert over a working widget.\n      if (!renderer) return;\n      try {\n        render();\n      } catch (error) {\n        if (host) {\n          reportWorkerError(host, error, \"Remote DOM widget render failed.\");\n        }\n        throw error;\n      }\n    },\n    async dispose() {\n      disposeMount();\n    },\n  };\n\n  const thread = new Thread<Record<string, never>, RemoteDomWidgetWorkerApi>(\n    toThreadMessageTarget(workerSelf),\n    { exports: workerApi },\n  );\n\n  return {\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      const errors: unknown[] = [];\n      try {\n        disposeMount();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        thread.close();\n      } catch (error) {\n        errors.push(error);\n      }\n      try {\n        workerSelf.onmessage = null;\n      } catch (error) {\n        errors.push(error);\n      }\n      if (errors.length > 0) {\n        throw new AggregateError(\n          errors,\n          \"Remote DOM widget worker shutdown failed.\",\n        );\n      }\n    },\n  };\n}\n\nfunction normalizeWidgetEntry(\n  entry: RemoteDomWidgetWorkerEntry,\n): RemoteDomWidgetWorkerDefinition {\n  if (typeof entry === \"function\") {\n    return { component: entry, capabilities: [] };\n  }\n\n  return entry;\n}\n\nfunction toComponentProps(\n  props: RemoteDomSerializableValue,\n): Readonly<Record<string, unknown>> {\n  return isObjectRecord(props) ? props : { value: props };\n}\n\nfunction assertWorkerActive(disposed: boolean): void {\n  if (disposed) {\n    throw new Error(\"Remote DOM widget worker has been disposed.\");\n  }\n}\n\nfunction loadRemoteDomWorkerReactRendererModule(): Promise<RemoteDomReactWorkerRendererModule> {\n  if (!remoteDomReactWorkerRendererModulePromise) {\n    remoteDomReactWorkerRendererModulePromise = (async () => {\n      await import(\"./worker-react-bootstrap\");\n      return import(\"./worker-react-renderer\");\n    })().catch((error: unknown) => {\n      remoteDomReactWorkerRendererModulePromise = undefined;\n      throw error;\n    });\n  }\n  return remoteDomReactWorkerRendererModulePromise;\n}\n\nfunction reportWorkerError(\n  host: RemoteDomWidgetWorkerHostApi,\n  error: unknown,\n  fallbackMessage: string,\n): void {\n  try {\n    host.reportError({\n      message: error instanceof Error ? error.message : fallbackMessage,\n    });\n  } catch {\n    // The host proxy may already be closed during teardown.\n  }\n}\n\nfunction failClosedWorker(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  result: RemoteDomWorkerLockdownResult,\n): never {\n  shutdownWorkerScope(workerSelf);\n  throw new Error(\n    `Remote DOM worker lockdown failed for globals: ${result.failedGlobals.join(\", \")}.`,\n  );\n}\n\nfunction failClosedWorkerOnNetworkGuardError(\n  workerSelf: RemoteDomWorkerGlobalScopeLike,\n  error: unknown,\n): never {\n  shutdownWorkerScope(workerSelf);\n  throw new Error(\n    `Remote DOM worker network guard install failed: ${\n      error instanceof Error ? error.message : String(error)\n    }`,\n    { cause: error },\n  );\n}\n\nfunction shutdownWorkerScope(workerSelf: RemoteDomWorkerGlobalScopeLike): void {\n  try {\n    workerSelf.onmessage = null;\n  } catch {\n    // The fail-closed error still prevents the worker runtime from starting.\n  }\n  workerSelf.close?.();\n}\n\nfunction readGlobalWorkerSelf(): RemoteDomWorkerGlobalScopeLike {\n  const candidate = globalThis as Partial<RemoteDomWorkerGlobalScopeLike>;\n  if (typeof candidate.postMessage !== \"function\") {\n    throw new Error(\n      \"Remote DOM widget runtime requires a Worker global scope.\",\n    );\n  }\n  if (candidate.onmessage === undefined) {\n    candidate.onmessage = null;\n  }\n  return candidate as RemoteDomWorkerGlobalScopeLike;\n}\n\nfunction toThreadMessageTarget(\n  scope: RemoteDomWorkerGlobalScopeLike,\n): ThreadMessageTarget {\n  return {\n    send(message, transferables) {\n      scope.postMessage(message, transferables ?? []);\n    },\n    listen(listener, { signal }) {\n      if (scope.addEventListener) {\n        scope.addEventListener(\"message\", (event) => listener(event.data), {\n          signal,\n        });\n        return;\n      }\n\n      scope.onmessage = (event) => listener(event.data);\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          scope.onmessage = null;\n        },\n        { once: true },\n      );\n    },\n  };\n}\n\nfunction isObjectRecord(\n  value: unknown,\n): value is Readonly<Record<string, RemoteDomSerializableValue>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;;;AAUA,MAAM,0BAA0B;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAgB,+BACd,UAA0C,EAAE,EACb;CAC/B,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,gBAA0B,EAAE;CAClC,MAAM,gBAA0B,EAAE;AAElC,MAAK,MAAM,QAAQ,wBACjB,KAAI,eAAe,SAAS,MAAM,KAAK,CACrC,eAAc,KAAK,KAAK;KAExB,eAAc,KAAK,KAAK;AAI5B,QAAO;EAAE;EAAe;EAAe;;AAGzC,SAAS,eACP,SACA,MACA,MACS;CACT,MAAM,cACJ,SAAS,UAAU,uBAAuB,KAAK,GAAG,KAAA;AAEpD,KAAI;AACF,SAAO,eAAe,SAAS,MAAM;GACnC,cAAc;GACd,YAAY;GACZ,OAAO;GACP,UAAU;GACX,CAAC;AACF,SAAO;SACD;AACN,MAAI;AACF,UAAQ,QAAoC;AAC5C,UAAO,EAAE,QAAQ;UACX;AACN,UAAO;;;;AAKb,SAAS,uBAAuB,MAA2B;AACzD,QAAO,SAAS,mBAA0B;AACxC,QAAM,IAAI,MAAM,4BAA4B,KAAK,kBAAkB;;;;;ACvDvE,IAAa,mCAAb,cAAsD,MAAM;CAC1D,OAAyB;CACzB;CAEA,YAAY,MAA4C,SAAiB;AACvE,QAAM,QAAQ;AACd,OAAK,OAAO;;;AAqBhB,MAAM,0CAA0C,OAC9C,gDACD;AAED,IAAI;AAEJ,SAAgB,kCAId,UAC4C;AAC5C,oBAAmB,SAAS,YAAY,aAAa;AACrD,oBAAmB,SAAS,SAAS,UAAU;AAC/C,oBAAmB,SAAS,QAAQ,SAAS;CAE7C,MAAM,iBAAiB,EAAE,GAAG,UAAU;CACtC,MAAM,qBAAqB,OACzB,GAAG,SACiB;EACpB,MAAM,CAAC,SAAS;EAChB,MAAM,UAAU;AAChB,MAAI,CAAC,QACH,OAAM,IAAI,iCACR,eACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,4DAC5E;AASH,MAAI,CANe,QAAQ,aAAa,MACrC,EAAE,YAAY,SAAS,aACtB,eAAe,eAAe,cAC9B,WAAW,eAAe,UAC1B,YAAY,eAAe,QAC9B,CAEC,OAAM,IAAI,iCACR,gBACA,eAAe,eAAe,WAAW,aAAa,eAAe,QAAQ,gCAAgC,QAAQ,WAAW,wDACjI;AAGH,MACE,KAAK,SAAS,KACb,KAAK,WAAW,MACd,UAAU,KAAA,KAAa,CAAC,6BAA6B,MAAM,EAE9D,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,uDAC5E;EAGH,MAAM,WAAW,MAAM,QAAQ,eAC7B,eAAe,YACf,eAAe,QACf,MACD;AACD,MAAI,CAAC,6BAA6B,SAAS,CACzC,OAAM,IAAI,iCACR,oBACA,wBAAwB,eAAe,WAAW,GAAG,eAAe,OAAO,2DAC5E;AAGH,SAAO;;AAGT,QAAO,eACL,oBACA,yCACA,EACE,OAAO,gBACR,CACF;AAED,QAAO;;AAGT,SAAgB,uCACd,OACiD;AACjD,KAAI,OAAO,UAAU,WAAY,QAAO,KAAA;CAMxC,MAAM,WAJa,OAAO,yBACxB,OACA,wCACD,EAC4B;AAC7B,KAAI,CAAC,sCAAsC,SAAS,CAAE,QAAO,KAAA;AAE7D,QAAO,EAAE,GAAG,UAAU;;;AAIxB,SAAgB,+BACd,SACY;AACZ,KAAI,wBACF,OAAM,IAAI,MAAM,qDAAqD;AAGvE,2BAA0B;AAC1B,cAAa;AACX,MAAI,4BAA4B,QAC9B,2BAA0B,KAAA;;;AAKhC,SAAS,sCACP,OAC8C;AAC9C,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CACrE,QAAO;AAGT,QACE,gBAAgB,SAChB,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS,KACvB,YAAY,SACZ,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS;;AAI1B,SAAS,mBAAmB,OAAe,MAAoB;AAC7D,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MAAM,kCAAkC,KAAK,mBAAmB;;;;ACvK9E,MAAM,yBAAS,IAAI,SAAqC;;;;;;;AAQxD,MAAM,sBAAsB,OAAO,IAAI,iCAAiC;AAExE,IAAa,sCAAb,cAAyD,MAAM;CAC7D,cAAc;AACZ,QACE,2OAID;AACD,OAAK,OAAO;;;AAIhB,SAAgB,oCACd,UAAkB,YACZ;AACN,KAAI,OAAO,IAAI,QAAQ,CAAE;CAEzB,MAAM,gBAAgB,QAAQ,IAAI,SAAS,QAAQ;AACnD,KACE,OAAO,kBAAkB,cACzB,QAAQ,IAAI,eAAe,oBAAoB,KAAK,KAEpD,OAAM,IAAI,qCAAqC;CAGjD,MAAM,cAAc,gBAAgB,QAAQ;CAC5C,MAAM,YAAY,cAAc,QAAQ;CACxC,MAAM,UAAU,YAAY,QAAQ;CACpC,IAAI,UAA+C,EAAE,SAAS,OAAO;CACrE,MAAM,gBAA6B,OAAO,SAAS;AACjD,MAAI,CAAC,QAAQ,QACX,QAAO,QAAQ,uBACb,IAAI,MAAM,mDAAmD,CAC9D;EAGH,MAAM,SAAS,eAAe,OAAO,WAAW,QAAQ;AACxD,MAAI,CAAC,OACH,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,gBAAgB,QAAQ,QAAQ,YAAY,UAAU,CACxD,QAAO,QAAQ,uBACb,IAAI,MAAM,kCAAkC,OAAO,OAAO,GAAG,CAC9D;AAEH,SAAO,YAAY,KAAK,SAAS,OAAO,KAAK;;AAO/C,QAAO,eAAe,cAAc,qBAAqB;EACvD,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,eAAe,SAAS,SAAS;EACtC,cAAc;EACd,YAAY;EACZ,OAAO;EACP,UAAU;EACX,CAAC;AACF,QAAO,IAAI,SAAS;EAClB,WAAW,aAAa;AACtB,aAAU;;EAEZ,eAAe;AACb,aAAU,EAAE,SAAS,OAAO;;EAE/B,CAAC;;AAGJ,SAAgB,wCACd,SACA,UAAkB,YACN;AACZ,qCAAoC,QAAQ;CAC5C,MAAM,QAAQ,OAAO,IAAI,QAAQ;AACjC,KAAI,CAAC,MACH,OAAM,IAAI,MAAM,wDAAwD;AAE1E,OAAM,WAAW,QAAQ;AACzB,cAAa,MAAM,cAAc;;AAGnC,SAAS,gBAAgB,SAA8B;CACrD,MAAM,YAAY,QAAQ,IAAI,SAAS,QAAQ;AAC/C,KAAI,OAAO,cAAc,WACvB,cACE,QAAQ,uBACN,IAAI,MAAM,iDAAiD,CAC5D;AAEL,QAAO;;AAGT,SAAS,cAAc,SAA6B;CAClD,MAAM,YAAY,QAAQ,IAAI,SAAS,MAAM;AAC7C,QAAO,OAAO,cAAc,aAAc,YAA2B;;AAGvE,SAAS,YAAY,SAAqC;CACxD,MAAM,WAAW,QAAQ,IAAI,SAAS,WAAW;AAGjD,QAAO,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO,KAAA;;AAG9D,SAAS,eACP,OACA,WACA,SACiB;CACjB,IAAI;AACJ,KAAI,OAAO,UAAU,SAAU,SAAQ;UAC9B,iBAAiB,UAAW,SAAQ,MAAM;UAC1C,OAAO,MAAM,QAAQ,SAAU,SAAQ,MAAM;KACjD,QAAO,KAAA;AAEZ,KAAI;AACF,SAAO,IAAI,UAAU,OAAO,QAAQ;SAC9B;AACN;;;AAIJ,SAAS,gBACP,QACA,YACA,WACS;AACT,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SAAU,QAAO;AAExE,KAAI,WACF,KAAI;EACF,MAAM,OAAO,IAAI,UAAU,WAAW;AACtC,MACE,OAAO,aAAa,KAAK,YACzB,kBAAkB,OAAO,SAAS,KAChC,kBAAkB,KAAK,SAAS,IAClC,OAAO,SAAS,KAAK,KAErB,QAAO;SAEH;AACN,SAAO;;CAIX,MAAM,WAAW,kBAAkB,OAAO,SAAS;AACnD,KACE,aAAa,eACb,SAAS,SAAS,aAAa,IAC/B,aAAa,eACb,SAAS,SAAS,aAAa,CAE/B,QAAO;AAET,QAAO,cAAc,SAAS,IAAI,cAAc,SAAS;;AAG3D,SAAS,kBAAkB,UAA0B;AACnD,QAAO,SACJ,aAAa,CACb,QAAQ,YAAY,GAAG,CACvB,QAAQ,OAAO,GAAG;;AAGvB,SAAS,cAAc,UAA2B;CAChD,MAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,SAAS,MAAM,IAAI,OAAO;AAChC,KACE,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAExE,QAAO;CAET,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,OAAO;AACtB,KAAI,UAAU,KAAA,KAAa,WAAW,KAAA,EAAW,QAAO;AACxD,QACE,UAAU,KACV,UAAU,MACV,UAAU,OACT,UAAU,OAAO,WAAW,OAC5B,UAAU,OAAO,UAAU,MAAM,UAAU,MAC3C,UAAU,OAAO,WAAW;;AAIjC,SAAS,cAAc,UAA2B;AAChD,KAAI,CAAC,SAAS,SAAS,IAAI,CAAE,QAAO;CACpC,MAAM,aAAa,SAAS,aAAa;AACzC,KAAI,eAAe,QAAQ,eAAe,MAAO,QAAO;CACxD,MAAM,aAAa,WAAW,MAAM,IAAI,CAAC,MAAM;CAC/C,MAAM,aAAa,OAAO,SAAS,cAAc,KAAK,GAAG;AACzD,MAAK,aAAa,WAAY,UAAW,aAAa,WAAY,MAChE,QAAO;CAET,MAAM,aAAa,gCAAgC,KAAK,WAAW,GAAG;AACtE,KAAI,WAAY,QAAO,cAAc,WAAW;CAEhD,MAAM,YAAY,yCAAyC,KAAK,WAAW;AAC3E,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,OAAO,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;CACpD,MAAM,MAAM,OAAO,SAAS,UAAU,MAAM,IAAI,GAAG;AACnD,QAAO,cAAc,GAAG,QAAQ,EAAE,GAAG,OAAO,IAAK,GAAG,OAAO,EAAE,GAAG,MAAM,MAAO;;;;AChI/E,MAAM,6BAA6B,cACjC,KAAA,EACD;AAED,IAAI;AAIJ,SAAgB,uBAAuB,MAAmC;CACxE,MAAM,iBAAiB,WAAW,2BAA2B;AAC7D,KAAI,CAAC,eACH,OAAM,IAAI,MACR,kEACD;AAEH,KAAI,KAAK,WAAW,EAClB,OAAM,IAAI,MAAM,+CAA+C;AAGjE,QAAO,eACE,EACL,KAAK,QAAgB,SAAsC;AACzD,MAAI,OAAO,WAAW,EACpB,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,MAAI,YAAY,KAAA,KAAa,CAAC,6BAA6B,QAAQ,CACjE,QAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CACjE;AAEH,SAAO,eAAe,MAAM,QAAQ,QAAQ;IAE/C,GACD,CAAC,gBAAgB,KAAK,CACvB;;AAGH,SAAgB,2BACd,SACiC;AACjC,QAAO,mCAAmC,QAAQ;;AAGpD,SAAgB,+BAAqC;AACnD,sCAAqC;;AAWvC,SAAS,mCACP,SACA,iBACiC;CACjC,MAAM,aAAa,iBAAiB,QAAQ,sBAAsB;CAClE,MAAM,kBAAkB,iBAAiB,mBAAmB;CAC5D,MAAM,sBAAsB,iBAAiB,oBAAoB;AAEjE,KAAI,oBACF,KAAI;AACF,sCAAoC,gBAAgB;UAC7C,OAAO;AACd,sCAAoC,YAAY,MAAM;;AAI1D,KAAI,iBAAiB,oBAAoB,MAAM;EAC7C,MAAM,iBAAiB,+BAA+B,EACpD,SAAS,iBACV,CAAC;AACF,MAAI,eAAe,cAAc,SAAS,EACxC,kBAAiB,YAAY,eAAe;;CAIhD,IAAI,WAAW;CACf,IAAI,UAAU;CACd,IAAI;CAKJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;;;;;;;;;;;;CAYJ,IAAI;CAEJ,MAAM,eAAqB;AACzB,qBAAmB,SAAS;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,UAAU,KAAA,EACzD,OAAM,IAAI,MAAM,iDAAiD;EAInE,MAAM,OAAO,cADS,QACoB,iBAAiB,MAAM,CAAC;AAClE,WAAS,OACP,cACE,2BAA2B,UAC3B,EAAE,OAAO,iBAAiB,EAC1B,KACD,CACF;;CAGH,MAAM,qBAA2B;AAC/B,MACE,CAAC,WACD,CAAC,YACD,CAAC,QACD,CAAC,0BACD,CAAC,0BAED;EAEF,MAAM,kBAAkB;EACxB,MAAM,eAAe;EACrB,MAAM,gCAAgC;EACtC,MAAM,mCAAmC;AACzC,aAAW,KAAA;AACX,SAAO,KAAA;AACP,UAAQ,KAAA;AACR,WAAS,KAAA;AACT,2BAAyB,KAAA;AACzB,8BAA4B,KAAA;AAG5B,oBAAkB,KAAA;AAClB,YAAU;EAEV,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,oCAAiC;WAC1B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,uCAAoC;WAC7B,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,oBAAiB,SAAS;WACnB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,aACF,KAAI;AACF,WAAQ,aAAa;WACd,OAAO;AACd,UAAO,KAAK,MAAM;;AAGtB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,2CACD;;CAwHL,MAAM,SAAS,IAAI,OACjB,sBAAsB,WAAW,EACjC,EAAE,SAtHwC;EAC1C,MAAM,MAAM,MAAM,UAAU;AAC1B,sBAAmB,SAAS;AAC5B,OAAI,WAAW,YAAY,KACzB,OAAM,IAAI,MAAM,+CAA+C;AAEjE,OAAI,KAAK,WAAW,WAAW,EAC7B,OAAM,IAAI,MAAM,0CAA0C;AAE5D,OAAI,CAAC,6BAA6B,KAAK,MAAM,CAC3C,OAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM,gBAAgB,QAAQ,QAAQ,KAAK;AAC3C,OAAI,CAAC,cACH,OAAM,IAAI,MACR,kDAAkD,KAAK,WAAW,GACnE;GAEH,MAAM,iBAAiB,qBAAqB,cAAc;AAE1D,OAAI;AACF,WAAO,SAAS;AAChB,WAAO;AAEP,uBAAmB,YAAY,QAAQ,YACrC,SAAS,eAAe,YAAY,QAAQ,QAAQ;AACtD,YAAQ,KAAK;AACb,aAAS,eAAe;AACxB,6BAAyB,+BAA+B;KACtD,YAAY,KAAK;KACjB,cAAc,eAAe,aAAa,EAAE;KAC5C,iBAAiB,YAAY,QAAQ,YACnC,SAAS,eAAe,YAAY,QAAQ,QAAQ;KACvD,CAAC;AACF,QAAI,oBACF,6BAA4B,wCAC1B;KACE,SAAS,KAAK,yBAAyB;KACvC,YAAY,KAAK;KAClB,EACD,gBACD;AAEH,cAAU;IAEV,MAAM,iBAAiB,MAAM,wCAAwC;AACrE,uBAAmB,SAAS;AAa5B,eAAW,eAAe,mCAAmC,EAC3D,YAbmC;KACnC,OAAO,SAAS;AACT,cAAQ,QAAQ,SAAS,OAAO,QAAQ,CAAC,CAAC,YACvC,KAAA,EACP;;KAEH,OAAO;AACL,YAAM,IAAI,MACR,gEACD;;KAEJ,EAGA,CAAC;AACF,YAAQ;YACD,OAAO;AACd,sBAAkB,UAAU,OAAO,kCAAkC;AACrE,QAAI;AACF,mBAAc;aACP,cAAc;AACrB,uBACE,UACA,cACA,oCACD;;AAEH,UAAM;;;EAGV,MAAM,YAAY,WAAW;AAC3B,sBAAmB,SAAS;AAC5B,OAAI,CAAC,QACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,OAAI,CAAC,6BAA6B,UAAU,CAC1C,OAAM,IAAI,MAAM,gDAAgD;AAGlE,WAAQ;AAcR,OAAI,CAAC,SAAU;AACf,OAAI;AACF,YAAQ;YACD,OAAO;AACd,QAAI,KACF,mBAAkB,MAAM,OAAO,mCAAmC;AAEpE,UAAM;;;EAGV,MAAM,UAAU;AACd,iBAAc;;EAEjB,EAIuB,CACvB;AAED,QAAO,EACL,UAAU;AACR,MAAI,SAAU;AACd,aAAW;EACX,MAAM,SAAoB,EAAE;AAC5B,MAAI;AACF,iBAAc;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,UAAO,OAAO;WACP,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI;AACF,cAAW,YAAY;WAChB,OAAO;AACd,UAAO,KAAK,MAAM;;AAEpB,MAAI,OAAO,SAAS,EAClB,OAAM,IAAI,eACR,QACA,4CACD;IAGN;;AAGH,SAAS,qBACP,OACiC;AACjC,KAAI,OAAO,UAAU,WACnB,QAAO;EAAE,WAAW;EAAO,cAAc,EAAE;EAAE;AAG/C,QAAO;;AAGT,SAAS,iBACP,OACmC;AACnC,QAAO,eAAe,MAAM,GAAG,QAAQ,EAAE,OAAO,OAAO;;AAGzD,SAAS,mBAAmB,UAAyB;AACnD,KAAI,SACF,OAAM,IAAI,MAAM,8CAA8C;;AAIlE,SAAS,yCAAsF;AAC7F,KAAI,CAAC,0CACH,8CAA6C,YAAY;AACvD,QAAM,OAAO;AACb,SAAO,OAAO;KACZ,CAAC,OAAO,UAAmB;AAC7B,8CAA4C,KAAA;AAC5C,QAAM;GACN;AAEJ,QAAO;;AAGT,SAAS,kBACP,MACA,OACA,iBACM;AACN,KAAI;AACF,OAAK,YAAY,EACf,SAAS,iBAAiB,QAAQ,MAAM,UAAU,iBACnD,CAAC;SACI;;AAKV,SAAS,iBACP,YACA,QACO;AACP,qBAAoB,WAAW;AAC/B,OAAM,IAAI,MACR,kDAAkD,OAAO,cAAc,KAAK,KAAK,CAAC,GACnF;;AAGH,SAAS,oCACP,YACA,OACO;AACP,qBAAoB,WAAW;AAC/B,OAAM,IAAI,MACR,mDACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IAExD,EAAE,OAAO,OAAO,CACjB;;AAGH,SAAS,oBAAoB,YAAkD;AAC7E,KAAI;AACF,aAAW,YAAY;SACjB;AAGR,YAAW,SAAS;;AAGtB,SAAS,uBAAuD;CAC9D,MAAM,YAAY;AAClB,KAAI,OAAO,UAAU,gBAAgB,WACnC,OAAM,IAAI,MACR,4DACD;AAEH,KAAI,UAAU,cAAc,KAAA,EAC1B,WAAU,YAAY;AAExB,QAAO;;AAGT,SAAS,sBACP,OACqB;AACrB,QAAO;EACL,KAAK,SAAS,eAAe;AAC3B,SAAM,YAAY,SAAS,iBAAiB,EAAE,CAAC;;EAEjD,OAAO,UAAU,EAAE,UAAU;AAC3B,OAAI,MAAM,kBAAkB;AAC1B,UAAM,iBAAiB,YAAY,UAAU,SAAS,MAAM,KAAK,EAAE,EACjE,QACD,CAAC;AACF;;AAGF,SAAM,aAAa,UAAU,SAAS,MAAM,KAAK;AACjD,WAAQ,iBACN,eACM;AACJ,UAAM,YAAY;MAEpB,EAAE,MAAM,MAAM,CACf;;EAEJ;;AAGH,SAAS,eACP,OAC+D;AAC/D,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fluid-app/widget-runtime",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Remote DOM host and worker runtime for Fluid widget packages",
   "files": [
     "dist"