@vielzeug/sandbox 26.10.15 → 26.10.16

package/dist/_bridge.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_bridge.cjs","names":[],"sources":["../src/_bridge.ts"],"sourcesContent":["import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n"],"mappings":"AAEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP"}
+{"version":3,"file":"_bridge.cjs","names":["bootstrap"],"sources":["../src/_bridge.ts"],"sourcesContent":["import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n"],"mappings":"AAEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,C"}

package/dist/_bridge.js

@@ -1,4 +1,6 @@
-function buildBridgeScript(e){return`
+//#region src/_bridge.ts
+function buildBridgeScript(e) {
+	return `
 (function() {
 window.__sandboxChannel = ${JSON.stringify(e.channel)};
 window.__sandboxGeneration = ${String(e.generation)};
@@ -63,5 +65,9 @@ window.addEventListener('DOMContentLoaded', function() {
   }).observe(document.body);
 });
 })();
-`.trim()}export{buildBridgeScript};
+`.trim();
+}
+//#endregion
+export { buildBridgeScript };
+
 //# sourceMappingURL=_bridge.js.map

package/dist/_bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"_bridge.js","names":[],"sources":["../src/_bridge.ts"],"sourcesContent":["import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n"],"mappings":"AAEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAU,EAAU,OAKf,EAAQ;+BAJf,OAAO,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP"}
+{"version":3,"file":"_bridge.js","names":["bootstrap"],"sources":["../src/_bridge.ts"],"sourcesContent":["import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n"],"mappings":";AAEA,SAAgB,kBAAkB,GAAoC;CAIpE,OAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK;AACP"}

package/dist/_dev.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_dev.cjs","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}
+{"version":3,"file":"_dev.cjs","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C,C"}

package/dist/_dev.js

@@ -1,2 +1,7 @@
-function warn(e){}function devOnly(e){}export{devOnly,warn};
+//#region src/_dev.ts
+function warn(e) {}
+function devOnly(e) {}
+//#endregion
+export { devOnly, warn };
+
 //# sourceMappingURL=_dev.js.map

package/dist/_dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"_dev.js","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n"],"mappings":"AAGA,SAAgB,KAAK,EAAmB,CAExC,CAGA,SAAgB,QAAQ,EAAsB,CAE9C"}
+{"version":3,"file":"_dev.js","names":[],"sources":["../src/_dev.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n"],"mappings":";AAGA,SAAgB,KAAK,GAAmB,CAExC;AAGA,SAAgB,QAAQ,GAAsB,CAE9C"}

package/dist/_document.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_document.cjs","names":[],"sources":["../src/_document.ts"],"sourcesContent":["import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n"],"mappings":"4DAKA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,EAAA,oBAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,EAAA,kBAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP"}
+{"version":3,"file":"_document.cjs","names":["buildCspFromOptions","buildBridgeScript","require__bridge","require__policy","css","value","csp","options","styles","id","scripts","src","nonce","bootstrap","html"],"sources":["../src/_document.ts"],"sourcesContent":["import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n"],"mappings":"A,4DAKA,SAAS,UAAU,EAAqB,CACtC,OAAOI,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOC,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOA,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAMC,EAAM,WAAWN,EAAAA,oBAAoBO,CAAO,CAAC,EAC7CC,EAAS,OAAO,QAAQD,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACE,EAAIL,KAAS,cAAc,WAAWK,CAAE,EAAE,IAAI,UAAUL,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACNM,EAAUH,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAWI,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACNC,EAAQL,EAAQ,MAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeD,EAAI;;;SAGjD,WAAWC,EAAQ,KAAK,EAAE;EACjCC,EAAO;SACAI,EAAM;EACbX,EAAAA,kBAAkBY,CAAS,EAAE;;;;EAI7BH,EAAQ;EACRI,EAAK;;QAGP,C"}

package/dist/_document.js

@@ -1,6 +1,18 @@
-import{buildBridgeScript as e}from"./_bridge.js";import{buildCspFromOptions as t}from"./_policy.js";function escapeCss(e){return e.replace(/<\/style/gi,`\\3C /style`)}function escapeAttr(e){return e.replace(/&/g,`&amp;`).replace(/"/g,`&quot;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`)}function escapeText(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`)}function buildDocumentFromOptions(n,r,i){let a=escapeAttr(t(r)),o=Object.entries(r.styles).map(([e,t])=>`<style id="${escapeAttr(e)}">${escapeCss(t)}</style>`).join(`
-`),s=r.scripts.map(e=>`<script crossorigin="anonymous" src="${escapeAttr(e)}"><\/script>`).join(`
-`),c=r.nonce?` nonce="${escapeAttr(r.nonce)}"`:``;return`<!doctype html>
+import { buildBridgeScript as e } from "./_bridge.js";
+import { buildCspFromOptions as t } from "./_policy.js";
+//#region src/_document.ts
+function escapeCss(e) {
+	return e.replace(/<\/style/gi, "\\3C /style");
+}
+function escapeAttr(e) {
+	return e.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escapeText(e) {
+	return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildDocumentFromOptions(n, r, i) {
+	let a = escapeAttr(t(r)), o = Object.entries(r.styles).map(([e, t]) => `<style id="${escapeAttr(e)}">${escapeCss(t)}</style>`).join("\n"), s = r.scripts.map((e) => `<script crossorigin="anonymous" src="${escapeAttr(e)}"><\/script>`).join("\n"), c = r.nonce ? ` nonce="${escapeAttr(r.nonce)}"` : "";
+	return `<!doctype html>
 <html lang="${escapeAttr(r.lang)}">
 <head>
 <meta http-equiv="Content-Security-Policy" content="${a}">
@@ -16,5 +28,9 @@ ${e(i)}
 ${s}
 ${n}
 </body>
-</html>`}export{buildDocumentFromOptions};
+</html>`;
+}
+//#endregion
+export { buildDocumentFromOptions };
+
 //# sourceMappingURL=_document.js.map

package/dist/_document.js.map

@@ -1 +1 @@
-{"version":3,"file":"_document.js","names":[],"sources":["../src/_document.ts"],"sourcesContent":["import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n"],"mappings":"oGAKA,SAAS,UAAU,EAAqB,CACtC,OAAO,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAO,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAM,EAAM,WAAW,EAAoB,CAAO,CAAC,EAC7C,EAAS,OAAO,QAAQ,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAAC,EAAI,KAAS,cAAc,WAAW,CAAE,EAAE,IAAI,UAAU,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACN,EAAU,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACN,EAAQ,EAAQ,MAAQ,WAAW,WAAW,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAW,EAAQ,IAAI,EAAE;;sDAEe,EAAI;;;SAGjD,WAAW,EAAQ,KAAK,EAAE;EACjC,EAAO;SACA,EAAM;EACb,EAAkB,CAAS,EAAE;;;;EAI7B,EAAQ;EACR,EAAK;;QAGP"}
+{"version":3,"file":"_document.js","names":["css","value","csp","buildCspFromOptions","options","styles","id","scripts","src","nonce","buildBridgeScript","bootstrap","html"],"sources":["../src/_document.ts"],"sourcesContent":["import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n"],"mappings":";;;AAKA,SAAS,UAAU,GAAqB;CACtC,OAAOA,EAAI,QAAQ,cAAc,aAAa;AAChD;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAOC,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AACxG;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAOA,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AAChF;AAEA,SAAgB,yBACd,GACA,GACA,GACQ;CACR,IAAMC,IAAM,WAAWC,EAAoBC,CAAO,CAAC,GAC7CC,IAAS,OAAO,QAAQD,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACE,GAAIN,OAAS,cAAc,WAAWM,CAAE,EAAE,IAAI,UAAUN,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK,IAAI,GACNO,IAAUH,EAAQ,QACrB,KAAK,MAAQ,wCAAwC,WAAWI,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK,IAAI,GACNC,IAAQL,EAAQ,QAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,KAAK;CAExE,OAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeF,EAAI;;;SAGjD,WAAWE,EAAQ,KAAK,EAAE;EACjCC,EAAO;SACAI,EAAM;EACbC,EAAkBC,CAAS,EAAE;;;;EAI7BJ,EAAQ;EACRK,EAAK;;;AAGP"}

package/dist/_policy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_policy.cjs","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":"gCAgBA,IAAa,EAA2B,IAElC,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,EAAA,0BAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb"}
+{"version":3,"file":"_policy.cjs","names":["SandboxConfigurationError","require_errors","DEFAULT_READY_TIMEOUT_MS","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins"],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":"A,gCAgBA,IAAaE,EAA2B,IAElCC,EAAK,2BACLC,EAAO,wCACPC,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAIL,EAAAA,0BAA0B,GAAGM,EAAM,eAAe,OAAOC,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAOA,GAAU,SAAU,OAAO,KAAKD,EAAOC,CAAK,EAEvD,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAKD,EAAOC,CAAK,CAC1B,CAaA,OAVGC,EAAI,WAAa,SAAWA,EAAI,WAAa,UAC9CA,EAAI,UACJA,EAAI,UACJA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,KAEG,KAAKF,EAAOC,CAAK,EAGnBC,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHIC,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQA,CAAM,EAElBA,EAAO,IAAK,GAAU,gBAAgBF,EAAOD,CAAK,CAAC,EAFvB,KAAKA,EAAOG,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAOF,GAAU,SAAU,OAAO,KAAK,UAAWA,CAAK,EAE3D,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAWA,CAAK,CAC9B,CAIA,OAFIC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAiB,KAAK,UAAWD,CAAK,EAEhFC,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAIE,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAOA,GAAW,WAAYA,GAAmB,MAAM,QAAQA,CAAM,EAAG,OAAO,KAAK,SAAUA,CAAM,EAExG,IAAMC,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAACC,EAAIC,KAAQ,OAAO,QAAQH,CAAM,GACvC,CAACP,EAAG,KAAKS,CAAE,GAAK,OAAOC,GAAQ,WAAU,KAAK,SAAUD,CAAE,EAE9D,EAAWA,GAAMC,EAGnB,OAAOF,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAOG,GAAY,WAAYA,GAAoB,MAAM,QAAQA,CAAO,IAAG,KAAK,UAAWA,CAAO,EAEtG,IAAMC,EAAOD,EAAQ,MAAQ,KAExBV,EAAK,KAAKW,CAAI,GAAG,KAAK,OAAQA,CAAI,EAEnCD,EAAQ,QAAU,IAAA,KAAc,CAACT,EAAM,KAAKS,EAAQ,KAAK,GAAKA,EAAQ,MAAM,SAAW,IACzF,KAAK,QAASA,EAAQ,KAAK,EAGzBA,EAAQ,QAAU,IAAA,IAAa,OAAOA,EAAQ,OAAU,UAAU,KAAK,QAASA,EAAQ,KAAK,EAEjG,IAAME,EAAkBF,EAAQ,aAC1BG,EAAeD,GAAA,IAGnBA,IAAoB,IAAA,KACnBA,IAAoB,MACnB,OAAOA,GAAoB,UAC3B,CAAC,OAAO,SAASA,CAAe,GAChCA,GAAmB,GACnBA,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgBA,CAAe,EAGlCF,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,GAAG,KAAK,UAAWA,EAAQ,OAAO,EAErG,IAAMI,GAAWJ,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiBA,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiBA,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAOA,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgBA,EAAQ,MAAM,EACtC,MAAOA,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAMK,EAAgB,CACpB,kBACA,GAAIL,EAAQ,MAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAGA,EAAQ,qBACX,GAAGA,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJC,EAAe,CAAC,kBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3EQ,EAAe,CAAC,QAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjES,EAAcT,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAcK,IACd,aAAaE,IACb,WAAWC,IACX,YAAYC,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,C"}

package/dist/_policy.js

@@ -1,2 +1,78 @@
-import{SandboxConfigurationError as e}from"./errors.js";var t=5e3,n=/^[A-Za-z][A-Za-z0-9_-]*$/,r=/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/,i=/^[A-Za-z0-9+/_-]+={0,2}$/;function fail(t,n){throw new e(`${t} is invalid: ${String(n)}`)}function normalizeOrigin(e,t){if(typeof e!=`string`)return fail(t,e);let n;try{n=new URL(e)}catch{return fail(t,e)}return n.protocol!==`http:`&&n.protocol!==`https:`||n.username||n.password||n.pathname!==`/`||n.search||n.hash?fail(t,e):n.origin}function normalizeOrigins(e,t){return e===void 0?[]:Array.isArray(e)?e.map(e=>normalizeOrigin(e,t)):fail(t,e)}function normalizeScript(e){if(typeof e!=`string`)return fail(`scripts`,e);let t;try{t=new URL(e)}catch{return fail(`scripts`,e)}return t.protocol!==`http:`&&t.protocol!==`https:`?fail(`scripts`,e):t.href}function normalizeStyles(e){if(e===void 0)return{};if(typeof e!=`object`||!e||Array.isArray(e))return fail(`styles`,e);let t={};for(let[r,i]of Object.entries(e))(!n.test(r)||typeof i!=`string`)&&fail(`styles`,r),t[r]=i;return t}function normalizeSandboxOptions(e={}){(typeof e!=`object`||!e||Array.isArray(e))&&fail(`options`,e);let t=e.lang??`en`;r.test(t)||fail(`lang`,t),e.nonce!==void 0&&(!i.test(e.nonce)||e.nonce.length===0)&&fail(`nonce`,e.nonce),e.title!==void 0&&typeof e.title!=`string`&&fail(`title`,e.title);let n=e.readyTimeout,a=n??5e3;n!==void 0&&(n===null||typeof n!=`number`||!Number.isFinite(n)||n<=0||n>2**31-1)&&fail(`readyTimeout`,n),e.scripts!==void 0&&!Array.isArray(e.scripts)&&fail(`scripts`,e.scripts);let o=(e.scripts??[]).map(normalizeScript);return{allowedFontOrigins:normalizeOrigins(e.allowedFontOrigins,`allowedFontOrigins`),allowedImageOrigins:normalizeOrigins(e.allowedImageOrigins,`allowedImageOrigins`),allowedScriptOrigins:normalizeOrigins(e.allowedScriptOrigins,`allowedScriptOrigins`),allowedStyleOrigins:normalizeOrigins(e.allowedStyleOrigins,`allowedStyleOrigins`),lang:t,nonce:e.nonce,readyTimeout:a,scripts:o,styles:normalizeStyles(e.styles),title:e.title??``}}function buildCspFromOptions(e){let t=[`'unsafe-inline'`,...e.nonce?[`'nonce-${e.nonce}'`]:[],...e.allowedScriptOrigins,...e.scripts.map(e=>new URL(e).origin)].join(` `),n=[`'unsafe-inline'`,...e.allowedStyleOrigins].join(` `),r=[`data:`,...e.allowedImageOrigins].join(` `),i=e.allowedFontOrigins.join(` `)||`'none'`;return[`default-src 'none'`,`script-src ${t}`,`style-src ${n}`,`img-src ${r}`,`font-src ${i}`,`connect-src 'none'`,`form-action 'none'`,`base-uri 'none'`].join(`; `)}export{t as DEFAULT_READY_TIMEOUT_MS,buildCspFromOptions,normalizeSandboxOptions};
+import { SandboxConfigurationError as e } from "./errors.js";
+//#region src/_policy.ts
+var t = 5e3, n = /^[A-Za-z][A-Za-z0-9_-]*$/, r = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/, i = /^[A-Za-z0-9+/_-]+={0,2}$/;
+function fail(t, n) {
+	throw new e(`${t} is invalid: ${String(n)}`);
+}
+function normalizeOrigin(e, t) {
+	if (typeof e != "string") return fail(t, e);
+	let n;
+	try {
+		n = new URL(e);
+	} catch {
+		return fail(t, e);
+	}
+	return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password || n.pathname !== "/" || n.search || n.hash ? fail(t, e) : n.origin;
+}
+function normalizeOrigins(e, t) {
+	return e === void 0 ? [] : Array.isArray(e) ? e.map((e) => normalizeOrigin(e, t)) : fail(t, e);
+}
+function normalizeScript(e) {
+	if (typeof e != "string") return fail("scripts", e);
+	let t;
+	try {
+		t = new URL(e);
+	} catch {
+		return fail("scripts", e);
+	}
+	return t.protocol !== "http:" && t.protocol !== "https:" ? fail("scripts", e) : t.href;
+}
+function normalizeStyles(e) {
+	if (e === void 0) return {};
+	if (typeof e != "object" || !e || Array.isArray(e)) return fail("styles", e);
+	let t = {};
+	for (let [r, i] of Object.entries(e)) (!n.test(r) || typeof i != "string") && fail("styles", r), t[r] = i;
+	return t;
+}
+function normalizeSandboxOptions(e = {}) {
+	(typeof e != "object" || !e || Array.isArray(e)) && fail("options", e);
+	let t = e.lang ?? "en";
+	r.test(t) || fail("lang", t), e.nonce !== void 0 && (!i.test(e.nonce) || e.nonce.length === 0) && fail("nonce", e.nonce), e.title !== void 0 && typeof e.title != "string" && fail("title", e.title);
+	let n = e.readyTimeout, a = n ?? 5e3;
+	n !== void 0 && (n === null || typeof n != "number" || !Number.isFinite(n) || n <= 0 || n > 2 ** 31 - 1) && fail("readyTimeout", n), e.scripts !== void 0 && !Array.isArray(e.scripts) && fail("scripts", e.scripts);
+	let o = (e.scripts ?? []).map(normalizeScript);
+	return {
+		allowedFontOrigins: normalizeOrigins(e.allowedFontOrigins, "allowedFontOrigins"),
+		allowedImageOrigins: normalizeOrigins(e.allowedImageOrigins, "allowedImageOrigins"),
+		allowedScriptOrigins: normalizeOrigins(e.allowedScriptOrigins, "allowedScriptOrigins"),
+		allowedStyleOrigins: normalizeOrigins(e.allowedStyleOrigins, "allowedStyleOrigins"),
+		lang: t,
+		nonce: e.nonce,
+		readyTimeout: a,
+		scripts: o,
+		styles: normalizeStyles(e.styles),
+		title: e.title ?? ""
+	};
+}
+function buildCspFromOptions(e) {
+	let t = [
+		"'unsafe-inline'",
+		...e.nonce ? [`'nonce-${e.nonce}'`] : [],
+		...e.allowedScriptOrigins,
+		...e.scripts.map((e) => new URL(e).origin)
+	].join(" "), n = ["'unsafe-inline'", ...e.allowedStyleOrigins].join(" "), r = ["data:", ...e.allowedImageOrigins].join(" "), i = e.allowedFontOrigins.join(" ") || "'none'";
+	return [
+		"default-src 'none'",
+		`script-src ${t}`,
+		`style-src ${n}`,
+		`img-src ${r}`,
+		`font-src ${i}`,
+		"connect-src 'none'",
+		"form-action 'none'",
+		"base-uri 'none'"
+	].join("; ");
+}
+//#endregion
+export { t as DEFAULT_READY_TIMEOUT_MS, buildCspFromOptions, normalizeSandboxOptions };
+
 //# sourceMappingURL=_policy.js.map

package/dist/_policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"_policy.js","names":[],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":"wDAgBA,IAAa,EAA2B,IAElC,EAAK,2BACL,EAAO,wCACP,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,EAA0B,GAAG,EAAM,eAAe,OAAO,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,EAAO,CAAK,EAEvD,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,EAAO,CAAK,CAC1B,CAaA,OAVG,EAAI,WAAa,SAAW,EAAI,WAAa,UAC9C,EAAI,UACJ,EAAI,UACJ,EAAI,WAAa,KACjB,EAAI,QACJ,EAAI,KAEG,KAAK,EAAO,CAAK,EAGnB,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHI,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQ,CAAM,EAElB,EAAO,IAAK,GAAU,gBAAgB,EAAO,CAAK,CAAC,EAFvB,KAAK,EAAO,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAO,GAAU,SAAU,OAAO,KAAK,UAAW,CAAK,EAE3D,IAAI,EAEJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAW,CAAK,CAC9B,CAIA,OAFI,EAAI,WAAa,SAAW,EAAI,WAAa,SAAiB,KAAK,UAAW,CAAK,EAEhF,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAI,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAO,GAAW,WAAY,GAAmB,MAAM,QAAQ,CAAM,EAAG,OAAO,KAAK,SAAU,CAAM,EAExG,IAAM,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAAC,EAAI,KAAQ,OAAO,QAAQ,CAAM,GACvC,CAAC,EAAG,KAAK,CAAE,GAAK,OAAO,GAAQ,WAAU,KAAK,SAAU,CAAE,EAE9D,EAAW,GAAM,EAGnB,OAAO,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAO,GAAY,WAAY,GAAoB,MAAM,QAAQ,CAAO,IAAG,KAAK,UAAW,CAAO,EAEtG,IAAM,EAAO,EAAQ,MAAQ,KAExB,EAAK,KAAK,CAAI,GAAG,KAAK,OAAQ,CAAI,EAEnC,EAAQ,QAAU,IAAA,KAAc,CAAC,EAAM,KAAK,EAAQ,KAAK,GAAK,EAAQ,MAAM,SAAW,IACzF,KAAK,QAAS,EAAQ,KAAK,EAGzB,EAAQ,QAAU,IAAA,IAAa,OAAO,EAAQ,OAAU,UAAU,KAAK,QAAS,EAAQ,KAAK,EAEjG,IAAM,EAAkB,EAAQ,aAC1B,EAAe,GAAA,IAGnB,IAAoB,IAAA,KACnB,IAAoB,MACnB,OAAO,GAAoB,UAC3B,CAAC,OAAO,SAAS,CAAe,GAChC,GAAmB,GACnB,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgB,CAAe,EAGlC,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQ,EAAQ,OAAO,GAAG,KAAK,UAAW,EAAQ,OAAO,EAErG,IAAM,GAAW,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiB,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiB,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiB,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAO,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgB,EAAQ,MAAM,EACtC,MAAO,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAM,EAAgB,CACpB,kBACA,GAAI,EAAQ,MAAQ,CAAC,UAAU,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAG,EAAQ,qBACX,GAAG,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAI,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJ,EAAe,CAAC,kBAAmB,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3E,EAAe,CAAC,QAAS,GAAG,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjE,EAAc,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAc,IACd,aAAa,IACb,WAAW,IACX,YAAY,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb"}
+{"version":3,"file":"_policy.js","names":["DEFAULT_READY_TIMEOUT_MS","ID","LANG","NONCE","SandboxConfigurationError","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins"],"sources":["../src/_policy.ts"],"sourcesContent":["import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n"],"mappings":";;AAgBA,IAAaA,IAA2B,KAElCC,IAAK,4BACLC,IAAO,yCACPC,IAAQ;AAEd,SAAS,KAAK,GAAe,GAAuB;CAClD,MAAM,IAAIC,EAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG;AAC7E;AAEA,SAAS,gBAAgB,GAAgB,GAAuB;CAC9D,IAAI,OAAOA,KAAU,UAAU,OAAO,KAAKD,GAAOC,CAAK;CAEvD,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAKD,GAAOC,CAAK;CAC1B;CAaA,OAVGC,EAAI,aAAa,WAAWA,EAAI,aAAa,YAC9CA,EAAI,YACJA,EAAI,YACJA,EAAI,aAAa,OACjBA,EAAI,UACJA,EAAI,OAEG,KAAKF,GAAOC,CAAK,IAGnBC,EAAI;AACb;AAEA,SAAS,iBAAiB,GAA8B,GAAyB;CAI/E,OAHIC,MAAW,KAAA,IAAkB,CAAC,IAC7B,MAAM,QAAQA,CAAM,IAElBA,EAAO,KAAK,MAAU,gBAAgBF,GAAOD,CAAK,CAAC,IAFvB,KAAKA,GAAOG,CAAM;AAGvD;AAEA,SAAS,gBAAgB,GAAwB;CAC/C,IAAI,OAAOF,KAAU,UAAU,OAAO,KAAK,WAAWA,CAAK;CAE3D,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAK,WAAWA,CAAK;CAC9B;CAIA,OAFIC,EAAI,aAAa,WAAWA,EAAI,aAAa,WAAiB,KAAK,WAAWD,CAAK,IAEhFC,EAAI;AACb;AAEA,SAAS,gBAAgB,GAAoE;CAC3F,IAAIE,MAAW,KAAA,GAAW,OAAO,CAAC;CAClC,IAAI,OAAOA,KAAW,aAAYA,KAAmB,MAAM,QAAQA,CAAM,GAAG,OAAO,KAAK,UAAUA,CAAM;CAExG,IAAMC,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAACC,GAAIC,MAAQ,OAAO,QAAQH,CAAM,GAG3C,CAFI,CAACR,EAAG,KAAKU,CAAE,KAAK,OAAOC,KAAQ,aAAU,KAAK,UAAUD,CAAE,GAE9D,EAAWA,KAAMC;CAGnB,OAAOF;AACT;AAEA,SAAgB,wBAAwB,IAA0B,CAAC,GAA6B;CAC9F,CAAI,OAAOG,KAAY,aAAYA,KAAoB,MAAM,QAAQA,CAAO,MAAG,KAAK,WAAWA,CAAO;CAEtG,IAAMC,IAAOD,EAAQ,QAAQ;CAQ7B,AANKX,EAAK,KAAKY,CAAI,KAAG,KAAK,QAAQA,CAAI,GAEnCD,EAAQ,UAAU,KAAA,MAAc,CAACV,EAAM,KAAKU,EAAQ,KAAK,KAAKA,EAAQ,MAAM,WAAW,MACzF,KAAK,SAASA,EAAQ,KAAK,GAGzBA,EAAQ,UAAU,KAAA,KAAa,OAAOA,EAAQ,SAAU,YAAU,KAAK,SAASA,EAAQ,KAAK;CAEjG,IAAME,IAAkBF,EAAQ,cAC1BG,IAAeD,KAAA;CAarB,AAVEA,MAAoB,KAAA,MACnBA,MAAoB,QACnB,OAAOA,KAAoB,YAC3B,CAAC,OAAO,SAASA,CAAe,KAChCA,KAAmB,KACnBA,IAAkB,KAAK,KAAK,MAE9B,KAAK,gBAAgBA,CAAe,GAGlCF,EAAQ,YAAY,KAAA,KAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,KAAG,KAAK,WAAWA,EAAQ,OAAO;CAErG,IAAMI,KAAWJ,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,eAAe;CAE3D,OAAO;EACL,oBAAoB,iBAAiBA,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,iBAAiBA,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,OAAOA,EAAQ;EACf;EACA;EACA,QAAQ,gBAAgBA,EAAQ,MAAM;EACtC,OAAOA,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,oBAAoB,GAA2C;CAC7E,IAAMK,IAAgB;EACpB;EACA,GAAIL,EAAQ,QAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAGA,EAAQ;EACX,GAAGA,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJC,IAAe,CAAC,mBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3EQ,IAAe,CAAC,SAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjES,IAAcT,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAcK;EACd,aAAaE;EACb,WAAWC;EACX,YAAYC;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb"}

package/dist/_protocol.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.cjs","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}
+{"version":3,"file":"_protocol.cjs","names":["MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","value","bootstrap","bytes","byte","message"],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAaA,EAAa,SACbC,EAAY,QACZC,EAAmB,eACnBC,EAAY,QACZC,EAAa,SACbC,EAAuB,mBACvBC,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAOC,GAAU,YACjBA,GACA,OAAQA,EAAgC,SAAY,UACnDA,EAA8B,UAAYC,EAAU,SACrD,OAAQD,EAAmC,YAAe,UACzDA,EAAiC,aAAeC,EAAU,YAC3D,OAAQD,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAME,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAKA,EAAQ,GAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAGC,EAAS,QAASH,EAAU,QAAS,WAAYA,EAAU,UAAW,CACpF,C"}

package/dist/_protocol.js

@@ -1,2 +1,21 @@
-var e=`custom`,t=`error`,n=`html-replace`,r=`ready`,i=`resize`,a=`state-update-all`,o=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}export{e as MSG_CUSTOM,t as MSG_ERROR,n as MSG_HTML_REPLACE,r as MSG_READY,i as MSG_RESIZE,a as MSG_STATE_UPDATE_ALL,o as MSG_STYLE_PATCH,createChannel,envelope,isProtocolMessage};
+//#region src/_protocol.ts
+var e = "custom", t = "error", n = "html-replace", r = "ready", i = "resize", a = "state-update-all", o = "style-patch";
+function isProtocolMessage(e, t) {
+	return typeof e == "object" && !!e && typeof e.channel == "string" && e.channel === t.channel && typeof e.generation == "number" && e.generation === t.generation && typeof e.type == "string";
+}
+function createChannel() {
+	if (typeof crypto.randomUUID == "function") return crypto.randomUUID();
+	let e = crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(4));
+	return Array.from(e, (e) => e.toString(16).padStart(8, "0")).join("");
+}
+function envelope(e, t) {
+	return {
+		...t,
+		channel: e.channel,
+		generation: e.generation
+	};
+}
+//#endregion
+export { e as MSG_CUSTOM, t as MSG_ERROR, n as MSG_HTML_REPLACE, r as MSG_READY, i as MSG_RESIZE, a as MSG_STATE_UPDATE_ALL, o as MSG_STYLE_PATCH, createChannel, envelope, isProtocolMessage };
+
 //# sourceMappingURL=_protocol.js.map

package/dist/_protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"_protocol.js","names":[],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":"AAAA,IAAa,EAAa,SACb,EAAY,QACZ,EAAmB,eACnB,EAAY,QACZ,EAAa,SACb,EAAuB,mBACvB,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO,GAAU,YACjB,GACA,OAAQ,EAAgC,SAAY,UACnD,EAA8B,UAAY,EAAU,SACrD,OAAQ,EAAmC,YAAe,UACzD,EAAiC,aAAe,EAAU,YAC3D,OAAQ,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAK,EAAQ,GAAS,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAG,EAAS,QAAS,EAAU,QAAS,WAAY,EAAU,UAAW,CACpF"}
+{"version":3,"file":"_protocol.js","names":["MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","value","bootstrap","bytes","byte","message"],"sources":["../src/_protocol.ts"],"sourcesContent":["export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n"],"mappings":";AAAA,IAAaA,IAAa,UACbC,IAAY,SACZC,IAAmB,gBACnBC,IAAY,SACZC,IAAa,UACbC,IAAuB,oBACvBC,IAAkB;AAS/B,SAAgB,kBAAkB,GAAgB,GAAsD;CACtG,OACE,OAAOC,KAAU,cACjBA,KACA,OAAQA,EAAgC,WAAY,YACnDA,EAA8B,YAAYC,EAAU,WACrD,OAAQD,EAAmC,cAAe,YACzDA,EAAiC,eAAeC,EAAU,cAC3D,OAAQD,EAA6B,QAAS;AAElD;AAEA,SAAgB,gBAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAME,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAKA,IAAQ,MAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,SAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAGC;EAAS,SAASH,EAAU;EAAS,YAAYA,EAAU;CAAW;AACpF"}

package/dist/_runtime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.cjs","names":[],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAM,EAAa,EAAA,wBAAwB,CAAO,EAC5C,EAAU,EAAA,cAAc,EACxB,EAAiC,CAAE,GAAG,EAAW,MAAO,EACxD,EAAY,IAAI,IAChB,EAA+B,CAAC,EAChC,EAAa,IAAI,gBACnB,EAAmC,KACnC,EAAW,GACX,EAAc,GACd,EAAa,EACb,EAAqD,KACrD,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B,IAAiB,OAErB,aAAa,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAM,KAAY,EACrB,GAAI,CACF,EAAS,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAAC,GAAU,EAAM,SAAW,EAAO,cAAe,OAEtD,IAAM,EAAY,iBAAiB,EAE9B,KAAA,kBAAkB,EAAM,KAAM,CAAS,EAE5C,OAAQ,EAAM,KAAK,KAAnB,CACE,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,MAAO,EAAM,KAAK,MAAO,KAAM,EAAA,UAAW,CAAC,EAGpF,MACF,KAAK,EAAA,UACC,OAAO,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAAS,EAAM,KAAK,QACpB,GAAI,OAAO,EAAM,KAAK,OAAU,SAAW,CAAE,MAAO,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM,EAAA,SACR,CAAC,EAGH,MACF,KAAK,EAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAK,EAAA,WACC,OAAO,EAAM,KAAK,QAAW,UAAY,OAAO,SAAS,EAAM,KAAK,MAAM,GAAK,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQ,EAAM,KAAK,OAAQ,KAAM,EAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATI,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxC,EAAO,aAAa,UAAW,eAAe,EAC9C,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiB,EAChC,EAAU,YAAY,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzC,EACT,CAEA,SAAS,SAAgB,CACnB,IAEJ,EAAW,GACX,uBAAuB,EACvB,EAAW,MAAM,EAEjB,AAGE,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnD,EAAO,OAAO,EACL,MAGX,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARI,MAGW,CAAC,GAGhB,EAAU,IAAI,CAAO,MAER,EAAU,OAAO,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAI,EAGF,OAAO,QAAQ,QAAQ,EAGpB,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAM,EAAU,aAAa,EACvB,EAAY,iBAAiB,EAC7B,EAAkB,CAAE,GAAG,EAAY,OAAQ,CAAE,GAAG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAO,CAAU,EACrD,EAAQ,OAAS,EAAA,yBAAyB,EAAM,EAAiB,CAAS,EAE1E,IAAM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzB,IAEL,EAAc,OACZ,IAAI,EAAA,oBACF,oDAAoD,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAG,EAAW,YAAY,EAEnB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpD,GAAQ,eAAe,YAAY,EAAA,SAAS,iBAAiB,EAAG,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B,GAAgB,GAAQ,eAAiB,OAAO,KAAK,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAG,CAAa,EAAG,KAAM,EAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1C,IAMJ,OAAO,OAAO,EAAc,CAAM,EAE9B,GAAe,GAAQ,eAAiB,OAAO,KAAK,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQ,EAAQ,KAAM,EAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnC,GAMC,GAAgB,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAM,EAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9C,IAYJ,EAAO,GAAM,EAET,GAAe,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAM,EAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAO,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAO,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF"}
+{"version":3,"file":"_runtime.cjs","names":["normalizeSandboxOptions","createChannel","isProtocolMessage","MSG_CUSTOM","MSG_ERROR","MSG_READY","MSG_RESIZE","buildDocumentFromOptions","SandboxTimeoutError","envelope","MSG_STATE_UPDATE_ALL","MSG_HTML_REPLACE","MSG_STYLE_PATCH","require_errors","require__policy","require__document","require__protocol","normalized","options","channel","styles","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","readyTimeout","currentRender","listener","message","event","bootstrap","container","handler","html","current","documentOptions","promise","update","id","css"],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMiB,EAAajB,EAAAA,wBAAwBkB,CAAO,EAC5CC,EAAUlB,EAAAA,cAAc,EACxBmB,EAAiC,CAAE,GAAGH,EAAW,MAAO,EACxDI,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACbC,EAAqD,KACrDC,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7BD,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClBC,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYT,EACrB,GAAI,CACFS,EAASC,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACP,GAAUQ,EAAM,SAAWR,EAAO,cAAe,OAEtD,IAAMS,EAAY,iBAAiB,EAEnC,GAAK/B,EAAAA,kBAAkB8B,EAAM,KAAMC,CAAS,EAE5C,OAAQD,EAAM,KAAK,KAAnB,CACE,KAAK7B,EAAAA,WACC,OAAO6B,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAM7B,EAAAA,UAAW,CAAC,EAGpF,MACF,KAAKC,EAAAA,UACC,OAAO4B,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM5B,EAAAA,SACR,CAAC,EAGH,MACF,KAAKC,EAAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EAAAA,WACC,OAAO0B,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAM1B,EAAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIkB,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBL,EAChCe,EAAU,YAAYV,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIc,CAAO,MAERd,EAAU,OAAOc,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIV,EAGF,OAAO,QAAQ,QAAQ,EAGpBW,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMC,EAAU,aAAa,EACvBJ,EAAY,iBAAiB,EAC7BK,EAAkB,CAAE,GAAGrB,EAAY,OAAQ,CAAE,GAAGG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOO,CAAU,EACrD,EAAQ,OAASpB,EAAAA,yBAAyB6B,EAAME,EAAiBL,CAAS,EAE1E,IAAMM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBV,IAELA,EAAc,OACZ,IAAIrB,EAAAA,oBACF,oDAAoDS,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnBsB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDf,GAAQ,eAAe,YAAYf,EAAAA,SAAS,iBAAiB,EAAGsB,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5BL,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMZ,EAAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1Ce,IAMJ,OAAO,OAAOH,EAAckB,CAAM,EAE9Bd,GAAeF,GAAQ,eAAiB,OAAO,KAAKgB,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAM9B,EAAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCe,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMb,EAAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9Cc,IAYJ,EAAOgB,GAAMC,EAEThB,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMZ,EAAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOW,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}

package/dist/_runtime.js

@@ -1,2 +1,129 @@
-import"./_dev.js";import{SandboxTimeoutError as e}from"./errors.js";import{normalizeSandboxOptions as t}from"./_policy.js";import{buildDocumentFromOptions as n}from"./_document.js";import{MSG_CUSTOM as r,MSG_ERROR as i,MSG_HTML_REPLACE as a,MSG_READY as o,MSG_RESIZE as s,MSG_STATE_UPDATE_ALL as c,MSG_STYLE_PATCH as l,createChannel as u,envelope as d,isProtocolMessage as f}from"./_protocol.js";function createSandbox(p,m={}){let h=t(m),g=u(),_={...h.styles},v=new Set,y={},b=new AbortController,x=null,S=!1,C=!1,w=0,T=null,E=null;function currentBootstrap(){return{channel:g,generation:w}}function clearReadyTimeout(){T!==null&&(clearTimeout(T),T=null)}function supersedePendingRender(){clearReadyTimeout(),E?.resolve(),E=null,C=!1}function broadcast(e){for(let t of v)try{t(e)}catch{}}function handleMessage(e){if(!x||e.source!==x.contentWindow)return;let t=currentBootstrap();if(f(e.data,t))switch(e.data.type){case r:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:r});break;case i:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:i});break;case o:supersedePendingRender(),C=!0,flushPendingState();break;case s:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:s})}}function ensureIframe(){return x||(x=document.createElement(`iframe`),x.setAttribute(`sandbox`,`allow-scripts`),x.setAttribute(`referrerpolicy`,`no-referrer`),x.dataset.sandboxChannel=g,p.appendChild(x),window.addEventListener(`message`,handleMessage),x)}function dispose(){S||(S=!0,supersedePendingRender(),b.abort(),x&&=(window.removeEventListener(`message`,handleMessage),x.remove(),null),v.clear())}function onMessage(e){return S?()=>{}:(v.add(e),()=>v.delete(e))}function render(t){if(S)return Promise.resolve();t.trim(),supersedePendingRender(),w+=1;let r=ensureIframe(),i=currentBootstrap(),a={...h,styles:{..._}};r.dataset.sandboxGeneration=String(w),r.srcdoc=n(t,a,i);let o=new Promise((e,t)=>{E={reject:t,resolve:e}});return T=setTimeout(()=>{E&&(E.reject(new e(`render() did not receive a 'ready' signal within ${h.readyTimeout}ms. An injected script may have blocked document initialization.`)),E=null,T=null)},h.readyTimeout),o}function send(e){x?.contentWindow?.postMessage(d(currentBootstrap(),e),`*`)}function flushPendingState(){C&&x?.contentWindow&&Object.keys(y).length!==0&&send({record:{...y},type:c})}function setState(e){S||(Object.assign(y,e),C&&x?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:c}))}function replaceBody(e){S||C&&x?.contentWindow&&send({html:e,type:a})}function updateStyle(e,t){S||(_[e]=t,C&&x?.contentWindow&&send({css:t,id:e,type:l}))}return{get disposalSignal(){return b.signal},dispose,get disposed(){return S},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}export{createSandbox};
+import "./_dev.js";
+import { SandboxTimeoutError as e } from "./errors.js";
+import { normalizeSandboxOptions as t } from "./_policy.js";
+import { buildDocumentFromOptions as n } from "./_document.js";
+import { MSG_CUSTOM as r, MSG_ERROR as i, MSG_HTML_REPLACE as a, MSG_READY as o, MSG_RESIZE as s, MSG_STATE_UPDATE_ALL as c, MSG_STYLE_PATCH as l, createChannel as u, envelope as d, isProtocolMessage as f } from "./_protocol.js";
+//#region src/_runtime.ts
+function createSandbox(p, m = {}) {
+	let h = t(m), g = u(), _ = { ...h.styles }, v = /* @__PURE__ */ new Set(), y = {}, b = new AbortController(), x = null, S = !1, C = !1, w = 0, T = null, E = null;
+	function currentBootstrap() {
+		return {
+			channel: g,
+			generation: w
+		};
+	}
+	function clearReadyTimeout() {
+		T !== null && (clearTimeout(T), T = null);
+	}
+	function supersedePendingRender() {
+		clearReadyTimeout(), E?.resolve(), E = null, C = !1;
+	}
+	function broadcast(e) {
+		for (let t of v) try {
+			t(e);
+		} catch {}
+	}
+	function handleMessage(e) {
+		if (!x || e.source !== x.contentWindow) return;
+		let t = currentBootstrap();
+		if (f(e.data, t)) switch (e.data.type) {
+			case r:
+				typeof e.data.event == "string" && broadcast({
+					detail: e.data.detail,
+					event: e.data.event,
+					type: r
+				});
+				break;
+			case i:
+				typeof e.data.message == "string" && broadcast({
+					message: e.data.message,
+					...typeof e.data.stack == "string" ? { stack: e.data.stack } : {},
+					type: i
+				});
+				break;
+			case o:
+				supersedePendingRender(), C = !0, flushPendingState();
+				break;
+			case s: typeof e.data.height == "number" && Number.isFinite(e.data.height) && e.data.height >= 0 && broadcast({
+				height: e.data.height,
+				type: s
+			});
+		}
+	}
+	function ensureIframe() {
+		return x || (x = document.createElement("iframe"), x.setAttribute("sandbox", "allow-scripts"), x.setAttribute("referrerpolicy", "no-referrer"), x.dataset.sandboxChannel = g, p.appendChild(x), window.addEventListener("message", handleMessage), x);
+	}
+	function dispose() {
+		S || (S = !0, supersedePendingRender(), b.abort(), x &&= (window.removeEventListener("message", handleMessage), x.remove(), null), v.clear());
+	}
+	function onMessage(e) {
+		return S ? () => {} : (v.add(e), () => v.delete(e));
+	}
+	function render(t) {
+		if (S) return Promise.resolve();
+		t.trim(), supersedePendingRender(), w += 1;
+		let r = ensureIframe(), i = currentBootstrap(), a = {
+			...h,
+			styles: { ..._ }
+		};
+		r.dataset.sandboxGeneration = String(w), r.srcdoc = n(t, a, i);
+		let o = new Promise((e, t) => {
+			E = {
+				reject: t,
+				resolve: e
+			};
+		});
+		return T = setTimeout(() => {
+			E && (E.reject(new e(`render() did not receive a 'ready' signal within ${h.readyTimeout}ms. An injected script may have blocked document initialization.`)), E = null, T = null);
+		}, h.readyTimeout), o;
+	}
+	function send(e) {
+		x?.contentWindow?.postMessage(d(currentBootstrap(), e), "*");
+	}
+	function flushPendingState() {
+		C && x?.contentWindow && Object.keys(y).length !== 0 && send({
+			record: { ...y },
+			type: c
+		});
+	}
+	function setState(e) {
+		S || (Object.assign(y, e), C && x?.contentWindow && Object.keys(e).length > 0 && send({
+			record: e,
+			type: c
+		}));
+	}
+	function replaceBody(e) {
+		S || C && x?.contentWindow && send({
+			html: e,
+			type: a
+		});
+	}
+	function updateStyle(e, t) {
+		S || (_[e] = t, C && x?.contentWindow && send({
+			css: t,
+			id: e,
+			type: l
+		}));
+	}
+	return {
+		get disposalSignal() {
+			return b.signal;
+		},
+		dispose,
+		get disposed() {
+			return S;
+		},
+		onMessage,
+		render,
+		replaceBody,
+		setState,
+		[Symbol.dispose]() {
+			dispose();
+		},
+		updateStyle
+	};
+}
+//#endregion
+export { createSandbox };
+
 //# sourceMappingURL=_runtime.js.map