@aglyn/plugins-data 1.0.0-beta.218 → 1.0.0-beta.220

package/src/lib/form-target/form-dataset-binding-token.js

@@ -0,0 +1,107 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { tokenSigningSecret } from "@aglyn/tenant-data-admin/server/media-signing";
+import { safeEqual } from "@aglyn/tenant-data-admin/server/safe-equal";
+import { createHmac } from "crypto";
+/**
+ * A form's dataset binding, signed into the page that renders the form.
+ *
+ * `/api/forms/submit` is public and unauthenticated, so nothing in its body
+ * may choose which dataset a record lands in: a dataset id taken from the body
+ * let anyone add rows to any dataset the site can see. The binding is instead
+ * read off the form by the compose that renders the page, signed here, and
+ * carried by the form; the route writes only where a valid signature says.
+ *
+ * What a token grants is what the published form already does. Anyone can read
+ * one out of the page, and replaying it writes to that form's dataset with
+ * that form's field map, for the site it was minted on — nothing a visitor
+ * submitting the form could not already do.
+ *
+ * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the
+ * other tenant tokens use, under its own `form-dataset-binding:` prefix so it
+ * can never be replayed as any other kind of token. No expiry: a published
+ * page can be served long after it rendered, and an expired token would drop
+ * a live form's records. Rotating the secret, or the version, retires every
+ * token at once.
+ */ const VERSION = 'v1';
+const PREFIX = 'form-dataset-binding';
+/** Far above any real binding, so an oversized body is refused unparsed. */ const MAX_TOKEN_CHARS = 8192;
+const signature = (payload)=>createHmac('sha256', tokenSigningSecret()).update(`${PREFIX}:${VERSION}:${payload}`).digest('hex');
+/**
+ * The token a page carries for one form's binding on one site.
+ *
+ * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this
+ * secret signs; a caller that renders a page decides what an unsigned form
+ * does.
+ */ export function signFormDatasetBinding(hostId, binding) {
+    const body = _extends({
+        h: hostId
+    }, binding.datasetId ? {
+        d: binding.datasetId
+    } : {}, binding.datasetName ? {
+        n: binding.datasetName
+    } : {}, {
+        m: binding.fieldMap
+    });
+    const payload = Buffer.from(JSON.stringify(body)).toString('base64url');
+    return `${VERSION}.${payload}.${signature(payload)}`;
+}
+const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
+/**
+ * The binding a token carries, or null when it is not a valid token for
+ * `hostId`.
+ *
+ * Null for anything else at all — not a string, oversized, another version, a
+ * signature that does not match, a site other than this one, or no signing
+ * secret — because the only safe reading of a binding that cannot be verified
+ * is that there is none.
+ */ export function verifyFormDatasetBinding(hostId, token) {
+    try {
+        if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null;
+        const [version, payload, signed, extra] = token.split('.');
+        if (version !== VERSION || !payload || !signed || extra !== undefined) {
+            return null;
+        }
+        if (!safeEqual(signed, signature(payload))) return null;
+        const body = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (!hostId || (body == null ? void 0 : body.h) !== hostId) return null;
+        const datasetId = text(body.d, 128);
+        const datasetName = text(body.n, 60);
+        if (!datasetId && !datasetName) return null;
+        const fieldMap = {};
+        if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {
+            for (const [key, value] of Object.entries(body.m)){
+                const submittedKey = text(key, 64);
+                const datasetFieldId = text(value, 64);
+                if (submittedKey && datasetFieldId) {
+                    fieldMap[submittedKey] = datasetFieldId;
+                }
+            }
+        }
+        return _extends({}, datasetId ? {
+            datasetId
+        } : {}, datasetName ? {
+            datasetName
+        } : {}, {
+            fieldMap
+        });
+    } catch (unused) {
+        return null;
+    }
+}
+
+//# sourceMappingURL=form-dataset-binding-token.js.map

package/src/lib/form-target/form-dataset-binding-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/form-target/form-dataset-binding-token.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { tokenSigningSecret } from '@aglyn/tenant-data-admin/server/media-signing'\nimport { safeEqual } from '@aglyn/tenant-data-admin/server/safe-equal'\nimport { createHmac } from 'crypto'\nimport type { FormDatasetBinding } from './form-dataset-binding'\n\n/**\n * A form's dataset binding, signed into the page that renders the form.\n *\n * `/api/forms/submit` is public and unauthenticated, so nothing in its body\n * may choose which dataset a record lands in: a dataset id taken from the body\n * let anyone add rows to any dataset the site can see. The binding is instead\n * read off the form by the compose that renders the page, signed here, and\n * carried by the form; the route writes only where a valid signature says.\n *\n * What a token grants is what the published form already does. Anyone can read\n * one out of the page, and replaying it writes to that form's dataset with\n * that form's field map, for the site it was minted on — nothing a visitor\n * submitting the form could not already do.\n *\n * Signed with the shared, fail-closed `TOKEN_SIGNING_SECRET`, the secret the\n * other tenant tokens use, under its own `form-dataset-binding:` prefix so it\n * can never be replayed as any other kind of token. No expiry: a published\n * page can be served long after it rendered, and an expired token would drop\n * a live form's records. Rotating the secret, or the version, retires every\n * token at once.\n */\n\nconst VERSION = 'v1'\nconst PREFIX = 'form-dataset-binding'\n/** Far above any real binding, so an oversized body is refused unparsed. */\nconst MAX_TOKEN_CHARS = 8192\n\ninterface SignedBinding {\n  h: string\n  d?: string\n  n?: string\n  m: Record<string, string>\n}\n\nconst signature = (payload: string): string =>\n  createHmac('sha256', tokenSigningSecret())\n    .update(`${PREFIX}:${VERSION}:${payload}`)\n    .digest('hex')\n\n/**\n * The token a page carries for one form's binding on one site.\n *\n * Throws when `TOKEN_SIGNING_SECRET` is not configured, like every token this\n * secret signs; a caller that renders a page decides what an unsigned form\n * does.\n */\nexport function signFormDatasetBinding(\n  hostId: string,\n  binding: FormDatasetBinding,\n): string {\n  const body: SignedBinding = {\n    h: hostId,\n    ...(binding.datasetId ? { d: binding.datasetId } : {}),\n    ...(binding.datasetName ? { n: binding.datasetName } : {}),\n    m: binding.fieldMap,\n  }\n  const payload = Buffer.from(JSON.stringify(body)).toString('base64url')\n  return `${VERSION}.${payload}.${signature(payload)}`\n}\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * The binding a token carries, or null when it is not a valid token for\n * `hostId`.\n *\n * Null for anything else at all — not a string, oversized, another version, a\n * signature that does not match, a site other than this one, or no signing\n * secret — because the only safe reading of a binding that cannot be verified\n * is that there is none.\n */\nexport function verifyFormDatasetBinding(\n  hostId: string,\n  token: unknown,\n): FormDatasetBinding | null {\n  try {\n    if (typeof token !== 'string' || token.length > MAX_TOKEN_CHARS) return null\n    const [version, payload, signed, extra] = token.split('.')\n    if (version !== VERSION || !payload || !signed || extra !== undefined) {\n      return null\n    }\n    if (!safeEqual(signed, signature(payload))) return null\n    const body = JSON.parse(\n      Buffer.from(payload, 'base64url').toString('utf8'),\n    ) as Partial<SignedBinding>\n    if (!hostId || body?.h !== hostId) return null\n    const datasetId = text(body.d, 128)\n    const datasetName = text(body.n, 60)\n    if (!datasetId && !datasetName) return null\n    const fieldMap: Record<string, string> = {}\n    if (body.m && typeof body.m === 'object' && !Array.isArray(body.m)) {\n      for (const [key, value] of Object.entries(body.m)) {\n        const submittedKey = text(key, 64)\n        const datasetFieldId = text(value, 64)\n        if (submittedKey && datasetFieldId) {\n          fieldMap[submittedKey] = datasetFieldId\n        }\n      }\n    }\n    return {\n      ...(datasetId ? { datasetId } : {}),\n      ...(datasetName ? { datasetName } : {}),\n      fieldMap,\n    }\n  } catch {\n    return null\n  }\n}\n"],"names":["tokenSigningSecret","safeEqual","createHmac","VERSION","PREFIX","MAX_TOKEN_CHARS","signature","payload","update","digest","signFormDatasetBinding","hostId","binding","body","h","datasetId","d","datasetName","n","m","fieldMap","Buffer","from","JSON","stringify","toString","text","value","max","trim","slice","verifyFormDatasetBinding","token","length","version","signed","extra","split","undefined","parse","Array","isArray","key","Object","entries","submittedKey","datasetFieldId"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,gDAA+C;AAClF,SAASC,SAAS,QAAQ,6CAA4C;AACtE,SAASC,UAAU,QAAQ,SAAQ;AAGnC;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,UAAU;AAChB,MAAMC,SAAS;AACf,0EAA0E,GAC1E,MAAMC,kBAAkB;AASxB,MAAMC,YAAY,CAACC,UACjBL,WAAW,UAAUF,sBAClBQ,MAAM,CAAC,GAAGJ,OAAO,CAAC,EAAED,QAAQ,CAAC,EAAEI,SAAS,EACxCE,MAAM,CAAC;AAEZ;;;;;;CAMC,GACD,OAAO,SAASC,uBACdC,MAAc,EACdC,OAA2B;IAE3B,MAAMC,OAAsB;QAC1BC,GAAGH;OACCC,QAAQG,SAAS,GAAG;QAAEC,GAAGJ,QAAQG,SAAS;IAAC,IAAI,CAAC,GAChDH,QAAQK,WAAW,GAAG;QAAEC,GAAGN,QAAQK,WAAW;IAAC,IAAI,CAAC;QACxDE,GAAGP,QAAQQ,QAAQ;;IAErB,MAAMb,UAAUc,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACX,OAAOY,QAAQ,CAAC;IAC3D,OAAO,GAAGtB,QAAQ,CAAC,EAAEI,QAAQ,CAAC,EAAED,UAAUC,UAAU;AACtD;AAEA,MAAMmB,OAAO,CAACC,OAAgBC,MAC5B,OAAOD,UAAU,WAAWA,MAAME,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;CAQC,GACD,OAAO,SAASG,yBACdpB,MAAc,EACdqB,KAAc;IAEd,IAAI;QACF,IAAI,OAAOA,UAAU,YAAYA,MAAMC,MAAM,GAAG5B,iBAAiB,OAAO;QACxE,MAAM,CAAC6B,SAAS3B,SAAS4B,QAAQC,MAAM,GAAGJ,MAAMK,KAAK,CAAC;QACtD,IAAIH,YAAY/B,WAAW,CAACI,WAAW,CAAC4B,UAAUC,UAAUE,WAAW;YACrE,OAAO;QACT;QACA,IAAI,CAACrC,UAAUkC,QAAQ7B,UAAUC,WAAW,OAAO;QACnD,MAAMM,OAAOU,KAAKgB,KAAK,CACrBlB,OAAOC,IAAI,CAACf,SAAS,aAAakB,QAAQ,CAAC;QAE7C,IAAI,CAACd,UAAUE,CAAAA,wBAAAA,KAAMC,CAAC,MAAKH,QAAQ,OAAO;QAC1C,MAAMI,YAAYW,KAAKb,KAAKG,CAAC,EAAE;QAC/B,MAAMC,cAAcS,KAAKb,KAAKK,CAAC,EAAE;QACjC,IAAI,CAACH,aAAa,CAACE,aAAa,OAAO;QACvC,MAAMG,WAAmC,CAAC;QAC1C,IAAIP,KAAKM,CAAC,IAAI,OAAON,KAAKM,CAAC,KAAK,YAAY,CAACqB,MAAMC,OAAO,CAAC5B,KAAKM,CAAC,GAAG;YAClE,KAAK,MAAM,CAACuB,KAAKf,MAAM,IAAIgB,OAAOC,OAAO,CAAC/B,KAAKM,CAAC,EAAG;gBACjD,MAAM0B,eAAenB,KAAKgB,KAAK;gBAC/B,MAAMI,iBAAiBpB,KAAKC,OAAO;gBACnC,IAAIkB,gBAAgBC,gBAAgB;oBAClC1B,QAAQ,CAACyB,aAAa,GAAGC;gBAC3B;YACF;QACF;QACA,OAAO,aACD/B,YAAY;YAAEA;QAAU,IAAI,CAAC,GAC7BE,cAAc;YAAEA;QAAY,IAAI,CAAC;YACrCG;;IAEJ,EAAE,eAAM;QACN,OAAO;IACT;AACF"}

package/src/lib/form-target/form-dataset-binding.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { AglynNodeSchema, NodeId } from '@aglyn/aglyn';
+/**
+ * Where a form's submissions are also written as dataset records, read off
+ * the form as a page renders it.
+ */
+export interface FormDatasetBinding {
+    /** The dataset, by id, so renaming it never breaks the binding (AGL-556). */
+    datasetId?: string;
+    /** The legacy by-name binding, honored when no id is set (AGL-141). */
+    datasetName?: string;
+    /** Submitted field name → the dataset field id the value is stored under. */
+    fieldMap: Record<string, string>;
+}
+/** The most fields a submission may carry, and so the most a map can name. */
+export declare const FORM_DATASET_BINDING_MAX_FIELDS = 20;
+/**
+ * The dataset binding a `form` node declares, or null when it declares none.
+ *
+ * The map is built the way the browser builds the submission: every
+ * `formField` under the form, in reading order, keyed by the name the field
+ * submits under (`fieldName`, or `field` when it has none), and a later field
+ * under the same name replaces an earlier one. A field with no
+ * `datasetFieldId` maps nothing and its value falls back to matching dataset
+ * fields by name.
+ *
+ * Read from the COMPOSED tree, so a form grafted from a layout, a reusable
+ * component or a form entity is read exactly as the page renders it.
+ */
+export declare function formDatasetBindingOf(nodes: Record<NodeId, AglynNodeSchema | undefined> | undefined | null, formNodeId: NodeId): FormDatasetBinding | null;
+/** Every `form` node in a composed tree that declares a dataset binding. */
+export declare function formDatasetBindingsOf(nodes: Record<NodeId, AglynNodeSchema | undefined> | undefined | null): Array<{
+    nodeId: NodeId;
+    binding: FormDatasetBinding;
+}>;

package/src/lib/form-target/form-dataset-binding.js

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { collectFormFieldNodeIds, FORM_COMPONENT_ID } from "@aglyn/aglyn/app-utils/forms";
+/** The most fields a submission may carry, and so the most a map can name. */ export const FORM_DATASET_BINDING_MAX_FIELDS = 20;
+const text = (value, max)=>typeof value === 'string' ? value.trim().slice(0, max) : '';
+/**
+ * The dataset binding a `form` node declares, or null when it declares none.
+ *
+ * The map is built the way the browser builds the submission: every
+ * `formField` under the form, in reading order, keyed by the name the field
+ * submits under (`fieldName`, or `field` when it has none), and a later field
+ * under the same name replaces an earlier one. A field with no
+ * `datasetFieldId` maps nothing and its value falls back to matching dataset
+ * fields by name.
+ *
+ * Read from the COMPOSED tree, so a form grafted from a layout, a reusable
+ * component or a form entity is read exactly as the page renders it.
+ */ export function formDatasetBindingOf(nodes, formNodeId) {
+    var _node_props;
+    const node = nodes == null ? void 0 : nodes[formNodeId];
+    if ((node == null ? void 0 : node.componentId) !== FORM_COMPONENT_ID) return null;
+    const props = (_node_props = node.props) != null ? _node_props : {};
+    const datasetId = text(props['datasetId'], 128);
+    const datasetName = text(props['datasetName'], 60);
+    if (!datasetId && !datasetName) return null;
+    const fieldMap = {};
+    for (const fieldNodeId of collectFormFieldNodeIds(nodes, formNodeId)){
+        var _ref;
+        var _nodes_fieldNodeId;
+        const fieldProps = (_ref = nodes == null ? void 0 : (_nodes_fieldNodeId = nodes[fieldNodeId]) == null ? void 0 : _nodes_fieldNodeId.props) != null ? _ref : {};
+        const datasetFieldId = text(fieldProps['datasetFieldId'], 64);
+        if (!datasetFieldId) continue;
+        const submittedKey = text(fieldProps['fieldName'], 64) || 'field';
+        if (!(submittedKey in fieldMap) && Object.keys(fieldMap).length >= FORM_DATASET_BINDING_MAX_FIELDS) {
+            continue;
+        }
+        fieldMap[submittedKey] = datasetFieldId;
+    }
+    return _extends({}, datasetId ? {
+        datasetId
+    } : {}, datasetName ? {
+        datasetName
+    } : {}, {
+        fieldMap
+    });
+}
+/** Every `form` node in a composed tree that declares a dataset binding. */ export function formDatasetBindingsOf(nodes) {
+    const found = [];
+    for (const [nodeId, node] of Object.entries(nodes != null ? nodes : {})){
+        if ((node == null ? void 0 : node.componentId) !== FORM_COMPONENT_ID) continue;
+        const binding = formDatasetBindingOf(nodes, nodeId);
+        if (binding) found.push({
+            nodeId: nodeId,
+            binding
+        });
+    }
+    return found;
+}
+
+//# sourceMappingURL=form-dataset-binding.js.map

package/src/lib/form-target/form-dataset-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/form-target/form-dataset-binding.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynNodeSchema, NodeId } from '@aglyn/aglyn'\nimport {\n  collectFormFieldNodeIds,\n  FORM_COMPONENT_ID,\n} from '@aglyn/aglyn/app-utils/forms'\n\n/**\n * Where a form's submissions are also written as dataset records, read off\n * the form as a page renders it.\n */\nexport interface FormDatasetBinding {\n  /** The dataset, by id, so renaming it never breaks the binding (AGL-556). */\n  datasetId?: string\n  /** The legacy by-name binding, honored when no id is set (AGL-141). */\n  datasetName?: string\n  /** Submitted field name → the dataset field id the value is stored under. */\n  fieldMap: Record<string, string>\n}\n\n/** The most fields a submission may carry, and so the most a map can name. */\nexport const FORM_DATASET_BINDING_MAX_FIELDS = 20\n\nconst text = (value: unknown, max: number): string =>\n  typeof value === 'string' ? value.trim().slice(0, max) : ''\n\n/**\n * The dataset binding a `form` node declares, or null when it declares none.\n *\n * The map is built the way the browser builds the submission: every\n * `formField` under the form, in reading order, keyed by the name the field\n * submits under (`fieldName`, or `field` when it has none), and a later field\n * under the same name replaces an earlier one. A field with no\n * `datasetFieldId` maps nothing and its value falls back to matching dataset\n * fields by name.\n *\n * Read from the COMPOSED tree, so a form grafted from a layout, a reusable\n * component or a form entity is read exactly as the page renders it.\n */\nexport function formDatasetBindingOf(\n  nodes: Record<NodeId, AglynNodeSchema | undefined> | undefined | null,\n  formNodeId: NodeId,\n): FormDatasetBinding | null {\n  const node = nodes?.[formNodeId]\n  if (node?.componentId !== FORM_COMPONENT_ID) return null\n  const props = (node.props ?? {}) as Record<string, unknown>\n  const datasetId = text(props['datasetId'], 128)\n  const datasetName = text(props['datasetName'], 60)\n  if (!datasetId && !datasetName) return null\n  const fieldMap: Record<string, string> = {}\n  for (const fieldNodeId of collectFormFieldNodeIds(nodes, formNodeId)) {\n    const fieldProps = (nodes?.[fieldNodeId]?.props ?? {}) as Record<\n      string,\n      unknown\n    >\n    const datasetFieldId = text(fieldProps['datasetFieldId'], 64)\n    if (!datasetFieldId) continue\n    const submittedKey = text(fieldProps['fieldName'], 64) || 'field'\n    if (\n      !(submittedKey in fieldMap) &&\n      Object.keys(fieldMap).length >= FORM_DATASET_BINDING_MAX_FIELDS\n    ) {\n      continue\n    }\n    fieldMap[submittedKey] = datasetFieldId\n  }\n  return {\n    ...(datasetId ? { datasetId } : {}),\n    ...(datasetName ? { datasetName } : {}),\n    fieldMap,\n  }\n}\n\n/** Every `form` node in a composed tree that declares a dataset binding. */\nexport function formDatasetBindingsOf(\n  nodes: Record<NodeId, AglynNodeSchema | undefined> | undefined | null,\n): Array<{ nodeId: NodeId; binding: FormDatasetBinding }> {\n  const found: Array<{ nodeId: NodeId; binding: FormDatasetBinding }> = []\n  for (const [nodeId, node] of Object.entries(nodes ?? {})) {\n    if (node?.componentId !== FORM_COMPONENT_ID) continue\n    const binding = formDatasetBindingOf(nodes, nodeId as NodeId)\n    if (binding) found.push({ nodeId: nodeId as NodeId, binding })\n  }\n  return found\n}\n"],"names":["collectFormFieldNodeIds","FORM_COMPONENT_ID","FORM_DATASET_BINDING_MAX_FIELDS","text","value","max","trim","slice","formDatasetBindingOf","nodes","formNodeId","node","componentId","props","datasetId","datasetName","fieldMap","fieldNodeId","fieldProps","datasetFieldId","submittedKey","Object","keys","length","formDatasetBindingsOf","found","nodeId","entries","binding","push"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,uBAAuB,EACvBC,iBAAiB,QACZ,+BAA8B;AAerC,4EAA4E,GAC5E,OAAO,MAAMC,kCAAkC,GAAE;AAEjD,MAAMC,OAAO,CAACC,OAAgBC,MAC5B,OAAOD,UAAU,WAAWA,MAAME,IAAI,GAAGC,KAAK,CAAC,GAAGF,OAAO;AAE3D;;;;;;;;;;;;CAYC,GACD,OAAO,SAASG,qBACdC,KAAqE,EACrEC,UAAkB;QAIHC;IAFf,MAAMA,OAAOF,yBAAAA,KAAO,CAACC,WAAW;IAChC,IAAIC,CAAAA,wBAAAA,KAAMC,WAAW,MAAKX,mBAAmB,OAAO;IACpD,MAAMY,SAASF,cAAAA,KAAKE,KAAK,YAAVF,cAAc,CAAC;IAC9B,MAAMG,YAAYX,KAAKU,KAAK,CAAC,YAAY,EAAE;IAC3C,MAAME,cAAcZ,KAAKU,KAAK,CAAC,cAAc,EAAE;IAC/C,IAAI,CAACC,aAAa,CAACC,aAAa,OAAO;IACvC,MAAMC,WAAmC,CAAC;IAC1C,KAAK,MAAMC,eAAejB,wBAAwBS,OAAOC,YAAa;;YAChDD;QAApB,MAAMS,qBAAcT,0BAAAA,qBAAAA,KAAO,CAACQ,YAAY,qBAApBR,mBAAsBI,KAAK,mBAAI,CAAC;QAIpD,MAAMM,iBAAiBhB,KAAKe,UAAU,CAAC,iBAAiB,EAAE;QAC1D,IAAI,CAACC,gBAAgB;QACrB,MAAMC,eAAejB,KAAKe,UAAU,CAAC,YAAY,EAAE,OAAO;QAC1D,IACE,CAAEE,CAAAA,gBAAgBJ,QAAO,KACzBK,OAAOC,IAAI,CAACN,UAAUO,MAAM,IAAIrB,iCAChC;YACA;QACF;QACAc,QAAQ,CAACI,aAAa,GAAGD;IAC3B;IACA,OAAO,aACDL,YAAY;QAAEA;IAAU,IAAI,CAAC,GAC7BC,cAAc;QAAEA;IAAY,IAAI,CAAC;QACrCC;;AAEJ;AAEA,0EAA0E,GAC1E,OAAO,SAASQ,sBACdf,KAAqE;IAErE,MAAMgB,QAAgE,EAAE;IACxE,KAAK,MAAM,CAACC,QAAQf,KAAK,IAAIU,OAAOM,OAAO,CAAClB,gBAAAA,QAAS,CAAC,GAAI;QACxD,IAAIE,CAAAA,wBAAAA,KAAMC,WAAW,MAAKX,mBAAmB;QAC7C,MAAM2B,UAAUpB,qBAAqBC,OAAOiB;QAC5C,IAAIE,SAASH,MAAMI,IAAI,CAAC;YAAEH,QAAQA;YAAkBE;QAAQ;IAC9D;IACA,OAAOH;AACT"}

package/src/lib/form-target/stamp-form-dataset-bindings.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The prop a rendered `form` node carries its signed dataset binding in. The
+ * form element posts it back as {@link FORM_DATASET_BINDING_FIELD}. Both are
+ * on pages already rendered and cached — never rename.
+ */
+export declare const FORM_DATASET_BINDING_PROP = "datasetBindingToken";
+/** The submission body field the form element posts the signed binding in. */
+export declare const FORM_DATASET_BINDING_FIELD = "datasetBinding";
+/**
+ * Signs every `form` node's dataset binding into its props, for this plugin's
+ * form record target to verify when the submission comes back (AGL-2773) —
+ * the stamping half of `plugin-manager/submission-record-target.ts`.
+ *
+ * A record is written only where a valid signature says, so a form
+ * without one still submits — the Inbox copy is always written — but adds no
+ * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the
+ * tree is returned unsigned rather than failing the page render, and the
+ * missing secret is reported once per process instead of once per render.
+ *
+ * Never mutates `nodes`; a tree with no bound form comes back as the same
+ * object.
+ */
+export declare function stampFormDatasetBindings<N extends Record<string, any>>(nodes: N, hostId: string): N;

package/src/lib/form-target/stamp-form-dataset-bindings.js

@@ -0,0 +1,65 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { formDatasetBindingsOf } from "./form-dataset-binding.js";
+import { signFormDatasetBinding } from "./form-dataset-binding-token.js";
+/**
+ * The prop a rendered `form` node carries its signed dataset binding in. The
+ * form element posts it back as {@link FORM_DATASET_BINDING_FIELD}. Both are
+ * on pages already rendered and cached — never rename.
+ */ export const FORM_DATASET_BINDING_PROP = 'datasetBindingToken';
+/** The submission body field the form element posts the signed binding in. */ export const FORM_DATASET_BINDING_FIELD = 'datasetBinding';
+/** Whether an unsigned render has been reported in this process yet. */ let reportedUnsigned = false;
+/**
+ * Signs every `form` node's dataset binding into its props, for this plugin's
+ * form record target to verify when the submission comes back (AGL-2773) —
+ * the stamping half of `plugin-manager/submission-record-target.ts`.
+ *
+ * A record is written only where a valid signature says, so a form
+ * without one still submits — the Inbox copy is always written — but adds no
+ * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the
+ * tree is returned unsigned rather than failing the page render, and the
+ * missing secret is reported once per process instead of once per render.
+ *
+ * Never mutates `nodes`; a tree with no bound form comes back as the same
+ * object.
+ */ export function stampFormDatasetBindings(nodes, hostId) {
+    const bindings = formDatasetBindingsOf(nodes);
+    if (!bindings.length) return nodes;
+    const signed = _extends({}, nodes);
+    for (const { nodeId, binding } of bindings){
+        var _ref;
+        let token;
+        try {
+            token = signFormDatasetBinding(hostId, binding);
+        } catch (error) {
+            if (!reportedUnsigned) {
+                reportedUnsigned = true;
+                console.error('Form dataset bindings are not being signed, so forms bound to a ' + 'dataset will not write records', error);
+            }
+            return nodes;
+        }
+        const node = signed[nodeId];
+        signed[nodeId] = _extends({}, node, {
+            props: _extends({}, (_ref = node == null ? void 0 : node.props) != null ? _ref : {}, {
+                [FORM_DATASET_BINDING_PROP]: token
+            })
+        });
+    }
+    return signed;
+}
+
+//# sourceMappingURL=stamp-form-dataset-bindings.js.map

package/src/lib/form-target/stamp-form-dataset-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/form-target/stamp-form-dataset-bindings.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { formDatasetBindingsOf } from './form-dataset-binding'\nimport { signFormDatasetBinding } from './form-dataset-binding-token'\n\n/**\n * The prop a rendered `form` node carries its signed dataset binding in. The\n * form element posts it back as {@link FORM_DATASET_BINDING_FIELD}. Both are\n * on pages already rendered and cached — never rename.\n */\nexport const FORM_DATASET_BINDING_PROP = 'datasetBindingToken'\n\n/** The submission body field the form element posts the signed binding in. */\nexport const FORM_DATASET_BINDING_FIELD = 'datasetBinding'\n\n/** Whether an unsigned render has been reported in this process yet. */\nlet reportedUnsigned = false\n\n/**\n * Signs every `form` node's dataset binding into its props, for this plugin's\n * form record target to verify when the submission comes back (AGL-2773) —\n * the stamping half of `plugin-manager/submission-record-target.ts`.\n *\n * A record is written only where a valid signature says, so a form\n * without one still submits — the Inbox copy is always written — but adds no\n * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the\n * tree is returned unsigned rather than failing the page render, and the\n * missing secret is reported once per process instead of once per render.\n *\n * Never mutates `nodes`; a tree with no bound form comes back as the same\n * object.\n */\nexport function stampFormDatasetBindings<N extends Record<string, any>>(\n  nodes: N,\n  hostId: string,\n): N {\n  const bindings = formDatasetBindingsOf(nodes as never)\n  if (!bindings.length) return nodes\n  const signed: Record<string, any> = { ...nodes }\n  for (const { nodeId, binding } of bindings) {\n    let token: string\n    try {\n      token = signFormDatasetBinding(hostId, binding)\n    } catch (error) {\n      if (!reportedUnsigned) {\n        reportedUnsigned = true\n        console.error(\n          'Form dataset bindings are not being signed, so forms bound to a ' +\n            'dataset will not write records',\n          error,\n        )\n      }\n      return nodes\n    }\n    const node = signed[nodeId]\n    signed[nodeId] = {\n      ...node,\n      props: { ...(node?.props ?? {}), [FORM_DATASET_BINDING_PROP]: token },\n    }\n  }\n  return signed as N\n}\n"],"names":["formDatasetBindingsOf","signFormDatasetBinding","FORM_DATASET_BINDING_PROP","FORM_DATASET_BINDING_FIELD","reportedUnsigned","stampFormDatasetBindings","nodes","hostId","bindings","length","signed","nodeId","binding","token","error","console","node","props"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,qBAAqB,QAAQ,4BAAwB;AAC9D,SAASC,sBAAsB,QAAQ,kCAA8B;AAErE;;;;CAIC,GACD,OAAO,MAAMC,4BAA4B,sBAAqB;AAE9D,4EAA4E,GAC5E,OAAO,MAAMC,6BAA6B,iBAAgB;AAE1D,sEAAsE,GACtE,IAAIC,mBAAmB;AAEvB;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,yBACdC,KAAQ,EACRC,MAAc;IAEd,MAAMC,WAAWR,sBAAsBM;IACvC,IAAI,CAACE,SAASC,MAAM,EAAE,OAAOH;IAC7B,MAAMI,SAA8B,aAAKJ;IACzC,KAAK,MAAM,EAAEK,MAAM,EAAEC,OAAO,EAAE,IAAIJ,SAAU;;QAC1C,IAAIK;QACJ,IAAI;YACFA,QAAQZ,uBAAuBM,QAAQK;QACzC,EAAE,OAAOE,OAAO;YACd,IAAI,CAACV,kBAAkB;gBACrBA,mBAAmB;gBACnBW,QAAQD,KAAK,CACX,qEACE,kCACFA;YAEJ;YACA,OAAOR;QACT;QACA,MAAMU,OAAON,MAAM,CAACC,OAAO;QAC3BD,MAAM,CAACC,OAAO,GAAG,aACZK;YACHC,OAAO,qBAAMD,wBAAAA,KAAMC,KAAK,mBAAI,CAAC;gBAAI,CAACf,0BAA0B,EAAEW;;;IAElE;IACA,OAAOH;AACT"}

package/src/lib/model/dataset-csv.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { DatasetFieldDefinition, DatasetModel } from '@aglyn/aglyn/app-utils/dataset-models';
+/** Storage value → portable string (CSV cell / JSON value). */
+export declare function serializeDatasetValue(field: DatasetFieldDefinition, value: unknown): string;
+/**
+ * The header line — field ids, in model order (AGL-2335).
+ *
+ * Split out of {@link datasetRecordsToCsv} so a server export can emit the
+ * file a page at a time. The whole point of that export is that it is not
+ * bounded by what one process can hold in memory, and a helper that only
+ * takes a complete `rows` array cannot serve it. Everything below shares
+ * one escaper: there are already five divergent hand-rolled CSV escapers in
+ * this repo and this is not becoming the sixth.
+ */
+export declare function datasetCsvHeader(model: DatasetModel): string;
+/** One record's values (storage form) → one CSV line, no terminator. */
+export declare function datasetCsvRow(model: DatasetModel, row: Record<string, unknown>): string;
+/** One record's values → the portable JSON object the JSON export emits. */
+export declare function datasetRecordToJson(model: DatasetModel, row: Record<string, unknown>): Record<string, string>;
+/** Rows (storage-form value maps) → CSV with a fieldId header row. */
+export declare function datasetRecordsToCsv(model: DatasetModel, rows: Array<Record<string, unknown>>): string;

package/src/lib/model/dataset-csv.js

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Dataset CSV/JSON serialization (AGL-182). The predictable inverse of
+ * `coerceDocumentValues`: ISO dates, `lat, lon` coordinates, comma-joined
+ * lists, JSON maps, reference ids — so an export re-imports losslessly
+ * through the same coercion.
+ *
+ * This plugin's own: the export route that streams a dataset a page at a
+ * time and the hub's client-side download both write through it. The
+ * escaper, the parser and the row-count check are the platform's
+ * (`app-utils/csv`), because the email, commerce and CRM imports read files
+ * too and may not reach this plugin.
+ */ import { escapeCsvCell as csvEscape } from "@aglyn/aglyn/app-utils/csv";
+/** Storage value → portable string (CSV cell / JSON value). */ export function serializeDatasetValue(field, value) {
+    if (value == null) return '';
+    switch(field.type){
+        case 'timestamp':
+            return typeof value === 'number' && Number.isFinite(value) ? new Date(value).toISOString() : String(value);
+        case 'coordinates':
+            {
+                const coordinates = value;
+                return coordinates && typeof coordinates.latitude === 'number' && typeof coordinates.longitude === 'number' ? `${coordinates.latitude}, ${coordinates.longitude}` : String(value);
+            }
+        case 'sorted':
+        case 'reference':
+            return Array.isArray(value) ? value.join(', ') : String(value);
+        case 'map':
+            try {
+                return JSON.stringify(value);
+            } catch (unused) {
+                return String(value);
+            }
+        default:
+            return String(value);
+    }
+}
+/**
+ * The header line — field ids, in model order (AGL-2335).
+ *
+ * Split out of {@link datasetRecordsToCsv} so a server export can emit the
+ * file a page at a time. The whole point of that export is that it is not
+ * bounded by what one process can hold in memory, and a helper that only
+ * takes a complete `rows` array cannot serve it. Everything below shares
+ * one escaper: there are already five divergent hand-rolled CSV escapers in
+ * this repo and this is not becoming the sixth.
+ */ export function datasetCsvHeader(model) {
+    return model.order.map(csvEscape).join(',');
+}
+/** One record's values (storage form) → one CSV line, no terminator. */ export function datasetCsvRow(model, row) {
+    return model.order.map((fieldId)=>{
+        const field = model.fields[fieldId];
+        return csvEscape(field ? serializeDatasetValue(field, row[fieldId]) : '');
+    }).join(',');
+}
+/** One record's values → the portable JSON object the JSON export emits. */ export function datasetRecordToJson(model, row) {
+    return Object.fromEntries(model.order.map((fieldId)=>{
+        const field = model.fields[fieldId];
+        return [
+            fieldId,
+            field ? serializeDatasetValue(field, row[fieldId]) : ''
+        ];
+    }));
+}
+/** Rows (storage-form value maps) → CSV with a fieldId header row. */ export function datasetRecordsToCsv(model, rows) {
+    return [
+        datasetCsvHeader(model),
+        ...rows.map((row)=>datasetCsvRow(model, row))
+    ].join('\n');
+}
+
+//# sourceMappingURL=dataset-csv.js.map

package/src/lib/model/dataset-csv.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/model/dataset-csv.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Dataset CSV/JSON serialization (AGL-182). The predictable inverse of\n * `coerceDocumentValues`: ISO dates, `lat, lon` coordinates, comma-joined\n * lists, JSON maps, reference ids — so an export re-imports losslessly\n * through the same coercion.\n *\n * This plugin's own: the export route that streams a dataset a page at a\n * time and the hub's client-side download both write through it. The\n * escaper, the parser and the row-count check are the platform's\n * (`app-utils/csv`), because the email, commerce and CRM imports read files\n * too and may not reach this plugin.\n */\n\nimport { escapeCsvCell as csvEscape } from '@aglyn/aglyn/app-utils/csv'\nimport type {\n  DatasetFieldDefinition,\n  DatasetModel,\n} from '@aglyn/aglyn/app-utils/dataset-models'\n\n\n/** Storage value → portable string (CSV cell / JSON value). */\nexport function serializeDatasetValue(\n  field: DatasetFieldDefinition,\n  value: unknown,\n): string {\n  if (value == null) return ''\n  switch (field.type) {\n    case 'timestamp':\n      return typeof value === 'number' && Number.isFinite(value)\n        ? new Date(value).toISOString()\n        : String(value)\n    case 'coordinates': {\n      const coordinates = value as { latitude?: number; longitude?: number }\n      return coordinates &&\n        typeof coordinates.latitude === 'number' &&\n        typeof coordinates.longitude === 'number'\n        ? `${coordinates.latitude}, ${coordinates.longitude}`\n        : String(value)\n    }\n    case 'sorted':\n    case 'reference':\n      return Array.isArray(value) ? value.join(', ') : String(value)\n    case 'map':\n      try {\n        return JSON.stringify(value)\n      } catch {\n        return String(value)\n      }\n    default:\n      return String(value)\n  }\n}\n\n/**\n * The header line — field ids, in model order (AGL-2335).\n *\n * Split out of {@link datasetRecordsToCsv} so a server export can emit the\n * file a page at a time. The whole point of that export is that it is not\n * bounded by what one process can hold in memory, and a helper that only\n * takes a complete `rows` array cannot serve it. Everything below shares\n * one escaper: there are already five divergent hand-rolled CSV escapers in\n * this repo and this is not becoming the sixth.\n */\nexport function datasetCsvHeader(model: DatasetModel): string {\n  return model.order.map(csvEscape).join(',')\n}\n\n/** One record's values (storage form) → one CSV line, no terminator. */\nexport function datasetCsvRow(\n  model: DatasetModel,\n  row: Record<string, unknown>,\n): string {\n  return model.order\n    .map((fieldId) => {\n      const field = model.fields[fieldId]\n      return csvEscape(field ? serializeDatasetValue(field, row[fieldId]) : '')\n    })\n    .join(',')\n}\n\n/** One record's values → the portable JSON object the JSON export emits. */\nexport function datasetRecordToJson(\n  model: DatasetModel,\n  row: Record<string, unknown>,\n): Record<string, string> {\n  return Object.fromEntries(\n    model.order.map((fieldId) => {\n      const field = model.fields[fieldId]\n      return [fieldId, field ? serializeDatasetValue(field, row[fieldId]) : '']\n    }),\n  )\n}\n\n/** Rows (storage-form value maps) → CSV with a fieldId header row. */\nexport function datasetRecordsToCsv(\n  model: DatasetModel,\n  rows: Array<Record<string, unknown>>,\n): string {\n  return [\n    datasetCsvHeader(model),\n    ...rows.map((row) => datasetCsvRow(model, row)),\n  ].join('\\n')\n}\n"],"names":["escapeCsvCell","csvEscape","serializeDatasetValue","field","value","type","Number","isFinite","Date","toISOString","String","coordinates","latitude","longitude","Array","isArray","join","JSON","stringify","datasetCsvHeader","model","order","map","datasetCsvRow","row","fieldId","fields","datasetRecordToJson","Object","fromEntries","datasetRecordsToCsv","rows"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,SAASA,iBAAiBC,SAAS,QAAQ,6BAA4B;AAOvE,6DAA6D,GAC7D,OAAO,SAASC,sBACdC,KAA6B,EAC7BC,KAAc;IAEd,IAAIA,SAAS,MAAM,OAAO;IAC1B,OAAQD,MAAME,IAAI;QAChB,KAAK;YACH,OAAO,OAAOD,UAAU,YAAYE,OAAOC,QAAQ,CAACH,SAChD,IAAII,KAAKJ,OAAOK,WAAW,KAC3BC,OAAON;QACb,KAAK;YAAe;gBAClB,MAAMO,cAAcP;gBACpB,OAAOO,eACL,OAAOA,YAAYC,QAAQ,KAAK,YAChC,OAAOD,YAAYE,SAAS,KAAK,WAC/B,GAAGF,YAAYC,QAAQ,CAAC,EAAE,EAAED,YAAYE,SAAS,EAAE,GACnDH,OAAON;YACb;QACA,KAAK;QACL,KAAK;YACH,OAAOU,MAAMC,OAAO,CAACX,SAASA,MAAMY,IAAI,CAAC,QAAQN,OAAON;QAC1D,KAAK;YACH,IAAI;gBACF,OAAOa,KAAKC,SAAS,CAACd;YACxB,EAAE,eAAM;gBACN,OAAOM,OAAON;YAChB;QACF;YACE,OAAOM,OAAON;IAClB;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASe,iBAAiBC,KAAmB;IAClD,OAAOA,MAAMC,KAAK,CAACC,GAAG,CAACrB,WAAWe,IAAI,CAAC;AACzC;AAEA,sEAAsE,GACtE,OAAO,SAASO,cACdH,KAAmB,EACnBI,GAA4B;IAE5B,OAAOJ,MAAMC,KAAK,CACfC,GAAG,CAAC,CAACG;QACJ,MAAMtB,QAAQiB,MAAMM,MAAM,CAACD,QAAQ;QACnC,OAAOxB,UAAUE,QAAQD,sBAAsBC,OAAOqB,GAAG,CAACC,QAAQ,IAAI;IACxE,GACCT,IAAI,CAAC;AACV;AAEA,0EAA0E,GAC1E,OAAO,SAASW,oBACdP,KAAmB,EACnBI,GAA4B;IAE5B,OAAOI,OAAOC,WAAW,CACvBT,MAAMC,KAAK,CAACC,GAAG,CAAC,CAACG;QACf,MAAMtB,QAAQiB,MAAMM,MAAM,CAACD,QAAQ;QACnC,OAAO;YAACA;YAAStB,QAAQD,sBAAsBC,OAAOqB,GAAG,CAACC,QAAQ,IAAI;SAAG;IAC3E;AAEJ;AAEA,oEAAoE,GACpE,OAAO,SAASK,oBACdV,KAAmB,EACnBW,IAAoC;IAEpC,OAAO;QACLZ,iBAAiBC;WACdW,KAAKT,GAAG,CAAC,CAACE,MAAQD,cAAcH,OAAOI;KAC3C,CAACR,IAAI,CAAC;AACT"}

package/src/lib/model/dataset-io.d.ts

@@ -17,15 +17,16 @@
 /**
  * Dataset CSV/JSON round-tripping (AGL-182) — the IMPORT half.
  *
- * Both the serialization half and the CSV parser live in `@aglyn/aglyn`'s
- * `dataset-csv` (AGL-2335) so that the server export route and the email
- * list importer can share one escaper and one parser; both are re-exported
- * here unchanged, so `@aglyn/plugins-data/model` remains the one import site
- * for everything dataset-io. What stays here is the part that is about
- * DATASETS — mapping a file's columns onto a `DatasetModel`.
+ * The serialization half is `dataset-csv.ts` beside this, and the CSV parser
+ * and the row-count check are the platform's `app-utils/csv` (AGL-2335), so
+ * the email, commerce and CRM imports read files with the same parser; all of
+ * them are re-exported here, so `@aglyn/plugins-data/model` remains the one
+ * import site for everything dataset-io. What stays here is the part that is
+ * about DATASETS — mapping a file's columns onto a `DatasetModel`.
  */
 import type { DatasetModel } from '@aglyn/aglyn';
-export { countCsvDataRows, datasetCsvHeader, datasetCsvRow, datasetRecordToJson, datasetRecordsToCsv, exportShortfall, parseCsv, serializeDatasetValue, } from '@aglyn/aglyn/app-utils/dataset-csv';
+export { countCsvDataRows, exportShortfall, parseCsv, } from '@aglyn/aglyn/app-utils/csv';
+export { datasetCsvHeader, datasetCsvRow, datasetRecordToJson, datasetRecordsToCsv, serializeDatasetValue, } from './dataset-csv';
 /**
  * Parses pasted/uploaded import text — a JSON array of objects or CSV
  * with a header row — into raw string maps keyed by the source column

package/src/lib/model/dataset-io.js

@@ -16,14 +16,15 @@
  */ /**
  * Dataset CSV/JSON round-tripping (AGL-182) — the IMPORT half.
  *
- * Both the serialization half and the CSV parser live in `@aglyn/aglyn`'s
- * `dataset-csv` (AGL-2335) so that the server export route and the email
- * list importer can share one escaper and one parser; both are re-exported
- * here unchanged, so `@aglyn/plugins-data/model` remains the one import site
- * for everything dataset-io. What stays here is the part that is about
- * DATASETS — mapping a file's columns onto a `DatasetModel`.
- */ import { parseCsv } from "@aglyn/aglyn/app-utils/dataset-csv";
-export { countCsvDataRows, datasetCsvHeader, datasetCsvRow, datasetRecordToJson, datasetRecordsToCsv, exportShortfall, parseCsv, serializeDatasetValue } from "@aglyn/aglyn/app-utils/dataset-csv";
+ * The serialization half is `dataset-csv.ts` beside this, and the CSV parser
+ * and the row-count check are the platform's `app-utils/csv` (AGL-2335), so
+ * the email, commerce and CRM imports read files with the same parser; all of
+ * them are re-exported here, so `@aglyn/plugins-data/model` remains the one
+ * import site for everything dataset-io. What stays here is the part that is
+ * about DATASETS — mapping a file's columns onto a `DatasetModel`.
+ */ import { parseCsv } from "@aglyn/aglyn/app-utils/csv";
+export { countCsvDataRows, exportShortfall, parseCsv } from "@aglyn/aglyn/app-utils/csv";
+export { datasetCsvHeader, datasetCsvRow, datasetRecordToJson, datasetRecordsToCsv, serializeDatasetValue } from "./dataset-csv.js";
 /**
  * Parses pasted/uploaded import text — a JSON array of objects or CSV
  * with a header row — into raw string maps keyed by the source column

package/src/lib/model/dataset-io.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/model/dataset-io.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Dataset CSV/JSON round-tripping (AGL-182) — the IMPORT half.\n *\n * Both the serialization half and the CSV parser live in `@aglyn/aglyn`'s\n * `dataset-csv` (AGL-2335) so that the server export route and the email\n * list importer can share one escaper and one parser; both are re-exported\n * here unchanged, so `@aglyn/plugins-data/model` remains the one import site\n * for everything dataset-io. What stays here is the part that is about\n * DATASETS — mapping a file's columns onto a `DatasetModel`.\n */\n\nimport type { DatasetModel } from '@aglyn/aglyn'\nimport { parseCsv } from '@aglyn/aglyn/app-utils/dataset-csv'\nexport {\n  countCsvDataRows,\n  datasetCsvHeader,\n  datasetCsvRow,\n  datasetRecordToJson,\n  datasetRecordsToCsv,\n  exportShortfall,\n  parseCsv,\n  serializeDatasetValue,\n} from '@aglyn/aglyn/app-utils/dataset-csv'\n\n/**\n * Parses pasted/uploaded import text — a JSON array of objects or CSV\n * with a header row — into raw string maps keyed by the source column\n * names. Returns null when nothing parseable is found.\n */\nexport function parseImportRows(\n  text: string,\n): Array<Record<string, string>> | null {\n  const trimmed = String(text ?? '').trim()\n  if (!trimmed) return null\n  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {\n    try {\n      const parsed = JSON.parse(trimmed)\n      const list = Array.isArray(parsed) ? parsed : [parsed]\n      return list\n        .filter((entry) => entry && typeof entry === 'object')\n        .map((entry) =>\n          Object.fromEntries(\n            Object.entries(entry as Record<string, unknown>).map(\n              ([key, value]) => [\n                key,\n                typeof value === 'string' ? value : JSON.stringify(value),\n              ],\n            ),\n          ),\n        )\n    } catch {\n      return null\n    }\n  }\n  const rows = parseCsv(trimmed)\n  if (rows.length < 2) return null\n  const [header, ...body] = rows\n  return body.map((cells) =>\n    Object.fromEntries(\n      header.map((column, index) => [column.trim(), cells[index] ?? '']),\n    ),\n  )\n}\n\n/**\n * Maps raw import columns to model fieldIds: exact fieldId match first,\n * then case-insensitive display-name match. Unmatched columns are\n * reported, never silently dropped.\n */\nexport function mapImportColumns(\n  model: DatasetModel,\n  columns: string[],\n): { mapping: Record<string, string>; unmatched: string[] } {\n  const byName = new Map<string, string>()\n  for (const fieldId of model.order) {\n    byName.set(fieldId.toLowerCase(), fieldId)\n    const display = model.fields[fieldId]?.name\n    if (display) byName.set(display.trim().toLowerCase(), fieldId)\n  }\n  const mapping: Record<string, string> = {}\n  const unmatched: string[] = []\n  for (const column of columns) {\n    const fieldId = byName.get(column.trim().toLowerCase())\n    if (fieldId) mapping[column] = fieldId\n    else unmatched.push(column)\n  }\n  return { mapping, unmatched }\n}\n"],"names":["parseCsv","countCsvDataRows","datasetCsvHeader","datasetCsvRow","datasetRecordToJson","datasetRecordsToCsv","exportShortfall","serializeDatasetValue","parseImportRows","text","trimmed","String","trim","startsWith","parsed","JSON","parse","list","Array","isArray","filter","entry","map","Object","fromEntries","entries","key","value","stringify","rows","length","header","body","cells","column","index","mapImportColumns","model","columns","byName","Map","fieldId","order","set","toLowerCase","display","fields","name","mapping","unmatched","get","push"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GAGD,SAASA,QAAQ,QAAQ,qCAAoC;AAC7D,SACEC,gBAAgB,EAChBC,gBAAgB,EAChBC,aAAa,EACbC,mBAAmB,EACnBC,mBAAmB,EACnBC,eAAe,EACfN,QAAQ,EACRO,qBAAqB,QAChB,qCAAoC;AAE3C;;;;CAIC,GACD,OAAO,SAASC,gBACdC,IAAY;IAEZ,MAAMC,UAAUC,OAAOF,eAAAA,OAAQ,IAAIG,IAAI;IACvC,IAAI,CAACF,SAAS,OAAO;IACrB,IAAIA,QAAQG,UAAU,CAAC,QAAQH,QAAQG,UAAU,CAAC,MAAM;QACtD,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACN;YAC1B,MAAMO,OAAOC,MAAMC,OAAO,CAACL,UAAUA,SAAS;gBAACA;aAAO;YACtD,OAAOG,KACJG,MAAM,CAAC,CAACC,QAAUA,SAAS,OAAOA,UAAU,UAC5CC,GAAG,CAAC,CAACD,QACJE,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAACJ,OAAkCC,GAAG,CAClD,CAAC,CAACI,KAAKC,MAAM,GAAK;wBAChBD;wBACA,OAAOC,UAAU,WAAWA,QAAQZ,KAAKa,SAAS,CAACD;qBACpD;QAIX,EAAE,eAAM;YACN,OAAO;QACT;IACF;IACA,MAAME,OAAO7B,SAASU;IACtB,IAAImB,KAAKC,MAAM,GAAG,GAAG,OAAO;IAC5B,MAAM,CAACC,QAAQ,GAAGC,KAAK,GAAGH;IAC1B,OAAOG,KAAKV,GAAG,CAAC,CAACW,QACfV,OAAOC,WAAW,CAChBO,OAAOT,GAAG,CAAC,CAACY,QAAQC;gBAA0BF;mBAAhB;gBAACC,OAAOtB,IAAI;iBAAIqB,eAAAA,KAAK,CAACE,MAAM,YAAZF,eAAgB;aAAG;;AAGvE;AAEA;;;;CAIC,GACD,OAAO,SAASG,iBACdC,KAAmB,EACnBC,OAAiB;IAEjB,MAAMC,SAAS,IAAIC;IACnB,KAAK,MAAMC,WAAWJ,MAAMK,KAAK,CAAE;YAEjBL;QADhBE,OAAOI,GAAG,CAACF,QAAQG,WAAW,IAAIH;QAClC,MAAMI,WAAUR,wBAAAA,MAAMS,MAAM,CAACL,QAAQ,qBAArBJ,sBAAuBU,IAAI;QAC3C,IAAIF,SAASN,OAAOI,GAAG,CAACE,QAAQjC,IAAI,GAAGgC,WAAW,IAAIH;IACxD;IACA,MAAMO,UAAkC,CAAC;IACzC,MAAMC,YAAsB,EAAE;IAC9B,KAAK,MAAMf,UAAUI,QAAS;QAC5B,MAAMG,UAAUF,OAAOW,GAAG,CAAChB,OAAOtB,IAAI,GAAGgC,WAAW;QACpD,IAAIH,SAASO,OAAO,CAACd,OAAO,GAAGO;aAC1BQ,UAAUE,IAAI,CAACjB;IACtB;IACA,OAAO;QAAEc;QAASC;IAAU;AAC9B"}
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/model/dataset-io.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Dataset CSV/JSON round-tripping (AGL-182) — the IMPORT half.\n *\n * The serialization half is `dataset-csv.ts` beside this, and the CSV parser\n * and the row-count check are the platform's `app-utils/csv` (AGL-2335), so\n * the email, commerce and CRM imports read files with the same parser; all of\n * them are re-exported here, so `@aglyn/plugins-data/model` remains the one\n * import site for everything dataset-io. What stays here is the part that is\n * about DATASETS — mapping a file's columns onto a `DatasetModel`.\n */\n\nimport type { DatasetModel } from '@aglyn/aglyn'\nimport { parseCsv } from '@aglyn/aglyn/app-utils/csv'\nexport {\n  countCsvDataRows,\n  exportShortfall,\n  parseCsv,\n} from '@aglyn/aglyn/app-utils/csv'\nexport {\n  datasetCsvHeader,\n  datasetCsvRow,\n  datasetRecordToJson,\n  datasetRecordsToCsv,\n  serializeDatasetValue,\n} from './dataset-csv'\n\n/**\n * Parses pasted/uploaded import text — a JSON array of objects or CSV\n * with a header row — into raw string maps keyed by the source column\n * names. Returns null when nothing parseable is found.\n */\nexport function parseImportRows(\n  text: string,\n): Array<Record<string, string>> | null {\n  const trimmed = String(text ?? '').trim()\n  if (!trimmed) return null\n  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {\n    try {\n      const parsed = JSON.parse(trimmed)\n      const list = Array.isArray(parsed) ? parsed : [parsed]\n      return list\n        .filter((entry) => entry && typeof entry === 'object')\n        .map((entry) =>\n          Object.fromEntries(\n            Object.entries(entry as Record<string, unknown>).map(\n              ([key, value]) => [\n                key,\n                typeof value === 'string' ? value : JSON.stringify(value),\n              ],\n            ),\n          ),\n        )\n    } catch {\n      return null\n    }\n  }\n  const rows = parseCsv(trimmed)\n  if (rows.length < 2) return null\n  const [header, ...body] = rows\n  return body.map((cells) =>\n    Object.fromEntries(\n      header.map((column, index) => [column.trim(), cells[index] ?? '']),\n    ),\n  )\n}\n\n/**\n * Maps raw import columns to model fieldIds: exact fieldId match first,\n * then case-insensitive display-name match. Unmatched columns are\n * reported, never silently dropped.\n */\nexport function mapImportColumns(\n  model: DatasetModel,\n  columns: string[],\n): { mapping: Record<string, string>; unmatched: string[] } {\n  const byName = new Map<string, string>()\n  for (const fieldId of model.order) {\n    byName.set(fieldId.toLowerCase(), fieldId)\n    const display = model.fields[fieldId]?.name\n    if (display) byName.set(display.trim().toLowerCase(), fieldId)\n  }\n  const mapping: Record<string, string> = {}\n  const unmatched: string[] = []\n  for (const column of columns) {\n    const fieldId = byName.get(column.trim().toLowerCase())\n    if (fieldId) mapping[column] = fieldId\n    else unmatched.push(column)\n  }\n  return { mapping, unmatched }\n}\n"],"names":["parseCsv","countCsvDataRows","exportShortfall","datasetCsvHeader","datasetCsvRow","datasetRecordToJson","datasetRecordsToCsv","serializeDatasetValue","parseImportRows","text","trimmed","String","trim","startsWith","parsed","JSON","parse","list","Array","isArray","filter","entry","map","Object","fromEntries","entries","key","value","stringify","rows","length","header","body","cells","column","index","mapImportColumns","model","columns","byName","Map","fieldId","order","set","toLowerCase","display","fields","name","mapping","unmatched","get","push"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GAGD,SAASA,QAAQ,QAAQ,6BAA4B;AACrD,SACEC,gBAAgB,EAChBC,eAAe,EACfF,QAAQ,QACH,6BAA4B;AACnC,SACEG,gBAAgB,EAChBC,aAAa,EACbC,mBAAmB,EACnBC,mBAAmB,EACnBC,qBAAqB,QAChB,mBAAe;AAEtB;;;;CAIC,GACD,OAAO,SAASC,gBACdC,IAAY;IAEZ,MAAMC,UAAUC,OAAOF,eAAAA,OAAQ,IAAIG,IAAI;IACvC,IAAI,CAACF,SAAS,OAAO;IACrB,IAAIA,QAAQG,UAAU,CAAC,QAAQH,QAAQG,UAAU,CAAC,MAAM;QACtD,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACN;YAC1B,MAAMO,OAAOC,MAAMC,OAAO,CAACL,UAAUA,SAAS;gBAACA;aAAO;YACtD,OAAOG,KACJG,MAAM,CAAC,CAACC,QAAUA,SAAS,OAAOA,UAAU,UAC5CC,GAAG,CAAC,CAACD,QACJE,OAAOC,WAAW,CAChBD,OAAOE,OAAO,CAACJ,OAAkCC,GAAG,CAClD,CAAC,CAACI,KAAKC,MAAM,GAAK;wBAChBD;wBACA,OAAOC,UAAU,WAAWA,QAAQZ,KAAKa,SAAS,CAACD;qBACpD;QAIX,EAAE,eAAM;YACN,OAAO;QACT;IACF;IACA,MAAME,OAAO7B,SAASU;IACtB,IAAImB,KAAKC,MAAM,GAAG,GAAG,OAAO;IAC5B,MAAM,CAACC,QAAQ,GAAGC,KAAK,GAAGH;IAC1B,OAAOG,KAAKV,GAAG,CAAC,CAACW,QACfV,OAAOC,WAAW,CAChBO,OAAOT,GAAG,CAAC,CAACY,QAAQC;gBAA0BF;mBAAhB;gBAACC,OAAOtB,IAAI;iBAAIqB,eAAAA,KAAK,CAACE,MAAM,YAAZF,eAAgB;aAAG;;AAGvE;AAEA;;;;CAIC,GACD,OAAO,SAASG,iBACdC,KAAmB,EACnBC,OAAiB;IAEjB,MAAMC,SAAS,IAAIC;IACnB,KAAK,MAAMC,WAAWJ,MAAMK,KAAK,CAAE;YAEjBL;QADhBE,OAAOI,GAAG,CAACF,QAAQG,WAAW,IAAIH;QAClC,MAAMI,WAAUR,wBAAAA,MAAMS,MAAM,CAACL,QAAQ,qBAArBJ,sBAAuBU,IAAI;QAC3C,IAAIF,SAASN,OAAOI,GAAG,CAACE,QAAQjC,IAAI,GAAGgC,WAAW,IAAIH;IACxD;IACA,MAAMO,UAAkC,CAAC;IACzC,MAAMC,YAAsB,EAAE;IAC9B,KAAK,MAAMf,UAAUI,QAAS;QAC5B,MAAMG,UAAUF,OAAOW,GAAG,CAAChB,OAAOtB,IAAI,GAAGgC,WAAW;QACpD,IAAIH,SAASO,OAAO,CAACd,OAAO,GAAGO;aAC1BQ,UAAUE,IAAI,CAACjB;IACtB;IACA,OAAO;QAAEc;QAASC;IAAU;AAC9B"}