@diagrammo/dgmo 0.85.0 → 0.87.0

package/dist/{dgmo-router-VILEOWQ2.js → dgmo-router-F2DSURTR.js}

@@ -6,7 +6,7 @@ import {
   isExtendedChartType,
   knownChartTypeIds,
   parseDgmo
-} from "./chunk-T327J6CE.js";
+} from "./chunk-MSXRNVHB.js";
 import "./chunk-EOYPX6SF.js";
 import "./chunk-WP2RLGDI.js";
 import "./chunk-A2RUBBVT.js";
@@ -46,11 +46,11 @@ import {
   looksLikeC4,
   looksLikeGantt,
   parseDgmoChartType
-} from "./chunk-JVRDKR5R.js";
+} from "./chunk-AQIBKTPG.js";
 import "./chunk-3RYBTEF5.js";
 import "./chunk-UNNJCSSQ.js";
 import "./chunk-3TYUXC7D.js";
-import "./chunk-HMWZQ53A.js";
+import "./chunk-7WGCQE2E.js";
 import "./chunk-EQW6HOP4.js";
 import "./chunk-DAOFNU6J.js";
 import "./chunk-VPASQOR3.js";
@@ -72,7 +72,7 @@ import "./chunk-HSRQDWV7.js";
 import "./chunk-4WW3SGMH.js";
 import "./chunk-L5AFONQU.js";
 import "./chunk-44GP7PD5.js";
-import "./chunk-23RWHHI5.js";
+import "./chunk-5NU7NII2.js";
 import "./chunk-IDJGV6VM.js";
 import "./chunk-7HWY4QAJ.js";
 import "./chunk-2M4IGSCY.js";

package/dist/{dimensions-F3Y5T54V.js → dimensions-6QAWEGIR.js}

@@ -1,8 +1,8 @@
 import {
   mapContentAspect,
   mapExportDimensions
-} from "./chunk-UGYZ5Q5Y.js";
-import "./chunk-3MXJMZAN.js";
+} from "./chunk-VJ2KROJ5.js";
+import "./chunk-BV6PKJUS.js";
 import "./chunk-4QV26TEG.js";
 import "./chunk-KMU65FYM.js";
 import "./chunk-VLC6WNRD.js";

package/dist/{flowchart-renderer-TGQL4S4L.js → flowchart-renderer-THC6Y7EH.js}

@@ -1,19 +1,20 @@
 import {
   renderFlowchart,
   renderFlowchartForExport
-} from "./chunk-LQSNWE3W.js";
+} from "./chunk-XUDGZJTJ.js";
 import "./chunk-26EVL454.js";
-import "./chunk-PBEH52A2.js";
-import "./chunk-5JO443MB.js";
+import "./chunk-ZNNVI5SR.js";
+import "./chunk-HAH5X345.js";
 import "./chunk-XBJJP2HN.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-EPDBWATV.js";
 import "./chunk-24YPR5EH.js";
-import "./chunk-IIEI7VK5.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-LD2JSKU3.js";
 import "./chunk-VLC6WNRD.js";
 import "./chunk-ICLB27PZ.js";

package/dist/index.d.ts

@@ -102,6 +102,73 @@ declare function attachDataChartInteractions(svg: SVGSVGElement, opts?: DataChar
 declare const D3_DATA_CHART_TYPES: Set<string>;
 declare function supportsD3DataChart(type: string): boolean;
 
+/**
+ * The supported sanitizing boundary for renderer output that is about to land
+ * in a live document.
+ *
+ * Renderer output is trusted only as far as the renderer that produced it, and
+ * every host — the desktop app, the web editor, Obsidian, the script-tag
+ * drop-ins, this library's own `mountD3DataChart` — puts that output into the
+ * DOM. This module is what they call first. It lives here, beside `safe-href`,
+ * rather than inside `src/auto/shared.ts` where it started: that module is the
+ * browser-embed bundle's private toolbox, reachable only from the two IIFE
+ * script-tag builds, so a host importing `@diagrammo/dgmo` could not call the
+ * sanitizer at all however much it wanted to.
+ *
+ * 🔴 **Parse into a DETACHED holder, take the `<svg>`, sanitize, insert.** All
+ * four steps, in that order:
+ *
+ * ```ts
+ * const holder = document.createElement('div');
+ * holder.innerHTML = svg;          // inert: nothing here is connected yet
+ * const svgEl = holder.querySelector('svg');
+ * if (svgEl) {
+ *   sanitizeSvgInPlace(svgEl);
+ *   container.replaceChildren(svgEl);
+ * }
+ * ```
+ *
+ * Sanitizing *after* assigning into a live container is too late: connecting
+ * the subtree is what creates a nested browsing context for an `<iframe>` and
+ * runs a custom element's `connectedCallback`, both synchronously inside the
+ * assignment. And taking only the `<svg>` is half the safety — moving every
+ * child of the holder across would connect whatever a hostile document put
+ * *beside* the diagram. `auto/index.ts` and `element/index.ts` have always done
+ * both; `mount.ts` learned them on diagrammo/diagrammo#884.
+ *
+ * 🔴 **What this does NOT do**, so a caller is not misled about the contract:
+ *
+ * - It does not parse CSS. An `@import` or a `url()` inside a `<style>`
+ *   element passes through untouched.
+ * - It removes the elements listed in `REMOVED_TAGS` and nothing else. That
+ *   set is the script-execution and remote-content surface as of
+ *   diagrammo/diagrammo#884; an element neither it nor the attribute scrub
+ *   below names survives, so a caller sanitizing *arbitrary* HTML rather than
+ *   dgmo renderer output needs its own allowlist on top.
+ * - It does not stop a resource load that an attribute alone starts —
+ *   `<img src>` fetches whether or not the node is connected. What protects
+ *   that case is the `on*` strip, not the detached holder.
+ * - It is no substitute for escaping where a renderer interpolates author
+ *   text (see `src/embed/escape.ts`).
+ *
+ * Browser-only — it needs a live DOM. There is nothing to sanitize on the
+ * rasterising path, which never builds a document.
+ */
+/**
+ * Strip script-execution surface from a freshly parsed SVG tree before it
+ * lands in the live DOM. This is the safety net that lets us build SVG from
+ * markup without trusting renderer output to be fully sanitized.
+ *
+ * Removes every element in `REMOVED_TAGS`, any SMIL element animating an
+ * `href`, any `on*` event-handler attribute, and any `href`/`xlink:href`
+ * failing the `safeHref` allowlist.
+ *
+ * Mutates `root` and returns nothing. Call it on a detached holder — see the
+ * module comment above for why the order matters, and for what this does not
+ * cover.
+ */
+declare function sanitizeSvgInPlace(root: Element): void;
+
 /**
  * The full diagnostic catalog, sorted by code. Every coded diagnostic
  * dgmo can emit — its severity, owning chart type, canonical message,
@@ -206,4 +273,4 @@ interface DecodedDiagramUrl {
  */
 declare function decodeDiagramUrl(url: string): DecodedDiagramUrl | null;
 
-export { CompactViewState, D3_DATA_CHART_TYPES, type DataChartInteractionOpts, type DecodedDiagramUrl, DgmoError, DiagnosticSpec, type EncodeDiagramUrlOptions, MapDataSource, type MountD3Opts, type MountedD3Chart, type NormalizeSvgForEmbedOptions, PaletteConfig, type RenderOptions, type RenderResult, Theme, attachDataChartInteractions, decodeDiagramUrl, defaultEmbedBackground, encodeDiagramUrl, getDiagnosticSpec, getEmbedSvgViewBox, listDiagnosticCodes, mountD3DataChart, normalizeSvgForEmbed, render, supportsD3DataChart };
+export { CompactViewState, D3_DATA_CHART_TYPES, type DataChartInteractionOpts, type DecodedDiagramUrl, DgmoError, DiagnosticSpec, type EncodeDiagramUrlOptions, MapDataSource, type MountD3Opts, type MountedD3Chart, type NormalizeSvgForEmbedOptions, PaletteConfig, type RenderOptions, type RenderResult, Theme, attachDataChartInteractions, decodeDiagramUrl, defaultEmbedBackground, encodeDiagramUrl, getDiagnosticSpec, getEmbedSvgViewBox, listDiagnosticCodes, mountD3DataChart, normalizeSvgForEmbed, render, sanitizeSvgInPlace, supportsD3DataChart };

package/dist/index.js

@@ -9,17 +9,20 @@ import {
   searchMapLocations,
   themes
 } from "./chunk-SQAG3UXH.js";
+import {
+  safeHref
+} from "./chunk-Z6DXWULM.js";
 import {
   render
-} from "./chunk-ADAGWVWJ.js";
+} from "./chunk-PJQZWJ5I.js";
 import {
   renderErrorCard
-} from "./chunk-OZTDXMRQ.js";
+} from "./chunk-D4M25W6R.js";
 import {
   getDiagnosticSpec,
   listDiagnosticCodes,
   parseDgmo
-} from "./chunk-T327J6CE.js";
+} from "./chunk-MSXRNVHB.js";
 import "./chunk-EOYPX6SF.js";
 import "./chunk-WP2RLGDI.js";
 import "./chunk-A2RUBBVT.js";
@@ -34,12 +37,12 @@ import "./chunk-KMU65FYM.js";
 import "./chunk-EPDBWATV.js";
 import "./chunk-7UDAIP6W.js";
 import "./chunk-2CW5ZTNH.js";
-import "./chunk-ULCB4BLF.js";
+import "./chunk-LPXC4I4R.js";
 import "./chunk-YRYKTYMQ.js";
 import "./chunk-24YPR5EH.js";
 import {
   GRID_DASH
-} from "./chunk-IIEI7VK5.js";
+} from "./chunk-XCKNFFKM.js";
 import "./chunk-RE6TVIAV.js";
 import "./chunk-QFIXL3OK.js";
 import "./chunk-3DOQOXXI.js";
@@ -82,11 +85,11 @@ import {
   decodeDiagramUrl,
   encodeDiagramUrl
 } from "./chunk-RE27AX7O.js";
-import "./chunk-JVRDKR5R.js";
+import "./chunk-AQIBKTPG.js";
 import "./chunk-3RYBTEF5.js";
 import "./chunk-UNNJCSSQ.js";
 import "./chunk-3TYUXC7D.js";
-import "./chunk-HMWZQ53A.js";
+import "./chunk-7WGCQE2E.js";
 import "./chunk-EQW6HOP4.js";
 import "./chunk-DAOFNU6J.js";
 import "./chunk-VPASQOR3.js";
@@ -110,7 +113,7 @@ import "./chunk-L5AFONQU.js";
 import {
   chartTypes
 } from "./chunk-44GP7PD5.js";
-import "./chunk-23RWHHI5.js";
+import "./chunk-5NU7NII2.js";
 import {
   getPalette,
   palettes,
@@ -124,6 +127,50 @@ import {
 } from "./chunk-BYU54C3S.js";
 import "./chunk-5WRI5ZAA.js";
 
+// src/utils/sanitize-svg.ts
+var XLINK_NS = "http://www.w3.org/1999/xlink";
+var REMOVED_TAGS = "script, foreignObject, iframe, object, embed, frame, base, link, meta";
+var ANIMATION_TAGS = new Set(
+  ["animate", "set", "animateTransform", "animateMotion"].map(
+    (t) => t.toLowerCase()
+  )
+);
+var ANIMATED_URL_ATTRS = /* @__PURE__ */ new Set(["href", "xlink:href"]);
+function isUrlAnimation(node) {
+  if (!ANIMATION_TAGS.has(node.localName.toLowerCase())) return false;
+  const target = (node.getAttribute("attributeName") ?? "").trim().toLowerCase();
+  return ANIMATED_URL_ATTRS.has(target);
+}
+function scrubElement(node) {
+  for (const attr of Array.from(node.attributes)) {
+    if (attr.name.toLowerCase().startsWith("on")) {
+      node.removeAttribute(attr.name);
+    }
+  }
+  if (node.hasAttribute("href")) {
+    const safe = safeHref(node.getAttribute("href"));
+    if (safe === null) node.removeAttribute("href");
+  }
+  if (node.hasAttributeNS(XLINK_NS, "href")) {
+    const v = node.getAttributeNS(XLINK_NS, "href");
+    if (safeHref(v) === null) {
+      node.removeAttributeNS(XLINK_NS, "href");
+    }
+  }
+}
+function sanitizeSvgInPlace(root) {
+  const dangerous = root.querySelectorAll(REMOVED_TAGS);
+  dangerous.forEach((n) => n.remove());
+  const all = [root, ...Array.from(root.querySelectorAll("*"))];
+  for (const node of all) {
+    if (isUrlAnimation(node)) {
+      node.remove();
+      continue;
+    }
+    scrubElement(node);
+  }
+}
+
 // src/charts-d3/interactions.ts
 var NS = "http://www.w3.org/2000/svg";
 var STYLE_ID = "dgmo-chart-interactions-style";
@@ -134,7 +181,8 @@ function ensureStyle(svg, muted) {
   style.id = STYLE_ID;
   style.textContent = `
     .dgmo-series,.dgmo-datum,.dgmo-tick,.dgmo-ptlabel{transition:opacity .12s ease}
-    .dgmo-series.dgmo-dim,.dgmo-datum.dgmo-dim,.dgmo-ptlabel.dgmo-dim{opacity:.18}
+    [data-legend-entry]{transition:opacity .12s ease}
+    .dgmo-series.dgmo-dim,.dgmo-datum.dgmo-dim,.dgmo-ptlabel.dgmo-dim,[data-legend-entry].dgmo-dim{opacity:.18}
     .dgmo-tick.dgmo-faded{opacity:.22}
     .dgmo-datum{cursor:pointer}
     .dgmo-axis-label{cursor:pointer}
@@ -177,6 +225,9 @@ function attachDataChartInteractions(svg, opts = {}) {
     svg.querySelectorAll(".dgmo-series")
   );
   const datums = Array.from(svg.querySelectorAll(".dgmo-datum"));
+  const legendEntries = Array.from(
+    svg.querySelectorAll(".chart-legend [data-legend-entry]")
+  );
   const circles = Array.from(
     svg.querySelectorAll(".dgmo-pt")
   );
@@ -247,6 +298,15 @@ function attachDataChartInteractions(svg, opts = {}) {
   const ptLabels = Array.from(
     svg.querySelectorAll(".dgmo-ptlabel")
   );
+  const dimLegendExcept = (el) => {
+    const name = el?.getAttribute("data-series-name") ?? el?.getAttribute("data-emph-key") ?? null;
+    const paired = name != null && legendEntries.some((e) => e.getAttribute("data-series-name") === name);
+    for (const e of legendEntries)
+      e.classList.toggle(
+        "dgmo-dim",
+        paired && e.getAttribute("data-series-name") !== name
+      );
+  };
   const dimDatumsExcept = (el) => {
     for (const d of datums) d.classList.toggle("dgmo-dim", d !== el);
     const line = el?.getAttribute("data-line-number");
@@ -255,6 +315,7 @@ function attachDataChartInteractions(svg, opts = {}) {
         "dgmo-dim",
         line == null || l.getAttribute("data-line-number") !== line
       );
+    dimLegendExcept(el);
   };
   const dimByKey = (el) => {
     const key = el.getAttribute("data-emph-key");
@@ -263,11 +324,13 @@ function attachDataChartInteractions(svg, opts = {}) {
       if (key) d.classList.toggle("dgmo-dim", dk !== key);
       else d.classList.toggle("dgmo-dim", d !== el);
     }
+    dimLegendExcept(el);
   };
   const clearDim = () => {
     for (const d of datums) d.classList.remove("dgmo-dim");
     for (const g of seriesGroups) g.classList.remove("dgmo-dim");
     for (const l of ptLabels) l.classList.remove("dgmo-dim");
+    for (const e of legendEntries) e.classList.remove("dgmo-dim");
     reapplyAxisPin();
   };
   let axisPin = null;
@@ -513,9 +576,6 @@ function attachDataChartInteractions(svg, opts = {}) {
     svg.addEventListener("mousemove", onSvgMove);
   svg.addEventListener("mouseleave", onLeave);
   svg.addEventListener("click", onClick);
-  const legendEntries = Array.from(
-    svg.querySelectorAll(".chart-legend [data-legend-entry]")
-  );
   const emphasizeSeries = (name) => {
     for (const g of seriesGroups) {
       const sn = g.getAttribute("data-series-name");
@@ -637,7 +697,14 @@ function mountD3DataChart(container, content, opts = {}) {
       interaction.destroy();
       interaction = null;
     }
-    container.innerHTML = svg;
+    const holder = document.createElement("div");
+    holder.innerHTML = svg;
+    const parsed = holder.querySelector("svg");
+    container.innerHTML = "";
+    if (parsed) {
+      sanitizeSvgInPlace(parsed);
+      container.append(parsed);
+    }
     const el = container.querySelector("svg");
     if (el) {
       const pal = paletteOf(current);
@@ -750,6 +817,7 @@ export {
   palettes,
   render2 as render,
   resolvePaletteOrFallback,
+  sanitizeSvgInPlace,
   searchMapLocations,
   supportsD3DataChart,
   themes,

package/dist/{layout-WZCXK7DF.js → layout-5NPBHV5F.js}

@@ -1,8 +1,8 @@
 import {
   layoutMindmap
-} from "./chunk-ZUUNTOMG.js";
+} from "./chunk-UIUXIDBX.js";
 import "./chunk-24YPR5EH.js";
-import "./chunk-IIEI7VK5.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-IYULMRBE.js";
 import "./chunk-L5AFONQU.js";

package/dist/{layout-WXVGMSI3.js → layout-5VSMZPMG.js}

@@ -1,9 +1,9 @@
 import {
   focusFamily,
   layoutFamily
-} from "./chunk-XXAZ5C4K.js";
+} from "./chunk-IJ27L3R4.js";
 import "./chunk-IVKC4GID.js";
-import "./chunk-IIEI7VK5.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-QQJUTGQH.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-5WRI5ZAA.js";

package/dist/{layout-CFTB7GKV.js → layout-BOVTLAOT.js}

@@ -1,14 +1,15 @@
 import {
   computeNodeSize,
   layoutBoxesAndLines
-} from "./chunk-Y7FTHOMD.js";
-import "./chunk-WTTIODDV.js";
-import "./chunk-HBCAY3KR.js";
+} from "./chunk-XIFK423U.js";
+import "./chunk-QT3KDDXK.js";
+import "./chunk-HTNLLT34.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-O753JUEZ.js";

package/dist/{layout-K6NI4VCS.js → layout-CUFA7XJD.js}

@@ -6,8 +6,8 @@ import {
   layoutC4Context,
   layoutC4Deployment,
   rollUpContextRelationships
-} from "./chunk-A4PHPKNR.js";
-import "./chunk-IIEI7VK5.js";
+} from "./chunk-DAX42XVH.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-RH2PROYG.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-L5AFONQU.js";

package/dist/{layout-6JARW64V.js → layout-EHTYSMV4.js}

@@ -1,12 +1,13 @@
 import {
   layoutERDiagram
-} from "./chunk-FAV4RDVT.js";
-import "./chunk-HBCAY3KR.js";
+} from "./chunk-2A4DQAXG.js";
+import "./chunk-HTNLLT34.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-O753JUEZ.js";

package/dist/{layout-NB7TKAWN.js → layout-LUQKAGGT.js}

@@ -1,7 +1,7 @@
 import {
   layoutSitemap
-} from "./chunk-NSS2EF5B.js";
-import "./chunk-IIEI7VK5.js";
+} from "./chunk-AAMCXQPP.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-RH2PROYG.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-L5AFONQU.js";

package/dist/{layout-YELNBVPC.js → layout-P6DTD4RT.js}

@@ -1,12 +1,13 @@
 import {
   layoutClassDiagram
-} from "./chunk-BP4BT5TH.js";
-import "./chunk-HBCAY3KR.js";
+} from "./chunk-CLQIXD2C.js";
+import "./chunk-HTNLLT34.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-O753JUEZ.js";

package/dist/{layout-PT7IKVCV.js → layout-QX5T6ZNE.js}

@@ -1,7 +1,7 @@
 import {
   layoutOrg
-} from "./chunk-LRNIYQ6Y.js";
-import "./chunk-IIEI7VK5.js";
+} from "./chunk-33FQ6HNV.js";
+import "./chunk-XCKNFFKM.js";
 import "./chunk-RH2PROYG.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-L5AFONQU.js";

package/dist/layout-RANVNAKI.js

@@ -0,0 +1,10 @@
+import {
+  layoutSwimlane
+} from "./chunk-AUS7V54P.js";
+import "./chunk-EJS3K44P.js";
+import "./chunk-QT3KDDXK.js";
+import "./chunk-KAO7JL4I.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  layoutSwimlane
+};

package/dist/{layout-FMKSENGL.js → layout-XUW444O5.js}

@@ -1,11 +1,12 @@
 import {
   layoutGraph
-} from "./chunk-PBEH52A2.js";
+} from "./chunk-ZNNVI5SR.js";
 import "./chunk-6EK55ART.js";
-import "./chunk-ZGHV4QLK.js";
+import "./chunk-RJNZHFNG.js";
 import "./chunk-5DH3KYFH.js";
-import "./chunk-WMIKC5XO.js";
-import "./chunk-FWNJDD4U.js";
+import "./chunk-NPWVOFB3.js";
+import "./chunk-S7W75MIM.js";
+import "./chunk-Z6DXWULM.js";
 import "./chunk-ICLB27PZ.js";
 import "./chunk-KAO7JL4I.js";
 import "./chunk-NXMESY4J.js";