@reqvire-org/ads 0.3.14 → 0.3.15

package/dist/showcase/sandbox.bundle.js

@@ -0,0 +1 @@
+function c(e,t){let n=new DOMParser().parseFromString(e,"text/html"),r=n.createElement("meta");if(r.httpEquiv="Content-Security-Policy",r.content=t,n.head.prepend(r),!n.querySelector("base[href]")){let i=n.querySelector("base")??n.createElement("base");i.setAttribute("href","about:srcdoc"),r.after(i)}return"<!doctype html>"+n.documentElement.outerHTML}var a=new URL(location.href).searchParams.get("parent"),o;function s(e=[]){return e.filter(t=>/^(?:https?:\/\/[a-z0-9.*:[\]-]+(?::\d+)?|data:|blob:|about:)$/i.test(t)).join(" ")}function d(e={}){let t=s(e.resourceDomains);return`default-src 'none';script-src 'unsafe-inline' ${t};style-src 'unsafe-inline' ${t};img-src data: ${t};font-src ${t||"'none'"};media-src ${t||"'none'"};worker-src ${t||"'none'"};connect-src ${s(e.connectDomains)||"'none'"};frame-src ${s(e.frameDomains)||"'none'"};base-uri about: ${s(e.baseUriDomains)};object-src 'none'`}window.addEventListener("message",e=>{if(e.source===parent&&e.origin===a){let t=e.data;if(t?.method==="ui/notifications/sandbox-resource-ready"){let{html:n,csp:r}=t.params??{};if(typeof n!="string")return;o?.remove(),o=window.document.createElement("iframe"),o.title="Design-system App",o.setAttribute("sandbox","allow-scripts"),window.document.body.append(o),o.srcdoc=c(n,d(r))}else t?.jsonrpc==="2.0"&&!t.method?.startsWith("ui/notifications/sandbox-")&&o?.contentWindow.postMessage(t,"*")}else e.source===o?.contentWindow&&e.data?.jsonrpc==="2.0"&&!e.data.method?.startsWith("ui/notifications/sandbox-")&&parent.postMessage(e.data,a)});parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-ready",params:{}},a);

package/dist/skills/ads-break-ui/SKILL.md

@@ -55,8 +55,8 @@ For on-demand current/candidate screenshots and visual dry-run review, read
 
 
 For parent/child `covers`, conditional-control review, reference comparisons,
-public style-helper use in scenarios, or `scenario-render` / `showcase-class`
-findings, read [scenario contracts](references/scenarios.md). Its verification
+public style-helper use, fragment-link navigation, or `scenario-render` /
+`showcase-class` findings, read [scenario contracts](references/scenarios.md). Its verification
 examples explain API visibility, reference baselines and state-transition checks.
 Traced parents can cover declared public children; verified public Linaria
 helpers do not grant custom scenario CSS.

package/dist/skills/ads-break-ui/references/scenarios.md

@@ -23,6 +23,17 @@ on-demand element screenshots. It grants no render/behavior coverage and no extr
 styling permission. Use [captures.md](captures.md) for current/candidate review,
 target selection, resource reads and storage lifecycle.
 
+## Fragment links inside Apps
+
+Keep intended `href="#"` and named fragments in the project API and fixtures.
+ADS's inline-document loader supplies an `about:srcdoc` base when the App has no
+explicit base, preserving native scrolling, events and state. If a fragment
+replaces the App with a sandbox URL or browser error, inspect `location.href`,
+`document.baseURI` and the resolved anchor URL. Report a host loading defect;
+do not add scenario `preventDefault` handlers merely to hide it. Explicit App
+bases retain their declared behavior and CSP requirements; external hosts own
+their document-loading policy. Verify link activation as well as rendering.
+
 ## Owner-local token previews load their own definitions
 
 Keep the registered token sheet imported by its runtime owner for product use.

package/dist/skills/ads-designer/SKILL.md

@@ -86,8 +86,8 @@ For on-demand current/candidate screenshots and visual dry-run review, read
 [captures.md](references/captures.md).
 
 For parent/child `covers`, conditional-control review, reference comparisons,
-public style-helper use in scenarios, or `scenario-render` / `showcase-class`
-findings, read [scenario contracts](references/scenarios.md). Its verification
+public style-helper use, fragment-link navigation, or `scenario-render` /
+`showcase-class` findings, read [scenario contracts](references/scenarios.md). Its verification
 examples explain API visibility, reference baselines and state-transition checks.
 Traced parents can cover declared public children; verified public Linaria
 helpers do not grant custom scenario CSS.

package/dist/skills/ads-designer/references/scenarios.md

@@ -23,6 +23,17 @@ on-demand element screenshots. It grants no render/behavior coverage and no extr
 styling permission. Use [captures.md](captures.md) for current/candidate review,
 target selection, resource reads and storage lifecycle.
 
+## Fragment links inside Apps
+
+Keep intended `href="#"` and named fragments in the project API and fixtures.
+ADS's inline-document loader supplies an `about:srcdoc` base when the App has no
+explicit base, preserving native scrolling, events and state. If a fragment
+replaces the App with a sandbox URL or browser error, inspect `location.href`,
+`document.baseURI` and the resolved anchor URL. Report a host loading defect;
+do not add scenario `preventDefault` handlers merely to hide it. Explicit App
+bases retain their declared behavior and CSP requirements; external hosts own
+their document-loading policy. Verify link activation as well as rendering.
+
 ## Owner-local token previews load their own definitions
 
 Keep the registered token sheet imported by its runtime owner for product use.

package/dist/skills/ads-import/SKILL.md

@@ -50,8 +50,8 @@ For on-demand current/candidate screenshots and visual dry-run review, read
 [captures.md](references/captures.md).
 
 For parent/child `covers`, conditional-control review, reference comparisons,
-public style-helper use in scenarios, or `scenario-render` / `showcase-class`
-findings, read [scenario contracts](references/scenarios.md). Its verification
+public style-helper use, fragment-link navigation, or `scenario-render` /
+`showcase-class` findings, read [scenario contracts](references/scenarios.md). Its verification
 examples explain API visibility, reference baselines and state-transition checks.
 Traced parents can cover declared public children; verified public Linaria
 helpers do not grant custom scenario CSS.

package/dist/skills/ads-import/references/scenarios.md

@@ -23,6 +23,17 @@ on-demand element screenshots. It grants no render/behavior coverage and no extr
 styling permission. Use [captures.md](captures.md) for current/candidate review,
 target selection, resource reads and storage lifecycle.
 
+## Fragment links inside Apps
+
+Keep intended `href="#"` and named fragments in the project API and fixtures.
+ADS's inline-document loader supplies an `about:srcdoc` base when the App has no
+explicit base, preserving native scrolling, events and state. If a fragment
+replaces the App with a sandbox URL or browser error, inspect `location.href`,
+`document.baseURI` and the resolved anchor URL. Report a host loading defect;
+do not add scenario `preventDefault` handlers merely to hide it. Explicit App
+bases retain their declared behavior and CSP requirements; external hosts own
+their document-loading policy. Verify link activation as well as rendering.
+
 ## Owner-local token previews load their own definitions
 
 Keep the registered token sheet imported by its runtime owner for product use.

package/dist/skills/ads-migrate/SKILL.md

@@ -52,8 +52,8 @@ For on-demand current/candidate screenshots and visual dry-run review, read
 
 
 For parent/child `covers`, conditional-control review, reference comparisons,
-public style-helper use in scenarios, or `scenario-render` / `showcase-class`
-findings, read [scenario contracts](references/scenarios.md). Its verification
+public style-helper use, fragment-link navigation, or `scenario-render` /
+`showcase-class` findings, read [scenario contracts](references/scenarios.md). Its verification
 examples explain API visibility, reference baselines and state-transition checks.
 Traced parents can cover declared public children; verified public Linaria
 helpers do not grant custom scenario CSS.

package/dist/skills/ads-migrate/references/scenarios.md

@@ -23,6 +23,17 @@ on-demand element screenshots. It grants no render/behavior coverage and no extr
 styling permission. Use [captures.md](captures.md) for current/candidate review,
 target selection, resource reads and storage lifecycle.
 
+## Fragment links inside Apps
+
+Keep intended `href="#"` and named fragments in the project API and fixtures.
+ADS's inline-document loader supplies an `about:srcdoc` base when the App has no
+explicit base, preserving native scrolling, events and state. If a fragment
+replaces the App with a sandbox URL or browser error, inspect `location.href`,
+`document.baseURI` and the resolved anchor URL. Report a host loading defect;
+do not add scenario `preventDefault` handlers merely to hide it. Explicit App
+bases retain their declared behavior and CSP requirements; external hosts own
+their document-loading policy. Verify link activation as well as rendering.
+
 ## Owner-local token previews load their own definitions
 
 Keep the registered token sheet imported by its runtime owner for product use.

package/dist/skills/ads-motion/SKILL.md

@@ -72,8 +72,8 @@ For on-demand current/candidate screenshots and visual dry-run review, read
 
 
 For parent/child `covers`, conditional-control review, reference comparisons,
-public style-helper use in scenarios, or `scenario-render` / `showcase-class`
-findings, read [scenario contracts](references/scenarios.md). Its verification
+public style-helper use, fragment-link navigation, or `scenario-render` /
+`showcase-class` findings, read [scenario contracts](references/scenarios.md). Its verification
 examples explain API visibility, reference baselines and state-transition checks.
 Traced parents can cover declared public children; verified public Linaria
 helpers do not grant custom scenario CSS.

package/dist/skills/ads-motion/references/scenarios.md

@@ -23,6 +23,17 @@ on-demand element screenshots. It grants no render/behavior coverage and no extr
 styling permission. Use [captures.md](captures.md) for current/candidate review,
 target selection, resource reads and storage lifecycle.
 
+## Fragment links inside Apps
+
+Keep intended `href="#"` and named fragments in the project API and fixtures.
+ADS's inline-document loader supplies an `about:srcdoc` base when the App has no
+explicit base, preserving native scrolling, events and state. If a fragment
+replaces the App with a sandbox URL or browser error, inspect `location.href`,
+`document.baseURI` and the resolved anchor URL. Report a host loading defect;
+do not add scenario `preventDefault` handlers merely to hide it. Explicit App
+bases retain their declared behavior and CSP requirements; external hosts own
+their document-loading policy. Verify link activation as well as rendering.
+
 ## Owner-local token previews load their own definitions
 
 Keep the registered token sheet imported by its runtime owner for product use.

package/docs/ARCHITECTURE.md

@@ -213,6 +213,13 @@ Project JavaScript, styles, fonts and UI run only inside that App; the outer
 shell forwards resource bytes without applying project styles or executing its
 runtime. This keeps the host neutral while compositions retain their full skin.
 
+The ADS host gives inline App documents an `about:srcdoc` base when the App
+provides no explicit base URL. Fragment links then stay inside their own document
+with native scrolling, history and events. The sandbox permits this local base;
+external bases still require declared CSP origins. This belongs to document
+loading and changes no project link or scenario handler. External hosts control
+their own document-loading and CSP behavior.
+
 The project compiler publishes a versioned dependency graph: shared runtime and
 foundation assets, plus independently addressable scenario modules. Inside the
 App, a resource loader obtains the selected dependency closure through MCP,

package/docs/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.15
+
+- Keep fragment links inside inline preview documents by supplying a local
+  `about:srcdoc` base in the sandbox host and legacy nested widget. Preserve
+  explicit App bases, native link events and opaque origins; retain CSP gates
+  for external bases. Verify scrolling, state and bridge continuity in browsers.
+
 ## 0.3.14
 
 - Preserve independent passing behavior outcomes in complete runs with failed

package/docs/MCP.md

@@ -593,6 +593,13 @@ origin hosts the sandbox proxy; that proxy creates an opaque inner App iframe
 and forwards the standard Apps bridge messages. The diagnostic explorer follows
 the same sandbox model. Only the App materializes and executes project resources.
 
+For inline documents without an explicit App base URL, ADS supplies
+`<base href="about:srcdoc">` and permits the local `about:` base scheme in CSP.
+Bare and named fragment links retain native in-document navigation and state.
+Explicit App bases remain subject to declared CSP origins. The legacy nested
+widget uses the same document preparation. External hosts own this behavior in
+their loaders; adding scenario click handlers would conceal a host defect.
+
 Hosts need Apps support, server resource forwarding, native ESM/import maps and
 a CSP permitting declared `blob:` script/style/font/worker resources. Project
 previews declare no network connections. The host may enforce stricter policy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reqvire-org/ads",
-  "version": "0.3.14",
+  "version": "0.3.15",
   "type": "module",
   "description": "A design system your agent can see and shape. Your components. Your look. Your code.",
   "repository": {

package/dist/showcase/sandbox.js

@@ -1,30 +0,0 @@
-const parentOrigin = new URL(location.href).searchParams.get("parent");
-let view;
-function domains(values = []) {
-  return values.filter(value => /^(?:https?:\/\/[a-z0-9.*:[\]-]+(?::\d+)?|data:|blob:|about:)$/i.test(value)).join(" ");
-}
-function policy(csp = {}) {
-  const resources = domains(csp.resourceDomains);
-  return `default-src 'none';script-src 'unsafe-inline' ${resources};style-src 'unsafe-inline' ${resources};img-src data: ${resources};font-src ${resources || "'none'"};media-src ${resources || "'none'"};worker-src ${resources || "'none'"};connect-src ${domains(csp.connectDomains) || "'none'"};frame-src ${domains(csp.frameDomains) || "'none'"};base-uri ${domains(csp.baseUriDomains) || "'none'"};object-src 'none'`;
-}
-window.addEventListener("message", event => {
-  if (event.source === parent && event.origin === parentOrigin) {
-    const message = event.data;
-    if (message?.method === "ui/notifications/sandbox-resource-ready") {
-      const { html, csp } = message.params ?? {};
-      if (typeof html !== "string") return;
-      const document = new DOMParser().parseFromString(html, "text/html");
-      const meta = document.createElement("meta");
-      meta.httpEquiv = "Content-Security-Policy";
-      meta.content = policy(csp);
-      document.head.prepend(meta);
-      view?.remove();
-      view = window.document.createElement("iframe");
-      view.title = "Design-system App";
-      view.setAttribute("sandbox", "allow-scripts");
-      window.document.body.append(view);
-      view.srcdoc = "<!doctype html>" + document.documentElement.outerHTML;
-    } else if (message?.jsonrpc === "2.0" && !message.method?.startsWith("ui/notifications/sandbox-")) view?.contentWindow.postMessage(message, "*");
-  } else if (event.source === view?.contentWindow && event.data?.jsonrpc === "2.0" && !event.data.method?.startsWith("ui/notifications/sandbox-")) parent.postMessage(event.data, parentOrigin);
-});
-parent.postMessage({ jsonrpc: "2.0", method: "ui/notifications/sandbox-proxy-ready", params: {} }, parentOrigin);