Semantics of `ui.domain` for web rendering

[hybrist]

I tried to find a reference implementation for UIResourceMeta#domain but couldn't find one. The description says:

Optional domain for the widget's sandbox origin. Useful when widgets need dedicated origins for API key allowlists or cross-origin isolation.

But from what I can tell, an iframe-based embedder (any embedder?) doesn't have a way to say "please render this arbitrary string as an iframe and let it act as if it was arbitrary origin X". That also doesn't feel like something that should work in terms of web security.

Is there more detail on the expected semantics of ui.domain?

[ochafik]

Hi @hybrist , thanks for filing this, fixed by #309 :-)