@highstate/designer 0.19.1 → 0.21.1

package/.output/server/node_modules/unhead/dist/shared/{unhead.BpRRHAhY.mjs → unhead.B5FWS6X0.mjs}

@@ -1,4 +1,4 @@
-import { U as UniqueTags, T as TagsWithInnerContent, M as MetaTagsArrayable, a as TagConfigKeys, D as DupeableTags } from './unhead.yem5I2v_.mjs';
+import { U as UniqueTags, T as TagsWithInnerContent, M as MetaTagsArrayable, H as HasElementTags, a as TagConfigKeys, D as DupeableTags } from './unhead.yem5I2v_.mjs';
 
 const allowedMetaProperties = ["name", "property", "http-equiv"];
 const StandardSingleMetaTags = /* @__PURE__ */ new Set([
@@ -19,14 +19,20 @@ function dedupeKey(tag) {
     return name;
   if (name === "link" && props.rel === "canonical")
     return "canonical";
+  if (name === "link" && props.rel === "alternate") {
+    const altKey = props.hreflang || props.type;
+    if (altKey) {
+      return `alternate:${altKey}`;
+    }
+  }
   if (props.charset)
     return "charset";
   if (tag.tag === "meta") {
     for (const n of allowedMetaProperties) {
       if (props[n] !== void 0) {
         const propValue = props[n];
-        const isStructured = propValue.includes(":");
-        const isStandardSingle = StandardSingleMetaTags.has(propValue);
+        const isStructured = propValue && typeof propValue === "string" && propValue.includes(":");
+        const isStandardSingle = propValue && StandardSingleMetaTags.has(propValue);
         const shouldAlwaysDedupe = isStructured || isStandardSingle;
         const keyPart = !shouldAlwaysDedupe && tag.key ? `:key:${tag.key}` : "";
         return `${name}:${propValue}${keyPart}`;
@@ -39,6 +45,9 @@ function dedupeKey(tag) {
   if (props.id) {
     return `${name}:id:${props.id}`;
   }
+  if (name === "link" && props.rel === "alternate") {
+    return `alternate:${props.href || ""}`;
+  }
   if (TagsWithInnerContent.has(name)) {
     const v = tag.textContent || tag.innerHTML;
     if (v) {
@@ -63,17 +72,14 @@ function walkResolver(val, resolve, key) {
       val = val();
     }
   }
-  let v;
-  if (resolve) {
-    v = resolve(key, val);
-  }
+  const v = resolve ? resolve(key, val) : val;
   if (Array.isArray(v)) {
     return v.map((r) => walkResolver(r, resolve));
   }
   if (v?.constructor === Object) {
     const next = {};
-    for (const key2 of Object.keys(v)) {
-      next[key2] = walkResolver(v[key2], resolve, key2);
+    for (const k of Object.keys(v)) {
+      next[k] = walkResolver(v[k], resolve, k);
     }
     return next;
   }
@@ -83,11 +89,13 @@ function walkResolver(val, resolve, key) {
 function normalizeStyleClassProps(key, value) {
   const store = key === "style" ? /* @__PURE__ */ new Map() : /* @__PURE__ */ new Set();
   function processValue(rawValue) {
-    const value2 = rawValue.trim();
+    if (rawValue == null || rawValue === void 0)
+      return;
+    const value2 = String(rawValue).trim();
     if (!value2)
       return;
     if (key === "style") {
-      const [k, ...v] = value2.split(":").map((s) => s.trim());
+      const [k, ...v] = value2.split(":").map((s) => s ? s.trim() : "");
       if (k && v.length)
         store.set(k, v.join(":"));
     } else {
@@ -101,7 +109,7 @@ function normalizeStyleClassProps(key, value) {
   } else if (value && typeof value === "object") {
     Object.entries(value).forEach(([k, v]) => {
       if (v && v !== "false") {
-        key === "style" ? store.set(k.trim(), v) : processValue(k);
+        key === "style" ? store.set(String(k).trim(), String(v)) : processValue(k);
       }
     });
   }
@@ -116,17 +124,20 @@ function normalizeProps(tag, input) {
     tag.props = input;
     return tag;
   }
-  Object.entries(input).forEach(([key, value]) => {
+  const isHtmlTag = HasElementTags.has(tag.tag) || tag.tag === "htmlAttrs" || tag.tag === "bodyAttrs";
+  Object.entries(input).forEach(([prop, value]) => {
+    if (prop === "__proto__" || prop === "constructor" || prop === "prototype")
+      return;
     if (value === null) {
-      tag.props[key] = null;
+      tag.props[prop] = null;
       return;
     }
-    if (key === "class" || key === "style") {
-      tag.props[key] = normalizeStyleClassProps(key, value);
+    if (prop === "class" || prop === "style") {
+      tag.props[prop] = normalizeStyleClassProps(prop, value);
       return;
     }
-    if (TagConfigKeys.has(key)) {
-      if (["textContent", "innerHTML"].includes(key) && typeof value === "object") {
+    if (TagConfigKeys.has(prop)) {
+      if ((prop === "textContent" || prop === "innerHTML") && typeof value === "object") {
         let type = input.type;
         if (!input.type) {
           type = "application/json";
@@ -136,16 +147,18 @@ function normalizeProps(tag, input) {
         }
         input.type = type;
         tag.props.type = type;
-        tag[key] = JSON.stringify(value);
+        tag[prop] = JSON.stringify(value);
       } else {
-        tag[key] = value;
+        tag[prop] = value;
       }
       return;
     }
+    const isDataKey = prop.startsWith("data-");
+    const key = isHtmlTag && !isDataKey ? prop.toLowerCase() : prop;
     const strValue = String(value);
-    const isDataKey = key.startsWith("data-");
+    const isMetaContentKey = tag.tag === "meta" && key === "content";
     if (strValue === "true" || strValue === "") {
-      tag.props[key] = isDataKey ? strValue : true;
+      tag.props[key] = isDataKey || isMetaContentKey ? strValue : true;
     } else if (!value && isDataKey && strValue === "false") {
       tag.props[key] = "false";
     } else if (value !== void 0) {

package/.output/server/node_modules/unhead/dist/shared/{unhead.DZbvapt-.mjs → unhead.CbpEuj3y.mjs}

@@ -54,11 +54,12 @@ function tagWeight(head, tag) {
   } else if (tag.tag === "link" && tag.props.rel) {
     weight = weightMap.link[tag.props.rel];
   } else if (tag.tag === "script") {
+    const type = String(tag.props.type);
     if (isTruthy(tag.props.async)) {
       weight = weightMap.script.async;
-    } else if (tag.props.src && !isTruthy(tag.props.defer) && !isTruthy(tag.props.async) && tag.props.type !== "module" && !tag.props.type?.endsWith("json")) {
+    } else if (tag.props.src && !isTruthy(tag.props.defer) && !isTruthy(tag.props.async) && type !== "module" && !type.endsWith("json") || tag.innerHTML && !type.endsWith("json")) {
       weight = weightMap.script.sync;
-    } else if (isTruthy(tag.props.defer) && tag.props.src && !isTruthy(tag.props.async)) {
+    } else if (isTruthy(tag.props.defer) && tag.props.src && !isTruthy(tag.props.async) || type === "module") {
       weight = weightMap.script.defer;
     }
   } else if (tag.tag === "style") {

package/.output/server/node_modules/unhead/dist/shared/{unhead.DH45uomy.mjs → unhead.Ct24BOby.mjs}

@@ -1,6 +1,6 @@
 import { createHooks } from 'hookable';
-import { n as normalizeEntryToTags, d as dedupeKey, i as isMetaArrayDupeKey } from './unhead.BpRRHAhY.mjs';
-import { t as tagWeight, s as sortTags } from './unhead.DZbvapt-.mjs';
+import { n as normalizeEntryToTags, d as dedupeKey, h as hashTag, i as isMetaArrayDupeKey } from './unhead.B5FWS6X0.mjs';
+import { t as tagWeight, s as sortTags } from './unhead.CbpEuj3y.mjs';
 import { c as UsesMergeStrategy, V as ValidHeadTags } from './unhead.yem5I2v_.mjs';
 
 function registerPlugin(head, p) {
@@ -86,13 +86,15 @@ function createUnhead(resolvedOptions = {}) {
             t._w = tagWeight(head, t);
             t._p = (e._i << 10) + i2;
             t._d = dedupeKey(t);
+            if (!t._d)
+              t._h = hashTag(t);
             return t;
           });
         }
       }
       let hasFlatMeta = false;
       ctx.entries.flatMap((e) => (e._tags || []).map((t) => ({ ...t, props: { ...t.props } }))).sort(sortTags).reduce((acc, next) => {
-        const k = String(next._d || next._p);
+        const k = next._d || next._h;
         if (!acc.has(k))
           return acc.set(k, next);
         const prev = acc.get(k);
@@ -151,7 +153,7 @@ function createUnhead(resolvedOptions = {}) {
           continue;
         }
         if (tag === "script" && innerHTML) {
-          if (props.type?.endsWith("json")) {
+          if (String(props.type).endsWith("json")) {
             const v = typeof innerHTML === "string" ? innerHTML : JSON.stringify(innerHTML);
             t.innerHTML = v.replace(/</g, "\\u003C");
           } else if (typeof innerHTML === "string") {

package/.output/server/node_modules/unhead/dist/shared/unhead.D4vSFytZ.mjs

@@ -0,0 +1,236 @@
+import { u as unpackMeta } from './unhead.DQc16pHI.mjs';
+
+function defineHeadPlugin(plugin) {
+  return plugin;
+}
+
+const FlatMetaPlugin = /* @__PURE__ */ defineHeadPlugin({
+  key: "flatMeta",
+  hooks: {
+    "entries:normalize": (ctx) => {
+      const tagsToAdd = [];
+      ctx.tags = ctx.tags.map((t) => {
+        if (t.tag !== "_flatMeta") {
+          return t;
+        }
+        tagsToAdd.push(unpackMeta(t.props).map((p) => ({
+          ...t,
+          tag: "meta",
+          props: p
+        })));
+        return false;
+      }).filter(Boolean).concat(...tagsToAdd);
+    }
+  }
+});
+
+const WhitelistAttributes = {
+  htmlAttrs: /* @__PURE__ */ new Set(["class", "style", "lang", "dir"]),
+  bodyAttrs: /* @__PURE__ */ new Set(["class", "style"]),
+  meta: /* @__PURE__ */ new Set(["name", "property", "charset", "content", "media"]),
+  noscript: /* @__PURE__ */ new Set([]),
+  style: /* @__PURE__ */ new Set(["media", "nonce", "title", "blocking"]),
+  script: /* @__PURE__ */ new Set(["type", "textContent", "nonce", "blocking"]),
+  link: /* @__PURE__ */ new Set(["color", "crossorigin", "fetchpriority", "href", "hreflang", "imagesrcset", "imagesizes", "integrity", "media", "referrerpolicy", "rel", "sizes", "type"])
+};
+const BlockedLinkRels = /* @__PURE__ */ new Set(["canonical", "modulepreload", "prerender", "preload", "prefetch", "dns-prefetch", "preconnect", "manifest", "pingback"]);
+const SafeAttrName = /^[a-z][a-z0-9\-]*[a-z0-9]$/i;
+const HtmlEntityHex = /&#x([0-9a-f]+);?/gi;
+const HtmlEntityDec = /&#(\d+);?/g;
+const HtmlEntityNamed = /&(tab|newline|colon|semi|lpar|rpar|sol|bsol|comma|period|excl|num|dollar|percnt|amp|apos|ast|plus|lt|gt|equals|quest|at|lsqb|rsqb|lcub|rcub|vert|hat|grave|tilde|nbsp);?/gi;
+const ControlChars = /[\x00-\x20]+/g;
+const NamedEntityMap = {
+  tab: "	",
+  newline: "\n",
+  colon: ":",
+  semi: ";",
+  lpar: "(",
+  rpar: ")",
+  sol: "/",
+  bsol: "\\",
+  comma: ",",
+  period: ".",
+  excl: "!",
+  num: "#",
+  dollar: "$",
+  percnt: "%",
+  amp: "&",
+  apos: "'",
+  ast: "*",
+  plus: "+",
+  lt: "<",
+  gt: ">",
+  equals: "=",
+  quest: "?",
+  at: "@",
+  lsqb: "[",
+  rsqb: "]",
+  lcub: "{",
+  rcub: "}",
+  vert: "|",
+  hat: "^",
+  grave: "`",
+  tilde: "~",
+  nbsp: "\xA0"
+};
+function safeFromCodePoint(codePoint) {
+  if (codePoint > 1114111 || codePoint < 0 || Number.isNaN(codePoint))
+    return "";
+  return String.fromCodePoint(codePoint);
+}
+function decodeHtmlEntities(str) {
+  return str.replace(HtmlEntityHex, (_, hex) => safeFromCodePoint(Number.parseInt(hex, 16))).replace(HtmlEntityDec, (_, dec) => safeFromCodePoint(Number(dec))).replace(HtmlEntityNamed, (_, name) => NamedEntityMap[name.toLowerCase()] || "");
+}
+function hasDangerousProtocol(url) {
+  const entityDecoded = decodeHtmlEntities(url);
+  const cleaned = entityDecoded.replace(ControlChars, "");
+  let decoded;
+  try {
+    decoded = decodeURIComponent(cleaned);
+  } catch {
+    decoded = cleaned;
+  }
+  const sanitized = decoded.replace(ControlChars, "");
+  const lower = sanitized.toLowerCase();
+  return lower.startsWith("javascript:") || lower.startsWith("data:") || lower.startsWith("vbscript:");
+}
+function stripProtoKeys(obj) {
+  if (Array.isArray(obj))
+    return obj.map(stripProtoKeys);
+  if (obj && typeof obj === "object") {
+    const clean = {};
+    for (const key of Object.keys(obj)) {
+      if (key === "__proto__" || key === "constructor" || key === "prototype")
+        continue;
+      clean[key] = stripProtoKeys(obj[key]);
+    }
+    return clean;
+  }
+  return obj;
+}
+function acceptDataAttrs(value, allowId = true) {
+  return Object.fromEntries(
+    Object.entries(value || {}).filter(([key]) => (allowId && key === "id" || key.startsWith("data-")) && SafeAttrName.test(key))
+  );
+}
+function makeTagSafe(tag) {
+  let next = {};
+  const { tag: type, props: prev } = tag;
+  switch (type) {
+    // title: textContent is escaped in rendering (tagToString), no props needed
+    case "title":
+      break;
+    // virtual tags, not rendered to HTML — but sanitize to prevent injection if rendered
+    case "titleTemplate":
+    case "templateParams":
+      next = prev;
+      break;
+    case "htmlAttrs":
+    case "bodyAttrs":
+      WhitelistAttributes[type].forEach((attr) => {
+        if (prev[attr]) {
+          next[attr] = prev[attr];
+        }
+      });
+      delete tag.innerHTML;
+      delete tag.textContent;
+      tag.props = { ...acceptDataAttrs(prev, false), ...next };
+      return !Object.keys(tag.props).length ? false : tag;
+    case "style":
+      next = acceptDataAttrs(prev);
+      WhitelistAttributes.style.forEach((key) => {
+        if (prev[key]) {
+          next[key] = prev[key];
+        }
+      });
+      break;
+    // meta is safe, except for http-equiv
+    case "meta":
+      WhitelistAttributes.meta.forEach((key) => {
+        if (prev[key]) {
+          next[key] = prev[key];
+        }
+      });
+      break;
+    // link tags we block preloading, prerendering, prefetching, dns-prefetch, preconnect, manifest, etc
+    case "link":
+      WhitelistAttributes.link.forEach((key) => {
+        const val = prev[key];
+        if (!val) {
+          return;
+        }
+        if (key === "rel" && (typeof val !== "string" || BlockedLinkRels.has(val.toLowerCase()))) {
+          return;
+        }
+        if (key === "href" || key === "imagesrcset") {
+          if (typeof val !== "string") {
+            return;
+          }
+          const urls = key === "imagesrcset" ? val.split(",").map((s) => s.trim()) : [val];
+          if (urls.some((u) => hasDangerousProtocol(u))) {
+            return;
+          }
+          next[key] = val;
+        } else if (val) {
+          next[key] = val;
+        }
+      });
+      if (!next.href && !next.imagesrcset || !next.rel) {
+        return false;
+      }
+      break;
+    case "noscript":
+      WhitelistAttributes.noscript.forEach((key) => {
+        if (prev[key]) {
+          next[key] = prev[key];
+        }
+      });
+      break;
+    // we only allow JSON in scripts
+    case "script":
+      if (!tag.textContent || typeof prev.type !== "string" || !prev.type.endsWith("json")) {
+        return false;
+      }
+      try {
+        const jsonVal = typeof tag.textContent === "string" ? JSON.parse(tag.textContent) : tag.textContent;
+        tag.textContent = JSON.stringify(stripProtoKeys(jsonVal), null, 0);
+      } catch {
+        return false;
+      }
+      WhitelistAttributes.script.forEach((s) => {
+        if (s !== "textContent" && prev[s]) {
+          next[s] = prev[s];
+        }
+      });
+      break;
+  }
+  delete tag.innerHTML;
+  if (type !== "title" && type !== "script") {
+    delete tag.textContent;
+  }
+  tag.props = { ...acceptDataAttrs(prev), ...next };
+  if (!Object.keys(tag.props).length && !tag.tag.endsWith("Attrs") && !tag.textContent) {
+    return false;
+  }
+  return tag;
+}
+const SafeInputPlugin = (
+  /* @PURE */
+  defineHeadPlugin({
+    key: "safe",
+    hooks: {
+      "entries:normalize": (ctx) => {
+        if (ctx.entry.options?._safe) {
+          ctx.tags = ctx.tags.reduce((acc, tag) => {
+            const safeTag = makeTagSafe(tag);
+            if (safeTag)
+              acc.push(safeTag);
+            return acc;
+          }, []);
+        }
+      }
+    }
+  })
+);
+
+export { FlatMetaPlugin as F, SafeInputPlugin as S, defineHeadPlugin as d };

package/.output/server/node_modules/unhead/dist/shared/{unhead.Djo8ep_Y.mjs → unhead.TxTMM7cM.mjs}

@@ -1,5 +1,5 @@
-import { d as defineHeadPlugin } from './unhead.CApf5sj3.mjs';
-import { s as sortTags } from './unhead.DZbvapt-.mjs';
+import { d as defineHeadPlugin } from './unhead.D4vSFytZ.mjs';
+import { s as sortTags } from './unhead.CbpEuj3y.mjs';
 import { p as processTemplateParams } from './unhead.BYvz9V1x.mjs';
 
 const formatKey = (k) => !k.includes(":key") ? k.split(":").join(":key:") : k;

package/.output/server/node_modules/unhead/dist/utils.mjs

@@ -1,5 +1,5 @@
 export { D as DupeableTags, H as HasElementTags, M as MetaTagsArrayable, b as ScriptNetworkEvents, S as SelfClosingTags, a as TagConfigKeys, T as TagsWithInnerContent, U as UniqueTags, c as UsesMergeStrategy, V as ValidHeadTags } from './shared/unhead.yem5I2v_.mjs';
-export { d as dedupeKey, h as hashTag, i as isMetaArrayDupeKey, n as normalizeEntryToTags, a as normalizeProps, w as walkResolver } from './shared/unhead.BpRRHAhY.mjs';
+export { d as dedupeKey, h as hashTag, i as isMetaArrayDupeKey, n as normalizeEntryToTags, a as normalizeProps, w as walkResolver } from './shared/unhead.B5FWS6X0.mjs';
 export { r as resolveMetaKeyType, a as resolveMetaKeyValue, b as resolvePackedMetaObjectValue, u as unpackMeta } from './shared/unhead.DQc16pHI.mjs';
-export { s as sortTags, t as tagWeight } from './shared/unhead.DZbvapt-.mjs';
+export { s as sortTags, t as tagWeight } from './shared/unhead.CbpEuj3y.mjs';
 export { p as processTemplateParams } from './shared/unhead.BYvz9V1x.mjs';

package/.output/server/node_modules/unhead/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unhead",
   "type": "module",
-  "version": "2.0.19",
+  "version": "2.1.13",
   "description": "Full-stack <head> manager built for any framework.",
   "author": {
     "name": "Harlan Wilton",
@@ -95,7 +95,7 @@
     "dist"
   ],
   "dependencies": {
-    "hookable": "^5.5.3"
+    "hookable": "^6.0.1"
   },
   "scripts": {
     "build": "unbuild",

package/.output/server/node_modules/vue/dist/vue.cjs.js

@@ -1,5 +1,5 @@
 /**
-* vue v3.5.22
+* vue v3.5.33
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/

package/.output/server/node_modules/vue/dist/vue.cjs.prod.js

@@ -1,5 +1,5 @@
 /**
-* vue v3.5.22
+* vue v3.5.33
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/

package/.output/server/node_modules/vue/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vue",
-  "version": "3.5.22",
+  "version": "3.5.33",
   "description": "The progressive JavaScript framework for building modern web UI.",
   "main": "index.js",
   "module": "dist/vue.runtime.esm-bundler.js",
@@ -93,13 +93,13 @@
   "bugs": {
     "url": "https://github.com/vuejs/core/issues"
   },
-  "homepage": "https://github.com/vuejs/core/tree/main/packages/vue#readme",
+  "homepage": "https://vuejs.org/",
   "dependencies": {
-    "@vue/shared": "3.5.22",
-    "@vue/compiler-dom": "3.5.22",
-    "@vue/runtime-dom": "3.5.22",
-    "@vue/compiler-sfc": "3.5.22",
-    "@vue/server-renderer": "3.5.22"
+    "@vue/shared": "3.5.33",
+    "@vue/compiler-dom": "3.5.33",
+    "@vue/runtime-dom": "3.5.33",
+    "@vue/compiler-sfc": "3.5.33",
+    "@vue/server-renderer": "3.5.33"
   },
   "peerDependencies": {
     "typescript": "*"

package/.output/server/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.1.12",
+  "version": "4.3.6",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/.output/server/node_modules/zod/v4/classic/checks.js

@@ -1 +1 @@
-export { _lt as lt, _lte as lte, _gt as gt, _gte as gte, _positive as positive, _negative as negative, _nonpositive as nonpositive, _nonnegative as nonnegative, _multipleOf as multipleOf, _maxSize as maxSize, _minSize as minSize, _size as size, _maxLength as maxLength, _minLength as minLength, _length as length, _regex as regex, _lowercase as lowercase, _uppercase as uppercase, _includes as includes, _startsWith as startsWith, _endsWith as endsWith, _property as property, _mime as mime, _overwrite as overwrite, _normalize as normalize, _trim as trim, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, } from "../core/index.js";
+export { _lt as lt, _lte as lte, _gt as gt, _gte as gte, _positive as positive, _negative as negative, _nonpositive as nonpositive, _nonnegative as nonnegative, _multipleOf as multipleOf, _maxSize as maxSize, _minSize as minSize, _size as size, _maxLength as maxLength, _minLength as minLength, _length as length, _regex as regex, _lowercase as lowercase, _uppercase as uppercase, _includes as includes, _startsWith as startsWith, _endsWith as endsWith, _property as property, _mime as mime, _overwrite as overwrite, _normalize as normalize, _trim as trim, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, _slugify as slugify, } from "../core/index.js";

package/.output/server/node_modules/zod/v4/classic/external.js

@@ -8,7 +8,9 @@ export * from "./compat.js";
 import { config } from "../core/index.js";
 import en from "../locales/en.js";
 config(en());
-export { globalRegistry, registry, config, $output, $input, $brand, clone, regexes, treeifyError, prettifyError, formatError, flattenError, toJSONSchema, TimePrecision, util, NEVER, } from "../core/index.js";
+export { globalRegistry, registry, config, $output, $input, $brand, clone, regexes, treeifyError, prettifyError, formatError, flattenError, TimePrecision, util, NEVER, } from "../core/index.js";
+export { toJSONSchema } from "../core/json-schema-processors.js";
+export { fromJSONSchema } from "./from-json-schema.js";
 export * as locales from "../locales/index.js";
 // iso
 // must be exported from top-level