npm - @vielzeug/sandbox - Versions diffs - 26.10.0 → 26.10.1 - Mend

@vielzeug/sandbox 26.10.0 → 26.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md CHANGED Viewed

@@ -54,4 +54,4 @@ sandbox.dispose();
 ## License
-MIT © [Helmuth Saatkamp](https://github.com/helmuthdu) — part of the [Vielzeug](https://github.com/helmuthdu/vielzeug) monorepo.
+MIT © [Helmuth Saatkamp](https://github.com/helmuthdu): part of the [Vielzeug](https://github.com/helmuthdu/vielzeug) monorepo.

package/dist/_dev.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"_dev.cjs","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security — some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}
1	+ {"version":3,"file":"_dev.cjs","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}

package/dist/_dev.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"_dev.js","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security — some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}
1	+ {"version":3,"file":"_dev.js","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}

package/dist/_runtime.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw — remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,EAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,EAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
1	+ {"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw: remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,EAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,EAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/_runtime.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw — remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"4YAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAwB,CAAO,EAC5C,EAAU,EAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
1	+ {"version":3,"file":"_runtime.js","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw: remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"4YAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAwB,CAAO,EAC5C,EAAU,EAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/sandbox.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sandbox.cjs","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security — some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw — remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"mECEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
1	+ {"version":3,"file":"sandbox.cjs","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw: remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"mECEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/sandbox.iife.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sandbox.iife.js","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security — some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw — remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"sFCEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
1	+ {"version":3,"file":"sandbox.iife.js","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw: remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"sFCEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/sandbox.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sandbox.js","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security — some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal — Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw — remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox — handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved — bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …) — '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"ACEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
1	+ {"version":3,"file":"sandbox.js","names":[],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. /\nexport function warn(msg: string): void {\n if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/* @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. /\nexport function devOnly(fn: () => void): void {\n if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n const channel = JSON.stringify(bootstrap.channel);\n const generation = String(bootstrap.generation);\n\n return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n var msg = e.data;\n if (e.source !== parent \|\| !msg \|\| msg.channel !== __sandboxChannel \|\| msg.generation !== __sandboxGeneration) return;\n if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n var keys = Object.keys(msg.record);\n for (var i = 0; i < keys.length; i++) {\n var k = keys[i];\n document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n }\n }\n if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n var el = document.getElementById(msg.id);\n if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n }\n if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n document.body.innerHTML = msg.html;\n }\n});\nfunction post(msg) {\n msg.channel = __sandboxChannel;\n msg.generation = __sandboxGeneration;\n parent.postMessage(msg, '');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n post({ type: 'error', message: String(message), stack: err && err.stack });\n return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n var reason = e.reason;\n post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n emit: function(event, detail) {\n post({ type: 'custom', event: String(event), detail: detail });\n },\n onState: function(key, handler) {\n function listener(e) {\n if (e.detail && e.detail.key === key) handler(e.detail.value);\n }\n document.addEventListener('sandbox:state-update', listener);\n return function() {\n document.removeEventListener('sandbox:state-update', listener);\n };\n }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n post({ type: 'ready' });\n if (typeof ResizeObserver === 'undefined') return;\n new ResizeObserver(function(entries) {\n var entry = entries[0];\n if (!entry) return;\n var h = entry.borderBoxSize && entry.borderBoxSize[0]\n ? entry.borderBoxSize[0].blockSize\n : entry.contentRect.height;\n post({ type: 'resize', height: h });\n }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. /\nexport class SandboxError extends Error {\n constructor(message: string, opts?: ErrorOptions) {\n super(message, opts);\n this.name = new.target.name;\n Object.setPrototypeOf(this, new.target.prototype);\n }\n}\n\n/\n Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n /\nexport class SandboxTimeoutError extends SandboxError {}\n\n/* Thrown when Sandbox configuration cannot produce a valid document or CSP policy. /\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n allowedFontOrigins: string[];\n allowedImageOrigins: string[];\n allowedScriptOrigins: string[];\n allowedStyleOrigins: string[];\n lang: string;\n nonce: string \| undefined;\n readyTimeout: number;\n scripts: string[];\n styles: Record<string, string>;\n title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n if (typeof value !== 'string') return fail(field, value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail(field, value);\n }\n\n if (\n (url.protocol !== 'http:' && url.protocol !== 'https:') \|\|\n url.username \|\|\n url.password \|\|\n url.pathname !== '/' \|\|\n url.search \|\|\n url.hash\n ) {\n return fail(field, value);\n }\n\n return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] \| undefined, field: string): string[] {\n if (values === undefined) return [];\n if (!Array.isArray(values)) return fail(field, values);\n\n return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n if (typeof value !== 'string') return fail('scripts', value);\n\n let url: URL;\n\n try {\n url = new URL(value);\n } catch {\n return fail('scripts', value);\n }\n\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> \| undefined): Record<string, string> {\n if (styles === undefined) return {};\n if (typeof styles !== 'object' \|\| styles === null \|\| Array.isArray(styles)) return fail('styles', styles);\n\n const normalized: Record<string, string> = {};\n\n for (const [id, css] of Object.entries(styles)) {\n if (!ID.test(id) \|\| typeof css !== 'string') fail('styles', id);\n\n normalized[id] = css;\n }\n\n return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n if (typeof options !== 'object' \|\| options === null \|\| Array.isArray(options)) fail('options', options);\n\n const lang = options.lang ?? 'en';\n\n if (!LANG.test(lang)) fail('lang', lang);\n\n if (options.nonce !== undefined && (!NONCE.test(options.nonce) \|\| options.nonce.length === 0)) {\n fail('nonce', options.nonce);\n }\n\n if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n const rawReadyTimeout = options.readyTimeout;\n const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n if (\n rawReadyTimeout !== undefined &&\n (rawReadyTimeout === null \|\|\n typeof rawReadyTimeout !== 'number' \|\|\n !Number.isFinite(rawReadyTimeout) \|\|\n rawReadyTimeout <= 0 \|\|\n rawReadyTimeout > 2 * 31 - 1)\n ) {\n fail('readyTimeout', rawReadyTimeout);\n }\n\n if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n const scripts = (options.scripts ?? []).map(normalizeScript);\n\n return {\n allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n lang,\n nonce: options.nonce,\n readyTimeout,\n scripts,\n styles: normalizeStyles(options.styles),\n title: options.title ?? '',\n };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n const scriptOrigins = [\n \"'unsafe-inline'\",\n ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n ...options.allowedScriptOrigins,\n ...options.scripts.map((script) => new URL(script).origin),\n ].join(' ');\n const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n const fontOrigins = options.allowedFontOrigins.join(' ') \|\| \"'none'\";\n\n return [\n \"default-src 'none'\",\n `script-src ${scriptOrigins}`,\n `style-src ${styleOrigins}`,\n `img-src ${imageOrigins}`,\n `font-src ${fontOrigins}`,\n \"connect-src 'none'\",\n \"form-action 'none'\",\n \"base-uri 'none'\",\n ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n return value.replace(/&/g, '&').replace(/\"/g, '"').replace(/</g, '<').replace(/>/g, '>');\n}\n\nfunction escapeText(value: string): string {\n return value.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');\n}\n\nexport function buildDocumentFromOptions(\n html: string,\n options: NormalizedSandboxOptions,\n bootstrap: BridgeBootstrap,\n): string {\n const csp = escapeAttr(buildCspFromOptions(options));\n const styles = Object.entries(options.styles)\n .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n .join('\\n');\n const scripts = options.scripts\n .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n .join('\\n');\n const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n channel: string;\n generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n return (\n typeof value === 'object' &&\n value !== null &&\n typeof (value as { channel?: unknown }).channel === 'string' &&\n (value as { channel: string }).channel === bootstrap.channel &&\n typeof (value as { generation?: unknown }).generation === 'number' &&\n (value as { generation: number }).generation === bootstrap.generation &&\n typeof (value as { type?: unknown }).type === 'string'\n );\n}\n\nexport function createChannel(): string {\n if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n type BridgeBootstrap,\n createChannel,\n envelope,\n isProtocolMessage,\n MSG_CUSTOM,\n MSG_ERROR,\n MSG_HTML_REPLACE,\n MSG_READY,\n MSG_RESIZE,\n MSG_STATE_UPDATE_ALL,\n MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n container: HTMLElement,\n options: SandboxOptions = {},\n): SandboxHandle<State> {\n const normalized = normalizeSandboxOptions(options);\n const channel = createChannel();\n const styles: Record<string, string> = { ...normalized.styles };\n const listeners = new Set<(message: SandboxMessage) => void>();\n const pendingState: Partial<State> = {};\n const controller = new AbortController();\n let iframe: HTMLIFrameElement \| null = null;\n let disposed = false;\n let bridgeReady = false;\n let generation = 0;\n let readyTimeout: ReturnType<typeof setTimeout> \| null = null;\n let currentRender: { reject: (error: unknown) => void; resolve: () => void } \| null = null;\n\n function currentBootstrap(): BridgeBootstrap {\n return { channel, generation };\n }\n\n function clearReadyTimeout(): void {\n if (readyTimeout === null) return;\n\n clearTimeout(readyTimeout);\n readyTimeout = null;\n }\n\n function supersedePendingRender(): void {\n clearReadyTimeout();\n currentRender?.resolve();\n currentRender = null;\n bridgeReady = false;\n }\n\n function broadcast(message: SandboxMessage): void {\n for (const listener of listeners) {\n try {\n listener(message);\n } catch {\n warn('onMessage() handler threw: remaining handlers will still run.');\n }\n }\n }\n\n function handleMessage(event: MessageEvent): void {\n if (!iframe \|\| event.source !== iframe.contentWindow) return;\n\n const bootstrap = currentBootstrap();\n\n if (!isProtocolMessage(event.data, bootstrap)) return;\n\n switch (event.data.type) {\n case MSG_CUSTOM:\n if (typeof event.data.event === 'string') {\n broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n }\n\n break;\n case MSG_ERROR:\n if (typeof event.data.message === 'string') {\n broadcast({\n message: event.data.message,\n ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n type: MSG_ERROR,\n });\n }\n\n break;\n case MSG_READY:\n supersedePendingRender();\n bridgeReady = true;\n flushPendingState();\n break;\n case MSG_RESIZE:\n if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n broadcast({ height: event.data.height, type: MSG_RESIZE });\n }\n\n break;\n }\n }\n\n function ensureIframe(): HTMLIFrameElement {\n if (iframe) return iframe;\n\n iframe = document.createElement('iframe');\n iframe.setAttribute('sandbox', 'allow-scripts');\n iframe.setAttribute('referrerpolicy', 'no-referrer');\n iframe.dataset.sandboxChannel = channel;\n container.appendChild(iframe);\n window.addEventListener('message', handleMessage);\n\n return iframe;\n }\n\n function dispose(): void {\n if (disposed) return;\n\n disposed = true;\n supersedePendingRender();\n controller.abort();\n\n if (iframe) {\n window.removeEventListener('message', handleMessage);\n iframe.remove();\n iframe = null;\n }\n\n listeners.clear();\n }\n\n function onMessage(handler: (message: SandboxMessage) => void): () => void {\n if (disposed) {\n warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n return () => {};\n }\n\n listeners.add(handler);\n\n return () => listeners.delete(handler);\n }\n\n function render(html: string): Promise<void> {\n if (disposed) {\n warn('render() called on a disposed sandbox.');\n\n return Promise.resolve();\n }\n\n if (!html.trim()) warn('render() called with empty HTML.');\n\n supersedePendingRender();\n generation += 1;\n\n const current = ensureIframe();\n const bootstrap = currentBootstrap();\n const documentOptions = { ...normalized, styles: { ...styles } };\n\n current.dataset.sandboxGeneration = String(generation);\n current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n const promise = new Promise<void>((resolve, reject) => {\n currentRender = { reject, resolve };\n });\n\n readyTimeout = setTimeout(() => {\n if (!currentRender) return;\n\n currentRender.reject(\n new SandboxTimeoutError(\n `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n 'An injected script may have blocked document initialization.',\n ),\n );\n currentRender = null;\n readyTimeout = null;\n }, normalized.readyTimeout);\n\n return promise;\n }\n\n function send(message: Record<string, unknown>): void {\n iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n }\n\n function flushPendingState(): void {\n if (!bridgeReady \|\| !iframe?.contentWindow \|\| Object.keys(pendingState).length === 0) return;\n\n send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n }\n\n function setState(update: Partial<State>): void {\n if (disposed) {\n warn('setState() called on a disposed sandbox.');\n\n return;\n }\n\n Object.assign(pendingState, update);\n\n if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n send({ record: update, type: MSG_STATE_UPDATE_ALL });\n }\n }\n\n function replaceBody(html: string): void {\n if (disposed) {\n warn('replaceBody() called on a disposed sandbox.');\n\n return;\n }\n\n if (!bridgeReady \|\| !iframe?.contentWindow) {\n warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n return;\n }\n\n send({ html, type: MSG_HTML_REPLACE });\n }\n\n function updateStyle(id: string, css: string): void {\n if (disposed) {\n warn('updateStyle() called on a disposed sandbox.');\n\n return;\n }\n\n devOnly(() => {\n if (!(id in styles)) {\n warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n }\n });\n\n styles[id] = css;\n\n if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n }\n\n return {\n get disposalSignal() {\n return controller.signal;\n },\n dispose,\n get disposed() {\n return disposed;\n },\n onMessage,\n render,\n replaceBody,\n setState,\n [Symbol.dispose]() {\n dispose();\n },\n updateStyle,\n };\n}\n"],"mappings":"ACEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAM,EAAS,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvD,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP,CChDA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,wBAAwB,CAAO,EAC5C,EAAU,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,qBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,CAAW,CAAC,EAGpF,MACF,KAAK,EACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,CACR,CAAC,EAGH,MACF,KAAK,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}

package/dist/testing.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"testing.cjs","names":[],"sources":["../src/testing.ts"],"sourcesContent":["/*\n Test utilities for code that integrates with @vielzeug/sandbox.\n \n Import from '@vielzeug/sandbox/testing' — not the main entry point.\n * These helpers encapsulate the postMessage protocol so tests don't\n * need to know internal message shapes.\n /\n\n/* Helpers for simulating sandbox→host messages in tests. /\nexport interface SandboxTestHelpers {\n /* Fire a 'custom' event as if sandbox code called window.__sandbox__.emit(). /\n fireCustom(event: string, detail?: unknown): void;\n /* Fire an 'error' message as if the sandbox caught an uncaught error. /\n fireError(message: string, stack?: string): void;\n /* Fire a 'ready' signal as if the bridge script executed. /\n fireReady(): void;\n /* Fire a 'resize' message as if the bridge ResizeObserver fired. /\n fireResize(height: number): void;\n}\n\n/\n Create test helpers bound to a specific sandbox container's iframe.\n \n @example\n * ```ts\n * const container = document.createElement('div');\n * document.body.appendChild(container);\n * const sandbox = createSandbox(container);\n * const helpers = createSandboxTestHelpers(container);\n \n const render = sandbox.render('<p>test</p>');\n * helpers.fireReady();\n * await render;\n * ```\n */\nexport function createSandboxTestHelpers(container: HTMLElement): SandboxTestHelpers {\n function getIframe(): HTMLIFrameElement \| null {\n return container.querySelector('iframe');\n }\n\n function fire(data: Record<string, unknown>): void {\n const iframe = getIframe();\n const channel = iframe?.dataset.sandboxChannel;\n const generation = Number(iframe?.dataset.sandboxGeneration);\n\n if (!iframe \|\| !channel \|\| !Number.isInteger(generation)) {\n throw new Error('createSandboxTestHelpers requires a rendered sandbox.');\n }\n\n window.dispatchEvent(\n new MessageEvent('message', { data: { ...data, channel, generation }, source: iframe.contentWindow }),\n );\n }\n\n return {\n fireCustom: (event, detail = undefined) => fire({ detail, event, type: 'custom' }),\n fireError: (message, stack) => fire({ message, type: 'error', ...(stack !== undefined ? { stack } : {}) }),\n fireReady: () => fire({ type: 'ready' }),\n fireResize: (height) => fire({ height, type: 'resize' }),\n };\n}\n"],"mappings":"mEAmCA,SAAgB,yBAAyB,EAA4C,CACnF,SAAS,WAAsC,CAC7C,OAAO,EAAU,cAAc,QAAQ,CACzC,CAEA,SAAS,KAAK,EAAqC,CACjD,IAAM,EAAS,UAAU,EACnB,EAAU,GAAQ,QAAQ,eAC1B,EAAa,OAAO,GAAQ,QAAQ,iBAAiB,EAE3D,GAAI,CAAC,GAAU,CAAC,GAAW,CAAC,OAAO,UAAU,CAAU,EACrD,MAAU,MAAM,uDAAuD,EAGzE,OAAO,cACL,IAAI,aAAa,UAAW,CAAE,KAAM,CAAE,GAAG,EAAM,UAAS,YAAW,EAAG,OAAQ,EAAO,aAAc,CAAC,CACtG,CACF,CAEA,MAAO,CACL,YAAa,EAAO,EAAS,IAAA,KAAc,KAAK,CAAE,SAAQ,QAAO,KAAM,QAAS,CAAC,EACjF,WAAY,EAAS,IAAU,KAAK,CAAE,UAAS,KAAM,QAAS,GAAI,IAAU,IAAA,GAAwB,CAAC,EAAb,CAAE,OAAM,CAAQ,CAAC,EACzG,cAAiB,KAAK,CAAE,KAAM,OAAQ,CAAC,EACvC,WAAa,GAAW,KAAK,CAAE,SAAQ,KAAM,QAAS,CAAC,CACzD,CACF"}
1	+ {"version":3,"file":"testing.cjs","names":[],"sources":["../src/testing.ts"],"sourcesContent":["/*\n Test utilities for code that integrates with @vielzeug/sandbox.\n \n Import from '@vielzeug/sandbox/testing': not the main entry point.\n * These helpers encapsulate the postMessage protocol so tests don't\n * need to know internal message shapes.\n /\n\n/* Helpers for simulating sandbox→host messages in tests. /\nexport interface SandboxTestHelpers {\n /* Fire a 'custom' event as if sandbox code called window.__sandbox__.emit(). /\n fireCustom(event: string, detail?: unknown): void;\n /* Fire an 'error' message as if the sandbox caught an uncaught error. /\n fireError(message: string, stack?: string): void;\n /* Fire a 'ready' signal as if the bridge script executed. /\n fireReady(): void;\n /* Fire a 'resize' message as if the bridge ResizeObserver fired. /\n fireResize(height: number): void;\n}\n\n/\n Create test helpers bound to a specific sandbox container's iframe.\n \n @example\n * ```ts\n * const container = document.createElement('div');\n * document.body.appendChild(container);\n * const sandbox = createSandbox(container);\n * const helpers = createSandboxTestHelpers(container);\n \n const render = sandbox.render('<p>test</p>');\n * helpers.fireReady();\n * await render;\n * ```\n */\nexport function createSandboxTestHelpers(container: HTMLElement): SandboxTestHelpers {\n function getIframe(): HTMLIFrameElement \| null {\n return container.querySelector('iframe');\n }\n\n function fire(data: Record<string, unknown>): void {\n const iframe = getIframe();\n const channel = iframe?.dataset.sandboxChannel;\n const generation = Number(iframe?.dataset.sandboxGeneration);\n\n if (!iframe \|\| !channel \|\| !Number.isInteger(generation)) {\n throw new Error('createSandboxTestHelpers requires a rendered sandbox.');\n }\n\n window.dispatchEvent(\n new MessageEvent('message', { data: { ...data, channel, generation }, source: iframe.contentWindow }),\n );\n }\n\n return {\n fireCustom: (event, detail = undefined) => fire({ detail, event, type: 'custom' }),\n fireError: (message, stack) => fire({ message, type: 'error', ...(stack !== undefined ? { stack } : {}) }),\n fireReady: () => fire({ type: 'ready' }),\n fireResize: (height) => fire({ height, type: 'resize' }),\n };\n}\n"],"mappings":"mEAmCA,SAAgB,yBAAyB,EAA4C,CACnF,SAAS,WAAsC,CAC7C,OAAO,EAAU,cAAc,QAAQ,CACzC,CAEA,SAAS,KAAK,EAAqC,CACjD,IAAM,EAAS,UAAU,EACnB,EAAU,GAAQ,QAAQ,eAC1B,EAAa,OAAO,GAAQ,QAAQ,iBAAiB,EAE3D,GAAI,CAAC,GAAU,CAAC,GAAW,CAAC,OAAO,UAAU,CAAU,EACrD,MAAU,MAAM,uDAAuD,EAGzE,OAAO,cACL,IAAI,aAAa,UAAW,CAAE,KAAM,CAAE,GAAG,EAAM,UAAS,YAAW,EAAG,OAAQ,EAAO,aAAc,CAAC,CACtG,CACF,CAEA,MAAO,CACL,YAAa,EAAO,EAAS,IAAA,KAAc,KAAK,CAAE,SAAQ,QAAO,KAAM,QAAS,CAAC,EACjF,WAAY,EAAS,IAAU,KAAK,CAAE,UAAS,KAAM,QAAS,GAAI,IAAU,IAAA,GAAwB,CAAC,EAAb,CAAE,OAAM,CAAQ,CAAC,EACzG,cAAiB,KAAK,CAAE,KAAM,OAAQ,CAAC,EACvC,WAAa,GAAW,KAAK,CAAE,SAAQ,KAAM,QAAS,CAAC,CACzD,CACF"}

package/dist/testing.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 /**
  * Test utilities for code that integrates with @vielzeug/sandbox.
  *
- * Import from '@vielzeug/sandbox/testing' — not the main entry point.
+ * Import from '@vielzeug/sandbox/testing': not the main entry point.
  * These helpers encapsulate the postMessage protocol so tests don't
  * need to know internal message shapes.
  */

package/dist/testing.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"testing.js","names":[],"sources":["../src/testing.ts"],"sourcesContent":["/*\n Test utilities for code that integrates with @vielzeug/sandbox.\n \n Import from '@vielzeug/sandbox/testing' — not the main entry point.\n * These helpers encapsulate the postMessage protocol so tests don't\n * need to know internal message shapes.\n /\n\n/* Helpers for simulating sandbox→host messages in tests. /\nexport interface SandboxTestHelpers {\n /* Fire a 'custom' event as if sandbox code called window.__sandbox__.emit(). /\n fireCustom(event: string, detail?: unknown): void;\n /* Fire an 'error' message as if the sandbox caught an uncaught error. /\n fireError(message: string, stack?: string): void;\n /* Fire a 'ready' signal as if the bridge script executed. /\n fireReady(): void;\n /* Fire a 'resize' message as if the bridge ResizeObserver fired. /\n fireResize(height: number): void;\n}\n\n/\n Create test helpers bound to a specific sandbox container's iframe.\n \n @example\n * ```ts\n * const container = document.createElement('div');\n * document.body.appendChild(container);\n * const sandbox = createSandbox(container);\n * const helpers = createSandboxTestHelpers(container);\n \n const render = sandbox.render('<p>test</p>');\n * helpers.fireReady();\n * await render;\n * ```\n */\nexport function createSandboxTestHelpers(container: HTMLElement): SandboxTestHelpers {\n function getIframe(): HTMLIFrameElement \| null {\n return container.querySelector('iframe');\n }\n\n function fire(data: Record<string, unknown>): void {\n const iframe = getIframe();\n const channel = iframe?.dataset.sandboxChannel;\n const generation = Number(iframe?.dataset.sandboxGeneration);\n\n if (!iframe \|\| !channel \|\| !Number.isInteger(generation)) {\n throw new Error('createSandboxTestHelpers requires a rendered sandbox.');\n }\n\n window.dispatchEvent(\n new MessageEvent('message', { data: { ...data, channel, generation }, source: iframe.contentWindow }),\n );\n }\n\n return {\n fireCustom: (event, detail = undefined) => fire({ detail, event, type: 'custom' }),\n fireError: (message, stack) => fire({ message, type: 'error', ...(stack !== undefined ? { stack } : {}) }),\n fireReady: () => fire({ type: 'ready' }),\n fireResize: (height) => fire({ height, type: 'resize' }),\n };\n}\n"],"mappings":"AAmCA,SAAgB,yBAAyB,EAA4C,CACnF,SAAS,WAAsC,CAC7C,OAAO,EAAU,cAAc,QAAQ,CACzC,CAEA,SAAS,KAAK,EAAqC,CACjD,IAAM,EAAS,UAAU,EACnB,EAAU,GAAQ,QAAQ,eAC1B,EAAa,OAAO,GAAQ,QAAQ,iBAAiB,EAE3D,GAAI,CAAC,GAAU,CAAC,GAAW,CAAC,OAAO,UAAU,CAAU,EACrD,MAAU,MAAM,uDAAuD,EAGzE,OAAO,cACL,IAAI,aAAa,UAAW,CAAE,KAAM,CAAE,GAAG,EAAM,UAAS,YAAW,EAAG,OAAQ,EAAO,aAAc,CAAC,CACtG,CACF,CAEA,MAAO,CACL,YAAa,EAAO,EAAS,IAAA,KAAc,KAAK,CAAE,SAAQ,QAAO,KAAM,QAAS,CAAC,EACjF,WAAY,EAAS,IAAU,KAAK,CAAE,UAAS,KAAM,QAAS,GAAI,IAAU,IAAA,GAAwB,CAAC,EAAb,CAAE,OAAM,CAAQ,CAAC,EACzG,cAAiB,KAAK,CAAE,KAAM,OAAQ,CAAC,EACvC,WAAa,GAAW,KAAK,CAAE,SAAQ,KAAM,QAAS,CAAC,CACzD,CACF"}
1	+ {"version":3,"file":"testing.js","names":[],"sources":["../src/testing.ts"],"sourcesContent":["/*\n Test utilities for code that integrates with @vielzeug/sandbox.\n \n Import from '@vielzeug/sandbox/testing': not the main entry point.\n * These helpers encapsulate the postMessage protocol so tests don't\n * need to know internal message shapes.\n /\n\n/* Helpers for simulating sandbox→host messages in tests. /\nexport interface SandboxTestHelpers {\n /* Fire a 'custom' event as if sandbox code called window.__sandbox__.emit(). /\n fireCustom(event: string, detail?: unknown): void;\n /* Fire an 'error' message as if the sandbox caught an uncaught error. /\n fireError(message: string, stack?: string): void;\n /* Fire a 'ready' signal as if the bridge script executed. /\n fireReady(): void;\n /* Fire a 'resize' message as if the bridge ResizeObserver fired. /\n fireResize(height: number): void;\n}\n\n/\n Create test helpers bound to a specific sandbox container's iframe.\n \n @example\n * ```ts\n * const container = document.createElement('div');\n * document.body.appendChild(container);\n * const sandbox = createSandbox(container);\n * const helpers = createSandboxTestHelpers(container);\n \n const render = sandbox.render('<p>test</p>');\n * helpers.fireReady();\n * await render;\n * ```\n */\nexport function createSandboxTestHelpers(container: HTMLElement): SandboxTestHelpers {\n function getIframe(): HTMLIFrameElement \| null {\n return container.querySelector('iframe');\n }\n\n function fire(data: Record<string, unknown>): void {\n const iframe = getIframe();\n const channel = iframe?.dataset.sandboxChannel;\n const generation = Number(iframe?.dataset.sandboxGeneration);\n\n if (!iframe \|\| !channel \|\| !Number.isInteger(generation)) {\n throw new Error('createSandboxTestHelpers requires a rendered sandbox.');\n }\n\n window.dispatchEvent(\n new MessageEvent('message', { data: { ...data, channel, generation }, source: iframe.contentWindow }),\n );\n }\n\n return {\n fireCustom: (event, detail = undefined) => fire({ detail, event, type: 'custom' }),\n fireError: (message, stack) => fire({ message, type: 'error', ...(stack !== undefined ? { stack } : {}) }),\n fireReady: () => fire({ type: 'ready' }),\n fireResize: (height) => fire({ height, type: 'resize' }),\n };\n}\n"],"mappings":"AAmCA,SAAgB,yBAAyB,EAA4C,CACnF,SAAS,WAAsC,CAC7C,OAAO,EAAU,cAAc,QAAQ,CACzC,CAEA,SAAS,KAAK,EAAqC,CACjD,IAAM,EAAS,UAAU,EACnB,EAAU,GAAQ,QAAQ,eAC1B,EAAa,OAAO,GAAQ,QAAQ,iBAAiB,EAE3D,GAAI,CAAC,GAAU,CAAC,GAAW,CAAC,OAAO,UAAU,CAAU,EACrD,MAAU,MAAM,uDAAuD,EAGzE,OAAO,cACL,IAAI,aAAa,UAAW,CAAE,KAAM,CAAE,GAAG,EAAM,UAAS,YAAW,EAAG,OAAQ,EAAO,aAAc,CAAC,CACtG,CACF,CAEA,MAAO,CACL,YAAa,EAAO,EAAS,IAAA,KAAc,KAAK,CAAE,SAAQ,QAAO,KAAM,QAAS,CAAC,EACjF,WAAY,EAAS,IAAU,KAAK,CAAE,UAAS,KAAM,QAAS,GAAI,IAAU,IAAA,GAAwB,CAAC,EAAb,CAAE,OAAM,CAAQ,CAAC,EACzG,cAAiB,KAAK,CAAE,KAAM,OAAQ,CAAC,EACvC,WAAa,GAAW,KAAK,CAAE,SAAQ,KAAM,QAAS,CAAC,CACzD,CACF"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@vielzeug/sandbox",
-  "version": "26.10.0",
+  "version": "26.10.1",
   "description": "Sandboxed iframe runtime with typed postMessage state bridge",
   "repository": {
     "type": "git",