@scrider/formatter 1.6.0 → 1.6.2

package/dist/index.d.cts

@@ -1010,7 +1010,14 @@ declare const blockFormat: Format<Record<string, unknown>>;
  * during HTML → Delta (see videoFormat.match guard).
  *
  * Markdown: ![Widget](url)
- * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen>
+ * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen
+ *         allow="…; cross-origin-isolated" credentialless>
+ *
+ * The `allow="…; cross-origin-isolated"` list (see CODE_WIDGET_IFRAME_ALLOW)
+ * delegates the cross-origin-isolated capability so StackBlitz WebContainer
+ * embeds can boot SharedArrayBuffer; without it those embeds render blank.
+ * `credentialless` keeps the frame loadable under a cross-origin-isolated host
+ * (COEP) — enabling the live preview is the host's responsibility.
  *
  * The src is run through `toCodeWidgetEmbedUrl` at render time, which is
  * idempotent, so resize/float attributes and the Delta ↔ HTML round-trip stay

package/dist/index.d.ts

@@ -1010,7 +1010,14 @@ declare const blockFormat: Format<Record<string, unknown>>;
  * during HTML → Delta (see videoFormat.match guard).
  *
  * Markdown: ![Widget](url)
- * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen>
+ * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen
+ *         allow="…; cross-origin-isolated" credentialless>
+ *
+ * The `allow="…; cross-origin-isolated"` list (see CODE_WIDGET_IFRAME_ALLOW)
+ * delegates the cross-origin-isolated capability so StackBlitz WebContainer
+ * embeds can boot SharedArrayBuffer; without it those embeds render blank.
+ * `credentialless` keeps the frame loadable under a cross-origin-isolated host
+ * (COEP) — enabling the live preview is the host's responsibility.
  *
  * The src is run through `toCodeWidgetEmbedUrl` at render time, which is
  * idempotent, so resize/float attributes and the Delta ↔ HTML round-trip stay

package/dist/index.js

@@ -1893,7 +1893,7 @@ var EMBED_RENDERERS = {
     const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
     const embedSrc = toVideoEmbedUrl(src);
     if (embedSrc) {
-      return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
+      return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen credentialless${float}${style}></iframe>`;
     }
     return `<video src="${escapeHtml(src)}" controls${float}${style}></video>`;
   },
@@ -1914,7 +1914,7 @@ var EMBED_RENDERERS = {
     }
     const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
     const embedSrc = toCodeWidgetEmbedUrl(src);
-    return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
+    return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen allow="${CODE_WIDGET_IFRAME_ALLOW}" credentialless${float}${style}></iframe>`;
   },
   formula: (value) => {
     const latex = typeof value === "string" ? value : "";
@@ -2034,6 +2034,7 @@ function appendQueryParam(url, key, value) {
   const next = query ? `${query}&${key}=${value}` : `?${key}=${value}`;
   return `${base}${next}${hash}`;
 }
+var CODE_WIDGET_IFRAME_ALLOW = "accelerometer; camera; encrypted-media; geolocation; gyroscope; microphone; midi; payment; usb; vr; xr-spatial-tracking; cross-origin-isolated";
 function toCodeWidgetEmbedUrl(url) {
   const u = typeof url === "string" ? url.trim() : "";
   if (!u) return "";
@@ -2102,7 +2103,7 @@ var codeWidgetFormat = {
     }
     const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
     const embedSrc = toCodeWidgetEmbedUrl(src);
-    return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
+    return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen allow="${CODE_WIDGET_IFRAME_ALLOW}" credentialless${float}${style}></iframe>`;
   },
   match(element) {
     if (element.tagName.toLowerCase() !== "iframe") return null;
@@ -2366,7 +2367,7 @@ var videoFormat = {
     const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
     const embedSrc = toVideoEmbedUrl(src);
     if (embedSrc) {
-      return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
+      return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen credentialless${float}${style}></iframe>`;
     }
     return `<video src="${escapeHtml(src)}" controls${float}${style}></video>`;
   },