@replohq/sandbox-runtime 1.6.5 → 1.6.7

package/NextErrorReporter.js

@@ -1,28 +1,66 @@
 "use client";
 import * as React from "react";
+import {
+  isAllowedEditorMessage,
+  isAllowedEditorOrigin
+} from "./annotations/bridgeGate";
 const RED_CHROME_SELECTOR = '[data-next-badge][data-error="true"], [data-nextjs-dialog]';
 const BLOCKING_ERROR_SELECTOR = "[data-nextjs-dialog]";
 const STATUS_LATCH_MS = 500;
+function findInitialEditorOrigin() {
+  if (window.self === window.top) {
+    return null;
+  }
+  const ancestorOrigin = "ancestorOrigins" in window.location ? window.location.ancestorOrigins.item(0) : null;
+  return [ancestorOrigin, getOriginOrNull(document.referrer)].find((origin) => {
+    return origin !== null && isAllowedEditorOrigin(origin);
+  }) ?? null;
+}
+function getOriginOrNull(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
 function NextErrorReporter() {
   React.useEffect(() => {
+    let editorOrigin = findInitialEditorOrigin();
     let lastStatus = null;
     let shadowObserver = null;
     let observedRoot = null;
     let pendingPost = null;
-    const postNow = (status) => {
-      if (status === lastStatus) {
+    const deliver = () => {
+      if (editorOrigin === null || lastStatus === null) {
         return;
       }
-      lastStatus = status;
       window.parent.postMessage(
         {
           type: "replo:preview:status",
-          status,
+          status: lastStatus,
           route: window.location.pathname
         },
-        "*"
+        editorOrigin
       );
     };
+    const postNow = (status) => {
+      if (status === lastStatus) {
+        return;
+      }
+      lastStatus = status;
+      deliver();
+    };
+    const handleParentMessage = (event) => {
+      if (event.source !== window.parent || !isAllowedEditorMessage(event)) {
+        return;
+      }
+      if (event.origin === editorOrigin) {
+        return;
+      }
+      editorOrigin = event.origin;
+      deliver();
+    };
+    window.addEventListener("message", handleParentMessage);
     const post = (status) => {
       if (pendingPost) {
         if (pendingPost.status === status) {
@@ -77,6 +115,7 @@ function NextErrorReporter() {
     });
     syncOverlayState();
     return () => {
+      window.removeEventListener("message", handleParentMessage);
       lightObserver.disconnect();
       shadowObserver?.disconnect();
       if (pendingPost) {

package/NextErrorReporter.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../NextErrorReporter.tsx"],
-  "sourcesContent": ["\"use client\";\n\nimport * as React from \"react\";\n\n/**\n * NOTE (Max, 2026-06-10): This component sends post messages to its embedder (website-builder miniapp)\n * so that it can render a loading / error UI if there's an error on this page.\n *\n * Ideally, we wouldn't need any update to the sandbox runtime to achieve this: the miniapp would just read the\n * iframe's content and detect whenever there's a nextjs error overlay.\n * But the preview runs cross-origin from the editor, so the editor can't read the iframe's\n * DOM (browser security).\n *\n * This component has observers that detect when the nextjs error overlay appears or\n * disappears, and sends a post message with a status:\n *  - `status`: \"error\" while Next's dev overlay opens its blocking error dialog\n *     (a real page break \u2014 see the selectors below for why the badge's issue\n *     count is deliberately NOT used: it also counts recovered loader misses)\n *  - `status`: \"ok\" otherwise. Cleared by Fast Refresh on a fix, so it's also the\n *     recovery signal (agent fixed the error, so it's the error -> ok transition)\n *\n * It also hides Next's dev error overlay (`<nextjs-portal>`) at the source the\n * instant an error appears, so the red bubble never paints \u2014 the MutationObserver\n * callback runs as a microtask before paint. `data-error` stays queryable while\n * hidden, so detection is unaffected;\n *\n * The overlay lives in `<nextjs-portal>`'s shadow root, which Next can recreate,\n * so we re-attach the shadow observer whenever it hands us a new root. No polling.\n *\n * This must be mounted OUTSIDE the error boundary (see ReploProvider) so it keeps\n * reporting while the boundary is caught (and showing its neutral cover).\n *\n * I'm unsatisfied with this approach: observing for the nextjs-portal is brittle and ugly.\n * Ideally, the ClientErrorBoundary, which hooks into the render cycle, in componentDidCatch, would\n * just report a post message to the miniapp. I prototyped that, the error detection works\n * great (ok -> error transition).\n * But the error -> ok transition doesn't work for Server components (it only does for Client\n * components). Here's a slack thread with me <> Gabe on it:\n * https://replohq.slack.com/archives/C03AACVP08Y/p1781154057832689?thread_ts=1781029224.564489&cid=C03AACVP08Y.\n */\n// NOTE (Max, 2026-08-04): <nextjs-portal> surfaces two very different things,\n// and only one of them means the page is actually broken:\n//   - the dev-tools badge (`[data-next-badge][data-error=\"true\"]`) lights for\n//     EVERY collected issue, including a server-side loader error that React\n//     already recovered from by streaming the LoaderErrorBoundary fallback. That\n//     is a graceful, recoverable miss (product unpublished, deleted collection,\n//     \u2026) \u2014 the page renders fine \u2014 and it must NOT be reported as a page error.\n//   - the error overlay dialog (`[data-nextjs-dialog]`) only mounts when Next\n//     auto-opens the overlay for a genuinely blocking error: the app shell's\n//     error boundary catching an uncaught render crash, an unrecoverable SSR\n//     error (missing root tags), or a build error. Next never auto-opens the\n//     dialog for a recovered error. Verified against next@16.1.7 (the version\n//     the platform SDK packages and most templates pin) and next@15.3.8: the sole auto-open\n//     is AppDevOverlayErrorBoundary's componentDidCatch -> openErrorOverlay,\n//     i.e. the shell boundary, which a nested LoaderErrorBoundary never reaches\n//     (a caught loader miss only increments the badge count). The badge count\n//     opens the dialog only on an explicit user click.\n// So the open dialog \u2014 not the badge's issue count \u2014 is the fatal-vs-recoverable\n// discriminator. Keying off the badge reported recoverable loader misses as\n// full-page errors, blanking a preview that had actually rendered its fallback.\n//\n// We still *hide* the whole portal whenever Next paints red chrome (the errored\n// badge OR the dialog) so no dev overlay bleeds into the preview \u2014 a recovered\n// loader miss shouldn't flash a red dot either. Only the blocking dialog is\n// reported upward as a page error.\nconst RED_CHROME_SELECTOR =\n  '[data-next-badge][data-error=\"true\"], [data-nextjs-dialog]';\nconst BLOCKING_ERROR_SELECTOR = \"[data-nextjs-dialog]\";\n\n// HMR portal churn flips the overlay for milliseconds in both directions; only a state that persists this long is real.\nconst STATUS_LATCH_MS = 500;\n\ntype PreviewStatus = \"ok\" | \"error\";\n\nexport function NextErrorReporter() {\n  // eslint-disable-next-line replo/no-use-effect -- Observes Next's dev error overlay (a shadow-DOM node outside React's tree) and relays its state to the cross-origin embedder. No React alternative applies.\n  React.useEffect(() => {\n    let lastStatus: PreviewStatus | null = null;\n    let shadowObserver: MutationObserver | null = null;\n    let observedRoot: ShadowRoot | null = null;\n    let pendingPost: { status: PreviewStatus; timeoutId: number } | null = null;\n\n    const postNow = (status: PreviewStatus) => {\n      if (status === lastStatus) {\n        return;\n      }\n      lastStatus = status;\n      window.parent.postMessage(\n        {\n          type: \"replo:preview:status\",\n          status,\n          route: window.location.pathname,\n        },\n        \"*\",\n      );\n    };\n\n    // Latch every transition (the opposite observation cancels a pending one) \u2014 a false error <-> ok flip makes the editor reload the preview. Only the initial \"ok\" posts immediately, as the readiness signal.\n    const post = (status: PreviewStatus) => {\n      if (pendingPost) {\n        if (pendingPost.status === status) {\n          return;\n        }\n        window.clearTimeout(pendingPost.timeoutId);\n        pendingPost = null;\n      }\n      if (status === lastStatus) {\n        return;\n      }\n      if (lastStatus === null && status === \"ok\") {\n        postNow(\"ok\");\n        return;\n      }\n      const timeoutId = window.setTimeout(() => {\n        pendingPost = null;\n        postNow(status);\n      }, STATUS_LATCH_MS);\n      pendingPost = { status, timeoutId };\n    };\n\n    // NOTE (Max, 2026-06-10): Reads the dev overlay's current error state and\n    // propagates it \u2014 re-attach the shadow observer to the live root, hide the\n    // portal while erroring, and post ok/error up to the editor. Runs on init and\n    // on every observed DOM mutation.\n    const syncOverlayState = () => {\n      const portal = document.getElementsByTagName(\"nextjs-portal\")[0];\n      if (!(portal instanceof HTMLElement)) {\n        post(\"ok\");\n        return;\n      }\n      // NOTE (Max, 2026-06-10): Re-attach whenever Next hands us a fresh shadow\n      // root, else we'd keep watching a detached one after the overlay is\n      // recreated.\n      const root = portal.shadowRoot;\n      if (root && root !== observedRoot) {\n        shadowObserver?.disconnect();\n        shadowObserver = new MutationObserver(syncOverlayState);\n        shadowObserver.observe(root, {\n          childList: true,\n          subtree: true,\n          attributes: true,\n          attributeFilter: [\"data-error\"],\n        });\n        observedRoot = root;\n      }\n      // NOTE (Max, 2026-06-10): Hide the dev overlay at the source so the red\n      // bubble never paints \u2014 for any red chrome, including a recovered miss's\n      // errored badge.\n      portal.style.display = portal.shadowRoot?.querySelector(\n        RED_CHROME_SELECTOR,\n      )\n        ? \"none\"\n        : \"\";\n      // Only the blocking overlay dialog means the page actually broke; the\n      // badge's issue count also covers recovered loader misses (see selectors).\n      const hasBlockingError = Boolean(\n        portal.shadowRoot?.querySelector(BLOCKING_ERROR_SELECTOR),\n      );\n      post(hasBlockingError ? \"error\" : \"ok\");\n    };\n\n    // NOTE (Max, 2026-06-10): Catches the portal being added/removed in the light\n    // DOM; the re-attached shadow observer catches in-overlay changes.\n    const lightObserver = new MutationObserver(syncOverlayState);\n    lightObserver.observe(document.documentElement, {\n      childList: true,\n      subtree: true,\n    });\n    syncOverlayState();\n\n    return () => {\n      lightObserver.disconnect();\n      shadowObserver?.disconnect();\n      if (pendingPost) {\n        window.clearTimeout(pendingPost.timeoutId);\n      }\n    };\n  }, []);\n\n  return null;\n}\n"],
-  "mappings": ";AAEA,YAAY,WAAW;AA+DvB,MAAM,sBACJ;AACF,MAAM,0BAA0B;AAGhC,MAAM,kBAAkB;AAIjB,SAAS,oBAAoB;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,aAAmC;AACvC,QAAI,iBAA0C;AAC9C,QAAI,eAAkC;AACtC,QAAI,cAAmE;AAEvE,UAAM,UAAU,CAAC,WAA0B;AACzC,UAAI,WAAW,YAAY;AACzB;AAAA,MACF;AACA,mBAAa;AACb,aAAO,OAAO;AAAA,QACZ;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,OAAO,CAAC,WAA0B;AACtC,UAAI,aAAa;AACf,YAAI,YAAY,WAAW,QAAQ;AACjC;AAAA,QACF;AACA,eAAO,aAAa,YAAY,SAAS;AACzC,sBAAc;AAAA,MAChB;AACA,UAAI,WAAW,YAAY;AACzB;AAAA,MACF;AACA,UAAI,eAAe,QAAQ,WAAW,MAAM;AAC1C,gBAAQ,IAAI;AACZ;AAAA,MACF;AACA,YAAM,YAAY,OAAO,WAAW,MAAM;AACxC,sBAAc;AACd,gBAAQ,MAAM;AAAA,MAChB,GAAG,eAAe;AAClB,oBAAc,EAAE,QAAQ,UAAU;AAAA,IACpC;AAMA,UAAM,mBAAmB,MAAM;AAC7B,YAAM,SAAS,SAAS,qBAAqB,eAAe,EAAE,CAAC;AAC/D,UAAI,EAAE,kBAAkB,cAAc;AACpC,aAAK,IAAI;AACT;AAAA,MACF;AAIA,YAAM,OAAO,OAAO;AACpB,UAAI,QAAQ,SAAS,cAAc;AACjC,wBAAgB,WAAW;AAC3B,yBAAiB,IAAI,iBAAiB,gBAAgB;AACtD,uBAAe,QAAQ,MAAM;AAAA,UAC3B,WAAW;AAAA,UACX,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,iBAAiB,CAAC,YAAY;AAAA,QAChC,CAAC;AACD,uBAAe;AAAA,MACjB;AAIA,aAAO,MAAM,UAAU,OAAO,YAAY;AAAA,QACxC;AAAA,MACF,IACI,SACA;AAGJ,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY,cAAc,uBAAuB;AAAA,MAC1D;AACA,WAAK,mBAAmB,UAAU,IAAI;AAAA,IACxC;AAIA,UAAM,gBAAgB,IAAI,iBAAiB,gBAAgB;AAC3D,kBAAc,QAAQ,SAAS,iBAAiB;AAAA,MAC9C,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AACD,qBAAiB;AAEjB,WAAO,MAAM;AACX,oBAAc,WAAW;AACzB,sBAAgB,WAAW;AAC3B,UAAI,aAAa;AACf,eAAO,aAAa,YAAY,SAAS;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AACT;",
+  "sourcesContent": ["\"use client\";\n\nimport * as React from \"react\";\n\nimport {\n  isAllowedEditorMessage,\n  isAllowedEditorOrigin,\n} from \"./annotations/bridgeGate\";\n\n/**\n * NOTE (Max, 2026-06-10): This component sends post messages to its embedder (website-builder miniapp)\n * so that it can render a loading / error UI if there's an error on this page.\n *\n * Ideally, we wouldn't need any update to the sandbox runtime to achieve this: the miniapp would just read the\n * iframe's content and detect whenever there's a nextjs error overlay.\n * But the preview runs cross-origin from the editor, so the editor can't read the iframe's\n * DOM (browser security).\n *\n * This component has observers that detect when the nextjs error overlay appears or\n * disappears, and sends a post message with a status:\n *  - `status`: \"error\" while Next's dev overlay opens its blocking error dialog\n *     (a real page break \u2014 see the selectors below for why the badge's issue\n *     count is deliberately NOT used: it also counts recovered loader misses)\n *  - `status`: \"ok\" otherwise. Cleared by Fast Refresh on a fix, so it's also the\n *     recovery signal (agent fixed the error, so it's the error -> ok transition)\n *\n * It also hides Next's dev error overlay (`<nextjs-portal>`) at the source the\n * instant an error appears, so the red bubble never paints \u2014 the MutationObserver\n * callback runs as a microtask before paint. `data-error` stays queryable while\n * hidden, so detection is unaffected;\n *\n * The overlay lives in `<nextjs-portal>`'s shadow root, which Next can recreate,\n * so we re-attach the shadow observer whenever it hands us a new root. No polling.\n *\n * This must be mounted OUTSIDE the error boundary (see ReploProvider) so it keeps\n * reporting while the boundary is caught (and showing its neutral cover).\n *\n * I'm unsatisfied with this approach: observing for the nextjs-portal is brittle and ugly.\n * Ideally, the ClientErrorBoundary, which hooks into the render cycle, in componentDidCatch, would\n * just report a post message to the miniapp. I prototyped that, the error detection works\n * great (ok -> error transition).\n * But the error -> ok transition doesn't work for Server components (it only does for Client\n * components). Here's a slack thread with me <> Gabe on it:\n * https://replohq.slack.com/archives/C03AACVP08Y/p1781154057832689?thread_ts=1781029224.564489&cid=C03AACVP08Y.\n */\n// NOTE (Max, 2026-08-04): <nextjs-portal> surfaces two very different things,\n// and only one of them means the page is actually broken:\n//   - the dev-tools badge (`[data-next-badge][data-error=\"true\"]`) lights for\n//     EVERY collected issue, including a server-side loader error that React\n//     already recovered from by streaming the LoaderErrorBoundary fallback. That\n//     is a graceful, recoverable miss (product unpublished, deleted collection,\n//     \u2026) \u2014 the page renders fine \u2014 and it must NOT be reported as a page error.\n//   - the error overlay dialog (`[data-nextjs-dialog]`) only mounts when Next\n//     auto-opens the overlay for a genuinely blocking error: the app shell's\n//     error boundary catching an uncaught render crash, an unrecoverable SSR\n//     error (missing root tags), or a build error. Next never auto-opens the\n//     dialog for a recovered error. Verified against next@16.1.7 (the version\n//     the platform SDK packages and most templates pin) and next@15.3.8: the sole auto-open\n//     is AppDevOverlayErrorBoundary's componentDidCatch -> openErrorOverlay,\n//     i.e. the shell boundary, which a nested LoaderErrorBoundary never reaches\n//     (a caught loader miss only increments the badge count). The badge count\n//     opens the dialog only on an explicit user click.\n// So the open dialog \u2014 not the badge's issue count \u2014 is the fatal-vs-recoverable\n// discriminator. Keying off the badge reported recoverable loader misses as\n// full-page errors, blanking a preview that had actually rendered its fallback.\n//\n// We still *hide* the whole portal whenever Next paints red chrome (the errored\n// badge OR the dialog) so no dev overlay bleeds into the preview \u2014 a recovered\n// loader miss shouldn't flash a red dot either. Only the blocking dialog is\n// reported upward as a page error.\nconst RED_CHROME_SELECTOR =\n  '[data-next-badge][data-error=\"true\"], [data-nextjs-dialog]';\nconst BLOCKING_ERROR_SELECTOR = \"[data-nextjs-dialog]\";\n\n// HMR portal churn flips the overlay for milliseconds in both directions; only a state that persists this long is real.\nconst STATUS_LATCH_MS = 500;\n\ntype PreviewStatus = \"ok\" | \"error\";\n\n// The embedder's origin as the browser reports it, trusted only if it is an allowed editor. `ancestorOrigins` names the actual parent and survives referrer policies and in-frame navigations, but Firefox lacks it; the referrer covers Firefox, the same way the annotation layer announces itself.\nfunction findInitialEditorOrigin(): string | null {\n  // A top-level page has no editor to report to.\n  if (window.self === window.top) {\n    return null;\n  }\n  const ancestorOrigin =\n    \"ancestorOrigins\" in window.location\n      ? window.location.ancestorOrigins.item(0)\n      : null;\n  return (\n    [ancestorOrigin, getOriginOrNull(document.referrer)].find((origin) => {\n      return origin !== null && isAllowedEditorOrigin(origin);\n    }) ?? null\n  );\n}\n\nfunction getOriginOrNull(url: string): string | null {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return null;\n  }\n}\n\nexport function NextErrorReporter() {\n  // eslint-disable-next-line replo/no-use-effect -- Observes Next's dev error overlay (a shadow-DOM node outside React's tree) and relays its state to the cross-origin embedder. No React alternative applies.\n  React.useEffect(() => {\n    let editorOrigin = findInitialEditorOrigin();\n    let lastStatus: PreviewStatus | null = null;\n    let shadowObserver: MutationObserver | null = null;\n    let observedRoot: ShadowRoot | null = null;\n    let pendingPost: { status: PreviewStatus; timeoutId: number } | null = null;\n\n    // Status and route are only for the editor, so they never go out with a wildcard target; without a trusted origin the status is kept and delivered once one is learned.\n    const deliver = () => {\n      if (editorOrigin === null || lastStatus === null) {\n        return;\n      }\n      window.parent.postMessage(\n        {\n          type: \"replo:preview:status\",\n          status: lastStatus,\n          route: window.location.pathname,\n        },\n        editorOrigin,\n      );\n    };\n\n    const postNow = (status: PreviewStatus) => {\n      if (status === lastStatus) {\n        return;\n      }\n      lastStatus = status;\n      deliver();\n    };\n\n    // Covers a missing or stale referrer (Firefox after an in-frame navigation): a message from the parent window at an allowed origin proves where the editor lives, the same capture the annotation layer uses for its replies.\n    const handleParentMessage = (event: MessageEvent) => {\n      if (event.source !== window.parent || !isAllowedEditorMessage(event)) {\n        return;\n      }\n      if (event.origin === editorOrigin) {\n        return;\n      }\n      editorOrigin = event.origin;\n      deliver();\n    };\n    window.addEventListener(\"message\", handleParentMessage);\n\n    // Latch every transition (the opposite observation cancels a pending one) \u2014 a false error <-> ok flip makes the editor reload the preview. Only the initial \"ok\" posts immediately, as the readiness signal.\n    const post = (status: PreviewStatus) => {\n      if (pendingPost) {\n        if (pendingPost.status === status) {\n          return;\n        }\n        window.clearTimeout(pendingPost.timeoutId);\n        pendingPost = null;\n      }\n      if (status === lastStatus) {\n        return;\n      }\n      if (lastStatus === null && status === \"ok\") {\n        postNow(\"ok\");\n        return;\n      }\n      const timeoutId = window.setTimeout(() => {\n        pendingPost = null;\n        postNow(status);\n      }, STATUS_LATCH_MS);\n      pendingPost = { status, timeoutId };\n    };\n\n    // NOTE (Max, 2026-06-10): Reads the dev overlay's current error state and\n    // propagates it \u2014 re-attach the shadow observer to the live root, hide the\n    // portal while erroring, and post ok/error up to the editor. Runs on init and\n    // on every observed DOM mutation.\n    const syncOverlayState = () => {\n      const portal = document.getElementsByTagName(\"nextjs-portal\")[0];\n      if (!(portal instanceof HTMLElement)) {\n        post(\"ok\");\n        return;\n      }\n      // NOTE (Max, 2026-06-10): Re-attach whenever Next hands us a fresh shadow\n      // root, else we'd keep watching a detached one after the overlay is\n      // recreated.\n      const root = portal.shadowRoot;\n      if (root && root !== observedRoot) {\n        shadowObserver?.disconnect();\n        shadowObserver = new MutationObserver(syncOverlayState);\n        shadowObserver.observe(root, {\n          childList: true,\n          subtree: true,\n          attributes: true,\n          attributeFilter: [\"data-error\"],\n        });\n        observedRoot = root;\n      }\n      // NOTE (Max, 2026-06-10): Hide the dev overlay at the source so the red\n      // bubble never paints \u2014 for any red chrome, including a recovered miss's\n      // errored badge.\n      portal.style.display = portal.shadowRoot?.querySelector(\n        RED_CHROME_SELECTOR,\n      )\n        ? \"none\"\n        : \"\";\n      // Only the blocking overlay dialog means the page actually broke; the\n      // badge's issue count also covers recovered loader misses (see selectors).\n      const hasBlockingError = Boolean(\n        portal.shadowRoot?.querySelector(BLOCKING_ERROR_SELECTOR),\n      );\n      post(hasBlockingError ? \"error\" : \"ok\");\n    };\n\n    // NOTE (Max, 2026-06-10): Catches the portal being added/removed in the light\n    // DOM; the re-attached shadow observer catches in-overlay changes.\n    const lightObserver = new MutationObserver(syncOverlayState);\n    lightObserver.observe(document.documentElement, {\n      childList: true,\n      subtree: true,\n    });\n    syncOverlayState();\n\n    return () => {\n      window.removeEventListener(\"message\", handleParentMessage);\n      lightObserver.disconnect();\n      shadowObserver?.disconnect();\n      if (pendingPost) {\n        window.clearTimeout(pendingPost.timeoutId);\n      }\n    };\n  }, []);\n\n  return null;\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA+DP,MAAM,sBACJ;AACF,MAAM,0BAA0B;AAGhC,MAAM,kBAAkB;AAKxB,SAAS,0BAAyC;AAEhD,MAAI,OAAO,SAAS,OAAO,KAAK;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,iBACJ,qBAAqB,OAAO,WACxB,OAAO,SAAS,gBAAgB,KAAK,CAAC,IACtC;AACN,SACE,CAAC,gBAAgB,gBAAgB,SAAS,QAAQ,CAAC,EAAE,KAAK,CAAC,WAAW;AACpE,WAAO,WAAW,QAAQ,sBAAsB,MAAM;AAAA,EACxD,CAAC,KAAK;AAEV;AAEA,SAAS,gBAAgB,KAA4B;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB;AAElC,QAAM,UAAU,MAAM;AACpB,QAAI,eAAe,wBAAwB;AAC3C,QAAI,aAAmC;AACvC,QAAI,iBAA0C;AAC9C,QAAI,eAAkC;AACtC,QAAI,cAAmE;AAGvE,UAAM,UAAU,MAAM;AACpB,UAAI,iBAAiB,QAAQ,eAAe,MAAM;AAChD;AAAA,MACF;AACA,aAAO,OAAO;AAAA,QACZ;AAAA,UACE,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,CAAC,WAA0B;AACzC,UAAI,WAAW,YAAY;AACzB;AAAA,MACF;AACA,mBAAa;AACb,cAAQ;AAAA,IACV;AAGA,UAAM,sBAAsB,CAAC,UAAwB;AACnD,UAAI,MAAM,WAAW,OAAO,UAAU,CAAC,uBAAuB,KAAK,GAAG;AACpE;AAAA,MACF;AACA,UAAI,MAAM,WAAW,cAAc;AACjC;AAAA,MACF;AACA,qBAAe,MAAM;AACrB,cAAQ;AAAA,IACV;AACA,WAAO,iBAAiB,WAAW,mBAAmB;AAGtD,UAAM,OAAO,CAAC,WAA0B;AACtC,UAAI,aAAa;AACf,YAAI,YAAY,WAAW,QAAQ;AACjC;AAAA,QACF;AACA,eAAO,aAAa,YAAY,SAAS;AACzC,sBAAc;AAAA,MAChB;AACA,UAAI,WAAW,YAAY;AACzB;AAAA,MACF;AACA,UAAI,eAAe,QAAQ,WAAW,MAAM;AAC1C,gBAAQ,IAAI;AACZ;AAAA,MACF;AACA,YAAM,YAAY,OAAO,WAAW,MAAM;AACxC,sBAAc;AACd,gBAAQ,MAAM;AAAA,MAChB,GAAG,eAAe;AAClB,oBAAc,EAAE,QAAQ,UAAU;AAAA,IACpC;AAMA,UAAM,mBAAmB,MAAM;AAC7B,YAAM,SAAS,SAAS,qBAAqB,eAAe,EAAE,CAAC;AAC/D,UAAI,EAAE,kBAAkB,cAAc;AACpC,aAAK,IAAI;AACT;AAAA,MACF;AAIA,YAAM,OAAO,OAAO;AACpB,UAAI,QAAQ,SAAS,cAAc;AACjC,wBAAgB,WAAW;AAC3B,yBAAiB,IAAI,iBAAiB,gBAAgB;AACtD,uBAAe,QAAQ,MAAM;AAAA,UAC3B,WAAW;AAAA,UACX,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,iBAAiB,CAAC,YAAY;AAAA,QAChC,CAAC;AACD,uBAAe;AAAA,MACjB;AAIA,aAAO,MAAM,UAAU,OAAO,YAAY;AAAA,QACxC;AAAA,MACF,IACI,SACA;AAGJ,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY,cAAc,uBAAuB;AAAA,MAC1D;AACA,WAAK,mBAAmB,UAAU,IAAI;AAAA,IACxC;AAIA,UAAM,gBAAgB,IAAI,iBAAiB,gBAAgB;AAC3D,kBAAc,QAAQ,SAAS,iBAAiB;AAAA,MAC9C,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AACD,qBAAiB;AAEjB,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,mBAAmB;AACzD,oBAAc,WAAW;AACzB,sBAAgB,WAAW;AAC3B,UAAI,aAAa;AACf,eAAO,aAAa,YAAY,SAAS;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AACT;",
   "names": []
 }

package/_vendor/replo-utils/lib/viewportSnapshot.d.ts

@@ -0,0 +1,86 @@
+export declare const VIEWPORT_SNAPSHOT_REQUEST = "replo:viewport-snapshot:request";
+export declare const VIEWPORT_SNAPSHOT_RESPONSE = "replo:viewport-snapshot:response";
+/**
+ * Levels of iframe nesting a capture request fans out to below the requester.
+ * 2 covers the deepest product surface: agent-ui → miniapp → builder preview.
+ */
+export declare const VIEWPORT_SNAPSHOT_MAX_DEPTH = 2;
+export interface ViewportSnapshotRequestMessage {
+    type: typeof VIEWPORT_SNAPSHOT_REQUEST;
+    requestId: string;
+    frameIndex: number;
+    remainingDepth: number;
+}
+export interface ViewportFrameRect {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+}
+/** One frame's serialized DOM plus its own captured child frames, recursively. */
+export interface ViewportFrameCapture {
+    snapshot: unknown;
+    childFrames: ViewportChildFrame[];
+}
+export interface ViewportChildFrame {
+    frameIndex: number;
+    rect: ViewportFrameRect;
+    capture: ViewportFrameCapture;
+}
+export interface ViewportSnapshotResponseMessage {
+    type: typeof VIEWPORT_SNAPSHOT_RESPONSE;
+    requestId: string;
+    frameIndex: number;
+    capture: ViewportFrameCapture | null;
+}
+interface RelayMessageListener {
+    (event: {
+        data: unknown;
+        source: unknown;
+        origin?: string;
+    }): void;
+}
+interface RelayWindow {
+    readonly parent: unknown;
+    readonly frames: ArrayLike<{
+        postMessage: (message: unknown, targetOrigin: string) => void;
+    }>;
+    addEventListener(type: "message", listener: RelayMessageListener): void;
+    removeEventListener(type: "message", listener: RelayMessageListener): void;
+    setTimeout(listener: () => void, timeout: number): number;
+    clearTimeout(timeoutId: number): void;
+}
+/**
+ * Default trust check for who may request this frame's DOM: Replo app origins
+ * plus local dev hosts. Runtimes embedded in arbitrary third-party pages
+ * (published sites) silently ignore requests from anything else.
+ */
+export declare function isTrustedViewportSnapshotRequester(origin: string): boolean;
+/**
+ * Ask every direct child frame for its capture (each child cascades to its own
+ * children while `remainingDepth` allows) and collect the responses. Resolves
+ * at the timeout with whatever arrived — a frame running an older runtime
+ * simply never answers and is omitted.
+ */
+export declare function requestChildViewportSnapshots({ targetWindow, requestId, timeoutMs, remainingDepth, }: {
+    targetWindow: RelayWindow;
+    requestId: string;
+    timeoutMs: number;
+    remainingDepth?: number;
+}): Promise<{
+    frameIndex: number;
+    capture: ViewportFrameCapture;
+}[]>;
+/**
+ * Child-side responder: on a trusted parent request, serialize this frame's
+ * DOM, cascade the request to this frame's own children while depth allows,
+ * and post the combined capture back to the requesting origin only.
+ */
+export declare function startViewportSnapshotResponder({ targetWindow, takeSnapshot, measureFrameRect, isTrustedRequester, cascadeTimeoutMs, }: {
+    targetWindow: RelayWindow;
+    takeSnapshot: () => unknown;
+    measureFrameRect: (frameIndex: number) => ViewportFrameRect | null;
+    isTrustedRequester?: (origin: string) => boolean;
+    cascadeTimeoutMs?: number;
+}): () => void;
+export {};

package/_vendor/replo-utils/lib/viewportSnapshot.mjs

@@ -0,0 +1 @@
+export { VIEWPORT_SNAPSHOT_MAX_DEPTH, VIEWPORT_SNAPSHOT_REQUEST, VIEWPORT_SNAPSHOT_RESPONSE, isTrustedViewportSnapshotRequester, requestChildViewportSnapshots, startViewportSnapshotResponder } from '../../../chunk-RXYLMSNM.mjs';

package/_vendor/replo-utils/react/use-viewport-snapshot-responder.d.ts

@@ -0,0 +1,9 @@
+import type { ViewportFrameRect } from "../lib/viewportSnapshot";
+/** Relay frameIndex → on-screen rect; window.frames order is iframe document order. */
+export declare function measureViewportFrameRect(frameIndex: number): ViewportFrameRect | null;
+/**
+ * Answers a trusted parent frame's turn-end viewport-capture requests with an
+ * rrweb serialization of this frame's DOM, cascading into this frame's own
+ * iframes. Passive until asked; see docs/agent-session-viewport-filmstrip-prd.md.
+ */
+export declare function useViewportSnapshotResponder(): void;