netra-artifacts 0.1.0-alpha.6 → 0.1.0-alpha.8

package/CHANGELOG.md

@@ -5,12 +5,33 @@ adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-### Changed
-
-- Trusted YouTube embeds and inline JavaScript are now explicit opt-ins. The
-  script-capable iframe sandbox omits `allow-same-origin`, and an internal
-  postMessage resize bridge keeps isolated video/script previews auto-sized.
-- HTML-artifact prompt reworked to a **hybrid styling model**: one small shared
+### Added
+
+- **Starter prompt templates.** `STARTER_PROMPTS` (exported from
+  `netra-artifacts/client`) ships 8 prebuilt templates — each a short show
+  `label` plus a rich `prompt` actually sent to the model — covering an HTML
+  artifact, markdown answer, three.js game, generative-UI-from-JSON, image-rich
+  page, YouTube video page, pricing page, and sign-up form. `ArtifactChat`
+  renders them as chips below the composer; each carries per-request `body`
+  overrides (`mode`/`game`/`allowVideoEmbeds`/…) now merged by `sendMessage`'s
+  new second argument. Pass `starterPrompts={[]}` to hide them.
+- **Single-file three.js games.** New `allowModuleImports` sanitize/preview flag
+  keeps a `<script type="importmap">` whose targets resolve to a trusted,
+  version-pinned ESM CDN (`esm.sh`, `cdn.jsdelivr.net`, `unpkg.com`,
+  `cdn.skypack.dev`), so a self-contained game can `import … from "three"` with
+  no build step. The game frame runs in the isolated `allow-scripts` sandbox
+  (no `allow-same-origin`) with a defense-in-depth CSP pinning script/connect to
+  those CDNs. New `game` server option switches the HTML prompt to a dedicated
+  three.js game builder (pinned import map + module + fixed-timestep loop) and
+  implies `allowModuleImports`. New `threejs-games` agent skill + single-file
+  setup guidance in `threejs-fundamentals`.
+
+### Changed
+
+- Trusted YouTube embeds and inline JavaScript are now explicit opt-ins. The
+  script-capable iframe sandbox omits `allow-same-origin`, and an internal
+  postMessage resize bridge keeps isolated video/script previews auto-sized.
+- HTML-artifact prompt reworked to a **hybrid styling model**: one small shared
   `<style>` design system (box-sizing reset + fluid `clamp()` type/space scale +
   element defaults + `.wrap/.stack/.grid/.row/.card/.scroll-x` utility classes)
   plus inline `style=""` for per-element specifics, with an optional 1–2 `@media`

package/README.md

@@ -41,14 +41,17 @@ const google = createGoogleGenerativeAI({
 });
 
 export async function POST(req: Request) {
-  const { messages } = await req.json();
+  // Spread the body so per-request fields from the client (mode, game,
+  // allowVideoEmbeds, allowModuleImports) — e.g. those sent by the built-in
+  // starter prompts — are forwarded into the options.
+  const body = await req.json();
   const model = google("gemini-2.5-flash");
 
   return createArtifactStreamResponse({
-    messages,
+    ...body,
     generateTextStream: (args) => streamText({ model, ...args }).textStream,
     generateText: async (args) => (await generateText({ model, ...args })).text,
-    mode: "auto",
+    mode: body.mode ?? "auto",
     snapshotIntervalMs: 0,
     allowExternalFonts: true,
   });
@@ -94,12 +97,12 @@ export async function POST(req: Request) {
         sanitize: {
           allowForms: true,
           allowScripts: false,
-          allowInlineStyles: true,
-          allowStyleTags: true,
-          allowSvg: true,
-          allowExternalFonts: false,
-          allowVideoEmbeds: false,
-        },
+          allowInlineStyles: true,
+          allowStyleTags: true,
+          allowSvg: true,
+          allowExternalFonts: false,
+          allowVideoEmbeds: false,
+        },
         snapshotIntervalMs: 0,
       },
       emit,
@@ -213,17 +216,18 @@ type ArtifactStreamEvent =
 
 ## Security
 
-Artifacts are static HTML/CSS by default:
-
-- Scripts are stripped unless `allowScripts` is explicitly enabled
-- Event handler attributes are stripped
-- Dangerous URLs are stripped
-- Iframes, embeds, object tags, and refresh meta tags are stripped unless `allowVideoEmbeds` keeps a normalized trusted YouTube iframe
-- The preview iframe receives `allow-scripts` only for opt-in inline scripts or trusted video embeds, and that script-capable path omits `allow-same-origin`
-- `allowExternalFonts` only keeps approved Google Fonts hosts
-
-Use Netra's default mode for safe previews of generated static HTML. Opt into
-scripts only for artifacts you are comfortable executing in an isolated iframe.
+Artifacts are static HTML/CSS by default:
+
+- Scripts are stripped unless `allowScripts` is explicitly enabled
+- Event handler attributes are stripped
+- Dangerous URLs are stripped
+- Iframes, embeds, object tags, and refresh meta tags are stripped unless `allowVideoEmbeds` keeps a normalized trusted YouTube iframe
+- `<script type="importmap">` is stripped unless `allowModuleImports` is set, and then only mappings that resolve to a trusted, version-pinned ESM CDN survive — enabling single-file ESM games (e.g. three.js) with a defense-in-depth CSP on the frame
+- The preview iframe receives `allow-scripts` only for opt-in inline scripts, trusted video embeds, or module-import games, and that script-capable path omits `allow-same-origin`
+- `allowExternalFonts` only keeps approved Google Fonts hosts
+
+Use Netra's default mode for safe previews of generated static HTML. Opt into
+scripts only for artifacts you are comfortable executing in an isolated iframe.
 
 ## Checks
 

package/dist/client/ArtifactChat.d.ts

@@ -1,10 +1,17 @@
 import * as React from "react";
+import { type StarterPrompt } from "./starterPrompts.js";
 import type { HtmlArtifactCardProps, UseArtifactStreamOptions } from "../types/client.js";
 export interface ArtifactChatProps extends UseArtifactStreamOptions {
     placeholder?: string;
     emptyState?: React.ReactNode;
     cardProps?: Partial<Omit<HtmlArtifactCardProps, "artifact">>;
     className?: string;
+    /**
+     * Template chips shown below the composer. Defaults to {@link STARTER_PROMPTS}.
+     * Pass `[]` to hide them. Clicking one sends its detailed prompt with its
+     * per-request `body` overrides (mode/game/allowVideoEmbeds/…).
+     */
+    starterPrompts?: StarterPrompt[];
 }
 /**
  * A batteries-included chat surface: message list, streaming status, and a

package/dist/client/ArtifactChat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactChat.d.ts","sourceRoot":"","sources":["../../src/client/ArtifactChat.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE1F,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,2CAgGpD"}
+{"version":3,"file":"ArtifactChat.d.ts","sourceRoot":"","sources":["../../src/client/ArtifactChat.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE1F,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,2CA4IpD"}

package/dist/client/ArtifactChat.js

@@ -3,17 +3,23 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { useArtifactStream } from "./useArtifactStream.js";
 import { ArtifactMessage } from "./ArtifactMessage.js";
+import { STARTER_PROMPTS } from "./starterPrompts.js";
 /**
  * A batteries-included chat surface: message list, streaming status, and a
  * composer. Drop it in with just an `endpoint` to get the full experience, or
  * compose `useArtifactStream` + `ArtifactMessage` yourself for custom layouts.
  */
 export function ArtifactChat(props) {
-    const { placeholder = "Ask anything, or describe a UI to generate…", emptyState, cardProps, className, ...streamOptions } = props;
+    const { placeholder = "Ask anything, or describe a UI to generate…", emptyState, cardProps, className, starterPrompts = STARTER_PROMPTS, ...streamOptions } = props;
     const { messages, artifacts, status, sendMessage, stop } = useArtifactStream(streamOptions);
     const [input, setInput] = React.useState("");
     const scrollRef = React.useRef(null);
     const busy = status === "submitted" || status === "streaming";
+    const showStarters = !busy && messages.length === 0 && starterPrompts.length > 0;
+    const runStarter = (p) => {
+        setInput("");
+        void sendMessage(p.prompt, p.body);
+    };
     React.useEffect(() => {
         scrollRef.current?.scrollTo({ top: scrollRef.current.scrollHeight, behavior: "smooth" });
     }, [messages, artifacts]);
@@ -44,7 +50,28 @@ export function ArtifactChat(props) {
                             fontSize: 14.5,
                             outline: "none",
                             background: "#fff",
-                        } }), busy ? (_jsx("button", { type: "button", onClick: stop, style: btn("#ef4444"), children: "Stop" })) : (_jsx("button", { type: "submit", disabled: !input.trim(), style: btn("#2563eb", !input.trim()), children: "Send" }))] })] }));
+                        } }), busy ? (_jsx("button", { type: "button", onClick: stop, style: btn("#ef4444"), children: "Stop" })) : (_jsx("button", { type: "submit", disabled: !input.trim(), style: btn("#2563eb", !input.trim()), children: "Send" }))] }), showStarters && (_jsx("div", { role: "list", "aria-label": "Starter prompts", style: {
+                    display: "flex",
+                    flexWrap: "wrap",
+                    gap: 8,
+                    padding: "0 10px 12px",
+                }, children: starterPrompts.map((p) => (_jsxs("button", { type: "button", role: "listitem", onClick: () => runStarter(p), title: p.hint, style: chip(), children: [_jsx("span", { "aria-hidden": "true", style: { fontSize: 15 }, children: p.emoji }), _jsx("span", { style: { fontWeight: 600 }, children: p.label }), _jsxs("span", { style: { color: "#9ca3af", fontWeight: 400 }, children: ["\u00B7 ", p.hint] })] }, p.id))) }))] }));
+}
+function chip() {
+    return {
+        display: "inline-flex",
+        alignItems: "center",
+        gap: 7,
+        border: "1px solid rgba(0,0,0,0.12)",
+        borderRadius: 999,
+        padding: "7px 13px",
+        fontSize: 13,
+        lineHeight: 1.2,
+        color: "var(--aha-fg, #1f2430)",
+        background: "rgba(0,0,0,0.02)",
+        cursor: "pointer",
+        whiteSpace: "nowrap",
+    };
 }
 function btn(bg, disabled = false) {
     return {

package/dist/client/ArtifactChat.js.map

@@ -1 +1 @@
-{"version":3,"file":"ArtifactChat.js","sourceRoot":"","sources":["../../src/client/ArtifactChat.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,WAAW,GAAG,6CAA6C,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;IAClI,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GACtD,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAEnC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW,CAAC;IAE9D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1B,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE;QACpC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC;QACnB,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO,CACL,eACE,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE;YACL,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,CAAC;YACZ,UAAU,EACR,4FAA4F;YAC9F,KAAK,EAAE,wBAAwB;SAChC,aAED,eACE,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAEtE,QAAQ,CAAC,MAAM,KAAK,CAAC;wBACpB,CAAC,UAAU,IAAI,CACb,cAAK,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,yHAEnF,CACP,CAAC,EAEH,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,eAAe,IAEd,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,IAHf,OAAO,CAAC,EAAE,CAIf,CACH,CAAC,EAED,MAAM,KAAK,WAAW,IAAI,CACzB,cAAK,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,+BAE5D,CACP,IACG,EAEN,gBACE,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;oBACL,OAAO,EAAE,MAAM;oBACf,GAAG,EAAE,CAAC;oBACN,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,4BAA4B;iBACxC,aAED,gBACE,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,EAAE,WAAW,gBACb,SAAS,EACpB,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC;4BACP,MAAM,EAAE,4BAA4B;4BACpC,YAAY,EAAE,EAAE;4BAChB,OAAO,EAAE,WAAW;4BACpB,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,MAAM;4BACf,UAAU,EAAE,MAAM;yBACnB,GACD,EACD,IAAI,CAAC,CAAC,CAAC,CACN,iBAAQ,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,qBAEjD,CACV,CAAC,CAAC,CAAC,CACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,qBAE1E,CACV,IACI,IACH,CACP,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,EAAU,EAAE,QAAQ,GAAG,KAAK;IACvC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC5C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ArtifactChat.js","sourceRoot":"","sources":["../../src/client/ArtifactChat.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAsB,MAAM,qBAAqB,CAAC;AAgB1E;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,EACJ,WAAW,GAAG,6CAA6C,EAC3D,UAAU,EACV,SAAS,EACT,SAAS,EACT,cAAc,GAAG,eAAe,EAChC,GAAG,aAAa,EACjB,GAAG,KAAK,CAAC;IACV,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GACtD,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAEnC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW,CAAC;IAC9D,MAAM,YAAY,GAChB,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAG,CAAC,CAAgB,EAAE,EAAE;QACtC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1B,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE;QACpC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC;QACnB,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO,CACL,eACE,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE;YACL,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,CAAC;YACZ,UAAU,EACR,4FAA4F;YAC9F,KAAK,EAAE,wBAAwB;SAChC,aAED,eACE,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAEtE,QAAQ,CAAC,MAAM,KAAK,CAAC;wBACpB,CAAC,UAAU,IAAI,CACb,cAAK,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,yHAEnF,CACP,CAAC,EAEH,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACzB,KAAC,eAAe,IAEd,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,IAHf,OAAO,CAAC,EAAE,CAIf,CACH,CAAC,EAED,MAAM,KAAK,WAAW,IAAI,CACzB,cAAK,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,+BAE5D,CACP,IACG,EAEN,gBACE,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;oBACL,OAAO,EAAE,MAAM;oBACf,GAAG,EAAE,CAAC;oBACN,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,4BAA4B;iBACxC,aAED,gBACE,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,EAAE,WAAW,gBACb,SAAS,EACpB,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC;4BACP,MAAM,EAAE,4BAA4B;4BACpC,YAAY,EAAE,EAAE;4BAChB,OAAO,EAAE,WAAW;4BACpB,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,MAAM;4BACf,UAAU,EAAE,MAAM;yBACnB,GACD,EACD,IAAI,CAAC,CAAC,CAAC,CACN,iBAAQ,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,qBAEjD,CACV,CAAC,CAAC,CAAC,CACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,qBAE1E,CACV,IACI,EAEN,YAAY,IAAI,CACf,cACE,IAAI,EAAC,MAAM,gBACA,iBAAiB,EAC5B,KAAK,EAAE;oBACL,OAAO,EAAE,MAAM;oBACf,QAAQ,EAAE,MAAM;oBAChB,GAAG,EAAE,CAAC;oBACN,OAAO,EAAE,aAAa;iBACvB,YAEA,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACzB,kBAEE,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,UAAU,EACf,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAC5B,KAAK,EAAE,CAAC,CAAC,IAAI,EACb,KAAK,EAAE,IAAI,EAAE,aAEb,8BAAkB,MAAM,EAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAC7C,CAAC,CAAC,KAAK,GACH,EACP,eAAM,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAG,CAAC,CAAC,KAAK,GAAQ,EAClD,gBAAM,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,wBAAK,CAAC,CAAC,IAAI,IAAQ,KAXhE,CAAC,CAAC,EAAE,CAYF,CACV,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,SAAS,IAAI;IACX,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,CAAC;QACN,MAAM,EAAE,4BAA4B;QACpC,YAAY,EAAE,GAAG;QACjB,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,wBAAwB;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,EAAU,EAAE,QAAQ,GAAG,KAAK;IACvC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC5C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -2,6 +2,7 @@ export { useArtifactStream } from "./useArtifactStream.js";
 export { ArtifactChat, type ArtifactChatProps } from "./ArtifactChat.js";
 export { ArtifactMessage, type ArtifactMessageProps } from "./ArtifactMessage.js";
 export { MarkdownMessage, type MarkdownMessageProps } from "./MarkdownMessage.js";
+export { STARTER_PROMPTS, type StarterPrompt } from "./starterPrompts.js";
 export { HtmlArtifactCard, HtmlArtifactPreview, HtmlArtifactModal, HtmlArtifactToolbar, HtmlArtifactCodeView, } from "../iframe/index.js";
 export type { ChatMessage, ArtifactStreamStatus, UseArtifactStreamOptions, UseArtifactStreamReturn, HtmlArtifactCardProps, HtmlArtifactPreviewOptions, } from "../types/client.js";
 export type { HtmlArtifact, ArtifactTheme, ArtifactPresentation, } from "../types/artifact.js";

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGlF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/dist/client/index.js

@@ -3,6 +3,7 @@ export { useArtifactStream } from "./useArtifactStream.js";
 export { ArtifactChat } from "./ArtifactChat.js";
 export { ArtifactMessage } from "./ArtifactMessage.js";
 export { MarkdownMessage } from "./MarkdownMessage.js";
+export { STARTER_PROMPTS } from "./starterPrompts.js";
 // Re-export the iframe surface for convenience from the client entry.
 export { HtmlArtifactCard, HtmlArtifactPreview, HtmlArtifactModal, HtmlArtifactToolbar, HtmlArtifactCodeView, } from "../iframe/index.js";
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAC;AAElF,sEAAsE;AACtE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA0B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAsB,MAAM,qBAAqB,CAAC;AAE1E,sEAAsE;AACtE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC"}

package/dist/client/starterPrompts.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Prebuilt starter prompts shown below the composer. Each has a short `label`
+ * (the chip the user sees) and a rich `prompt` (the detailed message actually
+ * sent to the model). `body` carries per-request overrides merged into the POST
+ * body by `sendMessage` — e.g. `{ game: true }` or `{ mode: "generative_ui" }`.
+ *
+ * NOTE: for the `body` overrides to take effect, the server route must forward
+ * those fields into `createArtifactStreamResponse` options, e.g.:
+ *   `createArtifactStreamResponse({ ...(await req.json()), generateTextStream })`.
+ */
+export interface StarterPrompt {
+    /** Stable id. */
+    id: string;
+    /** Short chip text shown to the user. */
+    label: string;
+    /** One-line description of what it produces. */
+    hint: string;
+    /** Leading glyph for the chip. */
+    emoji: string;
+    /** The full, detailed message sent to the chat. */
+    prompt: string;
+    /** Per-request body overrides merged into the POST body for this prompt. */
+    body?: Record<string, unknown>;
+}
+export declare const STARTER_PROMPTS: StarterPrompt[];
+//# sourceMappingURL=starterPrompts.d.ts.map

package/dist/client/starterPrompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"starterPrompts.d.ts","sourceRoot":"","sources":["../../src/client/starterPrompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,iBAAiB;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAqCD,eAAO,MAAM,eAAe,EAAE,aAAa,EA+E1C,CAAC"}

package/dist/client/starterPrompts.js

@@ -0,0 +1,102 @@
+/** YouTube videos used by the video-embed starter. */
+const VIDEO_URLS = [
+    "https://www.youtube.com/embed/dQw4w9WgXcQ?si=O39oVkrE_1PpJrRX",
+    "https://www.youtube.com/embed/_e8BFrAPedM?si=L3FxEEFbGARDVAtG",
+    "https://www.youtube.com/embed/H7gWCJNPpzk?si=trRfbxLq0ercujsX",
+    "https://www.youtube.com/embed/wQs0uhFhMaI?si=iFm1GedCmKw5SsGi",
+    "https://www.youtube.com/embed/glXx2r3ePcs?si=1iALmW5BiMPvEpTi",
+];
+/** Prebuilt generative-UI data payload (kept realistic and complete). */
+const ORDER_JSON = JSON.stringify({
+    order: { id: "NX-48217", placed: "2026-05-28T14:02:00Z", status: "out_for_delivery", eta: "2026-05-30T18:00:00Z" },
+    customer: { name: "Aria Nakamura", tier: "Gold" },
+    shipment: {
+        carrier: "Aerolane",
+        tracking: "AL93 4471 0028",
+        steps: [
+            { label: "Ordered", at: "May 28, 2:02 PM", done: true },
+            { label: "Packed", at: "May 28, 7:40 PM", done: true },
+            { label: "Shipped", at: "May 29, 9:15 AM", done: true },
+            { label: "Out for delivery", at: "May 30, 8:10 AM", done: true },
+            { label: "Delivered", at: "Est. May 30, 6:00 PM", done: false },
+        ],
+    },
+    items: [
+        { name: "Aurora Wireless Headphones", qty: 1, price: 248.0, image: "headphones" },
+        { name: "USB-C Braided Cable (2m)", qty: 2, price: 19.0, image: "cable" },
+    ],
+    totals: { subtotal: 286.0, shipping: 0, tax: 22.88, total: 308.88, currency: "USD" },
+}, null, 2);
+export const STARTER_PROMPTS = [
+    {
+        id: "artifact-dashboard",
+        label: "Analytics dashboard",
+        hint: "Rich HTML artifact",
+        emoji: "📊",
+        body: { mode: "artifact" },
+        prompt: "Design a polished dark-mode SaaS analytics dashboard as a single self-contained HTML artifact. Include: a top bar with product name, a time-range selector, and a search; a row of 4 KPI cards (Revenue $48.9K +4.2%, Active Users 12,480 +1.8%, Churn 1.9% -0.3%, MRR $61.2K +5.1%) each with a tiny inline sparkline; a large area/line chart of revenue over 12 months drawn with inline SVG; a donut chart of traffic sources; and a recent-transactions table with status pills. Use a confident accent color, soft gradients, hairline borders, generous spacing, and precomputed realistic numbers. Make it fully responsive and compact on phones.",
+    },
+    {
+        id: "markdown-explainer",
+        label: "Explain a concept",
+        hint: "Formatted markdown answer",
+        emoji: "📝",
+        body: { mode: "markdown" },
+        prompt: "Explain how CSS Flexbox vs CSS Grid differ and when to use each. Answer in well-structured markdown: a short intro, an H2 for each, bullet lists of strengths, a comparison table (axis, alignment, use case), a fenced ```css code block showing a holy-grail layout with Grid, and a final 'rule of thumb' callout. Keep it practical and skimmable.",
+    },
+    {
+        id: "game-runner",
+        label: "Make a 3D game",
+        hint: "Playable three.js game",
+        emoji: "🎮",
+        body: { game: true },
+        prompt: "Build a complete, playable single-file three.js endless-runner game. The player is a glowing cube on a neon grid lane that auto-runs forward; left/right (A/D or arrows, plus on-screen touch buttons) dodges oncoming obstacles, space jumps. Spawn obstacles and floating score orbs with object pooling, speed up over time, and detect collisions. Show a DOM HUD with score, a start menu, pause (Esc/P), and a game-over screen with restart. Use ACES tone mapping, ambient + directional light, a deliberate synthwave palette, screen-shake on hit, and a fixed-timestep loop. Make it genuinely fun.",
+    },
+    {
+        id: "genui-order",
+        label: "Render this JSON",
+        hint: "Generative UI from data",
+        emoji: "🧩",
+        body: { mode: "generative_ui" },
+        prompt: "Render this order-tracking data as a beautiful, embedded generative-UI component (seamless, transparent page — it sits inline in a dark chat). Show a header with order id and an 'Out for delivery' status pill, a horizontal stepper for the shipment steps (completed vs pending), the item list with quantities and prices (use small picsum thumbnails keyed off the image field), the carrier + tracking number, and a totals summary. Cards must have their own visible surface. Here is the data:\n\n```json\n" +
+            ORDER_JSON +
+            "\n```",
+    },
+    {
+        id: "image-landing",
+        label: "Travel landing page",
+        hint: "Image-rich design",
+        emoji: "🖼️",
+        body: { mode: "artifact" },
+        prompt: "Create a striking landing page for a boutique travel company called 'Wayfare' as a single HTML artifact. Full-bleed hero with a background photo (use https://picsum.photos/seed/wayfare/1920/1080), overlaid headline, subtext and a search-trip bar; a 3-up 'Featured destinations' card grid with different seeded picsum images (seed per card: kyoto, patagonia, lisbon), price-from labels and ratings; a testimonial; and a footer CTA. Editorial typography, warm palette, rounded cards, tasteful shadows. Every image responsive with aspect-ratio and alt text. Fully responsive.",
+    },
+    {
+        id: "video-gallery",
+        label: "Video watch page",
+        hint: "YouTube embeds",
+        emoji: "▶️",
+        body: { mode: "artifact", allowVideoEmbeds: true },
+        prompt: "Build a YouTube-style watch page as a single HTML artifact. A large primary player at the top embedding " +
+            VIDEO_URLS[0] +
+            ", with a title, channel row, and action buttons; then a 'Up next' list on the side/below with the remaining videos as clickable thumbnail cards that each embed their player in a responsive 16:9 wrapper. Embed these: " +
+            VIDEO_URLS.slice(1).join(" , ") +
+            ". Every iframe must use referrerpolicy=\"strict-origin-when-cross-origin\", loading=\"lazy\", allowfullscreen, and a black rounded wrapper. Dark UI, clean spacing, fully responsive.",
+    },
+    {
+        id: "pricing",
+        label: "SaaS pricing page",
+        hint: "Conversion-focused design",
+        emoji: "💳",
+        body: { mode: "artifact" },
+        prompt: "Design a modern 3-tier SaaS pricing section as a single HTML artifact: Starter $0, Pro $24/mo (highlighted 'Most popular' with a glow/badge and scale), and Scale $79/mo. Each card: price, billing note, a feature checklist with check icons, and a CTA button. Add a monthly/annual toggle (native, CSS-only or simple), a feature-comparison table below, and an FAQ using native <details>. Premium dark aesthetic, one accent color, strong hierarchy, accessible contrast, responsive (cards stack on mobile).",
+    },
+    {
+        id: "signup-form",
+        label: "Sign-up form",
+        hint: "Polished form UI",
+        emoji: "✍️",
+        body: { mode: "artifact", allowForms: true },
+        prompt: "Create a beautiful centered sign-up card as a single HTML artifact: brand mark, heading, social sign-in buttons (Google/GitHub with inline SVG icons), an 'or' divider, then fields for full name, email, and password with a visible strength hint, a terms checkbox, and a primary 'Create account' button, plus a 'Sign in' link. Style inputs with clear labels, comfortable padding, ≥44px targets, focus rings, and helpful inline validation styling (error/success states via CSS). Glassy card on a soft gradient background, fully responsive.",
+    },
+];
+//# sourceMappingURL=starterPrompts.js.map

package/dist/client/starterPrompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"starterPrompts.js","sourceRoot":"","sources":["../../src/client/starterPrompts.ts"],"names":[],"mappings":"AAyBA,sDAAsD;AACtD,MAAM,UAAU,GAAG;IACjB,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;CAChE,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAC/B;IACE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,sBAAsB,EAAE;IAClH,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;IACjD,QAAQ,EAAE;QACR,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;YACtD,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;YACvD,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;YAChE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,EAAE;SAChE;KACF;IACD,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE;QACjF,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;KAC1E;IACD,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACrF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC1B,MAAM,EACJ,4nBAA4nB;KAC/nB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC1B,MAAM,EACJ,wVAAwV;KAC3V;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACpB,MAAM,EACJ,glBAAglB;KACnlB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;QAC/B,MAAM,EACJ,wfAAwf;YACxf,UAAU;YACV,OAAO;KACV;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC1B,MAAM,EACJ,8jBAA8jB;KACjkB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE;QAClD,MAAM,EACJ,0GAA0G;YAC1G,UAAU,CAAC,CAAC,CAAC;YACb,0NAA0N;YAC1N,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/B,uLAAuL;KAC1L;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;QAC1B,MAAM,EACJ,ufAAuf;KAC1f;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE;QAC5C,MAAM,EACJ,0hBAA0hB;KAC7hB;CACF,CAAC"}

package/dist/client/useArtifactStream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useArtifactStream.d.ts","sourceRoot":"","sources":["../../src/client/useArtifactStream.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,uBAAuB,CAoPzB"}
+{"version":3,"file":"useArtifactStream.d.ts","sourceRoot":"","sources":["../../src/client/useArtifactStream.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,uBAAuB,CAqPzB"}

package/dist/client/useArtifactStream.js

@@ -68,7 +68,7 @@ export function useArtifactStream(options) {
         setMode(null);
         setError(null);
     }, [stop]);
-    const sendMessage = React.useCallback(async (text) => {
+    const sendMessage = React.useCallback(async (text, bodyOverrides) => {
         const trimmed = text.trim();
         if (!trimmed || status === "streaming" || status === "submitted")
             return;
@@ -93,6 +93,7 @@ export function useArtifactStream(options) {
                 headers: { "Content-Type": "application/json", ...headers },
                 body: JSON.stringify({
                     ...body,
+                    ...bodyOverrides,
                     messages: history.map(({ role, content }) => ({ role, content })),
                 }),
             });

package/dist/client/useArtifactStream.js.map

@@ -1 +1 @@
-{"version":3,"file":"useArtifactStream.js","sourceRoot":"","sources":["../../src/client/useArtifactStream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAiC;IAEjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEtE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAC5C,eAAe,IAAI,EAAE,CACtB,CAAC;IACF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAC9C,EAAE,CACH,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAuB,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAyB,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAgB,QAAQ,CAAC,CAAC;IAE1D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,WAAW,CAAC,OAAO,GAAG,QAAQ,CAAC;IACjC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CACrC,CAAC,EAAU,EAAE,KAA4B,EAAE,EAAE;QAC3C,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GACZ,IAAI,CAAC,EAAE,CAAC;gBACP;oBACC,EAAE;oBACF,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,EAAE;oBACR,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACS,CAAC;YAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,sBAAsB,GAAG,KAAK,CAAC,WAAW,CAC9C,CAAC,EAAiB,EAAE,IAAyB,EAAU,EAAE;QACvD,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACpB,GAAG,IAAI;YACP;gBACE,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,IAAI,IAAI,SAAS;aACxB;SACF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CACpC,CAAC,EAAU,EAAE,KAA2B,EAAE,EAAE;QAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,EAAE,CAAC;QACP,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CACnC,KAAK,EAAE,IAAY,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO;QAEzE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAEd,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,eAAe,EAAE;YACrB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;SACjB,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACtD,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,SAAS,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC;QAE9B,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,IAAI;oBACP,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;iBAClE,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvB,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;oBAChB,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,WAAW,GAAG,EAAE,CAAC,IAAI,CAAC;wBACtB,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;wBACjB,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC;wBAC3B,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;4BACpB,GAAG,IAAI;4BACP;gCACE,EAAE,EAAE,EAAE,CAAC,SAAS;gCAChB,IAAI,EAAE,WAAW;gCACjB,OAAO,EAAE,EAAE;gCACX,IAAI,EAAE,WAAW,IAAI,SAAS;6BAC/B;yBACF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS;4BACnB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,EAAE;4BACzC,CAAC,CAAC,CAAC,CACN,CACF,CAAC;wBACF,MAAM;oBACR,CAAC;oBACD,KAAK,cAAc,CAAC,CAAC,CAAC;wBACpB,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;wBACpD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,WAAW,GAAG,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;wBAC/D,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE;4BAC3B,KAAK,EAAE,EAAE,CAAC,KAAK;4BACf,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI;4BAClC,MAAM,EAAE,WAAW;yBACpB,CAAC,CAAC;wBACH,YAAY,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;wBACzD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;4BACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;4BACrC,IAAI,CAAC,QAAQ;gCAAE,OAAO,IAAI,CAAC;4BAC3B,OAAO;gCACL,GAAG,IAAI;gCACP,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;oCACf,GAAG,QAAQ;oCACX,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,KAAK;oCAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iCACtB;6BACF,CAAC;wBACJ,CAAC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;wBACzB,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;wBACpD,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE;4BAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;4BACb,QAAQ,EAAE,EAAE,CAAC,IAAI;4BACjB,MAAM,EAAE,UAAU;yBACnB,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,OAAO,CAAC,CAAC,CAAC;wBACb,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;wBAClC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBACd,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;wBACf,IAAI,CAAC,EAAE,CAAC,WAAW;4BAAE,SAAS,CAAC,OAAO,CAAC,CAAC;wBACxC,MAAM;oBACR,CAAC;oBACD,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU;gBAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC,EACD;QACE,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,MAAM;QACN,aAAa;QACb,YAAY;QACZ,sBAAsB;QACtB,OAAO;KACR,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,WAAW;QACX,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useArtifactStream.js","sourceRoot":"","sources":["../../src/client/useArtifactStream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAiC;IAEjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEtE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAC5C,eAAe,IAAI,EAAE,CACtB,CAAC;IACF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAC9C,EAAE,CACH,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAuB,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAyB,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAgB,QAAQ,CAAC,CAAC;IAE1D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,WAAW,CAAC,OAAO,GAAG,QAAQ,CAAC;IACjC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CACrC,CAAC,EAAU,EAAE,KAA4B,EAAE,EAAE;QAC3C,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GACZ,IAAI,CAAC,EAAE,CAAC;gBACP;oBACC,EAAE;oBACF,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,EAAE;oBACR,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACS,CAAC;YAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,sBAAsB,GAAG,KAAK,CAAC,WAAW,CAC9C,CAAC,EAAiB,EAAE,IAAyB,EAAU,EAAE;QACvD,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACpB,GAAG,IAAI;YACP;gBACE,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,IAAI,IAAI,SAAS;aACxB;SACF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CACpC,CAAC,EAAU,EAAE,KAA2B,EAAE,EAAE;QAC1C,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,EAAE,CAAC;QACP,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CACnC,KAAK,EAAE,IAAY,EAAE,aAAuC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO;QAEzE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAEd,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,eAAe,EAAE;YACrB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO;SACjB,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACtD,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,SAAS,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC;QAE9B,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,WAAW,GAAwB,IAAI,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,IAAI;oBACP,GAAG,aAAa;oBAChB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;iBAClE,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvB,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;oBAChB,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,WAAW,GAAG,EAAE,CAAC,IAAI,CAAC;wBACtB,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;wBACjB,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC;wBAC3B,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;4BACpB,GAAG,IAAI;4BACP;gCACE,EAAE,EAAE,EAAE,CAAC,SAAS;gCAChB,IAAI,EAAE,WAAW;gCACjB,OAAO,EAAE,EAAE;gCACX,IAAI,EAAE,WAAW,IAAI,SAAS;6BAC/B;yBACF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS;4BACnB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,EAAE;4BACzC,CAAC,CAAC,CAAC,CACN,CACF,CAAC;wBACF,MAAM;oBACR,CAAC;oBACD,KAAK,cAAc,CAAC,CAAC,CAAC;wBACpB,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;wBACpD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,WAAW,GAAG,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;wBAC/D,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE;4BAC3B,KAAK,EAAE,EAAE,CAAC,KAAK;4BACf,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI;4BAClC,MAAM,EAAE,WAAW;yBACpB,CAAC,CAAC;wBACH,YAAY,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;wBACzD,MAAM;oBACR,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE;4BACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;4BACrC,IAAI,CAAC,QAAQ;gCAAE,OAAO,IAAI,CAAC;4BAC3B,OAAO;gCACL,GAAG,IAAI;gCACP,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;oCACf,GAAG,QAAQ;oCACX,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,KAAK;oCAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iCACtB;6BACF,CAAC;wBACJ,CAAC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;wBACzB,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;wBACpD,MAAM;oBACR,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE;4BAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;4BACb,QAAQ,EAAE,EAAE,CAAC,IAAI;4BACjB,MAAM,EAAE,UAAU;yBACnB,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;oBACD,KAAK,OAAO,CAAC,CAAC,CAAC;wBACb,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;wBAClC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBACd,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;wBACf,IAAI,CAAC,EAAE,CAAC,WAAW;4BAAE,SAAS,CAAC,OAAO,CAAC,CAAC;wBACxC,MAAM;oBACR,CAAC;oBACD,KAAK,MAAM,CAAC,CAAC,CAAC;wBACZ,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACb,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU;gBAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC,EACD;QACE,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,MAAM;QACN,aAAa;QACb,YAAY;QACZ,sBAAsB;QACtB,OAAO;KACR,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,WAAW;QACX,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/constants/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/constants/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,iGACgE,CAAC;AAE/F,oDAAoD;AACpD,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,eAAe,CAQ9D,CAAC;AAEF,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,0BAA0B,CAgBxE,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,8BAA8B;AAC9B,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/constants/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,iGACgE,CAAC;AAE/F,oDAAoD;AACpD,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,eAAe,CAS9D,CAAC;AAEF,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,0BAA0B,CAiBxE,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,8BAA8B;AAC9B,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC"}

package/dist/constants/defaults.js

@@ -10,6 +10,7 @@ export const DEFAULT_SANITIZE_OPTIONS = {
     allowSvg: true,
     allowExternalFonts: false,
     allowVideoEmbeds: false,
+    allowModuleImports: false,
 };
 /** Preview defaults for the iframe card. */
 export const DEFAULT_PREVIEW_OPTIONS = {
@@ -21,6 +22,7 @@ export const DEFAULT_PREVIEW_OPTIONS = {
     allowSvg: true,
     allowExternalFonts: false,
     allowVideoEmbeds: false,
+    allowModuleImports: false,
     sanitize: true,
     seamless: true,
     minHeight: 420,

package/dist/constants/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/constants/defaults.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4FAA4F,CAAC;AAE/F,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAA8B;IACjE,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI;IACd,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAyC;IAC3E,OAAO,EAAE,eAAe;IACxB,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI;IACd,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,KAAK;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,qBAAqB;CACpC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;CACV,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/constants/defaults.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4FAA4F,CAAC;AAE/F,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAA8B;IACjE,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI;IACd,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAyC;IAC3E,OAAO,EAAE,eAAe;IACxB,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,KAAK;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI;IACd,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,KAAK;IACzB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,qBAAqB;CACpC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;CACV,CAAC"}

package/dist/constants/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./events.js";
 export * from "./sandbox.js";
 export * from "./defaults.js";
+export * from "./trustedCdnHosts.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC"}

package/dist/constants/index.js

@@ -1,4 +1,5 @@
 export * from "./events.js";
 export * from "./sandbox.js";
 export * from "./defaults.js";
+export * from "./trustedCdnHosts.js";
 //# sourceMappingURL=index.js.map

package/dist/constants/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC"}

package/dist/constants/trustedCdnHosts.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Allowlist for ESM module URLs that may appear in a `<script type="importmap">`
+ * when `allowModuleImports` is enabled (single-file games, e.g. three.js).
+ *
+ * The sanitizer guarantees no arbitrary JavaScript can be loaded: an importmap
+ * only maps bare specifiers to URLs, and the inline module that consumes it can
+ * only `import` from those mapped URLs. So the security boundary is "which URLs
+ * may a mapping target." We require:
+ *
+ *   1. https only,
+ *   2. a known immutable ESM CDN host, and
+ *   3. a version-pinned path (so a mapping can't silently float to new code).
+ *
+ * This mirrors the deliberately-narrow allowlist approach already used for
+ * Google Fonts (`ALLOWED_FONT_LINK`) and trusted YouTube embeds.
+ */
+/** Immutable, versioned ESM CDN hosts. */
+export declare const TRUSTED_MODULE_CDN_HOSTS: readonly string[];
+/**
+ * True if `value` is an https URL on a trusted CDN host with a version-pinned
+ * package path. Accepts a bare specifier check too: callers pass fully-resolved
+ * URLs (importmap values), not bare names.
+ */
+export declare function isTrustedModuleUrl(value: string): boolean;
+/** CSP source list (space-joined origins) for the trusted CDN hosts. */
+export declare function trustedModuleCdnOrigins(): string;
+//# sourceMappingURL=trustedCdnHosts.d.ts.map

package/dist/constants/trustedCdnHosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedCdnHosts.d.ts","sourceRoot":"","sources":["../../src/constants/trustedCdnHosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAKrD,CAAC;AAYF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/dist/constants/trustedCdnHosts.js

@@ -0,0 +1,58 @@
+/**
+ * Allowlist for ESM module URLs that may appear in a `<script type="importmap">`
+ * when `allowModuleImports` is enabled (single-file games, e.g. three.js).
+ *
+ * The sanitizer guarantees no arbitrary JavaScript can be loaded: an importmap
+ * only maps bare specifiers to URLs, and the inline module that consumes it can
+ * only `import` from those mapped URLs. So the security boundary is "which URLs
+ * may a mapping target." We require:
+ *
+ *   1. https only,
+ *   2. a known immutable ESM CDN host, and
+ *   3. a version-pinned path (so a mapping can't silently float to new code).
+ *
+ * This mirrors the deliberately-narrow allowlist approach already used for
+ * Google Fonts (`ALLOWED_FONT_LINK`) and trusted YouTube embeds.
+ */
+/** Immutable, versioned ESM CDN hosts. */
+export const TRUSTED_MODULE_CDN_HOSTS = [
+    "esm.sh",
+    "cdn.jsdelivr.net",
+    "unpkg.com",
+    "cdn.skypack.dev",
+];
+/**
+ * A path is "pinned" when it carries an explicit version. We accept the common
+ * forms used by these CDNs:
+ *   - `…/three@0.160.0/…`            (esm.sh, unpkg, skypack)
+ *   - `…/npm/three@0.160.0/…`        (jsDelivr npm)
+ *   - `…/three@0.160.0`              (bare package, no subpath)
+ * A leading `v` on the version (skypack's `three@v0.160.0`) is allowed.
+ */
+const PINNED_PACKAGE = /[@/][a-z0-9._-]+@v?\d+(?:\.\d+){0,2}(?:[-+][a-z0-9.-]+)?(?:\/|$)/i;
+/**
+ * True if `value` is an https URL on a trusted CDN host with a version-pinned
+ * package path. Accepts a bare specifier check too: callers pass fully-resolved
+ * URLs (importmap values), not bare names.
+ */
+export function isTrustedModuleUrl(value) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "https:")
+        return false;
+    const host = url.hostname.toLowerCase().replace(/^www\./, "");
+    if (!TRUSTED_MODULE_CDN_HOSTS.includes(host))
+        return false;
+    // The path must pin a version somewhere (package@version).
+    return PINNED_PACKAGE.test(url.pathname);
+}
+/** CSP source list (space-joined origins) for the trusted CDN hosts. */
+export function trustedModuleCdnOrigins() {
+    return TRUSTED_MODULE_CDN_HOSTS.map((h) => `https://${h}`).join(" ");
+}
+//# sourceMappingURL=trustedCdnHosts.js.map

package/dist/constants/trustedCdnHosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedCdnHosts.js","sourceRoot":"","sources":["../../src/constants/trustedCdnHosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,QAAQ;IACR,kBAAkB;IAClB,WAAW;IACX,iBAAiB;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,mEAAmE,CAAC;AAE3F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,2DAA2D;IAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB;IACrC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/iframe/HtmlArtifactPreview.js

@@ -87,12 +87,12 @@ export function HtmlArtifactPreview(props) {
         const doc = buildSrcDoc(finalHtml, {
             sanitize: opts.sanitize,
             seamless: true,
-            resizeBridge: opts.allowScripts || opts.allowVideoEmbeds,
+            resizeBridge: opts.allowScripts || opts.allowVideoEmbeds || opts.allowModuleImports,
             camouflage: bare,
             theme,
             sanitizeOptions: opts,
         });
-        paint(doc, !streaming && opts.allowScripts);
+        paint(doc, !streaming && (opts.allowScripts || opts.allowModuleImports));
     }, [paint, theme, bare]);
     // Schedule a flush, throttled to at most once per `debounceMs` and aligned to
     // an animation frame so rapid SSE deltas don't trigger a render storm.