@render-policy/core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 render-policy contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,23 @@
+# @render-policy/core
+
+Render Markdown or HTML that an agent wrote without ever assigning `innerHTML`: sanitize into a
+`DocumentFragment`, apply a policy for images, links and hosts, insert with `replaceChildren()`.
+Trusted Types compatible. Streaming aware.
+
+```ts
+import { createRenderer } from '@render-policy/core';
+
+const renderer = createRenderer({ mode: 'balanced', policy: { images: { hosts: ['cdn.example.com'] } } });
+renderer.renderMarkdownInto(element, message.content);
+
+const stream = renderer.createStream(element);
+stream.push(chunk);
+stream.end();
+```
+
+`createContentBinding(renderer, element, { mode, schedule, onDecisions })` is the lifecycle a framework
+adapter needs (`update(content, streaming)`); the building blocks the renderer is made of are in
+`@render-policy/core/internal`, outside semver.
+
+Full documentation, modes, policy reference and threat model: the
+[repository README](https://github.com/shteynu/render-policy#readme).

package/dist/binding.d.ts

@@ -0,0 +1,28 @@
+import type { RenderDecision } from './decisions.js';
+import type { Renderer, RenderTarget } from './render.js';
+import type { Scheduler, StreamOptions } from './stream.js';
+export interface ContentBindingOptions {
+    /** Interpret the content as Markdown (default) or HTML. */
+    readonly mode?: 'markdown' | 'html';
+    /** Coalesces streaming renders, for example `frameScheduler(window)`. Default: render on every update. */
+    readonly schedule?: Scheduler;
+    /** Stream behaviour while streaming (withheld URLs, fence closing, tail patching). */
+    readonly stream?: Pick<StreamOptions, 'holdIncompleteUrls' | 'closeFences' | 'patch'>;
+    /** Receives the decision journal of every one-shot render and of the final render of a stream. */
+    readonly onDecisions?: (decisions: readonly RenderDecision[]) => void;
+}
+/**
+ * One piece of agent content bound to one target: the lifecycle every framework adapter
+ * needs, written once. `update(content, streaming)` starts a stream on the first streaming
+ * update, feeds it while streaming stays true, ends it with a final render when streaming
+ * turns false, and otherwise renders in one shot.
+ */
+export interface ContentBinding {
+    update(content: string, streaming?: boolean): void;
+    /** True while a stream is open. */
+    readonly streaming: boolean;
+    /** Forget the open stream, if any. The target is left as it is. */
+    dispose(): void;
+}
+export declare function createContentBinding(renderer: Renderer, target: RenderTarget, options?: ContentBindingOptions): ContentBinding;
+//# sourceMappingURL=binding.d.ts.map

package/dist/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAgB,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACpC,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,oBAAoB,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;IACtF,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;CACvE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACnD,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAgClI"}

package/dist/binding.js

@@ -0,0 +1,32 @@
+export function createContentBinding(renderer, target, options = {}) {
+    const mode = options.mode ?? 'markdown';
+    let stream = null;
+    const report = (decisions) => {
+        options.onDecisions?.(decisions);
+    };
+    return {
+        update(content, streaming = false) {
+            if (streaming) {
+                stream ??= renderer.createStream(target, { ...options.stream, mode, schedule: options.schedule });
+                stream.set(content);
+                return;
+            }
+            if (stream) {
+                const open = stream;
+                stream = null;
+                open.set(content);
+                report(open.end().decisions);
+                return;
+            }
+            const result = mode === 'html' ? renderer.renderHtmlInto(target, content) : renderer.renderMarkdownInto(target, content);
+            report(result.decisions);
+        },
+        get streaming() {
+            return stream !== null;
+        },
+        dispose() {
+            stream = null;
+        },
+    };
+}
+//# sourceMappingURL=binding.js.map

package/dist/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,MAAoB,EAAE,OAAO,GAA0B,EAAE;IAChH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC;IACxC,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,MAAM,MAAM,GAAG,CAAC,SAAoC,EAAQ,EAAE;QAC5D,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,OAAO,EAAE,SAAS,GAAG,KAAK;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAClG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QACD,OAAO;YACL,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/data/sink-domains.d.ts

@@ -0,0 +1,14 @@
+import type { SinkDenylist } from '../sinks.js';
+/**
+ * Hosts that exist to receive whatever is sent to them. An agent that was
+ * prompt-injected does not need a server of its own: an image pointing at a
+ * request catcher, a tunnel or a public bucket is enough to carry the
+ * conversation out.
+ *
+ * This file is data, not code. It is versioned separately from the library
+ * and can be replaced at runtime through `createRenderer({ sinkDenylist })`.
+ * It is a starting set, not an exhaustive one: pair it with an image host
+ * allowlist and a CSP `img-src`.
+ */
+export declare const SINK_DENYLIST: SinkDenylist;
+//# sourceMappingURL=sink-domains.d.ts.map

package/dist/data/sink-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-domains.d.ts","sourceRoot":"","sources":["../../src/data/sink-domains.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,EAAE,YAmF1B,CAAC"}

package/dist/data/sink-domains.js

@@ -0,0 +1,91 @@
+/**
+ * Hosts that exist to receive whatever is sent to them. An agent that was
+ * prompt-injected does not need a server of its own: an image pointing at a
+ * request catcher, a tunnel or a public bucket is enough to carry the
+ * conversation out.
+ *
+ * This file is data, not code. It is versioned separately from the library
+ * and can be replaced at runtime through `createRenderer({ sinkDenylist })`.
+ * It is a starting set, not an exhaustive one: pair it with an image host
+ * allowlist and a CSP `img-src`.
+ */
+export const SINK_DENYLIST = Object.freeze({
+    version: '2026-09-30',
+    entries: Object.freeze([
+        // Out-of-band interaction services used to prove exfiltration.
+        { pattern: 'interact.sh', category: 'oast' },
+        { pattern: 'oast.fun', category: 'oast' },
+        { pattern: 'oast.live', category: 'oast' },
+        { pattern: 'oast.me', category: 'oast' },
+        { pattern: 'oast.online', category: 'oast' },
+        { pattern: 'oast.pro', category: 'oast' },
+        { pattern: 'oast.site', category: 'oast' },
+        { pattern: 'burpcollaborator.net', category: 'oast' },
+        { pattern: 'oastify.com', category: 'oast' },
+        { pattern: 'canarytokens.com', category: 'oast' },
+        { pattern: 'dnslog.cn', category: 'oast' },
+        { pattern: 'ceye.io', category: 'oast' },
+        // Request catchers and inbound webhooks.
+        { pattern: 'webhook.site', category: 'webhook' },
+        { pattern: 'requestbin.com', category: 'webhook' },
+        { pattern: 'requestbin.net', category: 'webhook' },
+        { pattern: 'pipedream.net', category: 'webhook' },
+        { pattern: 'requestcatcher.com', category: 'webhook' },
+        { pattern: 'hookbin.com', category: 'webhook' },
+        { pattern: 'postb.in', category: 'webhook' },
+        { pattern: 'beeceptor.com', category: 'webhook' },
+        { pattern: 'mockbin.org', category: 'webhook' },
+        { pattern: 'ptsv2.com', category: 'webhook' },
+        { pattern: 'ptsv3.com', category: 'webhook' },
+        { pattern: 'hooks.slack.com', category: 'webhook' },
+        { pattern: 'hooks.zapier.com', category: 'webhook' },
+        { pattern: 'maker.ifttt.com', category: 'webhook' },
+        { pattern: 'discord.com/api/webhooks', category: 'webhook' },
+        { pattern: 'discordapp.com/api/webhooks', category: 'webhook' },
+        // Tunnels that expose a laptop to the internet.
+        { pattern: 'ngrok.io', category: 'tunnel' },
+        { pattern: 'ngrok.app', category: 'tunnel' },
+        { pattern: 'ngrok-free.app', category: 'tunnel' },
+        { pattern: 'ngrok.dev', category: 'tunnel' },
+        { pattern: 'loca.lt', category: 'tunnel' },
+        { pattern: 'serveo.net', category: 'tunnel' },
+        { pattern: 'trycloudflare.com', category: 'tunnel' },
+        { pattern: 'localhost.run', category: 'tunnel' },
+        { pattern: 'lhr.life', category: 'tunnel' },
+        // Anonymous serverless endpoints.
+        { pattern: 'workers.dev', category: 'serverless' },
+        { pattern: 'val.run', category: 'serverless' },
+        { pattern: 'deno.dev', category: 'serverless' },
+        { pattern: 'repl.co', category: 'serverless' },
+        { pattern: 'replit.app', category: 'serverless' },
+        { pattern: 'replit.dev', category: 'serverless' },
+        // Forms: the agent asks the user to "confirm" something on a page the attacker owns.
+        { pattern: 'forms.gle', category: 'forms' },
+        { pattern: 'docs.google.com/forms', category: 'forms' },
+        { pattern: 'forms.office.com', category: 'forms' },
+        { pattern: 'forms.microsoft.com', category: 'forms' },
+        { pattern: 'typeform.com', category: 'forms' },
+        { pattern: 'jotform.com', category: 'forms' },
+        { pattern: 'tally.so', category: 'forms' },
+        { pattern: 'surveymonkey.com', category: 'forms' },
+        { pattern: 'formspree.io', category: 'forms' },
+        { pattern: 'getform.io', category: 'forms' },
+        { pattern: 'formsubmit.co', category: 'forms' },
+        { pattern: 'formcarry.com', category: 'forms' },
+        // Public object storage with anonymous write or logging.
+        { pattern: 'blob.core.windows.net', category: 'blob-storage' },
+        { pattern: 's3.amazonaws.com', category: 'blob-storage' },
+        { pattern: 'storage.googleapis.com', category: 'blob-storage' },
+        { pattern: 'r2.dev', category: 'blob-storage' },
+        { pattern: 'digitaloceanspaces.com', category: 'blob-storage' },
+        { pattern: 'backblazeb2.com', category: 'blob-storage' },
+        { pattern: 'wasabisys.com', category: 'blob-storage' },
+        { pattern: 'file.io', category: 'blob-storage' },
+        { pattern: 'transfer.sh', category: 'blob-storage' },
+        { pattern: '0x0.st', category: 'blob-storage' },
+        { pattern: 'catbox.moe', category: 'blob-storage' },
+        { pattern: 'tmpfiles.org', category: 'blob-storage' },
+        { pattern: 'gofile.io', category: 'blob-storage' },
+    ]),
+});
+//# sourceMappingURL=sink-domains.js.map

package/dist/data/sink-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-domains.js","sourceRoot":"","sources":["../../src/data/sink-domains.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB,MAAM,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAuB;QAC3C,+DAA+D;QAC/D,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC5C,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC1C,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;QACxC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC5C,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC1C,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE;QACrD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC5C,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE;QACjD,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC1C,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;QAExC,yCAAyC;QACzC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE;QAChD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAClD,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;QACjD,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC/C,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC5C,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;QACjD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC/C,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7C,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7C,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACnD,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACpD,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACnD,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC5D,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,SAAS,EAAE;QAE/D,gDAAgD;QAChD,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC3C,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC5C,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACjD,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC5C,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC1C,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC7C,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACpD,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAChD,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAE3C,kCAAkC;QAClC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;QAClD,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9C,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC/C,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC9C,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QACjD,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE;QAEjD,qFAAqF;QACrF,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC3C,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACvD,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAClD,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACrD,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC9C,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC7C,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC1C,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAClD,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC9C,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC5C,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC/C,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE;QAE/C,yDAAyD;QACzD,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,cAAc,EAAE;QAC9D,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE;QACzD,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,cAAc,EAAE;QAC/D,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QAC/C,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,cAAc,EAAE;QAC/D,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE;QACxD,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE;QACtD,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE;QAChD,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE;QACpD,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE;QAC/C,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE;QACnD,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE;QACrD,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE;KACnD,CAAC;CACH,CAAC,CAAC"}

package/dist/decisions.d.ts

@@ -0,0 +1,22 @@
+export type DecisionKind = 'blocked' | 'rewritten' | 'flagged';
+export type DecisionSubject = 'element' | 'attribute' | 'link' | 'image' | 'url' | 'class' | 'markdown' | 'transform';
+/** Codes the core emits. A transform may add its own; prefix them with its name (`diagram-…`). */
+export type CoreDecisionCode = 'event-handler' | 'event-handler-survived' | 'class-not-allowed' | 'class-filtered' | 'target-not-allowed' | 'scheme-not-allowed' | 'url-unparsable' | 'relative-url-not-allowed' | 'sink-host' | 'url-denied' | 'url-rewritten' | 'url-rewrite-invalid' | 'url-decider-failed' | 'remote-images-disabled' | 'image-host-not-allowed' | 'image-query-denied' | 'image-query-stripped' | 'url-too-long' | 'url-encoded-payload' | 'image-rewrite-rejected' | 'image-rewrite-invalid' | 'image-rewrite-failed' | 'image-rewritten' | 'image-without-src' | 'element-not-allowed' | 'attribute-not-allowed' | 'markdown-failed' | 'transform-failed';
+/** A known code, with room for codes a transform defines. */
+export type DecisionCode = CoreDecisionCode | (string & {});
+/**
+ * One policy decision made while rendering. The journal is the audit trail of a render:
+ * what was blocked, what was rewritten, and what was let through but is worth a look
+ * (`flagged`: a sink host under `sinkDenylist: 'log'`, a transform that failed).
+ * `code` is stable and meant for programs; `reason` is for people and may change.
+ */
+export interface RenderDecision {
+    readonly kind: DecisionKind;
+    readonly subject: DecisionSubject;
+    readonly code: DecisionCode;
+    readonly reason: string;
+    readonly tag?: string;
+    readonly attribute?: string;
+    readonly value?: string;
+}
+//# sourceMappingURL=decisions.d.ts.map

package/dist/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;AAEtH,kGAAkG;AAClG,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,wBAAwB,GACxB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,0BAA0B,GAC1B,WAAW,GACX,YAAY,GACZ,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/decisions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=decisions.js.map

package/dist/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":""}

package/dist/dom.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Replace the children of `target` with the children of `fragment`, keeping the
+ * leading child nodes that are unchanged. During streaming the settled blocks
+ * keep their DOM nodes (no flicker, no lost selection, no re-layout above the
+ * cursor) and only the block being typed is replaced.
+ *
+ * Both inputs are trusted here: the fragment comes out of the sanitizer.
+ */
+export declare function patchChildren(target: ParentNode, fragment: DocumentFragment): {
+    readonly kept: number;
+    readonly replaced: number;
+};
+//# sourceMappingURL=dom.d.ts.map

package/dist/dom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom.d.ts","sourceRoot":"","sources":["../src/dom.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAelI"}

package/dist/dom.js

@@ -0,0 +1,25 @@
+/**
+ * Replace the children of `target` with the children of `fragment`, keeping the
+ * leading child nodes that are unchanged. During streaming the settled blocks
+ * keep their DOM nodes (no flicker, no lost selection, no re-layout above the
+ * cursor) and only the block being typed is replaced.
+ *
+ * Both inputs are trusted here: the fragment comes out of the sanitizer.
+ */
+export function patchChildren(target, fragment) {
+    const current = Array.from(target.childNodes);
+    const next = Array.from(fragment.childNodes);
+    let kept = 0;
+    while (kept < current.length && kept < next.length && current[kept].isEqualNode(next[kept])) {
+        kept += 1;
+    }
+    for (let i = current.length - 1; i >= kept; i -= 1) {
+        current[i].remove();
+    }
+    const tail = next.slice(kept);
+    if (tail.length > 0) {
+        target.append(...tail);
+    }
+    return { kept, replaced: tail.length };
+}
+//# sourceMappingURL=dom.js.map

package/dist/dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom.js","sourceRoot":"","sources":["../src/dom.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB,EAAE,QAA0B;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,3 @@
+/** The message of whatever was thrown, for a journal entry. */
+export declare function messageOf(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD"}

package/dist/errors.js

@@ -0,0 +1,5 @@
+/** The message of whatever was thrown, for a journal entry. */
+export function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export { createRenderer } from './render.js';
+export type { FragmentResult, FragmentTransform, RenderContext, RenderOptions, RenderResult, RenderTarget, Renderer, RendererOptions, TransformContext } from './render.js';
+export { createContentBinding } from './binding.js';
+export type { ContentBinding, ContentBindingOptions } from './binding.js';
+export { DEFAULT_MODE, DEFAULT_URL_HEURISTICS, MODE_PRESETS, resolvePolicy } from './policy.js';
+export type { ContentPolicy, HostPattern, ImagePolicy, ImageHosts, RenderMode, RenderPolicy, RenderPolicyOverrides, UrlContext, UrlDecider, UrlDecision, UrlHeuristics, UrlPolicy, UrlSubject } from './policy.js';
+export type { CoreDecisionCode, DecisionCode, DecisionKind, DecisionSubject, RenderDecision } from './decisions.js';
+export { createMarkdownRenderer } from './markdown.js';
+export type { MarkdownOptions, MarkdownRenderer } from './markdown.js';
+export { completeFences, defaultScheduler, frameScheduler, holdIncompleteHtml, holdIncompleteMarkdown } from './stream.js';
+export type { RenderStream, Scheduler, StreamOptions } from './stream.js';
+export { checkUrl, hostMatches } from './url.js';
+export type { ParsedUrl, UrlProblem, UrlVerdict } from './url.js';
+export { matchSink, mergeSinkDenylists } from './sinks.js';
+export type { SinkCategory, SinkDenylist, SinkEntry } from './sinks.js';
+export { SINK_DENYLIST } from './data/sink-domains.js';
+export { resolveWindow } from './window.js';
+export type { RenderWindow } from './window.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5K,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChG,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEnN,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC3H,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+export { createRenderer } from './render.js';
+export { createContentBinding } from './binding.js';
+export { DEFAULT_MODE, DEFAULT_URL_HEURISTICS, MODE_PRESETS, resolvePolicy } from './policy.js';
+export { createMarkdownRenderer } from './markdown.js';
+export { completeFences, defaultScheduler, frameScheduler, holdIncompleteHtml, holdIncompleteMarkdown } from './stream.js';
+export { checkUrl, hostMatches } from './url.js';
+export { matchSink, mergeSinkDenylists } from './sinks.js';
+export { SINK_DENYLIST } from './data/sink-domains.js';
+export { resolveWindow } from './window.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKhG,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAG3H,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAG3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/internal.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Building blocks the public entry does not expose: `@render-policy/core/internal`.
+ * They exist for this repository's tests and proofs and for integrators who need the
+ * pieces rather than the renderer. They are not covered by semver.
+ */
+export { patchChildren } from './dom.js';
+export { createSanitizer } from './sanitize.js';
+export type { SanitizeOutcome, Sanitizer } from './sanitize.js';
+export { createRenderStream } from './stream.js';
+export type { StreamRenderOps } from './stream.js';
+export { checkUrlHeuristics, normalizeUrl, shannonEntropy, usableBase } from './url.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/internal.js

@@ -0,0 +1,10 @@
+/**
+ * Building blocks the public entry does not expose: `@render-policy/core/internal`.
+ * They exist for this repository's tests and proofs and for integrators who need the
+ * pieces rather than the renderer. They are not covered by semver.
+ */
+export { patchChildren } from './dom.js';
+export { createSanitizer } from './sanitize.js';
+export { createRenderStream } from './stream.js';
+export { checkUrlHeuristics, normalizeUrl, shannonEntropy, usableBase } from './url.js';
+//# sourceMappingURL=internal.js.map

package/dist/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/markdown.d.ts

@@ -0,0 +1,15 @@
+/** Markdown to HTML. The output is untrusted: it always goes through the sanitizer afterwards. */
+export type MarkdownRenderer = (markdown: string) => string;
+export interface MarkdownOptions {
+    /** GitHub Flavored Markdown (tables, strikethrough, autolinks). Default true. */
+    readonly gfm?: boolean;
+    /** Render single newlines as <br>. Default false. */
+    readonly breaks?: boolean;
+}
+/**
+ * The default Markdown renderer, built on marked. Raw HTML in the Markdown is
+ * passed through unchanged on purpose: sanitization runs last, on the final HTML,
+ * so nothing the Markdown step produces can bypass it.
+ */
+export declare function createMarkdownRenderer(options?: MarkdownOptions): MarkdownRenderer;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,eAAoB,GAAG,gBAAgB,CAOtF"}

package/dist/markdown.js

@@ -0,0 +1,15 @@
+import { Marked } from 'marked';
+/**
+ * The default Markdown renderer, built on marked. Raw HTML in the Markdown is
+ * passed through unchanged on purpose: sanitization runs last, on the final HTML,
+ * so nothing the Markdown step produces can bypass it.
+ */
+export function createMarkdownRenderer(options = {}) {
+    const marked = new Marked({
+        gfm: options.gfm ?? true,
+        breaks: options.breaks ?? false,
+        async: false,
+    });
+    return (markdown) => marked.parse(markdown, { async: false });
+}
+//# sourceMappingURL=markdown.js.map

package/dist/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAYhC;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAO,GAAoB,EAAE;IAClE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,141 @@
+/**
+ * A RenderPolicy is the single place where an application decides what
+ * agent-generated content may do once it reaches the DOM.
+ *
+ * Sanitization (no scripts, no event handlers, no unknown elements) is not
+ * negotiable and is not part of the policy. The policy covers what a
+ * sanitizer alone cannot decide for you, grouped into three concerns:
+ *
+ * - `content`: which elements, attributes and classes agent output may carry.
+ * - `urls`: which URLs any attribute may point at (schemes, sink hosts, encoded
+ *   payloads, and an application hook that decides or rewrites each one).
+ * - `images`: what happens to the image requests those URLs would make, which
+ *   fire without a click (host allowlist, query strings, proxy rewrite, placeholder).
+ */
+export type RenderMode = 'strict' | 'balanced' | 'permissive';
+/** `cdn.example.com` matches exactly; `*.example.com` matches subdomains only when `allowWildcardHosts` is on. */
+export type HostPattern = string;
+/** `'none'`: no remote images at all. `'any'`: every host. An array: an allowlist of host patterns. */
+export type ImageHosts = 'none' | 'any' | readonly HostPattern[];
+export interface UrlHeuristics {
+    /** Longest URL accepted at all, in characters, after normalization. */
+    readonly maxLength: number;
+    /** A path segment or query value longer than this is inspected for encoded payloads. */
+    readonly maxTokenLength: number;
+    /** Shannon entropy (bits per character) at or above which a long token counts as an encoded payload. */
+    readonly minEntropy: number;
+}
+/** What a URL decision applies to: an `href` link, an image `src`, or another URL attribute. */
+export type UrlSubject = 'link' | 'image' | 'url';
+/** What a `urls.decide` hook is told about the URL it is judging. */
+export interface UrlContext {
+    readonly subject: UrlSubject;
+    /** The element's tag, lower-case. */
+    readonly tag: string;
+    /** The attribute the URL came from, lower-case. */
+    readonly attribute: string;
+    /** True when the value resolves within the page's own origin without naming a scheme or host. */
+    readonly relative: boolean;
+}
+/**
+ * A `urls.decide` verdict. `null` means "no opinion; apply the rest of the policy". A decision may
+ * deny the URL (drop the attribute), rewrite it (route a link through a redirector, an image through
+ * a proxy — the result is re-checked against the scheme allowlist), and carry a reason for the journal.
+ */
+export interface UrlDecision {
+    /** `false` drops the attribute. Omitted or `true` keeps it (subject to any `rewrite`). */
+    readonly allow?: boolean;
+    /** Replace the URL with this value. Re-validated against `allowedSchemes`. */
+    readonly rewrite?: string;
+    /** Recorded in the decision journal. */
+    readonly reason?: string;
+}
+/**
+ * An application hook, run for every URL attribute after the scheme, relative and sink-denylist
+ * checks pass. It is where a link policy lives (deny or redirect off-site links); it runs for
+ * images too, before the image-specific policy. Trusted application code: if it throws, that one
+ * URL is dropped and the render goes on.
+ */
+export type UrlDecider = (url: URL, context: UrlContext) => UrlDecision | null;
+/** Which elements, attributes and classes agent output may carry. Sanitization is applied regardless. */
+export interface ContentPolicy {
+    /** Allow `<img>` at all. Same-origin and relative images are always allowed when this is on. */
+    readonly allowImages: boolean;
+    /** Allow form controls. Off by default: a rendered password field is a phishing form inside the chat. */
+    readonly allowForms: boolean;
+    /** Allow inline SVG (a sanitized subset). Off by default. */
+    readonly allowSvg: boolean;
+    /** Allow audio/video/source/track/picture. Off by default: they request URLs without a click, like images. */
+    readonly allowMedia: boolean;
+    /** Allow the style attribute. Off by default: agent content must not restyle or overlay the host UI. */
+    readonly allowInlineStyles: boolean;
+    /** Allow data-* attributes. Off by default: host scripts commonly read them as configuration. */
+    readonly allowDataAttributes: boolean;
+    /** Allow target="_blank" on links. rel="noopener noreferrer" is always enforced when a target is present. */
+    readonly allowTargetBlank: boolean;
+    /** Class names the content may carry; every other class is stripped. Patterns must not be global regexes. */
+    readonly allowedClassPatterns: readonly RegExp[];
+    /** Extra tags to forbid on top of the built-in list. */
+    readonly forbidTags: readonly string[];
+    /** Extra attributes to forbid on top of the built-in list. */
+    readonly forbidAttributes: readonly string[];
+}
+/** Which URLs any attribute may point at. */
+export interface UrlPolicy {
+    /** URL schemes allowed in href/src/etc., lower-case, without the colon. Everything else is dropped. */
+    readonly allowedSchemes: readonly string[];
+    /** Scheme-less URLs resolve against the host page. Turn off to require absolute URLs. */
+    readonly allowRelativeUrls: boolean;
+    /** Length and entropy checks against encoded payloads hidden in a URL. `false` disables them. */
+    readonly heuristics: UrlHeuristics | false;
+    /** Hosts known to receive arbitrary data (webhook catchers, tunnels, forms, blob storage): block, log only, or ignore. */
+    readonly sinkDenylist: 'block' | 'log' | 'off';
+    /** Application hook to allow, deny or rewrite each URL. `null` to make no per-URL decisions. */
+    readonly decide: UrlDecider | null;
+}
+/** What happens to the image requests URLs would make (they fire without a click). */
+export interface ImagePolicy {
+    /** Which remote hosts may receive image requests. */
+    readonly hosts: ImageHosts;
+    /** Honour `*.example.com` patterns in `hosts`. Off by default: a wildcard allows every subdomain, including user-controlled ones. */
+    readonly allowWildcardHosts: boolean;
+    /** Query strings on remote images: keep them, strip them (breaks signed URLs, defeats `?data=` exfiltration) or reject the image. */
+    readonly query: 'keep' | 'strip' | 'deny';
+    /** Rewrite allowed remote image URLs, for example through an image proxy. Return null to block the image. */
+    readonly rewriteUrl: ((url: URL) => string | null) | null;
+    /** Show a blocked image as a "click to open" placeholder link, or remove it silently. */
+    readonly blocked: 'remove' | 'placeholder';
+}
+export interface RenderPolicy {
+    readonly mode: RenderMode;
+    readonly content: ContentPolicy;
+    readonly urls: UrlPolicy;
+    readonly images: ImagePolicy;
+}
+/** A partial override of any group, merged onto a mode preset by {@link resolvePolicy}. */
+export interface RenderPolicyOverrides {
+    readonly mode?: RenderMode;
+    readonly content?: Partial<ContentPolicy>;
+    readonly urls?: Partial<UrlPolicy>;
+    readonly images?: Partial<ImagePolicy>;
+}
+export declare const DEFAULT_URL_HEURISTICS: UrlHeuristics;
+/**
+ * Mode presets.
+ *
+ * - strict: no remote images at all; sink hosts blocked; heuristics on.
+ * - balanced: remote images only from the allowlist, query strings stripped; sink hosts blocked; heuristics on.
+ * - permissive: every host allowed, nothing rewritten; sink hosts and nothing else are only logged.
+ *
+ * Sanitization is identical in all three modes. Permissive is still XSS-safe; it just stops
+ * making decisions about where data may flow.
+ */
+export declare const MODE_PRESETS: Readonly<Record<RenderMode, RenderPolicy>>;
+export declare const DEFAULT_MODE: RenderMode;
+/**
+ * Build a policy from a mode preset plus explicit overrides. Each group is merged on top of the
+ * preset, so an override names only the fields it changes. Throws on configurations that silently
+ * widen exposure (wildcard hosts without opting in).
+ */
+export declare function resolvePolicy(mode?: RenderMode, overrides?: RenderPolicyOverrides): RenderPolicy;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;AAE9D,kHAAkH;AAClH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,WAAW,EAAE,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,gGAAgG;AAChG,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAElD,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,KAAK,WAAW,GAAG,IAAI,CAAC;AAE/E,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yGAAyG;IACzG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,6GAA6G;IAC7G,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,6GAA6G;IAC7G,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uGAAuG;IACvG,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,yFAAyF;IACzF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,KAAK,CAAC;IAC3C,0HAA0H;IAC1H,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;IAC/C,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CACpC;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,qIAAqI;IACrI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,aAAa,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAInC,CAAC;AAmBH;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAmBlE,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,UAAuB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,UAAyB,EAAE,SAAS,GAAE,qBAA0B,GAAG,YAAY,CAgClH"}