Host Sandpack bundler at sandpack.modulora.dev (isolated origin)

[jal-co]

The live preview uses the Sandpack bundler, which must run on a separate origin from modulora.dev because it executes untrusted author code (the origin boundary is the security line — same reason previews are cross-origin).

Task

• Vendor a pinned commit of codesandbox/sandpack-bundler (Apache-2.0) in infra; build dist/ in CI (~5s).
• Deploy as an assets-only Cloudflare Worker at sandpack.modulora.dev (ships a _headers file).
• Point VITE_SANDPACK_BUNDLER_URL at it for prod builds. Dev already runs a local build on :4587.
• Version-pin bundlerURL + sandpack-react together so upgrades are deliberate.

Why self-hosted

The codesandbox.io-hosted bundler's handshake is blocked on some networks (telemetry timeouts) and is a third-party runtime dependency. Self-hosting removes csbops.io telemetry from authors' browsers and keeps previews working if codesandbox.io is down.

Area: Cloud

[jal-co]

Config prepped (not deployed): assets-only worker in modulora-infra/workers/sandpack — pinned build.sh (codesandbox/sandpack-bundler @ a323f46), wrangler.jsonc on the isolated sandpack.modulora.dev origin, README. App wiring done: VITE_SANDPACK_BUNDLER_URL documented (dev :4587 / prod sandpack.modulora.dev). Remaining: run build.sh + wrangler deploy + set the DNS custom domain.

[jal-co]

Audit update: application-side bundler configuration is present, but sandpack.modulora.dev did not resolve during this audit and production-origin isolation could not be verified. Keep open until the infra deployment, pinned assets, headers, and production availability are evidenced.