ampless 1.0.0-alpha.30 → 1.0.0-alpha.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +34 -1
- package/package.json +1 -1
package/dist/index.d.ts
CHANGED
|
@@ -411,7 +411,40 @@ type PublicHeadDescriptor = {
|
|
|
411
411
|
} | {
|
|
412
412
|
type: 'noscript';
|
|
413
413
|
id?: string;
|
|
414
|
-
/**
|
|
414
|
+
/**
|
|
415
|
+
* Raw HTML emitted inside `<noscript>` via React's
|
|
416
|
+
* `dangerouslySetInnerHTML`. This is an intentional escape hatch:
|
|
417
|
+
* descriptors otherwise constrain shape (typed props on `meta` /
|
|
418
|
+
* `link` / `script`), but `<noscript>` content is often vendor-
|
|
419
|
+
* supplied (analytics fallbacks, etc.) and cannot be modelled
|
|
420
|
+
* as typed props without an unbounded discriminated union.
|
|
421
|
+
*
|
|
422
|
+
* **Trust model.** This is part of the same public injection
|
|
423
|
+
* surface as `inlineScript` and `script`. It is **not** gated
|
|
424
|
+
* by the plugin's `trust_level` — `untrusted` plugins can emit
|
|
425
|
+
* a `noscript` descriptor too, and the runtime tests in
|
|
426
|
+
* `packages/runtime/src/plugin-head.test.ts` explicitly cover
|
|
427
|
+
* the untrusted case. The trust decision is **plugin install**:
|
|
428
|
+
* an admin installs a plugin, accepting whatever it eventually
|
|
429
|
+
* renders into `<head>` / `<body>`. The boundary is structurally
|
|
430
|
+
* the same as the [editor trust
|
|
431
|
+
* model](../../docs/architecture/04-access-layer-mcp.md#editor-trust-model-specification)
|
|
432
|
+
* — editors can already inject arbitrary `<script>` via post
|
|
433
|
+
* body anyway, so a per-plugin sandbox here wouldn't change the
|
|
434
|
+
* upper bound. If a tighter sandbox is needed, scope it at
|
|
435
|
+
* install time: do not install plugins you do not trust to
|
|
436
|
+
* render arbitrary HTML into your pages.
|
|
437
|
+
*
|
|
438
|
+
* **Author guidance.** Plugin authors are still responsible
|
|
439
|
+
* for the HTML being well-formed — in particular, do not embed
|
|
440
|
+
* `</noscript>` sequences mid-content (such a sequence breaks
|
|
441
|
+
* out of the element and the remainder of the string is parsed
|
|
442
|
+
* as page-level HTML). The runtime does not detect or mask
|
|
443
|
+
* this; the regression test in
|
|
444
|
+
* [`packages/runtime/src/plugin-head.test.ts`](../../packages/runtime/src/plugin-head.test.ts)
|
|
445
|
+
* pins the current passthrough behaviour so any future move
|
|
446
|
+
* to sanitization becomes a deliberate, reviewed change.
|
|
447
|
+
*/
|
|
415
448
|
html: string;
|
|
416
449
|
};
|
|
417
450
|
/**
|