sibujs 4.11.0 → 4.12.0

package/dist/ssr.js

@@ -23,9 +23,9 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-YXJHLMRH.js";
+} from "./chunk-NB7TFSJE.js";
 import "./chunk-52XFPGSN.js";
-import "./chunk-LQ2C44YH.js";
+import "./chunk-T5O2CUHV.js";
 import {
   collectStream,
   deserializeState,
@@ -45,17 +45,18 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-FC6KCJSA.js";
+} from "./chunk-2F4PSJ5Z.js";
+import "./chunk-AM6DZLBM.js";
 import "./chunk-62BDYGAG.js";
-import "./chunk-3Z7AEJMQ.js";
-import "./chunk-HMOPAC2Z.js";
-import "./chunk-3ACAAQIN.js";
+import "./chunk-WH4U2VUE.js";
+import "./chunk-XX4BRMWF.js";
+import "./chunk-F2UWOZ6J.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-OJV2RW4D.js";
+import "./chunk-EMB5PG7V.js";
 import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-F6B5CKF7.js";
-import "./chunk-ADWDDJ5M.js";
+import "./chunk-IHA62NGJ.js";
+import "./chunk-B2Y5BJSP.js";
 import "./chunk-NYNYSPK7.js";
 export {
   Head,

package/dist/{tagFactory-BL2fymez.d.ts → tagFactory-Bnd_Nph9.d.ts}

@@ -93,7 +93,7 @@ type TagEventHandlers = {
  * it types `onElement`.
  */
 interface TagProps<El extends Element = HTMLElement> {
-    id?: string | (() => string);
+    id?: string | (() => string | null | undefined);
     class?: string | (() => string | null | undefined | false) | Record<string, boolean | (() => boolean)>;
     style?: StyleMap | string | (() => string | StyleObject);
     /**

package/dist/{tagFactory-8qL9LCIx.d.cts → tagFactory-DkytnJws.d.cts}

@@ -93,7 +93,7 @@ type TagEventHandlers = {
  * it types `onElement`.
  */
 interface TagProps<El extends Element = HTMLElement> {
-    id?: string | (() => string);
+    id?: string | (() => string | null | undefined);
     class?: string | (() => string | null | undefined | false) | Record<string, boolean | (() => boolean)>;
     style?: StyleMap | string | (() => string | StyleObject);
     /**

package/dist/testing.cjs

@@ -780,7 +780,7 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.11.0" : "dev";
+var _runtimeVersion = true ? "4.12.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;

package/dist/testing.js

@@ -3,9 +3,9 @@ import {
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-OJV2RW4D.js";
+} from "./chunk-EMB5PG7V.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-ADWDDJ5M.js";
+import "./chunk-B2Y5BJSP.js";
 import {
   dispose,
   replaceChildrenSafely,

package/dist/ui.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // ui.ts
 var ui_exports = {};
 __export(ui_exports, {
+  DEFAULT_EMBED_SANDBOX: () => DEFAULT_EMBED_SANDBOX,
   FocusTrap: () => FocusTrap,
   RenderProp: () => RenderProp,
   VirtualList: () => VirtualList,
@@ -46,6 +47,7 @@ __export(ui_exports, {
   defineStrictComponent: () => defineStrictComponent,
   dialog: () => dialog,
   email: () => email,
+  embed: () => embed,
   eventBus: () => eventBus,
   focus: () => focus,
   form: () => form,
@@ -69,6 +71,7 @@ __export(ui_exports, {
   required: () => required,
   scopedStyle: () => scopedStyle,
   scrollLock: () => scrollLock,
+  setEmbedPolicy: () => setEmbedPolicy,
   ssnMask: () => ssnMask,
   svgElement: () => svgElement,
   timeMask: () => timeMask,
@@ -860,7 +863,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.11.0" : "dev";
+var _runtimeVersion = true ? "4.12.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1093,7 +1096,7 @@ var isBatching = API2.isBatching;
 // src/core/signals/signal.ts
 var _g = globalThis;
 function signal(initial, options) {
-  const state2 = {
+  const state3 = {
     value: initial,
     __v: 0,
     __sc: 0,
@@ -1106,57 +1109,57 @@ function signal(initial, options) {
   };
   const debugName = DEV ? options?.name : void 0;
   const equalsFn = options?.equals;
-  if (debugName) state2.__name = debugName;
+  if (debugName) state3.__name = debugName;
   function get() {
-    recordDependency2(state2);
-    return state2.value;
+    recordDependency2(state3);
+    return state3.value;
   }
-  get.__signal = state2;
+  get.__signal = state3;
   if (debugName) get.__name = debugName;
   let set;
   if (equalsFn) {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (equalsFn(prev, newValue)) return;
-      state2.value = newValue;
-      state2.__v++;
+      state3.value = newValue;
+      state3.__v++;
       if (DEV) {
         const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-        if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
+        if (hook) emitDevtools(hook, "signal:update", { signal: state3, name: debugName, oldValue: prev, newValue });
       }
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   } else if (DEV) {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state2.value = newValue;
-      state2.__v++;
+      state3.value = newValue;
+      state3.__v++;
       const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-      if (hook) emitDevtools(hook, "signal:update", { signal: state2, name: debugName, oldValue: prev, newValue });
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      if (hook) emitDevtools(hook, "signal:update", { signal: state3, name: debugName, oldValue: prev, newValue });
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   } else {
     set = (next) => {
-      const prev = state2.value;
+      const prev = state3.value;
       const newValue = typeof next === "function" ? next(prev) : next;
       if (Object.is(newValue, prev)) return;
-      state2.value = newValue;
-      state2.__v++;
-      if (!enqueueBatchedSignal(state2)) {
-        notifySubscribers2(state2);
+      state3.value = newValue;
+      state3.__v++;
+      if (!enqueueBatchedSignal(state3)) {
+        notifySubscribers2(state3);
       }
     };
   }
   if (DEV) {
     const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-    if (hook) emitDevtools(hook, "signal:create", { signal: state2, name: debugName, getter: get, initial });
+    if (hook) emitDevtools(hook, "signal:create", { signal: state3, name: debugName, getter: get, initial });
   }
   return [get, set];
 }
@@ -3226,6 +3229,227 @@ function dialog() {
   return { open, close, isOpen, toggle, dispose: dispose2 };
 }
 
+// src/core/rendering/requireDocument.ts
+function noDocument() {
+  throw new Error(
+    "[SibuJS] renderToString needs a DOM: register happy-dom or jsdom globals first." + (DEV ? ' There is no global `document`, and SibuJS builds live DOM nodes, on the server too. For example: import { GlobalRegistrator } from "@happy-dom/global-registrator"; GlobalRegistrator.register(); See SSR in AGENTS.md \xA710.' : "")
+  );
+}
+
+// src/utils/embedPolicy.ts
+var state2 = globalSingleton(/* @__PURE__ */ Symbol.for("sibujs.embed.v2"), () => ({
+  allowed: [],
+  frames: /* @__PURE__ */ new WeakMap()
+}));
+var REQUEST_CACHE = "embed";
+function currentEmbedAllowlist() {
+  const scoped = getRequestStore()?.caches?.get(REQUEST_CACHE)?.get("allowed");
+  return scoped ?? state2.allowed;
+}
+function setEmbedPolicy(policy) {
+  const allowed = [];
+  for (const entry of policy.allowedOrigins) {
+    let url = null;
+    try {
+      url = new URL(entry);
+    } catch {
+      url = null;
+    }
+    if (!url || url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
+      throw new TypeError(
+        `setEmbedPolicy: "${entry}" is not an allowed embed origin. Use an absolute https: URL, optionally with a path prefix, and no credentials, query or fragment.`
+      );
+    }
+    allowed.push({ origin: url.origin, path: url.pathname === "/" ? "" : url.pathname });
+  }
+  const store = getRequestStore();
+  if (store) {
+    const caches = store.caches ?? (store.caches = /* @__PURE__ */ new Map());
+    let scoped = caches.get(REQUEST_CACHE);
+    if (!scoped) {
+      scoped = /* @__PURE__ */ new Map();
+      caches.set(REQUEST_CACHE, scoped);
+    }
+    scoped.set("allowed", allowed);
+  } else {
+    state2.allowed = allowed;
+  }
+}
+function resolveEmbedSrc(value, allowed = currentEmbedAllowlist()) {
+  if (typeof value !== "string" || sanitizeUrl(value) === "") return null;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username || url.password) return null;
+  if (typeof location !== "undefined" && url.origin === location.origin) return null;
+  for (const entry of allowed) {
+    if (url.origin !== entry.origin) continue;
+    const path = entry.path;
+    if (path === "" || url.pathname === path || url.pathname.startsWith(path.endsWith("/") ? path : `${path}/`)) {
+      return url.href;
+    }
+  }
+  return null;
+}
+var DEFAULT_EMBED_SANDBOX = [
+  "allow-scripts",
+  "allow-same-origin",
+  "allow-presentation",
+  "allow-popups",
+  "allow-popups-to-escape-sandbox"
+];
+var EMBED_FEATURES = /* @__PURE__ */ new Set([
+  "accelerometer",
+  "autoplay",
+  "clipboard-write",
+  "encrypted-media",
+  "fullscreen",
+  "gyroscope",
+  "picture-in-picture",
+  "web-share"
+]);
+var EMBED_REFERRER_POLICIES = /* @__PURE__ */ new Set([
+  "no-referrer",
+  "same-origin",
+  "strict-origin",
+  "strict-origin-when-cross-origin"
+]);
+var DEFAULT_EMBED_REFERRER_POLICY = "strict-origin-when-cross-origin";
+function narrowEmbedSandbox(value) {
+  const out = [];
+  for (const token of value.toLowerCase().split(/[\t\n\f\r ]+/)) {
+    if (token && DEFAULT_EMBED_SANDBOX.includes(token) && !out.includes(token)) out.push(token);
+  }
+  return out.join(" ");
+}
+function narrowEmbedAllow(value) {
+  const granted = [];
+  const denied = [];
+  for (const directive of value.split(";")) {
+    const tokens = directive.trim().split(/[\t\n\f\r ]+/);
+    const feature = tokens[0];
+    if (!feature) continue;
+    const list = tokens.slice(1).map((token) => token.toLowerCase());
+    const grantsSrc = (list.length === 0 || list.includes("'src'") || list.includes("*")) && !list.includes("'none'");
+    if (!grantsSrc) denied.push(feature);
+    else if (EMBED_FEATURES.has(feature) && !granted.includes(feature)) granted.push(feature);
+  }
+  return granted.filter((feature) => !denied.includes(feature)).join("; ");
+}
+function narrowEmbedReferrerPolicy(value) {
+  const lower = value.trim().toLowerCase();
+  return EMBED_REFERRER_POLICIES.has(lower) ? lower : DEFAULT_EMBED_REFERRER_POLICY;
+}
+function recordEmbedFrame(frame, record) {
+  state2.frames.set(frame, record);
+}
+
+// src/ui/embed.ts
+var DEFAULT_ALLOW = "encrypted-media; picture-in-picture; fullscreen";
+var RATIO = /^\d+(\.\d+)?(\s*\/\s*\d+(\.\d+)?)?$/;
+var warnedEmbeds = /* @__PURE__ */ new Set();
+function warnEmbed(key, message) {
+  devWarnLazy(() => {
+    if (warnedEmbeds.has(key) || warnedEmbeds.size >= 100) return "";
+    warnedEmbeds.add(key);
+    return message;
+  });
+}
+function embed(props) {
+  const { src, title } = props;
+  if (typeof title !== "function" && (typeof title !== "string" || !title.trim())) {
+    throw new TypeError("embed: `title` is required \u2014 it is the frame's accessible name.");
+  }
+  if (typeof document === "undefined") noDocument();
+  if ("srcdoc" in props) {
+    warnEmbed("srcdoc", "embed: `srcdoc` is never written \u2014 a frame's document must come from an allowlisted src.");
+  }
+  const el = document.createElement("iframe");
+  const allowed = currentEmbedAllowlist();
+  const sandbox = props.sandbox === void 0 ? DEFAULT_EMBED_SANDBOX.join(" ") : narrowEmbedSandbox(props.sandbox);
+  if (props.sandbox !== void 0 && sandbox !== props.sandbox.trim().toLowerCase().split(/\s+/).join(" ")) {
+    warnEmbed(
+      `sandbox|${props.sandbox}`,
+      `embed: sandbox "${props.sandbox}" was narrowed to "${sandbox}". A sandbox may only remove tokens from DEFAULT_EMBED_SANDBOX (${DEFAULT_EMBED_SANDBOX.join(" ")}).`
+    );
+  }
+  el.setAttribute("sandbox", sandbox);
+  const allowIn = props.allow ?? DEFAULT_ALLOW;
+  const allow = narrowEmbedAllow(allowIn);
+  const requested = allowIn.split(";").map((d) => d.trim().toLowerCase()).filter(Boolean).join("; ");
+  if (allow !== requested) {
+    warnEmbed(
+      `allow|${allowIn}`,
+      `embed: allow "${allowIn}" was narrowed to "${allow}" \u2014 only player features are delegated.`
+    );
+  }
+  if (allow) el.setAttribute("allow", allow);
+  if (allow.split("; ").includes("fullscreen")) el.setAttribute("allowfullscreen", "");
+  const referrer = narrowEmbedReferrerPolicy(props.referrerpolicy ?? DEFAULT_EMBED_REFERRER_POLICY);
+  if (props.referrerpolicy !== void 0 && referrer !== props.referrerpolicy) {
+    warnEmbed(
+      `referrer|${props.referrerpolicy}`,
+      `embed: referrerpolicy "${props.referrerpolicy}" is less strict than the default; using "${referrer}".`
+    );
+  }
+  el.setAttribute("referrerpolicy", referrer);
+  recordEmbedFrame(el, { allowed, sandbox, allow, referrer });
+  el.setAttribute("loading", props.loading === "eager" ? "eager" : "lazy");
+  if (props.aspectRatio !== void 0) {
+    if (RATIO.test(props.aspectRatio.trim())) {
+      el.style.setProperty("aspect-ratio", props.aspectRatio.trim());
+      el.style.setProperty("width", "100%");
+      el.style.setProperty("height", "auto");
+      el.style.setProperty("border", "0");
+    } else {
+      warnEmbed(
+        `ratio|${props.aspectRatio}`,
+        `embed: aspectRatio "${props.aspectRatio}" is not a ratio such as "16 / 9".`
+      );
+    }
+  }
+  if (typeof props.class === "string") el.setAttribute("class", props.class);
+  if (typeof props.id === "string") el.id = props.id;
+  if (typeof title === "function") {
+    registerDisposer(
+      el,
+      reactiveBinding2(() => {
+        const value = String(title() ?? "");
+        if (value.trim()) el.setAttribute("title", value);
+        else warnEmbed("title", "embed: a `title` getter returned a blank value; the previous title is kept.");
+      }, el)
+    );
+  } else {
+    el.setAttribute("title", title);
+  }
+  const commitSrc = (value) => {
+    const safe = resolveEmbedSrc(value, allowed);
+    if (safe === null) {
+      el.removeAttribute("src");
+      if (value != null) {
+        warnEmbed(
+          `src|${String(value)}`,
+          `embed: refusing src "${String(value)}" \u2014 it is not an https: URL on an origin allowed by setEmbedPolicy().`
+        );
+      }
+      return;
+    }
+    if (el.getAttribute("src") !== safe) el.setAttribute("src", safe);
+  };
+  if (typeof src === "function") {
+    registerDisposer(
+      el,
+      reactiveBinding2(() => commitSrc(src()), el)
+    );
+  } else {
+    commitSrc(src);
+  }
+  return el;
+}
+
 // src/ui/toast.ts
 function toast(options) {
   const duration = options?.duration ?? 3e3;
@@ -4133,6 +4357,7 @@ function createGuard(validator) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_EMBED_SANDBOX,
   FocusTrap,
   RenderProp,
   VirtualList,
@@ -4159,6 +4384,7 @@ function createGuard(validator) {
   defineStrictComponent,
   dialog,
   email,
+  embed,
   eventBus,
   focus,
   form,
@@ -4182,6 +4408,7 @@ function createGuard(validator) {
   required,
   scopedStyle,
   scrollLock,
+  setEmbedPolicy,
   ssnMask,
   svgElement,
   timeMask,

package/dist/ui.d.cts

@@ -180,6 +180,116 @@ interface DialogAriaHandle {
  */
 declare function createDialogAria(element: HTMLElement, options?: DialogAriaOptions): DialogAriaHandle;
 
+/**
+ * The policy `embed()` enforces.
+ *
+ * Each entry of `allowedOrigins` is an absolute `https:` URL: an origin
+ * (`"https://www.youtube-nocookie.com"`) allows every path on it; an origin
+ * with a path (`"https://player.vimeo.com/video/"`) allows that path and what
+ * lies beneath it. Credentials, a query or a fragment in an entry are refused.
+ */
+interface EmbedPolicy {
+    allowedOrigins: readonly string[];
+}
+/**
+ * Set the origins `embed()` may frame. Replaces the previous policy; the
+ * default allows nothing. Call it once at startup — on the server too, before
+ * rendering.
+ *
+ * Inside `runInSSRContext()` it sets the policy of THAT request only, so a
+ * multi-tenant server can configure each render without one request's
+ * allowlist reaching another's. Outside a request it sets the process-wide
+ * policy every request without its own falls back to.
+ *
+ * A frame is judged by the policy in force when `embed()` built it: a later
+ * `setEmbedPolicy()` changes neither its getter `src` checks nor how SSR
+ * serializes it.
+ *
+ * @throws TypeError for an entry that is not an absolute `https:` URL, or
+ * that carries credentials, a query or a fragment.
+ */
+declare function setEmbedPolicy(policy: EmbedPolicy): void;
+/**
+ * The sandbox `embed()` applies by default — the tokens a hosted video player
+ * needs and nothing more:
+ *
+ *   - `allow-scripts`, `allow-same-origin`: the player runs and keeps its own
+ *     storage. Safe together only because the frame is never same-origin with
+ *     the page (see `resolveEmbedSrc`).
+ *   - `allow-presentation`: casting to a second screen.
+ *   - `allow-popups`, `allow-popups-to-escape-sandbox`: "watch on …" links
+ *     open a normal tab instead of a crippled sandboxed one.
+ *
+ * Absent on purpose: `allow-top-navigation*` (the player cannot navigate the
+ * page), `allow-forms`, `allow-modals`, `allow-downloads`,
+ * `allow-pointer-lock`, `allow-storage-access-by-user-activation`.
+ */
+declare const DEFAULT_EMBED_SANDBOX: readonly string[];
+
+/** Props for {@link embed}. */
+interface EmbedProps {
+    /**
+     * The player URL. Must be absolute `https:` and match the allowlist set with
+     * `setEmbedPolicy()`. A getter is re-checked on every change; a refused or
+     * `null` value leaves the frame without a `src`.
+     */
+    src: string | (() => string | null | undefined);
+    /** Accessible name of the frame. Required. */
+    title: string | (() => string);
+    /**
+     * Permissions-policy features, as in the `allow` attribute. Narrowed to the
+     * player features (`accelerometer`, `autoplay`, `clipboard-write`,
+     * `encrypted-media`, `fullscreen`, `gyroscope`, `picture-in-picture`,
+     * `web-share`). Default: `"encrypted-media; picture-in-picture; fullscreen"`.
+     * A feature is kept only when every declaration of it grants the frame's own
+     * origin (no allowlist, `'src'` or `*`); `fullscreen 'none'`, `'self'` or a
+     * list of other origins drops it instead of granting it.
+     */
+    allow?: string;
+    /**
+     * Sandbox tokens. May only REMOVE tokens from `DEFAULT_EMBED_SANDBOX`; other
+     * tokens are dropped. `""` applies every restriction.
+     */
+    sandbox?: string;
+    /** Default `"strict-origin-when-cross-origin"`; only stricter values are accepted. */
+    referrerpolicy?: "no-referrer" | "same-origin" | "strict-origin" | "strict-origin-when-cross-origin";
+    /** Default `"lazy"`. */
+    loading?: "lazy" | "eager";
+    /** A CSS ratio such as `"16 / 9"`. Sizes the frame to the container's width. */
+    aspectRatio?: string;
+    class?: string;
+    id?: string;
+}
+/**
+ * Embed a third-party player (YouTube, Vimeo, …) in an `<iframe>`.
+ *
+ * The tag factories, `svgElement()` and `DOMPool` refuse `iframe`; this is the
+ * one runtime door, and it only opens onto origins the application allowlisted
+ * with `setEmbedPolicy()`:
+ *
+ *   - `src` must be absolute `https:` and match an allowlisted origin and path
+ *     prefix. A value outside the allowlist — a getter's included — is omitted
+ *     and reported with a development warning. `javascript:`, `data:` and
+ *     `blob:` can never match; neither can the page's own origin.
+ *   - `title` is required. `srcdoc` is never written.
+ *   - Safe defaults: `loading="lazy"`, `referrerpolicy=
+ *     "strict-origin-when-cross-origin"`, `sandbox` set to
+ *     `DEFAULT_EMBED_SANDBOX` (written before `src`, so it applies to the first
+ *     document), and `allow` limited to player features. `sandbox`,
+ *     `referrerpolicy` and `allow` can only be narrowed.
+ *   - `renderToString` serializes the frame under the same policy.
+ *
+ * @example
+ * ```ts
+ * import { embed, setEmbedPolicy } from "sibujs/ui";
+ * setEmbedPolicy({ allowedOrigins: ["https://www.youtube-nocookie.com/embed/"] });
+ * embed({ src: `https://www.youtube-nocookie.com/embed/${id}`, title: "Product tour", aspectRatio: "16 / 9" });
+ * ```
+ *
+ * @throws TypeError when `title` is missing or blank.
+ */
+declare function embed(props: EmbedProps): HTMLIFrameElement;
+
 /**
  * lazyEffect creates an effect that only activates when the target element
  * becomes visible in the viewport (via IntersectionObserver). When the element
@@ -292,4 +402,4 @@ interface ScrollLockHandle {
  */
 declare function scrollLock(): ScrollLockHandle;
 
-export { type DialogAriaHandle, type DialogAriaOptions, type FocusManagerHandle, type FocusManagerOptions, type FormActionHandle, type FormActionState, type FormActionSubmit, type IntervalHandle, type ListboxHandle, type ListboxOptions, type ScrollLockHandle, type TimeoutHandle, createDialogAria, createFocusManager, createListbox, formAction, hover, interval, lazyEffect, scrollLock, timeout };
+export { DEFAULT_EMBED_SANDBOX, type DialogAriaHandle, type DialogAriaOptions, type EmbedPolicy, type EmbedProps, type FocusManagerHandle, type FocusManagerOptions, type FormActionHandle, type FormActionState, type FormActionSubmit, type IntervalHandle, type ListboxHandle, type ListboxOptions, type ScrollLockHandle, type TimeoutHandle, createDialogAria, createFocusManager, createListbox, embed, formAction, hover, interval, lazyEffect, scrollLock, setEmbedPolicy, timeout };