@vielzeug/sandbox 2.1.0 → 26.10.0

package/dist/_policy.js

@@ -1,73 +1,2 @@
-import { SandboxConfigurationError as e } from "./errors.js";
-//#region src/_policy.ts
-var t = /^[A-Za-z][A-Za-z0-9_-]*$/, n = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/, r = /^[A-Za-z0-9+/_-]+={0,2}$/;
-function i(t, n) {
-	throw new e(`${t} is invalid: ${String(n)}`);
-}
-function a(e, t) {
-	let n;
-	try {
-		n = new URL(e);
-	} catch {
-		return i(t, e);
-	}
-	return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password || n.pathname !== "/" || n.search || n.hash ? i(t, e) : n.origin;
-}
-function o(e, t) {
-	return (e ?? []).map((e) => a(e, t));
-}
-function s(e) {
-	let t;
-	try {
-		t = new URL(e);
-	} catch {
-		return i("scripts", e);
-	}
-	return t.protocol !== "http:" && t.protocol !== "https:" ? i("scripts", e) : t.href;
-}
-function c(e) {
-	let n = {};
-	for (let [r, a] of Object.entries(e ?? {})) (!t.test(r) || typeof a != "string") && i("namedStyles", r), n[r] = a;
-	return n;
-}
-function l(e = {}) {
-	let t = e.lang ?? "en";
-	n.test(t) || i("lang", t), e.nonce !== void 0 && (!r.test(e.nonce) || e.nonce.length === 0) && i("nonce", e.nonce), e.title !== void 0 && typeof e.title != "string" && i("title", e.title);
-	let a = (e.scripts ?? []).map(s);
-	return {
-		allowedFontOrigins: o(e.allowedFontOrigins, "allowedFontOrigins"),
-		allowedImageOrigins: o(e.allowedImageOrigins, "allowedImageOrigins"),
-		allowedScriptOrigins: o(e.allowedScriptOrigins, "allowedScriptOrigins"),
-		allowedStyleOrigins: o(e.allowedStyleOrigins, "allowedStyleOrigins"),
-		lang: t,
-		namedStyles: c(e.namedStyles),
-		nonce: e.nonce,
-		scripts: a,
-		title: e.title ?? ""
-	};
-}
-function u(e) {
-	let t = [
-		"'unsafe-inline'",
-		...e.nonce ? [`'nonce-${e.nonce}'`] : [],
-		...e.allowedScriptOrigins,
-		...e.scripts.map((e) => new URL(e).origin)
-	].join(" "), n = ["'unsafe-inline'", ...e.allowedStyleOrigins].join(" "), r = ["data:", ...e.allowedImageOrigins].join(" "), i = e.allowedFontOrigins.join(" ") || "'none'";
-	return [
-		"default-src 'none'",
-		`script-src ${t}`,
-		`style-src ${n}`,
-		`img-src ${r}`,
-		`font-src ${i}`,
-		"connect-src 'none'",
-		"form-action 'none'",
-		"base-uri 'none'"
-	].join("; ");
-}
-function d(e = {}) {
-	return u(l(e));
-}
-//#endregion
-export { d as buildCsp, u as buildCspFromOptions, l as normalizeSandboxOptions };
-
+import{SandboxConfigurationError as e}from"./errors.js";var t=5e3,n=/^[A-Za-z][A-Za-z0-9_-]*$/,r=/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/,i=/^[A-Za-z0-9+/_-]+={0,2}$/;function fail(t,n){throw new e(`${t} is invalid: ${String(n)}`)}function normalizeOrigin(e,t){if(typeof e!=`string`)return fail(t,e);let n;try{n=new URL(e)}catch{return fail(t,e)}return n.protocol!==`http:`&&n.protocol!==`https:`||n.username||n.password||n.pathname!==`/`||n.search||n.hash?fail(t,e):n.origin}function normalizeOrigins(e,t){return e===void 0?[]:Array.isArray(e)?e.map(e=>normalizeOrigin(e,t)):fail(t,e)}function normalizeScript(e){if(typeof e!=`string`)return fail(`scripts`,e);let t;try{t=new URL(e)}catch{return fail(`scripts`,e)}return t.protocol!==`http:`&&t.protocol!==`https:`?fail(`scripts`,e):t.href}function normalizeStyles(e){if(e===void 0)return{};if(typeof e!=`object`||!e||Array.isArray(e))return fail(`styles`,e);let t={};for(let[r,i]of Object.entries(e))(!n.test(r)||typeof i!=`string`)&&fail(`styles`,r),t[r]=i;return t}function normalizeSandboxOptions(e={}){(typeof e!=`object`||!e||Array.isArray(e))&&fail(`options`,e);let t=e.lang??`en`;r.test(t)||fail(`lang`,t),e.nonce!==void 0&&(!i.test(e.nonce)||e.nonce.length===0)&&fail(`nonce`,e.nonce),e.title!==void 0&&typeof e.title!=`string`&&fail(`title`,e.title);let n=e.readyTimeout,a=n??5e3;n!==void 0&&(n===null||typeof n!=`number`||!Number.isFinite(n)||n<=0||n>2**31-1)&&fail(`readyTimeout`,n),e.scripts!==void 0&&!Array.isArray(e.scripts)&&fail(`scripts`,e.scripts);let o=(e.scripts??[]).map(normalizeScript);return{allowedFontOrigins:normalizeOrigins(e.allowedFontOrigins,`allowedFontOrigins`),allowedImageOrigins:normalizeOrigins(e.allowedImageOrigins,`allowedImageOrigins`),allowedScriptOrigins:normalizeOrigins(e.allowedScriptOrigins,`allowedScriptOrigins`),allowedStyleOrigins:normalizeOrigins(e.allowedStyleOrigins,`allowedStyleOrigins`),lang:t,nonce:e.nonce,readyTimeout:a,scripts:o,styles:normalizeStyles(e.styles),title:e.title??``}}function buildCspFromOptions(e){let t=[`'unsafe-inline'`,...e.nonce?[`'nonce-${e.nonce}'`]:[],...e.allowedScriptOrigins,...e.scripts.map(e=>new URL(e).origin)].join(` `),n=[`'unsafe-inline'`,...e.allowedStyleOrigins].join(` `),r=[`data:`,...e.allowedImageOrigins].join(` `),i=e.allowedFontOrigins.join(` `)||`'none'`;return[`default-src 'none'`,`script-src ${t}`,`style-src ${n}`,`img-src ${r}`,`font-src ${i}`,`connect-src 'none'`,`form-action 'none'`,`base-uri 'none'`].join(`; `)}export{t as DEFAULT_READY_TIMEOUT_MS,buildCspFromOptions,normalizeSandboxOptions};
 //# sourceMappingURL=_policy.js.map

package/dist/_policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"_policy.js","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  namedStyles: Record<string, string>;\n  nonce: string | undefined;\n  scripts: string[];\n  title: string;\n}\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: string, field: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  return (values ?? []).map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles ?? {})) {\n    if (!ID.test(id) || typeof css !== 'string') fail('namedStyles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    namedStyles: normalizeStyles(options.namedStyles),\n    nonce: options.nonce,\n    scripts,\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":";;AAeA,IAAM,IAAK,4BACL,IAAO,yCACP,IAAQ;AAEd,SAAS,EAAK,GAAe,GAAuB;CAClD,MAAM,IAAI,EAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG;AAC7E;AAEA,SAAS,EAAgB,GAAe,GAAuB;CAC7D,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,GAAO,CAAK;CAC1B;CAaA,OAVG,EAAI,aAAa,WAAW,EAAI,aAAa,YAC9C,EAAI,YACJ,EAAI,YACJ,EAAI,aAAa,OACjB,EAAI,UACJ,EAAI,OAEG,EAAK,GAAO,CAAK,IAGnB,EAAI;AACb;AAEA,SAAS,EAAiB,GAA8B,GAAyB;CAC/E,QAAQ,KAAU,CAAC,EAAA,CAAG,KAAK,MAAU,EAAgB,GAAO,CAAK,CAAC;AACpE;AAEA,SAAS,EAAgB,GAAuB;CAC9C,IAAI;CAEJ,IAAI;EACF,IAAM,IAAI,IAAI,CAAK;CACrB,QAAQ;EACN,OAAO,EAAK,WAAW,CAAK;CAC9B;CAIA,OAFI,EAAI,aAAa,WAAW,EAAI,aAAa,WAAiB,EAAK,WAAW,CAAK,IAEhF,EAAI;AACb;AAEA,SAAS,EAAgB,GAAoE;CAC3F,IAAM,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAAC,GAAI,MAAQ,OAAO,QAAQ,KAAU,CAAC,CAAC,GAGjD,CAFI,CAAC,EAAG,KAAK,CAAE,KAAK,OAAO,KAAQ,aAAU,EAAK,eAAe,CAAE,GAEnE,EAAW,KAAM;CAGnB,OAAO;AACT;AAEA,SAAgB,EAAwB,IAA0B,CAAC,GAA6B;CAC9F,IAAM,IAAO,EAAQ,QAAQ;CAQ7B,AANK,EAAK,KAAK,CAAI,KAAG,EAAK,QAAQ,CAAI,GAEnC,EAAQ,UAAU,KAAA,MAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,KAAK,EAAQ,MAAM,WAAW,MACzF,EAAK,SAAS,EAAQ,KAAK,GAGzB,EAAQ,UAAU,KAAA,KAAa,OAAO,EAAQ,SAAU,YAAU,EAAK,SAAS,EAAQ,KAAK;CAEjG,IAAM,KAAW,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,CAAe;CAE3D,OAAO;EACL,oBAAoB,EAAiB,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,EAAiB,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,EAAiB,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,aAAa,EAAgB,EAAQ,WAAW;EAChD,OAAO,EAAQ;EACf;EACA,OAAO,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,EAAoB,GAA2C;CAC7E,IAAM,IAAgB;EACpB;EACA,GAAI,EAAQ,QAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAG,EAAQ;EACX,GAAG,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJ,IAAe,CAAC,mBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3E,IAAe,CAAC,SAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjE,IAAc,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAc;EACd,aAAa;EACb,WAAW;EACX,YAAY;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,EAAS,IAA0B,CAAC,GAAW;CAC7D,OAAO,EAAoB,EAAwB,CAAO,CAAC;AAC7D"}
+{"version":3,"file":"_policy.js","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":"wDAgBA,IAAa,EAA2B,IAElC,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,EAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb"}

package/dist/_protocol.cjs

@@ -1,2 +1,2 @@
-var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update`,o=`state-update-all`,s=`style-patch`;function c(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function l(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function u(e,t){return{...t,channel:e.channel,generation:e.generation}}exports.MSG_CUSTOM=e,exports.MSG_ERROR=t,exports.MSG_HTML_REPLACE=n,exports.MSG_READY=r,exports.MSG_RESIZE=i,exports.MSG_STATE_UPDATE=a,exports.MSG_STATE_UPDATE_ALL=o,exports.MSG_STYLE_PATCH=s,exports.createChannel=l,exports.envelope=u,exports.isProtocolMessage=c;
+var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update-all`,o=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}exports.MSG_CUSTOM=e,exports.MSG_ERROR=t,exports.MSG_HTML_REPLACE=n,exports.MSG_READY=r,exports.MSG_RESIZE=i,exports.MSG_STATE_UPDATE_ALL=a,exports.MSG_STYLE_PATCH=o,exports.createChannel=createChannel,exports.envelope=envelope,exports.isProtocolMessage=isProtocolMessage;
 //# sourceMappingURL=_protocol.cjs.map

package/dist/_protocol.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.cjs","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE = 'state-update';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAmB,eACnB,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,EAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,GAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,EAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}
+{"version":3,"file":"_protocol.cjs","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}

package/dist/_protocol.d.ts

@@ -3,7 +3,6 @@ export declare const MSG_ERROR = "error";
 export declare const MSG_HTML_REPLACE = "html-replace";
 export declare const MSG_READY = "ready";
 export declare const MSG_RESIZE = "resize";
-export declare const MSG_STATE_UPDATE = "state-update";
 export declare const MSG_STATE_UPDATE_ALL = "state-update-all";
 export declare const MSG_STYLE_PATCH = "style-patch";
 export interface BridgeBootstrap {

package/dist/_protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.d.ts","sourceRoot":"","sources":["../src/_protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,GAAG,KAAK,IAAI,eAAe,CAUtG;AAED,wBAAgB,aAAa,IAAI,MAAM,CAMtC;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAEtG"}
+{"version":3,"file":"_protocol.d.ts","sourceRoot":"","sources":["../src/_protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,GAAG,KAAK,IAAI,eAAe,CAUtG;AAED,wBAAgB,aAAa,IAAI,MAAM,CAMtC;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAEtG"}

package/dist/_protocol.js

@@ -1,21 +1,2 @@
-//#region src/_protocol.ts
-var e = "custom", t = "error", n = "html-replace", r = "ready", i = "resize", a = "state-update", o = "state-update-all", s = "style-patch";
-function c(e, t) {
-	return typeof e == "object" && !!e && typeof e.channel == "string" && e.channel === t.channel && typeof e.generation == "number" && e.generation === t.generation && typeof e.type == "string";
-}
-function l() {
-	if (typeof crypto.randomUUID == "function") return crypto.randomUUID();
-	let e = crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(4));
-	return Array.from(e, (e) => e.toString(16).padStart(8, "0")).join("");
-}
-function u(e, t) {
-	return {
-		...t,
-		channel: e.channel,
-		generation: e.generation
-	};
-}
-//#endregion
-export { e as MSG_CUSTOM, t as MSG_ERROR, n as MSG_HTML_REPLACE, r as MSG_READY, i as MSG_RESIZE, a as MSG_STATE_UPDATE, o as MSG_STATE_UPDATE_ALL, s as MSG_STYLE_PATCH, l as createChannel, u as envelope, c as isProtocolMessage };
-
+var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update-all`,o=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}export{e as MSG_CUSTOM,t as MSG_ERROR,n as MSG_HTML_REPLACE,r as MSG_READY,i as MSG_RESIZE,a as MSG_STATE_UPDATE_ALL,o as MSG_STYLE_PATCH,createChannel,envelope,isProtocolMessage};
 //# sourceMappingURL=_protocol.js.map

package/dist/_protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.js","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE = 'state-update';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":";AAAA,IAAa,IAAa,UACb,IAAY,SACZ,IAAmB,gBACnB,IAAY,SACZ,IAAa,UACb,IAAmB,gBACnB,IAAuB,oBACvB,IAAkB;AAS/B,SAAgB,EAAkB,GAAgB,GAAsD;CACtG,OACE,OAAO,KAAU,cACjB,KACA,OAAQ,EAAgC,WAAY,YACnD,EAA8B,YAAY,EAAU,WACrD,OAAQ,EAAmC,cAAe,YACzD,EAAiC,eAAe,EAAU,cAC3D,OAAQ,EAA6B,QAAS;AAElD;AAEA,SAAgB,IAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAM,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAK,IAAQ,MAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,EAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAG;EAAS,SAAS,EAAU;EAAS,YAAY,EAAU;CAAW;AACpF"}
+{"version":3,"file":"_protocol.js","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}

package/dist/_runtime.cjs

@@ -1,2 +1,2 @@
-const e=require("./errors.cjs"),t=require("./_policy.cjs"),n=require("./_document.cjs");require("./_dev.cjs");const r=require("./_protocol.cjs");var i=5e3;function a(a,o={}){let s=t.normalizeSandboxOptions(o),c=r.createChannel(),l={...s.namedStyles},u=new Set,d=new AbortController,f=null,p=!1,m=!1,h=0,g=null,_=null,v,y=new Promise(e=>{v=e});function b(){return{channel:c,generation:h}}function x(){g!==null&&(clearTimeout(g),g=null)}function S(){x(),_?.resolve(),_=null,m=!1}function C(e){for(let t of u)t(e)}function w(e){if(!f||e.source!==f.contentWindow)return;let t=b();if(r.isProtocolMessage(e.data,t))switch(e.data.type){case r.MSG_CUSTOM:typeof e.data.event==`string`&&C({detail:e.data.detail,event:e.data.event,type:r.MSG_CUSTOM});break;case r.MSG_ERROR:typeof e.data.message==`string`&&C({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:r.MSG_ERROR});break;case r.MSG_READY:S(),v(),m=!0;break;case r.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&C({height:e.data.height,type:r.MSG_RESIZE})}}function T(){return f||(f=document.createElement(`iframe`),f.setAttribute(`sandbox`,`allow-scripts`),f.setAttribute(`referrerpolicy`,`no-referrer`),f.dataset.sandboxChannel=c,a.appendChild(f),window.addEventListener(`message`,w),f)}function E(){p||(p=!0,S(),d.abort(),v(),f&&=(window.removeEventListener(`message`,w),f.remove(),null),u.clear())}function D(e){return p?()=>{}:(u.add(e),()=>u.delete(e))}function O(t,r){if(p||r?.signal?.aborted)return Promise.resolve();t.trim(),S(),h+=1;let a=T(),o=b(),c={...s,namedStyles:{...l}};a.dataset.sandboxGeneration=String(h),a.srcdoc=n.buildDocumentFromOptions(t,c,o);let u=new Promise((e,t)=>{_={reject:t,resolve:e}});return g=setTimeout(()=>{_&&(_.reject(new e.SandboxTimeoutError(`render() did not receive a 'ready' signal from the sandbox document within ${i}ms. The document is likely missing the bridge script — use buildDocument() to generate documents that include it.`)),_=null,g=null)},i),u}function k(e){f?.contentWindow?.postMessage(r.envelope(b(),e),`*`)}function A(e){p||!m||!f?.contentWindow||k({html:e,type:r.MSG_HTML_REPLACE})}function j(e,t){p||f?.contentWindow&&k({key:e,type:r.MSG_STATE_UPDATE,value:t})}function M(e){p||f?.contentWindow&&k({record:e,type:r.MSG_STATE_UPDATE_ALL})}function N(e,t){p||(l[e]=t,m&&f?.contentWindow&&k({css:t,id:e,type:r.MSG_STYLE_PATCH}))}return{get disposalSignal(){return d.signal},dispose:E,get disposed(){return p},onMessage:D,ready:y,render:O,replaceBody:A,setState:j,setStateAll:M,[Symbol.dispose](){E()},updateStyle:N}}exports.createSandbox=a;
+require("./_dev.cjs");const e=require("./errors.cjs"),t=require("./_policy.cjs"),n=require("./_document.cjs"),r=require("./_protocol.cjs");function createSandbox(i,a={}){let o=t.normalizeSandboxOptions(a),s=r.createChannel(),c={...o.styles},l=new Set,u={},d=new AbortController,f=null,p=!1,m=!1,h=0,g=null,_=null;function currentBootstrap(){return{channel:s,generation:h}}function clearReadyTimeout(){g!==null&&(clearTimeout(g),g=null)}function supersedePendingRender(){clearReadyTimeout(),_?.resolve(),_=null,m=!1}function broadcast(e){for(let t of l)try{t(e)}catch{}}function handleMessage(e){if(!f||e.source!==f.contentWindow)return;let t=currentBootstrap();if(r.isProtocolMessage(e.data,t))switch(e.data.type){case r.MSG_CUSTOM:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:r.MSG_CUSTOM});break;case r.MSG_ERROR:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:r.MSG_ERROR});break;case r.MSG_READY:supersedePendingRender(),m=!0,flushPendingState();break;case r.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:r.MSG_RESIZE})}}function ensureIframe(){return f||(f=document.createElement(`iframe`),f.setAttribute(`sandbox`,`allow-scripts`),f.setAttribute(`referrerpolicy`,`no-referrer`),f.dataset.sandboxChannel=s,i.appendChild(f),window.addEventListener(`message`,handleMessage),f)}function dispose(){p||(p=!0,supersedePendingRender(),d.abort(),f&&=(window.removeEventListener(`message`,handleMessage),f.remove(),null),l.clear())}function onMessage(e){return p?()=>{}:(l.add(e),()=>l.delete(e))}function render(t){if(p)return Promise.resolve();t.trim(),supersedePendingRender(),h+=1;let r=ensureIframe(),i=currentBootstrap(),a={...o,styles:{...c}};r.dataset.sandboxGeneration=String(h),r.srcdoc=n.buildDocumentFromOptions(t,a,i);let s=new Promise((e,t)=>{_={reject:t,resolve:e}});return g=setTimeout(()=>{_&&(_.reject(new e.SandboxTimeoutError(`render() did not receive a 'ready' signal within ${o.readyTimeout}ms. An injected script may have blocked document initialization.`)),_=null,g=null)},o.readyTimeout),s}function send(e){f?.contentWindow?.postMessage(r.envelope(currentBootstrap(),e),`*`)}function flushPendingState(){m&&f?.contentWindow&&Object.keys(u).length!==0&&send({record:{...u},type:r.MSG_STATE_UPDATE_ALL})}function setState(e){p||(Object.assign(u,e),m&&f?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:r.MSG_STATE_UPDATE_ALL}))}function replaceBody(e){p||m&&f?.contentWindow&&send({html:e,type:r.MSG_HTML_REPLACE})}function updateStyle(e,t){p||(c[e]=t,m&&f?.contentWindow&&send({css:t,id:e,type:r.MSG_STYLE_PATCH}))}return{get disposalSignal(){return d.signal},dispose,get disposed(){return p},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}exports.createSandbox=createSandbox;
 //# sourceMappingURL=_runtime.cjs.map

package/dist/_runtime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions, Unsubscribe } from './types.js';\n\nconst READY_TIMEOUT_MS = 5000;\n\nexport function createSandbox(container: HTMLElement, options: SandboxOptions = {}): SandboxHandle {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const namedStyles: Record<string, string> = { ...normalized.namedStyles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  let resolveReady!: () => void;\n  const ready = new Promise<void>((resolve) => {\n    resolveReady = resolve;\n  });\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) listener(message);\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        resolveReady();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n    resolveReady();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): Unsubscribe {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string, renderOptions?: { signal?: AbortSignal }): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (renderOptions?.signal?.aborted) return Promise.resolve();\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, namedStyles: { ...namedStyles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal from the sandbox document within ${READY_TIMEOUT_MS}ms. ` +\n            'The document is likely missing the bridge script — use buildDocument() to generate documents that include it.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, READY_TIMEOUT_MS);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function setState(key: string, value: unknown): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setState() called before ready — state update may be lost. Await render() first.');\n    }\n\n    send({ key, type: MSG_STATE_UPDATE, value });\n  }\n\n  function setStateAll(record: Record<string, unknown>): void {\n    if (disposed) {\n      warn('setStateAll() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setStateAll() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setStateAll() called before ready — state updates may be lost. Await render() first.');\n    }\n\n    send({ record, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) return;\n\n    devOnly(() => {\n      if (!(id in namedStyles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known namedStyles key.`);\n      }\n    });\n\n    namedStyles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    ready,\n    render,\n    replaceBody,\n    setState,\n    setStateAll,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"iJAoBA,IAAM,EAAmB,IAEzB,SAAgB,EAAc,EAAwB,EAA0B,CAAC,EAAkB,CACjG,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAsC,CAAE,GAAG,EAAW,WAAY,EAClE,EAAY,IAAI,IAChB,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAElF,EACE,EAAQ,IAAI,QAAe,GAAY,CAC3C,EAAe,CACjB,CAAC,EAED,SAAS,GAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,GAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,GAA+B,CACtC,EAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,EAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EAAW,EAAS,CAAO,CACpD,CAEA,SAAS,EAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,EAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,EAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,EAAuB,EACvB,EAAa,EACb,EAAc,GACd,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,EAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,GAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,CAAa,EAEzC,EACT,CAEA,SAAS,GAAgB,CACnB,IAEJ,EAAW,GACX,EAAuB,EACvB,EAAW,MAAM,EACjB,EAAa,EAEb,AAGE,KAFA,OAAO,oBAAoB,UAAW,CAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,EAAU,EAAyD,CAS1E,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,EAAO,EAAc,EAAyD,CAOrF,GANI,GAMA,GAAe,QAAQ,QAAS,OAAO,QAAQ,QAAQ,EAEtD,EAAK,KAAK,EAEf,EAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,EAAa,EACvB,EAAY,EAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,YAAa,CAAE,GAAG,CAAY,CAAE,EAEzE,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,8EAA8E,EAAiB,kHAEjG,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,CAAgB,EAEZ,CACT,CAEA,SAAS,EAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,EAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,EAAY,EAAoB,CACnC,GAMA,CAAC,GAAe,CAAC,GAAQ,eAM7B,EAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,EAAS,EAAa,EAAsB,CAC/C,GAMC,GAAQ,eAUb,EAAK,CAAE,MAAK,KAAM,EAAA,iBAAkB,OAAM,CAAC,CAC7C,CAEA,SAAS,EAAY,EAAuC,CACtD,GAMC,GAAQ,eAUb,EAAK,CAAE,SAAQ,KAAM,EAAA,oBAAqB,CAAC,CAC7C,CAEA,SAAS,EAAY,EAAY,EAAmB,CAC9C,IAQJ,EAAY,GAAM,EAEd,GAAe,GAAQ,eAAe,EAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,UACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,YACA,QACA,SACA,cACA,WACA,cACA,CAAC,OAAO,UAAW,CACjB,EAAQ,CACV,EACA,aACF,CACF"}
+{"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw — remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,EAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,EAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/_runtime.d.ts

@@ -1,3 +1,3 @@
 import type { SandboxHandle, SandboxOptions } from './types.js';
-export declare function createSandbox(container: HTMLElement, options?: SandboxOptions): SandboxHandle;
+export declare function createSandbox<State extends object = Record<string, unknown>>(container: HTMLElement, options?: SandboxOptions): SandboxHandle<State>;
 //# sourceMappingURL=_runtime.d.ts.map

package/dist/_runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAe,MAAM,YAAY,CAAC;AAI7F,wBAAgB,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CA8PjG"}
+{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,wBAAgB,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,SAAS,EAAE,WAAW,EACtB,OAAO,GAAE,cAAmB,GAC3B,aAAa,CAAC,KAAK,CAAC,CA2OtB"}

package/dist/_runtime.js

@@ -1,133 +1,2 @@
-import { SandboxTimeoutError as e } from "./errors.js";
-import { normalizeSandboxOptions as t } from "./_policy.js";
-import { buildDocumentFromOptions as n } from "./_document.js";
-import "./_dev.js";
-import { MSG_CUSTOM as r, MSG_ERROR as i, MSG_HTML_REPLACE as a, MSG_READY as o, MSG_RESIZE as s, MSG_STATE_UPDATE as c, MSG_STATE_UPDATE_ALL as l, MSG_STYLE_PATCH as u, createChannel as d, envelope as f, isProtocolMessage as p } from "./_protocol.js";
-//#region src/_runtime.ts
-var m = 5e3;
-function h(h, g = {}) {
-	let _ = t(g), v = d(), y = { ..._.namedStyles }, b = /* @__PURE__ */ new Set(), x = new AbortController(), S = null, C = !1, w = !1, T = 0, E = null, D = null, O, k = new Promise((e) => {
-		O = e;
-	});
-	function A() {
-		return {
-			channel: v,
-			generation: T
-		};
-	}
-	function j() {
-		E !== null && (clearTimeout(E), E = null);
-	}
-	function M() {
-		j(), D?.resolve(), D = null, w = !1;
-	}
-	function N(e) {
-		for (let t of b) t(e);
-	}
-	function P(e) {
-		if (!S || e.source !== S.contentWindow) return;
-		let t = A();
-		if (p(e.data, t)) switch (e.data.type) {
-			case r:
-				typeof e.data.event == "string" && N({
-					detail: e.data.detail,
-					event: e.data.event,
-					type: r
-				});
-				break;
-			case i:
-				typeof e.data.message == "string" && N({
-					message: e.data.message,
-					...typeof e.data.stack == "string" ? { stack: e.data.stack } : {},
-					type: i
-				});
-				break;
-			case o:
-				M(), O(), w = !0;
-				break;
-			case s: typeof e.data.height == "number" && Number.isFinite(e.data.height) && e.data.height >= 0 && N({
-				height: e.data.height,
-				type: s
-			});
-		}
-	}
-	function F() {
-		return S || (S = document.createElement("iframe"), S.setAttribute("sandbox", "allow-scripts"), S.setAttribute("referrerpolicy", "no-referrer"), S.dataset.sandboxChannel = v, h.appendChild(S), window.addEventListener("message", P), S);
-	}
-	function I() {
-		C || (C = !0, M(), x.abort(), O(), S &&= (window.removeEventListener("message", P), S.remove(), null), b.clear());
-	}
-	function L(e) {
-		return C ? () => {} : (b.add(e), () => b.delete(e));
-	}
-	function R(t, r) {
-		if (C || r?.signal?.aborted) return Promise.resolve();
-		t.trim(), M(), T += 1;
-		let i = F(), a = A(), o = {
-			..._,
-			namedStyles: { ...y }
-		};
-		i.dataset.sandboxGeneration = String(T), i.srcdoc = n(t, o, a);
-		let s = new Promise((e, t) => {
-			D = {
-				reject: t,
-				resolve: e
-			};
-		});
-		return E = setTimeout(() => {
-			D && (D.reject(new e(`render() did not receive a 'ready' signal from the sandbox document within ${m}ms. The document is likely missing the bridge script — use buildDocument() to generate documents that include it.`)), D = null, E = null);
-		}, m), s;
-	}
-	function z(e) {
-		S?.contentWindow?.postMessage(f(A(), e), "*");
-	}
-	function B(e) {
-		C || !w || !S?.contentWindow || z({
-			html: e,
-			type: a
-		});
-	}
-	function V(e, t) {
-		C || S?.contentWindow && z({
-			key: e,
-			type: c,
-			value: t
-		});
-	}
-	function H(e) {
-		C || S?.contentWindow && z({
-			record: e,
-			type: l
-		});
-	}
-	function U(e, t) {
-		C || (y[e] = t, w && S?.contentWindow && z({
-			css: t,
-			id: e,
-			type: u
-		}));
-	}
-	return {
-		get disposalSignal() {
-			return x.signal;
-		},
-		dispose: I,
-		get disposed() {
-			return C;
-		},
-		onMessage: L,
-		ready: k,
-		render: R,
-		replaceBody: B,
-		setState: V,
-		setStateAll: H,
-		[Symbol.dispose]() {
-			I();
-		},
-		updateStyle: U
-	};
-}
-//#endregion
-export { h as createSandbox };
-
+import"./_dev.js";import{SandboxTimeoutError as e}from"./errors.js";import{normalizeSandboxOptions as t}from"./_policy.js";import{buildDocumentFromOptions as n}from"./_document.js";import{MSG_CUSTOM as r,MSG_ERROR as i,MSG_HTML_REPLACE as a,MSG_READY as o,MSG_RESIZE as s,MSG_STATE_UPDATE_ALL as c,MSG_STYLE_PATCH as l,createChannel as u,envelope as d,isProtocolMessage as f}from"./_protocol.js";function createSandbox(p,m={}){let h=t(m),g=u(),_={...h.styles},v=new Set,y={},b=new AbortController,x=null,S=!1,C=!1,w=0,T=null,E=null;function currentBootstrap(){return{channel:g,generation:w}}function clearReadyTimeout(){T!==null&&(clearTimeout(T),T=null)}function supersedePendingRender(){clearReadyTimeout(),E?.resolve(),E=null,C=!1}function broadcast(e){for(let t of v)try{t(e)}catch{}}function handleMessage(e){if(!x||e.source!==x.contentWindow)return;let t=currentBootstrap();if(f(e.data,t))switch(e.data.type){case r:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:r});break;case i:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:i});break;case o:supersedePendingRender(),C=!0,flushPendingState();break;case s:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:s})}}function ensureIframe(){return x||(x=document.createElement(`iframe`),x.setAttribute(`sandbox`,`allow-scripts`),x.setAttribute(`referrerpolicy`,`no-referrer`),x.dataset.sandboxChannel=g,p.appendChild(x),window.addEventListener(`message`,handleMessage),x)}function dispose(){S||(S=!0,supersedePendingRender(),b.abort(),x&&=(window.removeEventListener(`message`,handleMessage),x.remove(),null),v.clear())}function onMessage(e){return S?()=>{}:(v.add(e),()=>v.delete(e))}function render(t){if(S)return Promise.resolve();t.trim(),supersedePendingRender(),w+=1;let r=ensureIframe(),i=currentBootstrap(),a={...h,styles:{..._}};r.dataset.sandboxGeneration=String(w),r.srcdoc=n(t,a,i);let o=new Promise((e,t)=>{E={reject:t,resolve:e}});return T=setTimeout(()=>{E&&(E.reject(new e(`render() did not receive a 'ready' signal within ${h.readyTimeout}ms. An injected script may have blocked document initialization.`)),E=null,T=null)},h.readyTimeout),o}function send(e){x?.contentWindow?.postMessage(d(currentBootstrap(),e),`*`)}function flushPendingState(){C&&x?.contentWindow&&Object.keys(y).length!==0&&send({record:{...y},type:c})}function setState(e){S||(Object.assign(y,e),C&&x?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:c}))}function replaceBody(e){S||C&&x?.contentWindow&&send({html:e,type:a})}function updateStyle(e,t){S||(_[e]=t,C&&x?.contentWindow&&send({css:t,id:e,type:l}))}return{get disposalSignal(){return b.signal},dispose,get disposed(){return S},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}export{createSandbox};
 //# sourceMappingURL=_runtime.js.map

package/dist/_runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions, Unsubscribe } from './types.js';\n\nconst READY_TIMEOUT_MS = 5000;\n\nexport function createSandbox(container: HTMLElement, options: SandboxOptions = {}): SandboxHandle {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const namedStyles: Record<string, string> = { ...normalized.namedStyles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  let resolveReady!: () => void;\n  const ready = new Promise<void>((resolve) => {\n    resolveReady = resolve;\n  });\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) listener(message);\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        resolveReady();\n        bridgeReady = true;\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n    resolveReady();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): Unsubscribe {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string, renderOptions?: { signal?: AbortSignal }): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (renderOptions?.signal?.aborted) return Promise.resolve();\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, namedStyles: { ...namedStyles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal from the sandbox document within ${READY_TIMEOUT_MS}ms. ` +\n            'The document is likely missing the bridge script — use buildDocument() to generate documents that include it.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, READY_TIMEOUT_MS);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function setState(key: string, value: unknown): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setState() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setState() called before ready — state update may be lost. Await render() first.');\n    }\n\n    send({ key, type: MSG_STATE_UPDATE, value });\n  }\n\n  function setStateAll(record: Record<string, unknown>): void {\n    if (disposed) {\n      warn('setStateAll() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!iframe?.contentWindow) {\n      warn('setStateAll() called before render() — sandbox has no document yet.');\n\n      return;\n    }\n\n    if (!bridgeReady) {\n      warn('setStateAll() called before ready — state updates may be lost. Await render() first.');\n    }\n\n    send({ record, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) return;\n\n    devOnly(() => {\n      if (!(id in namedStyles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known namedStyles key.`);\n      }\n    });\n\n    namedStyles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    ready,\n    render,\n    replaceBody,\n    setState,\n    setStateAll,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";;;;;;AAoBA,IAAM,IAAmB;AAEzB,SAAgB,EAAc,GAAwB,IAA0B,CAAC,GAAkB;CACjG,IAAM,IAAa,EAAwB,CAAO,GAC5C,IAAU,EAAc,GACxB,IAAsC,EAAE,GAAG,EAAW,YAAY,GAClE,oBAAY,IAAI,IAAuC,GACvD,IAAa,IAAI,gBAAgB,GACnC,IAAmC,MACnC,IAAW,IACX,IAAc,IACd,IAAa,GACb,IAAqD,MACrD,IAAkF,MAElF,GACE,IAAQ,IAAI,SAAe,MAAY;EAC3C,IAAe;CACjB,CAAC;CAED,SAAS,IAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,IAA0B;EAC7B,MAAiB,SAErB,aAAa,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,IAA+B;EAItC,AAHA,EAAkB,GAClB,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,EAAU,GAA+B;EAChD,KAAK,IAAM,KAAY,GAAW,EAAS,CAAO;CACpD;CAEA,SAAS,EAAc,GAA2B;EAChD,IAAI,CAAC,KAAU,EAAM,WAAW,EAAO,eAAe;EAEtD,IAAM,IAAY,EAAiB;EAE9B,MAAkB,EAAM,MAAM,CAAS,GAE5C,QAAQ,EAAM,KAAK,MAAnB;GACE,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,SAAU,YAC9B,EAAU;KAAE,QAAQ,EAAM,KAAK;KAAQ,OAAO,EAAM,KAAK;KAAO,MAAM;IAAW,CAAC;IAGpF;GACF,KAAK;IACH,AAAI,OAAO,EAAM,KAAK,WAAY,YAChC,EAAU;KACR,SAAS,EAAM,KAAK;KACpB,GAAI,OAAO,EAAM,KAAK,SAAU,WAAW,EAAE,OAAO,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAM;IACR,CAAC;IAGH;GACF,KAAK;IAGH,AAFA,EAAuB,GACvB,EAAa,GACb,IAAc;IACd;GACF,KAAK,GACH,AAAI,OAAO,EAAM,KAAK,UAAW,YAAY,OAAO,SAAS,EAAM,KAAK,MAAM,KAAK,EAAM,KAAK,UAAU,KACtG,EAAU;IAAE,QAAQ,EAAM,KAAK;IAAQ,MAAM;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,IAAkC;EAUzC,OATI,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxC,EAAO,aAAa,WAAW,eAAe,GAC9C,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiB,GAChC,EAAU,YAAY,CAAM,GAC5B,OAAO,iBAAiB,WAAW,CAAa,GAEzC;CACT;CAEA,SAAS,IAAgB;EACnB,MAEJ,IAAW,IACX,EAAuB,GACvB,EAAW,MAAM,GACjB,EAAa,GAEb,AAGE,OAFA,OAAO,oBAAoB,WAAW,CAAa,GACnD,EAAO,OAAO,GACL,OAGX,EAAU,MAAM;CAClB;CAEA,SAAS,EAAU,GAAyD;EAS1E,OARI,UAGW,CAAC,KAGhB,EAAU,IAAI,CAAO,SAER,EAAU,OAAO,CAAO;CACvC;CAEA,SAAS,EAAO,GAAc,GAAyD;EAOrF,IANI,KAMA,GAAe,QAAQ,SAAS,OAAO,QAAQ,QAAQ;EAK3D,AAHK,EAAK,KAAK,GAEf,EAAuB,GACvB,KAAc;EAEd,IAAM,IAAU,EAAa,GACvB,IAAY,EAAiB,GAC7B,IAAkB;GAAE,GAAG;GAAY,aAAa,EAAE,GAAG,EAAY;EAAE;EAGzE,AADA,EAAQ,QAAQ,oBAAoB,OAAO,CAAU,GACrD,EAAQ,SAAS,EAAyB,GAAM,GAAiB,CAAS;EAE1E,IAAM,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GACzB,MAEL,EAAc,OACZ,IAAI,EACF,8EAA8E,EAAiB,kHAEjG,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAG,CAAgB,GAEZ;CACT;CAEA,SAAS,EAAK,GAAwC;EACpD,GAAQ,eAAe,YAAY,EAAS,EAAiB,GAAG,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,EAAY,GAAoB;EACnC,KAMA,CAAC,KAAe,CAAC,GAAQ,iBAM7B,EAAK;GAAE;GAAM,MAAM;EAAiB,CAAC;CACvC;CAEA,SAAS,EAAS,GAAa,GAAsB;EAC/C,KAMC,GAAQ,iBAUb,EAAK;GAAE;GAAK,MAAM;GAAkB;EAAM,CAAC;CAC7C;CAEA,SAAS,EAAY,GAAuC;EACtD,KAMC,GAAQ,iBAUb,EAAK;GAAE;GAAQ,MAAM;EAAqB,CAAC;CAC7C;CAEA,SAAS,EAAY,GAAY,GAAmB;EAC9C,MAQJ,EAAY,KAAM,GAEd,KAAe,GAAQ,iBAAe,EAAK;GAAE;GAAK;GAAI,MAAM;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAO,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAO;EACT;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,EAAQ;EACV;EACA;CACF;AACF"}
+{"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw — remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"4YAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAwB,CAAO,EAC5C,EAAU,EAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/errors.cjs

@@ -1,2 +1,2 @@
-var e=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},t=class extends e{},n=class extends e{};exports.SandboxConfigurationError=n,exports.SandboxError=e,exports.SandboxTimeoutError=t;
+var SandboxError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},SandboxTimeoutError=class extends SandboxError{},SandboxConfigurationError=class extends SandboxError{};exports.SandboxConfigurationError=SandboxConfigurationError,exports.SandboxError=SandboxError,exports.SandboxTimeoutError=SandboxTimeoutError;
 //# sourceMappingURL=errors.cjs.map

package/dist/errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. The document is most likely missing the bridge script —\n * use buildDocument() to generate documents that include it.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":"AACA,IAAa,EAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAOa,EAAb,cAAyC,CAAa,CAAC,EAG1C,EAAb,cAA+C,CAAa,CAAC"}
+{"version":3,"file":"errors.cjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":"AACA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC"}

package/dist/errors.d.ts

@@ -4,8 +4,7 @@ export declare class SandboxError extends Error {
 }
 /**
  * Thrown when render() does not receive a 'ready' signal from the sandbox document
- * within the timeout window. The document is most likely missing the bridge script —
- * use buildDocument() to generate documents that include it.
+ * within the timeout window. An injected script may have blocked document initialization.
  */
 export declare class SandboxTimeoutError extends SandboxError {
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AAExD,uFAAuF;AACvF,qBAAa,yBAA0B,SAAQ,YAAY;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AAExD,uFAAuF;AACvF,qBAAa,yBAA0B,SAAQ,YAAY;CAAG"}

package/dist/errors.js

@@ -1,10 +1,2 @@
-//#region src/errors.ts
-var e = class extends Error {
-	constructor(e, t) {
-		super(e, t), this.name = new.target.name, Object.setPrototypeOf(this, new.target.prototype);
-	}
-}, t = class extends e {}, n = class extends e {};
-//#endregion
-export { n as SandboxConfigurationError, e as SandboxError, t as SandboxTimeoutError };
-
+var SandboxError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},SandboxTimeoutError=class extends SandboxError{},SandboxConfigurationError=class extends SandboxError{};export{SandboxConfigurationError,SandboxError,SandboxTimeoutError};
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. The document is most likely missing the bridge script —\n * use buildDocument() to generate documents that include it.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":";AACA,IAAa,IAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAM,GAAS,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAOa,IAAb,cAAyC,EAAa,CAAC,GAG1C,IAAb,cAA+C,EAAa,CAAC"}
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n"],"mappings":"AACA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC"}

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./errors.cjs"),t=require("./_policy.cjs"),n=require("./_document.cjs"),r=require("./_runtime.cjs");exports.SandboxConfigurationError=e.SandboxConfigurationError,exports.SandboxError=e.SandboxError,exports.SandboxTimeoutError=e.SandboxTimeoutError,exports.buildCsp=t.buildCsp,exports.buildDocument=n.buildDocument,exports.createSandbox=r.createSandbox;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./errors.cjs"),t=require("./_runtime.cjs");exports.SandboxConfigurationError=e.SandboxConfigurationError,exports.SandboxError=e.SandboxError,exports.SandboxTimeoutError=e.SandboxTimeoutError,exports.createSandbox=t.createSandbox;

package/dist/index.d.ts

@@ -1,6 +1,4 @@
-export { buildDocument } from './_document.js';
-export { buildCsp } from './_policy.js';
 export { createSandbox } from './_runtime.js';
 export { SandboxConfigurationError, SandboxError, SandboxTimeoutError } from './errors.js';
-export type { SandboxBridge, SandboxHandle, SandboxMessage, SandboxOptions, SandboxStateUpdateDetail, Unsubscribe, } from './types.js';
+export type { SandboxBridge, SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACd,wBAAwB,EACxB,WAAW,GACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1 @@
-import { SandboxConfigurationError as e, SandboxError as t, SandboxTimeoutError as n } from "./errors.js";
-import { buildCsp as r } from "./_policy.js";
-import { buildDocument as i } from "./_document.js";
-import { createSandbox as a } from "./_runtime.js";
-export { e as SandboxConfigurationError, t as SandboxError, n as SandboxTimeoutError, r as buildCsp, i as buildDocument, a as createSandbox };
+import{SandboxConfigurationError as e,SandboxError as t,SandboxTimeoutError as n}from"./errors.js";import{createSandbox as r}from"./_runtime.js";export{e as SandboxConfigurationError,t as SandboxError,n as SandboxTimeoutError,r as createSandbox};