@useinsider/guido 3.12.0-beta.60e4757 → 3.12.0-beta.66af948

package/README.md

@@ -161,6 +161,7 @@ const config: GuidoConfigInput = {
     modulesDisabled?: boolean,    // Default: false - Disable modules panel
     liquidSyntax?: boolean,       // Default: false - Enable Liquid template syntax
     autosave?: boolean,           // Default: false - Show the Auto Save toggle in the header. See wiki/AUTOSAVE.md.
+    allowlistEnabled?: boolean,   // Default: false - Pre-save domain-allowlist check (opt-in). Guido self-serves the block toaster (role lookup, deep-link, copy from window.trans).
   },
 
   // Optional: Callbacks

package/dist/@types/config/schemas.js

@@ -1,11 +1,11 @@
 import { ModuleFolderDefaults as y } from "../../enums/defaults.js";
-import { object as a, number as n, optional as e, string as t, picklist as l, pipe as p, minLength as b, custom as f, boolean as o, array as c, record as k, fallback as C, literal as i, looseObject as g, variant as R, union as h, unknown as s, lazy as T } from "../../node_modules/valibot/dist/index.js";
+import { object as a, number as n, optional as e, string as t, picklist as r, pipe as p, minLength as b, custom as h, boolean as o, array as c, record as k, fallback as C, literal as i, looseObject as g, variant as R, union as f, unknown as s, lazy as T } from "../../node_modules/valibot/dist/index.js";
 const d = {
   /** Promotional/marketing emails */
   PROMOTIONAL: 1,
   /** Transactional/system emails */
   TRANSACTIONAL: 2
-}, r = {
+}, l = {
   /** Standard email campaigns */
   EMAIL: 60,
   /** Architect journey builder */
@@ -38,16 +38,16 @@ const d = {
   ),
   /** Product type identifier */
   productType: e(
-    l([
-      r.EMAIL,
-      r.ARCHITECT,
-      r.UNSUBSCRIBE_PAGES
+    r([
+      l.EMAIL,
+      l.ARCHITECT,
+      l.UNSUBSCRIBE_PAGES
     ]),
-    r.EMAIL
+    l.EMAIL
   ),
   /** Message type (promotional or transactional) */
   messageType: e(
-    l([d.PROMOTIONAL, d.TRANSACTIONAL]),
+    r([d.PROMOTIONAL, d.TRANSACTIONAL]),
     d.PROMOTIONAL
   ),
   /** Display name for the current user */
@@ -76,14 +76,14 @@ const d = {
   children: e(c(S)),
   // eslint-disable-next-line camelcase -- backend field name
   select_items: e(c(S))
-})), P = k(
+})), E = k(
   t(),
   C(c(S), [])
-), D = g({
+), P = g({
   /** Block ID (matches the dictionary key and the legacy HTML element id) */
   id: e(n()),
   /** Decimal places for price display (legacy data may use string or number) */
-  decimalCount: e(h([t(), n()])),
+  decimalCount: e(f([t(), n()])),
   /** Pinned product IDs (empty array when filter-driven) */
   productIds: e(c(s())),
   /** Whether the block requested live products at send time */
@@ -117,14 +117,14 @@ const d = {
   /** Block type marker used by some legacy variants */
   blockType: e(t()),
   /** Size variant marker (legacy data may use string or number) */
-  size: e(h([t(), n()])),
+  size: e(f([t(), n()])),
   /** Vertical responsiveness flag (legacy size=1 variants) */
   verticalResponsiveness: e(o()),
   /** Legacy "Move to next line" price placement toggle (cardPricePlacement.js) */
   isPriceMovedToNextLine: e(o()),
   /** Legacy "Hide if same as discounted" / delete-price-for-zero-sale toggle */
   isPriceDeletedForZeroSale: e(o())
-}), E = a({
+}), D = a({
   /**
    * Legacy recommendation block configs keyed by block ID.
    * Pass this when loading a template authored with the v1
@@ -132,7 +132,7 @@ const d = {
    * strategy, currency, locale, and layout data.
    */
   recommendationConfigs: e(
-    k(t(), D),
+    k(t(), P),
     {}
   )
 }), M = a({
@@ -151,7 +151,7 @@ const d = {
    * (first) partner's leaf attributes into the label→token map that repairs
    * label-form placeholders (`{{ Phone Number }}`) in dropped saved modules.
    */
-  dynamicContentList: e(P, {}),
+  dynamicContentList: e(E, {}),
   /** Valid custom field attribute names from the partner's categorized fields */
   customFieldAttributes: e(c(t()), []),
   /** Selected unsubscribe page IDs */
@@ -159,7 +159,7 @@ const d = {
   /** Force recreate template in Stripo storage (use true when updating externally modified templates) */
   forceRecreate: e(o(), !1),
   /** Migration-only inputs (legacy block configs) */
-  migration: e(E, {})
+  migration: e(D, {})
 }), N = a({
   /** Sender display name */
   senderName: e(t(), ""),
@@ -201,8 +201,10 @@ const d = {
   /** Enable Liquid template syntax */
   liquidSyntax: e(o(), !1),
   /** Enable autosave (3-min interval + tab-hide). User toggles on/off from the header. */
-  autosave: e(o(), !1)
-}), U = l([
+  autosave: e(o(), !1),
+  /** Enable pre-save domain-allowlist validation (opt-in; Guido self-serves the block toaster) */
+  allowlistEnabled: e(o(), !1)
+}), U = r([
   "amp-accordion",
   "amp-carousel",
   "amp-form-controls",
@@ -216,7 +218,7 @@ const d = {
   "text-block",
   "timer-block",
   "video-block"
-]), B = l([
+]), B = r([
   "dynamic-content",
   "checkbox-block",
   "radio-button-block",
@@ -269,7 +271,7 @@ const d = {
   ...m.entries,
   type: i("custom"),
   /** Custom processor function */
-  processor: f(
+  processor: h(
     (u) => typeof u == "function",
     "processor must be a function"
   )
@@ -289,7 +291,7 @@ const d = {
    * Return false to cancel the save operation.
    */
   externalValidation: e(
-    f(
+    h(
       (u) => typeof u == "function",
       "externalValidation must be a function"
     )
@@ -324,7 +326,7 @@ export {
   B as CustomBlockTypeSchema,
   q as CustomRuleSchema,
   U as DefaultBlockTypeSchema,
-  P as DynamicContentListSchema,
+  E as DynamicContentListSchema,
   S as DynamicContentNodeSchema,
   v as DynamicContentSchema,
   O as EditorSchema,
@@ -333,14 +335,14 @@ export {
   F as FeaturesSchema,
   K as GuidoConfigSchema,
   A as IdentitySchema,
-  D as LegacyRecommendationConfigSchema,
+  P as LegacyRecommendationConfigSchema,
   d as MessageType,
   L as PartnerSchema,
-  r as ProductType,
+  l as ProductType,
   _ as RegexRuleSchema,
   j as RemoveRuleSchema,
   H as ReplaceRuleSchema,
-  E as TemplateMigrationSchema,
+  D as TemplateMigrationSchema,
   M as TemplateSchema,
   x as UISchema
 };

package/dist/components/organisms/email-preview/desktop-preview/DesktopPreview.vue.js

@@ -15,7 +15,7 @@ var a = function() {
   i,
   !1,
   null,
-  "06afaecb"
+  "cf946232"
 );
 const f = n.exports;
 export {

package/dist/components/organisms/email-preview/desktop-preview/DesktopPreview.vue2.js

@@ -1,24 +1,24 @@
-import { defineComponent as u, ref as a, onMounted as p, onBeforeUnmount as l, nextTick as v } from "vue";
-import { usePreviewInteractionGuard as d } from "../../../../composables/usePreviewInteractionGuard.js";
+import { defineComponent as u, ref as a, onMounted as p, onBeforeUnmount as l, nextTick as d } from "vue";
+import { usePreviewInteractionGuard as v } from "../../../../composables/usePreviewInteractionGuard.js";
 import { useTranslations as _ } from "../../../../composables/useTranslations.js";
 import { usePreviewStore as w } from "../../../../stores/preview.js";
 import I from "./DesktopBrowserHeader.vue.js";
 const C = /* @__PURE__ */ u({
   __name: "DesktopPreview",
-  setup(k) {
-    const i = _(), { blockPreviewInteractions: t } = d(), o = a(), n = a(!1), c = w();
+  setup(P) {
+    const i = _(), { guardPreviewInteractions: t } = v(), o = a(), r = a(!1), c = w();
     let e = null;
     const f = (m) => {
       t(m.target);
-    }, r = () => {
+    }, n = () => {
       o.value && (e = new ResizeObserver(() => {
-      }), e.observe(o.value), v(() => {
-        n.value = !0;
+      }), e.observe(o.value), d(() => {
+        r.value = !0;
       }));
     }, s = () => {
       e == null || e.disconnect();
     };
-    return p(r), l(s), { __sfc: !0, trans: i, blockPreviewInteractions: t, containerRef: o, isContainerReady: n, previewStore: c, resizeObserver: e, onIframeLoad: f, initIframe: r, cleanIframe: s, DesktopBrowserHeader: I };
+    return p(n), l(s), { __sfc: !0, trans: i, guardPreviewInteractions: t, containerRef: o, isContainerReady: r, previewStore: c, resizeObserver: e, onIframeLoad: f, initIframe: n, cleanIframe: s, DesktopBrowserHeader: I };
   }
 });
 export {

package/dist/components/organisms/email-preview/mobile-preview/ContentView.vue.js

@@ -1,20 +1,20 @@
 import e from "./ContentView.vue2.js";
 /* empty css                 */
 import n from "../../../../_virtual/_plugin-vue2_normalizer.js";
-var c = function() {
+var o = function() {
   var t = this, s = t._self._c, a = t._self._setupProxy;
   return s("div", { staticClass: "w-1 h-1 b-c-4 d-f f-d-c" }, [s("div", { staticClass: "d-f j-c-s-b a-i-c p-2 h-6-s" }, [s("div", { staticClass: "d-f a-i-c cur-p", on: { click: function(l) {
     return t.$emit("back-to-inbox");
   } } }, [s(a.InIcons, { staticClass: "f-s-3 i-c-7", attrs: { name: "line-chevron-left" } }), s("span", { staticClass: "ml-2 f-s-1 f-w-400 l-h-1 t-c-7" }, [t._v(t._s(a.trans("newsletter.inbox")))])], 1), s("div", { staticClass: "d-f a-i-c" }, [s(a.InIcons, { staticClass: "i-c-52", attrs: { name: "line-chevron-down" } }), s(a.InIcons, { staticClass: "ml-1 i-c-52", attrs: { name: "line-chevron-up" } })], 1)]), s("div", { staticClass: "iframe-wrapper f-g-1 o-h" }, [s("iframe", { ref: "iframeRef", staticClass: "iframe-scaled d-b b-c-4 bor-s-n", attrs: { sandbox: "allow-same-origin allow-popups allow-forms allow-scripts allow-popups-to-escape-sandbox", srcdoc: a.previewStore.previewHtml }, on: { load: a.onLoad } })])]);
-}, o = [], i = /* @__PURE__ */ n(
+}, i = [], r = /* @__PURE__ */ n(
   e,
-  c,
   o,
+  i,
   !1,
   null,
-  "cbafc185"
+  "f255b2bb"
 );
-const d = i.exports;
+const d = r.exports;
 export {
   d as default
 };

package/dist/components/organisms/email-preview/mobile-preview/ContentView.vue2.js

@@ -1,24 +1,24 @@
-import { defineComponent as m, ref as a } from "vue";
+import { defineComponent as c, ref as a } from "vue";
 import { usePreviewInteractionGuard as f } from "../../../../composables/usePreviewInteractionGuard.js";
 import { useResponsivePreview as p } from "../../../../composables/useResponsivePreview.js";
 import { useTranslations as u } from "../../../../composables/useTranslations.js";
 import { usePreviewStore as v } from "../../../../stores/preview.js";
-import { InIcons as P } from "@useinsider/design-system-vue";
-const g = /* @__PURE__ */ m({
+import { InIcons as d } from "@useinsider/design-system-vue";
+const b = /* @__PURE__ */ c({
   __name: "ContentView",
   emits: ["back-to-inbox"],
-  setup(_) {
-    const c = u(), t = v(), r = a(), { setupResponsivePreview: n } = p(), { blockPreviewInteractions: s } = f(), i = (e) => {
+  setup(P) {
+    const m = u(), r = v(), t = a(), { setupResponsivePreview: n } = p(), { guardPreviewInteractions: s } = f(), i = (e) => {
       ["transform", "transform-origin", "height"].forEach((o) => {
         e.documentElement.style.removeProperty(o);
       });
     };
-    return { __sfc: !0, trans: c, previewStore: t, iframeRef: r, setupResponsivePreview: n, blockPreviewInteractions: s, clearAMPTransforms: i, onLoad: () => {
-      const e = r.value, o = e == null ? void 0 : e.contentDocument;
-      o && (n(e), s(e), t.isAMPResponsive && i(o));
-    }, InIcons: P };
+    return { __sfc: !0, trans: m, previewStore: r, iframeRef: t, setupResponsivePreview: n, guardPreviewInteractions: s, clearAMPTransforms: i, onLoad: () => {
+      const e = t.value, o = e == null ? void 0 : e.contentDocument;
+      o && (n(e), s(e), r.isAMPResponsive && i(o));
+    }, InIcons: d };
   }
 });
 export {
-  g as default
+  b as default
 };

package/dist/composables/useAllowlist.js

@@ -0,0 +1,50 @@
+import { useAllowlistApi as A } from "../services/allowlistApi.js";
+import { base64EncodeWithSpecialChars as p } from "../utils/base64.js";
+import { useTranslations as h } from "./useTranslations.js";
+import { useUserRole as D } from "./useUserRole.js";
+const f = /(?:https?:\/\/|www\.)[^\s"'<>()]+/gi, E = /&quot;\/\//gi, i = {
+  MANAGE: "journey-builder.domain-allowlist-warning",
+  NON_MANAGE: "settings.allow-list-warning-not-admin-architect",
+  ADD_BUTTON: "settings.allow-list-warning-add-button"
+}, w = /* @__PURE__ */ new Set(), O = (n) => `/settings?openAddModal=true&type=domain&values=${p(n)}#security`, M = () => {
+  const { checkDomain: n } = A(), { getIsManageUser: l } = D(), a = h(), d = (t, s) => {
+    const c = `${t || ""} ${s || ""}`.replace(E, "https://").match(f) || [], e = /* @__PURE__ */ new Set();
+    return c.forEach((r) => {
+      const g = /^https?:\/\//i.test(r) ? r : `https://${r}`;
+      try {
+        const { hostname: u } = new URL(g);
+        u && e.add(u.replace(/^www\./i, "").toLowerCase());
+      } catch {
+      }
+    }), [...e];
+  }, m = async (t) => {
+    if (w.has(t))
+      return !0;
+    try {
+      const s = await n(t);
+      return s && w.add(t), s;
+    } catch (s) {
+      return console.error("[GUIDO_ALLOWLIST] isDomainAllowlisted failed", t, s), !0;
+    }
+  };
+  return { getBlockedDomains: async (t, s) => {
+    try {
+      const o = d(t, s);
+      return o.length ? (await Promise.all(
+        o.map(async (e) => ({ domain: e, allowlisted: await m(e) }))
+      )).filter((e) => !e.allowlisted).map((e) => e.domain) : [];
+    } catch (o) {
+      return console.error("[GUIDO_ALLOWLIST] getBlockedDomains failed", o), [];
+    }
+  }, resolveToast: async (t) => await l() ? {
+    message: a(i.MANAGE),
+    actionButton: {
+      text: a(i.ADD_BUTTON),
+      onClick: () => window.open(O(t.join(",")), "_blank")
+    }
+  } : { message: a(i.NON_MANAGE) } };
+};
+export {
+  O as buildAllowlistSettingsUrl,
+  M as useAllowlist
+};

package/dist/composables/usePreviewInteractionGuard.js

@@ -1,17 +1,42 @@
-const o = ["click", "auxclick", "submit"], c = (t) => {
-  t.preventDefault(), t.stopPropagation();
-}, a = () => ({ blockPreviewInteractions: (r) => {
+import { URLS as o, MERGE_TAGS as a } from "../enums/unsubscribe.js";
+import { UNSUBSCRIBE_LINK_SELECTOR as i } from "../extensions/Blocks/Unsubscribe/utils/constants.js";
+import { BASE_SAFE_URL_SCHEMES as u } from "../utils/urlSchemes.js";
+const E = ["click", "auxclick"], d = [
+  ...Object.values(a),
+  o.UNSUBSCRIBE_URL,
+  o.PREFERENCES_URL
+], l = (e) => {
+  if (e.matches(i))
+    return !0;
+  const r = e.getAttribute("href") ?? "";
+  return d.some((t) => r.includes(t));
+}, S = [...u, "tel:", "sms:"], f = (e) => {
+  const r = (e.getAttribute("href") ?? "").trim();
+  return r === "" || r.startsWith("#") || r.startsWith("{{") ? !1 : S.includes(e.protocol);
+}, m = (e) => {
+  var t, n;
+  const r = (n = (t = e.target) == null ? void 0 : t.closest) == null ? void 0 : n.call(t, "a");
+  if (r) {
+    if (l(r) || !f(r)) {
+      e.preventDefault(), e.stopPropagation();
+      return;
+    }
+    r.setAttribute("target", "_blank"), r.setAttribute("rel", "noopener noreferrer");
+  }
+}, R = (e) => {
+  e.preventDefault(), e.stopPropagation();
+}, s = /* @__PURE__ */ new WeakSet(), c = "guidoPreviewGuarded", g = () => ({ guardPreviewInteractions: (r) => {
   try {
-    const e = r.contentDocument;
-    if (!e)
+    const t = r.contentDocument;
+    if (!t || s.has(t))
       return;
-    o.forEach((n) => {
-      e.addEventListener(n, c, !0);
-    });
-  } catch (e) {
-    console.warn("[usePreviewInteractionGuard] Could not guard preview iframe:", e);
+    delete t.documentElement.dataset[c], E.forEach((n) => {
+      t.addEventListener(n, m, !0);
+    }), t.addEventListener("submit", R, !0), s.add(t), t.documentElement.dataset[c] = "true";
+  } catch (t) {
+    console.warn("[usePreviewInteractionGuard] Could not guard preview iframe:", t);
   }
 } });
 export {
-  a as usePreviewInteractionGuard
+  g as usePreviewInteractionGuard
 };

package/dist/composables/useRecommendationPreview.js

@@ -1,111 +1,112 @@
-import { BLOCK_ROOT_SELECTOR as S, CURRENCY_ATTR as p, CONTAINER_SELECTOR as O } from "../extensions/Blocks/Recommendation/constants/selectors.js";
-import { useRecommendationExtensionStore as h } from "../extensions/Blocks/Recommendation/store/recommendation.js";
-import { formatPrice as E } from "../extensions/Blocks/Recommendation/utils/priceFormatter.js";
-const f = `${S}[recommendation-id]`, C = ".product-old-price", R = /\{\{(?:reco_)?(\d+_\d+_[a-zA-Z0-9_.]+)\}\}/g, T = new RegExp(
+import { BLOCK_ROOT_SELECTOR as f, CURRENCY_ATTR as A, CONTAINER_SELECTOR as O } from "../extensions/Blocks/Recommendation/constants/selectors.js";
+import { useRecommendationExtensionStore as C } from "../extensions/Blocks/Recommendation/store/recommendation.js";
+import { formatPrice as _ } from "../extensions/Blocks/Recommendation/utils/priceFormatter.js";
+import { BASE_SAFE_URL_SCHEMES as R } from "../utils/urlSchemes.js";
+const S = `${f}[recommendation-id]`, h = ".product-old-price", T = /\{\{(?:reco_)?(\d+_\d+_[a-zA-Z0-9_.]+)\}\}/g, b = new RegExp(
   "\\{%\\s*if\\s+([\\s\\S]+?)\\s*%\\}([\\s\\S]*?)(?:\\{%\\s*else\\s*%\\}([\\s\\S]*?))?\\{%\\s*endif\\s*%\\}",
   "g"
 );
-function b(e) {
+function L(e) {
   return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
-function _(e) {
-  var s;
-  const n = (s = e.replace(/[\u0000-\u0020]+/g, "").toLowerCase().match(/^([a-z][a-z0-9+.-]*):/)) == null ? void 0 : s[1];
-  return n && n !== "http" && n !== "https" && n !== "mailto" ? "" : e;
+function g(e) {
+  var c;
+  const i = (c = e.replace(/[\u0000-\u0020]+/g, "").toLowerCase().match(/^([a-z][a-z0-9+.-]*):/)) == null ? void 0 : c[1];
+  return i && !R.includes(`${i}:`) ? "" : e;
 }
 function N(e) {
-  const t = e.getAttribute(p.CURRENCY) || "USD", n = e.getAttribute(p.DECIMAL_SEPARATOR) || ".", s = e.getAttribute(p.THOUSAND_SEPARATOR) || ",";
+  const t = e.getAttribute(A.CURRENCY) || "USD", i = e.getAttribute(A.DECIMAL_SEPARATOR) || ".", c = e.getAttribute(A.THOUSAND_SEPARATOR) || ",";
   return {
     code: t,
-    symbol: e.getAttribute(p.SYMBOL) || t,
-    alignment: e.getAttribute(p.ALIGNMENT) === "0" ? "before" : "after",
-    decimalCount: parseInt(e.getAttribute(p.DECIMAL_COUNT) || "2") || 2,
-    decimalSeparator: n,
-    thousandSeparator: s
+    symbol: e.getAttribute(A.SYMBOL) || t,
+    alignment: e.getAttribute(A.ALIGNMENT) === "0" ? "before" : "after",
+    decimalCount: parseInt(e.getAttribute(A.DECIMAL_COUNT) || "2") || 2,
+    decimalSeparator: i,
+    thousandSeparator: c
   };
 }
-function g(e, t) {
+function E(e, t) {
   return (e == null ? void 0 : e[t]) ?? Object.values(e ?? {})[0] ?? 0;
 }
-function L(e, t) {
-  const n = g(e.original_price, t), s = g(e.price, t), o = n > 0 ? Math.round((n - s) / n * 100) : 0;
-  return o > 0 ? `${o}%` : "0%";
+function $(e, t) {
+  const i = E(e.original_price, t), c = E(e.price, t), n = i > 0 ? Math.round((i - c) / i * 100) : 0;
+  return n > 0 ? `${n}%` : "0%";
 }
-function P(e, t, n, s, o, a) {
-  s.forEach((i, c) => {
-    const r = (m) => `${n}_${c}_${m}`, u = E({ price: g(i.price, o.code), currency: o }), l = E({ price: g(i.original_price, o.code), currency: o }), d = L(i, o.code);
-    e.set(r("name"), i.name ?? ""), e.set(r("image_url"), _(i.image_url ?? "")), e.set(r("url"), _(i.url ?? "")), e.set(r("item_id"), i.item_id ?? ""), e.set(r("currency"), ""), e.set(r("price"), u), e.set(r("original_price"), l), e.set(r("discount"), d), e.set(r("omnibus_price"), l), e.set(r("omnibus_discount"), d), a && u === l && t.add(`${n}_${c}`), Object.entries(i.product_attributes ?? {}).forEach(([m, A]) => {
-      e.set(r(`product_attribute.${m}`), String(A)), e.set(r(m), String(A));
+function P(e, t, i, c, n, a) {
+  c.forEach((o, s) => {
+    const r = (m) => `${i}_${s}_${m}`, u = _({ price: E(o.price, n.code), currency: n }), l = _({ price: E(o.original_price, n.code), currency: n }), d = $(o, n.code);
+    e.set(r("name"), o.name ?? ""), e.set(r("image_url"), g(o.image_url ?? "")), e.set(r("url"), g(o.url ?? "")), e.set(r("item_id"), o.item_id ?? ""), e.set(r("currency"), ""), e.set(r("price"), u), e.set(r("original_price"), l), e.set(r("discount"), d), e.set(r("omnibus_price"), l), e.set(r("omnibus_discount"), d), a && u === l && t.add(`${i}_${s}`), Object.entries(o.product_attributes ?? {}).forEach(([m, p]) => {
+      e.set(r(`product_attribute.${m}`), String(p)), e.set(r(m), String(p));
     });
   });
 }
-function $(e, t) {
-  const n = e.match(/^(.+?)\s*(!=|==)\s*"([^"]*)"$/);
-  if (!n)
+function z(e, t) {
+  const i = e.match(/^(.+?)\s*(!=|==)\s*"([^"]*)"$/);
+  if (!i)
     return !0;
-  const [, s, o, a] = n, i = t.get(s.trim()) ?? "";
-  return o === "!=" ? i !== a : i === a;
+  const [, c, n, a] = i, o = t.get(c.trim()) ?? "";
+  return n === "!=" ? o !== a : o === a;
 }
-function z(e, t) {
+function w(e, t) {
   return e.replace(
-    T,
-    (n, s, o, a) => s.split(/\s+and\s+/).every((c) => $(c.trim(), t)) ? o : a ?? ""
+    b,
+    (i, c, n, a) => c.split(/\s+and\s+/).every((s) => z(s.trim(), t)) ? n : a ?? ""
   );
 }
-function w(e) {
+function D(e) {
   let t = e;
   for (; t.children.length === 1; )
     [t] = t.children;
   return t;
 }
-function D(e, t) {
-  var i;
+function I(e, t) {
+  var o;
   if (!t.size)
     return e;
-  const n = e.replaceAll("{%", "<!--{%").replaceAll("%}", "%}-->"), s = new DOMParser().parseFromString(n, "text/html");
-  s.querySelectorAll(f).forEach((c) => {
-    const r = Number(c.getAttribute("recommendation-id"));
+  const i = e.replaceAll("{%", "<!--{%").replaceAll("%}", "%}-->"), c = new DOMParser().parseFromString(i, "text/html");
+  c.querySelectorAll(S).forEach((s) => {
+    const r = Number(s.getAttribute("recommendation-id"));
     if (!Number.isFinite(r))
       return;
-    const u = c.querySelectorAll(O);
-    (u.length ? Array.from(u) : [c]).forEach((d) => {
-      d.querySelectorAll(C).forEach((m, A) => {
-        t.has(`${r}_${A}`) && (w(m).textContent = "");
+    const u = s.querySelectorAll(O);
+    (u.length ? Array.from(u) : [s]).forEach((d) => {
+      d.querySelectorAll(h).forEach((m, p) => {
+        t.has(`${r}_${p}`) && (D(m).textContent = "");
       });
     });
   });
-  const o = (i = e.match(/<!DOCTYPE[^>]*>/i)) == null ? void 0 : i[0];
-  return ((o ? `${o}
-` : "") + s.documentElement.outerHTML).replaceAll("<!--{%", "{%").replaceAll("%}-->", "%}").replaceAll("&lt;!--{%", "{%").replaceAll("%}--&gt;", "%}");
+  const n = (o = e.match(/<!DOCTYPE[^>]*>/i)) == null ? void 0 : o[0];
+  return ((n ? `${n}
+` : "") + c.documentElement.outerHTML).replaceAll("<!--{%", "{%").replaceAll("%}-->", "%}").replaceAll("&lt;!--{%", "{%").replaceAll("%}--&gt;", "%}");
 }
-function I(e) {
+function y(e) {
   if (!e || !e.includes("recommendation-block-v2"))
     return e;
-  const t = h(), n = new DOMParser().parseFromString(e, "text/html"), s = Array.from(n.querySelectorAll(f)), o = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set();
-  if (s.forEach((c) => {
+  const t = C(), i = new DOMParser().parseFromString(e, "text/html"), c = Array.from(i.querySelectorAll(S)), n = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set();
+  if (c.forEach((s) => {
     var l;
-    const r = Number(c.getAttribute("recommendation-id"));
+    const r = Number(s.getAttribute("recommendation-id"));
     if (!Number.isFinite(r))
       return;
     const u = ((l = t.blockStates[r]) == null ? void 0 : l.recommendationProducts) ?? [];
     u.length && P(
-      o,
+      n,
       a,
       r,
       u,
-      N(c),
-      c.getAttribute("hide-price") === "true"
+      N(s),
+      s.getAttribute("hide-price") === "true"
     );
-  }), !o.size)
+  }), !n.size)
     return e;
-  let i = D(e, a);
-  return i = i.replace(
-    R,
-    (c, r) => o.has(r) ? b(o.get(r)) : c
-  ), i = z(i, o), i;
+  let o = I(e, a);
+  return o = o.replace(
+    T,
+    (s, r) => n.has(r) ? L(n.get(r)) : s
+  ), o = w(o, n), o;
 }
-const q = () => ({ substituteRecommendationPreview: I });
+const q = () => ({ substituteRecommendationPreview: y });
 export {
-  I as substituteRecommendationPreview,
+  y as substituteRecommendationPreview,
   q as useRecommendationPreview
 };

package/dist/composables/useSave.js

@@ -1,32 +1,51 @@
-import { useActionsApi as H } from "./useActionsApi.js";
-import { useConfig as y } from "./useConfig.js";
-import { useSaveStart as w, useSaveComplete as k } from "./useGuidoActions.js";
+import { useActionsApi as T } from "./useActionsApi.js";
+import { useConfig as k } from "./useConfig.js";
+import { useSaveStart as B, useSaveComplete as E } from "./useGuidoActions.js";
 import { useSyncModuleExtractor as q } from "./useSyncModuleExtractor.js";
-import { useStripoApi as C } from "../services/stripoApi.js";
-import { useTemplatePreparation as E } from "../utils/templatePreparation.js";
-import { useHtmlValidator as B } from "./useHtmlValidator.js";
-import { useCouponBlockValidator as L } from "./validators/useCouponBlockValidator.js";
-import { useLiquidValidator as P } from "./validators/useLiquidValidator.js";
-import { useUnsubscribeBlockValidator as U } from "./validators/useUnsubscribeBlockValidator.js";
-const K = () => {
-  const o = w(), s = k(), { validateHtml: r } = B(), { validateLiquidSyntax: l } = P(), { validateCouponBlockTags: n } = L(), { validateUnsubscribeBlockUniqueness: d, validateUnsubscribeBlockHasTemplate: c } = U(), { callbacks: i, isFeatureEnabled: u } = y(), { extractSyncModuleData: m } = q(), { setSyncModuleUnsubscriptionPages: p } = C(), { editorSave: v } = H();
-  return { save: async (f = !1, S = !1) => {
-    var a;
-    o();
-    const { prepareTemplateDetails: V } = E(), t = await V();
-    if (!n(t.compiledHtml) || !d(t.compiledHtml) || !c(t.compiledHtml))
+import { ToasterTypeOptions as C } from "../enums/toaster.js";
+import { useStripoApi as D } from "../services/stripoApi.js";
+import { useTemplatePreparation as L } from "../utils/templatePreparation.js";
+import { useAllowlist as P } from "./useAllowlist.js";
+import { useHtmlValidator as U } from "./useHtmlValidator.js";
+import { useToaster as A } from "./useToaster.js";
+import { useCouponBlockValidator as M } from "./validators/useCouponBlockValidator.js";
+import { useLiquidValidator as h } from "./validators/useLiquidValidator.js";
+import { useUnsubscribeBlockValidator as F } from "./validators/useUnsubscribeBlockValidator.js";
+const $ = () => {
+  const n = B(), l = E(), { validateHtml: c } = U(), { validateLiquidSyntax: d } = h(), { validateCouponBlockTags: m } = M(), { validateUnsubscribeBlockUniqueness: u, validateUnsubscribeBlockHasTemplate: p } = F(), { callbacks: e, isFeatureEnabled: a } = k(), { extractSyncModuleData: f } = q(), { setSyncModuleUnsubscriptionPages: v } = D(), { editorSave: S } = T(), { showToaster: b } = A(), { getBlockedDomains: w, resolveToast: V } = P();
+  return { save: async (y = !1, s = !1) => {
+    var r;
+    n();
+    const { prepareTemplateDetails: H } = L(), t = await H();
+    if (!m(t.compiledHtml) || !u(t.compiledHtml) || !p(t.compiledHtml))
       return;
-    if (u("liquidSyntax")) {
-      if (!await l(t.compiledHtml))
+    if (a("liquidSyntax")) {
+      if (!await d(t.compiledHtml))
         return;
-    } else if (!await r(t.compiledHtml, t.dynamicContentList, !0))
+    } else if (!await c(t.compiledHtml, t.dynamicContentList, !0))
       return;
-    if ((a = i.value) != null && a.externalValidation && !await i.value.externalValidation(t) || !await v())
+    if ((r = e.value) != null && r.externalValidation && !await e.value.externalValidation(t))
       return;
-    const { unsubscribePayload: b, stripoModules: x } = m(t.rawHtml);
-    return await p(b), t.modules = x, f || s({ ...t, silent: S }), t;
+    if (a("allowlistEnabled")) {
+      const i = await w(t.compiledHtml, t.css);
+      if (i.length) {
+        if (!s) {
+          const o = await V(i);
+          o != null && o.message && b({
+            type: C.Warning,
+            message: o.message,
+            actionButton: o.actionButton
+          });
+        }
+        return;
+      }
+    }
+    if (!await S())
+      return;
+    const { unsubscribePayload: g, stripoModules: x } = f(t.rawHtml);
+    return await v(g), t.modules = x, y || l({ ...t, silent: s }), t;
   } };
 };
 export {
-  K as useSave
+  $ as useSave
 };

package/dist/composables/useUserRole.js

@@ -0,0 +1,12 @@
+import { RoleEnums as t } from "../enums/roles.js";
+import { useAllowlistApi as s } from "../services/allowlistApi.js";
+let e = null, l = null;
+const c = () => {
+  const { getUserRole: n } = s();
+  return { getIsManageUser: async () => e !== null ? e : (l || (l = n().then((r) => (e = r === t.MANAGE_USERS, e)).catch((r) => (console.error("[GUIDO_ALLOWLIST] role fetch failed", r), !1)).finally(() => {
+    l = null;
+  })), l) };
+};
+export {
+  c as useUserRole
+};

package/dist/enums/roles.js

@@ -0,0 +1,4 @@
+var e = /* @__PURE__ */ ((r) => (r.MANAGE_USERS = "manage-users", r))(e || {});
+export {
+  e as RoleEnums
+};

package/dist/extensions/Blocks/Unsubscribe/utils/constants.js

@@ -5,9 +5,10 @@ const s = {
   PAGE_TYPE: "data-unsubscribe-page-type",
   PAGE_LIST: "data-unsubscribe-page-list",
   BLOCK_ID: "data-unsubscribe-block-id"
-}, c = ".unsubscribe-block-v2";
+}, c = ".unsubscribe-block-v2", u = 'a[data-unsubscribe-link="true"], a.unsubscribe-link';
 export {
   b as DATA_ATTRIBUTES,
   c as UNSUBSCRIBE_BLOCK_SELECTOR,
-  s as UNSUBSCRIBE_EVENTS
+  s as UNSUBSCRIBE_EVENTS,
+  u as UNSUBSCRIBE_LINK_SELECTOR
 };

package/dist/guido.css

@@ -1 +1 @@
-.gap-16[data-v-5553d071],.gap-16[data-v-0e1b0c54]{gap:16px}[data-v-73199fa4] .in-button-v2__wrapper{line-height:0}[data-v-22226124] .in-segments-wrapper__button_selected,[data-v-22226124] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb;color:#0010ac;border-color:#0010ac}[data-v-2cb418af] .in-progress-wrapper__progress p span:last-child{display:none!important}[data-v-2cb418af] .in-progress-description-status{display:none!important}.view-options-wrapper[data-v-195ab6d4]{position:relative;display:inline-block}.new-tag[data-v-195ab6d4]{position:absolute;top:-8px;right:-16px;z-index:10}[data-v-195ab6d4] .guido__view-option-selection-desktop svg,[data-v-195ab6d4] .guido__view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-195ab6d4] .in-segments-wrapper__button_selected,[data-v-195ab6d4] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}[data-v-195ab6d4] .in-tooltip-wrapper__icon{cursor:pointer}.editor-toolbar[data-v-173c3a40]{gap:4px}.version-history-item[data-v-ee4b9c3f]{flex-basis:200px}.version-history[data-v-fad98586]{gap:8px}.version-history__toolbar[data-v-fad98586]{gap:4px}.view-options-wrapper[data-v-d405ca59]{position:relative;display:inline-block}.new-tag[data-v-d405ca59]{position:absolute;top:-8px;right:-16px;z-index:10}[data-v-d405ca59] .guido__verion-history-view-option-selection-desktop svg,[data-v-d405ca59] .guido__verion-history-view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-d405ca59] .in-segments-wrapper__button_selected,[data-v-d405ca59] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}[data-v-d405ca59] .in-tooltip-wrapper__icon{cursor:pointer}.auto-save-toggle[data-v-2c964af4]{position:relative}.auto-save-toggle__info-box[data-v-2c964af4]{position:absolute;top:100%;left:0;z-index:10;width:280px}.editor-actions[data-v-6e711fd7]{gap:4px}.header-wrapper[data-v-d11dd577]{min-width:1000px}.guido-loading__wrapper[data-v-07c4b2d8]{height:100%;top:75px!important;bottom:0!important}.guido-editor__wrapper[data-v-50dac6de]{--ribbon-offset: 0px;position:relative;width:100%;height:calc(100vh - 128px - var(--ribbon-offset))}.guido-editor__container[data-v-50dac6de]{width:100%;height:calc(100vh - 128px - var(--ribbon-offset))}.guido-editor__no-header[data-v-50dac6de]{height:calc(100vh - 75px - var(--ribbon-offset))}[data-v-293f1c47] .in-breadcrumb-wrapper__links{cursor:pointer}.templates-wrapper[data-v-91a26acd]{gap:16px;grid-template-columns:repeat(3,1fr)}.templates-wrapper .template-wrapper[data-v-91a26acd]{cursor:pointer}.templates-wrapper .template-wrapper .template-container[data-v-91a26acd]{height:274px;padding:2px;transition:none}.templates-wrapper .template-wrapper .template-container.selected[data-v-91a26acd]{padding:1px}.templates-wrapper .template-wrapper .template-container .thumbnail[data-v-91a26acd]{object-fit:cover;transform:scale(1)}[data-v-b9a93c6e] .guido__verion-history-view-option-selection-desktop svg,[data-v-b9a93c6e] .guido__verion-history-view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-b9a93c6e] .in-segments-wrapper__button_selected,[data-v-b9a93c6e] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}.error-list[data-v-c3fd5d4b]{gap:16px}.desktop-browser-header[data-v-d86c5af5]{height:79px;min-height:79px}.desktop-browser-header__left[data-v-d86c5af5]{-webkit-user-drag:none;height:79px;width:378px}.desktop-browser-header__center[data-v-d86c5af5]{height:79px;background-repeat:repeat-x;background-size:auto 100%;background-position:left top}.desktop-browser-header__right[data-v-d86c5af5]{-webkit-user-drag:none;height:79px;width:112px}.desktop-preview[data-v-06afaecb]{min-width:602px;height:70vh;min-height:583px;border-radius:10px}.desktop-preview iframe[data-v-06afaecb]{min-height:504px}.iframe-wrapper[data-v-cbafc185]{width:258px}.iframe-scaled[data-v-cbafc185]{width:320px;height:124.0310077519%;transform:scale(.80625);transform-origin:top left}.cropped-text[data-v-eb3d05d7]{width:220px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.mobile-preview-wrapper__phone[data-v-3f472f96]{width:282px}.mobile-preview-wrapper__phone img[data-v-3f472f96]{object-fit:cover;border-radius:44px}.mobile-preview-wrapper__content[data-v-3f472f96]{width:258px;height:450px;left:12px}[data-v-6bcaca8a] .vueperslides__parallax-wrapper{padding-bottom:110px!important}[data-v-f16f20f8] .vueperslides__bullets{pointer-events:none!important}[data-v-f16f20f8] .vueperslides__parallax-wrapper{padding-bottom:110px!important}[data-v-bb3cca55] .vueperslides__bullets{pointer-events:none!important}[data-v-bb3cca55] .vueperslides__parallax-wrapper{height:110px!important;padding-bottom:110px!important}[data-v-b09e80c4] .vueperslides__bullets{pointer-events:none!important}[data-v-b09e80c4] .vueperslides__parallax-wrapper{height:110px!important;padding-bottom:110px!important}[data-v-9bdef600] .vueperslides__parallax-wrapper{padding-bottom:110px!important}
+.gap-16[data-v-5553d071],.gap-16[data-v-0e1b0c54]{gap:16px}[data-v-73199fa4] .in-button-v2__wrapper{line-height:0}[data-v-22226124] .in-segments-wrapper__button_selected,[data-v-22226124] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb;color:#0010ac;border-color:#0010ac}[data-v-2cb418af] .in-progress-wrapper__progress p span:last-child{display:none!important}[data-v-2cb418af] .in-progress-description-status{display:none!important}.view-options-wrapper[data-v-195ab6d4]{position:relative;display:inline-block}.new-tag[data-v-195ab6d4]{position:absolute;top:-8px;right:-16px;z-index:10}[data-v-195ab6d4] .guido__view-option-selection-desktop svg,[data-v-195ab6d4] .guido__view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-195ab6d4] .in-segments-wrapper__button_selected,[data-v-195ab6d4] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}[data-v-195ab6d4] .in-tooltip-wrapper__icon{cursor:pointer}.editor-toolbar[data-v-173c3a40]{gap:4px}.version-history-item[data-v-ee4b9c3f]{flex-basis:200px}.version-history[data-v-fad98586]{gap:8px}.version-history__toolbar[data-v-fad98586]{gap:4px}.view-options-wrapper[data-v-d405ca59]{position:relative;display:inline-block}.new-tag[data-v-d405ca59]{position:absolute;top:-8px;right:-16px;z-index:10}[data-v-d405ca59] .guido__verion-history-view-option-selection-desktop svg,[data-v-d405ca59] .guido__verion-history-view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-d405ca59] .in-segments-wrapper__button_selected,[data-v-d405ca59] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}[data-v-d405ca59] .in-tooltip-wrapper__icon{cursor:pointer}.auto-save-toggle[data-v-2c964af4]{position:relative}.auto-save-toggle__info-box[data-v-2c964af4]{position:absolute;top:100%;left:0;z-index:10;width:280px}.editor-actions[data-v-6e711fd7]{gap:4px}.header-wrapper[data-v-d11dd577]{min-width:1000px}.guido-loading__wrapper[data-v-07c4b2d8]{height:100%;top:75px!important;bottom:0!important}.guido-editor__wrapper[data-v-50dac6de]{--ribbon-offset: 0px;position:relative;width:100%;height:calc(100vh - 128px - var(--ribbon-offset))}.guido-editor__container[data-v-50dac6de]{width:100%;height:calc(100vh - 128px - var(--ribbon-offset))}.guido-editor__no-header[data-v-50dac6de]{height:calc(100vh - 75px - var(--ribbon-offset))}[data-v-293f1c47] .in-breadcrumb-wrapper__links{cursor:pointer}.templates-wrapper[data-v-91a26acd]{gap:16px;grid-template-columns:repeat(3,1fr)}.templates-wrapper .template-wrapper[data-v-91a26acd]{cursor:pointer}.templates-wrapper .template-wrapper .template-container[data-v-91a26acd]{height:274px;padding:2px;transition:none}.templates-wrapper .template-wrapper .template-container.selected[data-v-91a26acd]{padding:1px}.templates-wrapper .template-wrapper .template-container .thumbnail[data-v-91a26acd]{object-fit:cover;transform:scale(1)}[data-v-b9a93c6e] .guido__verion-history-view-option-selection-desktop svg,[data-v-b9a93c6e] .guido__verion-history-view-option-selection-mobile svg{margin:0 0 0 2px}[data-v-b9a93c6e] .in-segments-wrapper__button_selected,[data-v-b9a93c6e] .in-segments-wrapper__button_selected:hover{background-color:#dae1fb}.error-list[data-v-c3fd5d4b]{gap:16px}.desktop-browser-header[data-v-d86c5af5]{height:79px;min-height:79px}.desktop-browser-header__left[data-v-d86c5af5]{-webkit-user-drag:none;height:79px;width:378px}.desktop-browser-header__center[data-v-d86c5af5]{height:79px;background-repeat:repeat-x;background-size:auto 100%;background-position:left top}.desktop-browser-header__right[data-v-d86c5af5]{-webkit-user-drag:none;height:79px;width:112px}.desktop-preview[data-v-cf946232]{min-width:602px;height:70vh;min-height:583px;border-radius:10px}.desktop-preview iframe[data-v-cf946232]{min-height:504px}.iframe-wrapper[data-v-f255b2bb]{width:258px}.iframe-scaled[data-v-f255b2bb]{width:320px;height:124.0310077519%;transform:scale(.80625);transform-origin:top left}.cropped-text[data-v-eb3d05d7]{width:220px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.mobile-preview-wrapper__phone[data-v-3f472f96]{width:282px}.mobile-preview-wrapper__phone img[data-v-3f472f96]{object-fit:cover;border-radius:44px}.mobile-preview-wrapper__content[data-v-3f472f96]{width:258px;height:450px;left:12px}[data-v-6bcaca8a] .vueperslides__parallax-wrapper{padding-bottom:110px!important}[data-v-f16f20f8] .vueperslides__bullets{pointer-events:none!important}[data-v-f16f20f8] .vueperslides__parallax-wrapper{padding-bottom:110px!important}[data-v-bb3cca55] .vueperslides__bullets{pointer-events:none!important}[data-v-bb3cca55] .vueperslides__parallax-wrapper{height:110px!important;padding-bottom:110px!important}[data-v-b09e80c4] .vueperslides__bullets{pointer-events:none!important}[data-v-b09e80c4] .vueperslides__parallax-wrapper{height:110px!important;padding-bottom:110px!important}[data-v-9bdef600] .vueperslides__parallax-wrapper{padding-bottom:110px!important}

package/dist/services/allowlistApi.js

@@ -0,0 +1,15 @@
+import { useHttp as n } from "../composables/useHttp.js";
+import { base64EncodeWithSpecialChars as c } from "../utils/base64.js";
+const i = "/allowlist/check-single-item", r = "/get-user-role-and-email", u = () => {
+  const { get: t } = n();
+  return { checkDomain: async (e) => {
+    const o = encodeURIComponent(c(`https://${e}`)), { data: s } = await t(`${i}?item=${o}&type=domain`);
+    return s.type === "success";
+  }, getUserRole: async () => {
+    const { data: e } = await t(r);
+    return e == null ? void 0 : e.role;
+  } };
+};
+export {
+  u as useAllowlistApi
+};

package/dist/services/stripoApi.js

@@ -1,9 +1,13 @@
-import { useHttp as d } from "../composables/useHttp.js";
-import { useToaster as m } from "../composables/useToaster.js";
-import { MAX_DEFAULT_TEMPLATE_ID as y } from "../enums/defaults.js";
-import { useBlankTemplate as f } from "./blankTemplate.js";
-const D = () => {
-  const { get: s, post: u } = d(), { handleError: r } = m(), { getBlankTemplate: o } = f();
+import { useHttp as m } from "../composables/useHttp.js";
+import { useToaster as y } from "../composables/useToaster.js";
+import { MAX_DEFAULT_TEMPLATE_ID as f } from "../enums/defaults.js";
+import { useBlankTemplate as g } from "./blankTemplate.js";
+const l = () => ({
+  id: 0,
+  stripoId: 0,
+  unsubscriptionPreferencePages: []
+}), D = () => {
+  const { get: s, post: u } = m(), { handleError: r } = y(), { getBlankTemplate: n } = g();
   return {
     getToken: async () => {
       try {
@@ -26,13 +30,13 @@ const D = () => {
     },
     getDefaultTemplate: async () => {
       try {
-        const t = new URLSearchParams(window.location.search), e = t.get("default-template"), l = t.get("master"), n = e ? parseInt(e) : 0, i = n >= 1 && n <= y ? n : 0;
-        if (!i && !l)
-          return await o();
-        const p = `/stripo/default-template/${i}`, { data: c } = await s(p), a = typeof c == "string" ? JSON.parse(c) : c;
-        return !a || typeof a != "object" || !("html" in a) || !("css" in a) ? await o() : a;
+        const t = new URLSearchParams(window.location.search), e = t.get("default-template"), p = t.get("master"), o = e ? parseInt(e) : 0, i = o >= 1 && o <= f ? o : 0;
+        if (!i && !p)
+          return await n();
+        const d = `/stripo/default-template/${i}`, { data: c } = await s(d), a = typeof c == "string" ? JSON.parse(c) : c;
+        return !a || typeof a != "object" || !("html" in a) || !("css" in a) ? await n() : a;
       } catch (t) {
-        return r(t, "Failed to fetch default template"), o();
+        return r(t, "Failed to fetch default template"), n();
       }
     },
     getSyncModulesStatus: async () => {
@@ -53,13 +57,9 @@ const D = () => {
     getSyncModule: async (t) => {
       try {
         const { data: e } = await s(`/stripo/stripo-modules/${t}/get`);
-        return e;
+        return Array.isArray(e == null ? void 0 : e.unsubscriptionPreferencePages) ? e : l();
       } catch (e) {
-        return r(e, "Failed to get sync module"), {
-          id: 0,
-          stripoId: 0,
-          unsubscriptionPreferencePages: []
-        };
+        return r(e, "Failed to get sync module"), l();
       }
     },
     setSyncModuleUnsubscriptionPages: async (t) => {

package/dist/src/@types/config/schemas.d.ts

@@ -7,6 +7,7 @@
  */
 import type { DynamicContentNode } from '../generic';
 import type { SavedTemplateDetails } from '../stripo';
+import type { ActionButton } from '../toaster';
 import * as v from 'valibot';
 /**
  * Handler function for external validation before save
@@ -14,6 +15,16 @@ import * as v from 'valibot';
  * @returns Promise<boolean> - true if valid, false to cancel save
  */
 export type ExternalValidationHandler = (data: Omit<SavedTemplateDetails, 'metadata'>) => Promise<boolean>;
+/**
+ * Content for the domain-allowlist block toaster. Guido self-serves this (see
+ * useAllowlist): it resolves the user role via /get-user-role-and-email, builds the
+ * settings deep-link, and pulls copy from window.trans. `actionButton.onClick` runs the
+ * action (e.g. the "Add to allowlist" deep-link).
+ */
+export interface AllowlistToastContent {
+    message: string;
+    actionButton?: ActionButton;
+}
 /**
  * Message type constants for email templates
  */
@@ -377,6 +388,8 @@ export declare const FeaturesSchema: v.ObjectSchema<{
     readonly liquidSyntax: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
     /** Enable autosave (3-min interval + tab-hide). User toggles on/off from the header. */
     readonly autosave: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
+    /** Enable pre-save domain-allowlist validation (opt-in; Guido self-serves the block toaster) */
+    readonly allowlistEnabled: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
 }, undefined>;
 /**
  * Default block types available in Stripo
@@ -764,6 +777,8 @@ export declare const GuidoConfigSchema: v.ObjectSchema<{
         readonly liquidSyntax: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
         /** Enable autosave (3-min interval + tab-hide). User toggles on/off from the header. */
         readonly autosave: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
+        /** Enable pre-save domain-allowlist validation (opt-in; Guido self-serves the block toaster) */
+        readonly allowlistEnabled: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
     }, undefined>, {}>;
     /** Block configuration */
     readonly blocks: v.OptionalSchema<v.ObjectSchema<{

package/dist/src/composables/useAllowlist.d.ts

@@ -0,0 +1,18 @@
+import type { AllowlistToastContent } from '@@/Types/config/schemas';
+/**
+ * Builds the "Add to allowlist" InOne Settings deep-link (Security tab, add-domain modal
+ * prefilled). The route is identical across InOne products, so Guido builds it generically.
+ * @param value - domain(s) to prefill; base64-encoded into the `values` query param.
+ */
+export declare const buildAllowlistSettingsUrl: (value: string) => string;
+/**
+ * Domain-allowlist feature composable. Extracts every external domain from the compiled
+ * HTML/CSS and asks the backend (via allowlistApi) whether each is allowlisted, so an
+ * un-allowlisted link can block the save BEFORE anything is persisted; and builds the
+ * role-gated block-toaster content Guido renders. Gated by `features.allowlistEnabled` in
+ * useSave — consumers only flip the flag. SD-143197.
+ */
+export declare const useAllowlist: () => {
+    getBlockedDomains: (html: string, css: string) => Promise<string[]>;
+    resolveToast: (blockedDomains: string[]) => Promise<AllowlistToastContent>;
+};

package/dist/src/composables/useConfig.d.ts

@@ -96,6 +96,7 @@ export declare const useConfig: () => {
             modulesDisabled: boolean;
             liquidSyntax: boolean;
             autosave: boolean;
+            allowlistEnabled: boolean;
         };
         blocks: {
             excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -227,6 +228,7 @@ export declare const useConfig: () => {
         modulesDisabled: boolean;
         liquidSyntax: boolean;
         autosave: boolean;
+        allowlistEnabled: boolean;
     } | null>;
     blocks: import("vue").ComputedRef<{
         excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];

package/dist/src/composables/usePreviewInteractionGuard.d.ts

@@ -1,3 +1,3 @@
 export declare const usePreviewInteractionGuard: () => {
-    blockPreviewInteractions: (iframe: HTMLIFrameElement) => void;
+    guardPreviewInteractions: (iframe: HTMLIFrameElement) => void;
 };

package/dist/src/composables/useUserRole.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolves whether the current user may manage the partner's domain allowlist, via the shared
+ * InOne endpoint GET /get-user-role-and-email (allowlistApi.getUserRole). Fail-open: on any
+ * error the user is treated as non-manage (message-only toaster, no "Add to allowlist" deep-link
+ * they may not be able to use).
+ */
+export declare const useUserRole: () => {
+    getIsManageUser: () => Promise<boolean>;
+};

package/dist/src/enums/roles.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Insider user-role aliases — the kebab-case wire values returned by
+ * GET /get-user-role-and-email (the same set honey-badger's RoleEnums defines).
+ * Only the manage-user role is needed in Guido: it gates the "Add to allowlist"
+ * action in the domain-allowlist block toaster. SD-143197.
+ */
+export declare enum RoleEnums {
+    MANAGE_USERS = "manage-users"
+}

package/dist/src/extensions/Blocks/Unsubscribe/utils/constants.d.ts

@@ -9,3 +9,4 @@ export declare const DATA_ATTRIBUTES: {
     readonly BLOCK_ID: "data-unsubscribe-block-id";
 };
 export declare const UNSUBSCRIBE_BLOCK_SELECTOR = ".unsubscribe-block-v2";
+export declare const UNSUBSCRIBE_LINK_SELECTOR = "a[data-unsubscribe-link=\"true\"], a.unsubscribe-link";

package/dist/src/services/allowlistApi.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Backend calls behind the domain-allowlist feature. Thin transport layer: it owns the
+ * endpoints, encoding, and response shape, and lets callers (useAllowlist / useUserRole) apply
+ * the caching + fail-open policy — mirroring how validators/saveAsTemplate delegates its check
+ * to templateLibraryApi.
+ */
+export declare const useAllowlistApi: () => {
+    checkDomain: (domain: string) => Promise<boolean>;
+    getUserRole: () => Promise<string | undefined>;
+};

package/dist/src/stores/config.d.ts

@@ -101,6 +101,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -238,6 +239,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -375,6 +377,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -512,6 +515,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -649,6 +653,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -786,6 +791,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -923,6 +929,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1060,6 +1067,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1197,6 +1205,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1334,6 +1343,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1471,6 +1481,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1608,6 +1619,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1745,6 +1757,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -1882,6 +1895,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -2019,6 +2033,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -2156,6 +2171,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -2293,6 +2309,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];
@@ -2430,6 +2447,7 @@ export declare const useConfigStore: import("pinia").StoreDefinition<"guido-conf
                 modulesDisabled: boolean;
                 liquidSyntax: boolean;
                 autosave: boolean;
+                allowlistEnabled: boolean;
             };
             blocks: {
                 excludeDefaults: ("amp-accordion" | "amp-carousel" | "amp-form-controls" | "banner-block" | "button-block" | "html-block" | "image-block" | "menu-block" | "social-block" | "spacer-block" | "text-block" | "timer-block" | "video-block")[];

package/dist/src/utils/urlSchemes.d.ts

@@ -0,0 +1,6 @@
+/**
+ * URL schemes that are safe to follow from partner-authored email HTML. Shared so a
+ * future bypass fix lands in one place — the preview guard and the recommendation
+ * sanitizer both gate on it. Stored with the trailing colon to match `anchor.protocol`.
+ */
+export declare const BASE_SAFE_URL_SCHEMES: readonly string[];

package/dist/static/styles/components/base-input.css.js

@@ -3,8 +3,12 @@ const n = `.base-input {
     border-radius: 4px;
     background-color: var(--guido-color-gray-0);
     align-items: center;
-    height: 40px;
-    max-height: 40px;
+    /* 40px is a floor, never a cap: \`.base-input\` is shared by every settings field,
+       including Stripo's own auto-height inputs (e.g. the link field) that expand on
+       focus. A fixed max-height clamped their inner box; keep 40px only as the floor. */
+    min-height: 40px;
+    height: auto;
+    max-height: none;
     box-sizing: content-box;
     outline: none;
     resize: vertical;
@@ -36,11 +40,6 @@ ue-contenteditable .base-input {
     line-height: 24px;
 }
 
-/* Image link input is auto-height; lift the fixed 40px cap so it can grow. */
-ue-contenteditable.link-autoheight-contenteditable .base-input {
-    max-height: none;
-}
-
 ue-icon-component.icon-button.icon-clear-input {
     right: 2px;
     top: 2px;

package/dist/utils/urlSchemes.js

@@ -0,0 +1,4 @@
+const t = ["http:", "https:", "mailto:"];
+export {
+  t as BASE_SAFE_URL_SCHEMES
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@useinsider/guido",
-  "version": "3.12.0-beta.60e4757",
+  "version": "3.12.0-beta.66af948",
   "description": "Guido is a Vue + TypeScript wrapper for Email Plugin. Easily embed the email editor in your Vue applications.",
   "main": "./dist/guido.umd.cjs",
   "module": "./dist/library.js",