[AI-8410] Feature: Host apps can load Angie sidebar with v2 config — host API bridge

[matipojo]

Summary

Stacked PR 3/3 for AI-8410: Feature: Host apps can load Angie sidebar with v2 config.

Adds the host API bridge and getExternalHeaders callback wiring for embedded iframe API calls. Completes the split of the original monolithic branch; diff vs AI-8410-load-sidebar-v2 is bridge-only on top of #44.

Jira

https://elementor.atlassian.net/browse/AI-8410

Test plan

• npm test
• npm run lint
• Verify host bridge / external headers in a host app

✨ PR Description

1. Problem & Context

Hosts need bidirectional communication with embedded Angie sidebar to provide external headers, website context, and analytics data. This PR establishes a postMessage-based API bridge enabling the iframe to request host-side information with origin validation.

2. What Changed (Where)

• host-api-bridge.ts (new): Message handler for GET_EXTERNAL_HEADERS, website/analytics context, and localStorage operations with origin gating
• config.ts: Added ExternalHeadersCallback type and analytics field to HostConfig; wired getExternalHeaders through CallbacksConfig
• boot-sidebar.ts: Initialize bridge before rendering with iframe origin and callbacks
• resolve-config.ts: Pass getExternalHeaders callback through config resolution pipeline
• Tests & exports: Added comprehensive bridge tests (237 lines), mocked in boot tests, exported new type

3. How It Works

Boot initiates bridge with iframe origin and callback reference → iframe sends MessageEvent with transferable port → bridge validates origin → routes to handler (headers/context/storage) → callback executes if provided → response posted back on port. Undefined headers filtered before sending; errors caught and reported as error payloads.

4. Risks

Origin spoofing: Mitigated by explicit origin check against configured iframe origin. Callback exceptions: Wrapped in try-catch with error reporting. localStorage failures: Gracefully degrade in private browsing mode. No cleanup: bridgeListenerRegistered prevents duplicate listeners but lacks explicit teardown—acceptable for single-boot lifecycle.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[wiz-9a149474ff]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.