@cyberskill/design 1.5.0 → 1.5.1

package/templates/vn-termination-decision/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/vn-total-rewards-appendix/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/vn-training-commitment/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/vn-travel-expense-policy/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/tokens/element-seeds.json

@@ -1,7 +1,7 @@
 {
   "$meta": {
     "system": "CyberSkill Design System",
-    "version": "1.5.0",
+    "version": "1.5.1",
     "note": "OKLCH seed contract for the 15 element packs × light/dark (30 sets). SoT for scripts/generate-element-packs.mjs — do not hand-edit tokens/elements.css. Owner bar (Jul 2026): soft/middle/deep clearly distinct; middle intensity synced across elements; harmonious role palettes; light↔dark same-hue identity. Public variant names unchanged."
   },
   "intensity": {

package/tokens/native/CSTokens.kt

@@ -1,6 +1,6 @@
 // CyberSkill Design System — native design tokens.
 // GENERATED from tokens/tokens.dtcg.json — do not hand-edit; regenerate on token change.
-// release v1.5.0 · source sha256 ec2b32d8928c3725…
+// release v1.5.1 · source sha256 6777be7e2f0abb1f…
 // conversions: rem→px at 16 · em→…Em relative doubles · rgba alpha→ARGB byte (round(a*255)) · durations in ms
 // dark element packs: see $extensions.overrides.elementsDark
 // provenance: tokens/provenance.json · parity gate: _audit/token-pipeline-test.html

package/tokens/native/CSTokens.swift

@@ -1,6 +1,6 @@
 // CyberSkill Design System — native design tokens.
 // GENERATED from tokens/tokens.dtcg.json — do not hand-edit; regenerate on token change.
-// release v1.5.0 · source sha256 ec2b32d8928c3725…
+// release v1.5.1 · source sha256 6777be7e2f0abb1f…
 // conversions: rem→px at 16 · em→…Em relative doubles · rgba alpha→ARGB byte (round(a*255)) · durations in ms
 // dark element packs: see $extensions.overrides.elementsDark
 // provenance: tokens/provenance.json · parity gate: _audit/token-pipeline-test.html

package/tokens/native/cs_tokens.dart

@@ -1,6 +1,6 @@
 // CyberSkill Design System — native design tokens.
 // GENERATED from tokens/tokens.dtcg.json — do not hand-edit; regenerate on token change.
-// release v1.5.0 · source sha256 ec2b32d8928c3725…
+// release v1.5.1 · source sha256 6777be7e2f0abb1f…
 // conversions: rem→px at 16 · em→…Em relative doubles · rgba alpha→ARGB byte (round(a*255)) · durations in ms
 // dark element packs: see $extensions.overrides.elementsDark
 // provenance: tokens/provenance.json · parity gate: _audit/token-pipeline-test.html

package/tokens/provenance.json

@@ -1,10 +1,10 @@
 {
   "system": "CyberSkill Design System",
-  "release": "1.5.0",
+  "release": "1.5.1",
   "source": "tokens/tokens.dtcg.json",
-  "sourceSha256": "ec2b32d8928c3725d74c99ca770c2343d7ec00594170796103bb1993cc1bf702",
+  "sourceSha256": "6777be7e2f0abb1f584895195c14422ce0c2c4014131fffd09184d448fbe9fb7",
   "dtcgStamp": {
-    "version": "1.5.0",
+    "version": "1.5.1",
     "generated": "2026-07-23"
   },
   "conversions": {
@@ -36,17 +36,17 @@
     {
       "file": "tokens/native/CSTokens.swift",
       "lang": "swift",
-      "sha256": "f962fa5348e5565c528b20328777613a88efb0c2d41941e7d24ed6b80336961f"
+      "sha256": "5f20925cda544afea83eaa8aed92a089dc59a90901f1b9c28369ab60f1cbc428"
     },
     {
       "file": "tokens/native/CSTokens.kt",
       "lang": "kotlin",
-      "sha256": "ef9e6cf8721cca6f2be599a66594402c46001b11e5490ff005b270213bb3f1cc"
+      "sha256": "f5fda78ec741016205d6c807b70ce2fc728700e1cd542e22750cdea7cce3674f"
     },
     {
       "file": "tokens/native/cs_tokens.dart",
       "lang": "dart",
-      "sha256": "46a042ef79e1f90f5dafdeab7dd6750d47ee74ef0263da5c7f71b1f4a1ba6202"
+      "sha256": "b0be5bb6c2c832aa84d06da1e841b4f2d53108e8b6528092d22299fa9a897f5d"
     }
   ]
 }

package/tokens/tokens.dtcg.json

@@ -3,7 +3,7 @@
   "$extensions": {
     "com.cyberskill": {
       "system": "CyberSkill Design System",
-      "version": "1.5.0",
+      "version": "1.5.1",
       "generated": "2026-07-23",
       "source": "tokens/tokens.json",
       "note": "Scope overrides (dark/system theme · 15 element×variant packs) are carried under $extensions.overrides keyed by CSS selector — apply the matching selector on :root/ancestor to activate.",

package/tokens/tokens.js

@@ -1,8 +1,8 @@
-// CyberSkill design tokens — generated from tokens/*.css (v1.5.0). Do not edit by hand.
+// CyberSkill design tokens — generated from tokens/*.css (v1.5.1). Do not edit by hand.
 export const tokens = {
   "$meta": {
     "system": "CyberSkill Design System",
-    "version": "1.5.0",
+    "version": "1.5.1",
     "generated": "2026-07-23",
     "note": "Generated from tokens/*.css. Root grouped by category; theme/element scopes carry overrides only. Regenerate after any token change (see docs/conventions.md)."
   },

package/tokens/tokens.json

@@ -1,7 +1,7 @@
 {
   "$meta": {
     "system": "CyberSkill Design System",
-    "version": "1.5.0",
+    "version": "1.5.1",
     "generated": "2026-07-23",
     "note": "Generated from tokens/*.css. Root grouped by category; theme/element scopes carry overrides only. Regenerate after any token change (see docs/conventions.md)."
   },