From 6a93de6950c4a7cce51406e9f26bbc00462c8f22 Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 11:57:18 -0800
Subject: [PATCH 1/9] Add key to see if will sidestep chromes caching

---
 src/blocks/GenericEmbed/Component.tsx | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 83c315b1..3d1f5948 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -21,6 +21,9 @@ export const GenericEmbedBlockComponent = ({
   isLexical = true,
 }: Props) => {
   const [sanitizedHtml, setSanitizedHtml] = useState<string | null>(null)
+  // Unique key per mount forces a new iframe browsing context, ensuring scripts
+  // (especially type="module") re-execute after client-side navigation in Chrome.
+  const [iframeKey] = useState(() => Date.now())
 
   const bgColorClass = `bg-${backgroundColor}`
   const textColor = getTextColorFromBgColor(backgroundColor)
@@ -85,6 +88,7 @@ export const GenericEmbedBlockComponent = ({
         )}
       >
         <IframeResizer
+          key={iframeKey}
           id={String(id)}
           title={`Embedded content ${id}`}
           srcDoc={sanitizedHtml}

From c815dc3142ad1a98ac9950660e683d98ddc0bd6f Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 12:24:29 -0800
Subject: [PATCH 2/9] Cache-busting via DOMPurify

---
 src/blocks/GenericEmbed/Component.tsx | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 3d1f5948..6b4e7180 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -21,9 +21,6 @@ export const GenericEmbedBlockComponent = ({
   isLexical = true,
 }: Props) => {
   const [sanitizedHtml, setSanitizedHtml] = useState<string | null>(null)
-  // Unique key per mount forces a new iframe browsing context, ensuring scripts
-  // (especially type="module") re-execute after client-side navigation in Chrome.
-  const [iframeKey] = useState(() => Date.now())
 
   const bgColorClass = `bg-${backgroundColor}`
   const textColor = getTextColorFromBgColor(backgroundColor)
@@ -34,6 +31,17 @@ export const GenericEmbedBlockComponent = ({
     // Normalize problematic quotes that are parsed incorrectly by DOMParser and DOMPurify
     const normalizedHTML = html.replaceAll('"', '"').replaceAll('"', '"')
 
+    // Add cache-busting parameter to module script URLs to force re-evaluation.
+    // Chrome caches module scripts by URL and skips re-evaluation on client-side
+    // navigation, which prevents widgets from loading when revisiting a page.
+    DOMPurify.addHook('afterSanitizeAttributes', (node) => {
+      const src = node.getAttribute('src')
+      if (node.tagName === 'SCRIPT' && node.getAttribute('type') === 'module' && src) {
+        const separator = src.includes('?') ? '&' : '?'
+        node.setAttribute('src', `${src}${separator}_cb=${Date.now()}`)
+      }
+    })
+
     const sanitized = DOMPurify.sanitize(normalizedHTML, {
       ADD_TAGS: ['iframe', 'script', 'style', 'dbox-widget'],
       ADD_ATTR: [
@@ -58,6 +66,8 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
+    DOMPurify.removeHook('afterSanitizeAttributes')
+
     const styleOverrides = `
       <style>
         html, body {
@@ -88,7 +98,6 @@ export const GenericEmbedBlockComponent = ({
         )}
       >
         <IframeResizer
-          key={iframeKey}
           id={String(id)}
           title={`Embedded content ${id}`}
           srcDoc={sanitizedHtml}

From 726cf25da7bc0006b6d84b3d1971cd605942bdff Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 13:10:28 -0800
Subject: [PATCH 3/9] Add logging to understand

---
 src/blocks/GenericEmbed/Component.tsx | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 6b4e7180..ff178988 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -25,22 +25,19 @@ export const GenericEmbedBlockComponent = ({
   const bgColorClass = `bg-${backgroundColor}`
   const textColor = getTextColorFromBgColor(backgroundColor)
 
+  // TODO: remove debug logging
+  console.log('[GenericEmbed] component rendered, sanitizedHtml:', sanitizedHtml ? 'set' : 'null')
+
   useEffect(() => {
+    console.log('[GenericEmbed] useEffect fired, html:', html ? 'present' : 'missing')
     if (typeof window === 'undefined' || !html) return
 
     // Normalize problematic quotes that are parsed incorrectly by DOMParser and DOMPurify
     const normalizedHTML = html.replaceAll('"', '"').replaceAll('"', '"')
-
-    // Add cache-busting parameter to module script URLs to force re-evaluation.
-    // Chrome caches module scripts by URL and skips re-evaluation on client-side
-    // navigation, which prevents widgets from loading when revisiting a page.
-    DOMPurify.addHook('afterSanitizeAttributes', (node) => {
-      const src = node.getAttribute('src')
-      if (node.tagName === 'SCRIPT' && node.getAttribute('type') === 'module' && src) {
-        const separator = src.includes('?') ? '&' : '?'
-        node.setAttribute('src', `${src}${separator}_cb=${Date.now()}`)
-      }
-    })
+    console.log(
+      '[GenericEmbed] normalizedHTML contains script:',
+      normalizedHTML.includes('<script'),
+    )
 
     const sanitized = DOMPurify.sanitize(normalizedHTML, {
       ADD_TAGS: ['iframe', 'script', 'style', 'dbox-widget'],
@@ -66,7 +63,8 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    DOMPurify.removeHook('afterSanitizeAttributes')
+    console.log('[GenericEmbed] sanitized contains script:', sanitized.includes('<script'))
+    console.log('[GenericEmbed] sanitized output:', sanitized)
 
     const styleOverrides = `
       <style>

From 98ce32cf9879c97b0e674cbdc824504f9364d56a Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 13:38:30 -0800
Subject: [PATCH 4/9] Retry hook and remove logs

---
 src/blocks/GenericEmbed/Component.tsx | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index ff178988..e9b1c2a4 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -25,19 +25,27 @@ export const GenericEmbedBlockComponent = ({
   const bgColorClass = `bg-${backgroundColor}`
   const textColor = getTextColorFromBgColor(backgroundColor)
 
-  // TODO: remove debug logging
-  console.log('[GenericEmbed] component rendered, sanitizedHtml:', sanitizedHtml ? 'set' : 'null')
-
   useEffect(() => {
-    console.log('[GenericEmbed] useEffect fired, html:', html ? 'present' : 'missing')
     if (typeof window === 'undefined' || !html) return
 
     // Normalize problematic quotes that are parsed incorrectly by DOMParser and DOMPurify
     const normalizedHTML = html.replaceAll('"', '"').replaceAll('"', '"')
-    console.log(
-      '[GenericEmbed] normalizedHTML contains script:',
-      normalizedHTML.includes('<script'),
-    )
+
+    // Convert external module scripts to dynamic imports inside inline classic scripts.
+    // Chrome does not re-execute <script type="module" src="..."> in srcDoc iframes
+    // after client-side navigation. Inline classic scripts always execute, and dynamic
+    // import() bypasses Chrome's per-URL module evaluation cache.
+    DOMPurify.addHook('uponSanitizeElement', (node, data) => {
+      if (data.tagName === 'script' && node instanceof Element) {
+        const src = node.getAttribute('src')
+        if (node.getAttribute('type') === 'module' && src) {
+          node.removeAttribute('type')
+          node.removeAttribute('src')
+          node.removeAttribute('async')
+          node.textContent = `import(${JSON.stringify(src)});`
+        }
+      }
+    })
 
     const sanitized = DOMPurify.sanitize(normalizedHTML, {
       ADD_TAGS: ['iframe', 'script', 'style', 'dbox-widget'],
@@ -63,8 +71,7 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    console.log('[GenericEmbed] sanitized contains script:', sanitized.includes('<script'))
-    console.log('[GenericEmbed] sanitized output:', sanitized)
+    DOMPurify.removeHook('uponSanitizeElement')
 
     const styleOverrides = `
       <style>

From 01c414039be2594421b351face9e610f2aeff8ed Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 14:04:46 -0800
Subject: [PATCH 5/9] Remove hook and try script replace

---
 src/blocks/GenericEmbed/Component.tsx | 27 +++++++++------------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index e9b1c2a4..fdb6e9c9 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -31,22 +31,6 @@ export const GenericEmbedBlockComponent = ({
     // Normalize problematic quotes that are parsed incorrectly by DOMParser and DOMPurify
     const normalizedHTML = html.replaceAll('"', '"').replaceAll('"', '"')
 
-    // Convert external module scripts to dynamic imports inside inline classic scripts.
-    // Chrome does not re-execute <script type="module" src="..."> in srcDoc iframes
-    // after client-side navigation. Inline classic scripts always execute, and dynamic
-    // import() bypasses Chrome's per-URL module evaluation cache.
-    DOMPurify.addHook('uponSanitizeElement', (node, data) => {
-      if (data.tagName === 'script' && node instanceof Element) {
-        const src = node.getAttribute('src')
-        if (node.getAttribute('type') === 'module' && src) {
-          node.removeAttribute('type')
-          node.removeAttribute('src')
-          node.removeAttribute('async')
-          node.textContent = `import(${JSON.stringify(src)});`
-        }
-      }
-    })
-
     const sanitized = DOMPurify.sanitize(normalizedHTML, {
       ADD_TAGS: ['iframe', 'script', 'style', 'dbox-widget'],
       ADD_ATTR: [
@@ -71,7 +55,14 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    DOMPurify.removeHook('uponSanitizeElement')
+    // Convert external module scripts to dynamic imports inside inline classic scripts.
+    // Chrome does not re-execute <script type="module" src="..."> in srcDoc iframes
+    // after client-side navigation. Inline classic scripts always execute, and dynamic
+    // import() bypasses Chrome's per-URL module evaluation cache.
+    const withDynamicScripts = sanitized.replace(
+      /<script[^>]*\btype="module"[^>]*\bsrc="([^"]+)"[^>]*><\/script>/gi,
+      (_, url) => `<script>import(${JSON.stringify(url)});<\/script>`,
+    )
 
     const styleOverrides = `
       <style>
@@ -85,7 +76,7 @@ export const GenericEmbedBlockComponent = ({
       </style>
     `
 
-    setSanitizedHtml(sanitized + styleOverrides)
+    setSanitizedHtml(withDynamicScripts + styleOverrides)
   }, [html])
 
   if (sanitizedHtml === null) return null

From d5bd8147e7342feb1400c45f8e90180a629ff2b8 Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 14:31:24 -0800
Subject: [PATCH 6/9] Injects a fresh script element rather than relying on the
 browser to execute a static <script> tag from parsed HTML

---
 src/blocks/GenericEmbed/Component.tsx | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index fdb6e9c9..2ee3e7f4 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -55,13 +55,15 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    // Convert external module scripts to dynamic imports inside inline classic scripts.
-    // Chrome does not re-execute <script type="module" src="..."> in srcDoc iframes
-    // after client-side navigation. Inline classic scripts always execute, and dynamic
-    // import() bypasses Chrome's per-URL module evaluation cache.
+    // Replace static module script tags with inline scripts that programmatically
+    // create and inject the script element. Chrome does not re-execute static
+    // <script type="module" src="..."> in srcDoc iframes after client-side navigation
+    // because it considers the script already loaded. Using document.createElement
+    // forces the browser to treat it as a fresh script load every time.
     const withDynamicScripts = sanitized.replace(
       /<script[^>]*\btype="module"[^>]*\bsrc="([^"]+)"[^>]*><\/script>/gi,
-      (_, url) => `<script>import(${JSON.stringify(url)});<\/script>`,
+      (_, url) =>
+        `<script>var s=document.createElement("script");s.type="module";s.src=${JSON.stringify(url)};s.async=true;document.head.appendChild(s);<\/script>`,
     )
 
     const styleOverrides = `

From 60b0e2144c767d026281fcb0df740aaadb7d3864 Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 15:08:36 -0800
Subject: [PATCH 7/9] Add cache-busting to bypass Chrome's MemoryCache for
 module scripts in srcDoc iframes

---
 src/blocks/GenericEmbed/Component.tsx | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 2ee3e7f4..867d4d71 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -56,14 +56,20 @@ export const GenericEmbedBlockComponent = ({
     })
 
     // Replace static module script tags with inline scripts that programmatically
-    // create and inject the script element. Chrome does not re-execute static
-    // <script type="module" src="..."> in srcDoc iframes after client-side navigation
-    // because it considers the script already loaded. Using document.createElement
-    // forces the browser to treat it as a fresh script load every time.
+    // create and inject the script element with a cache-busted URL.
+    // Chrome's renderer-process-level MemoryCache is shared across same-site
+    // documents, including about:srcdoc iframes. In an SPA, client-side navigation
+    // doesn't create a new renderer process, so the MemoryCache persists and
+    // causes Chrome to skip module evaluation on subsequent iframe loads.
+    // A unique URL misses the MemoryCache entirely, and createElement ensures
+    // the script is treated as a fresh insertion.
+    const cacheBuster = Date.now()
     const withDynamicScripts = sanitized.replace(
       /<script[^>]*\btype="module"[^>]*\bsrc="([^"]+)"[^>]*><\/script>/gi,
-      (_, url) =>
-        `<script>var s=document.createElement("script");s.type="module";s.src=${JSON.stringify(url)};s.async=true;document.head.appendChild(s);<\/script>`,
+      (_, url) => {
+        const bustUrl = url + (url.includes('?') ? '&' : '?') + '_v=' + cacheBuster
+        return `<script>var s=document.createElement("script");s.type="module";s.src=${JSON.stringify(bustUrl)};s.async=true;document.head.appendChild(s);<\/script>`
+      },
     )
 
     const styleOverrides = `

From 373437a0d189f22ba0e6f4de9162d297ecaefa8e Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 15:30:49 -0800
Subject: [PATCH 8/9] Add timestamp to url

---
 src/blocks/GenericEmbed/Component.tsx | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 867d4d71..7c7119d9 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -55,23 +55,23 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    // Replace static module script tags with inline scripts that programmatically
-    // create and inject the script element with a cache-busted URL.
-    // Chrome's renderer-process-level MemoryCache is shared across same-site
-    // documents, including about:srcdoc iframes. In an SPA, client-side navigation
-    // doesn't create a new renderer process, so the MemoryCache persists and
-    // causes Chrome to skip module evaluation on subsequent iframe loads.
-    // A unique URL misses the MemoryCache entirely, and createElement ensures
-    // the script is treated as a fresh insertion.
+    // Cache-bust external script URLs to bypass Chrome's renderer-process-level
+    // MemoryCache, which is shared across same-site documents including srcdoc
+    // iframes. In an SPA, the MemoryCache persists across client-side navigations
+    // and causes Chrome to skip module re-evaluation on subsequent iframe loads.
     const cacheBuster = Date.now()
     const withDynamicScripts = sanitized.replace(
-      /<script[^>]*\btype="module"[^>]*\bsrc="([^"]+)"[^>]*><\/script>/gi,
-      (_, url) => {
-        const bustUrl = url + (url.includes('?') ? '&' : '?') + '_v=' + cacheBuster
-        return `<script>var s=document.createElement("script");s.type="module";s.src=${JSON.stringify(bustUrl)};s.async=true;document.head.appendChild(s);<\/script>`
+      /(<script\b[^>]*\bsrc=")([^"]+)("[^>]*>)/gi,
+      (_match, before, url, after) => {
+        const separator = url.includes('?') ? '&' : '?'
+        return `${before}${url}${separator}_v=${cacheBuster}${after}`
       },
     )
 
+    // TODO: remove debug logging
+    console.log('[GenericEmbed] original:', sanitized.substring(0, 100))
+    console.log('[GenericEmbed] replaced:', withDynamicScripts.substring(0, 100))
+
     const styleOverrides = `
       <style>
         html, body {

From bfe8b17819c8ca177b704d4d371c99b1d5852365 Mon Sep 17 00:00:00 2001
From: rchlfryn <rachelafryan@gmail.com>
Date: Wed, 18 Feb 2026 16:02:09 -0800
Subject: [PATCH 9/9] completely sidestep srcDoc

---
 src/blocks/GenericEmbed/Component.tsx | 36 ++++++++++-----------------
 1 file changed, 13 insertions(+), 23 deletions(-)

diff --git a/src/blocks/GenericEmbed/Component.tsx b/src/blocks/GenericEmbed/Component.tsx
index 7c7119d9..0fe2d14d 100644
--- a/src/blocks/GenericEmbed/Component.tsx
+++ b/src/blocks/GenericEmbed/Component.tsx
@@ -20,7 +20,7 @@ export const GenericEmbedBlockComponent = ({
   className,
   isLexical = true,
 }: Props) => {
-  const [sanitizedHtml, setSanitizedHtml] = useState<string | null>(null)
+  const [blobUrl, setBlobUrl] = useState<string | null>(null)
 
   const bgColorClass = `bg-${backgroundColor}`
   const textColor = getTextColorFromBgColor(backgroundColor)
@@ -29,7 +29,7 @@ export const GenericEmbedBlockComponent = ({
     if (typeof window === 'undefined' || !html) return
 
     // Normalize problematic quotes that are parsed incorrectly by DOMParser and DOMPurify
-    const normalizedHTML = html.replaceAll('"', '"').replaceAll('"', '"')
+    const normalizedHTML = html.replaceAll('\u201C', '"').replaceAll('\u201D', '"')
 
     const sanitized = DOMPurify.sanitize(normalizedHTML, {
       ADD_TAGS: ['iframe', 'script', 'style', 'dbox-widget'],
@@ -55,23 +55,6 @@ export const GenericEmbedBlockComponent = ({
       FORCE_BODY: true,
     })
 
-    // Cache-bust external script URLs to bypass Chrome's renderer-process-level
-    // MemoryCache, which is shared across same-site documents including srcdoc
-    // iframes. In an SPA, the MemoryCache persists across client-side navigations
-    // and causes Chrome to skip module re-evaluation on subsequent iframe loads.
-    const cacheBuster = Date.now()
-    const withDynamicScripts = sanitized.replace(
-      /(<script\b[^>]*\bsrc=")([^"]+)("[^>]*>)/gi,
-      (_match, before, url, after) => {
-        const separator = url.includes('?') ? '&' : '?'
-        return `${before}${url}${separator}_v=${cacheBuster}${after}`
-      },
-    )
-
-    // TODO: remove debug logging
-    console.log('[GenericEmbed] original:', sanitized.substring(0, 100))
-    console.log('[GenericEmbed] replaced:', withDynamicScripts.substring(0, 100))
-
     const styleOverrides = `
       <style>
         html, body {
@@ -84,10 +67,17 @@ export const GenericEmbedBlockComponent = ({
       </style>
     `
 
-    setSanitizedHtml(withDynamicScripts + styleOverrides)
+    // Use a blob URL instead of srcDoc because Chromium doesn't re-execute
+    // scripts in srcDoc iframes after SPA client-side navigation.
+    const fullHtml = `<!DOCTYPE html><html><head></head><body>${sanitized}${styleOverrides}</body></html>`
+    const blob = new Blob([fullHtml], { type: 'text/html' })
+    const url = URL.createObjectURL(blob)
+    setBlobUrl(url)
+
+    return () => URL.revokeObjectURL(url)
   }, [html])
 
-  if (sanitizedHtml === null) return null
+  if (blobUrl === null) return null
 
   return (
     <div className={cn(bgColorClass, textColor)}>
@@ -104,10 +94,10 @@ export const GenericEmbedBlockComponent = ({
         <IframeResizer
           id={String(id)}
           title={`Embedded content ${id}`}
-          srcDoc={sanitizedHtml}
+          src={blobUrl}
           sandbox="allow-scripts allow-presentation allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"
           className="w-full border-none m-0 p-0 transition-[height] duration-200 ease-in-out"
-          height={0} // This iframe will resize to it's content height - this initial height is to avoid the iframe rendering at the browser default 150px initially
+          height={0}
         />
       </div>
     </div>