@clepit/core 0.6.0-beta.416 → 0.6.0-beta.421

package/CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- `DrawContext.locale` and `DrawContext.defaultLocale`: `renderBlocks` draws each translated field in the language asked for, falling back to the page's own, and draws a translated document that names no language in the first of its languages, where it drew "[object Object]". A document with no translation draws exactly as before.
 - `EditorConfig.onClearRequest`: the toolbar's Clear awaits the host and empties the page only when it resolves `true`; a rejection leaves the page and is reported. Absent, Clear empties the page at once, as before. `@clepit/react`'s `ClepitEditor` forwards it through the same latest-props contract as `onChange`.
 - `EditorConfig.dialogLabels` and `DIALOG_LABELS`: the link, tooltip and status dialogs draw the host's words (titles, field labels, placeholders, the status variants, Cancel and Apply), in English when absent. Each dialog element carries a test id (`link-dialog-title`, `status-dialog-variant-success` and the rest).
 - Six `blockToolbarLabels` keys for the image block's own words: `imageDropTitle`, `imageDropAction`, `imageDropFormats`, `imageUploading`, `imageUploadFailed` and `imageInvalidType`, in English when absent. The drop area's delete button takes the `delete` label as its tooltip and its `aria-label`. Each state carries a test id (`image-drop`, `image-drop-title`, `image-uploading`, `image-upload-failed`, `image-invalid-type` and the rest).
@@ -17,7 +18,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `PublicPage.scheme`: `renderPage` draws the page in `light` or `dark` only, by setting `data-clepit-theme` on `<body>` (the attribute the theme's tokens resolve under) and a `color-scheme` meta so the browser's own canvas and text follow it. A page passing no scheme renders exactly as before.
 
 ### Fixed
+- An editor given `locale` kept only the language being edited: an edit replaced a field's map of languages with one string. The editor now keeps each block's stored data and writes an edit back into it with the rule both twins share, on every way a block leaves it (`onChange`, `data.extract()`, `blocks.get` and `blocks.getAll`), while `blocks.insert`, `blocks.update` and `data.set` take stored data and show it in the language being edited. A converted block keeps the languages of the fields both types share.
+- An editor given no `locale` drew a translated field as "[object Object]". It now shows a translated document in the first of its languages, and keeps the others through an edit.
 - The inline toolbar no longer leaves a hidden copy of the rewrite menu behind each time a new selection repaints it, so each rewrite action exists once in the page.
+- A rewrite that the host's `onInlineRewrite` rejects is reported with `console.error`, and the passage stays as it was; it vanished silently before. A failure inside the inline or block toolbar now reaches the page's error reporting instead of being caught and dropped.
+
+### Security
+- Every block sanitises its stored markup when it draws it, on the editing path and the reading path alike, and the DOM backing's `setHtml` sanitises like the string backing. A paragraph, header, quote, alert, list or checklist item, or an image, video or audio caption stored with an event handler (by a client writing the document directly, for instance) no longer runs it in the browser of whoever opens the page.
+- `sanitizeHtml` parses into a document from `document.implementation.createHTMLDocument`, which has no browsing context, so markup is never handed to the live page while it is cleaned, and drops `javascript:`, `data:` and `vbscript:` link targets, as `sanitizeHtmlWithoutDom` already did. It still needs only `document`.
+- `sanitizeHtmlWithoutDom` reads a tag as a browser does: a quote opens a value only after `=` and is an ordinary character in a name or an unquoted value, a tag the input ends inside is dropped, and comments and declarations are dropped. A `<` or `>` left in text is escaped. One stray quote in a tag (`<img src=x onerror=alert(1) a"b>`) used to carry the whole tag, handler included, into every page drawn with `renderBlocks` or `renderPage`.
+- An issue chip, an issue card and a Linked issues row draw their link only for an http or https address, and a chip read back from a page or from markup keeps no other link or avatar address. A stored `javascript:` issue URL used to be redrawn as a live link.
 
 ## [0.6.0] - 2026-09-25
 

package/dist/core/editor/index.d.ts

@@ -1,5 +1,6 @@
 import { EditorAPI, EditorConfig } from '../../types';
 export declare class Editor {
+    private static sources;
     static create(config: EditorConfig): EditorAPI;
     private static initialize;
     /**
@@ -12,6 +13,10 @@ export declare class Editor {
      * change when they switched.
      */
     private static localizeData;
+    private static localizeBlock;
+    private static localizeArriving;
+    private static delocalizeBlock;
+    private static delocalizeData;
     private static render;
     /** Releases the runtime a container holds and leaves its document in the
      *  store. `create` runs this first so a second create in the same container

package/dist/core/element/index.d.ts

@@ -21,10 +21,9 @@ export type ClepitElement = {
     /**
      * Assign markup.
      *
-     * The DOM backing hands this to the browser's parser. The string backing has
-     * no parser, so it runs the value through the sanitiser it was constructed
-     * with — without that, stored document content would emit arbitrary markup
-     * into a server-rendered page.
+     * Both backings sanitise it, because stored document content is not trusted:
+     * the DOM backing with the editor's own sanitiser, the string backing (which
+     * has no parser) with the one it was constructed with.
      */
     setHtml(html: string): void;
     append(child: ClepitElement): void;
@@ -66,6 +65,8 @@ export type DrawContext = {
     issueChip?: IssueChipParts;
     /** Translated issue words; English fallbacks otherwise. */
     issueLabels?: Partial<Record<IssueLabel, string>>;
+    locale?: string;
+    defaultLocale?: string;
 };
 export type Backing = {
     create(tag: string): ClepitElement;

package/dist/core/i18n/index.d.ts

@@ -40,4 +40,9 @@ export declare const resolveLocalized: <T>(value: Localized<T> | undefined, requ
  * changes shape.
  */
 export declare const withLocale: <T>(value: Localized<T> | undefined, locale: string, next: T, documentDefault: string) => Localized<T>;
+export declare const writeBlockData: (blockType: string, stored: Record<string, unknown> | undefined, edited: Record<string, unknown>, locale: string, documentDefault: string) => Record<string, unknown>;
+export declare const firstLocaleOf: (blocks: {
+    data: unknown;
+    type: string;
+}[]) => string | undefined;
 //# sourceMappingURL=index.d.ts.map