@classic-homes/theme-svelte 1.21.0 → 1.22.1

package/dist/lib/components/studio/StudioCanvas.svelte.d.ts

@@ -19,7 +19,11 @@ interface Props {
     toolbar?: Snippet;
     /** Accessible name of the canvas region (default: "Canvas") */
     label?: string;
-    /** Clicked on the backdrop, outside any item: usually clears the selection */
+    /**
+     * Clicked on the backdrop, outside any item: usually clears the selection.
+     * Also called on Escape pressed inside the canvas (outside a text field),
+     * the keyboard path back to "nothing selected".
+     */
     onBackgroundClick?: () => void;
     /** Classes for the frame that holds the content */
     frameClass?: string;

package/dist/lib/components/studio/StudioCanvasItem.svelte

@@ -12,6 +12,11 @@
    * gets a ring and its `toolbar` (duplicate, delete...). With `onInsert`, a
    * "+" between this item and the next adds a new one right there. On phones
    * picking an item opens the inspector sheet.
+   *
+   * Picking an item from elsewhere (an outline, an issue list) scrolls it into
+   * view; picking it on the canvas does not, so it never moves under the
+   * pointer. `insertPlacement="gutter"` puts the "+" in the left margin, for
+   * items edited in place, where a centred "+" would sit on the text.
    */
   interface Props {
     children: Snippet;
@@ -32,6 +37,8 @@
      * Turn off for items edited in place, where the sheet would cover them.
      */
     revealOnSelect?: boolean;
+    /** Where the "+" sits: centred on the item's bottom edge, or in the left gutter beside it */
+    insertPlacement?: 'center' | 'gutter';
     class?: string;
   }
 
@@ -45,11 +52,14 @@
     insertLabel,
     invalid = false,
     revealOnSelect = true,
+    insertPlacement = 'center',
     class: className,
   }: Props = $props();
 
   const studio = getStudioContext();
   let element: HTMLDivElement | undefined = $state();
+  /** The item was picked on the canvas (pointer or focus), so it is already in view. */
+  let pickedHere = false;
 
   // Quick actions (toolbar, "+") act on the item without selecting it. A
   // dialog they open (the insert palette) returns focus to them on close;
@@ -63,7 +73,14 @@
   }
 
   $effect(() => {
-    if (!selected || !element) return;
+    if (!selected || !element) {
+      pickedHere = false;
+      return;
+    }
+    if (pickedHere) {
+      pickedHere = false;
+      return;
+    }
     const el = element;
     void tick().then(() => {
       // Don't yank the canvas while the user is working inside the item
@@ -88,9 +105,14 @@
     invalid && 'outline-dashed outline-2 -outline-offset-2 outline-warning/70',
     className
   )}
+  onpointerdowncapture={(e) => {
+    if (!selected && !inQuickAction(e.target)) pickedHere = true;
+  }}
   onclickcapture={(e) => select(!inQuickAction(e.target))}
   onfocusin={(e) => {
-    if (!inQuickAction(e.target)) select(false);
+    if (inQuickAction(e.target)) return;
+    if (!selected) pickedHere = true;
+    select(false);
   }}
 >
   {#if !selected}
@@ -121,8 +143,13 @@
         type="button"
         aria-label={insertLabel ?? `Add below ${label}`}
         title={insertLabel ?? 'Add below'}
-        class="absolute left-1/2 top-0 z-10 flex h-7 w-7 -translate-x-1/2 -translate-y-1/2 items-center justify-center rounded-full border border-border bg-background text-muted-foreground opacity-0 shadow-sm hover:border-primary hover:text-primary focus-visible:opacity-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring group-hover/item:opacity-100 [@media(hover:none)]:opacity-100"
-        class:opacity-100={selected}
+        class={cn(
+          'absolute top-0 z-10 flex h-7 w-7 -translate-y-1/2 items-center justify-center rounded-full border border-border bg-background text-muted-foreground opacity-0 shadow-sm hover:border-primary hover:text-primary focus-visible:opacity-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring group-hover/item:opacity-100 [@media(hover:none)]:opacity-100',
+          insertPlacement === 'gutter'
+            ? 'right-full mr-1.5 group-focus-within/item:opacity-100'
+            : 'left-1/2 -translate-x-1/2',
+          selected && insertPlacement === 'center' && 'opacity-100'
+        )}
         onclick={(e) => {
           e.stopPropagation();
           onInsert?.();

package/dist/lib/components/studio/StudioCanvasItem.svelte.d.ts

@@ -7,6 +7,11 @@ import { type Snippet } from 'svelte';
  * gets a ring and its `toolbar` (duplicate, delete...). With `onInsert`, a
  * "+" between this item and the next adds a new one right there. On phones
  * picking an item opens the inspector sheet.
+ *
+ * Picking an item from elsewhere (an outline, an issue list) scrolls it into
+ * view; picking it on the canvas does not, so it never moves under the
+ * pointer. `insertPlacement="gutter"` puts the "+" in the left margin, for
+ * items edited in place, where a centred "+" would sit on the text.
  */
 interface Props {
     children: Snippet;
@@ -27,6 +32,8 @@ interface Props {
      * Turn off for items edited in place, where the sheet would cover them.
      */
     revealOnSelect?: boolean;
+    /** Where the "+" sits: centred on the item's bottom edge, or in the left gutter beside it */
+    insertPlacement?: 'center' | 'gutter';
     class?: string;
 }
 declare const StudioCanvasItem: import("svelte").Component<Props, {}, "">;

package/dist/lib/composables/useFocusTrap.svelte.js

@@ -8,12 +8,19 @@ const FOCUSABLE_SELECTOR = [
     'iframe',
     'object',
     'embed',
-    '[contenteditable]',
+    '[contenteditable]:not([contenteditable="false"])',
     '[tabindex]:not([tabindex="-1"])',
 ].join(',');
 function getFocusableElements(container) {
     const elements = container.querySelectorAll(FOCUSABLE_SELECTOR);
-    return Array.from(elements).filter((el) => el.offsetParent !== null && getComputedStyle(el).visibility !== 'hidden');
+    return Array.from(elements).filter((el) => 
+    // tabindex="-1" on a natively focusable element (roving-tabindex radios,
+    // toolbar buttons) takes it out of the Tab order, so it can't be the
+    // trap's first or last stop.
+    el.tabIndex >= 0 &&
+        !el.closest('[inert]') &&
+        el.offsetParent !== null &&
+        getComputedStyle(el).visibility !== 'hidden');
 }
 /**
  * Creates a focus trap action for use with Svelte's use: directive.

package/dist/lib/notices/sanitize.js

@@ -15,8 +15,10 @@ import { BROWSER } from 'esm-env';
 const ALLOWED_TAGS = ['a', 'b', 'br', 'em', 'i', 'p', 'span', 'strong', 'u', 'ul', 'ol', 'li'];
 /**
  * Allowed HTML attributes for notice messages.
+ * `class` is deliberately excluded: with Tailwind on the page, arbitrary
+ * utilities (`fixed inset-0 z-[9999]`) would let a message overlay the app.
  */
-const ALLOWED_ATTR = ['href', 'target', 'rel', 'class'];
+const ALLOWED_ATTR = ['href', 'target', 'rel'];
 /**
  * Escape HTML entities for safe rendering when DOMPurify isn't available.
  * This is a fallback for server-side rendering.
@@ -31,6 +33,12 @@ function escapeHtml(html) {
 }
 // Cached DOMPurify instance (only loaded on client)
 let purify = null;
+/** Force rel="noopener noreferrer" on any element that kept a target. */
+function enforceSafeRel(node) {
+    if (node.hasAttribute?.('target')) {
+        node.setAttribute('rel', 'noopener noreferrer');
+    }
+}
 /**
  * Initialize DOMPurify on the client.
  * Must be called before sanitizeHtml on the client side.
@@ -38,6 +46,7 @@ let purify = null;
 export async function initSanitizer() {
     if (BROWSER && !purify) {
         const DOMPurify = await import('isomorphic-dompurify');
+        DOMPurify.default.addHook('afterSanitizeAttributes', enforceSafeRel);
         purify = DOMPurify.default;
     }
 }
@@ -71,7 +80,5 @@ export function sanitizeHtml(html) {
     return purify.sanitize(html, {
         ALLOWED_TAGS,
         ALLOWED_ATTR,
-        // Ensure links open safely
-        ADD_ATTR: ['target'],
     });
 }

package/dist/lib/notices/store.d.ts

@@ -77,8 +77,8 @@ export declare const activeNotices: import("svelte/store").Readable<{
     location: "banner" | "both" | "card";
     pages: string[];
     link?: {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     } | undefined;
     title?: string | undefined;
@@ -98,8 +98,8 @@ export declare const bannerNotices: import("svelte/store").Readable<{
     location: "banner" | "both" | "card";
     pages: string[];
     link?: {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     } | undefined;
     title?: string | undefined;
@@ -119,8 +119,8 @@ export declare const cardNotices: import("svelte/store").Readable<{
     location: "banner" | "both" | "card";
     pages: string[];
     link?: {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     } | undefined;
     title?: string | undefined;

package/dist/lib/notices/store.js

@@ -36,10 +36,22 @@ function getDismissedNotices() {
     }
     catch (error) {
         console.warn('[notices] Failed to parse dismissed notices from localStorage', { error });
-        localStorage.removeItem(DISMISSED_STORAGE_KEY);
+        removeDismissedStorage();
     }
     return new Set();
 }
+/**
+ * Remove the dismissed-notices key. Storage itself can throw (blocked cookies,
+ * sandboxed iframes), so this never propagates.
+ */
+function removeDismissedStorage() {
+    try {
+        localStorage.removeItem(DISMISSED_STORAGE_KEY);
+    }
+    catch {
+        // Storage unavailable - nothing to clear
+    }
+}
 /**
  * Save dismissed notice IDs to localStorage
  */
@@ -166,7 +178,7 @@ export function dismissNotice(noticeId) {
 export function clearDismissedNotices() {
     dismissedIds.set(new Set());
     if (BROWSER) {
-        localStorage.removeItem(DISMISSED_STORAGE_KEY);
+        removeDismissedStorage();
     }
 }
 /**

package/dist/lib/notices/types.d.ts

@@ -23,15 +23,15 @@ export type NoticePage = '*' | string;
  */
 export declare const NoticeLinkSchema: z.ZodObject<{
     text: z.ZodString;
-    href: z.ZodString;
+    href: z.ZodEffects<z.ZodString, string, string>;
     external: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    href: string;
     text: string;
+    href: string;
     external?: boolean | undefined;
 }, {
-    href: string;
     text: string;
+    href: string;
     external?: boolean | undefined;
 }>;
 /**
@@ -61,15 +61,15 @@ export declare const NoticeSchema: z.ZodObject<{
     /** Optional link for "Learn more" or CTA */
     link: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
-        href: z.ZodString;
+        href: z.ZodEffects<z.ZodString, string, string>;
         external: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     }, {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     }>>;
     /** Whether the notice is enabled (quick toggle without removing) */
@@ -81,8 +81,8 @@ export declare const NoticeSchema: z.ZodObject<{
     location: "banner" | "both" | "card";
     pages: string[];
     link?: {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     } | undefined;
     title?: string | undefined;
@@ -98,8 +98,8 @@ export declare const NoticeSchema: z.ZodObject<{
     location: "banner" | "both" | "card";
     pages: string[];
     link?: {
-        href: string;
         text: string;
+        href: string;
         external?: boolean | undefined;
     } | undefined;
     title?: string | undefined;

package/dist/lib/notices/types.js

@@ -5,12 +5,16 @@
  * as banners at the top of pages or as cards within form pages.
  */
 import { z } from 'zod';
+import { safeHref } from '../utils/url.js';
 /**
  * Zod schema for notice link
  */
 export const NoticeLinkSchema = z.object({
     text: z.string().min(1, 'Link text is required'),
-    href: z.string().min(1, 'Link href is required'),
+    href: z
+        .string()
+        .min(1, 'Link href is required')
+        .refine((href) => safeHref(href) !== null, 'Link href must be relative or http(s)/mailto/tel'),
     external: z.boolean().optional(),
 });
 /**

package/dist/lib/stores/sidebar.svelte.d.ts

@@ -98,6 +98,12 @@ declare class SidebarStore {
      * This bypasses the persisted state check but doesn't persist the changes
      */
     forceExpandSections(sectionIds: string[]): void;
+    /**
+     * Undo search force-expansions, restoring the expansion state from before the
+     * search (including any toggles made while it was active). Call when the
+     * search query is cleared; a no-op when no search expanded anything.
+     */
+    restoreSearchExpansion(): void;
     /**
      * Set callback for when pinned items change (for external persistence)
      */

package/dist/lib/stores/sidebar.svelte.js

@@ -16,7 +16,7 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _SidebarStore_instances, _SidebarStore_initialized, _SidebarStore_loadedFromStorage, _SidebarStore_loadedExpansionFromStorage, _SidebarStore_loadedPinnedFromStorage, _SidebarStore_onPinnedChange, _SidebarStore_appId, _SidebarStore_desktopOpen, _SidebarStore_getStorageKey, _SidebarStore_persist, _SidebarStore_persistExpansion, _SidebarStore_persistPinned, _SidebarStore_persistDesktopState;
+var _SidebarStore_instances, _SidebarStore_initialized, _SidebarStore_loadedFromStorage, _SidebarStore_loadedExpansionFromStorage, _SidebarStore_loadedPinnedFromStorage, _SidebarStore_onPinnedChange, _SidebarStore_appId, _SidebarStore_desktopOpen, _SidebarStore_searchSnapshot, _SidebarStore_getStorageKey, _SidebarStore_persist, _SidebarStore_persistExpansion, _SidebarStore_persistPinned, _SidebarStore_persistDesktopState, _SidebarStore_takeSearchSnapshot;
 import { matchesAccess } from '../utils/nav-access.js';
 const STORAGE_PREFIX = 'classic-theme-sidebar';
 class SidebarStore {
@@ -43,6 +43,9 @@ class SidebarStore {
         // mobile drawer (which must always start closed and never persists) can't
         // clobber it. Restored when leaving mobile mode.
         _SidebarStore_desktopOpen.set(this, null);
+        // Expansion state from before a search force-expanded everything; restored
+        // when the search clears. Null while no search is active.
+        _SidebarStore_searchSnapshot.set(this, null);
     }
     /**
      * Whether the store has been initialized
@@ -87,6 +90,7 @@ class SidebarStore {
         __classPrivateFieldSet(this, _SidebarStore_loadedFromStorage, false, "f");
         __classPrivateFieldSet(this, _SidebarStore_loadedExpansionFromStorage, false, "f");
         __classPrivateFieldSet(this, _SidebarStore_loadedPinnedFromStorage, false, "f");
+        __classPrivateFieldSet(this, _SidebarStore_searchSnapshot, null, "f");
         try {
             // Load sidebar open state. On mobile only the desktop preference is
             // recorded — the drawer must never open on first paint.
@@ -176,36 +180,24 @@ class SidebarStore {
      * Toggle section expansion state. When expanding, sections in `collapseOnExpand` close.
      */
     toggleSection(sectionId, collapseOnExpand = []) {
-        const newSet = new Set(this.expandedSections);
-        if (newSet.has(sectionId)) {
-            newSet.delete(sectionId);
-        }
-        else {
-            newSet.add(sectionId);
-            // Accordion behaviour: opening one closes these (its siblings)
-            for (const id of collapseOnExpand)
-                if (id !== sectionId)
-                    newSet.delete(id);
+        const expand = !this.expandedSections.has(sectionId);
+        this.expandedSections = applyToggle(this.expandedSections, sectionId, expand, collapseOnExpand);
+        if (__classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f")) {
+            const snap = __classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f");
+            snap.sections = applyToggle(snap.sections, sectionId, expand, collapseOnExpand);
         }
-        this.expandedSections = newSet;
         __classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_persistExpansion).call(this);
     }
     /**
      * Toggle item expansion state. When expanding, items in `collapseOnExpand` close.
      */
     toggleItem(itemId, collapseOnExpand = []) {
-        const newSet = new Set(this.expandedItems);
-        if (newSet.has(itemId)) {
-            newSet.delete(itemId);
-        }
-        else {
-            newSet.add(itemId);
-            // Accordion behaviour: opening one closes these (its siblings)
-            for (const id of collapseOnExpand)
-                if (id !== itemId)
-                    newSet.delete(id);
+        const expand = !this.expandedItems.has(itemId);
+        this.expandedItems = applyToggle(this.expandedItems, itemId, expand, collapseOnExpand);
+        if (__classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f")) {
+            const snap = __classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f");
+            snap.items = applyToggle(snap.items, itemId, expand, collapseOnExpand);
         }
-        this.expandedItems = newSet;
         __classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_persistExpansion).call(this);
     }
     /**
@@ -241,6 +233,7 @@ class SidebarStore {
      * This bypasses the persisted state check but doesn't persist the changes
      */
     forceExpandItems(itemIds) {
+        __classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_takeSearchSnapshot).call(this);
         const newSet = new Set(this.expandedItems);
         itemIds.forEach((id) => newSet.add(id));
         this.expandedItems = newSet;
@@ -251,11 +244,25 @@ class SidebarStore {
      * This bypasses the persisted state check but doesn't persist the changes
      */
     forceExpandSections(sectionIds) {
+        __classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_takeSearchSnapshot).call(this);
         const newSet = new Set(this.expandedSections);
         sectionIds.forEach((id) => newSet.add(id));
         this.expandedSections = newSet;
         // Don't persist - this is temporary for search
     }
+    /**
+     * Undo search force-expansions, restoring the expansion state from before the
+     * search (including any toggles made while it was active). Call when the
+     * search query is cleared; a no-op when no search expanded anything.
+     */
+    restoreSearchExpansion() {
+        const snap = __classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f");
+        if (!snap)
+            return;
+        __classPrivateFieldSet(this, _SidebarStore_searchSnapshot, null, "f");
+        this.expandedSections = snap.sections;
+        this.expandedItems = snap.items;
+    }
     // ============================================
     // Pinning Methods
     // ============================================
@@ -353,7 +360,7 @@ class SidebarStore {
         };
     }
 }
-_SidebarStore_initialized = new WeakMap(), _SidebarStore_loadedFromStorage = new WeakMap(), _SidebarStore_loadedExpansionFromStorage = new WeakMap(), _SidebarStore_loadedPinnedFromStorage = new WeakMap(), _SidebarStore_onPinnedChange = new WeakMap(), _SidebarStore_appId = new WeakMap(), _SidebarStore_desktopOpen = new WeakMap(), _SidebarStore_instances = new WeakSet(), _SidebarStore_getStorageKey = function _SidebarStore_getStorageKey(suffix) {
+_SidebarStore_initialized = new WeakMap(), _SidebarStore_loadedFromStorage = new WeakMap(), _SidebarStore_loadedExpansionFromStorage = new WeakMap(), _SidebarStore_loadedPinnedFromStorage = new WeakMap(), _SidebarStore_onPinnedChange = new WeakMap(), _SidebarStore_appId = new WeakMap(), _SidebarStore_desktopOpen = new WeakMap(), _SidebarStore_searchSnapshot = new WeakMap(), _SidebarStore_instances = new WeakSet(), _SidebarStore_getStorageKey = function _SidebarStore_getStorageKey(suffix) {
     return __classPrivateFieldGet(this, _SidebarStore_appId, "f")
         ? `${STORAGE_PREFIX}-${__classPrivateFieldGet(this, _SidebarStore_appId, "f")}-${suffix}`
         : `${STORAGE_PREFIX}-${suffix}`;
@@ -372,9 +379,16 @@ _SidebarStore_initialized = new WeakMap(), _SidebarStore_loadedFromStorage = new
 }, _SidebarStore_persistExpansion = function _SidebarStore_persistExpansion() {
     if (typeof window === 'undefined')
         return;
+    // During a search the live sets hold temporary force-expansions; persist
+    // the user's real state instead.
+    const sections = __classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f")?.sections ?? this.expandedSections;
+    const items = __classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f")?.items ?? this.expandedItems;
     try {
-        localStorage.setItem(__classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_getStorageKey).call(this, 'sections'), JSON.stringify([...this.expandedSections]));
-        localStorage.setItem(__classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_getStorageKey).call(this, 'items'), JSON.stringify([...this.expandedItems]));
+        localStorage.setItem(__classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_getStorageKey).call(this, 'sections'), JSON.stringify([...sections]));
+        localStorage.setItem(__classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_getStorageKey).call(this, 'items'), JSON.stringify([...items]));
+        // The keys now exist: defaults applied "only when nothing is persisted"
+        // must stop, or they undo the user's toggle (same as #persist).
+        __classPrivateFieldSet(this, _SidebarStore_loadedExpansionFromStorage, true, "f");
     }
     catch {
         // localStorage not available
@@ -395,5 +409,26 @@ _SidebarStore_initialized = new WeakMap(), _SidebarStore_loadedFromStorage = new
         return;
     __classPrivateFieldSet(this, _SidebarStore_desktopOpen, this.isOpen, "f");
     __classPrivateFieldGet(this, _SidebarStore_instances, "m", _SidebarStore_persist).call(this);
+}, _SidebarStore_takeSearchSnapshot = function _SidebarStore_takeSearchSnapshot() {
+    if (__classPrivateFieldGet(this, _SidebarStore_searchSnapshot, "f"))
+        return;
+    __classPrivateFieldSet(this, _SidebarStore_searchSnapshot, {
+        sections: new Set(this.expandedSections),
+        items: new Set(this.expandedItems),
+    }, "f");
 };
+/** Copy of `set` with `id` expanded or collapsed; expanding closes `collapseOnExpand` (accordion). */
+function applyToggle(set, id, expand, collapseOnExpand) {
+    const next = new Set(set);
+    if (expand) {
+        next.add(id);
+        for (const other of collapseOnExpand)
+            if (other !== id)
+                next.delete(other);
+    }
+    else {
+        next.delete(id);
+    }
+    return next;
+}
 export const sidebarStore = new SidebarStore();

package/dist/lib/utils/media.js

@@ -614,10 +614,11 @@ export function buildEmbedSrc(provider, videoId, options = {}) {
         params.set('autoplay', '1');
     if (privacy)
         params.set('dnt', '1');
-    if (start !== undefined)
-        params.set('#t', `${Math.floor(start)}s`);
     const query = params.toString();
-    return `https://player.vimeo.com/video/${videoId}${query ? `?${query}` : ''}`;
+    // Vimeo reads the start time from the fragment (#t=30s), not the query;
+    // URLSearchParams would encode it as `%23t`, which Vimeo ignores.
+    const fragment = start !== undefined ? `#t=${Math.floor(start)}s` : '';
+    return `https://player.vimeo.com/video/${videoId}${query ? `?${query}` : ''}${fragment}`;
 }
 /**
  * Poster image URL for an embedded video, when one can be derived without a

package/dist/lib/utils/url.d.ts

@@ -0,0 +1,10 @@
+/**
+ * URL safety helpers for hrefs that come from config or API data.
+ */
+/**
+ * Return `url` when it is relative or uses a safe scheme (http, https, mailto,
+ * tel), otherwise `null`. Rejects `javascript:`, `data:`, `vbscript:` and the
+ * like, including obfuscated forms (leading whitespace, mixed case, embedded
+ * tabs/newlines), because the URL parser normalises those before the check.
+ */
+export declare function safeHref(url: string | null | undefined): string | null;

package/dist/lib/utils/url.js

@@ -0,0 +1,21 @@
+/**
+ * URL safety helpers for hrefs that come from config or API data.
+ */
+const SAFE_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:']);
+/**
+ * Return `url` when it is relative or uses a safe scheme (http, https, mailto,
+ * tel), otherwise `null`. Rejects `javascript:`, `data:`, `vbscript:` and the
+ * like, including obfuscated forms (leading whitespace, mixed case, embedded
+ * tabs/newlines), because the URL parser normalises those before the check.
+ */
+export function safeHref(url) {
+    if (typeof url !== 'string' || url.trim() === '')
+        return null;
+    try {
+        const parsed = new URL(url, 'https://relative.invalid');
+        return SAFE_PROTOCOLS.has(parsed.protocol) ? url : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/lib/utils.js

@@ -1,5 +1,18 @@
 import { clsx } from 'clsx';
-import { twMerge } from 'tailwind-merge';
+import { extendTailwindMerge } from 'tailwind-merge';
+/**
+ * tailwind-merge only knows Tailwind's default theme, so it reads the preset's
+ * custom font sizes (`text-h1`..`text-h6`, from `fontSize` in
+ * @classic-homes/theme-tailwind-preset) as text colours and drops a real colour
+ * such as `text-foreground` beside them. Register them as font sizes.
+ */
+const twMerge = extendTailwindMerge({
+    extend: {
+        classGroups: {
+            'font-size': [{ text: ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'] }],
+        },
+    },
+});
 /**
  * Utility function to merge Tailwind CSS classes
  * Uses clsx for conditional classes and tailwind-merge to handle conflicts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/theme-svelte",
-  "version": "1.21.0",
+  "version": "1.22.1",
   "description": "Svelte components for the Classic theme system",
   "type": "module",
   "svelte": "./dist/lib/index.js",
@@ -15,14 +15,15 @@
       "types": "./dist/lib/components/notifications/index.d.ts",
       "svelte": "./dist/lib/components/notifications/index.js",
       "default": "./dist/lib/components/notifications/index.js"
-    },
-    "./styles.css": "./dist/styles.css"
+    }
   },
   "sideEffects": [
     "*.css"
   ],
   "files": [
-    "dist"
+    "dist",
+    "!dist/__tests__",
+    "!dist/**/*.test.*"
   ],
   "scripts": {
     "build": "svelte-package -i src",

package/dist/__tests__/FileUpload.test.js

@@ -1,45 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { render, screen } from '@testing-library/svelte';
-import FileUpload from '../lib/components/FileUpload.svelte';
-describe('FileUpload accepted-types label', () => {
-    it('derives a friendly label from MIME types instead of showing raw values', () => {
-        render(FileUpload, {
-            props: {
-                label: 'Upload files',
-                acceptedTypes: [
-                    'image/jpeg',
-                    'image/png',
-                    'application/pdf',
-                    'video/mp4',
-                    'video/quicktime',
-                ],
-            },
-        });
-        expect(screen.getByText(/Images, PDF, Videos \(max/)).toBeInTheDocument();
-        // Raw MIME types should not be shown
-        expect(screen.queryByText(/image\/jpeg/)).not.toBeInTheDocument();
-    });
-    it('uses the default accepted types (Images, PDF) when none are provided', () => {
-        render(FileUpload, { props: { label: 'Upload files' } });
-        expect(screen.getByText(/^Images, PDF \(max/)).toBeInTheDocument();
-    });
-    it('respects an explicit typesLabel override', () => {
-        render(FileUpload, {
-            props: {
-                label: 'Upload files',
-                acceptedTypes: ['image/png', 'video/mp4'],
-                typesLabel: 'Photos and clips',
-            },
-        });
-        expect(screen.getByText(/^Photos and clips \(max/)).toBeInTheDocument();
-    });
-    it('falls back to the uppercased subtype for unmapped types', () => {
-        render(FileUpload, {
-            props: {
-                label: 'Upload files',
-                acceptedTypes: ['application/zip'],
-            },
-        });
-        expect(screen.getByText(/^ZIP \(max/)).toBeInTheDocument();
-    });
-});