/** * SandboxedIframe - Double-Iframe Sandbox Component for MCP Apps * * Provides secure double-iframe architecture for rendering untrusted HTML: * Host Page → Sandbox Proxy (different origin) → Guest UI * * The sandbox proxy: * 1. Runs on a different origin for security isolation (localhost ↔ 127.0.0.1) * 2. Loads guest HTML via srcdoc when ready * 3. Forwards messages between host and guest (except sandbox-internal) * * Per SEP-1865, this component provides cross-origin isolation for MCP Apps. */ export interface SandboxedIframeHandle { postMessage: (data: unknown) => void; getIframeElement: () => HTMLIFrameElement | null; } interface SandboxedIframeProps { /** HTML content to render in the sandbox */ html: string | null; /** Sandbox attribute for the inner iframe */ sandbox?: string; /** CSP metadata from resource _meta.ui.csp (SEP-1865) */ csp?: { connectDomains?: string[]; resourceDomains?: string[]; frameDomains?: string[]; baseUriDomains?: string[]; }; /** Permissions metadata from resource _meta.ui.permissions (SEP-1865) */ permissions?: { camera?: object; microphone?: object; geolocation?: object; clipboardWrite?: object; }; /** Skip CSP injection entirely (for permissive/testing mode) */ permissive?: boolean; /** Callback when sandbox proxy is ready */ onProxyReady?: () => void; /** Callback when the outer iframe has loaded */ onLoad?: () => void; /** Fired once when this sandbox instance mounts (used to detect remounts). */ onSandboxMount?: () => void; /** Callback for messages from guest UI (excluding sandbox-internal messages) */ onMessage: (event: MessageEvent) => void; /** CSS class for the outer iframe */ className?: string; /** Inline styles for the outer iframe */ style?: React.CSSProperties; /** Title for accessibility */ title?: string; } /** * SandboxedIframe provides a secure double-iframe architecture per SEP-1865. * * Message flow: * 1. Proxy sends ui/notifications/sandbox-proxy-ready when loaded * 2. Host sends ui/notifications/sandbox-resource-ready with HTML * 3. Guest UI initializes and communicates via JSON-RPC 2.0 */ export declare const SandboxedIframe: import("react").ForwardRefExoticComponent>; export {}; //# sourceMappingURL=SandboxedIframe.d.ts.map