Embedding an external function does not inherently require every kind of external connection. I reread the current block’s separate declarations for code, styles, data connections and frames, then extracted a small declaration planner. Registration and actual display remain distinct steps.

Name the resource purpose before opening a connection

Receiving a script file, querying data and displaying another page in a frame involve different requests. Current HTML blocks accept scripts, styles, connections, frames, images and media separately. Once a resource has been identified, establish which request purpose it serves.

A registered provider does not need to appear in every list. Declaring only the purposes an example needs makes subsequent changes or connection withdrawal easier to inspect. The new module rejects unknown purpose fields. This is a contract for reusable declarations, not an automatic analyzer discovering every request an external service may make.

Distinguish an origin from a resource address

An origin is a protocol, host and port boundary; a file path and search parameters describe other information. Current registration and block checks require a credential-free HTTPS origin without path, query or fragment. The new function parses the input and applies those conditions, reducing accidental registration of an entire resource URL.

Similar-looking hosts with different protocols or ports should not be treated as the same condition. Default ports and case use the URL parser’s normalized result. Selecting an actual provider also requires reviewing what organization and material that boundary represents. A well-formed declaration does not approve the service’s content or permitted use.

Compare the site’s reviewed list with each block declaration

A block’s address alone does not grant use. The site maintains a reviewed registry with purpose and evidence, and checks whether each declared origin is present. The planner accepts that registry as input, deduplicates origins within each purpose and rejects unregistered entries. Actual registration is a separate authenticated management operation.

Removing registration can change a manuscript’s later publication check. Withdrawal remains available when these conditions change. Inspect which articles depend on the provider before deciding an edit or withdrawal scope. This module examines input declarations only; it does not change server policy or automatically revise material already published.

Explore the implementation

Compare declared origins with the reviewed registry

const kinds=['scripts','styles','connections','frames','images','media'];
export function exactResourceOrigin(value){
 let url;try{url=new URL(value);}catch{throw new TypeError('Absolute HTTPS origin required');}
 if(url.protocol!=='https:'||url.username||url.password||url.pathname!=='/'||url.search||url.hash)throw new TypeError('Origin must exclude credentials,path,query and fragment');
 return url.origin;
}
export function planResourceOrigins(resources,registered){
 if(!resources||typeof resources!=='object'||Array.isArray(resources)||!Array.isArray(registered))throw new TypeError('Explicit resource object and registered origin list required');
 if(Object.keys(resources).some(kind=>!kinds.includes(kind)))throw new TypeError('Unknown resource purpose');
 const allowed=new Set(registered.map(exactResourceOrigin)),result={};
 for(const kind of kinds){
  const values=resources[kind]||[];if(!Array.isArray(values)||values.length>12)throw new RangeError('Each purpose supports at most 12 declared origins');
  const origins=[...new Set(values.map(exactResourceOrigin))];
  if(origins.some(origin=>!allowed.has(origin)))throw new Error('Origin is not registered for this site');
  result[kind]=origins;
 }
 return {resources:result,scope:'Declaration planning only. Registration needs separate actual review; no fetch,CORS,iframe-provider permission or complete policy enforcement is demonstrated.'};
}

Separate registration from actual browser availability

A registered origin can still belong to a provider that prevents framing or requires login and connection conditions. Reading API data also needs a separate check of whether the browser may use the response. This editor is not described as bypassing those restrictions. Declared connections and actual display need related verification.

Execution tokens and content policy must be read with the resource declaration. A script origin in the registry does not create the same execution condition when scripts is disabled on the HTML block. Retaining what was registered, requested and enabled helps locate a failure. The declaration model does not promise that every page visible on the internet can be embedded identically.

Inspect the declaration in a model that performs no connection

Local checks cover per-purpose deduplication, empty lists, unregistered origins and path, credential, protocol and port conditions. The example does not request its input address. A checkbox supplies an illustrative registration state, with no actual server registration or external-provider call. Its returned lists help readers inspect which purpose retains the address.

New browser interaction and provider behavior remain unverified. An actual integration should continue through the reviewed service’s supported delivery, responses, scripts and framing. I want expansion to retain the required declaration and next verification step rather than opening every connection as one undifferentiated group.