//#region ../core/src/preview/protocol.ts
const ALLOWED_ORIGIN_PATTERNS = [
	/^https?:\/\/localhost(:\d+)?$/,
	/^https?:\/\/127\.0\.0\.1(:\d+)?$/,
	/^https:\/\/[a-z0-9-]+\.portal\.fluid\.app$/,
	/^https:\/\/[a-z0-9-]+\.fluid\.app$/
];
/**
* Validate that a postMessage origin is trusted.
* Accepts localhost (any port), *.portal.fluid.app, and *.fluid.app.
*/
function isAllowedOrigin(origin) {
	return ALLOWED_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
}
/** Check if a message is a valid PreviewCommand (builder → iframe). */
function isPreviewCommand(data) {
	if (typeof data !== "object" || data === null) return false;
	const msg = data;
	switch (msg["type"]) {
		case "auth": return typeof msg["token"] === "string";
		case "render-widget": return typeof msg["widgetType"] === "string" && typeof msg["props"] === "object" && msg["props"] !== null && !Array.isArray(msg["props"]);
		case "unmount-widget": return true;
		case "select-widget": return typeof msg["widgetType"] === "string";
		default: return false;
	}
}
//#endregion
Object.defineProperty(exports, "isAllowedOrigin", {
	enumerable: true,
	get: function() {
		return isAllowedOrigin;
	}
});
Object.defineProperty(exports, "isPreviewCommand", {
	enumerable: true,
	get: function() {
		return isPreviewCommand;
	}
});

//# sourceMappingURL=protocol-DIE_XooL.cjs.map