forgeframe 0.0.1 → 0.0.3

package/dist/forgeframe.js

@@ -33,7 +33,7 @@ const p = {
   BASE64: "base64",
   /** Dot notation for nested objects (e.g., "a.b.c=value") */
   DOTIFY: "dotify"
-}, D = {
+}, T = {
   /** Request message expecting a response */
   REQUEST: "request",
   /** Response to a previous request */
@@ -63,8 +63,14 @@ const p = {
   CONSUMER_EXPORT: "forgeframe_consumer_export",
   /** Get sibling components request */
   GET_SIBLINGS: "forgeframe_get_siblings"
-}, N = "__forgeframe__", pe = "0.0.1";
-class me {
+}, F = "__forgeframe__", ye = (() => {
+  if ("0.0.3".trim().length === 0)
+    throw new Error(
+      "ForgeFrame VERSION injection is missing. Configure __FORGEFRAME_VERSION__ in build/test tooling."
+    );
+  return "0.0.3";
+})();
+class we {
   /**
    * Internal storage for event listeners mapped by event name.
    * @internal
@@ -87,8 +93,8 @@ class me {
    *
    * @public
    */
-  on(e, s) {
-    return this.listeners.has(e) || this.listeners.set(e, /* @__PURE__ */ new Set()), this.listeners.get(e).add(s), () => this.off(e, s);
+  on(e, t) {
+    return this.listeners.has(e) || this.listeners.set(e, /* @__PURE__ */ new Set()), this.listeners.get(e).add(t), () => this.off(e, t);
   }
   /**
    * Subscribes a handler to an event that will automatically unsubscribe after the first invocation.
@@ -111,8 +117,8 @@ class me {
    *
    * @public
    */
-  once(e, s) {
-    const n = (i) => (this.off(e, n), s(i));
+  once(e, t) {
+    const n = (i) => (this.off(e, n), t(i));
     return this.on(e, n);
   }
   /**
@@ -134,12 +140,12 @@ class me {
    *
    * @public
    */
-  emit(e, s) {
+  emit(e, t) {
     const n = this.listeners.get(e);
     if (n)
       for (const i of n)
         try {
-          const r = i(s);
+          const r = i(t);
           r && typeof r == "object" && "catch" in r && typeof r.catch == "function" && r.catch((o) => {
             console.error(`Error in async event handler for "${e}":`, o);
           });
@@ -168,13 +174,13 @@ class me {
    *
    * @public
    */
-  off(e, s) {
-    if (!s) {
+  off(e, t) {
+    if (!t) {
       this.listeners.delete(e);
       return;
     }
     const n = this.listeners.get(e);
-    n && (n.delete(s), n.size === 0 && this.listeners.delete(e));
+    n && (n.delete(t), n.size === 0 && this.listeners.delete(e));
   }
   /**
    * Removes all event listeners from the emitter.
@@ -215,14 +221,14 @@ class me {
     return this.listeners.get(e)?.size ?? 0;
   }
 }
-function Ie() {
-  const t = Date.now().toString(36), e = Math.random().toString(36).slice(2, 11);
-  return `${t}_${e}`;
+function Fe() {
+  const s = Date.now().toString(36), e = Math.random().toString(36).slice(2, 11);
+  return `${s}_${e}`;
 }
-function W() {
+function z() {
   return Math.random().toString(36).slice(2, 11);
 }
-class De {
+class Ne {
   /**
    * Array of registered cleanup tasks awaiting execution.
    * @internal
@@ -260,8 +266,8 @@ class De {
     if (this.cleaned) {
       try {
         e();
-      } catch (s) {
-        console.error("Error in cleanup task:", s);
+      } catch (t) {
+        console.error("Error in cleanup task:", t);
       }
       return;
     }
@@ -293,9 +299,9 @@ class De {
     this.cleaned = !0;
     const e = this.tasks.reverse();
     this.tasks = [];
-    for (const s of e)
+    for (const t of e)
       try {
-        await s();
+        await t();
       } catch (n) {
         console.error("Error in cleanup task:", n);
       }
@@ -340,60 +346,60 @@ class De {
     this.tasks = [], this.cleaned = !1;
   }
 }
-function ge() {
-  let t, e;
+function _e() {
+  let s, e;
   return { promise: new Promise((n, i) => {
-    t = n, e = i;
-  }), resolve: t, reject: e };
+    s = n, e = i;
+  }), resolve: s, reject: e };
 }
-function Ne(t, e, s = "Operation timed out") {
+function ke(s, e, t = "Operation timed out") {
   return new Promise((n, i) => {
     const r = setTimeout(() => {
-      i(new Error(`${s} (${e}ms)`));
+      i(new Error(`${t} (${e}ms)`));
     }, e);
-    t.then((o) => {
+    s.then((o) => {
       clearTimeout(r), n(o);
     }).catch((o) => {
       clearTimeout(r), i(o);
     });
   });
 }
-const z = "forgeframe:";
-function A(t) {
-  return z + JSON.stringify(t);
+const j = "forgeframe:";
+function M(s) {
+  return j + JSON.stringify(s);
 }
-function Te(t) {
-  if (typeof t != "string" || !t.startsWith(z)) return null;
+function $e(s) {
+  if (typeof s != "string" || !s.startsWith(j)) return null;
   try {
-    const e = t.slice(z.length), s = JSON.parse(e);
-    return !s.id || !s.type || !s.name || !s.source ? null : s;
+    const e = s.slice(j.length), t = JSON.parse(e);
+    return !t.id || !t.type || !t.name || !t.source ? null : t;
   } catch {
     return null;
   }
 }
-function re(t, e, s, n) {
+function ce(s, e, t, n) {
   return {
-    id: t,
-    type: D.REQUEST,
+    id: s,
+    type: T.REQUEST,
     name: e,
-    data: s,
+    data: t,
     source: n
   };
 }
-function ke(t, e, s, n) {
+function Le(s, e, t, n) {
   return {
-    id: t,
-    type: D.RESPONSE,
+    id: s,
+    type: T.RESPONSE,
     name: "response",
     data: e,
-    source: s,
+    source: t,
     error: n ? {
       message: n.message,
       stack: n.stack
     } : void 0
   };
 }
-class ye {
+class Ee {
   /**
    * Creates a new Messenger instance.
    *
@@ -402,8 +408,8 @@ class ye {
    * @param domain - The origin domain of this messenger
    * @param trustedDomains - Optional domains to trust for incoming messages
    */
-  constructor(e, s = window, n = window.location.origin, i) {
-    this.uid = e, this.win = s, this.domain = n, this.allowedOrigins.add(n), i && this.addTrustedDomain(i), this.setupListener();
+  constructor(e, t = window, n = window.location.origin, i) {
+    this.uid = e, this.win = t, this.domain = n, this.allowedOrigins.add(n), i && this.addTrustedDomain(i), this.setupListener();
   }
   /** @internal */
   pending = /* @__PURE__ */ new Map();
@@ -424,10 +430,21 @@ class ye {
    */
   addTrustedDomain(e) {
     if (Array.isArray(e))
-      for (const s of e)
-        this.allowedOrigins.add(s);
+      for (const t of e)
+        this.allowedOrigins.add(t);
     else e instanceof RegExp ? this.allowedOriginPatterns.push(e) : this.allowedOrigins.add(e);
   }
+  /**
+   * Removes a trusted domain from this messenger.
+   *
+   * @param domain - Domain pattern to remove (string, RegExp, or array)
+   */
+  removeTrustedDomain(e) {
+    if (Array.isArray(e))
+      for (const t of e)
+        this.allowedOrigins.delete(t);
+    else e instanceof RegExp ? this.allowedOriginPatterns = this.allowedOriginPatterns.filter((t) => t !== e) : this.allowedOrigins.delete(e);
+  }
   /**
    * Checks if an origin is trusted.
    *
@@ -438,8 +455,8 @@ class ye {
   isOriginTrusted(e) {
     if (this.allowedOrigins.has(e))
       return !0;
-    for (const s of this.allowedOriginPatterns)
-      if (s.test(e))
+    for (const t of this.allowedOriginPatterns)
+      if (t.test(e))
         return !0;
     return !1;
   }
@@ -456,13 +473,13 @@ class ye {
    * @returns Promise resolving to the response data
    * @throws Error if messenger is destroyed or timeout occurs
    */
-  async send(e, s, n, i, r = 1e4) {
+  async send(e, t, n, i, r = 1e4) {
     if (this.destroyed)
       throw new Error("Messenger has been destroyed");
-    const o = W(), a = re(o, n, i, {
+    const o = z(), a = ce(o, n, i, {
       uid: this.uid,
       domain: this.domain
-    }), c = ge(), l = setTimeout(() => {
+    }), c = _e(), l = setTimeout(() => {
       this.pending.delete(o), c.reject(new Error(`Message "${n}" timed out after ${r}ms`));
     }, r);
     this.pending.set(o, {
@@ -470,7 +487,7 @@ class ye {
       timeout: l
     });
     try {
-      e.postMessage(A(a), s);
+      e.postMessage(M(a), t);
     } catch (h) {
       throw this.pending.delete(o), clearTimeout(l), h;
     }
@@ -486,14 +503,14 @@ class ye {
    * @param data - Optional data payload
    * @throws Error if messenger is destroyed
    */
-  post(e, s, n, i) {
+  post(e, t, n, i) {
     if (this.destroyed)
       throw new Error("Messenger has been destroyed");
-    const r = W(), o = re(r, n, i, {
+    const r = z(), o = ce(r, n, i, {
       uid: this.uid,
       domain: this.domain
     });
-    e.postMessage(A(o), s);
+    e.postMessage(M(o), t);
   }
   /**
    * Registers a handler for incoming messages of a specific type.
@@ -504,8 +521,8 @@ class ye {
    * @param handler - The handler function
    * @returns Function to unregister the handler
    */
-  on(e, s) {
-    return this.handlers.set(e, s), () => this.handlers.delete(e);
+  on(e, t) {
+    return this.handlers.set(e, t), () => this.handlers.delete(e);
   }
   /**
    * Sets up the postMessage event listener.
@@ -515,16 +532,16 @@ class ye {
     this.listener = (e) => {
       if (e.source === this.win || !this.isOriginTrusted(e.origin))
         return;
-      const s = Te(e.data);
-      s && this.handleMessage(s, e.source, e.origin);
+      const t = $e(e.data);
+      t && this.handleMessage(t, e.source, e.origin);
     }, this.win.addEventListener("message", this.listener);
   }
   /**
    * Processes a received message.
    * @internal
    */
-  async handleMessage(e, s, n) {
-    if (e.type === D.RESPONSE) {
+  async handleMessage(e, t, n) {
+    if (e.type === T.RESPONSE) {
       const i = this.pending.get(e.id);
       if (i)
         if (this.pending.delete(e.id), clearTimeout(i.timeout), e.error) {
@@ -534,7 +551,7 @@ class ye {
           i.deferred.resolve(e.data);
       return;
     }
-    if (e.type === D.REQUEST) {
+    if (e.type === T.REQUEST) {
       const i = this.handlers.get(e.name);
       if (!i)
         return;
@@ -544,14 +561,14 @@ class ye {
       } catch (c) {
         o = c instanceof Error ? c : new Error(String(c));
       }
-      const a = ke(
+      const a = Le(
         e.id,
         r,
         { uid: this.uid, domain: this.domain },
         o
       );
       try {
-        s.postMessage(A(a), n);
+        t.postMessage(M(a), n);
       } catch {
       }
     }
@@ -580,8 +597,8 @@ class ye {
     return this.destroyed;
   }
 }
-const oe = 500;
-class B {
+const le = 500;
+class J {
   /**
    * Creates a new FunctionBridge instance.
    *
@@ -607,16 +624,16 @@ class B {
    * @param name - Optional name for debugging
    * @returns A function reference that can be sent across domains
    */
-  serialize(e, s) {
-    if (this.localFunctions.size >= oe) {
+  serialize(e, t) {
+    if (this.localFunctions.size >= le) {
       const i = this.localFunctions.keys().next().value;
       i && this.localFunctions.delete(i);
     }
-    const n = W();
+    const n = z();
     return this.localFunctions.set(n, e), this.currentBatchIds.add(n), {
       __type__: "function",
       __id__: n,
-      __name__: s || e.name || "anonymous"
+      __name__: t || e.name || "anonymous"
     };
   }
   /**
@@ -631,14 +648,14 @@ class B {
    * @param targetDomain - The origin of the target window
    * @returns A callable wrapper function
    */
-  deserialize(e, s, n) {
+  deserialize(e, t, n) {
     const i = `${e.__id__}`, r = this.remoteFunctions.get(i);
     if (r) return r;
-    if (this.remoteFunctions.size >= oe) {
+    if (this.remoteFunctions.size >= le) {
       const a = this.remoteFunctions.keys().next().value;
       a && this.remoteFunctions.delete(a);
     }
-    const o = async (...a) => this.messenger.send(s, n, u.CALL, {
+    const o = async (...a) => this.messenger.send(t, n, u.CALL, {
       id: e.__id__,
       args: a
     });
@@ -663,11 +680,11 @@ class B {
   setupCallHandler() {
     this.messenger.on(
       u.CALL,
-      async ({ id: e, args: s }) => {
+      async ({ id: e, args: t }) => {
         const n = this.localFunctions.get(e);
         if (!n)
           throw new Error(`Function with id "${e}" not found`);
-        return n(...s);
+        return n(...t);
       }
     );
   }
@@ -710,8 +727,8 @@ class B {
       this.currentBatchIds.clear();
       return;
     }
-    for (const s of this.localFunctions.keys())
-      this.currentBatchIds.has(s) || this.localFunctions.delete(s);
+    for (const t of this.localFunctions.keys())
+      this.currentBatchIds.has(t) || this.localFunctions.delete(t);
     this.currentBatchIds.clear();
   }
   /**
@@ -745,175 +762,175 @@ class B {
     this.localFunctions.clear(), this.remoteFunctions.clear(), this.currentBatchIds.clear();
   }
 }
-function M(t, e, s = /* @__PURE__ */ new WeakSet()) {
-  if (typeof t == "function")
-    return e.serialize(t);
-  if (Array.isArray(t)) {
-    if (s.has(t))
+function B(s, e, t = /* @__PURE__ */ new WeakSet()) {
+  if (typeof s == "function")
+    return e.serialize(s);
+  if (Array.isArray(s)) {
+    if (t.has(s))
       throw new Error("Circular reference detected in props - arrays cannot contain circular references");
-    return s.add(t), t.map((n) => M(n, e, s));
+    return t.add(s), s.map((n) => B(n, e, t));
   }
-  if (typeof t == "object" && t !== null) {
-    if (s.has(t))
+  if (typeof s == "object" && s !== null) {
+    if (t.has(s))
       throw new Error("Circular reference detected in props - objects cannot contain circular references");
-    s.add(t);
+    t.add(s);
     const n = {};
-    for (const [i, r] of Object.entries(t))
-      n[i] = M(r, e, s);
+    for (const [i, r] of Object.entries(s))
+      n[i] = B(r, e, t);
     return n;
   }
-  return t;
+  return s;
 }
-function U(t, e, s, n, i = /* @__PURE__ */ new WeakSet()) {
-  if (B.isFunctionRef(t))
-    return e.deserialize(t, s, n);
-  if (Array.isArray(t)) {
-    if (i.has(t))
+function V(s, e, t, n, i = /* @__PURE__ */ new WeakSet()) {
+  if (J.isFunctionRef(s))
+    return e.deserialize(s, t, n);
+  if (Array.isArray(s)) {
+    if (i.has(s))
       throw new Error("Circular reference detected in serialized props");
-    return i.add(t), t.map(
-      (r) => U(r, e, s, n, i)
+    return i.add(s), s.map(
+      (r) => V(r, e, t, n, i)
     );
   }
-  if (typeof t == "object" && t !== null) {
-    if (i.has(t))
+  if (typeof s == "object" && s !== null) {
+    if (i.has(s))
       throw new Error("Circular reference detected in serialized props");
-    i.add(t);
+    i.add(s);
     const r = {};
-    for (const [o, a] of Object.entries(t))
-      r[o] = U(a, e, s, n, i);
+    for (const [o, a] of Object.entries(s))
+      r[o] = V(a, e, t, n, i);
     return r;
   }
-  return t;
+  return s;
 }
-function j(t = window) {
+function q(s = window) {
   try {
-    return t.location.origin;
+    return s.location.origin;
   } catch {
     return "";
   }
 }
-function _e(t, e = window) {
+function be(s, e = window) {
   try {
-    return t.location.origin === e.location.origin;
+    return s.location.origin === e.location.origin;
   } catch {
     return !1;
   }
 }
-function we(t, e) {
-  return typeof t == "string" ? t === "*" ? !0 : t === e : t instanceof RegExp ? t.test(e) : Array.isArray(t) ? t.some((s) => we(s, e)) : !1;
+function L(s, e) {
+  return typeof s == "string" ? s === "*" ? !0 : s === e : s instanceof RegExp ? s.test(e) : Array.isArray(s) ? s.some((t) => L(t, e)) : !1;
 }
-function Ee(t) {
-  if (!t) return !0;
+function Pe(s) {
+  if (!s) return !0;
   try {
-    return t.closed;
+    return s.closed;
   } catch {
     return !0;
   }
 }
-function $e(t = window) {
+function He(s = window) {
   try {
-    return t.opener;
+    return s.opener;
   } catch {
     return null;
   }
 }
-function Fe(t = window) {
+function Ae(s = window) {
   try {
-    const e = t.parent;
-    return e && e !== t ? e : null;
+    const e = s.parent;
+    return e && e !== s ? e : null;
   } catch {
     return null;
   }
 }
-function Le(t = window) {
+function Ue(s = window) {
   try {
-    return t.parent !== t;
+    return s.parent !== s;
   } catch {
     return !0;
   }
 }
-function Ae(t = window) {
+function Me(s = window) {
   try {
-    return t.opener !== null && t.opener !== void 0;
+    return s.opener !== null && s.opener !== void 0;
   } catch {
     return !1;
   }
 }
-const ae = 32 * 1024;
-function He(t) {
-  const e = We(t);
-  return `${N}${e}`;
+const ue = 32 * 1024;
+function We(s) {
+  const e = ze(s);
+  return `${F}${e}`;
 }
-function be(t) {
-  if (!t || !t.startsWith(N))
+function Oe(s) {
+  if (!s || !s.startsWith(F))
     return null;
-  const e = t.slice(N.length);
-  return ze(e);
+  const e = s.slice(F.length);
+  return je(e);
 }
-function J(t = window) {
+function X(s = window) {
   try {
-    return t.name.startsWith(N);
+    return s.name.startsWith(F);
   } catch {
     return !1;
   }
 }
-function H(t, e = window) {
-  return be(e.name)?.tag === t;
+function W(s, e = window) {
+  return Oe(e.name)?.tag === s;
 }
-function We(t) {
+function ze(s) {
   try {
-    const e = JSON.stringify(t), s = btoa(encodeURIComponent(e)), n = new Blob([s]).size;
-    if (n > ae)
+    const e = JSON.stringify(s), t = btoa(encodeURIComponent(e)), n = new Blob([t]).size;
+    if (n > ue)
       throw new Error(
-        `Payload size (${Math.round(n / 1024)}KB) exceeds maximum allowed size (${ae / 1024}KB). Consider reducing the amount of data passed via props.`
+        `Payload size (${Math.round(n / 1024)}KB) exceeds maximum allowed size (${ue / 1024}KB). Consider reducing the amount of data passed via props.`
       );
-    return s;
+    return t;
   } catch (e) {
     throw e instanceof Error && e.message.includes("Payload size") ? e : new Error(`Failed to encode payload: ${e}`);
   }
 }
-function ze(t) {
+function je(s) {
   try {
-    const e = decodeURIComponent(atob(t));
+    const e = decodeURIComponent(atob(s));
     return JSON.parse(e);
   } catch {
     return null;
   }
 }
-function Me(t) {
+function Be(s) {
   return {
-    uid: t.uid,
-    tag: t.tag,
-    version: pe,
-    context: t.context,
-    consumerDomain: t.consumerDomain,
-    props: t.props,
-    exports: t.exports,
-    children: t.children
+    uid: s.uid,
+    tag: s.tag,
+    version: ye,
+    context: s.context,
+    consumerDomain: s.consumerDomain,
+    props: s.props,
+    exports: s.exports,
+    children: s.children
   };
 }
-function Ue(t = window) {
-  return be(t.name);
+function Ve(s = window) {
+  return Oe(s.name);
 }
-const ce = 100, w = /* @__PURE__ */ new Map();
-function je() {
-  const t = [];
-  for (const [e, s] of w.entries())
-    Ee(s) && t.push(e);
-  for (const e of t)
-    w.delete(e);
+const he = 100, E = /* @__PURE__ */ new Map();
+function qe() {
+  const s = [];
+  for (const [e, t] of E.entries())
+    Pe(t) && s.push(e);
+  for (const e of s)
+    E.delete(e);
 }
-function Be(t, e) {
-  if (w.size >= ce && je(), w.size >= ce) {
-    const s = w.keys().next().value;
-    s && w.delete(s);
+function Je(s, e) {
+  if (E.size >= he && qe(), E.size >= he) {
+    const t = E.keys().next().value;
+    t && E.delete(t);
   }
-  w.set(t, e);
+  E.set(s, e);
 }
-function Je(t) {
-  w.delete(t);
+function Xe(s) {
+  E.delete(s);
 }
-class m {
+class y {
   /** @internal */
   _optional = !1;
   /** @internal */
@@ -976,11 +993,11 @@ class m {
    * ```
    */
   default(e) {
-    const s = this._clone();
-    return s._default = e, s;
+    const t = this._clone();
+    return t._default = e, t;
   }
 }
-class V extends m {
+class K extends y {
   /** @internal */
   _minLength;
   /** @internal */
@@ -997,26 +1014,26 @@ class V extends m {
       return {
         issues: [{ message: `Expected string, got ${typeof e}` }]
       };
-    const s = this._trim ? e.trim() : e;
-    return this._minLength !== void 0 && s.length < this._minLength ? {
+    const t = this._trim ? e.trim() : e;
+    return this._minLength !== void 0 && t.length < this._minLength ? {
       issues: [
         { message: `String must be at least ${this._minLength} characters` }
       ]
-    } : this._maxLength !== void 0 && s.length > this._maxLength ? {
+    } : this._maxLength !== void 0 && t.length > this._maxLength ? {
       issues: [
         { message: `String must be at most ${this._maxLength} characters` }
       ]
-    } : this._pattern && !this._pattern.test(s) ? {
+    } : this._pattern && !this._pattern.test(t) ? {
       issues: [
         {
           message: this._patternMessage || `String must match pattern ${this._pattern}`
         }
       ]
-    } : { value: s };
+    } : { value: t };
   }
   /** @internal */
   _clone() {
-    const e = new V();
+    const e = new K();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._minLength = this._minLength, e._maxLength = this._maxLength, e._pattern = this._pattern, e._patternMessage = this._patternMessage, e._trim = this._trim, e;
   }
   /**
@@ -1030,8 +1047,8 @@ class V extends m {
    * ```
    */
   min(e) {
-    const s = this._clone();
-    return s._minLength = e, s;
+    const t = this._clone();
+    return t._minLength = e, t;
   }
   /**
    * Requires maximum string length.
@@ -1044,8 +1061,8 @@ class V extends m {
    * ```
    */
   max(e) {
-    const s = this._clone();
-    return s._maxLength = e, s;
+    const t = this._clone();
+    return t._maxLength = e, t;
   }
   /**
    * Requires exact string length.
@@ -1058,8 +1075,8 @@ class V extends m {
    * ```
    */
   length(e) {
-    const s = this._clone();
-    return s._minLength = e, s._maxLength = e, s;
+    const t = this._clone();
+    return t._minLength = e, t._maxLength = e, t;
   }
   /**
    * Requires string to match a regex pattern.
@@ -1072,9 +1089,9 @@ class V extends m {
    * slug: prop.string().pattern(/^[a-z0-9-]+$/, 'Invalid slug format')
    * ```
    */
-  pattern(e, s) {
+  pattern(e, t) {
     const n = this._clone();
-    return n._pattern = e, n._patternMessage = s, n;
+    return n._pattern = e, n._patternMessage = t, n;
   }
   /**
    * Validates as email address.
@@ -1141,7 +1158,7 @@ class V extends m {
     return e._minLength = 1, e;
   }
 }
-class q extends m {
+class G extends y {
   /** @internal */
   _min;
   /** @internal */
@@ -1156,7 +1173,7 @@ class q extends m {
   }
   /** @internal */
   _clone() {
-    const e = new q();
+    const e = new G();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._min = this._min, e._max = this._max, e._int = this._int, e;
   }
   /**
@@ -1170,8 +1187,8 @@ class q extends m {
    * ```
    */
   min(e) {
-    const s = this._clone();
-    return s._min = e, s;
+    const t = this._clone();
+    return t._min = e, t;
   }
   /**
    * Requires maximum value.
@@ -1184,8 +1201,8 @@ class q extends m {
    * ```
    */
   max(e) {
-    const s = this._clone();
-    return s._max = e, s;
+    const t = this._clone();
+    return t._max = e, t;
   }
   /**
    * Requires integer value.
@@ -1236,7 +1253,7 @@ class q extends m {
     return e._max = -Number.MIN_VALUE, e;
   }
 }
-class X extends m {
+class Y extends y {
   /** @internal */
   _validate(e) {
     return typeof e != "boolean" ? {
@@ -1245,11 +1262,11 @@ class X extends m {
   }
   /** @internal */
   _clone() {
-    const e = new X();
+    const e = new Y();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class Y extends m {
+class Z extends y {
   /** @internal */
   _validate(e) {
     return typeof e != "function" ? {
@@ -1258,11 +1275,11 @@ class Y extends m {
   }
   /** @internal */
   _clone() {
-    const e = new Y();
+    const e = new Z();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class T extends m {
+class N extends y {
   /** @internal */
   _itemSchema;
   /** @internal */
@@ -1288,7 +1305,7 @@ class T extends m {
         ]
       };
     if (this._itemSchema) {
-      const s = [];
+      const t = [];
       for (let n = 0; n < e.length; n++) {
         const i = this._itemSchema["~standard"].validate(e[n]);
         if (i instanceof Promise)
@@ -1302,15 +1319,15 @@ class T extends m {
               path: [n, ...r.path || []]
             }))
           };
-        s.push(i.value);
+        t.push(i.value);
       }
-      return { value: s };
+      return { value: t };
     }
     return { value: e };
   }
   /** @internal */
   _clone() {
-    const e = new T();
+    const e = new N();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._itemSchema = this._itemSchema, e._minLength = this._minLength, e._maxLength = this._maxLength, e;
   }
   /**
@@ -1326,8 +1343,8 @@ class T extends m {
    * ```
    */
   of(e) {
-    const s = new T();
-    return s._optional = this._optional, s._nullable = this._nullable, s._itemSchema = e, s._minLength = this._minLength, s._maxLength = this._maxLength, s;
+    const t = new N();
+    return t._optional = this._optional, t._nullable = this._nullable, t._itemSchema = e, t._minLength = this._minLength, t._maxLength = this._maxLength, t;
   }
   /**
    * Requires minimum array length.
@@ -1340,8 +1357,8 @@ class T extends m {
    * ```
    */
   min(e) {
-    const s = this._clone();
-    return s._minLength = e, s;
+    const t = this._clone();
+    return t._minLength = e, t;
   }
   /**
    * Requires maximum array length.
@@ -1354,8 +1371,8 @@ class T extends m {
    * ```
    */
   max(e) {
-    const s = this._clone();
-    return s._maxLength = e, s;
+    const t = this._clone();
+    return t._maxLength = e, t;
   }
   /**
    * Requires non-empty array.
@@ -1369,7 +1386,7 @@ class T extends m {
     return this.min(1);
   }
 }
-class k extends m {
+class k extends y {
   /** @internal */
   _shape;
   /** @internal */
@@ -1384,18 +1401,18 @@ class k extends m {
           }
         ]
       };
-    const s = e, n = {};
+    const t = e, n = {};
     if (this._shape) {
       if (this._strict) {
         const i = new Set(Object.keys(this._shape));
-        for (const r of Object.keys(s))
+        for (const r of Object.keys(t))
           if (!i.has(r))
             return {
               issues: [{ message: `Unknown key: ${r}`, path: [r] }]
             };
       }
       for (const [i, r] of Object.entries(this._shape)) {
-        const o = r["~standard"].validate(s[i]);
+        const o = r["~standard"].validate(t[i]);
         if (o instanceof Promise)
           throw new Error(
             "Async schema validation is not supported. Use synchronous schemas."
@@ -1410,8 +1427,8 @@ class k extends m {
         n[i] = o.value;
       }
       if (!this._strict)
-        for (const i of Object.keys(s))
-          i in this._shape || (n[i] = s[i]);
+        for (const i of Object.keys(t))
+          i in this._shape || (n[i] = t[i]);
       return { value: n };
     }
     return { value: e };
@@ -1436,8 +1453,8 @@ class k extends m {
    * ```
    */
   shape(e) {
-    const s = new k();
-    return s._optional = this._optional, s._nullable = this._nullable, s._shape = e, s._strict = this._strict, s;
+    const t = new k();
+    return t._optional = this._optional, t._nullable = this._nullable, t._shape = e, t._strict = this._strict, t;
   }
   /**
    * Rejects objects with unknown keys.
@@ -1452,7 +1469,7 @@ class k extends m {
     return e._strict = !0, e;
   }
 }
-class Z extends m {
+class Q extends y {
   /** @internal */
   _value;
   constructor(e) {
@@ -1466,11 +1483,11 @@ class Z extends m {
   }
   /** @internal */
   _clone() {
-    const e = new Z(this._value);
+    const e = new Q(this._value);
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class G extends m {
+class ee extends y {
   /** @internal */
   _values;
   constructor(e) {
@@ -1481,18 +1498,18 @@ class G extends m {
     return this._values.includes(e) ? { value: e } : {
       issues: [
         {
-          message: `Expected one of [${this._values.map((s) => JSON.stringify(s)).join(", ")}], got ${JSON.stringify(e)}`
+          message: `Expected one of [${this._values.map((t) => JSON.stringify(t)).join(", ")}], got ${JSON.stringify(e)}`
         }
       ]
     };
   }
   /** @internal */
   _clone() {
-    const e = new G(this._values);
+    const e = new ee(this._values);
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class K extends m {
+class te extends y {
   constructor() {
     super(), this._nullable = !0;
   }
@@ -1502,7 +1519,7 @@ class K extends m {
   }
   /** @internal */
   _clone() {
-    const e = new K();
+    const e = new te();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
@@ -1519,7 +1536,7 @@ const d = {
    * prop.string().pattern(/^[a-z]+$/)
    * ```
    */
-  string: () => new V(),
+  string: () => new K(),
   /**
    * Creates a number schema.
    *
@@ -1531,7 +1548,7 @@ const d = {
    * prop.number().positive()
    * ```
    */
-  number: () => new q(),
+  number: () => new G(),
   /**
    * Creates a boolean schema.
    *
@@ -1541,7 +1558,7 @@ const d = {
    * prop.boolean().default(false)
    * ```
    */
-  boolean: () => new X(),
+  boolean: () => new Y(),
   /**
    * Creates a function schema.
    *
@@ -1554,7 +1571,7 @@ const d = {
    * prop.function<(data: { id: string }) => Promise<void>>()
    * ```
    */
-  function: () => new Y(),
+  function: () => new Z(),
   /**
    * Creates an array schema.
    *
@@ -1567,7 +1584,7 @@ const d = {
    * prop.array().of(prop.number()).min(1).max(10)
    * ```
    */
-  array: () => new T(),
+  array: () => new N(),
   /**
    * Creates an object schema.
    *
@@ -1596,7 +1613,7 @@ const d = {
    * prop.literal(true)
    * ```
    */
-  literal: (t) => new Z(t),
+  literal: (s) => new Q(s),
   /**
    * Creates an enum schema for a set of allowed values.
    *
@@ -1608,7 +1625,7 @@ const d = {
    * prop.enum([1, 2, 3])
    * ```
    */
-  enum: (t) => new G(t),
+  enum: (s) => new ee(s),
   /**
    * Creates a schema that accepts any value.
    *
@@ -1620,8 +1637,8 @@ const d = {
    * prop.any()
    * ```
    */
-  any: () => new K()
-}, R = {
+  any: () => new te()
+}, P = {
   uid: {
     schema: d.string().optional(),
     sendToHost: !0
@@ -1688,118 +1705,140 @@ const d = {
     sendToHost: !1
   }
 };
-function E(t) {
-  return typeof t == "object" && t !== null && "~standard" in t && typeof t["~standard"] == "object" && t["~standard"] !== null && t["~standard"].version === 1 && typeof t["~standard"].validate == "function";
+function b(s) {
+  return typeof s == "object" && s !== null && "~standard" in s && typeof s["~standard"] == "object" && s["~standard"] !== null && s["~standard"].version === 1 && typeof s["~standard"].vendor == "string" && typeof s["~standard"].validate == "function";
 }
-function Ve(t, e, s) {
-  const n = t["~standard"].validate(e);
+function Ke(s, e, t) {
+  const n = s["~standard"].validate(e);
   if (n instanceof Promise)
     throw new Error(
-      `Prop "${s}" uses an async schema. ForgeFrame only supports synchronous schema validation. Please use a synchronous schema or remove async operations (like database lookups) from your schema definition.`
+      `Prop "${t}" uses an async schema. ForgeFrame only supports synchronous schema validation. Please use a synchronous schema or remove async operations (like database lookups) from your schema definition.`
     );
   if (n.issues) {
-    const i = n.issues.map((r) => `${qe(r.path, s)}: ${r.message}`);
+    const i = n.issues.map((r) => `${Ge(r.path, t)}: ${r.message}`);
     throw new Error(`Validation failed: ${i.join("; ")}`);
   }
   return n.value;
 }
-function qe(t, e) {
-  if (!t || t.length === 0)
+function Ge(s, e) {
+  if (!s || s.length === 0)
     return e;
-  const s = t.map((n) => typeof n == "object" && n !== null && "key" in n ? String(n.key) : String(n));
-  return `${e}.${s.join(".")}`;
+  const t = s.map((n) => {
+    if (typeof n == "object" && n !== null) {
+      if ("key" in n && n.key !== void 0)
+        return String(n.key);
+      if ("index" in n && typeof n.index == "number")
+        return String(n.index);
+    }
+    return String(n);
+  });
+  return `${e}.${t.join(".")}`;
 }
-function le(t, e, s) {
+function de(s, e, t) {
   const n = {
-    ...R,
+    ...P,
     ...e
   }, i = {};
   for (const [r, o] of Object.entries(n)) {
-    const c = E(o) ? { schema: o } : o;
+    const c = b(o) ? { schema: o } : o;
     let l;
-    const h = c.alias, g = r in t, y = h && h in t;
-    if (g)
-      l = t[r];
-    else if (y)
-      l = t[h];
+    const h = c.alias, w = r in s, _ = h && h in s;
+    if (w)
+      l = s[r];
+    else if (_)
+      l = s[h];
     else if (c.value)
-      l = c.value(s);
+      l = c.value(t);
     else if (c.default !== void 0)
-      l = typeof c.default == "function" ? c.default(s) : c.default;
-    else if (c.schema && E(c.schema)) {
-      const b = c.schema["~standard"].validate(void 0);
-      !(b instanceof Promise) && !b.issues && (l = b.value);
+      l = typeof c.default == "function" ? c.default(t) : c.default;
+    else if (c.schema && b(c.schema)) {
+      const O = c.schema["~standard"].validate(void 0);
+      !(O instanceof Promise) && !O.issues && (l = O.value);
     }
     l !== void 0 && c.decorate && (l = c.decorate({ value: l, props: i })), i[r] = l;
   }
   return i;
 }
-function Xe(t, e) {
-  const s = {
-    ...R,
+function Ye(s, e) {
+  const t = {
+    ...P,
     ...e
   };
-  for (const [n, i] of Object.entries(s)) {
-    const r = E(i), o = r ? { schema: i } : i;
-    let a = t[n];
+  for (const [n, i] of Object.entries(t)) {
+    const r = b(i), o = r ? { schema: i } : i;
+    let a = s[n];
     if (o.required && a === void 0)
       throw new Error(`Prop "${n}" is required but was not provided`);
-    if (o.schema && E(o.schema))
-      (a !== void 0 || r) && (a = Ve(o.schema, a, n), t[n] = a);
+    if (o.schema && b(o.schema))
+      (a !== void 0 || r) && (a = Ke(o.schema, a, n), s[n] = a);
     else if (a === void 0)
       continue;
-    o.validate && o.validate({ value: a, props: t });
+    o.validate && o.validate({ value: a, props: s });
   }
 }
-function ue(t, e, s, n) {
+function fe(s, e, t, n) {
   const i = {
-    ...R,
+    ...P,
     ...e
   }, r = {};
   for (const [o, a] of Object.entries(i)) {
-    const l = E(a) ? { schema: a } : a, h = t[o];
+    const l = b(a) ? { schema: a } : a, h = s[o];
     if (l.sendToHost === !1 || l.sameDomain && !n) continue;
     if (l.trustedDomains) {
-      const y = l.trustedDomains;
-      if (!we(y, s)) continue;
+      const _ = l.trustedDomains;
+      if (!L(_, t)) continue;
     }
-    let g = h;
-    l.hostDecorate && h !== void 0 && (g = l.hostDecorate({ value: h, props: t })), r[o] = g;
+    let w = h;
+    l.hostDecorate && h !== void 0 && (w = l.hostDecorate({ value: h, props: s })), r[o] = w;
   }
   return r;
 }
-function Ye(t, e) {
-  const s = new URLSearchParams(), n = {
-    ...R,
+function Ze(s, e) {
+  const t = new URLSearchParams(), n = {
+    ...P,
     ...e
   };
   for (const [i, r] of Object.entries(n)) {
-    const a = E(r) ? { schema: r } : r, c = t[i];
+    const a = b(r) ? { schema: r } : r, c = s[i];
     if (c === void 0 || typeof c == "function" || !a.queryParam) continue;
     const l = typeof a.queryParam == "string" ? a.queryParam : i;
     let h;
-    typeof a.queryParam == "function" ? h = a.queryParam({ value: c }) : typeof c == "object" ? h = JSON.stringify(c) : h = String(c), s.set(l, h);
+    typeof a.queryParam == "function" ? h = a.queryParam({ value: c }) : typeof c == "object" ? h = JSON.stringify(c) : h = String(c), t.set(l, h);
   }
-  return s;
+  return t;
 }
-function Pe(t, e = "") {
-  const s = [];
-  for (const [n, i] of Object.entries(t)) {
+function Qe(s, e) {
+  const t = new URLSearchParams(), n = {
+    ...P,
+    ...e
+  };
+  for (const [i, r] of Object.entries(n)) {
+    const a = b(r) ? { schema: r } : r, c = s[i];
+    if (c === void 0 || typeof c == "function" || !a.bodyParam) continue;
+    const l = typeof a.bodyParam == "string" ? a.bodyParam : i;
+    let h;
+    typeof a.bodyParam == "function" ? h = a.bodyParam({ value: c }) : typeof c == "object" ? h = JSON.stringify(c) : h = String(c), t.set(l, h);
+  }
+  return t;
+}
+function Re(s, e = "") {
+  const t = [];
+  for (const [n, i] of Object.entries(s)) {
     const r = e ? `${e}.${n}` : n;
     if (i !== null && typeof i == "object" && !Array.isArray(i))
-      s.push(Pe(i, r));
+      t.push(Re(i, r));
     else {
       const o = encodeURIComponent(JSON.stringify(i));
-      s.push(`${r}=${o}`);
+      t.push(`${r}=${o}`);
     }
   }
-  return s.filter(Boolean).join("&");
+  return t.filter(Boolean).join("&");
 }
-function Ze(t) {
+function et(s) {
   const e = {};
-  if (!t) return e;
-  const s = t.split("&");
-  for (const n of s) {
+  if (!s) return e;
+  const t = s.split("&");
+  for (const n of t) {
     const [i, r] = n.split("=");
     if (!i || r === void 0) continue;
     let o;
@@ -1818,48 +1857,48 @@ function Ze(t) {
   }
   return e;
 }
-function Ge(t) {
-  return typeof t == "object" && t !== null && t.__type__ === "dotify" && typeof t.__value__ == "string";
+function tt(s) {
+  return typeof s == "object" && s !== null && s.__type__ === "dotify" && typeof s.__value__ == "string";
 }
-function he(t, e, s) {
+function pe(s, e, t) {
   const n = {
-    ...R,
+    ...P,
     ...e
   }, i = {};
-  for (const [r, o] of Object.entries(t)) {
+  for (const [r, o] of Object.entries(s)) {
     if (o === void 0) continue;
     const a = n[r];
-    i[r] = Ke(o, a, s);
+    i[r] = st(o, a, t);
   }
   return i;
 }
-function Ke(t, e, s) {
-  if (typeof t == "function")
-    return s.serialize(t);
+function st(s, e, t) {
+  if (typeof s == "function")
+    return t.serialize(s);
   const n = e?.serialization ?? I.JSON;
-  if (n === I.BASE64 && typeof t == "object") {
-    const i = JSON.stringify(t);
+  if (n === I.BASE64 && typeof s == "object") {
+    const i = JSON.stringify(s);
     return {
       __type__: "base64",
       __value__: btoa(encodeURIComponent(i))
     };
   }
-  return n === I.DOTIFY && typeof t == "object" && t !== null && !Array.isArray(t) ? {
+  return n === I.DOTIFY && typeof s == "object" && s !== null && !Array.isArray(s) ? {
     __type__: "dotify",
-    __value__: Pe(t)
-  } : M(t, s);
+    __value__: Re(s)
+  } : B(s, t);
 }
-function de(t, e, s, n, i, r) {
+function me(s, e, t, n, i, r) {
   const o = {
-    ...R,
+    ...P,
     ...e
   }, a = {};
-  for (const [c, l] of Object.entries(t)) {
+  for (const [c, l] of Object.entries(s)) {
     const h = o[c];
-    a[c] = Qe(
+    a[c] = nt(
       l,
       h,
-      s,
+      t,
       n,
       i,
       r
@@ -1867,65 +1906,65 @@ function de(t, e, s, n, i, r) {
   }
   return a;
 }
-function Qe(t, e, s, n, i, r) {
-  if (et(t))
+function nt(s, e, t, n, i, r) {
+  if (it(s))
     try {
-      const o = decodeURIComponent(atob(t.__value__));
+      const o = decodeURIComponent(atob(s.__value__));
       return JSON.parse(o);
     } catch {
-      return t;
+      return s;
     }
-  if (Ge(t))
+  if (tt(s))
     try {
-      return Ze(t.__value__);
+      return et(s.__value__);
     } catch {
-      return t;
+      return s;
     }
-  return U(t, n, i, r);
+  return V(s, n, i, r);
 }
-function et(t) {
-  return typeof t == "object" && t !== null && t.__type__ === "base64" && typeof t.__value__ == "string";
+function it(s) {
+  return typeof s == "object" && s !== null && s.__type__ === "base64" && typeof s.__value__ == "string";
 }
-function P(t, e = "100%") {
-  return t === void 0 ? e : typeof t == "number" ? `${t}px` : t;
+function R(s, e = "100%") {
+  return s === void 0 ? e : typeof s == "number" ? `${s}px` : s;
 }
-function $(t, e) {
-  if (t === void 0) return e;
-  if (typeof t == "number") return t;
-  const s = parseInt(t, 10);
-  return isNaN(s) ? e : s;
+function $(s, e) {
+  if (s === void 0) return e;
+  if (typeof s == "number") return s;
+  const t = parseInt(s, 10);
+  return isNaN(t) ? e : t;
 }
-function tt(t) {
+function rt(s) {
   try {
-    t.src = "about:blank", t.parentNode?.removeChild(t);
+    s.src = "about:blank", s.parentNode?.removeChild(s);
   } catch {
   }
 }
-function st(t, e) {
-  rt(t, e);
+function ot(s, e) {
+  lt(s, e);
 }
-function nt(t) {
-  t.style.display = "", t.style.visibility = "visible";
+function at(s) {
+  s.style.display = "", s.style.visibility = "visible";
 }
-function fe(t) {
-  t.style.display = "none", t.style.visibility = "hidden";
+function ge(s) {
+  s.style.display = "none", s.style.visibility = "hidden";
 }
-function it(t) {
+function ct(s) {
   try {
-    t.focus(), t.contentWindow?.focus();
+    s.focus(), s.contentWindow?.focus();
   } catch {
   }
 }
-function rt(t, e) {
-  e.width !== void 0 && (t.style.width = P(e.width)), e.height !== void 0 && (t.style.height = P(e.height));
+function lt(s, e) {
+  e.width !== void 0 && (s.style.width = R(e.width)), e.height !== void 0 && (s.style.height = R(e.height));
 }
-class Re extends Error {
+class ve extends Error {
   constructor(e = "Popup blocked by browser") {
     super(e), this.name = "PopupOpenError";
   }
 }
-function ot(t) {
-  const { url: e, name: s, dimensions: n } = t, i = $(n.width, 500), r = $(n.height, 500), o = Math.floor(window.screenX + (window.outerWidth - i) / 2), a = Math.floor(window.screenY + (window.outerHeight - r) / 2), c = [
+function ut(s) {
+  const { url: e, name: t, dimensions: n } = s, i = $(n.width, 500), r = $(n.height, 500), o = Math.floor(window.screenX + (window.outerWidth - i) / 2), a = Math.floor(window.screenY + (window.outerHeight - r) / 2), c = [
     `width=${i}`,
     `height=${r}`,
     `left=${o}`,
@@ -1937,32 +1976,32 @@ function ot(t) {
     "status=no",
     "resizable=yes",
     "scrollbars=yes"
-  ].join(","), l = window.open(e, s, c);
-  if (!l || lt(l))
-    throw new Re();
+  ].join(","), l = window.open(e, t, c);
+  if (!l || ft(l))
+    throw new ve();
   return l;
 }
-function at(t) {
+function ht(s) {
   try {
-    t.closed || t.close();
+    s.closed || s.close();
   } catch {
   }
 }
-function ct(t) {
+function dt(s) {
   try {
-    t.closed || t.focus();
+    s.closed || s.focus();
   } catch {
   }
 }
-function lt(t) {
-  if (!t) return !0;
+function ft(s) {
+  if (!s) return !0;
   try {
-    return !!(t.closed || t.innerHeight === 0 || t.innerWidth === 0);
+    return !!(s.closed || s.innerHeight === 0 || s.innerWidth === 0);
   } catch {
     return !0;
   }
 }
-function ut(t, e, s = {}) {
+function pt(s, e, t = {}) {
   const {
     initialInterval: n = 100,
     // Start fast to catch quick closes
@@ -1970,18 +2009,18 @@ function ut(t, e, s = {}) {
     // Cap at 2 seconds
     multiplier: r = 1.5
     // Exponential backoff multiplier
-  } = s;
+  } = t;
   let o = n, a, c = !1;
   const l = () => {
     try {
       e();
-    } catch (g) {
-      console.error("Error in popup close callback:", g);
+    } catch (w) {
+      console.error("Error in popup close callback:", w);
     }
   }, h = () => {
     if (!c) {
       try {
-        if (t.closed) {
+        if (s.closed) {
           l();
           return;
         }
@@ -1996,34 +2035,34 @@ function ut(t, e, s = {}) {
     c = !0, clearTimeout(a);
   };
 }
-function ht(t, e) {
+function mt(s, e) {
   try {
-    const s = $(e.width, t.outerWidth), n = $(
+    const t = $(e.width, s.outerWidth), n = $(
       e.height,
-      t.outerHeight
+      s.outerHeight
     );
-    t.resizeTo(s, n);
+    s.resizeTo(t, n);
   } catch {
   }
 }
-function dt(t) {
-  const { doc: e, dimensions: s, uid: n, tag: i } = t, r = e.createElement("div");
+function gt(s) {
+  const { doc: e, dimensions: t, uid: n, tag: i } = s, r = e.createElement("div");
   return r.id = `forgeframe-container-${n}`, r.setAttribute("data-forgeframe-tag", i), Object.assign(r.style, {
     display: "inline-block",
     position: "relative",
-    width: P(s.width),
-    height: P(s.height),
+    width: R(t.width),
+    height: R(t.height),
     overflow: "hidden"
   }), r;
 }
-function ft(t) {
-  const { doc: e, dimensions: s, cspNonce: n } = t, i = e.createElement("div");
+function yt(s) {
+  const { doc: e, dimensions: t, cspNonce: n } = s, i = e.createElement("div");
   Object.assign(i.style, {
     display: "flex",
     alignItems: "center",
     justifyContent: "center",
-    width: P(s.width),
-    height: P(s.height),
+    width: R(t.width),
+    height: R(t.height),
     backgroundColor: "#f5f5f5",
     position: "absolute",
     top: "0",
@@ -2046,20 +2085,20 @@ function ft(t) {
     }
   `, i.appendChild(o), i.appendChild(r), i;
 }
-function pt(t, e = 200) {
-  return new Promise((s) => {
-    t.style.opacity = "0", t.style.transition = `opacity ${e}ms ease-in`, t.offsetHeight, t.style.opacity = "1", setTimeout(s, e);
+function wt(s, e = 200) {
+  return new Promise((t) => {
+    s.style.opacity = "0", s.style.transition = `opacity ${e}ms ease-in`, s.offsetHeight, s.style.opacity = "1", setTimeout(t, e);
   });
 }
-function mt(t, e = 200) {
-  return new Promise((s) => {
-    t.style.transition = `opacity ${e}ms ease-out`, t.style.opacity = "0", setTimeout(s, e);
+function _t(s, e = 200) {
+  return new Promise((t) => {
+    s.style.transition = `opacity ${e}ms ease-out`, s.style.opacity = "0", setTimeout(t, e);
   });
 }
-async function gt(t, e, s) {
-  e && (await mt(e, 150), e.remove()), s.style.display = "", s.style.visibility = "visible", s.style.opacity = "0", await pt(s, 150);
+async function Et(s, e, t) {
+  e && (await _t(e, 150), e.remove()), t.style.display = "", t.style.visibility = "visible", t.style.opacity = "0", await wt(t, 150);
 }
-class Q {
+class se {
   /** Event emitter for lifecycle events. */
   event;
   /** Arbitrary state storage for the component instance. */
@@ -2092,6 +2131,10 @@ class Q {
   /** @internal */
   hostWindow = null;
   /** @internal */
+  openedHostDomain = null;
+  /** @internal */
+  dynamicUrlTrustedOrigin = null;
+  /** @internal */
   iframe = null;
   /** @internal */
   container = null;
@@ -2109,25 +2152,20 @@ class Q {
    * @param options - Component configuration options
    * @param props - Initial props to pass to the component
    */
-  constructor(e, s = {}) {
-    this._uid = Ie(), this.options = this.normalizeOptions(e), this.context = this.options.defaultContext, this.event = new me(), this.cleanup = new De();
-    const n = this.buildTrustedDomains();
-    this.messenger = new ye(this.uid, window, j(), n), this.bridge = new B(this.messenger);
-    const i = this.createPropContext();
-    this.props = le(s, this.options.props, i), this.setupMessageHandlers(), this.setupCleanup();
+  constructor(e, t = {}) {
+    this._uid = Fe(), this.options = this.normalizeOptions(e), this.context = this.options.defaultContext, this.event = new we(), this.cleanup = new Ne();
+    const n = this.createPropContext();
+    this.props = de(t, this.options.props, n);
+    const i = this.buildTrustedDomains();
+    this.messenger = new Ee(this.uid, window, q(), i), this.bridge = new J(this.messenger), this.setupMessageHandlers(), this.setupCleanup();
   }
   /**
    * Builds the list of trusted domains for messenger communication.
    * @internal
    */
   buildTrustedDomains() {
-    const e = [], s = typeof this.options.url == "function" ? this.options.url(this.props) : this.options.url;
-    try {
-      const n = new URL(s);
-      e.push(n.origin);
-    } catch {
-    }
-    if (this.options.domain) {
+    const e = [], t = this.resolveUrlOrigin(this.resolveUrl());
+    if (t && (e.push(t), this.dynamicUrlTrustedOrigin = t), this.options.domain) {
       if (typeof this.options.domain == "string")
         e.push(this.options.domain);
       else if (Array.isArray(this.options.domain))
@@ -2155,12 +2193,12 @@ class Q {
    * await instance.render(document.getElementById('target'), 'popup');
    * ```
    */
-  async render(e, s) {
+  async render(e, t) {
     if (this.destroyed)
       throw new Error("Component has been destroyed");
     if (this.rendered)
       throw new Error("Component has already been rendered");
-    this.context = s ?? this.options.defaultContext, this.checkEligibility(), Xe(this.props, this.options.props), this.container = this.resolveContainer(e), this.event.emit(f.PRERENDER), this.callPropCallback("onPrerender"), await this.prerender(), this.event.emit(f.PRERENDERED), this.callPropCallback("onPrerendered"), this.event.emit(f.RENDER), this.callPropCallback("onRender"), await this.open(), await this.waitForHost(), this.context === p.IFRAME && this.iframe && this.prerenderElement && (await gt(
+    this.context = t ?? this.options.defaultContext, this.checkEligibility(), Ye(this.props, this.options.props), this.options.validate?.({ props: this.props }), this.container = this.resolveContainer(e), this.event.emit(f.PRERENDER), this.callPropCallback("onPrerender"), await this.prerender(), this.event.emit(f.PRERENDERED), this.callPropCallback("onPrerendered"), this.event.emit(f.RENDER), this.callPropCallback("onRender"), await this.open(), await this.waitForHost(), this.context === p.IFRAME && this.iframe && this.prerenderElement && (await Et(
       this.container,
       this.prerenderElement,
       this.iframe
@@ -2177,8 +2215,8 @@ class Q {
    * @param container - CSS selector or HTMLElement to render into
    * @param context - Override the default rendering context
    */
-  async renderTo(e, s, n) {
-    return this.render(s, n);
+  async renderTo(e, t, n) {
+    return this.render(t, n);
   }
   /**
    * Closes and destroys the component.
@@ -2196,7 +2234,7 @@ class Q {
    * For iframes, focuses the iframe element. For popups, brings the window to front.
    */
   async focus() {
-    this.context === p.IFRAME && this.iframe ? it(this.iframe) : this.context === p.POPUP && this.hostWindow && ct(this.hostWindow), this.event.emit(f.FOCUS), this.callPropCallback("onFocus");
+    this.context === p.IFRAME && this.iframe ? ct(this.iframe) : this.context === p.POPUP && this.hostWindow && dt(this.hostWindow), this.event.emit(f.FOCUS), this.callPropCallback("onFocus");
   }
   /**
    * Resizes the component to the specified dimensions.
@@ -2204,7 +2242,7 @@ class Q {
    * @param dimensions - New width and height for the component
    */
   async resize(e) {
-    this.context === p.IFRAME && this.iframe ? st(this.iframe, e) : this.context === p.POPUP && this.hostWindow && ht(this.hostWindow, e), this.event.emit(f.RESIZE, e), this.callPropCallback("onResize", e);
+    this.context === p.IFRAME && this.iframe ? ot(this.iframe, e) : this.context === p.POPUP && this.hostWindow && mt(this.hostWindow, e), this.event.emit(f.RESIZE, e), this.callPropCallback("onResize", e);
   }
   /**
    * Shows the component if hidden.
@@ -2213,7 +2251,7 @@ class Q {
    * Only applicable to iframe context.
    */
   async show() {
-    this.context === p.IFRAME && this.iframe && nt(this.iframe);
+    this.context === p.IFRAME && this.iframe && at(this.iframe);
   }
   /**
    * Hides the component.
@@ -2222,7 +2260,7 @@ class Q {
    * Only applicable to iframe context.
    */
   async hide() {
-    this.context === p.IFRAME && this.iframe && fe(this.iframe);
+    this.context === p.IFRAME && this.iframe && ge(this.iframe);
   }
   /**
    * Updates the component props and sends them to the host.
@@ -2233,27 +2271,33 @@ class Q {
    * @param newProps - Partial props object to merge with existing props
    */
   async updateProps(e) {
-    const s = this.createPropContext();
-    if (this.props = le(
+    const t = this.createPropContext(), n = de(
       { ...this.props, ...e },
       this.options.props,
-      s
-    ), this.hostWindow && !Ee(this.hostWindow)) {
-      const n = this.getHostDomain(), i = ue(
-        this.props,
-        this.options.props,
+      t
+    );
+    this.options.validate?.({ props: n });
+    const i = this.resolveUrl(n), r = this.resolveUrlOrigin(i);
+    if (this.rendered && this.openedHostDomain && r && r !== this.openedHostDomain)
+      throw new Error(
+        `Cannot change component URL origin after render (from "${this.openedHostDomain}" to "${r}")`
+      );
+    if (this.props = n, this.rendered || this.syncTrustedDomainForUrl(i), this.hostWindow && !Pe(this.hostWindow)) {
+      const o = this.openedHostDomain ?? this.getHostDomain(), a = fe(
         n,
-        _e(this.hostWindow)
-      ), r = he(
-        i,
+        this.options.props,
+        o,
+        be(this.hostWindow)
+      ), c = pe(
+        a,
         this.options.props,
         this.bridge
       );
       await this.messenger.send(
         this.hostWindow,
-        n,
+        o,
         u.PROPS,
-        r
+        c
       );
     }
     this.event.emit(f.PROPS, this.props), this.callPropCallback("onProps", this.props);
@@ -2264,7 +2308,7 @@ class Q {
    * @returns A new unrendered component instance with identical configuration
    */
   clone() {
-    return new Q(this.options, this.props);
+    return new se(this.options, this.props);
   }
   /**
    * Checks if the component is eligible to render based on the eligible option.
@@ -2283,11 +2327,54 @@ class Q {
       ...e,
       props: e.props ?? {},
       defaultContext: e.defaultContext ?? p.IFRAME,
-      dimensions: typeof e.dimensions == "function" ? e.dimensions(this.props) : e.dimensions ?? { width: "100%", height: "100%" },
+      dimensions: e.dimensions ?? { width: "100%", height: "100%" },
       timeout: e.timeout ?? 1e4,
       children: e.children
     };
   }
+  /**
+   * Resolves the host URL from static or function options.
+   * @internal
+   */
+  resolveUrl(e = this.props) {
+    return typeof this.options.url == "function" ? this.options.url(e) : this.options.url;
+  }
+  /**
+   * Resolves dimensions from static or function options.
+   * @internal
+   */
+  resolveDimensions() {
+    return typeof this.options.dimensions == "function" ? this.options.dimensions(this.props) : this.options.dimensions;
+  }
+  /**
+   * Resolves a URL to an origin, supporting relative URLs.
+   * @internal
+   */
+  resolveUrlOrigin(e) {
+    try {
+      return new URL(e, window.location.origin).origin;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Returns true when the domain option explicitly includes this origin.
+   * @internal
+   */
+  isExplicitDomainTrust(e) {
+    return !this.options.domain || this.options.domain instanceof RegExp ? !1 : typeof this.options.domain == "string" ? this.options.domain === e : this.options.domain.includes(e);
+  }
+  /**
+   * Ensures the messenger trusts the origin for a resolved host URL.
+   * @internal
+   */
+  syncTrustedDomainForUrl(e) {
+    const t = this.resolveUrlOrigin(e);
+    if (!t)
+      return;
+    const n = this.dynamicUrlTrustedOrigin;
+    n && n !== t && !this.isExplicitDomainTrust(n) && this.messenger.removeTrustedDomain(n), this.messenger.addTrustedDomain(t), this.dynamicUrlTrustedOrigin = t;
+  }
   /**
    * Creates the prop context passed to prop callbacks and validators.
    * @internal
@@ -2312,10 +2399,10 @@ class Q {
     if (!e)
       throw new Error("Container is required for rendering");
     if (typeof e == "string") {
-      const s = document.querySelector(e);
-      if (!s)
+      const t = document.querySelector(e);
+      if (!t)
         throw new Error(`Container "${e}" not found`);
-      return s;
+      return t;
     }
     return e;
   }
@@ -2335,10 +2422,10 @@ class Q {
    */
   async prerender() {
     if (!this.container) return;
-    const e = this.options.prerenderTemplate ?? ft, s = this.options.containerTemplate ?? dt, n = this.options.dimensions, i = this.props.cspNonce;
+    const e = this.options.prerenderTemplate ?? yt, t = this.options.containerTemplate ?? gt, n = this.resolveDimensions(), i = this.props.cspNonce;
     if (this.context === p.IFRAME) {
       const c = this.buildWindowName();
-      this.iframe = this.createIframeElement(c), fe(this.iframe);
+      this.iframe = this.createIframeElement(c), ge(this.iframe);
     }
     const r = {
       uid: this.uid,
@@ -2368,7 +2455,7 @@ class Q {
       close: () => this.close(),
       focus: () => this.focus(),
       cspNonce: i
-    }, a = s(o);
+    }, a = t(o);
     a && (this.container.appendChild(a), this.container = a), this.prerenderElement && !this.prerenderElement.parentNode && this.container.appendChild(this.prerenderElement), this.iframe && !this.iframe.parentNode && this.container.appendChild(this.iframe);
   }
   /**
@@ -2377,82 +2464,112 @@ class Q {
    * @internal
    */
   createIframeElement(e) {
-    const s = document.createElement("iframe"), n = this.options.dimensions, i = typeof this.options.attributes == "function" ? this.options.attributes(this.props) : this.options.attributes ?? {}, r = typeof this.options.style == "function" ? this.options.style(this.props) : this.options.style ?? {};
-    s.name = e, s.setAttribute("frameborder", "0"), s.setAttribute("allowtransparency", "true"), s.setAttribute("scrolling", "auto"), n.width !== void 0 && (s.style.width = typeof n.width == "number" ? `${n.width}px` : n.width), n.height !== void 0 && (s.style.height = typeof n.height == "number" ? `${n.height}px` : n.height);
+    const t = document.createElement("iframe"), n = this.resolveDimensions(), i = typeof this.options.attributes == "function" ? this.options.attributes(this.props) : this.options.attributes ?? {}, r = typeof this.options.style == "function" ? this.options.style(this.props) : this.options.style ?? {};
+    t.name = e, t.setAttribute("frameborder", "0"), t.setAttribute("allowtransparency", "true"), t.setAttribute("scrolling", "auto"), n.width !== void 0 && (t.style.width = typeof n.width == "number" ? `${n.width}px` : n.width), n.height !== void 0 && (t.style.height = typeof n.height == "number" ? `${n.height}px` : n.height);
     for (const [o, a] of Object.entries(i))
-      a !== void 0 && (typeof a == "boolean" ? a && s.setAttribute(o, "") : s.setAttribute(o, a));
+      a !== void 0 && (typeof a == "boolean" ? a && t.setAttribute(o, "") : t.setAttribute(o, a));
     for (const [o, a] of Object.entries(r)) {
       if (a === void 0) continue;
       const c = typeof a == "number" ? `${a}px` : a;
-      s.style.setProperty(
+      t.style.setProperty(
         o.replace(/([A-Z])/g, "-$1").toLowerCase(),
         String(c)
       );
     }
-    return i.sandbox || s.setAttribute(
+    return i.sandbox || t.setAttribute(
       "sandbox",
       "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox"
-    ), s;
+    ), t;
   }
   /**
    * Opens the host window (iframe or popup).
    * @internal
    */
   async open() {
-    const e = this.buildUrl();
+    const e = this.resolveUrl();
+    this.syncTrustedDomainForUrl(e), this.openedHostDomain = this.resolveUrlOrigin(e);
+    const t = this.buildUrl(e), n = this.buildBodyParams(), i = n.toString().length > 0;
     if (this.context === p.IFRAME) {
       if (!this.iframe)
         throw new Error("Iframe not created during prerender");
-      this.iframe.src = e, this.hostWindow = this.iframe.contentWindow;
+      i ? this.submitBodyForm(this.iframe.name, t, n) : this.iframe.src = t, this.hostWindow = this.iframe.contentWindow;
     } else {
-      const s = this.buildWindowName();
-      this.hostWindow = ot({
-        url: e,
-        name: s,
-        dimensions: this.options.dimensions
-      });
-      const n = ut(this.hostWindow, () => {
+      const r = this.buildWindowName();
+      this.hostWindow = ut({
+        url: i ? "about:blank" : t,
+        name: r,
+        dimensions: this.resolveDimensions()
+      }), i && this.submitBodyForm(r, t, n);
+      const o = pt(this.hostWindow, () => {
         this.destroy();
       });
-      this.cleanup.register(n);
+      this.cleanup.register(o);
     }
-    this.hostWindow && Be(this.uid, this.hostWindow);
+    this.hostWindow && Je(this.uid, this.hostWindow);
   }
   /**
    * Builds the URL for the host window including query parameters.
    * @internal
    */
-  buildUrl() {
-    const e = typeof this.options.url == "function" ? this.options.url(this.props) : this.options.url, n = Ye(this.props, this.options.props).toString();
+  buildUrl(e = this.resolveUrl()) {
+    const n = Ze(this.props, this.options.props).toString();
     if (!n) return e;
     const i = e.includes("?") ? "&" : "?";
     return `${e}${i}${n}`;
   }
+  /**
+   * Builds POST body parameters from props marked with bodyParam.
+   * @internal
+   */
+  buildBodyParams() {
+    return Qe(this.props, this.options.props);
+  }
+  /**
+   * Submits a hidden form to navigate a target window via POST.
+   * @internal
+   */
+  submitBodyForm(e, t, n) {
+    const i = this.container?.ownerDocument ?? document, r = i.body ?? i.documentElement;
+    if (!r)
+      throw new Error("Document root is unavailable for bodyParam form submission");
+    const o = i.createElement("form");
+    o.method = "POST", o.action = t, o.target = e, o.style.display = "none";
+    for (const [a, c] of n.entries()) {
+      const l = i.createElement("input");
+      l.type = "hidden", l.name = a, l.value = c, o.appendChild(l);
+    }
+    r.appendChild(o);
+    try {
+      o.submit();
+    } finally {
+      o.remove();
+    }
+  }
   /**
    * Builds the window.name payload for the host window.
    * @internal
    */
   buildWindowName() {
-    const e = this.getHostDomain(), s = ue(
+    const e = this.getHostDomain(), t = fe(
       this.props,
       this.options.props,
       e,
       !1
       // Assume cross-domain for initial payload
-    ), n = he(
-      s,
+    ), n = pe(
+      t,
       this.options.props,
       this.bridge
-    ), i = this.buildNestedHostRefs(), r = Me({
+    ), i = this.buildNestedHostRefs(), r = Be({
       uid: this.uid,
       tag: this.options.tag,
       context: this.context,
-      consumerDomain: j(),
+      consumerDomain: q(),
       props: n,
       exports: this.createConsumerExports(),
       children: i
     });
-    return He(r);
+    return We(r);
   }
   /**
    * Builds component references for nested host components.
@@ -2460,15 +2577,24 @@ class Q {
    */
   buildNestedHostRefs() {
     if (!this.options.children) return;
-    const e = this.options.children({ props: this.props }), s = {};
+    const e = this.options.children({ props: this.props }), t = {};
     for (const [n, i] of Object.entries(e)) {
-      const r = i;
-      s[n] = {
-        tag: r.tag ?? n,
-        url: typeof r.url == "function" ? r.url.toString() : r.url ?? ""
+      const r = Ct(i);
+      if (!r)
+        throw new Error(`Nested component "${n}" is missing component metadata`);
+      if (typeof r.url != "string")
+        throw new Error(
+          `Nested component "${n}" must use a static string URL. Function URLs are not supported in children.`
+        );
+      t[n] = {
+        tag: r.tag,
+        url: r.url,
+        props: r.props,
+        dimensions: typeof r.dimensions == "function" ? void 0 : r.dimensions,
+        defaultContext: r.defaultContext
       };
     }
-    return Object.keys(s).length > 0 ? s : void 0;
+    return Object.keys(t).length > 0 ? t : void 0;
   }
   /**
    * Creates the exports object sent to the host.
@@ -2491,21 +2617,16 @@ class Q {
    * @internal
    */
   getHostDomain() {
-    const e = typeof this.options.url == "function" ? this.options.url(this.props) : this.options.url;
-    try {
-      return new URL(e, window.location.origin).origin;
-    } catch {
-      return "*";
-    }
+    return this.openedHostDomain ? this.openedHostDomain : this.resolveUrlOrigin(this.resolveUrl()) ?? "*";
   }
   /**
    * Waits for the host to send the init message.
    * @internal
    */
   async waitForHost() {
-    this.initPromise = ge();
+    this.initPromise = _e();
     try {
-      await Ne(
+      await ke(
         this.initPromise.promise,
         this.options.timeout,
         `Host component "${this.options.tag}" (uid: ${this._uid}) did not initialize within ${this.options.timeout}ms. Check that the host page loads correctly and calls the initialization code.`
@@ -2522,21 +2643,21 @@ class Q {
     this.messenger.on(u.INIT, () => (this.initPromise && this.initPromise.resolve(), { success: !0 })), this.messenger.on(u.CLOSE, async () => (await this.close(), { success: !0 })), this.messenger.on(u.RESIZE, async (e) => (await this.resize(e), { success: !0 })), this.messenger.on(u.FOCUS, async () => (await this.focus(), { success: !0 })), this.messenger.on(u.SHOW, async () => (await this.show(), { success: !0 })), this.messenger.on(u.HIDE, async () => (await this.hide(), { success: !0 })), this.messenger.on(
       u.ERROR,
       async (e) => {
-        const s = new Error(e.message);
-        return s.stack = e.stack, this.handleError(s), { success: !0 };
+        const t = new Error(e.message);
+        return t.stack = e.stack, this.handleError(t), { success: !0 };
       }
     ), this.messenger.on(u.EXPORT, async (e) => (this.exports = e, { success: !0 })), this.messenger.on(u.CONSUMER_EXPORT, async (e) => (this.consumerExports = e, { success: !0 })), this.messenger.on(
       u.GET_SIBLINGS,
       async (e) => {
-        const s = [], n = Pt(e.tag);
+        const t = [], n = xt(e.tag);
         if (n)
           for (const i of n.instances)
-            i.uid !== e.uid && s.push({
+            i.uid !== e.uid && t.push({
               uid: i.uid,
               tag: e.tag,
               exports: i.exports
             });
-        return s;
+        return t;
       }
     );
   }
@@ -2546,7 +2667,7 @@ class Q {
    */
   setupCleanup() {
     this.cleanup.register(() => {
-      this.messenger.destroy(), this.bridge.destroy(), this.event.removeAllListeners(), Je(this.uid);
+      this.messenger.destroy(), this.bridge.destroy(), Xe(this.uid);
     });
   }
   /**
@@ -2560,11 +2681,11 @@ class Q {
    * Calls a prop callback if it exists.
    * @internal
    */
-  callPropCallback(e, ...s) {
+  callPropCallback(e, ...t) {
     const n = this.props[e];
     if (typeof n == "function")
       try {
-        const i = n(...s);
+        const i = n(...t);
         i && typeof i == "object" && "catch" in i && typeof i.catch == "function" && i.catch((r) => {
           console.error(`Error in async ${e} callback:`, r);
         });
@@ -2579,18 +2700,20 @@ class Q {
   async destroy() {
     this.destroyed || (this.destroyed = !0, this.initPromise && (this.initPromise.reject(
       new Error(`Component "${this.options.tag}" was destroyed before initialization completed`)
-    ), this.initPromise = null), this.iframe && (tt(this.iframe), this.iframe = null), this.context === p.POPUP && this.hostWindow && at(this.hostWindow), this.hostWindow = null, this.prerenderElement && (this.prerenderElement.remove(), this.prerenderElement = null), await this.cleanup.cleanup(), this.event.emit(f.DESTROY), this.callPropCallback("onDestroy"));
+    ), this.initPromise = null), this.iframe && (rt(this.iframe), this.iframe = null), this.context === p.POPUP && this.hostWindow && ht(this.hostWindow), this.hostWindow = null, this.openedHostDomain = null, this.dynamicUrlTrustedOrigin = null, this.prerenderElement && (this.prerenderElement.remove(), this.prerenderElement = null), await this.cleanup.cleanup(), this.event.emit(f.DESTROY), this.callPropCallback("onDestroy"), this.event.removeAllListeners());
   }
 }
-class yt {
+class bt {
   /**
    * Creates a new HostComponent instance.
    *
    * @param payload - The payload parsed from window.name
    * @param propDefinitions - Optional prop definitions for deserialization
+   * @param allowedConsumerDomains - Optional allowlist of consumer domains
+   * @param deferInit - Whether to defer INIT until a later explicit flush
    */
-  constructor(e, s = {}) {
-    this.propDefinitions = s, this.uid = e.uid, this.tag = e.tag, this.consumerDomain = e.consumerDomain, this.event = new me(), this.messenger = new ye(this.uid, window, j(), this.consumerDomain), this.setupMessageHandlers(), this.consumerWindow = this.resolveConsumerWindow(), this.bridge = new B(this.messenger), this.hostProps = this.buildHostProps(e), window.hostProps = this.hostProps, this.sendInit();
+  constructor(e, t = {}, n, i = !1) {
+    this.propDefinitions = t, this.allowedConsumerDomains = n, this.deferInit = i, this.uid = e.uid, this.tag = e.tag, this.consumerDomain = e.consumerDomain, this.validateConsumerDomain(), this.event = new we(), this.messenger = new Ee(this.uid, window, q(), this.consumerDomain), this.setupMessageHandlers(), this.consumerWindow = this.resolveConsumerWindow(), this.bridge = new J(this.messenger), this.hostProps = this.buildHostProps(e), this.exposeHostProps(), this.deferInit || this.flushInit();
   }
   /** The hostProps object containing props and control methods passed from the consumer. */
   hostProps;
@@ -2614,6 +2737,59 @@ class yt {
   consumerProps;
   /** @internal */
   initError = null;
+  /** @internal */
+  destroyed = !1;
+  /** @internal */
+  initSent = !1;
+  /** @internal */
+  deferredInitFlushScheduled = !1;
+  /**
+   * Ensures the INIT handshake is sent at most once.
+   * @internal
+   */
+  flushInit() {
+    this.destroyed || this.initSent || (this.initSent = !0, this.sendInit());
+  }
+  /**
+   * Schedules deferred INIT flush on the next microtask.
+   * This preserves legacy hostProps-only usage while giving same-tick
+   * host configuration a chance to run allowlist checks first.
+   * @internal
+   */
+  scheduleDeferredInitFlush() {
+    this.deferredInitFlushScheduled || this.destroyed || this.initSent || (this.deferredInitFlushScheduled = !0, queueMicrotask(() => {
+      this.deferredInitFlushScheduled = !1, this.flushInit();
+    }));
+  }
+  /**
+   * Exposes hostProps on window and lazily flushes deferred init on first access.
+   * @internal
+   */
+  exposeHostProps() {
+    const e = window;
+    try {
+      Object.defineProperty(e, "hostProps", {
+        configurable: !0,
+        enumerable: !0,
+        get: () => (this.deferInit && !this.initSent && !this.destroyed && this.scheduleDeferredInitFlush(), this.hostProps),
+        set: (t) => {
+          t && (this.hostProps = t);
+        }
+      });
+    } catch {
+      e.hostProps = this.hostProps;
+    }
+  }
+  /**
+   * Validates that the consumer domain is allowed.
+   * @internal
+   */
+  validateConsumerDomain() {
+    if (this.allowedConsumerDomains && !L(this.allowedConsumerDomains, this.consumerDomain))
+      throw new Error(
+        `Consumer domain "${this.consumerDomain}" is not allowed for component "${this.tag}"`
+      );
+  }
   /**
    * Returns the hostProps object.
    *
@@ -2627,12 +2803,12 @@ class yt {
    * @internal
    */
   resolveConsumerWindow() {
-    if (Le()) {
-      const e = Fe();
+    if (Ue()) {
+      const e = Ae();
       if (e) return e;
     }
-    if (Ae()) {
-      const e = $e();
+    if (Me()) {
+      const e = He();
       if (e) return e;
     }
     throw new Error("Could not resolve consumer window");
@@ -2642,7 +2818,7 @@ class yt {
    * @internal
    */
   buildHostProps(e) {
-    const s = de(
+    const t = me(
       e.props,
       this.propDefinitions,
       this.messenger,
@@ -2650,8 +2826,8 @@ class yt {
       this.consumerWindow,
       this.consumerDomain
     );
-    return this.consumerProps = s, {
-      ...s,
+    return this.consumerProps = t, {
+      ...t,
       uid: this.uid,
       tag: this.tag,
       close: () => this.close(),
@@ -2685,11 +2861,11 @@ class yt {
         { uid: this.uid, tag: this.tag }
       );
     } catch (e) {
-      const s = e instanceof Error ? e : new Error(String(e));
-      this.initError = s, this.event.emit(f.ERROR, {
+      const t = e instanceof Error ? e : new Error(String(e));
+      this.initError = t, this.event.emit(f.ERROR, {
         type: "init_failed",
-        message: `Failed to initialize host component: ${s.message}`,
-        error: s
+        message: `Failed to initialize host component: ${t.message}`,
+        error: t
       }), console.error("Failed to send init message:", e);
     }
   }
@@ -2827,10 +3003,10 @@ class yt {
    */
   buildNestedComponents(e) {
     if (!e) return;
-    const s = {};
+    const t = {};
     for (const [n, i] of Object.entries(e))
       try {
-        s[n] = Se({
+        t[n] = xe({
           tag: i.tag,
           url: i.url,
           props: i.props,
@@ -2840,7 +3016,7 @@ class yt {
       } catch (r) {
         console.warn(`Failed to create nested component "${n}":`, r);
       }
-    return Object.keys(s).length > 0 ? s : void 0;
+    return Object.keys(t).length > 0 ? t : void 0;
   }
   /**
    * Sets up message handlers for consumer communication.
@@ -2849,7 +3025,7 @@ class yt {
   setupMessageHandlers() {
     this.messenger.on(u.PROPS, (e) => {
       try {
-        const s = de(
+        const t = me(
           e,
           this.propDefinitions,
           this.messenger,
@@ -2857,16 +3033,16 @@ class yt {
           this.consumerWindow,
           this.consumerDomain
         );
-        Object.assign(this.hostProps, s);
+        Object.assign(this.hostProps, t);
         for (const n of this.propsHandlers)
           try {
-            n(s);
+            n(t);
           } catch (i) {
             console.error("Error in props handler:", i);
           }
-        return this.event.emit(f.PROPS, s), { success: !0 };
-      } catch (s) {
-        const n = s instanceof Error ? s : new Error(String(s));
+        return this.event.emit(f.PROPS, t), { success: !0 };
+      } catch (t) {
+        const n = t instanceof Error ? t : new Error(String(t));
         throw console.error("Error deserializing props:", n), this.event.emit(f.ERROR, n), n;
       }
     });
@@ -2875,145 +3051,172 @@ class yt {
    * Destroys the host component and cleans up resources.
    */
   destroy() {
-    this.messenger.destroy(), this.bridge.destroy(), this.event.removeAllListeners(), this.propsHandlers.clear();
+    this.destroyed || (this.destroyed = !0, this.deferredInitFlushScheduled = !1, this.messenger.destroy(), this.bridge.destroy(), this.event.removeAllListeners(), this.propsHandlers.clear());
   }
 }
-let v = null;
-function xe(t) {
-  if (v)
-    return v;
-  if (!J())
+let g = null;
+function ne(s, e, t = {}) {
+  if (g) {
+    if (e) {
+      const i = g.getProps().getConsumerDomain();
+      if (!L(e, i))
+        throw vt(), new Error(
+          `Consumer domain "${i}" is not allowed for this host component`
+        );
+    }
+    return t.deferInit || g.flushInit(), g;
+  }
+  if (!X())
     return null;
-  const e = Ue();
-  return e ? (v = new yt(
+  const n = Ve();
+  return n ? (g = new bt(
+    n,
+    s,
     e,
-    t
-  ), v) : (console.error("Failed to parse ForgeFrame payload from window.name"), null);
+    t.deferInit ?? !1
+  ), g) : (console.error("Failed to parse ForgeFrame payload from window.name"), null);
 }
-function _t() {
-  return J();
+function Pt() {
+  return X();
 }
-function wt() {
-  return J();
+function Ot() {
+  return X();
 }
-function Et() {
+function Rt() {
   return window.hostProps;
 }
-const S = /* @__PURE__ */ new Map();
-function bt(t) {
-  if (!t.tag)
+function vt() {
+  g && (g.destroy(), g = null), delete window.hostProps;
+}
+const C = /* @__PURE__ */ new Map(), Se = /* @__PURE__ */ Symbol("forgeframe.component.options");
+function St(s) {
+  if (!s.tag)
     throw new Error("Component tag is required");
-  if (!/^[a-z][a-z0-9-]*$/.test(t.tag))
+  if (!/^[a-z][a-z0-9-]*$/.test(s.tag))
     throw new Error(
-      `Invalid component tag "${t.tag}". Must start with lowercase letter and contain only lowercase letters, numbers, and hyphens.`
+      `Invalid component tag "${s.tag}". Must start with lowercase letter and contain only lowercase letters, numbers, and hyphens.`
     );
-  if (!t.url)
+  if (!s.url)
     throw new Error("Component url is required");
-  if (typeof t.url == "string")
+  if (typeof s.url == "string")
     try {
-      new URL(t.url, window.location.origin);
+      new URL(s.url, window.location.origin);
     } catch {
       throw new Error(
-        `Invalid component URL "${t.url}". Must be a valid absolute or relative URL.`
+        `Invalid component URL "${s.url}". Must be a valid absolute or relative URL.`
       );
     }
-  if (S.has(t.tag))
-    throw new Error(`Component "${t.tag}" is already registered`);
+  if (C.has(s.tag))
+    throw new Error(`Component "${s.tag}" is already registered`);
 }
-function Se(t) {
-  bt(t);
+function xe(s) {
+  St(s);
   const e = [];
-  let s;
-  if (H(t.tag)) {
-    const i = xe(t.props);
-    i && (s = i.hostProps);
+  let t;
+  if (W(s.tag)) {
+    const i = ne(s.props, s.allowedConsumerDomains);
+    i && (t = i.hostProps);
   }
   const n = function(i = {}) {
-    const r = new Q(t, i);
+    const r = new se(s, i);
     return e.push(r), r.event.once("destroy", () => {
       const o = e.indexOf(r);
       o !== -1 && e.splice(o, 1);
     }), r;
   };
-  return n.instances = e, n.isHost = () => H(t.tag), n.isEmbedded = () => H(t.tag), n.hostProps = s, n.canRenderTo = async (i) => {
+  return n.instances = e, n.isHost = () => W(s.tag), n.isEmbedded = () => W(s.tag), n.hostProps = t, n[Se] = s, n.canRenderTo = async (i) => {
     try {
-      return !!(_e(i) || t.domain);
+      return !!(be(i) || s.domain);
     } catch {
       return !1;
     }
-  }, S.set(t.tag, n), n;
+  }, C.set(s.tag, n), n;
 }
-function Pt(t) {
-  return S.get(t);
+function xt(s) {
+  return C.get(s);
 }
-async function Rt(t) {
-  await t.close();
+function Ct(s) {
+  return s[Se];
 }
-async function Oe(t) {
-  const e = S.get(t);
+async function Dt(s) {
+  await s.close();
+}
+async function Ce(s) {
+  const e = C.get(s);
   if (!e) return;
-  const s = [...e.instances];
-  await Promise.all(s.map((n) => n.close()));
+  const t = [...e.instances];
+  await Promise.all(t.map((n) => n.close()));
+}
+async function It() {
+  const s = Array.from(C.keys());
+  await Promise.all(s.map((e) => Ce(e)));
 }
-async function xt() {
-  const t = Array.from(S.keys());
-  await Promise.all(t.map((e) => Oe(e)));
+function Tt(s, e) {
+  const t = Object.keys(s), n = Object.keys(e);
+  if (t.length !== n.length)
+    return !1;
+  for (const i of t)
+    if (!Object.prototype.hasOwnProperty.call(e, i) || !Object.is(s[i], e[i]))
+      return !1;
+  return !0;
 }
-function St(t, e) {
-  const { React: s } = e, { createElement: n, useRef: i, useEffect: r, useState: o, forwardRef: a } = s, c = a(
-    function(g, y) {
+function Ft(s, e) {
+  const { React: t } = e, { createElement: n, useRef: i, useEffect: r, useState: o, forwardRef: a } = t, c = a(
+    function(w, _) {
       const {
-        onRendered: b,
-        onError: O,
-        onClose: ee,
-        context: Ce,
-        className: te,
-        style: se,
-        ...F
-      } = g, C = i(null), L = i(null), [ne, ve] = o(null);
+        onRendered: O,
+        onError: v,
+        onClose: ie,
+        context: De,
+        className: re,
+        style: oe,
+        ...H
+      } = w, D = i(null), A = i(null), U = i(null), [ae, Ie] = o(null);
       return r(() => {
-        const x = C.current;
-        if (!x) return;
-        const _ = t(F);
-        return L.current = _, b && _.event.once("rendered", b), ee && _.event.once("close", ee), O && _.event.on("error", O), _.render(x, Ce).catch((ie) => {
-          ve(ie), O?.(ie);
+        const S = D.current;
+        if (!S) return;
+        const m = s(H);
+        return A.current = m, O && m.event.once("rendered", O), ie && m.event.once("close", ie), v && m.event.on("error", v), m.render(S, De).catch((x) => {
+          Ie(x), v?.(x);
         }), () => {
-          _.close().catch(() => {
-          }), L.current = null;
+          m.close().catch(() => {
+          }), A.current = null, U.current = null;
         };
       }, []), r(() => {
-        const x = L.current;
-        x && x.updateProps(F).catch((_) => {
-          O?.(_);
-        });
-      }, [JSON.stringify(F)]), r(() => {
-        y && typeof y == "object" && C.current && (y.current = C.current);
-      }, [y]), ne ? n(
+        const S = A.current;
+        if (!S) return;
+        const m = H, x = U.current;
+        x && Tt(x, m) || (U.current = m, S.updateProps(m).catch((Te) => {
+          v?.(Te);
+        }));
+      }, [H, v]), r(() => {
+        _ && typeof _ == "object" && D.current && (_.current = D.current);
+      }, [_]), ae ? n(
         "div",
         {
-          className: te,
-          style: { color: "red", padding: "16px", ...se }
+          className: re,
+          style: { color: "red", padding: "16px", ...oe }
         },
-        `Error: ${ne.message}`
+        `Error: ${ae.message}`
       ) : n("div", {
-        ref: C,
-        className: te,
+        ref: D,
+        className: re,
         style: {
           display: "inline-block",
-          ...se
+          ...oe
         }
       });
     }
-  ), l = `ForgeFrame(${t.name || "Component"})`;
+  ), l = `ForgeFrame(${s.name || "Component"})`;
   return c.displayName = l, c;
 }
-function Ot(t) {
-  return function(s) {
-    return St(s, { React: t });
+function kt(s) {
+  return function(t) {
+    return Ft(t, { React: s });
   };
 }
-xe();
-const Ct = {
+ne(void 0, void 0, { deferInit: !0 });
+const $t = {
   /**
    * Create a new component definition.
    *
@@ -3038,23 +3241,23 @@ const Ct = {
    * await instance.render('#container');
    * ```
    */
-  create: Se,
+  create: xe,
   /**
    * Destroy a single component instance.
    *
    * @param instance - The component instance to destroy
    */
-  destroy: Rt,
+  destroy: Dt,
   /**
    * Destroy all instances of a specific component by tag.
    *
    * @param tag - The component tag name
    */
-  destroyByTag: Oe,
+  destroyByTag: Ce,
   /**
    * Destroy all ForgeFrame component instances.
    */
-  destroyAll: xt,
+  destroyAll: It,
   /**
    * Check if the current window is a host component context.
    *
@@ -3064,7 +3267,7 @@ const Ct = {
    *
    * @returns True if running inside a ForgeFrame iframe/popup
    */
-  isHost: _t,
+  isHost: Pt,
   /**
    * Check if the current window is embedded by ForgeFrame.
    *
@@ -3073,7 +3276,7 @@ const Ct = {
    *
    * @returns True if running inside a ForgeFrame iframe/popup
    */
-  isEmbedded: wt,
+  isEmbedded: Ot,
   /**
    * Get hostProps from the current host window.
    *
@@ -3082,7 +3285,18 @@ const Ct = {
    *
    * @returns The hostProps object if in host context, undefined otherwise
    */
-  getHostProps: Et,
+  getHostProps: Rt,
+  /**
+   * Flush host initialization in embedded contexts.
+   *
+   * @remarks
+   * Only required in host pages that access `window.hostProps` directly
+   * without defining a component via `ForgeFrame.create(...)`.
+   * When `create()` is used on the host side, init is flushed automatically.
+   *
+   * @returns The host component instance if running embedded, otherwise null
+   */
+  initHost: ne,
   /**
    * Serialization strategy constants.
    * @see {@link PROP_SERIALIZATION}
@@ -3101,11 +3315,11 @@ const Ct = {
   /**
    * Error thrown when popup window fails to open.
    */
-  PopupOpenError: Re,
+  PopupOpenError: ve,
   /**
    * Current library version.
    */
-  VERSION: pe,
+  VERSION: ye,
   /**
    * Check if a value is a Standard Schema (Zod, Valibot, ArkType, etc.)
    *
@@ -3122,7 +3336,7 @@ const Ct = {
    * }
    * ```
    */
-  isStandardSchema: E,
+  isStandardSchema: b,
   /**
    * Prop schema builders for defining component props.
    *
@@ -3148,32 +3362,33 @@ const Ct = {
   prop: d
 };
 export {
-  K as AnySchema,
-  T as ArraySchema,
-  X as BooleanSchema,
+  te as AnySchema,
+  N as ArraySchema,
+  Y as BooleanSchema,
   p as CONTEXT,
   f as EVENT,
-  G as EnumSchema,
-  Ct as ForgeFrame,
-  Y as FunctionSchema,
-  Z as LiteralSchema,
-  q as NumberSchema,
+  ee as EnumSchema,
+  $t as ForgeFrame,
+  Z as FunctionSchema,
+  Q as LiteralSchema,
+  G as NumberSchema,
   k as ObjectSchema,
   I as PROP_SERIALIZATION,
-  Re as PopupOpenError,
-  m as PropSchema,
-  V as StringSchema,
-  pe as VERSION,
-  Se as create,
-  St as createReactComponent,
-  Ct as default,
-  Rt as destroy,
-  xt as destroyAll,
-  Oe as destroyByTag,
-  Et as getHostProps,
-  wt as isEmbedded,
-  _t as isHost,
-  E as isStandardSchema,
+  ve as PopupOpenError,
+  y as PropSchema,
+  K as StringSchema,
+  ye as VERSION,
+  xe as create,
+  Ft as createReactComponent,
+  $t as default,
+  Dt as destroy,
+  It as destroyAll,
+  Ce as destroyByTag,
+  Rt as getHostProps,
+  ne as initHost,
+  Ot as isEmbedded,
+  Pt as isHost,
+  b as isStandardSchema,
   d as prop,
-  Ot as withReactComponent
+  kt as withReactComponent
 };