@clepit/core 0.6.0-beta.417 → 0.6.0-beta.422

package/CHANGELOG.md

@@ -16,11 +16,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `PublicPage.alternates` and `PublicPage.notice`: `renderPage` writes one `<link rel="alternate">` per hreflang and address pair, and draws the notice (a title and a line, test id `public-page-notice`) below the page title with its own styles. A page passing neither renders exactly as before.
 - `pageMetadata`, `renderNotice` and `noticeStylesheet`: a host that frames a public page in its own chrome writes the page's description, canonical, language and link-preview tags and draws its language notice exactly as `renderPage` does, which now draws both through them.
 - `PublicPage.scheme`: `renderPage` draws the page in `light` or `dark` only, by setting `data-clepit-theme` on `<body>` (the attribute the theme's tokens resolve under) and a `color-scheme` meta so the browser's own canvas and text follow it. A page passing no scheme renders exactly as before.
+- `ClepitError` and `ClepitErrorCode`: the package names its own failures by code. `Renderer.render` given a container id that matches no element throws a `ClepitError` with the code `CONTAINER_MISSING`, where it threw a plain `Error`; the message is unchanged, and it is still an `Error`.
 
 ### Fixed
 - An editor given `locale` kept only the language being edited: an edit replaced a field's map of languages with one string. The editor now keeps each block's stored data and writes an edit back into it with the rule both twins share, on every way a block leaves it (`onChange`, `data.extract()`, `blocks.get` and `blocks.getAll`), while `blocks.insert`, `blocks.update` and `data.set` take stored data and show it in the language being edited. A converted block keeps the languages of the fields both types share.
 - An editor given no `locale` drew a translated field as "[object Object]". It now shows a translated document in the first of its languages, and keeps the others through an edit.
 - The inline toolbar no longer leaves a hidden copy of the rewrite menu behind each time a new selection repaints it, so each rewrite action exists once in the page.
+- A rewrite that the host's `onInlineRewrite` rejects is reported with `console.error`, and the passage stays as it was; it vanished silently before. A failure inside the inline or block toolbar now reaches the page's error reporting instead of being caught and dropped.
+
+### Security
+- Every block sanitises its stored markup when it draws it, on the editing path and the reading path alike, and the DOM backing's `setHtml` sanitises like the string backing. A paragraph, header, quote, alert, list or checklist item, or an image, video or audio caption stored with an event handler (by a client writing the document directly, for instance) no longer runs it in the browser of whoever opens the page.
+- `sanitizeHtml` parses into a document from `document.implementation.createHTMLDocument`, which has no browsing context, so markup is never handed to the live page while it is cleaned, and drops `javascript:`, `data:` and `vbscript:` link targets, as `sanitizeHtmlWithoutDom` already did. It still needs only `document`.
+- `sanitizeHtmlWithoutDom` reads a tag as a browser does: a quote opens a value only after `=` and is an ordinary character in a name or an unquoted value, a tag the input ends inside is dropped, and comments and declarations are dropped. A `<` or `>` left in text is escaped. One stray quote in a tag (`<img src=x onerror=alert(1) a"b>`) used to carry the whole tag, handler included, into every page drawn with `renderBlocks` or `renderPage`.
+- An issue chip, an issue card and a Linked issues row draw their link only for an http or https address, and a chip read back from a page or from markup keeps no other link or avatar address. A stored `javascript:` issue URL used to be redrawn as a live link.
 
 ## [0.6.0] - 2026-09-25
 

package/dist/core/editor/views/json.d.ts

@@ -4,6 +4,7 @@ export declare class JsonView {
     private static removeEventListeners;
     private static handleJsonInput;
     private static validateAndUpdateJson;
+    private static markInvalid;
     static destroy(containerId: string): void;
 }
 //# sourceMappingURL=json.d.ts.map

package/dist/core/element/index.d.ts

@@ -21,10 +21,9 @@ export type ClepitElement = {
     /**
      * Assign markup.
      *
-     * The DOM backing hands this to the browser's parser. The string backing has
-     * no parser, so it runs the value through the sanitiser it was constructed
-     * with — without that, stored document content would emit arbitrary markup
-     * into a server-rendered page.
+     * Both backings sanitise it, because stored document content is not trusted:
+     * the DOM backing with the editor's own sanitiser, the string backing (which
+     * has no parser) with the one it was constructed with.
      */
     setHtml(html: string): void;
     append(child: ClepitElement): void;

package/dist/core/errors.d.ts

@@ -0,0 +1,6 @@
+export type ClepitErrorCode = 'CONTAINER_MISSING';
+export declare class ClepitError extends Error {
+    readonly code: ClepitErrorCode;
+    constructor(code: ClepitErrorCode, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { Editor } from './core/editor';
 export { type Backing, type ClepitElement, type DrawContext, domBacking, renderToString, stringBacking, toDomElement } from './core/element';
+export { ClepitError, type ClepitErrorCode } from './core/errors';
 export { StyleManager } from './core/managers/style';
 export { Renderer } from './core/renderer';
 export { activateBlocks } from './core/renderer/activate';