feat(timestamp): add TSA URL validation and sanitization methods

src/js/workflow/nodes/timestamp-node.ts

@@ -4,7 +4,10 @@ import { pdfSocket } from '../sockets';
 import type { SocketData } from '../types';
 import { requirePdfInput, processBatch } from '../types';
 import { wfError } from '../errors';
-import { TIMESTAMP_TSA_PRESETS } from '../../config/timestamp-tsa.js';
+import {
+  TIMESTAMP_TSA_PRESETS,
+  isAllowedTsaUrl,
+} from '../../config/timestamp-tsa.js';
 import { timestampPdf } from '../../logic/digital-sign-pdf.js';
 import { loadPdfDocument } from '../../utils/load-pdf-document.js';
 
@@ -32,6 +35,14 @@ export class TimestampNode extends BaseWorkflowNode {
     return TIMESTAMP_TSA_PRESETS;
   }
 
+  sanitizeControlValue(key: string, value: unknown): unknown {
+    const sanitized = super.sanitizeControlValue(key, value);
+    if (key === 'tsaUrl' && !isAllowedTsaUrl(sanitized)) {
+      return TIMESTAMP_TSA_PRESETS[0].url;
+    }
+    return sanitized;
+  }
+
   async data(
     inputs: Record<string, SocketData[]>
   ): Promise<Record<string, SocketData>> {