@vninvestcharts/widget 0.0.0-stage → 0.2.0

package/dist/dts/widget/i18n/a11y.messages.vi.d.ts

@@ -0,0 +1,3 @@
+import type { WidgetMessages } from "./types";
+/** Xem giải thích tại `a11y.messages.en.ts`. */
+export declare const a11yMessagesVi: WidgetMessages;

package/dist/dts/widget/i18n/capability.messages.en.d.ts

@@ -0,0 +1,7 @@
+import type { WidgetMessages } from "./types";
+/**
+ * Chuỗi cho capability gate / upsell / data-availability.
+ * Tách riêng (W0.4) vì `messages.en.ts` chỉ còn ~48 dòng headroom budget
+ * còn Track A cần ~168 key × 2 ngôn ngữ (PLAN_FRONTEND_PROPLUS_TRACKA §8.2).
+ */
+export declare const capabilityMessagesEn: WidgetMessages;

package/dist/dts/widget/i18n/capability.messages.vi.d.ts

@@ -0,0 +1,3 @@
+import type { WidgetMessages } from "./types";
+/** Bản dịch tiếng Việt — phải khớp 100% key với `capability.messages.en.ts`. */
+export declare const capabilityMessagesVi: WidgetMessages;

package/dist/dts/widget/i18n/dock.messages.en.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const dockMessagesEn: WidgetMessages;

package/dist/dts/widget/i18n/dock.messages.vi.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const dockMessagesVi: WidgetMessages;

package/dist/dts/widget/i18n/messages.en.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const widgetMessagesEn: WidgetMessages;

package/dist/dts/widget/i18n/messages.licensing.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Licensing settings strings, split out from `messages.en.ts` / `messages.vi.ts`.
+ *
+ * Why a separate file: those two sit one line from their budget (en 1552, vi 1550),
+ * so there is no room for new `licensing.*` keys. This is the split CS-6 of
+ * PLAN_CREDENTIAL_SPLIT_O1 calls for; it is pulled forward because the CS-1 refusal
+ * fix could not tell the user that a save was rejected without one more key.
+ *
+ * Parity with messages.en.ts is enforced by the i18n key-count check in CI.
+ */
+export declare const licensingMessagesEn: {
+    readonly "licensing.notSaved": "Key not saved. A license key is still being migrated - reload and try again.";
+    readonly "licensing.degraded.offline": "Cannot reach the server. Showing offline features only.";
+    readonly "licensing.degraded.graceExpired": "Server data is stale. Reconnect to restore live features.";
+    readonly "licensing.degraded.planLimited": "Signed in. Live data works; some features need a higher plan.";
+    readonly "licensing.diag.insecureContext": "License needs HTTPS (or localhost). This page is served over insecure HTTP.";
+    readonly "licensing.diag.subtleUnavailable": "Web Crypto is unavailable here, so licenses cannot be verified.";
+    readonly "licensing.reject.unknown": "Server does not recognize this key. Check for typos or request a new one.";
+    readonly "licensing.reject.status": "Server reports this key is {status}.";
+    readonly "licensing.reject.disabled": "Server reports its service account is disabled.";
+    readonly "licensing.reject.network": "Server refuses this network for the key.";
+    readonly "licensing.licenseTitle": "Offline License Key";
+    readonly "licensing.licenseInputLabel": "Offline license key (vni1.)";
+    readonly "licensing.licensePlaceholder": "Paste vni1. here";
+    readonly "licensing.licenseSaved": "License key saved (offline).";
+    readonly "licensing.licenseCleared": "Offline license key removed.";
+    readonly "licensing.licenseSerial": "Serial";
+    readonly "licensing.patTitle": "Access Token (PAT)";
+};
+export declare const licensingMessagesVi: {
+    readonly "licensing.notSaved": "Chưa lưu được khóa. Còn một khóa license đang được di chuyển — hãy tải lại trang rồi thử lại.";
+    readonly "licensing.degraded.offline": "Không kết nối được server. Chỉ hiển thị tính năng offline.";
+    readonly "licensing.degraded.graceExpired": "Dữ liệu server đã cũ. Hãy kết nối lại để khôi phục tính năng trực tiếp.";
+    readonly "licensing.degraded.planLimited": "Đã đăng nhập. Dữ liệu trực tiếp hoạt động; một số tính năng cần gói cao hơn.";
+    readonly "licensing.diag.insecureContext": "License cần HTTPS (hoặc localhost). Trang này đang chạy qua HTTP không mã hoá.";
+    readonly "licensing.diag.subtleUnavailable": "Web Crypto không khả dụng ở đây, không thể xác thực license.";
+    readonly "licensing.reject.unknown": "Server không nhận key này. Kiểm tra lỗi gõ hoặc xin key mới.";
+    readonly "licensing.reject.status": "Server báo key đang ở {status}.";
+    readonly "licensing.reject.disabled": "Server báo service account bị tắt.";
+    readonly "licensing.reject.network": "Server từ chối mạng này với key.";
+    readonly "licensing.licenseTitle": "License Key offline";
+    readonly "licensing.licenseInputLabel": "License key offline (vni1.…)";
+    readonly "licensing.licensePlaceholder": "Dán vni1.… vào đây";
+    readonly "licensing.licenseSaved": "Đã lưu license key (offline).";
+    readonly "licensing.licenseCleared": "Đã xoá license key offline.";
+    readonly "licensing.licenseSerial": "Mã serial";
+    readonly "licensing.patTitle": "Access Token (PAT)";
+};

package/dist/dts/widget/i18n/messages.vi.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const widgetMessagesVi: WidgetMessages;

package/dist/dts/widget/i18n/trading.messages.en.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const tradingMessagesEn: WidgetMessages;

package/dist/dts/widget/i18n/trading.messages.vi.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetMessages } from "./types";
+export declare const tradingMessagesVi: WidgetMessages;

package/dist/dts/widget/i18n/types.d.ts

@@ -0,0 +1,3 @@
+export type WidgetLocale = "vi" | "en";
+/** Flat key→value map of UI strings used by the widget layer. */
+export type WidgetMessages = Record<string, string>;

package/dist/dts/widget/iframe/builtInAdapters.d.ts

@@ -0,0 +1,63 @@
+/**
+ * WP-11: Built-in Adapter Classes for Iframe Mode
+ *
+ * These adapter classes can be instantiated from JSON-serializable config
+ * and are used in the iframe-hosted widget where custom callbacks
+ * cannot be passed via postMessage.
+ */
+import type { StockDataAdapter, Unsubscribe, Timeframe, Trade, OrderbookSnapshot, SymbolInfo } from "../../lib/types/adapter";
+import type { OHLCVBar } from "../../lib/types/ohlcv";
+import type { CoverageFragment, SourceSemanticsDescriptor } from "@vninvestcharts/engine-core";
+import { type WidgetAuthHandler } from "../adapters/VNInvestClient";
+/**
+ * Base class for built-in adapters
+ */
+export declare abstract class BuiltInAdapter implements StockDataAdapter {
+    abstract readonly name: string;
+    abstract readonly type: string;
+    abstract fetchBarsInRange(symbol: string, timeframe: Timeframe, from: Date, to: Date): Promise<readonly OHLCVBar[]>;
+    abstract fetchBarsBefore(symbol: string, timeframe: Timeframe, before: Date, limit?: number): Promise<readonly OHLCVBar[]>;
+    abstract subscribeToBar(symbol: string, timeframe: Timeframe, onBar: (bar: OHLCVBar) => void): Unsubscribe;
+    subscribeToTrades(_symbol: string, _onTrade: (trade: Trade) => void): Unsubscribe;
+    subscribeToOrderbook(_symbol: string, _onUpdate: (snapshot: OrderbookSnapshot) => void): Unsubscribe;
+    abstract searchSymbols(query: string): Promise<readonly SymbolInfo[]>;
+    abstract destroy(): void;
+    getSourceSemantics(): SourceSemanticsDescriptor;
+    getLastBackfillCoverage(): readonly CoverageFragment[] | null;
+    getLastRangeCoverage(): readonly CoverageFragment[] | null;
+}
+/**
+ * VNInvest Built-in Adapter
+ */
+export declare class VNInvestBuiltInAdapter extends BuiltInAdapter {
+    readonly name = "vninvest";
+    readonly type = "vninvest";
+    private client;
+    private wsClient;
+    private readonly barSubscribers;
+    private readonly snapshotIds;
+    private readonly lastBackfillCoverageMap;
+    private readonly lastRangeCoverageMap;
+    constructor(config: {
+        patToken: string;
+        apiBase?: string;
+    });
+    setAuthHandler(handler: WidgetAuthHandler): void;
+    private coverageKey;
+    getLastBackfillCoverage(symbol?: string, timeframe?: Timeframe, chartId?: string): readonly CoverageFragment[] | null;
+    getLastRangeCoverage(symbol?: string, timeframe?: Timeframe, chartId?: string): readonly CoverageFragment[] | null;
+    fetchBarsInRange(symbol: string, timeframe: Timeframe, from: Date, to: Date, chartId?: string): Promise<readonly OHLCVBar[]>;
+    fetchBarsBefore(symbol: string, timeframe: Timeframe, before: Date, limit?: number, chartId?: string): Promise<readonly OHLCVBar[]>;
+    subscribeToBar(symbol: string, timeframe: Timeframe, onBar: (bar: OHLCVBar) => void): Unsubscribe;
+    searchSymbols(query: string): Promise<readonly SymbolInfo[]>;
+    destroy(): void;
+    private handleTickerUpdate;
+}
+/**
+ * Factory function to create built-in adapter from config
+ */
+export declare function createBuiltInAdapter(config: {
+    type: string;
+    options?: Record<string, string | number | boolean | null>;
+    token?: string;
+}): BuiltInAdapter | null;

package/dist/dts/widget/iframe/host-entry.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Host-only entry point for iframe embedding.
+ *
+ * This module intentionally excludes React and the iframe runtime bundle.
+ * Website hosts import the postMessage Host SDK from `vninvestcharts-widget/iframe-host`.
+ */
+export { VNInvestChartsHostSDK, createVNInvestChartsHost, EmbedError } from "./hostSDK";
+export { IframeBridge, createHostBridge, DEFAULT_ALLOWED_ORIGINS } from "./iframeBridge";
+export type { HostSDKConfig, WidgetController } from "./hostSDK";
+export type { AllowedOriginsConfig, BridgeConfig } from "./iframeBridge";
+export type { AdapterConfig, HostToIframeCommand, IframeToHostEvent, ResponsePayload, WidgetConfig, } from "./messageProtocol";

package/dist/dts/widget/iframe/hostSDK.d.ts

@@ -0,0 +1,151 @@
+/**
+ * WP-11: Host SDK - Type-safe API for embedding VNInvestCharts in an iframe
+ *
+ * Provides a clean Promise-based API for controlling the widget from the parent page.
+ * Handles connection lifecycle, origin validation, and automatic reconnection.
+ */
+import { type IframeToHostEvent, type WidgetConfig } from "./iframeBridge";
+/** Host SDK configuration */
+export interface HostSDKConfig {
+    /** Iframe element or selector */
+    iframe: HTMLIFrameElement | string;
+    /** Allowed origins for postMessage security */
+    allowedOrigins?: string[];
+    /** Connection timeout in ms */
+    connectionTimeout?: number;
+    /** Request timeout in ms */
+    requestTimeout?: number;
+    /** Callback when widget is ready */
+    onReady?: (info: {
+        version: string;
+        capabilities: string[];
+    }) => void;
+    /** Callback on widget events */
+    onEvent?: (event: IframeToHostEvent) => void;
+    /** Callback on connection error */
+    onError?: (error: Error) => void;
+    /** Callback when connection is lost */
+    onDisconnect?: () => void;
+}
+/** Widget control API returned by HostSDK */
+export interface WidgetController {
+    /** Initialize widget with configuration */
+    initialize(config: WidgetConfig): Promise<{
+        widgetId: string;
+    }>;
+    /** Change symbol */
+    setSymbol(symbol: string): Promise<void>;
+    /** Change timeframe */
+    setTimeframe(timeframe: string): Promise<void>;
+    /** Change visible range */
+    setRange(range: string): Promise<void>;
+    /** Change theme */
+    setTheme(theme: "light" | "dark"): Promise<void>;
+    /** Replace all drawings */
+    setDrawings(drawings: readonly any[]): Promise<void>;
+    /** Add a drawing */
+    addDrawing(drawing: any): Promise<void>;
+    /** Remove a drawing by ID */
+    removeDrawing(drawingId: string): Promise<void>;
+    /** Update a drawing */
+    updateDrawing(drawingId: string, updates: Partial<any>): Promise<void>;
+    /** Set active drawing tool */
+    setActiveTool(tool: string): Promise<void>;
+    /** E3: switch the right-dock tab */
+    setDockTab(tab: string): Promise<void>;
+    /** E3: replace the dock watchlist (static symbols) */
+    setWatchlist(symbols: string[]): Promise<void>;
+    /** Export current drawings */
+    exportDrawings(): Promise<readonly any[]>;
+    /** Get current visible range */
+    getVisibleRange(): Promise<{
+        startIndex: number;
+        endIndex: number;
+        startDate: string;
+        endDate: string;
+        barCount: number;
+    } | null>;
+    /** Get current pane snapshots */
+    getPaneSnapshots(): Promise<readonly any[]>;
+    /** Capture snapshot as image */
+    captureSnapshot(format?: "png" | "jpeg", quality?: number): Promise<string>;
+    /** Toggle fullscreen */
+    toggleFullscreen(): Promise<void>;
+    /** Set locale */
+    setLocale(locale: string): Promise<void>;
+    /** Set timezone */
+    setTimezone(timezone: string): Promise<void>;
+    /** Destroy widget and cleanup */
+    destroy(): Promise<void>;
+    /** E5: subscribe to live quote fan-out (batch ≥250ms); returns unsubscribe */
+    subscribeQuotes(symbols: string[], onQuotes: (updates: Array<{
+        symbol: string;
+        price?: number;
+        change?: number;
+        changePercent?: number;
+    }>) => void): Promise<() => Promise<void>>;
+    /** Check if widget is ready */
+    isReady(): boolean;
+    /** Get widget version */
+    getVersion(): string | null;
+}
+/** E4: typed embed error — `{code, recoverable, detail}` for the host matrix. */
+export declare class EmbedError extends Error {
+    readonly code: string;
+    readonly recoverable: boolean;
+    readonly detail?: string;
+    constructor(code: string, message: string, recoverable?: boolean, detail?: string);
+}
+/**
+ * Host SDK for controlling VNInvestCharts widget in an iframe
+ */
+export declare class VNInvestChartsHostSDK {
+    private config;
+    private iframe;
+    private bridge;
+    private isReady;
+    private version;
+    private capabilities;
+    private readyPromise;
+    private readyResolve;
+    private eventListeners;
+    constructor(config: HostSDKConfig);
+    /**
+     * Connect to the iframe widget
+     */
+    connect(): Promise<void>;
+    /**
+     * Wait for iframe to finish loading
+     */
+    private waitForIframeLoad;
+    /**
+     * Handle ready signal from iframe
+     */
+    private handleReady;
+    /**
+     * Handle incoming events from iframe
+     */
+    private handleEvent;
+    /**
+     * Get the widget controller API
+     */
+    getController(): WidgetController;
+    /**
+     * Subscribe to specific event types
+     */
+    on<K extends IframeToHostEvent["type"]>(eventType: K, listener: (payload: Extract<IframeToHostEvent, {
+        type: K;
+    }>["payload"]) => void): () => void;
+    /**
+     * Disconnect and cleanup
+     */
+    disconnect(): void;
+    /**
+     * Check if connected and ready
+     */
+    get connected(): boolean;
+}
+/**
+ * Convenience function to create and connect Host SDK in one call
+ */
+export declare function createVNInvestChartsHost(config: HostSDKConfig): Promise<VNInvestChartsHostSDK>;

package/dist/dts/widget/iframe/iframeBridge.d.ts

@@ -0,0 +1,165 @@
+/**
+ * WP-11: Iframe Bridge - Host ↔ Iframe Communication Layer
+ *
+ * Handles postMessage communication with:
+ * - Origin validation against allowlist
+ * - Request/response correlation
+ * - Event emission
+ * - Automatic cleanup
+ */
+import { HostToIframeCommand, IframeToHostEvent, RequestMessage, ResponsePayload } from "./messageProtocol";
+export type { HostToIframeCommand, IframeToHostEvent, RequestMessage, ResponseMessage, EventMessage, WidgetConfig, AdapterConfig, ResponsePayload, } from "./messageProtocol";
+export { generateCorrelationId, createRequest, createResponse, createEvent, isHostToIframeCommand, isIframeToHostEvent } from "./messageProtocol";
+/** Allowed origins for postMessage security */
+export interface AllowedOriginsConfig {
+    /** List of allowed origins (exact match or wildcard patterns) */
+    allowedOrigins: string[];
+    /** Whether to allow any origin (DANGEROUS - only for development) */
+    allowAnyOrigin?: boolean;
+}
+/**
+ * Default allowed origins — override per deployment.
+ * SECURITY: Remove `http://localhost` entries in production.
+ */
+export declare const DEFAULT_ALLOWED_ORIGINS: string[];
+/**
+ * SEC-01: origin allowlist matcher.
+ *
+ * Deliberately regex-free. A wildcard is only honoured as a leading subdomain
+ * marker (`scheme://*.<rest>`), and the remainder is compared with plain string
+ * equality. Compiling the pattern into a RegExp (the previous behaviour) let
+ * every `.` act as "any character", so an allowlist entry for
+ * `https:` + wildcard + `vninvestcharts.com` also accepted unrelated hosts.
+ */
+export declare function matchOriginPattern(pattern: string, origin: string): boolean;
+/** Message handler type */
+export type MessageHandler = (message: IframeToHostEvent) => void;
+/** Request handler type (for Iframe side) */
+export type RequestHandler = (command: HostToIframeCommand) => Promise<ResponsePayload>;
+/** Bridge configuration */
+export interface BridgeConfig {
+    /** Target window (iframe.contentWindow or window.parent) */
+    targetWindow: Window;
+    /** Target origin for sending messages */
+    targetOrigin: string;
+    /** Allowed origins for receiving messages */
+    allowedOrigins: string[];
+    /** Whether we are the Host (true) or Iframe (false) */
+    isHost: boolean;
+    /** Request timeout in ms */
+    requestTimeout?: number;
+    /** Callback when connection is established */
+    onReady?: () => void;
+    /** Callback on connection error */
+    onError?: (error: Error) => void;
+    /** Whether to allow any origin (DANGEROUS - only for development) */
+    allowAnyOrigin?: boolean;
+    /**
+     * SEC-01: maximum serialized size of an accepted inbound message.
+     * Oversized payloads are rejected before parsing or state mutation.
+     */
+    maxPayloadBytes?: number;
+    /**
+     * SEC-01: inbound message budget. Once more than `maxMessages` are accepted
+     * within `rateWindowMs`, further traffic is dropped until the window rolls.
+     */
+    maxMessages?: number;
+    rateWindowMs?: number;
+}
+/**
+ * Iframe Bridge - bidirectional postMessage communication
+ */
+export declare class IframeBridge {
+    private config;
+    private pendingRequests;
+    private messageHandler;
+    private requestHandler;
+    private boundHandleMessage;
+    private isDestroyed;
+    private readyPromise;
+    private readyResolve;
+    /**
+     * Origin pinned from the first origin-allowlisted incoming message
+     * (iframe side). All outbound sends use it instead of the "*" fallback,
+     * so widget data is never broadcast to arbitrary windows once the host
+     * is known. Re-pinned on every validated message (allows host moves).
+     */
+    private pinnedSendOrigin;
+    /** SEC-01: sliding-window counters for the inbound rate limit. */
+    private rateWindowStart;
+    private rateCount;
+    constructor(config: BridgeConfig);
+    /**
+     * Set handler for incoming events (Host side)
+     */
+    setMessageHandler(handler: MessageHandler): void;
+    /**
+     * Set handler for incoming requests (Iframe side)
+     */
+    setRequestHandler(handler: RequestHandler): void;
+    /**
+     * Resolve the target origin for outbound sends. Prefers the pinned
+     * validated origin; falls back to the configured targetOrigin ("*" only
+     * until the first allowlisted message arrives on the iframe side).
+     */
+    private resolveSendOrigin;
+    /**
+     * Send a command to the other side
+     */
+    sendCommand<T extends HostToIframeCommand>(command: T, timeoutMs?: number): Promise<ResponsePayload>;
+    /**
+     * Send an event (fire-and-forget)
+     */
+    sendEvent(event: IframeToHostEvent): void;
+    /**
+     * Send a response to a request
+     */
+    sendResponse(request: RequestMessage, payload: ResponsePayload, success?: boolean, error?: string): void;
+    /**
+     * Wait for the bridge to be ready (Iframe side)
+     */
+    waitForReady(): Promise<void>;
+    /**
+     * Signal that Iframe is ready (Iframe side)
+     */
+    signalReady(version: string, capabilities: string[]): void;
+    /**
+     * Validate message origin against allowlist.
+     *
+     * SEC-01: wildcard patterns are matched as PLAIN STRINGS, never compiled into
+     * a RegExp. The previous implementation replaced every `*` with `.*` and then
+     * ran `new RegExp`, which left every `.` unescaped, so a pattern like
+     * `https:` + wildcard-subdomain + `vninvestcharts.com` also matched origins
+     * such as `https://evilvninvestchartsXcom`. Only a leading subdomain
+     * wildcard is supported and it must sit on a scheme boundary.
+     */
+    private isOriginAllowed;
+    /** SEC-01: counters for rejected traffic — surfaced for tests/monitoring. */
+    readonly stats: {
+        rejectedOrigin: number;
+        rejectedSize: number;
+        rejectedRate: number;
+        accepted: number;
+    };
+    /**
+     * SEC-01: size + rate gate, applied after the origin is trusted so that
+     * hostile origins are not charged against the budget.
+     */
+    private passesTrafficBudget;
+    /**
+     * Handle incoming postMessage
+     */
+    private handleMessage;
+    /**
+     * Destroy the bridge and cleanup
+     */
+    destroy(): void;
+}
+/**
+ * Create Host-side bridge (parent page embedding iframe)
+ */
+export declare function createHostBridge(iframe: HTMLIFrameElement, allowedOrigins?: string[], options?: Partial<BridgeConfig>): IframeBridge;
+/**
+ * Create Iframe-side bridge (widget inside iframe)
+ */
+export declare function createIframeBridge(allowedOrigins?: string[], options?: Partial<BridgeConfig>): IframeBridge;

package/dist/dts/widget/iframe/iframeEntry.d.ts

@@ -0,0 +1,52 @@
+/**
+ * WP-11: Iframe Entry Point - Widget running inside iframe
+ *
+ * This is the standalone entry point for the iframe-hosted widget.
+ * It initializes the bridge, listens for commands from Host, and renders the widget.
+ */
+import { type VNInvestChartsProps } from "../VNInvestCharts";
+import { type RequestHandler, type WidgetConfig } from "./iframeBridge";
+import type { WatchlistAdapter } from "../types/watchlist";
+export declare const requestHandler: RequestHandler;
+/**
+ * E3: static in-iframe watchlist adapter from plain symbols (JSON-safe).
+ * No streaming here — live quotes arrive via E5 subscribeQuotes.
+ */
+export declare function buildStaticWatchlistAdapter(symbols: readonly string[] | undefined): WatchlistAdapter | undefined;
+/**
+ * Build widget props from host config (exported for tests).
+ */
+export declare function buildWidgetProps(config: WidgetConfig): VNInvestChartsProps;
+/**
+ * Convert an engine snapshot (canvas or bitmap) to a data URL.
+ * Returns null when capture is unavailable. Exported for tests.
+ */
+export declare function captureWidgetSnapshot(capture: () => Promise<ImageBitmap | HTMLCanvasElement | null | undefined> | ImageBitmap | HTMLCanvasElement | null | undefined, format?: "png" | "jpeg", quality?: number): Promise<string | null>;
+/**
+ * Reset module state for tests only. Not part of the runtime contract.
+ */
+export declare function __resetIframeEntryForTests(): void;
+/**
+ * Attach a fake widget handle for tests only (the real handle attaches via
+ * React ref when the mocked root renders). Not part of the runtime contract.
+ */
+export declare function __setWidgetRefForTests(handle: unknown): void;
+export declare function __getIframeEntryStateForTests(): {
+    isInitialized: boolean;
+    hasRoot: boolean;
+    props: VNInvestChartsProps | null;
+};
+/**
+ * E0: resolve the parent-origin allowlist. Query params (set by whoever
+ * serves iframe.html) extend the compiled default whitelist:
+ * - `?parentOrigin=https://doi-tac.vn` (repeatable) or
+ *   `?allowedOrigins=https://a.vn,https://b.vn`
+ * - `?allowAnyOrigin=1` works ONLY with the debug gate (`?vnsc_debug=1` or
+ *   localStorage) — never in a plain prod load. `file://` parents (origin
+ *   "null") must be listed explicitly to pass.
+ */
+export declare function resolveAllowedOrigins(search?: string): {
+    allowedOrigins: string[];
+    allowAnyOrigin: boolean;
+};
+export declare function isIframeDebugEnabled(): boolean;

package/dist/dts/widget/iframe/iframeFrame.d.ts

@@ -0,0 +1,15 @@
+import type { IframeBridge } from "./iframeBridge";
+import { type WidgetConfig } from "./messageProtocol";
+/**
+ * E1 (split from iframeEntry): frame sizing controller.
+ * Fill mode (default) = 100%/100%, host owns the frame, zero resize
+ * messages. Card mode (numeric height) pins the height and reports guarded
+ * `event:resized` for bottom-panel expansion only.
+ */
+export interface FrameResizeReporter {
+    onResize?: (height: number) => void;
+}
+export declare function createFrameController(container: HTMLElement, getBridge: () => IframeBridge | null): {
+    applyFrameHeight: (config: WidgetConfig) => void;
+    stopFrameResizeReporter: () => void;
+};

package/dist/dts/widget/iframe/iframeQuotes.d.ts

@@ -0,0 +1,20 @@
+import type { Timeframe } from "../../lib/types/adapter";
+import type { OHLCVBar } from "../../lib/types/ohlcv";
+import type { WatchlistAdapter, WatchlistQuoteUpdate } from "../types/watchlist";
+import { type QuoteHub } from "./quoteHub";
+/** Minimal structural surface needed for bar→quotes (avoids adapter-type coupling). */
+export interface BarStreamSource {
+    subscribeToBar: (symbol: string, timeframe: Timeframe, onBar: (bar: OHLCVBar) => void) => () => void;
+}
+/**
+ * E5 (split from iframeEntry): quote-hub wiring.
+ * Source priority: explicit watchlist adapter with subscribeQuotes, else
+ * last-price quotes derived from the bar adapter's live WS.
+ */
+export declare function createQuotesController(emit: (updates: WatchlistQuoteUpdate[]) => void): {
+    setWatchlistAdapter: (adapter: WatchlistAdapter | null) => void;
+    setBarAdapter: (adapter: BarStreamSource | null, timeframe: Timeframe | undefined) => void;
+    getHub: () => QuoteHub;
+    reset: () => void;
+};
+export type QuotesController = ReturnType<typeof createQuotesController>;