@riverbankcms/sdk 0.68.0 → 0.70.2

package/dist/server/theme-bridge.mjs

@@ -1558,6 +1558,31 @@ var blockCustomCssRuleSchema = customCssRuleSchema.extend({
 });
 var customCssRulesSchema = z12.array(customCssRuleSchema).optional();
 var blockCustomCssRulesSchema = z12.array(blockCustomCssRuleSchema).optional();
+function toValidatedCssSelector(value) {
+  return value;
+}
+function toValidatedCssDeclarationValue(value) {
+  return value;
+}
+function toValidatedCssDeclarations(declarations) {
+  return Object.fromEntries(
+    Object.entries(declarations).map(([property, value]) => [
+      property,
+      toValidatedCssDeclarationValue(value)
+    ])
+  );
+}
+function parseCustomCssRule(rule) {
+  const parsed = customCssRuleSchema.parse(rule);
+  return {
+    id: parsed.id,
+    selector: toValidatedCssSelector(parsed.selector),
+    declarations: toValidatedCssDeclarations(parsed.declarations)
+  };
+}
+function parseCustomCssRules(rules) {
+  return rules?.map((rule) => parseCustomCssRule(rule));
+}
 
 // ../theme-core/src/customCss/atRuleValidation.ts
 import { z as z13 } from "zod";
@@ -3006,10 +3031,48 @@ function generateAllBlockVarsCss(context) {
 }
 
 // ../theme-core/src/customCss/selectorUtils.ts
+function prefixSelector(selector, scopePrefix) {
+  return selector.split(",").map((s) => s.trim()).filter(Boolean).map((s) => {
+    const themeScopeAliases = [".theme-scope", ":where(.theme-scope)"];
+    for (const alias of themeScopeAliases) {
+      if (s === alias) {
+        return scopePrefix;
+      }
+      if (s.startsWith(alias)) {
+        return scopePrefix + s.slice(alias.length);
+      }
+    }
+    if (s === "&") {
+      return scopePrefix;
+    }
+    if (s.startsWith("&")) {
+      return scopePrefix + s.slice(1);
+    }
+    return `${scopePrefix} ${s}`;
+  }).join(", ");
+}
+function toKebabCase(str) {
+  return str.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+}
 function escapeStyleContent(css) {
   return css.replace(/<\/style/gi, "<\\/style");
 }
 
+// ../theme-core/src/customCss/compile.ts
+function compileCustomCssRules(rules, themeId) {
+  if (!rules || rules.length === 0) return "";
+  const scopePrefix = `:where([data-theme-scope="${themeId}"])`;
+  return rules.map((rule) => compileRule(rule.selector, rule.declarations, scopePrefix)).filter(Boolean).join("\n\n");
+}
+function compileRule(selector, declarations, scopePrefix) {
+  const declarationLines = Object.entries(declarations).map(([prop, value]) => `  ${toKebabCase(prop)}: ${value};`).join("\n");
+  if (!declarationLines) return "";
+  const scopedSelector = prefixSelector(selector, scopePrefix);
+  return `${scopedSelector} {
+${declarationLines}
+}`;
+}
+
 // ../theme-core/src/responsiveMode.ts
 var DEFAULT_THEME_RESPONSIVE_MODE = "viewport";
 var THEME_RESPONSIVE_CONTAINER_NAME = "rb-site";
@@ -12203,6 +12266,9 @@ import { Fragment, jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
 // ../theme-core/src/siteChrome.tsx
 import { Fragment as Fragment2, jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
 
+// ../theme-core/src/runtime/buildThemeRuntimeFromBridge.ts
+import { z as z17 } from "zod";
+
 // ../theme-core/src/inputs/core.ts
 var CORNER_RADIUS_MAP4 = {
   square: "0",
@@ -12387,6 +12453,41 @@ var BRIDGE_DEFAULT_TOKENS = {
   "neutral-100": "241 245 249",
   "neutral-400": "148 163 184"
 };
+var TOKEN_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9-]*$/;
+var CSS_VARIABLE_REFERENCE_PATTERN = /^var\(\s*--[a-zA-Z][a-zA-Z0-9-]*(?:\s*,\s*[^{};<>]+)?\s*\)$/;
+var RGB_CHANNELS_PATTERN = /^(\d{1,3})\s+(\d{1,3})\s+(\d{1,3})(?:\s*\/\s*(0|1|0?\.\d+|\d{1,3}%))?$/;
+var CSS_DECLARATION_PROPERTY_PATTERN = /^(?:-[a-zA-Z][a-zA-Z0-9-]*|[a-zA-Z][a-zA-Z0-9-]*|--[a-zA-Z][a-zA-Z0-9-]*)$/;
+var UNSAFE_CSS_MARKUP_PATTERN = /[{}<>]|<\/|<script/i;
+var EXTERNAL_URL_PATTERN = /url\s*\(\s*['"]?(?:https?:|\/\/)/i;
+var JAVASCRIPT_URL_PATTERN2 = /javascript\s*:/i;
+var themeBridgeConfigSchema = z17.object({
+  tokens: z17.record(z17.string(), z17.string()),
+  typography: z17.object({
+    headingFamily: z17.string().optional(),
+    bodyFamily: z17.string().optional(),
+    headingWeight: z17.number().optional(),
+    bodyWeight: z17.number().optional()
+  }).optional(),
+  spacing: z17.enum(["comfortable", "standard", "dense"]).optional(),
+  corners: z17.enum(["square", "soft", "rounded", "pill"]).optional(),
+  shadows: z17.enum(["none", "low", "medium", "high"]).optional(),
+  components: z17.object({
+    buttons: z17.union([
+      z17.boolean(),
+      z17.object({
+        variants: z17.array(z17.enum(["primary", "secondary", "outline", "ghost"])).optional()
+      })
+    ]).optional(),
+    cards: z17.union([
+      z17.boolean(),
+      z17.object({
+        variants: z17.array(z17.enum(["default", "elevated", "outlined"])).optional()
+      })
+    ]).optional(),
+    inputs: z17.boolean().optional()
+  }).optional(),
+  overrides: z17.record(z17.string(), z17.string()).optional()
+}).passthrough();
 var TOKEN_ALIASES = [
   { source: "text", target: "foreground" },
   { source: "foreground", target: "text" },
@@ -12402,17 +12503,25 @@ function hexToRgbChannels(hex) {
     const { r, g, b } = hexToRgb(hex);
     return `${r} ${g} ${b}`;
   } catch {
-    return "0 0 0";
+    throw new Error(
+      `[ThemeBridge] Invalid token value "${hex}": expected a valid hex colour, CSS var(), or RGB channel value.`
+    );
   }
 }
 function normalizeTokenValue(value) {
-  if (value.startsWith("var(")) {
-    return value;
+  const trimmedValue = value.trim();
+  if (!isSafeBridgeTokenValue(trimmedValue)) {
+    throw new Error(
+      `[ThemeBridge] Invalid token value "${value}": expected a hex colour, CSS var(), or RGB channel value.`
+    );
   }
-  if (value.startsWith("#")) {
-    return hexToRgbChannels(value);
+  if (trimmedValue.startsWith("var(")) {
+    return trimmedValue;
   }
-  return value;
+  if (trimmedValue.startsWith("#")) {
+    return hexToRgbChannels(trimmedValue);
+  }
+  return trimmedValue;
 }
 function buildThemeBridgeRuntime(config) {
   validateThemeBridgeConfig(config);
@@ -12430,7 +12539,7 @@ function buildThemeBridgeRuntime(config) {
     statusCss: generateStatusCss({ themeId, theme: generatorTheme }),
     progressCss: generateProgressCss({ themeId, theme: generatorTheme }),
     blockVarsCss: generateAllBlockVarsCss({ themeId, theme: generatorTheme }),
-    customCss: config.overrides ? generateOverrideCss(config.overrides) : void 0
+    customCss: hasBridgeOverrides(config.overrides) ? generateOverrideCss(config.overrides) : void 0
   };
 }
 function buildBridgeCssVars(config) {
@@ -12552,6 +12661,8 @@ function buildShadowCssVars(shadows) {
   cssVars["--tb-shadow-sm"] = cssVars["--shadow-sm"] ?? shadowElev;
   cssVars["--tb-shadow-md"] = cssVars["--shadow-md"] ?? shadowElev;
   cssVars["--tb-shadow-lg"] = cssVars["--shadow-lg"] ?? shadowElev;
+  cssVars["--tb-shadow-xl"] = cssVars["--shadow-xl"] ?? shadowElev;
+  cssVars["--tb-shadow-2xl"] = cssVars["--shadow-2xl"] ?? shadowElev;
   return cssVars;
 }
 function buildMotionCssVars() {
@@ -12574,6 +12685,17 @@ function validateThemeBridgeConfig(config) {
       '[ThemeBridge] Missing "tokens" property in config. ThemeBridgeConfig requires a "tokens" object with color definitions. Example: { tokens: { primary: "#6d28d9", background: "#ffffff" } }'
     );
   }
+  const parsedConfig = themeBridgeConfigSchema.safeParse(config);
+  if (!parsedConfig.success) {
+    const firstIssue = parsedConfig.error.issues[0];
+    throw new Error(
+      `[ThemeBridge] Invalid config: ${firstIssue?.message ?? "failed validation"}.`
+    );
+  }
+  validateBridgeTokens(config.tokens);
+  if (config.overrides !== void 0) {
+    parseBridgeOverrideRules(config.overrides);
+  }
 }
 function resolveBridgeTokens(tokens) {
   const resolved = {};
@@ -12597,13 +12719,125 @@ function resolveBridgeTokens(tokens) {
 function isPresentTokenValue(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
+function isSafeBridgeTokenName(name) {
+  return TOKEN_NAME_PATTERN.test(name);
+}
+function isSafeBridgeTokenValue(value) {
+  const trimmedValue = value.trim();
+  if (trimmedValue.length === 0) {
+    return true;
+  }
+  if (trimmedValue.startsWith("#")) {
+    return true;
+  }
+  if (trimmedValue.startsWith("var(")) {
+    return CSS_VARIABLE_REFERENCE_PATTERN.test(trimmedValue);
+  }
+  return isRgbChannelValue(trimmedValue);
+}
+function isRgbChannelValue(value) {
+  const match = value.match(RGB_CHANNELS_PATTERN);
+  if (!match) {
+    return false;
+  }
+  const [, red, green, blue, alpha] = match;
+  const channels = [red, green, blue].map((channel) => Number(channel));
+  const channelsInRange = channels.every(
+    (channel) => Number.isInteger(channel) && channel >= 0 && channel <= 255
+  );
+  if (!channelsInRange) {
+    return false;
+  }
+  if (alpha === void 0) {
+    return true;
+  }
+  if (alpha.endsWith("%")) {
+    const percent = Number(alpha.slice(0, -1));
+    return Number.isFinite(percent) && percent >= 0 && percent <= 100;
+  }
+  const alphaNumber = Number(alpha);
+  return Number.isFinite(alphaNumber) && alphaNumber >= 0 && alphaNumber <= 1;
+}
+function validateBridgeTokens(tokens) {
+  for (const [name, value] of Object.entries(tokens)) {
+    if (!isSafeBridgeTokenName(name)) {
+      throw new Error(
+        `[ThemeBridge] Invalid token name "${name}": token names must match ${TOKEN_NAME_PATTERN}.`
+      );
+    }
+    if (typeof value !== "string" || !isSafeBridgeTokenValue(value)) {
+      throw new Error(
+        `[ThemeBridge] Invalid token value for "${name}": expected a hex colour, CSS var(), or RGB channel value.`
+      );
+    }
+  }
+}
+function parseBridgeOverrideRules(overrides) {
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) {
+    throw new Error("[ThemeBridge] Invalid overrides: expected a selector-to-rules object.");
+  }
+  return Object.entries(overrides).map(([selector, rules], index) => {
+    if (hasUnsafeCssFragment(selector)) {
+      throw new Error(
+        `[ThemeBridge] Invalid override selector "${selector}": selectors contain unsafe CSS markup or external URLs.`
+      );
+    }
+    return {
+      id: `theme-bridge-override-${index + 1}`,
+      selector,
+      declarations: parseBridgeOverrideDeclarations(selector, rules)
+    };
+  });
+}
+function parseBridgeOverrideDeclarations(selector, rules) {
+  if (typeof rules !== "string") {
+    throw new Error(
+      `[ThemeBridge] Invalid override for "${selector}": expected a CSS declaration string.`
+    );
+  }
+  if (hasUnsafeCssFragment(rules)) {
+    throw new Error(
+      `[ThemeBridge] Invalid override for "${selector}": rules contain unsafe CSS markup or external URLs.`
+    );
+  }
+  const declarations = {};
+  for (const declaration of rules.split(";")) {
+    const trimmedDeclaration = declaration.trim();
+    if (trimmedDeclaration.length === 0) {
+      continue;
+    }
+    const colonIndex = trimmedDeclaration.indexOf(":");
+    if (colonIndex <= 0) {
+      throw new Error(
+        `[ThemeBridge] Invalid override for "${selector}": expected "property: value" declarations.`
+      );
+    }
+    const property = trimmedDeclaration.slice(0, colonIndex).trim();
+    const value = trimmedDeclaration.slice(colonIndex + 1).trim();
+    if (!CSS_DECLARATION_PROPERTY_PATTERN.test(property) || value.length === 0) {
+      throw new Error(
+        `[ThemeBridge] Invalid override for "${selector}": expected safe CSS declaration names and values.`
+      );
+    }
+    if (hasUnsafeCssFragment(value)) {
+      throw new Error(
+        `[ThemeBridge] Invalid override for "${selector}": declaration value contains unsafe CSS.`
+      );
+    }
+    declarations[property] = value;
+  }
+  return declarations;
+}
+function hasUnsafeCssFragment(value) {
+  return UNSAFE_CSS_MARKUP_PATTERN.test(value) || /@import/i.test(value) || EXTERNAL_URL_PATTERN.test(value) || JAVASCRIPT_URL_PATTERN2.test(value);
+}
 function shouldGenerateComponent(value) {
-  return value === true || typeof value === "object" && value !== null;
+  return value !== void 0 && value !== false;
 }
 function generateButtonsCss(config, corners2, shadows) {
   let variants = getDefaultButtonVariants();
   const buttonConfig = config.components?.buttons;
-  if (typeof buttonConfig === "object" && buttonConfig.variants) {
+  if (buttonConfig !== void 0 && buttonConfig !== true && buttonConfig !== false && buttonConfig.variants) {
     const requestedIds = new Set(buttonConfig.variants);
     variants = variants.filter((variant) => requestedIds.has(variant.id));
   }
@@ -12619,7 +12853,7 @@ function generateButtonsCss(config, corners2, shadows) {
 function generateCardsCss(config, corners2, shadows) {
   let variants = getDefaultCardVariants();
   const cardConfig = config.components?.cards;
-  if (typeof cardConfig === "object" && cardConfig.variants) {
+  if (cardConfig !== void 0 && cardConfig !== true && cardConfig !== false && cardConfig.variants) {
     const requestedIds = new Set(cardConfig.variants);
     variants = variants.filter((variant) => requestedIds.has(variant.id));
   }
@@ -12637,12 +12871,12 @@ function generateInputsCss(corners2, shadows) {
     shadow: shadows === "none" ? "none" : "low"
   });
 }
+function hasBridgeOverrides(overrides) {
+  return overrides !== void 0 && Object.keys(overrides).length > 0;
+}
 function generateOverrideCss(overrides) {
-  return Object.entries(overrides).map(
-    ([selector, rules]) => `:where([data-theme-scope="${THEME_BRIDGE_SCOPE_ID}"]) ${selector} {
-  ${rules}
-}`
-  ).join("\n\n");
+  const parsedRules = parseCustomCssRules(parseBridgeOverrideRules(overrides));
+  return compileCustomCssRules(parsedRules, THEME_BRIDGE_SCOPE_ID);
 }
 function buildBridgeGeneratorTheme(corners2) {
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riverbankcms/sdk",
-  "version": "0.68.0",
+  "version": "0.70.2",
   "description": "Riverbank CMS SDK for headless content consumption",
   "main": "./dist/server/index.mjs",
   "module": "./dist/server/index.mjs",
@@ -230,8 +230,6 @@
   },
   "dependencies": {
     "@tanstack/react-query": "^5.90.20",
-    "@riverbankcms/content-model": "workspace:*",
-    "@riverbankcms/site-commands": "workspace:*",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",
     "fast-deep-equal": "^3.1.3",