@arbidocs/blocks 0.4.128 → 0.4.130

package/dist/sandboxDocument-JLEETIWW.js

@@ -0,0 +1,71 @@
+"use client";
+import { ARTIFACT_MESSAGE_TAG, ARTIFACT_CSP } from './chunk-NS4JD2VR.js';
+import './chunk-VUNV25KB.js';
+import { transform } from 'sucrase';
+
+var BRIDGE_SCRIPT = `(function(){
+var TAG=${JSON.stringify(ARTIFACT_MESSAGE_TAG)};
+function send(m){m[TAG]=true;try{parent.postMessage(m,'*')}catch(e){}}
+function str(v){if(typeof v==='string')return v;if(v instanceof Error)return v.stack||v.message;try{return JSON.stringify(v)}catch(e){return String(v)}}
+['log','info','warn','error'].forEach(function(l){var o=console[l];console[l]=function(){var a=[].slice.call(arguments);send({type:'console',level:l,text:a.map(str).join(' ')});try{o.apply(console,a)}catch(e){}}});
+window.addEventListener('error',function(e){send({type:'error',text:(e.message||'Error')+(e.lineno?' (line '+e.lineno+')':'')})});
+window.addEventListener('unhandledrejection',function(e){send({type:'error',text:'Unhandled promise rejection: '+str(e.reason)})});
+window.__arbiArtifactSend=send;
+})();`;
+function securityPrefix(extraHead) {
+  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${ARTIFACT_CSP}"><meta name="viewport" content="width=device-width, initial-scale=1"><script>${BRIDGE_SCRIPT}</script>${extraHead}</head><body>`;
+}
+var TAILWIND_CDN_SCRIPT = /<script\b[^>]*\bsrc\s*=\s*["']https?:\/\/(?:cdn\.tailwindcss\.com|cdn\.jsdelivr\.net\/npm\/@tailwindcss\/browser)[^"']*["'][^>]*>\s*<\/script\s*>/gi;
+function buildHtmlSandboxDocument(source, runtime) {
+  const body = source.replace(
+    TAILWIND_CDN_SCRIPT,
+    () => `<script>${escapeForInlineScript(runtime.tailwind)}</script>`
+  );
+  return securityPrefix("") + body;
+}
+function compileReactArtifact(source) {
+  try {
+    return transform(source, {
+      transforms: ["jsx", "imports"],
+      jsxRuntime: "classic",
+      production: true
+    }).code;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Could not compile this component: ${message}`, { cause: err });
+  }
+}
+function escapeForInlineScript(code) {
+  return code.replace(/<\/script/gi, "<\\/script").replace(/<!--/g, "<\\!--");
+}
+function reactBootstrap(compiled) {
+  return `(function(){
+var send=window.__arbiArtifactSend||function(){};
+var available={'react':window.React,'react-dom':window.ReactDOM,'react-dom/client':window.ReactDOMClient};
+function req(name){if(Object.prototype.hasOwnProperty.call(available,name))return available[name];throw new Error('Module "'+name+'" is not available in artifacts. Only "react" and "react-dom" can be imported.')}
+var module={exports:{}};var exports=module.exports;
+try{
+(function(require,module,exports){
+${escapeForInlineScript(compiled)}
+})(req,module,exports);
+var App=(module.exports&&module.exports.default)||module.exports;
+if(typeof App!=='function')throw new Error('The artifact must export a React component with "export default".');
+var React=window.React;
+var Boundary=class extends React.Component{constructor(p){super(p);this.state={e:null}}static getDerivedStateFromError(e){return{e:e}}componentDidCatch(e){send({type:'error',text:String(e&&e.stack||e)})}render(){if(this.state.e)return React.createElement('pre',{style:{color:'#b91c1c',padding:'16px',whiteSpace:'pre-wrap',font:'13px/1.5 ui-monospace,monospace'}},String(this.state.e&&this.state.e.message||this.state.e));return this.props.children}};
+window.ReactDOMClient.createRoot(document.getElementById('root')).render(React.createElement(Boundary,null,React.createElement(App)));
+send({type:'ready'});
+}catch(e){send({type:'error',text:String(e&&e.message||e)})}
+})();`;
+}
+function buildReactSandboxDocument(source, runtime) {
+  const compiled = compileReactArtifact(source);
+  const head = `<script>${escapeForInlineScript(runtime.react)}</script><script>${escapeForInlineScript(runtime.tailwind)}</script><style>html,body,#root{min-height:100%;margin:0}</style>`;
+  return securityPrefix(head) + `<div id="root"></div><script>${reactBootstrap(compiled)}</script>`;
+}
+function buildSandboxDocument(kind, source, runtime) {
+  return kind === "react" ? buildReactSandboxDocument(source, runtime) : buildHtmlSandboxDocument(source, runtime);
+}
+
+export { buildHtmlSandboxDocument, buildReactSandboxDocument, buildSandboxDocument, compileReactArtifact };
+//# sourceMappingURL=sandboxDocument-JLEETIWW.js.map
+//# sourceMappingURL=sandboxDocument-JLEETIWW.js.map

package/dist/sandboxDocument-JLEETIWW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/artifacts/sandboxDocument.ts"],"names":[],"mappings":";;;;AAsBA,IAAM,aAAA,GAAgB,CAAA;AAAA,QAAA,EACZ,IAAA,CAAK,SAAA,CAAU,oBAAoB,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAAA,CAAA;AAS9C,SAAS,eAAe,SAAA,EAA2B;AACjD,EAAA,OACE,CAAA,qGAAA,EACuD,YAAY,CAAA,8EAAA,EAExD,aAAa,YAAY,SAAS,CAAA,aAAA,CAAA;AAEjD;AAIA,IAAM,mBAAA,GACJ,qJAAA;AAEK,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAAkC;AAEzF,EAAA,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,IAClB,mBAAA;AAAA,IACA,MAAM,CAAA,QAAA,EAAW,qBAAA,CAAsB,OAAA,CAAQ,QAAQ,CAAC,CAAA,SAAA;AAAA,GAC1D;AACA,EAAA,OAAO,cAAA,CAAe,EAAE,CAAA,GAAI,IAAA;AAC9B;AAGO,SAAS,qBAAqB,MAAA,EAAwB;AAC3D,EAAA,IAAI;AACF,IAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,MACvB,UAAA,EAAY,CAAC,KAAA,EAAO,SAAS,CAAA;AAAA,MAC7B,UAAA,EAAY,SAAA;AAAA,MACZ,UAAA,EAAY;AAAA,KACb,CAAA,CAAE,IAAA;AAAA,EACL,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,OAAO,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EAChF;AACF;AAGA,SAAS,sBAAsB,IAAA,EAAsB;AACnD,EAAA,OAAO,KAAK,OAAA,CAAQ,aAAA,EAAe,YAAY,CAAA,CAAE,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC5E;AAGA,SAAS,eAAe,QAAA,EAA0B;AAChD,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,qBAAA,CAAsB,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAAA,CAAA;AAUjC;AAEO,SAAS,yBAAA,CAA0B,QAAgB,OAAA,EAAkC;AAC1F,EAAA,MAAM,QAAA,GAAW,qBAAqB,MAAM,CAAA;AAC5C,EAAA,MAAM,IAAA,GACJ,CAAA,QAAA,EAAW,qBAAA,CAAsB,OAAA,CAAQ,KAAK,CAAC,CAAA,iBAAA,EACpC,qBAAA,CAAsB,OAAA,CAAQ,QAAQ,CAAC,CAAA,iEAAA,CAAA;AAEpD,EAAA,OAAO,eAAe,IAAI,CAAA,GAAI,CAAA,6BAAA,EAAgC,cAAA,CAAe,QAAQ,CAAC,CAAA,SAAA,CAAA;AACxF;AAEO,SAAS,oBAAA,CACd,IAAA,EACA,MAAA,EACA,OAAA,EACQ;AACR,EAAA,OAAO,IAAA,KAAS,UACZ,yBAAA,CAA0B,MAAA,EAAQ,OAAO,CAAA,GACzC,wBAAA,CAAyB,QAAQ,OAAO,CAAA;AAC9C","file":"sandboxDocument-JLEETIWW.js","sourcesContent":["/**\n * Builds the document that runs inside the artifact preview iframe.\n *\n * Threat model: artifact code is written by an LLM from untrusted input and runs in\n * the user's browser next to a decrypted session. It must never reach the app.\n * Layers (each independently sufficient for the main risks):\n *   1. The iframe is sandboxed with `allow-scripts` ONLY. No `allow-same-origin`, so the\n *      frame gets an opaque origin: no access to the parent DOM, cookies, localStorage,\n *      IndexedDB or the in-memory session. No popups, forms, top navigation or downloads.\n *   2. A Content-Security-Policy with `connect-src 'none'` and no remote sources: the\n *      artifact cannot fetch, open sockets, load remote scripts/images/fonts or exfiltrate.\n *   3. JSX is compiled in the app (sucrase = text transform only), so the sandbox never\n *      needs a compiler and compile errors surface in the app UI.\n *\n * The security prefix is PREPENDED to artifact HTML, never spliced into it, so a crafted\n * comment or `<head>` in the artifact cannot move the CSP out of effect.\n */\nimport { transform } from 'sucrase'\nimport type { ArtifactPreviewKind } from '@arbidocs/react/artifacts'\nimport { ARTIFACT_CSP, ARTIFACT_MESSAGE_TAG, type ArtifactRuntime } from './sandbox-policy'\n\n// Forwards console output and uncaught errors to the app. Runs first, before artifact code.\nconst BRIDGE_SCRIPT = `(function(){\nvar TAG=${JSON.stringify(ARTIFACT_MESSAGE_TAG)};\nfunction send(m){m[TAG]=true;try{parent.postMessage(m,'*')}catch(e){}}\nfunction str(v){if(typeof v==='string')return v;if(v instanceof Error)return v.stack||v.message;try{return JSON.stringify(v)}catch(e){return String(v)}}\n['log','info','warn','error'].forEach(function(l){var o=console[l];console[l]=function(){var a=[].slice.call(arguments);send({type:'console',level:l,text:a.map(str).join(' ')});try{o.apply(console,a)}catch(e){}}});\nwindow.addEventListener('error',function(e){send({type:'error',text:(e.message||'Error')+(e.lineno?' (line '+e.lineno+')':'')})});\nwindow.addEventListener('unhandledrejection',function(e){send({type:'error',text:'Unhandled promise rejection: '+str(e.reason)})});\nwindow.__arbiArtifactSend=send;\n})();`\n\nfunction securityPrefix(extraHead: string): string {\n  return (\n    '<!doctype html><html><head><meta charset=\"utf-8\">' +\n    `<meta http-equiv=\"Content-Security-Policy\" content=\"${ARTIFACT_CSP}\">` +\n    '<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">' +\n    `<script>${BRIDGE_SCRIPT}</script>${extraHead}</head><body>`\n  )\n}\n\n// Models often include the Tailwind CDN script; there is no network in the sandbox, so replace the\n// whole element with the bundled copy.\nconst TAILWIND_CDN_SCRIPT =\n  /<script\\b[^>]*\\bsrc\\s*=\\s*[\"']https?:\\/\\/(?:cdn\\.tailwindcss\\.com|cdn\\.jsdelivr\\.net\\/npm\\/@tailwindcss\\/browser)[^\"']*[\"'][^>]*>\\s*<\\/script\\s*>/gi\n\nexport function buildHtmlSandboxDocument(source: string, runtime: ArtifactRuntime): string {\n  // A replacer function, not a string: the runtime contains `$` sequences that String.replace would expand.\n  const body = source.replace(\n    TAILWIND_CDN_SCRIPT,\n    () => `<script>${escapeForInlineScript(runtime.tailwind)}</script>`\n  )\n  return securityPrefix('') + body\n}\n\n/** Compiles an artifact's JSX file to plain JS (CommonJS), or throws with a readable message. */\nexport function compileReactArtifact(source: string): string {\n  try {\n    return transform(source, {\n      transforms: ['jsx', 'imports'],\n      jsxRuntime: 'classic',\n      production: true,\n    }).code\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    throw new Error(`Could not compile this component: ${message}`, { cause: err })\n  }\n}\n\n/** Keeps code from terminating an inline <script> or opening an HTML comment. */\nfunction escapeForInlineScript(code: string): string {\n  return code.replace(/<\\/script/gi, '<\\\\/script').replace(/<!--/g, '<\\\\!--')\n}\n\n// Runs compiled artifact code with a tiny CommonJS shim and mounts its default export.\nfunction reactBootstrap(compiled: string): string {\n  return `(function(){\nvar send=window.__arbiArtifactSend||function(){};\nvar available={'react':window.React,'react-dom':window.ReactDOM,'react-dom/client':window.ReactDOMClient};\nfunction req(name){if(Object.prototype.hasOwnProperty.call(available,name))return available[name];throw new Error('Module \"'+name+'\" is not available in artifacts. Only \"react\" and \"react-dom\" can be imported.')}\nvar module={exports:{}};var exports=module.exports;\ntry{\n(function(require,module,exports){\n${escapeForInlineScript(compiled)}\n})(req,module,exports);\nvar App=(module.exports&&module.exports.default)||module.exports;\nif(typeof App!=='function')throw new Error('The artifact must export a React component with \"export default\".');\nvar React=window.React;\nvar Boundary=class extends React.Component{constructor(p){super(p);this.state={e:null}}static getDerivedStateFromError(e){return{e:e}}componentDidCatch(e){send({type:'error',text:String(e&&e.stack||e)})}render(){if(this.state.e)return React.createElement('pre',{style:{color:'#b91c1c',padding:'16px',whiteSpace:'pre-wrap',font:'13px/1.5 ui-monospace,monospace'}},String(this.state.e&&this.state.e.message||this.state.e));return this.props.children}};\nwindow.ReactDOMClient.createRoot(document.getElementById('root')).render(React.createElement(Boundary,null,React.createElement(App)));\nsend({type:'ready'});\n}catch(e){send({type:'error',text:String(e&&e.message||e)})}\n})();`\n}\n\nexport function buildReactSandboxDocument(source: string, runtime: ArtifactRuntime): string {\n  const compiled = compileReactArtifact(source)\n  const head =\n    `<script>${escapeForInlineScript(runtime.react)}</script>` +\n    `<script>${escapeForInlineScript(runtime.tailwind)}</script>` +\n    '<style>html,body,#root{min-height:100%;margin:0}</style>'\n  return securityPrefix(head) + `<div id=\"root\"></div><script>${reactBootstrap(compiled)}</script>`\n}\n\nexport function buildSandboxDocument(\n  kind: ArtifactPreviewKind,\n  source: string,\n  runtime: ArtifactRuntime\n): string {\n  return kind === 'react'\n    ? buildReactSandboxDocument(source, runtime)\n    : buildHtmlSandboxDocument(source, runtime)\n}\n"]}

package/dist/sandboxDocument-WQUNODSC.cjs

@@ -0,0 +1,76 @@
+"use client";
+'use strict';
+
+var chunkVG24E4JJ_cjs = require('./chunk-VG24E4JJ.cjs');
+require('./chunk-DES3K4SD.cjs');
+var sucrase = require('sucrase');
+
+var BRIDGE_SCRIPT = `(function(){
+var TAG=${JSON.stringify(chunkVG24E4JJ_cjs.ARTIFACT_MESSAGE_TAG)};
+function send(m){m[TAG]=true;try{parent.postMessage(m,'*')}catch(e){}}
+function str(v){if(typeof v==='string')return v;if(v instanceof Error)return v.stack||v.message;try{return JSON.stringify(v)}catch(e){return String(v)}}
+['log','info','warn','error'].forEach(function(l){var o=console[l];console[l]=function(){var a=[].slice.call(arguments);send({type:'console',level:l,text:a.map(str).join(' ')});try{o.apply(console,a)}catch(e){}}});
+window.addEventListener('error',function(e){send({type:'error',text:(e.message||'Error')+(e.lineno?' (line '+e.lineno+')':'')})});
+window.addEventListener('unhandledrejection',function(e){send({type:'error',text:'Unhandled promise rejection: '+str(e.reason)})});
+window.__arbiArtifactSend=send;
+})();`;
+function securityPrefix(extraHead) {
+  return `<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${chunkVG24E4JJ_cjs.ARTIFACT_CSP}"><meta name="viewport" content="width=device-width, initial-scale=1"><script>${BRIDGE_SCRIPT}</script>${extraHead}</head><body>`;
+}
+var TAILWIND_CDN_SCRIPT = /<script\b[^>]*\bsrc\s*=\s*["']https?:\/\/(?:cdn\.tailwindcss\.com|cdn\.jsdelivr\.net\/npm\/@tailwindcss\/browser)[^"']*["'][^>]*>\s*<\/script\s*>/gi;
+function buildHtmlSandboxDocument(source, runtime) {
+  const body = source.replace(
+    TAILWIND_CDN_SCRIPT,
+    () => `<script>${escapeForInlineScript(runtime.tailwind)}</script>`
+  );
+  return securityPrefix("") + body;
+}
+function compileReactArtifact(source) {
+  try {
+    return sucrase.transform(source, {
+      transforms: ["jsx", "imports"],
+      jsxRuntime: "classic",
+      production: true
+    }).code;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Could not compile this component: ${message}`, { cause: err });
+  }
+}
+function escapeForInlineScript(code) {
+  return code.replace(/<\/script/gi, "<\\/script").replace(/<!--/g, "<\\!--");
+}
+function reactBootstrap(compiled) {
+  return `(function(){
+var send=window.__arbiArtifactSend||function(){};
+var available={'react':window.React,'react-dom':window.ReactDOM,'react-dom/client':window.ReactDOMClient};
+function req(name){if(Object.prototype.hasOwnProperty.call(available,name))return available[name];throw new Error('Module "'+name+'" is not available in artifacts. Only "react" and "react-dom" can be imported.')}
+var module={exports:{}};var exports=module.exports;
+try{
+(function(require,module,exports){
+${escapeForInlineScript(compiled)}
+})(req,module,exports);
+var App=(module.exports&&module.exports.default)||module.exports;
+if(typeof App!=='function')throw new Error('The artifact must export a React component with "export default".');
+var React=window.React;
+var Boundary=class extends React.Component{constructor(p){super(p);this.state={e:null}}static getDerivedStateFromError(e){return{e:e}}componentDidCatch(e){send({type:'error',text:String(e&&e.stack||e)})}render(){if(this.state.e)return React.createElement('pre',{style:{color:'#b91c1c',padding:'16px',whiteSpace:'pre-wrap',font:'13px/1.5 ui-monospace,monospace'}},String(this.state.e&&this.state.e.message||this.state.e));return this.props.children}};
+window.ReactDOMClient.createRoot(document.getElementById('root')).render(React.createElement(Boundary,null,React.createElement(App)));
+send({type:'ready'});
+}catch(e){send({type:'error',text:String(e&&e.message||e)})}
+})();`;
+}
+function buildReactSandboxDocument(source, runtime) {
+  const compiled = compileReactArtifact(source);
+  const head = `<script>${escapeForInlineScript(runtime.react)}</script><script>${escapeForInlineScript(runtime.tailwind)}</script><style>html,body,#root{min-height:100%;margin:0}</style>`;
+  return securityPrefix(head) + `<div id="root"></div><script>${reactBootstrap(compiled)}</script>`;
+}
+function buildSandboxDocument(kind, source, runtime) {
+  return kind === "react" ? buildReactSandboxDocument(source, runtime) : buildHtmlSandboxDocument(source, runtime);
+}
+
+exports.buildHtmlSandboxDocument = buildHtmlSandboxDocument;
+exports.buildReactSandboxDocument = buildReactSandboxDocument;
+exports.buildSandboxDocument = buildSandboxDocument;
+exports.compileReactArtifact = compileReactArtifact;
+//# sourceMappingURL=sandboxDocument-WQUNODSC.cjs.map
+//# sourceMappingURL=sandboxDocument-WQUNODSC.cjs.map

package/dist/sandboxDocument-WQUNODSC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/artifacts/sandboxDocument.ts"],"names":["ARTIFACT_MESSAGE_TAG","ARTIFACT_CSP","transform"],"mappings":";;;;;;AAsBA,IAAM,aAAA,GAAgB,CAAA;AAAA,QAAA,EACZ,IAAA,CAAK,SAAA,CAAUA,sCAAoB,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAAA,CAAA;AAS9C,SAAS,eAAe,SAAA,EAA2B;AACjD,EAAA,OACE,CAAA,qGAAA,EACuDC,8BAAY,CAAA,8EAAA,EAExD,aAAa,YAAY,SAAS,CAAA,aAAA,CAAA;AAEjD;AAIA,IAAM,mBAAA,GACJ,qJAAA;AAEK,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAAkC;AAEzF,EAAA,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,IAClB,mBAAA;AAAA,IACA,MAAM,CAAA,QAAA,EAAW,qBAAA,CAAsB,OAAA,CAAQ,QAAQ,CAAC,CAAA,SAAA;AAAA,GAC1D;AACA,EAAA,OAAO,cAAA,CAAe,EAAE,CAAA,GAAI,IAAA;AAC9B;AAGO,SAAS,qBAAqB,MAAA,EAAwB;AAC3D,EAAA,IAAI;AACF,IAAA,OAAOC,kBAAU,MAAA,EAAQ;AAAA,MACvB,UAAA,EAAY,CAAC,KAAA,EAAO,SAAS,CAAA;AAAA,MAC7B,UAAA,EAAY,SAAA;AAAA,MACZ,UAAA,EAAY;AAAA,KACb,CAAA,CAAE,IAAA;AAAA,EACL,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,OAAO,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,EAChF;AACF;AAGA,SAAS,sBAAsB,IAAA,EAAsB;AACnD,EAAA,OAAO,KAAK,OAAA,CAAQ,aAAA,EAAe,YAAY,CAAA,CAAE,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC5E;AAGA,SAAS,eAAe,QAAA,EAA0B;AAChD,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,qBAAA,CAAsB,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAAA,CAAA;AAUjC;AAEO,SAAS,yBAAA,CAA0B,QAAgB,OAAA,EAAkC;AAC1F,EAAA,MAAM,QAAA,GAAW,qBAAqB,MAAM,CAAA;AAC5C,EAAA,MAAM,IAAA,GACJ,CAAA,QAAA,EAAW,qBAAA,CAAsB,OAAA,CAAQ,KAAK,CAAC,CAAA,iBAAA,EACpC,qBAAA,CAAsB,OAAA,CAAQ,QAAQ,CAAC,CAAA,iEAAA,CAAA;AAEpD,EAAA,OAAO,eAAe,IAAI,CAAA,GAAI,CAAA,6BAAA,EAAgC,cAAA,CAAe,QAAQ,CAAC,CAAA,SAAA,CAAA;AACxF;AAEO,SAAS,oBAAA,CACd,IAAA,EACA,MAAA,EACA,OAAA,EACQ;AACR,EAAA,OAAO,IAAA,KAAS,UACZ,yBAAA,CAA0B,MAAA,EAAQ,OAAO,CAAA,GACzC,wBAAA,CAAyB,QAAQ,OAAO,CAAA;AAC9C","file":"sandboxDocument-WQUNODSC.cjs","sourcesContent":["/**\n * Builds the document that runs inside the artifact preview iframe.\n *\n * Threat model: artifact code is written by an LLM from untrusted input and runs in\n * the user's browser next to a decrypted session. It must never reach the app.\n * Layers (each independently sufficient for the main risks):\n *   1. The iframe is sandboxed with `allow-scripts` ONLY. No `allow-same-origin`, so the\n *      frame gets an opaque origin: no access to the parent DOM, cookies, localStorage,\n *      IndexedDB or the in-memory session. No popups, forms, top navigation or downloads.\n *   2. A Content-Security-Policy with `connect-src 'none'` and no remote sources: the\n *      artifact cannot fetch, open sockets, load remote scripts/images/fonts or exfiltrate.\n *   3. JSX is compiled in the app (sucrase = text transform only), so the sandbox never\n *      needs a compiler and compile errors surface in the app UI.\n *\n * The security prefix is PREPENDED to artifact HTML, never spliced into it, so a crafted\n * comment or `<head>` in the artifact cannot move the CSP out of effect.\n */\nimport { transform } from 'sucrase'\nimport type { ArtifactPreviewKind } from '@arbidocs/react/artifacts'\nimport { ARTIFACT_CSP, ARTIFACT_MESSAGE_TAG, type ArtifactRuntime } from './sandbox-policy'\n\n// Forwards console output and uncaught errors to the app. Runs first, before artifact code.\nconst BRIDGE_SCRIPT = `(function(){\nvar TAG=${JSON.stringify(ARTIFACT_MESSAGE_TAG)};\nfunction send(m){m[TAG]=true;try{parent.postMessage(m,'*')}catch(e){}}\nfunction str(v){if(typeof v==='string')return v;if(v instanceof Error)return v.stack||v.message;try{return JSON.stringify(v)}catch(e){return String(v)}}\n['log','info','warn','error'].forEach(function(l){var o=console[l];console[l]=function(){var a=[].slice.call(arguments);send({type:'console',level:l,text:a.map(str).join(' ')});try{o.apply(console,a)}catch(e){}}});\nwindow.addEventListener('error',function(e){send({type:'error',text:(e.message||'Error')+(e.lineno?' (line '+e.lineno+')':'')})});\nwindow.addEventListener('unhandledrejection',function(e){send({type:'error',text:'Unhandled promise rejection: '+str(e.reason)})});\nwindow.__arbiArtifactSend=send;\n})();`\n\nfunction securityPrefix(extraHead: string): string {\n  return (\n    '<!doctype html><html><head><meta charset=\"utf-8\">' +\n    `<meta http-equiv=\"Content-Security-Policy\" content=\"${ARTIFACT_CSP}\">` +\n    '<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">' +\n    `<script>${BRIDGE_SCRIPT}</script>${extraHead}</head><body>`\n  )\n}\n\n// Models often include the Tailwind CDN script; there is no network in the sandbox, so replace the\n// whole element with the bundled copy.\nconst TAILWIND_CDN_SCRIPT =\n  /<script\\b[^>]*\\bsrc\\s*=\\s*[\"']https?:\\/\\/(?:cdn\\.tailwindcss\\.com|cdn\\.jsdelivr\\.net\\/npm\\/@tailwindcss\\/browser)[^\"']*[\"'][^>]*>\\s*<\\/script\\s*>/gi\n\nexport function buildHtmlSandboxDocument(source: string, runtime: ArtifactRuntime): string {\n  // A replacer function, not a string: the runtime contains `$` sequences that String.replace would expand.\n  const body = source.replace(\n    TAILWIND_CDN_SCRIPT,\n    () => `<script>${escapeForInlineScript(runtime.tailwind)}</script>`\n  )\n  return securityPrefix('') + body\n}\n\n/** Compiles an artifact's JSX file to plain JS (CommonJS), or throws with a readable message. */\nexport function compileReactArtifact(source: string): string {\n  try {\n    return transform(source, {\n      transforms: ['jsx', 'imports'],\n      jsxRuntime: 'classic',\n      production: true,\n    }).code\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    throw new Error(`Could not compile this component: ${message}`, { cause: err })\n  }\n}\n\n/** Keeps code from terminating an inline <script> or opening an HTML comment. */\nfunction escapeForInlineScript(code: string): string {\n  return code.replace(/<\\/script/gi, '<\\\\/script').replace(/<!--/g, '<\\\\!--')\n}\n\n// Runs compiled artifact code with a tiny CommonJS shim and mounts its default export.\nfunction reactBootstrap(compiled: string): string {\n  return `(function(){\nvar send=window.__arbiArtifactSend||function(){};\nvar available={'react':window.React,'react-dom':window.ReactDOM,'react-dom/client':window.ReactDOMClient};\nfunction req(name){if(Object.prototype.hasOwnProperty.call(available,name))return available[name];throw new Error('Module \"'+name+'\" is not available in artifacts. Only \"react\" and \"react-dom\" can be imported.')}\nvar module={exports:{}};var exports=module.exports;\ntry{\n(function(require,module,exports){\n${escapeForInlineScript(compiled)}\n})(req,module,exports);\nvar App=(module.exports&&module.exports.default)||module.exports;\nif(typeof App!=='function')throw new Error('The artifact must export a React component with \"export default\".');\nvar React=window.React;\nvar Boundary=class extends React.Component{constructor(p){super(p);this.state={e:null}}static getDerivedStateFromError(e){return{e:e}}componentDidCatch(e){send({type:'error',text:String(e&&e.stack||e)})}render(){if(this.state.e)return React.createElement('pre',{style:{color:'#b91c1c',padding:'16px',whiteSpace:'pre-wrap',font:'13px/1.5 ui-monospace,monospace'}},String(this.state.e&&this.state.e.message||this.state.e));return this.props.children}};\nwindow.ReactDOMClient.createRoot(document.getElementById('root')).render(React.createElement(Boundary,null,React.createElement(App)));\nsend({type:'ready'});\n}catch(e){send({type:'error',text:String(e&&e.message||e)})}\n})();`\n}\n\nexport function buildReactSandboxDocument(source: string, runtime: ArtifactRuntime): string {\n  const compiled = compileReactArtifact(source)\n  const head =\n    `<script>${escapeForInlineScript(runtime.react)}</script>` +\n    `<script>${escapeForInlineScript(runtime.tailwind)}</script>` +\n    '<style>html,body,#root{min-height:100%;margin:0}</style>'\n  return securityPrefix(head) + `<div id=\"root\"></div><script>${reactBootstrap(compiled)}</script>`\n}\n\nexport function buildSandboxDocument(\n  kind: ArtifactPreviewKind,\n  source: string,\n  runtime: ArtifactRuntime\n): string {\n  return kind === 'react'\n    ? buildReactSandboxDocument(source, runtime)\n    : buildHtmlSandboxDocument(source, runtime)\n}\n"]}

package/dist/settings/DraggableHeader.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Wrapper that makes a header region draggable for FloatingPanel,
+ * while ignoring clicks on interactive elements (buttons, inputs, tabs, etc.).
+ */
+import React from 'react';
+export interface DraggableHeaderProps {
+    onDragStart?: (e: React.MouseEvent) => void;
+    children: React.ReactNode;
+}
+export declare function DraggableHeader({ onDragStart, children }: DraggableHeaderProps): React.JSX.Element;

package/dist/settings/FilterChip.d.ts

@@ -0,0 +1,15 @@
+import type { ReactNode } from 'react';
+import type { TriState } from './TriStateFilterMenu';
+export interface FilterChipProps {
+    label: string;
+    state: TriState;
+    icon?: ReactNode;
+    /** When provided, renders a colored pill identical to Labels column */
+    color?: string;
+    onDismiss?: () => void;
+    /** The dismiss button's accessible name (default "Remove <label>"). */
+    dismissLabel?: string;
+    className?: string;
+    testId?: string;
+}
+export declare function FilterChip({ label, state, icon, color, onDismiss, dismissLabel, className, testId, }: FilterChipProps): import("react").JSX.Element;

package/dist/settings/MessageJsonTree.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MessageJsonTree: the JsonTree with the ARBI message schema hints (field names, ids, timestamps
+ * of a message and its tool outputs), for a "message details" view.
+ */
+import { type JsonTreeProps } from './JsonTree';
+export type MessageJsonTreeProps = Omit<JsonTreeProps, 'resolveHint' | 'formatValue'>;
+export declare function MessageJsonTree(props: MessageJsonTreeProps): import("react").JSX.Element;

package/dist/settings/MoreInfo.d.ts

@@ -0,0 +1,25 @@
+import { type ReactNode } from 'react';
+export interface MoreInfoProps {
+    /** The modal's title, e.g. "Usage and top-ups". */
+    title: string;
+    /** The explanation: short paragraphs or a {@link MoreInfoList}. */
+    children: ReactNode;
+    /** The link's text. */
+    label?: string;
+    /** Test id of the link; the modal is `<testId>-dialog`. */
+    testId?: string;
+    className?: string;
+}
+/**
+ * A small "More info" link that opens a modal with the longer explanation, so a screen can keep to
+ * short labels and one-line facts. The one place billing surfaces put proration, caps, renewals
+ * and refunds.
+ */
+export declare function MoreInfo({ title, children, label, testId, className, }: MoreInfoProps): import("react").JSX.Element;
+/** The explanation as a list of short points, each with an optional bold lead. */
+export declare function MoreInfoList({ items }: {
+    items: Array<{
+        term?: string;
+        text: ReactNode;
+    }>;
+}): import("react").JSX.Element;

package/dist/settings/PlanCard.d.ts

@@ -95,7 +95,7 @@ export declare function PromoCodeInput({ value, onChange, labels, }: {
     onChange: (value: string) => void;
     labels?: Partial<PlanCardLabels>;
 }): import("react").JSX.Element;
-/** "Pricing Explainer" popover. `onOpenModelList` opens the AI model list. */
+/** "How pricing works": a link that opens the pricing explainer modal. `onOpenModelList` opens the AI model list. */
 export declare function PlanInfoPopover({ onOpenModelList, labels, }: {
     onOpenModelList: () => void;
     labels?: Partial<PlanCardLabels>;