@seanhogg/builderforce-webcontainers 2026.10.1 → 2026.10.2

package/README.md

@@ -20,5 +20,11 @@ if (runtime.profile().supported) iframe.src = runtime.url;
 else showFallback(runtime.profile().reason);
 ```
 
+To run untrusted code (AI-written, arbitrary packages), isolate the preview on its
+own origin with `bootPreviewRuntime({ relayUrl })`. That origin serves
+`relay.html` and `sw.js` (strings in `@seanhogg/builderforce-webcontainers/assets`)
+with `Content-Security-Policy: frame-ancestors` limited to your app. See the
+[root README](../../README.md#isolating-the-preview-relay-mode).
+
 The package re-exports everything from
 [`@seanhogg/builderforce-webcontainers-core`](../core).

package/dist/assets.d.ts

@@ -0,0 +1,4 @@
+/** The preview service worker's source — serve as `<scope>/sw.js`, text/javascript. */
+export declare const serviceWorkerSource: string;
+/** The cross-origin relay page — serve as `<scope>/relay.html`, text/html, with frame-ancestors set. */
+export declare const relayHtml: string;

package/dist/assets.js

@@ -0,0 +1,4 @@
+/** The preview service worker's source — serve as `<scope>/sw.js`, text/javascript. */
+export const serviceWorkerSource = "\"use strict\";(()=>{var h=\"__bfwc\",g=/^[A-Za-z0-9_-]+$/,w=\"bfwc:attach\",m=\"bfwc:reattach\";function y(e){let r=e.endsWith(\"/\")?e:e+\"/\";return r.endsWith(`/${h}/`)?r:`${r}${h}/`}function R(e){let r=e;return!!r&&r.type===\"response\"&&typeof r.reqId==\"number\"}var v={\"content-type\":\"text/plain; charset=utf-8\",\"cache-control\":\"no-store\"};function A(e){let r=y(e.scopePath),i=e.timeoutMs??3e4,T=e.reattachWaitMs??3e3,c=new Map,d=new Map,p=new Map,b=0;function k(t,s){c.set(t,s),s.onmessage=n=>{R(n.data)&&(p.get(n.data.reqId)?.(n.data),p.delete(n.data.reqId))};for(let n of d.get(t)??[])n(s);d.delete(t)}function x(t){if(!t.pathname.startsWith(r))return null;let s=t.pathname.slice(r.length),n=s.indexOf(\"/\"),o=n<0?s:s.slice(0,n);return!o||!g.test(o)?null:{id:o,path:n<0?\"/\":s.slice(n),search:t.search}}async function E(t){let s=c.get(t);if(s)return s;let n=new Promise(o=>{let u=d.get(t)??[];u.push(o),d.set(t,u),setTimeout(()=>o(void 0),T)});return await e.requestReattach(t),n}async function L(t){let s=await E(t.id);if(!s)return{status:503,headers:v,body:\"This preview is not running in any open tab.\"};let n=++b;return new Promise(o=>{let u=setTimeout(()=>{p.delete(n),c.get(t.id)===s&&c.delete(t.id),o({status:504,headers:v,body:\"The preview did not answer in time.\"})},i);p.set(n,l=>{clearTimeout(u),o({status:l.status,headers:l.headers,body:l.body})}),s.postMessage({type:\"request\",reqId:n,path:t.path,search:t.search})})}return{attach:k,match:x,respond:L,detach:t=>c.delete(t)}}var a=globalThis,f=A({scopePath:new URL(a.registration.scope).pathname,async requestReattach(e){let r=await a.clients.matchAll({type:\"window\",includeUncontrolled:!0});for(let i of r)i.postMessage({type:m,id:e})}});a.addEventListener(\"install\",()=>{a.skipWaiting()});a.addEventListener(\"activate\",e=>{e.waitUntil(a.clients.claim())});a.addEventListener(\"message\",e=>{let r=e.data,i=e.ports[0];r?.type===w&&typeof r.id==\"string\"&&i&&f.attach(r.id,i)});a.addEventListener(\"fetch\",e=>{if(e.request.method!==\"GET\")return;let r=f.match(new URL(e.request.url));r&&e.respondWith(f.respond(r).then(i=>new Response(i.body,{status:i.status,headers:i.headers})))});})();\n";
+/** The cross-origin relay page — serve as `<scope>/relay.html`, text/html, with frame-ancestors set. */
+export const relayHtml = "<!doctype html><html><head><meta charset=\"utf-8\"><title>Preview relay</title></head><body><script>\"use strict\";(()=>{var a=\"bfwc:attach\",c=\"bfwc:reattach\",s=\"bfwc:relay-ready\",p=\"bfwc:relay-attach\",f=\"bfwc:relay-reattach\",d=\"bfwc:relay-reload\";function i(e){return`bfwc:reload:${e}`}function l(e){if(e.active)return Promise.resolve(e.active);let r=e.installing??e.waiting;return r?new Promise((t,n)=>{r.addEventListener(\"statechange\",()=>{r.state===\"activated\"&&e.active&&t(e.active),r.state===\"redundant\"&&n(new Error(\"The preview service worker failed to install.\"))})}):Promise.reject(new Error(\"The preview service worker did not install.\"))}function u(e){if(typeof BroadcastChannel>\"u\")return;let r=new BroadcastChannel(i(e));r.postMessage(\"reload\"),r.close()}var o=window.parent;async function m(){let e=navigator.serviceWorker;if(!e)throw new Error(\"Service workers are unavailable on the preview origin.\");let r=await e.register(new URL(\"./sw.js\",location.href).href,{scope:\"./\"});await l(r),e.addEventListener(\"message\",t=>{t.data?.type===c&&typeof t.data.id==\"string\"&&o.postMessage({type:f,id:t.data.id},\"*\")}),addEventListener(\"message\",t=>{if(t.source!==o)return;let n=t.data;n?.type===p&&typeof n.id==\"string\"&&t.ports[0]?r.active?.postMessage({type:a,id:n.id},[t.ports[0]]):n?.type===d&&typeof n.base==\"string\"&&u(n.base)}),o.postMessage({type:s},\"*\")}m().catch(e=>{o.postMessage({type:s,error:e instanceof Error?e.message:String(e)},\"*\")});})();\n</script></body></html>\n";

package/dist/host.d.ts

@@ -1,17 +1,35 @@
 import { DevServer, VirtualFileSystem, type DevServerOptions, type FileSystemTree, type FlatFiles, type ProjectProfile, type Transformer } from '@seanhogg/builderforce-webcontainers-core';
-export interface BootOptions {
+/** Serve previews on THIS page's origin. Only for code the page's own user trusts. */
+export interface SameOriginOptions {
     /** Where the host serves this package's `dist/sw.js` (e.g. `/__bfwc/sw.js`). */
     serviceWorkerUrl: string;
     /** Worker scope. Defaults to the worker script's directory. */
     scope?: string;
+    relayUrl?: never;
+}
+/**
+ * Serve previews on a SEPARATE origin, isolated from this page's cookies, storage
+ * and DOM. That origin serves `dist/relay.html` and `dist/sw.js` side by side, with
+ * `frame-ancestors` limited to the pages allowed to drive it.
+ */
+export interface RelayOptions {
+    /** e.g. `https://preview.example.com/__bfwc/relay.html`. */
+    relayUrl: string;
+    serviceWorkerUrl?: never;
+    scope?: never;
+}
+export type BootOptions = (SameOriginOptions | RelayOptions) & CommonBootOptions;
+export interface CommonBootOptions {
     /** Compiler. Defaults to esbuild-wasm. */
     transformer?: Transformer;
     /** Package CDN factory. Defaults to esm.sh. */
     cdn?: DevServerOptions['cdn'];
-    /** Stable id (e.g. the project id) — keeps the preview URL stable across reloads. */
+    /** Stable id (e.g. the project id; `[A-Za-z0-9_-]`) — keeps the preview URL stable across reloads. */
     id?: string;
     /** The "Built with Builderforce.ai" badge in the preview. Default true — please keep it. */
     attribution?: boolean;
+    /** Reload open previews when files change. Default true. */
+    liveReload?: boolean;
 }
 export interface PreviewError {
     message: string;
@@ -36,7 +54,8 @@ export interface PreviewRuntime {
  * it, and a service worker that routes the preview iframe's requests back here.
  *
  * Needs a secure context (https or localhost) for the service worker — and
- * nothing else: no cross-origin isolation headers, no SharedArrayBuffer.
+ * nothing else: no cross-origin isolation headers, no SharedArrayBuffer. Pass
+ * `relayUrl` to serve the preview from its own origin (see `RelayOptions`).
  */
 export declare function bootPreviewRuntime(options: BootOptions): Promise<PreviewRuntime>;
 //# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EAET,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,2CAA2C,CAAC;AAInD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,qFAAqF;IACrF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,uEAAuE;IACvE,OAAO,IAAI,cAAc,CAAC;IAC1B,gEAAgE;IAChE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC7D,OAAO,IAAI,IAAI,CAAC;CACjB;AA0BD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA2DtF"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EAET,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,2CAA2C,CAAC;AAKnD,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,iBAAiB,GAAG,YAAY,CAAC,GAAG,iBAAiB,CAAC;AAEjF,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,sGAAsG;IACtG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAKD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,uEAAuE;IACvE,OAAO,IAAI,cAAc,CAAC;IAC1B,gEAAgE;IAChE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC7D,OAAO,IAAI,IAAI,CAAC;CACjB;AAcD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAyEtF"}

package/dist/host.js

@@ -1,21 +1,9 @@
 import { DevServer, ERROR_MESSAGE_TYPE, VirtualFileSystem, } from '@seanhogg/builderforce-webcontainers-core';
-import { ATTACH, REATTACH, isWireRequest, previewBase } from './protocol.js';
+import { PREVIEW_ID, isWireRequest, previewBase } from './protocol.js';
+import { relayTransport, sameOriginTransport } from './transport.js';
 import { createEsbuildWasmTransformer } from './esbuildWasm.js';
-function waitForActive(registration) {
-    if (registration.active)
-        return Promise.resolve(registration.active);
-    const installing = registration.installing ?? registration.waiting;
-    if (!installing)
-        return Promise.reject(new Error('The preview service worker did not install.'));
-    return new Promise((resolve, reject) => {
-        installing.addEventListener('statechange', () => {
-            if (installing.state === 'activated' && registration.active)
-                resolve(registration.active);
-            if (installing.state === 'redundant')
-                reject(new Error('The preview service worker failed to install.'));
-        });
-    });
-}
+/** Edits arrive in bursts (a save, an agent writing several files): reload once per burst. */
+const RELOAD_DEBOUNCE_MS = 120;
 function randomId() {
     return globalThis.crypto?.randomUUID?.().replace(/-/g, '').slice(0, 16) ?? Math.random().toString(36).slice(2, 18);
 }
@@ -31,22 +19,28 @@ function toWire(reqId, served) {
  * it, and a service worker that routes the preview iframe's requests back here.
  *
  * Needs a secure context (https or localhost) for the service worker — and
- * nothing else: no cross-origin isolation headers, no SharedArrayBuffer.
+ * nothing else: no cross-origin isolation headers, no SharedArrayBuffer. Pass
+ * `relayUrl` to serve the preview from its own origin (see `RelayOptions`).
  */
 export async function bootPreviewRuntime(options) {
-    const container = navigator.serviceWorker;
-    if (!container)
-        throw new Error('Service workers are unavailable here (a secure context — https or localhost — is required).');
-    const scriptUrl = new URL(options.serviceWorkerUrl, location.href);
-    const scope = new URL(options.scope ?? './', scriptUrl).pathname;
-    const registration = await container.register(scriptUrl.href, { scope });
-    await waitForActive(registration);
     const id = options.id ?? randomId();
-    const base = previewBase(scope, id);
+    if (!PREVIEW_ID.test(id))
+        throw new Error(`Preview id "${id}" may only contain letters, digits, "_" and "-".`);
+    const transport = options.relayUrl
+        ? await relayTransport(options.relayUrl)
+        : await sameOriginTransport(options.serviceWorkerUrl, options.scope);
+    const base = previewBase(transport.scope, id);
     const fs = new VirtualFileSystem();
-    const transformer = options.transformer ?? (await createEsbuildWasmTransformer());
-    const server = new DevServer({ fs, transformer, base, cdn: options.cdn, attribution: options.attribution });
-    const attach = (worker) => {
+    let server;
+    try {
+        const transformer = options.transformer ?? (await createEsbuildWasmTransformer());
+        server = new DevServer({ fs, transformer, base, cdn: options.cdn, attribution: options.attribution });
+    }
+    catch (error) {
+        transport.dispose();
+        throw error;
+    }
+    const attach = () => {
         const channel = new MessageChannel();
         channel.port1.onmessage = async (event) => {
             if (!isWireRequest(event.data))
@@ -54,20 +48,27 @@ export async function bootPreviewRuntime(options) {
             const { message, transfer } = toWire(event.data.reqId, await server.handle(event.data.path, event.data.search));
             channel.port1.postMessage(message, transfer);
         };
-        worker.postMessage({ type: ATTACH, id }, [channel.port2]);
-    };
-    attach(registration.active);
-    const onWorkerMessage = (event) => {
-        if (event.data?.type === REATTACH && event.data.id === id && registration.active)
-            attach(registration.active);
+        transport.attach(id, channel.port2);
     };
-    container.addEventListener('message', onWorkerMessage);
+    attach();
+    const stopReattach = transport.onReattach((wanted) => {
+        if (wanted === id)
+            attach();
+    });
+    // Live reload: any change to the files reloads every frame showing this preview.
+    let reloadTimer;
+    const stopWatching = options.liveReload === false
+        ? undefined
+        : fs.watch(() => {
+            clearTimeout(reloadTimer);
+            reloadTimer = setTimeout(() => transport.reload(base), RELOAD_DEBOUNCE_MS);
+        });
     const errorListeners = new Set();
     const onWindowMessage = (event) => {
         const data = event.data;
         if (data?.type !== ERROR_MESSAGE_TYPE || typeof data.href !== 'string')
             return;
-        if (!new URL(data.href).pathname.startsWith(base))
+        if (event.origin !== transport.origin || !new URL(data.href).pathname.startsWith(base))
             return; // another runtime's preview
         const error = { message: String(data.message ?? ''), stack: data.stack, href: data.href };
         for (const listener of errorListeners)
@@ -76,7 +77,7 @@ export async function bootPreviewRuntime(options) {
     window.addEventListener('message', onWindowMessage);
     return {
         id,
-        url: new URL(base, location.origin).href,
+        url: new URL(base, transport.origin).href,
         fs,
         server,
         mount: (files) => fs.mount(files),
@@ -86,9 +87,12 @@ export async function bootPreviewRuntime(options) {
             return () => errorListeners.delete(listener);
         },
         dispose() {
-            container.removeEventListener('message', onWorkerMessage);
             window.removeEventListener('message', onWindowMessage);
             errorListeners.clear();
+            clearTimeout(reloadTimer);
+            stopWatching?.();
+            stopReattach();
+            transport.dispose();
             server.dispose();
         },
     };

package/dist/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,GAMlB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAqChE,SAAS,aAAa,CAAC,YAAuC;IAC5D,IAAI,YAAY,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC;IACnE,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACjG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,UAAU,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE;YAC9C,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM;gBAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1F,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,MAAgD;IAC7E,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAqB,CAAC,CAAC,2DAA2D;IACnH,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB;IAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAE/H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,4BAA4B,EAAE,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5G,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,MAAO,CAAC,CAAC;IAE7B,MAAM,eAAe,GAAG,CAAC,KAAmB,EAAE,EAAE;QAC9C,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,YAAY,CAAC,MAAM;YAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAChH,CAAC,CAAC;IACF,SAAS,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAC;IAChE,MAAM,eAAe,GAAG,CAAC,KAAmB,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAiD,CAAC;QACrE,IAAI,IAAI,EAAE,IAAI,KAAK,kBAAkB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC/E,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,4BAA4B;QACvF,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACxG,KAAK,MAAM,QAAQ,IAAI,cAAc;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEpD,OAAO;QACL,EAAE;QACF,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI;QACxC,EAAE;QACF,MAAM;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QAC/B,OAAO,CAAC,QAAQ;YACd,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACvD,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,GAMlB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAqB,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAsChE,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAsB/B,SAAS,QAAQ;IACf,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,MAAgD;IAC7E,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAqB,CAAC,CAAC,2DAA2D;IACnH,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAE/G,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ;QAChC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,MAAM,mBAAmB,CAAE,OAA6B,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9F,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACnC,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,4BAA4B,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,EAAE,CAAC;IACT,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QACnD,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,IAAI,WAAsD,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK;QAC/C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IAEL,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAC;IAChE,MAAM,eAAe,GAAG,CAAC,KAAmB,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAiD,CAAC;QACrE,IAAI,IAAI,EAAE,IAAI,KAAK,kBAAkB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,4BAA4B;QAC5H,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACxG,KAAK,MAAM,QAAQ,IAAI,cAAc;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEpD,OAAO;QACL,EAAE;QACF,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI;QACzC,EAAE;QACF,MAAM;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QAC/B,OAAO,CAAC,QAAQ;YACd,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACvD,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,YAAY,EAAE,EAAE,CAAC;YACjB,YAAY,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export { bootPreviewRuntime } from './host.js';
-export type { BootOptions, PreviewRuntime, PreviewError } from './host.js';
+export type { BootOptions, SameOriginOptions, RelayOptions, CommonBootOptions, PreviewRuntime, PreviewError } from './host.js';
+export type { PreviewTransport } from './transport.js';
 export { createEsbuildWasmTransformer } from './esbuildWasm.js';
 export type { EsbuildWasmOptions } from './esbuildWasm.js';
 export { createSwRouter } from './swRouter.js';
 export type { SwRouter, SwRouterOptions, PortLike, PreviewTarget, RoutedResponse } from './swRouter.js';
-export { previewBase, previewPrefix, PREVIEW_SEGMENT } from './protocol.js';
+export { previewBase, previewPrefix, PREVIEW_SEGMENT, PREVIEW_ID } from './protocol.js';
 export * from '@seanhogg/builderforce-webcontainers-core';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5E,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/H,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxF,cAAc,2CAA2C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { bootPreviewRuntime } from './host.js';
 export { createEsbuildWasmTransformer } from './esbuildWasm.js';
 export { createSwRouter } from './swRouter.js';
-export { previewBase, previewPrefix, PREVIEW_SEGMENT } from './protocol.js';
+export { previewBase, previewPrefix, PREVIEW_SEGMENT, PREVIEW_ID } from './protocol.js';
 export * from '@seanhogg/builderforce-webcontainers-core';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5E,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxF,cAAc,2CAA2C,CAAC"}

package/dist/protocol.d.ts

@@ -4,10 +4,28 @@
  * state: every request it intercepts is forwarded over a MessagePort to the page.
  */
 export declare const PREVIEW_SEGMENT = "__bfwc";
+/**
+ * What a preview id may contain. No dots, so a file served beside the worker
+ * (`sw.js`, `relay.html`) can never be mistaken for a preview.
+ */
+export declare const PREVIEW_ID: RegExp;
 /** page → worker, with a MessagePort in `ports[0]`: "serve preview `id` over this port". */
 export declare const ATTACH = "bfwc:attach";
 /** worker → pages: "I lost the port for `id` (I was restarted) — attach again". */
 export declare const REATTACH = "bfwc:reattach";
+/**
+ * The cross-origin relay (`relay.html`, served on the preview origin and framed,
+ * hidden, by the host). The host cannot talk to a worker on another origin, so the
+ * relay registers it and passes messages both ways.
+ */
+/** relay → host: the worker is active; send ports. */
+export declare const RELAY_READY = "bfwc:relay-ready";
+/** host → relay, with a MessagePort: forward as ATTACH for `id`. */
+export declare const RELAY_ATTACH = "bfwc:relay-attach";
+/** relay → host: the worker asked for `id` again. */
+export declare const RELAY_REATTACH = "bfwc:relay-reattach";
+/** host → relay: reload every frame showing the preview at `base`. */
+export declare const RELAY_RELOAD = "bfwc:relay-reload";
 export interface AttachMessage {
     type: typeof ATTACH;
     id: string;

package/dist/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,eAAe,WAAW,CAAC;AAExC,4FAA4F;AAC5F,eAAO,MAAM,MAAM,gBAAgB,CAAC;AACpC,mFAAmF;AACnF,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,QAAQ,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAGlE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAGpE"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,eAAe,WAAW,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,UAAU,QAAqB,CAAC;AAE7C,4FAA4F;AAC5F,eAAO,MAAM,MAAM,gBAAgB,CAAC;AACpC,mFAAmF;AACnF,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAExC;;;;GAIG;AACH,sDAAsD;AACtD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,oEAAoE;AACpE,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,qDAAqD;AACrD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,QAAQ,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAGlE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAGpE"}

package/dist/protocol.js

@@ -4,10 +4,28 @@
  * state: every request it intercepts is forwarded over a MessagePort to the page.
  */
 export const PREVIEW_SEGMENT = '__bfwc';
+/**
+ * What a preview id may contain. No dots, so a file served beside the worker
+ * (`sw.js`, `relay.html`) can never be mistaken for a preview.
+ */
+export const PREVIEW_ID = /^[A-Za-z0-9_-]+$/;
 /** page → worker, with a MessagePort in `ports[0]`: "serve preview `id` over this port". */
 export const ATTACH = 'bfwc:attach';
 /** worker → pages: "I lost the port for `id` (I was restarted) — attach again". */
 export const REATTACH = 'bfwc:reattach';
+/**
+ * The cross-origin relay (`relay.html`, served on the preview origin and framed,
+ * hidden, by the host). The host cannot talk to a worker on another origin, so the
+ * relay registers it and passes messages both ways.
+ */
+/** relay → host: the worker is active; send ports. */
+export const RELAY_READY = 'bfwc:relay-ready';
+/** host → relay, with a MessagePort: forward as ATTACH for `id`. */
+export const RELAY_ATTACH = 'bfwc:relay-attach';
+/** relay → host: the worker asked for `id` again. */
+export const RELAY_REATTACH = 'bfwc:relay-reattach';
+/** host → relay: reload every frame showing the preview at `base`. */
+export const RELAY_RELOAD = 'bfwc:relay-reload';
 /**
  * The URL prefix previews live under, for a worker scope. Serving the worker from
  * `/__bfwc/sw.js` (scope `/__bfwc/`) keeps it off every other page of the host app;

package/dist/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;AACpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAC;AA2BxC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;IACpE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,eAAe,GAAG,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,EAAU;IACvD,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,CAAC,GAAG,KAA2B,CAAC;IACtC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAA4B,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;AACrE,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAE7C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;AACpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAExC;;;;GAIG;AACH,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAChD,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AA2BhD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;IACpE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,eAAe,GAAG,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,EAAU;IACvD,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,CAAC,GAAG,KAA2B,CAAC;IACtC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,CAAC,GAAG,KAA4B,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;AACrE,CAAC"}

package/dist/relay.html

@@ -0,0 +1,2 @@
+<!doctype html><html><head><meta charset="utf-8"><title>Preview relay</title></head><body><script>"use strict";(()=>{var a="bfwc:attach",c="bfwc:reattach",s="bfwc:relay-ready",p="bfwc:relay-attach",f="bfwc:relay-reattach",d="bfwc:relay-reload";function i(e){return`bfwc:reload:${e}`}function l(e){if(e.active)return Promise.resolve(e.active);let r=e.installing??e.waiting;return r?new Promise((t,n)=>{r.addEventListener("statechange",()=>{r.state==="activated"&&e.active&&t(e.active),r.state==="redundant"&&n(new Error("The preview service worker failed to install."))})}):Promise.reject(new Error("The preview service worker did not install."))}function u(e){if(typeof BroadcastChannel>"u")return;let r=new BroadcastChannel(i(e));r.postMessage("reload"),r.close()}var o=window.parent;async function m(){let e=navigator.serviceWorker;if(!e)throw new Error("Service workers are unavailable on the preview origin.");let r=await e.register(new URL("./sw.js",location.href).href,{scope:"./"});await l(r),e.addEventListener("message",t=>{t.data?.type===c&&typeof t.data.id=="string"&&o.postMessage({type:f,id:t.data.id},"*")}),addEventListener("message",t=>{if(t.source!==o)return;let n=t.data;n?.type===p&&typeof n.id=="string"&&t.ports[0]?r.active?.postMessage({type:a,id:n.id},[t.ports[0]]):n?.type===d&&typeof n.base=="string"&&u(n.base)}),o.postMessage({type:s},"*")}m().catch(e=>{o.postMessage({type:s,error:e instanceof Error?e.message:String(e)},"*")});})();
+</script></body></html>

package/dist/sw.js

@@ -1 +1 @@
-"use strict";(()=>{var f="__bfwc",g="bfwc:attach",m="bfwc:reattach";function w(e){let n=e.endsWith("/")?e:e+"/";return n.endsWith(`/${f}/`)?n:`${n}${f}/`}function y(e){let n=e;return!!n&&n.type==="response"&&typeof n.reqId=="number"}var v={"content-type":"text/plain; charset=utf-8","cache-control":"no-store"};function R(e){let n=w(e.scopePath),i=e.timeoutMs??3e4,k=e.reattachWaitMs??3e3,c=new Map,d=new Map,p=new Map,T=0;function W(t,r){c.set(t,r),r.onmessage=s=>{y(s.data)&&(p.get(s.data.reqId)?.(s.data),p.delete(s.data.reqId))};for(let s of d.get(t)??[])s(r);d.delete(t)}function P(t){if(!t.pathname.startsWith(n))return null;let r=t.pathname.slice(n.length),s=r.indexOf("/"),o=s<0?r:r.slice(0,s);return o?{id:o,path:s<0?"/":r.slice(s),search:t.search}:null}async function b(t){let r=c.get(t);if(r)return r;let s=new Promise(o=>{let u=d.get(t)??[];u.push(o),d.set(t,u),setTimeout(()=>o(void 0),k)});return await e.requestReattach(t),s}async function x(t){let r=await b(t.id);if(!r)return{status:503,headers:v,body:"This preview is not running in any open tab."};let s=++T;return new Promise(o=>{let u=setTimeout(()=>{p.delete(s),c.get(t.id)===r&&c.delete(t.id),o({status:504,headers:v,body:"The preview did not answer in time."})},i);p.set(s,l=>{clearTimeout(u),o({status:l.status,headers:l.headers,body:l.body})}),r.postMessage({type:"request",reqId:s,path:t.path,search:t.search})})}return{attach:W,match:P,respond:x,detach:t=>c.delete(t)}}var a=globalThis,h=R({scopePath:new URL(a.registration.scope).pathname,async requestReattach(e){let n=await a.clients.matchAll({type:"window",includeUncontrolled:!0});for(let i of n)i.postMessage({type:m,id:e})}});a.addEventListener("install",()=>{a.skipWaiting()});a.addEventListener("activate",e=>{e.waitUntil(a.clients.claim())});a.addEventListener("message",e=>{let n=e.data,i=e.ports[0];n?.type===g&&typeof n.id=="string"&&i&&h.attach(n.id,i)});a.addEventListener("fetch",e=>{if(e.request.method!=="GET")return;let n=h.match(new URL(e.request.url));n&&e.respondWith(h.respond(n).then(i=>new Response(i.body,{status:i.status,headers:i.headers})))});})();
+"use strict";(()=>{var h="__bfwc",g=/^[A-Za-z0-9_-]+$/,w="bfwc:attach",m="bfwc:reattach";function y(e){let r=e.endsWith("/")?e:e+"/";return r.endsWith(`/${h}/`)?r:`${r}${h}/`}function R(e){let r=e;return!!r&&r.type==="response"&&typeof r.reqId=="number"}var v={"content-type":"text/plain; charset=utf-8","cache-control":"no-store"};function A(e){let r=y(e.scopePath),i=e.timeoutMs??3e4,T=e.reattachWaitMs??3e3,c=new Map,d=new Map,p=new Map,b=0;function k(t,s){c.set(t,s),s.onmessage=n=>{R(n.data)&&(p.get(n.data.reqId)?.(n.data),p.delete(n.data.reqId))};for(let n of d.get(t)??[])n(s);d.delete(t)}function x(t){if(!t.pathname.startsWith(r))return null;let s=t.pathname.slice(r.length),n=s.indexOf("/"),o=n<0?s:s.slice(0,n);return!o||!g.test(o)?null:{id:o,path:n<0?"/":s.slice(n),search:t.search}}async function E(t){let s=c.get(t);if(s)return s;let n=new Promise(o=>{let u=d.get(t)??[];u.push(o),d.set(t,u),setTimeout(()=>o(void 0),T)});return await e.requestReattach(t),n}async function L(t){let s=await E(t.id);if(!s)return{status:503,headers:v,body:"This preview is not running in any open tab."};let n=++b;return new Promise(o=>{let u=setTimeout(()=>{p.delete(n),c.get(t.id)===s&&c.delete(t.id),o({status:504,headers:v,body:"The preview did not answer in time."})},i);p.set(n,l=>{clearTimeout(u),o({status:l.status,headers:l.headers,body:l.body})}),s.postMessage({type:"request",reqId:n,path:t.path,search:t.search})})}return{attach:k,match:x,respond:L,detach:t=>c.delete(t)}}var a=globalThis,f=A({scopePath:new URL(a.registration.scope).pathname,async requestReattach(e){let r=await a.clients.matchAll({type:"window",includeUncontrolled:!0});for(let i of r)i.postMessage({type:m,id:e})}});a.addEventListener("install",()=>{a.skipWaiting()});a.addEventListener("activate",e=>{e.waitUntil(a.clients.claim())});a.addEventListener("message",e=>{let r=e.data,i=e.ports[0];r?.type===w&&typeof r.id=="string"&&i&&f.attach(r.id,i)});a.addEventListener("fetch",e=>{if(e.request.method!=="GET")return;let r=f.match(new URL(e.request.url));r&&e.respondWith(f.respond(r).then(i=>new Response(i.body,{status:i.status,headers:i.headers})))});})();

package/dist/swRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"swRouter.d.ts","sourceRoot":"","sources":["../src/swRouter.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe;iBASjC,MAAM,QAAQ,QAAQ,KAAG,IAAI;iBAW7B,GAAG,KAAG,aAAa,GAAG,IAAI;sBAsBf,aAAa,KAAG,OAAO,CAAC,cAAc,CAAC;iBAkBxB,MAAM;EACrD;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"swRouter.d.ts","sourceRoot":"","sources":["../src/swRouter.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe;iBASjC,MAAM,QAAQ,QAAQ,KAAG,IAAI;iBAW7B,GAAG,KAAG,aAAa,GAAG,IAAI;sBAwBf,aAAa,KAAG,OAAO,CAAC,cAAc,CAAC;iBAkBxB,MAAM;EACrD;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/swRouter.js

@@ -1,4 +1,4 @@
-import { isWireResponse, previewPrefix } from './protocol.js';
+import { PREVIEW_ID, isWireResponse, previewPrefix } from './protocol.js';
 const TEXT = { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' };
 /**
  * Request routing for the preview service worker, with no worker globals in it.
@@ -35,7 +35,9 @@ export function createSwRouter(options) {
         const rest = url.pathname.slice(prefix.length);
         const slash = rest.indexOf('/');
         const id = slash < 0 ? rest : rest.slice(0, slash);
-        if (!id)
+        // Ids are `[A-Za-z0-9_-]`; a dotted segment is a real file beside the worker
+        // (`sw.js`, `relay.html`), which must load from the network.
+        if (!id || !PREVIEW_ID.test(id))
             return null;
         return { id, path: slash < 0 ? '/' : rest.slice(slash), search: url.search };
     }

package/dist/swRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"swRouter.js","sourceRoot":"","sources":["../src/swRouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AA+BjF,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,SAAS,MAAM,CAAC,EAAU,EAAE,IAAc;QACxC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,SAAS,KAAK,CAAC,GAAQ;QACrB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAU;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAqB;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,EAAE,MAAM,CAAC;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"swRouter.js","sourceRoot":"","sources":["../src/swRouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AA+B7F,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,SAAS,MAAM,CAAC,EAAU,EAAE,IAAc;QACxC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,SAAS,KAAK,CAAC,GAAQ;QACrB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,6EAA6E;QAC7E,6DAA6D;QAC7D,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAU;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAqB;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,EAAE,MAAM,CAAC;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,16 @@
+export interface PreviewTransport {
+    /** The origin previews are served from. */
+    readonly origin: string;
+    /** The worker's scope path on that origin. */
+    readonly scope: string;
+    /** Hand the worker the port that serves preview `id`. */
+    attach(id: string, port: MessagePort): void;
+    /** The worker restarted and wants `id` again. */
+    onReattach(listener: (id: string) => void): () => void;
+    /** Reload every frame showing the preview at `base`. */
+    reload(base: string): void;
+    dispose(): void;
+}
+export declare function sameOriginTransport(serviceWorkerUrl: string, scopeOption?: string): Promise<PreviewTransport>;
+export declare function relayTransport(relayUrl: string): Promise<PreviewTransport>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C,iDAAiD;IACjD,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACvD,wDAAwD;IACxD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;CACjB;AAKD,wBAAsB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6BnH;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwDhF"}

package/dist/transport.js

@@ -0,0 +1,106 @@
+/**
+ * How the host page reaches the preview service worker.
+ *
+ * Same origin: the page registers the worker itself. Simple, but the preview then
+ * runs on the host's origin, with the host's storage and session — fine for a
+ * page that only previews code its own user wrote and trusts.
+ *
+ * Relay: the worker lives on a SEPARATE preview origin. A hidden `relay.html` on
+ * that origin registers it and passes ports and reloads across. The preview can
+ * then never read the host's cookies, storage or DOM, which is what an editor
+ * running AI-written code or arbitrary npm packages needs.
+ */
+import { ATTACH, REATTACH, RELAY_ATTACH, RELAY_READY, RELAY_REATTACH, RELAY_RELOAD, } from './protocol.js';
+import { broadcastReload, waitForActive } from './worker.js';
+/** How long the relay has to register its worker before boot gives up. */
+const RELAY_TIMEOUT_MS = 15_000;
+export async function sameOriginTransport(serviceWorkerUrl, scopeOption) {
+    const container = navigator.serviceWorker;
+    if (!container)
+        throw new Error('Service workers are unavailable here (a secure context — https or localhost — is required).');
+    const scriptUrl = new URL(serviceWorkerUrl, location.href);
+    const scope = new URL(scopeOption ?? './', scriptUrl).pathname;
+    const registration = await container.register(scriptUrl.href, { scope });
+    await waitForActive(registration);
+    const listeners = new Set();
+    const onWorkerMessage = (event) => {
+        if (event.data?.type === REATTACH && typeof event.data.id === 'string')
+            for (const listener of listeners)
+                listener(event.data.id);
+    };
+    container.addEventListener('message', onWorkerMessage);
+    return {
+        origin: location.origin,
+        scope,
+        attach: (id, port) => registration.active?.postMessage({ type: ATTACH, id }, [port]),
+        onReattach(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        reload: broadcastReload,
+        dispose() {
+            container.removeEventListener('message', onWorkerMessage);
+            listeners.clear();
+        },
+    };
+}
+export async function relayTransport(relayUrl) {
+    const url = new URL(relayUrl, location.href);
+    const frame = document.createElement('iframe');
+    frame.src = url.href;
+    frame.title = 'Preview relay';
+    frame.setAttribute('aria-hidden', 'true');
+    frame.tabIndex = -1;
+    frame.style.cssText = 'position:absolute;width:0;height:0;border:0;visibility:hidden';
+    const fromRelay = (event) => event.origin === url.origin && event.source === frame.contentWindow;
+    const ready = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            window.removeEventListener('message', onReady);
+            reject(new Error(`The preview relay at ${url.origin} did not start.`));
+        }, RELAY_TIMEOUT_MS);
+        function onReady(event) {
+            if (!fromRelay(event) || event.data?.type !== RELAY_READY)
+                return;
+            clearTimeout(timer);
+            window.removeEventListener('message', onReady);
+            if (typeof event.data.error === 'string')
+                reject(new Error(event.data.error));
+            else
+                resolve();
+        }
+        window.addEventListener('message', onReady);
+    });
+    document.body.appendChild(frame);
+    try {
+        await ready;
+    }
+    catch (error) {
+        frame.remove();
+        throw error;
+    }
+    const listeners = new Set();
+    const onRelayMessage = (event) => {
+        if (!fromRelay(event) || event.data?.type !== RELAY_REATTACH || typeof event.data.id !== 'string')
+            return;
+        for (const listener of listeners)
+            listener(event.data.id);
+    };
+    window.addEventListener('message', onRelayMessage);
+    const post = (message, transfer = []) => frame.contentWindow?.postMessage(message, url.origin, transfer);
+    return {
+        origin: url.origin,
+        scope: new URL('./', url).pathname,
+        attach: (id, port) => post({ type: RELAY_ATTACH, id }, [port]),
+        onReattach(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        reload: (base) => post({ type: RELAY_RELOAD, base }),
+        dispose() {
+            window.removeEventListener('message', onRelayMessage);
+            listeners.clear();
+            frame.remove();
+        },
+    };
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgB7D,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,gBAAwB,EAAE,WAAoB;IACtF,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAE/H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,eAAe,GAAG,CAAC,KAAmB,EAAE,EAAE;QAC9C,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC;IACF,SAAS,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK;QACL,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACpF,UAAU,CAAC,QAAQ;YACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,EAAE,eAAe;QACvB,OAAO;YACL,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAC1D,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/C,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;IAC9B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IACpB,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,+DAA+D,CAAC;IAEtF,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC;IAE/G,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC;QACzE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,SAAS,OAAO,CAAC,KAAmB;YAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW;gBAAE,OAAO;YAClE,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;gBACzE,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAE,EAAE;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,cAAc,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO;QAC1G,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAE,WAA2B,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElI,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,UAAU,CAAC,QAAQ;YACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACtD,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,5 @@
+/** Resolve once the registration has an active worker. */
+export declare function waitForActive(registration: ServiceWorkerRegistration): Promise<ServiceWorker>;
+/** Reload every frame (on this origin) showing the preview served at `base`. */
+export declare function broadcastReload(base: string): void;
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAKA,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,YAAY,EAAE,yBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAU7F;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKlD"}

package/dist/worker.js

@@ -0,0 +1,29 @@
+/**
+ * Small helpers shared by the page-side transports and the relay page.
+ */
+import { reloadChannelName } from '@seanhogg/builderforce-webcontainers-core';
+/** Resolve once the registration has an active worker. */
+export function waitForActive(registration) {
+    if (registration.active)
+        return Promise.resolve(registration.active);
+    const installing = registration.installing ?? registration.waiting;
+    if (!installing)
+        return Promise.reject(new Error('The preview service worker did not install.'));
+    return new Promise((resolve, reject) => {
+        installing.addEventListener('statechange', () => {
+            if (installing.state === 'activated' && registration.active)
+                resolve(registration.active);
+            if (installing.state === 'redundant')
+                reject(new Error('The preview service worker failed to install.'));
+        });
+    });
+}
+/** Reload every frame (on this origin) showing the preview served at `base`. */
+export function broadcastReload(base) {
+    if (typeof BroadcastChannel === 'undefined')
+        return;
+    const channel = new BroadcastChannel(reloadChannelName(base));
+    channel.postMessage('reload');
+    channel.close();
+}
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,YAAuC;IACnE,IAAI,YAAY,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC;IACnE,IAAI,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACjG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,UAAU,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE;YAC9C,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM;gBAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1F,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,OAAO,gBAAgB,KAAK,WAAW;QAAE,OAAO;IACpD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanhogg/builderforce-webcontainers",
-  "version": "2026.10.1",
+  "version": "2026.10.2",
   "description": "BuilderForce WebContainers — browser runtime. Boots an in-browser dev server for a project held in memory and serves it to an iframe through a service worker. Open source, no COOP/COEP, no session caps.",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -10,7 +10,12 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
-    "./sw.js": "./dist/sw.js"
+    "./assets": {
+      "types": "./dist/assets.d.ts",
+      "import": "./dist/assets.js"
+    },
+    "./sw.js": "./dist/sw.js",
+    "./relay.html": "./dist/relay.html"
   },
   "type": "module",
   "sideEffects": false,
@@ -53,7 +58,7 @@
   },
   "dependencies": {
     "esbuild-wasm": "^0.24.0",
-    "@seanhogg/builderforce-webcontainers-core": "^2026.10.1"
+    "@seanhogg/builderforce-webcontainers-core": "^2026.10.2"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/host.ts

@@ -8,24 +8,49 @@ import {
   type ProjectProfile,
   type Transformer,
 } from '@seanhogg/builderforce-webcontainers-core';
-import { ATTACH, REATTACH, isWireRequest, previewBase, type WireResponse } from './protocol.js';
+import { PREVIEW_ID, isWireRequest, previewBase, type WireResponse } from './protocol.js';
+import { relayTransport, sameOriginTransport } from './transport.js';
 import { createEsbuildWasmTransformer } from './esbuildWasm.js';
 
-export interface BootOptions {
+/** Serve previews on THIS page's origin. Only for code the page's own user trusts. */
+export interface SameOriginOptions {
   /** Where the host serves this package's `dist/sw.js` (e.g. `/__bfwc/sw.js`). */
   serviceWorkerUrl: string;
   /** Worker scope. Defaults to the worker script's directory. */
   scope?: string;
+  relayUrl?: never;
+}
+
+/**
+ * Serve previews on a SEPARATE origin, isolated from this page's cookies, storage
+ * and DOM. That origin serves `dist/relay.html` and `dist/sw.js` side by side, with
+ * `frame-ancestors` limited to the pages allowed to drive it.
+ */
+export interface RelayOptions {
+  /** e.g. `https://preview.example.com/__bfwc/relay.html`. */
+  relayUrl: string;
+  serviceWorkerUrl?: never;
+  scope?: never;
+}
+
+export type BootOptions = (SameOriginOptions | RelayOptions) & CommonBootOptions;
+
+export interface CommonBootOptions {
   /** Compiler. Defaults to esbuild-wasm. */
   transformer?: Transformer;
   /** Package CDN factory. Defaults to esm.sh. */
   cdn?: DevServerOptions['cdn'];
-  /** Stable id (e.g. the project id) — keeps the preview URL stable across reloads. */
+  /** Stable id (e.g. the project id; `[A-Za-z0-9_-]`) — keeps the preview URL stable across reloads. */
   id?: string;
   /** The "Built with Builderforce.ai" badge in the preview. Default true — please keep it. */
   attribution?: boolean;
+  /** Reload open previews when files change. Default true. */
+  liveReload?: boolean;
 }
 
+/** Edits arrive in bursts (a save, an agent writing several files): reload once per burst. */
+const RELOAD_DEBOUNCE_MS = 120;
+
 export interface PreviewError {
   message: string;
   stack?: string;
@@ -46,18 +71,6 @@ export interface PreviewRuntime {
   dispose(): void;
 }
 
-function waitForActive(registration: ServiceWorkerRegistration): Promise<ServiceWorker> {
-  if (registration.active) return Promise.resolve(registration.active);
-  const installing = registration.installing ?? registration.waiting;
-  if (!installing) return Promise.reject(new Error('The preview service worker did not install.'));
-  return new Promise((resolve, reject) => {
-    installing.addEventListener('statechange', () => {
-      if (installing.state === 'activated' && registration.active) resolve(registration.active);
-      if (installing.state === 'redundant') reject(new Error('The preview service worker failed to install.'));
-    });
-  });
-}
-
 function randomId(): string {
   return globalThis.crypto?.randomUUID?.().replace(/-/g, '').slice(0, 16) ?? Math.random().toString(36).slice(2, 18);
 }
@@ -75,44 +88,56 @@ function toWire(reqId: number, served: Awaited<ReturnType<DevServer['handle']>>)
  * it, and a service worker that routes the preview iframe's requests back here.
  *
  * Needs a secure context (https or localhost) for the service worker — and
- * nothing else: no cross-origin isolation headers, no SharedArrayBuffer.
+ * nothing else: no cross-origin isolation headers, no SharedArrayBuffer. Pass
+ * `relayUrl` to serve the preview from its own origin (see `RelayOptions`).
  */
 export async function bootPreviewRuntime(options: BootOptions): Promise<PreviewRuntime> {
-  const container = navigator.serviceWorker;
-  if (!container) throw new Error('Service workers are unavailable here (a secure context — https or localhost — is required).');
+  const id = options.id ?? randomId();
+  if (!PREVIEW_ID.test(id)) throw new Error(`Preview id "${id}" may only contain letters, digits, "_" and "-".`);
 
-  const scriptUrl = new URL(options.serviceWorkerUrl, location.href);
-  const scope = new URL(options.scope ?? './', scriptUrl).pathname;
-  const registration = await container.register(scriptUrl.href, { scope });
-  await waitForActive(registration);
+  const transport = options.relayUrl
+    ? await relayTransport(options.relayUrl)
+    : await sameOriginTransport((options as SameOriginOptions).serviceWorkerUrl, options.scope);
 
-  const id = options.id ?? randomId();
-  const base = previewBase(scope, id);
+  const base = previewBase(transport.scope, id);
   const fs = new VirtualFileSystem();
-  const transformer = options.transformer ?? (await createEsbuildWasmTransformer());
-  const server = new DevServer({ fs, transformer, base, cdn: options.cdn, attribution: options.attribution });
+  let server: DevServer;
+  try {
+    const transformer = options.transformer ?? (await createEsbuildWasmTransformer());
+    server = new DevServer({ fs, transformer, base, cdn: options.cdn, attribution: options.attribution });
+  } catch (error) {
+    transport.dispose();
+    throw error;
+  }
 
-  const attach = (worker: ServiceWorker) => {
+  const attach = () => {
     const channel = new MessageChannel();
     channel.port1.onmessage = async (event) => {
       if (!isWireRequest(event.data)) return;
       const { message, transfer } = toWire(event.data.reqId, await server.handle(event.data.path, event.data.search));
       channel.port1.postMessage(message, transfer);
     };
-    worker.postMessage({ type: ATTACH, id }, [channel.port2]);
+    transport.attach(id, channel.port2);
   };
-  attach(registration.active!);
+  attach();
+  const stopReattach = transport.onReattach((wanted) => {
+    if (wanted === id) attach();
+  });
 
-  const onWorkerMessage = (event: MessageEvent) => {
-    if (event.data?.type === REATTACH && event.data.id === id && registration.active) attach(registration.active);
-  };
-  container.addEventListener('message', onWorkerMessage);
+  // Live reload: any change to the files reloads every frame showing this preview.
+  let reloadTimer: ReturnType<typeof setTimeout> | undefined;
+  const stopWatching = options.liveReload === false
+    ? undefined
+    : fs.watch(() => {
+      clearTimeout(reloadTimer);
+      reloadTimer = setTimeout(() => transport.reload(base), RELOAD_DEBOUNCE_MS);
+    });
 
   const errorListeners = new Set<(error: PreviewError) => void>();
   const onWindowMessage = (event: MessageEvent) => {
     const data = event.data as Partial<PreviewError> & { type?: string };
     if (data?.type !== ERROR_MESSAGE_TYPE || typeof data.href !== 'string') return;
-    if (!new URL(data.href).pathname.startsWith(base)) return; // another runtime's preview
+    if (event.origin !== transport.origin || !new URL(data.href).pathname.startsWith(base)) return; // another runtime's preview
     const error: PreviewError = { message: String(data.message ?? ''), stack: data.stack, href: data.href };
     for (const listener of errorListeners) listener(error);
   };
@@ -120,7 +145,7 @@ export async function bootPreviewRuntime(options: BootOptions): Promise<PreviewR
 
   return {
     id,
-    url: new URL(base, location.origin).href,
+    url: new URL(base, transport.origin).href,
     fs,
     server,
     mount: (files) => fs.mount(files),
@@ -130,9 +155,12 @@ export async function bootPreviewRuntime(options: BootOptions): Promise<PreviewR
       return () => errorListeners.delete(listener);
     },
     dispose() {
-      container.removeEventListener('message', onWorkerMessage);
       window.removeEventListener('message', onWindowMessage);
       errorListeners.clear();
+      clearTimeout(reloadTimer);
+      stopWatching?.();
+      stopReattach();
+      transport.dispose();
       server.dispose();
     },
   };

package/src/index.ts

@@ -1,8 +1,9 @@
 export { bootPreviewRuntime } from './host.js';
-export type { BootOptions, PreviewRuntime, PreviewError } from './host.js';
+export type { BootOptions, SameOriginOptions, RelayOptions, CommonBootOptions, PreviewRuntime, PreviewError } from './host.js';
+export type { PreviewTransport } from './transport.js';
 export { createEsbuildWasmTransformer } from './esbuildWasm.js';
 export type { EsbuildWasmOptions } from './esbuildWasm.js';
 export { createSwRouter } from './swRouter.js';
 export type { SwRouter, SwRouterOptions, PortLike, PreviewTarget, RoutedResponse } from './swRouter.js';
-export { previewBase, previewPrefix, PREVIEW_SEGMENT } from './protocol.js';
+export { previewBase, previewPrefix, PREVIEW_SEGMENT, PREVIEW_ID } from './protocol.js';
 export * from '@seanhogg/builderforce-webcontainers-core';

package/src/protocol.ts

@@ -6,11 +6,31 @@
 
 export const PREVIEW_SEGMENT = '__bfwc';
 
+/**
+ * What a preview id may contain. No dots, so a file served beside the worker
+ * (`sw.js`, `relay.html`) can never be mistaken for a preview.
+ */
+export const PREVIEW_ID = /^[A-Za-z0-9_-]+$/;
+
 /** page → worker, with a MessagePort in `ports[0]`: "serve preview `id` over this port". */
 export const ATTACH = 'bfwc:attach';
 /** worker → pages: "I lost the port for `id` (I was restarted) — attach again". */
 export const REATTACH = 'bfwc:reattach';
 
+/**
+ * The cross-origin relay (`relay.html`, served on the preview origin and framed,
+ * hidden, by the host). The host cannot talk to a worker on another origin, so the
+ * relay registers it and passes messages both ways.
+ */
+/** relay → host: the worker is active; send ports. */
+export const RELAY_READY = 'bfwc:relay-ready';
+/** host → relay, with a MessagePort: forward as ATTACH for `id`. */
+export const RELAY_ATTACH = 'bfwc:relay-attach';
+/** relay → host: the worker asked for `id` again. */
+export const RELAY_REATTACH = 'bfwc:relay-reattach';
+/** host → relay: reload every frame showing the preview at `base`. */
+export const RELAY_RELOAD = 'bfwc:relay-reload';
+
 export interface AttachMessage {
   type: typeof ATTACH;
   id: string;

package/src/relay.ts

@@ -0,0 +1,40 @@
+/**
+ * The relay page's script (bundled inline into dist/relay.html). Served on the
+ * preview origin and framed, hidden, by the host page, it registers the preview
+ * worker on ITS origin and passes ports, re-attach requests and reloads between
+ * the two. See `relayTransport`.
+ *
+ * Whoever may frame this page may drive it, so the server that hosts relay.html
+ * must restrict that with `Content-Security-Policy: frame-ancestors <host origins>`.
+ */
+import { ATTACH, REATTACH, RELAY_ATTACH, RELAY_READY, RELAY_REATTACH, RELAY_RELOAD } from './protocol.js';
+import { broadcastReload, waitForActive } from './worker.js';
+
+const host = window.parent;
+
+async function start(): Promise<void> {
+  const container = navigator.serviceWorker;
+  if (!container) throw new Error('Service workers are unavailable on the preview origin.');
+  const registration = await container.register(new URL('./sw.js', location.href).href, { scope: './' });
+  await waitForActive(registration);
+
+  container.addEventListener('message', (event) => {
+    if (event.data?.type === REATTACH && typeof event.data.id === 'string') host.postMessage({ type: RELAY_REATTACH, id: event.data.id }, '*');
+  });
+
+  addEventListener('message', (event) => {
+    if (event.source !== host) return;
+    const data = event.data as { type?: string; id?: unknown; base?: unknown } | null;
+    if (data?.type === RELAY_ATTACH && typeof data.id === 'string' && event.ports[0]) {
+      registration.active?.postMessage({ type: ATTACH, id: data.id }, [event.ports[0]]);
+    } else if (data?.type === RELAY_RELOAD && typeof data.base === 'string') {
+      broadcastReload(data.base);
+    }
+  });
+
+  host.postMessage({ type: RELAY_READY }, '*');
+}
+
+start().catch((error: unknown) => {
+  host.postMessage({ type: RELAY_READY, error: error instanceof Error ? error.message : String(error) }, '*');
+});

package/src/swRouter.ts

@@ -1,4 +1,4 @@
-import { isWireResponse, previewPrefix, type WireResponse } from './protocol.js';
+import { PREVIEW_ID, isWireResponse, previewPrefix, type WireResponse } from './protocol.js';
 
 /** The part of MessagePort the router uses — a fake in tests, a real port in the worker. */
 export interface PortLike {
@@ -65,7 +65,9 @@ export function createSwRouter(options: SwRouterOptions) {
     const rest = url.pathname.slice(prefix.length);
     const slash = rest.indexOf('/');
     const id = slash < 0 ? rest : rest.slice(0, slash);
-    if (!id) return null;
+    // Ids are `[A-Za-z0-9_-]`; a dotted segment is a real file beside the worker
+    // (`sw.js`, `relay.html`), which must load from the network.
+    if (!id || !PREVIEW_ID.test(id)) return null;
     return { id, path: slash < 0 ? '/' : rest.slice(slash), search: url.search };
   }
 

package/src/transport.ts

@@ -0,0 +1,127 @@
+/**
+ * How the host page reaches the preview service worker.
+ *
+ * Same origin: the page registers the worker itself. Simple, but the preview then
+ * runs on the host's origin, with the host's storage and session — fine for a
+ * page that only previews code its own user wrote and trusts.
+ *
+ * Relay: the worker lives on a SEPARATE preview origin. A hidden `relay.html` on
+ * that origin registers it and passes ports and reloads across. The preview can
+ * then never read the host's cookies, storage or DOM, which is what an editor
+ * running AI-written code or arbitrary npm packages needs.
+ */
+import {
+  ATTACH,
+  REATTACH,
+  RELAY_ATTACH,
+  RELAY_READY,
+  RELAY_REATTACH,
+  RELAY_RELOAD,
+} from './protocol.js';
+import { broadcastReload, waitForActive } from './worker.js';
+
+export interface PreviewTransport {
+  /** The origin previews are served from. */
+  readonly origin: string;
+  /** The worker's scope path on that origin. */
+  readonly scope: string;
+  /** Hand the worker the port that serves preview `id`. */
+  attach(id: string, port: MessagePort): void;
+  /** The worker restarted and wants `id` again. */
+  onReattach(listener: (id: string) => void): () => void;
+  /** Reload every frame showing the preview at `base`. */
+  reload(base: string): void;
+  dispose(): void;
+}
+
+/** How long the relay has to register its worker before boot gives up. */
+const RELAY_TIMEOUT_MS = 15_000;
+
+export async function sameOriginTransport(serviceWorkerUrl: string, scopeOption?: string): Promise<PreviewTransport> {
+  const container = navigator.serviceWorker;
+  if (!container) throw new Error('Service workers are unavailable here (a secure context — https or localhost — is required).');
+
+  const scriptUrl = new URL(serviceWorkerUrl, location.href);
+  const scope = new URL(scopeOption ?? './', scriptUrl).pathname;
+  const registration = await container.register(scriptUrl.href, { scope });
+  await waitForActive(registration);
+
+  const listeners = new Set<(id: string) => void>();
+  const onWorkerMessage = (event: MessageEvent) => {
+    if (event.data?.type === REATTACH && typeof event.data.id === 'string') for (const listener of listeners) listener(event.data.id);
+  };
+  container.addEventListener('message', onWorkerMessage);
+
+  return {
+    origin: location.origin,
+    scope,
+    attach: (id, port) => registration.active?.postMessage({ type: ATTACH, id }, [port]),
+    onReattach(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    reload: broadcastReload,
+    dispose() {
+      container.removeEventListener('message', onWorkerMessage);
+      listeners.clear();
+    },
+  };
+}
+
+export async function relayTransport(relayUrl: string): Promise<PreviewTransport> {
+  const url = new URL(relayUrl, location.href);
+  const frame = document.createElement('iframe');
+  frame.src = url.href;
+  frame.title = 'Preview relay';
+  frame.setAttribute('aria-hidden', 'true');
+  frame.tabIndex = -1;
+  frame.style.cssText = 'position:absolute;width:0;height:0;border:0;visibility:hidden';
+
+  const fromRelay = (event: MessageEvent) => event.origin === url.origin && event.source === frame.contentWindow;
+
+  const ready = new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      window.removeEventListener('message', onReady);
+      reject(new Error(`The preview relay at ${url.origin} did not start.`));
+    }, RELAY_TIMEOUT_MS);
+    function onReady(event: MessageEvent) {
+      if (!fromRelay(event) || event.data?.type !== RELAY_READY) return;
+      clearTimeout(timer);
+      window.removeEventListener('message', onReady);
+      if (typeof event.data.error === 'string') reject(new Error(event.data.error));
+      else resolve();
+    }
+    window.addEventListener('message', onReady);
+  });
+  document.body.appendChild(frame);
+  try {
+    await ready;
+  } catch (error) {
+    frame.remove();
+    throw error;
+  }
+
+  const listeners = new Set<(id: string) => void>();
+  const onRelayMessage = (event: MessageEvent) => {
+    if (!fromRelay(event) || event.data?.type !== RELAY_REATTACH || typeof event.data.id !== 'string') return;
+    for (const listener of listeners) listener(event.data.id);
+  };
+  window.addEventListener('message', onRelayMessage);
+  const post = (message: unknown, transfer: Transferable[] = []) => frame.contentWindow?.postMessage(message, url.origin, transfer);
+
+  return {
+    origin: url.origin,
+    scope: new URL('./', url).pathname,
+    attach: (id, port) => post({ type: RELAY_ATTACH, id }, [port]),
+    onReattach(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    reload: (base) => post({ type: RELAY_RELOAD, base }),
+    dispose() {
+      window.removeEventListener('message', onRelayMessage);
+      listeners.clear();
+      frame.remove();
+    },
+  };
+}

package/src/worker.ts

@@ -0,0 +1,25 @@
+/**
+ * Small helpers shared by the page-side transports and the relay page.
+ */
+import { reloadChannelName } from '@seanhogg/builderforce-webcontainers-core';
+
+/** Resolve once the registration has an active worker. */
+export function waitForActive(registration: ServiceWorkerRegistration): Promise<ServiceWorker> {
+  if (registration.active) return Promise.resolve(registration.active);
+  const installing = registration.installing ?? registration.waiting;
+  if (!installing) return Promise.reject(new Error('The preview service worker did not install.'));
+  return new Promise((resolve, reject) => {
+    installing.addEventListener('statechange', () => {
+      if (installing.state === 'activated' && registration.active) resolve(registration.active);
+      if (installing.state === 'redundant') reject(new Error('The preview service worker failed to install.'));
+    });
+  });
+}
+
+/** Reload every frame (on this origin) showing the preview served at `base`. */
+export function broadcastReload(base: string): void {
+  if (typeof BroadcastChannel === 'undefined') return;
+  const channel = new BroadcastChannel(reloadChannelName(base));
+  channel.postMessage('reload');
+  channel.close();
+}