@vielzeug/sandbox 2.0.0 → 3.0.0

package/dist/_policy.js

@@ -1,52 +1,60 @@
 import { SandboxConfigurationError as e } from "./errors.js";
 //#region src/_policy.ts
-var t = /^[A-Za-z][A-Za-z0-9_-]*$/, n = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/, r = /^[A-Za-z0-9+/_-]+={0,2}$/;
-function i(t, n) {
+var t = 5e3, n = /^[A-Za-z][A-Za-z0-9_-]*$/, r = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/, i = /^[A-Za-z0-9+/_-]+={0,2}$/;
+function a(t, n) {
 	throw new e(`${t} is invalid: ${String(n)}`);
 }
-function a(e, t) {
+function o(e, t) {
+	if (typeof e != "string") return a(t, e);
 	let n;
 	try {
 		n = new URL(e);
 	} catch {
-		return i(t, e);
+		return a(t, e);
 	}
-	return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password || n.pathname !== "/" || n.search || n.hash ? i(t, e) : n.origin;
+	return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password || n.pathname !== "/" || n.search || n.hash ? a(t, e) : n.origin;
 }
-function o(e, t) {
-	return (e ?? []).map((e) => a(e, t));
+function s(e, t) {
+	return e === void 0 ? [] : Array.isArray(e) ? e.map((e) => o(e, t)) : a(t, e);
 }
-function s(e) {
+function c(e) {
+	if (typeof e != "string") return a("scripts", e);
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
-		return i("scripts", e);
+		return a("scripts", e);
 	}
-	return t.protocol !== "http:" && t.protocol !== "https:" ? i("scripts", e) : t.href;
+	return t.protocol !== "http:" && t.protocol !== "https:" ? a("scripts", e) : t.href;
 }
-function c(e) {
-	let n = {};
-	for (let [r, a] of Object.entries(e ?? {})) (!t.test(r) || typeof a != "string") && i("namedStyles", r), n[r] = a;
-	return n;
+function l(e) {
+	if (e === void 0) return {};
+	if (typeof e != "object" || !e || Array.isArray(e)) return a("styles", e);
+	let t = {};
+	for (let [r, i] of Object.entries(e)) (!n.test(r) || typeof i != "string") && a("styles", r), t[r] = i;
+	return t;
 }
-function l(e = {}) {
+function u(e = {}) {
+	(typeof e != "object" || !e || Array.isArray(e)) && a("options", e);
 	let t = e.lang ?? "en";
-	n.test(t) || i("lang", t), e.nonce !== void 0 && (!r.test(e.nonce) || e.nonce.length === 0) && i("nonce", e.nonce), e.title !== void 0 && typeof e.title != "string" && i("title", e.title);
-	let a = (e.scripts ?? []).map(s);
+	r.test(t) || a("lang", t), e.nonce !== void 0 && (!i.test(e.nonce) || e.nonce.length === 0) && a("nonce", e.nonce), e.title !== void 0 && typeof e.title != "string" && a("title", e.title);
+	let n = e.readyTimeout, o = n ?? 5e3;
+	n !== void 0 && (n === null || typeof n != "number" || !Number.isFinite(n) || n <= 0 || n > 2 ** 31 - 1) && a("readyTimeout", n), e.scripts !== void 0 && !Array.isArray(e.scripts) && a("scripts", e.scripts);
+	let u = (e.scripts ?? []).map(c);
 	return {
-		allowedFontOrigins: o(e.allowedFontOrigins, "allowedFontOrigins"),
-		allowedImageOrigins: o(e.allowedImageOrigins, "allowedImageOrigins"),
-		allowedScriptOrigins: o(e.allowedScriptOrigins, "allowedScriptOrigins"),
-		allowedStyleOrigins: o(e.allowedStyleOrigins, "allowedStyleOrigins"),
+		allowedFontOrigins: s(e.allowedFontOrigins, "allowedFontOrigins"),
+		allowedImageOrigins: s(e.allowedImageOrigins, "allowedImageOrigins"),
+		allowedScriptOrigins: s(e.allowedScriptOrigins, "allowedScriptOrigins"),
+		allowedStyleOrigins: s(e.allowedStyleOrigins, "allowedStyleOrigins"),
 		lang: t,
-		namedStyles: c(e.namedStyles),
 		nonce: e.nonce,
-		scripts: a,
+		readyTimeout: o,
+		scripts: u,
+		styles: l(e.styles),
 		title: e.title ?? ""
 	};
 }
-function u(e) {
+function d(e) {
 	let t = [
 		"'unsafe-inline'",
 		...e.nonce ? [`'nonce-${e.nonce}'`] : [],
@@ -65,6 +73,6 @@ function u(e) {
 	].join("; ");
 }
 //#endregion
-export { u as buildCspFromOptions, l as normalizeSandboxOptions };
+export { t as DEFAULT_READY_TIMEOUT_MS, d as buildCspFromOptions, u as normalizeSandboxOptions };
 
 //# sourceMappingURL=_policy.js.map

package/dist/_policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"_policy.js","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import type { SandboxOptions } from './types.js';\n\nimport { SandboxConfigurationError } from './errors.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  namedStyles: Record<string, string>;\n  nonce: string | undefined;\n  scripts: string[];\n  title: string;\n}\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: string, field: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  return (values ?? []).map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles ?? {})) {\n    if (!ID.test(id) || typeof css !== 'string') fail('namedStyles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    namedStyles: normalizeStyles(options.namedStyles),\n    nonce: options.nonce,\n    scripts,\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n"],"mappings":";;AAgBA,IAAM,IAAK,4BACL,IAAO,yCACP,IAAQ;AAEd,SAAS,EAAK,GAAe,GAAuB;CAClD,MAAM,IAAI,EAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG;AAC7E;AAEA,SAAS,EAAgB,GAAe,GAAuB;CAC7D,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,GAAO,CAAK;CAC1B;CAaA,OAVG,EAAI,aAAa,WAAW,EAAI,aAAa,YAC9C,EAAI,YACJ,EAAI,YACJ,EAAI,aAAa,OACjB,EAAI,UACJ,EAAI,OAEG,EAAK,GAAO,CAAK,IAGnB,EAAI;AACb;AAEA,SAAS,EAAiB,GAA8B,GAAyB;CAC/E,QAAQ,KAAU,CAAC,EAAA,CAAG,KAAK,MAAU,EAAgB,GAAO,CAAK,CAAC;AACpE;AAEA,SAAS,EAAgB,GAAuB;CAC9C,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,WAAW,CAAK;CAC9B;CAIA,OAFI,EAAI,aAAa,WAAW,EAAI,aAAa,WAAiB,EAAK,WAAW,CAAK,IAEhF,EAAI;AACb;AAEA,SAAS,EAAgB,GAAoE;CAC3F,IAAM,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAAC,GAAI,MAAQ,OAAO,QAAQ,KAAU,CAAC,CAAC,GAGjD,CAFI,CAAC,EAAG,KAAK,CAAE,KAAK,OAAO,KAAQ,aAAU,EAAK,eAAe,CAAE,GAEnE,EAAW,KAAM;CAGnB,OAAO;AACT;AAEA,SAAgB,EAAwB,IAA0B,CAAC,GAA6B;CAC9F,IAAM,IAAO,EAAQ,QAAQ;CAQ7B,AANK,EAAK,KAAK,CAAI,KAAG,EAAK,QAAQ,CAAI,GAEnC,EAAQ,UAAU,KAAA,MAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,KAAK,EAAQ,MAAM,WAAW,MACzF,EAAK,SAAS,EAAQ,KAAK,GAGzB,EAAQ,UAAU,KAAA,KAAa,OAAO,EAAQ,SAAU,YAAU,EAAK,SAAS,EAAQ,KAAK;CAEjG,IAAM,KAAW,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,CAAe;CAE3D,OAAO;EACL,oBAAoB,EAAiB,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,EAAiB,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,aAAa,EAAgB,EAAQ,WAAW;EAChD,OAAO,EAAQ;EACf;EACA,OAAO,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,EAAoB,GAA2C;CAC7E,IAAM,IAAgB;EACpB;EACA,GAAI,EAAQ,QAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAG,EAAQ;EACX,GAAG,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJ,IAAe,CAAC,mBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3E,IAAe,CAAC,SAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjE,IAAc,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAc;EACd,aAAa;EACb,WAAW;EACX,YAAY;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb"}
+{"version":3,"file":"_policy.js","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":";;AAgBA,IAAa,IAA2B,KAElC,IAAK,4BACL,IAAO,yCACP,IAAQ;AAEd,SAAS,EAAK,GAAe,GAAuB;CAClD,MAAM,IAAI,EAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG;AAC7E;AAEA,SAAS,EAAgB,GAAgB,GAAuB;CAC9D,IAAI,OAAO,KAAU,UAAU,OAAO,EAAK,GAAO,CAAK;CAEvD,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,GAAO,CAAK;CAC1B;CAaA,OAVG,EAAI,aAAa,WAAW,EAAI,aAAa,YAC9C,EAAI,YACJ,EAAI,YACJ,EAAI,aAAa,OACjB,EAAI,UACJ,EAAI,OAEG,EAAK,GAAO,CAAK,IAGnB,EAAI;AACb;AAEA,SAAS,EAAiB,GAA8B,GAAyB;CAI/E,OAHI,MAAW,KAAA,IAAkB,CAAC,IAC7B,MAAM,QAAQ,CAAM,IAElB,EAAO,KAAK,MAAU,EAAgB,GAAO,CAAK,CAAC,IAFvB,EAAK,GAAO,CAAM;AAGvD;AAEA,SAAS,EAAgB,GAAwB;CAC/C,IAAI,OAAO,KAAU,UAAU,OAAO,EAAK,WAAW,CAAK;CAE3D,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,WAAW,CAAK;CAC9B;CAIA,OAFI,EAAI,aAAa,WAAW,EAAI,aAAa,WAAiB,EAAK,WAAW,CAAK,IAEhF,EAAI;AACb;AAEA,SAAS,EAAgB,GAAoE;CAC3F,IAAI,MAAW,KAAA,GAAW,OAAO,CAAC;CAClC,IAAI,OAAO,KAAW,aAAY,KAAmB,MAAM,QAAQ,CAAM,GAAG,OAAO,EAAK,UAAU,CAAM;CAExG,IAAM,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAAC,GAAI,MAAQ,OAAO,QAAQ,CAAM,GAG3C,CAFI,CAAC,EAAG,KAAK,CAAE,KAAK,OAAO,KAAQ,aAAU,EAAK,UAAU,CAAE,GAE9D,EAAW,KAAM;CAGnB,OAAO;AACT;AAEA,SAAgB,EAAwB,IAA0B,CAAC,GAA6B;CAC9F,CAAI,OAAO,KAAY,aAAY,KAAoB,MAAM,QAAQ,CAAO,MAAG,EAAK,WAAW,CAAO;CAEtG,IAAM,IAAO,EAAQ,QAAQ;CAQ7B,AANK,EAAK,KAAK,CAAI,KAAG,EAAK,QAAQ,CAAI,GAEnC,EAAQ,UAAU,KAAA,MAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,KAAK,EAAQ,MAAM,WAAW,MACzF,EAAK,SAAS,EAAQ,KAAK,GAGzB,EAAQ,UAAU,KAAA,KAAa,OAAO,EAAQ,SAAU,YAAU,EAAK,SAAS,EAAQ,KAAK;CAEjG,IAAM,IAAkB,EAAQ,cAC1B,IAAe,KAAA;CAarB,AAVE,MAAoB,KAAA,MACnB,MAAoB,QACnB,OAAO,KAAoB,YAC3B,CAAC,OAAO,SAAS,CAAe,KAChC,KAAmB,KACnB,IAAkB,KAAK,KAAK,MAE9B,EAAK,gBAAgB,CAAe,GAGlC,EAAQ,YAAY,KAAA,KAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,KAAG,EAAK,WAAW,EAAQ,OAAO;CAErG,IAAM,KAAW,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,CAAe;CAE3D,OAAO;EACL,oBAAoB,EAAiB,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,EAAiB,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,OAAO,EAAQ;EACf;EACA;EACA,QAAQ,EAAgB,EAAQ,MAAM;EACtC,OAAO,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,EAAoB,GAA2C;CAC7E,IAAM,IAAgB;EACpB;EACA,GAAI,EAAQ,QAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAG,EAAQ;EACX,GAAG,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJ,IAAe,CAAC,mBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3E,IAAe,CAAC,SAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjE,IAAc,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAc;EACd,aAAa;EACb,WAAW;EACX,YAAY;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb"}

package/dist/_protocol.cjs

@@ -1,2 +1,2 @@
-var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update`,o=`state-update-all`,s=`style-patch`;function c(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function l(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function u(e,t){return{...t,channel:e.channel,generation:e.generation}}exports.MSG_CUSTOM=e,exports.MSG_ERROR=t,exports.MSG_HTML_REPLACE=n,exports.MSG_READY=r,exports.MSG_RESIZE=i,exports.MSG_STATE_UPDATE=a,exports.MSG_STATE_UPDATE_ALL=o,exports.MSG_STYLE_PATCH=s,exports.createChannel=l,exports.envelope=u,exports.isProtocolMessage=c;
+var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update-all`,o=`style-patch`;function s(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function c(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function l(e,t){return{...t,channel:e.channel,generation:e.generation}}exports.MSG_CUSTOM=e,exports.MSG_ERROR=t,exports.MSG_HTML_REPLACE=n,exports.MSG_READY=r,exports.MSG_RESIZE=i,exports.MSG_STATE_UPDATE_ALL=a,exports.MSG_STYLE_PATCH=o,exports.createChannel=c,exports.envelope=l,exports.isProtocolMessage=s;
 //# sourceMappingURL=_protocol.cjs.map

package/dist/_protocol.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.cjs","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE = 'state-update';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAmB,eACnB,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,EAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,GAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,EAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}
+{"version":3,"file":"_protocol.cjs","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,EAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,GAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,EAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}

package/dist/_protocol.d.ts

@@ -3,7 +3,6 @@ export declare const MSG_ERROR = "error";
 export declare const MSG_HTML_REPLACE = "html-replace";
 export declare const MSG_READY = "ready";
 export declare const MSG_RESIZE = "resize";
-export declare const MSG_STATE_UPDATE = "state-update";
 export declare const MSG_STATE_UPDATE_ALL = "state-update-all";
 export declare const MSG_STYLE_PATCH = "style-patch";
 export interface BridgeBootstrap {

package/dist/_protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.d.ts","sourceRoot":"","sources":["../src/_protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,GAAG,KAAK,IAAI,eAAe,CAUtG;AAED,wBAAgB,aAAa,IAAI,MAAM,CAMtC;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAEtG"}
+{"version":3,"file":"_protocol.d.ts","sourceRoot":"","sources":["../src/_protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,GAAG,KAAK,IAAI,eAAe,CAUtG;AAED,wBAAgB,aAAa,IAAI,MAAM,CAMtC;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAEtG"}

package/dist/_protocol.js

@@ -1,14 +1,14 @@
 //#region src/_protocol.ts
-var e = "custom", t = "error", n = "html-replace", r = "ready", i = "resize", a = "state-update", o = "state-update-all", s = "style-patch";
-function c(e, t) {
+var e = "custom", t = "error", n = "html-replace", r = "ready", i = "resize", a = "state-update-all", o = "style-patch";
+function s(e, t) {
 	return typeof e == "object" && !!e && typeof e.channel == "string" && e.channel === t.channel && typeof e.generation == "number" && e.generation === t.generation && typeof e.type == "string";
 }
-function l() {
+function c() {
 	if (typeof crypto.randomUUID == "function") return crypto.randomUUID();
 	let e = crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(4));
 	return Array.from(e, (e) => e.toString(16).padStart(8, "0")).join("");
 }
-function u(e, t) {
+function l(e, t) {
 	return {
 		...t,
 		channel: e.channel,
@@ -16,6 +16,6 @@ function u(e, t) {
 	};
 }
 //#endregion
-export { e as MSG_CUSTOM, t as MSG_ERROR, n as MSG_HTML_REPLACE, r as MSG_READY, i as MSG_RESIZE, a as MSG_STATE_UPDATE, o as MSG_STATE_UPDATE_ALL, s as MSG_STYLE_PATCH, l as createChannel, u as envelope, c as isProtocolMessage };
+export { e as MSG_CUSTOM, t as MSG_ERROR, n as MSG_HTML_REPLACE, r as MSG_READY, i as MSG_RESIZE, a as MSG_STATE_UPDATE_ALL, o as MSG_STYLE_PATCH, c as createChannel, l as envelope, s as isProtocolMessage };
 
 //# sourceMappingURL=_protocol.js.map

package/dist/_protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.js","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE = 'state-update';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":";AAAA,IAAa,IAAa,UACb,IAAY,SACZ,IAAmB,gBACnB,IAAY,SACZ,IAAa,UACb,IAAmB,gBACnB,IAAuB,oBACvB,IAAkB;AAS/B,SAAgB,EAAkB,GAAgB,GAAsD;CACtG,OACE,OAAO,KAAU,cACjB,KACA,OAAQ,EAAgC,WAAY,YACnD,EAA8B,YAAY,EAAU,WACrD,OAAQ,EAAmC,cAAe,YACzD,EAAiC,eAAe,EAAU,cAC3D,OAAQ,EAA6B,QAAS;AAElD;AAEA,SAAgB,IAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAM,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAK,IAAQ,MAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,EAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAG;EAAS,SAAS,EAAU;EAAS,YAAY,EAAU;CAAW;AACpF"}
+{"version":3,"file":"_protocol.js","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":";AAAA,IAAa,IAAa,UACb,IAAY,SACZ,IAAmB,gBACnB,IAAY,SACZ,IAAa,UACb,IAAuB,oBACvB,IAAkB;AAS/B,SAAgB,EAAkB,GAAgB,GAAsD;CACtG,OACE,OAAO,KAAU,cACjB,KACA,OAAQ,EAAgC,WAAY,YACnD,EAA8B,YAAY,EAAU,WACrD,OAAQ,EAAmC,cAAe,YACzD,EAAiC,eAAe,EAAU,cAC3D,OAAQ,EAA6B,QAAS;AAElD;AAEA,SAAgB,IAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAM,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAK,IAAQ,MAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,EAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAG;EAAS,SAAS,EAAU;EAAS,YAAY,EAAU;CAAW;AACpF"}

package/dist/_runtime.cjs

@@ -1,2 +1,2 @@
-const e=require("./errors.cjs"),t=require("./_policy.cjs"),n=require("./_document.cjs");require("./_dev.cjs");const r=require("./_protocol.cjs");var i=5e3;function a(a,o={}){let s=t.normalizeSandboxOptions(o),c=r.createChannel(),l={...s.namedStyles},u=new Set,d=new AbortController,f=null,p=!1,m=!1,h=0,g=null,_=null,v,y=new Promise(e=>{v=e});function b(){return{channel:c,generation:h}}function x(){g!==null&&(clearTimeout(g),g=null)}function S(){x(),_?.resolve(),_=null,m=!1}function C(e){for(let t of u)t(e)}function w(e){if(!f||e.source!==f.contentWindow)return;let t=b();if(r.isProtocolMessage(e.data,t))switch(e.data.type){case r.MSG_CUSTOM:typeof e.data.event==`string`&&C({detail:e.data.detail,event:e.data.event,type:r.MSG_CUSTOM});break;case r.MSG_ERROR:typeof e.data.message==`string`&&C({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:r.MSG_ERROR});break;case r.MSG_READY:S(),v(),m=!0;break;case r.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&C({height:e.data.height,type:r.MSG_RESIZE})}}function T(){return f||(f=document.createElement(`iframe`),f.setAttribute(`sandbox`,`allow-scripts`),f.setAttribute(`referrerpolicy`,`no-referrer`),f.dataset.sandboxChannel=c,a.appendChild(f),window.addEventListener(`message`,w),f)}function E(){p||(p=!0,S(),d.abort(),v(),f&&=(window.removeEventListener(`message`,w),f.remove(),null),u.clear())}function D(e){return p?()=>{}:(u.add(e),()=>u.delete(e))}function O(t,r){if(p||r?.signal?.aborted)return Promise.resolve();t.trim(),S(),h+=1;let a=T(),o=b(),c={...s,namedStyles:{...l}};a.dataset.sandboxGeneration=String(h),a.srcdoc=n.buildRuntimeDocument(t,c,o);let u=new Promise((e,t)=>{_={reject:t,resolve:e}});return g=setTimeout(()=>{_&&(_.reject(new e.SandboxTimeoutError(`render() did not receive a 'ready' signal from the sandbox document within ${i}ms. The document is likely missing the bridge script — use buildDocument() to generate documents that include it.`)),_=null,g=null)},i),u}function k(e){f?.contentWindow?.postMessage(r.envelope(b(),e),`*`)}function A(e){p||!m||!f?.contentWindow||k({html:e,type:r.MSG_HTML_REPLACE})}function j(e,t){p||f?.contentWindow&&k({key:e,type:r.MSG_STATE_UPDATE,value:t})}function M(e){p||f?.contentWindow&&k({record:e,type:r.MSG_STATE_UPDATE_ALL})}function N(e,t){p||(l[e]=t,m&&f?.contentWindow&&k({css:t,id:e,type:r.MSG_STYLE_PATCH}))}return{get disposalSignal(){return d.signal},dispose:E,get disposed(){return p},onMessage:D,ready:y,render:O,replaceBody:A,setState:j,setStateAll:M,[Symbol.dispose](){E()},updateStyle:N}}exports.createSandbox=a;
+require("./_dev.cjs");const e=require("./errors.cjs"),t=require("./_policy.cjs"),n=require("./_document.cjs"),r=require("./_protocol.cjs");function i(i,a={}){let o=t.normalizeSandboxOptions(a),s=r.createChannel(),c={...o.styles},l=new Set,u=new AbortController,d=null,f=!1,p=!1,m=0,h=null,g=null;function _(){return{channel:s,generation:m}}function v(){h!==null&&(clearTimeout(h),h=null)}function y(){v(),g?.resolve(),g=null,p=!1}function b(e){for(let t of l)try{t(e)}catch{}}function x(e){if(!d||e.source!==d.contentWindow)return;let t=_();if(r.isProtocolMessage(e.data,t))switch(e.data.type){case r.MSG_CUSTOM:typeof e.data.event==`string`&&b({detail:e.data.detail,event:e.data.event,type:r.MSG_CUSTOM});break;case r.MSG_ERROR:typeof e.data.message==`string`&&b({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:r.MSG_ERROR});break;case r.MSG_READY:y(),p=!0;break;case r.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&b({height:e.data.height,type:r.MSG_RESIZE})}}function S(){return d||(d=document.createElement(`iframe`),d.setAttribute(`sandbox`,`allow-scripts`),d.setAttribute(`referrerpolicy`,`no-referrer`),d.dataset.sandboxChannel=s,i.appendChild(d),window.addEventListener(`message`,x),d)}function C(){f||(f=!0,y(),u.abort(),d&&=(window.removeEventListener(`message`,x),d.remove(),null),l.clear())}function w(e){return f?()=>{}:(l.add(e),()=>l.delete(e))}function T(t){if(f)return Promise.resolve();t.trim(),y(),m+=1;let r=S(),i=_(),a={...o,styles:{...c}};r.dataset.sandboxGeneration=String(m),r.srcdoc=n.buildDocumentFromOptions(t,a,i);let s=new Promise((e,t)=>{g={reject:t,resolve:e}});return h=setTimeout(()=>{g&&(g.reject(new e.SandboxTimeoutError(`render() did not receive a 'ready' signal within ${o.readyTimeout}ms. An injected script may have blocked document initialization.`)),g=null,h=null)},o.readyTimeout),s}function E(e){d?.contentWindow?.postMessage(r.envelope(_(),e),`*`)}function D(e){f||d?.contentWindow&&Object.keys(e).length>0&&E({record:e,type:r.MSG_STATE_UPDATE_ALL})}function O(e){f||p&&d?.contentWindow&&E({html:e,type:r.MSG_HTML_REPLACE})}function k(e,t){f||(c[e]=t,p&&d?.contentWindow&&E({css:t,id:e,type:r.MSG_STYLE_PATCH}))}return{get disposalSignal(){return u.signal},dispose:C,get disposed(){return f},onMessage:w,render:T,replaceBody:O,setState:D,[Symbol.dispose](){C()},updateStyle:k}}exports.createSandbox=i;
 //# sourceMappingURL=_runtime.cjs.map

package/dist/_runtime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import type { SandboxHandle, SandboxMessage, SandboxOptions, Unsubscribe } from './types.js';\n\nimport { devOnly, warn } from './_dev.js';\nimport { buildRuntimeDocument } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n  type BridgeBootstrap,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\n\nconst READY_TIMEOUT_MS = 5000;\n\nexport function createSandbox(container: HTMLElement, options: SandboxOptions = {}): SandboxHandle {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const namedStyles: Record<string, string> = { ...normalized.namedStyles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  let resolveReady!: () => void;\n  const ready = new Promise<void>((resolve) => {\n    resolveReady = resolve;\n  });\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) listener(message);\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        resolveReady();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n    resolveReady();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): Unsubscribe {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string, renderOptions?: { signal?: AbortSignal }): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (renderOptions?.signal?.aborted) return Promise.resolve();\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, namedStyles: { ...namedStyles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildRuntimeDocument(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal from the sandbox document within ${READY_TIMEOUT_MS}ms. ` +\n            'The document is likely missing the bridge script — use buildDocument() to generate documents that include it.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, READY_TIMEOUT_MS);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function setState(key: string, value: unknown): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setState() called before ready — state update may be lost. Await render() first.');\n    }\n\n    send({ key, type: MSG_STATE_UPDATE, value });\n  }\n\n  function setStateAll(record: Record<string, unknown>): void {\n    if (disposed) {\n      warn('setStateAll() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setStateAll() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setStateAll() called before ready — state updates may be lost. Await render() first.');\n    }\n\n    send({ record, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) return;\n\n    devOnly(() => {\n      if (!(id in namedStyles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known namedStyles key.`);\n      }\n    });\n\n    namedStyles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    ready,\n    render,\n    replaceBody,\n    setState,\n    setStateAll,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"iJAqBA,IAAM,EAAmB,IAEzB,SAAgB,EAAc,EAAwB,EAA0B,CAAC,EAAkB,CACjG,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAsC,CAAE,GAAG,EAAW,WAAY,EAClE,EAAY,IAAI,IAChB,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAElF,EACE,EAAQ,IAAI,QAAe,GAAY,CAC3C,EAAe,CACjB,CAAC,EAED,SAAS,GAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,GAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,GAA+B,CACtC,EAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,EAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EAAW,EAAS,CAAO,CACpD,CAEA,SAAS,EAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,EAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,EAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,EAAuB,EACvB,EAAa,EACb,EAAc,GACd,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,GAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,CAAa,EAEzC,EACT,CAEA,SAAS,GAAgB,CACnB,IAEJ,EAAW,GACX,EAAuB,EACvB,EAAW,MAAM,EACjB,EAAa,EAEb,AAGE,KAFA,OAAO,oBAAoB,UAAW,CAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,EAAU,EAAyD,CAS1E,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,EAAO,EAAc,EAAyD,CAOrF,GANI,GAMA,GAAe,QAAQ,QAAS,OAAO,QAAQ,QAAQ,EAEtD,EAAK,KAAK,EAEf,EAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,EAAa,EACvB,EAAY,EAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,YAAa,CAAE,GAAG,CAAY,CAAE,EAEzE,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,qBAAqB,EAAM,EAAiB,CAAS,EAEtE,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,8EAA8E,EAAiB,kHAEjG,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,CAAgB,EAEZ,CACT,CAEA,SAAS,EAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,EAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,EAAY,EAAoB,CACnC,GAMA,CAAC,GAAe,CAAC,GAAQ,eAM7B,EAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,EAAS,EAAa,EAAsB,CAC/C,GAMC,GAAQ,eAUb,EAAK,CAAE,MAAK,KAAM,EAAA,iBAAkB,OAAM,CAAC,CAC7C,CAEA,SAAS,EAAY,EAAuC,CACtD,GAMC,GAAQ,eAUb,EAAK,CAAE,SAAQ,KAAM,EAAA,oBAAqB,CAAC,CAC7C,CAEA,SAAS,EAAY,EAAY,EAAmB,CAC9C,IAQJ,EAAY,GAAM,EAEd,GAAe,GAAQ,eAAe,EAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,UACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,YACA,QACA,SACA,cACA,WACA,cACA,CAAC,OAAO,UAAW,CACjB,EAAQ,CACV,EACA,aACF,CACF"}
+{"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw — remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) warn('setState() called before ready — state updates may be lost. Await render() first.');\n\n    if (Object.keys(update).length > 0) send({ record: update, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"2IAmBA,SAAgB,EACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,GAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,GAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,GAA+B,CACtC,EAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,EAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,EAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,EAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,EAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,EAAuB,EACvB,EAAc,GACd,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,GAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,CAAa,EAEzC,EACT,CAEA,SAAS,GAAgB,CACnB,IAEJ,EAAW,GACX,EAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,CAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,EAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,EAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,EAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,EAAa,EACvB,EAAY,EAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,EAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,EAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,EAAS,EAA8B,CAC1C,GAMC,GAAQ,eAQT,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GAAG,EAAK,CAAE,OAAQ,EAAQ,KAAM,EAAA,oBAAqB,CAAC,CACzF,CAEA,SAAS,EAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,EAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,EAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,EAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,UACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,YACA,SACA,cACA,WACA,CAAC,OAAO,UAAW,CACjB,EAAQ,CACV,EACA,aACF,CACF"}

package/dist/_runtime.d.ts

@@ -1,3 +1,3 @@
 import type { SandboxHandle, SandboxOptions } from './types.js';
-export declare function createSandbox(container: HTMLElement, options?: SandboxOptions): SandboxHandle;
+export declare function createSandbox<State extends object = Record<string, unknown>>(container: HTMLElement, options?: SandboxOptions): SandboxHandle<State>;
 //# sourceMappingURL=_runtime.d.ts.map

package/dist/_runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAe,MAAM,YAAY,CAAC;AAuB7F,wBAAgB,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CA8PjG"}
+{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,wBAAgB,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,SAAS,EAAE,WAAW,EACtB,OAAO,GAAE,cAAmB,GAC3B,aAAa,CAAC,KAAK,CAAC,CAuOtB"}

package/dist/_runtime.js

@@ -1,133 +1,123 @@
+import "./_dev.js";
 import { SandboxTimeoutError as e } from "./errors.js";
 import { normalizeSandboxOptions as t } from "./_policy.js";
-import { buildRuntimeDocument as n } from "./_document.js";
-import "./_dev.js";
-import { MSG_CUSTOM as r, MSG_ERROR as i, MSG_HTML_REPLACE as a, MSG_READY as o, MSG_RESIZE as s, MSG_STATE_UPDATE as c, MSG_STATE_UPDATE_ALL as l, MSG_STYLE_PATCH as u, createChannel as d, envelope as f, isProtocolMessage as p } from "./_protocol.js";
+import { buildDocumentFromOptions as n } from "./_document.js";
+import { MSG_CUSTOM as r, MSG_ERROR as i, MSG_HTML_REPLACE as a, MSG_READY as o, MSG_RESIZE as s, MSG_STATE_UPDATE_ALL as c, MSG_STYLE_PATCH as l, createChannel as u, envelope as d, isProtocolMessage as f } from "./_protocol.js";
 //#region src/_runtime.ts
-var m = 5e3;
-function h(h, g = {}) {
-	let _ = t(g), v = d(), y = { ..._.namedStyles }, b = /* @__PURE__ */ new Set(), x = new AbortController(), S = null, C = !1, w = !1, T = 0, E = null, D = null, O, k = new Promise((e) => {
-		O = e;
-	});
-	function A() {
+function p(p, m = {}) {
+	let h = t(m), g = u(), _ = { ...h.styles }, v = /* @__PURE__ */ new Set(), y = new AbortController(), b = null, x = !1, S = !1, C = 0, w = null, T = null;
+	function E() {
 		return {
-			channel: v,
-			generation: T
+			channel: g,
+			generation: C
 		};
 	}
-	function j() {
-		E !== null && (clearTimeout(E), E = null);
+	function D() {
+		w !== null && (clearTimeout(w), w = null);
 	}
-	function M() {
-		j(), D?.resolve(), D = null, w = !1;
+	function O() {
+		D(), T?.resolve(), T = null, S = !1;
 	}
-	function N(e) {
-		for (let t of b) t(e);
+	function k(e) {
+		for (let t of v) try {
+			t(e);
+		} catch {}
 	}
-	function P(e) {
-		if (!S || e.source !== S.contentWindow) return;
-		let t = A();
-		if (p(e.data, t)) switch (e.data.type) {
+	function A(e) {
+		if (!b || e.source !== b.contentWindow) return;
+		let t = E();
+		if (f(e.data, t)) switch (e.data.type) {
 			case r:
-				typeof e.data.event == "string" && N({
+				typeof e.data.event == "string" && k({
 					detail: e.data.detail,
 					event: e.data.event,
 					type: r
 				});
 				break;
 			case i:
-				typeof e.data.message == "string" && N({
+				typeof e.data.message == "string" && k({
 					message: e.data.message,
 					...typeof e.data.stack == "string" ? { stack: e.data.stack } : {},
 					type: i
 				});
 				break;
 			case o:
-				M(), O(), w = !0;
+				O(), S = !0;
 				break;
-			case s: typeof e.data.height == "number" && Number.isFinite(e.data.height) && e.data.height >= 0 && N({
+			case s: typeof e.data.height == "number" && Number.isFinite(e.data.height) && e.data.height >= 0 && k({
 				height: e.data.height,
 				type: s
 			});
 		}
 	}
-	function F() {
-		return S || (S = document.createElement("iframe"), S.setAttribute("sandbox", "allow-scripts"), S.setAttribute("referrerpolicy", "no-referrer"), S.dataset.sandboxChannel = v, h.appendChild(S), window.addEventListener("message", P), S);
+	function j() {
+		return b || (b = document.createElement("iframe"), b.setAttribute("sandbox", "allow-scripts"), b.setAttribute("referrerpolicy", "no-referrer"), b.dataset.sandboxChannel = g, p.appendChild(b), window.addEventListener("message", A), b);
 	}
-	function I() {
-		C || (C = !0, M(), x.abort(), O(), S &&= (window.removeEventListener("message", P), S.remove(), null), b.clear());
+	function M() {
+		x || (x = !0, O(), y.abort(), b &&= (window.removeEventListener("message", A), b.remove(), null), v.clear());
 	}
-	function L(e) {
-		return C ? () => {} : (b.add(e), () => b.delete(e));
+	function N(e) {
+		return x ? () => {} : (v.add(e), () => v.delete(e));
 	}
-	function R(t, r) {
-		if (C || r?.signal?.aborted) return Promise.resolve();
-		t.trim(), M(), T += 1;
-		let i = F(), a = A(), o = {
-			..._,
-			namedStyles: { ...y }
+	function P(t) {
+		if (x) return Promise.resolve();
+		t.trim(), O(), C += 1;
+		let r = j(), i = E(), a = {
+			...h,
+			styles: { ..._ }
 		};
-		i.dataset.sandboxGeneration = String(T), i.srcdoc = n(t, o, a);
-		let s = new Promise((e, t) => {
-			D = {
+		r.dataset.sandboxGeneration = String(C), r.srcdoc = n(t, a, i);
+		let o = new Promise((e, t) => {
+			T = {
 				reject: t,
 				resolve: e
 			};
 		});
-		return E = setTimeout(() => {
-			D && (D.reject(new e(`render() did not receive a 'ready' signal from the sandbox document within ${m}ms. The document is likely missing the bridge script — use buildDocument() to generate documents that include it.`)), D = null, E = null);
-		}, m), s;
-	}
-	function z(e) {
-		S?.contentWindow?.postMessage(f(A(), e), "*");
+		return w = setTimeout(() => {
+			T && (T.reject(new e(`render() did not receive a 'ready' signal within ${h.readyTimeout}ms. An injected script may have blocked document initialization.`)), T = null, w = null);
+		}, h.readyTimeout), o;
 	}
-	function B(e) {
-		C || !w || !S?.contentWindow || z({
-			html: e,
-			type: a
-		});
+	function F(e) {
+		b?.contentWindow?.postMessage(d(E(), e), "*");
 	}
-	function V(e, t) {
-		C || S?.contentWindow && z({
-			key: e,
-			type: c,
-			value: t
+	function I(e) {
+		x || b?.contentWindow && Object.keys(e).length > 0 && F({
+			record: e,
+			type: c
 		});
 	}
-	function H(e) {
-		C || S?.contentWindow && z({
-			record: e,
-			type: l
+	function L(e) {
+		x || S && b?.contentWindow && F({
+			html: e,
+			type: a
 		});
 	}
-	function U(e, t) {
-		C || (y[e] = t, w && S?.contentWindow && z({
+	function R(e, t) {
+		x || (_[e] = t, S && b?.contentWindow && F({
 			css: t,
 			id: e,
-			type: u
+			type: l
 		}));
 	}
 	return {
 		get disposalSignal() {
-			return x.signal;
+			return y.signal;
 		},
-		dispose: I,
+		dispose: M,
 		get disposed() {
-			return C;
+			return x;
 		},
-		onMessage: L,
-		ready: k,
-		render: R,
-		replaceBody: B,
-		setState: V,
-		setStateAll: H,
+		onMessage: N,
+		render: P,
+		replaceBody: L,
+		setState: I,
 		[Symbol.dispose]() {
-			I();
+			M();
 		},
-		updateStyle: U
+		updateStyle: R
 	};
 }
 //#endregion
-export { h as createSandbox };
+export { p as createSandbox };
 
 //# sourceMappingURL=_runtime.js.map

package/dist/_runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import type { SandboxHandle, SandboxMessage, SandboxOptions, Unsubscribe } from './types.js';\n\nimport { devOnly, warn } from './_dev.js';\nimport { buildRuntimeDocument } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n  type BridgeBootstrap,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\n\nconst READY_TIMEOUT_MS = 5000;\n\nexport function createSandbox(container: HTMLElement, options: SandboxOptions = {}): SandboxHandle {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const namedStyles: Record<string, string> = { ...normalized.namedStyles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  let resolveReady!: () => void;\n  const ready = new Promise<void>((resolve) => {\n    resolveReady = resolve;\n  });\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) listener(message);\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        resolveReady();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n    resolveReady();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): Unsubscribe {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string, renderOptions?: { signal?: AbortSignal }): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (renderOptions?.signal?.aborted) return Promise.resolve();\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, namedStyles: { ...namedStyles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildRuntimeDocument(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal from the sandbox document within ${READY_TIMEOUT_MS}ms. ` +\n            'The document is likely missing the bridge script — use buildDocument() to generate documents that include it.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, READY_TIMEOUT_MS);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function setState(key: string, value: unknown): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setState() called before ready — state update may be lost. Await render() first.');\n    }\n\n    send({ key, type: MSG_STATE_UPDATE, value });\n  }\n\n  function setStateAll(record: Record<string, unknown>): void {\n    if (disposed) {\n      warn('setStateAll() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setStateAll() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setStateAll() called before ready — state updates may be lost. Await render() first.');\n    }\n\n    send({ record, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) return;\n\n    devOnly(() => {\n      if (!(id in namedStyles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known namedStyles key.`);\n      }\n    });\n\n    namedStyles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    ready,\n    render,\n    replaceBody,\n    setState,\n    setStateAll,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";;;;;;AAqBA,IAAM,IAAmB;AAEzB,SAAgB,EAAc,GAAwB,IAA0B,CAAC,GAAkB;CACjG,IAAM,IAAa,EAAwB,CAAO,GAC5C,IAAU,EAAc,GACxB,IAAsC,EAAE,GAAG,EAAW,YAAY,GAClE,oBAAY,IAAI,IAAuC,GACvD,IAAa,IAAI,gBAAgB,GACnC,IAAmC,MACnC,IAAW,IACX,IAAc,IACd,IAAa,GACb,IAAqD,MACrD,IAAkF,MAElF,GACE,IAAQ,IAAI,SAAe,MAAY;EAC3C,IAAe;CACjB,CAAC;CAED,SAAS,IAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,IAA0B;EAC7B,MAAiB,SAErB,aAAa,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,IAA+B;EAItC,AAHA,EAAkB,GAClB,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,EAAU,GAA+B;EAChD,KAAK,IAAM,KAAY,GAAW,EAAS,CAAO;CACpD;CAEA,SAAS,EAAc,GAA2B;EAChD,IAAI,CAAC,KAAU,EAAM,WAAW,EAAO,eAAe;EAEtD,IAAM,IAAY,EAAiB;EAE9B,MAAkB,EAAM,MAAM,CAAS,GAE5C,QAAQ,EAAM,KAAK,MAAnB;GACE,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,SAAU,YAC9B,EAAU;KAAE,QAAQ,EAAM,KAAK;KAAQ,OAAO,EAAM,KAAK;KAAO,MAAM;IAAW,CAAC;IAGpF;GACF,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,WAAY,YAChC,EAAU;KACR,SAAS,EAAM,KAAK;KACpB,GAAI,OAAO,EAAM,KAAK,SAAU,WAAW,EAAE,OAAO,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAM;IACR,CAAC;IAGH;GACF,KAAK;IAGH,AAFA,EAAuB,GACvB,EAAa,GACb,IAAc;IACd;GACF,KAAK,GACH,AAAI,OAAO,EAAM,KAAK,UAAW,YAAY,OAAO,SAAS,EAAM,KAAK,MAAM,KAAK,EAAM,KAAK,UAAU,KACtG,EAAU;IAAE,QAAQ,EAAM,KAAK;IAAQ,MAAM;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,IAAkC;EAUzC,OATI,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxC,EAAO,aAAa,WAAW,eAAe,GAC9C,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiB,GAChC,EAAU,YAAY,CAAM,GAC5B,OAAO,iBAAiB,WAAW,CAAa,GAEzC;CACT;CAEA,SAAS,IAAgB;EACnB,MAEJ,IAAW,IACX,EAAuB,GACvB,EAAW,MAAM,GACjB,EAAa,GAEb,AAGE,OAFA,OAAO,oBAAoB,WAAW,CAAa,GACnD,EAAO,OAAO,GACL,OAGX,EAAU,MAAM;CAClB;CAEA,SAAS,EAAU,GAAyD;EAS1E,OARI,UAGW,CAAC,KAGhB,EAAU,IAAI,CAAO,SAER,EAAU,OAAO,CAAO;CACvC;CAEA,SAAS,EAAO,GAAc,GAAyD;EAOrF,IANI,KAMA,GAAe,QAAQ,SAAS,OAAO,QAAQ,QAAQ;EAK3D,AAHK,EAAK,KAAK,GAEf,EAAuB,GACvB,KAAc;EAEd,IAAM,IAAU,EAAa,GACvB,IAAY,EAAiB,GAC7B,IAAkB;GAAE,GAAG;GAAY,aAAa,EAAE,GAAG,EAAY;EAAE;EAGzE,AADA,EAAQ,QAAQ,oBAAoB,OAAO,CAAU,GACrD,EAAQ,SAAS,EAAqB,GAAM,GAAiB,CAAS;EAEtE,IAAM,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GACzB,MAEL,EAAc,OACZ,IAAI,EACF,8EAA8E,EAAiB,kHAEjG,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAG,CAAgB,GAEZ;CACT;CAEA,SAAS,EAAK,GAAwC;EACpD,GAAQ,eAAe,YAAY,EAAS,EAAiB,GAAG,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,EAAY,GAAoB;EACnC,KAMA,CAAC,KAAe,CAAC,GAAQ,iBAM7B,EAAK;GAAE;GAAM,MAAM;EAAiB,CAAC;CACvC;CAEA,SAAS,EAAS,GAAa,GAAsB;EAC/C,KAMC,GAAQ,iBAUb,EAAK;GAAE;GAAK,MAAM;GAAkB;EAAM,CAAC;CAC7C;CAEA,SAAS,EAAY,GAAuC;EACtD,KAMC,GAAQ,iBAUb,EAAK;GAAE;GAAQ,MAAM;EAAqB,CAAC;CAC7C;CAEA,SAAS,EAAY,GAAY,GAAmB;EAC9C,MAQJ,EAAY,KAAM,GAEd,KAAe,GAAQ,iBAAe,EAAK;GAAE;GAAK;GAAI,MAAM;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAO,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAO;EACT;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,EAAQ;EACV;EACA;CACF;AACF"}
+{"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw — remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) warn('setState() called before ready — state updates may be lost. Await render() first.');\n\n    if (Object.keys(update).length > 0) send({ record: update, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";;;;;;AAmBA,SAAgB,EACd,GACA,IAA0B,CAAC,GACL;CACtB,IAAM,IAAa,EAAwB,CAAO,GAC5C,IAAU,EAAc,GACxB,IAAiC,EAAE,GAAG,EAAW,OAAO,GACxD,oBAAY,IAAI,IAAuC,GACvD,IAAa,IAAI,gBAAgB,GACnC,IAAmC,MACnC,IAAW,IACX,IAAc,IACd,IAAa,GACb,IAAqD,MACrD,IAAkF;CAEtF,SAAS,IAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,IAA0B;EAC7B,MAAiB,SAErB,aAAa,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,IAA+B;EAItC,AAHA,EAAkB,GAClB,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,EAAU,GAA+B;EAChD,KAAK,IAAM,KAAY,GACrB,IAAI;GACF,EAAS,CAAO;EAClB,QAAQ,CAER;CAEJ;CAEA,SAAS,EAAc,GAA2B;EAChD,IAAI,CAAC,KAAU,EAAM,WAAW,EAAO,eAAe;EAEtD,IAAM,IAAY,EAAiB;EAE9B,MAAkB,EAAM,MAAM,CAAS,GAE5C,QAAQ,EAAM,KAAK,MAAnB;GACE,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,SAAU,YAC9B,EAAU;KAAE,QAAQ,EAAM,KAAK;KAAQ,OAAO,EAAM,KAAK;KAAO,MAAM;IAAW,CAAC;IAGpF;GACF,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,WAAY,YAChC,EAAU;KACR,SAAS,EAAM,KAAK;KACpB,GAAI,OAAO,EAAM,KAAK,SAAU,WAAW,EAAE,OAAO,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAM;IACR,CAAC;IAGH;GACF,KAAK;IAEH,AADA,EAAuB,GACvB,IAAc;IACd;GACF,KAAK,GACH,AAAI,OAAO,EAAM,KAAK,UAAW,YAAY,OAAO,SAAS,EAAM,KAAK,MAAM,KAAK,EAAM,KAAK,UAAU,KACtG,EAAU;IAAE,QAAQ,EAAM,KAAK;IAAQ,MAAM;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,IAAkC;EAUzC,OATI,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxC,EAAO,aAAa,WAAW,eAAe,GAC9C,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiB,GAChC,EAAU,YAAY,CAAM,GAC5B,OAAO,iBAAiB,WAAW,CAAa,GAEzC;CACT;CAEA,SAAS,IAAgB;EACnB,MAEJ,IAAW,IACX,EAAuB,GACvB,EAAW,MAAM,GAEjB,AAGE,OAFA,OAAO,oBAAoB,WAAW,CAAa,GACnD,EAAO,OAAO,GACL,OAGX,EAAU,MAAM;CAClB;CAEA,SAAS,EAAU,GAAwD;EASzE,OARI,UAGW,CAAC,KAGhB,EAAU,IAAI,CAAO,SAER,EAAU,OAAO,CAAO;CACvC;CAEA,SAAS,EAAO,GAA6B;EAC3C,IAAI,GAGF,OAAO,QAAQ,QAAQ;EAMzB,AAHK,EAAK,KAAK,GAEf,EAAuB,GACvB,KAAc;EAEd,IAAM,IAAU,EAAa,GACvB,IAAY,EAAiB,GAC7B,IAAkB;GAAE,GAAG;GAAY,QAAQ,EAAE,GAAG,EAAO;EAAE;EAG/D,AADA,EAAQ,QAAQ,oBAAoB,OAAO,CAAU,GACrD,EAAQ,SAAS,EAAyB,GAAM,GAAiB,CAAS;EAE1E,IAAM,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GACzB,MAEL,EAAc,OACZ,IAAI,EACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAG,EAAW,YAAY,GAEnB;CACT;CAEA,SAAS,EAAK,GAAwC;EACpD,GAAQ,eAAe,YAAY,EAAS,EAAiB,GAAG,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,EAAS,GAA8B;EAC1C,KAMC,GAAQ,iBAQT,OAAO,KAAK,CAAM,CAAC,CAAC,SAAS,KAAG,EAAK;GAAE,QAAQ;GAAQ,MAAM;EAAqB,CAAC;CACzF;CAEA,SAAS,EAAY,GAAoB;EACnC,KAMC,KAAgB,GAAQ,iBAM7B,EAAK;GAAE;GAAM,MAAM;EAAiB,CAAC;CACvC;CAEA,SAAS,EAAY,GAAY,GAAmB;EAC9C,MAYJ,EAAO,KAAM,GAET,KAAe,GAAQ,iBAAe,EAAK;GAAE;GAAK;GAAI,MAAM;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAO,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAO;EACT;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,EAAQ;EACV;EACA;CACF;AACF"}

package/dist/errors.cjs

@@ -1,2 +1,2 @@
-var e=class e extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}static is(t){return t instanceof e}},t=class extends e{},n=class extends e{};exports.SandboxConfigurationError=n,exports.SandboxError=e,exports.SandboxTimeoutError=t;
+var e=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},t=class extends e{},n=class extends e{};exports.SandboxConfigurationError=n,exports.SandboxError=e,exports.SandboxTimeoutError=t;
 //# sourceMappingURL=errors.cjs.map

package/dist/errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n\n  static is(err: unknown): err is SandboxError {\n    return err instanceof SandboxError;\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. The document is most likely missing the bridge script —\n * use buildDocument() to generate documents that include it.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":"AACA,IAAa,EAAb,MAAa,UAAqB,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CAEA,OAAO,GAAG,EAAmC,CAC3C,OAAO,aAAe,CACxB,CACF,EAOa,EAAb,cAAyC,CAAa,CAAC,EAG1C,EAAb,cAA+C,CAAa,CAAC"}
+{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":"AACA,IAAa,EAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,EAAb,cAAyC,CAAa,CAAC,EAG1C,EAAb,cAA+C,CAAa,CAAC"}

package/dist/errors.d.ts

@@ -1,12 +1,10 @@
 /** Base class for all sandbox errors. */
 export declare class SandboxError extends Error {
     constructor(message: string, opts?: ErrorOptions);
-    static is(err: unknown): err is SandboxError;
 }
 /**
  * Thrown when render() does not receive a 'ready' signal from the sandbox document
- * within the timeout window. The document is most likely missing the bridge script —
- * use buildDocument() to generate documents that include it.
+ * within the timeout window. An injected script may have blocked document initialization.
  */
 export declare class SandboxTimeoutError extends SandboxError {
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;IAMhD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY;CAG7C;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AAExD,uFAAuF;AACvF,qBAAa,yBAA0B,SAAQ,YAAY;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AAExD,uFAAuF;AACvF,qBAAa,yBAA0B,SAAQ,YAAY;CAAG"}

package/dist/errors.js

@@ -1,11 +1,8 @@
 //#region src/errors.ts
-var e = class e extends Error {
+var e = class extends Error {
 	constructor(e, t) {
 		super(e, t), this.name = new.target.name, Object.setPrototypeOf(this, new.target.prototype);
 	}
-	static is(t) {
-		return t instanceof e;
-	}
 }, t = class extends e {}, n = class extends e {};
 //#endregion
 export { n as SandboxConfigurationError, e as SandboxError, t as SandboxTimeoutError };

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n\n  static is(err: unknown): err is SandboxError {\n    return err instanceof SandboxError;\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. The document is most likely missing the bridge script —\n * use buildDocument() to generate documents that include it.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":";AACA,IAAa,IAAb,MAAa,UAAqB,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAM,GAAS,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;CAEA,OAAO,GAAG,GAAmC;EAC3C,OAAO,aAAe;CACxB;AACF,GAOa,IAAb,cAAyC,EAAa,CAAC,GAG1C,IAAb,cAA+C,EAAa,CAAC"}
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":";AACA,IAAa,IAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAM,GAAS,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAMa,IAAb,cAAyC,EAAa,CAAC,GAG1C,IAAb,cAA+C,EAAa,CAAC"}