@teleporthq/teleport-shared 0.43.60 → 0.43.62

package/__tests__/utils/local-imports.ts

@@ -0,0 +1,174 @@
+import { GeneratedFolder } from '@teleporthq/teleport-types'
+import { LocalImports } from '../../src'
+
+const {
+  collectProjectFiles,
+  findUnresolvedLocalImports,
+  findUnresolvedLocalImportsInProject,
+  formatUnresolvedLocalImports,
+} = LocalImports
+
+const file = (name: string, fileType: string, content = '') => ({ name, fileType, content })
+
+const folder = (
+  name: string,
+  files: Array<ReturnType<typeof file>> = [],
+  subFolders: GeneratedFolder[] = []
+): GeneratedFolder => ({ name, files, subFolders } as GeneratedFolder)
+
+describe('collectProjectFiles', () => {
+  it('addresses every file relative to the project root, not to the root folder name', () => {
+    const project = folder(
+      'my-project',
+      [file('package', 'json', '{}')],
+      [folder('pages', [file('index', 'js', '')], [folder('blog', [file('[slug]', 'js', '')])])]
+    )
+
+    expect(
+      collectProjectFiles(project)
+        .map((entry) => entry.path)
+        .sort()
+    ).toEqual(['package.json', 'pages/blog/[slug].js', 'pages/index.js'])
+  })
+
+  it('skips the content of base64 files', () => {
+    const project = folder('my-project', [
+      { ...file('logo', 'png', 'iVBORw0KGgo='), contentEncoding: 'base64' as const },
+    ])
+
+    expect(collectProjectFiles(project)[0].content).toBe('')
+  })
+})
+
+describe('findUnresolvedLocalImports', () => {
+  it('accepts an import that resolves to a generated file', () => {
+    const unresolved = findUnresolvedLocalImports([
+      {
+        path: 'pages/blog/[slug].js',
+        content: `import fetcher from '../../resources/fetch-posts'`,
+      },
+      { path: 'resources/fetch-posts.js', content: '' },
+    ])
+
+    expect(unresolved).toEqual([])
+  })
+
+  it('reports the page-folder/root-folder collision that broke `next build`', () => {
+    const unresolved = findUnresolvedLocalImports([
+      {
+        path: 'pages/resources/[id].js',
+        content: `import fetcher from '../fetch_content_items_detail'`,
+      },
+      { path: 'resources/fetch_content_items_detail.js', content: '' },
+    ])
+
+    expect(unresolved).toEqual([
+      { filePath: 'pages/resources/[id].js', specifier: '../fetch_content_items_detail' },
+    ])
+  })
+
+  it('resolves extensionless, explicit-extension, folder-index and multi-line imports', () => {
+    const unresolved = findUnresolvedLocalImports([
+      {
+        path: 'pages/index.js',
+        content: [
+          `import {`,
+          `  Repeater,`,
+          `} from '../components/navigation'`,
+          `import '../pages/style.css'`,
+          `import cache from '../utils/tq-cache'`,
+          `const runtime = require('../utils/workflows/runtime')`,
+          `const lazy = () => import('../components/footer')`,
+        ].join('\n'),
+      },
+      { path: 'components/navigation.js', content: '' },
+      { path: 'components/footer.jsx', content: '' },
+      { path: 'pages/style.css', content: '' },
+      { path: 'utils/tq-cache/index.js', content: '' },
+      { path: 'utils/workflows/runtime.js', content: '' },
+    ])
+
+    expect(unresolved).toEqual([])
+  })
+
+  it('reports an import that climbs above the project root', () => {
+    const unresolved = findUnresolvedLocalImports([
+      { path: 'pages/index.js', content: `import x from '../../outside/thing'` },
+    ])
+
+    expect(unresolved).toEqual([{ filePath: 'pages/index.js', specifier: '../../outside/thing' }])
+  })
+
+  it('ignores package imports, aliases and non-JS files', () => {
+    const unresolved = findUnresolvedLocalImports([
+      {
+        path: 'pages/index.js',
+        content: [
+          `import React from 'react'`,
+          `import { useGlobalState } from '@/global-state-context'`,
+        ].join('\n'),
+      },
+      { path: 'pages/style.css', content: `@import './missing.css';` },
+    ])
+
+    expect(unresolved).toEqual([])
+  })
+
+  it('ignores a bundler suffix on the specifier', () => {
+    const unresolved = findUnresolvedLocalImports([
+      { path: 'pages/index.js', content: `import icon from '../public/icon.svg?inline'` },
+      { path: 'public/icon.svg', content: '' },
+    ])
+
+    expect(unresolved).toEqual([])
+  })
+
+  it('reports every offending file, sorted, and reports each specifier once', () => {
+    const unresolved = findUnresolvedLocalImports([
+      { path: 'pages/b.js', content: `import x from './missing'\nimport y from './missing'` },
+      { path: 'pages/a.js', content: `import z from './also-missing'` },
+    ])
+
+    expect(unresolved).toEqual([
+      { filePath: 'pages/a.js', specifier: './also-missing' },
+      { filePath: 'pages/b.js', specifier: './missing' },
+    ])
+  })
+})
+
+describe('findUnresolvedLocalImportsInProject', () => {
+  it('walks a generated folder', () => {
+    const project = folder(
+      'my-project',
+      [],
+      [
+        folder(
+          'pages',
+          [],
+          [folder('resources', [file('[id]', 'js', `import r from '../fetch'`)])]
+        ),
+        folder('resources', [file('fetch', 'js', '')]),
+      ]
+    )
+
+    expect(findUnresolvedLocalImportsInProject(project)).toEqual([
+      { filePath: 'pages/resources/[id].js', specifier: '../fetch' },
+    ])
+  })
+})
+
+describe('formatUnresolvedLocalImports', () => {
+  it('is empty when there is nothing to report', () => {
+    expect(formatUnresolvedLocalImports([])).toBe('')
+  })
+
+  it('names every file and specifier', () => {
+    const report = formatUnresolvedLocalImports([
+      { filePath: 'pages/resources/[id].js', specifier: '../fetch_content_items_detail' },
+    ])
+
+    expect(report).toContain('pages/resources/[id].js')
+    expect(report).toContain('../fetch_content_items_detail')
+    expect(report).toContain('Module not found')
+  })
+})

package/__tests__/utils/page-dependencies-prefix.ts

@@ -0,0 +1,89 @@
+import { GenericUtils } from '../../src'
+
+const { generatePageDependenciesPrefix, generatePageToRootPrefix, DEFAULT_PAGES_PATH } =
+  GenericUtils
+
+/**
+ * Regression guard for the `pages/resources/[id].js` → `../fetch_content_items_detail`
+ * build break: the page folder path is relative to the PAGES ROOT while the
+ * target folder path is relative to the PROJECT ROOT, and resolving one against
+ * the other cancelled the `resources` segment that only looked shared.
+ */
+describe('generatePageDependenciesPrefix', () => {
+  it('reaches a root folder from a page at the pages root', () => {
+    expect(generatePageDependenciesPrefix({ toPath: ['resources'], folderPath: [] })).toBe(
+      '../resources/'
+    )
+  })
+
+  it('reaches a root folder from a page in a subfolder', () => {
+    expect(generatePageDependenciesPrefix({ toPath: ['resources'], folderPath: ['blog'] })).toBe(
+      '../../resources/'
+    )
+  })
+
+  it('does NOT collapse a page folder that is named after the target root folder', () => {
+    expect(
+      generatePageDependenciesPrefix({ toPath: ['resources'], folderPath: ['resources'] })
+    ).toBe('../../resources/')
+  })
+
+  it('does not collapse deeper collisions either', () => {
+    expect(
+      generatePageDependenciesPrefix({
+        toPath: ['utils', 'data-sources'],
+        folderPath: ['utils', 'data-sources'],
+      })
+    ).toBe('../../../utils/data-sources/')
+  })
+
+  it('counts a multi-segment pages root', () => {
+    expect(
+      generatePageDependenciesPrefix({
+        toPath: ['resources'],
+        folderPath: ['resources'],
+        pagesPath: ['src', 'pages'],
+      })
+    ).toBe('../../../resources/')
+  })
+
+  it('cancels a genuinely shared ancestor', () => {
+    expect(
+      generatePageDependenciesPrefix({
+        toPath: ['src', 'resources'],
+        folderPath: ['blog'],
+        pagesPath: ['src', 'pages'],
+      })
+    ).toBe('../../resources/')
+  })
+
+  it('defaults to the Next pages root and to a page at that root', () => {
+    expect(generatePageDependenciesPrefix({ toPath: ['components'] })).toBe('../components/')
+    expect(DEFAULT_PAGES_PATH).toEqual(['pages'])
+  })
+
+  it('treats a missing folder path the same as an empty one', () => {
+    expect(
+      generatePageDependenciesPrefix({
+        toPath: ['resources'],
+        folderPath: undefined,
+        pagesPath: undefined,
+      })
+    ).toBe('../resources/')
+  })
+})
+
+describe('generatePageToRootPrefix', () => {
+  it('matches the hand-rolled depth math it replaced', () => {
+    expect(generatePageToRootPrefix({ folderPath: [] })).toBe('../')
+    expect(generatePageToRootPrefix({ folderPath: ['admin'] })).toBe('../../')
+    expect(generatePageToRootPrefix({ folderPath: ['admin', 'reports'] })).toBe('../../../')
+    expect(generatePageToRootPrefix({})).toBe('../')
+  })
+
+  it('counts a multi-segment pages root', () => {
+    expect(generatePageToRootPrefix({ folderPath: ['admin'], pagesPath: ['src', 'pages'] })).toBe(
+      '../../../'
+    )
+  })
+})

package/__tests__/utils/rich-text-embeds-runtime-module.ts

@@ -0,0 +1,124 @@
+import { parse } from '@babel/parser'
+import { RichTextEmbeds, RichTextEmbedsCodegen } from '../../src'
+
+/**
+ * The generated project gets `components/embed-runtime.js`, emitted from the
+ * very functions in `src/utils/rich-text-embeds.ts` rather than hand-copied
+ * into a template. These tests are what makes that safe: the emitted module has
+ * to parse, evaluate with no module-scoped references left dangling, and answer
+ * exactly what the source module answers.
+ */
+const SOURCE = RichTextEmbedsCodegen.generateEmbedRuntimeModuleSource()
+
+/** Evaluates the ES module source in-process and returns its exports. */
+const loadRuntime = (): Record<string, (...args: never[]) => unknown> => {
+  const exportedNames = Array.from(
+    SOURCE.matchAll(/^export (?:var|function) ([A-Za-z_$][\w$]*)/gm)
+  ).map((match) => match[1])
+  const body = `${SOURCE.replace(/^export /gm, '')}\nreturn { ${exportedNames.join(', ')} }`
+  // eslint-disable-next-line no-new-func
+  return new Function(body)() as Record<string, (...args: never[]) => unknown>
+}
+
+describe('the emitted embed runtime module', () => {
+  it('parses as an ES module', () => {
+    expect(() => parse(SOURCE, { sourceType: 'module' })).not.toThrow()
+  })
+
+  it('carries no reference the module itself does not declare', () => {
+    expect(SOURCE).not.toContain('exports.')
+    expect(() => loadRuntime()).not.toThrow()
+  })
+
+  it('exports every helper the generated editor and activator call', () => {
+    const runtime = loadRuntime()
+    const required = [
+      'isSafeEmbedUrl',
+      'resolveEmbedProvider',
+      'buildEmbedHtmlFromUrl',
+      'resolveEmbedMode',
+      'createEmbedValue',
+      'buildEmbedElementHtml',
+      'buildEmbedFrameChildren',
+      'readEmbedValueFromElement',
+      'readEncodedEmbedCode',
+      'findEmbedFrame',
+      'normalizeEmbedsForStorage',
+      'resolveEmbedSandboxFlags',
+      'buildEmbedSandboxDocument',
+      'parseEmbedHeightMessage',
+      'createEmbedToken',
+      'encodeEmbedCode',
+      'decodeEmbedCode',
+    ]
+
+    required.forEach((name) => {
+      expect(typeof runtime[name]).toBe('function')
+    })
+  })
+
+  it('answers exactly what the source module answers', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+
+    const urls = [
+      'https://youtu.be/dQw4w9WgXcQ',
+      'https://x.com/a/status/1',
+      'https://www.figma.com/design/abc/File?node-id=1-2',
+      'https://open.spotify.com/track/abc123',
+      'https://example.com/plain',
+      'javascript:alert(1)',
+    ]
+
+    urls.forEach((url) => {
+      expect(runtime.isSafeEmbedUrl(url)).toBe(RichTextEmbeds.isSafeEmbedUrl(url))
+
+      const built = runtime.buildEmbedHtmlFromUrl(url)
+      const expected = RichTextEmbeds.buildEmbedHtmlFromUrl(url)
+      expect(built?.html).toBe(expected?.html)
+      expect(built?.provider.id).toBe(expected?.provider.id)
+
+      if (!built || !expected) {
+        return
+      }
+
+      const params = {
+        code: built.html,
+        provider: built.provider.id,
+        url,
+        ratio: built.provider.ratio,
+        caption: 'a & "b"',
+      }
+      expect(runtime.createEmbedValue(params)).toEqual(RichTextEmbeds.createEmbedValue(params))
+      expect(runtime.buildEmbedElementHtml(runtime.createEmbedValue(params))).toBe(
+        RichTextEmbeds.buildEmbedElementHtml(RichTextEmbeds.createEmbedValue(params))
+      )
+    })
+  })
+
+  it('produces the same sandbox payload as the source module', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+
+    expect(runtime.resolveEmbedSandboxFlags('strict')).toBe(
+      RichTextEmbeds.resolveEmbedSandboxFlags('strict')
+    )
+    expect(runtime.resolveEmbedSandboxFlags('trusted')).toBe(
+      RichTextEmbeds.resolveEmbedSandboxFlags('trusted')
+    )
+    expect(runtime.buildEmbedSandboxDocument('<b>x</b>', 'tok')).toBe(
+      RichTextEmbeds.buildEmbedSandboxDocument('<b>x</b>', 'tok')
+    )
+    expect(
+      runtime.parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 9e9 })
+    ).toEqual(
+      RichTextEmbeds.parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 9e9 })
+    )
+  })
+
+  it('round-trips base64 the same way in both', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+    const code = '<blockquote>café — 日本語 — 🎉</blockquote><script>x()</script>'
+
+    expect(runtime.encodeEmbedCode(code)).toBe(RichTextEmbeds.encodeEmbedCode(code))
+    expect(runtime.decodeEmbedCode(RichTextEmbeds.encodeEmbedCode(code))).toBe(code)
+  })
+})

package/__tests__/utils/rich-text-embeds.ts

@@ -0,0 +1,254 @@
+import { parse } from '@babel/parser'
+import { RichTextEmbeds, RichTextEmbedsCodegen } from '../../src'
+
+const {
+  EMBED_ATTR,
+  applyEmbedTemplate,
+  buildEmbedElementHtml,
+  buildEmbedHtmlFromUrl,
+  clampEmbedWidth,
+  createEmbedValue,
+  decodeEmbedCode,
+  embedBlockStyle,
+  embedFrameStyle,
+  encodeEmbedCode,
+  isSafeEmbedUrl,
+  normalizeEmbedAlign,
+  resolveEmbedMode,
+  resolveEmbedProvider,
+} = RichTextEmbeds
+
+// The DOM half of the contract (`readEmbedValueFromElement`, the layout and
+// caption editors) is covered in teleport-gui, whose test runner has a DOM —
+// this repo's jest runs in a node environment.
+
+describe('provider resolution', () => {
+  it('matches every YouTube URL spelling to the same embed', () => {
+    const urls = [
+      'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
+      'https://www.youtube.com/watch?list=PL123&v=dQw4w9WgXcQ',
+      'https://youtu.be/dQw4w9WgXcQ',
+      'https://www.youtube.com/shorts/dQw4w9WgXcQ',
+      'https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ',
+    ]
+
+    urls.forEach((url) => {
+      const built = buildEmbedHtmlFromUrl(url)
+      expect(built).not.toBeNull()
+      expect(built?.provider.id).toBe('youtube')
+      expect(built?.html).toContain('https://www.youtube.com/embed/dQw4w9WgXcQ')
+    })
+  })
+
+  it('URL-encodes the whole URL where a provider takes it as a query parameter', () => {
+    const built = buildEmbedHtmlFromUrl('https://www.figma.com/design/abc123/My-File?node-id=1-2')
+    expect(built?.provider.id).toBe('figma')
+    expect(built?.html).toContain(
+      'url=https%3A%2F%2Fwww.figma.com%2Fdesign%2Fabc123%2FMy-File%3Fnode-id%3D1-2'
+    )
+  })
+
+  it('falls back to a generic iframe only after every specific provider missed', () => {
+    expect(resolveEmbedProvider('https://example.com/some/page')?.provider.id).toBe('iframe-url')
+    expect(resolveEmbedProvider('https://vimeo.com/76979871')?.provider.id).toBe('vimeo')
+    expect(resolveEmbedProvider('https://codepen.io/team/pen/abcDEF')?.provider.id).toBe('codepen')
+  })
+
+  it('refuses anything that is not an http(s) URL', () => {
+    expect(isSafeEmbedUrl('javascript:alert(1)')).toBe(false)
+    expect(isSafeEmbedUrl('data:text/html;base64,PHNjcmlwdD4=')).toBe(false)
+    expect(isSafeEmbedUrl('//evil.example.com')).toBe(false)
+    expect(isSafeEmbedUrl('')).toBe(false)
+    expect(isSafeEmbedUrl('https://ok.example.com/x')).toBe(true)
+    expect(resolveEmbedProvider('javascript:alert(1)')).toBeNull()
+  })
+
+  it('keeps `$$` literal and never honours the replacement patterns String.replace reserves', () => {
+    const match = 'https://x.test/1'.match(/^https:\/\/x\.test\/(\d+)$/) as RegExpMatchArray
+    expect(applyEmbedTemplate("[$1][$$][$'][$`]", match, 'https://x.test/1')).toBe("[1][$][$'][$`]")
+  })
+
+  it('gives every provider patterns that agree on their capture groups', () => {
+    RichTextEmbeds.EMBED_PROVIDERS.forEach((provider) => {
+      const groupCounts = provider.patterns.map(
+        (pattern) => new RegExp(`${pattern.source}|`).exec('')?.length ?? 0
+      )
+      expect(new Set(groupCounts).size).toBe(1)
+    })
+  })
+})
+
+describe('mode resolution', () => {
+  it('quarantines anything that can execute', () => {
+    expect(resolveEmbedMode('<script src="https://x.test/a.js"></script>')).toBe('sandbox')
+    expect(resolveEmbedMode('<img src=x onerror="alert(1)">')).toBe('sandbox')
+    expect(resolveEmbedMode('<a href="javascript:alert(1)">x</a>')).toBe('sandbox')
+    expect(resolveEmbedMode('<iframe src="https://x.test"></iframe>')).toBe('inline')
+  })
+
+  it('does not mistake an attribute merely starting with "on" for a handler', () => {
+    expect(resolveEmbedMode('<iframe data-only="1" title="one"></iframe>')).toBe('inline')
+  })
+
+  it('sends every script-based provider to the sandbox and the rest inline', () => {
+    expect(resolveEmbedMode(buildEmbedHtmlFromUrl('https://x.com/a/status/1')?.html ?? '')).toBe(
+      'sandbox'
+    )
+    expect(
+      resolveEmbedMode(buildEmbedHtmlFromUrl('https://youtu.be/dQw4w9WgXcQ')?.html ?? '')
+    ).toBe('inline')
+  })
+})
+
+describe('base64 round-trip', () => {
+  it('survives non-ASCII markup', () => {
+    const code = '<blockquote>café — 日本語 — 🎉</blockquote>'
+    expect(decodeEmbedCode(encodeEmbedCode(code))).toBe(code)
+  })
+})
+
+describe('stored markup', () => {
+  it('keeps an inline embed as real children so it renders without JavaScript', () => {
+    const value = createEmbedValue({
+      code: '<iframe src="https://www.youtube.com/embed/abc"></iframe>',
+      provider: 'youtube',
+      url: 'https://youtu.be/abc',
+      ratio: 56.25,
+      caption: 'A "quoted" caption & more',
+    })
+    const html = buildEmbedElementHtml(value)
+
+    expect(html).toContain(`${EMBED_ATTR.MODE}="inline"`)
+    expect(html).not.toContain(EMBED_ATTR.CODE)
+    expect(html).toContain('<iframe src="https://www.youtube.com/embed/abc"></iframe>')
+    expect(html).toContain('padding-top:56.25%')
+    expect(html).toContain('A &quot;quoted&quot; caption &amp; more')
+  })
+
+  it('encodes a script embed and leaves only a noscript fallback in the page', () => {
+    const code =
+      '<blockquote class="twitter-tweet"></blockquote><script src="https://x.test/w.js"></script>'
+    const value = createEmbedValue({ code, provider: 'twitter', url: 'https://x.com/a/status/1' })
+    const html = buildEmbedElementHtml(value)
+
+    expect(html).toContain(`${EMBED_ATTR.MODE}="sandbox"`)
+    expect(html).toContain(`${EMBED_ATTR.SANDBOX}="strict"`)
+    expect(html).toContain(`${EMBED_ATTR.CODE}="${encodeEmbedCode(code)}"`)
+    expect(html).not.toContain('<script')
+    expect(html).toContain('<noscript>')
+  })
+
+  it('omits the noscript fallback for a pasted snippet that has no source URL', () => {
+    const html = buildEmbedElementHtml(createEmbedValue({ code: '<script>x()</script>' }))
+    expect(html).not.toContain('<noscript>')
+    expect(html).toContain(`${EMBED_ATTR.PROVIDER}="custom"`)
+  })
+})
+
+describe('layout vocabulary', () => {
+  it('clamps the width to a usable range', () => {
+    expect(clampEmbedWidth(0)).toBe(10)
+    expect(clampEmbedWidth(1000)).toBe(100)
+    expect(clampEmbedWidth(NaN)).toBe(100)
+  })
+
+  it('falls back to center for an unknown alignment', () => {
+    expect(normalizeEmbedAlign('diagonal')).toBe('center')
+    expect(normalizeEmbedAlign('float-right')).toBe('float-right')
+  })
+
+  it('only floats when the alignment asks for it', () => {
+    expect(embedBlockStyle({ width: 50, align: 'center' })).toContain('margin-left:auto')
+    expect(embedBlockStyle({ width: 50, align: 'center' })).not.toContain('float')
+    expect(embedBlockStyle({ width: 50, align: 'float-right' })).toContain('float:right')
+  })
+
+  it('only builds a padding-top box for a usable ratio', () => {
+    expect(embedFrameStyle(56.25)).toContain('padding-top:56.25%')
+    expect(embedFrameStyle(null)).not.toContain('padding-top')
+    expect(embedFrameStyle(0)).not.toContain('padding-top')
+  })
+})
+
+describe('runtime serialization', () => {
+  it('emits a registry the generated module can evaluate', () => {
+    // tslint:disable-next-line:no-eval
+    const providers = eval(RichTextEmbedsCodegen.serializeEmbedProvidersForRuntime()) as Array<{
+      id: string
+      patterns: RegExp[]
+    }>
+
+    expect(providers).toHaveLength(RichTextEmbeds.EMBED_PROVIDERS.length)
+    expect(providers[0].patterns[0]).toBeInstanceOf(RegExp)
+    expect(providers.map((entry) => entry.id)).toEqual(
+      RichTextEmbeds.EMBED_PROVIDERS.map((entry) => entry.id)
+    )
+  })
+})
+
+describe('the sandbox payload', () => {
+  const {
+    EMBED_MAX_HEIGHT,
+    EMBED_MIN_HEIGHT,
+    buildEmbedSandboxDocument,
+    createEmbedToken,
+    parseEmbedHeightMessage,
+    resolveEmbedSandboxFlags,
+  } = RichTextEmbeds
+
+  it('withholds allow-same-origin unless the author opted in', () => {
+    expect(resolveEmbedSandboxFlags('strict')).not.toContain('allow-same-origin')
+    expect(resolveEmbedSandboxFlags('trusted')).toContain('allow-same-origin')
+  })
+
+  it('hands the frame a bootstrap script that is valid JavaScript', () => {
+    // The document is assembled from concatenated fragments, so a stray
+    // character would only surface as a silent parse failure inside a sandboxed
+    // frame — where nothing can report it. Parse it here instead.
+    const doc = buildEmbedSandboxDocument('', 'tok')
+    const script = /<script>([\s\S]*?)<\/script>/.exec(doc)
+
+    expect(script).not.toBeNull()
+    expect(() => parse((script as RegExpExecArray)[1], { sourceType: 'script' })).not.toThrow()
+  })
+
+  it('closes every tag it opens, so the embed lands inside the body', () => {
+    const doc = buildEmbedSandboxDocument('<b>x</b>', 'tok')
+
+    expect(doc.indexOf('<body>')).toBeLessThan(doc.indexOf('<b>x</b>'))
+    expect(doc.indexOf('<b>x</b>')).toBeLessThan(doc.indexOf('</body>'))
+    expect(doc.endsWith('</body></html>')).toBe(true)
+  })
+
+  it('bakes the frame token into the document it hands the iframe', () => {
+    const token = createEmbedToken()
+    const doc = buildEmbedSandboxDocument('<blockquote>hi</blockquote>', token)
+
+    expect(doc).toContain(token)
+    expect(doc).not.toContain(RichTextEmbeds.EMBED_TOKEN_PLACEHOLDER)
+    expect(doc).toContain('<blockquote>hi</blockquote>')
+    expect(doc.indexOf('</head>')).toBeLessThan(doc.indexOf('<blockquote>'))
+  })
+
+  it('mints a distinct token per frame', () => {
+    expect(createEmbedToken()).not.toBe(createEmbedToken())
+  })
+
+  it('accepts only a well-formed height message, and clamps it', () => {
+    expect(parseEmbedHeightMessage(null)).toBeNull()
+    expect(parseEmbedHeightMessage('tq-embed-height')).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'other', token: 'a', height: 10 })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 1, height: 10 })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 'x' })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: -5 })).toBeNull()
+
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 1 })).toEqual({
+      token: 'a',
+      height: EMBED_MIN_HEIGHT,
+    })
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 1e9 })).toEqual({
+      token: 'a',
+      height: EMBED_MAX_HEIGHT,
+    })
+  })
+})

package/dist/cjs/index.d.ts

@@ -2,6 +2,7 @@ import * as Constants from './constants';
 import * as StringUtils from './utils/string-utils';
 import * as UIDLUtils from './utils/uidl-utils';
 import * as GenericUtils from './utils/generic';
+import * as LocalImports from './utils/local-imports';
 import * as JSIdentifiers from './utils/js-identifiers';
 import * as ASTScope from './utils/ast-scope';
 import * as ASTStatementOrder from './utils/ast-statement-order';
@@ -13,6 +14,8 @@ import * as StyleDeclarations from './utils/style-declarations';
 import * as StorefrontTax from './utils/storefront-tax';
 import * as ProductDiscounts from './utils/product-discounts';
 import * as EmailDate from './utils/email-date';
+import * as RichTextEmbeds from './utils/rich-text-embeds';
+import * as RichTextEmbedsCodegen from './utils/rich-text-embeds-codegen';
 import * as DataCache from './cache';
-export { Constants, StringUtils, UIDLUtils, GenericUtils, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, EmailDate, DataCache, };
+export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, };
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AAEpC,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,SAAS,GACV,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AAEpC,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,GACV,CAAA"}