@bendyline/squisq 2.1.0 → 2.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bendyline LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,24 @@
+# Third-Party Notices for @bendyline/squisq
+
+This notice applies to the `@bendyline/squisq` npm package. Squisq-authored
+code is licensed under the MIT license in `LICENSE`. Third-party components
+remain under their respective license terms.
+
+## Runtime dependencies
+
+| Package             | Version | License    | Repository                                                             |
+| ------------------- | ------- | ---------- | ---------------------------------------------------------------------- |
+| genson-js           | 0.0.8   | Apache-2.0 | https://github.com/aspecto-io/genson-js                                |
+| hast-util-from-html | 2.0.3   | MIT        | https://github.com/syntax-tree/hast-util-from-html                     |
+| localforage         | 1.10.0  | Apache-2.0 | https://github.com/localForage/localForage                             |
+| ngeohash            | 0.6.3   | MIT        | https://github.com/sunng87/node-geohash                                |
+| remark-directive    | 3.0.1   | MIT        | https://github.com/remarkjs/remark-directive                           |
+| remark-frontmatter  | 5.0.0   | MIT        | https://github.com/remarkjs/remark-frontmatter                         |
+| remark-gfm          | 4.0.1   | MIT        | https://github.com/remarkjs/remark-gfm                                 |
+| remark-math         | 6.0.0   | MIT        | https://github.com/remarkjs/remark-math                                |
+| remark-parse        | 11.0.0  | MIT        | https://github.com/remarkjs/remark/tree/main/packages/remark-parse     |
+| remark-stringify    | 11.0.0  | MIT        | https://github.com/remarkjs/remark/tree/main/packages/remark-stringify |
+| unified             | 11.0.5  | MIT        | https://unifiedjs.com                                                  |
+
+Copyright and complete license texts for these dependencies are included in
+their respective npm distributions and source repositories.

package/dist/{ContentContainer-BXUlIf18.d.ts → ContentContainer-B2w9sUoL.d.ts}

@@ -31,10 +31,23 @@ interface ContentEntry {
  * with no leading slash. Example: 'images/hero.jpg', 'index.md'.
  */
 interface ContentContainer {
+    /**
+     * Shared identity used to serialize in-process mutations across multiple
+     * scoped views of the same backing store. Implementations may omit it; the
+     * container object itself is then used.
+     */
+    readonly mutationLock?: object;
     /** Read a file's binary content. Returns null if the file does not exist. */
     readFile(path: string): Promise<ArrayBuffer | null>;
     /** Write a file. Creates or overwrites. */
     writeFile(path: string, data: ArrayBuffer | Uint8Array, mimeType?: string): Promise<void>;
+    /**
+     * Atomically create a file only when the path does not already exist.
+     * Returns false on collision. Persistent adapters should implement this
+     * with their datastore/filesystem's exclusive-create primitive so callers
+     * are safe across tabs and processes.
+     */
+    writeFileExclusive?(path: string, data: ArrayBuffer | Uint8Array, mimeType?: string): Promise<boolean>;
     /** Remove a file. No-op if the file does not exist. */
     removeFile(path: string): Promise<void>;
     /**
@@ -79,8 +92,10 @@ declare function findDocumentPath(entries: ContentEntry[]): string | null;
  */
 declare class MemoryContentContainer implements ContentContainer {
     private files;
+    readonly mutationLock: object;
     readFile(path: string): Promise<ArrayBuffer | null>;
     writeFile(path: string, data: ArrayBuffer | Uint8Array, mimeType?: string): Promise<void>;
+    writeFileExclusive(path: string, data: ArrayBuffer | Uint8Array, mimeType?: string): Promise<boolean>;
     removeFile(path: string): Promise<void>;
     listFiles(prefix?: string): Promise<ContentEntry[]>;
     exists(path: string): Promise<boolean>;

package/dist/{Doc-DynJleo-.d.ts → Doc-BubIpWsp.d.ts}

@@ -1,4 +1,4 @@
-import { Z as Transition, $ as TransitionType, M as MarkdownBlockNode, q as MarkdownHeading } from './types-BwMPl2CB.js';
+import { a0 as Transition, a2 as TransitionType, M as MarkdownBlockNode, r as MarkdownHeading } from './types-CUNc9biN.js';
 
 /**
  * Media-clip timing model.

package/dist/{ImageEditDoc-Ca4Tr9uN.d.ts → ImageEditDoc-CGxk5CHc.d.ts}

@@ -1,4 +1,4 @@
-import { R as ImageLayer, a$ as TextLayer, aO as ShapeLayer, aw as PathLayer } from './Doc-DynJleo-.js';
+import { R as ImageLayer, a$ as TextLayer, aO as ShapeLayer, aw as PathLayer } from './Doc-BubIpWsp.js';
 
 /**
  * ImageEditDoc — JSON document describing a layered, editable image.

package/dist/{annotationCoercion-Dr_DY9Hx.d.ts → annotationCoercion-PtRQhk5V.d.ts}

@@ -1,4 +1,4 @@
-import { a5 as BlockConnection, $ as TransitionType, _ as TransitionDirection } from './types-BwMPl2CB.js';
+import { ab as BlockConnection, a2 as TransitionType, a1 as TransitionDirection } from './types-CUNc9biN.js';
 
 /**
  * Heading-attribute value coercion.

package/dist/{chunk-VWCJ2WXC.js → chunk-2ZWIXGAC.js}

@@ -212,4 +212,3 @@ export {
   getDocPlaybackDuration,
   defaultPageStyle
 };
-//# sourceMappingURL=chunk-VWCJ2WXC.js.map

package/dist/{chunk-VYFRI7R6.js → chunk-32R2RZAO.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_THEME,
   applySurface,
   resolveFontFamily
-} from "./chunk-JHZWYRSW.js";
+} from "./chunk-C33GTPUZ.js";
 
 // src/jsonForm/chooseControl.ts
 var ENUM_SEGMENTED_LIMIT = 4;
@@ -169,6 +169,74 @@ function resolveRef(schema, root) {
 }
 
 // src/jsonForm/evaluateWhen.ts
+var MAX_CONDITION_REGEX_LENGTH = 256;
+function isSafeConditionRegex(pattern) {
+  if (pattern.length === 0 || pattern.length > MAX_CONDITION_REGEX_LENGTH) return false;
+  if (/\\[1-9]|\(\?[=!<]/.test(pattern)) return false;
+  const groups = [];
+  let escaped = false;
+  let inClass = false;
+  let unboundedQuantifiers = 0;
+  for (let index = 0; index < pattern.length; index++) {
+    const ch = pattern[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "]" && inClass) {
+      inClass = false;
+      continue;
+    }
+    if (inClass) continue;
+    if (ch === "(") {
+      groups.push({ hasQuantifier: false, hasAlternation: false });
+      continue;
+    }
+    if (ch === "|") {
+      const group = groups[groups.length - 1];
+      if (group) group.hasAlternation = true;
+      continue;
+    }
+    if (ch === ")") {
+      const group = groups.pop();
+      if (!group) return false;
+      const next = pattern[index + 1];
+      if (next && "*+?{".includes(next) && (group.hasQuantifier || group.hasAlternation)) {
+        return false;
+      }
+      if (next && "*+?{".includes(next)) {
+        const parent = groups[groups.length - 1];
+        if (parent) parent.hasQuantifier = true;
+      }
+      continue;
+    }
+    if ("*+?".includes(ch) || ch === "{") {
+      if (ch === "*" || ch === "+") unboundedQuantifiers += 1;
+      if (ch === "{") {
+        const close = pattern.indexOf("}", index + 1);
+        if (close < 0) return false;
+        const bounds = pattern.slice(index + 1, close);
+        if (!/^\d+(?:,\d*)?$/.test(bounds)) return false;
+        const values = bounds.split(",").filter(Boolean).map(Number);
+        if (values.some((value) => value > 1e3)) return false;
+        if (bounds.endsWith(",")) unboundedQuantifiers += 1;
+        index = close;
+      }
+      if (unboundedQuantifiers > 1) return false;
+      const group = groups[groups.length - 1];
+      if (group) group.hasQuantifier = true;
+    }
+  }
+  return !escaped && !inClass && groups.length === 0;
+}
 function evaluateWhen(when, rootData) {
   const actual = getByPointer(rootData, when.field);
   if (when.equals !== void 0) {
@@ -178,7 +246,8 @@ function evaluateWhen(when, rootData) {
     return when.oneOf.some((v) => deepEqual(actual, v));
   }
   if (when.matches !== void 0) {
-    if (typeof actual !== "string") return false;
+    if (typeof actual !== "string" || actual.length > 1e5) return false;
+    if (!isSafeConditionRegex(when.matches)) return false;
     try {
       return new RegExp(when.matches).test(actual);
     } catch {
@@ -266,10 +335,10 @@ export {
   getByPointer,
   setByPointer,
   resolveRef,
+  isSafeConditionRegex,
   evaluateWhen,
   resolveFlag,
   inferSchema,
   buildJsonFormTokens,
   resolveJsonFormTheme
 };
-//# sourceMappingURL=chunk-VYFRI7R6.js.map