// Bundled by scripts/e2e-capture-security.mjs and run in real Firefox + Chromium.
import { captureHtml } from '../src/utils/self-review-capture';
import { CAPTURE_CSP } from '../src/utils/sanitize-capture-html';

(window as any).captureHtml = captureHtml;
/** Defence-in-depth probe: the capture frame WITHOUT the sanitiser (sandbox + CSP only). */
(window as any).rawFrame = (html: string) => new Promise<void>((resolve) => {
  const f = document.createElement('iframe');
  f.setAttribute('sandbox', 'allow-same-origin');
  const CSP = CAPTURE_CSP;
  f.setAttribute('csp', CSP);
  f.style.cssText = 'position:fixed;left:-9999px;width:800px;height:600px';
  f.addEventListener('load', () => setTimeout(resolve, 800), { once: true });
  f.srcdoc = html.replace('<head>', `<head><meta http-equiv="Content-Security-Policy" content="${CSP}">`);
  document.body.appendChild(f);
});