@fileverse-dev/ddoc 4.1.11-patch-1 → 4.1.11-patch-3

package/dist/index.es.js

@@ -1,4 +1,4 @@
-import { D as e, a as o, E as t, P as d, e as r, h as i, m as n, d as E, c as l, u, v as C } from "./index-ES2pPSG6.mjs";
+import { D as e, a as o, E as t, P as d, e as r, h as i, m as n, d as E, c as l, u, v as C } from "./index-k1yI08g6.mjs";
 export {
   e as DdocEditor,
   o as DdocExportModal,

package/dist/{markdown-source-pane-CL7ZPDWq.mjs → markdown-source-pane-BoxLMIir.mjs}

@@ -1,9 +1,9 @@
 var Vr = Object.defineProperty;
 var Wr = (t, e, O) => e in t ? Vr(t, e, { enumerable: !0, configurable: !0, writable: !0, value: O }) : t[e] = O;
 var gt = (t, e, O) => Wr(t, typeof e != "symbol" ? e + "" : e, O);
-import { j as Cr } from "./index-ES2pPSG6.mjs";
+import { j as Cr } from "./index-k1yI08g6.mjs";
 import { useRef as pe, useEffect as St } from "react";
-import { s as y, A as pO, T as dO, a as Gr, S as et, b as Lr, P as fO, E as j, i as QO, c as _, D as le, k as tt, F as Ar, M as Pt, W as Er, R as Ur, d as mO, N as oe, e as V, f as Mr, g as Ot, h as ce, p as $O, j as Y, t as h, l as Ir, I as rt, L as at, m as ye, n as ue, o as Qe, q as gO, r as te, u as SO, v as Br, w as Nr, x as PO, y as kO, z as Dr, B as Fr, C as Kr, G as Oe, H as ZO, J as Jr, K as kt, O as Hr, Q as ea, U as ta, V as Oa, X as ra, Y as aa, Z as ia, _ as sa, $ as na, a0 as la, a1 as oa, a2 as ca } from "./index-CqX0iYGN.mjs";
+import { s as y, A as pO, T as dO, a as Gr, S as et, b as Lr, P as fO, E as j, i as QO, c as _, D as le, k as tt, F as Ar, M as Pt, W as Er, R as Ur, d as mO, N as oe, e as V, f as Mr, g as Ot, h as ce, p as $O, j as Y, t as h, l as Ir, I as rt, L as at, m as ye, n as ue, o as Qe, q as gO, r as te, u as SO, v as Br, w as Nr, x as PO, y as kO, z as Dr, B as Fr, C as Kr, G as Oe, H as ZO, J as Jr, K as kt, O as Hr, Q as ea, U as ta, V as Oa, X as ra, Y as aa, Z as ia, _ as sa, $ as na, a0 as la, a1 as oa, a2 as ca } from "./index-CAQPA7Hs.mjs";
 class ua {
   /**
   Create a new completion context. (Mostly useful for testing

package/dist/package/utils/sanitize-css.d.ts

@@ -1,45 +1,45 @@
 /**
- * Sanitize + validate author-supplied custom CSS before it is injected into the
- * document.
+ * Sanitize + scope + validate author-supplied custom CSS before it is injected
+ * into the document.
  *
- * Custom CSS travels to VIEWERS of a published document, so the raw string is
- * NOT a trusted stylesheet. We defend against:
- *  - scope breakout: a `}` in the CSS escaping the `scope { … }` wrapper to
- *    style the whole app (toolbar, other content, security UI, overlays);
- *  - external resource loads / exfiltration: `url(…)` and `@import` (tracking
- *    beacons, plus CSS attribute-selector data exfiltration);
- *  - clickjacking / UI redressing: `position: fixed | sticky` overlays that
- *    escape the document box and cover the viewport;
+ * Authors write **normal, full-page CSS** — `body { … }`, `html body h1 { … }`,
+ * `h1 { … }`, `* { … }` — the way they'd style any web page. We transparently
+ * scope every rule to the document so it can't leak into the app, AND we map the
+ * page-root selectors (`html`, `body`, `:root`) onto the document root so that
+ * `body { background: … }` styles the doc surface and `html body h1 { … }`
+ * styles the doc's headings. No `.ProseMirror` prefix, no learning curve.
+ *
+ * Because the raw string reaches VIEWERS of a published doc, it is untrusted.
+ * Every selector is force-scoped (so a `}` breakout is neutralised — the escaped
+ * rule is simply scoped too), and dangerous declarations are stripped:
+ *  - external resource loads / exfiltration: `url(…)`, `@import`;
+ *  - clickjacking / UI redressing: `position: fixed | sticky`;
  *  - legacy script vectors: `expression()`, `-moz-binding`, `behavior:`.
  *
- * Strategy: wrap the raw CSS in `scope { … }` and parse it with the browser's
- * own CSS engine (no dependency, no regex parsing). A well-formed input yields
- * exactly ONE top-level rule whose selector is `scope`; a breakout produces
- * extra top-level rules with other selectors — we keep only `scope` rules and
- * drop the rest. Dangerous declarations are stripped at every nesting level.
- * The kept rules are re-serialized by the engine, so the output is always a
- * valid, balanced stylesheet.
+ * We parse with the browser's own CSS engine (no dependency), rewrite each
+ * selector, strip dangerous declarations at every nesting level, and let the
+ * engine re-serialise — so the output is always a valid, balanced stylesheet.
  *
- * The sanitizer knows exactly what it removed, so it also returns non-blocking
- * `diagnostics` — the editing UI shows these so authors aren't left wondering
- * why a rule silently vanished (CSS is forgiving; we warn, never block).
+ * The sanitizer knows exactly what it removed, so it returns non-blocking
+ * `diagnostics`; the editing UI surfaces them (CSS is forgiving — we warn,
+ * never block).
  */
 export interface CssDiagnostic {
     level: 'warning' | 'error';
     message: string;
 }
 export interface CssValidationResult {
-    /** Sanitized, scope-wrapped CSS, safe to inject. '' when nothing survives. */
+    /** Sanitized, scoped CSS, safe to inject. '' when nothing survives. */
     css: string;
     /** What was stripped/ignored, deduped. Empty when the CSS was fully clean. */
     diagnostics: CssDiagnostic[];
 }
 /**
- * Sanitize AND report. Use this from the editing UI to surface diagnostics.
+ * Sanitize + scope AND report. Use this from the editing UI for diagnostics.
  */
 export declare const validateCustomCss: (raw: string | undefined | null, scope?: string) => CssValidationResult;
 /**
- * Sanitized CSS only — used at injection/export sinks that just need the safe
- * string. Diagnostics are surfaced separately via validateCustomCss.
+ * Sanitized + scoped CSS only — used at injection/export sinks that just need
+ * the safe string. Diagnostics are surfaced separately via validateCustomCss.
  */
 export declare const sanitizeCustomCss: (raw: string | undefined | null, scope?: string) => string;

package/dist/{split-view-toolbar-Kh-dQ_qt.mjs → split-view-toolbar-ndChIJxD.mjs}

@@ -1,7 +1,7 @@
-import { j as d } from "./index-ES2pPSG6.mjs";
+import { j as d } from "./index-k1yI08g6.mjs";
 import { useRef as I, useState as N, useEffect as D } from "react";
 import { DynamicDropdown as E, Tooltip as R, IconButton as O } from "@fileverse/ui";
-import { a3 as A, a4 as P, c as y } from "./index-CqX0iYGN.mjs";
+import { a3 as A, a4 as P, c as y } from "./index-CAQPA7Hs.mjs";
 const p = (e, t, o = t) => {
   const { state: s } = e, l = s.changeByRange((n) => {
     const u = s.sliceDoc(n.from, n.to), r = s.sliceDoc(

package/package.json

@@ -2,7 +2,7 @@
   "name": "@fileverse-dev/ddoc",
   "private": false,
   "description": "DDoc",
-  "version": "4.1.11-patch-1",
+  "version": "4.1.11-patch-3",
   "main": "dist/index.es.js",
   "module": "dist/index.es.js",
   "exports": {