@replohq/sandbox-runtime 0.1.0

package/annotations/bridgeGate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Origin gate for inbound editor-bridge messages, checked BEFORE any payload
+ * parsing. The select-mode bridge predates this and validates payload shape
+ * only; its hardening ticket is expected to adopt this helper.
+ */
+export declare function isAllowedEditorOrigin(origin: string): boolean;
+export declare function isAllowedEditorMessage(event: MessageEvent): boolean;

package/annotations/bridgeGate.js

@@ -0,0 +1,22 @@
+const ALLOWED_EDITOR_ORIGIN_PATTERNS = [
+  // Local dev editors (any port).
+  /^https?:\/\/localhost(?::\d+)?$/u,
+  // Hosted editors and miniapps; multi-label hosts like website-builder.apps.replo.app must pass.
+  /^https:\/\/(?:[a-z0-9-]+\.)*replo\.app$/u,
+  // Dev front-door tunnels (`https://replo-<alias>.ngrok.app`).
+  /^https:\/\/replo-[a-z0-9-]+\.ngrok\.app$/u
+];
+function isAllowedEditorOrigin(origin) {
+  return ALLOWED_EDITOR_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
+}
+function isAllowedEditorMessage(event) {
+  if (typeof window === "undefined" || window.self === window.top) {
+    return false;
+  }
+  return isAllowedEditorOrigin(event.origin);
+}
+export {
+  isAllowedEditorMessage,
+  isAllowedEditorOrigin
+};
+//# sourceMappingURL=bridgeGate.js.map

package/annotations/bridgeGate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../annotations/bridgeGate.ts"],
+  "sourcesContent": ["/**\n * Origin gate for inbound editor-bridge messages, checked BEFORE any payload\n * parsing. The select-mode bridge predates this and validates payload shape\n * only; its hardening ticket is expected to adopt this helper.\n */\n\nconst ALLOWED_EDITOR_ORIGIN_PATTERNS = [\n  // Local dev editors (any port).\n  /^https?:\\/\\/localhost(?::\\d+)?$/u,\n  // Hosted editors and miniapps; multi-label hosts like website-builder.apps.replo.app must pass.\n  /^https:\\/\\/(?:[a-z0-9-]+\\.)*replo\\.app$/u,\n  // Dev front-door tunnels (`https://replo-<alias>.ngrok.app`).\n  /^https:\\/\\/replo-[a-z0-9-]+\\.ngrok\\.app$/u,\n];\n\nexport function isAllowedEditorOrigin(origin: string): boolean {\n  return ALLOWED_EDITOR_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));\n}\n\nexport function isAllowedEditorMessage(event: MessageEvent): boolean {\n  // A top-level page has no editor parent; only embedded previews qualify.\n  if (typeof window === \"undefined\" || window.self === window.top) {\n    return false;\n  }\n  return isAllowedEditorOrigin(event.origin);\n}\n"],
+  "mappings": "AAMA,MAAM,iCAAiC;AAAA;AAAA,EAErC;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AAEO,SAAS,sBAAsB,QAAyB;AAC7D,SAAO,+BAA+B,KAAK,CAAC,YAAY,QAAQ,KAAK,MAAM,CAAC;AAC9E;AAEO,SAAS,uBAAuB,OAA8B;AAEnE,MAAI,OAAO,WAAW,eAAe,OAAO,SAAS,OAAO,KAAK;AAC/D,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,MAAM,MAAM;AAC3C;",
+  "names": []
+}

package/chunk-3UFG7XTQ.mjs

@@ -0,0 +1,205 @@
+import { exhaustiveSwitch } from './chunk-N5EI2MOZ.mjs';
+import { z } from 'zod';
+
+// ../replo-utils/lib/json.ts
+function parseJsonOrNull(json) {
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+// ../replo-utils/lib/parse.ts
+function parseSchemaOrNull(value, schema) {
+  const parseResult = schema.safeParse(value);
+  return parseResult.success ? parseResult.data : null;
+}
+var SELECT_MODE_SELECTABLE_ATTRIBUTE = "data-replo-selectable";
+var SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE = "data-replo-selectable-payload";
+var displayModeSchema = z.enum(["browse", "selection"]).describe("DisplayMode");
+var selectModeInlineTextStatusSchema = z.enum(["editable", "dynamic"]).nullable().describe("SelectModeInlineTextStatus");
+var selectModeTextMetricsSchema = z.object({
+  tightWidth: z.number(),
+  lineCount: z.number(),
+  lineHeight: z.number()
+}).describe("SelectModeTextMetrics");
+var selectModeClickPositionSchema = z.object({
+  x: z.number(),
+  y: z.number()
+}).describe("SelectModeClickPosition");
+var selectModeSourceLocationSchema = z.object({
+  filePath: z.string(),
+  lineNumber: z.number(),
+  columnNumber: z.number().optional(),
+  componentName: z.string().optional()
+}).describe("SelectModeSourceLocation");
+var selectModeFiberChainEntrySchema = z.object({
+  sourceLocation: selectModeSourceLocationSchema,
+  tagName: z.string().optional(),
+  componentName: z.string().optional(),
+  props: z.record(z.string(), z.unknown()).optional()
+}).describe("SelectModeFiberChainEntry");
+var selectModeBoundingRectSchema = z.object({
+  x: z.number(),
+  y: z.number(),
+  left: z.number(),
+  top: z.number(),
+  right: z.number(),
+  bottom: z.number(),
+  width: z.number(),
+  height: z.number()
+}).describe("SelectModeBoundingRect");
+var selectModeSelectionRectSchema = z.object({
+  id: z.string(),
+  rect: selectModeBoundingRectSchema
+}).describe("SelectModeSelectionRect");
+var selectModeStyleAtRuleSchema = z.object({
+  type: z.string(),
+  text: z.string()
+}).describe("SelectModeStyleAtRule");
+var selectModeStyleVariantSchema = z.object({
+  atRules: z.array(selectModeStyleAtRuleSchema),
+  pseudo: z.string().nullable()
+}).describe("SelectModeStyleVariant");
+var selectModeDefinedStyleSchema = z.object({
+  property: z.string(),
+  variant: selectModeStyleVariantSchema.nullable(),
+  className: z.string().nullable(),
+  raw: z.string(),
+  resolved: z.string()
+}).describe("SelectModeDefinedStyle");
+function transformRect({
+  rect,
+  offset
+}) {
+  return {
+    x: rect.x + offset.left,
+    y: rect.y + offset.top,
+    left: rect.left + offset.left,
+    right: rect.right + offset.left,
+    top: rect.top + offset.top,
+    bottom: rect.bottom + offset.top,
+    width: rect.width,
+    height: rect.height
+  };
+}
+function transformPoint({
+  point,
+  offset
+}) {
+  return {
+    x: point.x + offset.left,
+    y: point.y + offset.top
+  };
+}
+function getIframeOffset(iframe) {
+  if (!iframe) {
+    return { left: 0, top: 0 };
+  }
+  const iframeRect = iframe.getBoundingClientRect();
+  return { left: iframeRect.left, top: iframeRect.top };
+}
+var selectedElementSchema = z.object({
+  kind: z.literal("react-element"),
+  selector: z.string(),
+  tagName: z.string(),
+  elementType: z.string(),
+  textContent: z.string().nullable(),
+  rect: selectModeBoundingRectSchema,
+  textMetrics: selectModeTextMetricsSchema.nullable(),
+  outerHTML: z.string(),
+  definedStyles: z.array(selectModeDefinedStyleSchema).default([]),
+  inheritedStyles: z.record(z.string(), z.string()).default({}),
+  clickPosition: selectModeClickPositionSchema,
+  sourceLocation: selectModeSourceLocationSchema.optional(),
+  fiberChain: z.array(selectModeFiberChainEntrySchema).default([]),
+  siblingSelectors: z.array(z.string()).default([])
+}).describe("SelectedElement");
+var selectablePlanDataSchema = z.object({
+  kind: z.literal("plan"),
+  planId: z.string(),
+  label: z.string(),
+  rect: selectModeBoundingRectSchema
+}).describe("SelectablePlanData");
+var selectablePlanPayloadSchema = selectablePlanDataSchema.omit({ rect: true }).describe("SelectablePlanPayload");
+var selectableDataPayloadSchema = z.discriminatedUnion("kind", [selectablePlanPayloadSchema]).describe("SelectableDataPayload");
+var selectableDataSchema = z.discriminatedUnion("kind", [selectedElementSchema, selectablePlanDataSchema]).describe("SelectableData");
+function transformSelectableData({
+  data,
+  offset
+}) {
+  return exhaustiveSwitch(
+    data,
+    "kind"
+  )({
+    "react-element": (element) => ({
+      ...element,
+      rect: transformRect({ rect: element.rect, offset }),
+      clickPosition: transformPoint({
+        point: element.clickPosition,
+        offset
+      })
+    }),
+    plan: (plan) => ({
+      ...plan,
+      rect: transformRect({ rect: plan.rect, offset })
+    })
+  });
+}
+function readSelectablePayload(rawPayload) {
+  if (!rawPayload) {
+    return null;
+  }
+  const parsedPayload = parseJsonOrNull(rawPayload);
+  if (!parsedPayload) {
+    return null;
+  }
+  return parseSchemaOrNull(parsedPayload, selectableDataPayloadSchema);
+}
+var selectModeOptimisticUpdatePayloadSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("css"),
+    property: z.string(),
+    value: z.string().nullable()
+  }),
+  z.object({
+    kind: z.literal("content"),
+    innerHTML: z.string()
+  }),
+  z.object({
+    kind: z.literal("attribute"),
+    name: z.string(),
+    value: z.string()
+  })
+]).describe("SelectModeOptimisticUpdatePayload");
+var selectModeTiptapActiveMarksSchema = z.object({
+  bold: z.boolean(),
+  italic: z.boolean(),
+  underline: z.boolean(),
+  strike: z.boolean()
+}).describe("SelectModeTiptapActiveMarks");
+var selectModeFormatCommandSchema = z.enum(["toggleBold", "toggleItalic", "toggleUnderline", "toggleStrike"]).describe("SelectModeFormatCommand");
+var selectModeSelectionTypeSchema = z.enum(["none", "element", "area", "drag"]).describe("SelectModeSelectionType");
+var selectModeSelectionSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("none") }),
+  z.object({
+    type: z.literal("element"),
+    data: selectableDataSchema
+  }),
+  z.object({
+    type: z.literal("area"),
+    rect: selectModeBoundingRectSchema,
+    items: z.array(selectableDataSchema)
+  }),
+  z.object({
+    type: z.literal("drag"),
+    dragRect: selectModeBoundingRectSchema,
+    // Bounding boxes of the selectables the drag currently intersects,
+    // rendered as lighter highlights so the user can see what the drag
+    // will capture before they release.
+    selectionRects: z.array(selectModeSelectionRectSchema)
+  })
+]).describe("SelectModeSelection");
+
+export { SELECT_MODE_SELECTABLE_ATTRIBUTE, SELECT_MODE_SELECTABLE_PAYLOAD_ATTRIBUTE, displayModeSchema, getIframeOffset, readSelectablePayload, selectModeBoundingRectSchema, selectModeClickPositionSchema, selectModeDefinedStyleSchema, selectModeFiberChainEntrySchema, selectModeFormatCommandSchema, selectModeInlineTextStatusSchema, selectModeOptimisticUpdatePayloadSchema, selectModeSelectionRectSchema, selectModeSelectionSchema, selectModeSelectionTypeSchema, selectModeSourceLocationSchema, selectModeStyleAtRuleSchema, selectModeStyleVariantSchema, selectModeTextMetricsSchema, selectModeTiptapActiveMarksSchema, selectableDataPayloadSchema, selectableDataSchema, selectablePlanDataSchema, selectablePlanPayloadSchema, selectedElementSchema, transformPoint, transformRect, transformSelectableData };

package/chunk-FNTGY7I5.mjs

@@ -0,0 +1,68 @@
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/isArray.js
+var isArray = Array.isArray;
+var isArray_default = isArray;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_freeGlobal.js
+var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
+var freeGlobal_default = freeGlobal;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_root.js
+var freeSelf = typeof self == "object" && self && self.Object === Object && self;
+var root = freeGlobal_default || freeSelf || Function("return this")();
+var root_default = root;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_Symbol.js
+var Symbol = root_default.Symbol;
+var Symbol_default = Symbol;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_getRawTag.js
+var objectProto = Object.prototype;
+var hasOwnProperty = objectProto.hasOwnProperty;
+var nativeObjectToString = objectProto.toString;
+var symToStringTag = Symbol_default ? Symbol_default.toStringTag : void 0;
+function getRawTag(value) {
+  var isOwn = hasOwnProperty.call(value, symToStringTag), tag = value[symToStringTag];
+  try {
+    value[symToStringTag] = void 0;
+    var unmasked = true;
+  } catch (e) {
+  }
+  var result = nativeObjectToString.call(value);
+  if (unmasked) {
+    if (isOwn) {
+      value[symToStringTag] = tag;
+    } else {
+      delete value[symToStringTag];
+    }
+  }
+  return result;
+}
+var getRawTag_default = getRawTag;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_objectToString.js
+var objectProto2 = Object.prototype;
+var nativeObjectToString2 = objectProto2.toString;
+function objectToString(value) {
+  return nativeObjectToString2.call(value);
+}
+var objectToString_default = objectToString;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/_baseGetTag.js
+var nullTag = "[object Null]";
+var undefinedTag = "[object Undefined]";
+var symToStringTag2 = Symbol_default ? Symbol_default.toStringTag : void 0;
+function baseGetTag(value) {
+  if (value == null) {
+    return value === void 0 ? undefinedTag : nullTag;
+  }
+  return symToStringTag2 && symToStringTag2 in Object(value) ? getRawTag_default(value) : objectToString_default(value);
+}
+var baseGetTag_default = baseGetTag;
+
+// ../../node_modules/.pnpm/lodash-es@4.17.21/node_modules/lodash-es/isObjectLike.js
+function isObjectLike(value) {
+  return value != null && typeof value == "object";
+}
+var isObjectLike_default = isObjectLike;
+
+export { Symbol_default, baseGetTag_default, freeGlobal_default, isArray_default, isObjectLike_default, root_default };