safe-content-frame 0.0.4 → 0.0.6

package/dist/index.d.ts

@@ -1,18 +1,18 @@
-type SandboxOption = "allow-same-origin" | "allow-scripts" | "allow-forms" | "allow-popups" | "allow-modals" | "allow-downloads" | "allow-popups-to-escape-sandbox";
-interface SafeContentFrameOptions {
+export type SandboxOption = "allow-same-origin" | "allow-scripts" | "allow-forms" | "allow-popups" | "allow-modals" | "allow-downloads" | "allow-popups-to-escape-sandbox";
+export interface SafeContentFrameOptions {
     useShadowDom?: boolean;
     enableBrowserCaching?: boolean;
     sandbox?: SandboxOption[];
     salt?: string;
 }
-interface RenderedFrame {
+export interface RenderedFrame {
     iframe: HTMLIFrameElement;
     origin: string;
     sendMessage(data: unknown, transfer?: Transferable[]): void;
     fullyLoadedPromiseWithTimeout(timeoutMs: number): Promise<void>;
     dispose(): void;
 }
-declare class SafeContentFrame {
+export declare class SafeContentFrame {
     private product;
     private options;
     constructor(product: string, options?: SafeContentFrameOptions);
@@ -24,5 +24,4 @@ declare class SafeContentFrame {
     private render;
     private getSandbox;
 }
-
-export { type RenderedFrame, SafeContentFrame, type SafeContentFrameOptions, type SandboxOption };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,cAAc,GACd,cAAc,GACd,iBAAiB,GACjB,gCAAgC,CAAC;AAErC,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC5D,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC;CACjB;AA2DD,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;gBADP,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,uBAA4B;IAGzC,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,WAAW,EACtB,IAAI,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,GACvC,OAAO,CAAC,aAAa,CAAC;IASnB,SAAS,CACb,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,GACrB,OAAO,CAAC,aAAa,CAAC;IAMnB,SAAS,CACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,WAAW,GACrB,OAAO,CAAC,aAAa,CAAC;YAIX,MAAM;IA2EpB,OAAO,CAAC,UAAU;CAMnB"}

package/dist/index.js

@@ -1,132 +1,119 @@
-// src/index.ts
-var SCF_HOST = "scf.auiusercontent.com";
-var PRODUCT_HASH = "h184756";
+const SCF_HOST = "scf.auiusercontent.com";
+const PRODUCT_HASH = "h184756";
 async function sha256(data) {
-  return crypto.subtle.digest("SHA-256", data);
+    return crypto.subtle.digest("SHA-256", data);
 }
 async function computeOriginHash(product, salt, origin) {
-  const enc = new TextEncoder();
-  const sep = enc.encode("$@#|");
-  const parts = [
-    enc.encode(product),
-    sep,
-    new Uint8Array(salt),
-    sep,
-    enc.encode(origin)
-  ];
-  const combined = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
-  let offset = 0;
-  for (const p of parts) {
-    combined.set(p, offset);
-    offset += p.length;
-  }
-  const hash = new Uint8Array(await sha256(combined.buffer));
-  const bigint = hash.reduce(
-    (acc, b) => BigInt(256) * acc + BigInt(b),
-    BigInt(0)
-  );
-  return bigint.toString(36).padStart(50, "0").slice(0, 50);
+    const enc = new TextEncoder();
+    const sep = enc.encode("$@#|");
+    const parts = [
+        enc.encode(product),
+        sep,
+        new Uint8Array(salt),
+        sep,
+        enc.encode(origin),
+    ];
+    const combined = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let offset = 0;
+    for (const p of parts) {
+        combined.set(p, offset);
+        offset += p.length;
+    }
+    const hash = new Uint8Array(await sha256(combined.buffer));
+    const bigint = hash.reduce((acc, b) => BigInt(256) * acc + BigInt(b), BigInt(0));
+    return bigint.toString(36).padStart(50, "0").slice(0, 50);
 }
 function randomSalt() {
-  const arr = new Uint8Array(10);
-  crypto.getRandomValues(arr);
-  return arr.buffer;
+    const arr = new Uint8Array(10);
+    crypto.getRandomValues(arr);
+    return arr.buffer;
 }
 async function contentSalt(content, pathname) {
-  const enc = new TextEncoder();
-  const sep = enc.encode("$@#|");
-  const combined = new Uint8Array(
-    content.length + sep.length + pathname.length
-  );
-  combined.set(content, 0);
-  combined.set(sep, content.length);
-  combined.set(enc.encode(pathname), content.length + sep.length);
-  return sha256(combined.buffer);
+    const enc = new TextEncoder();
+    const sep = enc.encode("$@#|");
+    const combined = new Uint8Array(content.length + sep.length + pathname.length);
+    combined.set(content, 0);
+    combined.set(sep, content.length);
+    combined.set(enc.encode(pathname), content.length + sep.length);
+    return sha256(combined.buffer);
 }
-var SafeContentFrame = class {
-  constructor(product, options = {}) {
-    this.product = product;
-    this.options = options;
-  }
-  async renderHtml(html, container, opts) {
-    return this.render(
-      new TextEncoder().encode(html),
-      "text/html; charset=utf-8",
-      container,
-      opts
-    );
-  }
-  async renderRaw(content, mimeType, container) {
-    const data = typeof content === "string" ? new TextEncoder().encode(content) : content;
-    return this.render(data, mimeType, container);
-  }
-  async renderPdf(content, container) {
-    return this.render(content, "application/pdf", container);
-  }
-  async render(content, mimeType, container, opts) {
-    const origin = window.location.origin;
-    const salt = this.options.salt ? new TextEncoder().encode(this.options.salt).buffer : this.options.enableBrowserCaching ? await contentSalt(content, location.pathname) : randomSalt();
-    const hash = await computeOriginHash(this.product, salt, origin);
-    const shimUrl = `https://${hash}-${PRODUCT_HASH}.${SCF_HOST}/${this.product}/shim.html?origin=${encodeURIComponent(origin)}${this.options.enableBrowserCaching ? "&cache=1" : ""}`;
-    const iframeOrigin = new URL(shimUrl).origin;
-    const iframe = document.createElement("iframe");
-    iframe.setAttribute("sandbox", this.getSandbox());
-    iframe.style.cssText = "border:none;width:100%;height:100%";
-    if (this.options.useShadowDom) {
-      const host = document.createElement("div");
-      host.attachShadow({ mode: "closed" }).appendChild(iframe);
-      container.appendChild(host);
-    } else {
-      container.appendChild(iframe);
+export class SafeContentFrame {
+    product;
+    options;
+    constructor(product, options = {}) {
+        this.product = product;
+        this.options = options;
+    }
+    async renderHtml(html, container, opts) {
+        return this.render(new TextEncoder().encode(html), "text/html; charset=utf-8", container, opts);
+    }
+    async renderRaw(content, mimeType, container) {
+        const data = typeof content === "string" ? new TextEncoder().encode(content) : content;
+        return this.render(data, mimeType, container);
+    }
+    async renderPdf(content, container) {
+        return this.render(content, "application/pdf", container);
     }
-    return new Promise((resolve, reject) => {
-      const channel = new MessageChannel();
-      let onLoaded;
-      const loaded = new Promise((r) => {
-        onLoaded = r;
-      });
-      channel.port1.onmessage = (e) => {
-        if (e.data?.type === "msg") onLoaded();
-        else if (e.data?.type === "error") reject(new Error(e.data.message));
-      };
-      iframe.onload = () => {
-        iframe.contentWindow?.postMessage(
-          {
-            body: content.buffer.slice(
-              content.byteOffset,
-              content.byteOffset + content.byteLength
-            ),
-            mimeType,
-            salt,
-            unsafeDocumentWrite: opts?.unsafeDocumentWrite
-          },
-          iframeOrigin,
-          [channel.port2]
-        );
-        resolve({
-          iframe,
-          origin: iframeOrigin,
-          sendMessage: (data, transfer) => iframe.contentWindow?.postMessage(data, iframeOrigin, transfer),
-          fullyLoadedPromiseWithTimeout: (ms) => Promise.race([
-            loaded,
-            new Promise(
-              (_, rej) => setTimeout(() => rej(new Error("Timeout")), ms)
-            )
-          ]),
-          dispose: () => iframe.remove()
+    async render(content, mimeType, container, opts) {
+        const origin = window.location.origin;
+        const salt = this.options.salt
+            ? new TextEncoder().encode(this.options.salt).buffer
+            : this.options.enableBrowserCaching
+                ? await contentSalt(content, location.pathname)
+                : randomSalt();
+        const hash = await computeOriginHash(this.product, salt, origin);
+        const shimUrl = `https://${hash}-${PRODUCT_HASH}.${SCF_HOST}/${this.product}/shim.html?origin=${encodeURIComponent(origin)}${this.options.enableBrowserCaching ? "&cache=1" : ""}`;
+        const iframeOrigin = new URL(shimUrl).origin;
+        const iframe = document.createElement("iframe");
+        iframe.setAttribute("sandbox", this.getSandbox());
+        iframe.style.cssText = "border:none;width:100%;height:100%";
+        if (this.options.useShadowDom) {
+            const host = document.createElement("div");
+            host.attachShadow({ mode: "closed" }).appendChild(iframe);
+            container.appendChild(host);
+        }
+        else {
+            container.appendChild(iframe);
+        }
+        return new Promise((resolve, reject) => {
+            const channel = new MessageChannel();
+            let onLoaded;
+            const loaded = new Promise((r) => {
+                onLoaded = r;
+            });
+            channel.port1.onmessage = (e) => {
+                if (e.data?.type === "msg")
+                    onLoaded();
+                else if (e.data?.type === "error")
+                    reject(new Error(e.data.message));
+            };
+            iframe.onload = () => {
+                iframe.contentWindow?.postMessage({
+                    body: content.buffer.slice(content.byteOffset, content.byteOffset + content.byteLength),
+                    mimeType,
+                    salt,
+                    unsafeDocumentWrite: opts?.unsafeDocumentWrite,
+                }, iframeOrigin, [channel.port2]);
+                resolve({
+                    iframe,
+                    origin: iframeOrigin,
+                    sendMessage: (data, transfer) => iframe.contentWindow?.postMessage(data, iframeOrigin, transfer),
+                    fullyLoadedPromiseWithTimeout: (ms) => Promise.race([
+                        loaded,
+                        new Promise((_, rej) => setTimeout(() => rej(new Error("Timeout")), ms)),
+                    ]),
+                    dispose: () => iframe.remove(),
+                });
+            };
+            iframe.onerror = () => reject(new Error("Failed to load iframe"));
+            iframe.src = shimUrl;
         });
-      };
-      iframe.onerror = () => reject(new Error("Failed to load iframe"));
-      iframe.src = shimUrl;
-    });
-  }
-  getSandbox() {
-    const s = new Set(this.options.sandbox || []);
-    s.add("allow-same-origin");
-    s.add("allow-scripts");
-    return [...s].join(" ");
-  }
-};
-export {
-  SafeContentFrame
-};
+    }
+    getSandbox() {
+        const s = new Set(this.options.sandbox || []);
+        s.add("allow-same-origin");
+        s.add("allow-scripts");
+        return [...s].join(" ");
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,KAAK,UAAU,MAAM,CAAC,IAAiB;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAe,EACf,IAAiB,EACjB,MAAc;IAEd,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;QACpB,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAqB,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CACxB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EACzC,MAAM,CAAC,CAAC,CAAC,CACV,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,MAAqB,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAmB,EACnB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAC9C,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAqB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAEjB;IACA;IAFV,YACU,OAAe,EACf,UAAmC,EAAE;QADrC,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAA8B;IAC5C,CAAC;IAEJ,KAAK,CAAC,UAAU,CACd,IAAY,EACZ,SAAsB,EACtB,IAAwC;QAExC,OAAO,IAAI,CAAC,MAAM,CAChB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,0BAA0B,EAC1B,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,QAAgB,EAChB,SAAsB;QAEtB,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAAmB,EACnB,SAAsB;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,OAAmB,EACnB,QAAgB,EAChB,SAAsB,EACtB,IAAwC;QAExC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI;YAC5B,CAAC,CAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAsB;YACrE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB;gBACjC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAC/C,CAAC,CAAC,UAAU,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,IAAI,IAAI,YAAY,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACnL,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAE7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,oCAAoC,CAAC;QAE5D,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1D,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,QAAoB,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;gBACrC,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,EAAE;gBAC9B,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK;oBAAE,QAAQ,EAAE,CAAC;qBAClC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO;oBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC;YAEF,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE;gBACnB,MAAM,CAAC,aAAa,EAAE,WAAW,CAC/B;oBACE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CACxB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CACxC;oBACD,QAAQ;oBACR,IAAI;oBACJ,mBAAmB,EAAE,IAAI,EAAE,mBAAmB;iBAC/C,EACD,YAAY,EACZ,CAAC,OAAO,CAAC,KAAK,CAAC,CAChB,CAAC;gBACF,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM,EAAE,YAAY;oBACpB,WAAW,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAC9B,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;oBACjE,6BAA6B,EAAE,CAAC,EAAE,EAAE,EAAE,CACpC,OAAO,CAAC,IAAI,CAAC;wBACX,MAAM;wBACN,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAC3B,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAChD;qBACF,CAAC;oBACJ,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/shadow_dom.d.ts

@@ -1,4 +1,3 @@
-declare const enableShadowDom: () => boolean;
-declare const unsafeDisableShadowDom: () => boolean;
-
-export { enableShadowDom, unsafeDisableShadowDom };
+export declare const enableShadowDom: () => boolean;
+export declare const unsafeDisableShadowDom: () => boolean;
+//# sourceMappingURL=shadow_dom.d.ts.map

package/dist/shadow_dom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow_dom.d.ts","sourceRoot":"","sources":["../src/shadow_dom.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,eAAa,CAAC;AAC1C,eAAO,MAAM,sBAAsB,eAAc,CAAC"}

package/dist/shadow_dom.js

@@ -1,7 +1,3 @@
-// src/shadow_dom.ts
-var enableShadowDom = () => true;
-var unsafeDisableShadowDom = () => false;
-export {
-  enableShadowDom,
-  unsafeDisableShadowDom
-};
+export const enableShadowDom = () => true;
+export const unsafeDisableShadowDom = () => false;
+//# sourceMappingURL=shadow_dom.js.map

package/dist/shadow_dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow_dom.js","sourceRoot":"","sources":["../src/shadow_dom.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC"}

package/package.json

@@ -1,15 +1,26 @@
 {
   "name": "safe-content-frame",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Secure iframe rendering for untrusted content using SafeContentFrame",
+  "keywords": [
+    "iframe",
+    "sandbox",
+    "security",
+    "html",
+    "content",
+    "safe"
+  ],
+  "author": "AgentbaseAI Inc.",
   "license": "MIT",
   "type": "module",
   "exports": {
     ".": {
+      "aui-source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
     "./shadow_dom": {
+      "aui-source": "./src/shadow_dom.ts",
       "types": "./dist/shadow_dom.d.ts",
       "default": "./dist/shadow_dom.js"
     }
@@ -17,27 +28,31 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "src",
+    "shadow_dom",
+    "README.md"
   ],
+  "sideEffects": false,
   "devDependencies": {
-    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vite": "^7.2.7",
+    "vite": "^7.3.1",
     "@assistant-ui/x-buildutils": "0.0.1"
   },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
+  "homepage": "https://www.assistant-ui.com/safe-content-frame",
   "repository": {
     "type": "git",
-    "url": "https://github.com/assistant-ui/assistant-ui/tree/main/packages/safe-content-frame"
+    "url": "git+https://github.com/assistant-ui/assistant-ui.git",
+    "directory": "packages/safe-content-frame"
   },
   "bugs": {
     "url": "https://github.com/assistant-ui/assistant-ui/issues"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/shadow_dom.ts --format esm --dts",
+    "build": "aui-build",
     "dev": "vite demo"
   }
 }

package/shadow_dom/package.json

@@ -0,0 +1,5 @@
+{
+  "type": "module",
+  "main": "../dist/shadow_dom.js",
+  "types": "../dist/shadow_dom.d.ts"
+}

package/src/index.ts

@@ -0,0 +1,199 @@
+export type SandboxOption =
+  | "allow-same-origin"
+  | "allow-scripts"
+  | "allow-forms"
+  | "allow-popups"
+  | "allow-modals"
+  | "allow-downloads"
+  | "allow-popups-to-escape-sandbox";
+
+export interface SafeContentFrameOptions {
+  useShadowDom?: boolean;
+  enableBrowserCaching?: boolean;
+  sandbox?: SandboxOption[];
+  salt?: string;
+}
+
+export interface RenderedFrame {
+  iframe: HTMLIFrameElement;
+  origin: string;
+  sendMessage(data: unknown, transfer?: Transferable[]): void;
+  fullyLoadedPromiseWithTimeout(timeoutMs: number): Promise<void>;
+  dispose(): void;
+}
+
+const SCF_HOST = "scf.auiusercontent.com";
+const PRODUCT_HASH = "h184756";
+
+async function sha256(data: ArrayBuffer): Promise<ArrayBuffer> {
+  return crypto.subtle.digest("SHA-256", data);
+}
+
+async function computeOriginHash(
+  product: string,
+  salt: ArrayBuffer,
+  origin: string,
+): Promise<string> {
+  const enc = new TextEncoder();
+  const sep = enc.encode("$@#|");
+  const parts = [
+    enc.encode(product),
+    sep,
+    new Uint8Array(salt),
+    sep,
+    enc.encode(origin),
+  ];
+  const combined = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let offset = 0;
+  for (const p of parts) {
+    combined.set(p, offset);
+    offset += p.length;
+  }
+
+  const hash = new Uint8Array(await sha256(combined.buffer as ArrayBuffer));
+  const bigint = hash.reduce(
+    (acc, b) => BigInt(256) * acc + BigInt(b),
+    BigInt(0),
+  );
+  return bigint.toString(36).padStart(50, "0").slice(0, 50);
+}
+
+function randomSalt(): ArrayBuffer {
+  const arr = new Uint8Array(10);
+  crypto.getRandomValues(arr);
+  return arr.buffer as ArrayBuffer;
+}
+
+async function contentSalt(
+  content: Uint8Array,
+  pathname: string,
+): Promise<ArrayBuffer> {
+  const enc = new TextEncoder();
+  const sep = enc.encode("$@#|");
+  const combined = new Uint8Array(
+    content.length + sep.length + pathname.length,
+  );
+  combined.set(content, 0);
+  combined.set(sep, content.length);
+  combined.set(enc.encode(pathname), content.length + sep.length);
+  return sha256(combined.buffer as ArrayBuffer);
+}
+
+export class SafeContentFrame {
+  constructor(
+    private product: string,
+    private options: SafeContentFrameOptions = {},
+  ) {}
+
+  async renderHtml(
+    html: string,
+    container: HTMLElement,
+    opts?: { unsafeDocumentWrite?: boolean },
+  ): Promise<RenderedFrame> {
+    return this.render(
+      new TextEncoder().encode(html),
+      "text/html; charset=utf-8",
+      container,
+      opts,
+    );
+  }
+
+  async renderRaw(
+    content: Uint8Array | string,
+    mimeType: string,
+    container: HTMLElement,
+  ): Promise<RenderedFrame> {
+    const data =
+      typeof content === "string" ? new TextEncoder().encode(content) : content;
+    return this.render(data, mimeType, container);
+  }
+
+  async renderPdf(
+    content: Uint8Array,
+    container: HTMLElement,
+  ): Promise<RenderedFrame> {
+    return this.render(content, "application/pdf", container);
+  }
+
+  private async render(
+    content: Uint8Array,
+    mimeType: string,
+    container: HTMLElement,
+    opts?: { unsafeDocumentWrite?: boolean },
+  ): Promise<RenderedFrame> {
+    const origin = window.location.origin;
+    const salt = this.options.salt
+      ? (new TextEncoder().encode(this.options.salt).buffer as ArrayBuffer)
+      : this.options.enableBrowserCaching
+        ? await contentSalt(content, location.pathname)
+        : randomSalt();
+
+    const hash = await computeOriginHash(this.product, salt, origin);
+    const shimUrl = `https://${hash}-${PRODUCT_HASH}.${SCF_HOST}/${this.product}/shim.html?origin=${encodeURIComponent(origin)}${this.options.enableBrowserCaching ? "&cache=1" : ""}`;
+    const iframeOrigin = new URL(shimUrl).origin;
+
+    const iframe = document.createElement("iframe");
+    iframe.setAttribute("sandbox", this.getSandbox());
+    iframe.style.cssText = "border:none;width:100%;height:100%";
+
+    if (this.options.useShadowDom) {
+      const host = document.createElement("div");
+      host.attachShadow({ mode: "closed" }).appendChild(iframe);
+      container.appendChild(host);
+    } else {
+      container.appendChild(iframe);
+    }
+
+    return new Promise((resolve, reject) => {
+      const channel = new MessageChannel();
+      let onLoaded: () => void;
+      const loaded = new Promise<void>((r) => {
+        onLoaded = r;
+      });
+
+      channel.port1.onmessage = (e) => {
+        if (e.data?.type === "msg") onLoaded();
+        else if (e.data?.type === "error") reject(new Error(e.data.message));
+      };
+
+      iframe.onload = () => {
+        iframe.contentWindow?.postMessage(
+          {
+            body: content.buffer.slice(
+              content.byteOffset,
+              content.byteOffset + content.byteLength,
+            ),
+            mimeType,
+            salt,
+            unsafeDocumentWrite: opts?.unsafeDocumentWrite,
+          },
+          iframeOrigin,
+          [channel.port2],
+        );
+        resolve({
+          iframe,
+          origin: iframeOrigin,
+          sendMessage: (data, transfer) =>
+            iframe.contentWindow?.postMessage(data, iframeOrigin, transfer),
+          fullyLoadedPromiseWithTimeout: (ms) =>
+            Promise.race([
+              loaded,
+              new Promise<void>((_, rej) =>
+                setTimeout(() => rej(new Error("Timeout")), ms),
+              ),
+            ]),
+          dispose: () => iframe.remove(),
+        });
+      };
+      iframe.onerror = () => reject(new Error("Failed to load iframe"));
+      iframe.src = shimUrl;
+    });
+  }
+
+  private getSandbox(): string {
+    const s = new Set(this.options.sandbox || []);
+    s.add("allow-same-origin");
+    s.add("allow-scripts");
+    return [...s].join(" ");
+  }
+}

package/src/shadow_dom.ts

@@ -0,0 +1,2 @@
+export const enableShadowDom = () => true;
+export const unsafeDisableShadowDom = () => false;