@jbpark/live-editor 0.2.0 → 1.1.0

package/README.ko.md

@@ -37,7 +37,7 @@ live-editor/
 
 ## 🔒 보안 참고사항
 
-- 프리뷰 `<iframe>`(`src/components/Frame/IFrame`)의 `sandbox` prop은 **실제 보안 경계가 아닙니다**. 컴파일된 프리뷰 코드는 host 페이지 자신의 JS realm에서 `new Function(...)`으로 실행되며(`src/utils/index.ts`의 `compileModule`), iframe에는 그 결과로 생성된 React 엘리먼트만 `contentDocument`에 포탈되어 DOM/CSS 렌더링 용도로만 쓰입니다. iframe 자체는 사용자 코드를 실행하지 않습니다.
+- 프리뷰 `<iframe>`(`src/components/frame/iframe.tsx`)의 `sandbox` prop은 **실제 보안 경계가 아닙니다**. 컴파일된 프리뷰 코드는 host 페이지 자신의 JS realm에서 `new Function(...)`으로 실행되며(`src/utils/index.ts`의 `compileModule`), iframe에는 그 결과로 생성된 React 엘리먼트만 `contentDocument`에 포탈되어 DOM/CSS 렌더링 용도로만 쓰입니다. iframe 자체는 사용자 코드를 실행하지 않습니다.
 - 실질적 의미: 미리보기되는 코드는 호스트 애플리케이션과 동일한 수준의 JS 접근 권한(쿠키, DOM, 메모리상의 상태 등)을 가지며, iframe 경계가 이를 막아주지 않습니다.
 - 신뢰할 수 있는 프로젝트만 열어서 편집하세요. 직접 별도의 격리 조치(예: iframe 자체 `contentWindow` realm에서 컴파일을 실행하고 결과를 `postMessage`로 주고받는 방식)를 추가하지 않은 채로, 신뢰할 수 없는 제3자 프로젝트 파일을 미리보기하는 용도로 사용하지 마세요 — 그런 격리는 현재 구현되어 있지 않습니다.
 

package/README.md

@@ -37,7 +37,7 @@ live-editor/
 
 ## 🔒 Security Notes
 
-- The `sandbox` prop on the preview `<iframe>` (`src/components/Frame/IFrame`) is **not a security boundary**. Compiled preview code is executed via `new Function(...)` in the host page's own JS realm (`compileModule` in `src/utils/index.ts`); only the resulting React elements are portaled into the iframe's `contentDocument` for DOM/CSS rendering. The iframe itself never evaluates user code.
+- The `sandbox` prop on the preview `<iframe>` (`src/components/frame/iframe.tsx`) is **not a security boundary**. Compiled preview code is executed via `new Function(...)` in the host page's own JS realm (`compileModule` in `src/utils/index.ts`); only the resulting React elements are portaled into the iframe's `contentDocument` for DOM/CSS rendering. The iframe itself never evaluates user code.
 - Practical implication: previewed code runs with the same JS-level access as the host application (cookies, DOM, in-memory state) — the iframe boundary does not contain it.
 - Only open/edit projects you trust. Don't use this editor to preview arbitrary third-party project files without adding real isolation yourself (e.g. running compilation inside the iframe's own `contentWindow` realm and communicating results back via `postMessage`) — that isolation is not implemented here today.
 

package/dist/{ast-6PhUZ232.mjs → ast-UXy9dqvD.mjs}

@@ -9,21 +9,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") {
 		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
@@ -42,7 +28,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
@@ -26800,7 +26785,11 @@ const parseBinding = (bindingValue) => {
 							"boolean",
 							"color",
 							"jsx",
-							"richtext"
+							"richtext",
+							"date",
+							"url",
+							"icon-picker",
+							"asset-picker"
 						].includes(typeValue)) binding.type = typeValue;
 					}
 					const renderProp = element.properties.find((p) => import_lib$3.isObjectProperty(p) && import_lib$3.isIdentifier(p.key) && p.key.name === "render" && import_lib$3.isObjectExpression(p.value));
@@ -26822,6 +26811,14 @@ const parseBinding = (bindingValue) => {
 						}).filter((item) => item !== null);
 						if (options.length > 0) binding.options = options;
 					}
+					const minProp = element.properties.find((p) => import_lib$3.isObjectProperty(p) && import_lib$3.isIdentifier(p.key) && p.key.name === "min" && import_lib$3.isNumericLiteral(p.value));
+					if (minProp) binding.min = minProp.value.value;
+					const maxProp = element.properties.find((p) => import_lib$3.isObjectProperty(p) && import_lib$3.isIdentifier(p.key) && p.key.name === "max" && import_lib$3.isNumericLiteral(p.value));
+					if (maxProp) binding.max = maxProp.value.value;
+					const patternProp = element.properties.find((p) => import_lib$3.isObjectProperty(p) && import_lib$3.isIdentifier(p.key) && p.key.name === "pattern" && import_lib$3.isStringLiteral(p.value));
+					if (patternProp) binding.pattern = patternProp.value.value;
+					const requiredProp = element.properties.find((p) => import_lib$3.isObjectProperty(p) && import_lib$3.isIdentifier(p.key) && p.key.name === "required" && import_lib$3.isBooleanLiteral(p.value));
+					if (requiredProp) binding.required = requiredProp.value.value;
 					return binding;
 				}
 			}
@@ -39660,5 +39657,55 @@ const clone = (element, generateId = () => nanoid(6)) => {
 };
 
 //#endregion
-export { __exportAll as C, __toESM as E, __esmMin as S, __toCommonJS as T, getCurrentValue as _, update as a, require_lib$7 as b, nanoid as c, extractNodeValue as d, extractObjectProperties as f, findEditableChildren as g, generateCode as h, bulkUpdate as i, arrayExpressionToCode as l, parseValue as m, fillIds as n, clearExtractCache as o, parseArrayExpression as p, replaceIds as r, extract as s, clone as t, createNodeFromValue as u, parseBinding as v, __require as w, __commonJSMin as x, require_lib$4 as y };
-//# sourceMappingURL=ast-6PhUZ232.mjs.map
+//#region src/utils/ast/validate.ts
+const VALID = { valid: true };
+const validateBindingValue = (binding, value) => {
+	if (value === "" || value === null || value === void 0) {
+		if (binding.required) return {
+			valid: false,
+			message: "This field is required."
+		};
+		return VALID;
+	}
+	if (typeof value === "number") {
+		if (binding.min !== void 0 && value < binding.min) return {
+			valid: false,
+			message: `Must be at least ${binding.min}.`
+		};
+		if (binding.max !== void 0 && value > binding.max) return {
+			valid: false,
+			message: `Must be at most ${binding.max}.`
+		};
+	}
+	if (typeof value === "string" && binding.pattern) {
+		let regex;
+		try {
+			regex = new RegExp(binding.pattern);
+		} catch {
+			return VALID;
+		}
+		if (!regex.test(value)) return {
+			valid: false,
+			message: "Value does not match the required format."
+		};
+	}
+	if (typeof value === "string" && binding.type === "url") try {
+		new URL(value);
+	} catch {
+		return {
+			valid: false,
+			message: "Must be a valid URL."
+		};
+	}
+	if (typeof value === "string" && binding.type === "date") {
+		if (Number.isNaN(Date.parse(value))) return {
+			valid: false,
+			message: "Must be a valid date."
+		};
+	}
+	return VALID;
+};
+
+//#endregion
+export { __toESM as S, findEditableChildren as _, bulkUpdate as a, require_lib$4 as b, extract as c, createNodeFromValue as d, extractNodeValue as f, generateCode as g, parseValue as h, replaceIds as i, nanoid as l, parseArrayExpression as m, clone as n, update as o, extractObjectProperties as p, fillIds as r, clearExtractCache as s, validateBindingValue as t, arrayExpressionToCode as u, getCurrentValue as v, require_lib$7 as x, parseBinding as y };
+//# sourceMappingURL=ast-UXy9dqvD.mjs.map