@mcp-b/char 0.0.6 → 0.1.1

package/dist/utils.js

@@ -0,0 +1,393 @@
+/*! @mcp-b/char | Copyright (c) 2025 Kukumis Inc. All rights reserved. | UNLICENSED */
+//#region src/utils/css-resolver.ts
+/**
+* CSS var() Resolver
+*
+* Recursively resolves CSS custom property references (`var(--x, fallback)`)
+* to concrete values using getComputedStyle(). Necessary because `var()`
+* references are not valid across iframe boundaries.
+*
+* Handles nested var() references, fallbacks, and cycle detection.
+*/
+const MAX_CSS_VAR_RESOLVE_DEPTH = 12;
+function findMatchingParen(value, openParenIndex) {
+	let depth = 1;
+	for (let i = openParenIndex + 1; i < value.length; i++) {
+		const char = value[i];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		if (depth === 0) return i;
+	}
+	return -1;
+}
+function splitTopLevelComma(value) {
+	let depth = 0;
+	for (let i = 0; i < value.length; i++) {
+		const char = value[i];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth = Math.max(0, depth - 1);
+		else if (char === "," && depth === 0) return [value.slice(0, i), value.slice(i + 1)];
+	}
+	return [value, void 0];
+}
+function resolveFallback(fallback, computed, seen, depth) {
+	if (!fallback) return void 0;
+	return resolveCssValue(fallback, computed, seen, depth + 1) || void 0;
+}
+function resolveCssVariable(variableName, fallback, computed, seen, depth) {
+	if (depth > MAX_CSS_VAR_RESOLVE_DEPTH) {
+		console.warn(`[Char] CSS variable resolution depth exceeded for "${variableName}". Possible circular reference.`);
+		return fallback?.trim();
+	}
+	if (!variableName.startsWith("--") || seen.has(variableName)) return resolveFallback(fallback, computed, seen, depth);
+	const nextSeen = new Set(seen);
+	nextSeen.add(variableName);
+	const rawValue = computed.getPropertyValue(variableName).trim();
+	if (rawValue) {
+		const resolvedRaw = resolveCssValue(rawValue, computed, nextSeen, depth + 1);
+		if (resolvedRaw) return resolvedRaw;
+	}
+	return resolveFallback(fallback, computed, seen, depth);
+}
+function resolveCssValue(value, computed, seen, depth = 0) {
+	const trimmed = value.trim();
+	if (!trimmed || !trimmed.includes("var(") || depth > MAX_CSS_VAR_RESOLVE_DEPTH) return trimmed;
+	let cursor = 0;
+	let resolved = "";
+	let replacedAny = false;
+	while (cursor < trimmed.length) {
+		const varStart = trimmed.indexOf("var(", cursor);
+		if (varStart === -1) {
+			resolved += trimmed.slice(cursor);
+			break;
+		}
+		resolved += trimmed.slice(cursor, varStart);
+		const openParenIndex = varStart + 3;
+		const closeParenIndex = findMatchingParen(trimmed, openParenIndex);
+		if (closeParenIndex === -1) {
+			resolved += trimmed.slice(varStart);
+			break;
+		}
+		const [rawVariableName, rawFallback] = splitTopLevelComma(trimmed.slice(openParenIndex + 1, closeParenIndex));
+		const variableName = rawVariableName.trim();
+		const fallback = rawFallback?.trim();
+		const replacement = variableName ? resolveCssVariable(variableName, fallback, computed, seen, depth + 1) : void 0;
+		if (replacement !== void 0) {
+			resolved += replacement;
+			replacedAny = true;
+		} else resolved += trimmed.slice(varStart, closeParenIndex + 1);
+		cursor = closeParenIndex + 1;
+	}
+	const normalized = resolved.trim();
+	if (!replacedAny || !normalized.includes("var(")) return normalized;
+	return resolveCssValue(normalized, computed, seen, depth + 1);
+}
+
+//#endregion
+//#region src/utils/css-sanitizer.ts
+/**
+* Maximum allowed length for CSS custom property values transported to iframe.
+*
+* NOTE: This value and the blocked-token policy intentionally mirror
+* `packages/shared-types/src/schemas/embed-bridge.ts` so validation happens
+* both before transport (host) and at contract parse-time (iframe).
+*
+* CONTROL_CHAR_PATTERN here is intentionally more permissive than
+* embed-bridge.ts: it allows tabs/newlines/CR/FF because
+* normalizeCssFormattingWhitespace converts them to spaces before the
+* control-char check. The iframe-side schema (embed-bridge.ts) uses
+* the stricter pattern as defense-in-depth for values that bypass
+* host-side sanitization.
+*/
+const MAX_CSS_VARIABLE_VALUE_LENGTH = 1024;
+const MAX_HOST_FONT_CSS_LENGTH = 16384;
+const CONTROL_CHAR_PATTERN = /[\u0000-\u0008\u000b\u000e-\u001f\u007f]/u;
+const FONT_RULES_PATTERN = /^(?:\s*@font-face\s*\{[^{}]*\}\s*)+$/iu;
+const CSS_COMMENT_PATTERN = /\/\*[\s\S]*?\*\//g;
+const CSS_FORMATTING_WHITESPACE_PATTERN = /[\t\n\r\f]+/gu;
+/**
+* Normalizes CSS values for dangerous-token scanning.
+* Lowercases and removes CSS comments/whitespace/control chars to catch obfuscation.
+*/
+function normalizeForSecurityScan(value) {
+	return value.replace(CSS_COMMENT_PATTERN, "").toLowerCase().replace(/[\s\u0000-\u001f\u007f]+/gu, "");
+}
+/**
+* Collapses CSS formatting whitespace (tabs, newlines, carriage returns, form feeds)
+* into single spaces. Applied to the output value before trimming, so multiline
+* host-provided values (e.g., font stacks) become single-line without losing
+* meaningful token boundaries. This also ensures split-token obfuscation
+* (e.g., "java\nscript:") is collapsed before the security scan.
+*/
+function normalizeCssFormattingWhitespace(value) {
+	return value.replace(CSS_FORMATTING_WHITESPACE_PATTERN, " ");
+}
+/**
+* Sanitizes host-provided CSS variable values before iframe transport.
+* Returns `undefined` for unsafe or invalid values.
+*
+* @param value - The raw CSS property value.
+* @param variableName - Optional variable name for diagnostic logging.
+*/
+function sanitizeCssVariableValue(value, variableName) {
+	const trimmed = normalizeCssFormattingWhitespace(value).trim();
+	if (!trimmed) return void 0;
+	if (trimmed.length > MAX_CSS_VARIABLE_VALUE_LENGTH) {
+		console.warn(`[Char] CSS variable ${variableName ?? "(unknown)"} rejected: value exceeds max length (${trimmed.length} > ${MAX_CSS_VARIABLE_VALUE_LENGTH})`);
+		return;
+	}
+	if (CONTROL_CHAR_PATTERN.test(trimmed)) {
+		console.warn(`[Char] CSS variable ${variableName ?? "(unknown)"} rejected: contains control characters`);
+		return;
+	}
+	const blockedToken = getBlockedCssVariableToken(normalizeForSecurityScan(trimmed));
+	if (blockedToken) return warnAndReject(variableName, blockedToken);
+	return trimmed;
+}
+/**
+* Sanitizes host-provided font CSS before iframe injection.
+* Only `@font-face` rules are allowed.
+*/
+function sanitizeHostFontCss(fontCss) {
+	const trimmed = fontCss.trim();
+	if (!trimmed) return void 0;
+	if (trimmed.length > MAX_HOST_FONT_CSS_LENGTH) {
+		console.warn(`[Char] Host font CSS rejected: value exceeds max length (${trimmed.length} > ${MAX_HOST_FONT_CSS_LENGTH})`);
+		return;
+	}
+	if (CONTROL_CHAR_PATTERN.test(trimmed)) {
+		console.warn("[Char] Host font CSS rejected: contains control characters");
+		return;
+	}
+	const blockedToken = getBlockedFontToken(normalizeForSecurityScan(trimmed));
+	if (blockedToken) {
+		console.warn(`[Char] Host font CSS rejected: contains blocked token "${blockedToken}"`);
+		return;
+	}
+	const withoutComments = trimmed.replace(/\/\*[\s\S]*?\*\//g, "").trim();
+	if (!FONT_RULES_PATTERN.test(withoutComments)) {
+		console.warn("[Char] Host font CSS rejected: only @font-face rules are allowed");
+		return;
+	}
+	return trimmed;
+}
+function getBlockedCssVariableToken(normalizedValue) {
+	if (normalizedValue.includes("javascript:")) return "javascript:";
+	if (normalizedValue.includes("vbscript:")) return "vbscript:";
+	if (normalizedValue.includes("expression(")) return "expression(";
+	if (normalizedValue.includes("@import")) return "@import";
+	if (normalizedValue.includes("-moz-binding")) return "-moz-binding";
+	if (normalizedValue.includes("url(")) return "url(";
+}
+function getBlockedFontToken(normalizedValue) {
+	if (normalizedValue.includes("javascript:")) return "javascript:";
+	if (normalizedValue.includes("vbscript:")) return "vbscript:";
+	if (normalizedValue.includes("expression(")) return "expression(";
+	if (normalizedValue.includes("-moz-binding")) return "-moz-binding";
+}
+function warnAndReject(variableName, blockedToken) {
+	console.warn(`[Char] CSS variable ${variableName ?? "(unknown)"} rejected: contains blocked token "${blockedToken}"`);
+}
+
+//#endregion
+//#region src/utils/css-variables.ts
+/**
+* Public CSS variable names for the Char widget.
+*
+* These are the external API — host pages set these to customise the widget.
+* We maintain static lists because `getComputedStyle()` cannot enumerate
+* custom properties.
+*
+* Source of truth:
+* - `src/styles/globals.css` (`--char-*`)
+* - WebMCP ext-apps UI spec (`--color-*`, `--font-*`, etc.)
+*/
+const CHAR_PUBLIC_VARIABLE_NAMES = [
+	"--char-color-background",
+	"--char-color-foreground",
+	"--char-color-card",
+	"--char-color-card-foreground",
+	"--char-color-popover",
+	"--char-color-popover-foreground",
+	"--char-color-primary",
+	"--char-color-primary-foreground",
+	"--char-color-secondary",
+	"--char-color-secondary-foreground",
+	"--char-color-muted",
+	"--char-color-muted-foreground",
+	"--char-color-accent",
+	"--char-color-accent-foreground",
+	"--char-color-destructive",
+	"--char-color-destructive-foreground",
+	"--char-color-border",
+	"--char-color-success",
+	"--char-color-warning",
+	"--char-color-error",
+	"--char-color-input",
+	"--char-color-ring",
+	"--char-user-bubble-bg",
+	"--char-user-bubble-text",
+	"--char-assistant-bubble-bg",
+	"--char-assistant-bubble-text",
+	"--char-composer-bg",
+	"--char-composer-border",
+	"--char-composer-text",
+	"--char-composer-placeholder",
+	"--char-composer-button-bg",
+	"--char-composer-button-text",
+	"--char-tool-bg",
+	"--char-tool-border",
+	"--char-tool-text",
+	"--char-tool-header-bg",
+	"--char-tool-approve-bg",
+	"--char-tool-approve-text",
+	"--char-tool-deny-bg",
+	"--char-tool-deny-text",
+	"--char-code-bg",
+	"--char-code-text",
+	"--char-code-header-bg",
+	"--char-radius",
+	"--char-radius-sm",
+	"--char-radius-md",
+	"--char-radius-lg",
+	"--char-radius-xl",
+	"--char-radius-2xl",
+	"--char-radius-3xl",
+	"--char-radius-full",
+	"--char-spacing-unit",
+	"--char-font-sans",
+	"--char-font-mono",
+	"--char-font-size-xs",
+	"--char-font-size-sm",
+	"--char-font-size-base",
+	"--char-font-size-lg",
+	"--char-duration-fast",
+	"--char-duration-normal",
+	"--char-duration-slow",
+	"--char-easing-default",
+	"--char-easing-spring",
+	"--char-z-base",
+	"--char-z-content",
+	"--char-z-overlay",
+	"--char-z-max",
+	"--char-shadow-sm",
+	"--char-shadow-md",
+	"--char-shadow-lg",
+	"--char-blur-sm",
+	"--char-blur-md",
+	"--char-blur-lg"
+];
+const MCP_UI_STYLE_VARIABLE_NAMES = [
+	"--color-background-primary",
+	"--color-background-secondary",
+	"--color-background-tertiary",
+	"--color-background-inverse",
+	"--color-background-ghost",
+	"--color-background-info",
+	"--color-background-danger",
+	"--color-background-success",
+	"--color-background-warning",
+	"--color-background-disabled",
+	"--color-text-primary",
+	"--color-text-secondary",
+	"--color-text-tertiary",
+	"--color-text-inverse",
+	"--color-text-ghost",
+	"--color-text-info",
+	"--color-text-danger",
+	"--color-text-success",
+	"--color-text-warning",
+	"--color-text-disabled",
+	"--color-border-primary",
+	"--color-border-secondary",
+	"--color-border-tertiary",
+	"--color-border-inverse",
+	"--color-border-ghost",
+	"--color-border-info",
+	"--color-border-danger",
+	"--color-border-success",
+	"--color-border-warning",
+	"--color-border-disabled",
+	"--color-ring-primary",
+	"--color-ring-secondary",
+	"--color-ring-inverse",
+	"--color-ring-info",
+	"--color-ring-danger",
+	"--color-ring-success",
+	"--color-ring-warning",
+	"--font-sans",
+	"--font-mono",
+	"--font-weight-normal",
+	"--font-weight-medium",
+	"--font-weight-semibold",
+	"--font-weight-bold",
+	"--font-text-xs-size",
+	"--font-text-sm-size",
+	"--font-text-md-size",
+	"--font-text-lg-size",
+	"--font-heading-xs-size",
+	"--font-heading-sm-size",
+	"--font-heading-md-size",
+	"--font-heading-lg-size",
+	"--font-heading-xl-size",
+	"--font-heading-2xl-size",
+	"--font-heading-3xl-size",
+	"--font-text-xs-line-height",
+	"--font-text-sm-line-height",
+	"--font-text-md-line-height",
+	"--font-text-lg-line-height",
+	"--font-heading-xs-line-height",
+	"--font-heading-sm-line-height",
+	"--font-heading-md-line-height",
+	"--font-heading-lg-line-height",
+	"--font-heading-xl-line-height",
+	"--font-heading-2xl-line-height",
+	"--font-heading-3xl-line-height",
+	"--border-radius-xs",
+	"--border-radius-sm",
+	"--border-radius-md",
+	"--border-radius-lg",
+	"--border-radius-xl",
+	"--border-radius-full",
+	"--border-width-regular",
+	"--shadow-hairline",
+	"--shadow-sm",
+	"--shadow-md",
+	"--shadow-lg"
+];
+const CHAR_CSS_VARIABLE_NAMES = [...CHAR_PUBLIC_VARIABLE_NAMES, ...MCP_UI_STYLE_VARIABLE_NAMES];
+
+//#endregion
+//#region src/utils/host-context-merge.ts
+function mergeStyles(current, patch) {
+	if (!patch) return current;
+	return {
+		...current,
+		...patch,
+		variables: patch.variables ?? current?.variables,
+		fonts: patch.fonts ?? current?.fonts
+	};
+}
+function shallowMerge(current, patch) {
+	if (!patch) return current;
+	return {
+		...current,
+		...patch
+	};
+}
+function mergeHostContext(current, patch) {
+	const previous = current ?? {};
+	return {
+		...previous,
+		...patch,
+		styles: mergeStyles(previous.styles, patch.styles),
+		containerDimensions: shallowMerge(previous.containerDimensions, patch.containerDimensions),
+		deviceCapabilities: shallowMerge(previous.deviceCapabilities, patch.deviceCapabilities),
+		safeAreaInsets: shallowMerge(previous.safeAreaInsets, patch.safeAreaInsets),
+		hostCapabilities: shallowMerge(previous.hostCapabilities, patch.hostCapabilities)
+	};
+}
+
+//#endregion
+export { CHAR_CSS_VARIABLE_NAMES, MAX_CSS_VARIABLE_VALUE_LENGTH, MAX_CSS_VAR_RESOLVE_DEPTH, MAX_HOST_FONT_CSS_LENGTH, findMatchingParen, mergeHostContext, mergeStyles, resolveCssValue, resolveCssVariable, resolveFallback, sanitizeCssVariableValue, sanitizeHostFontCss, shallowMerge, splitTopLevelComma };
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils/css-resolver.ts","../src/utils/css-sanitizer.ts","../src/utils/css-variables.ts","../src/utils/host-context-merge.ts"],"sourcesContent":["/**\n * CSS var() Resolver\n *\n * Recursively resolves CSS custom property references (`var(--x, fallback)`)\n * to concrete values using getComputedStyle(). Necessary because `var()`\n * references are not valid across iframe boundaries.\n *\n * Handles nested var() references, fallbacks, and cycle detection.\n */\n\nexport const MAX_CSS_VAR_RESOLVE_DEPTH = 12\n\nexport function findMatchingParen(value: string, openParenIndex: number): number {\n\tlet depth = 1\n\tfor (let i = openParenIndex + 1; i < value.length; i++) {\n\t\tconst char = value[i]\n\t\tif (char === '(') depth += 1\n\t\telse if (char === ')') depth -= 1\n\t\tif (depth === 0) return i\n\t}\n\treturn -1\n}\n\nexport function splitTopLevelComma(value: string): [string, string | undefined] {\n\tlet depth = 0\n\tfor (let i = 0; i < value.length; i++) {\n\t\tconst char = value[i]\n\t\tif (char === '(') depth += 1\n\t\telse if (char === ')') depth = Math.max(0, depth - 1)\n\t\telse if (char === ',' && depth === 0) return [value.slice(0, i), value.slice(i + 1)]\n\t}\n\treturn [value, undefined]\n}\n\nexport function resolveFallback(\n\tfallback: string | undefined,\n\tcomputed: CSSStyleDeclaration,\n\tseen: Set<string>,\n\tdepth: number,\n): string | undefined {\n\tif (!fallback) return undefined\n\treturn resolveCssValue(fallback, computed, seen, depth + 1) || undefined\n}\n\nexport function resolveCssVariable(\n\tvariableName: string,\n\tfallback: string | undefined,\n\tcomputed: CSSStyleDeclaration,\n\tseen: Set<string>,\n\tdepth: number,\n): string | undefined {\n\tif (depth > MAX_CSS_VAR_RESOLVE_DEPTH) {\n\t\tconsole.warn(`[Char] CSS variable resolution depth exceeded for \"${variableName}\". Possible circular reference.`)\n\t\treturn fallback?.trim()\n\t}\n\n\tif (!variableName.startsWith('--') || seen.has(variableName)) {\n\t\treturn resolveFallback(fallback, computed, seen, depth)\n\t}\n\n\tconst nextSeen = new Set(seen)\n\tnextSeen.add(variableName)\n\n\tconst rawValue = computed.getPropertyValue(variableName).trim()\n\tif (rawValue) {\n\t\tconst resolvedRaw = resolveCssValue(rawValue, computed, nextSeen, depth + 1)\n\t\tif (resolvedRaw) return resolvedRaw\n\t}\n\n\treturn resolveFallback(fallback, computed, seen, depth)\n}\n\nexport function resolveCssValue(\n\tvalue: string,\n\tcomputed: CSSStyleDeclaration,\n\tseen: Set<string>,\n\tdepth = 0,\n): string {\n\tconst trimmed = value.trim()\n\tif (!trimmed || !trimmed.includes('var(') || depth > MAX_CSS_VAR_RESOLVE_DEPTH) {\n\t\treturn trimmed\n\t}\n\n\tlet cursor = 0\n\tlet resolved = ''\n\tlet replacedAny = false\n\n\twhile (cursor < trimmed.length) {\n\t\tconst varStart = trimmed.indexOf('var(', cursor)\n\t\tif (varStart === -1) {\n\t\t\tresolved += trimmed.slice(cursor)\n\t\t\tbreak\n\t\t}\n\n\t\tresolved += trimmed.slice(cursor, varStart)\n\n\t\tconst openParenIndex = varStart + 3\n\t\tconst closeParenIndex = findMatchingParen(trimmed, openParenIndex)\n\t\tif (closeParenIndex === -1) {\n\t\t\tresolved += trimmed.slice(varStart)\n\t\t\tbreak\n\t\t}\n\n\t\tconst rawArgs = trimmed.slice(openParenIndex + 1, closeParenIndex)\n\t\tconst [rawVariableName, rawFallback] = splitTopLevelComma(rawArgs)\n\t\tconst variableName = rawVariableName.trim()\n\t\tconst fallback = rawFallback?.trim()\n\n\t\tconst replacement = variableName\n\t\t\t? resolveCssVariable(variableName, fallback, computed, seen, depth + 1)\n\t\t\t: undefined\n\n\t\tif (replacement !== undefined) {\n\t\t\tresolved += replacement\n\t\t\treplacedAny = true\n\t\t} else {\n\t\t\tresolved += trimmed.slice(varStart, closeParenIndex + 1)\n\t\t}\n\n\t\tcursor = closeParenIndex + 1\n\t}\n\n\tconst normalized = resolved.trim()\n\tif (!replacedAny || !normalized.includes('var(')) {\n\t\treturn normalized\n\t}\n\n\treturn resolveCssValue(normalized, computed, seen, depth + 1)\n}\n","/**\n * Maximum allowed length for CSS custom property values transported to iframe.\n *\n * NOTE: This value and the blocked-token policy intentionally mirror\n * `packages/shared-types/src/schemas/embed-bridge.ts` so validation happens\n * both before transport (host) and at contract parse-time (iframe).\n *\n * CONTROL_CHAR_PATTERN here is intentionally more permissive than\n * embed-bridge.ts: it allows tabs/newlines/CR/FF because\n * normalizeCssFormattingWhitespace converts them to spaces before the\n * control-char check. The iframe-side schema (embed-bridge.ts) uses\n * the stricter pattern as defense-in-depth for values that bypass\n * host-side sanitization.\n */\nexport const MAX_CSS_VARIABLE_VALUE_LENGTH = 1024\nexport const MAX_HOST_FONT_CSS_LENGTH = 16_384\n\nconst CONTROL_CHAR_PATTERN = /[\\u0000-\\u0008\\u000b\\u000e-\\u001f\\u007f]/u\nconst FONT_RULES_PATTERN = /^(?:\\s*@font-face\\s*\\{[^{}]*\\}\\s*)+$/iu\nconst CSS_COMMENT_PATTERN = /\\/\\*[\\s\\S]*?\\*\\//g\nconst CSS_FORMATTING_WHITESPACE_PATTERN = /[\\t\\n\\r\\f]+/gu\n\n/**\n * Normalizes CSS values for dangerous-token scanning.\n * Lowercases and removes CSS comments/whitespace/control chars to catch obfuscation.\n */\nfunction normalizeForSecurityScan(value: string): string {\n\tconst withoutComments = value.replace(CSS_COMMENT_PATTERN, '')\n\treturn withoutComments.toLowerCase().replace(/[\\s\\u0000-\\u001f\\u007f]+/gu, '')\n}\n\n/**\n * Collapses CSS formatting whitespace (tabs, newlines, carriage returns, form feeds)\n * into single spaces. Applied to the output value before trimming, so multiline\n * host-provided values (e.g., font stacks) become single-line without losing\n * meaningful token boundaries. This also ensures split-token obfuscation\n * (e.g., \"java\\nscript:\") is collapsed before the security scan.\n */\nfunction normalizeCssFormattingWhitespace(value: string): string {\n\treturn value.replace(CSS_FORMATTING_WHITESPACE_PATTERN, ' ')\n}\n\n/**\n * Sanitizes host-provided CSS variable values before iframe transport.\n * Returns `undefined` for unsafe or invalid values.\n *\n * @param value - The raw CSS property value.\n * @param variableName - Optional variable name for diagnostic logging.\n */\nexport function sanitizeCssVariableValue(value: string, variableName?: string): string | undefined {\n\tconst trimmed = normalizeCssFormattingWhitespace(value).trim()\n\tif (!trimmed) return undefined\n\tif (trimmed.length > MAX_CSS_VARIABLE_VALUE_LENGTH) {\n\t\tconsole.warn(`[Char] CSS variable ${variableName ?? '(unknown)'} rejected: value exceeds max length (${trimmed.length} > ${MAX_CSS_VARIABLE_VALUE_LENGTH})`)\n\t\treturn undefined\n\t}\n\tif (CONTROL_CHAR_PATTERN.test(trimmed)) {\n\t\tconsole.warn(`[Char] CSS variable ${variableName ?? '(unknown)'} rejected: contains control characters`)\n\t\treturn undefined\n\t}\n\n\tconst normalized = normalizeForSecurityScan(trimmed)\n\tconst blockedToken = getBlockedCssVariableToken(normalized)\n\tif (blockedToken) return warnAndReject(variableName, blockedToken)\n\n\treturn trimmed\n}\n\n/**\n * Sanitizes host-provided font CSS before iframe injection.\n * Only `@font-face` rules are allowed.\n */\nexport function sanitizeHostFontCss(fontCss: string): string | undefined {\n\tconst trimmed = fontCss.trim()\n\tif (!trimmed) return undefined\n\tif (trimmed.length > MAX_HOST_FONT_CSS_LENGTH) {\n\t\tconsole.warn(`[Char] Host font CSS rejected: value exceeds max length (${trimmed.length} > ${MAX_HOST_FONT_CSS_LENGTH})`)\n\t\treturn undefined\n\t}\n\tif (CONTROL_CHAR_PATTERN.test(trimmed)) {\n\t\tconsole.warn('[Char] Host font CSS rejected: contains control characters')\n\t\treturn undefined\n\t}\n\n\tconst normalized = normalizeForSecurityScan(trimmed)\n\tconst blockedToken = getBlockedFontToken(normalized)\n\tif (blockedToken) {\n\t\tconsole.warn(`[Char] Host font CSS rejected: contains blocked token \"${blockedToken}\"`)\n\t\treturn undefined\n\t}\n\n\tconst withoutComments = trimmed.replace(/\\/\\*[\\s\\S]*?\\*\\//g, '').trim()\n\tif (!FONT_RULES_PATTERN.test(withoutComments)) {\n\t\tconsole.warn('[Char] Host font CSS rejected: only @font-face rules are allowed')\n\t\treturn undefined\n\t}\n\n\treturn trimmed\n}\n\nfunction getBlockedCssVariableToken(normalizedValue: string): string | undefined {\n\tif (normalizedValue.includes('javascript:')) return 'javascript:'\n\tif (normalizedValue.includes('vbscript:')) return 'vbscript:'\n\tif (normalizedValue.includes('expression(')) return 'expression('\n\tif (normalizedValue.includes('@import')) return '@import'\n\tif (normalizedValue.includes('-moz-binding')) return '-moz-binding'\n\tif (normalizedValue.includes('url(')) return 'url('\n\treturn undefined\n}\n\nfunction getBlockedFontToken(normalizedValue: string): string | undefined {\n\tif (normalizedValue.includes('javascript:')) return 'javascript:'\n\tif (normalizedValue.includes('vbscript:')) return 'vbscript:'\n\tif (normalizedValue.includes('expression(')) return 'expression('\n\tif (normalizedValue.includes('-moz-binding')) return '-moz-binding'\n\treturn undefined\n}\n\nfunction warnAndReject(variableName: string | undefined, blockedToken: string): undefined {\n\tconsole.warn(`[Char] CSS variable ${variableName ?? '(unknown)'} rejected: contains blocked token \"${blockedToken}\"`)\n\treturn undefined\n}\n","/**\n * Public CSS variable names for the Char widget.\n *\n * These are the external API — host pages set these to customise the widget.\n * We maintain static lists because `getComputedStyle()` cannot enumerate\n * custom properties.\n *\n * Source of truth:\n * - `src/styles/globals.css` (`--char-*`)\n * - WebMCP ext-apps UI spec (`--color-*`, `--font-*`, etc.)\n */\n\nconst CHAR_PUBLIC_VARIABLE_NAMES = [\n\t// Colors - Core\n\t'--char-color-background',\n\t'--char-color-foreground',\n\t'--char-color-card',\n\t'--char-color-card-foreground',\n\t'--char-color-popover',\n\t'--char-color-popover-foreground',\n\t'--char-color-primary',\n\t'--char-color-primary-foreground',\n\t'--char-color-secondary',\n\t'--char-color-secondary-foreground',\n\t'--char-color-muted',\n\t'--char-color-muted-foreground',\n\t'--char-color-accent',\n\t'--char-color-accent-foreground',\n\t'--char-color-destructive',\n\t'--char-color-destructive-foreground',\n\t'--char-color-border',\n\n\t// Colors - Semantic\n\t'--char-color-success',\n\t'--char-color-warning',\n\t'--char-color-error',\n\n\t// Colors - Derived\n\t'--char-color-input',\n\t'--char-color-ring',\n\n\t// Message Bubbles\n\t'--char-user-bubble-bg',\n\t'--char-user-bubble-text',\n\t'--char-assistant-bubble-bg',\n\t'--char-assistant-bubble-text',\n\n\t// Composer\n\t'--char-composer-bg',\n\t'--char-composer-border',\n\t'--char-composer-text',\n\t'--char-composer-placeholder',\n\t'--char-composer-button-bg',\n\t'--char-composer-button-text',\n\n\t// Tool Cards\n\t'--char-tool-bg',\n\t'--char-tool-border',\n\t'--char-tool-text',\n\t'--char-tool-header-bg',\n\t'--char-tool-approve-bg',\n\t'--char-tool-approve-text',\n\t'--char-tool-deny-bg',\n\t'--char-tool-deny-text',\n\n\t// Code Blocks\n\t'--char-code-bg',\n\t'--char-code-text',\n\t'--char-code-header-bg',\n\n\t// Sizing\n\t'--char-radius',\n\t'--char-radius-sm',\n\t'--char-radius-md',\n\t'--char-radius-lg',\n\t'--char-radius-xl',\n\t'--char-radius-2xl',\n\t'--char-radius-3xl',\n\t'--char-radius-full',\n\t'--char-spacing-unit',\n\n\t// Typography\n\t'--char-font-sans',\n\t'--char-font-mono',\n\t'--char-font-size-xs',\n\t'--char-font-size-sm',\n\t'--char-font-size-base',\n\t'--char-font-size-lg',\n\n\t// Motion\n\t'--char-duration-fast',\n\t'--char-duration-normal',\n\t'--char-duration-slow',\n\t'--char-easing-default',\n\t'--char-easing-spring',\n\n\t// Z-index\n\t'--char-z-base',\n\t'--char-z-content',\n\t'--char-z-overlay',\n\t'--char-z-max',\n\n\t// Shadows\n\t'--char-shadow-sm',\n\t'--char-shadow-md',\n\t'--char-shadow-lg',\n\n\t// Blur\n\t'--char-blur-sm',\n\t'--char-blur-md',\n\t'--char-blur-lg',\n] as const\n\nconst MCP_UI_STYLE_VARIABLE_NAMES = [\n\t// Background colors\n\t'--color-background-primary',\n\t'--color-background-secondary',\n\t'--color-background-tertiary',\n\t'--color-background-inverse',\n\t'--color-background-ghost',\n\t'--color-background-info',\n\t'--color-background-danger',\n\t'--color-background-success',\n\t'--color-background-warning',\n\t'--color-background-disabled',\n\n\t// Text colors\n\t'--color-text-primary',\n\t'--color-text-secondary',\n\t'--color-text-tertiary',\n\t'--color-text-inverse',\n\t'--color-text-ghost',\n\t'--color-text-info',\n\t'--color-text-danger',\n\t'--color-text-success',\n\t'--color-text-warning',\n\t'--color-text-disabled',\n\n\t// Border colors\n\t'--color-border-primary',\n\t'--color-border-secondary',\n\t'--color-border-tertiary',\n\t'--color-border-inverse',\n\t'--color-border-ghost',\n\t'--color-border-info',\n\t'--color-border-danger',\n\t'--color-border-success',\n\t'--color-border-warning',\n\t'--color-border-disabled',\n\n\t// Ring colors\n\t'--color-ring-primary',\n\t'--color-ring-secondary',\n\t'--color-ring-inverse',\n\t'--color-ring-info',\n\t'--color-ring-danger',\n\t'--color-ring-success',\n\t'--color-ring-warning',\n\n\t// Typography - Family\n\t'--font-sans',\n\t'--font-mono',\n\n\t// Typography - Weight\n\t'--font-weight-normal',\n\t'--font-weight-medium',\n\t'--font-weight-semibold',\n\t'--font-weight-bold',\n\n\t// Typography - Text Size\n\t'--font-text-xs-size',\n\t'--font-text-sm-size',\n\t'--font-text-md-size',\n\t'--font-text-lg-size',\n\n\t// Typography - Heading Size\n\t'--font-heading-xs-size',\n\t'--font-heading-sm-size',\n\t'--font-heading-md-size',\n\t'--font-heading-lg-size',\n\t'--font-heading-xl-size',\n\t'--font-heading-2xl-size',\n\t'--font-heading-3xl-size',\n\n\t// Typography - Text Line Height\n\t'--font-text-xs-line-height',\n\t'--font-text-sm-line-height',\n\t'--font-text-md-line-height',\n\t'--font-text-lg-line-height',\n\n\t// Typography - Heading Line Height\n\t'--font-heading-xs-line-height',\n\t'--font-heading-sm-line-height',\n\t'--font-heading-md-line-height',\n\t'--font-heading-lg-line-height',\n\t'--font-heading-xl-line-height',\n\t'--font-heading-2xl-line-height',\n\t'--font-heading-3xl-line-height',\n\n\t// Border radius\n\t'--border-radius-xs',\n\t'--border-radius-sm',\n\t'--border-radius-md',\n\t'--border-radius-lg',\n\t'--border-radius-xl',\n\t'--border-radius-full',\n\n\t// Border width\n\t'--border-width-regular',\n\n\t// Shadows\n\t'--shadow-hairline',\n\t'--shadow-sm',\n\t'--shadow-md',\n\t'--shadow-lg',\n] as const\n\nexport const CHAR_CSS_VARIABLE_NAMES = [\n\t...CHAR_PUBLIC_VARIABLE_NAMES,\n\t...MCP_UI_STYLE_VARIABLE_NAMES,\n] as const\n","/**\n * Host Context Merge Utilities\n *\n * Canonical merge logic for CharHostContext deltas. Used by both the host-side\n * web component and the iframe-side useHostContext hook to ensure identical\n * merge behavior on both sides of the postMessage bridge.\n */\n\nimport type { CharHostContext } from '../types'\n\nexport function mergeStyles(\n\tcurrent: CharHostContext['styles'] | undefined,\n\tpatch: CharHostContext['styles'] | undefined,\n): CharHostContext['styles'] | undefined {\n\tif (!patch) return current\n\treturn {\n\t\t...current,\n\t\t...patch,\n\t\t// variables are sent as a snapshot so removals propagate\n\t\tvariables: patch.variables ?? current?.variables,\n\t\tfonts: patch.fonts ?? current?.fonts,\n\t}\n}\n\nexport function shallowMerge<T extends object>(\n\tcurrent: T | undefined,\n\tpatch: T | undefined,\n): T | undefined {\n\tif (!patch) return current\n\treturn { ...current, ...patch }\n}\n\nexport function mergeHostContext(\n\tcurrent: CharHostContext | null,\n\tpatch: CharHostContext,\n): CharHostContext {\n\tconst previous = current ?? {}\n\treturn {\n\t\t...previous,\n\t\t...patch,\n\t\tstyles: mergeStyles(previous.styles, patch.styles),\n\t\tcontainerDimensions: shallowMerge(previous.containerDimensions, patch.containerDimensions),\n\t\tdeviceCapabilities: shallowMerge(previous.deviceCapabilities, patch.deviceCapabilities),\n\t\tsafeAreaInsets: shallowMerge(previous.safeAreaInsets, patch.safeAreaInsets),\n\t\thostCapabilities: shallowMerge(previous.hostCapabilities, patch.hostCapabilities),\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAUA,MAAa,4BAA4B;AAEzC,SAAgB,kBAAkB,OAAe,gBAAgC;CAChF,IAAI,QAAQ;AACZ,MAAK,IAAI,IAAI,iBAAiB,GAAG,IAAI,MAAM,QAAQ,KAAK;EACvD,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,IAAK,UAAS;WAClB,SAAS,IAAK,UAAS;AAChC,MAAI,UAAU,EAAG,QAAO;;AAEzB,QAAO;;AAGR,SAAgB,mBAAmB,OAA6C;CAC/E,IAAI,QAAQ;AACZ,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACtC,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,IAAK,UAAS;WAClB,SAAS,IAAK,SAAQ,KAAK,IAAI,GAAG,QAAQ,EAAE;WAC5C,SAAS,OAAO,UAAU,EAAG,QAAO,CAAC,MAAM,MAAM,GAAG,EAAE,EAAE,MAAM,MAAM,IAAI,EAAE,CAAC;;AAErF,QAAO,CAAC,OAAO,OAAU;;AAG1B,SAAgB,gBACf,UACA,UACA,MACA,OACqB;AACrB,KAAI,CAAC,SAAU,QAAO;AACtB,QAAO,gBAAgB,UAAU,UAAU,MAAM,QAAQ,EAAE,IAAI;;AAGhE,SAAgB,mBACf,cACA,UACA,UACA,MACA,OACqB;AACrB,KAAI,QAAQ,2BAA2B;AACtC,UAAQ,KAAK,sDAAsD,aAAa,iCAAiC;AACjH,SAAO,UAAU,MAAM;;AAGxB,KAAI,CAAC,aAAa,WAAW,KAAK,IAAI,KAAK,IAAI,aAAa,CAC3D,QAAO,gBAAgB,UAAU,UAAU,MAAM,MAAM;CAGxD,MAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,UAAS,IAAI,aAAa;CAE1B,MAAM,WAAW,SAAS,iBAAiB,aAAa,CAAC,MAAM;AAC/D,KAAI,UAAU;EACb,MAAM,cAAc,gBAAgB,UAAU,UAAU,UAAU,QAAQ,EAAE;AAC5E,MAAI,YAAa,QAAO;;AAGzB,QAAO,gBAAgB,UAAU,UAAU,MAAM,MAAM;;AAGxD,SAAgB,gBACf,OACA,UACA,MACA,QAAQ,GACC;CACT,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,WAAW,CAAC,QAAQ,SAAS,OAAO,IAAI,QAAQ,0BACpD,QAAO;CAGR,IAAI,SAAS;CACb,IAAI,WAAW;CACf,IAAI,cAAc;AAElB,QAAO,SAAS,QAAQ,QAAQ;EAC/B,MAAM,WAAW,QAAQ,QAAQ,QAAQ,OAAO;AAChD,MAAI,aAAa,IAAI;AACpB,eAAY,QAAQ,MAAM,OAAO;AACjC;;AAGD,cAAY,QAAQ,MAAM,QAAQ,SAAS;EAE3C,MAAM,iBAAiB,WAAW;EAClC,MAAM,kBAAkB,kBAAkB,SAAS,eAAe;AAClE,MAAI,oBAAoB,IAAI;AAC3B,eAAY,QAAQ,MAAM,SAAS;AACnC;;EAID,MAAM,CAAC,iBAAiB,eAAe,mBADvB,QAAQ,MAAM,iBAAiB,GAAG,gBAAgB,CACA;EAClE,MAAM,eAAe,gBAAgB,MAAM;EAC3C,MAAM,WAAW,aAAa,MAAM;EAEpC,MAAM,cAAc,eACjB,mBAAmB,cAAc,UAAU,UAAU,MAAM,QAAQ,EAAE,GACrE;AAEH,MAAI,gBAAgB,QAAW;AAC9B,eAAY;AACZ,iBAAc;QAEd,aAAY,QAAQ,MAAM,UAAU,kBAAkB,EAAE;AAGzD,WAAS,kBAAkB;;CAG5B,MAAM,aAAa,SAAS,MAAM;AAClC,KAAI,CAAC,eAAe,CAAC,WAAW,SAAS,OAAO,CAC/C,QAAO;AAGR,QAAO,gBAAgB,YAAY,UAAU,MAAM,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;ACjH9D,MAAa,gCAAgC;AAC7C,MAAa,2BAA2B;AAExC,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;AAC5B,MAAM,oCAAoC;;;;;AAM1C,SAAS,yBAAyB,OAAuB;AAExD,QADwB,MAAM,QAAQ,qBAAqB,GAAG,CACvC,aAAa,CAAC,QAAQ,8BAA8B,GAAG;;;;;;;;;AAU/E,SAAS,iCAAiC,OAAuB;AAChE,QAAO,MAAM,QAAQ,mCAAmC,IAAI;;;;;;;;;AAU7D,SAAgB,yBAAyB,OAAe,cAA2C;CAClG,MAAM,UAAU,iCAAiC,MAAM,CAAC,MAAM;AAC9D,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,SAAS,+BAA+B;AACnD,UAAQ,KAAK,uBAAuB,gBAAgB,YAAY,uCAAuC,QAAQ,OAAO,KAAK,8BAA8B,GAAG;AAC5J;;AAED,KAAI,qBAAqB,KAAK,QAAQ,EAAE;AACvC,UAAQ,KAAK,uBAAuB,gBAAgB,YAAY,wCAAwC;AACxG;;CAID,MAAM,eAAe,2BADF,yBAAyB,QAAQ,CACO;AAC3D,KAAI,aAAc,QAAO,cAAc,cAAc,aAAa;AAElE,QAAO;;;;;;AAOR,SAAgB,oBAAoB,SAAqC;CACxE,MAAM,UAAU,QAAQ,MAAM;AAC9B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,SAAS,0BAA0B;AAC9C,UAAQ,KAAK,4DAA4D,QAAQ,OAAO,KAAK,yBAAyB,GAAG;AACzH;;AAED,KAAI,qBAAqB,KAAK,QAAQ,EAAE;AACvC,UAAQ,KAAK,6DAA6D;AAC1E;;CAID,MAAM,eAAe,oBADF,yBAAyB,QAAQ,CACA;AACpD,KAAI,cAAc;AACjB,UAAQ,KAAK,0DAA0D,aAAa,GAAG;AACvF;;CAGD,MAAM,kBAAkB,QAAQ,QAAQ,qBAAqB,GAAG,CAAC,MAAM;AACvE,KAAI,CAAC,mBAAmB,KAAK,gBAAgB,EAAE;AAC9C,UAAQ,KAAK,mEAAmE;AAChF;;AAGD,QAAO;;AAGR,SAAS,2BAA2B,iBAA6C;AAChF,KAAI,gBAAgB,SAAS,cAAc,CAAE,QAAO;AACpD,KAAI,gBAAgB,SAAS,YAAY,CAAE,QAAO;AAClD,KAAI,gBAAgB,SAAS,cAAc,CAAE,QAAO;AACpD,KAAI,gBAAgB,SAAS,UAAU,CAAE,QAAO;AAChD,KAAI,gBAAgB,SAAS,eAAe,CAAE,QAAO;AACrD,KAAI,gBAAgB,SAAS,OAAO,CAAE,QAAO;;AAI9C,SAAS,oBAAoB,iBAA6C;AACzE,KAAI,gBAAgB,SAAS,cAAc,CAAE,QAAO;AACpD,KAAI,gBAAgB,SAAS,YAAY,CAAE,QAAO;AAClD,KAAI,gBAAgB,SAAS,cAAc,CAAE,QAAO;AACpD,KAAI,gBAAgB,SAAS,eAAe,CAAE,QAAO;;AAItD,SAAS,cAAc,cAAkC,cAAiC;AACzF,SAAQ,KAAK,uBAAuB,gBAAgB,YAAY,qCAAqC,aAAa,GAAG;;;;;;;;;;;;;;;;AC3GtH,MAAM,6BAA6B;CAElC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CAGA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CACA;CAGA;CACA;CACA;CACA;AAED,MAAM,8BAA8B;CAEnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CAGA;CAGA;CACA;CACA;CACA;CACA;AAED,MAAa,0BAA0B,CACtC,GAAG,4BACH,GAAG,4BACH;;;;AClND,SAAgB,YACf,SACA,OACwC;AACxC,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO;EACN,GAAG;EACH,GAAG;EAEH,WAAW,MAAM,aAAa,SAAS;EACvC,OAAO,MAAM,SAAS,SAAS;EAC/B;;AAGF,SAAgB,aACf,SACA,OACgB;AAChB,KAAI,CAAC,MAAO,QAAO;AACnB,QAAO;EAAE,GAAG;EAAS,GAAG;EAAO;;AAGhC,SAAgB,iBACf,SACA,OACkB;CAClB,MAAM,WAAW,WAAW,EAAE;AAC9B,QAAO;EACN,GAAG;EACH,GAAG;EACH,QAAQ,YAAY,SAAS,QAAQ,MAAM,OAAO;EAClD,qBAAqB,aAAa,SAAS,qBAAqB,MAAM,oBAAoB;EAC1F,oBAAoB,aAAa,SAAS,oBAAoB,MAAM,mBAAmB;EACvF,gBAAgB,aAAa,SAAS,gBAAgB,MAAM,eAAe;EAC3E,kBAAkB,aAAa,SAAS,kBAAkB,MAAM,iBAAiB;EACjF"}