@vielzeug/sandbox 26.11.13 → 26.11.15

package/dist/_runtime.cjs

@@ -1,2 +1,2 @@
-require("./_dev.cjs");const e=require("./_document.cjs"),t=require("./_policy.cjs"),n=require("./_protocol.cjs"),r=require("./errors.cjs");function createSandbox(i,a={}){let o=t.normalizeSandboxOptions(a),s=n.createChannel(),c={...o.styles},l=new Set,u={},d=new AbortController,f=null,p=!1,m=!1,h=0,g=null,_=null;function currentBootstrap(){return{channel:s,generation:h}}function clearReadyTimeout(){g!==null&&(clearTimeout(g),g=null)}function supersedePendingRender(){clearReadyTimeout(),_?.resolve(),_=null,m=!1}function broadcast(e){for(let t of l)try{t(e)}catch{}}function handleMessage(e){if(!f||e.source!==f.contentWindow)return;let t=currentBootstrap();if(n.isProtocolMessage(e.data,t))switch(e.data.type){case n.MSG_CUSTOM:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:n.MSG_CUSTOM});break;case n.MSG_ERROR:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:n.MSG_ERROR});break;case n.MSG_READY:supersedePendingRender(),m=!0,flushPendingState();break;case n.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:n.MSG_RESIZE})}}function ensureIframe(){return f||(f=document.createElement(`iframe`),f.setAttribute(`sandbox`,`allow-scripts`),f.setAttribute(`referrerpolicy`,`no-referrer`),f.dataset.sandboxChannel=s,i.appendChild(f),window.addEventListener(`message`,handleMessage),f)}function dispose(){p||(p=!0,supersedePendingRender(),d.abort(),f&&=(window.removeEventListener(`message`,handleMessage),f.remove(),null),l.clear())}function onMessage(e){return p?()=>{}:(l.add(e),()=>l.delete(e))}function render(t){if(p)return Promise.resolve();t.trim(),supersedePendingRender(),h+=1;let n=ensureIframe(),i=currentBootstrap(),a={...o,styles:{...c}};n.dataset.sandboxGeneration=String(h),n.srcdoc=e.buildDocumentFromOptions(t,a,i);let s=new Promise((e,t)=>{_={reject:t,resolve:e}});return g=setTimeout(()=>{_&&(_.reject(new r.SandboxTimeoutError(`render() did not receive a 'ready' signal within ${o.readyTimeout}ms. An injected script may have blocked document initialization.`)),_=null,g=null)},o.readyTimeout),s}function send(e){f?.contentWindow?.postMessage(n.envelope(currentBootstrap(),e),`*`)}function flushPendingState(){m&&f?.contentWindow&&Object.keys(u).length!==0&&send({record:{...u},type:n.MSG_STATE_UPDATE_ALL})}function setState(e){p||(Object.assign(u,e),m&&f?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:n.MSG_STATE_UPDATE_ALL}))}function replaceBody(e){p||m&&f?.contentWindow&&send({html:e,type:n.MSG_HTML_REPLACE})}function updateStyle(e,t){p||(c[e]=t,m&&f?.contentWindow&&send({css:t,id:e,type:n.MSG_STYLE_PATCH}))}return{get disposalSignal(){return d.signal},dispose,get disposed(){return p},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}exports.createSandbox=createSandbox;
+require("./_dev.cjs");const e=require("./_document.cjs"),t=require("./_policy.cjs"),n=require("./_protocol.cjs"),r=require("./errors.cjs");function createSandbox(i,a={}){let o=t.normalizeSandboxOptions(a),s=n.createChannel(),c={...o.styles},l=new Set,u={},d=new AbortController,f=null,p=!1,m=!1,h=0,g=null,_=null;function currentBootstrap(){return{channel:s,generation:h}}function clearReadyTimeout(){g!==null&&(clearTimeout(g),g=null)}function supersedePendingRender(){clearReadyTimeout(),_?.resolve(),_=null,m=!1}function broadcast(e){for(let t of l)try{t(e)}catch{}}function handleMessage(e){if(!f||e.source!==f.contentWindow)return;let t=currentBootstrap();if(n.isProtocolMessage(e.data,t))switch(e.data.type){case n.MSG_CUSTOM:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:n.MSG_CUSTOM});break;case n.MSG_ERROR:typeof e.data.message==`string`&&(broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:n.MSG_ERROR}),`${e.data.message}`);break;case n.MSG_READY:supersedePendingRender(),m=!0,flushPendingState();break;case n.MSG_RESIZE:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:n.MSG_RESIZE})}}function ensureIframe(){return f||(f=document.createElement(`iframe`),f.setAttribute(`sandbox`,`allow-scripts`),f.setAttribute(`referrerpolicy`,`no-referrer`),f.dataset.sandboxChannel=s,i.appendChild(f),window.addEventListener(`message`,handleMessage),f)}function dispose(){p||(p=!0,supersedePendingRender(),d.abort(),f&&=(window.removeEventListener(`message`,handleMessage),f.remove(),null),l.clear())}function onMessage(e){return p?()=>{}:(l.add(e),()=>l.delete(e))}function render(t){if(p)return Promise.resolve();t.trim(),supersedePendingRender(),h+=1;let n=ensureIframe(),i=currentBootstrap(),a={...o,styles:{...c}};n.dataset.sandboxGeneration=String(h),n.srcdoc=e.buildDocumentFromOptions(t,a,i);let s=new Promise((e,t)=>{_={reject:t,resolve:e}});return g=setTimeout(()=>{_&&(_.reject(new r.SandboxTimeoutError(`render() did not receive a 'ready' signal within ${o.readyTimeout}ms. An injected script may have blocked document initialization.`)),_=null,g=null)},o.readyTimeout),s}function send(e){f?.contentWindow?.postMessage(n.envelope(currentBootstrap(),e),`*`)}function flushPendingState(){m&&f?.contentWindow&&Object.keys(u).length!==0&&send({record:{...u},type:n.MSG_STATE_UPDATE_ALL})}function setState(e){p||(Object.assign(u,e),m&&f?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:n.MSG_STATE_UPDATE_ALL}))}function replaceBody(e){p||m&&f?.contentWindow&&send({html:e,type:n.MSG_HTML_REPLACE})}function updateStyle(e,t){p||(c[e]=t,m&&f?.contentWindow&&send({css:t,id:e,type:n.MSG_STYLE_PATCH}))}return{get disposalSignal(){return d.signal},dispose,get disposed(){return p},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}exports.createSandbox=createSandbox;
 //# sourceMappingURL=_runtime.cjs.map

package/dist/_runtime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.cjs","names":["normalizeSandboxOptions","createChannel","isProtocolMessage","MSG_CUSTOM","MSG_ERROR","MSG_READY","MSG_RESIZE","buildDocumentFromOptions","SandboxTimeoutError","envelope","MSG_STATE_UPDATE_ALL","MSG_HTML_REPLACE","MSG_STYLE_PATCH","require__document","require__policy","require__protocol","require_errors","normalized","options","channel","styles","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","readyTimeout","currentRender","listener","message","event","bootstrap","container","handler","html","current","documentOptions","promise","update","id","css"],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMiB,EAAajB,EAAAA,wBAAwBkB,CAAO,EAC5CC,EAAUlB,EAAAA,cAAc,EACxBmB,EAAiC,CAAE,GAAGH,EAAW,MAAO,EACxDI,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACbC,EAAqD,KACrDC,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7BD,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClBC,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYT,EACrB,GAAI,CACFS,EAASC,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACP,GAAUQ,EAAM,SAAWR,EAAO,cAAe,OAEtD,IAAMS,EAAY,iBAAiB,EAEnC,GAAK/B,EAAAA,kBAAkB8B,EAAM,KAAMC,CAAS,EAE5C,OAAQD,EAAM,KAAK,KAAnB,CACE,KAAK7B,EAAAA,WACC,OAAO6B,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAM7B,EAAAA,UAAW,CAAC,EAGpF,MACF,KAAKC,EAAAA,UACC,OAAO4B,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM5B,EAAAA,SACR,CAAC,EAGH,MACF,KAAKC,EAAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EAAAA,WACC,OAAO0B,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAM1B,EAAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIkB,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBL,EAChCe,EAAU,YAAYV,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIc,CAAO,MAERd,EAAU,OAAOc,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIV,EAGF,OAAO,QAAQ,QAAQ,EAGpBW,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMC,EAAU,aAAa,EACvBJ,EAAY,iBAAiB,EAC7BK,EAAkB,CAAE,GAAGrB,EAAY,OAAQ,CAAE,GAAGG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOO,CAAU,EACrD,EAAQ,OAASpB,EAAAA,yBAAyB6B,EAAME,EAAiBL,CAAS,EAE1E,IAAMM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBV,IAELA,EAAc,OACZ,IAAIrB,EAAAA,oBACF,oDAAoDS,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnBsB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDf,GAAQ,eAAe,YAAYf,EAAAA,SAAS,iBAAiB,EAAGsB,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5BL,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMZ,EAAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1Ce,IAMJ,OAAO,OAAOH,EAAckB,CAAM,EAE9Bd,GAAeF,GAAQ,eAAiB,OAAO,KAAKgB,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAM9B,EAAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCe,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMb,EAAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9Cc,IAYJ,EAAOgB,GAAMC,EAEThB,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMZ,EAAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOW,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}
+{"version":3,"file":"_runtime.cjs","names":["normalizeSandboxOptions","createChannel","isProtocolMessage","MSG_CUSTOM","MSG_ERROR","MSG_READY","MSG_RESIZE","buildDocumentFromOptions","SandboxTimeoutError","envelope","MSG_STATE_UPDATE_ALL","MSG_HTML_REPLACE","MSG_STYLE_PATCH","require__document","require__policy","require__protocol","require_errors","normalized","options","channel","styles","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","readyTimeout","currentRender","listener","message","event","bootstrap","container","handler","html","current","documentOptions","promise","update","id","css"],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n\n          // The bridge replaces window.onerror inside the document, so without this the\n          // host is the only place a sandboxed error can surface: consumers that do not\n          // subscribe to MSG_ERROR would otherwise watch a sandbox fail silently.\n          warn(`sandboxed document error: ${event.data.message}`);\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,2IAmBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMiB,EAAajB,EAAAA,wBAAwBkB,CAAO,EAC5CC,EAAUlB,EAAAA,cAAc,EACxBmB,EAAiC,CAAE,GAAGH,EAAW,MAAO,EACxDI,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACbC,EAAqD,KACrDC,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7BD,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClBC,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYT,EACrB,GAAI,CACFS,EAASC,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACP,GAAUQ,EAAM,SAAWR,EAAO,cAAe,OAEtD,IAAMS,EAAY,iBAAiB,EAEnC,GAAK/B,EAAAA,kBAAkB8B,EAAM,KAAMC,CAAS,EAE5C,OAAQD,EAAM,KAAK,KAAnB,CACE,KAAK7B,EAAAA,WACC,OAAO6B,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAM7B,EAAAA,UAAW,CAAC,EAGpF,MACF,KAAKC,EAAAA,UACC,OAAO4B,EAAM,KAAK,SAAY,WAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAM5B,EAAAA,SACR,CAAC,EAKI,GAA6B4B,EAAM,KAAK,QAAxC,GAGP,MACF,KAAK3B,EAAAA,UACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EAAAA,WACC,OAAO0B,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAM1B,EAAAA,UAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIkB,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBL,EAChCe,EAAU,YAAYV,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIc,CAAO,MAERd,EAAU,OAAOc,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIV,EAGF,OAAO,QAAQ,QAAQ,EAGpBW,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMC,EAAU,aAAa,EACvBJ,EAAY,iBAAiB,EAC7BK,EAAkB,CAAE,GAAGrB,EAAY,OAAQ,CAAE,GAAGG,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOO,CAAU,EACrD,EAAQ,OAASpB,EAAAA,yBAAyB6B,EAAME,EAAiBL,CAAS,EAE1E,IAAMM,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBV,IAELA,EAAc,OACZ,IAAIrB,EAAAA,oBACF,oDAAoDS,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnBsB,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDf,GAAQ,eAAe,YAAYf,EAAAA,SAAS,iBAAiB,EAAGsB,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5BL,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMZ,EAAAA,oBAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1Ce,IAMJ,OAAO,OAAOH,EAAckB,CAAM,EAE9Bd,GAAeF,GAAQ,eAAiB,OAAO,KAAKgB,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAM9B,EAAAA,oBAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCe,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMb,EAAAA,gBAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9Cc,IAYJ,EAAOgB,GAAMC,EAEThB,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMZ,EAAAA,eAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOW,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}

package/dist/_runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,wBAAgB,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,SAAS,EAAE,WAAW,EACtB,OAAO,GAAE,cAAmB,GAC3B,aAAa,CAAC,KAAK,CAAC,CA2OtB"}
+{"version":3,"file":"_runtime.d.ts","sourceRoot":"","sources":["../src/_runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,wBAAgB,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,SAAS,EAAE,WAAW,EACtB,OAAO,GAAE,cAAmB,GAC3B,aAAa,CAAC,KAAK,CAAC,CAgPtB"}

package/dist/_runtime.js

@@ -35,11 +35,11 @@ function createSandbox(p, m = {}) {
 				});
 				break;
 			case r:
-				typeof e.data.message == "string" && broadcast({
+				typeof e.data.message == "string" && (broadcast({
 					message: e.data.message,
 					...typeof e.data.stack == "string" ? { stack: e.data.stack } : {},
 					type: r
-				});
+				}), `${e.data.message}`);
 				break;
 			case a:
 				supersedePendingRender(), C = !0, flushPendingState();

package/dist/_runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"_runtime.js","names":["normalized","normalizeSandboxOptions","options","channel","createChannel","styles","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","readyTimeout","currentRender","listener","message","event","bootstrap","isProtocolMessage","MSG_CUSTOM","MSG_ERROR","MSG_READY","MSG_RESIZE","container","handler","html","current","documentOptions","buildDocumentFromOptions","promise","SandboxTimeoutError","envelope","MSG_STATE_UPDATE_ALL","update","MSG_HTML_REPLACE","id","css","MSG_STYLE_PATCH"],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";;;;;;AAmBA,SAAgB,cACd,GACA,IAA0B,CAAC,GACL;CACtB,IAAMA,IAAaC,EAAwBC,CAAO,GAC5CC,IAAUC,EAAc,GACxBC,IAAiC,EAAE,GAAGL,EAAW,OAAO,GACxDM,oBAAY,IAAI,IAAuC,GACvDC,IAA+B,CAAC,GAChCC,IAAa,IAAI,gBAAgB,GACnCC,IAAmC,MACnCC,IAAW,IACXC,IAAc,IACdC,IAAa,GACbC,IAAqD,MACrDC,IAAkF;CAEtF,SAAS,mBAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,oBAA0B;EACjC,AAAID,MAAiB,SAErB,aAAaA,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,yBAA+B;EAItC,AAHA,kBAAkB,GAClBC,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,UAAU,GAA+B;EAChD,KAAK,IAAMC,KAAYT,GACrB,IAAI;GACF,EAASU,CAAO;EAClB,QAAQ,CAER;CAEJ;CAEA,SAAS,cAAc,GAA2B;EAChD,IAAI,CAACP,KAAUQ,EAAM,WAAWR,EAAO,eAAe;EAEtD,IAAMS,IAAY,iBAAiB;EAEnC,IAAKC,EAAkBF,EAAM,MAAMC,CAAS,GAE5C,QAAQD,EAAM,KAAK,MAAnB;GACE,KAAKG;IACH,AAAI,OAAOH,EAAM,KAAK,SAAU,YAC9B,UAAU;KAAE,QAAQA,EAAM,KAAK;KAAQ,OAAOA,EAAM,KAAK;KAAO,MAAMG;IAAW,CAAC;IAGpF;GACF,KAAKC;IACH,AAAI,OAAOJ,EAAM,KAAK,WAAY,YAChC,UAAU;KACR,SAASA,EAAM,KAAK;KACpB,GAAI,OAAOA,EAAM,KAAK,SAAU,WAAW,EAAE,OAAOA,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAMI;IACR,CAAC;IAGH;GACF,KAAKC;IAGH,AAFA,uBAAuB,GACvB,IAAc,IACd,kBAAkB;IAClB;GACF,KAAKC,GACH,AAAI,OAAON,EAAM,KAAK,UAAW,YAAY,OAAO,SAASA,EAAM,KAAK,MAAM,KAAKA,EAAM,KAAK,UAAU,KACtG,UAAU;IAAE,QAAQA,EAAM,KAAK;IAAQ,MAAMM;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,eAAkC;EAUzC,OATId,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxCA,EAAO,aAAa,WAAW,eAAe,GAC9CA,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiBN,GAChCqB,EAAU,YAAYf,CAAM,GAC5B,OAAO,iBAAiB,WAAW,aAAa,GAEzCA;CACT;CAEA,SAAS,UAAgB;EACvB,AAAIC,MAEJ,IAAW,IACX,uBAAuB,GACvBF,EAAW,MAAM,GAEjB,AAGEC,OAFA,OAAO,oBAAoB,WAAW,aAAa,GACnDA,EAAO,OAAO,GACL,OAGXH,EAAU,MAAM;CAClB;CAEA,SAAS,UAAU,GAAwD;EASzE,OARII,UAGW,CAAC,KAGhBJ,EAAU,IAAImB,CAAO,SAERnB,EAAU,OAAOmB,CAAO;CACvC;CAEA,SAAS,OAAO,GAA6B;EAC3C,IAAIf,GAGF,OAAO,QAAQ,QAAQ;EAMzB,AAHKgB,EAAK,KAAK,GAEf,uBAAuB,GACvB,KAAc;EAEd,IAAMC,IAAU,aAAa,GACvBT,IAAY,iBAAiB,GAC7BU,IAAkB;GAAE,GAAG5B;GAAY,QAAQ,EAAE,GAAGK,EAAO;EAAE;EAG/D,AADA,EAAQ,QAAQ,oBAAoB,OAAOO,CAAU,GACrD,EAAQ,SAASiB,EAAyBH,GAAME,GAAiBV,CAAS;EAE1E,IAAMY,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GAC9B,AAAKhB,MAELA,EAAc,OACZ,IAAIiB,EACF,oDAAoD/B,EAAW,aAAa,iEAE9E,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAGA,EAAW,YAAY,GAEnB8B;CACT;CAEA,SAAS,KAAK,GAAwC;EACpD,GAAQ,eAAe,YAAYE,EAAS,iBAAiB,GAAGhB,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,oBAA0B;EACjC,AAAKL,KAAgBF,GAAQ,iBAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,WAAW,KAEnF,KAAK;GAAE,QAAQ,EAAE,GAAGA,EAAa;GAAG,MAAM0B;EAAqB,CAAC;CAClE;CAEA,SAAS,SAAS,GAA8B;EAC9C,AAAIvB,MAMJ,OAAO,OAAOH,GAAc2B,CAAM,GAE9BvB,KAAeF,GAAQ,iBAAiB,OAAO,KAAKyB,CAAM,CAAC,CAAC,SAAS,KACvE,KAAK;GAAE,QAAQA;GAAQ,MAAMD;EAAqB,CAAC;CAEvD;CAEA,SAAS,YAAY,GAAoB;EACvC,AAAIvB,KAMCC,KAAgBF,GAAQ,iBAM7B,KAAK;GAAE;GAAM,MAAM0B;EAAiB,CAAC;CACvC;CAEA,SAAS,YAAY,GAAY,GAAmB;EAClD,AAAIzB,MAYJ,EAAO0B,KAAMC,GAET1B,KAAeF,GAAQ,iBAAe,KAAK;GAAE;GAAK;GAAI,MAAM6B;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAO9B,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAOE;EACT;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,QAAQ;EACV;EACA;CACF;AACF"}
+{"version":3,"file":"_runtime.js","names":["normalized","normalizeSandboxOptions","options","channel","createChannel","styles","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","readyTimeout","currentRender","listener","message","event","bootstrap","isProtocolMessage","MSG_CUSTOM","MSG_ERROR","MSG_READY","MSG_RESIZE","container","handler","html","current","documentOptions","buildDocumentFromOptions","promise","SandboxTimeoutError","envelope","MSG_STATE_UPDATE_ALL","update","MSG_HTML_REPLACE","id","css","MSG_STYLE_PATCH"],"sources":["../src/_runtime.ts"],"sourcesContent":["import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n\n          // The bridge replaces window.onerror inside the document, so without this the\n          // host is the only place a sandboxed error can surface: consumers that do not\n          // subscribe to MSG_ERROR would otherwise watch a sandbox fail silently.\n          warn(`sandboxed document error: ${event.data.message}`);\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";;;;;;AAmBA,SAAgB,cACd,GACA,IAA0B,CAAC,GACL;CACtB,IAAMA,IAAaC,EAAwBC,CAAO,GAC5CC,IAAUC,EAAc,GACxBC,IAAiC,EAAE,GAAGL,EAAW,OAAO,GACxDM,oBAAY,IAAI,IAAuC,GACvDC,IAA+B,CAAC,GAChCC,IAAa,IAAI,gBAAgB,GACnCC,IAAmC,MACnCC,IAAW,IACXC,IAAc,IACdC,IAAa,GACbC,IAAqD,MACrDC,IAAkF;CAEtF,SAAS,mBAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,oBAA0B;EACjC,AAAID,MAAiB,SAErB,aAAaA,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,yBAA+B;EAItC,AAHA,kBAAkB,GAClBC,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,UAAU,GAA+B;EAChD,KAAK,IAAMC,KAAYT,GACrB,IAAI;GACF,EAASU,CAAO;EAClB,QAAQ,CAER;CAEJ;CAEA,SAAS,cAAc,GAA2B;EAChD,IAAI,CAACP,KAAUQ,EAAM,WAAWR,EAAO,eAAe;EAEtD,IAAMS,IAAY,iBAAiB;EAEnC,IAAKC,EAAkBF,EAAM,MAAMC,CAAS,GAE5C,QAAQD,EAAM,KAAK,MAAnB;GACE,KAAKG;IACH,AAAI,OAAOH,EAAM,KAAK,SAAU,YAC9B,UAAU;KAAE,QAAQA,EAAM,KAAK;KAAQ,OAAOA,EAAM,KAAK;KAAO,MAAMG;IAAW,CAAC;IAGpF;GACF,KAAKC;IACH,AAAI,OAAOJ,EAAM,KAAK,WAAY,aAChC,UAAU;KACR,SAASA,EAAM,KAAK;KACpB,GAAI,OAAOA,EAAM,KAAK,SAAU,WAAW,EAAE,OAAOA,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAMI;IACR,CAAC,GAKI,GAA6BJ,EAAM,KAAK,QAAxC;IAGP;GACF,KAAKK;IAGH,AAFA,uBAAuB,GACvB,IAAc,IACd,kBAAkB;IAClB;GACF,KAAKC,GACH,AAAI,OAAON,EAAM,KAAK,UAAW,YAAY,OAAO,SAASA,EAAM,KAAK,MAAM,KAAKA,EAAM,KAAK,UAAU,KACtG,UAAU;IAAE,QAAQA,EAAM,KAAK;IAAQ,MAAMM;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,eAAkC;EAUzC,OATId,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxCA,EAAO,aAAa,WAAW,eAAe,GAC9CA,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiBN,GAChCqB,EAAU,YAAYf,CAAM,GAC5B,OAAO,iBAAiB,WAAW,aAAa,GAEzCA;CACT;CAEA,SAAS,UAAgB;EACvB,AAAIC,MAEJ,IAAW,IACX,uBAAuB,GACvBF,EAAW,MAAM,GAEjB,AAGEC,OAFA,OAAO,oBAAoB,WAAW,aAAa,GACnDA,EAAO,OAAO,GACL,OAGXH,EAAU,MAAM;CAClB;CAEA,SAAS,UAAU,GAAwD;EASzE,OARII,UAGW,CAAC,KAGhBJ,EAAU,IAAImB,CAAO,SAERnB,EAAU,OAAOmB,CAAO;CACvC;CAEA,SAAS,OAAO,GAA6B;EAC3C,IAAIf,GAGF,OAAO,QAAQ,QAAQ;EAMzB,AAHKgB,EAAK,KAAK,GAEf,uBAAuB,GACvB,KAAc;EAEd,IAAMC,IAAU,aAAa,GACvBT,IAAY,iBAAiB,GAC7BU,IAAkB;GAAE,GAAG5B;GAAY,QAAQ,EAAE,GAAGK,EAAO;EAAE;EAG/D,AADA,EAAQ,QAAQ,oBAAoB,OAAOO,CAAU,GACrD,EAAQ,SAASiB,EAAyBH,GAAME,GAAiBV,CAAS;EAE1E,IAAMY,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GAC9B,AAAKhB,MAELA,EAAc,OACZ,IAAIiB,EACF,oDAAoD/B,EAAW,aAAa,iEAE9E,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAGA,EAAW,YAAY,GAEnB8B;CACT;CAEA,SAAS,KAAK,GAAwC;EACpD,GAAQ,eAAe,YAAYE,EAAS,iBAAiB,GAAGhB,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,oBAA0B;EACjC,AAAKL,KAAgBF,GAAQ,iBAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,WAAW,KAEnF,KAAK;GAAE,QAAQ,EAAE,GAAGA,EAAa;GAAG,MAAM0B;EAAqB,CAAC;CAClE;CAEA,SAAS,SAAS,GAA8B;EAC9C,AAAIvB,MAMJ,OAAO,OAAOH,GAAc2B,CAAM,GAE9BvB,KAAeF,GAAQ,iBAAiB,OAAO,KAAKyB,CAAM,CAAC,CAAC,SAAS,KACvE,KAAK;GAAE,QAAQA;GAAQ,MAAMD;EAAqB,CAAC;CAEvD;CAEA,SAAS,YAAY,GAAoB;EACvC,AAAIvB,KAMCC,KAAgBF,GAAQ,iBAM7B,KAAK;GAAE;GAAM,MAAM0B;EAAiB,CAAC;CACvC;CAEA,SAAS,YAAY,GAAY,GAAmB;EAClD,AAAIzB,MAYJ,EAAO0B,KAAMC,GAET1B,KAAeF,GAAQ,iBAAe,KAAK;GAAE;GAAK;GAAI,MAAM6B;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAO9B,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAOE;EACT;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,QAAQ;EACV;EACA;CACF;AACF"}

package/dist/sandbox.cjs

@@ -81,5 +81,5 @@ ${buildBridgeScript(n)}
 ${a}
 ${e}
 </body>
-</html>`}var r=`custom`,i=`error`,a=`html-replace`,o=`ready`,s=`resize`,c=`state-update-all`,l=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}function createSandbox(e,t={}){let n=normalizeSandboxOptions(t),u=createChannel(),d={...n.styles},f=new Set,p={},m=new AbortController,h=null,g=!1,_=!1,v=0,y=null,b=null;function currentBootstrap(){return{channel:u,generation:v}}function clearReadyTimeout(){y!==null&&(clearTimeout(y),y=null)}function supersedePendingRender(){clearReadyTimeout(),b?.resolve(),b=null,_=!1}function broadcast(e){for(let t of f)try{t(e)}catch{}}function handleMessage(e){if(!h||e.source!==h.contentWindow)return;let t=currentBootstrap();if(isProtocolMessage(e.data,t))switch(e.data.type){case r:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:r});break;case i:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:i});break;case o:supersedePendingRender(),_=!0,flushPendingState();break;case s:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:s})}}function ensureIframe(){return h||(h=document.createElement(`iframe`),h.setAttribute(`sandbox`,`allow-scripts`),h.setAttribute(`referrerpolicy`,`no-referrer`),h.dataset.sandboxChannel=u,e.appendChild(h),window.addEventListener(`message`,handleMessage),h)}function dispose(){g||(g=!0,supersedePendingRender(),m.abort(),h&&=(window.removeEventListener(`message`,handleMessage),h.remove(),null),f.clear())}function onMessage(e){return g?()=>{}:(f.add(e),()=>f.delete(e))}function render(e){if(g)return Promise.resolve();e.trim(),supersedePendingRender(),v+=1;let t=ensureIframe(),r=currentBootstrap(),i={...n,styles:{...d}};t.dataset.sandboxGeneration=String(v),t.srcdoc=buildDocumentFromOptions(e,i,r);let a=new Promise((e,t)=>{b={reject:t,resolve:e}});return y=setTimeout(()=>{b&&(b.reject(new SandboxTimeoutError(`render() did not receive a 'ready' signal within ${n.readyTimeout}ms. An injected script may have blocked document initialization.`)),b=null,y=null)},n.readyTimeout),a}function send(e){h?.contentWindow?.postMessage(envelope(currentBootstrap(),e),`*`)}function flushPendingState(){_&&h?.contentWindow&&Object.keys(p).length!==0&&send({record:{...p},type:c})}function setState(e){g||(Object.assign(p,e),_&&h?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:c}))}function replaceBody(e){g||_&&h?.contentWindow&&send({html:e,type:a})}function updateStyle(e,t){g||(d[e]=t,_&&h?.contentWindow&&send({css:t,id:e,type:l}))}return{get disposalSignal(){return m.signal},dispose,get disposed(){return g},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}exports.SandboxConfigurationError=SandboxConfigurationError,exports.SandboxError=SandboxError,exports.SandboxTimeoutError=SandboxTimeoutError,exports.createSandbox=createSandbox;
+</html>`}var r=`custom`,i=`error`,a=`html-replace`,o=`ready`,s=`resize`,c=`state-update-all`,l=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}function createSandbox(e,t={}){let n=normalizeSandboxOptions(t),u=createChannel(),d={...n.styles},f=new Set,p={},m=new AbortController,h=null,g=!1,_=!1,v=0,y=null,b=null;function currentBootstrap(){return{channel:u,generation:v}}function clearReadyTimeout(){y!==null&&(clearTimeout(y),y=null)}function supersedePendingRender(){clearReadyTimeout(),b?.resolve(),b=null,_=!1}function broadcast(e){for(let t of f)try{t(e)}catch{}}function handleMessage(e){if(!h||e.source!==h.contentWindow)return;let t=currentBootstrap();if(isProtocolMessage(e.data,t))switch(e.data.type){case r:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:r});break;case i:typeof e.data.message==`string`&&(broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:i}),`${e.data.message}`);break;case o:supersedePendingRender(),_=!0,flushPendingState();break;case s:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:s})}}function ensureIframe(){return h||(h=document.createElement(`iframe`),h.setAttribute(`sandbox`,`allow-scripts`),h.setAttribute(`referrerpolicy`,`no-referrer`),h.dataset.sandboxChannel=u,e.appendChild(h),window.addEventListener(`message`,handleMessage),h)}function dispose(){g||(g=!0,supersedePendingRender(),m.abort(),h&&=(window.removeEventListener(`message`,handleMessage),h.remove(),null),f.clear())}function onMessage(e){return g?()=>{}:(f.add(e),()=>f.delete(e))}function render(e){if(g)return Promise.resolve();e.trim(),supersedePendingRender(),v+=1;let t=ensureIframe(),r=currentBootstrap(),i={...n,styles:{...d}};t.dataset.sandboxGeneration=String(v),t.srcdoc=buildDocumentFromOptions(e,i,r);let a=new Promise((e,t)=>{b={reject:t,resolve:e}});return y=setTimeout(()=>{b&&(b.reject(new SandboxTimeoutError(`render() did not receive a 'ready' signal within ${n.readyTimeout}ms. An injected script may have blocked document initialization.`)),b=null,y=null)},n.readyTimeout),a}function send(e){h?.contentWindow?.postMessage(envelope(currentBootstrap(),e),`*`)}function flushPendingState(){_&&h?.contentWindow&&Object.keys(p).length!==0&&send({record:{...p},type:c})}function setState(e){g||(Object.assign(p,e),_&&h?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:c}))}function replaceBody(e){g||_&&h?.contentWindow&&send({html:e,type:a})}function updateStyle(e,t){g||(d[e]=t,_&&h?.contentWindow&&send({css:t,id:e,type:l}))}return{get disposalSignal(){return m.signal},dispose,get disposed(){return g},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}exports.SandboxConfigurationError=SandboxConfigurationError,exports.SandboxError=SandboxError,exports.SandboxTimeoutError=SandboxTimeoutError,exports.createSandbox=createSandbox;
 //# sourceMappingURL=sandbox.cjs.map

package/dist/sandbox.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.cjs","names":["bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,mECEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMC,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvDC,EAAK,2BACLC,EAAO,wCACPC,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAOA,GAAU,SAAU,OAAO,KAAKD,EAAOC,CAAK,EAEvD,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAKD,EAAOC,CAAK,CAC1B,CAaA,OAVGC,EAAI,WAAa,SAAWA,EAAI,WAAa,UAC9CA,EAAI,UACJA,EAAI,UACJA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,KAEG,KAAKF,EAAOC,CAAK,EAGnBC,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHIC,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQA,CAAM,EAElBA,EAAO,IAAK,GAAU,gBAAgBF,EAAOD,CAAK,CAAC,EAFvB,KAAKA,EAAOG,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAOF,GAAU,SAAU,OAAO,KAAK,UAAWA,CAAK,EAE3D,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAWA,CAAK,CAC9B,CAIA,OAFIC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAiB,KAAK,UAAWD,CAAK,EAEhFC,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAIE,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAOA,GAAW,WAAYA,GAAmB,MAAM,QAAQA,CAAM,EAAG,OAAO,KAAK,SAAUA,CAAM,EAExG,IAAMC,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAACC,EAAIC,KAAQ,OAAO,QAAQH,CAAM,EACtCP,EAAG,KAAKS,CAAE,GAAK,OAAOC,GAAQ,UAAU,KAAK,SAAUD,CAAE,EAE9D,EAAWA,GAAMC,EAGnB,OAAOF,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAOG,GAAY,WAAYA,GAAoB,MAAM,QAAQA,CAAO,IAAG,KAAK,UAAWA,CAAO,EAEtG,IAAMC,EAAOD,EAAQ,MAAQ,KAExBV,EAAK,KAAKW,CAAI,GAAG,KAAK,OAAQA,CAAI,EAEnCD,EAAQ,QAAU,IAAA,IAAeT,EAAM,KAAKS,EAAQ,KAAK,GAAKA,EAAQ,MAAM,SAAW,GACzF,KAAK,QAASA,EAAQ,KAAK,EAGzBA,EAAQ,QAAU,IAAA,IAAa,OAAOA,EAAQ,OAAU,UAAU,KAAK,QAASA,EAAQ,KAAK,EAEjG,IAAME,EAAkBF,EAAQ,aAC1BG,EAAeD,GAAA,IAGnBA,IAAoB,IAAA,KACnBA,IAAoB,MACnB,OAAOA,GAAoB,UAC3B,CAAC,OAAO,SAASA,CAAe,GAChCA,GAAmB,GACnBA,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgBA,CAAe,EAGlCF,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,GAAG,KAAK,UAAWA,EAAQ,OAAO,EAErG,IAAMI,GAAWJ,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiBA,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiBA,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAOA,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgBA,EAAQ,MAAM,EACtC,MAAOA,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAMK,EAAgB,CACpB,kBACA,GAAIL,EAAQ,MAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAGA,EAAQ,qBACX,GAAGA,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJC,EAAe,CAAC,kBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3EQ,EAAe,CAAC,QAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjES,EAAcT,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAcK,IACd,aAAaE,IACb,WAAWC,IACX,YAAYC,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAOV,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAON,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOA,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAMiB,EAAM,WAAW,oBAAoBV,CAAO,CAAC,EAC7CJ,EAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,EAAIC,KAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACNK,EAAUJ,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACNC,EAAQZ,EAAQ,MAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;QAGP,CChDA,IAAaC,EAAa,SACbC,EAAY,QACZC,EAAmB,eACnBC,EAAY,QACZC,EAAa,SACbC,EAAuB,mBACvBC,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO3B,GAAU,YACjBA,GACA,OAAQA,EAAgC,SAAY,UACnDA,EAA8B,UAAYP,EAAU,SACrD,OAAQO,EAAmC,YAAe,UACzDA,EAAiC,aAAeP,EAAU,YAC3D,OAAQO,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM4B,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAKA,EAAQ,GAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAGnC,EAAS,QAASD,EAAU,QAAS,WAAYA,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMW,EAAa,wBAAwBG,CAAO,EAC5CuB,EAAU,cAAc,EACxB3B,EAAiC,CAAE,GAAGC,EAAW,MAAO,EACxD2B,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACb3B,EAAqD,KACrD4B,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B5B,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB4B,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYR,EACrB,GAAI,CACFQ,EAAS7C,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACwC,GAAUM,EAAM,SAAWN,EAAO,cAAe,OAEtD,IAAMzC,EAAY,iBAAiB,EAEnC,GAAK,kBAAkB+C,EAAM,KAAM/C,CAAS,EAE5C,OAAQ+C,EAAM,KAAK,KAAnB,CACE,KAAKnB,EACC,OAAOmB,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAMnB,CAAW,CAAC,EAGpF,MACF,KAAKC,EACC,OAAOkB,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAMlB,CACR,CAAC,EAGH,MACF,KAAKE,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EACC,OAAOe,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAMf,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIS,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBJ,EAChCW,EAAU,YAAYP,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIW,CAAO,MAERX,EAAU,OAAOW,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIP,EAGF,OAAO,QAAQ,QAAQ,EAGpBf,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMuB,EAAU,aAAa,EACvBlD,EAAY,iBAAiB,EAC7BmD,EAAkB,CAAE,GAAGxC,EAAY,OAAQ,CAAE,GAAGD,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOkC,CAAU,EACrD,EAAQ,OAAS,yBAAyBjB,EAAMwB,EAAiBnD,CAAS,EAE1E,IAAMoD,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBP,IAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnByC,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDX,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAGxC,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B0C,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMN,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1CS,IAMJ,OAAO,OAAOH,EAAcc,CAAM,EAE9BV,GAAeF,GAAQ,eAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAMpB,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCS,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMX,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9CY,IAYJ,EAAO9B,GAAMC,EAET8B,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMP,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOM,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}
+{"version":3,"file":"sandbox.cjs","names":["bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n\n          // The bridge replaces window.onerror inside the document, so without this the\n          // host is the only place a sandboxed error can surface: consumers that do not\n          // subscribe to MSG_ERROR would otherwise watch a sandbox fail silently.\n          warn(`sandboxed document error: ${event.data.message}`);\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,mECEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMC,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvDC,EAAK,2BACLC,EAAO,wCACPC,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAOA,GAAU,SAAU,OAAO,KAAKD,EAAOC,CAAK,EAEvD,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAKD,EAAOC,CAAK,CAC1B,CAaA,OAVGC,EAAI,WAAa,SAAWA,EAAI,WAAa,UAC9CA,EAAI,UACJA,EAAI,UACJA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,KAEG,KAAKF,EAAOC,CAAK,EAGnBC,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHIC,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQA,CAAM,EAElBA,EAAO,IAAK,GAAU,gBAAgBF,EAAOD,CAAK,CAAC,EAFvB,KAAKA,EAAOG,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAOF,GAAU,SAAU,OAAO,KAAK,UAAWA,CAAK,EAE3D,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAWA,CAAK,CAC9B,CAIA,OAFIC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAiB,KAAK,UAAWD,CAAK,EAEhFC,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAIE,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAOA,GAAW,WAAYA,GAAmB,MAAM,QAAQA,CAAM,EAAG,OAAO,KAAK,SAAUA,CAAM,EAExG,IAAMC,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAACC,EAAIC,KAAQ,OAAO,QAAQH,CAAM,EACtCP,EAAG,KAAKS,CAAE,GAAK,OAAOC,GAAQ,UAAU,KAAK,SAAUD,CAAE,EAE9D,EAAWA,GAAMC,EAGnB,OAAOF,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAOG,GAAY,WAAYA,GAAoB,MAAM,QAAQA,CAAO,IAAG,KAAK,UAAWA,CAAO,EAEtG,IAAMC,EAAOD,EAAQ,MAAQ,KAExBV,EAAK,KAAKW,CAAI,GAAG,KAAK,OAAQA,CAAI,EAEnCD,EAAQ,QAAU,IAAA,IAAeT,EAAM,KAAKS,EAAQ,KAAK,GAAKA,EAAQ,MAAM,SAAW,GACzF,KAAK,QAASA,EAAQ,KAAK,EAGzBA,EAAQ,QAAU,IAAA,IAAa,OAAOA,EAAQ,OAAU,UAAU,KAAK,QAASA,EAAQ,KAAK,EAEjG,IAAME,EAAkBF,EAAQ,aAC1BG,EAAeD,GAAA,IAGnBA,IAAoB,IAAA,KACnBA,IAAoB,MACnB,OAAOA,GAAoB,UAC3B,CAAC,OAAO,SAASA,CAAe,GAChCA,GAAmB,GACnBA,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgBA,CAAe,EAGlCF,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,GAAG,KAAK,UAAWA,EAAQ,OAAO,EAErG,IAAMI,GAAWJ,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiBA,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiBA,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAOA,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgBA,EAAQ,MAAM,EACtC,MAAOA,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAMK,EAAgB,CACpB,kBACA,GAAIL,EAAQ,MAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAGA,EAAQ,qBACX,GAAGA,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJC,EAAe,CAAC,kBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3EQ,EAAe,CAAC,QAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjES,EAAcT,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAcK,IACd,aAAaE,IACb,WAAWC,IACX,YAAYC,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAOV,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAON,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOA,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAMiB,EAAM,WAAW,oBAAoBV,CAAO,CAAC,EAC7CJ,EAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,EAAIC,KAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACNK,EAAUJ,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACNC,EAAQZ,EAAQ,MAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;QAGP,CChDA,IAAaC,EAAa,SACbC,EAAY,QACZC,EAAmB,eACnBC,EAAY,QACZC,EAAa,SACbC,EAAuB,mBACvBC,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO3B,GAAU,YACjBA,GACA,OAAQA,EAAgC,SAAY,UACnDA,EAA8B,UAAYP,EAAU,SACrD,OAAQO,EAAmC,YAAe,UACzDA,EAAiC,aAAeP,EAAU,YAC3D,OAAQO,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM4B,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAKA,EAAQ,GAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAGnC,EAAS,QAASD,EAAU,QAAS,WAAYA,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMW,EAAa,wBAAwBG,CAAO,EAC5CuB,EAAU,cAAc,EACxB3B,EAAiC,CAAE,GAAGC,EAAW,MAAO,EACxD2B,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACb3B,EAAqD,KACrD4B,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B5B,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB4B,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYR,EACrB,GAAI,CACFQ,EAAS7C,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACwC,GAAUM,EAAM,SAAWN,EAAO,cAAe,OAEtD,IAAMzC,EAAY,iBAAiB,EAEnC,GAAK,kBAAkB+C,EAAM,KAAM/C,CAAS,EAE5C,OAAQ+C,EAAM,KAAK,KAAnB,CACE,KAAKnB,EACC,OAAOmB,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAMnB,CAAW,CAAC,EAGpF,MACF,KAAKC,EACC,OAAOkB,EAAM,KAAK,SAAY,WAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAMlB,CACR,CAAC,EAKI,GAA6BkB,EAAM,KAAK,QAAxC,GAGP,MACF,KAAKhB,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EACC,OAAOe,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAMf,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIS,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBJ,EAChCW,EAAU,YAAYP,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIW,CAAO,MAERX,EAAU,OAAOW,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIP,EAGF,OAAO,QAAQ,QAAQ,EAGpBf,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMuB,EAAU,aAAa,EACvBlD,EAAY,iBAAiB,EAC7BmD,EAAkB,CAAE,GAAGxC,EAAY,OAAQ,CAAE,GAAGD,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOkC,CAAU,EACrD,EAAQ,OAAS,yBAAyBjB,EAAMwB,EAAiBnD,CAAS,EAE1E,IAAMoD,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBP,IAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnByC,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDX,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAGxC,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B0C,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMN,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1CS,IAMJ,OAAO,OAAOH,EAAcc,CAAM,EAE9BV,GAAeF,GAAQ,eAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAMpB,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCS,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMX,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9CY,IAYJ,EAAO9B,GAAMC,EAET8B,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMP,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOM,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}

package/dist/sandbox.iife.js

@@ -81,5 +81,5 @@ ${buildBridgeScript(n)}
 ${a}
 ${e}
 </body>
-</html>`}var i=`custom`,a=`error`,o=`html-replace`,s=`ready`,c=`resize`,l=`state-update-all`,u=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}function createSandbox(e,t={}){let n=normalizeSandboxOptions(t),r=createChannel(),d={...n.styles},f=new Set,p={},m=new AbortController,h=null,g=!1,_=!1,v=0,y=null,b=null;function currentBootstrap(){return{channel:r,generation:v}}function clearReadyTimeout(){y!==null&&(clearTimeout(y),y=null)}function supersedePendingRender(){clearReadyTimeout(),b?.resolve(),b=null,_=!1}function broadcast(e){for(let t of f)try{t(e)}catch{}}function handleMessage(e){if(!h||e.source!==h.contentWindow)return;let t=currentBootstrap();if(isProtocolMessage(e.data,t))switch(e.data.type){case i:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:i});break;case a:typeof e.data.message==`string`&&broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:a});break;case s:supersedePendingRender(),_=!0,flushPendingState();break;case c:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:c})}}function ensureIframe(){return h||(h=document.createElement(`iframe`),h.setAttribute(`sandbox`,`allow-scripts`),h.setAttribute(`referrerpolicy`,`no-referrer`),h.dataset.sandboxChannel=r,e.appendChild(h),window.addEventListener(`message`,handleMessage),h)}function dispose(){g||(g=!0,supersedePendingRender(),m.abort(),h&&=(window.removeEventListener(`message`,handleMessage),h.remove(),null),f.clear())}function onMessage(e){return g?()=>{}:(f.add(e),()=>f.delete(e))}function render(e){if(g)return Promise.resolve();e.trim(),supersedePendingRender(),v+=1;let t=ensureIframe(),r=currentBootstrap(),i={...n,styles:{...d}};t.dataset.sandboxGeneration=String(v),t.srcdoc=buildDocumentFromOptions(e,i,r);let a=new Promise((e,t)=>{b={reject:t,resolve:e}});return y=setTimeout(()=>{b&&(b.reject(new SandboxTimeoutError(`render() did not receive a 'ready' signal within ${n.readyTimeout}ms. An injected script may have blocked document initialization.`)),b=null,y=null)},n.readyTimeout),a}function send(e){h?.contentWindow?.postMessage(envelope(currentBootstrap(),e),`*`)}function flushPendingState(){_&&h?.contentWindow&&Object.keys(p).length!==0&&send({record:{...p},type:l})}function setState(e){g||(Object.assign(p,e),_&&h?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:l}))}function replaceBody(e){g||_&&h?.contentWindow&&send({html:e,type:o})}function updateStyle(e,t){g||(d[e]=t,_&&h?.contentWindow&&send({css:t,id:e,type:u}))}return{get disposalSignal(){return m.signal},dispose,get disposed(){return g},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}return e.SandboxConfigurationError=SandboxConfigurationError,e.SandboxError=SandboxError,e.SandboxTimeoutError=SandboxTimeoutError,e.createSandbox=createSandbox,e})({});
+</html>`}var i=`custom`,a=`error`,o=`html-replace`,s=`ready`,c=`resize`,l=`state-update-all`,u=`style-patch`;function isProtocolMessage(e,t){return typeof e==`object`&&!!e&&typeof e.channel==`string`&&e.channel===t.channel&&typeof e.generation==`number`&&e.generation===t.generation&&typeof e.type==`string`}function createChannel(){if(typeof crypto.randomUUID==`function`)return crypto.randomUUID();let e=crypto.getRandomValues(new Uint32Array(4));return Array.from(e,e=>e.toString(16).padStart(8,`0`)).join(``)}function envelope(e,t){return{...t,channel:e.channel,generation:e.generation}}function createSandbox(e,t={}){let n=normalizeSandboxOptions(t),r=createChannel(),d={...n.styles},f=new Set,p={},m=new AbortController,h=null,g=!1,_=!1,v=0,y=null,b=null;function currentBootstrap(){return{channel:r,generation:v}}function clearReadyTimeout(){y!==null&&(clearTimeout(y),y=null)}function supersedePendingRender(){clearReadyTimeout(),b?.resolve(),b=null,_=!1}function broadcast(e){for(let t of f)try{t(e)}catch{}}function handleMessage(e){if(!h||e.source!==h.contentWindow)return;let t=currentBootstrap();if(isProtocolMessage(e.data,t))switch(e.data.type){case i:typeof e.data.event==`string`&&broadcast({detail:e.data.detail,event:e.data.event,type:i});break;case a:typeof e.data.message==`string`&&(broadcast({message:e.data.message,...typeof e.data.stack==`string`?{stack:e.data.stack}:{},type:a}),`${e.data.message}`);break;case s:supersedePendingRender(),_=!0,flushPendingState();break;case c:typeof e.data.height==`number`&&Number.isFinite(e.data.height)&&e.data.height>=0&&broadcast({height:e.data.height,type:c})}}function ensureIframe(){return h||(h=document.createElement(`iframe`),h.setAttribute(`sandbox`,`allow-scripts`),h.setAttribute(`referrerpolicy`,`no-referrer`),h.dataset.sandboxChannel=r,e.appendChild(h),window.addEventListener(`message`,handleMessage),h)}function dispose(){g||(g=!0,supersedePendingRender(),m.abort(),h&&=(window.removeEventListener(`message`,handleMessage),h.remove(),null),f.clear())}function onMessage(e){return g?()=>{}:(f.add(e),()=>f.delete(e))}function render(e){if(g)return Promise.resolve();e.trim(),supersedePendingRender(),v+=1;let t=ensureIframe(),r=currentBootstrap(),i={...n,styles:{...d}};t.dataset.sandboxGeneration=String(v),t.srcdoc=buildDocumentFromOptions(e,i,r);let a=new Promise((e,t)=>{b={reject:t,resolve:e}});return y=setTimeout(()=>{b&&(b.reject(new SandboxTimeoutError(`render() did not receive a 'ready' signal within ${n.readyTimeout}ms. An injected script may have blocked document initialization.`)),b=null,y=null)},n.readyTimeout),a}function send(e){h?.contentWindow?.postMessage(envelope(currentBootstrap(),e),`*`)}function flushPendingState(){_&&h?.contentWindow&&Object.keys(p).length!==0&&send({record:{...p},type:l})}function setState(e){g||(Object.assign(p,e),_&&h?.contentWindow&&Object.keys(e).length>0&&send({record:e,type:l}))}function replaceBody(e){g||_&&h?.contentWindow&&send({html:e,type:o})}function updateStyle(e,t){g||(d[e]=t,_&&h?.contentWindow&&send({css:t,id:e,type:u}))}return{get disposalSignal(){return m.signal},dispose,get disposed(){return g},onMessage,render,replaceBody,setState,[Symbol.dispose](){dispose()},updateStyle}}return e.SandboxConfigurationError=SandboxConfigurationError,e.SandboxError=SandboxError,e.SandboxTimeoutError=SandboxTimeoutError,e.createSandbox=createSandbox,e})({});
 //# sourceMappingURL=sandbox.iife.js.map

package/dist/sandbox.iife.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.iife.js","names":["exports","bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,sFCEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAUC,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMC,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvDC,EAAK,2BACLC,EAAO,wCACPC,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAOA,GAAU,SAAU,OAAO,KAAKD,EAAOC,CAAK,EAEvD,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAKD,EAAOC,CAAK,CAC1B,CAaA,OAVGC,EAAI,WAAa,SAAWA,EAAI,WAAa,UAC9CA,EAAI,UACJA,EAAI,UACJA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,KAEG,KAAKF,EAAOC,CAAK,EAGnBC,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHIC,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQA,CAAM,EAElBA,EAAO,IAAK,GAAU,gBAAgBF,EAAOD,CAAK,CAAC,EAFvB,KAAKA,EAAOG,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAOF,GAAU,SAAU,OAAO,KAAK,UAAWA,CAAK,EAE3D,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAWA,CAAK,CAC9B,CAIA,OAFIC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAiB,KAAK,UAAWD,CAAK,EAEhFC,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAIE,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAOA,GAAW,WAAYA,GAAmB,MAAM,QAAQA,CAAM,EAAG,OAAO,KAAK,SAAUA,CAAM,EAExG,IAAMC,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAACC,EAAIC,KAAQ,OAAO,QAAQH,CAAM,EACtCP,EAAG,KAAKS,CAAE,GAAK,OAAOC,GAAQ,UAAU,KAAK,SAAUD,CAAE,EAE9D,EAAWA,GAAMC,EAGnB,OAAOF,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAOG,GAAY,WAAYA,GAAoB,MAAM,QAAQA,CAAO,IAAG,KAAK,UAAWA,CAAO,EAEtG,IAAMC,EAAOD,EAAQ,MAAQ,KAExBV,EAAK,KAAKW,CAAI,GAAG,KAAK,OAAQA,CAAI,EAEnCD,EAAQ,QAAU,IAAA,IAAeT,EAAM,KAAKS,EAAQ,KAAK,GAAKA,EAAQ,MAAM,SAAW,GACzF,KAAK,QAASA,EAAQ,KAAK,EAGzBA,EAAQ,QAAU,IAAA,IAAa,OAAOA,EAAQ,OAAU,UAAU,KAAK,QAASA,EAAQ,KAAK,EAEjG,IAAME,EAAkBF,EAAQ,aAC1BG,EAAeD,GAAA,IAGnBA,IAAoB,IAAA,KACnBA,IAAoB,MACnB,OAAOA,GAAoB,UAC3B,CAAC,OAAO,SAASA,CAAe,GAChCA,GAAmB,GACnBA,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgBA,CAAe,EAGlCF,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,GAAG,KAAK,UAAWA,EAAQ,OAAO,EAErG,IAAMI,GAAWJ,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiBA,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiBA,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAOA,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgBA,EAAQ,MAAM,EACtC,MAAOA,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAMK,EAAgB,CACpB,kBACA,GAAIL,EAAQ,MAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAGA,EAAQ,qBACX,GAAGA,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJC,EAAe,CAAC,kBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3EQ,EAAe,CAAC,QAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjES,EAAcT,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAcK,IACd,aAAaE,IACb,WAAWC,IACX,YAAYC,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAOV,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAON,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOA,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAMiB,EAAM,WAAW,oBAAoBV,CAAO,CAAC,EAC7CJ,EAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,EAAIC,KAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACNK,EAAUJ,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACNC,EAAQZ,EAAQ,MAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;QAGP,CChDA,IAAaC,EAAa,SACbC,EAAY,QACZC,EAAmB,eACnBC,EAAY,QACZC,EAAa,SACbC,EAAuB,mBACvBC,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO3B,GAAU,YACjBA,GACA,OAAQA,EAAgC,SAAY,UACnDA,EAA8B,UAAYP,EAAU,SACrD,OAAQO,EAAmC,YAAe,UACzDA,EAAiC,aAAeP,EAAU,YAC3D,OAAQO,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM4B,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAKA,EAAQ,GAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAGnC,EAAS,QAASD,EAAU,QAAS,WAAYA,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMW,EAAa,wBAAwBG,CAAO,EAC5CuB,EAAU,cAAc,EACxB3B,EAAiC,CAAE,GAAGC,EAAW,MAAO,EACxD2B,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACb3B,EAAqD,KACrD4B,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B5B,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB4B,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYR,EACrB,GAAI,CACFQ,EAAS7C,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACwC,GAAUM,EAAM,SAAWN,EAAO,cAAe,OAEtD,IAAMzC,EAAY,iBAAiB,EAEnC,GAAK,kBAAkB+C,EAAM,KAAM/C,CAAS,EAE5C,OAAQ+C,EAAM,KAAK,KAAnB,CACE,KAAKnB,EACC,OAAOmB,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAMnB,CAAW,CAAC,EAGpF,MACF,KAAKC,EACC,OAAOkB,EAAM,KAAK,SAAY,UAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAMlB,CACR,CAAC,EAGH,MACF,KAAKE,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EACC,OAAOe,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAMf,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIS,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBJ,EAChCW,EAAU,YAAYP,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIW,CAAO,MAERX,EAAU,OAAOW,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIP,EAGF,OAAO,QAAQ,QAAQ,EAGpBf,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMuB,EAAU,aAAa,EACvBlD,EAAY,iBAAiB,EAC7BmD,EAAkB,CAAE,GAAGxC,EAAY,OAAQ,CAAE,GAAGD,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOkC,CAAU,EACrD,EAAQ,OAAS,yBAAyBjB,EAAMwB,EAAiBnD,CAAS,EAE1E,IAAMoD,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBP,IAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnByC,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDX,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAGxC,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B0C,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMN,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1CS,IAMJ,OAAO,OAAOH,EAAcc,CAAM,EAE9BV,GAAeF,GAAQ,eAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAMpB,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCS,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMX,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9CY,IAYJ,EAAO9B,GAAMC,EAET8B,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMP,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOM,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}
+{"version":3,"file":"sandbox.iife.js","names":["exports","bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n\n          // The bridge replaces window.onerror inside the document, so without this the\n          // host is the only place a sandboxed error can surface: consumers that do not\n          // subscribe to MSG_ERROR would otherwise watch a sandbox fail silently.\n          warn(`sandboxed document error: ${event.data.message}`);\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":"A,sFCEA,SAAgB,kBAAkB,EAAoC,CAIpE,MAAO;;4BAHS,KAAK,UAAUC,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK,CACP,CCvEA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMC,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAMa,oBAAb,cAAyC,YAAa,CAAC,EAG1C,0BAAb,cAA+C,YAAa,CAAC,ECEvDC,EAAK,2BACLC,EAAO,wCACPC,EAAQ,2BAEd,SAAS,KAAK,EAAe,EAAuB,CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG,CAC7E,CAEA,SAAS,gBAAgB,EAAgB,EAAuB,CAC9D,GAAI,OAAOA,GAAU,SAAU,OAAO,KAAKD,EAAOC,CAAK,EAEvD,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAKD,EAAOC,CAAK,CAC1B,CAaA,OAVGC,EAAI,WAAa,SAAWA,EAAI,WAAa,UAC9CA,EAAI,UACJA,EAAI,UACJA,EAAI,WAAa,KACjBA,EAAI,QACJA,EAAI,KAEG,KAAKF,EAAOC,CAAK,EAGnBC,EAAI,MACb,CAEA,SAAS,iBAAiB,EAA8B,EAAyB,CAI/E,OAHIC,IAAW,IAAA,GAAkB,CAAC,EAC7B,MAAM,QAAQA,CAAM,EAElBA,EAAO,IAAK,GAAU,gBAAgBF,EAAOD,CAAK,CAAC,EAFvB,KAAKA,EAAOG,CAAM,CAGvD,CAEA,SAAS,gBAAgB,EAAwB,CAC/C,GAAI,OAAOF,GAAU,SAAU,OAAO,KAAK,UAAWA,CAAK,EAE3D,IAAIC,EAEJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAK,CACrB,MAAQ,CACN,OAAO,KAAK,UAAWA,CAAK,CAC9B,CAIA,OAFIC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAAiB,KAAK,UAAWD,CAAK,EAEhFC,EAAI,IACb,CAEA,SAAS,gBAAgB,EAAoE,CAC3F,GAAIE,IAAW,IAAA,GAAW,MAAO,CAAC,EAClC,GAAI,OAAOA,GAAW,WAAYA,GAAmB,MAAM,QAAQA,CAAM,EAAG,OAAO,KAAK,SAAUA,CAAM,EAExG,IAAMC,EAAqC,CAAC,EAE5C,IAAK,GAAM,CAACC,EAAIC,KAAQ,OAAO,QAAQH,CAAM,EACtCP,EAAG,KAAKS,CAAE,GAAK,OAAOC,GAAQ,UAAU,KAAK,SAAUD,CAAE,EAE9D,EAAWA,GAAMC,EAGnB,OAAOF,CACT,CAEA,SAAgB,wBAAwB,EAA0B,CAAC,EAA6B,EAC1F,OAAOG,GAAY,WAAYA,GAAoB,MAAM,QAAQA,CAAO,IAAG,KAAK,UAAWA,CAAO,EAEtG,IAAMC,EAAOD,EAAQ,MAAQ,KAExBV,EAAK,KAAKW,CAAI,GAAG,KAAK,OAAQA,CAAI,EAEnCD,EAAQ,QAAU,IAAA,IAAeT,EAAM,KAAKS,EAAQ,KAAK,GAAKA,EAAQ,MAAM,SAAW,GACzF,KAAK,QAASA,EAAQ,KAAK,EAGzBA,EAAQ,QAAU,IAAA,IAAa,OAAOA,EAAQ,OAAU,UAAU,KAAK,QAASA,EAAQ,KAAK,EAEjG,IAAME,EAAkBF,EAAQ,aAC1BG,EAAeD,GAAA,IAGnBA,IAAoB,IAAA,KACnBA,IAAoB,MACnB,OAAOA,GAAoB,UAC3B,CAAC,OAAO,SAASA,CAAe,GAChCA,GAAmB,GACnBA,EAAkB,GAAK,GAAK,IAE9B,KAAK,eAAgBA,CAAe,EAGlCF,EAAQ,UAAY,IAAA,IAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,GAAG,KAAK,UAAWA,EAAQ,OAAO,EAErG,IAAMI,GAAWJ,EAAQ,SAAW,CAAC,EAAA,CAAG,IAAI,eAAe,EAE3D,MAAO,CACL,mBAAoB,iBAAiBA,EAAQ,mBAAoB,oBAAoB,EACrF,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,qBAAsB,iBAAiBA,EAAQ,qBAAsB,sBAAsB,EAC3F,oBAAqB,iBAAiBA,EAAQ,oBAAqB,qBAAqB,EACxF,OACA,MAAOA,EAAQ,MACf,eACA,UACA,OAAQ,gBAAgBA,EAAQ,MAAM,EACtC,MAAOA,EAAQ,OAAS,EAC1B,CACF,CAEA,SAAgB,oBAAoB,EAA2C,CAC7E,IAAMK,EAAgB,CACpB,kBACA,GAAIL,EAAQ,MAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,EAAI,CAAC,EACpD,GAAGA,EAAQ,qBACX,GAAGA,EAAQ,QAAQ,IAAK,GAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM,CAC3D,CAAC,CAAC,KAAK,GAAG,EACJC,EAAe,CAAC,kBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EAC3EQ,EAAe,CAAC,QAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,EACjES,EAAcT,EAAQ,mBAAmB,KAAK,GAAG,GAAK,SAE5D,MAAO,CACL,qBACA,cAAcK,IACd,aAAaE,IACb,WAAWC,IACX,YAAYC,IACZ,qBACA,qBACA,iBACF,CAAC,CAAC,KAAK,IAAI,CACb,CCtJA,SAAS,UAAU,EAAqB,CACtC,OAAOV,EAAI,QAAQ,aAAc,aAAa,CAChD,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAON,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QAAQ,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CACxG,CAEA,SAAS,WAAW,EAAuB,CACzC,OAAOA,EAAM,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAM,CAAC,CAAC,QAAQ,KAAM,MAAM,CAChF,CAEA,SAAgB,yBACd,EACA,EACA,EACQ,CACR,IAAMiB,EAAM,WAAW,oBAAoBV,CAAO,CAAC,EAC7CJ,EAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,EAAIC,KAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK;CAAI,EACNK,EAAUJ,EAAQ,QACrB,IAAK,GAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK;CAAI,EACNC,EAAQZ,EAAQ,MAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,GAAK,GAExE,MAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;QAGP,CChDA,IAAaC,EAAa,SACbC,EAAY,QACZC,EAAmB,eACnBC,EAAY,QACZC,EAAa,SACbC,EAAuB,mBACvBC,EAAkB,cAS/B,SAAgB,kBAAkB,EAAgB,EAAsD,CACtG,OACE,OAAO3B,GAAU,YACjBA,GACA,OAAQA,EAAgC,SAAY,UACnDA,EAA8B,UAAYP,EAAU,SACrD,OAAQO,EAAmC,YAAe,UACzDA,EAAiC,aAAeP,EAAU,YAC3D,OAAQO,EAA6B,MAAS,QAElD,CAEA,SAAgB,eAAwB,CACtC,GAAI,OAAO,OAAO,YAAe,WAAY,OAAO,OAAO,WAAW,EAEtE,IAAM4B,EAAQ,OAAO,gBAAgB,IAAI,YAAY,CAAC,CAAC,EAEvD,OAAO,MAAM,KAAKA,EAAQ,GAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAChF,CAEA,SAAgB,SAAS,EAA4B,EAAmD,CACtG,MAAO,CAAE,GAAGnC,EAAS,QAASD,EAAU,QAAS,WAAYA,EAAU,UAAW,CACpF,CClBA,SAAgB,cACd,EACA,EAA0B,CAAC,EACL,CACtB,IAAMW,EAAa,wBAAwBG,CAAO,EAC5CuB,EAAU,cAAc,EACxB3B,EAAiC,CAAE,GAAGC,EAAW,MAAO,EACxD2B,EAAY,IAAI,IAChBC,EAA+B,CAAC,EAChCC,EAAa,IAAI,gBACnBC,EAAmC,KACnCC,EAAW,GACXC,EAAc,GACdC,EAAa,EACb3B,EAAqD,KACrD4B,EAAkF,KAEtF,SAAS,kBAAoC,CAC3C,MAAO,CAAE,UAAS,YAAW,CAC/B,CAEA,SAAS,mBAA0B,CAC7B5B,IAAiB,OAErB,aAAaA,CAAY,EACzB,EAAe,KACjB,CAEA,SAAS,wBAA+B,CACtC,kBAAkB,EAClB4B,GAAe,QAAQ,EACvB,EAAgB,KAChB,EAAc,EAChB,CAEA,SAAS,UAAU,EAA+B,CAChD,IAAK,IAAMC,KAAYR,EACrB,GAAI,CACFQ,EAAS7C,CAAO,CAClB,MAAQ,CAER,CAEJ,CAEA,SAAS,cAAc,EAA2B,CAChD,GAAI,CAACwC,GAAUM,EAAM,SAAWN,EAAO,cAAe,OAEtD,IAAMzC,EAAY,iBAAiB,EAEnC,GAAK,kBAAkB+C,EAAM,KAAM/C,CAAS,EAE5C,OAAQ+C,EAAM,KAAK,KAAnB,CACE,KAAKnB,EACC,OAAOmB,EAAM,KAAK,OAAU,UAC9B,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,MAAOA,EAAM,KAAK,MAAO,KAAMnB,CAAW,CAAC,EAGpF,MACF,KAAKC,EACC,OAAOkB,EAAM,KAAK,SAAY,WAChC,UAAU,CACR,QAASA,EAAM,KAAK,QACpB,GAAI,OAAOA,EAAM,KAAK,OAAU,SAAW,CAAE,MAAOA,EAAM,KAAK,KAAM,EAAI,CAAC,EAC1E,KAAMlB,CACR,CAAC,EAKI,GAA6BkB,EAAM,KAAK,QAAxC,GAGP,MACF,KAAKhB,EACH,uBAAuB,EACvB,EAAc,GACd,kBAAkB,EAClB,MACF,KAAKC,EACC,OAAOe,EAAM,KAAK,QAAW,UAAY,OAAO,SAASA,EAAM,KAAK,MAAM,GAAKA,EAAM,KAAK,QAAU,GACtG,UAAU,CAAE,OAAQA,EAAM,KAAK,OAAQ,KAAMf,CAAW,CAAC,CAI/D,CACF,CAEA,SAAS,cAAkC,CAUzC,OATIS,IAEJ,EAAS,SAAS,cAAc,QAAQ,EACxCA,EAAO,aAAa,UAAW,eAAe,EAC9CA,EAAO,aAAa,iBAAkB,aAAa,EACnD,EAAO,QAAQ,eAAiBJ,EAChCW,EAAU,YAAYP,CAAM,EAC5B,OAAO,iBAAiB,UAAW,aAAa,EAEzCA,EACT,CAEA,SAAS,SAAgB,CACnBC,IAEJ,EAAW,GACX,uBAAuB,EACvBF,EAAW,MAAM,EAEjB,AAGEC,KAFA,OAAO,oBAAoB,UAAW,aAAa,EACnDA,EAAO,OAAO,EACL,MAGXH,EAAU,MAAM,EAClB,CAEA,SAAS,UAAU,EAAwD,CASzE,OARII,MAGW,CAAC,GAGhBJ,EAAU,IAAIW,CAAO,MAERX,EAAU,OAAOW,CAAO,EACvC,CAEA,SAAS,OAAO,EAA6B,CAC3C,GAAIP,EAGF,OAAO,QAAQ,QAAQ,EAGpBf,EAAK,KAAK,EAEf,uBAAuB,EACvB,GAAc,EAEd,IAAMuB,EAAU,aAAa,EACvBlD,EAAY,iBAAiB,EAC7BmD,EAAkB,CAAE,GAAGxC,EAAY,OAAQ,CAAE,GAAGD,CAAO,CAAE,EAE/D,EAAQ,QAAQ,kBAAoB,OAAOkC,CAAU,EACrD,EAAQ,OAAS,yBAAyBjB,EAAMwB,EAAiBnD,CAAS,EAE1E,IAAMoD,EAAU,IAAI,SAAe,EAAS,IAAW,CACrD,EAAgB,CAAE,SAAQ,SAAQ,CACpC,CAAC,EAeD,MAbA,GAAe,eAAiB,CACzBP,IAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,EACA,EAAgB,KAChB,EAAe,KACjB,EAAGA,EAAW,YAAY,EAEnByC,CACT,CAEA,SAAS,KAAK,EAAwC,CACpDX,GAAQ,eAAe,YAAY,SAAS,iBAAiB,EAAGxC,CAAO,EAAG,GAAG,CAC/E,CAEA,SAAS,mBAA0B,CAC5B0C,GAAgBF,GAAQ,eAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,SAAW,GAEnF,KAAK,CAAE,OAAQ,CAAE,GAAGA,CAAa,EAAG,KAAMN,CAAqB,CAAC,CAClE,CAEA,SAAS,SAAS,EAA8B,CAC1CS,IAMJ,OAAO,OAAOH,EAAcc,CAAM,EAE9BV,GAAeF,GAAQ,eAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,OAAS,GACvE,KAAK,CAAE,OAAQA,EAAQ,KAAMpB,CAAqB,CAAC,EAEvD,CAEA,SAAS,YAAY,EAAoB,CACnCS,GAMCC,GAAgBF,GAAQ,eAM7B,KAAK,CAAE,OAAM,KAAMX,CAAiB,CAAC,CACvC,CAEA,SAAS,YAAY,EAAY,EAAmB,CAC9CY,IAYJ,EAAO9B,GAAMC,EAET8B,GAAeF,GAAQ,eAAe,KAAK,CAAE,MAAK,KAAI,KAAMP,CAAgB,CAAC,EACnF,CAEA,MAAO,CACL,IAAI,gBAAiB,CACnB,OAAOM,EAAW,MACpB,EACA,QACA,IAAI,UAAW,CACb,OAAOE,CACT,EACA,UACA,OACA,YACA,SACA,CAAC,OAAO,UAAW,CACjB,QAAQ,CACV,EACA,WACF,CACF,C"}

package/dist/sandbox.js

@@ -223,11 +223,11 @@ function createSandbox(e, t = {}) {
 				});
 				break;
 			case i:
-				typeof e.data.message == "string" && broadcast({
+				typeof e.data.message == "string" && (broadcast({
 					message: e.data.message,
 					...typeof e.data.stack == "string" ? { stack: e.data.stack } : {},
 					type: i
-				});
+				}), `${e.data.message}`);
 				break;
 			case o:
 				supersedePendingRender(), _ = !0, flushPendingState();

package/dist/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","names":["bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";ACEA,SAAgB,kBAAkB,GAAoC;CAIpE,OAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK;AACP;;ACvEA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAMC,GAASC,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAMa,sBAAb,cAAyC,aAAa,CAAC,GAG1C,4BAAb,cAA+C,aAAa,CAAC,GCEvDC,IAAK,4BACLC,IAAO,yCACPC,IAAQ;AAEd,SAAS,KAAK,GAAe,GAAuB;CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG;AAC7E;AAEA,SAAS,gBAAgB,GAAgB,GAAuB;CAC9D,IAAI,OAAOA,KAAU,UAAU,OAAO,KAAKD,GAAOC,CAAK;CAEvD,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAKD,GAAOC,CAAK;CAC1B;CAaA,OAVGC,EAAI,aAAa,WAAWA,EAAI,aAAa,YAC9CA,EAAI,YACJA,EAAI,YACJA,EAAI,aAAa,OACjBA,EAAI,UACJA,EAAI,OAEG,KAAKF,GAAOC,CAAK,IAGnBC,EAAI;AACb;AAEA,SAAS,iBAAiB,GAA8B,GAAyB;CAI/E,OAHIC,MAAW,KAAA,IAAkB,CAAC,IAC7B,MAAM,QAAQA,CAAM,IAElBA,EAAO,KAAK,MAAU,gBAAgBF,GAAOD,CAAK,CAAC,IAFvB,KAAKA,GAAOG,CAAM;AAGvD;AAEA,SAAS,gBAAgB,GAAwB;CAC/C,IAAI,OAAOF,KAAU,UAAU,OAAO,KAAK,WAAWA,CAAK;CAE3D,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAK,WAAWA,CAAK;CAC9B;CAIA,OAFIC,EAAI,aAAa,WAAWA,EAAI,aAAa,WAAiB,KAAK,WAAWD,CAAK,IAEhFC,EAAI;AACb;AAEA,SAAS,gBAAgB,GAAoE;CAC3F,IAAIE,MAAW,KAAA,GAAW,OAAO,CAAC;CAClC,IAAI,OAAOA,KAAW,aAAYA,KAAmB,MAAM,QAAQA,CAAM,GAAG,OAAO,KAAK,UAAUA,CAAM;CAExG,IAAMC,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAACC,GAAIC,MAAQ,OAAO,QAAQH,CAAM,GAG3C,AAFKP,EAAG,KAAKS,CAAE,KAAK,OAAOC,KAAQ,YAAU,KAAK,UAAUD,CAAE,GAE9D,EAAWA,KAAMC;CAGnB,OAAOF;AACT;AAEA,SAAgB,wBAAwB,IAA0B,CAAC,GAA6B;CAC9F,CAAI,OAAOG,KAAY,aAAYA,KAAoB,MAAM,QAAQA,CAAO,MAAG,KAAK,WAAWA,CAAO;CAEtG,IAAMC,IAAOD,EAAQ,QAAQ;CAQ7B,AANKV,EAAK,KAAKW,CAAI,KAAG,KAAK,QAAQA,CAAI,GAEnCD,EAAQ,UAAU,KAAA,KAAeT,EAAM,KAAKS,EAAQ,KAAK,KAAKA,EAAQ,MAAM,WAAW,KACzF,KAAK,SAASA,EAAQ,KAAK,GAGzBA,EAAQ,UAAU,KAAA,KAAa,OAAOA,EAAQ,SAAU,YAAU,KAAK,SAASA,EAAQ,KAAK;CAEjG,IAAME,IAAkBF,EAAQ,cAC1BG,IAAeD,KAAA;CAarB,AAVEA,MAAoB,KAAA,MACnBA,MAAoB,QACnB,OAAOA,KAAoB,YAC3B,CAAC,OAAO,SAASA,CAAe,KAChCA,KAAmB,KACnBA,IAAkB,KAAK,KAAK,MAE9B,KAAK,gBAAgBA,CAAe,GAGlCF,EAAQ,YAAY,KAAA,KAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,KAAG,KAAK,WAAWA,EAAQ,OAAO;CAErG,IAAMI,KAAWJ,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,eAAe;CAE3D,OAAO;EACL,oBAAoB,iBAAiBA,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,iBAAiBA,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,OAAOA,EAAQ;EACf;EACA;EACA,QAAQ,gBAAgBA,EAAQ,MAAM;EACtC,OAAOA,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,oBAAoB,GAA2C;CAC7E,IAAMK,IAAgB;EACpB;EACA,GAAIL,EAAQ,QAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAGA,EAAQ;EACX,GAAGA,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJC,IAAe,CAAC,mBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3EQ,IAAe,CAAC,SAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjES,IAAcT,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAcK;EACd,aAAaE;EACb,WAAWC;EACX,YAAYC;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;ACtJA,SAAS,UAAU,GAAqB;CACtC,OAAOV,EAAI,QAAQ,cAAc,aAAa;AAChD;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAON,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AACxG;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAOA,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AAChF;AAEA,SAAgB,yBACd,GACA,GACA,GACQ;CACR,IAAMiB,IAAM,WAAW,oBAAoBV,CAAO,CAAC,GAC7CJ,IAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,GAAIC,OAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK,IAAI,GACNK,IAAUJ,EAAQ,QACrB,KAAK,MAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK,IAAI,GACNC,IAAQZ,EAAQ,QAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,KAAK;CAExE,OAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;;AAGP;;AChDA,IAAaC,IAAa,UACbC,IAAY,SACZC,IAAmB,gBACnBC,IAAY,SACZC,IAAa,UACbC,IAAuB,oBACvBC,IAAkB;AAS/B,SAAgB,kBAAkB,GAAgB,GAAsD;CACtG,OACE,OAAO3B,KAAU,cACjBA,KACA,OAAQA,EAAgC,WAAY,YACnDA,EAA8B,YAAYP,EAAU,WACrD,OAAQO,EAAmC,cAAe,YACzDA,EAAiC,eAAeP,EAAU,cAC3D,OAAQO,EAA6B,QAAS;AAElD;AAEA,SAAgB,gBAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAM4B,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAKA,IAAQ,MAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,SAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAGnC;EAAS,SAASD,EAAU;EAAS,YAAYA,EAAU;CAAW;AACpF;;AClBA,SAAgB,cACd,GACA,IAA0B,CAAC,GACL;CACtB,IAAMW,IAAa,wBAAwBG,CAAO,GAC5CuB,IAAU,cAAc,GACxB3B,IAAiC,EAAE,GAAGC,EAAW,OAAO,GACxD2B,oBAAY,IAAI,IAAuC,GACvDC,IAA+B,CAAC,GAChCC,IAAa,IAAI,gBAAgB,GACnCC,IAAmC,MACnCC,IAAW,IACXC,IAAc,IACdC,IAAa,GACb3B,IAAqD,MACrD4B,IAAkF;CAEtF,SAAS,mBAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,oBAA0B;EACjC,AAAI5B,MAAiB,SAErB,aAAaA,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,yBAA+B;EAItC,AAHA,kBAAkB,GAClB4B,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,UAAU,GAA+B;EAChD,KAAK,IAAMC,KAAYR,GACrB,IAAI;GACF,EAASrC,CAAO;EAClB,QAAQ,CAER;CAEJ;CAEA,SAAS,cAAc,GAA2B;EAChD,IAAI,CAACwC,KAAUM,EAAM,WAAWN,EAAO,eAAe;EAEtD,IAAMzC,IAAY,iBAAiB;EAEnC,IAAK,kBAAkB+C,EAAM,MAAM/C,CAAS,GAE5C,QAAQ+C,EAAM,KAAK,MAAnB;GACE,KAAKnB;IACH,AAAI,OAAOmB,EAAM,KAAK,SAAU,YAC9B,UAAU;KAAE,QAAQA,EAAM,KAAK;KAAQ,OAAOA,EAAM,KAAK;KAAO,MAAMnB;IAAW,CAAC;IAGpF;GACF,KAAKC;IACH,AAAI,OAAOkB,EAAM,KAAK,WAAY,YAChC,UAAU;KACR,SAASA,EAAM,KAAK;KACpB,GAAI,OAAOA,EAAM,KAAK,SAAU,WAAW,EAAE,OAAOA,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAMlB;IACR,CAAC;IAGH;GACF,KAAKE;IAGH,AAFA,uBAAuB,GACvB,IAAc,IACd,kBAAkB;IAClB;GACF,KAAKC,GACH,AAAI,OAAOe,EAAM,KAAK,UAAW,YAAY,OAAO,SAASA,EAAM,KAAK,MAAM,KAAKA,EAAM,KAAK,UAAU,KACtG,UAAU;IAAE,QAAQA,EAAM,KAAK;IAAQ,MAAMf;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,eAAkC;EAUzC,OATIS,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxCA,EAAO,aAAa,WAAW,eAAe,GAC9CA,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiBJ,GAChCW,EAAU,YAAYP,CAAM,GAC5B,OAAO,iBAAiB,WAAW,aAAa,GAEzCA;CACT;CAEA,SAAS,UAAgB;EACvB,AAAIC,MAEJ,IAAW,IACX,uBAAuB,GACvBF,EAAW,MAAM,GAEjB,AAGEC,OAFA,OAAO,oBAAoB,WAAW,aAAa,GACnDA,EAAO,OAAO,GACL,OAGXH,EAAU,MAAM;CAClB;CAEA,SAAS,UAAU,GAAwD;EASzE,OARII,UAGW,CAAC,KAGhBJ,EAAU,IAAIW,CAAO,SAERX,EAAU,OAAOW,CAAO;CACvC;CAEA,SAAS,OAAO,GAA6B;EAC3C,IAAIP,GAGF,OAAO,QAAQ,QAAQ;EAMzB,AAHKf,EAAK,KAAK,GAEf,uBAAuB,GACvB,KAAc;EAEd,IAAMuB,IAAU,aAAa,GACvBlD,IAAY,iBAAiB,GAC7BmD,IAAkB;GAAE,GAAGxC;GAAY,QAAQ,EAAE,GAAGD,EAAO;EAAE;EAG/D,AADA,EAAQ,QAAQ,oBAAoB,OAAOkC,CAAU,GACrD,EAAQ,SAAS,yBAAyBjB,GAAMwB,GAAiBnD,CAAS;EAE1E,IAAMoD,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GAC9B,AAAKP,MAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAGA,EAAW,YAAY,GAEnByC;CACT;CAEA,SAAS,KAAK,GAAwC;EACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,GAAGnD,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,oBAA0B;EACjC,AAAK0C,KAAgBF,GAAQ,iBAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,WAAW,KAEnF,KAAK;GAAE,QAAQ,EAAE,GAAGA,EAAa;GAAG,MAAMN;EAAqB,CAAC;CAClE;CAEA,SAAS,SAAS,GAA8B;EAC9C,AAAIS,MAMJ,OAAO,OAAOH,GAAcc,CAAM,GAE9BV,KAAeF,GAAQ,iBAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,SAAS,KACvE,KAAK;GAAE,QAAQA;GAAQ,MAAMpB;EAAqB,CAAC;CAEvD;CAEA,SAAS,YAAY,GAAoB;EACvC,AAAIS,KAMCC,KAAgBF,GAAQ,iBAM7B,KAAK;GAAE;GAAM,MAAMX;EAAiB,CAAC;CACvC;CAEA,SAAS,YAAY,GAAY,GAAmB;EAClD,AAAIY,MAYJ,EAAO9B,KAAMC,GAET8B,KAAeF,GAAQ,iBAAe,KAAK;GAAE;GAAK;GAAI,MAAMP;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAOM,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAOE;EACT;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,QAAQ;EACV;EACA;CACF;AACF"}
+{"version":3,"file":"sandbox.js","names":["bootstrap","message","opts","ID","LANG","NONCE","field","value","url","values","styles","normalized","id","css","options","lang","rawReadyTimeout","readyTimeout","scripts","scriptOrigins","script","styleOrigins","imageOrigins","fontOrigins","csp","src","nonce","html","MSG_CUSTOM","MSG_ERROR","MSG_HTML_REPLACE","MSG_READY","MSG_RESIZE","MSG_STATE_UPDATE_ALL","MSG_STYLE_PATCH","bytes","byte","channel","listeners","pendingState","controller","iframe","disposed","bridgeReady","generation","currentRender","listener","event","container","handler","current","documentOptions","promise","update"],"sources":["../src/_dev.ts","../src/_bridge.ts","../src/errors.ts","../src/_policy.ts","../src/_document.ts","../src/_protocol.ts","../src/_runtime.ts"],"sourcesContent":["const isDev = !(globalThis as { __SANDBOX_PROD__?: boolean }).__SANDBOX_PROD__;\n\n/** @internal @security: some callers interpolate user-supplied values (e.g. styles key) into msg; do not log PII. */\nexport function warn(msg: string): void {\n  if (isDev) console.warn(`[@vielzeug/sandbox] ${msg}`);\n}\n\n/** @internal: Run fn only in dev builds. Use when dev-only logic goes beyond a single warn() / error() call. */\nexport function devOnly(fn: () => void): void {\n  if (isDev) fn();\n}\n","import type { BridgeBootstrap } from './_protocol.js';\n\nexport function buildBridgeScript(bootstrap: BridgeBootstrap): string {\n  const channel = JSON.stringify(bootstrap.channel);\n  const generation = String(bootstrap.generation);\n\n  return `\n(function() {\nwindow.__sandboxChannel = ${channel};\nwindow.__sandboxGeneration = ${generation};\nconst __sandboxChannel = window.__sandboxChannel;\nconst __sandboxGeneration = window.__sandboxGeneration;\nif ('ontouchstart' in window) document.addEventListener('touchstart', function() {}, { passive: true });\nwindow.addEventListener('message', function(e) {\n  var msg = e.data;\n  if (e.source !== parent || !msg || msg.channel !== __sandboxChannel || msg.generation !== __sandboxGeneration) return;\n  if (msg.type === 'state-update-all' && msg.record && typeof msg.record === 'object') {\n    var keys = Object.keys(msg.record);\n    for (var i = 0; i < keys.length; i++) {\n      var k = keys[i];\n      document.dispatchEvent(new CustomEvent('sandbox:state-update', { detail: { key: k, value: msg.record[k] } }));\n    }\n  }\n  if (msg.type === 'style-patch' && msg.id && typeof msg.css === 'string') {\n    var el = document.getElementById(msg.id);\n    if (el && el.tagName === 'STYLE') el.textContent = msg.css;\n  }\n  if (msg.type === 'html-replace' && typeof msg.html === 'string') {\n    document.body.innerHTML = msg.html;\n  }\n});\nfunction post(msg) {\n  msg.channel = __sandboxChannel;\n  msg.generation = __sandboxGeneration;\n  parent.postMessage(msg, '*');\n}\nwindow.onerror = function(message, _src, _line, _col, err) {\n  post({ type: 'error', message: String(message), stack: err && err.stack });\n  return true;\n};\nwindow.addEventListener('unhandledrejection', function(e) {\n  var reason = e.reason;\n  post({ type: 'error', message: String(reason), stack: reason && reason.stack });\n});\nwindow.__sandbox__ = {\n  emit: function(event, detail) {\n    post({ type: 'custom', event: String(event), detail: detail });\n  },\n  onState: function(key, handler) {\n    function listener(e) {\n      if (e.detail && e.detail.key === key) handler(e.detail.value);\n    }\n    document.addEventListener('sandbox:state-update', listener);\n    return function() {\n      document.removeEventListener('sandbox:state-update', listener);\n    };\n  }\n};\nwindow.addEventListener('DOMContentLoaded', function() {\n  post({ type: 'ready' });\n  if (typeof ResizeObserver === 'undefined') return;\n  new ResizeObserver(function(entries) {\n    var entry = entries[0];\n    if (!entry) return;\n    var h = entry.borderBoxSize && entry.borderBoxSize[0]\n      ? entry.borderBoxSize[0].blockSize\n      : entry.contentRect.height;\n    post({ type: 'resize', height: h });\n  }).observe(document.body);\n});\n})();\n`.trim();\n}\n","/** Base class for all sandbox errors. */\nexport class SandboxError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Thrown when render() does not receive a 'ready' signal from the sandbox document\n * within the timeout window. An injected script may have blocked document initialization.\n */\nexport class SandboxTimeoutError extends SandboxError {}\n\n/** Thrown when Sandbox configuration cannot produce a valid document or CSP policy. */\nexport class SandboxConfigurationError extends SandboxError {}\n","import { SandboxConfigurationError } from './errors.js';\nimport type { SandboxOptions } from './types.js';\n\nexport interface NormalizedSandboxOptions {\n  allowedFontOrigins: string[];\n  allowedImageOrigins: string[];\n  allowedScriptOrigins: string[];\n  allowedStyleOrigins: string[];\n  lang: string;\n  nonce: string | undefined;\n  readyTimeout: number;\n  scripts: string[];\n  styles: Record<string, string>;\n  title: string;\n}\n\nexport const DEFAULT_READY_TIMEOUT_MS = 5000;\n\nconst ID = /^[A-Za-z][A-Za-z0-9_-]*$/;\nconst LANG = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;\nconst NONCE = /^[A-Za-z0-9+/_-]+={0,2}$/;\n\nfunction fail(field: string, value: unknown): never {\n  throw new SandboxConfigurationError(`${field} is invalid: ${String(value)}`);\n}\n\nfunction normalizeOrigin(value: unknown, field: string): string {\n  if (typeof value !== 'string') return fail(field, value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail(field, value);\n  }\n\n  if (\n    (url.protocol !== 'http:' && url.protocol !== 'https:') ||\n    url.username ||\n    url.password ||\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash\n  ) {\n    return fail(field, value);\n  }\n\n  return url.origin;\n}\n\nfunction normalizeOrigins(values: string[] | undefined, field: string): string[] {\n  if (values === undefined) return [];\n  if (!Array.isArray(values)) return fail(field, values);\n\n  return values.map((value) => normalizeOrigin(value, field));\n}\n\nfunction normalizeScript(value: unknown): string {\n  if (typeof value !== 'string') return fail('scripts', value);\n\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    return fail('scripts', value);\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return fail('scripts', value);\n\n  return url.href;\n}\n\nfunction normalizeStyles(styles: Record<string, string> | undefined): Record<string, string> {\n  if (styles === undefined) return {};\n  if (typeof styles !== 'object' || styles === null || Array.isArray(styles)) return fail('styles', styles);\n\n  const normalized: Record<string, string> = {};\n\n  for (const [id, css] of Object.entries(styles)) {\n    if (!ID.test(id) || typeof css !== 'string') fail('styles', id);\n\n    normalized[id] = css;\n  }\n\n  return normalized;\n}\n\nexport function normalizeSandboxOptions(options: SandboxOptions = {}): NormalizedSandboxOptions {\n  if (typeof options !== 'object' || options === null || Array.isArray(options)) fail('options', options);\n\n  const lang = options.lang ?? 'en';\n\n  if (!LANG.test(lang)) fail('lang', lang);\n\n  if (options.nonce !== undefined && (!NONCE.test(options.nonce) || options.nonce.length === 0)) {\n    fail('nonce', options.nonce);\n  }\n\n  if (options.title !== undefined && typeof options.title !== 'string') fail('title', options.title);\n\n  const rawReadyTimeout = options.readyTimeout;\n  const readyTimeout = rawReadyTimeout ?? DEFAULT_READY_TIMEOUT_MS;\n\n  if (\n    rawReadyTimeout !== undefined &&\n    (rawReadyTimeout === null ||\n      typeof rawReadyTimeout !== 'number' ||\n      !Number.isFinite(rawReadyTimeout) ||\n      rawReadyTimeout <= 0 ||\n      rawReadyTimeout > 2 ** 31 - 1)\n  ) {\n    fail('readyTimeout', rawReadyTimeout);\n  }\n\n  if (options.scripts !== undefined && !Array.isArray(options.scripts)) fail('scripts', options.scripts);\n\n  const scripts = (options.scripts ?? []).map(normalizeScript);\n\n  return {\n    allowedFontOrigins: normalizeOrigins(options.allowedFontOrigins, 'allowedFontOrigins'),\n    allowedImageOrigins: normalizeOrigins(options.allowedImageOrigins, 'allowedImageOrigins'),\n    allowedScriptOrigins: normalizeOrigins(options.allowedScriptOrigins, 'allowedScriptOrigins'),\n    allowedStyleOrigins: normalizeOrigins(options.allowedStyleOrigins, 'allowedStyleOrigins'),\n    lang,\n    nonce: options.nonce,\n    readyTimeout,\n    scripts,\n    styles: normalizeStyles(options.styles),\n    title: options.title ?? '',\n  };\n}\n\nexport function buildCspFromOptions(options: NormalizedSandboxOptions): string {\n  const scriptOrigins = [\n    \"'unsafe-inline'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...options.allowedScriptOrigins,\n    ...options.scripts.map((script) => new URL(script).origin),\n  ].join(' ');\n  const styleOrigins = [\"'unsafe-inline'\", ...options.allowedStyleOrigins].join(' ');\n  const imageOrigins = ['data:', ...options.allowedImageOrigins].join(' ');\n  const fontOrigins = options.allowedFontOrigins.join(' ') || \"'none'\";\n\n  return [\n    \"default-src 'none'\",\n    `script-src ${scriptOrigins}`,\n    `style-src ${styleOrigins}`,\n    `img-src ${imageOrigins}`,\n    `font-src ${fontOrigins}`,\n    \"connect-src 'none'\",\n    \"form-action 'none'\",\n    \"base-uri 'none'\",\n  ].join('; ');\n}\n\nexport function buildCsp(options: SandboxOptions = {}): string {\n  return buildCspFromOptions(normalizeSandboxOptions(options));\n}\n","import { buildBridgeScript } from './_bridge.js';\nimport { buildCspFromOptions, type NormalizedSandboxOptions, normalizeSandboxOptions } from './_policy.js';\nimport type { BridgeBootstrap } from './_protocol.js';\nimport type { SandboxOptions } from './types.js';\n\nfunction escapeCss(css: string): string {\n  return css.replace(/<\\/style/gi, '\\\\3C /style');\n}\n\nfunction escapeAttr(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nfunction escapeText(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');\n}\n\nexport function buildDocumentFromOptions(\n  html: string,\n  options: NormalizedSandboxOptions,\n  bootstrap: BridgeBootstrap,\n): string {\n  const csp = escapeAttr(buildCspFromOptions(options));\n  const styles = Object.entries(options.styles)\n    .map(([id, css]) => `<style id=\"${escapeAttr(id)}\">${escapeCss(css)}</style>`)\n    .join('\\n');\n  const scripts = options.scripts\n    .map((src) => `<script crossorigin=\"anonymous\" src=\"${escapeAttr(src)}\"></script>`)\n    .join('\\n');\n  const nonce = options.nonce ? ` nonce=\"${escapeAttr(options.nonce)}\"` : '';\n\n  return `<!doctype html>\n<html lang=\"${escapeAttr(options.lang)}\">\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"${csp}\">\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeText(options.title)}</title>\n${styles}\n<script${nonce}>\n${buildBridgeScript(bootstrap)}\n</script>\n</head>\n<body>\n${scripts}\n${html}\n</body>\n</html>`;\n}\n\nexport function buildDocument(html: string, options: SandboxOptions = {}): string {\n  return buildDocumentFromOptions(html, normalizeSandboxOptions(options), { channel: '', generation: 0 });\n}\n","export const MSG_CUSTOM = 'custom';\nexport const MSG_ERROR = 'error';\nexport const MSG_HTML_REPLACE = 'html-replace';\nexport const MSG_READY = 'ready';\nexport const MSG_RESIZE = 'resize';\nexport const MSG_STATE_UPDATE_ALL = 'state-update-all';\nexport const MSG_STYLE_PATCH = 'style-patch';\n\nexport interface BridgeBootstrap {\n  channel: string;\n  generation: number;\n}\n\nexport type ProtocolMessage = Record<string, unknown> & { channel: string; generation: number; type: string };\n\nexport function isProtocolMessage(value: unknown, bootstrap: BridgeBootstrap): value is ProtocolMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { channel?: unknown }).channel === 'string' &&\n    (value as { channel: string }).channel === bootstrap.channel &&\n    typeof (value as { generation?: unknown }).generation === 'number' &&\n    (value as { generation: number }).generation === bootstrap.generation &&\n    typeof (value as { type?: unknown }).type === 'string'\n  );\n}\n\nexport function createChannel(): string {\n  if (typeof crypto.randomUUID === 'function') return crypto.randomUUID();\n\n  const bytes = crypto.getRandomValues(new Uint32Array(4));\n\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(8, '0')).join('');\n}\n\nexport function envelope(bootstrap: BridgeBootstrap, message: Record<string, unknown>): ProtocolMessage {\n  return { ...message, channel: bootstrap.channel, generation: bootstrap.generation } as ProtocolMessage;\n}\n","import { devOnly, warn } from './_dev.js';\nimport { buildDocumentFromOptions } from './_document.js';\nimport { normalizeSandboxOptions } from './_policy.js';\nimport {\n  type BridgeBootstrap,\n  createChannel,\n  envelope,\n  isProtocolMessage,\n  MSG_CUSTOM,\n  MSG_ERROR,\n  MSG_HTML_REPLACE,\n  MSG_READY,\n  MSG_RESIZE,\n  MSG_STATE_UPDATE_ALL,\n  MSG_STYLE_PATCH,\n} from './_protocol.js';\nimport { SandboxTimeoutError } from './errors.js';\nimport type { SandboxHandle, SandboxMessage, SandboxOptions } from './types.js';\n\nexport function createSandbox<State extends object = Record<string, unknown>>(\n  container: HTMLElement,\n  options: SandboxOptions = {},\n): SandboxHandle<State> {\n  const normalized = normalizeSandboxOptions(options);\n  const channel = createChannel();\n  const styles: Record<string, string> = { ...normalized.styles };\n  const listeners = new Set<(message: SandboxMessage) => void>();\n  const pendingState: Partial<State> = {};\n  const controller = new AbortController();\n  let iframe: HTMLIFrameElement | null = null;\n  let disposed = false;\n  let bridgeReady = false;\n  let generation = 0;\n  let readyTimeout: ReturnType<typeof setTimeout> | null = null;\n  let currentRender: { reject: (error: unknown) => void; resolve: () => void } | null = null;\n\n  function currentBootstrap(): BridgeBootstrap {\n    return { channel, generation };\n  }\n\n  function clearReadyTimeout(): void {\n    if (readyTimeout === null) return;\n\n    clearTimeout(readyTimeout);\n    readyTimeout = null;\n  }\n\n  function supersedePendingRender(): void {\n    clearReadyTimeout();\n    currentRender?.resolve();\n    currentRender = null;\n    bridgeReady = false;\n  }\n\n  function broadcast(message: SandboxMessage): void {\n    for (const listener of listeners) {\n      try {\n        listener(message);\n      } catch {\n        warn('onMessage() handler threw: remaining handlers will still run.');\n      }\n    }\n  }\n\n  function handleMessage(event: MessageEvent): void {\n    if (!iframe || event.source !== iframe.contentWindow) return;\n\n    const bootstrap = currentBootstrap();\n\n    if (!isProtocolMessage(event.data, bootstrap)) return;\n\n    switch (event.data.type) {\n      case MSG_CUSTOM:\n        if (typeof event.data.event === 'string') {\n          broadcast({ detail: event.data.detail, event: event.data.event, type: MSG_CUSTOM });\n        }\n\n        break;\n      case MSG_ERROR:\n        if (typeof event.data.message === 'string') {\n          broadcast({\n            message: event.data.message,\n            ...(typeof event.data.stack === 'string' ? { stack: event.data.stack } : {}),\n            type: MSG_ERROR,\n          });\n\n          // The bridge replaces window.onerror inside the document, so without this the\n          // host is the only place a sandboxed error can surface: consumers that do not\n          // subscribe to MSG_ERROR would otherwise watch a sandbox fail silently.\n          warn(`sandboxed document error: ${event.data.message}`);\n        }\n\n        break;\n      case MSG_READY:\n        supersedePendingRender();\n        bridgeReady = true;\n        flushPendingState();\n        break;\n      case MSG_RESIZE:\n        if (typeof event.data.height === 'number' && Number.isFinite(event.data.height) && event.data.height >= 0) {\n          broadcast({ height: event.data.height, type: MSG_RESIZE });\n        }\n\n        break;\n    }\n  }\n\n  function ensureIframe(): HTMLIFrameElement {\n    if (iframe) return iframe;\n\n    iframe = document.createElement('iframe');\n    iframe.setAttribute('sandbox', 'allow-scripts');\n    iframe.setAttribute('referrerpolicy', 'no-referrer');\n    iframe.dataset.sandboxChannel = channel;\n    container.appendChild(iframe);\n    window.addEventListener('message', handleMessage);\n\n    return iframe;\n  }\n\n  function dispose(): void {\n    if (disposed) return;\n\n    disposed = true;\n    supersedePendingRender();\n    controller.abort();\n\n    if (iframe) {\n      window.removeEventListener('message', handleMessage);\n      iframe.remove();\n      iframe = null;\n    }\n\n    listeners.clear();\n  }\n\n  function onMessage(handler: (message: SandboxMessage) => void): () => void {\n    if (disposed) {\n      warn('onMessage() called on a disposed sandbox: handler will never fire.');\n\n      return () => {};\n    }\n\n    listeners.add(handler);\n\n    return () => listeners.delete(handler);\n  }\n\n  function render(html: string): Promise<void> {\n    if (disposed) {\n      warn('render() called on a disposed sandbox.');\n\n      return Promise.resolve();\n    }\n\n    if (!html.trim()) warn('render() called with empty HTML.');\n\n    supersedePendingRender();\n    generation += 1;\n\n    const current = ensureIframe();\n    const bootstrap = currentBootstrap();\n    const documentOptions = { ...normalized, styles: { ...styles } };\n\n    current.dataset.sandboxGeneration = String(generation);\n    current.srcdoc = buildDocumentFromOptions(html, documentOptions, bootstrap);\n\n    const promise = new Promise<void>((resolve, reject) => {\n      currentRender = { reject, resolve };\n    });\n\n    readyTimeout = setTimeout(() => {\n      if (!currentRender) return;\n\n      currentRender.reject(\n        new SandboxTimeoutError(\n          `render() did not receive a 'ready' signal within ${normalized.readyTimeout}ms. ` +\n            'An injected script may have blocked document initialization.',\n        ),\n      );\n      currentRender = null;\n      readyTimeout = null;\n    }, normalized.readyTimeout);\n\n    return promise;\n  }\n\n  function send(message: Record<string, unknown>): void {\n    iframe?.contentWindow?.postMessage(envelope(currentBootstrap(), message), '*');\n  }\n\n  function flushPendingState(): void {\n    if (!bridgeReady || !iframe?.contentWindow || Object.keys(pendingState).length === 0) return;\n\n    send({ record: { ...pendingState }, type: MSG_STATE_UPDATE_ALL });\n  }\n\n  function setState(update: Partial<State>): void {\n    if (disposed) {\n      warn('setState() called on a disposed sandbox.');\n\n      return;\n    }\n\n    Object.assign(pendingState, update);\n\n    if (bridgeReady && iframe?.contentWindow && Object.keys(update).length > 0) {\n      send({ record: update, type: MSG_STATE_UPDATE_ALL });\n    }\n  }\n\n  function replaceBody(html: string): void {\n    if (disposed) {\n      warn('replaceBody() called on a disposed sandbox.');\n\n      return;\n    }\n\n    if (!bridgeReady || !iframe?.contentWindow) {\n      warn('replaceBody() called before render() has resolved: bridge is not ready. Await render() first.');\n\n      return;\n    }\n\n    send({ html, type: MSG_HTML_REPLACE });\n  }\n\n  function updateStyle(id: string, css: string): void {\n    if (disposed) {\n      warn('updateStyle() called on a disposed sandbox.');\n\n      return;\n    }\n\n    devOnly(() => {\n      if (!(id in styles)) {\n        warn(`updateStyle('${id}', …): '${id}' is not a known styles key.`);\n      }\n    });\n\n    styles[id] = css;\n\n    if (bridgeReady && iframe?.contentWindow) send({ css, id, type: MSG_STYLE_PATCH });\n  }\n\n  return {\n    get disposalSignal() {\n      return controller.signal;\n    },\n    dispose,\n    get disposed() {\n      return disposed;\n    },\n    onMessage,\n    render,\n    replaceBody,\n    setState,\n    [Symbol.dispose]() {\n      dispose();\n    },\n    updateStyle,\n  };\n}\n"],"mappings":";ACEA,SAAgB,kBAAkB,GAAoC;CAIpE,OAAO;;4BAHS,KAAK,UAAUA,EAAU,OAKf,EAAQ;+BAJf,OAAOA,EAAU,UAKP,EAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DxC,KAAK;AACP;;ACvEA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAMC,GAASC,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAMa,sBAAb,cAAyC,aAAa,CAAC,GAG1C,4BAAb,cAA+C,aAAa,CAAC,GCEvDC,IAAK,4BACLC,IAAO,yCACPC,IAAQ;AAEd,SAAS,KAAK,GAAe,GAAuB;CAClD,MAAM,IAAI,0BAA0B,GAAGC,EAAM,eAAe,OAAOC,CAAK,GAAG;AAC7E;AAEA,SAAS,gBAAgB,GAAgB,GAAuB;CAC9D,IAAI,OAAOA,KAAU,UAAU,OAAO,KAAKD,GAAOC,CAAK;CAEvD,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAKD,GAAOC,CAAK;CAC1B;CAaA,OAVGC,EAAI,aAAa,WAAWA,EAAI,aAAa,YAC9CA,EAAI,YACJA,EAAI,YACJA,EAAI,aAAa,OACjBA,EAAI,UACJA,EAAI,OAEG,KAAKF,GAAOC,CAAK,IAGnBC,EAAI;AACb;AAEA,SAAS,iBAAiB,GAA8B,GAAyB;CAI/E,OAHIC,MAAW,KAAA,IAAkB,CAAC,IAC7B,MAAM,QAAQA,CAAM,IAElBA,EAAO,KAAK,MAAU,gBAAgBF,GAAOD,CAAK,CAAC,IAFvB,KAAKA,GAAOG,CAAM;AAGvD;AAEA,SAAS,gBAAgB,GAAwB;CAC/C,IAAI,OAAOF,KAAU,UAAU,OAAO,KAAK,WAAWA,CAAK;CAE3D,IAAIC;CAEJ,IAAI;EACF,IAAM,IAAI,IAAID,CAAK;CACrB,QAAQ;EACN,OAAO,KAAK,WAAWA,CAAK;CAC9B;CAIA,OAFIC,EAAI,aAAa,WAAWA,EAAI,aAAa,WAAiB,KAAK,WAAWD,CAAK,IAEhFC,EAAI;AACb;AAEA,SAAS,gBAAgB,GAAoE;CAC3F,IAAIE,MAAW,KAAA,GAAW,OAAO,CAAC;CAClC,IAAI,OAAOA,KAAW,aAAYA,KAAmB,MAAM,QAAQA,CAAM,GAAG,OAAO,KAAK,UAAUA,CAAM;CAExG,IAAMC,IAAqC,CAAC;CAE5C,KAAK,IAAM,CAACC,GAAIC,MAAQ,OAAO,QAAQH,CAAM,GAG3C,AAFKP,EAAG,KAAKS,CAAE,KAAK,OAAOC,KAAQ,YAAU,KAAK,UAAUD,CAAE,GAE9D,EAAWA,KAAMC;CAGnB,OAAOF;AACT;AAEA,SAAgB,wBAAwB,IAA0B,CAAC,GAA6B;CAC9F,CAAI,OAAOG,KAAY,aAAYA,KAAoB,MAAM,QAAQA,CAAO,MAAG,KAAK,WAAWA,CAAO;CAEtG,IAAMC,IAAOD,EAAQ,QAAQ;CAQ7B,AANKV,EAAK,KAAKW,CAAI,KAAG,KAAK,QAAQA,CAAI,GAEnCD,EAAQ,UAAU,KAAA,KAAeT,EAAM,KAAKS,EAAQ,KAAK,KAAKA,EAAQ,MAAM,WAAW,KACzF,KAAK,SAASA,EAAQ,KAAK,GAGzBA,EAAQ,UAAU,KAAA,KAAa,OAAOA,EAAQ,SAAU,YAAU,KAAK,SAASA,EAAQ,KAAK;CAEjG,IAAME,IAAkBF,EAAQ,cAC1BG,IAAeD,KAAA;CAarB,AAVEA,MAAoB,KAAA,MACnBA,MAAoB,QACnB,OAAOA,KAAoB,YAC3B,CAAC,OAAO,SAASA,CAAe,KAChCA,KAAmB,KACnBA,IAAkB,KAAK,KAAK,MAE9B,KAAK,gBAAgBA,CAAe,GAGlCF,EAAQ,YAAY,KAAA,KAAa,CAAC,MAAM,QAAQA,EAAQ,OAAO,KAAG,KAAK,WAAWA,EAAQ,OAAO;CAErG,IAAMI,KAAWJ,EAAQ,WAAW,CAAC,EAAA,CAAG,IAAI,eAAe;CAE3D,OAAO;EACL,oBAAoB,iBAAiBA,EAAQ,oBAAoB,oBAAoB;EACrF,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF,sBAAsB,iBAAiBA,EAAQ,sBAAsB,sBAAsB;EAC3F,qBAAqB,iBAAiBA,EAAQ,qBAAqB,qBAAqB;EACxF;EACA,OAAOA,EAAQ;EACf;EACA;EACA,QAAQ,gBAAgBA,EAAQ,MAAM;EACtC,OAAOA,EAAQ,SAAS;CAC1B;AACF;AAEA,SAAgB,oBAAoB,GAA2C;CAC7E,IAAMK,IAAgB;EACpB;EACA,GAAIL,EAAQ,QAAQ,CAAC,UAAUA,EAAQ,MAAM,EAAE,IAAI,CAAC;EACpD,GAAGA,EAAQ;EACX,GAAGA,EAAQ,QAAQ,KAAK,MAAW,IAAI,IAAIM,CAAM,CAAC,CAAC,MAAM;CAC3D,CAAC,CAAC,KAAK,GAAG,GACJC,IAAe,CAAC,mBAAmB,GAAGP,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GAC3EQ,IAAe,CAAC,SAAS,GAAGR,EAAQ,mBAAmB,CAAC,CAAC,KAAK,GAAG,GACjES,IAAcT,EAAQ,mBAAmB,KAAK,GAAG,KAAK;CAE5D,OAAO;EACL;EACA,cAAcK;EACd,aAAaE;EACb,WAAWC;EACX,YAAYC;EACZ;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;ACtJA,SAAS,UAAU,GAAqB;CACtC,OAAOV,EAAI,QAAQ,cAAc,aAAa;AAChD;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAON,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AACxG;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAOA,EAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM;AAChF;AAEA,SAAgB,yBACd,GACA,GACA,GACQ;CACR,IAAMiB,IAAM,WAAW,oBAAoBV,CAAO,CAAC,GAC7CJ,IAAS,OAAO,QAAQI,EAAQ,MAAM,CAAC,CAC1C,KAAK,CAACF,GAAIC,OAAS,cAAc,WAAWD,CAAE,EAAE,IAAI,UAAUC,CAAG,EAAE,SAAS,CAAC,CAC7E,KAAK,IAAI,GACNK,IAAUJ,EAAQ,QACrB,KAAK,MAAQ,wCAAwC,WAAWW,CAAG,EAAE,aAAY,CAAC,CAClF,KAAK,IAAI,GACNC,IAAQZ,EAAQ,QAAQ,WAAW,WAAWA,EAAQ,KAAK,EAAE,KAAK;CAExE,OAAO;cACK,WAAWA,EAAQ,IAAI,EAAE;;sDAEeU,EAAI;;;SAGjD,WAAWV,EAAQ,KAAK,EAAE;EACjCJ,EAAO;SACAgB,EAAM;EACb,kBAAkB1B,CAAS,EAAE;;;;EAI7BkB,EAAQ;EACRS,EAAK;;;AAGP;;AChDA,IAAaC,IAAa,UACbC,IAAY,SACZC,IAAmB,gBACnBC,IAAY,SACZC,IAAa,UACbC,IAAuB,oBACvBC,IAAkB;AAS/B,SAAgB,kBAAkB,GAAgB,GAAsD;CACtG,OACE,OAAO3B,KAAU,cACjBA,KACA,OAAQA,EAAgC,WAAY,YACnDA,EAA8B,YAAYP,EAAU,WACrD,OAAQO,EAAmC,cAAe,YACzDA,EAAiC,eAAeP,EAAU,cAC3D,OAAQO,EAA6B,QAAS;AAElD;AAEA,SAAgB,gBAAwB;CACtC,IAAI,OAAO,OAAO,cAAe,YAAY,OAAO,OAAO,WAAW;CAEtE,IAAM4B,IAAQ,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC;CAEvD,OAAO,MAAM,KAAKA,IAAQ,MAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,SAAgB,SAAS,GAA4B,GAAmD;CACtG,OAAO;EAAE,GAAGnC;EAAS,SAASD,EAAU;EAAS,YAAYA,EAAU;CAAW;AACpF;;AClBA,SAAgB,cACd,GACA,IAA0B,CAAC,GACL;CACtB,IAAMW,IAAa,wBAAwBG,CAAO,GAC5CuB,IAAU,cAAc,GACxB3B,IAAiC,EAAE,GAAGC,EAAW,OAAO,GACxD2B,oBAAY,IAAI,IAAuC,GACvDC,IAA+B,CAAC,GAChCC,IAAa,IAAI,gBAAgB,GACnCC,IAAmC,MACnCC,IAAW,IACXC,IAAc,IACdC,IAAa,GACb3B,IAAqD,MACrD4B,IAAkF;CAEtF,SAAS,mBAAoC;EAC3C,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,SAAS,oBAA0B;EACjC,AAAI5B,MAAiB,SAErB,aAAaA,CAAY,GACzB,IAAe;CACjB;CAEA,SAAS,yBAA+B;EAItC,AAHA,kBAAkB,GAClB4B,GAAe,QAAQ,GACvB,IAAgB,MAChB,IAAc;CAChB;CAEA,SAAS,UAAU,GAA+B;EAChD,KAAK,IAAMC,KAAYR,GACrB,IAAI;GACF,EAASrC,CAAO;EAClB,QAAQ,CAER;CAEJ;CAEA,SAAS,cAAc,GAA2B;EAChD,IAAI,CAACwC,KAAUM,EAAM,WAAWN,EAAO,eAAe;EAEtD,IAAMzC,IAAY,iBAAiB;EAEnC,IAAK,kBAAkB+C,EAAM,MAAM/C,CAAS,GAE5C,QAAQ+C,EAAM,KAAK,MAAnB;GACE,KAAKnB;IACH,AAAI,OAAOmB,EAAM,KAAK,SAAU,YAC9B,UAAU;KAAE,QAAQA,EAAM,KAAK;KAAQ,OAAOA,EAAM,KAAK;KAAO,MAAMnB;IAAW,CAAC;IAGpF;GACF,KAAKC;IACH,AAAI,OAAOkB,EAAM,KAAK,WAAY,aAChC,UAAU;KACR,SAASA,EAAM,KAAK;KACpB,GAAI,OAAOA,EAAM,KAAK,SAAU,WAAW,EAAE,OAAOA,EAAM,KAAK,MAAM,IAAI,CAAC;KAC1E,MAAMlB;IACR,CAAC,GAKI,GAA6BkB,EAAM,KAAK,QAAxC;IAGP;GACF,KAAKhB;IAGH,AAFA,uBAAuB,GACvB,IAAc,IACd,kBAAkB;IAClB;GACF,KAAKC,GACH,AAAI,OAAOe,EAAM,KAAK,UAAW,YAAY,OAAO,SAASA,EAAM,KAAK,MAAM,KAAKA,EAAM,KAAK,UAAU,KACtG,UAAU;IAAE,QAAQA,EAAM,KAAK;IAAQ,MAAMf;GAAW,CAAC;EAI/D;CACF;CAEA,SAAS,eAAkC;EAUzC,OATIS,MAEJ,IAAS,SAAS,cAAc,QAAQ,GACxCA,EAAO,aAAa,WAAW,eAAe,GAC9CA,EAAO,aAAa,kBAAkB,aAAa,GACnD,EAAO,QAAQ,iBAAiBJ,GAChCW,EAAU,YAAYP,CAAM,GAC5B,OAAO,iBAAiB,WAAW,aAAa,GAEzCA;CACT;CAEA,SAAS,UAAgB;EACvB,AAAIC,MAEJ,IAAW,IACX,uBAAuB,GACvBF,EAAW,MAAM,GAEjB,AAGEC,OAFA,OAAO,oBAAoB,WAAW,aAAa,GACnDA,EAAO,OAAO,GACL,OAGXH,EAAU,MAAM;CAClB;CAEA,SAAS,UAAU,GAAwD;EASzE,OARII,UAGW,CAAC,KAGhBJ,EAAU,IAAIW,CAAO,SAERX,EAAU,OAAOW,CAAO;CACvC;CAEA,SAAS,OAAO,GAA6B;EAC3C,IAAIP,GAGF,OAAO,QAAQ,QAAQ;EAMzB,AAHKf,EAAK,KAAK,GAEf,uBAAuB,GACvB,KAAc;EAEd,IAAMuB,IAAU,aAAa,GACvBlD,IAAY,iBAAiB,GAC7BmD,IAAkB;GAAE,GAAGxC;GAAY,QAAQ,EAAE,GAAGD,EAAO;EAAE;EAG/D,AADA,EAAQ,QAAQ,oBAAoB,OAAOkC,CAAU,GACrD,EAAQ,SAAS,yBAAyBjB,GAAMwB,GAAiBnD,CAAS;EAE1E,IAAMoD,IAAU,IAAI,SAAe,GAAS,MAAW;GACrD,IAAgB;IAAE;IAAQ;GAAQ;EACpC,CAAC;EAeD,OAbA,IAAe,iBAAiB;GAC9B,AAAKP,MAELA,EAAc,OACZ,IAAI,oBACF,oDAAoDlC,EAAW,aAAa,iEAE9E,CACF,GACA,IAAgB,MAChB,IAAe;EACjB,GAAGA,EAAW,YAAY,GAEnByC;CACT;CAEA,SAAS,KAAK,GAAwC;EACpD,GAAQ,eAAe,YAAY,SAAS,iBAAiB,GAAGnD,CAAO,GAAG,GAAG;CAC/E;CAEA,SAAS,oBAA0B;EACjC,AAAK0C,KAAgBF,GAAQ,iBAAiB,OAAO,KAAKF,CAAY,CAAC,CAAC,WAAW,KAEnF,KAAK;GAAE,QAAQ,EAAE,GAAGA,EAAa;GAAG,MAAMN;EAAqB,CAAC;CAClE;CAEA,SAAS,SAAS,GAA8B;EAC9C,AAAIS,MAMJ,OAAO,OAAOH,GAAcc,CAAM,GAE9BV,KAAeF,GAAQ,iBAAiB,OAAO,KAAKY,CAAM,CAAC,CAAC,SAAS,KACvE,KAAK;GAAE,QAAQA;GAAQ,MAAMpB;EAAqB,CAAC;CAEvD;CAEA,SAAS,YAAY,GAAoB;EACvC,AAAIS,KAMCC,KAAgBF,GAAQ,iBAM7B,KAAK;GAAE;GAAM,MAAMX;EAAiB,CAAC;CACvC;CAEA,SAAS,YAAY,GAAY,GAAmB;EAClD,AAAIY,MAYJ,EAAO9B,KAAMC,GAET8B,KAAeF,GAAQ,iBAAe,KAAK;GAAE;GAAK;GAAI,MAAMP;EAAgB,CAAC;CACnF;CAEA,OAAO;EACL,IAAI,iBAAiB;GACnB,OAAOM,EAAW;EACpB;EACA;EACA,IAAI,WAAW;GACb,OAAOE;EACT;EACA;EACA;EACA;EACA;EACA,CAAC,OAAO,WAAW;GACjB,QAAQ;EACV;EACA;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vielzeug/sandbox",
-  "version": "26.11.13",
+  "version": "26.11.15",
   "description": "Sandboxed iframe runtime with typed postMessage state bridge",
   "repository": {
     "type": "git",