@classic-homes/slides 0.5.1 → 0.5.3

package/dist/{chunk-GX6P2SE6.js → chunk-7GFFKI3D.js}

@@ -3,7 +3,7 @@ import {
   parseDeckSource,
   renderDeck,
   stringifyDeck
-} from "./chunk-OUAMH2TP.js";
+} from "./chunk-WTC2VV5C.js";
 
 // src/node/index.ts
 import { readFile, stat, writeFile } from "fs/promises";
@@ -117,4 +117,4 @@ export {
   buildDeckFile,
   exportDeckFile
 };
-//# sourceMappingURL=chunk-GX6P2SE6.js.map
+//# sourceMappingURL=chunk-7GFFKI3D.js.map

package/dist/{chunk-TEE3OGRQ.js → chunk-RIKOLCES.js}

@@ -4,7 +4,7 @@ import {
   LAYOUT_CATEGORIES,
   baseSlide,
   getLayout
-} from "./chunk-OUAMH2TP.js";
+} from "./chunk-WTC2VV5C.js";
 
 // src/catalog.ts
 import { z } from "zod";
@@ -104,4 +104,4 @@ export {
   deckJsonSchema,
   AUTHORING_GUIDE
 };
-//# sourceMappingURL=chunk-TEE3OGRQ.js.map
+//# sourceMappingURL=chunk-RIKOLCES.js.map

package/dist/{chunk-OUAMH2TP.js → chunk-WTC2VV5C.js}

@@ -581,11 +581,16 @@ function escapeHtml(value) {
 function escapeAttr(value) {
   return escapeHtml(value);
 }
+function escapeCssString(value) {
+  return value.replace(/["'\\\n\r\f]/g, (c) => `\\${c.charCodeAt(0).toString(16)} `);
+}
 var SAFE_URL = /^(https?:|mailto:|tel:|#|\/)/i;
 function isSafeLinkUrl(url) {
   return SAFE_URL.test(url);
 }
 function inline(text) {
+  if (!text) return "";
+  text = text.replace(/[\uE000\uE001]/g, "");
   if (!text) return "";
   const codes = [];
   let s = text.replace(/`([^`]+)`/g, (_, code) => {
@@ -690,14 +695,15 @@ function items(list, marker = "square") {
     (i) => `<li class="b-item">${inline(i.text)}${i.sub ? `<span class="sub">${inline(i.sub)}</span>` : ""}</li>`
   ).join("")}</ul>`;
 }
+var SAFE_FOCUS = /^[a-z0-9.%\s-]+$/i;
 function img(image2, ctx, cls = "") {
   const style = [];
   if (image2.fit === "contain") style.push("object-fit:contain");
-  if (image2.focus) style.push(`object-position:${image2.focus.replace(/[;"<>]/g, "")}`);
+  if (image2.focus && SAFE_FOCUS.test(image2.focus)) style.push(`object-position:${image2.focus}`);
   const classes = [cls, image2.size === "natural" ? "natural" : ""].filter(Boolean).join(" ");
   const src = ctx.image(image2.src);
   const loading = src.startsWith("data:") ? "" : ' loading="lazy"';
-  return `<img${classes ? ` class="${classes}"` : ""} src="${escapeAttr(src)}" alt="${escapeAttr(image2.alt)}"${style.length ? ` style="${style.join(";")}"` : ""}${loading} decoding="async">`;
+  return `<img${classes ? ` class="${classes}"` : ""} src="${escapeAttr(src)}" alt="${escapeAttr(image2.alt)}"${style.length ? ` style="${escapeAttr(style.join(";"))}"` : ""}${loading} decoding="async">`;
 }
 function maxLen(value, limit, path, what) {
   if (!value || value.length <= limit) return [];
@@ -3592,7 +3598,7 @@ async function renderDeck(input, options = {}) {
         const overlay = slide.overlay ?? "dark";
         classes.push("has-bg", `overlay-${overlay}`);
         if (overlay !== "light" && !classes.includes("solid")) classes.push("solid");
-        style = ` style="--bg-img:url(&quot;${escapeAttr(ctx.image(slide.backgroundImage.src))}&quot;)"`;
+        style = ` style="--bg-img:url(&quot;${escapeAttr(escapeCssString(ctx.image(slide.backgroundImage.src)))}&quot;)"`;
       }
       if (slide.hidden) classes.push("is-hidden");
       let chrome = "";
@@ -3954,4 +3960,4 @@ export {
   inlineDeckImages,
   externalizeDeckImages
 };
-//# sourceMappingURL=chunk-OUAMH2TP.js.map
+//# sourceMappingURL=chunk-WTC2VV5C.js.map