@aglyn/aglyn 1.0.0-beta.256 → 1.0.0-beta.258

package/src/lib/app-utils/node-definition-sanitizer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/node-definition-sanitizer.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The node-definition sanitizer and the component allowlists (AGL-2939):\n * what a PORTABLE node tree must satisfy — one that lands on a canvas that did\n * not author it. Today that is a tree installed from another workspace and a\n * tree a model generated, and the rule is the same for both: whatever reaches\n * the canvas renders in a site whose author never saw it.\n *\n * The platform's rule, so named for what it guards rather than for who asks\n * (AGL-3080): any plugin that brings a tree in from elsewhere passes it\n * through here, and a plugin may not import another plugin's model. The\n * marketplace re-exports it under the names its publishers use.\n */\n\nimport { isFirstPartyMediaSrc } from './media-ref'\nimport { matchComponentPropToken } from './compose-reusable-components'\nimport {\n  isSafeNodeUrl,\n  type NodeUrlProp,\n  SAFE_SRC_PATTERN,\n} from './node-url-policy'\nimport { SAFE_HREF_PATTERN } from './screen-link-value'\n\n/**\n * Component ids a portable tree may hold. Mirrors the persisted ids in\n * plugins-mui (plugin.spec.ts) minus `reusableInstance` — nested\n * instances would smuggle references to another tenant's private\n * definitions — and minus `layoutSlot`, which is layout chrome. Keep sorted.\n *\n * The rule this list encodes is \"inert and self-contained\": an element that\n * renders from its own props travels to another workspace intact. What stays\n * out is what cannot — raw-HTML escape hatches (`customHtml`), references to\n * another tenant's documents (`reusableInstance`), third-party code\n * (`plugin`), host chrome (`layoutSlot`) and anything bound to the source\n * site's data (`collection`, `product`).\n *\n * It must cover everything the besigner's palette offers under those terms, or\n * the catalogue promises what the exporter refuses — which is how `section`\n * came to be missing (AGL-1033): every Sections & Blocks preset composes it,\n * so the whole category was unpublishable. `blocks-publishable.spec.ts` walks\n * the presets and fails if this list falls behind them again.\n */\nexport const PORTABLE_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'form',\n  'formField',\n  'image',\n  'muiAppBar',\n  'muiButton',\n  // MUI's form elements, one element each (they replace the all-in-one formField).\n  'muiCheckbox',\n  'muiFormControl',\n  'muiFormControlLabel',\n  'muiFormHelperText',\n  'muiFormLabel',\n  'muiInput',\n  'muiRadio',\n  'muiRadioGroup',\n  'muiRating',\n  'muiSelect',\n  'muiSelectOption',\n  'muiContainer',\n  'muiList',\n  'muiListItem',\n  'muiListItemText',\n  'muiScreenLink',\n  'muiStack',\n  'muiToolbar',\n  'muiTypography',\n  'searchBox',\n  // A semantic wrapper — `<section>`/`<footer>`/`<nav>` plus styling, with no\n  // behaviour and no binding to the site it came from.\n  'section',\n  'socialLinks',\n  'videoEmbed',\n]\n\n/**\n * Email block ids publishable as an `emailTemplate` (AGL-657).\n *\n * A separate list from the page allowlist because the two vocabularies don't\n * overlap — an email design is built entirely from `plugins-email` blocks, and\n * page components (MUI, forms, video) don't survive an email client anyway.\n *\n * `emailHtml` is excluded deliberately, for the same reason `reusableInstance`\n * is excluded above: it is a raw-HTML escape hatch, and a published template\n * lands in another org's OUTGOING CUSTOMER EMAIL. Email clients don't run\n * scripts, so this isn't XSS — it's that arbitrary markup sent from someone\n * else's domain is a phishing and tracking-pixel vector that no amount of\n * render-time sanitization makes reviewable. Keep sorted.\n */\nexport const PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'emailButton',\n  'emailDivider',\n  'emailImage',\n  'emailProduct',\n  'emailRichtext',\n  'emailSection',\n  'emailSpacer',\n  'emailText',\n]\n\n/**\n * Email block ids publishable as an `emailStarter` — the transactional list\n * minus `emailRichtext`.\n *\n * Derived rather than written out, so a block added to the list above cannot\n * silently miss this one. What it subtracts is the reason it exists.\n *\n * `emailRichtext` holds its content in an `html` prop, and the email renderer's\n * `sanitize` hook defaults to identity with no production caller supplying one\n * — so that prop reaches the recipient's inbox exactly as authored. On a\n * transactional design that is the site's own author writing their own mail. In\n * a STARTER it is a stranger's markup mailed from the shared sending domain\n * under the tenant's From header, which is the raw-HTML escape hatch\n * `emailHtml` was excluded for, wearing a friendlier block name. A remote\n * `<img>` inside it is a tracking pixel that the src policy on `emailImage`\n * would otherwise have caught.\n *\n * Subtracting the block is deliberate rather than sanitizing its markup: an\n * allowlist over someone else's HTML is a judgment we would have to keep\n * re-making, and everything rich text can express in an email — a heading, a\n * paragraph, a link, a button — the remaining blocks already express as a\n * structured tree we render ourselves.\n */\nexport const PORTABLE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST: readonly string[] =\n  PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST.filter(\n    (componentId) => componentId !== 'emailRichtext',\n  )\n\n/** Serialized definition size cap (Firestore doc limit is 1 MiB). */\nexport const PORTABLE_DEFINITION_MAX_BYTES = 200 * 1024\n\nconst KEPT_NODE_KEYS = [\n  '$id',\n  'componentId',\n  'pluginId',\n  'parentId',\n  'props',\n  'nodes',\n] as const\n\n/**\n * The address rules a published node's `href` and `src` meet — the linking\n * elements' navigable protocols, and https, inline or site-relative images\n * (see `node-url-policy`).\n *\n * Exported under these names for a property sanitizer (the marketplace's is\n * one), which holds a portable property's Link default to the same rule as a\n * portable node's `href`, and an Image default to the `src` rule.\n */\nexport {\n  SAFE_HREF_PATTERN as PORTABLE_SAFE_HREF,\n  SAFE_SRC_PATTERN as PORTABLE_SAFE_SRC,\n}\n\n/**\n * The property kind whose value may fill each address prop through a binding\n * (AGL-2933): a Link feeds an `href`, an Image a `src`. Each kind's default is\n * held to that prop's own rule wherever a declaration is published, so the\n * binding carries nothing a literal in the same place could not.\n */\nconst URL_PROP_KIND: Readonly<Record<NodeUrlProp, string>> = {\n  href: 'href',\n  src: 'image',\n}\n\n/**\n * Declared property names by the address prop their kind may fill — the\n * index {@link sanitizePublishedNodeProps} reads a binding against.\n */\nfunction urlBindingsOf(\n  declaredProps: ReadonlyArray<{ name?: unknown; type?: unknown }> | undefined,\n): ReadonlyMap<string, NodeUrlProp> {\n  const bindings = new Map<string, NodeUrlProp>()\n  for (const prop of declaredProps ?? []) {\n    if (typeof prop?.name !== 'string' || !prop.name) continue\n    if (prop.type === URL_PROP_KIND.href) bindings.set(prop.name, 'href')\n    else if (prop.type === URL_PROP_KIND.src) bindings.set(prop.name, 'src')\n  }\n  return bindings\n}\n\n/**\n * Strips props a published node must never carry into someone else's site\n * (AGL-784).\n *\n * `Leaf` spreads a node's props straight onto the rendered component, and MUI\n * passes unknown props through to its root DOM element, so whatever survives\n * publishing reaches the DOM of every org that installs the listing. Marketplace\n * components are auto-listed with no review, and `hosts/{h}/components` is\n * writable by any org member, so a hand-crafted doc is a realistic input here.\n *\n * What each stripped key actually does, measured rather than assumed:\n * - `dangerouslySetInnerHTML` is NOT the stored-XSS it looks like — `Leaf`\n *   always passes a children array, so React throws\n *   \"Can only set one of `children` or `props.dangerouslySetInnerHTML`\"\n *   (and the void-element variant for self-closing components like `image`).\n *   That is worse in practice than it sounds: the throw happens during SSR,\n *   which is the AGL-579 failure mode that 500s the page and wedges ISR for\n *   the whole site. One published component would take down every consumer.\n * - `on*` handlers can only survive JSON as strings, which React drops with a\n *   warning. Removed for hygiene, and so a future renderer that does eval-ish\n *   prop handling can't turn them back into a vector.\n * - `href`/`src` get the render-time URL policy applied at publish time too.\n *   React already neutralizes `javascript:` hrefs and the mui components run\n *   SAFE_HREF themselves, so this is defense in depth for any component that\n *   forgets to — cheap, and it keeps the stored artifact honest.\n * - An `href`/`src` that is exactly one `{{prop.*}}` token naming a declared\n *   property of the kind that holds that address — a Link for `href`, an\n *   Image for `src` — is kept as the binding it is (AGL-2933). The token is no\n *   address, so the rule above would refuse it, and every link and image a\n *   component's properties feed would arrive unbound. What it becomes is held\n *   to the same rule twice over: the property's default where the declaration\n *   is published, and whatever value a page sets where the graft substitutes\n *   it (`resolveComponentPropTokens`). A token that is only part of the value,\n *   or names a property of another kind or none, is refused as before.\n *\n * Deliberately shallow: only top-level props are spread onto the DOM. A nested\n * object (`icon: { path }`) is consumed by the component, never spread, so\n * recursing would strip legitimate data for no security gain.\n */\nfunction sanitizePublishedNodeProps(\n  props: Record<string, unknown>,\n  urlBindings: ReadonlyMap<string, NodeUrlProp>,\n): Record<string, unknown> {\n  const safe: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'dangerouslySetInnerHTML') continue\n    if (/^on[A-Z]/.test(key)) continue\n    if ((key === 'href' || key === 'src') && typeof value === 'string') {\n      const trimmed = value.trim()\n      const bound = matchComponentPropToken(trimmed)\n      const keep =\n        isSafeNodeUrl(key, trimmed) ||\n        (bound !== null && urlBindings.get(bound) === key)\n      if (keep) safe[key] = trimmed\n      continue\n    }\n    safe[key] = value\n  }\n  return safe\n}\n\n/**\n * `nodes` that is still in one of its STORAGE forms rather than a node map\n * (AGL-1395).\n *\n * The two forms `decodeStoredNodes` knows about, tested structurally so this\n * stays a model function with no server import: a byte view — what\n * firebase-admin hands back for a `Bytes` field — and the `{type, data}`\n * envelope `JSON.stringify` makes of a Node `Buffer`, which is what a\n * site-export bundle carries. Neither is a map, and neither is anything the\n * publisher did.\n *\n * The envelope test is deliberately exact, for the reason `decodeStoredNodes`\n * spells out: the alternative reading is a node map with nodes called `type`\n * and `data`, which cannot exist because node-map values are objects.\n */\nfunction isUndecodedNodes(nodes: unknown): boolean {\n  if (ArrayBuffer.isView(nodes)) return true\n  if (typeof nodes !== 'object' || nodes === null || Array.isArray(nodes)) {\n    return false\n  }\n  const value = nodes as { type?: unknown; data?: unknown }\n  return (\n    value.type === 'Buffer' &&\n    Array.isArray(value.data) &&\n    Object.keys(value).length === 2\n  )\n}\n\nexport type PortableDefinitionNodes = Record<\n  string,\n  {\n    $id: string\n    componentId: string\n    pluginId?: string\n    parentId: string | null\n    props?: Record<string, unknown>\n    nodes?: string[]\n  }\n>\n\n/**\n * Validates and strips a host component definition for publishing:\n * - only allowlisted component ids (no reusable instances, no layout chrome)\n * - only the persisted node keys (drops runtime fields like resolvedProps)\n * - the subtree reachable from `rootId` only, and a serialized size cap\n *\n * - per-node prop hardening (see `sanitizePublishedNodeProps`, AGL-784)\n *\n * XSS note: rich-text `html` props stay as-authored here — they are sanitized\n * at render time (sanitize-rich-text allowlist), which also covers definitions\n * written to Firestore directly (see docs/SECURITY_CONTENT_REVIEW.md). Props\n * that are spread onto the DOM (`dangerouslySetInnerHTML`, `on*`, `href`,\n * `src`) are hardened HERE as well, because publishing hands them to a\n * different org's render tree.\n */\nexport function sanitizePortableDefinition(\n  definition: {\n    rootId: string\n    nodes: Record<string, any>\n  },\n  options?: {\n    /**\n     * Additional component ids permitted for this artifact type.\n     *\n     * `layoutSlot` is excluded from the shared allowlist because a slot in\n     * page content has nowhere to graft — but a published LAYOUT is\n     * meaningless without one (AGL-671). Scoped per call rather than added\n     * globally so page and component publishing stay unchanged.\n     */\n    extraComponentIds?: readonly string[]\n    /**\n     * Replaces the page allowlist outright, for artifact types built from a\n     * disjoint component vocabulary — an email design uses `plugins-email`\n     * blocks and nothing else (AGL-657), so EXTENDING the page list would\n     * green-light a `videoEmbed` or `form` that no email client can render.\n     */\n    componentIds?: readonly string[]\n    /**\n     * The properties the tree declares, as they are published beside it\n     * (AGL-2933). A node's `href` or `src` bound whole to one of the kind that\n     * holds that address is kept — see `sanitizePublishedNodeProps`. Absent\n     * for a tree that declares none, which keeps no binding.\n     */\n    declaredProps?: ReadonlyArray<{ name?: unknown; type?: unknown }>\n  },\n):\n  | { ok: true; rootId: string; nodes: PortableDefinitionNodes }\n  | { ok: false; error: string } {\n  const { rootId, nodes } = definition\n  const base = options?.componentIds ?? PORTABLE_COMPONENT_ID_ALLOWLIST\n  const allowed = options?.extraComponentIds?.length\n    ? [...base, ...options.extraComponentIds]\n    : base\n  const urlBindings = urlBindingsOf(options?.declaredProps)\n  // An UNDECODED `nodes` is never the author's fault, so it must not share a\n  // message with a genuinely rootless definition (AGL-1395). Both undecoded\n  // forms — a Node `Buffer` from the Admin SDK, and the `{type:'Buffer'}`\n  // envelope `JSON.stringify` makes of one — reach the root check below as\n  // something with no `_@_` in it, and the answer was \"Definition has no root\n  // node\": a sentence that sends the publisher to redesign a page that is\n  // fine. Callers must run `decodeStoredNodes` first; this says so out loud\n  // rather than letting the next raw read look like a content problem.\n  if (isUndecodedNodes(nodes)) {\n    return {\n      ok: false,\n      error:\n        'This content could not be read — it is stored compressed and was ' +\n        'not decoded before publishing. That is a bug on our side, not a ' +\n        'problem with your design.',\n    }\n  }\n  if (!rootId || !nodes?.[rootId]) {\n    return { ok: false, error: 'Definition has no root node' }\n  }\n  const sanitized: PortableDefinitionNodes = {}\n  /** Set while walking; see the empty-definition check after the loop. */\n  let rootIsWrapper = false\n  const queue = [rootId]\n  while (queue.length) {\n    const id = queue.shift() as string\n    if (sanitized[id]) continue\n    const node = nodes[id]\n    if (!node) return { ok: false, error: `Missing node \"${id}\"` }\n    // The root node is the virtual root-collection wrapper (canvas\n    // `NODE_ROOT_ID` = `_@_`): it declares \"everything inside <body>\" for\n    // drag/drop mapping, not a rendered component, so a `div`/absent\n    // componentId there is structural — not a real component to allowlist\n    // (AGL-783). Exempt ONLY that wrapper shape; a root carrying a real\n    // component id is still checked, so a disallowed component can't be\n    // smuggled in as the root. Every descendant is real content and always\n    // checked below.\n    const isRootWrapper =\n      id === rootId &&\n      (node.componentId == null ||\n        node.componentId === '' ||\n        node.componentId === 'div')\n    if (!isRootWrapper && !allowed.includes(node.componentId)) {\n      return {\n        ok: false,\n        // Says why, not just no (AGL-1033). The bare id was doubly unhelpful:\n        // it is not what the palette calls the element, and it left the author\n        // guessing whether this was a bug or a rule.\n        error:\n          `Component \"${node.componentId}\" cannot be published — a listing may ` +\n          'only contain self-contained presentational elements. Raw HTML, ' +\n          'reusable-component references, plugin elements and anything bound ' +\n          \"to this site's data or layout stay behind.\",\n      }\n    }\n    const plain: any = {}\n    for (const key of KEPT_NODE_KEYS) {\n      if (node[key] !== undefined) plain[key] = node[key]\n    }\n    // Per-node prop hardening (AGL-784) — see sanitizePublishedNodeProps.\n    if (plain.props && typeof plain.props === 'object') {\n      plain.props = sanitizePublishedNodeProps(plain.props, urlBindings)\n    }\n    plain.$id = id\n    plain.parentId = id === rootId ? null : (node.parentId ?? null)\n    // Give the wrapper an explicit container id so the installed definition\n    // renders its root collection the same way it did on the source site.\n    if (isRootWrapper) {\n      plain.componentId = 'div'\n      rootIsWrapper = true\n    }\n    sanitized[id] = plain\n    if (Array.isArray(node.nodes)) queue.push(...node.nodes)\n  }\n  let serialized: string\n  try {\n    serialized = JSON.stringify(sanitized)\n  } catch {\n    return { ok: false, error: 'Definition is not serializable' }\n  }\n  if (serialized.length > PORTABLE_DEFINITION_MAX_BYTES) {\n    return { ok: false, error: 'Definition is too large to publish' }\n  }\n  // An empty definition is not a listing (AGL-1033). Publishing one used to\n  // SUCCEED — the root wrapper alone sanitizes cleanly — so a component whose\n  // content had never been published to its document shipped a blank version\n  // to everyone who installed it, and said nothing. Refusing here is the\n  // \"fail loudly at the point the author understands it\" half.\n  //\n  // Only the WRAPPER case: a definition that is a single real component is a\n  // perfectly good one-element listing, and refusing that would be a different\n  // bug in the other direction.\n  if (rootIsWrapper && Object.keys(sanitized).length <= 1) {\n    return {\n      ok: false,\n      error:\n        'There is nothing to publish — this is empty. If you have edited it ' +\n        'in the designer, publish those changes first, then publish the listing.',\n    }\n  }\n  return { ok: true, rootId, nodes: sanitized }\n}\n\n/**\n * Converts a sanitized portable definition (normalized map) into the\n * nested node shape `canvas.addNodeFromPreset` grafts — ids regenerate on\n * insert, so collisions with existing canvas nodes are impossible\n * (AGL-169). A seen-set guards malformed self-referencing trees.\n */\nexport function portableDefinitionToNested(\n  rootId: string,\n  nodes: PortableDefinitionNodes,\n): Record<string, unknown> | null {\n  const seen = new Set<string>()\n  const build = (id: string): Record<string, unknown> | null => {\n    const node = nodes[id]\n    if (!node || seen.has(id)) return null\n    seen.add(id)\n    return {\n      componentId: node.componentId,\n      ...(node.pluginId ? { pluginId: node.pluginId } : {}),\n      ...(node.props ? { props: node.props } : {}),\n      nodes: (node.nodes ?? [])\n        .map(build)\n        .filter((child): child is Record<string, unknown> => Boolean(child)),\n    }\n  }\n  return build(rootId)\n}\n\n/**\n * Field types a portable dataset schema may declare (AGL-657). Mirrors\n * `DATASET_FIELD_TYPES` in core; duplicated rather than imported to keep this\n * module dependency-free (it is imported by API routes and client components\n * alike), and asserted against the source of truth in the spec.\n */\nexport const PORTABLE_DATASET_FIELD_TYPES: readonly string[] = [\n  'bool',\n  'bytes',\n  'coordinates',\n  'float',\n  'int32',\n  'int64',\n  'map',\n  'nil',\n  'reference',\n  'sorted',\n  'text',\n  'timestamp',\n]\n\n"],"names":["matchComponentPropToken","isSafeNodeUrl","SAFE_SRC_PATTERN","SAFE_HREF_PATTERN","PORTABLE_COMPONENT_ID_ALLOWLIST","PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST","PORTABLE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST","filter","componentId","PORTABLE_DEFINITION_MAX_BYTES","KEPT_NODE_KEYS","PORTABLE_SAFE_HREF","PORTABLE_SAFE_SRC","URL_PROP_KIND","href","src","urlBindingsOf","declaredProps","bindings","Map","prop","name","type","set","sanitizePublishedNodeProps","props","urlBindings","safe","key","value","Object","entries","test","trimmed","trim","bound","keep","get","isUndecodedNodes","nodes","ArrayBuffer","isView","Array","isArray","data","keys","length","sanitizePortableDefinition","definition","options","rootId","base","componentIds","allowed","extraComponentIds","ok","error","sanitized","rootIsWrapper","queue","node","id","shift","isRootWrapper","includes","plain","undefined","$id","parentId","push","serialized","JSON","stringify","portableDefinitionToNested","seen","Set","build","has","add","pluginId","map","child","Boolean","PORTABLE_DATASET_FIELD_TYPES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC;AAGD,SAASA,uBAAuB,QAAQ,mCAA+B;AACvE,SACEC,aAAa,EAEbC,gBAAgB,QACX,uBAAmB;AAC1B,SAASC,iBAAiB,QAAQ,yBAAqB;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;IACA;IACA;IACA,iFAAiF;IACjF;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,qDAAqD;IACrD;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,wCAA2D;IACtE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC,gDACXD,sCAAsCE,MAAM,CAC1C,CAACC,cAAgBA,gBAAgB,iBAClC;AAEH,mEAAmE,GACnE,OAAO,MAAMC,gCAAgC,MAAM,KAAI;AAEvD,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,SACEP,qBAAqBQ,kBAAkB,EACvCT,oBAAoBU,iBAAiB,KACtC;AAED;;;;;CAKC,GACD,MAAMC,gBAAuD;IAC3DC,MAAM;IACNC,KAAK;AACP;AAEA;;;CAGC,GACD,SAASC,cACPC,aAA4E;IAE5E,MAAMC,WAAW,IAAIC;IACrB,KAAK,MAAMC,QAAQH,wBAAAA,gBAAiB,EAAE,CAAE;QACtC,IAAI,QAAOG,wBAAAA,KAAMC,IAAI,MAAK,YAAY,CAACD,KAAKC,IAAI,EAAE;QAClD,IAAID,KAAKE,IAAI,KAAKT,cAAcC,IAAI,EAAEI,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;aACzD,IAAID,KAAKE,IAAI,KAAKT,cAAcE,GAAG,EAAEG,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;IACpE;IACA,OAAOH;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,SAASM,2BACPC,KAA8B,EAC9BC,WAA6C;IAE7C,MAAMC,OAAgC,CAAC;IACvC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACN,OAAQ;QAChD,IAAIG,QAAQ,2BAA2B;QACvC,IAAI,WAAWI,IAAI,CAACJ,MAAM;QAC1B,IAAI,AAACA,CAAAA,QAAQ,UAAUA,QAAQ,KAAI,KAAM,OAAOC,UAAU,UAAU;YAClE,MAAMI,UAAUJ,MAAMK,IAAI;YAC1B,MAAMC,QAAQnC,wBAAwBiC;YACtC,MAAMG,OACJnC,cAAc2B,KAAKK,YAClBE,UAAU,QAAQT,YAAYW,GAAG,CAACF,WAAWP;YAChD,IAAIQ,MAAMT,IAAI,CAACC,IAAI,GAAGK;YACtB;QACF;QACAN,IAAI,CAACC,IAAI,GAAGC;IACd;IACA,OAAOF;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAASW,iBAAiBC,KAAc;IACtC,IAAIC,YAAYC,MAAM,CAACF,QAAQ,OAAO;IACtC,IAAI,OAAOA,UAAU,YAAYA,UAAU,QAAQG,MAAMC,OAAO,CAACJ,QAAQ;QACvE,OAAO;IACT;IACA,MAAMV,QAAQU;IACd,OACEV,MAAMP,IAAI,KAAK,YACfoB,MAAMC,OAAO,CAACd,MAAMe,IAAI,KACxBd,OAAOe,IAAI,CAAChB,OAAOiB,MAAM,KAAK;AAElC;AAcA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,2BACdC,UAGC,EACDC,OAwBC;;QAMeA;IAFhB,MAAM,EAAEC,MAAM,EAAEX,KAAK,EAAE,GAAGS;IAC1B,MAAMG,eAAOF,2BAAAA,QAASG,YAAY,mBAAIhD;IACtC,MAAMiD,UAAUJ,CAAAA,4BAAAA,6BAAAA,QAASK,iBAAiB,qBAA1BL,2BAA4BH,MAAM,IAC9C;WAAIK;WAASF,QAAQK,iBAAiB;KAAC,GACvCH;IACJ,MAAMzB,cAAcV,cAAciC,2BAAAA,QAAShC,aAAa;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,IAAIqB,iBAAiBC,QAAQ;QAC3B,OAAO;YACLgB,IAAI;YACJC,OACE,sEACA,qEACA;QACJ;IACF;IACA,IAAI,CAACN,UAAU,EAACX,yBAAAA,KAAO,CAACW,OAAO,GAAE;QAC/B,OAAO;YAAEK,IAAI;YAAOC,OAAO;QAA8B;IAC3D;IACA,MAAMC,YAAqC,CAAC;IAC5C,sEAAsE,GACtE,IAAIC,gBAAgB;IACpB,MAAMC,QAAQ;QAACT;KAAO;IACtB,MAAOS,MAAMb,MAAM,CAAE;YAwCsBc;QAvCzC,MAAMC,KAAKF,MAAMG,KAAK;QACtB,IAAIL,SAAS,CAACI,GAAG,EAAE;QACnB,MAAMD,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,MAAM,OAAO;YAAEL,IAAI;YAAOC,OAAO,CAAC,cAAc,EAAEK,GAAG,CAAC,CAAC;QAAC;QAC7D,+DAA+D;QAC/D,sEAAsE;QACtE,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,iBAAiB;QACjB,MAAME,gBACJF,OAAOX,UACNU,CAAAA,KAAKpD,WAAW,IAAI,QACnBoD,KAAKpD,WAAW,KAAK,MACrBoD,KAAKpD,WAAW,KAAK,KAAI;QAC7B,IAAI,CAACuD,iBAAiB,CAACV,QAAQW,QAAQ,CAACJ,KAAKpD,WAAW,GAAG;YACzD,OAAO;gBACL+C,IAAI;gBACJ,sEAAsE;gBACtE,uEAAuE;gBACvE,6CAA6C;gBAC7CC,OACE,CAAC,WAAW,EAAEI,KAAKpD,WAAW,CAAC,sCAAsC,CAAC,GACtE,oEACA,uEACA;YACJ;QACF;QACA,MAAMyD,QAAa,CAAC;QACpB,KAAK,MAAMrC,OAAOlB,eAAgB;YAChC,IAAIkD,IAAI,CAAChC,IAAI,KAAKsC,WAAWD,KAAK,CAACrC,IAAI,GAAGgC,IAAI,CAAChC,IAAI;QACrD;QACA,sEAAsE;QACtE,IAAIqC,MAAMxC,KAAK,IAAI,OAAOwC,MAAMxC,KAAK,KAAK,UAAU;YAClDwC,MAAMxC,KAAK,GAAGD,2BAA2ByC,MAAMxC,KAAK,EAAEC;QACxD;QACAuC,MAAME,GAAG,GAAGN;QACZI,MAAMG,QAAQ,GAAGP,OAAOX,SAAS,QAAQU,iBAAAA,KAAKQ,QAAQ,YAAbR,iBAAiB;QAC1D,wEAAwE;QACxE,sEAAsE;QACtE,IAAIG,eAAe;YACjBE,MAAMzD,WAAW,GAAG;YACpBkD,gBAAgB;QAClB;QACAD,SAAS,CAACI,GAAG,GAAGI;QAChB,IAAIvB,MAAMC,OAAO,CAACiB,KAAKrB,KAAK,GAAGoB,MAAMU,IAAI,IAAIT,KAAKrB,KAAK;IACzD;IACA,IAAI+B;IACJ,IAAI;QACFA,aAAaC,KAAKC,SAAS,CAACf;IAC9B,EAAE,eAAM;QACN,OAAO;YAAEF,IAAI;YAAOC,OAAO;QAAiC;IAC9D;IACA,IAAIc,WAAWxB,MAAM,GAAGrC,+BAA+B;QACrD,OAAO;YAAE8C,IAAI;YAAOC,OAAO;QAAqC;IAClE;IACA,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAIE,iBAAiB5B,OAAOe,IAAI,CAACY,WAAWX,MAAM,IAAI,GAAG;QACvD,OAAO;YACLS,IAAI;YACJC,OACE,wEACA;QACJ;IACF;IACA,OAAO;QAAED,IAAI;QAAML;QAAQX,OAAOkB;IAAU;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,SAASgB,2BACdvB,MAAc,EACdX,KAA8B;IAE9B,MAAMmC,OAAO,IAAIC;IACjB,MAAMC,QAAQ,CAACf;YAQHD;QAPV,MAAMA,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,QAAQc,KAAKG,GAAG,CAAChB,KAAK,OAAO;QAClCa,KAAKI,GAAG,CAACjB;QACT,OAAO;YACLrD,aAAaoD,KAAKpD,WAAW;WACzBoD,KAAKmB,QAAQ,GAAG;YAAEA,UAAUnB,KAAKmB,QAAQ;QAAC,IAAI,CAAC,GAC/CnB,KAAKnC,KAAK,GAAG;YAAEA,OAAOmC,KAAKnC,KAAK;QAAC,IAAI,CAAC;YAC1Cc,OAAO,EAACqB,cAAAA,KAAKrB,KAAK,YAAVqB,cAAc,EAAE,EACrBoB,GAAG,CAACJ,OACJrE,MAAM,CAAC,CAAC0E,QAA4CC,QAAQD;;IAEnE;IACA,OAAOL,MAAM1B;AACf;AAEA;;;;;CAKC,GACD,OAAO,MAAMiC,+BAAkD;IAC7D;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/node-definition-sanitizer.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The node-definition sanitizer and the component allowlists (AGL-2939):\n * what a PORTABLE node tree must satisfy — one that lands on a canvas that did\n * not author it. Today that is a tree installed from another workspace and a\n * tree a model generated, and the rule is the same for both: whatever reaches\n * the canvas renders in a site whose author never saw it.\n *\n * The platform's rule, so named for what it guards rather than for who asks\n * (AGL-3080): any plugin that brings a tree in from elsewhere passes it\n * through here, and a plugin may not import another plugin's model. The\n * marketplace re-exports it under the names its publishers use.\n */\n\nimport { isFirstPartyMediaSrc } from './media-ref'\nimport { matchComponentPropToken } from './compose-reusable-components'\nimport {\n  isSafeNodeUrl,\n  type NodeUrlProp,\n  SAFE_SRC_PATTERN,\n} from './node-url-policy'\nimport { SAFE_HREF_PATTERN } from './screen-link-value'\n\n/**\n * Component ids a portable tree may hold. Mirrors the persisted ids in\n * plugins-mui (plugin.spec.ts) minus `reusableInstance` — nested\n * instances would smuggle references to another tenant's private\n * definitions — and minus `layoutSlot`, which is layout chrome. Keep sorted.\n *\n * The rule this list encodes is \"inert and self-contained\": an element that\n * renders from its own props travels to another workspace intact. What stays\n * out is what cannot — raw-HTML escape hatches (`customHtml`), references to\n * another tenant's documents (`reusableInstance`), third-party code\n * (`plugin`), host chrome (`layoutSlot`) and anything bound to the source\n * site's data (`collection`, `product`).\n *\n * It must cover everything the besigner's palette offers under those terms, or\n * the catalogue promises what the exporter refuses — which is how `section`\n * came to be missing (AGL-1033): every Sections & Blocks preset composes it,\n * so the whole category was unpublishable. `blocks-publishable.spec.ts` walks\n * the presets and fails if this list falls behind them again.\n */\nexport const PORTABLE_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'form',\n  'formField',\n  'image',\n  'muiAppBar',\n  'muiButton',\n  // MUI's form elements, one element each (they replace the all-in-one formField).\n  'muiCheckbox',\n  'muiDatePicker',\n  'muiFormControl',\n  'muiFormControlLabel',\n  'muiFormHelperText',\n  'muiFormLabel',\n  'muiInput',\n  'muiRadio',\n  'muiRadioGroup',\n  'muiRating',\n  'muiSelect',\n  'muiSelectOption',\n  'muiTimePicker',\n  'muiContainer',\n  'muiList',\n  'muiListItem',\n  'muiListItemText',\n  'muiScreenLink',\n  'muiStack',\n  'muiToolbar',\n  'muiTypography',\n  'searchBox',\n  // A semantic wrapper — `<section>`/`<footer>`/`<nav>` plus styling, with no\n  // behaviour and no binding to the site it came from.\n  'section',\n  'socialLinks',\n  'videoEmbed',\n]\n\n/**\n * Email block ids publishable as an `emailTemplate` (AGL-657).\n *\n * A separate list from the page allowlist because the two vocabularies don't\n * overlap — an email design is built entirely from `plugins-email` blocks, and\n * page components (MUI, forms, video) don't survive an email client anyway.\n *\n * `emailHtml` is excluded deliberately, for the same reason `reusableInstance`\n * is excluded above: it is a raw-HTML escape hatch, and a published template\n * lands in another org's OUTGOING CUSTOMER EMAIL. Email clients don't run\n * scripts, so this isn't XSS — it's that arbitrary markup sent from someone\n * else's domain is a phishing and tracking-pixel vector that no amount of\n * render-time sanitization makes reviewable. Keep sorted.\n */\nexport const PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST: readonly string[] = [\n  'emailButton',\n  'emailDivider',\n  'emailImage',\n  'emailProduct',\n  'emailRichtext',\n  'emailSection',\n  'emailSpacer',\n  'emailText',\n]\n\n/**\n * Email block ids publishable as an `emailStarter` — the transactional list\n * minus `emailRichtext`.\n *\n * Derived rather than written out, so a block added to the list above cannot\n * silently miss this one. What it subtracts is the reason it exists.\n *\n * `emailRichtext` holds its content in an `html` prop, and the email renderer's\n * `sanitize` hook defaults to identity with no production caller supplying one\n * — so that prop reaches the recipient's inbox exactly as authored. On a\n * transactional design that is the site's own author writing their own mail. In\n * a STARTER it is a stranger's markup mailed from the shared sending domain\n * under the tenant's From header, which is the raw-HTML escape hatch\n * `emailHtml` was excluded for, wearing a friendlier block name. A remote\n * `<img>` inside it is a tracking pixel that the src policy on `emailImage`\n * would otherwise have caught.\n *\n * Subtracting the block is deliberate rather than sanitizing its markup: an\n * allowlist over someone else's HTML is a judgment we would have to keep\n * re-making, and everything rich text can express in an email — a heading, a\n * paragraph, a link, a button — the remaining blocks already express as a\n * structured tree we render ourselves.\n */\nexport const PORTABLE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST: readonly string[] =\n  PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST.filter(\n    (componentId) => componentId !== 'emailRichtext',\n  )\n\n/** Serialized definition size cap (Firestore doc limit is 1 MiB). */\nexport const PORTABLE_DEFINITION_MAX_BYTES = 200 * 1024\n\nconst KEPT_NODE_KEYS = [\n  '$id',\n  'componentId',\n  'pluginId',\n  'parentId',\n  'props',\n  'nodes',\n] as const\n\n/**\n * The address rules a published node's `href` and `src` meet — the linking\n * elements' navigable protocols, and https, inline or site-relative images\n * (see `node-url-policy`).\n *\n * Exported under these names for a property sanitizer (the marketplace's is\n * one), which holds a portable property's Link default to the same rule as a\n * portable node's `href`, and an Image default to the `src` rule.\n */\nexport {\n  SAFE_HREF_PATTERN as PORTABLE_SAFE_HREF,\n  SAFE_SRC_PATTERN as PORTABLE_SAFE_SRC,\n}\n\n/**\n * The property kind whose value may fill each address prop through a binding\n * (AGL-2933): a Link feeds an `href`, an Image a `src`. Each kind's default is\n * held to that prop's own rule wherever a declaration is published, so the\n * binding carries nothing a literal in the same place could not.\n */\nconst URL_PROP_KIND: Readonly<Record<NodeUrlProp, string>> = {\n  href: 'href',\n  src: 'image',\n}\n\n/**\n * Declared property names by the address prop their kind may fill — the\n * index {@link sanitizePublishedNodeProps} reads a binding against.\n */\nfunction urlBindingsOf(\n  declaredProps: ReadonlyArray<{ name?: unknown; type?: unknown }> | undefined,\n): ReadonlyMap<string, NodeUrlProp> {\n  const bindings = new Map<string, NodeUrlProp>()\n  for (const prop of declaredProps ?? []) {\n    if (typeof prop?.name !== 'string' || !prop.name) continue\n    if (prop.type === URL_PROP_KIND.href) bindings.set(prop.name, 'href')\n    else if (prop.type === URL_PROP_KIND.src) bindings.set(prop.name, 'src')\n  }\n  return bindings\n}\n\n/**\n * Strips props a published node must never carry into someone else's site\n * (AGL-784).\n *\n * `Leaf` spreads a node's props straight onto the rendered component, and MUI\n * passes unknown props through to its root DOM element, so whatever survives\n * publishing reaches the DOM of every org that installs the listing. Marketplace\n * components are auto-listed with no review, and `hosts/{h}/components` is\n * writable by any org member, so a hand-crafted doc is a realistic input here.\n *\n * What each stripped key actually does, measured rather than assumed:\n * - `dangerouslySetInnerHTML` is NOT the stored-XSS it looks like — `Leaf`\n *   always passes a children array, so React throws\n *   \"Can only set one of `children` or `props.dangerouslySetInnerHTML`\"\n *   (and the void-element variant for self-closing components like `image`).\n *   That is worse in practice than it sounds: the throw happens during SSR,\n *   which is the AGL-579 failure mode that 500s the page and wedges ISR for\n *   the whole site. One published component would take down every consumer.\n * - `on*` handlers can only survive JSON as strings, which React drops with a\n *   warning. Removed for hygiene, and so a future renderer that does eval-ish\n *   prop handling can't turn them back into a vector.\n * - `href`/`src` get the render-time URL policy applied at publish time too.\n *   React already neutralizes `javascript:` hrefs and the mui components run\n *   SAFE_HREF themselves, so this is defense in depth for any component that\n *   forgets to — cheap, and it keeps the stored artifact honest.\n * - An `href`/`src` that is exactly one `{{prop.*}}` token naming a declared\n *   property of the kind that holds that address — a Link for `href`, an\n *   Image for `src` — is kept as the binding it is (AGL-2933). The token is no\n *   address, so the rule above would refuse it, and every link and image a\n *   component's properties feed would arrive unbound. What it becomes is held\n *   to the same rule twice over: the property's default where the declaration\n *   is published, and whatever value a page sets where the graft substitutes\n *   it (`resolveComponentPropTokens`). A token that is only part of the value,\n *   or names a property of another kind or none, is refused as before.\n *\n * Deliberately shallow: only top-level props are spread onto the DOM. A nested\n * object (`icon: { path }`) is consumed by the component, never spread, so\n * recursing would strip legitimate data for no security gain.\n */\nfunction sanitizePublishedNodeProps(\n  props: Record<string, unknown>,\n  urlBindings: ReadonlyMap<string, NodeUrlProp>,\n): Record<string, unknown> {\n  const safe: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(props)) {\n    if (key === 'dangerouslySetInnerHTML') continue\n    if (/^on[A-Z]/.test(key)) continue\n    if ((key === 'href' || key === 'src') && typeof value === 'string') {\n      const trimmed = value.trim()\n      const bound = matchComponentPropToken(trimmed)\n      const keep =\n        isSafeNodeUrl(key, trimmed) ||\n        (bound !== null && urlBindings.get(bound) === key)\n      if (keep) safe[key] = trimmed\n      continue\n    }\n    safe[key] = value\n  }\n  return safe\n}\n\n/**\n * `nodes` that is still in one of its STORAGE forms rather than a node map\n * (AGL-1395).\n *\n * The two forms `decodeStoredNodes` knows about, tested structurally so this\n * stays a model function with no server import: a byte view — what\n * firebase-admin hands back for a `Bytes` field — and the `{type, data}`\n * envelope `JSON.stringify` makes of a Node `Buffer`, which is what a\n * site-export bundle carries. Neither is a map, and neither is anything the\n * publisher did.\n *\n * The envelope test is deliberately exact, for the reason `decodeStoredNodes`\n * spells out: the alternative reading is a node map with nodes called `type`\n * and `data`, which cannot exist because node-map values are objects.\n */\nfunction isUndecodedNodes(nodes: unknown): boolean {\n  if (ArrayBuffer.isView(nodes)) return true\n  if (typeof nodes !== 'object' || nodes === null || Array.isArray(nodes)) {\n    return false\n  }\n  const value = nodes as { type?: unknown; data?: unknown }\n  return (\n    value.type === 'Buffer' &&\n    Array.isArray(value.data) &&\n    Object.keys(value).length === 2\n  )\n}\n\nexport type PortableDefinitionNodes = Record<\n  string,\n  {\n    $id: string\n    componentId: string\n    pluginId?: string\n    parentId: string | null\n    props?: Record<string, unknown>\n    nodes?: string[]\n  }\n>\n\n/**\n * Validates and strips a host component definition for publishing:\n * - only allowlisted component ids (no reusable instances, no layout chrome)\n * - only the persisted node keys (drops runtime fields like resolvedProps)\n * - the subtree reachable from `rootId` only, and a serialized size cap\n *\n * - per-node prop hardening (see `sanitizePublishedNodeProps`, AGL-784)\n *\n * XSS note: rich-text `html` props stay as-authored here — they are sanitized\n * at render time (sanitize-rich-text allowlist), which also covers definitions\n * written to Firestore directly (see docs/SECURITY_CONTENT_REVIEW.md). Props\n * that are spread onto the DOM (`dangerouslySetInnerHTML`, `on*`, `href`,\n * `src`) are hardened HERE as well, because publishing hands them to a\n * different org's render tree.\n */\nexport function sanitizePortableDefinition(\n  definition: {\n    rootId: string\n    nodes: Record<string, any>\n  },\n  options?: {\n    /**\n     * Additional component ids permitted for this artifact type.\n     *\n     * `layoutSlot` is excluded from the shared allowlist because a slot in\n     * page content has nowhere to graft — but a published LAYOUT is\n     * meaningless without one (AGL-671). Scoped per call rather than added\n     * globally so page and component publishing stay unchanged.\n     */\n    extraComponentIds?: readonly string[]\n    /**\n     * Replaces the page allowlist outright, for artifact types built from a\n     * disjoint component vocabulary — an email design uses `plugins-email`\n     * blocks and nothing else (AGL-657), so EXTENDING the page list would\n     * green-light a `videoEmbed` or `form` that no email client can render.\n     */\n    componentIds?: readonly string[]\n    /**\n     * The properties the tree declares, as they are published beside it\n     * (AGL-2933). A node's `href` or `src` bound whole to one of the kind that\n     * holds that address is kept — see `sanitizePublishedNodeProps`. Absent\n     * for a tree that declares none, which keeps no binding.\n     */\n    declaredProps?: ReadonlyArray<{ name?: unknown; type?: unknown }>\n  },\n):\n  | { ok: true; rootId: string; nodes: PortableDefinitionNodes }\n  | { ok: false; error: string } {\n  const { rootId, nodes } = definition\n  const base = options?.componentIds ?? PORTABLE_COMPONENT_ID_ALLOWLIST\n  const allowed = options?.extraComponentIds?.length\n    ? [...base, ...options.extraComponentIds]\n    : base\n  const urlBindings = urlBindingsOf(options?.declaredProps)\n  // An UNDECODED `nodes` is never the author's fault, so it must not share a\n  // message with a genuinely rootless definition (AGL-1395). Both undecoded\n  // forms — a Node `Buffer` from the Admin SDK, and the `{type:'Buffer'}`\n  // envelope `JSON.stringify` makes of one — reach the root check below as\n  // something with no `_@_` in it, and the answer was \"Definition has no root\n  // node\": a sentence that sends the publisher to redesign a page that is\n  // fine. Callers must run `decodeStoredNodes` first; this says so out loud\n  // rather than letting the next raw read look like a content problem.\n  if (isUndecodedNodes(nodes)) {\n    return {\n      ok: false,\n      error:\n        'This content could not be read — it is stored compressed and was ' +\n        'not decoded before publishing. That is a bug on our side, not a ' +\n        'problem with your design.',\n    }\n  }\n  if (!rootId || !nodes?.[rootId]) {\n    return { ok: false, error: 'Definition has no root node' }\n  }\n  const sanitized: PortableDefinitionNodes = {}\n  /** Set while walking; see the empty-definition check after the loop. */\n  let rootIsWrapper = false\n  const queue = [rootId]\n  while (queue.length) {\n    const id = queue.shift() as string\n    if (sanitized[id]) continue\n    const node = nodes[id]\n    if (!node) return { ok: false, error: `Missing node \"${id}\"` }\n    // The root node is the virtual root-collection wrapper (canvas\n    // `NODE_ROOT_ID` = `_@_`): it declares \"everything inside <body>\" for\n    // drag/drop mapping, not a rendered component, so a `div`/absent\n    // componentId there is structural — not a real component to allowlist\n    // (AGL-783). Exempt ONLY that wrapper shape; a root carrying a real\n    // component id is still checked, so a disallowed component can't be\n    // smuggled in as the root. Every descendant is real content and always\n    // checked below.\n    const isRootWrapper =\n      id === rootId &&\n      (node.componentId == null ||\n        node.componentId === '' ||\n        node.componentId === 'div')\n    if (!isRootWrapper && !allowed.includes(node.componentId)) {\n      return {\n        ok: false,\n        // Says why, not just no (AGL-1033). The bare id was doubly unhelpful:\n        // it is not what the palette calls the element, and it left the author\n        // guessing whether this was a bug or a rule.\n        error:\n          `Component \"${node.componentId}\" cannot be published — a listing may ` +\n          'only contain self-contained presentational elements. Raw HTML, ' +\n          'reusable-component references, plugin elements and anything bound ' +\n          \"to this site's data or layout stay behind.\",\n      }\n    }\n    const plain: any = {}\n    for (const key of KEPT_NODE_KEYS) {\n      if (node[key] !== undefined) plain[key] = node[key]\n    }\n    // Per-node prop hardening (AGL-784) — see sanitizePublishedNodeProps.\n    if (plain.props && typeof plain.props === 'object') {\n      plain.props = sanitizePublishedNodeProps(plain.props, urlBindings)\n    }\n    plain.$id = id\n    plain.parentId = id === rootId ? null : (node.parentId ?? null)\n    // Give the wrapper an explicit container id so the installed definition\n    // renders its root collection the same way it did on the source site.\n    if (isRootWrapper) {\n      plain.componentId = 'div'\n      rootIsWrapper = true\n    }\n    sanitized[id] = plain\n    if (Array.isArray(node.nodes)) queue.push(...node.nodes)\n  }\n  let serialized: string\n  try {\n    serialized = JSON.stringify(sanitized)\n  } catch {\n    return { ok: false, error: 'Definition is not serializable' }\n  }\n  if (serialized.length > PORTABLE_DEFINITION_MAX_BYTES) {\n    return { ok: false, error: 'Definition is too large to publish' }\n  }\n  // An empty definition is not a listing (AGL-1033). Publishing one used to\n  // SUCCEED — the root wrapper alone sanitizes cleanly — so a component whose\n  // content had never been published to its document shipped a blank version\n  // to everyone who installed it, and said nothing. Refusing here is the\n  // \"fail loudly at the point the author understands it\" half.\n  //\n  // Only the WRAPPER case: a definition that is a single real component is a\n  // perfectly good one-element listing, and refusing that would be a different\n  // bug in the other direction.\n  if (rootIsWrapper && Object.keys(sanitized).length <= 1) {\n    return {\n      ok: false,\n      error:\n        'There is nothing to publish — this is empty. If you have edited it ' +\n        'in the designer, publish those changes first, then publish the listing.',\n    }\n  }\n  return { ok: true, rootId, nodes: sanitized }\n}\n\n/**\n * Converts a sanitized portable definition (normalized map) into the\n * nested node shape `canvas.addNodeFromPreset` grafts — ids regenerate on\n * insert, so collisions with existing canvas nodes are impossible\n * (AGL-169). A seen-set guards malformed self-referencing trees.\n */\nexport function portableDefinitionToNested(\n  rootId: string,\n  nodes: PortableDefinitionNodes,\n): Record<string, unknown> | null {\n  const seen = new Set<string>()\n  const build = (id: string): Record<string, unknown> | null => {\n    const node = nodes[id]\n    if (!node || seen.has(id)) return null\n    seen.add(id)\n    return {\n      componentId: node.componentId,\n      ...(node.pluginId ? { pluginId: node.pluginId } : {}),\n      ...(node.props ? { props: node.props } : {}),\n      nodes: (node.nodes ?? [])\n        .map(build)\n        .filter((child): child is Record<string, unknown> => Boolean(child)),\n    }\n  }\n  return build(rootId)\n}\n\n/**\n * Field types a portable dataset schema may declare (AGL-657). Mirrors\n * `DATASET_FIELD_TYPES` in core; duplicated rather than imported to keep this\n * module dependency-free (it is imported by API routes and client components\n * alike), and asserted against the source of truth in the spec.\n */\nexport const PORTABLE_DATASET_FIELD_TYPES: readonly string[] = [\n  'bool',\n  'bytes',\n  'coordinates',\n  'float',\n  'int32',\n  'int64',\n  'map',\n  'nil',\n  'reference',\n  'sorted',\n  'text',\n  'timestamp',\n]\n\n"],"names":["matchComponentPropToken","isSafeNodeUrl","SAFE_SRC_PATTERN","SAFE_HREF_PATTERN","PORTABLE_COMPONENT_ID_ALLOWLIST","PORTABLE_EMAIL_COMPONENT_ID_ALLOWLIST","PORTABLE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST","filter","componentId","PORTABLE_DEFINITION_MAX_BYTES","KEPT_NODE_KEYS","PORTABLE_SAFE_HREF","PORTABLE_SAFE_SRC","URL_PROP_KIND","href","src","urlBindingsOf","declaredProps","bindings","Map","prop","name","type","set","sanitizePublishedNodeProps","props","urlBindings","safe","key","value","Object","entries","test","trimmed","trim","bound","keep","get","isUndecodedNodes","nodes","ArrayBuffer","isView","Array","isArray","data","keys","length","sanitizePortableDefinition","definition","options","rootId","base","componentIds","allowed","extraComponentIds","ok","error","sanitized","rootIsWrapper","queue","node","id","shift","isRootWrapper","includes","plain","undefined","$id","parentId","push","serialized","JSON","stringify","portableDefinitionToNested","seen","Set","build","has","add","pluginId","map","child","Boolean","PORTABLE_DATASET_FIELD_TYPES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC;AAGD,SAASA,uBAAuB,QAAQ,mCAA+B;AACvE,SACEC,aAAa,EAEbC,gBAAgB,QACX,uBAAmB;AAC1B,SAASC,iBAAiB,QAAQ,yBAAqB;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMC,kCAAqD;IAChE;IACA;IACA;IACA;IACA;IACA,iFAAiF;IACjF;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,qDAAqD;IACrD;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,wCAA2D;IACtE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC,gDACXD,sCAAsCE,MAAM,CAC1C,CAACC,cAAgBA,gBAAgB,iBAClC;AAEH,mEAAmE,GACnE,OAAO,MAAMC,gCAAgC,MAAM,KAAI;AAEvD,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,SACEP,qBAAqBQ,kBAAkB,EACvCT,oBAAoBU,iBAAiB,KACtC;AAED;;;;;CAKC,GACD,MAAMC,gBAAuD;IAC3DC,MAAM;IACNC,KAAK;AACP;AAEA;;;CAGC,GACD,SAASC,cACPC,aAA4E;IAE5E,MAAMC,WAAW,IAAIC;IACrB,KAAK,MAAMC,QAAQH,wBAAAA,gBAAiB,EAAE,CAAE;QACtC,IAAI,QAAOG,wBAAAA,KAAMC,IAAI,MAAK,YAAY,CAACD,KAAKC,IAAI,EAAE;QAClD,IAAID,KAAKE,IAAI,KAAKT,cAAcC,IAAI,EAAEI,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;aACzD,IAAID,KAAKE,IAAI,KAAKT,cAAcE,GAAG,EAAEG,SAASK,GAAG,CAACH,KAAKC,IAAI,EAAE;IACpE;IACA,OAAOH;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,SAASM,2BACPC,KAA8B,EAC9BC,WAA6C;IAE7C,MAAMC,OAAgC,CAAC;IACvC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACN,OAAQ;QAChD,IAAIG,QAAQ,2BAA2B;QACvC,IAAI,WAAWI,IAAI,CAACJ,MAAM;QAC1B,IAAI,AAACA,CAAAA,QAAQ,UAAUA,QAAQ,KAAI,KAAM,OAAOC,UAAU,UAAU;YAClE,MAAMI,UAAUJ,MAAMK,IAAI;YAC1B,MAAMC,QAAQnC,wBAAwBiC;YACtC,MAAMG,OACJnC,cAAc2B,KAAKK,YAClBE,UAAU,QAAQT,YAAYW,GAAG,CAACF,WAAWP;YAChD,IAAIQ,MAAMT,IAAI,CAACC,IAAI,GAAGK;YACtB;QACF;QACAN,IAAI,CAACC,IAAI,GAAGC;IACd;IACA,OAAOF;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAASW,iBAAiBC,KAAc;IACtC,IAAIC,YAAYC,MAAM,CAACF,QAAQ,OAAO;IACtC,IAAI,OAAOA,UAAU,YAAYA,UAAU,QAAQG,MAAMC,OAAO,CAACJ,QAAQ;QACvE,OAAO;IACT;IACA,MAAMV,QAAQU;IACd,OACEV,MAAMP,IAAI,KAAK,YACfoB,MAAMC,OAAO,CAACd,MAAMe,IAAI,KACxBd,OAAOe,IAAI,CAAChB,OAAOiB,MAAM,KAAK;AAElC;AAcA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,2BACdC,UAGC,EACDC,OAwBC;;QAMeA;IAFhB,MAAM,EAAEC,MAAM,EAAEX,KAAK,EAAE,GAAGS;IAC1B,MAAMG,eAAOF,2BAAAA,QAASG,YAAY,mBAAIhD;IACtC,MAAMiD,UAAUJ,CAAAA,4BAAAA,6BAAAA,QAASK,iBAAiB,qBAA1BL,2BAA4BH,MAAM,IAC9C;WAAIK;WAASF,QAAQK,iBAAiB;KAAC,GACvCH;IACJ,MAAMzB,cAAcV,cAAciC,2BAAAA,QAAShC,aAAa;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,IAAIqB,iBAAiBC,QAAQ;QAC3B,OAAO;YACLgB,IAAI;YACJC,OACE,sEACA,qEACA;QACJ;IACF;IACA,IAAI,CAACN,UAAU,EAACX,yBAAAA,KAAO,CAACW,OAAO,GAAE;QAC/B,OAAO;YAAEK,IAAI;YAAOC,OAAO;QAA8B;IAC3D;IACA,MAAMC,YAAqC,CAAC;IAC5C,sEAAsE,GACtE,IAAIC,gBAAgB;IACpB,MAAMC,QAAQ;QAACT;KAAO;IACtB,MAAOS,MAAMb,MAAM,CAAE;YAwCsBc;QAvCzC,MAAMC,KAAKF,MAAMG,KAAK;QACtB,IAAIL,SAAS,CAACI,GAAG,EAAE;QACnB,MAAMD,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,MAAM,OAAO;YAAEL,IAAI;YAAOC,OAAO,CAAC,cAAc,EAAEK,GAAG,CAAC,CAAC;QAAC;QAC7D,+DAA+D;QAC/D,sEAAsE;QACtE,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,iBAAiB;QACjB,MAAME,gBACJF,OAAOX,UACNU,CAAAA,KAAKpD,WAAW,IAAI,QACnBoD,KAAKpD,WAAW,KAAK,MACrBoD,KAAKpD,WAAW,KAAK,KAAI;QAC7B,IAAI,CAACuD,iBAAiB,CAACV,QAAQW,QAAQ,CAACJ,KAAKpD,WAAW,GAAG;YACzD,OAAO;gBACL+C,IAAI;gBACJ,sEAAsE;gBACtE,uEAAuE;gBACvE,6CAA6C;gBAC7CC,OACE,CAAC,WAAW,EAAEI,KAAKpD,WAAW,CAAC,sCAAsC,CAAC,GACtE,oEACA,uEACA;YACJ;QACF;QACA,MAAMyD,QAAa,CAAC;QACpB,KAAK,MAAMrC,OAAOlB,eAAgB;YAChC,IAAIkD,IAAI,CAAChC,IAAI,KAAKsC,WAAWD,KAAK,CAACrC,IAAI,GAAGgC,IAAI,CAAChC,IAAI;QACrD;QACA,sEAAsE;QACtE,IAAIqC,MAAMxC,KAAK,IAAI,OAAOwC,MAAMxC,KAAK,KAAK,UAAU;YAClDwC,MAAMxC,KAAK,GAAGD,2BAA2ByC,MAAMxC,KAAK,EAAEC;QACxD;QACAuC,MAAME,GAAG,GAAGN;QACZI,MAAMG,QAAQ,GAAGP,OAAOX,SAAS,QAAQU,iBAAAA,KAAKQ,QAAQ,YAAbR,iBAAiB;QAC1D,wEAAwE;QACxE,sEAAsE;QACtE,IAAIG,eAAe;YACjBE,MAAMzD,WAAW,GAAG;YACpBkD,gBAAgB;QAClB;QACAD,SAAS,CAACI,GAAG,GAAGI;QAChB,IAAIvB,MAAMC,OAAO,CAACiB,KAAKrB,KAAK,GAAGoB,MAAMU,IAAI,IAAIT,KAAKrB,KAAK;IACzD;IACA,IAAI+B;IACJ,IAAI;QACFA,aAAaC,KAAKC,SAAS,CAACf;IAC9B,EAAE,eAAM;QACN,OAAO;YAAEF,IAAI;YAAOC,OAAO;QAAiC;IAC9D;IACA,IAAIc,WAAWxB,MAAM,GAAGrC,+BAA+B;QACrD,OAAO;YAAE8C,IAAI;YAAOC,OAAO;QAAqC;IAClE;IACA,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAIE,iBAAiB5B,OAAOe,IAAI,CAACY,WAAWX,MAAM,IAAI,GAAG;QACvD,OAAO;YACLS,IAAI;YACJC,OACE,wEACA;QACJ;IACF;IACA,OAAO;QAAED,IAAI;QAAML;QAAQX,OAAOkB;IAAU;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,SAASgB,2BACdvB,MAAc,EACdX,KAA8B;IAE9B,MAAMmC,OAAO,IAAIC;IACjB,MAAMC,QAAQ,CAACf;YAQHD;QAPV,MAAMA,OAAOrB,KAAK,CAACsB,GAAG;QACtB,IAAI,CAACD,QAAQc,KAAKG,GAAG,CAAChB,KAAK,OAAO;QAClCa,KAAKI,GAAG,CAACjB;QACT,OAAO;YACLrD,aAAaoD,KAAKpD,WAAW;WACzBoD,KAAKmB,QAAQ,GAAG;YAAEA,UAAUnB,KAAKmB,QAAQ;QAAC,IAAI,CAAC,GAC/CnB,KAAKnC,KAAK,GAAG;YAAEA,OAAOmC,KAAKnC,KAAK;QAAC,IAAI,CAAC;YAC1Cc,OAAO,EAACqB,cAAAA,KAAKrB,KAAK,YAAVqB,cAAc,EAAE,EACrBoB,GAAG,CAACJ,OACJrE,MAAM,CAAC,CAAC0E,QAA4CC,QAAQD;;IAEnE;IACA,OAAOL,MAAM1B;AACf;AAEA;;;;;CAKC,GACD,OAAO,MAAMiC,+BAAkD;IAC7D;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/src/lib/plugin-manager/first-party-plugins.generated.js

@@ -325,6 +325,16 @@
             "keeps": "The audio in your media library is kept, and players keep working on the workspace's other sites."
         }
     },
+    {
+        "id": "help-desks",
+        "label": "Help desks",
+        "alwaysOnForWorkspace": true,
+        "description": "Your buyers and their recent orders in your own Gorgias, Re:amaze, Kustomer, Gladly or Richpanel account, and contact form messages as tickets.",
+        "siteOff": {
+            "stops": "Switching Help desks off for this site stops its buyers, orders and contact form messages reaching the help desks it connected.",
+            "keeps": "The connections are kept, and everything already sent stays in the help desk."
+        }
+    },
     {
         "id": "ad-conversions",
         "label": "Ad conversions",
@@ -375,6 +385,7 @@ export const PUBLISHED_SITE_IMPACT = {
     "review-platforms": "console-only",
     "weglot": "elements",
     "music": "elements",
+    "help-desks": "console-only",
     "ad-conversions": "console-only"
 };
 /**
@@ -1924,6 +1935,15 @@ export const PUBLISHED_SITE_IMPACT = {
  * Where a person reads each record kind a first-party plugin's console page
  * shows, declared by that plugin (AGL-3080), for a server's notification link.
  */ export const PLUGIN_RECORD_PAGES_DECLARED = [
+    {
+        "pluginId": "commerce",
+        "kind": "order",
+        "path": "/products/orders",
+        "record": {
+            "path": "/products/orders",
+            "param": "order"
+        }
+    },
     {
         "pluginId": "inbox",
         "kind": "formSubmission",
@@ -2326,6 +2346,21 @@ export const PUBLISHED_SITE_IMPACT = {
         "name": "marketingPlatformEvents",
         "orgField": "orgId"
     },
+    {
+        "pluginId": "help-desks",
+        "name": "helpDeskConnections",
+        "orgField": "orgId"
+    },
+    {
+        "pluginId": "help-desks",
+        "name": "helpDeskOutbox",
+        "orgField": "orgId"
+    },
+    {
+        "pluginId": "help-desks",
+        "name": "helpDeskCustomers",
+        "orgField": "orgId"
+    },
     {
         "pluginId": "ad-conversions",
         "name": "adConversionConnections",