sunpeak 0.9.3 → 0.9.8

package/README.md

@@ -12,7 +12,7 @@
 [![npm downloads](https://img.shields.io/npm/dm/sunpeak.svg?style=flat-square)](https://www.npmjs.com/package/sunpeak)
 [![CI](https://img.shields.io/github/actions/workflow/status/Sunpeak-AI/sunpeak/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/Sunpeak-AI/sunpeak/actions)
 [![License](https://img.shields.io/npm/l/sunpeak.svg?style=flat-square)](https://github.com/Sunpeak-AI/sunpeak/blob/main/LICENSE)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.6-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.9-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org/)
 [![React](https://img.shields.io/badge/React-19-blue?style=flat-square&logo=react)](https://reactjs.org/)
 
 The ChatGPT App framework.
@@ -57,7 +57,7 @@ sunpeak is an npm package consisting of:
 2. **The `sunpeak` framework** (`./template`). Next.js for ChatGPT Apps. This templated npm package includes:
    1. Project scaffold - Complete development setup with build, test, and mcp tooling, including the sunpeak library.
    2. UI components - Production-ready components following ChatGPT design guidelines and using OpenAI apps-sdk-ui React components.
-   3. Convention over configuration - Create UIs (resources) by simply creating a `resources/NAME-resource.tsx` React file and `resources/NAME-resource.json` metadata file.
+   3. Convention over configuration - Create UIs (resources) by simply creating a `src/resources/NAME-resource.tsx` React file and `src/resources/NAME-resource.json` metadata file.
 3. **The `sunpeak` CLI** (`./bin`). Commands for managing ChatGPT Apps. Includes a client for the [sunpeak Resource Repository](https://app.sunpeak.ai/) (ECR for ChatGPT Apps). The repository helps you & your CI/CD decouple your App from your client-agnostic MCP server:
    1. Tag your app builds with version numbers and environment names (like `v1.0.0` and `prod`)
    2. `push` built Apps to a central location

package/dist/chatgpt/conversation.d.ts

@@ -1,12 +1,15 @@
 import { ScreenWidth } from './chatgpt-simulator-types';
 import * as React from 'react';
 interface ConversationProps {
-    children: React.ReactNode;
+    /** React content to render (mutually exclusive with iframeScriptSrc) */
+    children?: React.ReactNode;
+    /** URL to a built .js file to render in an iframe (mutually exclusive with children) */
+    iframeScriptSrc?: string;
     screenWidth: ScreenWidth;
     appName?: string;
     appIcon?: string;
     userMessage?: string;
     resourceMeta?: Record<string, unknown>;
 }
-export declare function Conversation({ children, screenWidth, appName, appIcon, userMessage, resourceMeta, }: ConversationProps): import("react/jsx-runtime").JSX.Element;
+export declare function Conversation({ children, iframeScriptSrc, screenWidth, appName, appIcon, userMessage, resourceMeta, }: ConversationProps): import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/chatgpt/iframe-resource.d.ts

@@ -0,0 +1,69 @@
+import * as React from 'react';
+/**
+ * Escapes HTML special characters to prevent XSS via attribute injection.
+ */
+declare function escapeHtml(str: string): string;
+/**
+ * Validates that a script source URL is from an allowed origin.
+ * Allows same-origin scripts and scripts from whitelisted domains.
+ */
+declare function isAllowedScriptSrc(src: string): boolean;
+/**
+ * Generates a Content Security Policy string from CSP configuration.
+ * Creates a restrictive policy that only allows specified domains.
+ */
+declare function generateCSP(csp: WidgetCSP | undefined, scriptSrc: string): string;
+/**
+ * Content Security Policy configuration for iframe resources.
+ * Maps to the openai/widgetCSP field in resource JSON files.
+ */
+export interface WidgetCSP {
+    /** Domains allowed for fetch/XHR/WebSocket connections */
+    connect_domains?: string[];
+    /** Domains allowed for scripts, images, styles, fonts */
+    resource_domains?: string[];
+}
+interface IframeResourceProps {
+    /** URL to a built .js file to load in the iframe. The HTML wrapper is generated automatically. */
+    scriptSrc: string;
+    /** Optional className for the iframe container */
+    className?: string;
+    /** Optional style for the iframe */
+    style?: React.CSSProperties;
+    /** Optional Content Security Policy configuration */
+    csp?: WidgetCSP;
+}
+/**
+ * Generates the bridge script with allowed parent origins injected.
+ * This bridges the MessageChannel API with the window.openai interface.
+ * Uses MessageChannel for secure communication instead of postMessage('*').
+ */
+declare function generateBridgeScript(allowedParentOrigins: string[]): string;
+/**
+ * Generates HTML wrapper for a script URL.
+ * Includes minimal styling for transparent background and full-size root.
+ * The scriptSrc is escaped to prevent XSS via attribute injection.
+ */
+declare function generateScriptHtml(scriptSrc: string, theme: string, cspPolicy: string): string;
+/**
+ * IframeResource renders production .js files in an actual iframe.
+ *
+ * It sets up a postMessage bridge to communicate window.openai state
+ * between the parent simulator and the iframe content.
+ *
+ * Usage:
+ * ```tsx
+ * <IframeResource scriptSrc="/dist/carousel.js" />
+ * ```
+ */
+export declare function IframeResource({ scriptSrc, className, style, csp }: IframeResourceProps): import("react/jsx-runtime").JSX.Element;
+export declare const _testExports: {
+    escapeHtml: typeof escapeHtml;
+    isAllowedScriptSrc: typeof isAllowedScriptSrc;
+    generateBridgeScript: typeof generateBridgeScript;
+    generateCSP: typeof generateCSP;
+    generateScriptHtml: typeof generateScriptHtml;
+    ALLOWED_SCRIPT_ORIGINS: string[];
+    ALLOWED_PARENT_ORIGINS: string[];
+};
+export {};

package/dist/chatgpt/index.cjs

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const simulatorUrl = require("../simulator-url-CG8lAAC3.cjs");
+const simulatorUrl = require("../simulator-url-BpCa95pE.cjs");
 exports.ChatGPTSimulator = simulatorUrl.ChatGPTSimulator;
+exports.IframeResource = simulatorUrl.IframeResource;
 exports.ThemeProvider = simulatorUrl.ThemeProvider;
 exports.createSimulatorUrl = simulatorUrl.createSimulatorUrl;
 exports.initMockOpenAI = simulatorUrl.initMockOpenAI;

package/dist/chatgpt/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;"}

package/dist/chatgpt/index.d.ts

@@ -4,3 +4,4 @@ export { initMockOpenAI } from './mock-openai';
 export * from './theme-provider';
 export { createSimulatorUrl } from './simulator-url';
 export type { SimulatorUrlParams } from './simulator-url';
+export { IframeResource } from './iframe-resource';

package/dist/chatgpt/index.js

@@ -1,6 +1,7 @@
-import { C, T, c, i, u } from "../simulator-url-CexnaL-e.js";
+import { C, I, T, c, i, u } from "../simulator-url-q5tHLc4-.js";
 export {
   C as ChatGPTSimulator,
+  I as IframeResource,
   T as ThemeProvider,
   c as createSimulatorUrl,
   i as initMockOpenAI,

package/dist/chatgpt/simple-sidebar.d.ts

@@ -45,10 +45,10 @@ interface SidebarTextareaProps {
     onFocus?: () => void;
     onBlur?: () => void;
     placeholder?: string;
-    rows?: number;
+    maxRows?: number;
     error?: string;
 }
-export declare function SidebarTextarea({ value, onChange, onFocus, onBlur, placeholder, rows, error, }: SidebarTextareaProps): import("react/jsx-runtime").JSX.Element;
+export declare function SidebarTextarea({ value, onChange, onFocus, onBlur, placeholder, maxRows, error, }: SidebarTextareaProps): import("react/jsx-runtime").JSX.Element;
 interface SidebarToggleProps {
     value: string;
     onChange: (value: string) => void;

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const simulatorUrl = require("./simulator-url-CG8lAAC3.cjs");
+const simulatorUrl = require("./simulator-url-BpCa95pE.cjs");
 const React = require("react");
 const discovery = require("./discovery-a4WId9PC.cjs");
 function _interopNamespaceDefault(e) {
@@ -3054,6 +3054,7 @@ const prefersReducedMotion = createMediaQueryFn("(prefers-reduced-motion: reduce
 const isPrimarilyTouchDevice = createMediaQueryFn("(pointer: coarse)");
 const isHoverAvailable = createMediaQueryFn("(hover: hover)");
 exports.ChatGPTSimulator = simulatorUrl.ChatGPTSimulator;
+exports.IframeResource = simulatorUrl.IframeResource;
 exports.SCREEN_WIDTHS = simulatorUrl.SCREEN_WIDTHS;
 exports.ThemeProvider = simulatorUrl.ThemeProvider;
 exports.createSimulatorUrl = simulatorUrl.createSimulatorUrl;