@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/plugin-manifest.js

@@ -0,0 +1,687 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+import { sanitizePluginContributions } from "../plugin-manager/plugin-contributions.js";
+/**
+ * Categories a third-party element may declare.
+ *
+ * Deliberately not the whole enum. `LAYOUT` and `NAVIGATION` are structural —
+ * a third-party element appearing among the containers a page is built out of
+ * invites placements the sandbox cannot honour, and taking a category away
+ * later breaks every site that used it. Cheaper to decide now, as the issue
+ * says; widening later is easy and narrowing is not.
+ */ export const PLUGIN_ELEMENT_CATEGORIES = [
+    'Data Display',
+    'Media',
+    'Commerce',
+    'Forms',
+    'Input',
+    'Text',
+    'Sections & Blocks'
+];
+/** Bound on how many elements one plugin may contribute to the palette. */ export const PLUGIN_MAX_ELEMENTS = 12;
+export * from "./plugin-artifact-path.js";
+export const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{1,63}$/;
+export const PLUGIN_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+export const PLUGIN_MAX_NETWORK_ORIGINS = 10;
+export const PLUGIN_MAX_PROPS = 32;
+/** Label/description/default text is publisher-authored; keep it bounded. */ const PLUGIN_PROP_TEXT_MAX = 200;
+/**
+ * `mdiTimerOutline` — an icon NAME from the set the host already ships.
+ *
+ * Never a path: a path is arbitrary SVG from a publisher rendered into console
+ * chrome. A name is a lookup, so the worst an unknown one does is render
+ * nothing.
+ */ const MDI_ICON_NAME_PATTERN = /^mdi[A-Za-z0-9]{1,48}$/;
+const PROP_SCHEMA_TYPES = new Set([
+    'string',
+    'number',
+    'boolean',
+    'color',
+    'date',
+    'url',
+    'select'
+]);
+export const PLUGIN_MAX_EVENTS = 32;
+export const PLUGIN_MAX_SIZE_PX = 4096;
+const HTTPS_ORIGIN_PATTERN = /^https:\/\/[a-z0-9.-]+(:\d+)?$/i;
+const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+/**
+ * Validates a manifest at publish time. Returns the normalized manifest or
+ * a human-readable error — the publish Cloud Function refuses to store a
+ * bundle whose manifest doesn't pass, so bad capabilities never reach a
+ * consumer's install screen.
+ */ /**
+ * Sanitizes a publisher-authored prop schema against a set of declared props.
+ *
+ * Shared by `capabilities.propSchema` and each element's `attributes`, so a
+ * declared element cannot describe its way past the allowlist any more than a
+ * top-level schema can. One implementation, one rule.
+ */ function sanitizePropSchemaList(input, declared) {
+    if (!Array.isArray(input)) return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of input.slice(0, PLUGIN_MAX_PROPS)){
+        if (!raw || typeof raw !== 'object') continue;
+        const entry = raw;
+        const name = entry['name'];
+        if (typeof name !== 'string' || !IDENTIFIER_PATTERN.test(name)) continue;
+        if (!declared.has(name) || seen.has(name)) continue;
+        seen.add(name);
+        const type = PROP_SCHEMA_TYPES.has(String(entry['type'])) ? entry['type'] : 'string';
+        const next = {
+            name,
+            type
+        };
+        for (const key of [
+            'label',
+            'description'
+        ]){
+            const value = entry[key];
+            if (typeof value === 'string' && value.trim()) {
+                next[key] = value.trim().slice(0, PLUGIN_PROP_TEXT_MAX);
+            }
+        }
+        const fallback = entry['default'];
+        if (typeof fallback === 'string' || typeof fallback === 'number' || typeof fallback === 'boolean') {
+            next.default = typeof fallback === 'string' ? fallback.slice(0, PLUGIN_PROP_TEXT_MAX) : fallback;
+        }
+        if (type === 'select' && Array.isArray(entry['options'])) {
+            const options = entry['options'].map((option)=>{
+                const record = option != null ? option : {};
+                const value = record['value'];
+                if (typeof value !== 'string' || !value) return null;
+                const label = record['label'];
+                return _extends({
+                    value: value.slice(0, PLUGIN_PROP_TEXT_MAX)
+                }, typeof label === 'string' && label.trim() ? {
+                    label: label.trim().slice(0, PLUGIN_PROP_TEXT_MAX)
+                } : {});
+            }).filter(Boolean);
+            if (options.length) next.options = options.slice(0, PLUGIN_MAX_PROPS);
+        }
+        out.push(next);
+    }
+    return out;
+}
+export function validatePluginManifest(input) {
+    var _raw_id, _raw_version, _raw_name, _raw_entry, _raw_capabilities;
+    if (!input || typeof input !== 'object') {
+        return {
+            ok: false,
+            error: 'Manifest must be an object'
+        };
+    }
+    const raw = input;
+    const id = String((_raw_id = raw['id']) != null ? _raw_id : '');
+    if (!PLUGIN_ID_PATTERN.test(id)) {
+        return {
+            ok: false,
+            error: 'Invalid plugin id'
+        };
+    }
+    const version = String((_raw_version = raw['version']) != null ? _raw_version : '');
+    if (!PLUGIN_VERSION_PATTERN.test(version)) {
+        return {
+            ok: false,
+            error: 'Version must be semver (e.g. 1.0.0)'
+        };
+    }
+    const name = String((_raw_name = raw['name']) != null ? _raw_name : '').trim();
+    if (!name || name.length > 80) {
+        return {
+            ok: false,
+            error: 'Name is required (max 80 chars)'
+        };
+    }
+    const entry = String((_raw_entry = raw['entry']) != null ? _raw_entry : '').trim();
+    // Entry is a relative bundle path — absolute URLs would let a plugin
+    // point the loader at an off-origin script.
+    if (!entry || /^[a-z][a-z0-9+.-]*:/i.test(entry) || entry.startsWith('//')) {
+        return {
+            ok: false,
+            error: 'Entry must be a relative bundle path'
+        };
+    }
+    const capabilitiesInput = (_raw_capabilities = raw['capabilities']) != null ? _raw_capabilities : {};
+    const capabilities = {};
+    const network = capabilitiesInput['network'];
+    if (network !== undefined) {
+        if (!Array.isArray(network) || network.length > PLUGIN_MAX_NETWORK_ORIGINS) {
+            return {
+                ok: false,
+                error: 'Too many network origins declared'
+            };
+        }
+        for (const origin of network){
+            if (typeof origin !== 'string' || !HTTPS_ORIGIN_PATTERN.test(origin)) {
+                return {
+                    ok: false,
+                    error: `Network origin "${origin}" must be an https origin`
+                };
+            }
+        }
+        if (network.length) capabilities.network = [
+            ...new Set(network)
+        ];
+    }
+    for (const key of [
+        'props',
+        'events'
+    ]){
+        const list = capabilitiesInput[key];
+        if (list === undefined) continue;
+        const max = key === 'props' ? PLUGIN_MAX_PROPS : PLUGIN_MAX_EVENTS;
+        if (!Array.isArray(list) || list.length > max) {
+            return {
+                ok: false,
+                error: `Too many ${key} declared`
+            };
+        }
+        for (const name of list){
+            if (typeof name !== 'string' || !IDENTIFIER_PATTERN.test(name)) {
+                return {
+                    ok: false,
+                    error: `Invalid ${key} name "${name}"`
+                };
+            }
+        }
+        if (list.length) capabilities[key] = [
+            ...new Set(list)
+        ];
+    }
+    /**
+   * Editing metadata (AGL-1049). Sanitized, never trusted, and INTERSECTED
+   * with the allowlist above — an entry naming a prop that is not declared in
+   * `props` is dropped rather than rejected.
+   *
+   * Dropped and not rejected on purpose: a publisher who describes a prop they
+   * forgot to declare has made an authoring mistake, not an attack, and
+   * refusing the whole manifest for it would fail the publish over a label.
+   * The prop still does not cross the bridge, because `filterPluginProps`
+   * reads `props` and never this.
+   *
+   * An unknown `type` degrades to a text field rather than failing: a manifest
+   * written against a newer platform must not make an older host refuse a
+   * plugin that is otherwise fine.
+   */ const propSchemaInput = capabilitiesInput['propSchema'];
+    if (propSchemaInput !== undefined) {
+        var _capabilities_props;
+        if (!Array.isArray(propSchemaInput) || propSchemaInput.length > PLUGIN_MAX_PROPS) {
+            return {
+                ok: false,
+                error: 'Too many prop schemas declared'
+            };
+        }
+        const propSchema = sanitizePropSchemaList(propSchemaInput, new Set((_capabilities_props = capabilities.props) != null ? _capabilities_props : []));
+        if (propSchema.length) capabilities.propSchema = propSchema;
+    }
+    const size = capabilitiesInput['size'];
+    if (size) {
+        var _size_width, _size_height;
+        const width = Number((_size_width = size.width) != null ? _size_width : 0);
+        const height = Number((_size_height = size.height) != null ? _size_height : 0);
+        if (size.width !== undefined && (!Number.isFinite(width) || width < 0 || width > PLUGIN_MAX_SIZE_PX) || size.height !== undefined && (!Number.isFinite(height) || height < 0 || height > PLUGIN_MAX_SIZE_PX)) {
+            return {
+                ok: false,
+                error: 'Declared size is out of range'
+            };
+        }
+        capabilities.size = _extends({}, size.width !== undefined ? {
+            width
+        } : {}, size.height !== undefined ? {
+            height
+        } : {});
+    }
+    const restrict = (value)=>{
+        if (!Array.isArray(value)) return undefined;
+        const ids = value.filter((entry)=>typeof entry === 'string' && entry.length > 0);
+        return ids.length ? [
+            ...new Set(ids)
+        ] : undefined;
+    };
+    const hostAbiRaw = raw['hostAbi'];
+    let hostAbi;
+    if (hostAbiRaw !== undefined) {
+        hostAbi = Number(hostAbiRaw);
+        if (!Number.isInteger(hostAbi) || hostAbi < 1 || hostAbi > 99) {
+            return {
+                ok: false,
+                error: 'hostAbi must be a small positive integer'
+            };
+        }
+    }
+    /**
+   * Declared canvas elements (AGL-1031). Sanitized hard, because every field
+   * here is publisher-authored data the HOST renders into its own chrome.
+   *
+   * A malformed `elements` array is refused — that is a build error a
+   * publisher can see and fix. A single bad ENTRY is dropped instead, so one
+   * typo cannot fail a whole release.
+   */ const elementsInput = raw['elements'];
+    const elements = [];
+    if (elementsInput !== undefined) {
+        var _capabilities_props1;
+        if (!Array.isArray(elementsInput) || elementsInput.length > PLUGIN_MAX_ELEMENTS) {
+            return {
+                ok: false,
+                error: 'Too many elements declared'
+            };
+        }
+        const declaredProps = new Set((_capabilities_props1 = capabilities.props) != null ? _capabilities_props1 : []);
+        const seenIds = new Set();
+        for (const rawElement of elementsInput){
+            if (!rawElement || typeof rawElement !== 'object') continue;
+            const entryRecord = rawElement;
+            const elementId = entryRecord['id'];
+            const elementName = entryRecord['displayName'];
+            if (typeof elementId !== 'string' || !IDENTIFIER_PATTERN.test(elementId)) {
+                continue;
+            }
+            if (seenIds.has(elementId)) continue;
+            if (typeof elementName !== 'string' || !elementName.trim()) continue;
+            seenIds.add(elementId);
+            const element = {
+                id: elementId,
+                displayName: elementName.trim().slice(0, PLUGIN_PROP_TEXT_MAX)
+            };
+            const elementDescription = entryRecord['description'];
+            if (typeof elementDescription === 'string' && elementDescription.trim()) {
+                element.description = elementDescription.trim().slice(0, PLUGIN_PROP_TEXT_MAX);
+            }
+            // A category outside the permitted subset is DROPPED, not refused: the
+            // structural ones are withheld deliberately (see
+            // PLUGIN_ELEMENT_CATEGORIES), and a publisher aiming at one should still
+            // get a usable element rather than a failed publish.
+            const elementCategory = entryRecord['category'];
+            if (typeof elementCategory === 'string' && PLUGIN_ELEMENT_CATEGORIES.includes(elementCategory)) {
+                element.category = elementCategory;
+            }
+            const elementIcon = entryRecord['icon'];
+            if (typeof elementIcon === 'string' && MDI_ICON_NAME_PATTERN.test(elementIcon)) {
+                element.icon = elementIcon;
+            }
+            const elementAttributes = sanitizePropSchemaList(entryRecord['attributes'], declaredProps);
+            if (elementAttributes.length) element.attributes = elementAttributes;
+            elements.push(element);
+        }
+    }
+    /**
+   * Declared contributions (AGL-3116). Refused whole when malformed rather
+   * than trimmed: a loader places the plugin by this block, and an entry
+   * dropped on the way in would stop it loading where it is used.
+   */ let contributes;
+    if (raw['contributes'] !== undefined) {
+        const verdict = sanitizePluginContributions(raw['contributes']);
+        if (verdict.ok === false) return {
+            ok: false,
+            error: verdict.error
+        };
+        contributes = verdict.contributions;
+    }
+    return {
+        ok: true,
+        manifest: _extends({
+            id,
+            name,
+            version,
+            entry
+        }, hostAbi !== undefined ? {
+            hostAbi
+        } : {}, contributes ? {
+            contributes
+        } : {}, Object.keys(capabilities).length ? {
+            capabilities
+        } : {}, elements.length ? {
+            elements
+        } : {}, restrict(raw['restrictParent']) ? {
+            restrictParent: restrict(raw['restrictParent'])
+        } : {}, restrict(raw['restrictChildren']) ? {
+            restrictChildren: restrict(raw['restrictChildren'])
+        } : {}, typeof raw['description'] === 'string' ? {
+            description: String(raw['description']).slice(0, 500)
+        } : {})
+    };
+}
+/**
+ * The sandbox CSP is NOT built here (AGL-1092).
+ *
+ * A `pluginContentSecurityPolicy` used to live at this spot: exported,
+ * unit-tested, and called by nothing. The policy that actually reaches a
+ * browser is `csp()` in `tools/plugin-loader/origin/api/load.mjs`, on the
+ * plugin-origin deployment, and the two disagreed — this one emitted
+ * `connect-src 'none'` for a manifest with no network, which would have
+ * broken every sandboxed load, since the frame fetches its own bundle from
+ * its own origin. Deleted rather than reconciled: a tested policy nobody
+ * serves is worse than none, because it answers a reader's question wrongly.
+ * `capabilities.network` still decides the allowlist — the loader reads it
+ * from the public listing-versions endpoint and appends it to `connect-src`,
+ * with tests beside it (`npm run test:plugin-loader`).
+ */ /**
+ * True when a pinned version is killed — the whole listing (`'all'`) or the
+ * specific version. Loaders check this before executing and render a safe
+ * placeholder when true (AGL-45 §3.5 kill switch).
+ */ export function isPluginRevoked(revocation, version) {
+    if (!revocation) return false;
+    if (isListingWideRevocation(revocation)) return true;
+    return Array.isArray(revocation.versions) && revocation.versions.includes(version);
+}
+/**
+ * True when the kill switch is thrown on the WHOLE listing, not one build.
+ *
+ * Split out for the one caller that has no version to ask about: marketplace
+ * checkout (AGL-2288) must refuse to SELL a listing the platform has switched
+ * off, and it decides that before any version is chosen. Written here rather
+ * than as `revocation?.versions === 'all'` at that call site for the reason
+ * the doc comment on `nextRevocationState` gives — what `'all'` means is a
+ * property of this document's shape, and a second reader that spelled it out
+ * itself is how a kill switch silently stops killing.
+ *
+ * A per-version revocation is deliberately NOT listing-wide: it stops one
+ * build while the rest stay installable.
+ */ export function isListingWideRevocation(revocation) {
+    return (revocation == null ? void 0 : revocation.versions) === 'all';
+}
+/**
+ * What a listing OFFERS a client right now (AGL-2368).
+ *
+ * `newestInstallableVersion` is the derivation, and it needs the version set —
+ * which is server-only (`pluginVersions`). A client has the listing's
+ * `latestApprovedVersion` mirror instead, and since AGL-2306 every writer of
+ * that mirror computes it with `newestInstallableVersion`. So on a client the
+ * mirror IS the answer, with one gap: the revocation document and the listing
+ * document are two non-transactional writes, and a live listener sees them
+ * land at different times. In that window the mirror names a version the kill
+ * switch has already stopped, which is the whole shape of this bug.
+ *
+ * So a client that holds the revocation checks it against the mirror and, when
+ * they disagree, offers NOTHING rather than the next-best guess. It cannot
+ * compute the next-best guess — it has no version list — and "no update to
+ * offer" is the safe reading of a mirror it has caught mid-repair. The repair
+ * lands moments later and the real answer appears.
+ *
+ * A client with no revocation in hand passes `undefined` and gets the mirror,
+ * which is what it had before. That is a real fallback, not a silent one: the
+ * gap it leaves is bounded by the repair, and the install route derives live
+ * and refuses regardless.
+ */ export function offeredPluginVersion(listing, revocation) {
+    var _ref;
+    const offered = String((_ref = listing == null ? void 0 : listing.latestApprovedVersion) != null ? _ref : '');
+    if (!offered) return null;
+    return isPluginRevoked(revocation, offered) ? null : offered;
+}
+/**
+ * The newest version a buyer could actually install right now (AGL-2306).
+ *
+ * Two things have to be true of an offer, and the listing's
+ * `latestApprovedVersion` mirror only ever tracked one of them: the version
+ * must be APPROVED (AGL-966 — review lives on the version) and it must not be
+ * REVOKED (AGL-1085 — `install-plugin` answers 409 to a revoked pin).
+ *
+ * Written here rather than in the console route that repairs the mirror, and
+ * rather than reusing `newestApprovedVersion` in the marketplace plugin's
+ * model, because the console is `scope:app` and may not depend on
+ * `aglyn:addons`. Both may import core, and "what is on offer" is one
+ * question that must have one answer.
+ *
+ * `compare` is injected rather than imported so this module stays free of the
+ * artifact-version comparator's own dependencies; every caller already has it.
+ * A `null` comparison (an unparseable version string) sorts as "not newer",
+ * which keeps a malformed version out of an offer rather than into one.
+ *
+ * Returns `null` when nothing qualifies — an ABSENT mirror reads as "no update
+ * to offer", while a stale string reads as an update that does not exist.
+ */ export function newestInstallableVersion(versions, revocation, compare) {
+    let newest = null;
+    for (const entry of versions){
+        var _compare;
+        if (!(entry == null ? void 0 : entry.version)) continue;
+        if (entry.reviewState !== 'approved') continue;
+        if (isPluginRevoked(revocation, entry.version)) continue;
+        if (newest == null || ((_compare = compare(newest, entry.version)) != null ? _compare : 0) < 0) {
+            newest = entry.version;
+        }
+    }
+    return newest;
+}
+/**
+ * The next `revocations/{listingId}` state after one write (AGL-1085).
+ *
+ * Two writers share this doc and neither may erase the other:
+ *
+ * * a **takedown** kills the listing, flattening `versions` to `'all'`, and
+ *   un-hiding removes what it wrote (AGL-948);
+ * * a **review** decision stops one version's bytes — the reviewer's only
+ *   alternative used to be a full takedown, which also revokes the version
+ *   customers are happily running.
+ *
+ * `versions` stays the single field every reader consults, so `isPluginRevoked`
+ * and the loaders are untouched. `reviewVersions` is the durable record of the
+ * review-owned half, which is what lets un-hiding restore rather than clear it.
+ * Returns `null` when nothing is revoked any more and the doc should be
+ * deleted — an empty `versions: []` would read as "revoked nothing" but keep a
+ * doc around that a later reader has to interpret.
+ *
+ * Pure so both transitions are testable without Firestore, and colocated with
+ * `isPluginRevoked` on purpose: a writer that disagreed with the reader about
+ * this doc's shape is exactly how a kill switch silently stops killing.
+ */ export function nextRevocationState(current, change) {
+    var _ref;
+    const takenDown = (current == null ? void 0 : current.source) === 'takedown';
+    // A document written before AGL-1085 — or by hand, which the rules permit
+    // any staff client to do — has `versions` and NO `reviewVersions`
+    // (AGL-2305). `withReview` REPLACES `versions` wholesale from this seed, so
+    // reading it as an empty list silently rebuilt the document: revoking a
+    // second version un-revoked the first, and un-revoking any version returned
+    // `null`, which the caller turns into a DELETE of the whole kill switch.
+    //
+    // A legacy `versions` array is adopted as the review-owned half, which is
+    // what it actually was: before AGL-1085 the only writer that produced an
+    // array here was a reviewer, and `'all'` (the takedown form) is excluded
+    // because that half is owned by `source` and restored by `restore`.
+    const reviewVersions = [
+        ...(_ref = current == null ? void 0 : current.reviewVersions) != null ? _ref : Array.isArray(current == null ? void 0 : current.versions) ? current.versions : []
+    ];
+    const withReview = (versions, stillTakenDown)=>{
+        if (stillTakenDown) {
+            return _extends({}, current, {
+                versions: 'all',
+                reviewVersions: versions
+            });
+        }
+        if (!versions.length) return null;
+        const _ref = current != null ? current : {}, { source: _source } = _ref, rest = _object_without_properties_loose(_ref, [
+            "source"
+        ]);
+        return _extends({}, rest, {
+            versions,
+            reviewVersions: versions
+        });
+    };
+    switch(change.type){
+        case 'revoke-version':
+            {
+                const next = reviewVersions.includes(change.version) ? reviewVersions : [
+                    ...reviewVersions,
+                    change.version
+                ];
+                return withReview(next, takenDown);
+            }
+        case 'unrevoke-version':
+            {
+                return withReview(reviewVersions.filter((entry)=>entry !== change.version), takenDown);
+            }
+        case 'takedown':
+            return _extends({}, current, {
+                versions: 'all',
+                source: 'takedown',
+                reviewVersions
+            });
+        case 'restore':
+            // Only the takedown's own contribution goes away. A version a reviewer
+            // stopped stays stopped — un-hiding is not a review decision.
+            return withReview(reviewVersions, false);
+    }
+}
+/** Methods a host-mediated plugin fetch may use (AGL-191). */ export const PLUGIN_FETCH_METHODS = [
+    'GET',
+    'POST'
+];
+/** Request/response body cap for host-mediated fetch (bytes). */ export const PLUGIN_FETCH_MAX_BODY_BYTES = 256 * 1024;
+/**
+ * True when `url`'s origin is an exact match against the manifest's
+ * declared `network` allowlist (AGL-191). The host re-checks this before
+ * proxying a plugin's `fetch-request`, so a plugin can only reach origins
+ * it declared at install (and the install screen surfaced). No allowlist =
+ * no host-mediated network; https-only.
+ */ export function isPluginNetworkAllowed(url, capabilities) {
+    const allow = capabilities == null ? void 0 : capabilities.network;
+    if (!(allow == null ? void 0 : allow.length)) return false;
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'https:') return false;
+        return allow.includes(parsed.origin);
+    } catch (unused) {
+        return false;
+    }
+}
+/** Component id of the sandboxed plugin canvas element (plugins-mui). */ export const PLUGIN_COMPONENT_ID = 'marketplacePlugin';
+/**
+ * Compose-time injection (AGL-45), mirroring `attachFunctionDefinitions`:
+ * a `marketplacePlugin` node carries only a `listingId` in the saved screen;
+ * the tenant compose pass resolves that to the host's pinned install
+ * (version/sha256/capabilities) and the kill-switch state, and stamps them
+ * onto the node's props so `PluginFrame` renders without a client read.
+ * Unknown/uninstalled listings leave the node untouched (it shows a safe
+ * "not installed" placeholder rather than taking the screen down).
+ */ export function attachPluginInstalls(nodes, installsByListingId) {
+    if (!Object.keys(installsByListingId).length) return nodes;
+    const next = {};
+    for (const [id, node] of Object.entries(nodes)){
+        var _node_props;
+        const listingId = (node == null ? void 0 : node.componentId) === PLUGIN_COMPONENT_ID ? node == null ? void 0 : (_node_props = node.props) == null ? void 0 : _node_props.listingId : undefined;
+        const install = listingId ? installsByListingId[String(listingId)] : undefined;
+        next[id] = install ? _extends({}, node, {
+            props: _extends({}, node.props, {
+                version: install.version,
+                sha256: install.sha256,
+                capabilities: install.capabilities,
+                revoked: Boolean(install.revoked)
+            })
+        }) : node;
+    }
+    return next;
+}
+/**
+ * The settings an author may edit on a placed plugin (AGL-1049).
+ *
+ * Driven by `capabilities.props` — THE allowlist — and decorated by
+ * `propSchema` where the publisher supplied one. That order is the whole
+ * security property: the list of editable settings can never be longer than
+ * the list of props that cross the bridge, whatever the schema says, so a
+ * publisher cannot describe their way into a prop they did not declare.
+ *
+ * A plugin published before `propSchema` existed still gets a field per
+ * declared prop, as plain text. That is the difference between guessing key
+ * names in a JSON textarea and being shown them, and it needs no manifest
+ * change to work — which matters, because every plugin installed today
+ * predates this.
+ */ export function resolvePluginPropFields(manifest) {
+    var _ref, _ref1;
+    var _manifest_capabilities, _manifest_capabilities1;
+    const props = (_ref = manifest == null ? void 0 : (_manifest_capabilities = manifest.capabilities) == null ? void 0 : _manifest_capabilities.props) != null ? _ref : [];
+    const schema = new Map(((_ref1 = manifest == null ? void 0 : (_manifest_capabilities1 = manifest.capabilities) == null ? void 0 : _manifest_capabilities1.propSchema) != null ? _ref1 : []).map((entry)=>[
+            entry.name,
+            entry
+        ]));
+    return props.map((name)=>{
+        var _ref, _ref1;
+        const declared = schema.get(name);
+        return _extends({
+            name,
+            type: (_ref = declared == null ? void 0 : declared.type) != null ? _ref : 'string',
+            label: (_ref1 = declared == null ? void 0 : declared.label) != null ? _ref1 : name
+        }, (declared == null ? void 0 : declared.description) ? {
+            description: declared.description
+        } : {}, (declared == null ? void 0 : declared.default) !== undefined ? {
+            default: declared.default
+        } : {}, (declared == null ? void 0 : declared.options) ? {
+            options: declared.options
+        } : {});
+    });
+}
+/**
+ * Keys an author has set that the plugin will silently ignore.
+ *
+ * The failure this exists to surface: `filterPluginProps` drops anything not
+ * in the allowlist, so a typo does not fail — it just quietly does nothing,
+ * which is the worst of the options. Naming the key is the whole fix.
+ */ export function unknownPluginPropKeys(manifest, values) {
+    var _ref;
+    var _manifest_capabilities;
+    if (!values) return [];
+    const allowed = new Set((_ref = manifest == null ? void 0 : (_manifest_capabilities = manifest.capabilities) == null ? void 0 : _manifest_capabilities.props) != null ? _ref : []);
+    return Object.keys(values).filter((key)=>!allowed.has(key));
+}
+/**
+ * The palette entries an installed plugin contributes (AGL-1031).
+ *
+ * Resolved from the PINNED install, which is what makes the two guarantees in
+ * the issue hold without extra machinery: an element only appears where the
+ * plugin is installed, and a revoked or downgraded version's elements vanish
+ * with it, because the palette is rebuilt from whatever the pin now points at.
+ *
+ * Attributes come back through `resolvePluginPropFields`, so an element's
+ * editable fields are bounded by `capabilities.props` exactly like the generic
+ * plugin element's are. A declared element cannot widen what crosses the
+ * bridge; it only gives the same props a better name and a better editor.
+ */ export function resolvePluginElements(install) {
+    var _ref, _ref1;
+    var _install_manifest;
+    const listingId = install == null ? void 0 : install.listingId;
+    if (!listingId) return [];
+    const declared = (_ref = (_ref1 = install == null ? void 0 : install.elements) != null ? _ref1 : install == null ? void 0 : (_install_manifest = install.manifest) == null ? void 0 : _install_manifest.elements) != null ? _ref : [];
+    const capabilities = install == null ? void 0 : install.capabilities;
+    return declared.map((element)=>{
+        var _element_category;
+        var _element_attributes;
+        return _extends({
+            listingId,
+            elementId: element.id,
+            displayName: element.displayName
+        }, element.description ? {
+            description: element.description
+        } : {}, {
+            category: (_element_category = element.category) != null ? _element_category : 'Data Display'
+        }, element.icon ? {
+            icon: element.icon
+        } : {}, {
+            // Per-element attributes when declared; otherwise the plugin's whole
+            // declared prop set, which is still better than a JSON box.
+            fields: ((_element_attributes = element.attributes) == null ? void 0 : _element_attributes.length) ? resolvePluginPropFields({
+                capabilities: {
+                    props: element.attributes.map((attribute)=>attribute.name),
+                    propSchema: element.attributes
+                }
+            }) : resolvePluginPropFields({
+                capabilities
+            })
+        });
+    });
+}
+
+//# sourceMappingURL=plugin-manifest.js.map