@replohq/sandbox-runtime 1.7.2 → 1.7.3

package/README.md

@@ -0,0 +1,48 @@
+# `@replohq/sandbox-runtime`
+
+The Replo sandbox runtime connects a Next.js development preview to Replo while
+preserving normal application behavior in production. It provides preview
+readiness, navigation, error reporting, selection, annotations, and design
+library preview support through one root component.
+
+## Installation
+
+```sh
+pnpm add @replohq/sandbox-runtime @replohq/sdk @opennextjs/cloudflare @tanstack/react-query
+```
+
+The package requires Next.js 15 or newer and React 19 or newer. React, React
+DOM, and their type packages are peer dependencies and are normally already
+present in a Next.js application.
+
+## Usage
+
+Compose `SandboxRuntime` inside the SDK's `ReploProvider` in the root layout:
+
+```tsx
+// app/layout.tsx
+import { SandboxRuntime } from "@replohq/sandbox-runtime";
+import { ReploProvider } from "@replohq/sdk/providers/replo-provider";
+
+export default function RootLayout({ children }: React.PropsWithChildren) {
+  return (
+    <html lang="en">
+      <body>
+        <ReploProvider>
+          <SandboxRuntime>{children}</SandboxRuntime>
+        </ReploProvider>
+      </body>
+    </html>
+  );
+}
+```
+
+`SandboxRuntime` is a Client Component. In a development server it enables the
+Replo preview integration. In a production build it renders `children`
+unchanged, so the same composition can remain in the root layout for every
+environment.
+
+## License
+
+This package is proprietary software. See [LICENSE](./LICENSE)
+(`SEE LICENSE IN LICENSE`) and the [Replo Terms of Service](https://replo.app/terms).

package/_vendor/replo-utils/lib/crypto.d.ts

@@ -12,14 +12,8 @@ export declare function randomBase64Url(byteLength: number): string;
  * `crypto.getRandomValues`, which carries no such restriction.
  */
 export declare function randomUUID(): string;
-/**
- * Returns the SHA-256 of `input` as a 64-char lowercase hex string.
- *
- * Used for storing opaque secrets (e.g. public API tokens) where we want
- * constant-length hex output suitable for a `VARCHAR(64)` column with a
- * unique index.
- */
-export declare function sha256Hex(input: string): Promise<string>;
+/** Strings use UTF-8; binary inputs are hashed unchanged. */
+export declare function sha256Hex(input: string | Parameters<typeof crypto.subtle.digest>[1]): Promise<string>;
 export declare function constantTimeEqual({ left, right, }: {
     left: Uint8Array;
     right: Uint8Array;

package/_vendor/replo-utils/lib/fonts.d.ts

@@ -1,3 +1,11 @@
+/** Known symbol assets are not text typefaces; unknown families stay eligible. */
+export declare function isKnownSymbolFontFamily(family: string): boolean;
+export declare function getTypographyFonts<FontType extends {
+    family: string;
+    faces: {
+        cssFamily: string;
+    }[];
+}>(fonts: FontType[]): FontType[];
 /**
  * Slugified family name, matching how `fontNameToCssVariable` derives a CSS var
  * (e.g. "DM Sans" → "dm-sans"), so a `--font-<slug>` var round-trips back to a

package/_vendor/replo-utils/lib/fonts.mjs

@@ -130,6 +130,17 @@ function capitalize(string) {
 }
 var capitalize_default = capitalize;
 
+function isKnownSymbolFontFamily(family) {
+  const normalized = family.trim().replace(/^["']|["']$/gu, "");
+  return /(?:^|[\s_-])(?:icons?|symbols?)(?:$|[\s_-])/iu.test(normalized) || /^(?:webrupee|fontawesome(?:[0-9]+)?(?:free|pro|brands|duotone|sharp)?|icomoon|glyphicons|wingdings|webdings|materialicons)$/iu.test(
+    normalized.replace(/[\s_-]/gu, "")
+  );
+}
+function getTypographyFonts(fonts) {
+  return fonts.filter((font) => {
+    return !isKnownSymbolFontFamily(font.family) && (font.faces.length === 0 || font.faces.some((face) => !isKnownSymbolFontFamily(face.cssFamily)));
+  });
+}
 function slugifyFontFamily(family) {
   return family.replace(/([a-z])([A-Z])/g, "$1-$2").split(/[\s_-]+/u).map((word) => word.toLowerCase()).join("-");
 }
@@ -206,4 +217,4 @@ var escapeFontFamilyName = (fontFamily) => {
   return fontFamily.replace(/"/g, '\\"').replace(/'/g, "\\'");
 };
 
-export { buildFontFaceCss, buildGoogleFontsCssUrl, describeFontFile, escapeFontFamilyName, fontFormatFromExtension, fontFormatFromMimeType, fontNameToCssVariable, fontNameToVariableName, quoteFontFamily, slugifyFontFamily };
+export { buildFontFaceCss, buildGoogleFontsCssUrl, describeFontFile, escapeFontFamilyName, fontFormatFromExtension, fontFormatFromMimeType, fontNameToCssVariable, fontNameToVariableName, getTypographyFonts, isKnownSymbolFontFamily, quoteFontFamily, slugifyFontFamily };

package/_vendor/schemas/generated/selectModeIframeRpc.d.ts

@@ -61,7 +61,7 @@ export type SelectModeParentMessage = {
 };
 export type SelectModeIframeMessage = {
     method: "iframeReady";
-    data?: IframeRuntimeBuildMetadata;
+    data: IframeRuntimeBuildMetadata;
 } | {
     method: "elementSelected";
     data: {

package/_vendor/schemas/selectModeIframeRpc.d.ts

@@ -356,13 +356,13 @@ export declare const canopyToWebsiteBuilderMethodConfig: {
         timeoutMs: number;
     };
     iframeReady: {
-        inputSchema: z.ZodOptional<z.ZodObject<{
+        inputSchema: z.ZodObject<{
             packageName: z.ZodString;
             version: z.ZodString;
             branch: z.ZodNullable<z.ZodString>;
             commit: z.ZodNullable<z.ZodString>;
             builtAt: z.ZodNullable<z.ZodString>;
-        }, z.core.$strip>>;
+        }, z.core.$strip>;
         outputSchema: z.ZodVoid;
     };
     elementSelected: {
@@ -776,13 +776,13 @@ export declare const selectModeParentMessageSchema: z.ZodDiscriminatedUnion<[z.Z
 }, z.core.$strip>], "method">;
 export declare const selectModeIframeMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     method: z.ZodLiteral<"iframeReady">;
-    data: z.ZodOptional<z.ZodObject<{
+    data: z.ZodObject<{
         packageName: z.ZodString;
         version: z.ZodString;
         branch: z.ZodNullable<z.ZodString>;
         commit: z.ZodNullable<z.ZodString>;
         builtAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     method: z.ZodLiteral<"elementSelected">;
     data: z.ZodObject<{

package/_vendor/schemas/selectModeIframeRpc.mjs

@@ -93,7 +93,7 @@ var canopyToWebsiteBuilderMethodConfig = {
     timeoutMs: 5e3
   },
   iframeReady: {
-    inputSchema: iframeRuntimeBuildMetadataSchema.optional(),
+    inputSchema: iframeRuntimeBuildMetadataSchema,
     outputSchema: z.void()
   },
   elementSelected: {
@@ -199,7 +199,7 @@ var selectModeParentMessageSchema = z.discriminatedUnion("method", [
 var selectModeIframeMessageSchema = z.discriminatedUnion("method", [
   z.object({
     method: z.literal("iframeReady"),
-    data: iframeRuntimeBuildMetadataSchema.optional()
+    data: iframeRuntimeBuildMetadataSchema
   }),
   z.object({
     method: z.literal("elementSelected"),

package/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sandbox-runtime",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "branch": "HEAD",
-  "commit": "d7ee0ec28234216b633c81e1a6d8683591c946f8",
-  "builtAt": "2026-09-15T17:30:06.538Z"
+  "commit": "769a5347144bb3d6c77b6f06b075c8f6ad45a6b3",
+  "builtAt": "2026-09-16T18:01:45.448Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sandbox-runtime",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "reploBuild": {
     "packageName": "@replohq/sandbox-runtime",
-    "version": "1.7.2",
+    "version": "1.7.3",
     "branch": "HEAD",
-    "commit": "d7ee0ec28234216b633c81e1a6d8683591c946f8",
-    "builtAt": "2026-09-15T17:30:06.538Z"
+    "commit": "769a5347144bb3d6c77b6f06b075c8f6ad45a6b3",
+    "builtAt": "2026-09-16T18:01:45.448Z"
   },
   "description": "Replo sandbox runtime — editor integration for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/select-mode/iframeRpcChannel.d.ts

@@ -76,13 +76,13 @@ export declare function getSelectModeIframeRpcChannel(): import("../_vendor/sche
         timeoutMs: number;
     };
     iframeReady: {
-        inputSchema: import("zod").ZodOptional<import("zod").ZodObject<{
+        inputSchema: import("zod").ZodObject<{
             packageName: import("zod").ZodString;
             version: import("zod").ZodString;
             branch: import("zod").ZodNullable<import("zod").ZodString>;
             commit: import("zod").ZodNullable<import("zod").ZodString>;
             builtAt: import("zod").ZodNullable<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>;
         outputSchema: import("zod").ZodVoid;
     };
     elementSelected: {