@agent-native/core-corpus 0.214.0 → 0.217.0

package/corpus/templates/slides-2/actions/_linked-design-system.ts

@@ -0,0 +1,83 @@
+import { resolveAccess } from "@agent-native/core/sharing";
+import { eq } from "drizzle-orm";
+
+import { getDb, schema } from "../server/db/index.js";
+import { resolveDeckDesignSystemId } from "../shared/deck-content.js";
+
+export type DesignSystemRow = typeof schema.designSystems.$inferSelect;
+
+function deckDesignSystemId(deck: {
+  designSystemId?: string | null;
+  data?: string | null;
+}): string | null {
+  if (deck.designSystemId) return deck.designSystemId;
+  try {
+    return resolveDeckDesignSystemId(deck, JSON.parse(deck.data ?? "null"));
+  } catch {
+    // coercion-ok: an unparseable deck links no design system, so access stays denied.
+    return null;
+  }
+}
+
+/**
+ * A deck's linked design system, readable by anyone who can read the deck.
+ * Its colors and fonts reach every deck viewer anyway — share links snapshot
+ * them and slide HTML bakes them in — so withholding the row only renders the
+ * deck wrong. This grants rendering reads, never edit or reuse.
+ */
+export async function readDeckLinkedDesignSystem(
+  deck: { designSystemId?: string | null; data?: string | null },
+  designSystemId: string,
+): Promise<{ resource: DesignSystemRow; viaDeck: boolean } | null> {
+  const direct = await resolveAccess("design-system", designSystemId);
+  if (direct) {
+    return { resource: direct.resource as DesignSystemRow, viaDeck: false };
+  }
+  if (deckDesignSystemId(deck) !== designSystemId) return null;
+  // Callers resolved access to `deck`; the design system is reached only
+  // through that deck's own link.
+  const [row] = await getDb()
+    .select()
+    .from(schema.designSystems)
+    .where(eq(schema.designSystems.id, designSystemId))
+    .limit(1);
+  return row ? { resource: row, viaDeck: true } : null;
+}
+
+const RENDERING_KEYS = [
+  "colors",
+  "typography",
+  "spacing",
+  "borders",
+  "slideDefaults",
+  "logos",
+  "customCSS",
+] as const;
+
+/**
+ * Allowlists the design-system fields that affect how a deck renders, so
+ * notes, image-style guidance, and Builder proxy references never leave
+ * through deck-inherited access or public share snapshots. Returns null when
+ * the stored data is absent or not a JSON object.
+ */
+export function projectRenderingDesignSystemData(
+  raw: string | null | undefined,
+): string | null {
+  if (typeof raw !== "string") return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    // coercion-ok: unreadable style data renders as the default tokens.
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const source = parsed as Record<string, unknown>;
+  const projected: Record<string, unknown> = {};
+  for (const key of RENDERING_KEYS) {
+    if (source[key] !== undefined) projected[key] = source[key];
+  }
+  return JSON.stringify(projected);
+}

package/corpus/templates/slides-2/actions/_presenter-notes.ts

@@ -0,0 +1,83 @@
+import type { ShareRole } from "@agent-native/core/sharing";
+import * as t from "@babel/types";
+
+import { parseSource } from "../server/lib/slide-source-editing/babel-walk.js";
+import { hashSlideSource } from "../server/lib/slide-source.js";
+
+export type DeckReadAccessRole = "owner" | ShareRole;
+
+export function canReadPresenterNotes(role: DeckReadAccessRole): boolean {
+  return role === "owner" || role === "admin" || role === "editor";
+}
+
+export function redactPresenterNotes(slide: unknown): unknown {
+  if (!slide || typeof slide !== "object" || Array.isArray(slide)) {
+    return slide;
+  }
+  const { notes: _notes, ...visibleSlide } = slide as Record<string, unknown>;
+  if (typeof visibleSlide.sourceTsx === "string") {
+    const sourceTsx = stripPresenterNotesExport(visibleSlide.sourceTsx);
+    if (sourceTsx === null) {
+      delete visibleSlide.sourceTsx;
+      delete visibleSlide.sourceHash;
+    } else if (sourceTsx !== visibleSlide.sourceTsx) {
+      visibleSlide.sourceTsx = sourceTsx;
+      if (typeof visibleSlide.sourceHash === "string") {
+        visibleSlide.sourceHash = hashSlideSource(sourceTsx);
+      }
+    }
+  }
+  return visibleSlide;
+}
+
+function stripPresenterNotesExport(source: string): string | null {
+  if (!/\bnotes\b/.test(source)) return source;
+  const ast = parseSource(source);
+  if (!ast) return null;
+
+  const edits: Array<{ start: number; end: number; replacement: string }> = [];
+  for (const statement of ast.program.body) {
+    if (
+      !t.isExportNamedDeclaration(statement) ||
+      !t.isVariableDeclaration(statement.declaration)
+    ) {
+      continue;
+    }
+    const declaration = statement.declaration;
+    const remaining = declaration.declarations.filter(
+      (entry) => !t.isIdentifier(entry.id, { name: "notes" }),
+    );
+    if (remaining.length === declaration.declarations.length) continue;
+    if (statement.start == null || statement.end == null) return null;
+
+    if (remaining.length === 0) {
+      edits.push({
+        start: statement.start,
+        end: statement.end,
+        replacement: "",
+      });
+      continue;
+    }
+    if (declaration.start == null || declaration.end == null) return null;
+    if (remaining.some((entry) => entry.start == null || entry.end == null)) {
+      return null;
+    }
+    edits.push({
+      start: statement.start,
+      end: statement.end,
+      replacement: `${source.slice(statement.start, declaration.start)}${declaration.kind} ${remaining
+        .map((entry) => source.slice(entry.start ?? 0, entry.end ?? 0))
+        .join(", ")}${source.slice(declaration.end, statement.end)}`,
+    });
+  }
+  if (edits.length === 0) return source;
+
+  let redacted = source;
+  for (const edit of edits.sort((a, b) => b.start - a.start)) {
+    redacted =
+      redacted.slice(0, edit.start) +
+      edit.replacement +
+      redacted.slice(edit.end);
+  }
+  return parseSource(redacted) ? redacted : null;
+}

package/corpus/templates/slides-2/actions/_render-artifacts.ts

@@ -0,0 +1,111 @@
+import { fail } from "@agent-native/core/action";
+
+import {
+  renderArtifactGrowth,
+  SCOPED_STYLE_SELECTOR_MARKER,
+} from "../app/lib/slide-source-map.js";
+import { assertSlideInlineImagesPersistable } from "./_inline-image-storage.js";
+
+export function assertNoRenderArtifacts(
+  previousContent: string,
+  nextContent: string,
+  slideId: string,
+): void {
+  assertSlideInlineImagesPersistable(
+    { content: previousContent },
+    { content: nextContent },
+    slideId,
+  );
+  const markers = renderArtifactGrowth(previousContent, nextContent);
+  if (markers.length === 0) return;
+  fail(
+    `Slide ${slideId} content contains editor-rendered markup (${markers.join(", ")}). Write the slide's stored HTML, not the rendered editor DOM.`,
+    {
+      errorCode: "render_artifact_in_slide_content",
+      details: { slideId, markers },
+    },
+  );
+}
+
+/**
+ * The check for a slide with no stored predecessor (a new deck, a duplicate,
+ * an undo-restored slide), whose history the server cannot see. An exact copy
+ * of a slide the deck stores is a duplicate of stored content and passes as it
+ * is. Otherwise, older saves stored the scoped stylesheet's selectors in
+ * `<style>`, and the renderer heals them, so a copy of such a slide may carry
+ * them; every other marker, the scope attribute included, is refused.
+ */
+export function assertNoRenderArtifactsInNewSlide(
+  content: string,
+  slideId: string,
+  storedContents: readonly string[] = [],
+): void {
+  assertSlideInlineImagesPersistable({}, { content }, slideId);
+  if (storedContents.includes(content)) return;
+  const markers = renderArtifactGrowth("", content).filter(
+    (marker) => marker !== SCOPED_STYLE_SELECTOR_MARKER,
+  );
+  if (markers.length === 0) return;
+  fail(
+    `Slide ${slideId} content contains editor-rendered markup (${markers.join(", ")}). Write the slide's stored HTML, not the rendered editor DOM.`,
+    {
+      errorCode: "render_artifact_in_slide_content",
+      details: { slideId, markers },
+    },
+  );
+}
+
+export function assertNoDeckRenderArtifacts(
+  previousData: string | null | undefined,
+  nextDeck: { slides?: unknown },
+): void {
+  assertDeckInlineImagesPersistable(previousData, nextDeck);
+
+  const previousSlides = (
+    previousData
+      ? ((JSON.parse(previousData) as { slides?: unknown }).slides ?? [])
+      : []
+  ) as Array<Record<string, unknown>>;
+  const nextSlides = Array.isArray(nextDeck.slides)
+    ? (nextDeck.slides as Array<Record<string, unknown>>)
+    : [];
+  const storedContents = previousSlides
+    .map((slide) => slide.content)
+    .filter((content): content is string => typeof content === "string");
+  for (const slide of nextSlides) {
+    const prior = previousSlides.find((candidate) => candidate.id === slide.id);
+    if (typeof slide.content !== "string") continue;
+    if (prior) {
+      assertNoRenderArtifacts(
+        typeof prior.content === "string" ? prior.content : "",
+        slide.content,
+        String(slide.id),
+      );
+    } else {
+      assertNoRenderArtifactsInNewSlide(
+        slide.content,
+        String(slide.id),
+        storedContents,
+      );
+    }
+  }
+}
+
+export function assertDeckInlineImagesPersistable(
+  previousData: string | null | undefined,
+  nextDeck: { slides?: unknown },
+): void {
+  const previousSlides = (
+    previousData
+      ? ((JSON.parse(previousData) as { slides?: unknown }).slides ?? [])
+      : []
+  ) as Array<Record<string, unknown>>;
+  const nextSlides = Array.isArray(nextDeck.slides)
+    ? (nextDeck.slides as Array<Record<string, unknown>>)
+    : [];
+
+  for (const slide of nextSlides) {
+    const prior = previousSlides.find((candidate) => candidate.id === slide.id);
+    assertSlideInlineImagesPersistable(prior ?? {}, slide, String(slide.id));
+  }
+}

package/corpus/templates/slides-2/actions/_slide-source.ts

@@ -0,0 +1,344 @@
+import { z } from "zod";
+
+import {
+  hashSlideSource,
+  renderSlideSource,
+  resolveSlideAssets,
+  slideAssetOrigins,
+  SlideSourceError,
+} from "../server/lib/slide-source.js";
+import { prepareReactSlideSource } from "../server/lib/slide-worker-runtime.js";
+
+export const slideSourceEditOpSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("set-style"),
+    key: z.string().min(1).max(80),
+    value: z.string().max(2_000).nullable(),
+    prevText: z.string().max(10_000).optional(),
+  }),
+  z.object({
+    kind: z.literal("set-text"),
+    value: z.string().max(10_000),
+    prevText: z.string().max(10_000).optional(),
+  }),
+  z.object({
+    kind: z.literal("set-text-range-style"),
+    start: z.number().int().min(0),
+    end: z.number().int().min(0),
+    key: z.string().min(1).max(80),
+    value: z.string().max(2_000).nullable(),
+    prevText: z.string().max(10_000).optional(),
+  }),
+  z.object({
+    kind: z.literal("set-attr-asset"),
+    attr: z.literal("src"),
+    assetId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+  }),
+  z.object({
+    kind: z.literal("replace-placeholder-with-image"),
+    assetId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+  }),
+  z.object({
+    kind: z.literal("insert-image-asset"),
+    assetId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/),
+    alt: z.string().max(2_000),
+  }),
+]);
+
+export const slideSourceEditsSchema = z
+  .array(
+    z.object({
+      line: z.number().int().min(1),
+      column: z.number().int().min(0).optional().default(0),
+      ops: z.array(slideSourceEditOpSchema).min(1).max(32),
+      dependsOn: z.number().int().min(0).optional(),
+    }),
+  )
+  .min(1)
+  .max(256);
+
+export const BLANK_SLIDE_SOURCE =
+  'export default function Slide() { return <div style={{ width: "1920px", height: "1080px", boxSizing: "border-box" }} />; }';
+
+export function renderBlankSlideSource(): {
+  sourceTsx: string;
+  sourceHash: string;
+  revision: 1;
+  content: string;
+} {
+  return {
+    sourceTsx: BLANK_SLIDE_SOURCE,
+    sourceHash: hashSlideSource(BLANK_SLIDE_SOURCE),
+    revision: 1,
+    content: renderSlideSource(BLANK_SLIDE_SOURCE, new Map()),
+  };
+}
+
+export async function compileSlideSource(
+  sourceTsx: string,
+  scope: { ownerEmail: string; orgId?: string | null },
+): Promise<{
+  content: string;
+  sourceHash: string;
+  assetUrls: Map<string, string>;
+  assetOrigins: string[];
+}> {
+  prepareReactSlideSource(sourceTsx);
+  const assetUrls = await resolveSlideAssets(sourceTsx, scope);
+  let content: string;
+  try {
+    content = renderSlideSource(sourceTsx, assetUrls);
+  } catch (error) {
+    if (
+      error instanceof SlideSourceError &&
+      error.message ===
+        "Slide source cannot import modules or execute top-level code."
+    ) {
+      content = "";
+    } else {
+      throw error;
+    }
+  }
+  return {
+    content,
+    sourceHash: hashSlideSource(sourceTsx),
+    assetUrls,
+    assetOrigins: slideAssetOrigins(assetUrls.values()),
+  };
+}
+
+export function slideSourceFailure(
+  message: string,
+  statusCode: number,
+  errorCode: string,
+  details?: Record<string, unknown>,
+): Error {
+  return Object.assign(new Error(message), {
+    statusCode,
+    errorCode,
+    ...(details ? { details } : {}),
+  });
+}
+
+export function readStoredSlideSource(
+  rawData: string,
+  slideId: string,
+): {
+  data: Record<string, unknown>;
+  slide: Record<string, unknown> & { sourceTsx: string };
+  position: number;
+  revision: number;
+  sourceHash: string;
+} {
+  let data: unknown;
+  try {
+    data = JSON.parse(rawData);
+  } catch {
+    throw slideSourceFailure(
+      "Deck data is not valid JSON.",
+      500,
+      "invalid_deck_data",
+    );
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw slideSourceFailure(
+      "Deck data has an invalid shape.",
+      500,
+      "invalid_deck_data",
+    );
+  }
+  const record = data as Record<string, unknown>;
+  if (!Array.isArray(record.slides)) {
+    throw slideSourceFailure(
+      "Deck has no slide list.",
+      500,
+      "invalid_deck_data",
+    );
+  }
+  const matchingPositions: number[] = [];
+  for (const [index, slide] of record.slides.entries()) {
+    if (
+      slide &&
+      typeof slide === "object" &&
+      !Array.isArray(slide) &&
+      (slide as Record<string, unknown>).id === slideId
+    ) {
+      matchingPositions.push(index);
+    }
+  }
+  if (matchingPositions.length > 1) {
+    throw slideSourceFailure(
+      "Deck contains duplicate slide IDs.",
+      409,
+      "duplicate_deck_slide_ids",
+      { slideId },
+    );
+  }
+  const position = matchingPositions[0] ?? -1;
+  if (position < 0) {
+    throw slideSourceFailure(
+      `Slide not found: ${slideId}`,
+      404,
+      "slide_not_found",
+    );
+  }
+  const rawSlide = record.slides[position];
+  if (!rawSlide || typeof rawSlide !== "object" || Array.isArray(rawSlide)) {
+    throw slideSourceFailure(
+      "Slide data has an invalid shape.",
+      500,
+      "invalid_slide_data",
+    );
+  }
+  const slide = rawSlide as Record<string, unknown>;
+  if (typeof slide.sourceTsx !== "string" || !slide.sourceTsx.trim()) {
+    throw slideSourceFailure(
+      "This slide does not contain React source yet.",
+      409,
+      "slide_source_missing",
+    );
+  }
+  const sourceHash = hashSlideSource(slide.sourceTsx);
+  const hasRevision = Object.hasOwn(slide, "revision");
+  const hasSourceHash = Object.hasOwn(slide, "sourceHash");
+  if (hasRevision !== hasSourceHash) {
+    throw slideSourceFailure(
+      "Stored slide source metadata is incomplete.",
+      409,
+      "slide_source_integrity_error",
+    );
+  }
+  const revision = hasRevision ? slide.revision : 1;
+  if (
+    hasRevision &&
+    (!Number.isSafeInteger(revision) || Number(revision) < 1)
+  ) {
+    throw slideSourceFailure(
+      "Stored slide source revision is invalid.",
+      409,
+      "slide_source_integrity_error",
+    );
+  }
+  if (hasSourceHash && slide.sourceHash !== sourceHash) {
+    throw slideSourceFailure(
+      "Stored slide source hash does not match its source.",
+      409,
+      "slide_source_integrity_error",
+    );
+  }
+  return {
+    data: record,
+    slide: slide as Record<string, unknown> & { sourceTsx: string },
+    position,
+    revision: Number(revision),
+    sourceHash,
+  };
+}
+
+export function assertSourceBackedSlidesUnchanged(
+  previousData: unknown,
+  nextData: unknown,
+  validatedNewSlideIds: Iterable<string> = [],
+): void {
+  const previousSlides = slidesFromDeckData(previousData);
+  const nextSlides = slidesFromDeckData(nextData);
+  const nextById = new Map(
+    nextSlides.flatMap((slide) =>
+      typeof slide.id === "string" ? [[slide.id, slide] as const] : [],
+    ),
+  );
+  const previousIds = new Set(
+    previousSlides.flatMap((slide) =>
+      typeof slide.id === "string" ? [slide.id] : [],
+    ),
+  );
+  const validatedIds = new Set(validatedNewSlideIds);
+
+  for (const previous of previousSlides) {
+    if (
+      typeof previous.id !== "string" ||
+      typeof previous.sourceTsx !== "string"
+    ) {
+      continue;
+    }
+    const next = nextById.get(previous.id);
+    if (!next) continue;
+    for (const field of [
+      "sourceTsx",
+      "sourceHash",
+      "revision",
+      "content",
+    ] as const) {
+      if (
+        Object.hasOwn(previous, field) !== Object.hasOwn(next, field) ||
+        previous[field] !== next[field]
+      ) {
+        throw slideSourceFailure(
+          "This slide is backed by React source. Edit it with update-slide-source so source and preview stay in sync.",
+          409,
+          "slide_source_action_required",
+          { slideId: previous.id, action: "update-slide-source" },
+        );
+      }
+    }
+  }
+
+  for (const next of nextSlides) {
+    if (typeof next.id !== "string" || typeof next.sourceTsx !== "string") {
+      continue;
+    }
+    const priorWithId = previousSlides.find(
+      (previous) => previous.id === next.id,
+    );
+    if (priorWithId && typeof priorWithId.sourceTsx !== "string") {
+      throw slideSourceFailure(
+        "React source can only be added through create-deck or add-slide so it is validated before storage.",
+        409,
+        "slide_source_action_required",
+        { slideId: next.id, actions: ["create-deck", "add-slide"] },
+      );
+    }
+    if (priorWithId) continue;
+    if (validatedIds.has(next.id)) continue;
+    if (previousIds.has(next.id)) continue;
+    const copiedSource = previousSlides.find(
+      (previous) =>
+        typeof previous.sourceTsx === "string" &&
+        previous.sourceTsx === next.sourceTsx &&
+        previous.sourceHash === next.sourceHash &&
+        previous.revision === next.revision &&
+        previous.content === next.content,
+    );
+    if (!copiedSource) {
+      throw slideSourceFailure(
+        "New React slide source must be validated by create-deck or add-slide.",
+        409,
+        "slide_source_action_required",
+        { slideId: next.id, actions: ["create-deck", "add-slide"] },
+      );
+    }
+  }
+}
+
+function slidesFromDeckData(value: unknown): Array<Record<string, unknown>> {
+  let data = value;
+  if (typeof value === "string") {
+    try {
+      data = JSON.parse(value);
+    } catch {
+      throw slideSourceFailure(
+        "Deck data is not valid JSON.",
+        500,
+        "invalid_deck_data",
+      );
+    }
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) return [];
+  const slides = (data as Record<string, unknown>).slides;
+  return Array.isArray(slides)
+    ? slides.filter(
+        (slide): slide is Record<string, unknown> =>
+          !!slide && typeof slide === "object" && !Array.isArray(slide),
+      )
+    : [];
+}

package/corpus/templates/slides-2/actions/_tab-state.ts

@@ -0,0 +1,51 @@
+import {
+  readAppState,
+  writeAppState,
+  compareAndSetAppState,
+} from "@agent-native/core/application-state";
+import { getRequestRunContext } from "@agent-native/core/server/request-context";
+
+import {
+  appStateKeyForBrowserTab,
+  normalizeBrowserTabId,
+} from "../shared/app-state-tabs.js";
+
+export function getCurrentRequestBrowserTabId(): string | null {
+  return normalizeBrowserTabId(getRequestRunContext()?.browserTabId);
+}
+
+export function appStateKeyForCurrentTab(key: string): string {
+  return appStateKeyForBrowserTab(key, getCurrentRequestBrowserTabId());
+}
+
+export async function readAppStateForCurrentTab(
+  key: string,
+  options?: { fallbackToGlobal?: boolean },
+): Promise<Record<string, unknown> | null> {
+  const tabKey = appStateKeyForCurrentTab(key);
+  if (tabKey !== key) {
+    const scoped = await readAppState(tabKey);
+    if (scoped) return scoped;
+    if (options?.fallbackToGlobal !== true) return null;
+  }
+  return readAppState(key);
+}
+
+export async function writeAppStateForCurrentTab(
+  key: string,
+  value: Record<string, unknown>,
+): Promise<void> {
+  await writeAppState(appStateKeyForCurrentTab(key), value);
+}
+
+export async function compareAndSetAppStateForCurrentTab(
+  key: string,
+  expectedValue: Record<string, unknown> | null,
+  nextValue: Record<string, unknown> | null,
+): Promise<boolean> {
+  return compareAndSetAppState(
+    appStateKeyForCurrentTab(key),
+    expectedValue,
+    nextValue,
+  );
+}

package/corpus/templates/slides-2/actions/_test-brandfetch.ts

@@ -0,0 +1,31 @@
+const domain = "zapier.com";
+const formats = ["/logo", "/theme/dark/logo", "", "/icon", "/symbol"];
+
+async function test() {
+  for (const fmt of formats) {
+    try {
+      const url = "https://cdn.brandfetch.io/" + domain + fmt;
+      const res = await fetch(url, {
+        method: "GET",
+        redirect: "follow",
+        headers: {
+          Accept: "image/webp,image/apng,image/*,*/*;q=0.8",
+          "User-Agent": "Mozilla/5.0",
+        },
+      });
+      const ct = res.headers.get("content-type") || "null";
+      const isImage = ct.startsWith("image/");
+      const body = await res.arrayBuffer();
+      console.log(
+        (fmt || "/").padEnd(25),
+        res.status,
+        ct.padEnd(25),
+        isImage ? "IMAGE" : "NOT-IMAGE",
+        body.byteLength + "b",
+      );
+    } catch (e: any) {
+      console.log((fmt || "/").padEnd(25), "ERR", e.message);
+    }
+  }
+}
+void test();