@pie-players/pie-players-shared 0.3.69 → 0.3.70

package/dist/pie/initialize-element.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Binding a single PIE element to its model and session.
+ *
+ * Split out of `initialization.ts` so the late-arrival observer in
+ * `element-observer.ts` can reuse it without importing the bundle loaders.
+ */
+import type { ConfigEntity, Env } from "../types/index.js";
+import type { EventListeners, PieElement } from "./types.js";
+/**
+ * Bind `element` to the model in `options.config` whose `id` matches it.
+ *
+ * Returns whether the element is bound: `true` once a model has been applied
+ * (including on a repeat call for an element that is already bound), `false`
+ * when the config carries no model for this `id`. A caller holding several
+ * configs — an item player registers its item config and its passage config
+ * separately — uses that to stop at the config the element belongs to.
+ */
+export declare const initializePieElement: (element: PieElement, options: {
+    config: ConfigEntity;
+    session: any[];
+    env?: Env;
+    eventListeners?: EventListeners;
+}) => boolean;

package/dist/pie/initialize-element.js

@@ -0,0 +1,78 @@
+/**
+ * Binding a single PIE element to its model and session.
+ *
+ * Split out of `initialization.ts` so the late-arrival observer in
+ * `element-observer.ts` can reuse it without importing the bundle loaders.
+ */
+import { wrapModelRichContent } from "../security/wrap-model-rich-content.js";
+import { createPieLogger, isGlobalDebugEnabled } from "./logger.js";
+import { pieRegistry } from "./registry.js";
+import { findPieController } from "./scoring.js";
+import { BundleType } from "./types.js";
+import { findOrAddSession } from "./utils.js";
+const logger = createPieLogger("pie-initialize-element", () => isGlobalDebugEnabled());
+/**
+ * Bind `element` to the model in `options.config` whose `id` matches it.
+ *
+ * Returns whether the element is bound: `true` once a model has been applied
+ * (including on a repeat call for an element that is already bound), `false`
+ * when the config carries no model for this `id`. A caller holding several
+ * configs — an item player registers its item config and its passage config
+ * separately — uses that to stop at the config the element belongs to.
+ */
+export const initializePieElement = (element, options) => {
+    const { config, session, env, eventListeners } = options;
+    if (element.__pieInitialized) {
+        return true;
+    }
+    const tagName = element.tagName.toLowerCase();
+    logger.debug(`[initializePieElement] Initializing ${tagName}#${element.id}`);
+    // Find model for this element
+    const model = config?.models?.find((m) => m.id === element.id);
+    if (!model) {
+        // Only warn if this element is from a client-player.js bundle (where models are expected)
+        // player.js bundles use server-processed models, so missing models are expected there
+        const registry = pieRegistry();
+        const registryEntry = registry[tagName];
+        if (registryEntry && registryEntry.bundleType === BundleType.clientPlayer) {
+            logger.warn(`[initializePieElement] Model not found for PIE element ${tagName}#${element.id} (client-player.js bundle)`);
+        }
+        return false;
+    }
+    // Set session (with element property for updateSession callback)
+    const elementSession = findOrAddSession(session, model.id, model.element);
+    element.session = elementSession;
+    element.__pieInitialized = true;
+    logger.debug(`[initializePieElement] Session set for ${tagName}#${element.id}:`, elementSession);
+    // Set model - use controller if available (client-player.js), or use server-processed model (player.js)
+    const controller = findPieController(tagName);
+    if (!env) {
+        logger.error(`[initializePieElement] ❌ FATAL: No env provided for ${tagName}`);
+        throw new Error(`No env provided for ${tagName}. PIE elements require an env object with mode and role.`);
+    }
+    if (!controller) {
+        // No controller available - using server-processed model (player.js bundle)
+        logger.debug(`[initializePieElement] ℹ️ No controller for ${tagName}, using server-processed model`);
+        logger.debug(`[initializePieElement] Model already processed by server:`, {
+            id: model.id,
+            element: model.element,
+            hasCorrectResponse: "correctResponse" in model,
+            mode: env.mode,
+            role: env.role,
+        });
+        // Set model directly - server already processed it
+        element.model = wrapModelRichContent(model);
+    }
+    else {
+        // Controller available - run client-side processing (client-player.js bundle)
+        // Note: updatePieElementWithRef handles controller invocation
+        logger.debug(`[initializePieElement] Controller found for ${tagName}, will invoke model() function`);
+    }
+    // Add event listeners
+    if (eventListeners) {
+        Object.entries(eventListeners).forEach(([evt, fn]) => {
+            element.addEventListener(evt, fn);
+        });
+    }
+    return true;
+};

package/dist/pie/instrumentation-event-map.d.ts

@@ -4,4 +4,5 @@ export type InstrumentationEventMapping = {
 };
 export declare const TOOLKIT_INSTRUMENTATION_EVENT_MAP: InstrumentationEventMapping[];
 export declare const SECTION_INSTRUMENTATION_EVENT_MAP: InstrumentationEventMapping[];
+export declare const ITEM_INSTRUMENTATION_EVENT_MAP: InstrumentationEventMapping[];
 export declare const ASSESSMENT_INSTRUMENTATION_EVENT_MAP: InstrumentationEventMapping[];

package/dist/pie/instrumentation-event-map.js

@@ -67,6 +67,24 @@ export const SECTION_INSTRUMENTATION_EVENT_MAP = [
         instrumentationEventName: "pie-section-element-preload-error",
     },
 ];
+export const ITEM_INSTRUMENTATION_EVENT_MAP = [
+    // Only the security signal is mapped, deliberately. The item player's other
+    // public events (`load-complete`, `player-error`, `model-updated`,
+    // `model-loaded`, `session-changed` and the `backend-*` family) stay off the
+    // bridge because `session-changed` carries the learner's responses, and
+    // forwarding response data to a host's telemetry provider by default is the
+    // host's decision to make rather than this package's default. A host that
+    // wants them can attach its own bridge with its own map.
+    //
+    // `correct-responses-populated` firing at all is the signal: population
+    // requires a controller with `createCorrectResponseSession` in the browser,
+    // which only a `client-player.js` bundle provides, and the attributes that
+    // request it (`add-correct-response`, `env`, `mode`) are all client-mutable.
+    {
+        sourceEventName: "correct-responses-populated",
+        instrumentationEventName: "pie-item-correct-responses-populated",
+    },
+];
 export const ASSESSMENT_INSTRUMENTATION_EVENT_MAP = [
     {
         sourceEventName: "assessment-controller-ready",

package/dist/pie/math-rendering.js

@@ -72,8 +72,12 @@ export async function initializeMathRendering(customRenderer) {
     initPromise = (async () => {
         try {
             const { _dll_pie_lib__math_rendering } = await import("@pie-lib/math-rendering-module/module");
-            setWindowRenderer(_dll_pie_lib__math_rendering);
-            logger.debug("Math rendering module initialized (both globals set)");
+            // A host may install its renderer while the default module is in flight.
+            // The explicit renderer remains authoritative when that happens.
+            if (!getWindowRenderer()) {
+                setWindowRenderer(_dll_pie_lib__math_rendering);
+                logger.debug("Math rendering module initialized (both globals set)");
+            }
         }
         catch (error) {
             logger.error("Failed to initialize math rendering:", error);

package/dist/pie/types.d.ts

@@ -123,6 +123,16 @@ export interface LoadPieElementsOptions {
     bundleUrl?: string;
     eventListeners?: EventListenersMap;
     container?: Element | Document;
+    /**
+     * Deadline in ms for `loadPieModule`'s bundle `<script>` load.
+     *
+     * A stalled request fires neither `load` nor `error`, so without a
+     * deadline the returned promise never settles. Named and defaulted to
+     * match `EnsureRegisteredOptions.loadTimeoutMs` on the `ElementLoader`
+     * primitive, so both bundle-loading paths give a host one budget to
+     * reason about. `0` or negative disables the deadline.
+     */
+    loadTimeoutMs?: number;
 }
 /**
  * Type guard: Check if object has window.pie

package/dist/pie/utils.d.ts

@@ -5,6 +5,33 @@
  */
 import type { ConfigEntity } from "../types/index.js";
 import type { LoadPieElementsOptions } from "./types.js";
+/**
+ * Percent-encode one element package spec for a build-service bundle path.
+ *
+ * `config.elements` is authored content, so a spec must not be able to
+ * restructure the URL. Escaping everything outside
+ * {@link BUNDLE_PATH_LITERAL_CHARS} is what stops it: `#` no longer truncates
+ * the path at a fragment, `?` no longer turns the remainder into a query
+ * string (which in `buildBundleUrl` also swallowed the real `?elements=`
+ * parameter), `\` is no longer normalized to `/` by the URL parser, `%` can
+ * no longer smuggle an escape the build service decodes back into a
+ * separator, and an in-spec `+` becomes `%2B` instead of a phantom package
+ * boundary.
+ *
+ * Both blanket encoders are wrong here, so do not "simplify" to either.
+ * `encodeURI` — what this replaced — leaves `/`, `?`, `#` and `%` alone.
+ * `encodeURIComponent` escapes `/` and `@`, which this route needs literal;
+ * it is correct for the `elements=` query value, which is why both encoders
+ * appear in `buildBundleUrl`.
+ */
+export declare const encodeElementPackageSpec: (spec: string) => string;
+/**
+ * Encode each element package spec and join them with the literal `+` the
+ * legacy IIFE bundle route uses as its package separator. Encoding the joined
+ * string instead would escape the separator. That same separator is why
+ * `element-package-policy` rejects semver build metadata.
+ */
+export declare const encodeElementPackageSpecs: (specs: Iterable<string>) => string;
 /**
  * Build URL for fetching PIE element bundles from build service
  */

package/dist/pie/utils.js

@@ -3,12 +3,67 @@
  *
  * URL building, package name parsing, and session utilities.
  */
+/**
+ * Characters an element package spec may carry into a bundle path unescaped.
+ *
+ * `@` and `/` are in the set because the build service route is
+ * `<host>/<spec>+<spec>.../<bundleType>`, and a scoped spec
+ * (`@pie-element/multiple-choice@9.9.1`) spans path segments inside it —
+ * escaping either yields a path the service does not match. The rest is the
+ * RFC 3986 unreserved set, which covers every npm package name and every
+ * semver version. The `u` flag makes a surrogate pair match as one code
+ * point, so an astral character encodes as a whole character.
+ */
+const BUNDLE_PATH_LITERAL_CHARS = /[^A-Za-z0-9\-._~@/]/gu;
+/** Path segments the URL parser resolves away before a request is sent. */
+const DOT_SEGMENTS = new Set([".", ".."]);
+/**
+ * Percent-encode one element package spec for a build-service bundle path.
+ *
+ * `config.elements` is authored content, so a spec must not be able to
+ * restructure the URL. Escaping everything outside
+ * {@link BUNDLE_PATH_LITERAL_CHARS} is what stops it: `#` no longer truncates
+ * the path at a fragment, `?` no longer turns the remainder into a query
+ * string (which in `buildBundleUrl` also swallowed the real `?elements=`
+ * parameter), `\` is no longer normalized to `/` by the URL parser, `%` can
+ * no longer smuggle an escape the build service decodes back into a
+ * separator, and an in-spec `+` becomes `%2B` instead of a phantom package
+ * boundary.
+ *
+ * Both blanket encoders are wrong here, so do not "simplify" to either.
+ * `encodeURI` — what this replaced — leaves `/`, `?`, `#` and `%` alone.
+ * `encodeURIComponent` escapes `/` and `@`, which this route needs literal;
+ * it is correct for the `elements=` query value, which is why both encoders
+ * appear in `buildBundleUrl`.
+ */
+export const encodeElementPackageSpec = (spec) => {
+    const escaped = spec.replace(BUNDLE_PATH_LITERAL_CHARS, (char) => encodeURIComponent(char));
+    const segments = escaped.split("/");
+    // A literal `/` next to a `.` or `..` segment is the one remaining way
+    // authored content rewrites the path: the URL parser resolves dot segments
+    // before the request is sent, so `@pie-element/../../x` would leave the
+    // bundles route. Percent-encoding the dots does not help — the parser
+    // recognizes `%2e` as a dot segment as well. Escaping every `/` in such a
+    // spec collapses it into one inert segment that 404s inside the route. No
+    // npm package name or subpath is `.` or `..`, so nothing legitimate takes
+    // this branch.
+    return segments.some((segment) => DOT_SEGMENTS.has(segment))
+        ? segments.join("%2F")
+        : escaped;
+};
+/**
+ * Encode each element package spec and join them with the literal `+` the
+ * legacy IIFE bundle route uses as its package separator. Encoding the joined
+ * string instead would escape the separator. That same separator is why
+ * `element-package-policy` rejects semver build metadata.
+ */
+export const encodeElementPackageSpecs = (specs) => Array.from(specs, encodeElementPackageSpec).join("+");
 /**
  * Build URL for fetching PIE element bundles from build service
  */
 export const getPieElementBundlesUrl = (config, opts) => {
     const elements = config.elements;
-    return `${opts.buildServiceBase}/${encodeURI(Object.values(elements).join("+"))}/${opts.bundleType}`;
+    return `${opts.buildServiceBase}/${encodeElementPackageSpecs(Object.values(elements))}/${opts.bundleType}`;
 };
 /**
  * Parse a package name string into its components

package/dist/security/index.d.ts

@@ -1,6 +1,7 @@
 export { buildAuthoringAllowList, createDefaultItemMarkupSanitizer, resetPurifierForTesting, sanitizeItemMarkup, type ItemMarkupSanitizer, type SanitizeItemMarkupOptions, } from "./sanitize-item-markup.js";
 export { parseAllowedStyleOrigins, validateExternalStyleUrl, type StyleUrlValidationError, type StyleUrlValidationOk, type StyleUrlValidationOptions, type StyleUrlValidationResult, } from "./validate-style-url.js";
 export { resetSvgSanitizerForTesting, sanitizeSvgIcon, } from "./sanitize-svg-icon.js";
-export { wrapOverwideImages, wrapOverwideImagesInElement, } from "./wrap-overwide-images.js";
+export { sanitizeStyleAttribute } from "./sanitize-style-attribute.js";
+export { isOverwideImageWrapMutation, wrapOverwideImages, wrapOverwideImagesInElement, } from "./wrap-overwide-images.js";
 export { wrapModelRichContent } from "./wrap-model-rich-content.js";
-export { wrapOverwideTables, wrapOverwideTablesInElement, } from "./wrap-overwide-tables.js";
+export { isOverwideTableWrapMutation, wrapOverwideTables, wrapOverwideTablesInElement, } from "./wrap-overwide-tables.js";

package/dist/security/index.js

@@ -1,6 +1,7 @@
 export { buildAuthoringAllowList, createDefaultItemMarkupSanitizer, resetPurifierForTesting, sanitizeItemMarkup, } from "./sanitize-item-markup.js";
 export { parseAllowedStyleOrigins, validateExternalStyleUrl, } from "./validate-style-url.js";
 export { resetSvgSanitizerForTesting, sanitizeSvgIcon, } from "./sanitize-svg-icon.js";
-export { wrapOverwideImages, wrapOverwideImagesInElement, } from "./wrap-overwide-images.js";
+export { sanitizeStyleAttribute } from "./sanitize-style-attribute.js";
+export { isOverwideImageWrapMutation, wrapOverwideImages, wrapOverwideImagesInElement, } from "./wrap-overwide-images.js";
 export { wrapModelRichContent } from "./wrap-model-rich-content.js";
-export { wrapOverwideTables, wrapOverwideTablesInElement, } from "./wrap-overwide-tables.js";
+export { isOverwideTableWrapMutation, wrapOverwideTables, wrapOverwideTablesInElement, } from "./wrap-overwide-tables.js";

package/dist/security/sanitize-forbidden-lists.js

@@ -13,6 +13,15 @@ export const SANITIZER_FORBIDDEN_TAGS = [
     "form",
     "meta",
     "link",
+    // A <style> element is a document-global stylesheet. The item player renders
+    // in light DOM (`shadow: "none"`), so a <style> in authored markup restyles
+    // host chrome outside the item. DOMPurify's defaults already drop a
+    // top-level HTML <style>; the SVG profile keeps one, whose rules apply
+    // document-wide all the same — verified in Chromium 2026-08-30, where
+    // `<svg><style>` passed this list and hid an element outside the player.
+    // `style` is in DOMPurify's default FORBID_CONTENTS, so the CSS text is
+    // dropped with the tag rather than surfacing as item text.
+    "style",
     // <foreignObject> inside an <svg> is a well-known escape hatch back into
     // HTML context.
     "foreignobject",

package/dist/security/sanitize-item-markup.js

@@ -9,6 +9,7 @@
  */
 import DOMPurify from "dompurify";
 import { SANITIZER_FORBIDDEN_ATTRS, SANITIZER_FORBIDDEN_TAGS, } from "./sanitize-forbidden-lists.js";
+import { installStyleAttributeHook } from "./sanitize-style-attribute.js";
 import { wrapOverwideImages } from "./wrap-overwide-images.js";
 import { wrapOverwideTables } from "./wrap-overwide-tables.js";
 // Attributes every PIE element / wrapper is allowed to carry.
@@ -53,6 +54,9 @@ function resolvePurifier() {
         typeof factory === "function"
             ? factory(window)
             : DOMPurify;
+    // `style` is URI-safe to DOMPurify, so nothing inside it is inspected
+    // without this. See sanitize-style-attribute.ts.
+    installStyleAttributeHook(purifierInstance);
     return purifierInstance;
 }
 /**

package/dist/security/sanitize-style-attribute.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Declaration-level filter for the `style` attribute on authored markup and
+ * tool icons.
+ *
+ * DOMPurify lists `style` among its URI-safe attributes, so it permits the
+ * attribute and inspects nothing inside it. Two things in an inline style
+ * therefore reach the page unchecked: a URL-fetching function, which makes the
+ * browser request an arbitrary origin every time the item renders and reports
+ * back which learner saw which item, and `position: fixed`, which leaves the
+ * item's box and covers the host page — the item player renders in light DOM
+ * (`shadow: "none"`), so nothing else confines it.
+ *
+ * What stays permitted is the point of filtering declarations rather than
+ * dropping the attribute: authored items use inline styles for ordinary
+ * per-element presentation, and `position: absolute` in particular is
+ * load-bearing for accessibility — MathJax's `mjx-assistive-mml` carries
+ * `position: absolute; width: 1px; height: 1px; overflow: hidden` to expose
+ * MathML to a screen reader while hiding it visually.
+ *
+ * `position: absolute` and `position: sticky` are deliberately left alone.
+ * Sticky cannot leave its containing block, so it is not an escape. Absolute
+ * can, when no ancestor between the node and the viewport is positioned, and
+ * closing that means making the player's own container a containing block
+ * rather than filtering the declaration — a change that re-anchors every
+ * absolutely positioned node a PIE element renders, so it is a separate
+ * decision with its own visual review.
+ */
+/**
+ * Filter one `style` attribute value.
+ *
+ * Returns the input unchanged when nothing needs removing, so authored markup
+ * keeps its own spelling — shorthands stay shorthands — in every case but the
+ * one that carries something forbidden.
+ */
+export declare function sanitizeStyleAttribute(value: unknown, doc: Document | null | undefined): string;
+/** The subset of a DOMPurify instance this hook needs. */
+export interface StyleAttributeHookTarget {
+    addHook?: (entryPoint: string, hook: (node: unknown, data?: unknown) => void) => void;
+}
+/**
+ * Install the filter on a DOMPurify instance.
+ *
+ * `afterSanitizeAttributes` rather than a post-pass over the output string:
+ * DOMPurify has already parsed the markup at that point, so the declarations
+ * are filtered on the node it is about to serialize instead of costing another
+ * DOM round-trip.
+ */
+export declare function installStyleAttributeHook(purifier: StyleAttributeHookTarget): void;

package/dist/security/sanitize-style-attribute.js

@@ -0,0 +1,129 @@
+/**
+ * Declaration-level filter for the `style` attribute on authored markup and
+ * tool icons.
+ *
+ * DOMPurify lists `style` among its URI-safe attributes, so it permits the
+ * attribute and inspects nothing inside it. Two things in an inline style
+ * therefore reach the page unchecked: a URL-fetching function, which makes the
+ * browser request an arbitrary origin every time the item renders and reports
+ * back which learner saw which item, and `position: fixed`, which leaves the
+ * item's box and covers the host page — the item player renders in light DOM
+ * (`shadow: "none"`), so nothing else confines it.
+ *
+ * What stays permitted is the point of filtering declarations rather than
+ * dropping the attribute: authored items use inline styles for ordinary
+ * per-element presentation, and `position: absolute` in particular is
+ * load-bearing for accessibility — MathJax's `mjx-assistive-mml` carries
+ * `position: absolute; width: 1px; height: 1px; overflow: hidden` to expose
+ * MathML to a screen reader while hiding it visually.
+ *
+ * `position: absolute` and `position: sticky` are deliberately left alone.
+ * Sticky cannot leave its containing block, so it is not an escape. Absolute
+ * can, when no ancestor between the node and the viewport is positioned, and
+ * closing that means making the player's own container a containing block
+ * rather than filtering the declaration — a change that re-anchors every
+ * absolutely positioned node a PIE element renders, so it is a separate
+ * decision with its own visual review.
+ */
+/**
+ * CSS functions that make the browser fetch a URL. Serialized CSSOM values are
+ * matched against this, so an escaped spelling (`\75 rl(`) is normalized to
+ * `url(` before it gets here.
+ */
+const URL_FUNCTION_REGEX = /(?:^|[^\w-])(?:url|image-set|-webkit-image-set|src)\s*\(/i;
+/**
+ * Cheap gate on the raw attribute so the common case costs one regex and no
+ * CSSOM parse. `position` is included because that check needs the parser, and
+ * a backslash because it introduces a CSS escape, which is exactly how a
+ * forbidden token hides from a raw-string match.
+ */
+const NEEDS_INSPECTION_REGEX = /url\s*\(|image-set\s*\(|src\s*\(|position|\\/i;
+function isForbiddenDeclaration(property, value) {
+    if (URL_FUNCTION_REGEX.test(value))
+        return true;
+    // `position` is a shorthand for nothing, so the CSSOM reports it verbatim.
+    return property.toLowerCase() === "position" && /\bfixed\b/i.test(value);
+}
+/**
+ * Rebuild the attribute from the parsed declarations, dropping the forbidden
+ * ones. Anything the engine failed to parse is dropped with them: an unparsed
+ * declaration cannot be inspected, and this path only runs on input that
+ * already tripped the gate.
+ */
+function rebuildFromCssom(value, doc) {
+    const probe = doc.createElement("span");
+    probe.setAttribute("style", value);
+    const declarations = probe.style;
+    const kept = [];
+    for (let index = 0; index < declarations.length; index += 1) {
+        const property = declarations.item(index);
+        if (!property)
+            continue;
+        const propertyValue = declarations.getPropertyValue(property);
+        if (isForbiddenDeclaration(property, propertyValue))
+            continue;
+        const priority = declarations.getPropertyPriority(property);
+        kept.push(`${property}: ${propertyValue}${priority ? ` !${priority}` : ""}`);
+    }
+    return kept.join("; ");
+}
+/**
+ * Filter one `style` attribute value.
+ *
+ * Returns the input unchanged when nothing needs removing, so authored markup
+ * keeps its own spelling — shorthands stay shorthands — in every case but the
+ * one that carries something forbidden.
+ */
+export function sanitizeStyleAttribute(value, doc) {
+    if (typeof value !== "string" || value.length === 0)
+        return "";
+    if (!doc)
+        return value;
+    if (!NEEDS_INSPECTION_REGEX.test(value))
+        return value;
+    const probe = doc.createElement("span");
+    probe.setAttribute("style", value);
+    const declarations = probe.style;
+    let hasForbidden = false;
+    for (let index = 0; index < declarations.length; index += 1) {
+        const property = declarations.item(index);
+        if (!property)
+            continue;
+        if (isForbiddenDeclaration(property, declarations.getPropertyValue(property))) {
+            hasForbidden = true;
+            break;
+        }
+    }
+    // A raw value carrying a URL function the engine did not parse into a
+    // declaration still goes through the rebuild, which drops it.
+    if (!hasForbidden && !URL_FUNCTION_REGEX.test(value))
+        return value;
+    return rebuildFromCssom(value, doc);
+}
+/**
+ * Install the filter on a DOMPurify instance.
+ *
+ * `afterSanitizeAttributes` rather than a post-pass over the output string:
+ * DOMPurify has already parsed the markup at that point, so the declarations
+ * are filtered on the node it is about to serialize instead of costing another
+ * DOM round-trip.
+ */
+export function installStyleAttributeHook(purifier) {
+    if (typeof purifier.addHook !== "function")
+        return;
+    purifier.addHook("afterSanitizeAttributes", (node) => {
+        const element = node;
+        if (!element || typeof element.getAttribute !== "function")
+            return;
+        const raw = element.getAttribute("style");
+        if (!raw)
+            return;
+        const filtered = sanitizeStyleAttribute(raw, element.ownerDocument);
+        if (filtered === raw)
+            return;
+        if (filtered)
+            element.setAttribute("style", filtered);
+        else
+            element.removeAttribute("style");
+    });
+}

package/dist/security/sanitize-svg-icon.js

@@ -11,6 +11,7 @@
  */
 import DOMPurify from "dompurify";
 import { SANITIZER_FORBIDDEN_ATTRS, SANITIZER_FORBIDDEN_TAGS, } from "./sanitize-forbidden-lists.js";
+import { installStyleAttributeHook } from "./sanitize-style-attribute.js";
 let svgPurifierInstance = null;
 function resolveSvgPurifier() {
     if (svgPurifierInstance)
@@ -22,6 +23,7 @@ function resolveSvgPurifier() {
         typeof factory === "function"
             ? factory(window)
             : DOMPurify;
+    installStyleAttributeHook(svgPurifierInstance);
     return svgPurifierInstance;
 }
 const FORBIDDEN_TAGS = SANITIZER_FORBIDDEN_TAGS;

package/dist/security/validate-style-url.d.ts

@@ -8,6 +8,13 @@
  * - When `allowedOrigins` is non-empty, the URL's origin must match one
  *   of the listed origins. This lets hosts restrict style loading to a
  *   known CDN allow-list.
+ * - With no allow-list configured, only same-origin URLs pass. The reachable
+ *   input here is authored — `itemConfig.resources.stylesheets[*].url` — so an
+ *   open default let an item pull page-wide CSS from any origin it named, and
+ *   the cross-origin branch in the player is the one that cannot be scoped
+ *   (CSS the browser applies from a `<link>` rather than text the player
+ *   fetched and rewrote). Naming an origin in `allowed-style-origins` is a
+ *   host's opt-in to that.
  */
 export type StyleUrlValidationOk = {
     ok: true;
@@ -20,6 +27,12 @@ export type StyleUrlValidationError = {
 };
 export type StyleUrlValidationResult = StyleUrlValidationOk | StyleUrlValidationError;
 export interface StyleUrlValidationOptions {
+    /**
+     * Document URL the stylesheet URL resolves against, and the origin a URL is
+     * compared to when no `allowedOrigins` are configured. Omitting it while
+     * supplying no allow-list leaves no origin to compare against, so
+     * cross-origin cannot be ruled out and the URL is rejected.
+     */
     baseUrl?: string;
     allowedOrigins?: string[];
 }

package/dist/security/validate-style-url.js

@@ -8,6 +8,13 @@
  * - When `allowedOrigins` is non-empty, the URL's origin must match one
  *   of the listed origins. This lets hosts restrict style loading to a
  *   known CDN allow-list.
+ * - With no allow-list configured, only same-origin URLs pass. The reachable
+ *   input here is authored — `itemConfig.resources.stylesheets[*].url` — so an
+ *   open default let an item pull page-wide CSS from any origin it named, and
+ *   the cross-origin branch in the player is the one that cannot be scoped
+ *   (CSS the browser applies from a `<link>` rather than text the player
+ *   fetched and rewrote). Naming an origin in `allowed-style-origins` is a
+ *   host's opt-in to that.
  */
 export function validateExternalStyleUrl(url, options = {}) {
     if (typeof url !== "string" || url.length === 0) {
@@ -38,11 +45,38 @@ export function validateExternalStyleUrl(url, options = {}) {
         };
     }
     const allowed = options.allowedOrigins ?? [];
-    if (allowed.length > 0 && !allowed.includes(resolvedUrl.origin)) {
+    if (allowed.length > 0) {
+        if (!allowed.includes(resolvedUrl.origin)) {
+            return {
+                ok: false,
+                reason: "disallowed-origin",
+                message: `External stylesheet origin ${resolvedUrl.origin} is not in the configured allow-list.`,
+            };
+        }
+        return { ok: true, resolvedUrl };
+    }
+    // No allow-list: same-origin only.
+    let baseOrigin = null;
+    if (options.baseUrl) {
+        try {
+            baseOrigin = new URL(options.baseUrl).origin;
+        }
+        catch {
+            baseOrigin = null;
+        }
+    }
+    if (baseOrigin === null) {
+        return {
+            ok: false,
+            reason: "disallowed-origin",
+            message: "External stylesheet origin cannot be checked: no allow-list is configured and no usable baseUrl was supplied. Pass allowedOrigins to permit a cross-origin stylesheet.",
+        };
+    }
+    if (resolvedUrl.origin !== baseOrigin) {
         return {
             ok: false,
             reason: "disallowed-origin",
-            message: `External stylesheet origin ${resolvedUrl.origin} is not in the configured allow-list.`,
+            message: `External stylesheet origin ${resolvedUrl.origin} is cross-origin and no allow-list is configured. Add it to \`allowed-style-origins\` to permit it.`,
         };
     }
     return { ok: true, resolvedUrl };

package/dist/security/wrap-overwide-images.d.ts

@@ -49,3 +49,10 @@ export declare function wrapOverwideImagesInElement(root: Element, options?: Wra
  *   to wrap element-rendered images.
  */
 export declare function wrapOverwideImages(markup: string): string;
+/**
+ * True when `record` mentions nothing but the output of
+ * {@link wrapOverwideImagesInElement} — a `pie-image-scroll` wrapper, or an
+ * `<img>` moving inside one. An observer-driven caller ignores such a record so
+ * its own wrap does not schedule a second pass.
+ */
+export declare function isOverwideImageWrapMutation(record: MutationRecord): boolean;

package/dist/security/wrap-overwide-images.js

@@ -26,7 +26,7 @@
  * The wrapping itself lives in `./wrap-overwide.js`, shared with the table
  * wrapper: only the four values below and the accessible name differ.
  */
-import { wrapOverwideInElement, wrapOverwideMarkup, } from "./wrap-overwide.js";
+import { isOverwideWrapMutation, wrapOverwideInElement, wrapOverwideMarkup, } from "./wrap-overwide.js";
 function buildAriaLabel(image) {
     const alt = image.getAttribute("alt");
     const trimmed = alt ? alt.trim() : "";
@@ -64,3 +64,12 @@ export function wrapOverwideImagesInElement(root, options = {}) {
 export function wrapOverwideImages(markup) {
     return wrapOverwideMarkup(markup, IMAGE_SPEC);
 }
+/**
+ * True when `record` mentions nothing but the output of
+ * {@link wrapOverwideImagesInElement} — a `pie-image-scroll` wrapper, or an
+ * `<img>` moving inside one. An observer-driven caller ignores such a record so
+ * its own wrap does not schedule a second pass.
+ */
+export function isOverwideImageWrapMutation(record) {
+    return isOverwideWrapMutation(record, IMAGE_SPEC);
+}

package/dist/security/wrap-overwide-tables.d.ts

@@ -35,3 +35,10 @@ export type WrapOverwideTablesInElementOptions = WrapOverwideOptions;
  */
 export declare function wrapOverwideTablesInElement(root: Element, options?: WrapOverwideTablesInElementOptions): number;
 export declare function wrapOverwideTables(markup: string): string;
+/**
+ * True when `record` mentions nothing but the output of
+ * {@link wrapOverwideTablesInElement} — a `pie-table-scroll` wrapper, or a
+ * `<table>` moving inside one. An observer-driven caller ignores such a record
+ * so its own wrap does not schedule a second pass.
+ */
+export declare function isOverwideTableWrapMutation(record: MutationRecord): boolean;