@bygghammar/cms-platform 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.35.0
+
+- Added `tracking/injections` — the pure "Code & tracking" helpers (profile
+  merging, scope selection, GTM/GA4/Meta/TikTok snippet builders).
+- Added `server/injections-core` — staff/admin CRUD for `site_injections` with a
+  host-supplied audit writer, plus cached request-time bundle resolution,
+  `isInjectablePath` and `applyInjections`.
+- Added `server/domains-core` — `locale_domains` reads, request-locale and
+  admin-domain resolution (with self-host `SITE_URL` precedence) and staff-only
+  upsert/delete.
+
+## 0.34.1
+
+- `saveContentSectionCore` accepts an optional `data` payload, matching hosts
+  whose validator makes the record body optional.
+
 ## 0.34.0
 
 - Added `server/content-sections-core` — public reads and staff-only upserts of

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": false,
@@ -145,7 +145,10 @@
     "./server/pages-core": "./src/server/pages-core.ts",
     "./server/resolve-globals": "./src/server/resolve-globals.ts",
     "./server/content-sections-core": "./src/server/content-sections-core.ts",
-    "./server/translate-db-core": "./src/server/translate-db-core.ts"
+    "./server/translate-db-core": "./src/server/translate-db-core.ts",
+    "./tracking/injections": "./src/tracking/injections.ts",
+    "./server/injections-core": "./src/server/injections-core.ts",
+    "./server/domains-core": "./src/server/domains-core.ts"
   },
   "dependencies": {
     "fflate": "^0.8.3"

package/src/server/content-sections-core.ts

@@ -49,7 +49,7 @@ export async function isStaffCore(context: PlatformAuthContext): Promise<boolean
  */
 export async function saveContentSectionCore(
   context: PlatformAuthContext & { supabase: ContentClient },
-  input: { key: string; data: unknown },
+  input: { key: string; data?: unknown },
 ): Promise<{ ok: true; key: string }> {
   await assertStaff(context);
 

package/src/server/domains-core.ts

@@ -0,0 +1,180 @@
+/**
+ * Host-agnostic logic for locale → domain mapping (`locale_domains`).
+ *
+ * Reads use a privileged client because the table reveals which hostname serves
+ * the backoffice; writes run as the signed-in staff user. The host owns the
+ * server functions, its locale union and the request headers.
+ */
+
+import { assertStaff, type PlatformAuthContext } from "./guards";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/** Structural subset of a Supabase-shaped client used by this core. */
+export type DomainsClient = { from: (table: string) => any };
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export type LocaleDomainRecord = {
+  locale: string;
+  domain: string;
+  isDefault: boolean;
+  isAdminDomain: boolean;
+};
+
+/** Strip protocol, trailing slashes and casing from a stored domain. */
+export function normalizeDomain(domain: string): string {
+  return domain
+    .replace(/^https?:\/\//, "")
+    .replace(/\/+$/, "")
+    .toLowerCase();
+}
+
+/** Strip a leading `www.` and casing from a request host. */
+export function normalizeHost(host: string): string {
+  return host.replace(/^www\./, "").toLowerCase();
+}
+
+function rowToDomain(row: {
+  locale: string;
+  domain: string;
+  is_default: boolean;
+  is_admin_domain: boolean;
+}): LocaleDomainRecord {
+  return {
+    locale: row.locale,
+    domain: row.domain,
+    isDefault: row.is_default,
+    isAdminDomain: row.is_admin_domain,
+  };
+}
+
+/** Every configured mapping, ordered by locale. Requires a privileged client. */
+export async function listLocaleDomainsCore(client: DomainsClient): Promise<LocaleDomainRecord[]> {
+  const { data, error } = await client
+    .from("locale_domains")
+    .select("locale, domain, is_default, is_admin_domain")
+    .order("locale");
+  if (error) throw new Error(error.message);
+  return (data ?? []).map(rowToDomain);
+}
+
+/** The mapping whose domain matches `host`, ignoring protocol and `www.`. */
+export function matchDomain(
+  domains: LocaleDomainRecord[],
+  host: string,
+): LocaleDomainRecord | undefined {
+  const normalizedHost = normalizeHost(host);
+  return domains.find((d) => {
+    const normalized = normalizeDomain(d.domain);
+    return normalizedHost === normalized || normalizedHost === `www.${normalized}`;
+  });
+}
+
+/**
+ * Resolve the active locale for a request host, falling back to the default
+ * mapping, then to the first mapping, then to a synthetic host-based record.
+ */
+export function resolveRequestLocale(
+  domains: LocaleDomainRecord[],
+  host: string,
+  defaultLocale: string,
+): { locale: string; domain: LocaleDomainRecord } {
+  const match = matchDomain(domains, host);
+  if (match) return { locale: match.locale, domain: match };
+
+  const fallback = domains.find((d) => d.isDefault) ??
+    domains[0] ?? {
+      locale: defaultLocale,
+      domain: host || "localhost",
+      isDefault: true,
+      isAdminDomain: true,
+    };
+  return { locale: fallback.locale, domain: fallback };
+}
+
+/**
+ * The domain that serves the backoffice.
+ *
+ * `forcedHost` (a self-host `SITE_URL`) is authoritative: an imported row from
+ * another deployment must never send the backoffice to that other hostname.
+ * Otherwise the flagged database row wins, and the request host is last resort.
+ */
+export function resolveAdminDomain(
+  domains: LocaleDomainRecord[],
+  options: { forcedHost?: string | null; requestHost?: string | null; defaultLocale: string },
+): LocaleDomainRecord {
+  const dbAdmin = domains.find((d) => d.isAdminDomain) ?? domains[0];
+
+  if (options.forcedHost) {
+    return {
+      locale: dbAdmin?.locale ?? options.defaultLocale,
+      domain: options.forcedHost,
+      isDefault: dbAdmin?.isDefault ?? true,
+      isAdminDomain: true,
+    };
+  }
+  if (dbAdmin) return dbAdmin;
+  return {
+    locale: options.defaultLocale,
+    domain: options.requestHost || "localhost",
+    isDefault: true,
+    isAdminDomain: true,
+  };
+}
+
+/** Absolute origin for a locale, or "" when the locale has no mapping. */
+export function resolveLocaleOrigin(locale: string, domains: LocaleDomainRecord[]): string {
+  const match = domains.find((d) => d.locale === locale);
+  if (!match) return "";
+  return `https://${normalizeDomain(match.domain)}`;
+}
+
+/**
+ * Staff-only upsert of one mapping. Keeps at most one default and one admin
+ * domain by clearing the flags on every other locale first.
+ */
+export async function saveLocaleDomainCore(
+  context: PlatformAuthContext & { supabase: DomainsClient },
+  input: { locale: string; domain: string; isDefault: boolean; isAdminDomain: boolean },
+  options: { invalidDomainMessage?: string } = {},
+): Promise<{ ok: true }> {
+  await assertStaff(context);
+
+  const normalized = normalizeDomain(input.domain);
+  if (!normalized) throw new Error(options.invalidDomainMessage ?? "Invalid domain");
+
+  if (input.isDefault) {
+    await context.supabase
+      .from("locale_domains")
+      .update({ is_default: false })
+      .neq("locale", input.locale);
+  }
+  if (input.isAdminDomain) {
+    await context.supabase
+      .from("locale_domains")
+      .update({ is_admin_domain: false })
+      .neq("locale", input.locale);
+  }
+
+  const { error } = await context.supabase.from("locale_domains").upsert(
+    {
+      locale: input.locale,
+      domain: normalized,
+      is_default: input.isDefault,
+      is_admin_domain: input.isAdminDomain,
+    },
+    { onConflict: "locale" },
+  );
+  if (error) throw new Error(error.message);
+  return { ok: true };
+}
+
+/** Staff-only delete of one mapping. */
+export async function deleteLocaleDomainCore(
+  context: PlatformAuthContext & { supabase: DomainsClient },
+  locale: string,
+): Promise<{ ok: true }> {
+  await assertStaff(context);
+  const { error } = await context.supabase.from("locale_domains").delete().eq("locale", locale);
+  if (error) throw new Error(error.message);
+  return { ok: true };
+}

package/src/server/injections-core.ts

@@ -0,0 +1,223 @@
+/**
+ * Host-agnostic logic for the "Code & tracking" admin area (`site_injections`).
+ *
+ * The host owns the server-function wrappers and the clients; this module owns
+ * the row mapping, validation-independent CRUD, the audit trail action names and
+ * the request-time resolution of the merged injection bundle, so every site
+ * behaves identically.
+ */
+
+import {
+  EMPTY_BUNDLE,
+  mergeBundles,
+  normalizeHostname,
+  selectProfiles,
+  type InjectionBundle,
+  type InjectionProfile,
+} from "../tracking/injections";
+import { actorEmail, assertRole, type PlatformAuthContext } from "./guards";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/** Structural subset of a Supabase-shaped client used by this core. */
+export type InjectionsClient = { from: (table: string) => any };
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export const INJECTION_SELECT_COLS =
+  "id, name, scope_type, scope_value, enabled, head_html, body_start_html, body_end_html, gtm_id, ga4_id, meta_pixel_id, tiktok_pixel_id, extra_meta, sort_order, updated_at";
+
+/** Normalize a database row into the profile shape the UI works with. */
+export function rowToInjectionProfile(row: Record<string, unknown>): InjectionProfile {
+  return {
+    id: String(row.id),
+    name: String(row.name ?? ""),
+    scope_type: (row.scope_type as InjectionProfile["scope_type"]) ?? "global",
+    scope_value: String(row.scope_value ?? ""),
+    enabled: Boolean(row.enabled),
+    head_html: String(row.head_html ?? ""),
+    body_start_html: String(row.body_start_html ?? ""),
+    body_end_html: String(row.body_end_html ?? ""),
+    gtm_id: String(row.gtm_id ?? ""),
+    ga4_id: String(row.ga4_id ?? ""),
+    meta_pixel_id: String(row.meta_pixel_id ?? ""),
+    tiktok_pixel_id: String(row.tiktok_pixel_id ?? ""),
+    extra_meta: Array.isArray(row.extra_meta)
+      ? (row.extra_meta as InjectionProfile["extra_meta"])
+      : [],
+    sort_order: Number(row.sort_order ?? 100),
+    updated_at: row.updated_at ? String(row.updated_at) : undefined,
+  };
+}
+
+/** Signed-in staff read of every profile, in scope then sort order. */
+export async function listInjectionsCore(client: InjectionsClient): Promise<InjectionProfile[]> {
+  const { data, error } = await client
+    .from("site_injections")
+    .select(INJECTION_SELECT_COLS)
+    .order("scope_type")
+    .order("sort_order");
+  if (error) throw new Error(error.message);
+  return ((data ?? []) as Record<string, unknown>[]).map(rowToInjectionProfile);
+}
+
+export type InjectionInput = Omit<InjectionProfile, "id" | "updated_at"> & { id?: string };
+
+/** Host-provided audit-log writer; keeps privileged clients out of the core. */
+export type AuditWriter = (entry: {
+  actorId: string;
+  actorEmail: string | null;
+  action: string;
+  entity: string;
+  entityId: string | null;
+  meta: Record<string, unknown>;
+}) => Promise<void>;
+
+function toRow(input: InjectionInput) {
+  return {
+    name: input.name,
+    scope_type: input.scope_type,
+    scope_value: input.scope_type === "global" ? "" : input.scope_value,
+    enabled: input.enabled,
+    head_html: input.head_html,
+    body_start_html: input.body_start_html,
+    body_end_html: input.body_end_html,
+    gtm_id: input.gtm_id,
+    ga4_id: input.ga4_id,
+    meta_pixel_id: input.meta_pixel_id,
+    tiktok_pixel_id: input.tiktok_pixel_id,
+    extra_meta: input.extra_meta,
+    sort_order: input.sort_order,
+  };
+}
+
+/** Admin-only create/update of one profile, with an audit entry. */
+export async function saveInjectionCore(
+  context: PlatformAuthContext & { supabase: InjectionsClient },
+  input: InjectionInput,
+  audit: AuditWriter,
+): Promise<{ id: string }> {
+  await assertRole(context, "admin");
+  const row = toRow(input);
+  const scope = `${row.scope_type}:${row.scope_value}`;
+
+  if (input.id) {
+    const { error } = await context.supabase
+      .from("site_injections")
+      .update(row)
+      .eq("id", input.id);
+    if (error) throw new Error(error.message);
+    await audit({
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.update",
+      entity: "site_injections",
+      entityId: input.id,
+      meta: { name: input.name, scope, enabled: input.enabled },
+    });
+    return { id: input.id };
+  }
+
+  const { data: inserted, error } = await context.supabase
+    .from("site_injections")
+    .insert(row)
+    .select("id")
+    .single();
+  if (error) throw new Error(error.message);
+  const id = String(inserted?.id ?? "");
+  await audit({
+    actorId: context.userId,
+    actorEmail: actorEmail(context),
+    action: "injection.create",
+    entity: "site_injections",
+    entityId: id || null,
+    meta: { name: input.name, scope },
+  });
+  return { id };
+}
+
+/** Admin-only delete of one profile, with an audit entry. */
+export async function deleteInjectionCore(
+  context: PlatformAuthContext & { supabase: InjectionsClient },
+  id: string,
+  audit: AuditWriter,
+): Promise<{ ok: true }> {
+  await assertRole(context, "admin");
+  const { error } = await context.supabase.from("site_injections").delete().eq("id", id);
+  if (error) throw new Error(error.message);
+  await audit({
+    actorId: context.userId,
+    actorEmail: actorEmail(context),
+    action: "injection.delete",
+    entity: "site_injections",
+    entityId: id,
+    meta: {},
+  });
+  return { ok: true };
+}
+
+/* ---------------- Request-time resolution ---------------- */
+
+const CACHE_TTL_MS = 30_000;
+const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
+
+/**
+ * Resolve the merged bundle for a request host. Never throws: a backend hiccup
+ * degrades to "no injection" so the site still renders.
+ *
+ * `client` must be a privileged (service-role) client — `site_injections` and
+ * `locale_domains` are not readable anonymously.
+ */
+export async function resolveInjectionsCore(
+  client: InjectionsClient,
+  host: string,
+  options: { defaultLocale?: string } = {},
+): Promise<InjectionBundle> {
+  const key = normalizeHostname(host);
+  const hit = cache.get(key);
+  if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.bundle;
+
+  let bundle = EMPTY_BUNDLE;
+  try {
+    const [{ data: rows }, { data: domains }] = await Promise.all([
+      client.from("site_injections").select("*").eq("enabled", true),
+      client.from("locale_domains").select("locale, domain, is_default"),
+    ]);
+
+    if (rows && rows.length > 0) {
+      const list = (domains ?? []) as { locale: string; domain: string; is_default: boolean }[];
+      const match = list.find((d) => normalizeHostname(d.domain) === key);
+      const fallback = list.find((d) => d.is_default);
+      const locale = match?.locale ?? fallback?.locale ?? options.defaultLocale ?? "en";
+      const profiles = (rows as Record<string, unknown>[]).map(rowToInjectionProfile);
+      bundle = mergeBundles(selectProfiles(profiles, locale, host));
+    }
+  } catch {
+    bundle = EMPTY_BUNDLE;
+  }
+
+  cache.set(key, { at: Date.now(), bundle });
+  return bundle;
+}
+
+/** True for paths that must never receive tracking code. */
+export function isInjectablePath(pathname: string, backofficePath = "/kontoret"): boolean {
+  if (pathname.startsWith(backofficePath)) return false;
+  if (pathname.startsWith("/preview")) return false;
+  if (pathname.startsWith("/api")) return false;
+  if (pathname.startsWith("/_serverFn")) return false;
+  return true;
+}
+
+/** Insert the bundle's three chunks into a rendered HTML document. */
+export function applyInjections(html: string, bundle: InjectionBundle): string {
+  let out = html;
+  if (bundle.head && out.includes("</head>")) {
+    out = out.replace("</head>", `${bundle.head}</head>`);
+  }
+  if (bundle.bodyStart) {
+    out = out.replace(/<body([^>]*)>/i, (m) => `${m}${bundle.bodyStart}`);
+  }
+  if (bundle.bodyEnd && out.includes("</body>")) {
+    out = out.replace("</body>", `${bundle.bodyEnd}</body>`);
+  }
+  return out;
+}

package/src/tracking/injections.ts

@@ -0,0 +1,153 @@
+/**
+ * Pure helpers for the "Code & tracking" admin area.
+ *
+ * A profile holds raw code for three injection points plus well-known
+ * tracking IDs. Profiles are merged in scope order (global → locale → domain)
+ * into three final HTML strings that the root shell renders.
+ */
+
+export type InjectionScopeType = "global" | "locale" | "domain";
+
+export type ExtraMeta = { name: string; content: string };
+
+export type InjectionProfile = {
+  id: string;
+  name: string;
+  scope_type: InjectionScopeType;
+  scope_value: string;
+  enabled: boolean;
+  head_html: string;
+  body_start_html: string;
+  body_end_html: string;
+  gtm_id: string;
+  ga4_id: string;
+  meta_pixel_id: string;
+  tiktok_pixel_id: string;
+  extra_meta: ExtraMeta[];
+  sort_order: number;
+  updated_at?: string;
+};
+
+export type InjectionBundle = {
+  head: string;
+  bodyStart: string;
+  bodyEnd: string;
+};
+
+export const EMPTY_BUNDLE: InjectionBundle = { head: "", bodyStart: "", bodyEnd: "" };
+
+/** Escapes a value used inside a generated snippet / attribute. */
+function esc(v: string): string {
+  return v.replace(/[\\'"<>]/g, "");
+}
+
+export function normalizeHostname(host: string): string {
+  return host
+    .replace(/^https?:\/\//, "")
+    .replace(/\/+$/, "")
+    .replace(/:\d+$/, "")
+    .replace(/^www\./, "")
+    .toLowerCase();
+}
+
+/* ---------------- Snippet builders ---------------- */
+
+export function gtmHead(id: string): string {
+  const gtm = esc(id);
+  return `<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${gtm}');</script>`;
+}
+
+export function gtmBody(id: string): string {
+  const gtm = esc(id);
+  return `<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=${gtm}" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>`;
+}
+
+export function ga4Head(id: string): string {
+  const g = esc(id);
+  return `<script async src="https://www.googletagmanager.com/gtag/js?id=${g}"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config','${g}');</script>`;
+}
+
+export function metaPixelHead(id: string): string {
+  const p = esc(id);
+  return `<script>!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${p}');fbq('track','PageView');</script>`;
+}
+
+export function metaPixelBody(id: string): string {
+  const p = esc(id);
+  return `<noscript><img height="1" width="1" style="display:none" alt="" src="https://www.facebook.com/tr?id=${p}&ev=PageView&noscript=1" /></noscript>`;
+}
+
+export function tiktokPixelHead(id: string): string {
+  const p = esc(id);
+  return `<script>!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie"];ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i||{};ttq._i[e]=[];ttq._i[e]._u=r;ttq._t=ttq._t||{};ttq._t[e]=+new Date;ttq._o=ttq._o||{};ttq._o[e]=n||{};var o=d.createElement("script");o.type="text/javascript";o.async=!0;o.src=r+"?sdkid="+e+"&lib="+t;var a=d.getElementsByTagName("script")[0];a.parentNode.insertBefore(o,a)};ttq.load('${p}');ttq.page();}(window,document,'ttq');</script>`;
+}
+
+export function extraMetaTags(items: ExtraMeta[]): string {
+  return items
+    .filter((m) => m.name && m.content)
+    .map((m) => `<meta name="${esc(m.name)}" content="${m.content.replace(/"/g, "&quot;")}" />`)
+    .join("");
+}
+
+/* ---------------- Merge ---------------- */
+
+/** Turns one profile into its three HTML chunks (IDs first, then raw code). */
+export function profileToBundle(p: InjectionProfile): InjectionBundle {
+  const head: string[] = [];
+  const bodyStart: string[] = [];
+  const bodyEnd: string[] = [];
+
+  if (p.gtm_id?.trim()) {
+    head.push(gtmHead(p.gtm_id.trim()));
+    bodyStart.push(gtmBody(p.gtm_id.trim()));
+  }
+  if (p.ga4_id?.trim()) head.push(ga4Head(p.ga4_id.trim()));
+  if (p.meta_pixel_id?.trim()) {
+    head.push(metaPixelHead(p.meta_pixel_id.trim()));
+    bodyStart.push(metaPixelBody(p.meta_pixel_id.trim()));
+  }
+  if (p.tiktok_pixel_id?.trim()) head.push(tiktokPixelHead(p.tiktok_pixel_id.trim()));
+
+  const extras = Array.isArray(p.extra_meta) ? p.extra_meta : [];
+  const metas = extraMetaTags(extras);
+  if (metas) head.push(metas);
+
+  if (p.head_html?.trim()) head.push(p.head_html);
+  if (p.body_start_html?.trim()) bodyStart.push(p.body_start_html);
+  if (p.body_end_html?.trim()) bodyEnd.push(p.body_end_html);
+
+  return {
+    head: head.join("\n"),
+    bodyStart: bodyStart.join("\n"),
+    bodyEnd: bodyEnd.join("\n"),
+  };
+}
+
+/** Profiles that apply to the given locale + host, in scope order. */
+export function selectProfiles(
+  profiles: InjectionProfile[],
+  locale: string,
+  host: string,
+): InjectionProfile[] {
+  const h = normalizeHostname(host);
+  const rank: Record<InjectionScopeType, number> = { global: 0, locale: 1, domain: 2 };
+  return profiles
+    .filter((p) => p.enabled)
+    .filter((p) => {
+      if (p.scope_type === "global") return true;
+      if (p.scope_type === "locale") return p.scope_value === locale;
+      return normalizeHostname(p.scope_value) === h;
+    })
+    .sort((a, b) => rank[a.scope_type] - rank[b.scope_type] || a.sort_order - b.sort_order);
+}
+
+export function mergeBundles(profiles: InjectionProfile[]): InjectionBundle {
+  return profiles.map(profileToBundle).reduce<InjectionBundle>(
+    (acc, b) => ({
+      head: [acc.head, b.head].filter(Boolean).join("\n"),
+      bodyStart: [acc.bodyStart, b.bodyStart].filter(Boolean).join("\n"),
+      bodyEnd: [acc.bodyEnd, b.bodyEnd].filter(Boolean).join("\n"),
+    }),
+    EMPTY_BUNDLE,
+  );
+}