@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/node-definition-sanitizer.js

@@ -0,0 +1,402 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The node-definition sanitizer and the component allowlists (AGL-2939):
+ * what a node tree must satisfy before it lands on a canvas that did not
+ * author it — a marketplace install, and a tree a model generated. Core
+ * rather than the marketplace plugin, because two plugins pass their trees
+ * through it and a plugin may not import another plugin's model; the
+ * marketplace re-exports it under the names its publishers use.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { matchComponentPropToken } from "./compose-reusable-components.js";
+import { isSafeNodeUrl, SAFE_SRC_PATTERN } from "./node-url-policy.js";
+import { SAFE_HREF_PATTERN } from "./screen-link-value.js";
+/**
+ * Component ids publishable to the marketplace. Mirrors the persisted ids in
+ * plugins-mui (plugin.spec.ts) minus `reusableInstance` — nested
+ * instances would smuggle references to another tenant's private
+ * definitions — and minus `layoutSlot`, which is layout chrome. Keep sorted.
+ *
+ * The rule this list encodes is "inert and self-contained": an element that
+ * renders from its own props travels to another workspace intact. What stays
+ * out is what cannot — raw-HTML escape hatches (`customHtml`), references to
+ * another tenant's documents (`reusableInstance`), third-party code
+ * (`plugin`), host chrome (`layoutSlot`) and anything bound to the source
+ * site's data (`collection`, `product`).
+ *
+ * It must cover everything the besigner's palette offers under those terms, or
+ * the catalogue promises what the exporter refuses — which is how `section`
+ * came to be missing (AGL-1033): every Sections & Blocks preset composes it,
+ * so the whole category was unpublishable. `blocks-publishable.spec.ts` walks
+ * the presets and fails if this list falls behind them again.
+ */ export const MARKETPLACE_COMPONENT_ID_ALLOWLIST = [
+    'form',
+    'formField',
+    'image',
+    'muiAppBar',
+    'muiButton',
+    'muiContainer',
+    'muiList',
+    'muiListItem',
+    'muiListItemText',
+    'muiScreenLink',
+    'muiStack',
+    'muiToolbar',
+    'muiTypography',
+    'searchBox',
+    // A semantic wrapper — `<section>`/`<footer>`/`<nav>` plus styling, with no
+    // behaviour and no binding to the site it came from.
+    'section',
+    'socialLinks',
+    'videoEmbed'
+];
+/**
+ * Email block ids publishable as an `emailTemplate` (AGL-657).
+ *
+ * A separate list from the page allowlist because the two vocabularies don't
+ * overlap — an email design is built entirely from `plugins-email` blocks, and
+ * page components (MUI, forms, video) don't survive an email client anyway.
+ *
+ * `emailHtml` is excluded deliberately, for the same reason `reusableInstance`
+ * is excluded above: it is a raw-HTML escape hatch, and a published template
+ * lands in another org's OUTGOING CUSTOMER EMAIL. Email clients don't run
+ * scripts, so this isn't XSS — it's that arbitrary markup sent from someone
+ * else's domain is a phishing and tracking-pixel vector that no amount of
+ * render-time sanitization makes reviewable. Keep sorted.
+ */ export const MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST = [
+    'emailButton',
+    'emailDivider',
+    'emailImage',
+    'emailProduct',
+    'emailRichtext',
+    'emailSection',
+    'emailSpacer',
+    'emailText'
+];
+/**
+ * Email block ids publishable as an `emailStarter` — the transactional list
+ * minus `emailRichtext`.
+ *
+ * Derived rather than written out, so a block added to the list above cannot
+ * silently miss this one. What it subtracts is the reason it exists.
+ *
+ * `emailRichtext` holds its content in an `html` prop, and the email renderer's
+ * `sanitize` hook defaults to identity with no production caller supplying one
+ * — so that prop reaches the recipient's inbox exactly as authored. On a
+ * transactional design that is the site's own author writing their own mail. In
+ * a STARTER it is a stranger's markup mailed from the shared sending domain
+ * under the tenant's From header, which is the raw-HTML escape hatch
+ * `emailHtml` was excluded for, wearing a friendlier block name. A remote
+ * `<img>` inside it is a tracking pixel that the src policy on `emailImage`
+ * would otherwise have caught.
+ *
+ * Subtracting the block is deliberate rather than sanitizing its markup: an
+ * allowlist over someone else's HTML is a judgment we would have to keep
+ * re-making, and everything rich text can express in an email — a heading, a
+ * paragraph, a link, a button — the remaining blocks already express as a
+ * structured tree we render ourselves.
+ */ export const MARKETPLACE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST = MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST.filter((componentId)=>componentId !== 'emailRichtext');
+/** Serialized definition size cap (Firestore doc limit is 1 MiB). */ export const MARKETPLACE_DEFINITION_MAX_BYTES = 200 * 1024;
+const KEPT_NODE_KEYS = [
+    '$id',
+    'componentId',
+    'pluginId',
+    'parentId',
+    'props',
+    'nodes'
+];
+/**
+ * The address rules a published node's `href` and `src` meet — the linking
+ * elements' navigable protocols, and https, inline or site-relative images
+ * (see `node-url-policy`).
+ *
+ * Exported under these names for the marketplace's property sanitizer, which
+ * holds a published property's Link default to the same rule as a published
+ * node's `href`, and an Image default to the `src` rule.
+ */ export { SAFE_HREF_PATTERN as MARKETPLACE_SAFE_HREF, SAFE_SRC_PATTERN as MARKETPLACE_SAFE_SRC,  };
+/**
+ * The property kind whose value may fill each address prop through a binding
+ * (AGL-2933): a Link feeds an `href`, an Image a `src`. Each kind's default is
+ * held to that prop's own rule wherever a declaration is published, so the
+ * binding carries nothing a literal in the same place could not.
+ */ const URL_PROP_KIND = {
+    href: 'href',
+    src: 'image'
+};
+/**
+ * Declared property names by the address prop their kind may fill — the
+ * index {@link sanitizePublishedNodeProps} reads a binding against.
+ */ function urlBindingsOf(declaredProps) {
+    const bindings = new Map();
+    for (const prop of declaredProps != null ? declaredProps : []){
+        if (typeof (prop == null ? void 0 : prop.name) !== 'string' || !prop.name) continue;
+        if (prop.type === URL_PROP_KIND.href) bindings.set(prop.name, 'href');
+        else if (prop.type === URL_PROP_KIND.src) bindings.set(prop.name, 'src');
+    }
+    return bindings;
+}
+/**
+ * Strips props a published node must never carry into someone else's site
+ * (AGL-784).
+ *
+ * `Leaf` spreads a node's props straight onto the rendered component, and MUI
+ * passes unknown props through to its root DOM element, so whatever survives
+ * publishing reaches the DOM of every org that installs the listing. Marketplace
+ * components are auto-listed with no review, and `hosts/{h}/components` is
+ * writable by any org member, so a hand-crafted doc is a realistic input here.
+ *
+ * What each stripped key actually does, measured rather than assumed:
+ * - `dangerouslySetInnerHTML` is NOT the stored-XSS it looks like — `Leaf`
+ *   always passes a children array, so React throws
+ *   "Can only set one of `children` or `props.dangerouslySetInnerHTML`"
+ *   (and the void-element variant for self-closing components like `image`).
+ *   That is worse in practice than it sounds: the throw happens during SSR,
+ *   which is the AGL-579 failure mode that 500s the page and wedges ISR for
+ *   the whole site. One published component would take down every consumer.
+ * - `on*` handlers can only survive JSON as strings, which React drops with a
+ *   warning. Removed for hygiene, and so a future renderer that does eval-ish
+ *   prop handling can't turn them back into a vector.
+ * - `href`/`src` get the render-time URL policy applied at publish time too.
+ *   React already neutralizes `javascript:` hrefs and the mui components run
+ *   SAFE_HREF themselves, so this is defense in depth for any component that
+ *   forgets to — cheap, and it keeps the stored artifact honest.
+ * - An `href`/`src` that is exactly one `{{prop.*}}` token naming a declared
+ *   property of the kind that holds that address — a Link for `href`, an
+ *   Image for `src` — is kept as the binding it is (AGL-2933). The token is no
+ *   address, so the rule above would refuse it, and every link and image a
+ *   component's properties feed would arrive unbound. What it becomes is held
+ *   to the same rule twice over: the property's default where the declaration
+ *   is published, and whatever value a page sets where the graft substitutes
+ *   it (`resolveComponentPropTokens`). A token that is only part of the value,
+ *   or names a property of another kind or none, is refused as before.
+ *
+ * Deliberately shallow: only top-level props are spread onto the DOM. A nested
+ * object (`icon: { path }`) is consumed by the component, never spread, so
+ * recursing would strip legitimate data for no security gain.
+ */ function sanitizePublishedNodeProps(props, urlBindings) {
+    const safe = {};
+    for (const [key, value] of Object.entries(props)){
+        if (key === 'dangerouslySetInnerHTML') continue;
+        if (/^on[A-Z]/.test(key)) continue;
+        if ((key === 'href' || key === 'src') && typeof value === 'string') {
+            const trimmed = value.trim();
+            const bound = matchComponentPropToken(trimmed);
+            const keep = isSafeNodeUrl(key, trimmed) || bound !== null && urlBindings.get(bound) === key;
+            if (keep) safe[key] = trimmed;
+            continue;
+        }
+        safe[key] = value;
+    }
+    return safe;
+}
+/**
+ * `nodes` that is still in one of its STORAGE forms rather than a node map
+ * (AGL-1395).
+ *
+ * The two forms `decodeStoredNodes` knows about, tested structurally so this
+ * stays a model function with no server import: a byte view — what
+ * firebase-admin hands back for a `Bytes` field — and the `{type, data}`
+ * envelope `JSON.stringify` makes of a Node `Buffer`, which is what a
+ * site-export bundle carries. Neither is a map, and neither is anything the
+ * publisher did.
+ *
+ * The envelope test is deliberately exact, for the reason `decodeStoredNodes`
+ * spells out: the alternative reading is a node map with nodes called `type`
+ * and `data`, which cannot exist because node-map values are objects.
+ */ function isUndecodedNodes(nodes) {
+    if (ArrayBuffer.isView(nodes)) return true;
+    if (typeof nodes !== 'object' || nodes === null || Array.isArray(nodes)) {
+        return false;
+    }
+    const value = nodes;
+    return value.type === 'Buffer' && Array.isArray(value.data) && Object.keys(value).length === 2;
+}
+/**
+ * Validates and strips a host component definition for publishing:
+ * - only allowlisted component ids (no reusable instances, no layout chrome)
+ * - only the persisted node keys (drops runtime fields like resolvedProps)
+ * - the subtree reachable from `rootId` only, and a serialized size cap
+ *
+ * - per-node prop hardening (see `sanitizePublishedNodeProps`, AGL-784)
+ *
+ * XSS note: rich-text `html` props stay as-authored here — they are sanitized
+ * at render time (sanitize-rich-text allowlist), which also covers definitions
+ * written to Firestore directly (see docs/SECURITY_CONTENT_REVIEW.md). Props
+ * that are spread onto the DOM (`dangerouslySetInnerHTML`, `on*`, `href`,
+ * `src`) are hardened HERE as well, because publishing hands them to a
+ * different org's render tree.
+ */ export function sanitizeMarketplaceDefinition(definition, options) {
+    var _ref;
+    var _options_extraComponentIds;
+    const { rootId, nodes } = definition;
+    const base = (_ref = options == null ? void 0 : options.componentIds) != null ? _ref : MARKETPLACE_COMPONENT_ID_ALLOWLIST;
+    const allowed = (options == null ? void 0 : (_options_extraComponentIds = options.extraComponentIds) == null ? void 0 : _options_extraComponentIds.length) ? [
+        ...base,
+        ...options.extraComponentIds
+    ] : base;
+    const urlBindings = urlBindingsOf(options == null ? void 0 : options.declaredProps);
+    // An UNDECODED `nodes` is never the author's fault, so it must not share a
+    // message with a genuinely rootless definition (AGL-1395). Both undecoded
+    // forms — a Node `Buffer` from the Admin SDK, and the `{type:'Buffer'}`
+    // envelope `JSON.stringify` makes of one — reach the root check below as
+    // something with no `_@_` in it, and the answer was "Definition has no root
+    // node": a sentence that sends the publisher to redesign a page that is
+    // fine. Callers must run `decodeStoredNodes` first; this says so out loud
+    // rather than letting the next raw read look like a content problem.
+    if (isUndecodedNodes(nodes)) {
+        return {
+            ok: false,
+            error: 'This content could not be read — it is stored compressed and was ' + 'not decoded before publishing. That is a bug on our side, not a ' + 'problem with your design.'
+        };
+    }
+    if (!rootId || !(nodes == null ? void 0 : nodes[rootId])) {
+        return {
+            ok: false,
+            error: 'Definition has no root node'
+        };
+    }
+    const sanitized = {};
+    /** Set while walking; see the empty-definition check after the loop. */ let rootIsWrapper = false;
+    const queue = [
+        rootId
+    ];
+    while(queue.length){
+        var _node_parentId;
+        const id = queue.shift();
+        if (sanitized[id]) continue;
+        const node = nodes[id];
+        if (!node) return {
+            ok: false,
+            error: `Missing node "${id}"`
+        };
+        // The root node is the virtual root-collection wrapper (canvas
+        // `NODE_ROOT_ID` = `_@_`): it declares "everything inside <body>" for
+        // drag/drop mapping, not a rendered component, so a `div`/absent
+        // componentId there is structural — not a real component to allowlist
+        // (AGL-783). Exempt ONLY that wrapper shape; a root carrying a real
+        // component id is still checked, so a disallowed component can't be
+        // smuggled in as the root. Every descendant is real content and always
+        // checked below.
+        const isRootWrapper = id === rootId && (node.componentId == null || node.componentId === '' || node.componentId === 'div');
+        if (!isRootWrapper && !allowed.includes(node.componentId)) {
+            return {
+                ok: false,
+                // Says why, not just no (AGL-1033). The bare id was doubly unhelpful:
+                // it is not what the palette calls the element, and it left the author
+                // guessing whether this was a bug or a rule.
+                error: `Component "${node.componentId}" cannot be published — a listing may ` + 'only contain self-contained presentational elements. Raw HTML, ' + 'reusable-component references, plugin elements and anything bound ' + "to this site's data or layout stay behind."
+            };
+        }
+        const plain = {};
+        for (const key of KEPT_NODE_KEYS){
+            if (node[key] !== undefined) plain[key] = node[key];
+        }
+        // Per-node prop hardening (AGL-784) — see sanitizePublishedNodeProps.
+        if (plain.props && typeof plain.props === 'object') {
+            plain.props = sanitizePublishedNodeProps(plain.props, urlBindings);
+        }
+        plain.$id = id;
+        plain.parentId = id === rootId ? null : (_node_parentId = node.parentId) != null ? _node_parentId : null;
+        // Give the wrapper an explicit container id so the installed definition
+        // renders its root collection the same way it did on the source site.
+        if (isRootWrapper) {
+            plain.componentId = 'div';
+            rootIsWrapper = true;
+        }
+        sanitized[id] = plain;
+        if (Array.isArray(node.nodes)) queue.push(...node.nodes);
+    }
+    let serialized;
+    try {
+        serialized = JSON.stringify(sanitized);
+    } catch (unused) {
+        return {
+            ok: false,
+            error: 'Definition is not serializable'
+        };
+    }
+    if (serialized.length > MARKETPLACE_DEFINITION_MAX_BYTES) {
+        return {
+            ok: false,
+            error: 'Definition is too large to publish'
+        };
+    }
+    // An empty definition is not a listing (AGL-1033). Publishing one used to
+    // SUCCEED — the root wrapper alone sanitizes cleanly — so a component whose
+    // content had never been published to its document shipped a blank version
+    // to everyone who installed it, and said nothing. Refusing here is the
+    // "fail loudly at the point the author understands it" half.
+    //
+    // Only the WRAPPER case: a definition that is a single real component is a
+    // perfectly good one-element listing, and refusing that would be a different
+    // bug in the other direction.
+    if (rootIsWrapper && Object.keys(sanitized).length <= 1) {
+        return {
+            ok: false,
+            error: 'There is nothing to publish — this is empty. If you have edited it ' + 'in the designer, publish those changes first, then publish the listing.'
+        };
+    }
+    return {
+        ok: true,
+        rootId,
+        nodes: sanitized
+    };
+}
+/**
+ * Converts a sanitized marketplace/AI definition (normalized map) into the
+ * nested node shape `canvas.addNodeFromPreset` grafts — ids regenerate on
+ * insert, so collisions with existing canvas nodes are impossible
+ * (AGL-169). A seen-set guards malformed self-referencing trees.
+ */ export function marketplaceDefinitionToNested(rootId, nodes) {
+    const seen = new Set();
+    const build = (id)=>{
+        var _node_nodes;
+        const node = nodes[id];
+        if (!node || seen.has(id)) return null;
+        seen.add(id);
+        return _extends({
+            componentId: node.componentId
+        }, node.pluginId ? {
+            pluginId: node.pluginId
+        } : {}, node.props ? {
+            props: node.props
+        } : {}, {
+            nodes: ((_node_nodes = node.nodes) != null ? _node_nodes : []).map(build).filter((child)=>Boolean(child))
+        });
+    };
+    return build(rootId);
+}
+/**
+ * Field types a published dataset schema may declare (AGL-657). Mirrors
+ * `DATASET_FIELD_TYPES` in core; duplicated rather than imported to keep this
+ * module dependency-free (it is imported by API routes and client components
+ * alike), and asserted against the source of truth in the spec.
+ */ export const MARKETPLACE_DATASET_FIELD_TYPES = [
+    'bool',
+    'bytes',
+    'coordinates',
+    'float',
+    'int32',
+    'int64',
+    'map',
+    'nil',
+    'reference',
+    'sorted',
+    'text',
+    'timestamp'
+];
+
+//# sourceMappingURL=node-definition-sanitizer.js.map

package/src/lib/app-utils/node-definition-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/node-definition-sanitizer.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The node-definition sanitizer and the component allowlists (AGL-2939):\n * what a node tree must satisfy before it lands on a canvas that did not\n * author it — a marketplace install, and a tree a model generated. Core\n * rather than the marketplace plugin, because two plugins pass their trees\n * through it and a plugin may not import another plugin's model; the\n * marketplace re-exports it under the names its publishers use.\n */\n\nimport { isFirstPartyMediaSrc } from './media-ref'\nimport { matchComponentPropToken } from './compose-reusable-components'\nimport {\n  isSafeNodeUrl,\n  type NodeUrlProp,\n  SAFE_SRC_PATTERN,\n} from './node-url-policy'\nimport { SAFE_HREF_PATTERN } from './screen-link-value'\n\n/**\n * Component ids publishable to the marketplace. Mirrors the persisted ids in\n * plugins-mui (plugin.spec.ts) minus `reusableInstance` — nested\n * instances would smuggle references to another tenant's private\n * definitions — and minus `layoutSlot`, which is layout chrome. Keep sorted.\n *\n * The rule this list encodes is \"inert and self-contained\": an element that\n * renders from its own props travels to another workspace intact. What stays\n * out is what cannot — raw-HTML escape hatches (`customHtml`), references to\n * another tenant's documents (`reusableInstance`), third-party code\n * (`plugin`), host chrome (`layoutSlot`) and anything bound to the source\n * site's data (`collection`, `product`).\n *\n * It must cover everything the besigner's palette offers under those terms, or\n * the catalogue promises what the exporter refuses — which is how `section`\n * came to be missing (AGL-1033): every Sections & Blocks preset composes it,\n * so the whole category was unpublishable. `blocks-publishable.spec.ts` walks\n * the presets and fails if this list falls behind them again.\n */\nexport const MARKETPLACE_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'form',\n  'formField',\n  'image',\n  'muiAppBar',\n  'muiButton',\n  'muiContainer',\n  'muiList',\n  'muiListItem',\n  'muiListItemText',\n  'muiScreenLink',\n  'muiStack',\n  'muiToolbar',\n  'muiTypography',\n  'searchBox',\n  // A semantic wrapper — `<section>`/`<footer>`/`<nav>` plus styling, with no\n  // behaviour and no binding to the site it came from.\n  'section',\n  'socialLinks',\n  'videoEmbed',\n]\n\n/**\n * Email block ids publishable as an `emailTemplate` (AGL-657).\n *\n * A separate list from the page allowlist because the two vocabularies don't\n * overlap — an email design is built entirely from `plugins-email` blocks, and\n * page components (MUI, forms, video) don't survive an email client anyway.\n *\n * `emailHtml` is excluded deliberately, for the same reason `reusableInstance`\n * is excluded above: it is a raw-HTML escape hatch, and a published template\n * lands in another org's OUTGOING CUSTOMER EMAIL. Email clients don't run\n * scripts, so this isn't XSS — it's that arbitrary markup sent from someone\n * else's domain is a phishing and tracking-pixel vector that no amount of\n * render-time sanitization makes reviewable. Keep sorted.\n */\nexport const MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'emailButton',\n  'emailDivider',\n  'emailImage',\n  'emailProduct',\n  'emailRichtext',\n  'emailSection',\n  'emailSpacer',\n  'emailText',\n]\n\n/**\n * Email block ids publishable as an `emailStarter` — the transactional list\n * minus `emailRichtext`.\n *\n * Derived rather than written out, so a block added to the list above cannot\n * silently miss this one. What it subtracts is the reason it exists.\n *\n * `emailRichtext` holds its content in an `html` prop, and the email renderer's\n * `sanitize` hook defaults to identity with no production caller supplying one\n * — so that prop reaches the recipient's inbox exactly as authored. On a\n * transactional design that is the site's own author writing their own mail. In\n * a STARTER it is a stranger's markup mailed from the shared sending domain\n * under the tenant's From header, which is the raw-HTML escape hatch\n * `emailHtml` was excluded for, wearing a friendlier block name. A remote\n * `<img>` inside it is a tracking pixel that the src policy on `emailImage`\n * would otherwise have caught.\n *\n * Subtracting the block is deliberate rather than sanitizing its markup: an\n * allowlist over someone else's HTML is a judgment we would have to keep\n * re-making, and everything rich text can express in an email — a heading, a\n * paragraph, a link, a button — the remaining blocks already express as a\n * structured tree we render ourselves.\n */\nexport const MARKETPLACE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST: readonly string[] =\n  MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST.filter(\n    (componentId) => componentId !== 'emailRichtext',\n  )\n\n/** Serialized definition size cap (Firestore doc limit is 1 MiB). */\nexport const MARKETPLACE_DEFINITION_MAX_BYTES = 200 * 1024\n\nconst KEPT_NODE_KEYS = [\n  '$id',\n  'componentId',\n  'pluginId',\n  'parentId',\n  'props',\n  'nodes',\n] as const\n\n/**\n * The address rules a published node's `href` and `src` meet — the linking\n * elements' navigable protocols, and https, inline or site-relative images\n * (see `node-url-policy`).\n *\n * Exported under these names for the marketplace's property sanitizer, which\n * holds a published property's Link default to the same rule as a published\n * node's `href`, and an Image default to the `src` rule.\n */\nexport {\n  SAFE_HREF_PATTERN as MARKETPLACE_SAFE_HREF,\n  SAFE_SRC_PATTERN as MARKETPLACE_SAFE_SRC,\n}\n\n/**\n * The property kind whose value may fill each address prop through a binding\n * (AGL-2933): a Link feeds an `href`, an Image a `src`. Each kind's default is\n * held to that prop's own rule wherever a declaration is published, so the\n * binding carries nothing a literal in the same place could not.\n */\nconst URL_PROP_KIND: Readonly<Record<NodeUrlProp, string>> = {\n  href: 'href',\n  src: 'image',\n}\n\n/**\n * Declared property names by the address prop their kind may fill — the\n * index {@link sanitizePublishedNodeProps} reads a binding against.\n */\nfunction urlBindingsOf(\n  declaredProps: ReadonlyArray<{ name?: unknown; type?: unknown }> | undefined,\n): ReadonlyMap<string, NodeUrlProp> {\n  const bindings = new Map<string, NodeUrlProp>()\n  for (const prop of declaredProps ?? []) {\n    if (typeof prop?.name !== 'string' || !prop.name) continue\n    if (prop.type === URL_PROP_KIND.href) bindings.set(prop.name, 'href')\n    else if (prop.type === URL_PROP_KIND.src) bindings.set(prop.name, 'src')\n  }\n  return bindings\n}\n\n/**\n * Strips props a published node must never carry into someone else's site\n * (AGL-784).\n *\n * `Leaf` spreads a node's props straight onto the rendered component, and MUI\n * passes unknown props through to its root DOM element, so whatever survives\n * publishing reaches the DOM of every org that installs the listing. Marketplace\n * components are auto-listed with no review, and `hosts/{h}/components` is\n * writable by any org member, so a hand-crafted doc is a realistic input here.\n *\n * What each stripped key actually does, measured rather than assumed:\n * - `dangerouslySetInnerHTML` is NOT the stored-XSS it looks like — `Leaf`\n *   always passes a children array, so React throws\n *   \"Can only set one of `children` or `props.dangerouslySetInnerHTML`\"\n *   (and the void-element variant for self-closing components like `image`).\n *   That is worse in practice than it sounds: the throw happens during SSR,\n *   which is the AGL-579 failure mode that 500s the page and wedges ISR for\n *   the whole site. One published component would take down every consumer.\n * - `on*` handlers can only survive JSON as strings, which React drops with a\n *   warning. Removed for hygiene, and so a future renderer that does eval-ish\n *   prop handling can't turn them back into a vector.\n * - `href`/`src` get the render-time URL policy applied at publish time too.\n *   React already neutralizes `javascript:` hrefs and the mui components run\n *   SAFE_HREF themselves, so this is defense in depth for any component that\n *   forgets to — cheap, and it keeps the stored artifact honest.\n * - An `href`/`src` that is exactly one `{{prop.*}}` token naming a declared\n *   property of the kind that holds that address — a Link for `href`, an\n *   Image for `src` — is kept as the binding it is (AGL-2933). The token is no\n *   address, so the rule above would refuse it, and every link and image a\n *   component's properties feed would arrive unbound. What it becomes is held\n *   to the same rule twice over: the property's default where the declaration\n *   is published, and whatever value a page sets where the graft substitutes\n *   it (`resolveComponentPropTokens`). A token that is only part of the value,\n *   or names a property of another kind or none, is refused as before.\n *\n * Deliberately shallow: only top-level props are spread onto the DOM. A nested\n * object (`icon: { path }`) is consumed by the component, never spread, so\n * recursing would strip legitimate data for no security gain.\n */\nfunction sanitizePublishedNodeProps(\n  props: Record<string, unknown>,\n  urlBindings: ReadonlyMap<string, NodeUrlProp>,\n): Record<string, unknown> {\n  const safe: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'dangerouslySetInnerHTML') continue\n    if (/^on[A-Z]/.test(key)) continue\n    if ((key === 'href' || key === 'src') && typeof value === 'string') {\n      const trimmed = value.trim()\n      const bound = matchComponentPropToken(trimmed)\n      const keep =\n        isSafeNodeUrl(key, trimmed) ||\n        (bound !== null && urlBindings.get(bound) === key)\n      if (keep) safe[key] = trimmed\n      continue\n    }\n    safe[key] = value\n  }\n  return safe\n}\n\n/**\n * `nodes` that is still in one of its STORAGE forms rather than a node map\n * (AGL-1395).\n *\n * The two forms `decodeStoredNodes` knows about, tested structurally so this\n * stays a model function with no server import: a byte view — what\n * firebase-admin hands back for a `Bytes` field — and the `{type, data}`\n * envelope `JSON.stringify` makes of a Node `Buffer`, which is what a\n * site-export bundle carries. Neither is a map, and neither is anything the\n * publisher did.\n *\n * The envelope test is deliberately exact, for the reason `decodeStoredNodes`\n * spells out: the alternative reading is a node map with nodes called `type`\n * and `data`, which cannot exist because node-map values are objects.\n */\nfunction isUndecodedNodes(nodes: unknown): boolean {\n  if (ArrayBuffer.isView(nodes)) return true\n  if (typeof nodes !== 'object' || nodes === null || Array.isArray(nodes)) {\n    return false\n  }\n  const value = nodes as { type?: unknown; data?: unknown }\n  return (\n    value.type === 'Buffer' &&\n    Array.isArray(value.data) &&\n    Object.keys(value).length === 2\n  )\n}\n\nexport type MarketplaceDefinitionNodes = Record<\n  string,\n  {\n    $id: string\n    componentId: string\n    pluginId?: string\n    parentId: string | null\n    props?: Record<string, unknown>\n    nodes?: string[]\n  }\n>\n\n/**\n * Validates and strips a host component definition for publishing:\n * - only allowlisted component ids (no reusable instances, no layout chrome)\n * - only the persisted node keys (drops runtime fields like resolvedProps)\n * - the subtree reachable from `rootId` only, and a serialized size cap\n *\n * - per-node prop hardening (see `sanitizePublishedNodeProps`, AGL-784)\n *\n * XSS note: rich-text `html` props stay as-authored here — they are sanitized\n * at render time (sanitize-rich-text allowlist), which also covers definitions\n * written to Firestore directly (see docs/SECURITY_CONTENT_REVIEW.md). Props\n * that are spread onto the DOM (`dangerouslySetInnerHTML`, `on*`, `href`,\n * `src`) are hardened HERE as well, because publishing hands them to a\n * different org's render tree.\n */\nexport function sanitizeMarketplaceDefinition(\n  definition: {\n    rootId: string\n    nodes: Record<string, any>\n  },\n  options?: {\n    /**\n     * Additional component ids permitted for this artifact type.\n     *\n     * `layoutSlot` is excluded from the shared allowlist because a slot in\n     * page content has nowhere to graft — but a published LAYOUT is\n     * meaningless without one (AGL-671). Scoped per call rather than added\n     * globally so page and component publishing stay unchanged.\n     */\n    extraComponentIds?: readonly string[]\n    /**\n     * Replaces the page allowlist outright, for artifact types built from a\n     * disjoint component vocabulary — an email design uses `plugins-email`\n     * blocks and nothing else (AGL-657), so EXTENDING the page list would\n     * green-light a `videoEmbed` or `form` that no email client can render.\n     */\n    componentIds?: readonly string[]\n    /**\n     * The properties the tree declares, as they are published beside it\n     * (AGL-2933). A node's `href` or `src` bound whole to one of the kind that\n     * holds that address is kept — see `sanitizePublishedNodeProps`. Absent\n     * for a tree that declares none, which keeps no binding.\n     */\n    declaredProps?: ReadonlyArray<{ name?: unknown; type?: unknown }>\n  },\n):\n  | { ok: true; rootId: string; nodes: MarketplaceDefinitionNodes }\n  | { ok: false; error: string } {\n  const { rootId, nodes } = definition\n  const base = options?.componentIds ?? MARKETPLACE_COMPONENT_ID_ALLOWLIST\n  const allowed = options?.extraComponentIds?.length\n    ? [...base, ...options.extraComponentIds]\n    : base\n  const urlBindings = urlBindingsOf(options?.declaredProps)\n  // An UNDECODED `nodes` is never the author's fault, so it must not share a\n  // message with a genuinely rootless definition (AGL-1395). Both undecoded\n  // forms — a Node `Buffer` from the Admin SDK, and the `{type:'Buffer'}`\n  // envelope `JSON.stringify` makes of one — reach the root check below as\n  // something with no `_@_` in it, and the answer was \"Definition has no root\n  // node\": a sentence that sends the publisher to redesign a page that is\n  // fine. Callers must run `decodeStoredNodes` first; this says so out loud\n  // rather than letting the next raw read look like a content problem.\n  if (isUndecodedNodes(nodes)) {\n    return {\n      ok: false,\n      error:\n        'This content could not be read — it is stored compressed and was ' +\n        'not decoded before publishing. That is a bug on our side, not a ' +\n        'problem with your design.',\n    }\n  }\n  if (!rootId || !nodes?.[rootId]) {\n    return { ok: false, error: 'Definition has no root node' }\n  }\n  const sanitized: MarketplaceDefinitionNodes = {}\n  /** Set while walking; see the empty-definition check after the loop. */\n  let rootIsWrapper = false\n  const queue = [rootId]\n  while (queue.length) {\n    const id = queue.shift() as string\n    if (sanitized[id]) continue\n    const node = nodes[id]\n    if (!node) return { ok: false, error: `Missing node \"${id}\"` }\n    // The root node is the virtual root-collection wrapper (canvas\n    // `NODE_ROOT_ID` = `_@_`): it declares \"everything inside <body>\" for\n    // drag/drop mapping, not a rendered component, so a `div`/absent\n    // componentId there is structural — not a real component to allowlist\n    // (AGL-783). Exempt ONLY that wrapper shape; a root carrying a real\n    // component id is still checked, so a disallowed component can't be\n    // smuggled in as the root. Every descendant is real content and always\n    // checked below.\n    const isRootWrapper =\n      id === rootId &&\n      (node.componentId == null ||\n        node.componentId === '' ||\n        node.componentId === 'div')\n    if (!isRootWrapper && !allowed.includes(node.componentId)) {\n      return {\n        ok: false,\n        // Says why, not just no (AGL-1033). The bare id was doubly unhelpful:\n        // it is not what the palette calls the element, and it left the author\n        // guessing whether this was a bug or a rule.\n        error:\n          `Component \"${node.componentId}\" cannot be published — a listing may ` +\n          'only contain self-contained presentational elements. Raw HTML, ' +\n          'reusable-component references, plugin elements and anything bound ' +\n          \"to this site's data or layout stay behind.\",\n      }\n    }\n    const plain: any = {}\n    for (const key of KEPT_NODE_KEYS) {\n      if (node[key] !== undefined) plain[key] = node[key]\n    }\n    // Per-node prop hardening (AGL-784) — see sanitizePublishedNodeProps.\n    if (plain.props && typeof plain.props === 'object') {\n      plain.props = sanitizePublishedNodeProps(plain.props, urlBindings)\n    }\n    plain.$id = id\n    plain.parentId = id === rootId ? null : (node.parentId ?? null)\n    // Give the wrapper an explicit container id so the installed definition\n    // renders its root collection the same way it did on the source site.\n    if (isRootWrapper) {\n      plain.componentId = 'div'\n      rootIsWrapper = true\n    }\n    sanitized[id] = plain\n    if (Array.isArray(node.nodes)) queue.push(...node.nodes)\n  }\n  let serialized: string\n  try {\n    serialized = JSON.stringify(sanitized)\n  } catch {\n    return { ok: false, error: 'Definition is not serializable' }\n  }\n  if (serialized.length > MARKETPLACE_DEFINITION_MAX_BYTES) {\n    return { ok: false, error: 'Definition is too large to publish' }\n  }\n  // An empty definition is not a listing (AGL-1033). Publishing one used to\n  // SUCCEED — the root wrapper alone sanitizes cleanly — so a component whose\n  // content had never been published to its document shipped a blank version\n  // to everyone who installed it, and said nothing. Refusing here is the\n  // \"fail loudly at the point the author understands it\" half.\n  //\n  // Only the WRAPPER case: a definition that is a single real component is a\n  // perfectly good one-element listing, and refusing that would be a different\n  // bug in the other direction.\n  if (rootIsWrapper && Object.keys(sanitized).length <= 1) {\n    return {\n      ok: false,\n      error:\n        'There is nothing to publish — this is empty. If you have edited it ' +\n        'in the designer, publish those changes first, then publish the listing.',\n    }\n  }\n  return { ok: true, rootId, nodes: sanitized }\n}\n\n/**\n * Converts a sanitized marketplace/AI definition (normalized map) into the\n * nested node shape `canvas.addNodeFromPreset` grafts — ids regenerate on\n * insert, so collisions with existing canvas nodes are impossible\n * (AGL-169). A seen-set guards malformed self-referencing trees.\n */\nexport function marketplaceDefinitionToNested(\n  rootId: string,\n  nodes: MarketplaceDefinitionNodes,\n): Record<string, unknown> | null {\n  const seen = new Set<string>()\n  const build = (id: string): Record<string, unknown> | null => {\n    const node = nodes[id]\n    if (!node || seen.has(id)) return null\n    seen.add(id)\n    return {\n      componentId: node.componentId,\n      ...(node.pluginId ? { pluginId: node.pluginId } : {}),\n      ...(node.props ? { props: node.props } : {}),\n      nodes: (node.nodes ?? [])\n        .map(build)\n        .filter((child): child is Record<string, unknown> => Boolean(child)),\n    }\n  }\n  return build(rootId)\n}\n\n/**\n * Field types a published dataset schema may declare (AGL-657). Mirrors\n * `DATASET_FIELD_TYPES` in core; duplicated rather than imported to keep this\n * module dependency-free (it is imported by API routes and client components\n * alike), and asserted against the source of truth in the spec.\n */\nexport const MARKETPLACE_DATASET_FIELD_TYPES: readonly string[] = [\n  'bool',\n  'bytes',\n  'coordinates',\n  'float',\n  'int32',\n  'int64',\n  'map',\n  'nil',\n  'reference',\n  'sorted',\n  'text',\n  'timestamp',\n]\n\n"],"names":["matchComponentPropToken","isSafeNodeUrl","SAFE_SRC_PATTERN","SAFE_HREF_PATTERN","MARKETPLACE_COMPONENT_ID_ALLOWLIST","MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST","MARKETPLACE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST","filter","componentId","MARKETPLACE_DEFINITION_MAX_BYTES","KEPT_NODE_KEYS","MARKETPLACE_SAFE_HREF","MARKETPLACE_SAFE_SRC","URL_PROP_KIND","href","src","urlBindingsOf","declaredProps","bindings","Map","prop","name","type","set","sanitizePublishedNodeProps","props","urlBindings","safe","key","value","Object","entries","test","trimmed","trim","bound","keep","get","isUndecodedNodes","nodes","ArrayBuffer","isView","Array","isArray","data","keys","length","sanitizeMarketplaceDefinition","definition","options","rootId","base","componentIds","allowed","extraComponentIds","ok","error","sanitized","rootIsWrapper","queue","node","id","shift","isRootWrapper","includes","plain","undefined","$id","parentId","push","serialized","JSON","stringify","marketplaceDefinitionToNested","seen","Set","build","has","add","pluginId","map","child","Boolean","MARKETPLACE_DATASET_FIELD_TYPES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;CAOC;AAGD,SAASA,uBAAuB,QAAQ,mCAA+B;AACvE,SACEC,aAAa,EAEbC,gBAAgB,QACX,uBAAmB;AAC1B,SAASC,iBAAiB,QAAQ,yBAAqB;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,qCAAwD;IACnE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,qDAAqD;IACrD;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,2CAA8D;IACzE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC,mDACXD,yCAAyCE,MAAM,CAC7C,CAACC,cAAgBA,gBAAgB,iBAClC;AAEH,mEAAmE,GACnE,OAAO,MAAMC,mCAAmC,MAAM,KAAI;AAE1D,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,SACEP,qBAAqBQ,qBAAqB,EAC1CT,oBAAoBU,oBAAoB,KACzC;AAED;;;;;CAKC,GACD,MAAMC,gBAAuD;IAC3DC,MAAM;IACNC,KAAK;AACP;AAEA;;;CAGC,GACD,SAASC,cACPC,aAA4E;IAE5E,MAAMC,WAAW,IAAIC;IACrB,KAAK,MAAMC,QAAQH,wBAAAA,gBAAiB,EAAE,CAAE;QACtC,IAAI,QAAOG,wBAAAA,KAAMC,IAAI,MAAK,YAAY,CAACD,KAAKC,IAAI,EAAE;QAClD,IAAID,KAAKE,IAAI,KAAKT,cAAcC,IAAI,EAAEI,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;aACzD,IAAID,KAAKE,IAAI,KAAKT,cAAcE,GAAG,EAAEG,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;IACpE;IACA,OAAOH;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,SAASM,2BACPC,KAA8B,EAC9BC,WAA6C;IAE7C,MAAMC,OAAgC,CAAC;IACvC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACN,OAAQ;QAChD,IAAIG,QAAQ,2BAA2B;QACvC,IAAI,WAAWI,IAAI,CAACJ,MAAM;QAC1B,IAAI,AAACA,CAAAA,QAAQ,UAAUA,QAAQ,KAAI,KAAM,OAAOC,UAAU,UAAU;YAClE,MAAMI,UAAUJ,MAAMK,IAAI;YAC1B,MAAMC,QAAQnC,wBAAwBiC;YACtC,MAAMG,OACJnC,cAAc2B,KAAKK,YAClBE,UAAU,QAAQT,YAAYW,GAAG,CAACF,WAAWP;YAChD,IAAIQ,MAAMT,IAAI,CAACC,IAAI,GAAGK;YACtB;QACF;QACAN,IAAI,CAACC,IAAI,GAAGC;IACd;IACA,OAAOF;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAASW,iBAAiBC,KAAc;IACtC,IAAIC,YAAYC,MAAM,CAACF,QAAQ,OAAO;IACtC,IAAI,OAAOA,UAAU,YAAYA,UAAU,QAAQG,MAAMC,OAAO,CAACJ,QAAQ;QACvE,OAAO;IACT;IACA,MAAMV,QAAQU;IACd,OACEV,MAAMP,IAAI,KAAK,YACfoB,MAAMC,OAAO,CAACd,MAAMe,IAAI,KACxBd,OAAOe,IAAI,CAAChB,OAAOiB,MAAM,KAAK;AAElC;AAcA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,8BACdC,UAGC,EACDC,OAwBC;;QAMeA;IAFhB,MAAM,EAAEC,MAAM,EAAEX,KAAK,EAAE,GAAGS;IAC1B,MAAMG,eAAOF,2BAAAA,QAASG,YAAY,mBAAIhD;IACtC,MAAMiD,UAAUJ,CAAAA,4BAAAA,6BAAAA,QAASK,iBAAiB,qBAA1BL,2BAA4BH,MAAM,IAC9C;WAAIK;WAASF,QAAQK,iBAAiB;KAAC,GACvCH;IACJ,MAAMzB,cAAcV,cAAciC,2BAAAA,QAAShC,aAAa;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,IAAIqB,iBAAiBC,QAAQ;QAC3B,OAAO;YACLgB,IAAI;YACJC,OACE,sEACA,qEACA;QACJ;IACF;IACA,IAAI,CAACN,UAAU,EAACX,yBAAAA,KAAO,CAACW,OAAO,GAAE;QAC/B,OAAO;YAAEK,IAAI;YAAOC,OAAO;QAA8B;IAC3D;IACA,MAAMC,YAAwC,CAAC;IAC/C,sEAAsE,GACtE,IAAIC,gBAAgB;IACpB,MAAMC,QAAQ;QAACT;KAAO;IACtB,MAAOS,MAAMb,MAAM,CAAE;YAwCsBc;QAvCzC,MAAMC,KAAKF,MAAMG,KAAK;QACtB,IAAIL,SAAS,CAACI,GAAG,EAAE;QACnB,MAAMD,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,MAAM,OAAO;YAAEL,IAAI;YAAOC,OAAO,CAAC,cAAc,EAAEK,GAAG,CAAC,CAAC;QAAC;QAC7D,+DAA+D;QAC/D,sEAAsE;QACtE,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,iBAAiB;QACjB,MAAME,gBACJF,OAAOX,UACNU,CAAAA,KAAKpD,WAAW,IAAI,QACnBoD,KAAKpD,WAAW,KAAK,MACrBoD,KAAKpD,WAAW,KAAK,KAAI;QAC7B,IAAI,CAACuD,iBAAiB,CAACV,QAAQW,QAAQ,CAACJ,KAAKpD,WAAW,GAAG;YACzD,OAAO;gBACL+C,IAAI;gBACJ,sEAAsE;gBACtE,uEAAuE;gBACvE,6CAA6C;gBAC7CC,OACE,CAAC,WAAW,EAAEI,KAAKpD,WAAW,CAAC,sCAAsC,CAAC,GACtE,oEACA,uEACA;YACJ;QACF;QACA,MAAMyD,QAAa,CAAC;QACpB,KAAK,MAAMrC,OAAOlB,eAAgB;YAChC,IAAIkD,IAAI,CAAChC,IAAI,KAAKsC,WAAWD,KAAK,CAACrC,IAAI,GAAGgC,IAAI,CAAChC,IAAI;QACrD;QACA,sEAAsE;QACtE,IAAIqC,MAAMxC,KAAK,IAAI,OAAOwC,MAAMxC,KAAK,KAAK,UAAU;YAClDwC,MAAMxC,KAAK,GAAGD,2BAA2ByC,MAAMxC,KAAK,EAAEC;QACxD;QACAuC,MAAME,GAAG,GAAGN;QACZI,MAAMG,QAAQ,GAAGP,OAAOX,SAAS,QAAQU,iBAAAA,KAAKQ,QAAQ,YAAbR,iBAAiB;QAC1D,wEAAwE;QACxE,sEAAsE;QACtE,IAAIG,eAAe;YACjBE,MAAMzD,WAAW,GAAG;YACpBkD,gBAAgB;QAClB;QACAD,SAAS,CAACI,GAAG,GAAGI;QAChB,IAAIvB,MAAMC,OAAO,CAACiB,KAAKrB,KAAK,GAAGoB,MAAMU,IAAI,IAAIT,KAAKrB,KAAK;IACzD;IACA,IAAI+B;IACJ,IAAI;QACFA,aAAaC,KAAKC,SAAS,CAACf;IAC9B,EAAE,eAAM;QACN,OAAO;YAAEF,IAAI;YAAOC,OAAO;QAAiC;IAC9D;IACA,IAAIc,WAAWxB,MAAM,GAAGrC,kCAAkC;QACxD,OAAO;YAAE8C,IAAI;YAAOC,OAAO;QAAqC;IAClE;IACA,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAIE,iBAAiB5B,OAAOe,IAAI,CAACY,WAAWX,MAAM,IAAI,GAAG;QACvD,OAAO;YACLS,IAAI;YACJC,OACE,wEACA;QACJ;IACF;IACA,OAAO;QAAED,IAAI;QAAML;QAAQX,OAAOkB;IAAU;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,SAASgB,8BACdvB,MAAc,EACdX,KAAiC;IAEjC,MAAMmC,OAAO,IAAIC;IACjB,MAAMC,QAAQ,CAACf;YAQHD;QAPV,MAAMA,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,QAAQc,KAAKG,GAAG,CAAChB,KAAK,OAAO;QAClCa,KAAKI,GAAG,CAACjB;QACT,OAAO;YACLrD,aAAaoD,KAAKpD,WAAW;WACzBoD,KAAKmB,QAAQ,GAAG;YAAEA,UAAUnB,KAAKmB,QAAQ;QAAC,IAAI,CAAC,GAC/CnB,KAAKnC,KAAK,GAAG;YAAEA,OAAOmC,KAAKnC,KAAK;QAAC,IAAI,CAAC;YAC1Cc,OAAO,EAACqB,cAAAA,KAAKrB,KAAK,YAAVqB,cAAc,EAAE,EACrBoB,GAAG,CAACJ,OACJrE,MAAM,CAAC,CAAC0E,QAA4CC,QAAQD;;IAEnE;IACA,OAAOL,MAAM1B;AACf;AAEA;;;;;CAKC,GACD,OAAO,MAAMiC,kCAAqD;IAChE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/src/lib/app-utils/node-identity.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The id of the node a component is rendering as (AGL-659). Provided by
+ * the renderer's Leaf around every component it mounts.
+ *
+ * Server-seeded page data (`SiteContext.pageData`) has to be keyed by node,
+ * because one page can hold several instances of the same block with
+ * different queries — a `/products` grid scoped to a collection sitting
+ * above a `related-products` grid. Seeding them from one unkeyed slice would
+ * server-render the wrong items into at least one of them, which is worse
+ * than rendering none: wrong items get indexed, and the visitor sees the
+ * content change under them on hydrate.
+ *
+ * Deliberately a context rather than a prop. A prop would land in every
+ * component's signature and, for the many that spread `...rest` onto a DOM
+ * element, leak an unknown attribute into the HTML. As a context only the
+ * blocks that actually seed pay any attention to it, and nothing about the
+ * existing component contract changes.
+ *
+ * Empty string when there is no surrounding node — a component mounted
+ * directly in a test or a console surface rather than through the renderer.
+ *
+ * Lives banner-free in @aglyn/aglyn for the same reason as SiteContext:
+ * a 'use client' banner in this module graph duplicates the canvas
+ * singleton and blanks the tenant site (AGL-52).
+ */
+export declare const NodeIdentityContext: import("react").Context<string>;
+/**
+ * The rendering node's id; '' outside the renderer. Use it to look up a
+ * per-node slice of `useSite().pageData`.
+ */
+export declare function useNodeId(): string;

package/src/lib/app-utils/node-identity.js

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createContext, useContext } from "react";
+/**
+ * The id of the node a component is rendering as (AGL-659). Provided by
+ * the renderer's Leaf around every component it mounts.
+ *
+ * Server-seeded page data (`SiteContext.pageData`) has to be keyed by node,
+ * because one page can hold several instances of the same block with
+ * different queries — a `/products` grid scoped to a collection sitting
+ * above a `related-products` grid. Seeding them from one unkeyed slice would
+ * server-render the wrong items into at least one of them, which is worse
+ * than rendering none: wrong items get indexed, and the visitor sees the
+ * content change under them on hydrate.
+ *
+ * Deliberately a context rather than a prop. A prop would land in every
+ * component's signature and, for the many that spread `...rest` onto a DOM
+ * element, leak an unknown attribute into the HTML. As a context only the
+ * blocks that actually seed pay any attention to it, and nothing about the
+ * existing component contract changes.
+ *
+ * Empty string when there is no surrounding node — a component mounted
+ * directly in a test or a console surface rather than through the renderer.
+ *
+ * Lives banner-free in @aglyn/aglyn for the same reason as SiteContext:
+ * a 'use client' banner in this module graph duplicates the canvas
+ * singleton and blanks the tenant site (AGL-52).
+ */ export const NodeIdentityContext = createContext('');
+NodeIdentityContext.displayName = 'AglynNodeIdentityContext';
+/**
+ * The rendering node's id; '' outside the renderer. Use it to look up a
+ * per-node slice of `useSite().pageData`.
+ */ export function useNodeId() {
+    return useContext(NodeIdentityContext);
+}
+
+//# sourceMappingURL=node-identity.js.map

package/src/lib/app-utils/node-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/node-identity.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createContext, useContext } from 'react'\n\n/**\n * The id of the node a component is rendering as (AGL-659). Provided by\n * the renderer's Leaf around every component it mounts.\n *\n * Server-seeded page data (`SiteContext.pageData`) has to be keyed by node,\n * because one page can hold several instances of the same block with\n * different queries — a `/products` grid scoped to a collection sitting\n * above a `related-products` grid. Seeding them from one unkeyed slice would\n * server-render the wrong items into at least one of them, which is worse\n * than rendering none: wrong items get indexed, and the visitor sees the\n * content change under them on hydrate.\n *\n * Deliberately a context rather than a prop. A prop would land in every\n * component's signature and, for the many that spread `...rest` onto a DOM\n * element, leak an unknown attribute into the HTML. As a context only the\n * blocks that actually seed pay any attention to it, and nothing about the\n * existing component contract changes.\n *\n * Empty string when there is no surrounding node — a component mounted\n * directly in a test or a console surface rather than through the renderer.\n *\n * Lives banner-free in @aglyn/aglyn for the same reason as SiteContext:\n * a 'use client' banner in this module graph duplicates the canvas\n * singleton and blanks the tenant site (AGL-52).\n */\nexport const NodeIdentityContext = createContext<string>('')\nNodeIdentityContext.displayName = 'AglynNodeIdentityContext'\n\n/**\n * The rendering node's id; '' outside the renderer. Use it to look up a\n * per-node slice of `useSite().pageData`.\n */\nexport function useNodeId(): string {\n  return useContext(NodeIdentityContext)\n}\n"],"names":["createContext","useContext","NodeIdentityContext","displayName","useNodeId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,EAAEC,UAAU,QAAQ,QAAO;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,MAAMC,sBAAsBF,cAAsB,IAAG;AAC5DE,oBAAoBC,WAAW,GAAG;AAElC;;;CAGC,GACD,OAAO,SAASC;IACd,OAAOH,WAAWC;AACpB"}