forgeframe 0.0.6 → 0.0.9

package/dist/forgeframe.js

@@ -1,9 +1,9 @@
-const m = {
+const f = {
   /** Render component in an iframe */
   IFRAME: "iframe",
   /** Render component in a popup window */
   POPUP: "popup"
-}, p = {
+}, g = {
   /** Emitted when rendering starts */
   RENDER: "render",
   /** Emitted when component is fully rendered and initialized */
@@ -26,14 +26,14 @@ const m = {
   RESIZE: "resize",
   /** Emitted when component receives focus */
   FOCUS: "focus"
-}, U = {
+}, A = {
   /** Default JSON serialization */
   JSON: "json",
   /** Base64 encoding for binary or large data */
   BASE64: "base64",
-  /** Dot notation for nested objects (e.g., "a.b.c=value") */
+  /** Explicit framed-path encoding for nested objects */
   DOTIFY: "dotify"
-}, F = {
+}, z = {
   /** Request message expecting a response */
   REQUEST: "request",
   /** Response to a previous request */
@@ -63,14 +63,14 @@ const m = {
   CONSUMER_EXPORT: "forgeframe_consumer_export",
   /** Get sibling components request */
   GET_SIBLINGS: "forgeframe_get_siblings"
-}, H = "__forgeframe__", xe = (() => {
-  if ("0.0.6".trim().length === 0)
+}, M = "__forgeframe__", se = (() => {
+  if ("0.0.9".trim().length === 0)
     throw new Error(
       "ForgeFrame VERSION injection is missing. Configure __FORGEFRAME_VERSION__ in build/test tooling."
     );
-  return "0.0.6";
+  return "0.0.9";
 })();
-class Re {
+class Ie {
   /**
    * Internal storage for event listeners mapped by event name.
    * @internal
@@ -118,8 +118,8 @@ class Re {
    * @public
    */
   once(e, t) {
-    const n = (r) => (this.off(e, n), t(r));
-    return this.on(e, n);
+    const s = (r) => (this.off(e, s), t(r));
+    return this.on(e, s);
   }
   /**
    * Emits an event, invoking all registered handlers with the provided data.
@@ -141,9 +141,9 @@ class Re {
    * @public
    */
   emit(e, t) {
-    const n = this.listeners.get(e);
-    if (n)
-      for (const r of n)
+    const s = this.listeners.get(e);
+    if (s)
+      for (const r of s)
         try {
           const i = r(t);
           i && typeof i == "object" && "catch" in i && typeof i.catch == "function" && i.catch((o) => {
@@ -179,8 +179,8 @@ class Re {
       this.listeners.delete(e);
       return;
     }
-    const n = this.listeners.get(e);
-    n && (n.delete(t), n.size === 0 && this.listeners.delete(e));
+    const s = this.listeners.get(e);
+    s && (s.delete(t), s.size === 0 && this.listeners.delete(e));
   }
   /**
    * Removes all event listeners from the emitter.
@@ -221,14 +221,14 @@ class Re {
     return this.listeners.get(e)?.size ?? 0;
   }
 }
-function Me() {
-  const s = Date.now().toString(36), e = Math.random().toString(36).slice(2, 11);
-  return `${s}_${e}`;
+function qe() {
+  const n = Date.now().toString(36), e = Math.random().toString(36).slice(2, 11);
+  return `${n}_${e}`;
 }
-function N() {
+function L() {
   return Math.random().toString(36).slice(2, 11);
 }
-class We {
+class Je {
   /**
    * Array of registered cleanup tasks awaiting execution.
    * @internal
@@ -301,8 +301,8 @@ class We {
     for (const t of e)
       try {
         await t();
-      } catch (n) {
-        console.error("Error in cleanup task:", n);
+      } catch (s) {
+        console.error("Error in cleanup task:", s);
       }
   }
   /**
@@ -345,123 +345,123 @@ class We {
     this.tasks = [], this.cleaned = !1;
   }
 }
-function Oe() {
-  let s, e;
-  return { promise: new Promise((n, r) => {
-    s = n, e = r;
-  }), resolve: s, reject: e };
+function Se() {
+  let n, e;
+  return { promise: new Promise((s, r) => {
+    n = s, e = r;
+  }), resolve: n, reject: e };
 }
-function Be(s, e, t = "Operation timed out") {
-  return new Promise((n, r) => {
+function Ke(n, e, t = "Operation timed out") {
+  return new Promise((s, r) => {
     const i = setTimeout(() => {
       r(new Error(`${t} (${e}ms)`));
     }, e);
-    s.then((o) => {
-      clearTimeout(i), n(o);
+    n.then((o) => {
+      clearTimeout(i), s(o);
     }).catch((o) => {
       clearTimeout(i), r(o);
     });
   });
 }
-const O = /* @__PURE__ */ new Map(), je = 200;
-function Ve(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const I = /* @__PURE__ */ new Map(), Ye = 200;
+function Xe(n) {
+  return n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Ke(s) {
-  if (!s.includes("*"))
+function Ge(n) {
+  if (!n.includes("*"))
     return null;
-  const e = O.get(s);
+  const e = I.get(n);
   if (e)
     return e;
-  const t = s.split("*").map((r) => Ve(r)).join(".*"), n = new RegExp(`^${t}$`);
-  if (O.size >= je) {
-    const r = O.keys().next().value;
-    r && O.delete(r);
+  const t = n.split("*").map((r) => Xe(r)).join(".*"), s = new RegExp(`^${t}$`);
+  if (I.size >= Ye) {
+    const r = I.keys().next().value;
+    r && I.delete(r);
   }
-  return O.set(s, n), n;
+  return I.set(n, s), s;
 }
-function qe(s, e) {
-  return s.global || s.sticky ? new RegExp(s.source, s.flags.replace(/[gy]/g, "")).test(e) : s.test(e);
+function Ze(n, e) {
+  return n.global || n.sticky ? new RegExp(n.source, n.flags.replace(/[gy]/g, "")).test(e) : n.test(e);
 }
-function K(s = window) {
+function k(n = window) {
   try {
-    return s.location.origin;
+    return n.location.origin;
   } catch {
     return "";
   }
 }
-function Je(s, e = window) {
+function ve(n, e = window) {
   try {
-    return s.location.origin === e.location.origin;
+    return n.location.origin === e.location.origin;
   } catch {
     return !1;
   }
 }
-function C(s, e) {
-  if (typeof s == "string") {
-    if (s === "*") return !0;
-    const t = Ke(s);
-    return t ? t.test(e) : s === e;
+function v(n, e) {
+  if (typeof n == "string") {
+    if (n === "*") return !0;
+    const t = Ge(n);
+    return t ? t.test(e) : n === e;
   }
-  return s instanceof RegExp ? qe(s, e) : Array.isArray(s) ? s.some((t) => C(t, e)) : !1;
+  return n instanceof RegExp ? Ze(n, e) : Array.isArray(n) ? n.some((t) => v(t, e)) : !1;
 }
-function q(s) {
-  if (!s) return !0;
+function Z(n) {
+  if (!n) return !0;
   try {
-    return s.closed;
+    return n.closed;
   } catch {
     return !0;
   }
 }
-function Xe(s = window) {
+function Qe(n = window) {
   try {
-    return s.opener;
+    return n.opener;
   } catch {
     return null;
   }
 }
-function Ye(s = window) {
+function et(n = window) {
   try {
-    const e = s.parent;
-    return e && e !== s ? e : null;
+    const e = n.parent;
+    return e && e !== n ? e : null;
   } catch {
     return null;
   }
 }
-function Ge(s = window) {
+function tt(n = window) {
   try {
-    return s.parent !== s;
+    return n.parent !== n;
   } catch {
     return !0;
   }
 }
-function Ze(s = window) {
+function nt(n = window) {
   try {
-    return s.opener !== null && s.opener !== void 0;
+    return n.opener !== null && n.opener !== void 0;
   } catch {
     return !1;
   }
 }
-const fe = 100, P = /* @__PURE__ */ new Map();
-function Qe() {
-  const s = [];
+const _e = 100, P = /* @__PURE__ */ new Map();
+function st() {
+  const n = [];
   for (const [e, t] of P.entries())
-    q(t) && s.push(e);
-  for (const e of s)
+    Z(t) && n.push(e);
+  for (const e of n)
     P.delete(e);
 }
-function et(s, e) {
-  if (P.size >= fe && Qe(), P.size >= fe) {
+function rt(n, e) {
+  if (P.size >= _e && st(), P.size >= _e) {
     const t = P.keys().next().value;
     t && P.delete(t);
   }
-  P.set(s, e);
+  P.set(n, e);
 }
-function tt(s) {
-  P.delete(s);
+function it(n) {
+  P.delete(n);
 }
-function st(s, e) {
-  return s.global || s.sticky ? new RegExp(s.source, s.flags.replace(/[gy]/g, "")).test(e) : s.test(e);
+function ot(n, e) {
+  return n.global || n.sticky ? new RegExp(n.source, n.flags.replace(/[gy]/g, "")).test(e) : n.test(e);
 }
 class _ {
   /** @internal */
@@ -530,7 +530,7 @@ class _ {
     return t._default = e, t;
   }
 }
-class G extends _ {
+class re extends _ {
   /** @internal */
   _minLength;
   /** @internal */
@@ -556,7 +556,7 @@ class G extends _ {
       issues: [
         { message: `String must be at most ${this._maxLength} characters` }
       ]
-    } : this._pattern && !st(this._pattern, t) ? {
+    } : this._pattern && !ot(this._pattern, t) ? {
       issues: [
         {
           message: this._patternMessage || `String must match pattern ${this._pattern}`
@@ -566,7 +566,7 @@ class G extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new G();
+    const e = new re();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._minLength = this._minLength, e._maxLength = this._maxLength, e._pattern = this._pattern, e._patternMessage = this._patternMessage, e._trim = this._trim, e;
   }
   /**
@@ -623,8 +623,8 @@ class G extends _ {
    * ```
    */
   pattern(e, t) {
-    const n = this._clone();
-    return n._pattern = e, n._patternMessage = t, n;
+    const s = this._clone();
+    return s._pattern = e, s._patternMessage = t, s;
   }
   /**
    * Validates as email address.
@@ -691,7 +691,7 @@ class G extends _ {
     return e._minLength = 1, e;
   }
 }
-class Z extends _ {
+class ie extends _ {
   /** @internal */
   _min;
   /** @internal */
@@ -706,7 +706,7 @@ class Z extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new Z();
+    const e = new ie();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._min = this._min, e._max = this._max, e._int = this._int, e;
   }
   /**
@@ -786,7 +786,7 @@ class Z extends _ {
     return e._max = -Number.MIN_VALUE, e;
   }
 }
-class Q extends _ {
+class oe extends _ {
   /** @internal */
   _validate(e) {
     return typeof e != "boolean" ? {
@@ -795,11 +795,11 @@ class Q extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new Q();
+    const e = new oe();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class ee extends _ {
+class ae extends _ {
   /** @internal */
   _validate(e) {
     return typeof e != "function" ? {
@@ -808,11 +808,11 @@ class ee extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new ee();
+    const e = new ae();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class $ extends _ {
+class W extends _ {
   /** @internal */
   _itemSchema;
   /** @internal */
@@ -839,8 +839,8 @@ class $ extends _ {
       };
     if (this._itemSchema) {
       const t = [];
-      for (let n = 0; n < e.length; n++) {
-        const r = this._itemSchema["~standard"].validate(e[n]);
+      for (let s = 0; s < e.length; s++) {
+        const r = this._itemSchema["~standard"].validate(e[s]);
         if (r instanceof Promise)
           throw new Error(
             "Async schema validation is not supported. Use synchronous schemas."
@@ -849,7 +849,7 @@ class $ extends _ {
           return {
             issues: r.issues.map((i) => ({
               ...i,
-              path: [n, ...i.path || []]
+              path: [s, ...i.path || []]
             }))
           };
         t.push(r.value);
@@ -860,7 +860,7 @@ class $ extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new $();
+    const e = new W();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._itemSchema = this._itemSchema, e._minLength = this._minLength, e._maxLength = this._maxLength, e;
   }
   /**
@@ -876,7 +876,7 @@ class $ extends _ {
    * ```
    */
   of(e) {
-    const t = new $();
+    const t = new W();
     return t._optional = this._optional, t._nullable = this._nullable, t._itemSchema = e, t._minLength = this._minLength, t._maxLength = this._maxLength, t;
   }
   /**
@@ -919,7 +919,7 @@ class $ extends _ {
     return this.min(1);
   }
 }
-class L extends _ {
+class B extends _ {
   /** @internal */
   _shape;
   /** @internal */
@@ -934,7 +934,7 @@ class L extends _ {
           }
         ]
       };
-    const t = e, n = {};
+    const t = e, s = {};
     if (this._shape) {
       if (this._strict) {
         const r = new Set(Object.keys(this._shape));
@@ -957,18 +957,18 @@ class L extends _ {
               path: [r, ...a.path || []]
             }))
           };
-        n[r] = o.value;
+        s[r] = o.value;
       }
       if (!this._strict)
         for (const r of Object.keys(t))
-          r in this._shape || (n[r] = t[r]);
-      return { value: n };
+          r in this._shape || (s[r] = t[r]);
+      return { value: s };
     }
     return { value: e };
   }
   /** @internal */
   _clone() {
-    const e = new L();
+    const e = new B();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e._shape = this._shape, e._strict = this._strict, e;
   }
   /**
@@ -986,7 +986,7 @@ class L extends _ {
    * ```
    */
   shape(e) {
-    const t = new L();
+    const t = new B();
     return t._optional = this._optional, t._nullable = this._nullable, t._shape = e, t._strict = this._strict, t;
   }
   /**
@@ -1002,7 +1002,7 @@ class L extends _ {
     return e._strict = !0, e;
   }
 }
-class te extends _ {
+class ce extends _ {
   /** @internal */
   _value;
   constructor(e) {
@@ -1016,11 +1016,11 @@ class te extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new te(this._value);
+    const e = new ce(this._value);
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class se extends _ {
+class le extends _ {
   /** @internal */
   _values;
   /** @internal */
@@ -1040,11 +1040,11 @@ class se extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new se(this._values);
+    const e = new le(this._values);
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-class ne extends _ {
+class ue extends _ {
   constructor() {
     super(), this._nullable = !0;
   }
@@ -1054,11 +1054,11 @@ class ne extends _ {
   }
   /** @internal */
   _clone() {
-    const e = new ne();
+    const e = new ue();
     return e._optional = this._optional, e._nullable = this._nullable, e._default = this._default, e;
   }
 }
-const d = {
+const p = {
   /**
    * Creates a string schema.
    *
@@ -1071,7 +1071,7 @@ const d = {
    * prop.string().pattern(/^[a-z]+$/)
    * ```
    */
-  string: () => new G(),
+  string: () => new re(),
   /**
    * Creates a number schema.
    *
@@ -1083,7 +1083,7 @@ const d = {
    * prop.number().positive()
    * ```
    */
-  number: () => new Z(),
+  number: () => new ie(),
   /**
    * Creates a boolean schema.
    *
@@ -1093,7 +1093,7 @@ const d = {
    * prop.boolean().default(false)
    * ```
    */
-  boolean: () => new Q(),
+  boolean: () => new oe(),
   /**
    * Creates a function schema.
    *
@@ -1106,7 +1106,7 @@ const d = {
    * prop.function<(data: { id: string }) => Promise<void>>()
    * ```
    */
-  function: () => new ee(),
+  function: () => new ae(),
   /**
    * Creates an array schema.
    *
@@ -1119,7 +1119,7 @@ const d = {
    * prop.array().of(prop.number()).min(1).max(10)
    * ```
    */
-  array: () => new $(),
+  array: () => new W(),
   /**
    * Creates an object schema.
    *
@@ -1135,7 +1135,7 @@ const d = {
    * prop.object().shape({ key: prop.string() }).strict()
    * ```
    */
-  object: () => new L(),
+  object: () => new B(),
   /**
    * Creates a literal schema for exact value matching.
    *
@@ -1148,7 +1148,7 @@ const d = {
    * prop.literal(true)
    * ```
    */
-  literal: (s) => new te(s),
+  literal: (n) => new ce(n),
   /**
    * Creates an enum schema for a set of allowed values.
    *
@@ -1160,7 +1160,7 @@ const d = {
    * prop.enum([1, 2, 3])
    * ```
    */
-  enum: (s) => new se(s),
+  enum: (n) => new le(n),
   /**
    * Creates a schema that accepts any value.
    *
@@ -1172,173 +1172,173 @@ const d = {
    * prop.any()
    * ```
    */
-  any: () => new ne()
-}, b = {
+  any: () => new ue()
+}, O = {
   uid: {
-    schema: d.string().optional(),
+    schema: p.string().optional(),
     sendToHost: !0
   },
   tag: {
-    schema: d.string().optional(),
+    schema: p.string().optional(),
     sendToHost: !0
   },
   dimensions: {
-    schema: d.object().default(() => ({ width: "100%", height: "100%" })),
+    schema: p.object().default(() => ({ width: "100%", height: "100%" })),
     sendToHost: !1
   },
   timeout: {
-    schema: d.number().default(1e4),
+    schema: p.number().default(1e4),
     sendToHost: !1
   },
   cspNonce: {
-    schema: d.string().optional(),
+    schema: p.string().optional(),
     sendToHost: !0
   },
   // Lifecycle callbacks - not sent to host (consumer-only)
   onDisplay: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onRendered: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onRender: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onPrerendered: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onPrerender: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onClose: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onDestroy: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onResize: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onFocus: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onError: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   },
   onProps: {
-    schema: d.function().optional(),
+    schema: p.function().optional(),
     sendToHost: !1
   }
 };
-function z(s) {
-  return typeof s == "object" && s !== null && "~standard" in s && typeof s["~standard"] == "object" && s["~standard"] !== null && s["~standard"].version === 1 && typeof s["~standard"].vendor == "string" && typeof s["~standard"].validate == "function";
+function x(n) {
+  return typeof n == "object" && n !== null && "~standard" in n && typeof n["~standard"] == "object" && n["~standard"] !== null && n["~standard"].version === 1 && typeof n["~standard"].vendor == "string" && typeof n["~standard"].validate == "function";
 }
-function nt(s, e, t) {
-  const n = s["~standard"].validate(e);
-  if (n instanceof Promise)
+function at(n, e, t) {
+  const s = n["~standard"].validate(e);
+  if (s instanceof Promise)
     throw new Error(
       `Prop "${t}" uses an async schema. ForgeFrame only supports synchronous schema validation. Please use a synchronous schema or remove async operations (like database lookups) from your schema definition.`
     );
-  if (n.issues) {
-    const r = n.issues.map((i) => `${rt(i.path, t)}: ${i.message}`);
+  if (s.issues) {
+    const r = s.issues.map((i) => `${ct(i.path, t)}: ${i.message}`);
     throw new Error(`Validation failed: ${r.join("; ")}`);
   }
-  return n.value;
+  return s.value;
 }
-function rt(s, e) {
-  if (!s || s.length === 0)
+function ct(n, e) {
+  if (!n || n.length === 0)
     return e;
-  const t = s.map((n) => {
-    if (typeof n == "object" && n !== null) {
-      if ("key" in n && n.key !== void 0)
-        return String(n.key);
-      if ("index" in n && typeof n.index == "number")
-        return String(n.index);
+  const t = n.map((s) => {
+    if (typeof s == "object" && s !== null) {
+      if ("key" in s && s.key !== void 0)
+        return String(s.key);
+      if ("index" in s && typeof s.index == "number")
+        return String(s.index);
     }
-    return String(n);
+    return String(s);
   });
   return `${e}.${t.join(".")}`;
 }
-function I(s) {
-  const e = z(s);
-  return { isDirectSchema: e, definition: e ? { schema: s } : s };
+function N(n) {
+  const e = x(n);
+  return { isDirectSchema: e, definition: e ? { schema: n } : n };
 }
-function me(s, e, t) {
-  const n = {
-    ...b,
+function Pe(n, e, t) {
+  const s = {
+    ...O,
     ...e
   }, r = {};
-  for (const [i, o] of Object.entries(n)) {
-    const { definition: a } = I(o);
+  for (const [i, o] of Object.entries(s)) {
+    const { definition: a } = N(o);
     let c;
-    const l = a.alias, h = i in s, f = l && l in s;
-    if (h)
-      c = s[i];
-    else if (f)
-      c = s[l];
+    const l = a.alias, m = i in n, h = l && l in n;
+    if (m)
+      c = n[i];
+    else if (h)
+      c = n[l];
     else if (a.value)
       c = a.value(t);
     else if (a.default !== void 0)
       c = typeof a.default == "function" ? a.default(t) : a.default;
-    else if (a.schema && z(a.schema)) {
-      const g = a.schema["~standard"].validate(void 0);
-      !(g instanceof Promise) && !g.issues && (c = g.value);
+    else if (a.schema && x(a.schema)) {
+      const d = a.schema["~standard"].validate(void 0);
+      !(d instanceof Promise) && !d.issues && (c = d.value);
     }
     c !== void 0 && a.decorate && (c = a.decorate({ value: c, props: r })), r[i] = c;
   }
   return r;
 }
-function ve(s, e) {
+function S(n, e) {
   const t = {
-    ...b,
+    ...O,
     ...e
   };
-  for (const [n, r] of Object.entries(t)) {
-    const { isDirectSchema: i, definition: o } = I(r);
-    let a = s[n];
+  for (const [s, r] of Object.entries(t)) {
+    const { isDirectSchema: i, definition: o } = N(r);
+    let a = n[s];
     if (o.required && a === void 0)
-      throw new Error(`Prop "${n}" is required but was not provided`);
-    if (o.schema && z(o.schema))
-      (a !== void 0 || i) && (a = nt(o.schema, a, n), s[n] = a);
+      throw new Error(`Prop "${s}" is required but was not provided`);
+    if (o.schema && x(o.schema))
+      (a !== void 0 || i) && (a = at(o.schema, a, s), n[s] = a);
     else if (a === void 0)
       continue;
-    o.validate && o.validate({ value: a, props: s });
+    o.validate && o.validate({ value: a, props: n });
   }
 }
-function ge(s, e, t, n) {
+function Ee(n, e, t, s) {
   const r = {
-    ...b,
+    ...O,
     ...e
   }, i = {};
   for (const [o, a] of Object.entries(r)) {
-    const { definition: c } = I(a), l = s[o];
-    if (c.sendToHost === !1 || c.sameDomain && !n) continue;
+    const { definition: c } = N(a), l = n[o];
+    if (c.sendToHost === !1 || c.sameDomain && !s) continue;
     if (c.trustedDomains) {
-      const f = c.trustedDomains;
-      if (!C(f, t)) continue;
+      const h = c.trustedDomains;
+      if (!v(h, t)) continue;
     }
-    let h = l;
-    c.hostDecorate && l !== void 0 && (h = c.hostDecorate({ value: l, props: s })), i[o] = h;
+    let m = l;
+    c.hostDecorate && l !== void 0 && (m = c.hostDecorate({ value: l, props: n })), i[o] = m;
   }
   return i;
 }
-function it(s, e) {
-  const t = new URLSearchParams(), n = {
-    ...b,
+function lt(n, e) {
+  const t = new URLSearchParams(), s = {
+    ...O,
     ...e
   };
-  for (const [r, i] of Object.entries(n)) {
-    const { definition: o } = I(i), a = s[r];
+  for (const [r, i] of Object.entries(s)) {
+    const { definition: o } = N(i), a = n[r];
     if (a === void 0 || typeof a == "function" || !o.queryParam) continue;
     const c = typeof o.queryParam == "string" ? o.queryParam : r;
     let l;
@@ -1346,13 +1346,13 @@ function it(s, e) {
   }
   return t;
 }
-function ot(s, e) {
-  const t = new URLSearchParams(), n = {
-    ...b,
+function ut(n, e) {
+  const t = new URLSearchParams(), s = {
+    ...O,
     ...e
   };
-  for (const [r, i] of Object.entries(n)) {
-    const { definition: o } = I(i), a = s[r];
+  for (const [r, i] of Object.entries(s)) {
+    const { definition: o } = N(i), a = n[r];
     if (a === void 0 || typeof a == "function" || !o.bodyParam) continue;
     const c = typeof o.bodyParam == "string" ? o.bodyParam : r;
     let l;
@@ -1360,11 +1360,11 @@ function ot(s, e) {
   }
   return t;
 }
-const ye = 500, at = /* @__PURE__ */ new Set(["__proto__"]);
-function Se(s) {
-  return !at.has(s);
+const be = 500, ht = /* @__PURE__ */ new Set(["__proto__"]);
+function Te(n) {
+  return !ht.has(n);
 }
-class re {
+class he {
   /**
    * Creates a new FunctionBridge instance.
    *
@@ -1391,14 +1391,14 @@ class re {
    * @returns A function reference that can be sent across domains
    */
   serialize(e, t) {
-    if (this.localFunctions.size >= ye) {
+    if (this.localFunctions.size >= be) {
       const r = this.localFunctions.keys().next().value;
       r && this.localFunctions.delete(r);
     }
-    const n = N();
-    return this.localFunctions.set(n, e), this.currentBatchIds.add(n), {
+    const s = L();
+    return this.localFunctions.set(s, e), this.currentBatchIds.add(s), {
       __type__: "function",
-      __id__: n,
+      __id__: s,
       __name__: t || e.name || "anonymous"
     };
   }
@@ -1414,14 +1414,14 @@ class re {
    * @param targetDomain - The origin of the target window
    * @returns A callable wrapper function
    */
-  deserialize(e, t, n) {
+  deserialize(e, t, s) {
     const r = `${e.__id__}`, i = this.remoteFunctions.get(r);
     if (i) return i;
-    if (this.remoteFunctions.size >= ye) {
+    if (this.remoteFunctions.size >= be) {
       const a = this.remoteFunctions.keys().next().value;
       a && this.remoteFunctions.delete(a);
     }
-    const o = async (...a) => this.messenger.send(t, n, u.CALL, {
+    const o = async (...a) => this.messenger.send(t, s, u.CALL, {
       id: e.__id__,
       args: a
     });
@@ -1447,10 +1447,10 @@ class re {
     this.messenger.on(
       u.CALL,
       async ({ id: e, args: t }) => {
-        const n = this.localFunctions.get(e);
-        if (!n)
+        const s = this.localFunctions.get(e);
+        if (!s)
           throw new Error(`Function with id "${e}" not found`);
-        return n(...t);
+        return s(...t);
       }
     );
   }
@@ -1528,180 +1528,194 @@ class re {
     this.localFunctions.clear(), this.remoteFunctions.clear(), this.currentBatchIds.clear();
   }
 }
-function J(s, e, t = /* @__PURE__ */ new WeakSet()) {
-  if (typeof s == "function")
-    return e.serialize(s);
-  if (Array.isArray(s)) {
-    if (t.has(s))
+function Q(n, e, t = /* @__PURE__ */ new WeakSet()) {
+  if (typeof n == "function")
+    return e.serialize(n);
+  if (Array.isArray(n)) {
+    if (t.has(n))
       throw new Error("Circular reference detected in props - arrays cannot contain circular references");
-    t.add(s);
+    t.add(n);
     try {
-      return s.map((n) => J(n, e, t));
+      return n.map((s) => Q(s, e, t));
     } finally {
-      t.delete(s);
+      t.delete(n);
     }
   }
-  if (typeof s == "object" && s !== null) {
-    if (t.has(s))
+  if (typeof n == "object" && n !== null) {
+    if (t.has(n))
       throw new Error("Circular reference detected in props - objects cannot contain circular references");
-    t.add(s);
+    t.add(n);
     try {
-      const n = {};
-      for (const [r, i] of Object.entries(s))
-        Se(r) && (n[r] = J(i, e, t));
-      return n;
+      const s = {};
+      for (const [r, i] of Object.entries(n))
+        Te(r) && (s[r] = Q(i, e, t));
+      return s;
     } finally {
-      t.delete(s);
+      t.delete(n);
     }
   }
-  return s;
+  return n;
 }
-function X(s, e, t, n, r = /* @__PURE__ */ new WeakSet()) {
-  if (re.isFunctionRef(s))
-    return e.deserialize(s, t, n);
-  if (Array.isArray(s)) {
-    if (r.has(s))
+function ee(n, e, t, s, r = /* @__PURE__ */ new WeakSet()) {
+  if (he.isFunctionRef(n))
+    return e.deserialize(n, t, s);
+  if (Array.isArray(n)) {
+    if (r.has(n))
       throw new Error("Circular reference detected in serialized props");
-    r.add(s);
+    r.add(n);
     try {
-      return s.map(
-        (i) => X(i, e, t, n, r)
+      return n.map(
+        (i) => ee(i, e, t, s, r)
       );
     } finally {
-      r.delete(s);
+      r.delete(n);
     }
   }
-  if (typeof s == "object" && s !== null) {
-    if (r.has(s))
+  if (typeof n == "object" && n !== null) {
+    if (r.has(n))
       throw new Error("Circular reference detected in serialized props");
-    r.add(s);
+    r.add(n);
     try {
       const i = {};
-      for (const [o, a] of Object.entries(s))
-        Se(o) && (i[o] = X(a, e, t, n, r));
+      for (const [o, a] of Object.entries(n))
+        Te(o) && (i[o] = ee(a, e, t, s, r));
       return i;
     } finally {
-      r.delete(s);
+      r.delete(n);
     }
   }
-  return s;
+  return n;
 }
-const ct = /* @__PURE__ */ new Set(["__proto__"]);
-function Ce(s) {
-  return !ct.has(s);
+const dt = /* @__PURE__ */ new Set(["__proto__"]), te = "__forgeframe.dotify_path__:";
+function Ue(n) {
+  return !dt.has(n);
 }
-function Ie(s, e = "") {
+function Ne(n, e = []) {
   const t = [];
-  for (const [n, r] of Object.entries(s)) {
-    const i = e ? `${e}.${n}` : n;
+  for (const [s, r] of Object.entries(n)) {
+    const i = [...e, s];
     if (r !== null && typeof r == "object" && !Array.isArray(r))
-      t.push(Ie(r, i));
+      t.push(Ne(r, i));
     else {
-      const o = encodeURIComponent(JSON.stringify(r));
-      t.push(`${i}=${o}`);
+      const o = `${te}${encodeURIComponent(
+        JSON.stringify(i)
+      )}`, a = encodeURIComponent(JSON.stringify(r));
+      t.push(`${o}=${a}`);
     }
   }
   return t.filter(Boolean).join("&");
 }
-function lt(s) {
+function pt(n) {
   const e = {};
-  if (!s) return e;
-  const t = s.split("&");
-  for (const n of t) {
-    const [r, i] = n.split("=");
-    if (!r || i === void 0) continue;
-    let o;
+  if (!n) return e;
+  const t = n.split("&");
+  for (const s of t) {
+    const r = s.indexOf("=");
+    if (r === -1) continue;
+    const i = s.slice(0, r), o = s.slice(r + 1);
+    if (!i || o === void 0) continue;
+    let a;
     try {
-      o = JSON.parse(decodeURIComponent(i));
+      a = JSON.parse(decodeURIComponent(o));
     } catch {
-      o = decodeURIComponent(i);
+      a = decodeURIComponent(o);
     }
-    const a = r.split(".");
-    if (a.some((h) => !Ce(h))) continue;
-    let c = e;
-    for (let h = 0; h < a.length - 1; h++) {
-      const f = a[h], g = c[f];
-      (!Object.prototype.hasOwnProperty.call(c, f) || typeof g != "object" || g === null || Array.isArray(g)) && (c[f] = {}), c = c[f];
+    const c = ft(i);
+    if (c.some((h) => !Ue(h))) continue;
+    let l = e;
+    for (let h = 0; h < c.length - 1; h++) {
+      const d = c[h], C = l[d];
+      (!Object.prototype.hasOwnProperty.call(l, d) || typeof C != "object" || C === null || Array.isArray(C)) && (l[d] = {}), l = l[d];
     }
-    const l = a[a.length - 1];
-    c[l] = o;
+    const m = c[c.length - 1];
+    l[m] = a;
   }
   return e;
 }
-function ut(s) {
-  return typeof s == "object" && s !== null && s.__type__ === "dotify" && typeof s.__value__ == "string";
+function ft(n) {
+  if (!n.startsWith(te))
+    throw new Error("Invalid DOTIFY path framing");
+  const e = decodeURIComponent(
+    n.slice(te.length)
+  ), t = JSON.parse(e);
+  if (Array.isArray(t) && t.length > 0 && t.every((s) => typeof s == "string"))
+    return t;
+  throw new Error("Invalid DOTIFY path framing");
+}
+function mt(n) {
+  return typeof n == "object" && n !== null && n.__type__ === "dotify" && typeof n.__value__ == "string";
 }
-function ht(s, e, t) {
-  const n = {
-    ...b,
+function gt(n, e, t) {
+  const s = {
+    ...O,
     ...e
   }, r = {};
-  for (const [i, o] of Object.entries(s)) {
+  for (const [i, o] of Object.entries(n)) {
     if (o === void 0) continue;
-    const a = n[i];
-    r[i] = dt(o, a, t);
+    const a = s[i];
+    r[i] = yt(o, a, t);
   }
   return r;
 }
-function dt(s, e, t) {
-  if (typeof s == "function")
-    return t.serialize(s);
-  const n = e?.serialization ?? U.JSON;
-  if (n === U.BASE64 && typeof s == "object") {
-    const r = JSON.stringify(s);
+function yt(n, e, t) {
+  if (typeof n == "function")
+    return t.serialize(n);
+  const s = e?.serialization ?? A.JSON;
+  if (s === A.BASE64 && typeof n == "object") {
+    const r = JSON.stringify(n);
     return {
       __type__: "base64",
       __value__: btoa(encodeURIComponent(r))
     };
   }
-  return n === U.DOTIFY && typeof s == "object" && s !== null && !Array.isArray(s) ? {
+  return s === A.DOTIFY && typeof n == "object" && n !== null && !Array.isArray(n) ? {
     __type__: "dotify",
-    __value__: Ie(s)
-  } : J(s, t);
+    __value__: Ne(n)
+  } : Q(n, t);
 }
-function we(s, e, t, n, r, i) {
+function Oe(n, e, t, s, r, i) {
   const o = {
-    ...b,
+    ...O,
     ...e
   }, a = {};
-  for (const [c, l] of Object.entries(s)) {
-    if (!Ce(c)) continue;
-    const h = o[c];
-    a[c] = pt(
+  for (const [c, l] of Object.entries(n)) {
+    if (!Ue(c)) continue;
+    const m = o[c];
+    a[c] = wt(
       l,
-      h,
+      m,
       t,
-      n,
+      s,
       r,
       i
     );
   }
   return a;
 }
-function pt(s, e, t, n, r, i) {
-  if (ft(s))
+function wt(n, e, t, s, r, i) {
+  if (_t(n))
     try {
-      const o = decodeURIComponent(atob(s.__value__));
+      const o = decodeURIComponent(atob(n.__value__));
       return JSON.parse(o);
     } catch {
-      return s;
+      return n;
     }
-  if (ut(s))
+  if (mt(n))
     try {
-      return lt(s.__value__);
+      return pt(n.__value__);
     } catch {
-      return s;
+      return n;
     }
-  return X(s, n, r, i);
+  return ee(n, s, r, i);
 }
-function ft(s) {
-  return typeof s == "object" && s !== null && s.__type__ === "base64" && typeof s.__value__ == "string";
+function _t(n) {
+  return typeof n == "object" && n !== null && n.__type__ === "base64" && typeof n.__value__ == "string";
 }
-class mt {
-  constructor(e, t, n) {
-    this.options = e, this.createPropContext = n, this.inputProps = { ...t };
+class Pt {
+  constructor(e, t, s) {
+    this.options = e, this.createPropContext = s, this.inputProps = { ...t };
     const r = this.inputProps, i = this.createPropContext(r);
-    this.props = me(r, this.options.props, i);
+    this.props = Pe(r, this.options.props, i);
   }
   /** Current normalized prop snapshot. */
   props;
@@ -1713,18 +1727,30 @@ class mt {
    * Builds and validates the next props snapshot.
    */
   buildNextProps(e) {
-    const t = { ...this.inputProps, ...e }, n = { ...this.props, ...e }, r = this.createPropContext(n), i = me(n, this.options.props, r);
-    return ve(i, this.options.props), this.options.validate?.({ props: i }), { nextInputProps: t, nextProps: i };
+    const t = { ...this.inputProps, ...e }, s = { ...this.props, ...e }, r = this.createPropContext(s), i = Pe(s, this.options.props, r);
+    return S(i, this.options.props), this.options.validate?.({ props: i }), { nextInputProps: t, nextProps: i };
   }
   /**
    * Applies a props update and synchronizes it to the host when connected.
    */
   updateProps(e, t) {
     return this.queuePropsUpdate(async () => {
-      const { nextInputProps: n, nextProps: r } = this.buildNextProps(e), i = t.resolveUrl(r), o = t.resolveUrlOrigin(i);
-      t.assertStableRenderedOrigin(o), this.inputProps = n, this.props = r, t.isRendered() || t.syncTrustedDomainForUrl(i), t.shouldSendPropsToHost() && await t.sendPropsUpdateToHost(r), t.emitPropsUpdated(r);
+      const { nextInputProps: s, nextProps: r } = this.buildNextProps(e), i = t.resolveUrl(r), o = t.resolveUrlOrigin(i);
+      t.assertStableRenderedOrigin(o), this.inputProps = s, this.props = r, t.isRendered() || t.syncTrustedDomainForUrl(i), t.shouldSendPropsToHost() && await t.sendPropsUpdateToHost(r), t.emitPropsUpdated(r);
     }, t.shouldSendPropsToHost);
   }
+  /**
+   * Queues a host synchronization for the current props snapshot.
+   *
+   * @remarks
+   * This shares the same serialization queue as updateProps so function bridge
+   * batches cannot overlap with user-initiated prop updates.
+   */
+  syncCurrentPropsToHost(e) {
+    return this.queuePropsUpdate(async () => {
+      e.shouldSendPropsToHost() && await e.sendPropsUpdateToHost(this.props);
+    }, e.shouldSendPropsToHost);
+  }
   /**
    * Queues prop updates when a previous host sync is in flight.
    */
@@ -1733,8 +1759,8 @@ class mt {
       const r = e();
       return t() && this.trackPendingUpdate(r), r;
     }
-    const n = this.pendingPropsUpdate.then(e, e);
-    return this.trackPendingUpdate(n), n;
+    const s = this.pendingPropsUpdate.then(e, e);
+    return this.trackPendingUpdate(s), s;
   }
   /**
    * Tracks a promise as the active queued update and clears it when settled.
@@ -1751,46 +1777,76 @@ class mt {
     });
   }
 }
-function x(s, e = "100%") {
-  return s === void 0 ? e : typeof s == "number" ? `${s}px` : s;
+function R(n, e = "100%") {
+  return n === void 0 ? e : typeof n == "number" ? `${n}px` : n;
 }
-function A(s, e) {
-  if (s === void 0) return e;
-  if (typeof s == "number") return s;
-  const t = parseInt(s, 10);
+function j(n, e) {
+  if (n === void 0) return e;
+  if (typeof n == "number") return n;
+  const t = parseInt(n, 10);
   return isNaN(t) ? e : t;
 }
-function gt(s) {
+function Et(n) {
+  const { name: e, dimensions: t, attributes: s = {}, style: r = {} } = n, i = document.createElement("iframe");
+  return i.name = e, i.setAttribute("frameborder", "0"), i.setAttribute("allowtransparency", "true"), i.setAttribute("scrolling", "auto"), Fe(i, t), Dt(i, s), xt(i, r), It(i, s), i;
+}
+function bt(n) {
   try {
-    s.src = "about:blank", s.parentNode?.removeChild(s);
+    n.src = "about:blank", n.parentNode?.removeChild(n);
   } catch {
   }
 }
-function yt(s, e) {
-  Pt(s, e);
+function Ot(n, e) {
+  Fe(n, e);
 }
-function wt(s) {
-  s.style.display = "", s.style.visibility = "visible";
+function Ct(n) {
+  n.style.display = "", n.style.visibility = "visible";
 }
-function _e(s) {
-  s.style.display = "none", s.style.visibility = "hidden";
+function Ce(n) {
+  n.style.display = "none", n.style.visibility = "hidden";
 }
-function _t(s) {
+function Rt(n) {
   try {
-    s.focus(), s.contentWindow?.focus();
+    n.focus(), n.contentWindow?.focus();
   } catch {
   }
 }
-function Pt(s, e) {
-  e.width !== void 0 && (s.style.width = x(e.width)), e.height !== void 0 && (s.style.height = x(e.height));
+function Fe(n, e) {
+  e.width !== void 0 && (n.style.width = R(e.width)), e.height !== void 0 && (n.style.height = R(e.height));
+}
+function xt(n, e) {
+  for (const [t, s] of Object.entries(e)) {
+    if (s === void 0) continue;
+    const r = typeof s == "number" ? `${s}px` : s;
+    n.style.setProperty(
+      t.replace(/([A-Z])/g, "-$1").toLowerCase(),
+      r
+    );
+  }
+}
+function Dt(n, e) {
+  for (const [t, s] of Object.entries(e))
+    if (s !== void 0) {
+      if (typeof s == "boolean") {
+        s && n.setAttribute(t, "");
+        continue;
+      }
+      n.setAttribute(t, s);
+    }
+}
+function It(n, e) {
+  e.sandbox || n.setAttribute(
+    "sandbox",
+    "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox"
+  );
 }
-class De extends Error {
+class He extends Error {
   constructor(e = "Popup blocked by browser") {
     super(e), this.name = "PopupOpenError";
   }
 }
-function Et(s) {
-  const { url: e, name: t, dimensions: n } = s, r = A(n.width, 500), i = A(n.height, 500), o = Math.floor(window.screenX + (window.outerWidth - r) / 2), a = Math.floor(window.screenY + (window.outerHeight - i) / 2), c = [
+function St(n) {
+  const { url: e, name: t, dimensions: s } = n, r = j(s.width, 500), i = j(s.height, 500), o = Math.floor(window.screenX + (window.outerWidth - r) / 2), a = Math.floor(window.screenY + (window.outerHeight - i) / 2), c = [
     `width=${r}`,
     `height=${i}`,
     `left=${o}`,
@@ -1803,50 +1859,50 @@ function Et(s) {
     "resizable=yes",
     "scrollbars=yes"
   ].join(","), l = window.open(e, t, c);
-  if (!l || Rt(l))
-    throw new De();
+  if (!l || Ut(l))
+    throw new He();
   return l;
 }
-function bt(s) {
+function vt(n) {
   try {
-    s.closed || s.close();
+    n.closed || n.close();
   } catch {
   }
 }
-function xt(s) {
+function Tt(n) {
   try {
-    s.closed || s.focus();
+    n.closed || n.focus();
   } catch {
   }
 }
-function Rt(s) {
-  if (!s) return !0;
+function Ut(n) {
+  if (!n) return !0;
   try {
-    return !!(s.closed || s.innerHeight === 0 || s.innerWidth === 0);
+    return !!(n.closed || n.innerHeight === 0 || n.innerWidth === 0);
   } catch {
     return !0;
   }
 }
-function Ot(s, e, t = {}) {
+function Nt(n, e, t = {}) {
   const {
-    initialInterval: n = 100,
+    initialInterval: s = 100,
     // Start fast to catch quick closes
     maxInterval: r = 2e3,
     // Cap at 2 seconds
     multiplier: i = 1.5
     // Exponential backoff multiplier
   } = t;
-  let o = n, a, c = !1;
+  let o = s, a, c = !1;
   const l = () => {
     try {
       e();
-    } catch (f) {
-      console.error("Error in popup close callback:", f);
+    } catch (h) {
+      console.error("Error in popup close callback:", h);
     }
-  }, h = () => {
+  }, m = () => {
     if (!c) {
       try {
-        if (s.closed) {
+        if (n.closed) {
           l();
           return;
         }
@@ -1854,59 +1910,59 @@ function Ot(s, e, t = {}) {
         l();
         return;
       }
-      o = Math.min(o * i, r), a = setTimeout(h, o);
+      o = Math.min(o * i, r), a = setTimeout(m, o);
     }
   };
-  return a = setTimeout(h, o), () => {
+  return a = setTimeout(m, o), () => {
     c = !0, clearTimeout(a);
   };
 }
-function vt(s, e) {
+function Ft(n, e) {
   try {
-    const t = A(e.width, s.outerWidth), n = A(
+    const t = j(e.width, n.outerWidth), s = j(
       e.height,
-      s.outerHeight
+      n.outerHeight
     );
-    s.resizeTo(t, n);
+    n.resizeTo(t, s);
   } catch {
   }
 }
-const Pe = "forgeframe-spinner-style";
-function St(s, e) {
-  const t = s.getElementById(Pe);
+const Re = "forgeframe-spinner-style";
+function Ht(n, e) {
+  const t = n.getElementById(Re);
   if (t) {
     const r = t.getAttribute("nonce");
     if (!e || r === e)
       return;
     t.remove();
   }
-  const n = s.createElement("style");
-  n.id = Pe, e && n.setAttribute("nonce", e), n.textContent = `
+  const s = n.createElement("style");
+  s.id = Re, e && s.setAttribute("nonce", e), s.textContent = `
     @keyframes forgeframe-spin {
       to { transform: rotate(360deg); }
     }
-  `, (s.head ?? s.documentElement).appendChild(n);
+  `, (n.head ?? n.documentElement).appendChild(s);
 }
-function Ct(s) {
-  const { doc: e, dimensions: t, uid: n, tag: r } = s, i = e.createElement("div");
-  return i.id = `forgeframe-container-${n}`, i.setAttribute("data-forgeframe-tag", r), Object.assign(i.style, {
+function $t(n) {
+  const { doc: e, dimensions: t, uid: s, tag: r } = n, i = e.createElement("div");
+  return i.id = `forgeframe-container-${s}`, i.setAttribute("data-forgeframe-tag", r), Object.assign(i.style, {
     display: "inline-block",
     position: "relative",
-    width: x(t.width),
-    height: x(t.height),
+    width: R(t.width),
+    height: R(t.height),
     overflow: "hidden"
   }), i;
 }
-function It(s) {
-  const { doc: e, dimensions: t, cspNonce: n } = s;
-  St(e, n);
+function At(n) {
+  const { doc: e, dimensions: t, cspNonce: s } = n;
+  Ht(e, s);
   const r = e.createElement("div");
   Object.assign(r.style, {
     display: "flex",
     alignItems: "center",
     justifyContent: "center",
-    width: x(t.width),
-    height: x(t.height),
+    width: R(t.width),
+    height: R(t.height),
     backgroundColor: "#f5f5f5",
     position: "absolute",
     top: "0",
@@ -1923,22 +1979,22 @@ function It(s) {
     animation: "forgeframe-spin 1s linear infinite"
   }), r.appendChild(i), r;
 }
-function Dt(s, e = 200) {
+function Lt(n, e = 200) {
   return new Promise((t) => {
-    s.style.opacity = "0", s.style.transition = `opacity ${e}ms ease-in`, s.offsetHeight, s.style.opacity = "1", setTimeout(t, e);
+    n.style.opacity = "0", n.style.transition = `opacity ${e}ms ease-in`, n.offsetHeight, n.style.opacity = "1", setTimeout(t, e);
   });
 }
-function Tt(s, e = 200) {
+function zt(n, e = 200) {
   return new Promise((t) => {
-    s.style.transition = `opacity ${e}ms ease-out`, s.style.opacity = "0", setTimeout(t, e);
+    n.style.transition = `opacity ${e}ms ease-out`, n.style.opacity = "0", setTimeout(t, e);
   });
 }
-async function Ut(s, e, t) {
-  e && (await Tt(e, 150), e.remove()), t.style.display = "", t.style.visibility = "visible", t.style.opacity = "0", await Dt(t, 150);
+async function Mt(n, e, t) {
+  e && (await zt(e, 150), e.remove()), t.style.display = "", t.style.visibility = "visible", t.style.opacity = "0", await Lt(t, 150);
 }
-class Nt {
-  constructor(e, t, n, r, i) {
-    this.options = e, this.uid = t, this.getProps = n, this.resolveDimensions = r, this.callbacks = i, this.context = this.options.defaultContext;
+class kt {
+  constructor(e, t, s, r, i) {
+    this.options = e, this.uid = t, this.getProps = s, this.resolveDimensions = r, this.callbacks = i, this.context = this.options.defaultContext;
   }
   /** Active rendering context. */
   context;
@@ -1948,6 +2004,8 @@ class Nt {
   container = null;
   /** Prerender element currently displayed while host initializes. */
   prerenderElement = null;
+  /** Wrapper element created and owned by the renderer. */
+  ownedContainer = null;
   /**
    * Resolves a container selector or element to an HTMLElement.
    */
@@ -1967,80 +2025,80 @@ class Nt {
    */
   async prerender(e, t) {
     if (!this.container) return;
-    const n = this.getProps(), r = this.options.prerenderTemplate ?? It, i = this.options.containerTemplate ?? Ct, o = this.resolveDimensions(), a = n.cspNonce;
-    if (this.context === m.IFRAME) {
-      const f = t();
-      this.iframe = e(f), _e(this.iframe);
+    const s = this.container;
+    this.ownedContainer = null;
+    const r = this.getProps(), i = this.options.prerenderTemplate ?? At, o = this.options.containerTemplate ?? $t, a = this.resolveDimensions(), c = r.cspNonce;
+    if (this.context === f.IFRAME) {
+      const d = t();
+      this.iframe = e(d), Ce(this.iframe);
     }
-    const c = {
+    const l = {
       uid: this.uid,
       tag: this.options.tag,
       context: this.context,
-      dimensions: o,
-      props: n,
+      dimensions: a,
+      props: r,
       doc: document,
-      container: this.container,
+      container: s,
       frame: this.iframe,
       prerenderFrame: null,
       close: () => this.callbacks.close(),
       focus: () => this.callbacks.focus(),
-      cspNonce: a
+      cspNonce: c
     };
-    this.prerenderElement = r(c);
-    const l = {
+    this.prerenderElement = i(l);
+    const m = {
       uid: this.uid,
       tag: this.options.tag,
       context: this.context,
-      dimensions: o,
-      props: n,
+      dimensions: a,
+      props: r,
       doc: document,
-      container: this.container,
+      container: s,
       frame: this.iframe,
       prerenderFrame: this.prerenderElement,
       close: () => this.callbacks.close(),
       focus: () => this.callbacks.focus(),
-      cspNonce: a
-    }, h = i(l);
-    h && (this.container.appendChild(h), this.container = h), this.prerenderElement && !this.prerenderElement.parentNode && this.container.appendChild(this.prerenderElement), this.iframe && !this.iframe.parentNode && this.container.appendChild(this.iframe);
+      cspNonce: c
+    }, h = o(m);
+    if (h) {
+      if (h !== s) {
+        const d = !h.parentNode;
+        s.appendChild(h), d && (this.ownedContainer = h);
+      }
+      this.container = h;
+    }
+    this.prerenderElement && !this.prerenderElement.parentNode && this.container.appendChild(this.prerenderElement), this.iframe && !this.iframe.parentNode && this.container.appendChild(this.iframe);
   }
   /**
    * Creates an iframe element without setting src (for prerender phase).
    */
   createIframeElement(e) {
-    const t = document.createElement("iframe"), n = this.resolveDimensions(), r = this.getProps(), i = typeof this.options.attributes == "function" ? this.options.attributes(r) : this.options.attributes ?? {}, o = typeof this.options.style == "function" ? this.options.style(r) : this.options.style ?? {};
-    t.name = e, t.setAttribute("frameborder", "0"), t.setAttribute("allowtransparency", "true"), t.setAttribute("scrolling", "auto"), n.width !== void 0 && (t.style.width = typeof n.width == "number" ? `${n.width}px` : n.width), n.height !== void 0 && (t.style.height = typeof n.height == "number" ? `${n.height}px` : n.height);
-    for (const [a, c] of Object.entries(i))
-      c !== void 0 && (typeof c == "boolean" ? c && t.setAttribute(a, "") : t.setAttribute(a, c));
-    for (const [a, c] of Object.entries(o)) {
-      if (c === void 0) continue;
-      const l = typeof c == "number" ? `${c}px` : c;
-      t.style.setProperty(
-        a.replace(/([A-Z])/g, "-$1").toLowerCase(),
-        String(l)
-      );
-    }
-    return i.sandbox || t.setAttribute(
-      "sandbox",
-      "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox"
-    ), t;
+    const t = this.resolveDimensions(), s = this.getProps(), r = typeof this.options.attributes == "function" ? this.options.attributes(s) : this.options.attributes ?? {}, i = typeof this.options.style == "function" ? this.options.style(s) : this.options.style ?? {};
+    return Et({
+      name: e,
+      dimensions: t,
+      attributes: r,
+      style: i
+    });
   }
   /**
    * Opens host content in iframe or popup context.
    */
   open(e) {
-    const t = e.buildUrl(e.baseUrl), n = e.buildBodyParams(), r = n.toString().length > 0;
-    if (this.context === m.IFRAME) {
+    const t = e.buildUrl(e.baseUrl), s = e.buildBodyParams(), r = s.toString().length > 0;
+    if (this.context === f.IFRAME) {
       if (!this.iframe)
         throw new Error("Iframe not created during prerender");
-      return r ? e.submitBodyForm(this.iframe.name, t, n) : this.iframe.src = t, this.iframe.contentWindow;
+      return r ? e.submitBodyForm(this.iframe.name, t, s) : this.iframe.src = t, this.iframe.contentWindow;
     }
-    const i = e.buildWindowName(), o = Et({
+    const i = e.buildWindowName(), o = St({
       url: r ? "about:blank" : t,
       name: i,
       dimensions: this.resolveDimensions()
     });
-    r && e.submitBodyForm(i, t, n);
-    const a = Ot(o, () => {
+    r && e.submitBodyForm(i, t, s);
+    const a = Nt(o, () => {
       e.onPopupClose();
     });
     return e.registerCleanup(a), o;
@@ -2049,18 +2107,18 @@ class Nt {
    * Swaps prerender content with the live iframe after host initialization.
    */
   async swapPrerenderContentIfNeeded() {
-    this.context === m.IFRAME && this.iframe && this.container && (await Ut(this.container, this.prerenderElement, this.iframe), this.prerenderElement = null);
+    this.context === f.IFRAME && this.iframe && this.container && (await Mt(this.container, this.prerenderElement, this.iframe), this.prerenderElement = null);
   }
   /**
    * Submits a hidden form to navigate a target window via POST.
    */
-  submitBodyForm(e, t, n) {
+  submitBodyForm(e, t, s) {
     const r = this.container?.ownerDocument ?? document, i = r.body ?? r.documentElement;
     if (!i)
       throw new Error("Document root is unavailable for bodyParam form submission");
     const o = r.createElement("form");
     o.method = "POST", o.action = t, o.target = e, o.style.display = "none";
-    for (const [a, c] of n.entries()) {
+    for (const [a, c] of s.entries()) {
       const l = r.createElement("input");
       l.type = "hidden", l.name = a, l.value = c, o.appendChild(l);
     }
@@ -2075,81 +2133,95 @@ class Nt {
    * Focuses iframe/popup context.
    */
   focus(e) {
-    this.context === m.IFRAME && this.iframe ? _t(this.iframe) : this.context === m.POPUP && e && xt(e);
+    this.context === f.IFRAME && this.iframe ? Rt(this.iframe) : this.context === f.POPUP && e && Tt(e);
   }
   /**
    * Resizes iframe/popup context.
    */
   resize(e, t) {
-    this.context === m.IFRAME && this.iframe ? yt(this.iframe, e) : this.context === m.POPUP && t && vt(t, e);
+    this.context === f.IFRAME && this.iframe ? Ot(this.iframe, e) : this.context === f.POPUP && t && Ft(t, e);
   }
   /**
    * Shows iframe context.
    */
   show() {
-    this.context === m.IFRAME && this.iframe && wt(this.iframe);
+    this.context === f.IFRAME && this.iframe && Ct(this.iframe);
   }
   /**
    * Hides iframe context.
    */
   hide() {
-    this.context === m.IFRAME && this.iframe && _e(this.iframe);
+    this.context === f.IFRAME && this.iframe && Ce(this.iframe);
   }
   /**
    * Destroys rendered iframe/popup DOM artifacts.
    */
   destroy(e) {
-    this.iframe && (gt(this.iframe), this.iframe = null), this.context === m.POPUP && e && bt(e), this.prerenderElement && (this.prerenderElement.remove(), this.prerenderElement = null);
+    this.iframe && (bt(this.iframe), this.iframe = null), this.context === f.POPUP && e && vt(e), this.prerenderElement && (this.prerenderElement.remove(), this.prerenderElement = null), this.ownedContainer && (this.ownedContainer.remove(), this.ownedContainer = null), this.container = null;
   }
 }
-const Y = "forgeframe:";
-function j(s) {
-  return Y + JSON.stringify(s);
+const ne = "forgeframe:";
+function Y(n) {
+  return ne + JSON.stringify(n);
 }
-function Ft(s) {
-  if (typeof s != "string" || !s.startsWith(Y)) return null;
+function Wt(n) {
+  if (typeof n != "string" || !n.startsWith(ne)) return null;
   try {
-    const e = s.slice(Y.length), t = JSON.parse(e);
+    const e = n.slice(ne.length), t = JSON.parse(e);
     return !t.id || !t.type || !t.name || !t.source ? null : t;
   } catch {
     return null;
   }
 }
-function Ee(s, e, t, n) {
+function xe(n, e, t, s) {
   return {
-    id: s,
-    type: F.REQUEST,
+    id: n,
+    type: z.REQUEST,
     name: e,
     data: t,
-    source: n
+    source: s
   };
 }
-function Ht(s, e, t, n) {
+function Bt(n, e, t, s) {
   return {
-    id: s,
-    type: F.RESPONSE,
+    id: n,
+    type: z.RESPONSE,
     name: "response",
     data: e,
     source: t,
-    error: n ? {
-      message: n.message,
-      stack: n.stack
+    error: s ? {
+      message: s.message,
+      stack: s.stack
     } : void 0
   };
 }
-function $t(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function jt(n) {
+  return n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Lt(s) {
-  if (!s.includes("*"))
+function Vt(n) {
+  if (!n.includes("*"))
     return null;
-  const e = s.split("*").map((t) => $t(t)).join(".*");
+  const e = n.split("*").map((t) => jt(t)).join(".*");
   return new RegExp(`^${e}$`);
 }
-function At(s, e) {
-  return s.global || s.sticky ? new RegExp(s.source, s.flags.replace(/[gy]/g, "")).test(e) : s.test(e);
+function qt(n, e) {
+  return n.global || n.sticky ? new RegExp(n.source, n.flags.replace(/[gy]/g, "")).test(e) : n.test(e);
+}
+function Jt(n, e, t) {
+  return e !== n.targetWin ? !1 : n.expectedOrigin === "*" ? !0 : t === n.expectedOrigin;
+}
+function Kt(n, e) {
+  if (n === "*")
+    return "*";
+  if (n === "/")
+    return e;
+  try {
+    return new URL(n, e).origin;
+  } catch {
+    return n;
+  }
 }
-class Te {
+class $e {
   /**
    * Creates a new Messenger instance.
    *
@@ -2158,8 +2230,8 @@ class Te {
    * @param domain - The origin domain of this messenger
    * @param trustedDomains - Optional domains to trust for incoming messages
    */
-  constructor(e, t = window, n = window.location.origin, r) {
-    this.uid = e, this.win = t, this.domain = n, this.allowedOrigins.add(n), r && this.addTrustedDomain(r), this.setupListener();
+  constructor(e, t = window, s = window.location.origin, r) {
+    this.uid = e, this.win = t, this.domain = s, this.allowedOrigins.add(s), r && this.addTrustedDomain(r), this.setupListener();
   }
   /** @internal */
   pending = /* @__PURE__ */ new Map();
@@ -2189,7 +2261,7 @@ class Te {
     else if (e instanceof RegExp)
       this.allowedOriginPatterns.push(e);
     else {
-      const t = Lt(e);
+      const t = Vt(e);
       t ? this.wildcardPatternRegistry.has(e) || (this.wildcardPatternRegistry.set(e, t), this.allowedOriginPatterns.push(t)) : this.allowedOrigins.add(e);
     }
   }
@@ -2207,7 +2279,7 @@ class Te {
     else {
       const t = this.wildcardPatternRegistry.get(e);
       t && (this.allowedOriginPatterns = this.allowedOriginPatterns.filter(
-        (n) => n !== t
+        (s) => s !== t
       ), this.wildcardPatternRegistry.delete(e)), this.allowedOrigins.delete(e);
     }
   }
@@ -2222,7 +2294,7 @@ class Te {
     if (this.allowedOrigins.has(e))
       return !0;
     for (const t of this.allowedOriginPatterns)
-      if (At(t, e))
+      if (qt(t, e))
         return !0;
     return !1;
   }
@@ -2230,11 +2302,11 @@ class Te {
    * Resolves source identity from the browser event context.
    * @internal
    */
-  resolveVerifiedSource(e, t, n) {
+  resolveVerifiedSource(e, t, s) {
     const r = e, i = this.sourceUidRegistry.get(r);
     if (i)
       return { uid: i, domain: t };
-    const o = n && typeof n.uid == "string" && n.uid.length > 0 ? n.uid : N();
+    const o = s && typeof s.uid == "string" && s.uid.length > 0 ? s.uid : L();
     return this.sourceUidRegistry.set(r, o), { uid: o, domain: t };
   }
   /**
@@ -2250,23 +2322,25 @@ class Te {
    * @returns Promise resolving to the response data
    * @throws Error if messenger is destroyed or timeout occurs
    */
-  async send(e, t, n, r, i = 1e4) {
+  async send(e, t, s, r, i = 1e4) {
     if (this.destroyed)
       throw new Error("Messenger has been destroyed");
-    const o = N(), a = Ee(o, n, r, {
+    const o = L(), a = xe(o, s, r, {
       uid: this.uid,
       domain: this.domain
-    }), c = Oe(), l = setTimeout(() => {
-      this.pending.delete(o), c.reject(new Error(`Message "${n}" timed out after ${i}ms`));
+    }), c = Se(), l = setTimeout(() => {
+      this.pending.delete(o), c.reject(new Error(`Message "${s}" timed out after ${i}ms`));
     }, i);
     this.pending.set(o, {
       deferred: c,
-      timeout: l
+      timeout: l,
+      targetWin: e,
+      expectedOrigin: Kt(t, this.domain)
     });
     try {
-      e.postMessage(j(a), t);
-    } catch (h) {
-      throw this.pending.delete(o), clearTimeout(l), h;
+      e.postMessage(Y(a), t);
+    } catch (m) {
+      throw this.pending.delete(o), clearTimeout(l), m;
     }
     return c.promise;
   }
@@ -2280,14 +2354,14 @@ class Te {
    * @param data - Optional data payload
    * @throws Error if messenger is destroyed
    */
-  post(e, t, n, r) {
+  post(e, t, s, r) {
     if (this.destroyed)
       throw new Error("Messenger has been destroyed");
-    const i = N(), o = Ee(i, n, r, {
+    const i = L(), o = xe(i, s, r, {
       uid: this.uid,
       domain: this.domain
     });
-    e.postMessage(j(o), t);
+    e.postMessage(Y(o), t);
   }
   /**
    * Registers a handler for incoming messages of a specific type.
@@ -2309,28 +2383,31 @@ class Te {
     this.listener = (e) => {
       if (e.source === this.win || !this.isOriginTrusted(e.origin))
         return;
-      const t = Ft(e.data);
+      const t = Wt(e.data);
       if (!t) return;
-      const n = e.source;
-      !n || typeof n.postMessage != "function" || this.handleMessage(t, n, e.origin);
+      const s = e.source;
+      !s || typeof s.postMessage != "function" || this.handleMessage(t, s, e.origin);
     }, this.win.addEventListener("message", this.listener);
   }
   /**
    * Processes a received message.
    * @internal
    */
-  async handleMessage(e, t, n) {
-    if (e.type === F.RESPONSE) {
+  async handleMessage(e, t, s) {
+    if (e.type === z.RESPONSE) {
       const r = this.pending.get(e.id);
-      if (r)
+      if (r) {
+        if (!Jt(r, t, s))
+          return;
         if (this.pending.delete(e.id), clearTimeout(r.timeout), e.error) {
           const i = new Error(e.error.message);
           i.stack = e.error.stack, r.deferred.reject(i);
         } else
           r.deferred.resolve(e.data);
+      }
       return;
     }
-    if (e.type === F.REQUEST) {
+    if (e.type === z.REQUEST) {
       const r = this.handlers.get(e.name);
       if (!r)
         return;
@@ -2338,21 +2415,21 @@ class Te {
       try {
         const c = this.resolveVerifiedSource(
           t,
-          n,
+          s,
           e.source
         );
         i = await r(e.data, c);
       } catch (c) {
         o = c instanceof Error ? c : new Error(String(c));
       }
-      const a = Ht(
+      const a = Bt(
         e.id,
         i,
         { uid: this.uid, domain: this.domain },
         o
       );
       try {
-        t.postMessage(j(a), n);
+        t.postMessage(Y(a), s);
       } catch {
       }
     }
@@ -2381,67 +2458,105 @@ class Te {
     return this.destroyed;
   }
 }
-const be = 32 * 1024;
-function zt(s) {
-  const e = kt(s);
-  return `${H}${e}`;
+const Yt = [
+  "init",
+  "close",
+  "resize",
+  "show",
+  "hide",
+  "onError",
+  "updateProps",
+  "export"
+], De = 32 * 1024;
+function Xt(n) {
+  const e = nn(n);
+  return `${M}${e}`;
 }
-function Ue(s) {
-  if (!s || !s.startsWith(H))
+function Ae(n) {
+  if (!n || !n.startsWith(M))
     return null;
-  const e = s.slice(H.length);
-  return Mt(e);
+  const e = n.slice(M.length);
+  return sn(e);
+}
+function b(n) {
+  return typeof n == "object" && n !== null;
+}
+function Gt(n) {
+  return b(n);
 }
-function ie(s = window) {
+function Zt(n) {
+  return b(n) && Yt.every(
+    (e) => typeof n[e] == "string" && n[e].length > 0
+  );
+}
+function Qt(n) {
+  if (!b(n) || typeof n.tag != "string" || n.tag.length === 0 || typeof n.url != "string" || n.url.length === 0 || n.props !== void 0 && !b(n.props) || n.defaultContext !== void 0 && n.defaultContext !== f.IFRAME && n.defaultContext !== f.POPUP)
+    return !1;
+  if (n.dimensions !== void 0) {
+    if (!b(n.dimensions))
+      return !1;
+    const { width: e, height: t } = n.dimensions;
+    if (e !== void 0 && typeof e != "string" && typeof e != "number" || t !== void 0 && typeof t != "string" && typeof t != "number")
+      return !1;
+  }
+  return !0;
+}
+function en(n) {
+  return b(n) ? Object.values(n).every((e) => Qt(e)) : !1;
+}
+function tn(n) {
+  return !(!b(n) || typeof n.uid != "string" || n.uid.length === 0 || typeof n.tag != "string" || n.tag.length === 0 || typeof n.version != "string" || n.version.length === 0 || n.version !== se || n.context !== f.IFRAME && n.context !== f.POPUP || typeof n.consumerDomain != "string" || n.consumerDomain.length === 0 || !Gt(n.props) || !Zt(n.exports) || n.children !== void 0 && !en(n.children));
+}
+function de(n = window) {
   try {
-    return s.name.startsWith(H);
+    return n.name.startsWith(M);
   } catch {
     return !1;
   }
 }
-function V(s, e = window) {
-  return Ue(e.name)?.tag === s;
+function X(n, e = window) {
+  return Ae(e.name)?.tag === n;
 }
-function kt(s) {
+function nn(n) {
   try {
-    const e = JSON.stringify(s), t = btoa(encodeURIComponent(e)), n = new Blob([t]).size;
-    if (n > be)
+    const e = JSON.stringify(n), t = btoa(encodeURIComponent(e)), s = new Blob([t]).size;
+    if (s > De)
       throw new Error(
-        `Payload size (${Math.round(n / 1024)}KB) exceeds maximum allowed size (${be / 1024}KB). Consider reducing the amount of data passed via props.`
+        `Payload size (${Math.round(s / 1024)}KB) exceeds maximum allowed size (${De / 1024}KB). Consider reducing the amount of data passed via props.`
       );
     return t;
   } catch (e) {
     throw e instanceof Error && e.message.includes("Payload size") ? e : new Error(`Failed to encode payload: ${e}`);
   }
 }
-function Mt(s) {
+function sn(n) {
   try {
-    const e = decodeURIComponent(atob(s));
-    return JSON.parse(e);
+    const e = decodeURIComponent(atob(n)), t = JSON.parse(e);
+    return tn(t) ? t : null;
   } catch {
     return null;
   }
 }
-function Wt(s) {
+function rn(n) {
   return {
-    uid: s.uid,
-    tag: s.tag,
-    version: xe,
-    context: s.context,
-    consumerDomain: s.consumerDomain,
-    props: s.props,
-    exports: s.exports,
-    children: s.children
+    uid: n.uid,
+    tag: n.tag,
+    version: se,
+    context: n.context,
+    consumerDomain: n.consumerDomain,
+    props: n.props,
+    exports: n.exports,
+    children: n.children
   };
 }
-function Bt(s = window) {
-  return Ue(s.name);
+function on(n = window) {
+  return Ae(n.name);
 }
-class jt {
-  constructor(e, t, n, r) {
-    this.uid = e, this.options = t, this.resolveUrl = n, this.resolveUrlOrigin = r;
+class an {
+  constructor(e, t, s, r) {
+    this.uid = e, this.options = t, this.resolveUrl = s, this.resolveUrlOrigin = r;
     const i = this.buildTrustedDomains();
-    this.messenger = new Te(this.uid, window, K(), i), this.bridge = new re(this.messenger);
+    this.messenger = new $e(this.uid, window, k(), i), this.bridge = new he(this.messenger);
   }
   /** Messenger for host communication. */
   messenger;
@@ -2469,7 +2584,7 @@ class jt {
    * Returns true when the domain option explicitly includes this origin.
    */
   isExplicitDomainTrust(e) {
-    return this.options.domain ? C(this.options.domain, e) : !1;
+    return this.options.domain ? v(this.options.domain, e) : !1;
   }
   /**
    * Ensures the messenger trusts the origin for a resolved host URL.
@@ -2478,8 +2593,8 @@ class jt {
     const t = this.resolveUrlOrigin(e);
     if (!t)
       return;
-    const n = this.dynamicUrlTrustedOrigin;
-    n && n !== t && !this.isExplicitDomainTrust(n) && this.messenger.removeTrustedDomain(n), this.messenger.addTrustedDomain(t), this.dynamicUrlTrustedOrigin = t;
+    const s = this.dynamicUrlTrustedOrigin;
+    s && s !== t && !this.isExplicitDomainTrust(s) && this.messenger.removeTrustedDomain(s), this.messenger.addTrustedDomain(t), this.dynamicUrlTrustedOrigin = t;
   }
   /**
    * Returns the current host domain target used for messaging.
@@ -2491,16 +2606,16 @@ class jt {
    * Returns true when the host window is connected and not closed.
    */
   isHostConnected() {
-    return !!(this.hostWindow && !q(this.hostWindow));
+    return !!(this.hostWindow && !Z(this.hostWindow));
   }
   /**
    * Serializes host props while keeping function bridge references in sync.
    */
-  serializePropsForHost(e, t, n) {
+  serializePropsForHost(e, t, s) {
     this.bridge.startBatch();
-    const r = n?.finishBatch ?? !0;
+    const r = s?.finishBatch ?? !0;
     try {
-      const i = ht(e, t, this.bridge);
+      const i = gt(e, t, this.bridge);
       return r && this.bridge.finishBatch(), i;
     } catch (i) {
       throw this.bridge.finishBatch(!0), i;
@@ -2510,13 +2625,13 @@ class jt {
    * Sends the current props snapshot to the host window when available.
    */
   async sendPropsUpdateToHost(e, t) {
-    if (!this.hostWindow || q(this.hostWindow))
+    if (!this.hostWindow || Z(this.hostWindow))
       return;
-    const n = this.getHostDomain(), r = ge(
+    const s = this.getHostDomain(), r = Ee(
       e,
       t,
-      n,
-      Je(this.hostWindow)
+      s,
+      ve(this.hostWindow)
     ), i = this.serializePropsForHost(
       r,
       t,
@@ -2525,7 +2640,7 @@ class jt {
     try {
       await this.messenger.send(
         this.hostWindow,
-        n,
+        s,
         u.PROPS,
         i
       ), this.bridge.finishBatch();
@@ -2537,41 +2652,41 @@ class jt {
    * Builds the window.name payload for host initialization.
    */
   buildWindowName(e) {
-    const t = e.hostDomain ?? this.getHostDomain(), n = ge(
+    const t = e.hostDomain ?? this.getHostDomain(), s = Ee(
       e.props,
       e.propDefinitions,
       t,
       !1
     ), r = this.serializePropsForHost(
-      n,
+      s,
       e.propDefinitions
-    ), i = Wt({
+    ), i = rn({
       uid: this.uid,
       tag: e.tag,
       context: e.context,
-      consumerDomain: K(),
+      consumerDomain: k(),
       props: r,
       exports: e.exports,
       children: e.children
     });
-    return zt(i);
+    return Xt(i);
   }
   /**
    * Waits for the host to send the initialization handshake.
    */
-  async waitForHost(e, t, n) {
+  async waitForHost(e, t, s) {
     if (this.hostInitialized)
       return;
-    const r = Oe();
+    const r = Se();
     this.initPromise = r;
     try {
-      await Be(
+      await Ke(
         r.promise,
         e,
         `Host component "${t}" (uid: ${this.uid}) did not initialize within ${e}ms. Check that the host page loads correctly and calls the initialization code.`
       );
     } catch (i) {
-      throw n(i), i;
+      throw s(i), i;
     } finally {
       this.initPromise === r && (this.initPromise = null);
     }
@@ -2580,11 +2695,15 @@ class jt {
    * Sets up host message handlers.
    */
   setupMessageHandlers(e) {
-    this.messenger.on(u.INIT, () => (this.hostInitialized = !0, this.initPromise && this.initPromise.resolve(), { success: !0 })), this.messenger.on(u.CLOSE, async () => (await e.onClose(), { success: !0 })), this.messenger.on(u.RESIZE, async (t) => (await e.onResize(t), { success: !0 })), this.messenger.on(u.FOCUS, async () => (await e.onFocus(), { success: !0 })), this.messenger.on(u.SHOW, async () => (await e.onShow(), { success: !0 })), this.messenger.on(u.HIDE, async () => (await e.onHide(), { success: !0 })), this.messenger.on(
+    this.messenger.on(u.INIT, () => (this.hostInitialized = !0, this.initPromise && this.initPromise.resolve(), e.onInit && queueMicrotask(() => {
+      Promise.resolve(e.onInit?.()).catch((t) => {
+        e.onError(t);
+      });
+    }), { success: !0 })), this.messenger.on(u.CLOSE, async () => (await e.onClose(), { success: !0 })), this.messenger.on(u.RESIZE, async (t) => (await e.onResize(t), { success: !0 })), this.messenger.on(u.FOCUS, async () => (await e.onFocus(), { success: !0 })), this.messenger.on(u.SHOW, async () => (await e.onShow(), { success: !0 })), this.messenger.on(u.HIDE, async () => (await e.onHide(), { success: !0 })), this.messenger.on(
       u.ERROR,
       async (t) => {
-        const n = new Error(t.message);
-        return n.stack = t.stack, e.onError(n), { success: !0 };
+        const s = new Error(t.message);
+        return s.stack = t.stack, e.onError(s), { success: !0 };
       }
     ), this.messenger.on(u.EXPORT, async (t) => (e.onExport(t), { success: !0 })), this.messenger.on(u.CONSUMER_EXPORT, async (t) => (e.onConsumerExport(t), { success: !0 })), this.messenger.on(u.GET_SIBLINGS, async (t) => e.onGetSiblings(t));
   }
@@ -2595,7 +2714,7 @@ class jt {
     this.messenger.destroy(), this.bridge.destroy();
   }
 }
-class oe {
+class pe {
   /** Event emitter for lifecycle events. */
   event;
   /** Arbitrary state storage for the component instance. */
@@ -2628,6 +2747,8 @@ class oe {
   /** @internal */
   destroyed = !1;
   /** @internal */
+  closing = !1;
+  /** @internal */
   get props() {
     return this.propsPipeline ? this.propsPipeline.props : {};
   }
@@ -2734,7 +2855,7 @@ class oe {
    * @param props - Initial props to pass to the component
    */
   constructor(e, t = {}) {
-    this._uid = Me(), this.options = this.normalizeOptions(e), this.event = new Re(), this.cleanup = new We(), this.renderer = new Nt(
+    this._uid = qe(), this.options = this.normalizeOptions(e), this.event = new Ie(), this.cleanup = new Je(), this.renderer = new kt(
       this.options,
       this.uid,
       () => this.props,
@@ -2743,15 +2864,15 @@ class oe {
         close: () => this.close(),
         focus: () => this.focus()
       }
-    ), this.propsPipeline = new mt(
+    ), this.propsPipeline = new Pt(
       this.options,
       { ...t },
-      (n) => this.createPropContext(n)
-    ), this.transport = new jt(
+      (s) => this.createPropContext(s)
+    ), this.transport = new an(
       this.uid,
       this.options,
       () => this.resolveUrl(),
-      (n) => this.resolveUrlOrigin(n)
+      (s) => this.resolveUrlOrigin(s)
     ), this.setupMessageHandlers(), this.setupCleanup();
   }
   /**
@@ -2777,14 +2898,14 @@ class oe {
       throw new Error("Component has been destroyed");
     if (this.rendered)
       throw new Error("Component has already been rendered");
-    this.context = t ?? this.options.defaultContext, this.checkEligibility(), ve(this.props, this.options.props), this.options.validate?.({ props: this.props }), this.container = this.resolveContainer(e), this.event.emit(p.PRERENDER), this.callPropCallback("onPrerender"), await this.prerender(), this.event.emit(p.PRERENDERED), this.callPropCallback("onPrerendered"), this.event.emit(p.RENDER), this.callPropCallback("onRender");
+    this.context = t ?? this.options.defaultContext, this.checkEligibility(), S(this.props, this.options.props), this.options.validate?.({ props: this.props }), this.container = this.resolveContainer(e), this.event.emit(g.PRERENDER), this.callPropCallback("onPrerender"), await this.prerender(), this.event.emit(g.PRERENDERED), this.callPropCallback("onPrerendered"), this.event.emit(g.RENDER), this.callPropCallback("onRender");
     try {
-      await this.open(), await this.waitForHost(), this.context === m.IFRAME && this.iframe && await this.renderer.swapPrerenderContentIfNeeded();
-    } catch (n) {
+      await this.open(), await this.waitForHost(), this.context === f.IFRAME && this.iframe && await this.renderer.swapPrerenderContentIfNeeded();
+    } catch (s) {
       throw await this.destroy().catch(() => {
-      }), n;
+      }), s;
     }
-    this.rendered = !0, this.event.emit(p.RENDERED), this.callPropCallback("onRendered"), this.event.emit(p.DISPLAY), this.callPropCallback("onDisplay");
+    this.rendered = !0, this.event.emit(g.RENDERED), this.callPropCallback("onRendered"), this.event.emit(g.DISPLAY), this.callPropCallback("onDisplay");
   }
   /**
    * Renders the component into a container in a different window.
@@ -2797,10 +2918,10 @@ class oe {
    * @param container - CSS selector or HTMLElement to render into
    * @param context - Override the default rendering context
    */
-  async renderTo(e, t, n) {
+  async renderTo(e, t, s) {
     if (e !== window)
       throw new Error("Cross-window renderTo is not supported; pass the current window");
-    return this.render(t, n);
+    return this.render(t, s);
   }
   /**
    * Closes and destroys the component.
@@ -2809,7 +2930,14 @@ class oe {
    * Emits the 'close' event before destruction. Safe to call multiple times.
    */
   async close() {
-    this.destroyed || (this.event.emit(p.CLOSE), await this.destroy());
+    if (!(this.destroyed || this.closing)) {
+      this.closing = !0;
+      try {
+        this.event.emit(g.CLOSE), this.callPropCallback("onClose"), await this.destroy();
+      } finally {
+        this.closing = !1;
+      }
+    }
   }
   /**
    * Focuses the component window.
@@ -2818,7 +2946,7 @@ class oe {
    * For iframes, focuses the iframe element. For popups, brings the window to front.
    */
   async focus() {
-    this.renderer.focus(this.hostWindow), this.event.emit(p.FOCUS), this.callPropCallback("onFocus");
+    this.renderer.focus(this.hostWindow), this.event.emit(g.FOCUS), this.callPropCallback("onFocus");
   }
   /**
    * Resizes the component to the specified dimensions.
@@ -2826,7 +2954,7 @@ class oe {
    * @param dimensions - New width and height for the component
    */
   async resize(e) {
-    this.renderer.resize(e, this.hostWindow), this.event.emit(p.RESIZE, e), this.callPropCallback("onResize", e);
+    this.renderer.resize(e, this.hostWindow), this.event.emit(g.RESIZE, e), this.callPropCallback("onResize", e);
   }
   /**
    * Shows the component if hidden.
@@ -2863,13 +2991,13 @@ class oe {
    */
   async applyPropsUpdate(e) {
     const t = {
-      resolveUrl: (n) => this.resolveUrl(n),
-      resolveUrlOrigin: (n) => this.resolveUrlOrigin(n),
-      assertStableRenderedOrigin: (n) => this.assertStableRenderedOrigin(n),
+      resolveUrl: (s) => this.resolveUrl(s),
+      resolveUrlOrigin: (s) => this.resolveUrlOrigin(s),
+      assertStableRenderedOrigin: (s) => this.assertStableRenderedOrigin(s),
       isRendered: () => this.rendered,
-      syncTrustedDomainForUrl: (n) => this.syncTrustedDomainForUrl(n),
+      syncTrustedDomainForUrl: (s) => this.syncTrustedDomainForUrl(s),
       shouldSendPropsToHost: () => this.transport.isHostConnected(),
-      sendPropsUpdateToHost: (n) => this.sendPropsUpdateToHost(n),
+      sendPropsUpdateToHost: (s) => this.sendPropsUpdateToHost(s),
       emitPropsUpdated: () => this.emitPropsUpdated()
     };
     await this.propsPipeline.updateProps(e, t);
@@ -2896,7 +3024,7 @@ class oe {
    * @internal
    */
   emitPropsUpdated() {
-    this.event.emit(p.PROPS, this.props), this.callPropCallback("onProps", this.props);
+    this.event.emit(g.PROPS, this.props), this.callPropCallback("onProps", this.props);
   }
   /**
    * Creates a clone of this instance with the same props.
@@ -2904,7 +3032,7 @@ class oe {
    * @returns A new unrendered component instance with identical configuration
    */
   clone() {
-    const e = new oe(this.options, this.props);
+    const e = new pe(this.options, this.props);
     return e.inputProps = { ...this.inputProps }, e;
   }
   /**
@@ -2923,7 +3051,7 @@ class oe {
     return {
       ...e,
       props: e.props ?? {},
-      defaultContext: e.defaultContext ?? m.IFRAME,
+      defaultContext: e.defaultContext ?? f.IFRAME,
       dimensions: e.dimensions ?? { width: "100%", height: "100%" },
       timeout: e.timeout ?? 1e4,
       children: e.children
@@ -3031,38 +3159,38 @@ class oe {
       buildUrl: (t) => this.buildUrl(t),
       buildBodyParams: () => this.buildBodyParams(),
       buildWindowName: () => this.buildWindowName(),
-      submitBodyForm: (t, n, r) => this.submitBodyForm(t, n, r),
+      submitBodyForm: (t, s, r) => this.submitBodyForm(t, s, r),
       onPopupClose: () => {
         this.close();
       },
       registerCleanup: (t) => {
         this.cleanup.register(t);
       }
-    }), this.hostWindow && et(this.uid, this.hostWindow);
+    }), this.hostWindow && rt(this.uid, this.hostWindow);
   }
   /**
    * Builds the URL for the host window including query parameters.
    * @internal
    */
   buildUrl(e = this.resolveUrl()) {
-    const n = it(this.props, this.options.props).toString();
-    if (!n) return e;
+    const s = lt(this.props, this.options.props).toString();
+    if (!s) return e;
     const r = e.includes("?") ? "&" : "?";
-    return `${e}${r}${n}`;
+    return `${e}${r}${s}`;
   }
   /**
    * Builds POST body parameters from props marked with bodyParam.
    * @internal
    */
   buildBodyParams() {
-    return ot(this.props, this.options.props);
+    return ut(this.props, this.options.props);
   }
   /**
    * Submits a hidden form to navigate a target window via POST.
    * @internal
    */
-  submitBodyForm(e, t, n) {
-    this.renderer.submitBodyForm(e, t, n);
+  submitBodyForm(e, t, s) {
+    this.renderer.submitBodyForm(e, t, s);
   }
   /**
    * Builds the window.name payload for the host window.
@@ -3086,15 +3214,15 @@ class oe {
   buildNestedHostRefs() {
     if (!this.options.children) return;
     const e = this.options.children({ props: this.props }), t = {};
-    for (const [n, r] of Object.entries(e)) {
-      const i = ns(r);
+    for (const [s, r] of Object.entries(e)) {
+      const i = Pn(r);
       if (!i)
-        throw new Error(`Nested component "${n}" is missing component metadata`);
+        throw new Error(`Nested component "${s}" is missing component metadata`);
       if (typeof i.url != "string")
         throw new Error(
-          `Nested component "${n}" must use a static string URL. Function URLs are not supported in children.`
+          `Nested component "${s}" must use a static string URL. Function URLs are not supported in children.`
         );
-      t[n] = {
+      t[s] = {
         tag: i.tag,
         url: i.url,
         props: i.props,
@@ -3144,6 +3272,7 @@ class oe {
    */
   setupMessageHandlers() {
     this.transport.setupMessageHandlers({
+      onInit: () => this.syncSameDomainPropsAfterInit(),
       onClose: async () => this.close(),
       onResize: async (e) => this.resize(e),
       onFocus: async () => this.focus(),
@@ -3159,6 +3288,28 @@ class oe {
       onGetSiblings: (e) => this.getSiblingInstances(e)
     });
   }
+  /**
+   * Synchronizes sameDomain props after the host proves its loaded origin via INIT.
+   * @internal
+   */
+  async syncSameDomainPropsAfterInit() {
+    if (!(!this.hostWindow || !this.transport.isHostConnected()) && ve(this.hostWindow) && this.hasSameDomainPropDefinition())
+      try {
+        await this.propsPipeline.syncCurrentPropsToHost({
+          shouldSendPropsToHost: () => this.transport.isHostConnected(),
+          sendPropsUpdateToHost: (e) => this.sendPropsUpdateToHost(e)
+        });
+      } catch (e) {
+        this.handleError(e);
+      }
+  }
+  /**
+   * Returns true when any prop definition is restricted to same-origin hosts.
+   * @internal
+   */
+  hasSameDomainPropDefinition() {
+    return Object.values(this.options.props).some((e) => !e || x(e) ? !1 : e.sameDomain === !0);
+  }
   /**
    * Gets sibling component instances for a request.
    * @internal
@@ -3166,19 +3317,19 @@ class oe {
   getSiblingInstances(e) {
     const t = [];
     if (e.options?.anyConsumer) {
-      for (const n of ss())
-        n.instance.uid !== e.uid && t.push({
-          uid: n.instance.uid,
-          tag: n.tag,
-          exports: n.instance.exports
+      for (const s of _n())
+        s.instance.uid !== e.uid && t.push({
+          uid: s.instance.uid,
+          tag: s.tag,
+          exports: s.instance.exports
         });
       return t;
     }
-    for (const n of ts(e.tag))
-      n.uid !== e.uid && t.push({
-        uid: n.uid,
+    for (const s of wn(e.tag))
+      s.uid !== e.uid && t.push({
+        uid: s.uid,
         tag: e.tag,
-        exports: n.exports
+        exports: s.exports
       });
     return t;
   }
@@ -3188,7 +3339,7 @@ class oe {
    */
   setupCleanup() {
     this.cleanup.register(() => {
-      this.messenger.destroy(), this.bridge.destroy(), tt(this.uid);
+      this.messenger.destroy(), this.bridge.destroy(), it(this.uid);
     });
   }
   /**
@@ -3196,17 +3347,17 @@ class oe {
    * @internal
    */
   handleError(e) {
-    this.event.emit(p.ERROR, e), this.callPropCallback("onError", e);
+    this.event.emit(g.ERROR, e), this.callPropCallback("onError", e);
   }
   /**
    * Calls a prop callback if it exists.
    * @internal
    */
   callPropCallback(e, ...t) {
-    const n = this.props[e];
-    if (typeof n == "function")
+    const s = this.props[e];
+    if (typeof s == "function")
       try {
-        const r = n(...t);
+        const r = s(...t);
         r && typeof r == "object" && "catch" in r && typeof r.catch == "function" && r.catch((i) => {
           console.error(`Error in async ${e} callback:`, i);
         });
@@ -3223,31 +3374,31 @@ class oe {
       new Error(
         `Component "${this.options.tag}" was destroyed before initialization completed`
       )
-    ), this.initPromise = null), this.hostInitialized = !1, this.renderer.destroy(this.hostWindow), this.hostWindow = null, this.openedHostDomain = null, this.dynamicUrlTrustedOrigin = null, this.pendingPropsUpdate = null, await this.cleanup.cleanup(), this.event.emit(p.DESTROY), this.callPropCallback("onDestroy"), this.event.removeAllListeners());
+    ), this.initPromise = null), this.hostInitialized = !1, this.renderer.destroy(this.hostWindow), this.hostWindow = null, this.openedHostDomain = null, this.dynamicUrlTrustedOrigin = null, this.pendingPropsUpdate = null, await this.cleanup.cleanup(), this.event.emit(g.DESTROY), this.callPropCallback("onDestroy"), this.event.removeAllListeners());
   }
 }
-const v = /* @__PURE__ */ new Map(), S = /* @__PURE__ */ new Map();
-function Vt(s, e) {
+const T = /* @__PURE__ */ new Map(), U = /* @__PURE__ */ new Map();
+function cn(n, e) {
   const t = e;
-  v.get(t.uid) && Ne(t.uid);
-  let r = S.get(s);
-  r || (r = /* @__PURE__ */ new Map(), S.set(s, r)), r.set(t.uid, t), v.set(t.uid, { tag: s, instance: t });
+  T.get(t.uid) && Le(t.uid);
+  let r = U.get(n);
+  r || (r = /* @__PURE__ */ new Map(), U.set(n, r)), r.set(t.uid, t), T.set(t.uid, { tag: n, instance: t });
 }
-function Ne(s) {
-  const e = v.get(s);
+function Le(n) {
+  const e = T.get(n);
   if (!e)
     return;
-  v.delete(s);
-  const t = S.get(e.tag);
-  t && (t.delete(s), t.size === 0 && S.delete(e.tag));
+  T.delete(n);
+  const t = U.get(e.tag);
+  t && (t.delete(n), t.size === 0 && U.delete(e.tag));
 }
-function Kt(s) {
-  return Array.from(S.get(s)?.values() ?? []);
+function ln(n) {
+  return Array.from(U.get(n)?.values() ?? []);
 }
-function qt() {
-  return Array.from(v.values());
+function un() {
+  return Array.from(T.values());
 }
-const Fe = "Could not resolve consumer window", Jt = /* @__PURE__ */ new Set([
+const ze = "Could not resolve consumer window", G = "Could not verify consumer origin", hn = /* @__PURE__ */ new Set([
   "uid",
   "tag",
   "close",
@@ -3264,7 +3415,7 @@ const Fe = "Could not resolve consumer window", Jt = /* @__PURE__ */ new Set([
   "getPeerInstances",
   "children"
 ]);
-class Xt {
+class dn {
   /**
    * Creates a new HostComponent instance.
    *
@@ -3273,13 +3424,13 @@ class Xt {
    * @param allowedConsumerDomains - Optional allowlist of consumer domains
    * @param deferInit - Whether to defer INIT until a later explicit flush
    */
-  constructor(e, t = {}, n, r = !1) {
-    this.propDefinitions = t, this.allowedConsumerDomains = n, this.deferInit = r, this.uid = e.uid, this.tag = e.tag, this.consumerDomain = e.consumerDomain, this.validateConsumerDomain(), this.event = new Re(), this.messenger = new Te(this.uid, window, K(), this.consumerDomain);
-    let i = null;
+  constructor(e, t = {}, s, r = !1) {
+    this.propDefinitions = t, this.allowedConsumerDomains = s, this.deferInit = r, this.uid = e.uid, this.tag = e.tag, this.event = new Ie();
+    let i = null, o = null;
     try {
-      this.setupMessageHandlers(), this.consumerWindow = this.resolveConsumerWindow(), i = new re(this.messenger), this.bridge = i, this.hostProps = this.buildHostProps(e), this.exposeHostProps(), this.deferInit || this.flushInit();
-    } catch (o) {
-      throw i?.destroy(), this.messenger.destroy(), this.event.removeAllListeners(), this.propsHandlers.clear(), o;
+      this.consumerWindow = this.resolveConsumerWindow(), this.consumerDomain = this.resolveConsumerDomain(e.consumerDomain), o = new $e(this.uid, window, k(), this.consumerDomain), this.messenger = o, this.setupMessageHandlers(), i = new he(this.messenger), this.bridge = i, this.hostProps = this.buildHostProps(e), this.exposeHostProps(), this.deferInit || this.flushInit();
+    } catch (a) {
+      throw i?.destroy(), o?.destroy(), this.event.removeAllListeners(), this.propsHandlers.clear(), a;
     }
   }
   /** The hostProps object containing props and control methods passed from the consumer. */
@@ -3295,6 +3446,8 @@ class Xt {
   /** @internal */
   consumerDomain;
   /** @internal */
+  consumerDomainVerified = !1;
+  /** @internal */
   messenger;
   /** @internal */
   bridge;
@@ -3352,11 +3505,93 @@ class Xt {
    * @internal
    */
   validateConsumerDomain() {
-    if (this.allowedConsumerDomains && !C(this.allowedConsumerDomains, this.consumerDomain))
+    if (this.allowedConsumerDomains) {
+      if (!this.consumerDomain)
+        throw new Error(
+          `${G} for component "${this.tag}"`
+        );
+      if (!v(this.allowedConsumerDomains, this.consumerDomain))
+        throw new Error(
+          `Consumer domain "${this.consumerDomain}" is not allowed for component "${this.tag}"`
+        );
+    }
+  }
+  /**
+   * Reads a browser-verifiable consumer origin when available.
+   * @internal
+   */
+  getVerifiedConsumerOrigin() {
+    return this.getReferrerOrigin() ?? this.getAccessibleConsumerOrigin();
+  }
+  /**
+   * Updates the tracked consumer origin and keeps trusted messaging origins in sync.
+   * @internal
+   */
+  setConsumerDomain(e, t) {
+    const s = this.consumerDomain;
+    this.consumerDomain = e, this.consumerDomainVerified = t, !(!this.messenger || !s || s === e) && (this.messenger.removeTrustedDomain(s), this.messenger.addTrustedDomain(e));
+  }
+  /**
+   * Applies host configuration that may arrive after deferred pre-initialization.
+   * @internal
+   */
+  applyHostConfiguration(e, t) {
+    t !== void 0 && (this.allowedConsumerDomains = t), e !== void 0 && (this.propDefinitions = e, S(this.consumerProps, this.getBootstrapValidationDefinitions()), Object.assign(this.hostProps, this.consumerProps), this.hostProps.consumer.props = this.consumerProps);
+  }
+  /**
+   * Resolves the consumer origin from browser-provided context and falls back to the
+   * claimed bootstrap origin only when no explicit allowlist is configured.
+   * @internal
+   */
+  resolveConsumerDomain(e) {
+    const t = this.getVerifiedConsumerOrigin();
+    if (t)
+      return this.consumerDomainVerified = !0, this.consumerDomain = t, this.validateConsumerDomain(), t;
+    if (this.consumerDomainVerified = !1, this.allowedConsumerDomains)
+      throw new Error(
+        `${G} for component "${this.tag}"`
+      );
+    return e;
+  }
+  /**
+   * Rechecks allowlist constraints against a browser-verified consumer origin.
+   * @internal
+   */
+  assertAllowedConsumerDomain(e) {
+    const t = this.getVerifiedConsumerOrigin();
+    if (t && this.setConsumerDomain(t, !0), !this.consumerDomainVerified)
+      throw new Error(
+        `${G} for component "${this.tag}"`
+      );
+    if (!v(e, this.consumerDomain))
       throw new Error(
         `Consumer domain "${this.consumerDomain}" is not allowed for component "${this.tag}"`
       );
   }
+  /**
+   * Reads the consumer origin from the browser-provided referrer when available.
+   * @internal
+   */
+  getReferrerOrigin() {
+    if (!document.referrer)
+      return null;
+    try {
+      return new URL(document.referrer, window.location.href).origin;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Reads the consumer origin directly when same-origin access is available.
+   * @internal
+   */
+  getAccessibleConsumerOrigin() {
+    try {
+      return this.consumerWindow.location.origin;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Returns the hostProps object.
    *
@@ -3370,22 +3605,22 @@ class Xt {
    * @internal
    */
   resolveConsumerWindow() {
-    if (Ge()) {
-      const e = Ye();
+    if (tt()) {
+      const e = et();
       if (e) return e;
     }
-    if (Ze()) {
-      const e = Xe();
+    if (nt()) {
+      const e = Qe();
       if (e) return e;
     }
-    throw new Error(Fe);
+    throw new Error(ze);
   }
   /**
    * Builds the hostProps object with deserialized props and control methods.
    * @internal
    */
   buildHostProps(e) {
-    const t = we(
+    const t = Oe(
       e.props,
       this.propDefinitions,
       this.messenger,
@@ -3393,28 +3628,47 @@ class Xt {
       this.consumerWindow,
       this.consumerDomain
     );
-    return this.consumerProps = t, {
+    return S(t, this.getBootstrapValidationDefinitions()), this.consumerProps = t, {
       ...t,
       uid: this.uid,
       tag: this.tag,
       close: () => this.close(),
       focus: () => this.focus(),
-      resize: (n) => this.resize(n),
+      resize: (s) => this.resize(s),
       show: () => this.show(),
       hide: () => this.hide(),
-      onProps: (n) => this.onProps(n),
-      onError: (n) => this.onError(n),
+      onProps: (s) => this.onProps(s),
+      onError: (s) => this.onError(s),
       getConsumer: () => this.consumerWindow,
       getConsumerDomain: () => this.consumerDomain,
-      export: (n) => this.exportData(n),
+      export: (s) => this.exportData(s),
       consumer: {
         props: this.consumerProps,
-        export: (n) => this.consumerExport(n)
+        export: (s) => this.consumerExport(s)
       },
-      getPeerInstances: (n) => this.getPeerInstances(n),
+      getPeerInstances: (s) => this.getPeerInstances(s),
       children: this.buildNestedComponents(e.children)
     };
   }
+  /**
+   * Relaxes required sameDomain props during bootstrap for verified same-origin hosts.
+   * Those props are synchronized after INIT through the live messaging channel.
+   * @internal
+   */
+  getBootstrapValidationDefinitions() {
+    if (!this.consumerDomainVerified || this.consumerDomain !== k())
+      return this.propDefinitions;
+    let e = !1;
+    const t = {
+      ...this.propDefinitions
+    };
+    for (const [s, r] of Object.entries(this.propDefinitions))
+      !r || x(r) || !r.sameDomain || (e = !0, t[s] = {
+        ...r,
+        required: !1
+      });
+    return e ? t : this.propDefinitions;
+  }
   /**
    * Sends initialization message to the consumer.
    * @internal
@@ -3429,7 +3683,7 @@ class Xt {
       );
     } catch (e) {
       const t = e instanceof Error ? e : new Error(String(e));
-      this.initError = t, this.event.emit(p.ERROR, {
+      this.initError = t, this.event.emit(g.ERROR, {
         type: "init_failed",
         message: `Failed to initialize host component: ${t.message}`,
         error: t
@@ -3571,9 +3825,9 @@ class Xt {
   buildNestedComponents(e) {
     if (!e) return;
     const t = {};
-    for (const [n, r] of Object.entries(e))
+    for (const [s, r] of Object.entries(e))
       try {
-        t[n] = $e({
+        t[s] = ke({
           tag: r.tag,
           url: r.url,
           props: r.props,
@@ -3581,7 +3835,7 @@ class Xt {
           defaultContext: r.defaultContext
         });
       } catch (i) {
-        console.warn(`Failed to create nested component "${n}":`, i);
+        console.warn(`Failed to create nested component "${s}":`, i);
       }
     return Object.keys(t).length > 0 ? t : void 0;
   }
@@ -3592,7 +3846,7 @@ class Xt {
   setupMessageHandlers() {
     this.messenger.on(u.PROPS, (e) => {
       try {
-        const t = this.consumerProps, n = we(
+        const t = this.consumerProps, s = Oe(
           e,
           this.propDefinitions,
           this.messenger,
@@ -3600,17 +3854,17 @@ class Xt {
           this.consumerWindow,
           this.consumerDomain
         );
-        this.removeStaleHostProps(t, n), this.consumerProps = n, Object.assign(this.hostProps, n), this.hostProps.consumer.props = this.consumerProps;
+        S(s, this.propDefinitions), this.removeStaleHostProps(t, s), this.consumerProps = s, Object.assign(this.hostProps, s), this.hostProps.consumer.props = this.consumerProps;
         for (const r of this.propsHandlers)
           try {
-            r(n);
+            r(s);
           } catch (i) {
             console.error("Error in props handler:", i);
           }
-        return this.event.emit(p.PROPS, n), { success: !0 };
+        return this.event.emit(g.PROPS, s), { success: !0 };
       } catch (t) {
-        const n = t instanceof Error ? t : new Error(String(t));
-        throw console.error("Error deserializing props:", n), this.event.emit(p.ERROR, n), n;
+        const s = t instanceof Error ? t : new Error(String(t));
+        throw console.error("Error deserializing props:", s), this.event.emit(g.ERROR, s), s;
       }
     });
   }
@@ -3619,8 +3873,8 @@ class Xt {
    * @internal
    */
   removeStaleHostProps(e, t) {
-    for (const n of Object.keys(e))
-      n in t || Jt.has(n) || delete this.hostProps[n];
+    for (const s of Object.keys(e))
+      s in t || hn.has(s) || delete this.hostProps[s];
   }
   /**
    * Destroys the host component and cleans up resources.
@@ -3630,178 +3884,179 @@ class Xt {
   }
 }
 let w = null;
-function ae(s, e, t = {}) {
+function fe(n, e, t = {}) {
   if (w) {
-    if (e) {
-      const r = w.getProps().getConsumerDomain();
-      if (!C(e, r))
-        throw Qt(), new Error(
-          `Consumer domain "${r}" is not allowed for this host component`
-        );
+    try {
+      w.applyHostConfiguration(
+        n,
+        e
+      ), e && w.assertAllowedConsumerDomain(e);
+    } catch (r) {
+      throw gn(), r;
     }
     return t.deferInit || w.flushInit(), w;
   }
-  if (!ie())
+  if (!de())
     return null;
-  const n = Bt();
-  if (!n)
+  const s = on();
+  if (!s)
     return console.error("Failed to parse ForgeFrame payload from window.name"), null;
   try {
-    w = new Xt(
-      n,
+    w = new dn(
       s,
+      n,
       e,
       t.deferInit ?? !1
     );
   } catch (r) {
-    if (r instanceof Error && r.message === Fe)
+    if (r instanceof Error && r.message === ze)
       return null;
     throw r;
   }
   return w;
 }
-function Yt() {
-  return ie();
+function pn() {
+  return de();
 }
-function Gt() {
-  return ie();
+function fn() {
+  return de();
 }
-function Zt() {
+function mn() {
   return window.hostProps;
 }
-function Qt() {
+function gn() {
   w && (w.destroy(), w = null), delete window.hostProps;
 }
-const k = /* @__PURE__ */ new Map(), He = /* @__PURE__ */ Symbol("forgeframe.component.options");
-function es(s) {
-  if (!s.tag)
+const V = /* @__PURE__ */ new Map(), Me = /* @__PURE__ */ Symbol("forgeframe.component.options");
+function yn(n) {
+  if (!n.tag)
     throw new Error("Component tag is required");
-  if (!/^[a-z][a-z0-9-]*$/.test(s.tag))
+  if (!/^[a-z][a-z0-9-]*$/.test(n.tag))
     throw new Error(
-      `Invalid component tag "${s.tag}". Must start with lowercase letter and contain only lowercase letters, numbers, and hyphens.`
+      `Invalid component tag "${n.tag}". Must start with lowercase letter and contain only lowercase letters, numbers, and hyphens.`
     );
-  if (!s.url)
+  if (!n.url)
     throw new Error("Component url is required");
-  if (typeof s.url == "string")
+  if (typeof n.url == "string")
     try {
-      new URL(s.url, window.location.origin);
+      new URL(n.url, window.location.origin);
     } catch {
       throw new Error(
-        `Invalid component URL "${s.url}". Must be a valid absolute or relative URL.`
+        `Invalid component URL "${n.url}". Must be a valid absolute or relative URL.`
       );
     }
-  if (k.has(s.tag))
-    throw new Error(`Component "${s.tag}" is already registered`);
+  if (V.has(n.tag))
+    throw new Error(`Component "${n.tag}" is already registered`);
 }
-function $e(s) {
-  es(s);
+function ke(n) {
+  yn(n);
   const e = [];
   let t;
-  if (V(s.tag)) {
-    const r = ae(s.props, s.allowedConsumerDomains);
+  if (X(n.tag)) {
+    const r = fe(n.props, n.allowedConsumerDomains);
     r && (t = r.hostProps);
   }
-  const n = function(r = {}) {
-    const i = new oe(s, r);
-    return e.push(i), Vt(s.tag, i), i.event.once("destroy", () => {
+  const s = function(r = {}) {
+    const i = new pe(n, r);
+    return e.push(i), cn(n.tag, i), i.event.once("destroy", () => {
       const o = e.indexOf(i);
-      o !== -1 && e.splice(o, 1), Ne(i.uid);
+      o !== -1 && e.splice(o, 1), Le(i.uid);
     }), i;
   };
-  return n.instances = e, n.isHost = () => V(s.tag), n.isEmbedded = () => V(s.tag), n.hostProps = t, n[He] = s, n.canRenderTo = async (r) => r === window, k.set(s.tag, n), n;
+  return s.instances = e, s.isHost = () => X(n.tag), s.isEmbedded = () => X(n.tag), s.hostProps = t, s[Me] = n, s.canRenderTo = async (r) => r === window, V.set(n.tag, s), s;
 }
-function ts(s) {
-  return Kt(s);
+function wn(n) {
+  return ln(n);
 }
-function ss() {
-  return qt();
+function _n() {
+  return un();
 }
-function ns(s) {
-  return s[He];
+function Pn(n) {
+  return n[Me];
 }
-async function rs(s) {
-  await s.close();
+async function En(n) {
+  await n.close();
 }
-async function Le(s) {
-  const e = k.get(s);
+async function We(n) {
+  const e = V.get(n);
   if (!e) return;
   const t = [...e.instances];
-  await Promise.all(t.map((n) => n.close()));
+  await Promise.all(t.map((s) => s.close()));
 }
-async function is() {
-  const s = Array.from(k.keys());
-  await Promise.all(s.map((e) => Le(e)));
+async function bn() {
+  const n = Array.from(V.keys());
+  await Promise.all(n.map((e) => We(e)));
 }
-function os(s, e) {
-  const t = Object.keys(s), n = Object.keys(e);
-  if (t.length !== n.length)
+function On(n, e) {
+  const t = Object.keys(n), s = Object.keys(e);
+  if (t.length !== s.length)
     return !1;
   for (const r of t)
-    if (!Object.prototype.hasOwnProperty.call(e, r) || !Object.is(s[r], e[r]))
+    if (!Object.prototype.hasOwnProperty.call(e, r) || !Object.is(n[r], e[r]))
       return !1;
   return !0;
 }
-function as(s, e) {
-  const { React: t } = e, { createElement: n, useRef: r, useEffect: i, useState: o, forwardRef: a } = t, c = a(
-    function(f, g) {
+function Cn(n, e) {
+  const { React: t } = e, { createElement: s, useRef: r, useEffect: i, useState: o, forwardRef: a } = t, c = a(
+    function(h, d) {
       const {
-        onRendered: ce,
-        onError: M,
-        onClose: le,
-        context: Ae,
-        className: ue,
-        style: he,
-        ...de
-      } = f, D = r(null), W = r(null), B = r(null), T = r(M), [pe, ze] = o(null);
+        onRendered: C,
+        onError: q,
+        onClose: me,
+        context: Be,
+        className: ge,
+        style: ye,
+        ...J
+      } = h, F = r(null), K = r(null), H = r(null), $ = r(q), [we, je] = o(null);
       return i(() => {
-        T.current = M;
-      }, [M]), i(() => {
-        const R = D.current;
-        if (!R) return;
-        const y = s(de);
-        return W.current = y, ce && y.event.once("rendered", ce), le && y.event.once("close", le), y.event.on("error", (E) => {
-          T.current?.(E);
-        }), y.render(R, Ae).catch((E) => {
-          ze(E), T.current?.(E);
+        $.current = q;
+      }, [q]), i(() => {
+        const D = F.current;
+        if (!D) return;
+        const y = n(J);
+        return K.current = y, H.current = J, C && y.event.once("rendered", C), me && y.event.once("close", me), y.event.on("error", (E) => {
+          $.current?.(E);
+        }), y.render(D, Be).catch((E) => {
+          je(E), $.current?.(E);
         }), () => {
           y.close().catch(() => {
-          }), W.current = null, B.current = null;
+          }), K.current = null, H.current = null;
         };
       }, []), i(() => {
-        const R = W.current;
-        if (!R) return;
-        const y = de, E = B.current;
-        E && os(E, y) || (B.current = y, R.updateProps(y).catch((ke) => {
-          T.current?.(ke);
+        const D = K.current;
+        if (!D) return;
+        const y = J, E = H.current;
+        E && On(E, y) || (H.current = y, D.updateProps(y).catch((Ve) => {
+          $.current?.(Ve);
         }));
       }), i(() => {
-        g && typeof g == "object" && D.current && (g.current = D.current);
-      }, [g]), pe ? n(
+        d && typeof d == "object" && F.current && (d.current = F.current);
+      }, [d]), we ? s(
         "div",
         {
-          className: ue,
-          style: { color: "red", padding: "16px", ...he }
+          className: ge,
+          style: { color: "red", padding: "16px", ...ye }
         },
-        `Error: ${pe.message}`
-      ) : n("div", {
-        ref: D,
-        className: ue,
+        `Error: ${we.message}`
+      ) : s("div", {
+        ref: F,
+        className: ge,
         style: {
           display: "inline-block",
-          ...he
+          ...ye
         }
       });
     }
-  ), l = `ForgeFrame(${s.name || "Component"})`;
+  ), l = `ForgeFrame(${n.name || "Component"})`;
   return c.displayName = l, c;
 }
-function ls(s) {
+function xn(n) {
   return function(t) {
-    return as(t, { React: s });
+    return Cn(t, { React: n });
   };
 }
-ae(void 0, void 0, { deferInit: !0 });
-const us = {
+fe(void 0, void 0, { deferInit: !0 });
+const Dn = {
   /**
    * Create a new component definition.
    *
@@ -3826,23 +4081,23 @@ const us = {
    * await instance.render('#container');
    * ```
    */
-  create: $e,
+  create: ke,
   /**
    * Destroy a single component instance.
    *
    * @param instance - The component instance to destroy
    */
-  destroy: rs,
+  destroy: En,
   /**
    * Destroy all instances of a specific component by tag.
    *
    * @param tag - The component tag name
    */
-  destroyByTag: Le,
+  destroyByTag: We,
   /**
    * Destroy all ForgeFrame component instances.
    */
-  destroyAll: is,
+  destroyAll: bn,
   /**
    * Check if the current window is a host component context.
    *
@@ -3852,7 +4107,7 @@ const us = {
    *
    * @returns True if running inside a ForgeFrame iframe/popup
    */
-  isHost: Yt,
+  isHost: pn,
   /**
    * Check if the current window is embedded by ForgeFrame.
    *
@@ -3861,7 +4116,7 @@ const us = {
    *
    * @returns True if running inside a ForgeFrame iframe/popup
    */
-  isEmbedded: Gt,
+  isEmbedded: fn,
   /**
    * Get hostProps from the current host window.
    *
@@ -3870,7 +4125,7 @@ const us = {
    *
    * @returns The hostProps object if in host context, undefined otherwise
    */
-  getHostProps: Zt,
+  getHostProps: mn,
   /**
    * Flush host initialization in embedded contexts.
    *
@@ -3881,30 +4136,30 @@ const us = {
    *
    * @returns The host component instance if running embedded, otherwise null
    */
-  initHost: ae,
+  initHost: fe,
   /**
    * Serialization strategy constants.
    * @see {@link PROP_SERIALIZATION}
    */
-  PROP_SERIALIZATION: U,
+  PROP_SERIALIZATION: A,
   /**
    * Rendering context constants (IFRAME, POPUP).
    * @see {@link CONTEXT}
    */
-  CONTEXT: m,
+  CONTEXT: f,
   /**
    * Lifecycle event name constants.
    * @see {@link EVENT}
    */
-  EVENT: p,
+  EVENT: g,
   /**
    * Error thrown when popup window fails to open.
    */
-  PopupOpenError: De,
+  PopupOpenError: He,
   /**
    * Current library version.
    */
-  VERSION: xe,
+  VERSION: se,
   /**
    * Check if a value is a Standard Schema (Zod, Valibot, ArkType, etc.)
    *
@@ -3921,7 +4176,7 @@ const us = {
    * }
    * ```
    */
-  isStandardSchema: z,
+  isStandardSchema: x,
   /**
    * Prop schema builders for defining component props.
    *
@@ -3944,36 +4199,36 @@ const us = {
    * });
    * ```
    */
-  prop: d
+  prop: p
 };
 export {
-  ne as AnySchema,
-  $ as ArraySchema,
-  Q as BooleanSchema,
-  m as CONTEXT,
-  p as EVENT,
-  se as EnumSchema,
-  us as ForgeFrame,
-  ee as FunctionSchema,
-  te as LiteralSchema,
-  Z as NumberSchema,
-  L as ObjectSchema,
-  U as PROP_SERIALIZATION,
-  De as PopupOpenError,
+  ue as AnySchema,
+  W as ArraySchema,
+  oe as BooleanSchema,
+  f as CONTEXT,
+  g as EVENT,
+  le as EnumSchema,
+  Dn as ForgeFrame,
+  ae as FunctionSchema,
+  ce as LiteralSchema,
+  ie as NumberSchema,
+  B as ObjectSchema,
+  A as PROP_SERIALIZATION,
+  He as PopupOpenError,
   _ as PropSchema,
-  G as StringSchema,
-  xe as VERSION,
-  $e as create,
-  as as createReactComponent,
-  us as default,
-  rs as destroy,
-  is as destroyAll,
-  Le as destroyByTag,
-  Zt as getHostProps,
-  ae as initHost,
-  Gt as isEmbedded,
-  Yt as isHost,
-  z as isStandardSchema,
-  d as prop,
-  ls as withReactComponent
+  re as StringSchema,
+  se as VERSION,
+  ke as create,
+  Cn as createReactComponent,
+  Dn as default,
+  En as destroy,
+  bn as destroyAll,
+  We as destroyByTag,
+  mn as getHostProps,
+  fe as initHost,
+  fn as isEmbedded,
+  pn as isHost,
+  x as isStandardSchema,
+  p as prop,
+  xn as withReactComponent
 };