@bsuite/ui 1.0.0 → 1.0.2

package/dist/branding/index.d.ts

@@ -4,4 +4,5 @@
 export { BrandingCard, type BrandingCardProps } from './BrandingCard.js';
 export { ColorEditorSheet, type ColorEditorSheetProps } from './ColorEditorSheet.js';
 export { OklchColorPicker, type OklchColorPickerProps } from './OklchColorPicker.js';
+export { sanitizeCustomCss } from './sanitizeCustomCss.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/branding/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/branding/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/branding/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/branding/index.js

@@ -4,3 +4,4 @@
 export { BrandingCard } from './BrandingCard.js';
 export { ColorEditorSheet } from './ColorEditorSheet.js';
 export { OklchColorPicker } from './OklchColorPicker.js';
+export { sanitizeCustomCss } from './sanitizeCustomCss.js';

package/dist/branding/sanitizeCustomCss.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Shared custom-CSS sanitizer for tenant white-label injection.
+ * Apps should prefer this over local copies (de-dupe / excellence loop).
+ *
+ * textContent injection avoids HTML breakout; this still rejects high-risk
+ * CSS constructs. No-regex: case-insensitive substring scan.
+ */
+export declare function sanitizeCustomCss(raw: string | null | undefined): string;
+//# sourceMappingURL=sanitizeCustomCss.d.ts.map

package/dist/branding/sanitizeCustomCss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeCustomCss.d.ts","sourceRoot":"","sources":["../../src/branding/sanitizeCustomCss.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAmBxE"}

package/dist/branding/sanitizeCustomCss.js

@@ -0,0 +1,30 @@
+/**
+ * Shared custom-CSS sanitizer for tenant white-label injection.
+ * Apps should prefer this over local copies (de-dupe / excellence loop).
+ *
+ * textContent injection avoids HTML breakout; this still rejects high-risk
+ * CSS constructs. No-regex: case-insensitive substring scan.
+ */
+export function sanitizeCustomCss(raw) {
+    if (raw == null)
+        return '';
+    const s = String(raw);
+    if (s.length > 50000)
+        return '';
+    const lower = s.toLowerCase();
+    const forbidden = [
+        '@import',
+        'expression(',
+        'javascript:',
+        'vbscript:',
+        '-moz-binding',
+        'behavior:',
+        '</style',
+        '<script',
+    ];
+    for (const token of forbidden) {
+        if (lower.includes(token))
+            return '';
+    }
+    return s;
+}

package/dist/index.d.ts

@@ -11,4 +11,5 @@ export { ErrorBoundary, type ErrorBoundaryProps } from './error-boundary.js';
 export { LoadingSpinner, type LoadingSpinnerProps } from './loading-spinner.js';
 export { StatusBadge, type StatusBadgeProps, type StatusBadgeTone } from './status-badge.js';
 export { BrandingCard, ColorEditorSheet, OklchColorPicker, type BrandingCardProps, type ColorEditorSheetProps, type OklchColorPickerProps, } from './branding/index.js';
+export { sanitizeCustomCss } from './branding/sanitizeCustomCss.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAC/B,OAAO,EACL,IAAI,EACJ,cAAc,EACd,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,OAAO,GACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EACL,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAG5F,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAC/B,OAAO,EACL,IAAI,EACJ,cAAc,EACd,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,OAAO,GACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EACL,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,MAAM,EACN,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAG5F,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA"}

package/dist/index.js

@@ -12,3 +12,4 @@ export { LoadingSpinner } from './loading-spinner.js';
 export { StatusBadge } from './status-badge.js';
 // Branding components (v0.3.0+)
 export { BrandingCard, ColorEditorSheet, OklchColorPicker, } from './branding/index.js';
+export { sanitizeCustomCss } from './branding/sanitizeCustomCss.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsuite/ui",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "license": "UNLICENSED",
   "publishConfig": {
@@ -79,7 +79,7 @@
     "tailwind-merge": "^3.6.0"
   },
   "peerDependencies": {
-    "@bsuite/theme": ">=0.6.0",
+    "@bsuite/theme": ">=0.7.0",
     "react": "^18.3.0 || ^19.0.0",
     "react-dom": "^18.3.0 || ^19.0.0"
   },
@@ -89,7 +89,7 @@
     }
   },
   "devDependencies": {
-    "@bsuite/theme": "^0.5.0",
+    "@bsuite/theme": "^0.7.0",
     "@storybook/react-vite": "^10.4.3",
     "@tailwindcss/vite": "^4.3.0",
     "@testing-library/jest-dom": "^6.9.1",