merge: upstream 393 commits

[github-actions]

Upstream sync: plasmicapp/plasmic, Apr 27 → Aug 5 (393 commits)

Brings the fork up to date with upstream master. ~95 of the commits are upstream's
Publish/upgrade-internal release noise; the rest is real change. All 114 merge
conflicts are resolved, EP customizations are verified intact, and the fork-integrity
suite has been extended to cover everything EP added since the April merge.

What we get from upstream

Security fixes (the main reason to land this promptly)

• Postgres data-source sort.field SQL-injection fix
• SSRF protection: all server fetches of user-supplied URLs go through a new
  fetchUntrusted wrapper (request-filtering-agent)
• HTML-import CSS url() validation bypass fix
• Sanitized user text in transactional emails; password-length cap (bcrypt DoS);
  rate-limited grant-revoke; workspace owners can manage data sources

Studio

• Large Copilot tool buildout (state variables, extract/delete component, tokens,
  animations, data queries, slot targets). Off for regular users: gated behind
  enableUiCopilot/enableChatCopilot, default false, enabled only for
  admin-team-domain accounts. Model defaults moved to Vertex-hosted models.
• New floating-window comments/chat UI; rich text rebuilt on TemplatedString
  (rendering now shared between canvas and codegen); HostConfig/trusted-host modal
  rewrite; Next 16 canvas fixes (blank artboards, HMR/React debug channel — supersedes
  the reactDebugChannel: false app-host workaround once deployed)

SDK / loader / codegen

• Breaking renames in the npm packages: unstable__getServerQueriesData →
  getPlasmicQueriesData, unstable_usePlasmicQueries → usePlasmicQueries,
  PlasmicClientRootProvider → ClientPlasmicRootProvider. Deployed storefronts are
  unaffected (the names live in the app's own npm dep; loader wire protocol unchanged,
  v7+ still supported) — but any app bumping its loader version must update. Our
  example app + 0.1.0 field guide need the same update (tracked as follow-up).
• Loader packages: native fetch (Node ≥18 floor); required-param validation on
  registered functions (EP commerce functions don't set required — unaffected)
• Codegen: animations support, app-router/SSG fixes, loader cache hit/miss metrics

Server / infra

• OpenTelemetry distributed tracing for codegen; worker-pool gauges; multiplayer
  connection-leak fixes; serialized loader prefill
• New env vars: STATIC_URL (optional, defaults to PUBLIC_URL — our single-domain
  deploys unaffected; build-time PUBLICPATH removed, we never set it) and
  SERVER_KEEP_ALIVE_TIMEOUT (default 60s — should be set above the ALB idle timeout
  in terraservices before/with deploy)
• Amplitude analytics writes removed upstream

Migrations

• One TypeORM migration: lz4 compression on project_revision.data (auto-applies at
  startup, transparent to rollback)
• One new bundle migration, renumbered 257 → 258 on our side (we hold
  255-fix-ep-addtocart-import-path); same collision pattern as April, now documented
  as a standing procedure in the runbook

Fork-side work in this PR (beyond conflict resolution)

• ep-fork-integrity extended with ~20 tests covering post-April customizations that
  had no protection: Redis rate limiters, adminOnly gates, CloudFront invalidation on
  publish, loader URL split + SSR data host, Server-Timing/S3-cache cluster, Datadog
  (no-Sentry) guard, bundle-migration numbering, yarn root + MCP workspaces
• Kept yarn at root — upstream moved the monorepo to pnpm. Root workspaces,
  resolutions, and yarn scripts preserved; ~76 package scripts that upstream
  pnpm-ified restored to their yarn forms; upstream's pnpm files land inert.
  Full pnpm adoption is a separate decision (recurring per-merge cost until made).
• Deleted six zombie files (tutorial frags, HtmlImporter, WebImporter,
  AnimationsSection) that upstream removed before the merge-base and that had wrongly
  survived an earlier merge — unreferenced, broken by this merge's import changes
• @babel/* pinned in root resolutions (lockfile regen had split resolutions and
  broken the cli build); new upstream vitest suites (host, data-sources) routed to
  vitest steps in CI instead of the jest sweep
• Runbook updated with six new EP-customization entries + the renumbering procedure

Verification

• ep-fork-integrity 48/48; cm-cors, WebImporter, prefill-cloudfront (CloudFront
  invalidation behavior), ep-loader-fast-path, host+data-sources vitest all pass
• tsc --noEmit introduces zero errors vs master (master carries ~46 pre-existing)
• Every EP commit since April that touched upstream-shared files audited: no EP work
  lost; per-file resolution log in docs/internal/merges/PR-313-august-2026.md
• Note: master's own Tests runs currently fail WAB shards 3/4 (pre-existing). This PR
  runs the full WAB shards via the run-wab-tests label — judge against that baseline.

Merging & deploy

• Merge with "Create a merge commit" — do NOT squash (preserves upstream ancestry;
  squashing makes every future weekly merge see all 393 commits as conflicts again)
• Post-merge: integration auto-deploys → verify migration ran → publish-hostless →
  smoke (Studio, EP commerce, storefront golden path, no Copilot for non-admin users)
  → bake ≥1 day (bundle migration 258 makes rollback fix-forward once projects are
  opened) → prod promote + publish-hostless both regions
• Pre-deploy (outside this repo): audit DevFlagOverrides (adminTeamDomain, pin
  copilot flags false if wanted fully dark); set SERVER_KEEP_ALIVE_TIMEOUT in
  terraservices