@commercetools-frontend/application-config 27.5.1 → 27.5.3

package/dist/commercetools-frontend-application-config.cjs.dev.js

@@ -1,7 +1,5 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
 var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
@@ -37,7 +35,7 @@ var _JSON$stringify = require('@babel/runtime-corejs3/core-js-stable/json/string
 var path$1 = require('path');
 var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
 var _bindInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/bind');
-var formatters = require('./formatters-5a68b5ac.cjs.dev.js');
+var formatters = require('./formatters-CWjiv2VA.cjs.dev.js');
 var _Set = require('@babel/runtime-corejs3/core-js-stable/set');
 var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-array');
 var Ajv = require('ajv');
@@ -48,7 +46,7 @@ var jsdom$1 = require('jsdom');
 require('@babel/runtime-corejs3/core-js-stable/object/entries');
 require('lodash/upperFirst');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
@@ -116,14 +114,14 @@ const LOADED_CONFIG_TYPES = {
   CUSTOM_VIEW: 'custom-view'
 };
 
-function _callSuper(t, o, e) { return o = _getPrototypeOf(o), _possibleConstructorReturn(t, _isNativeReflectConstruct() ? _Reflect$construct__default["default"](o, e || [], _getPrototypeOf(t).constructor) : o.apply(t, e)); }
-function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(_Reflect$construct__default["default"](Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function () { return !!t; })(); }
+function _callSuper(t, o, e) { return o = _getPrototypeOf(o), _possibleConstructorReturn(t, _isNativeReflectConstruct() ? _Reflect$construct__default.default(o, e || [], _getPrototypeOf(t).constructor) : o.apply(t, e)); }
+function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(_Reflect$construct__default.default(Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function () { return !!t; })(); }
 let MissingOrInvalidConfigError = /*#__PURE__*/function (_Error) {
   function MissingOrInvalidConfigError(message) {
     var _this;
     _classCallCheck(this, MissingOrInvalidConfigError);
     _this = _callSuper(this, MissingOrInvalidConfigError, [message]);
-    _Object$defineProperty__default["default"](_this, 'name', {
+    _Object$defineProperty__default.default(_this, 'name', {
       value: 'MissingOrInvalidConfigError'
     });
     return _this;
@@ -138,7 +136,7 @@ let MissingOrInvalidConfigError = /*#__PURE__*/function (_Error) {
 // Copied from @commitlint/load/src/utils/load-config.ts
 const isDynamicAwaitSupported = () => {
   var _context;
-  const _process$version$repl = _mapInstanceProperty__default["default"](_context = process.version.replace('v', '').split('.')).call(_context, val => _parseInt__default["default"](val)),
+  const _process$version$repl = _mapInstanceProperty__default.default(_context = process.version.replace('v', '').split('.')).call(_context, val => _parseInt__default.default(val)),
     _process$version$repl2 = _slicedToArray(_process$version$repl, 2),
     major = _process$version$repl2[0],
     minor = _process$version$repl2[1];
@@ -148,9 +146,9 @@ const isDynamicAwaitSupported = () => {
 // Is the given directory set up to use ESM (ECMAScript Modules)?
 // Copied from @commitlint/load/src/utils/load-config.ts
 const isEsmModule = async cwd => {
-  const packagePath = path__default["default"].join(cwd, 'package.json');
+  const packagePath = path__default.default.join(cwd, 'package.json');
   try {
-    const packageJSON = await fs__default["default"].readFile(packagePath, {
+    const packageJSON = await fs__default.default.readFile(packagePath, {
       encoding: 'utf-8'
     });
     return JSON.parse(packageJSON)?.type === 'module';
@@ -267,56 +265,74 @@ const substituteFilePathVariablePlaceholder = (valueOfPlaceholder, matchedString
   const _valueOfPlaceholder$s5 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s6 = _slicedToArray(_valueOfPlaceholder$s5, 2),
     filePathOrModule = _valueOfPlaceholder$s6[1];
+
+  // Security check: Prevent path traversal attacks.
+  // Two strategies depending on whether the specifier is a bare module name
+  // (e.g. "@scope/pkg/file.svg") or a relative/absolute path (e.g. "./app.svg").
+  const isModuleName = !_startsWithInstanceProperty__default.default(filePathOrModule).call(filePathOrModule, '.') && !_startsWithInstanceProperty__default.default(filePathOrModule).call(filePathOrModule, '/');
+  if (isModuleName) {
+    // Bare module specifiers are resolved by require.resolve through
+    // node_modules, linked packages, or Yarn PnP — all legitimate locations
+    // that may be outside the workspace root (e.g. hoisted deps in CI).
+    // We skip the workspace root check for these, but we must block ".."
+    // segments in the specifier itself — those are the only way to make
+    // require.resolve escape module directories and reach arbitrary files
+    // (e.g. "some-pkg/../../../../etc/passwd" resolves through node_modules
+    // to /etc/passwd).
+    const normalizedSpecifier = path__default$1.default.posix.normalize(filePathOrModule);
+    if (_startsWithInstanceProperty__default.default(normalizedSpecifier).call(normalizedSpecifier, '..')) {
+      throw new Error(`Path traversal in module specifiers is not allowed: ${filePathOrModule}`);
+    }
+  }
   const resolvedPath = require.resolve(filePathOrModule, {
     paths: [loadingOptions.applicationPath]
   });
+  const normalizedPath = path__default$1.default.normalize(resolvedPath);
+  if (!isModuleName) {
+    // For relative/absolute paths, verify the resolved path is within the
+    // workspace root. require.resolve() already provides some protection by
+    // only resolving from applicationPath, but we add an extra layer to
+    // prevent access to sensitive system files outside the workspace.
+    const applicationPath = path__default$1.default.normalize(loadingOptions.applicationPath);
 
-  // Security check: Prevent path traversal attacks.
-  // require.resolve() already provides protection by only resolving modules
-  // accessible from the applicationPath. However, we add an extra layer to
-  // prevent access to sensitive system files outside the workspace.
-  const normalizedPath = path__default$1["default"].normalize(resolvedPath);
-  const applicationPath = path__default$1["default"].normalize(loadingOptions.applicationPath);
-
-  // Find workspace root by traversing up from applicationPath until we find
-  // package.json, pnpm-workspace.yaml, or reach root
-  let workspaceRoot = applicationPath;
-  let currentPath = applicationPath;
-  const rootPath = path__default$1["default"].parse(currentPath).root;
-  while (currentPath !== rootPath) {
-    const hasPackageJson = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'package.json'));
-    const hasWorkspaceConfig = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'pnpm-workspace.yaml')) || fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'lerna.json'));
-    if (hasPackageJson) {
-      workspaceRoot = currentPath;
-      if (hasWorkspaceConfig) {
-        // Found workspace root
-        break;
+    // Find workspace root by traversing up from applicationPath until we find
+    // package.json, pnpm-workspace.yaml, or reach root
+    let workspaceRoot = applicationPath;
+    let currentPath = applicationPath;
+    const rootPath = path__default$1.default.parse(currentPath).root;
+    while (currentPath !== rootPath) {
+      const hasPackageJson = fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'package.json'));
+      const hasWorkspaceConfig = fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'pnpm-workspace.yaml')) || fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'lerna.json'));
+      if (hasPackageJson) {
+        workspaceRoot = currentPath;
+        if (hasWorkspaceConfig) {
+          // Found workspace root
+          break;
+        }
       }
+      currentPath = path__default$1.default.dirname(currentPath);
+    }
+    const relativePath = path__default$1.default.relative(workspaceRoot, normalizedPath);
+    // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
+    const isSafePath = !_startsWithInstanceProperty__default.default(relativePath).call(relativePath, '..') && !path__default$1.default.isAbsolute(relativePath);
+    if (!isSafePath) {
+      throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
     }
-    currentPath = path__default$1["default"].dirname(currentPath);
-  }
-  const relativePath = path__default$1["default"].relative(workspaceRoot, normalizedPath);
-
-  // Path is safe if it's within the workspace root.
-  // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
-  const isSafePath = !_startsWithInstanceProperty__default["default"](relativePath).call(relativePath, '..') && !path__default$1["default"].isAbsolute(relativePath);
-  if (!isSafePath) {
-    throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
   }
-  const content = fs__default$1["default"].readFileSync(normalizedPath, {
+  const content = fs__default$1.default.readFileSync(normalizedPath, {
     encoding: 'utf-8'
   });
   return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), content);
 };
-const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty__default["default"](varName).call(varName)).replace(/\s/g, '');
+const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty__default.default(varName).call(varName)).replace(/\s/g, '');
 const substituteVariablePlaceholders = (config, loadingOptions) => {
-  const result = JSON.parse(_JSON$stringify__default["default"](config), (_key, value) => {
+  const result = JSON.parse(_JSON$stringify__default.default(config), (_key, value) => {
     // Only strings are allowed
     let substitutedValue = value;
     if (hasVariablePlaceholder(substitutedValue)) {
       const matchResult = substitutedValue.match(variableSyntax);
       if (matchResult) {
-        _forEachInstanceProperty__default["default"](matchResult).call(matchResult, matchedString => {
+        _forEachInstanceProperty__default.default(matchResult).call(matchResult, matchedString => {
           const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
           if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
             substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
@@ -991,7 +1007,7 @@ var customViewSchemaJson = {
 	]
 };
 
-const ajv = new Ajv__default["default"]({
+const ajv = new Ajv__default.default({
   strict: true,
   useDefaults: true
 });
@@ -1001,7 +1017,7 @@ const printErrors = errors => {
   if (!errors) {
     return 'No errors';
   }
-  return _mapInstanceProperty__default["default"](errors).call(errors, error => {
+  return _mapInstanceProperty__default.default(errors).call(errors, error => {
     const baseMessage = `${error.instancePath} ${error.message}`;
     switch (error.keyword) {
       case 'additionalProperties':
@@ -1020,7 +1036,7 @@ const validateConfig = (configType, config) => {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     validation = validateCustomViewConfig;
   } else {
-    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys__default["default"](LOADED_CONFIG_TYPES).toString()}`);
+    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys__default.default(LOADED_CONFIG_TYPES).toString()}`);
   }
   const isValid = validation(config);
   if (!isValid) {
@@ -1034,8 +1050,8 @@ const validateEntryPointUriPath = config => {
 };
 const validateSubmenuLinks = config => {
   var _context;
-  const uriPathSet = new _Set__default["default"]();
-  _forEachInstanceProperty__default["default"](_context = config.submenuLinks).call(_context, _ref => {
+  const uriPathSet = new _Set__default.default();
+  _forEachInstanceProperty__default.default(_context = config.submenuLinks).call(_context, _ref => {
     let uriPath = _ref.uriPath;
     if (uriPathSet.has(uriPath)) {
       throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
@@ -1045,12 +1061,12 @@ const validateSubmenuLinks = config => {
 };
 const validateAdditionalOAuthScopes = config => {
   var _context2, _context3;
-  const additionalPermissionNames = new _Set__default["default"]();
-  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _forEachInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
+  const additionalPermissionNames = new _Set__default.default();
+  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default.default(_context3 = Function.call).call(_context3, _forEachInstanceProperty__default.default(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name,
       view = _ref2.view,
       manage = _ref2.manage;
-    if ((_Array$isArray__default["default"](view) && view.length === 0 || !view) && (_Array$isArray__default["default"](manage) && manage.length === 0 || !manage)) {
+    if ((_Array$isArray__default.default(view) && view.length === 0 || !view) && (_Array$isArray__default.default(manage) && manage.length === 0 || !manage)) {
       throw new Error(`At least one OAuth Scope for permission group name "${name}" is required`);
     } else if (additionalPermissionNames.has(name)) {
       throw new Error(`Duplicate additional permission group name "${name}". Every additional permission must have a unique name`);
@@ -1062,8 +1078,8 @@ const validateAdditionalOAuthScopes = config => {
   });
 };
 
-function ownKeys$1(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys$1(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys$1(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context6 = ownKeys$1(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 
 // The `uriPath` of each submenu link is supposed to be defined relative
 // to the `entryPointUriPath`. Computing the full path is done internally to keep
@@ -1075,13 +1091,13 @@ const computeUriPath = (uriPath, entryPointUriPath) => {
   if (uriPath === '/') return entryPointUriPath;
   // In case the `uriPath` is already configured including the `entryPointUriPath`,
   // we return the `uriPath` as-is.
-  if (_startsWithInstanceProperty__default["default"](uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
+  if (_startsWithInstanceProperty__default.default(uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
   // Return the full path including the `entryPointUriPath` as a prefix.
   return `${entryPointUriPath}/${uriPath}`;
 };
 const getPermissions = appConfig => {
   var _context, _context2, _context3, _context4;
-  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default["default"](_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
+  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default.default(_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
     let name = _ref.name,
       view = _ref.view,
       manage = _ref.manage;
@@ -1091,7 +1107,7 @@ const getPermissions = appConfig => {
       [`manage${formattedResourceKey}`]: manage
     });
   }, {});
-  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _mapInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
+  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default.default(_context3 = Function.call).call(_context3, _mapInstanceProperty__default.default(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name;
     return name;
   }) || [];
@@ -1100,7 +1116,7 @@ const getPermissions = appConfig => {
   // configuration is for a custom view. In this case we use the
   // default entry point uri path.
   constants.CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH, additionalPermissionNames);
-  const additionalPermissions = _mapInstanceProperty__default["default"](_context4 = _Object$keys__default["default"](additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
+  const additionalPermissions = _mapInstanceProperty__default.default(_context4 = _Object$keys__default.default(additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
     name: permissionKeys[additionalResourceAccessKey],
     oAuthScopes: additionalResourceAccessKeyToOauthScopeMap[additionalResourceAccessKey]
   }));
@@ -1126,7 +1142,7 @@ function transformCustomApplicationConfigToData(appConfig) {
     permissions: getPermissions(appConfig),
     icon: appConfig.icon,
     mainMenuLink: appConfig.mainMenuLink,
-    submenuLinks: _mapInstanceProperty__default["default"](_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
+    submenuLinks: _mapInstanceProperty__default.default(_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
       uriPath: computeUriPath(submenuLink.uriPath, appConfig.entryPointUriPath)
     }))
   };
@@ -1172,13 +1188,13 @@ const mapCloudIdentifierToApiUrl = key => {
     default:
       // We would probably never get to this point, as the JSON schema validation
       // kicks in before.
-      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values__default["default"](CLOUD_IDENTIFIERS).toString()}`);
+      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values__default.default(CLOUD_IDENTIFIERS).toString()}`);
   }
 };
 const getUniqueValues = function () {
   let initialValues = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : [];
   let additionalValues = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : [];
-  return uniq__default["default"]([...initialValues, ...additionalValues]);
+  return uniq__default.default([...initialValues, ...additionalValues]);
 };
 const nonProductionEnvironment = ['development', 'test'];
 const getIsProd = env =>
@@ -1186,7 +1202,7 @@ const getIsProd = env =>
 // a production environment unless it's one of `development` or `test`.
 // This allows to use for example the `staging` value, which from the
 // application perspective is still considered a production environment.
-env.MC_APP_ENV ? !_includesInstanceProperty__default["default"](nonProductionEnvironment).call(nonProductionEnvironment, env.MC_APP_ENV) : env.NODE_ENV === 'production';
+env.MC_APP_ENV ? !_includesInstanceProperty__default.default(nonProductionEnvironment).call(nonProductionEnvironment, env.MC_APP_ENV) : env.NODE_ENV === 'production';
 const getOrThrow = (fn, errorMessage) => {
   try {
     return fn();
@@ -1195,13 +1211,13 @@ const getOrThrow = (fn, errorMessage) => {
   }
 };
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context2 = ownKeys(Object(t), true)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 // TODO: make it configurable.
 const developmentPort = 3001;
 const developmentAppUrl = `http://localhost:${developmentPort}`;
 const getLoadedConfigurationType = configFileName => {
-  if (_includesInstanceProperty__default["default"](configFileName).call(configFileName, 'custom-view-config')) {
+  if (_includesInstanceProperty__default.default(configFileName).call(configFileName, 'custom-view-config')) {
     return LOADED_CONFIG_TYPES.CUSTOM_VIEW;
   }
   return LOADED_CONFIG_TYPES.CUSTOM_APPLICATION;
@@ -1223,7 +1239,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   if (isProd) {
     return undefined;
   }
-  const oidcConfig = omitEmpty__default["default"](_objectSpread(_objectSpread({
+  const oidcConfig = omitEmpty__default.default(_objectSpread(_objectSpread({
     authorizeUrl: [
     // In case the MC API url points to localhost, we need to point
     // to a local running dev login page to handle the workflow properly.
@@ -1244,7 +1260,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   if (isCustomViewData(configurationData)) {
     const hostUriPath = appConfig.env.development.hostUriPath;
     const defaultHostUriPath = oidcConfig.initialProjectKey ? `/${oidcConfig.initialProjectKey}/${entryPointUriPath}` : `/${entryPointUriPath}`;
-    const hostUrl = new _URL__default["default"](hostUriPath || defaultHostUriPath, developmentAppUrl);
+    const hostUrl = new _URL__default.default(hostUriPath || defaultHostUriPath, developmentAppUrl);
     return omitDevConfigIfEmpty({
       oidc: oidcConfig,
       customViewConfig: configurationData,
@@ -1291,7 +1307,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
     appConfig,
     entryPointUriPath
   });
-  return _objectSpread(_objectSpread(_objectSpread({}, omitEmpty__default["default"](additionalAppEnv)), {}, {
+  return _objectSpread(_objectSpread(_objectSpread({}, omitEmpty__default.default(additionalAppEnv)), {}, {
     cdnUrl: cdnUrl.href,
     env: appEnvKey,
     frontendHost: appUrl.host,
@@ -1322,7 +1338,7 @@ const processConfig = async function () {
     _ref3$processEnv = _ref3.processEnv,
     processEnv = _ref3$processEnv === void 0 ? process.env : _ref3$processEnv,
     _ref3$applicationPath = _ref3.applicationPath,
-    applicationPath = _ref3$applicationPath === void 0 ? fs__default$1["default"].realpathSync(process.cwd()) : _ref3$applicationPath;
+    applicationPath = _ref3$applicationPath === void 0 ? fs__default$1.default.realpathSync(process.cwd()) : _ref3$applicationPath;
   if (cachedConfig && !disableCache) return cachedConfig;
   const _await$loadConfig = await loadConfig(applicationPath),
     filepath = _await$loadConfig.filepath,
@@ -1342,12 +1358,12 @@ const processConfig = async function () {
   // Parse all the supported URLs, which gets implicitly validated
 
   const envAppUrl = isProd ? configurationData.url : developmentAppUrl;
-  const appUrl = getOrThrow(() => new _URL__default["default"](envAppUrl), `Invalid application URL: "${envAppUrl}"`);
+  const appUrl = getOrThrow(() => new _URL__default.default(envAppUrl), `Invalid application URL: "${envAppUrl}"`);
 
   // Use `||` instead of `??` to include empty string values.
   const envCdnUrl = isProd ? appConfig.env.production.cdnUrl || appUrl.href : developmentAppUrl;
-  const cdnUrl = getOrThrow(() => new _URL__default["default"](envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
-  const mcApiUrl = getOrThrow(() => new _URL__default["default"](
+  const cdnUrl = getOrThrow(() => new _URL__default.default(envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
+  const mcApiUrl = getOrThrow(() => new _URL__default.default(
   // Use `||` instead of `??` to include empty string values.
   appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), `Invalid MC API URL: "${appConfig.mcApiUrl}"`);
   cachedConfig = {
@@ -1371,7 +1387,7 @@ const processConfig = async function () {
         // the CSP point of view, it will say only the file `app` can be used as a source, so
         // any other file from that domain will be forbidden. Using the slash (ex: https://www.my-domain.com/app/)
         // at the end it's like using a wildcard so anything 'below' `app` will be allowed.
-        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty__default["default"](_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
+        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty__default.default(_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
         'script-src': getUniqueValues(appConfig.headers?.csp?.['script-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : []),
         'style-src': getUniqueValues(appConfig.headers?.csp?.['style-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])
       })
@@ -1381,7 +1397,7 @@ const processConfig = async function () {
 };
 
 const jsdom = new jsdom$1.JSDOM('');
-const DOMPurify = createDOMPurify__default["default"](jsdom.window);
+const DOMPurify = createDOMPurify__default.default(jsdom.window);
 function sanitizeSvg(data) {
   return DOMPurify.sanitize(data, {
     USE_PROFILES: {
@@ -1393,11 +1409,11 @@ function sanitizeSvg(data) {
   });
 }
 
-Object.defineProperty(exports, 'ENTRY_POINT_URI_PATH_REGEX', {
+Object.defineProperty(exports, "ENTRY_POINT_URI_PATH_REGEX", {
   enumerable: true,
   get: function () { return constants.ENTRY_POINT_URI_PATH_REGEX; }
 });
-Object.defineProperty(exports, 'PERMISSION_GROUP_NAME_REGEX', {
+Object.defineProperty(exports, "PERMISSION_GROUP_NAME_REGEX", {
   enumerable: true,
   get: function () { return constants.PERMISSION_GROUP_NAME_REGEX; }
 });

package/dist/commercetools-frontend-application-config.cjs.prod.js

@@ -1,7 +1,5 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
 var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
@@ -37,7 +35,7 @@ var _JSON$stringify = require('@babel/runtime-corejs3/core-js-stable/json/string
 var path$1 = require('path');
 var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
 var _bindInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/bind');
-var formatters = require('./formatters-4515015b.cjs.prod.js');
+var formatters = require('./formatters-CWjiv2VA.cjs.prod.js');
 var _Set = require('@babel/runtime-corejs3/core-js-stable/set');
 var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-array');
 var Ajv = require('ajv');
@@ -48,7 +46,7 @@ var jsdom$1 = require('jsdom');
 require('@babel/runtime-corejs3/core-js-stable/object/entries');
 require('lodash/upperFirst');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
@@ -116,14 +114,14 @@ const LOADED_CONFIG_TYPES = {
   CUSTOM_VIEW: 'custom-view'
 };
 
-function _callSuper(t, o, e) { return o = _getPrototypeOf(o), _possibleConstructorReturn(t, _isNativeReflectConstruct() ? _Reflect$construct__default["default"](o, e || [], _getPrototypeOf(t).constructor) : o.apply(t, e)); }
-function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(_Reflect$construct__default["default"](Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function () { return !!t; })(); }
+function _callSuper(t, o, e) { return o = _getPrototypeOf(o), _possibleConstructorReturn(t, _isNativeReflectConstruct() ? _Reflect$construct__default.default(o, e || [], _getPrototypeOf(t).constructor) : o.apply(t, e)); }
+function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(_Reflect$construct__default.default(Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function () { return !!t; })(); }
 let MissingOrInvalidConfigError = /*#__PURE__*/function (_Error) {
   function MissingOrInvalidConfigError(message) {
     var _this;
     _classCallCheck(this, MissingOrInvalidConfigError);
     _this = _callSuper(this, MissingOrInvalidConfigError, [message]);
-    _Object$defineProperty__default["default"](_this, 'name', {
+    _Object$defineProperty__default.default(_this, 'name', {
       value: 'MissingOrInvalidConfigError'
     });
     return _this;
@@ -138,7 +136,7 @@ let MissingOrInvalidConfigError = /*#__PURE__*/function (_Error) {
 // Copied from @commitlint/load/src/utils/load-config.ts
 const isDynamicAwaitSupported = () => {
   var _context;
-  const _process$version$repl = _mapInstanceProperty__default["default"](_context = process.version.replace('v', '').split('.')).call(_context, val => _parseInt__default["default"](val)),
+  const _process$version$repl = _mapInstanceProperty__default.default(_context = process.version.replace('v', '').split('.')).call(_context, val => _parseInt__default.default(val)),
     _process$version$repl2 = _slicedToArray(_process$version$repl, 2),
     major = _process$version$repl2[0],
     minor = _process$version$repl2[1];
@@ -148,9 +146,9 @@ const isDynamicAwaitSupported = () => {
 // Is the given directory set up to use ESM (ECMAScript Modules)?
 // Copied from @commitlint/load/src/utils/load-config.ts
 const isEsmModule = async cwd => {
-  const packagePath = path__default["default"].join(cwd, 'package.json');
+  const packagePath = path__default.default.join(cwd, 'package.json');
   try {
-    const packageJSON = await fs__default["default"].readFile(packagePath, {
+    const packageJSON = await fs__default.default.readFile(packagePath, {
       encoding: 'utf-8'
     });
     return JSON.parse(packageJSON)?.type === 'module';
@@ -267,56 +265,74 @@ const substituteFilePathVariablePlaceholder = (valueOfPlaceholder, matchedString
   const _valueOfPlaceholder$s5 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s6 = _slicedToArray(_valueOfPlaceholder$s5, 2),
     filePathOrModule = _valueOfPlaceholder$s6[1];
+
+  // Security check: Prevent path traversal attacks.
+  // Two strategies depending on whether the specifier is a bare module name
+  // (e.g. "@scope/pkg/file.svg") or a relative/absolute path (e.g. "./app.svg").
+  const isModuleName = !_startsWithInstanceProperty__default.default(filePathOrModule).call(filePathOrModule, '.') && !_startsWithInstanceProperty__default.default(filePathOrModule).call(filePathOrModule, '/');
+  if (isModuleName) {
+    // Bare module specifiers are resolved by require.resolve through
+    // node_modules, linked packages, or Yarn PnP — all legitimate locations
+    // that may be outside the workspace root (e.g. hoisted deps in CI).
+    // We skip the workspace root check for these, but we must block ".."
+    // segments in the specifier itself — those are the only way to make
+    // require.resolve escape module directories and reach arbitrary files
+    // (e.g. "some-pkg/../../../../etc/passwd" resolves through node_modules
+    // to /etc/passwd).
+    const normalizedSpecifier = path__default$1.default.posix.normalize(filePathOrModule);
+    if (_startsWithInstanceProperty__default.default(normalizedSpecifier).call(normalizedSpecifier, '..')) {
+      throw new Error(`Path traversal in module specifiers is not allowed: ${filePathOrModule}`);
+    }
+  }
   const resolvedPath = require.resolve(filePathOrModule, {
     paths: [loadingOptions.applicationPath]
   });
+  const normalizedPath = path__default$1.default.normalize(resolvedPath);
+  if (!isModuleName) {
+    // For relative/absolute paths, verify the resolved path is within the
+    // workspace root. require.resolve() already provides some protection by
+    // only resolving from applicationPath, but we add an extra layer to
+    // prevent access to sensitive system files outside the workspace.
+    const applicationPath = path__default$1.default.normalize(loadingOptions.applicationPath);
 
-  // Security check: Prevent path traversal attacks.
-  // require.resolve() already provides protection by only resolving modules
-  // accessible from the applicationPath. However, we add an extra layer to
-  // prevent access to sensitive system files outside the workspace.
-  const normalizedPath = path__default$1["default"].normalize(resolvedPath);
-  const applicationPath = path__default$1["default"].normalize(loadingOptions.applicationPath);
-
-  // Find workspace root by traversing up from applicationPath until we find
-  // package.json, pnpm-workspace.yaml, or reach root
-  let workspaceRoot = applicationPath;
-  let currentPath = applicationPath;
-  const rootPath = path__default$1["default"].parse(currentPath).root;
-  while (currentPath !== rootPath) {
-    const hasPackageJson = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'package.json'));
-    const hasWorkspaceConfig = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'pnpm-workspace.yaml')) || fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'lerna.json'));
-    if (hasPackageJson) {
-      workspaceRoot = currentPath;
-      if (hasWorkspaceConfig) {
-        // Found workspace root
-        break;
+    // Find workspace root by traversing up from applicationPath until we find
+    // package.json, pnpm-workspace.yaml, or reach root
+    let workspaceRoot = applicationPath;
+    let currentPath = applicationPath;
+    const rootPath = path__default$1.default.parse(currentPath).root;
+    while (currentPath !== rootPath) {
+      const hasPackageJson = fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'package.json'));
+      const hasWorkspaceConfig = fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'pnpm-workspace.yaml')) || fs__default$1.default.existsSync(path__default$1.default.join(currentPath, 'lerna.json'));
+      if (hasPackageJson) {
+        workspaceRoot = currentPath;
+        if (hasWorkspaceConfig) {
+          // Found workspace root
+          break;
+        }
       }
+      currentPath = path__default$1.default.dirname(currentPath);
+    }
+    const relativePath = path__default$1.default.relative(workspaceRoot, normalizedPath);
+    // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
+    const isSafePath = !_startsWithInstanceProperty__default.default(relativePath).call(relativePath, '..') && !path__default$1.default.isAbsolute(relativePath);
+    if (!isSafePath) {
+      throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
     }
-    currentPath = path__default$1["default"].dirname(currentPath);
-  }
-  const relativePath = path__default$1["default"].relative(workspaceRoot, normalizedPath);
-
-  // Path is safe if it's within the workspace root.
-  // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
-  const isSafePath = !_startsWithInstanceProperty__default["default"](relativePath).call(relativePath, '..') && !path__default$1["default"].isAbsolute(relativePath);
-  if (!isSafePath) {
-    throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
   }
-  const content = fs__default$1["default"].readFileSync(normalizedPath, {
+  const content = fs__default$1.default.readFileSync(normalizedPath, {
     encoding: 'utf-8'
   });
   return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), content);
 };
-const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty__default["default"](varName).call(varName)).replace(/\s/g, '');
+const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty__default.default(varName).call(varName)).replace(/\s/g, '');
 const substituteVariablePlaceholders = (config, loadingOptions) => {
-  const result = JSON.parse(_JSON$stringify__default["default"](config), (_key, value) => {
+  const result = JSON.parse(_JSON$stringify__default.default(config), (_key, value) => {
     // Only strings are allowed
     let substitutedValue = value;
     if (hasVariablePlaceholder(substitutedValue)) {
       const matchResult = substitutedValue.match(variableSyntax);
       if (matchResult) {
-        _forEachInstanceProperty__default["default"](matchResult).call(matchResult, matchedString => {
+        _forEachInstanceProperty__default.default(matchResult).call(matchResult, matchedString => {
           const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
           if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
             substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
@@ -991,7 +1007,7 @@ var customViewSchemaJson = {
 	]
 };
 
-const ajv = new Ajv__default["default"]({
+const ajv = new Ajv__default.default({
   strict: true,
   useDefaults: true
 });
@@ -1001,7 +1017,7 @@ const printErrors = errors => {
   if (!errors) {
     return 'No errors';
   }
-  return _mapInstanceProperty__default["default"](errors).call(errors, error => {
+  return _mapInstanceProperty__default.default(errors).call(errors, error => {
     const baseMessage = `${error.instancePath} ${error.message}`;
     switch (error.keyword) {
       case 'additionalProperties':
@@ -1020,7 +1036,7 @@ const validateConfig = (configType, config) => {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     validation = validateCustomViewConfig;
   } else {
-    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys__default["default"](LOADED_CONFIG_TYPES).toString()}`);
+    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys__default.default(LOADED_CONFIG_TYPES).toString()}`);
   }
   const isValid = validation(config);
   if (!isValid) {
@@ -1034,8 +1050,8 @@ const validateEntryPointUriPath = config => {
 };
 const validateSubmenuLinks = config => {
   var _context;
-  const uriPathSet = new _Set__default["default"]();
-  _forEachInstanceProperty__default["default"](_context = config.submenuLinks).call(_context, _ref => {
+  const uriPathSet = new _Set__default.default();
+  _forEachInstanceProperty__default.default(_context = config.submenuLinks).call(_context, _ref => {
     let uriPath = _ref.uriPath;
     if (uriPathSet.has(uriPath)) {
       throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
@@ -1045,12 +1061,12 @@ const validateSubmenuLinks = config => {
 };
 const validateAdditionalOAuthScopes = config => {
   var _context2, _context3;
-  const additionalPermissionNames = new _Set__default["default"]();
-  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _forEachInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
+  const additionalPermissionNames = new _Set__default.default();
+  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default.default(_context3 = Function.call).call(_context3, _forEachInstanceProperty__default.default(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name,
       view = _ref2.view,
       manage = _ref2.manage;
-    if ((_Array$isArray__default["default"](view) && view.length === 0 || !view) && (_Array$isArray__default["default"](manage) && manage.length === 0 || !manage)) {
+    if ((_Array$isArray__default.default(view) && view.length === 0 || !view) && (_Array$isArray__default.default(manage) && manage.length === 0 || !manage)) {
       throw new Error(`At least one OAuth Scope for permission group name "${name}" is required`);
     } else if (additionalPermissionNames.has(name)) {
       throw new Error(`Duplicate additional permission group name "${name}". Every additional permission must have a unique name`);
@@ -1062,8 +1078,8 @@ const validateAdditionalOAuthScopes = config => {
   });
 };
 
-function ownKeys$1(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys$1(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys$1(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context6 = ownKeys$1(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 
 // The `uriPath` of each submenu link is supposed to be defined relative
 // to the `entryPointUriPath`. Computing the full path is done internally to keep
@@ -1075,13 +1091,13 @@ const computeUriPath = (uriPath, entryPointUriPath) => {
   if (uriPath === '/') return entryPointUriPath;
   // In case the `uriPath` is already configured including the `entryPointUriPath`,
   // we return the `uriPath` as-is.
-  if (_startsWithInstanceProperty__default["default"](uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
+  if (_startsWithInstanceProperty__default.default(uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
   // Return the full path including the `entryPointUriPath` as a prefix.
   return `${entryPointUriPath}/${uriPath}`;
 };
 const getPermissions = appConfig => {
   var _context, _context2, _context3, _context4;
-  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default["default"](_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
+  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default.default(_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
     let name = _ref.name,
       view = _ref.view,
       manage = _ref.manage;
@@ -1091,7 +1107,7 @@ const getPermissions = appConfig => {
       [`manage${formattedResourceKey}`]: manage
     });
   }, {});
-  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _mapInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
+  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default.default(_context3 = Function.call).call(_context3, _mapInstanceProperty__default.default(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name;
     return name;
   }) || [];
@@ -1100,7 +1116,7 @@ const getPermissions = appConfig => {
   // configuration is for a custom view. In this case we use the
   // default entry point uri path.
   constants.CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH, additionalPermissionNames);
-  const additionalPermissions = _mapInstanceProperty__default["default"](_context4 = _Object$keys__default["default"](additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
+  const additionalPermissions = _mapInstanceProperty__default.default(_context4 = _Object$keys__default.default(additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
     name: permissionKeys[additionalResourceAccessKey],
     oAuthScopes: additionalResourceAccessKeyToOauthScopeMap[additionalResourceAccessKey]
   }));
@@ -1126,7 +1142,7 @@ function transformCustomApplicationConfigToData(appConfig) {
     permissions: getPermissions(appConfig),
     icon: appConfig.icon,
     mainMenuLink: appConfig.mainMenuLink,
-    submenuLinks: _mapInstanceProperty__default["default"](_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
+    submenuLinks: _mapInstanceProperty__default.default(_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
       uriPath: computeUriPath(submenuLink.uriPath, appConfig.entryPointUriPath)
     }))
   };
@@ -1172,13 +1188,13 @@ const mapCloudIdentifierToApiUrl = key => {
     default:
       // We would probably never get to this point, as the JSON schema validation
       // kicks in before.
-      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values__default["default"](CLOUD_IDENTIFIERS).toString()}`);
+      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values__default.default(CLOUD_IDENTIFIERS).toString()}`);
   }
 };
 const getUniqueValues = function () {
   let initialValues = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : [];
   let additionalValues = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : [];
-  return uniq__default["default"]([...initialValues, ...additionalValues]);
+  return uniq__default.default([...initialValues, ...additionalValues]);
 };
 const nonProductionEnvironment = ['development', 'test'];
 const getIsProd = env =>
@@ -1186,7 +1202,7 @@ const getIsProd = env =>
 // a production environment unless it's one of `development` or `test`.
 // This allows to use for example the `staging` value, which from the
 // application perspective is still considered a production environment.
-env.MC_APP_ENV ? !_includesInstanceProperty__default["default"](nonProductionEnvironment).call(nonProductionEnvironment, env.MC_APP_ENV) : env.NODE_ENV === 'production';
+env.MC_APP_ENV ? !_includesInstanceProperty__default.default(nonProductionEnvironment).call(nonProductionEnvironment, env.MC_APP_ENV) : env.NODE_ENV === 'production';
 const getOrThrow = (fn, errorMessage) => {
   try {
     return fn();
@@ -1195,13 +1211,13 @@ const getOrThrow = (fn, errorMessage) => {
   }
 };
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context2 = ownKeys(Object(t), true)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 // TODO: make it configurable.
 const developmentPort = 3001;
 const developmentAppUrl = `http://localhost:${developmentPort}`;
 const getLoadedConfigurationType = configFileName => {
-  if (_includesInstanceProperty__default["default"](configFileName).call(configFileName, 'custom-view-config')) {
+  if (_includesInstanceProperty__default.default(configFileName).call(configFileName, 'custom-view-config')) {
     return LOADED_CONFIG_TYPES.CUSTOM_VIEW;
   }
   return LOADED_CONFIG_TYPES.CUSTOM_APPLICATION;
@@ -1223,7 +1239,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   if (isProd) {
     return undefined;
   }
-  const oidcConfig = omitEmpty__default["default"](_objectSpread(_objectSpread({
+  const oidcConfig = omitEmpty__default.default(_objectSpread(_objectSpread({
     authorizeUrl: [
     // In case the MC API url points to localhost, we need to point
     // to a local running dev login page to handle the workflow properly.
@@ -1244,7 +1260,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   if (isCustomViewData(configurationData)) {
     const hostUriPath = appConfig.env.development.hostUriPath;
     const defaultHostUriPath = oidcConfig.initialProjectKey ? `/${oidcConfig.initialProjectKey}/${entryPointUriPath}` : `/${entryPointUriPath}`;
-    const hostUrl = new _URL__default["default"](hostUriPath || defaultHostUriPath, developmentAppUrl);
+    const hostUrl = new _URL__default.default(hostUriPath || defaultHostUriPath, developmentAppUrl);
     return omitDevConfigIfEmpty({
       oidc: oidcConfig,
       customViewConfig: configurationData,
@@ -1291,7 +1307,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
     appConfig,
     entryPointUriPath
   });
-  return _objectSpread(_objectSpread(_objectSpread({}, omitEmpty__default["default"](additionalAppEnv)), {}, {
+  return _objectSpread(_objectSpread(_objectSpread({}, omitEmpty__default.default(additionalAppEnv)), {}, {
     cdnUrl: cdnUrl.href,
     env: appEnvKey,
     frontendHost: appUrl.host,
@@ -1322,7 +1338,7 @@ const processConfig = async function () {
     _ref3$processEnv = _ref3.processEnv,
     processEnv = _ref3$processEnv === void 0 ? process.env : _ref3$processEnv,
     _ref3$applicationPath = _ref3.applicationPath,
-    applicationPath = _ref3$applicationPath === void 0 ? fs__default$1["default"].realpathSync(process.cwd()) : _ref3$applicationPath;
+    applicationPath = _ref3$applicationPath === void 0 ? fs__default$1.default.realpathSync(process.cwd()) : _ref3$applicationPath;
   if (cachedConfig && !disableCache) return cachedConfig;
   const _await$loadConfig = await loadConfig(applicationPath),
     filepath = _await$loadConfig.filepath,
@@ -1342,12 +1358,12 @@ const processConfig = async function () {
   // Parse all the supported URLs, which gets implicitly validated
 
   const envAppUrl = isProd ? configurationData.url : developmentAppUrl;
-  const appUrl = getOrThrow(() => new _URL__default["default"](envAppUrl), `Invalid application URL: "${envAppUrl}"`);
+  const appUrl = getOrThrow(() => new _URL__default.default(envAppUrl), `Invalid application URL: "${envAppUrl}"`);
 
   // Use `||` instead of `??` to include empty string values.
   const envCdnUrl = isProd ? appConfig.env.production.cdnUrl || appUrl.href : developmentAppUrl;
-  const cdnUrl = getOrThrow(() => new _URL__default["default"](envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
-  const mcApiUrl = getOrThrow(() => new _URL__default["default"](
+  const cdnUrl = getOrThrow(() => new _URL__default.default(envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
+  const mcApiUrl = getOrThrow(() => new _URL__default.default(
   // Use `||` instead of `??` to include empty string values.
   appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), `Invalid MC API URL: "${appConfig.mcApiUrl}"`);
   cachedConfig = {
@@ -1371,7 +1387,7 @@ const processConfig = async function () {
         // the CSP point of view, it will say only the file `app` can be used as a source, so
         // any other file from that domain will be forbidden. Using the slash (ex: https://www.my-domain.com/app/)
         // at the end it's like using a wildcard so anything 'below' `app` will be allowed.
-        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty__default["default"](_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
+        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty__default.default(_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
         'script-src': getUniqueValues(appConfig.headers?.csp?.['script-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : []),
         'style-src': getUniqueValues(appConfig.headers?.csp?.['style-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])
       })
@@ -1381,7 +1397,7 @@ const processConfig = async function () {
 };
 
 const jsdom = new jsdom$1.JSDOM('');
-const DOMPurify = createDOMPurify__default["default"](jsdom.window);
+const DOMPurify = createDOMPurify__default.default(jsdom.window);
 function sanitizeSvg(data) {
   return DOMPurify.sanitize(data, {
     USE_PROFILES: {
@@ -1393,11 +1409,11 @@ function sanitizeSvg(data) {
   });
 }
 
-Object.defineProperty(exports, 'ENTRY_POINT_URI_PATH_REGEX', {
+Object.defineProperty(exports, "ENTRY_POINT_URI_PATH_REGEX", {
   enumerable: true,
   get: function () { return constants.ENTRY_POINT_URI_PATH_REGEX; }
 });
-Object.defineProperty(exports, 'PERMISSION_GROUP_NAME_REGEX', {
+Object.defineProperty(exports, "PERMISSION_GROUP_NAME_REGEX", {
   enumerable: true,
   get: function () { return constants.PERMISSION_GROUP_NAME_REGEX; }
 });

package/dist/commercetools-frontend-application-config.esm.js

@@ -34,7 +34,7 @@ import _JSON$stringify from '@babel/runtime-corejs3/core-js-stable/json/stringif
 import path$1 from 'path';
 import _reduceInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/reduce';
 import _bindInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/bind';
-import { f as formatEntryPointUriPathToResourceAccessKey, e as entryPointUriPathToResourceAccesses } from './formatters-5629a23b.esm.js';
+import { f as formatEntryPointUriPathToResourceAccessKey, b as entryPointUriPathToResourceAccesses } from './formatters-CR1HIN8T.esm.js';
 import _Set from '@babel/runtime-corejs3/core-js-stable/set';
 import _Array$isArray from '@babel/runtime-corejs3/core-js-stable/array/is-array';
 import Ajv from 'ajv';
@@ -231,41 +231,59 @@ const substituteFilePathVariablePlaceholder = (valueOfPlaceholder, matchedString
   const _valueOfPlaceholder$s5 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s6 = _slicedToArray(_valueOfPlaceholder$s5, 2),
     filePathOrModule = _valueOfPlaceholder$s6[1];
+
+  // Security check: Prevent path traversal attacks.
+  // Two strategies depending on whether the specifier is a bare module name
+  // (e.g. "@scope/pkg/file.svg") or a relative/absolute path (e.g. "./app.svg").
+  const isModuleName = !_startsWithInstanceProperty(filePathOrModule).call(filePathOrModule, '.') && !_startsWithInstanceProperty(filePathOrModule).call(filePathOrModule, '/');
+  if (isModuleName) {
+    // Bare module specifiers are resolved by require.resolve through
+    // node_modules, linked packages, or Yarn PnP — all legitimate locations
+    // that may be outside the workspace root (e.g. hoisted deps in CI).
+    // We skip the workspace root check for these, but we must block ".."
+    // segments in the specifier itself — those are the only way to make
+    // require.resolve escape module directories and reach arbitrary files
+    // (e.g. "some-pkg/../../../../etc/passwd" resolves through node_modules
+    // to /etc/passwd).
+    const normalizedSpecifier = path$1.posix.normalize(filePathOrModule);
+    if (_startsWithInstanceProperty(normalizedSpecifier).call(normalizedSpecifier, '..')) {
+      throw new Error(`Path traversal in module specifiers is not allowed: ${filePathOrModule}`);
+    }
+  }
   const resolvedPath = require.resolve(filePathOrModule, {
     paths: [loadingOptions.applicationPath]
   });
-
-  // Security check: Prevent path traversal attacks.
-  // require.resolve() already provides protection by only resolving modules
-  // accessible from the applicationPath. However, we add an extra layer to
-  // prevent access to sensitive system files outside the workspace.
   const normalizedPath = path$1.normalize(resolvedPath);
-  const applicationPath = path$1.normalize(loadingOptions.applicationPath);
+  if (!isModuleName) {
+    // For relative/absolute paths, verify the resolved path is within the
+    // workspace root. require.resolve() already provides some protection by
+    // only resolving from applicationPath, but we add an extra layer to
+    // prevent access to sensitive system files outside the workspace.
+    const applicationPath = path$1.normalize(loadingOptions.applicationPath);
 
-  // Find workspace root by traversing up from applicationPath until we find
-  // package.json, pnpm-workspace.yaml, or reach root
-  let workspaceRoot = applicationPath;
-  let currentPath = applicationPath;
-  const rootPath = path$1.parse(currentPath).root;
-  while (currentPath !== rootPath) {
-    const hasPackageJson = fs$1.existsSync(path$1.join(currentPath, 'package.json'));
-    const hasWorkspaceConfig = fs$1.existsSync(path$1.join(currentPath, 'pnpm-workspace.yaml')) || fs$1.existsSync(path$1.join(currentPath, 'lerna.json'));
-    if (hasPackageJson) {
-      workspaceRoot = currentPath;
-      if (hasWorkspaceConfig) {
-        // Found workspace root
-        break;
+    // Find workspace root by traversing up from applicationPath until we find
+    // package.json, pnpm-workspace.yaml, or reach root
+    let workspaceRoot = applicationPath;
+    let currentPath = applicationPath;
+    const rootPath = path$1.parse(currentPath).root;
+    while (currentPath !== rootPath) {
+      const hasPackageJson = fs$1.existsSync(path$1.join(currentPath, 'package.json'));
+      const hasWorkspaceConfig = fs$1.existsSync(path$1.join(currentPath, 'pnpm-workspace.yaml')) || fs$1.existsSync(path$1.join(currentPath, 'lerna.json'));
+      if (hasPackageJson) {
+        workspaceRoot = currentPath;
+        if (hasWorkspaceConfig) {
+          // Found workspace root
+          break;
+        }
       }
+      currentPath = path$1.dirname(currentPath);
+    }
+    const relativePath = path$1.relative(workspaceRoot, normalizedPath);
+    // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
+    const isSafePath = !_startsWithInstanceProperty(relativePath).call(relativePath, '..') && !path$1.isAbsolute(relativePath);
+    if (!isSafePath) {
+      throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
     }
-    currentPath = path$1.dirname(currentPath);
-  }
-  const relativePath = path$1.relative(workspaceRoot, normalizedPath);
-
-  // Path is safe if it's within the workspace root.
-  // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
-  const isSafePath = !_startsWithInstanceProperty(relativePath).call(relativePath, '..') && !path$1.isAbsolute(relativePath);
-  if (!isSafePath) {
-    throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
   }
   const content = fs$1.readFileSync(normalizedPath, {
     encoding: 'utf-8'
@@ -1027,7 +1045,7 @@ const validateAdditionalOAuthScopes = config => {
 };
 
 function ownKeys$1(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context6 = ownKeys$1(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context6 = ownKeys$1(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 // The `uriPath` of each submenu link is supposed to be defined relative
 // to the `entryPointUriPath`. Computing the full path is done internally to keep
@@ -1160,7 +1178,7 @@ const getOrThrow = (fn, errorMessage) => {
 };
 
 function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context2 = ownKeys(Object(t), true)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 // TODO: make it configurable.
 const developmentPort = 3001;
 const developmentAppUrl = `http://localhost:${developmentPort}`;

package/dist/{formatters-5629a23b.esm.js → formatters-CR1HIN8T.esm.js}

@@ -15,7 +15,7 @@ import upperFirst from 'lodash/upperFirst';
 import { CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH } from '@commercetools-frontend/constants';
 
 function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context6 = ownKeys(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context6 = ownKeys(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 /**
  * The function formats the `entryPointUriPath` to a resource access key.
  * It makes the first character of the string and the next character after a special character an uppercase.
@@ -98,4 +98,4 @@ function entryPointUriPathToPermissionKeys(entryPointUriPath, permissionGroupNam
   }, {});
 }
 
-export { entryPointUriPathToPermissionKeys as a, formatPermissionGroupNameToResourceAccessKey as b, computeCustomViewResourceAccesses as c, computeCustomViewPermissionsKeys as d, entryPointUriPathToResourceAccesses as e, formatEntryPointUriPathToResourceAccessKey as f };
+export { computeCustomViewResourceAccesses as a, entryPointUriPathToResourceAccesses as b, computeCustomViewPermissionsKeys as c, formatPermissionGroupNameToResourceAccessKey as d, entryPointUriPathToPermissionKeys as e, formatEntryPointUriPathToResourceAccessKey as f };

package/dist/{formatters-4515015b.cjs.prod.js → formatters-CWjiv2VA.cjs.dev.js}

@@ -16,7 +16,7 @@ var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entr
 var upperFirst = require('lodash/upperFirst');
 var constants = require('@commercetools-frontend/constants');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
@@ -31,8 +31,8 @@ var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInsta
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
 var upperFirst__default = /*#__PURE__*/_interopDefault(upperFirst);
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context6 = ownKeys(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 /**
  * The function formats the `entryPointUriPath` to a resource access key.
  * It makes the first character of the string and the next character after a special character an uppercase.
@@ -47,11 +47,11 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _co
  */
 const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
   var _context, _context2;
-  return _mapInstanceProperty__default["default"](_context = _mapInstanceProperty__default["default"](_context2 = entryPointUriPath
+  return _mapInstanceProperty__default.default(_context = _mapInstanceProperty__default.default(_context2 = entryPointUriPath
   // Splits the string by underscore.
   .split('_')
   // Uppercase the first character of each word split.
-  ).call(_context2, upperFirst__default["default"])
+  ).call(_context2, upperFirst__default.default)
   // Join the words by an underscore.
   .join('_')
   // Each word is split by a hyphen.
@@ -62,7 +62,7 @@ const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
     if (i > 0 && /^\d+$/.test(word[0])) {
       return `/${word}`;
     }
-    return upperFirst__default["default"](word);
+    return upperFirst__default.default(word);
   }).join('');
 };
 
@@ -76,9 +76,9 @@ const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
  */
 const formatPermissionGroupNameToResourceAccessKey = permissionGroupName => {
   var _context3;
-  return _mapInstanceProperty__default["default"](_context3 = permissionGroupName
+  return _mapInstanceProperty__default.default(_context3 = permissionGroupName
   // Each word is split by a hyphen.
-  .split('-')).call(_context3, upperFirst__default["default"]).join('');
+  .split('-')).call(_context3, upperFirst__default.default).join('');
 };
 function entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames) {
   var _context4;
@@ -87,7 +87,7 @@ function entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupN
     view: `view${resourceAccessKey}`,
     manage: `manage${resourceAccessKey}`
   };
-  const additionalResourceAccesses = _reduceInstanceProperty__default["default"](_context4 = permissionGroupNames ?? []).call(_context4, (resourceAccesses, permissionGroupName) => {
+  const additionalResourceAccesses = _reduceInstanceProperty__default.default(_context4 = permissionGroupNames ?? []).call(_context4, (resourceAccesses, permissionGroupName) => {
     const additionalResourceAccessKey = formatPermissionGroupNameToResourceAccessKey(permissionGroupName);
     return _objectSpread(_objectSpread({}, resourceAccesses), {}, {
       [`view${additionalResourceAccessKey}`]: `${defaultResourceAccesses.view}${additionalResourceAccessKey}`,
@@ -105,12 +105,12 @@ function computeCustomViewPermissionsKeys(permissionGroupNames) {
 function entryPointUriPathToPermissionKeys(entryPointUriPath, permissionGroupNames) {
   var _context5;
   const resourceAccesses = entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames ?? []);
-  return _reduceInstanceProperty__default["default"](_context5 = _Object$entries__default["default"](resourceAccesses)).call(_context5, (permissionKeys, _ref) => {
+  return _reduceInstanceProperty__default.default(_context5 = _Object$entries__default.default(resourceAccesses)).call(_context5, (permissionKeys, _ref) => {
     let _ref2 = _slicedToArray(_ref, 2),
       resourceAccessKey = _ref2[0],
       resourceAccessValue = _ref2[1];
     return _objectSpread(_objectSpread({}, permissionKeys), {}, {
-      [upperFirst__default["default"](resourceAccessKey)]: upperFirst__default["default"](resourceAccessValue)
+      [upperFirst__default.default(resourceAccessKey)]: upperFirst__default.default(resourceAccessValue)
     });
   }, {});
 }

package/dist/{formatters-5a68b5ac.cjs.dev.js → formatters-CWjiv2VA.cjs.prod.js}

@@ -16,7 +16,7 @@ var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entr
 var upperFirst = require('lodash/upperFirst');
 var constants = require('@commercetools-frontend/constants');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
@@ -31,8 +31,8 @@ var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInsta
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
 var upperFirst__default = /*#__PURE__*/_interopDefault(upperFirst);
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function ownKeys(e, r) { var t = _Object$keys__default.default(e); if (_Object$getOwnPropertySymbols__default.default) { var o = _Object$getOwnPropertySymbols__default.default(e); r && (o = _filterInstanceProperty__default.default(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default.default(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default.default(_context6 = ownKeys(Object(t), true)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default.default ? _Object$defineProperties__default.default(e, _Object$getOwnPropertyDescriptors__default.default(t)) : _forEachInstanceProperty__default.default(_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty__default.default(e, r, _Object$getOwnPropertyDescriptor__default.default(t, r)); }); } return e; }
 /**
  * The function formats the `entryPointUriPath` to a resource access key.
  * It makes the first character of the string and the next character after a special character an uppercase.
@@ -47,11 +47,11 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _co
  */
 const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
   var _context, _context2;
-  return _mapInstanceProperty__default["default"](_context = _mapInstanceProperty__default["default"](_context2 = entryPointUriPath
+  return _mapInstanceProperty__default.default(_context = _mapInstanceProperty__default.default(_context2 = entryPointUriPath
   // Splits the string by underscore.
   .split('_')
   // Uppercase the first character of each word split.
-  ).call(_context2, upperFirst__default["default"])
+  ).call(_context2, upperFirst__default.default)
   // Join the words by an underscore.
   .join('_')
   // Each word is split by a hyphen.
@@ -62,7 +62,7 @@ const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
     if (i > 0 && /^\d+$/.test(word[0])) {
       return `/${word}`;
     }
-    return upperFirst__default["default"](word);
+    return upperFirst__default.default(word);
   }).join('');
 };
 
@@ -76,9 +76,9 @@ const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
  */
 const formatPermissionGroupNameToResourceAccessKey = permissionGroupName => {
   var _context3;
-  return _mapInstanceProperty__default["default"](_context3 = permissionGroupName
+  return _mapInstanceProperty__default.default(_context3 = permissionGroupName
   // Each word is split by a hyphen.
-  .split('-')).call(_context3, upperFirst__default["default"]).join('');
+  .split('-')).call(_context3, upperFirst__default.default).join('');
 };
 function entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames) {
   var _context4;
@@ -87,7 +87,7 @@ function entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupN
     view: `view${resourceAccessKey}`,
     manage: `manage${resourceAccessKey}`
   };
-  const additionalResourceAccesses = _reduceInstanceProperty__default["default"](_context4 = permissionGroupNames ?? []).call(_context4, (resourceAccesses, permissionGroupName) => {
+  const additionalResourceAccesses = _reduceInstanceProperty__default.default(_context4 = permissionGroupNames ?? []).call(_context4, (resourceAccesses, permissionGroupName) => {
     const additionalResourceAccessKey = formatPermissionGroupNameToResourceAccessKey(permissionGroupName);
     return _objectSpread(_objectSpread({}, resourceAccesses), {}, {
       [`view${additionalResourceAccessKey}`]: `${defaultResourceAccesses.view}${additionalResourceAccessKey}`,
@@ -105,12 +105,12 @@ function computeCustomViewPermissionsKeys(permissionGroupNames) {
 function entryPointUriPathToPermissionKeys(entryPointUriPath, permissionGroupNames) {
   var _context5;
   const resourceAccesses = entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames ?? []);
-  return _reduceInstanceProperty__default["default"](_context5 = _Object$entries__default["default"](resourceAccesses)).call(_context5, (permissionKeys, _ref) => {
+  return _reduceInstanceProperty__default.default(_context5 = _Object$entries__default.default(resourceAccesses)).call(_context5, (permissionKeys, _ref) => {
     let _ref2 = _slicedToArray(_ref, 2),
       resourceAccessKey = _ref2[0],
       resourceAccessValue = _ref2[1];
     return _objectSpread(_objectSpread({}, permissionKeys), {}, {
-      [upperFirst__default["default"](resourceAccessKey)]: upperFirst__default["default"](resourceAccessValue)
+      [upperFirst__default.default(resourceAccessKey)]: upperFirst__default.default(resourceAccessValue)
     });
   }, {});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-frontend/application-config",
-  "version": "27.5.1",
+  "version": "27.5.3",
   "description": "Configuration utilities for building Custom Applications",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -45,7 +45,7 @@
     "@babel/register": "^7.22.15",
     "@babel/runtime": "^7.22.15",
     "@babel/runtime-corejs3": "^7.22.15",
-    "@commercetools-frontend/constants": "27.5.1",
+    "@commercetools-frontend/constants": "27.5.3",
     "@types/lodash": "^4.14.198",
     "@types/react": "^19.0.3",
     "ajv": "8.18.0",
@@ -60,7 +60,7 @@
   "devDependencies": {
     "@types/jsdom": "^21.1.2",
     "json-schema-to-typescript": "15.0.4",
-    "@commercetools-frontend/assets": "27.5.1"
+    "@commercetools-frontend/assets": "27.5.3"
   },
   "engines": {
     "node": "18.x || 20.x || >=22.0.0"

package/ssr/dist/commercetools-frontend-application-config-ssr.cjs.dev.js

@@ -1,8 +1,6 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var formatters = require('../../dist/formatters-5a68b5ac.cjs.dev.js');
+var formatters = require('../../dist/formatters-CWjiv2VA.cjs.dev.js');
 require('@babel/runtime-corejs3/core-js-stable/object/keys');
 require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 require('@babel/runtime-corejs3/core-js-stable/instance/filter');

package/ssr/dist/commercetools-frontend-application-config-ssr.cjs.prod.js

@@ -1,8 +1,6 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var formatters = require('../../dist/formatters-4515015b.cjs.prod.js');
+var formatters = require('../../dist/formatters-CWjiv2VA.cjs.prod.js');
 require('@babel/runtime-corejs3/core-js-stable/object/keys');
 require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 require('@babel/runtime-corejs3/core-js-stable/instance/filter');

package/ssr/dist/commercetools-frontend-application-config-ssr.esm.js

@@ -1,4 +1,4 @@
-export { d as computeCustomViewPermissionsKeys, c as computeCustomViewResourceAccesses, a as entryPointUriPathToPermissionKeys, e as entryPointUriPathToResourceAccesses, f as formatEntryPointUriPathToResourceAccessKey, b as formatPermissionGroupNameToResourceAccessKey } from '../../dist/formatters-5629a23b.esm.js';
+export { c as computeCustomViewPermissionsKeys, a as computeCustomViewResourceAccesses, e as entryPointUriPathToPermissionKeys, b as entryPointUriPathToResourceAccesses, f as formatEntryPointUriPathToResourceAccessKey, d as formatPermissionGroupNameToResourceAccessKey } from '../../dist/formatters-CR1HIN8T.esm.js';
 import '@babel/runtime-corejs3/core-js-stable/object/keys';
 import '@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols';
 import '@babel/runtime-corejs3/core-js-stable/instance/filter';