@colixsystems/widget-sdk 0.149.0 → 0.150.0

package/dist/linter.js

@@ -530,13 +530,13 @@ function _scopeRules(source, manifest) {
   }
 
   // sc-7991 — every send spends the workspace's AI credits, so the manifest has
-  // to declare the capability. This gate is ADVISORY, not an authorization
-  // boundary: unlike users/groups (minted into X-Widget-Scopes and checked
-  // server-side), nothing re-checks ai.invoke at call time, so a widget that
-  // evades this regex still reaches the endpoint. What actually bounds abuse is
-  // the app-user JWT, the per-actor and per-tenant limiters and the AI quota
-  // gate. The scope's real job is DISCLOSURE — it is what the marketplace
-  // install consent screen shows.
+  // to declare the capability. This gate is still ADVISORY: the scope itself is
+  // not minted into X-Widget-Scopes, so a widget that evades this regex still
+  // reaches the endpoint, and the scope's real job is DISCLOSURE — it is what
+  // the marketplace install consent screen shows.
+  // sc-8128 — but the endpoint is no longer unguarded: a turn is refused unless
+  // the agent is bound on a page the caller can read. Abuse is bounded by that,
+  // the app-user JWT, the per-actor and per-tenant limiters and the AI quota.
   if (/\buseAgent\s*\(/.test(source)) {
     const invokes = declared.has("ai.invoke:*") || declared.has("ai.invoke");
     if (!invokes) {
@@ -1667,6 +1667,19 @@ function _bracedSpan(code, from) {
   return null;
 }
 
+// The non-escape branch excludes `\` so the two branches can never both
+// match the same character. With a bare `.`, escape pairs before a quote
+// the anchor then rejects backtrack exponentially — 60 characters of an
+// authored widget draft wedge the single-threaded API pod for ~60s, on the
+// AI-widget-agent publish vet, not the package-upload path (sc-8051, sc-8041).
+//
+// It excludes the line terminators too, because a character class — unlike
+// `.` — matches them, which would widen the literal past its own line.
+// An odd trailing backslash run therefore no longer matches; `_bracedSpan`
+// shares the escape rule and never yields one.
+const _TEXT_LITERAL_CHILD_RE =
+  /^(["'`])((?:\\.|(?!\1)[^\\\r\n\u2028\u2029])*)\1$/;
+
 // Copy pinned in a `<Text>`: a bare literal child, or a braced child that is
 // NOTHING BUT a string literal (`{"Hello"}`) — the one-pair-of-braces evasion.
 // A braced expression carrying an identifier is left alone: it may already be
@@ -1689,8 +1702,7 @@ function _textLiteralOccurrences(codes, masks) {
       let text = null;
       if (code[i] === "{") {
         const inner = _bracedSpan(code, i);
-        const lit =
-          inner && inner.trim().match(/^(["'`])((?:\\.|(?!\1).)*)\1$/);
+        const lit = inner && inner.trim().match(_TEXT_LITERAL_CHILD_RE);
         // A template carrying `${…}` interpolates a value, so it is not a literal.
         if (lit && !(lit[1] === "`" && lit[2].includes("${"))) text = lit[2];
       } else {

package/dist/theme-components.cjs

@@ -99,6 +99,11 @@ function normaliseThemeComponents(raw) {
 }
 
 
+// Long enough for a hex, an enum value or a font name; short enough that a
+// hand-edited theme_config cannot smuggle a payload into every widget.
+// Named because the Mason plan gate prints it when it rejects a value.
+const MAX_STYLE_STRING_LENGTH = 64;
+
 // Values are assigned onto plain object literals, so `__proto__` would set a
 // PROTOTYPE rather than a style field. Refused at every level.
 const UNSAFE_STYLE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
@@ -125,9 +130,9 @@ function coerceWidgetStyleValue(value, depth = 0) {
   const { maxValueDepth, maxValueEntries } = CONTRACT.themeWidgetStyles;
   if (typeof value === "string") {
     const trimmed = value.trim();
-    // Long enough for a hex, an enum value or a font name; short enough that a
-    // hand-edited theme_config cannot smuggle a payload into every widget.
-    return trimmed && trimmed.length <= 64 ? trimmed : undefined;
+    return trimmed && trimmed.length <= MAX_STYLE_STRING_LENGTH
+      ? trimmed
+      : undefined;
   }
   if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
   if (typeof value === "boolean") return value;
@@ -393,4 +398,4 @@ function applyThemeComponentStyle(manifestId, theme, props, styleSchema) {
   return { ...base, style: { ...themed, ...authored } };
 }
 
-module.exports = { normaliseThemeComponents, normaliseWidgetStyleFields, normaliseWidgetStyles, applyThemeComponentStyle };
+module.exports = { normaliseThemeComponents, normaliseWidgetStyleFields, normaliseWidgetStyles, applyThemeComponentStyle, styleValueBytes, MAX_STYLE_STRING_LENGTH };

package/dist/theme-components.js

@@ -91,6 +91,11 @@ export function normaliseThemeComponents(raw) {
 }
 
 
+// Long enough for a hex, an enum value or a font name; short enough that a
+// hand-edited theme_config cannot smuggle a payload into every widget.
+// Named because the Mason plan gate prints it when it rejects a value.
+export const MAX_STYLE_STRING_LENGTH = 64;
+
 // Values are assigned onto plain object literals, so `__proto__` would set a
 // PROTOTYPE rather than a style field. Refused at every level.
 const UNSAFE_STYLE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
@@ -117,9 +122,9 @@ function coerceWidgetStyleValue(value, depth = 0) {
   const { maxValueDepth, maxValueEntries } = CONTRACT.themeWidgetStyles;
   if (typeof value === "string") {
     const trimmed = value.trim();
-    // Long enough for a hex, an enum value or a font name; short enough that a
-    // hand-edited theme_config cannot smuggle a payload into every widget.
-    return trimmed && trimmed.length <= 64 ? trimmed : undefined;
+    return trimmed && trimmed.length <= MAX_STYLE_STRING_LENGTH
+      ? trimmed
+      : undefined;
   }
   if (typeof value === "number") return Number.isFinite(value) ? value : undefined;
   if (typeof value === "boolean") return value;
@@ -157,7 +162,7 @@ function coerceWidgetStyleValue(value, depth = 0) {
 }
 
 // What the value actually costs the cold-start read and the baked export.
-function styleValueBytes(value) {
+export function styleValueBytes(value) {
   const json = JSON.stringify(value);
   return typeof json === "string" ? json.length : Infinity;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.149.0",
+  "version": "0.150.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",
@@ -49,7 +49,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/theme-token-refs.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-screen-title.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-flex-basis-percent.test.js src/__tests__/linter-hardcoded-design.test.js src/__tests__/linter-editability.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/flatten-entry.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/interaction-lift.test.js src/__tests__/toast-host.test.js src/__tests__/overlay-tokens.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-camera.test.js src/__tests__/hooks-barcode.test.js src/__tests__/hooks-image-editor.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js src/__tests__/linter-html-in-content.test.js src/__tests__/markdown.test.js src/__tests__/markdown-edit.test.js src/__tests__/richtext-tokens.test.js src/__tests__/style-group.test.js"
+    "test": "node --test \"src/__tests__/*.test.js\""
   },
   "engines": {
     "node": ">=18"