@jini-ai/ui 0.1.2 → 0.3.1

package/dist/renderers/srcdoc/bridge.js

@@ -0,0 +1,35 @@
+/**
+ * The srcDoc bridge plugin seam.
+ *
+ * The origin project's `runtime/srcdoc.ts` bakes in a fixed set of
+ * postMessage bridges directly into its srcDoc builder — deck navigation,
+ * comment/inspect element-selection, a CSS tweaks palette, and a manual-edit
+ * overlay. Every one of those is product-specific (their protocols
+ * reference that product's own comment/inspect/edit UI), so none of the
+ * *implementations* are ported here. What's generic and worth keeping is
+ * the *seam*: a srcDoc document is built once, and any number of
+ * independent scripts get a chance to inject themselves into it before it's
+ * handed to the iframe.
+ *
+ * A host (e.g. a product's own adapter) implements {@link SrcDocBridge}
+ * for each bridge it needs and passes them to `buildSrcDoc`'s `bridges`
+ * option; this package's own `MANDATORY_BRIDGES` (sandbox shim, focus
+ * guard) always run first via `srcdoc/build.ts`, not through this seam,
+ * since sandbox/focus safety must not be skippable by a plugin bug.
+ */
+/**
+ * Runs every bridge's `inject` over `doc` in order. A bridge whose `inject`
+ * throws is skipped (with the original `doc` passed through unchanged) so
+ * one broken host-registered bridge can't blank the whole preview.
+ */
+export function applySrcDocBridges(doc, bridges, ctx = {}) {
+    return bridges.reduce((current, bridge) => {
+        try {
+            return bridge.inject(current, ctx);
+        }
+        catch {
+            return current;
+        }
+    }, doc);
+}
+//# sourceMappingURL=bridge.js.map

package/dist/renderers/srcdoc/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/renderers/srcdoc/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,OAAgC,EAChC,MAA2B,EAAE;IAE7B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,GAAG,CAAC,CAAC;AACV,CAAC"}

package/dist/renderers/srcdoc/build.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Wrap artifact HTML for a sandboxed iframe (`srcDoc`).
+ *
+ * Origin: `apps/web/src/runtime/srcdoc.ts` in the origin project (2,689
+ * lines). Ported the generic sandbox mechanics only — document wrapping,
+ * title sanitization, the same-origin storage shim, the anti-focus-steal
+ * guard, and the lazy-transport-shell perf optimization. NOT ported: every
+ * postMessage bridge (deck navigation, comment/inspect element-selection,
+ * CSS tweaks palette, manual-edit overlay, snapshot/export-capture) — those
+ * are that product's own UI protocols. They become `SrcDocBridge` plugins a
+ * host registers via `bridges` (see `bridge.ts`), not built-ins. See
+ * `source-map.md` for the full file-by-file breakdown.
+ */
+import { type SrcDocBridge } from './bridge.js';
+export interface BuildSrcDocOptions {
+    /** `<base href>` for the document, so relative asset/script URLs resolve as if served from this path. */
+    baseHref?: string | undefined;
+    /**
+     * Suppress focus-stealing scripts (`window.focus()`, `element.focus()` at
+     * load, `autofocus`) unless the user just interacted with the iframe.
+     * Callers decide when this is needed — see `htmlNeedsFocusGuard` in
+     * `url-load-decision.ts` for the auto-detection heuristic used upstream.
+     */
+    previewFocusGuard?: boolean | undefined;
+    /** Host-registered bridges to splice in, run in array order after the mandatory sandbox shim + focus guard. */
+    bridges?: readonly SrcDocBridge[] | undefined;
+    /** Extra context passed through to every bridge's `inject`. */
+    bridgeContext?: Record<string, unknown> | undefined;
+    /**
+     * Wrap the result as a small "lazy transport" shell instead of the real
+     * document (see {@link buildLazySrcDocTransport}) — the host activates it
+     * later via a `postMessage`, avoiding a second full srcDoc reflow when the
+     * same iframe is reused across renders.
+     */
+    lazyTransport?: boolean | undefined;
+    /**
+     * Content-Security-Policy meta tag to inject into the document `<head>`.
+     * `true` (default) injects {@link DEFAULT_SRC_DOC_CSP}; `false` skips CSP
+     * injection entirely (the iframe's `sandbox` attribute is still the
+     * primary isolation boundary — see `react/components/SrcDocSandbox.tsx`);
+     * a string uses that policy verbatim.
+     */
+    csp?: string | boolean | undefined;
+}
+/**
+ * Default Content-Security-Policy applied to every srcDoc document unless
+ * overridden. Locks down `object-src`/`base-uri`/`form-action` (no plugin
+ * embeds, no `<base>`-hijacking, no form navigation out of the sandbox)
+ * while still allowing the inline scripts/styles and `blob:`/`data:` assets
+ * that typical agent-generated HTML/React/SVG artifacts use. This is
+ * defense in depth on top of the iframe's own `sandbox` attribute (which
+ * lacks `allow-same-origin`, so the document already has no access to the
+ * host's storage/cookies/DOM regardless of CSP).
+ */
+export declare const DEFAULT_SRC_DOC_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: data:; style-src 'unsafe-inline'; img-src * data: blob:; font-src * data:; media-src * data: blob:; connect-src *; frame-src *; child-src *; object-src 'none'; base-uri 'none'; form-action 'none';";
+/**
+ * Sanitize a title string so it is safe to use as a downloaded/printed
+ * filename (avoids characters several common desktop OSes and collaboration
+ * tools reject in filenames: `: # % & * { } \ < > ? / + | "`), and strips
+ * doubled `~$` lock-file prefixes some office tools leave behind.
+ */
+export declare function sanitizePreviewTitle(text: string): string;
+/**
+ * Rewrite the `<title>` element in an HTML string so its text content is
+ * filename-safe (see {@link sanitizePreviewTitle}). Only the real `<title>`
+ * in the `<head>` region is changed — occurrences inside HTML comments,
+ * `<script>`, or `<style>` blocks are left untouched. Pure string
+ * operations — no `DOMParser` — so it behaves identically in Node test
+ * environments and in the browser.
+ */
+export declare function sanitizeTitleInDoc(html: string): string;
+/** Splice `payload` right after the opening `<head …>` tag, prepending it when no `<head>` exists. */
+export declare function injectAfterHeadOpen(doc: string, payload: string): string;
+/**
+ * Splice `payload` right before the real `</head>` (the last one before
+ * `<body>`, so a literal `</head>` inside a `<script>`/`<style>` isn't
+ * mistaken for the real close tag). String-first for speed; falls back to
+ * `DOMParser` only for head-less fragments where no textual insertion point
+ * exists.
+ */
+export declare function injectBeforeHeadEnd(doc: string, payload: string): string;
+/** Splice `payload` right before the real `</body>` (the last one before `</html>`). See {@link injectBeforeHeadEnd}. */
+export declare function injectBeforeBodyEnd(doc: string, payload: string): string;
+/**
+ * Build the lazy transport shell: a tiny placeholder document that, once
+ * mounted, listens for a `jini:srcdoc-transport-activate` postMessage
+ * carrying the real artifact HTML and replaces itself via
+ * `document.write`. Lets a host reuse one already-mounted iframe across
+ * renders instead of paying a full `srcDoc` reflow every time, at the cost
+ * of one extra postMessage round trip on first activation.
+ *
+ * The shell posts `jini:srcdoc-transport-ready` to the parent as soon as
+ * its listener is installed — the *only* reliable signal a host has that
+ * the listener is live. Without it, a host that posts `activate` too early
+ * (e.g. immediately after a key-driven iframe re-mount) risks the message
+ * being dropped before the shell's script has executed, leaving the iframe
+ * stuck on the empty shell.
+ */
+export declare function buildLazySrcDocTransport(): string;
+export interface SrcDocActivationInputs {
+    /** The real artifact HTML the host wants to inject into the shell. */
+    srcDoc: string;
+    /** Host is currently showing a URL-loaded iframe (the srcDoc iframe is hidden). */
+    useUrlLoadPreview: boolean;
+    /** Host's render pipeline is routing through the lazy transport shell. */
+    useLazyTransport: boolean;
+    /** The shell document has loaded AND posted `jini:srcdoc-transport-ready`. */
+    shellReady: boolean;
+    /** Which artifact HTML has already been pushed into this shell (dedupe). */
+    activatedHtml: string | null;
+}
+/**
+ * Pure decision for whether a host should now post
+ * `jini:srcdoc-transport-activate` to the shell iframe. Gating on
+ * `shellReady` matters: without it, an activation triggered by
+ * `useUrlLoadPreview` flipping to false can fire before the iframe's shell
+ * script has registered its message listener — the message is dropped, the
+ * shell stays on its empty body, and a naive dedupe check then suppresses
+ * the follow-up activation from the iframe's own `onLoad` path.
+ */
+export declare function canActivateSrcDocTransport(state: SrcDocActivationInputs): boolean;
+/**
+ * Wrap `html` for a sandboxed iframe's `srcDoc`. If `html` is already a full
+ * document (`<!doctype …>` / `<html>`), it's passed through unchanged;
+ * otherwise it's wrapped in a minimal doctype shell. Always applies the
+ * safety mechanics (title sanitization, sandbox shim, focus guard); runs any
+ * `options.bridges` afterward via {@link applySrcDocBridges}.
+ */
+export declare function buildSrcDoc(html: string, options?: BuildSrcDocOptions): string;
+//# sourceMappingURL=build.d.ts.map

package/dist/renderers/srcdoc/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/renderers/srcdoc/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAsB,KAAK,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,kBAAkB;IACjC,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,+GAA+G;IAC/G,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;IAC9C,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACpD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,4QAC2O,CAAC;AAO5Q;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUzD;AAwED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBvD;AAOD,sGAAsG;AACtG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBxE;AAED,yHAAyH;AACzH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAgBxE;AAoJD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAuBjD;AAED,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAOjF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CA6BlF"}

package/dist/renderers/srcdoc/build.js

@@ -0,0 +1,448 @@
+/**
+ * Wrap artifact HTML for a sandboxed iframe (`srcDoc`).
+ *
+ * Origin: `apps/web/src/runtime/srcdoc.ts` in the origin project (2,689
+ * lines). Ported the generic sandbox mechanics only — document wrapping,
+ * title sanitization, the same-origin storage shim, the anti-focus-steal
+ * guard, and the lazy-transport-shell perf optimization. NOT ported: every
+ * postMessage bridge (deck navigation, comment/inspect element-selection,
+ * CSS tweaks palette, manual-edit overlay, snapshot/export-capture) — those
+ * are that product's own UI protocols. They become `SrcDocBridge` plugins a
+ * host registers via `bridges` (see `bridge.ts`), not built-ins. See
+ * `source-map.md` for the full file-by-file breakdown.
+ */
+import { applySrcDocBridges } from './bridge.js';
+/**
+ * Default Content-Security-Policy applied to every srcDoc document unless
+ * overridden. Locks down `object-src`/`base-uri`/`form-action` (no plugin
+ * embeds, no `<base>`-hijacking, no form navigation out of the sandbox)
+ * while still allowing the inline scripts/styles and `blob:`/`data:` assets
+ * that typical agent-generated HTML/React/SVG artifacts use. This is
+ * defense in depth on top of the iframe's own `sandbox` attribute (which
+ * lacks `allow-same-origin`, so the document already has no access to the
+ * host's storage/cookies/DOM regardless of CSP).
+ */
+export const DEFAULT_SRC_DOC_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: data:; style-src 'unsafe-inline'; img-src * data: blob:; font-src * data:; media-src * data: blob:; connect-src *; frame-src *; child-src *; object-src 'none'; base-uri 'none'; form-action 'none';";
+function injectContentSecurityPolicy(doc, csp) {
+    const tag = `<meta http-equiv="Content-Security-Policy" content="${escapeAttr(csp)}">`;
+    return injectAfterHeadOpen(doc, tag);
+}
+/**
+ * Sanitize a title string so it is safe to use as a downloaded/printed
+ * filename (avoids characters several common desktop OSes and collaboration
+ * tools reject in filenames: `: # % & * { } \ < > ? / + | "`), and strips
+ * doubled `~$` lock-file prefixes some office tools leave behind.
+ */
+export function sanitizePreviewTitle(text) {
+    let result = text.trim();
+    let prev;
+    do {
+        prev = result;
+        result = result.replace(/^~\$/, '').trim();
+    } while (result !== prev);
+    // eslint-disable-next-line no-useless-escape
+    result = result.replace(/[:#%&*{}\\<>?/+|"]+/g, '-');
+    return result.trim();
+}
+const NAMED_ENTITY_MAP = {
+    agrave: 'à', aacute: 'á', acirc: 'â', atilde: 'ã', auml: 'ä', aring: 'å',
+    aelig: 'æ', ccedil: 'ç',
+    egrave: 'è', eacute: 'é', ecirc: 'ê', euml: 'ë',
+    igrave: 'ì', iacute: 'í', icirc: 'î', iuml: 'ï',
+    eth: 'ð', ntilde: 'ñ',
+    ograve: 'ò', oacute: 'ó', ocirc: 'ô', otilde: 'õ', ouml: 'ö', oslash: 'ø',
+    ugrave: 'ù', uacute: 'ú', ucirc: 'û', uuml: 'ü',
+    yacute: 'ý', thorn: 'þ', yuml: 'ÿ',
+    Agrave: 'À', Aacute: 'Á', Acirc: 'Â', Atilde: 'Ã', Auml: 'Ä', Aring: 'Å',
+    AElig: 'Æ', Ccedil: 'Ç',
+    Egrave: 'È', Eacute: 'É', Ecirc: 'Ê', Euml: 'Ë',
+    Igrave: 'Ì', Iacute: 'Í', Icirc: 'Î', Iuml: 'Ï',
+    ETH: 'Ð', Ntilde: 'Ñ',
+    Ograve: 'Ò', Oacute: 'Ó', Ocirc: 'Ô', Otilde: 'Õ', Ouml: 'Ö', Oslash: 'Ø',
+    Ugrave: 'Ù', Uacute: 'Ú', Ucirc: 'Û', Uuml: 'Ü',
+    Yacute: 'Ý', THORN: 'Þ',
+    ndash: '–', mdash: '—', lsquo: '‘', rsquo: '’',
+    ldquo: '“', rdquo: '”', hellip: '…', trade: '™', reg: '®',
+    copy: '©', deg: '°', euro: '€', pound: '£', yen: '¥',
+};
+function safeFromCodePoint(cp) {
+    if (cp < 0 || cp > 0x10ffff)
+        return '�';
+    return String.fromCodePoint(cp);
+}
+function decodeHtmlEntitiesForTitle(encoded) {
+    return encoded
+        .replace(/&([A-Za-z]+);/g, (match, name) => NAMED_ENTITY_MAP[name] ?? match)
+        .replace(/&amp;/gi, '&')
+        .replace(/&lt;/gi, '<')
+        .replace(/&gt;/gi, '>')
+        .replace(/&quot;/gi, '"')
+        .replace(/&apos;/gi, "'")
+        .replace(/&#(\d+);/g, (_, n) => safeFromCodePoint(Number(n)))
+        .replace(/&#x([0-9a-f]+);/gi, (_, h) => safeFromCodePoint(parseInt(h, 16)));
+}
+function findRealTitleOffset(html, searchLimit) {
+    let i = 0;
+    const limit = Math.min(html.length, searchLimit);
+    while (i < limit) {
+        if (html.charCodeAt(i) === 60 /* < */ && html.slice(i, i + 4) === '<!--') {
+            const end = html.indexOf('-->', i + 4);
+            if (end < 0)
+                return -1;
+            i = end + 3;
+            continue;
+        }
+        if (html.charCodeAt(i) === 60 /* < */) {
+            const tagMatch = /^<(script|style)\b/i.exec(html.slice(i, i + 20));
+            if (tagMatch) {
+                const closingTag = `</${tagMatch[1]}`;
+                const end = html.toLowerCase().indexOf(closingTag.toLowerCase(), i + tagMatch[0].length);
+                if (end < 0)
+                    return -1;
+                const closeEnd = html.indexOf('>', end);
+                i = closeEnd >= 0 ? closeEnd + 1 : end + closingTag.length;
+                continue;
+            }
+        }
+        if (html.charCodeAt(i) === 60 /* < */) {
+            if (/^<title[\s>]/i.test(html.slice(i, i + 8))) {
+                return i;
+            }
+        }
+        i++;
+    }
+    return -1;
+}
+/**
+ * Rewrite the `<title>` element in an HTML string so its text content is
+ * filename-safe (see {@link sanitizePreviewTitle}). Only the real `<title>`
+ * in the `<head>` region is changed — occurrences inside HTML comments,
+ * `<script>`, or `<style>` blocks are left untouched. Pure string
+ * operations — no `DOMParser` — so it behaves identically in Node test
+ * environments and in the browser.
+ */
+export function sanitizeTitleInDoc(html) {
+    const lower = html.toLowerCase();
+    const bodyStart = lower.indexOf('<body');
+    const headEnd = lower.lastIndexOf('</head>', bodyStart >= 0 ? bodyStart - 1 : lower.length - 1);
+    const searchLimit = headEnd >= 0 ? headEnd + 7 : bodyStart >= 0 ? bodyStart : html.length;
+    const titleStart = findRealTitleOffset(html, searchLimit);
+    if (titleStart < 0)
+        return html;
+    const openTagEnd = html.indexOf('>', titleStart);
+    if (openTagEnd < 0)
+        return html;
+    const closingTagStart = html.toLowerCase().indexOf('</title>', openTagEnd + 1);
+    if (closingTagStart < 0)
+        return html;
+    const closingTagEnd = html.indexOf('>', closingTagStart);
+    if (closingTagEnd < 0)
+        return html;
+    const openTag = html.slice(titleStart, openTagEnd + 1);
+    const rawContent = html.slice(openTagEnd + 1, closingTagStart);
+    const closeTag = html.slice(closingTagStart, closingTagEnd + 1);
+    const decoded = decodeHtmlEntitiesForTitle(rawContent);
+    const safe = sanitizePreviewTitle(decoded);
+    return html.slice(0, titleStart) + openTag + safe + closeTag + html.slice(closingTagEnd + 1);
+}
+function serializeHtmlDocument(doc) {
+    const doctype = doc.doctype ? '<!doctype html>\n' : '';
+    return `${doctype}${doc.documentElement.outerHTML}`;
+}
+/** Splice `payload` right after the opening `<head …>` tag, prepending it when no `<head>` exists. */
+export function injectAfterHeadOpen(doc, payload) {
+    if (/<head[^>]*>/i.test(doc))
+        return doc.replace(/<head[^>]*>/i, (m) => `${m}${payload}`);
+    return payload + doc;
+}
+/**
+ * Splice `payload` right before the real `</head>` (the last one before
+ * `<body>`, so a literal `</head>` inside a `<script>`/`<style>` isn't
+ * mistaken for the real close tag). String-first for speed; falls back to
+ * `DOMParser` only for head-less fragments where no textual insertion point
+ * exists.
+ */
+export function injectBeforeHeadEnd(doc, payload) {
+    const lower = doc.toLowerCase();
+    const bodyStart = lower.indexOf('<body');
+    const limit = bodyStart >= 0 ? bodyStart : lower.length;
+    const idx = lower.lastIndexOf('</head>', limit - 1);
+    if (idx >= 0)
+        return doc.slice(0, idx) + payload + doc.slice(idx);
+    if (/<head[^>]*>/i.test(doc))
+        return doc.replace(/<head[^>]*>/i, (m) => `${m}${payload}`);
+    if (typeof DOMParser !== 'undefined') {
+        try {
+            const parsed = new DOMParser().parseFromString(doc, 'text/html');
+            if (parsed.head)
+                parsed.head.insertAdjacentHTML('beforeend', payload);
+            return serializeHtmlDocument(parsed);
+        }
+        catch {
+            /* fall through to prepend */
+        }
+    }
+    return payload + doc;
+}
+/** Splice `payload` right before the real `</body>` (the last one before `</html>`). See {@link injectBeforeHeadEnd}. */
+export function injectBeforeBodyEnd(doc, payload) {
+    const lower = doc.toLowerCase();
+    const htmlEnd = lower.lastIndexOf('</html>');
+    const limit = htmlEnd >= 0 ? htmlEnd : lower.length;
+    const idx = lower.lastIndexOf('</body>', limit - 1);
+    if (idx >= 0)
+        return doc.slice(0, idx) + payload + doc.slice(idx);
+    if (typeof DOMParser !== 'undefined') {
+        try {
+            const parsed = new DOMParser().parseFromString(doc, 'text/html');
+            if (parsed.body)
+                parsed.body.insertAdjacentHTML('beforeend', payload);
+            return serializeHtmlDocument(parsed);
+        }
+        catch {
+            /* fall through to append */
+        }
+    }
+    return doc + payload;
+}
+function escapeAttr(value) {
+    return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+function injectBaseHref(doc, baseHref) {
+    const safeHref = escapeAttr(baseHref);
+    const tag = `<base href="${safeHref}">`;
+    if (/<head[^>]*>/i.test(doc)) {
+        return doc.replace(/<head[^>]*>/i, (m) => `${m}${tag}`);
+    }
+    if (/<html[^>]*>/i.test(doc)) {
+        return doc.replace(/<html[^>]*>/i, (m) => `${m}<head>${tag}</head>`);
+    }
+    return tag + doc;
+}
+// Sandboxed iframes (`sandbox="allow-scripts"`, deliberately without
+// `allow-same-origin` — see `react/components/SrcDocSandbox.tsx`) raise a
+// SecurityError on first `localStorage`/`sessionStorage` access. Many
+// freeform-generated artifacts call `localStorage.getItem(...)` at the top
+// of an IIFE with no try/catch — when it throws, the whole script aborts
+// and the artifact renders blank. Installing a same-origin in-memory shim
+// before any user script runs lets those artifacts degrade gracefully
+// (position/state just doesn't persist across reloads) instead of crashing.
+// The same script also intercepts same-document anchor navigation and
+// `target="_blank"` links so they behave sanely inside a sandboxed iframe
+// (`allow-popups`/`allow-popups-to-escape-sandbox` still required on the
+// iframe itself for the latter to actually open).
+function injectSandboxShim(doc) {
+    const shim = `<script data-jini-sandbox-shim>(function(){
+  function makeStore(){
+    var data = {};
+    var api = {
+      getItem: function(k){ return Object.prototype.hasOwnProperty.call(data, k) ? data[k] : null; },
+      setItem: function(k, v){ data[k] = String(v); },
+      removeItem: function(k){ delete data[k]; },
+      clear: function(){ data = {}; },
+      key: function(i){ return Object.keys(data)[i] || null; }
+    };
+    Object.defineProperty(api, 'length', { get: function(){ return Object.keys(data).length; } });
+    return api;
+  }
+  function tryShim(name){
+    var works = false;
+    try { works = !!window[name] && typeof window[name].getItem === 'function'; void window[name].length; }
+    catch (_) { works = false; }
+    if (works) return;
+    try { Object.defineProperty(window, name, { configurable: true, value: makeStore() }); }
+    catch (_) { try { window[name] = makeStore(); } catch (__) {} }
+  }
+  tryShim('localStorage');
+  tryShim('sessionStorage');
+  document.addEventListener('click', (e) => {
+    if (!e.target || !(e.target instanceof Element)) return;
+    var link = e.target.closest('a[href]');
+    if (!link) return;
+    var href = link.getAttribute('href');
+    if (href === null) return;
+    var isAnchor = href.startsWith('#') || href === '';
+    if (isAnchor) {
+      e.preventDefault();
+      if (href === '' || href === '#') {
+        window.scrollTo({ top: 0 });
+        history.replaceState(null, '', ' ');
+      } else {
+        var targetId = href.slice(1);
+        var target = targetId ? document.getElementById(targetId) : null;
+        if (target) {
+          target.scrollIntoView();
+          location.hash === href && history.replaceState(null, '', ' ');
+          location.hash = href;
+        }
+      }
+    } else if (link.getAttribute('target') === '_blank') {
+      e.preventDefault();
+      let safe = false;
+      try {
+        var url = new URL(href, location.href);
+        safe =
+          url.protocol === 'http:' ||
+          url.protocol === 'https:' ||
+          url.protocol === 'mailto:';
+      } catch (_) {}
+      safe && window.open(href, '_blank', 'noopener,noreferrer');
+    }
+  });
+})();</script>`;
+    if (/<head[^>]*>/i.test(doc))
+        return doc.replace(/<head[^>]*>/i, (m) => `${m}${shim}`);
+    if (/<body[^>]*>/i.test(doc))
+        return doc.replace(/<body[^>]*>/i, (m) => `${m}${shim}`);
+    return shim + doc;
+}
+function injectPreviewFocusGuard(doc) {
+    const script = `<script data-jini-preview-focus-guard>(function(){
+  var lastTrustedInputAt = 0;
+  function userActivated(){
+    return Date.now() - lastTrustedInputAt < 1000;
+  }
+  function markTrustedInput(event){
+    if (event && event.isTrusted) lastTrustedInputAt = Date.now();
+  }
+  document.addEventListener('pointerdown', function(event){
+    markTrustedInput(event);
+  }, true);
+  document.addEventListener('keydown', function(event){
+    markTrustedInput(event);
+  }, true);
+  try {
+    var nativeWindowFocus = window.focus && window.focus.bind(window);
+    Object.defineProperty(window, 'focus', {
+      configurable: true,
+      writable: true,
+      value: function(){
+        if (userActivated() && nativeWindowFocus) return nativeWindowFocus();
+      }
+    });
+  } catch (_) {}
+  try {
+    var nativeElementFocus = HTMLElement.prototype.focus;
+    Object.defineProperty(HTMLElement.prototype, 'focus', {
+      configurable: true,
+      writable: true,
+      value: function(options){
+        if (userActivated()) return nativeElementFocus.call(this, options);
+      }
+    });
+  } catch (_) {}
+})();</script>`;
+    if (/<head[^>]*>/i.test(doc))
+        return doc.replace(/<head[^>]*>/i, (m) => `${m}${script}`);
+    if (/<body[^>]*>/i.test(doc))
+        return doc.replace(/<body[^>]*>/i, (m) => `${m}${script}`);
+    return script + doc;
+}
+function injectSrcdocTransportActivationBridge(doc) {
+    const script = `<script data-jini-srcdoc-transport-activation>(function(){
+  window.addEventListener('message', function(ev){
+    var data = ev && ev.data;
+    if (!data || data.type !== 'jini:srcdoc-transport-activate' || typeof data.html !== 'string') return;
+    document.open();
+    document.write(data.html);
+    document.close();
+  });
+})();</script>`;
+    return injectBeforeBodyEnd(doc, script);
+}
+/**
+ * Build the lazy transport shell: a tiny placeholder document that, once
+ * mounted, listens for a `jini:srcdoc-transport-activate` postMessage
+ * carrying the real artifact HTML and replaces itself via
+ * `document.write`. Lets a host reuse one already-mounted iframe across
+ * renders instead of paying a full `srcDoc` reflow every time, at the cost
+ * of one extra postMessage round trip on first activation.
+ *
+ * The shell posts `jini:srcdoc-transport-ready` to the parent as soon as
+ * its listener is installed — the *only* reliable signal a host has that
+ * the listener is live. Without it, a host that posts `activate` too early
+ * (e.g. immediately after a key-driven iframe re-mount) risks the message
+ * being dropped before the shell's script has executed, leaving the iframe
+ * stuck on the empty shell.
+ */
+export function buildLazySrcDocTransport() {
+    return `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <script data-jini-lazy-srcdoc-transport>(function(){
+      window.addEventListener('message', function(ev){
+        var data = ev && ev.data;
+        if (!data || data.type !== 'jini:srcdoc-transport-activate' || typeof data.html !== 'string') return;
+        document.open();
+        document.write(data.html);
+        document.close();
+      });
+      try {
+        if (window.parent && window.parent !== window) {
+          window.parent.postMessage({ type: 'jini:srcdoc-transport-ready' }, '*');
+        }
+      } catch (_) { /* sandboxed parent — host falls back to onLoad */ }
+    })();</script>
+  </head>
+  <body></body>
+</html>`;
+}
+/**
+ * Pure decision for whether a host should now post
+ * `jini:srcdoc-transport-activate` to the shell iframe. Gating on
+ * `shellReady` matters: without it, an activation triggered by
+ * `useUrlLoadPreview` flipping to false can fire before the iframe's shell
+ * script has registered its message listener — the message is dropped, the
+ * shell stays on its empty body, and a naive dedupe check then suppresses
+ * the follow-up activation from the iframe's own `onLoad` path.
+ */
+export function canActivateSrcDocTransport(state) {
+    if (!state.srcDoc)
+        return false;
+    if (state.useUrlLoadPreview)
+        return false;
+    if (!state.useLazyTransport)
+        return false;
+    if (!state.shellReady)
+        return false;
+    if (state.activatedHtml === state.srcDoc)
+        return false;
+    return true;
+}
+/**
+ * Wrap `html` for a sandboxed iframe's `srcDoc`. If `html` is already a full
+ * document (`<!doctype …>` / `<html>`), it's passed through unchanged;
+ * otherwise it's wrapped in a minimal doctype shell. Always applies the
+ * safety mechanics (title sanitization, sandbox shim, focus guard); runs any
+ * `options.bridges` afterward via {@link applySrcDocBridges}.
+ */
+export function buildSrcDoc(html, options = {}) {
+    if (options.lazyTransport)
+        return buildLazySrcDocTransport();
+    const head = html.trimStart().slice(0, 64).toLowerCase();
+    const isFullDoc = head.startsWith('<!doctype') || head.startsWith('<html');
+    const wrapped = isFullDoc
+        ? html
+        : `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+  </head>
+  <body>${html}</body>
+</html>`;
+    const withSafeTitle = sanitizeTitleInDoc(wrapped);
+    const cspValue = options.csp === false ? null : options.csp === true || options.csp === undefined ? DEFAULT_SRC_DOC_CSP : options.csp;
+    const withCsp = cspValue ? injectContentSecurityPolicy(withSafeTitle, cspValue) : withSafeTitle;
+    const withBase = options.baseHref ? injectBaseHref(withCsp, options.baseHref) : withCsp;
+    const withShim = injectSandboxShim(withBase);
+    const withFocusGuard = options.previewFocusGuard ? injectPreviewFocusGuard(withShim) : withShim;
+    const ctx = { baseHref: options.baseHref, ...options.bridgeContext };
+    const withBridges = options.bridges?.length
+        ? applySrcDocBridges(withFocusGuard, options.bridges, ctx)
+        : withFocusGuard;
+    return injectSrcdocTransportActivationBridge(withBridges);
+}
+//# sourceMappingURL=build.js.map

package/dist/renderers/srcdoc/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/renderers/srcdoc/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAA+C,MAAM,aAAa,CAAC;AAiC9F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,yQAAyQ,CAAC;AAE5Q,SAAS,2BAA2B,CAAC,GAAW,EAAE,GAAW;IAC3D,MAAM,GAAG,GAAG,uDAAuD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;IACvF,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,IAAY,CAAC;IACjB,GAAG,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;QACd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE;IAC1B,6CAA6C;IAC7C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,gBAAgB,GAA2B;IAC/C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;IACxE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACrB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAClC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;IACxE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACrB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;IACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC/C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;IACvB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG;IAC9C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACzD,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACrD,CAAC;AAEF,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,OAAO;SACX,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;SACnF,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACpE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACvB,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACzF,IAAI,GAAG,GAAG,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC3D,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChG,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAE1F,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IAC/E,IAAI,eAAe,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,aAAa,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAa;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAe;IAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1F,OAAO,OAAO,GAAG,GAAG,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAe;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1F,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACtE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,GAAG,GAAG,CAAC;AACvB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAe;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACtE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,OAAO,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgB;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,QAAQ,IAAI,CAAC;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,yEAAyE;AACzE,kDAAkD;AAClD,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAyDA,CAAC;IACd,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,GAAG,GAAG,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAkCF,CAAC;IACd,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IACzF,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO,MAAM,GAAG,GAAG,CAAC;AACtB,CAAC;AAED,SAAS,qCAAqC,CAAC,GAAW;IACxD,MAAM,MAAM,GAAG;;;;;;;;eAQF,CAAC;IACd,OAAO,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;QAqBD,CAAC;AACT,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA6B;IACtE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,UAA8B,EAAE;IACxE,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,wBAAwB,EAAE,CAAC;IAE7D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;;;;;;UAMI,IAAI;QACN,CAAC;IAEP,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACtI,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAChG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEhG,MAAM,GAAG,GAAwB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM;QACzC,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;QAC1D,CAAC,CAAC,cAAc,CAAC;IAEnB,OAAO,qCAAqC,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC"}

package/dist/renderers/srcdoc/index.d.ts

@@ -0,0 +1,3 @@
+export { buildSrcDoc, buildLazySrcDocTransport, canActivateSrcDocTransport, sanitizeTitleInDoc, sanitizePreviewTitle, DEFAULT_SRC_DOC_CSP, injectAfterHeadOpen, injectBeforeHeadEnd, injectBeforeBodyEnd, type BuildSrcDocOptions, type SrcDocActivationInputs, } from './build.js';
+export { applySrcDocBridges, type SrcDocBridge, type SrcDocBridgeContext } from './bridge.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/renderers/srcdoc/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderers/srcdoc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/renderers/srcdoc/index.js

@@ -0,0 +1,3 @@
+export { buildSrcDoc, buildLazySrcDocTransport, canActivateSrcDocTransport, sanitizeTitleInDoc, sanitizePreviewTitle, DEFAULT_SRC_DOC_CSP, injectAfterHeadOpen, injectBeforeHeadEnd, injectBeforeBodyEnd, } from './build.js';
+export { applySrcDocBridges } from './bridge.js';
+//# sourceMappingURL=index.js.map