@teleporthq/teleport-shared 0.43.61 → 0.43.63

package/__tests__/utils/font-preconnect.ts

@@ -0,0 +1,62 @@
+import { resolveFontPreconnectHints } from '../../src/utils/font-preconnect'
+
+/**
+ * A Google Fonts stylesheet is a TWO-HOP dependency: the CSS comes from
+ * `fonts.googleapis.com`, and only once it has been parsed does the browser
+ * discover the font files on `fonts.gstatic.com` — a second origin needing its
+ * own DNS + TCP + TLS round trips, started after the CSS has already returned.
+ *
+ * Two things here are load-bearing:
+ *  - the gstatic hint MUST be `crossorigin`, because fonts are fetched in CORS
+ *    mode and a connection opened in the wrong mode cannot be reused (the hint
+ *    then costs a connection instead of saving one);
+ *  - a project that loads no Google font gets NO hints, because a preconnect to
+ *    an origin the page never contacts is pure waste.
+ */
+
+describe('resolveFontPreconnectHints', () => {
+  const googleFontsHref = 'https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap'
+
+  it('returns both hints when the project loads a Google font', () => {
+    expect(resolveFontPreconnectHints([googleFontsHref])).toEqual([
+      { href: 'https://fonts.googleapis.com', crossorigin: false },
+      { href: 'https://fonts.gstatic.com', crossorigin: true },
+    ])
+  })
+
+  // Without CORS mode the browser opens a second connection for the font files
+  // and the hint becomes a cost rather than a saving.
+  it('marks ONLY the font-file origin as crossorigin', () => {
+    const hints = resolveFontPreconnectHints([googleFontsHref])
+    const byHost = Object.fromEntries(hints.map((hint) => [hint.href, hint.crossorigin]))
+
+    expect(byHost['https://fonts.gstatic.com']).toBe(true)
+    expect(byHost['https://fonts.googleapis.com']).toBe(false)
+  })
+
+  it('returns nothing for a project with no Google font', () => {
+    expect(resolveFontPreconnectHints(['/styles.css', '/fonts/Inter.woff2'])).toEqual([])
+  })
+
+  it('returns nothing for an empty or sparse asset list', () => {
+    expect(resolveFontPreconnectHints([])).toEqual([])
+    expect(resolveFontPreconnectHints([undefined, undefined])).toEqual([])
+  })
+
+  // A page loading three families still only needs one pair of connections.
+  it('emits one pair however many font stylesheets there are', () => {
+    expect(
+      resolveFontPreconnectHints([
+        'https://fonts.googleapis.com/css2?family=Inter',
+        'https://fonts.googleapis.com/css2?family=Lora',
+        '/styles.css',
+      ])
+    ).toHaveLength(2)
+  })
+
+  // Self-hosted fonts need no hint: their files come from the page's own origin,
+  // which the browser has already connected to.
+  it('ignores a self-hosted font', () => {
+    expect(resolveFontPreconnectHints(['/assets/fonts/custom.css'])).toEqual([])
+  })
+})

package/__tests__/utils/rich-text-embeds-runtime-module.ts

@@ -0,0 +1,124 @@
+import { parse } from '@babel/parser'
+import { RichTextEmbeds, RichTextEmbedsCodegen } from '../../src'
+
+/**
+ * The generated project gets `components/embed-runtime.js`, emitted from the
+ * very functions in `src/utils/rich-text-embeds.ts` rather than hand-copied
+ * into a template. These tests are what makes that safe: the emitted module has
+ * to parse, evaluate with no module-scoped references left dangling, and answer
+ * exactly what the source module answers.
+ */
+const SOURCE = RichTextEmbedsCodegen.generateEmbedRuntimeModuleSource()
+
+/** Evaluates the ES module source in-process and returns its exports. */
+const loadRuntime = (): Record<string, (...args: never[]) => unknown> => {
+  const exportedNames = Array.from(
+    SOURCE.matchAll(/^export (?:var|function) ([A-Za-z_$][\w$]*)/gm)
+  ).map((match) => match[1])
+  const body = `${SOURCE.replace(/^export /gm, '')}\nreturn { ${exportedNames.join(', ')} }`
+  // eslint-disable-next-line no-new-func
+  return new Function(body)() as Record<string, (...args: never[]) => unknown>
+}
+
+describe('the emitted embed runtime module', () => {
+  it('parses as an ES module', () => {
+    expect(() => parse(SOURCE, { sourceType: 'module' })).not.toThrow()
+  })
+
+  it('carries no reference the module itself does not declare', () => {
+    expect(SOURCE).not.toContain('exports.')
+    expect(() => loadRuntime()).not.toThrow()
+  })
+
+  it('exports every helper the generated editor and activator call', () => {
+    const runtime = loadRuntime()
+    const required = [
+      'isSafeEmbedUrl',
+      'resolveEmbedProvider',
+      'buildEmbedHtmlFromUrl',
+      'resolveEmbedMode',
+      'createEmbedValue',
+      'buildEmbedElementHtml',
+      'buildEmbedFrameChildren',
+      'readEmbedValueFromElement',
+      'readEncodedEmbedCode',
+      'findEmbedFrame',
+      'normalizeEmbedsForStorage',
+      'resolveEmbedSandboxFlags',
+      'buildEmbedSandboxDocument',
+      'parseEmbedHeightMessage',
+      'createEmbedToken',
+      'encodeEmbedCode',
+      'decodeEmbedCode',
+    ]
+
+    required.forEach((name) => {
+      expect(typeof runtime[name]).toBe('function')
+    })
+  })
+
+  it('answers exactly what the source module answers', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+
+    const urls = [
+      'https://youtu.be/dQw4w9WgXcQ',
+      'https://x.com/a/status/1',
+      'https://www.figma.com/design/abc/File?node-id=1-2',
+      'https://open.spotify.com/track/abc123',
+      'https://example.com/plain',
+      'javascript:alert(1)',
+    ]
+
+    urls.forEach((url) => {
+      expect(runtime.isSafeEmbedUrl(url)).toBe(RichTextEmbeds.isSafeEmbedUrl(url))
+
+      const built = runtime.buildEmbedHtmlFromUrl(url)
+      const expected = RichTextEmbeds.buildEmbedHtmlFromUrl(url)
+      expect(built?.html).toBe(expected?.html)
+      expect(built?.provider.id).toBe(expected?.provider.id)
+
+      if (!built || !expected) {
+        return
+      }
+
+      const params = {
+        code: built.html,
+        provider: built.provider.id,
+        url,
+        ratio: built.provider.ratio,
+        caption: 'a & "b"',
+      }
+      expect(runtime.createEmbedValue(params)).toEqual(RichTextEmbeds.createEmbedValue(params))
+      expect(runtime.buildEmbedElementHtml(runtime.createEmbedValue(params))).toBe(
+        RichTextEmbeds.buildEmbedElementHtml(RichTextEmbeds.createEmbedValue(params))
+      )
+    })
+  })
+
+  it('produces the same sandbox payload as the source module', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+
+    expect(runtime.resolveEmbedSandboxFlags('strict')).toBe(
+      RichTextEmbeds.resolveEmbedSandboxFlags('strict')
+    )
+    expect(runtime.resolveEmbedSandboxFlags('trusted')).toBe(
+      RichTextEmbeds.resolveEmbedSandboxFlags('trusted')
+    )
+    expect(runtime.buildEmbedSandboxDocument('<b>x</b>', 'tok')).toBe(
+      RichTextEmbeds.buildEmbedSandboxDocument('<b>x</b>', 'tok')
+    )
+    expect(
+      runtime.parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 9e9 })
+    ).toEqual(
+      RichTextEmbeds.parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 9e9 })
+    )
+  })
+
+  it('round-trips base64 the same way in both', () => {
+    const runtime = loadRuntime() as unknown as typeof RichTextEmbeds
+    const code = '<blockquote>café — 日本語 — 🎉</blockquote><script>x()</script>'
+
+    expect(runtime.encodeEmbedCode(code)).toBe(RichTextEmbeds.encodeEmbedCode(code))
+    expect(runtime.decodeEmbedCode(RichTextEmbeds.encodeEmbedCode(code))).toBe(code)
+  })
+})

package/__tests__/utils/rich-text-embeds.ts

@@ -0,0 +1,254 @@
+import { parse } from '@babel/parser'
+import { RichTextEmbeds, RichTextEmbedsCodegen } from '../../src'
+
+const {
+  EMBED_ATTR,
+  applyEmbedTemplate,
+  buildEmbedElementHtml,
+  buildEmbedHtmlFromUrl,
+  clampEmbedWidth,
+  createEmbedValue,
+  decodeEmbedCode,
+  embedBlockStyle,
+  embedFrameStyle,
+  encodeEmbedCode,
+  isSafeEmbedUrl,
+  normalizeEmbedAlign,
+  resolveEmbedMode,
+  resolveEmbedProvider,
+} = RichTextEmbeds
+
+// The DOM half of the contract (`readEmbedValueFromElement`, the layout and
+// caption editors) is covered in teleport-gui, whose test runner has a DOM —
+// this repo's jest runs in a node environment.
+
+describe('provider resolution', () => {
+  it('matches every YouTube URL spelling to the same embed', () => {
+    const urls = [
+      'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
+      'https://www.youtube.com/watch?list=PL123&v=dQw4w9WgXcQ',
+      'https://youtu.be/dQw4w9WgXcQ',
+      'https://www.youtube.com/shorts/dQw4w9WgXcQ',
+      'https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ',
+    ]
+
+    urls.forEach((url) => {
+      const built = buildEmbedHtmlFromUrl(url)
+      expect(built).not.toBeNull()
+      expect(built?.provider.id).toBe('youtube')
+      expect(built?.html).toContain('https://www.youtube.com/embed/dQw4w9WgXcQ')
+    })
+  })
+
+  it('URL-encodes the whole URL where a provider takes it as a query parameter', () => {
+    const built = buildEmbedHtmlFromUrl('https://www.figma.com/design/abc123/My-File?node-id=1-2')
+    expect(built?.provider.id).toBe('figma')
+    expect(built?.html).toContain(
+      'url=https%3A%2F%2Fwww.figma.com%2Fdesign%2Fabc123%2FMy-File%3Fnode-id%3D1-2'
+    )
+  })
+
+  it('falls back to a generic iframe only after every specific provider missed', () => {
+    expect(resolveEmbedProvider('https://example.com/some/page')?.provider.id).toBe('iframe-url')
+    expect(resolveEmbedProvider('https://vimeo.com/76979871')?.provider.id).toBe('vimeo')
+    expect(resolveEmbedProvider('https://codepen.io/team/pen/abcDEF')?.provider.id).toBe('codepen')
+  })
+
+  it('refuses anything that is not an http(s) URL', () => {
+    expect(isSafeEmbedUrl('javascript:alert(1)')).toBe(false)
+    expect(isSafeEmbedUrl('data:text/html;base64,PHNjcmlwdD4=')).toBe(false)
+    expect(isSafeEmbedUrl('//evil.example.com')).toBe(false)
+    expect(isSafeEmbedUrl('')).toBe(false)
+    expect(isSafeEmbedUrl('https://ok.example.com/x')).toBe(true)
+    expect(resolveEmbedProvider('javascript:alert(1)')).toBeNull()
+  })
+
+  it('keeps `$$` literal and never honours the replacement patterns String.replace reserves', () => {
+    const match = 'https://x.test/1'.match(/^https:\/\/x\.test\/(\d+)$/) as RegExpMatchArray
+    expect(applyEmbedTemplate("[$1][$$][$'][$`]", match, 'https://x.test/1')).toBe("[1][$][$'][$`]")
+  })
+
+  it('gives every provider patterns that agree on their capture groups', () => {
+    RichTextEmbeds.EMBED_PROVIDERS.forEach((provider) => {
+      const groupCounts = provider.patterns.map(
+        (pattern) => new RegExp(`${pattern.source}|`).exec('')?.length ?? 0
+      )
+      expect(new Set(groupCounts).size).toBe(1)
+    })
+  })
+})
+
+describe('mode resolution', () => {
+  it('quarantines anything that can execute', () => {
+    expect(resolveEmbedMode('<script src="https://x.test/a.js"></script>')).toBe('sandbox')
+    expect(resolveEmbedMode('<img src=x onerror="alert(1)">')).toBe('sandbox')
+    expect(resolveEmbedMode('<a href="javascript:alert(1)">x</a>')).toBe('sandbox')
+    expect(resolveEmbedMode('<iframe src="https://x.test"></iframe>')).toBe('inline')
+  })
+
+  it('does not mistake an attribute merely starting with "on" for a handler', () => {
+    expect(resolveEmbedMode('<iframe data-only="1" title="one"></iframe>')).toBe('inline')
+  })
+
+  it('sends every script-based provider to the sandbox and the rest inline', () => {
+    expect(resolveEmbedMode(buildEmbedHtmlFromUrl('https://x.com/a/status/1')?.html ?? '')).toBe(
+      'sandbox'
+    )
+    expect(
+      resolveEmbedMode(buildEmbedHtmlFromUrl('https://youtu.be/dQw4w9WgXcQ')?.html ?? '')
+    ).toBe('inline')
+  })
+})
+
+describe('base64 round-trip', () => {
+  it('survives non-ASCII markup', () => {
+    const code = '<blockquote>café — 日本語 — 🎉</blockquote>'
+    expect(decodeEmbedCode(encodeEmbedCode(code))).toBe(code)
+  })
+})
+
+describe('stored markup', () => {
+  it('keeps an inline embed as real children so it renders without JavaScript', () => {
+    const value = createEmbedValue({
+      code: '<iframe src="https://www.youtube.com/embed/abc"></iframe>',
+      provider: 'youtube',
+      url: 'https://youtu.be/abc',
+      ratio: 56.25,
+      caption: 'A "quoted" caption & more',
+    })
+    const html = buildEmbedElementHtml(value)
+
+    expect(html).toContain(`${EMBED_ATTR.MODE}="inline"`)
+    expect(html).not.toContain(EMBED_ATTR.CODE)
+    expect(html).toContain('<iframe src="https://www.youtube.com/embed/abc"></iframe>')
+    expect(html).toContain('padding-top:56.25%')
+    expect(html).toContain('A &quot;quoted&quot; caption &amp; more')
+  })
+
+  it('encodes a script embed and leaves only a noscript fallback in the page', () => {
+    const code =
+      '<blockquote class="twitter-tweet"></blockquote><script src="https://x.test/w.js"></script>'
+    const value = createEmbedValue({ code, provider: 'twitter', url: 'https://x.com/a/status/1' })
+    const html = buildEmbedElementHtml(value)
+
+    expect(html).toContain(`${EMBED_ATTR.MODE}="sandbox"`)
+    expect(html).toContain(`${EMBED_ATTR.SANDBOX}="strict"`)
+    expect(html).toContain(`${EMBED_ATTR.CODE}="${encodeEmbedCode(code)}"`)
+    expect(html).not.toContain('<script')
+    expect(html).toContain('<noscript>')
+  })
+
+  it('omits the noscript fallback for a pasted snippet that has no source URL', () => {
+    const html = buildEmbedElementHtml(createEmbedValue({ code: '<script>x()</script>' }))
+    expect(html).not.toContain('<noscript>')
+    expect(html).toContain(`${EMBED_ATTR.PROVIDER}="custom"`)
+  })
+})
+
+describe('layout vocabulary', () => {
+  it('clamps the width to a usable range', () => {
+    expect(clampEmbedWidth(0)).toBe(10)
+    expect(clampEmbedWidth(1000)).toBe(100)
+    expect(clampEmbedWidth(NaN)).toBe(100)
+  })
+
+  it('falls back to center for an unknown alignment', () => {
+    expect(normalizeEmbedAlign('diagonal')).toBe('center')
+    expect(normalizeEmbedAlign('float-right')).toBe('float-right')
+  })
+
+  it('only floats when the alignment asks for it', () => {
+    expect(embedBlockStyle({ width: 50, align: 'center' })).toContain('margin-left:auto')
+    expect(embedBlockStyle({ width: 50, align: 'center' })).not.toContain('float')
+    expect(embedBlockStyle({ width: 50, align: 'float-right' })).toContain('float:right')
+  })
+
+  it('only builds a padding-top box for a usable ratio', () => {
+    expect(embedFrameStyle(56.25)).toContain('padding-top:56.25%')
+    expect(embedFrameStyle(null)).not.toContain('padding-top')
+    expect(embedFrameStyle(0)).not.toContain('padding-top')
+  })
+})
+
+describe('runtime serialization', () => {
+  it('emits a registry the generated module can evaluate', () => {
+    // tslint:disable-next-line:no-eval
+    const providers = eval(RichTextEmbedsCodegen.serializeEmbedProvidersForRuntime()) as Array<{
+      id: string
+      patterns: RegExp[]
+    }>
+
+    expect(providers).toHaveLength(RichTextEmbeds.EMBED_PROVIDERS.length)
+    expect(providers[0].patterns[0]).toBeInstanceOf(RegExp)
+    expect(providers.map((entry) => entry.id)).toEqual(
+      RichTextEmbeds.EMBED_PROVIDERS.map((entry) => entry.id)
+    )
+  })
+})
+
+describe('the sandbox payload', () => {
+  const {
+    EMBED_MAX_HEIGHT,
+    EMBED_MIN_HEIGHT,
+    buildEmbedSandboxDocument,
+    createEmbedToken,
+    parseEmbedHeightMessage,
+    resolveEmbedSandboxFlags,
+  } = RichTextEmbeds
+
+  it('withholds allow-same-origin unless the author opted in', () => {
+    expect(resolveEmbedSandboxFlags('strict')).not.toContain('allow-same-origin')
+    expect(resolveEmbedSandboxFlags('trusted')).toContain('allow-same-origin')
+  })
+
+  it('hands the frame a bootstrap script that is valid JavaScript', () => {
+    // The document is assembled from concatenated fragments, so a stray
+    // character would only surface as a silent parse failure inside a sandboxed
+    // frame — where nothing can report it. Parse it here instead.
+    const doc = buildEmbedSandboxDocument('', 'tok')
+    const script = /<script>([\s\S]*?)<\/script>/.exec(doc)
+
+    expect(script).not.toBeNull()
+    expect(() => parse((script as RegExpExecArray)[1], { sourceType: 'script' })).not.toThrow()
+  })
+
+  it('closes every tag it opens, so the embed lands inside the body', () => {
+    const doc = buildEmbedSandboxDocument('<b>x</b>', 'tok')
+
+    expect(doc.indexOf('<body>')).toBeLessThan(doc.indexOf('<b>x</b>'))
+    expect(doc.indexOf('<b>x</b>')).toBeLessThan(doc.indexOf('</body>'))
+    expect(doc.endsWith('</body></html>')).toBe(true)
+  })
+
+  it('bakes the frame token into the document it hands the iframe', () => {
+    const token = createEmbedToken()
+    const doc = buildEmbedSandboxDocument('<blockquote>hi</blockquote>', token)
+
+    expect(doc).toContain(token)
+    expect(doc).not.toContain(RichTextEmbeds.EMBED_TOKEN_PLACEHOLDER)
+    expect(doc).toContain('<blockquote>hi</blockquote>')
+    expect(doc.indexOf('</head>')).toBeLessThan(doc.indexOf('<blockquote>'))
+  })
+
+  it('mints a distinct token per frame', () => {
+    expect(createEmbedToken()).not.toBe(createEmbedToken())
+  })
+
+  it('accepts only a well-formed height message, and clamps it', () => {
+    expect(parseEmbedHeightMessage(null)).toBeNull()
+    expect(parseEmbedHeightMessage('tq-embed-height')).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'other', token: 'a', height: 10 })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 1, height: 10 })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 'x' })).toBeNull()
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: -5 })).toBeNull()
+
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 1 })).toEqual({
+      token: 'a',
+      height: EMBED_MIN_HEIGHT,
+    })
+    expect(parseEmbedHeightMessage({ type: 'tq-embed-height', token: 'a', height: 1e9 })).toEqual({
+      token: 'a',
+      height: EMBED_MAX_HEIGHT,
+    })
+  })
+})

package/dist/cjs/index.d.ts

@@ -13,7 +13,12 @@ import * as HtmlContentModel from './utils/html-content-model';
 import * as StyleDeclarations from './utils/style-declarations';
 import * as StorefrontTax from './utils/storefront-tax';
 import * as ProductDiscounts from './utils/product-discounts';
+import * as ProductRatings from './utils/product-ratings';
+import * as FontPreconnect from './utils/font-preconnect';
 import * as EmailDate from './utils/email-date';
+import * as RichTextEmbeds from './utils/rich-text-embeds';
+import * as RichTextEmbedsCodegen from './utils/rich-text-embeds-codegen';
 import * as DataCache from './cache';
-export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, EmailDate, DataCache, };
+import * as PageRevalidate from './page-revalidate';
+export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, ProductRatings, FontPreconnect, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, PageRevalidate, };
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AAEpC,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,SAAS,GACV,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,cAAc,GACf,CAAA"}

package/dist/cjs/index.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DataCache = exports.EmailDate = exports.ProductDiscounts = exports.StorefrontTax = exports.StyleDeclarations = exports.HtmlContentModel = exports.LayoutTopology = exports.RoutePaths = exports.ASTEffectCleanup = exports.ASTStatementOrder = exports.ASTScope = exports.JSIdentifiers = exports.LocalImports = exports.GenericUtils = exports.UIDLUtils = exports.StringUtils = exports.Constants = void 0;
+exports.PageRevalidate = exports.DataCache = exports.RichTextEmbedsCodegen = exports.RichTextEmbeds = exports.EmailDate = exports.FontPreconnect = exports.ProductRatings = exports.ProductDiscounts = exports.StorefrontTax = exports.StyleDeclarations = exports.HtmlContentModel = exports.LayoutTopology = exports.RoutePaths = exports.ASTEffectCleanup = exports.ASTStatementOrder = exports.ASTScope = exports.JSIdentifiers = exports.LocalImports = exports.GenericUtils = exports.UIDLUtils = exports.StringUtils = exports.Constants = void 0;
 var Constants = __importStar(require("./constants"));
 exports.Constants = Constants;
 var StringUtils = __importStar(require("./utils/string-utils"));
@@ -54,8 +54,18 @@ var StorefrontTax = __importStar(require("./utils/storefront-tax"));
 exports.StorefrontTax = StorefrontTax;
 var ProductDiscounts = __importStar(require("./utils/product-discounts"));
 exports.ProductDiscounts = ProductDiscounts;
+var ProductRatings = __importStar(require("./utils/product-ratings"));
+exports.ProductRatings = ProductRatings;
+var FontPreconnect = __importStar(require("./utils/font-preconnect"));
+exports.FontPreconnect = FontPreconnect;
 var EmailDate = __importStar(require("./utils/email-date"));
 exports.EmailDate = EmailDate;
+var RichTextEmbeds = __importStar(require("./utils/rich-text-embeds"));
+exports.RichTextEmbeds = RichTextEmbeds;
+var RichTextEmbedsCodegen = __importStar(require("./utils/rich-text-embeds-codegen"));
+exports.RichTextEmbedsCodegen = RichTextEmbedsCodegen;
 var DataCache = __importStar(require("./cache"));
 exports.DataCache = DataCache;
+var PageRevalidate = __importStar(require("./page-revalidate"));
+exports.PageRevalidate = PageRevalidate;
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAwC;AAmBtC,8BAAS;AAlBX,gEAAmD;AAmBjD,kCAAW;AAlBb,4DAA+C;AAmB7C,8BAAS;AAlBX,4DAA+C;AAmB7C,oCAAY;AAlBd,kEAAqD;AAmBnD,oCAAY;AAlBd,oEAAuD;AAmBrD,sCAAa;AAlBf,0DAA6C;AAmB3C,4BAAQ;AAlBV,6EAAgE;AAmB9D,8CAAiB;AAlBnB,2EAA8D;AAmB5D,4CAAgB;AAlBlB,8DAAiD;AAmB/C,gCAAU;AAlBZ,sEAAyD;AAmBvD,wCAAc;AAlBhB,2EAA8D;AAmB5D,4CAAgB;AAlBlB,4EAA+D;AAmB7D,8CAAiB;AAlBnB,oEAAuD;AAmBrD,sCAAa;AAlBf,0EAA6D;AAmB3D,4CAAgB;AAlBlB,4DAA+C;AAmB7C,8BAAS;AAlBX,iDAAoC;AAmBlC,8BAAS"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAwC;AAwBtC,8BAAS;AAvBX,gEAAmD;AAwBjD,kCAAW;AAvBb,4DAA+C;AAwB7C,8BAAS;AAvBX,4DAA+C;AAwB7C,oCAAY;AAvBd,kEAAqD;AAwBnD,oCAAY;AAvBd,oEAAuD;AAwBrD,sCAAa;AAvBf,0DAA6C;AAwB3C,4BAAQ;AAvBV,6EAAgE;AAwB9D,8CAAiB;AAvBnB,2EAA8D;AAwB5D,4CAAgB;AAvBlB,8DAAiD;AAwB/C,gCAAU;AAvBZ,sEAAyD;AAwBvD,wCAAc;AAvBhB,2EAA8D;AAwB5D,4CAAgB;AAvBlB,4EAA+D;AAwB7D,8CAAiB;AAvBnB,oEAAuD;AAwBrD,sCAAa;AAvBf,0EAA6D;AAwB3D,4CAAgB;AAvBlB,sEAAyD;AAwBvD,wCAAc;AAvBhB,sEAAyD;AAwBvD,wCAAc;AAvBhB,4DAA+C;AAwB7C,8BAAS;AAvBX,uEAA0D;AAwBxD,wCAAc;AAvBhB,sFAAyE;AAwBvE,sDAAqB;AAvBvB,iDAAoC;AAwBlC,8BAAS;AAvBX,gEAAmD;AAwBjD,wCAAc"}

package/dist/cjs/page-revalidate/api-route.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `POST /api/tq-revalidate`
+ *
+ * Re-runs `getStaticProps` for each given path, so a row an admin just created,
+ * edited or deleted reaches the public URL immediately instead of at the end of
+ * the page's ISR window. `res.revalidate` is a Pages-Router API-route method, so
+ * this route is the only place in a generated project that can do it — which is
+ * why the workflow node calls it over HTTP rather than doing the work itself.
+ *
+ * Reuses the cache secret rather than minting a second one: both endpoints
+ * authorise the same actor (the app's own server, mid-workflow) and a project
+ * already has this secret provisioned.
+ *
+ * Fails CLOSED when no secret is configured, for the same reason the cache
+ * route does: an unauthenticated rebuild endpoint on every published site is a
+ * free way to make a project re-render its pages on demand.
+ *
+ * Each path is rebuilt inside its OWN try/catch. `res.revalidate` throws for a
+ * path that was never generated (a deleted row's URL, a slug that no longer
+ * resolves), and one such path must not cost the caller the rebuilds it asked
+ * for alongside it — so failures are collected and reported, never thrown.
+ */
+export declare const generatePageRevalidateRoute: () => string;
+//# sourceMappingURL=api-route.d.ts.map

package/dist/cjs/page-revalidate/api-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-route.d.ts","sourceRoot":"","sources":["../../../src/page-revalidate/api-route.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B,QAAO,MAmD9C,CAAA"}

package/dist/cjs/page-revalidate/api-route.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePageRevalidateRoute = void 0;
+var constants_1 = require("../cache/constants");
+var constants_2 = require("./constants");
+/**
+ * `POST /api/tq-revalidate`
+ *
+ * Re-runs `getStaticProps` for each given path, so a row an admin just created,
+ * edited or deleted reaches the public URL immediately instead of at the end of
+ * the page's ISR window. `res.revalidate` is a Pages-Router API-route method, so
+ * this route is the only place in a generated project that can do it — which is
+ * why the workflow node calls it over HTTP rather than doing the work itself.
+ *
+ * Reuses the cache secret rather than minting a second one: both endpoints
+ * authorise the same actor (the app's own server, mid-workflow) and a project
+ * already has this secret provisioned.
+ *
+ * Fails CLOSED when no secret is configured, for the same reason the cache
+ * route does: an unauthenticated rebuild endpoint on every published site is a
+ * free way to make a project re-render its pages on demand.
+ *
+ * Each path is rebuilt inside its OWN try/catch. `res.revalidate` throws for a
+ * path that was never generated (a deleted row's URL, a slug that no longer
+ * resolves), and one such path must not cost the caller the rebuilds it asked
+ * for alongside it — so failures are collected and reported, never thrown.
+ */
+var generatePageRevalidateRoute = function () { return "import crypto from 'crypto'\n\nconst MAX_PATHS = ".concat(constants_2.REVALIDATE_MAX_PATHS, "\n\nfunction isAuthorized(req) {\n  const secret = process.env.").concat(constants_1.CACHE_SECRET_ENV, "\n  const provided = req.headers['x-tq-cache-secret']\n  if (!secret || typeof provided !== 'string') {\n    return false\n  }\n  const a = Buffer.from(provided)\n  const b = Buffer.from(secret)\n  // timingSafeEqual throws on a length mismatch, so the length is compared first.\n  if (a.length !== b.length) {\n    return false\n  }\n  return crypto.timingSafeEqual(a, b)\n}\n\nexport default async function handler(req, res) {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n\n  if (!isAuthorized(req)) {\n    return res.status(401).json({ error: 'Unauthorized' })\n  }\n\n  const body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body || {}\n  const paths = (Array.isArray(body.paths) ? body.paths : [])\n    .filter((path) => typeof path === 'string' && path.trim())\n    .map((path) => (path.trim().charAt(0) === '/' ? path.trim() : '/' + path.trim()))\n    .slice(0, MAX_PATHS)\n\n  const revalidated = []\n  const failed = []\n\n  for (const path of paths) {\n    try {\n      await res.revalidate(path)\n      revalidated.push(path)\n    } catch (error) {\n      // A path that was never statically generated throws here. That is the\n      // normal case for a page whose row was just deleted, so it is reported\n      // rather than raised.\n      failed.push(path)\n    }\n  }\n\n  return res.status(200).json({ ok: true, revalidated, failed })\n}\n"); };
+exports.generatePageRevalidateRoute = generatePageRevalidateRoute;
+//# sourceMappingURL=api-route.js.map

package/dist/cjs/page-revalidate/api-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-route.js","sourceRoot":"","sources":["../../../src/page-revalidate/api-route.ts"],"names":[],"mappings":";;;AAAA,gDAAqD;AACrD,yCAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,IAAM,2BAA2B,GAAG,cAAc,OAAA,2DAErC,gCAAoB,4EAGT,4BAAgB,45CA8C9C,EAnDwD,CAmDxD,CAAA;AAnDY,QAAA,2BAA2B,+BAmDvC"}

package/dist/cjs/page-revalidate/constants.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared constants for the generated page-revalidation route.
+ *
+ * Lives in `teleport-shared` because two generators agree on them — the Next
+ * project plugin that emits the route and the `page-revalidate` workflow node
+ * that calls it — and a mismatch would be a 404 the node reports only as a
+ * warning, so nothing would ever fail loudly.
+ */
+/** Emitted API route, relative to the generated project root. */
+export declare const REVALIDATE_API_DIR: string[];
+export declare const REVALIDATE_ROUTE = "tq-revalidate";
+/** The path the workflow node POSTs to. Kept beside the emitted route's name. */
+export declare const REVALIDATE_ROUTE_PATH = "/api/tq-revalidate";
+/**
+ * One request may not rebuild more than this many pages.
+ *
+ * Each path re-runs `getStaticProps`, so an unbounded list is an unbounded
+ * serverless invocation triggered by whatever the workflow put in the config.
+ * Every wiring the platform generates asks for one or two paths.
+ */
+export declare const REVALIDATE_MAX_PATHS = 20;
+//# sourceMappingURL=constants.d.ts.map

package/dist/cjs/page-revalidate/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/page-revalidate/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,UAAmB,CAAA;AAClD,eAAO,MAAM,gBAAgB,kBAAkB,CAAA;AAE/C,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,uBAAuB,CAAA;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA"}

package/dist/cjs/page-revalidate/constants.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Shared constants for the generated page-revalidation route.
+ *
+ * Lives in `teleport-shared` because two generators agree on them — the Next
+ * project plugin that emits the route and the `page-revalidate` workflow node
+ * that calls it — and a mismatch would be a 404 the node reports only as a
+ * warning, so nothing would ever fail loudly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REVALIDATE_MAX_PATHS = exports.REVALIDATE_ROUTE_PATH = exports.REVALIDATE_ROUTE = exports.REVALIDATE_API_DIR = void 0;
+/** Emitted API route, relative to the generated project root. */
+exports.REVALIDATE_API_DIR = ['pages', 'api'];
+exports.REVALIDATE_ROUTE = 'tq-revalidate';
+/** The path the workflow node POSTs to. Kept beside the emitted route's name. */
+exports.REVALIDATE_ROUTE_PATH = '/api/tq-revalidate';
+/**
+ * One request may not rebuild more than this many pages.
+ *
+ * Each path re-runs `getStaticProps`, so an unbounded list is an unbounded
+ * serverless invocation triggered by whatever the workflow put in the config.
+ * Every wiring the platform generates asks for one or two paths.
+ */
+exports.REVALIDATE_MAX_PATHS = 20;
+//# sourceMappingURL=constants.js.map

package/dist/cjs/page-revalidate/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/page-revalidate/constants.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,iEAAiE;AACpD,QAAA,kBAAkB,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACrC,QAAA,gBAAgB,GAAG,eAAe,CAAA;AAE/C,iFAAiF;AACpE,QAAA,qBAAqB,GAAG,oBAAoB,CAAA;AAEzD;;;;;;GAMG;AACU,QAAA,oBAAoB,GAAG,EAAE,CAAA"}

package/dist/cjs/page-revalidate/index.d.ts

@@ -0,0 +1,3 @@
+export * from './constants';
+export * from './api-route';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/page-revalidate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/page-revalidate/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/cjs/page-revalidate/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants"), exports);
+__exportStar(require("./api-route"), exports);
+//# sourceMappingURL=index.js.map