@alpaca-headless/dynamic-renderings 1.0.4694

package/dist/server/sanitize-tree.js

@@ -0,0 +1,343 @@
+// The allowlist every render tree from the engine passes before it becomes React.
+// Anything not listed here is dropped. The tree is rebuilt from scratch; no object from the
+// engine's JSON is reused, so nothing can smuggle extra keys through.
+//
+// Two kinds of attributes are refused because the editor bridge reads them: the markers it
+// builds page structure from (data-itemid, data-component-start, ...) and the class names it
+// treats specially (.scpm chrome, .a-editor-mce). Only the host emits those, from the
+// component JSON. test/dynamic-renderings.test.tsx extracts every such name from the
+// bridge source and checks this denylist still covers it.
+import { protocol } from "../protocol/protocol.js";
+export const ALLOWED_TAGS = new Set([
+    "a", "abbr", "address", "article", "aside", "audio", "b", "bdi", "bdo", "blockquote", "br",
+    "button", "caption", "cite", "col", "colgroup", "data", "dd", "del", "details", "dfn", "div",
+    "dl", "dt", "em", "figcaption", "figure", "footer", "h1", "h2", "h3", "h4", "h5", "h6",
+    "header", "hgroup", "hr", "i", "img", "ins", "kbd", "li", "main", "mark", "nav", "ol", "p",
+    "picture", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "small", "source", "span",
+    "strong", "sub", "summary", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "time",
+    "tr", "track", "u", "ul", "var", "video", "wbr",
+]);
+const VOID_TAGS = new Set(["br", "col", "hr", "img", "source", "track", "wbr"]);
+// Elements the host may render a text or rich-text field as. The SDK accepts any tag name.
+export const TEXT_TAGS = new Set(["p", "span", "div", "h1", "h2", "h3", "h4", "h5", "h6", "li", "dt", "dd", "figcaption", "blockquote", "strong", "em", "small", "time"]);
+export const RICH_TEXT_TAGS = new Set(["div", "section", "article"]);
+const GLOBAL_PROPS = new Set(["className", "id", "title", "lang", "dir", "role", "hidden", "tabIndex", "style"]);
+const TAG_PROPS = {
+    a: ["href", "target", "rel"],
+    img: ["src", "srcSet", "sizes", "alt", "width", "height", "loading", "decoding"],
+    source: ["src", "srcSet", "type", "media", "sizes"],
+    video: ["src", "poster", "controls", "muted", "loop", "autoPlay", "playsInline", "preload", "width", "height"],
+    audio: ["src", "controls", "muted", "loop", "autoPlay", "preload"],
+    track: ["src", "kind", "srcLang", "label", "default"],
+    td: ["colSpan", "rowSpan", "headers"],
+    th: ["colSpan", "rowSpan", "scope", "headers"],
+    time: ["dateTime"],
+    details: ["open"],
+    button: ["type", "disabled"],
+    ol: ["start", "reversed", "type"],
+    li: ["value"],
+    q: ["cite"],
+    blockquote: ["cite"],
+    del: ["cite"],
+    ins: ["cite"],
+    data: ["value"],
+    col: ["span"],
+    colgroup: ["span"],
+};
+// Attributes whose value is an id reference; ids are prefixed per rendering so a rendering
+// can never claim an id the page or the bridge relies on.
+const ID_REFERENCE_PROPS = new Set(["aria-labelledby", "aria-describedby", "aria-controls", "aria-owns", "aria-activedescendant", "headers"]);
+const URL_PROPS = new Set(["href", "src", "srcSet", "poster", "cite"]);
+/** data-* attributes the editor bridge (or the host itself) reads. */
+export const DENIED_DATA_ATTRIBUTE = new RegExp("^data-(" +
+    [
+        "itemid", "item-id", "fieldid", "fieldname", "language", "version", "database",
+        "component.*", "rendering.*", "renderingid", "placeholder.*", "dictionary-.*",
+        "editor-.*", "add-fields", "remove-fields", "is-rich.*", "parhelia.*", "typeid",
+        "layoutid", "editable", "variant", "target.*", "orientation", "description",
+        "parameters.*", "shared-.*", "has-.*", "type", "skip-.*", "island", "internal",
+        "querystring", "paste-.*",
+    ].join("|") +
+    ")$", "i");
+/** Class names the bridge or Sitecore chrome react to. */
+export function isDeniedClass(name) {
+    return /^sc[A-Z]/.test(name) || /^scpm$/i.test(name) || /^(a-editor|parhelia|alpaca)/i.test(name);
+}
+const ALLOWED_STYLE_FUNCTIONS = new Set([
+    "var", "calc", "min", "max", "clamp", "rgb", "rgba", "hsl", "hsla", "oklch", "oklab", "color-mix",
+    "linear-gradient", "radial-gradient", "conic-gradient", "translate", "translatex", "translatey",
+    "rotate", "scale", "scalex", "scaley", "skew", "skewx", "skewy", "repeat", "minmax", "cubic-bezier",
+]);
+function safeUrl(value, prop, ctx) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > 4096)
+        return undefined;
+    if (prop === "srcSet") {
+        const parts = trimmed.split(",").map((part) => {
+            const [url, ...descriptor] = part.trim().split(/\s+/);
+            const ok = safeUrl(url, "src", ctx);
+            return ok ? [ok, ...descriptor].join(" ") : undefined;
+        });
+        return parts.every(Boolean) ? parts.join(", ") : undefined;
+    }
+    if (prop === "href") {
+        // Relative links come from link fields (built by the host), never from element props.
+        return /^(https?:|mailto:|tel:)/i.test(trimmed) ? trimmed : undefined;
+    }
+    // src, poster, cite: media paths or configured media hosts only. Nothing ever points at the
+    // CM origin, where an image request would carry the editor's cookies.
+    if (/^\/-\/(media|jssmedia)\//i.test(trimmed) && !trimmed.includes(".."))
+        return trimmed;
+    try {
+        const url = new URL(trimmed);
+        if (url.protocol === "https:" && ctx.mediaHosts.includes(url.host.toLowerCase()))
+            return url.toString();
+    }
+    catch {
+        // not an absolute URL
+    }
+    return undefined;
+}
+function safeStyle(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const out = {};
+    for (const [prop, raw] of Object.entries(value)) {
+        if (!/^(--[A-Za-z0-9-]+|[a-zA-Z]+)$/.test(prop))
+            continue;
+        if (typeof raw === "number") {
+            if (Number.isFinite(raw))
+                out[prop] = raw;
+            continue;
+        }
+        if (typeof raw !== "string" || raw.length > 500)
+            continue;
+        if (/[\\<@]|\/\*/.test(raw))
+            continue;
+        let ok = true;
+        for (const match of raw.matchAll(/([a-zA-Z-]*)\s*\(/g)) {
+            if (!ALLOWED_STYLE_FUNCTIONS.has((match[1] ?? "").toLowerCase())) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok)
+            out[prop] = raw;
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+function prefixId(value, ctx) {
+    return value
+        .split(/\s+/)
+        .filter((v) => /^[A-Za-z][\w-]{0,99}$/.test(v))
+        .map((v) => `${ctx.idPrefix}${v}`)
+        .join(" ");
+}
+export function sanitizeProps(tag, props, ctx) {
+    const out = {};
+    if (!props || typeof props !== "object")
+        return out;
+    const allowed = TAG_PROPS[tag] || [];
+    for (const [name, value] of Object.entries(props)) {
+        if (name === "__parheliaComponentAttrs") {
+            if (value === true)
+                out.__parheliaComponentAttrs = true;
+            continue;
+        }
+        if (value === null || value === undefined)
+            continue;
+        const isAria = /^aria-[a-z]+$/.test(name);
+        const isData = /^data-[a-z0-9-]+$/.test(name) && !DENIED_DATA_ATTRIBUTE.test(name);
+        if (!GLOBAL_PROPS.has(name) && !allowed.includes(name) && !isAria && !isData)
+            continue;
+        if (name === "style") {
+            const style = safeStyle(value);
+            if (style)
+                out.style = style;
+            continue;
+        }
+        if (typeof value === "object" || typeof value === "function")
+            continue;
+        if (URL_PROPS.has(name)) {
+            const url = safeUrl(value, name, ctx);
+            if (url)
+                out[name] = url;
+            continue;
+        }
+        if (name === "className") {
+            if (typeof value !== "string")
+                continue;
+            const classes = value.split(/\s+/).filter((c) => c && c.length < 200 && !isDeniedClass(c));
+            if (classes.length)
+                out.className = classes.join(" ");
+            continue;
+        }
+        if (name === "id") {
+            if (typeof value === "string" && /^[A-Za-z][\w-]{0,99}$/.test(value))
+                out.id = `${ctx.idPrefix}${value}`;
+            continue;
+        }
+        if (ID_REFERENCE_PROPS.has(name)) {
+            if (typeof value === "string") {
+                const ids = prefixId(value, ctx);
+                if (ids)
+                    out[name] = ids;
+            }
+            continue;
+        }
+        if (name === "tabIndex") {
+            if (value === 0 || value === -1 || value === "0" || value === "-1")
+                out.tabIndex = Number(value);
+            continue;
+        }
+        if (name === "target") {
+            if (value === "_blank")
+                out.target = "_blank";
+            continue;
+        }
+        if (name === "type" && tag === "button") {
+            out.type = "button";
+            continue;
+        }
+        if (typeof value === "string" && value.length > 2000)
+            continue;
+        out[name] = value;
+    }
+    if (tag === "a" && out.target === "_blank")
+        out.rel = "noopener noreferrer";
+    if (tag === "button")
+        out.type = "button";
+    return out;
+}
+function sanitizeNode(node, ctx, depth, budget) {
+    if (typeof node === "string")
+        return node.length > 100_000 ? node.slice(0, 100_000) : node;
+    if (!node || typeof node !== "object" || Array.isArray(node))
+        return null;
+    budget.nodes += 1;
+    if (budget.nodes > ctx.limits.treeNodes || depth > ctx.limits.treeDepth) {
+        throw new Error("The render tree is too large.");
+    }
+    const n = node;
+    const children = (value) => sanitizeChildren(value, ctx, depth + 1, budget);
+    switch (n.t) {
+        case "el": {
+            const tag = typeof n.tag === "string" ? n.tag.toLowerCase() : "";
+            if (!ALLOWED_TAGS.has(tag))
+                return null;
+            return { t: "el", tag, props: sanitizeProps(tag, n.props, ctx), children: VOID_TAGS.has(tag) ? [] : children(n.children) };
+        }
+        case "field": {
+            if (typeof n.field !== "string" || !["text", "richtext", "picture", "link"].includes(n.kind))
+                return null;
+            const kind = n.kind;
+            const props = n.props && typeof n.props === "object" ? n.props : {};
+            const clean = {};
+            if (typeof props.className === "string") {
+                const classes = props.className.split(/\s+/).filter((c) => c && !isDeniedClass(c));
+                if (classes.length)
+                    clean.className = classes.join(" ");
+            }
+            if (kind === "picture") {
+                if (typeof props.sizes === "string" && props.sizes.length < 300)
+                    clean.sizes = props.sizes;
+                if (props.loading === "lazy" || props.loading === "eager")
+                    clean.loading = props.loading;
+            }
+            const tagSet = kind === "richtext" ? RICH_TEXT_TAGS : kind === "text" ? TEXT_TAGS : null;
+            const tag = tagSet && typeof n.tag === "string" && tagSet.has(n.tag) ? n.tag : undefined;
+            return {
+                t: "field",
+                kind,
+                field: n.field,
+                ...(tag ? { tag } : {}),
+                props: clean,
+                ...(kind === "link" ? { children: children(n.children) } : {}),
+            };
+        }
+        case "slot":
+            return typeof n.name === "string" ? { t: "slot", name: n.name } : null;
+        case "icon": {
+            if (typeof n.name !== "string" || !/^[A-Za-z0-9-]{1,60}$/.test(n.name))
+                return null;
+            const props = (n.props || {});
+            const clean = {};
+            if (typeof props.className === "string")
+                clean.className = props.className.split(/\s+/).filter((c) => c && !isDeniedClass(c)).join(" ");
+            if (typeof props.size === "number" && props.size > 0 && props.size <= 256)
+                clean.size = props.size;
+            if (typeof props.strokeWidth === "number" && props.strokeWidth > 0 && props.strokeWidth <= 8)
+                clean.strokeWidth = props.strokeWidth;
+            return { t: "icon", name: n.name, props: clean };
+        }
+        case "translate":
+            return typeof n.key === "string" && n.key.length < 300 ? { t: "translate", key: n.key } : null;
+        case "editorFields": {
+            const names = (value) => (Array.isArray(value) ? value.filter((v) => typeof v === "string") : []);
+            return { t: "editorFields", group: typeof n.group === "string" ? n.group : "Content", add: names(n.add), remove: names(n.remove) };
+        }
+        case "island": {
+            // A component of the rendering's client code, by export name. Its props reach the browser
+            // as JSON; its first paint is markup like any other and passes the same rules.
+            if (typeof n.name !== "string" || !/^[A-Za-z_$][\w$]{0,99}$/.test(n.name))
+                return null;
+            const props = jsonOnly(n.props, 0);
+            return {
+                t: "island",
+                name: n.name,
+                props: props && typeof props === "object" && !Array.isArray(props) ? props : {},
+                children: children(n.children),
+                firstPaint: children(n.firstPaint),
+            };
+        }
+        case "islandChildren":
+            return { t: "islandChildren" };
+        case "fragment":
+            return { t: "fragment", children: children(n.children) };
+        default:
+            return null;
+    }
+}
+function jsonOnly(value, depth) {
+    if (depth > 16)
+        return undefined;
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : undefined;
+    if (Array.isArray(value))
+        return value.slice(0, 1000).map((v) => jsonOnly(v, depth + 1));
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (k === "__proto__" || k === "constructor" || k === "prototype")
+                continue;
+            out[k] = jsonOnly(v, depth + 1);
+        }
+        return out;
+    }
+    return undefined;
+}
+function sanitizeChildren(value, ctx, depth, budget) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const child of value) {
+        const clean = sanitizeNode(child, ctx, depth, budget);
+        if (clean !== null)
+            out.push(clean);
+    }
+    return out;
+}
+/** Sanitizes a whole component tree. Throws when it exceeds the node or depth limits. */
+export function sanitizeTree(tree, renderingId, options = {}) {
+    const ctx = {
+        renderingId,
+        idPrefix: `pr-${renderingId.replace(/[^a-z0-9]/gi, "").slice(0, 8)}-`,
+        mediaHosts: options.mediaHosts ?? [],
+        limits: options.limits ?? protocol.limits,
+    };
+    return sanitizeChildren(tree, ctx, 0, { nodes: 0 });
+}

package/dist/server/theme.d.ts

@@ -0,0 +1,14 @@
+import "server-only";
+import { type DynamicRenderingsConfig } from "./config.js";
+/** SHA-256 of the LF-normalized theme text. */
+export declare function hashThemeCss(css: string): string;
+/**
+ * The theme a compile runs against: this host's theme file plus, when the tenant has a theme
+ * rendering, its tokens. The engine's compile result reports the same value.
+ */
+export declare function combineThemeHash(themeFileHash: string, themeTokens?: string | null): string;
+/** The theme's text and hash, cached for ten seconds. Throws ThemeUnavailableError. */
+export declare function loadTheme(config: DynamicRenderingsConfig): Promise<{
+    css: string;
+    hash: string;
+}>;

package/dist/server/theme.js

@@ -0,0 +1,38 @@
+import "server-only";
+import { createHash } from "node:crypto";
+import { normalizeThemeTokens } from "../css-policy/css-policy.mjs";
+import { ThemeUnavailableError } from "./config.js";
+const cache = new WeakMap();
+const sha256Hex = (text) => createHash("sha256").update(text).digest("hex");
+/** SHA-256 of the LF-normalized theme text. */
+export function hashThemeCss(css) {
+    return sha256Hex(css.replace(/\r\n/g, "\n"));
+}
+/**
+ * The theme a compile runs against: this host's theme file plus, when the tenant has a theme
+ * rendering, its tokens. The engine's compile result reports the same value.
+ */
+export function combineThemeHash(themeFileHash, themeTokens) {
+    const tokens = normalizeThemeTokens(themeTokens ?? "");
+    return tokens ? sha256Hex(`${themeFileHash}:${sha256Hex(tokens)}`) : themeFileHash;
+}
+/** The theme's text and hash, cached for ten seconds. Throws ThemeUnavailableError. */
+export async function loadTheme(config) {
+    const cached = cache.get(config);
+    if (cached && Date.now() - cached.at < 10_000)
+        return cached;
+    let css;
+    try {
+        css = await config.theme.load();
+    }
+    catch (err) {
+        if (err instanceof ThemeUnavailableError)
+            throw err;
+        throw new ThemeUnavailableError(`The theme (${config.theme.describe}) could not be read: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof css !== "string")
+        throw new ThemeUnavailableError(`The theme (${config.theme.describe}) returned no text.`);
+    const state = { css, hash: hashThemeCss(css), at: Date.now() };
+    cache.set(config, state);
+    return state;
+}

package/next-config/index.cjs

@@ -0,0 +1,101 @@
+"use strict";
+// next.config.js wrapper for dynamic renderings. Plain CommonJS on purpose: next.config.js loads
+// in ordinary Node, where anything importing "server-only" throws, so this file imports nothing
+// of the package's server code.
+const fs = require("node:fs");
+const path = require("node:path");
+const { corsExclusionSource, clientBundleRewrites } = require("./rewrites.cjs");
+
+const ENGINE_PACKAGE = "@alpaca-headless/dynamic-renderings-engine";
+const DEFAULT_THEME_TRACE = "./src/app/**/theme.css";
+const CATCH_ALL_SOURCES = new Set(["/:path*", "/(.*)", "/:path(.*)"]);
+const ALL_ROUTES = ["/*", "/**/*"];
+
+function setsAllowOrigin(rule) {
+  return Array.isArray(rule && rule.headers) && rule.headers.some((h) => String(h.key).toLowerCase() === "access-control-allow-origin");
+}
+
+/**
+ * A head's catch-all "Access-Control-Allow-Origin" rule would also cover /api/alpaca/*.
+ * Such rules get the exclusion source instead; rules with a narrower source are kept as they are.
+ */
+function excludeDynamicApi(rules) {
+  return (rules || []).map((rule) =>
+    setsAllowOrigin(rule) && CATCH_ALL_SOURCES.has(rule.source) ? { ...rule, source: corsExclusionSource } : rule,
+  );
+}
+
+async function resolve(value) {
+  return typeof value === "function" ? value() : value;
+}
+
+/**
+ * The head's own rewrites (an array or Next's phased object) with `before` checked first:
+ * beforeFiles, ahead of the pages, so a catch-all page never answers those paths.
+ */
+function prependRewrites(own, before) {
+  if (!before.length) return own || [];
+  if (!own) return { beforeFiles: before, afterFiles: [], fallback: [] };
+  if (Array.isArray(own)) return { beforeFiles: before, afterFiles: own, fallback: [] };
+  return { ...own, beforeFiles: [...before, ...(own.beforeFiles || [])] };
+}
+
+/**
+ * The engine's files as a trace glob relative to the project: the node_modules entry the app
+ * resolves at runtime (hoisted or not), not its real path, so standalone output keeps the layout
+ * Node resolves from.
+ */
+function engineTrace(projectDir) {
+  // Resolve from the runtime package too: an editor adapter can be a file: link in
+  // a sibling workspace. Walking only the head's ancestors misses its engine.
+  for (const start of [projectDir, __dirname]) {
+    for (let dir = start; ; dir = path.dirname(dir)) {
+      const candidate = path.join(dir, "node_modules", ...ENGINE_PACKAGE.split("/"));
+      if (fs.existsSync(path.join(candidate, "package.json"))) {
+        const relative = path.relative(projectDir, candidate).split(path.sep).join("/");
+        const base = relative.startsWith(".") ? relative : `./${relative}`;
+        return [`${base}/package.json`, `${base}/dist/**/*`];
+      }
+      if (path.dirname(dir) === dir) break;
+    }
+  }
+  return null;
+}
+
+function addTraces(tracing, routes, globs) {
+  for (const route of routes) tracing[route] = [...new Set([...(tracing[route] || []), ...globs])];
+}
+
+/**
+ * @param {import("next").NextConfig} nextConfig
+ * @param {{ themeFile?: string, routePrefixes?: string[] }} [options] themeFile: the theme's path
+ *   relative to the project, when it is not src/app/**\/theme.css. routePrefixes: path patterns
+ *   (e.g. "/editor/proxy/:host") a proxy serves pages under; bundle URLs under them reach the
+ *   bundle route.
+ */
+function withDynamicRenderings(nextConfig = {}, options = {}) {
+  const themeTrace = options.themeFile ? `./${String(options.themeFile).replace(/^\.?\//, "")}` : DEFAULT_THEME_TRACE;
+  const tracing = { ...(nextConfig.outputFileTracingIncludes || {}) };
+  // Pages and the build route read the theme at runtime and start the engine's threads from its
+  // dist folder; standalone output must contain both.
+  const engine = engineTrace(process.cwd());
+  if (!engine) console.warn(`[dynamic-renderings] ${ENGINE_PACKAGE} is not installed; dynamic renderings cannot compile or render.`);
+  addTraces(tracing, ALL_ROUTES, engine ? [themeTrace, ...engine] : [themeTrace]);
+
+  return {
+    ...nextConfig,
+    // The engine starts worker threads from files next to its own module; a bundled copy would
+    // point them at the bundle instead.
+    serverExternalPackages: [...new Set([...(nextConfig.serverExternalPackages || []), ENGINE_PACKAGE])],
+    outputFileTracingIncludes: tracing,
+    async headers() {
+      const own = await resolve(nextConfig.headers);
+      return excludeDynamicApi(own || []);
+    },
+    async rewrites() {
+      return prependRewrites(await resolve(nextConfig.rewrites), clientBundleRewrites(options.routePrefixes));
+    },
+  };
+}
+
+module.exports = { withDynamicRenderings, prependRewrites, corsExclusionSource, ENGINE_PACKAGE };

package/next-config/index.d.cts

@@ -0,0 +1,26 @@
+import type { NextConfig } from "next";
+
+export type DynamicRenderingsNextOptions = {
+  /** The theme's path relative to the project, when it is not src/app/**\/theme.css. */
+  themeFile?: string;
+  /**
+   * Path patterns a proxy serves this head's pages under, e.g. "/editor/proxy/:host". Bundle URLs
+   * under them (`{prefix}/api/alpaca/renderings/client/...`) are rewritten to the bundle route.
+   */
+  routePrefixes?: readonly string[];
+};
+
+type Rewrite = { source: string; destination: string; [key: string]: unknown };
+type Rewrites = Rewrite[] | { beforeFiles?: Rewrite[]; afterFiles?: Rewrite[]; fallback?: Rewrite[] };
+
+/**
+ * Loads @alpaca-headless/dynamic-renderings-engine unbundled (its threads start from files next to it),
+ * traces the engine and the theme file into standalone output, keeps the head's catch-all CORS
+ * rule off /api/alpaca/* (also under a prefix), and adds the bundle route's rewrites for
+ * `routePrefixes`. The head's own headers(), rewrites() and other settings are kept.
+ */
+export declare function withDynamicRenderings(nextConfig?: NextConfig, options?: DynamicRenderingsNextOptions): NextConfig;
+/** The head's rewrites with `before` checked ahead of the pages (as beforeFiles). */
+export declare function prependRewrites(own: Rewrites | undefined | null, before: Rewrite[]): Rewrites;
+export declare const corsExclusionSource: string;
+export declare const ENGINE_PACKAGE: "@alpaca-headless/dynamic-renderings-engine";

package/next-config/rewrites.cjs

@@ -0,0 +1,25 @@
+"use strict";
+// Routing data a rendering host needs, as plain CommonJS: next.config.js loads in ordinary Node,
+// and CommonJS loads from ESM while the reverse does not.
+
+/**
+ * A header rule source that matches every path except the dynamic-renderings API, also under a
+ * proxy prefix (/some/prefix/api/alpaca/...). The build route is for the CM only, and the proxy in
+ * front of a prefixed bundle URL sets its own CORS headers.
+ */
+const corsExclusionSource = "/:path((?!(?:.+/)?api/alpaca/).*)";
+
+const CLIENT_BUNDLE_PATH = "/api/alpaca/renderings/client/:file";
+
+/**
+ * Rewrites that let bundle URLs work under each proxy prefix a page may be served under. A prefix
+ * is a path pattern such as "/editor/proxy/:host"; only the bundle route is reachable this way.
+ */
+function clientBundleRewrites(routePrefixes) {
+  return (routePrefixes || []).map((prefix) => ({
+    source: `${String(prefix).replace(/\/+$/, "")}${CLIENT_BUNDLE_PATH}`,
+    destination: CLIENT_BUNDLE_PATH,
+  }));
+}
+
+module.exports = { corsExclusionSource, clientBundleRewrites, CLIENT_BUNDLE_PATH };

package/next-config/rewrites.d.cts

@@ -0,0 +1,3 @@
+export declare const corsExclusionSource: string;
+export declare const CLIENT_BUNDLE_PATH: "/api/alpaca/renderings/client/:file";
+export declare function clientBundleRewrites(routePrefixes?: readonly string[]): { source: string; destination: string }[];

package/package.json

@@ -0,0 +1,108 @@
+{
+  "name": "@alpaca-headless/dynamic-renderings",
+  "version": "1.0.4694",
+  "description": "Optional Alpaca Headless dynamic renderings: source client, safe React rendering, client code and Next.js integration.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    "./protocol": {
+      "types": "./dist/protocol/index.d.ts",
+      "import": "./dist/protocol/index.js"
+    },
+    "./css-policy": {
+      "types": "./dist/css-policy/css-policy.d.mts",
+      "import": "./dist/css-policy/css-policy.mjs"
+    },
+    "./rich-text": {
+      "types": "./dist/rich-text/index.d.ts",
+      "import": "./dist/rich-text/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./handlers": {
+      "types": "./dist/handlers/index.d.ts",
+      "import": "./dist/handlers/index.js"
+    },
+    "./handlers/rewrites": {
+      "types": "./next-config/rewrites.d.cts",
+      "default": "./next-config/rewrites.cjs"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "import": "./dist/next/index.js"
+    },
+    "./next/config": {
+      "types": "./next-config/index.d.cts",
+      "default": "./next-config/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/",
+    "next-config/",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": [
+    "./dist/client/ClientIslandRuntime.js"
+  ],
+  "scripts": {
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node scripts/copy-assets.mjs",
+    "build:native": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsgo -p tsconfig.build.json && node scripts/copy-assets.mjs",
+    "check-types": "tsc --noEmit",
+    "check-types:native": "tsgo --noEmit",
+    "test": "vitest run",
+    "acceptance": "node scripts/acceptance.mjs"
+  },
+  "dependencies": {
+    "@alpaca-headless/dynamic-renderings-engine": "1.0.4694",
+    "lucide-react": "^1.38.0",
+    "postcss": "^8.5.26",
+    "postcss-selector-parser": "^7.1.6",
+    "postcss-value-parser": "^4.2.0",
+    "sanitize-html": "^2.17.7",
+    "server-only": "^0.0.1"
+  },
+  "peerDependencies": {
+    "@alpaca-headless/alpaca-headless": ">=1.0.4656",
+    "@alpaca-headless/alpaca-headless-nextjs": ">=1.0.4656",
+    "next": ">=16",
+    "react": ">=19.2.0 <20",
+    "react-dom": ">=19.2.0 <20"
+  },
+  "peerDependenciesMeta": {
+    "@alpaca-headless/alpaca-headless-nextjs": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@alpaca-headless/alpaca-headless": "^1.0.4656",
+    "@alpaca-headless/alpaca-headless-nextjs": "^1.0.4656",
+    "@types/node": "^26.4.0",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.5",
+    "@types/sanitize-html": "^2.16.1",
+    "@typescript/native": "npm:typescript@7.0.2",
+    "next": "16.3.4",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "typescript": "npm:@typescript/typescript6@6.0.2",
+    "vitest": "^4.1.11"
+  },
+  "license": "SEE LICENSE IN LICENSE"
+}