@limetech/lime-elements 39.34.1 → 39.34.2

package/dist/cjs/{markdown-parser-ZtNkFlPt.js → markdown-parser-F3YRMjcy.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var _commonjsHelpers = require('./_commonjsHelpers-CFO10eej.js');
-var index$2 = require('./index-BgFEL6FF.js');
+var index$2 = require('./index-ETPz91V5.js');
 
 /**
  *
@@ -34048,7 +34048,7 @@ async function markdownToHTML(text, options) {
         .use(remarkRehype, { allowDangerousHtml: true })
         .use(rehypeRaw)
         .use(createLinksPlugin())
-        .use(index$2.rehypeSanitize, Object.assign({}, getWhiteList((_a = options === null || options === void 0 ? void 0 : options.whitelist) !== null && _a !== void 0 ? _a : [])))
+        .use(index$2.rehypeSanitize, getWhiteList((_a = options === null || options === void 0 ? void 0 : options.whitelist) !== null && _a !== void 0 ? _a : []))
         .use(() => {
         return (tree) => {
             // Run the sanitizeStyle function on all elements, to sanitize
@@ -34072,7 +34072,7 @@ async function markdownToHTML(text, options) {
 async function sanitizeHTML(html, whitelist) {
     const file = await index$2.unified()
         .use(index$2.rehypeParse)
-        .use(index$2.rehypeSanitize, Object.assign({}, getWhiteList(whitelist !== null && whitelist !== void 0 ? whitelist : [])))
+        .use(index$2.rehypeSanitize, getWhiteList(whitelist !== null && whitelist !== void 0 ? whitelist : []))
         .use(() => {
         return (tree) => {
             // Run the sanitizeStyle function on all elements, to sanitize
@@ -34091,13 +34091,40 @@ function getWhiteList(allowedComponents) {
         return attr !== 'height';
     });
     asteriskAttributeWhitelist.push('style');
-    const whitelist = Object.assign(Object.assign({}, index$2.defaultSchema), { strip: [...((_b = index$2.defaultSchema.strip) !== null && _b !== void 0 ? _b : []), 'style'], tagNames: [
+    const whitelist = Object.assign(Object.assign({}, index$2.defaultSchema), {
+        // Disable rehype-sanitize's default `user-content-` prefix, which it
+        // otherwise prepends to the DOM-clobber attributes (`id`, `name`,
+        // `aria-describedby`, `aria-labelledby`).
+        //
+        // Without this, whitelisted custom elements break: e.g.
+        // `<limel-icon name="globe">` becomes `name="user-content-globe"` and
+        // the icon no longer resolves. It also keeps GFM footnote ids
+        // consistent with the links that reference them — remark-rehype already
+        // namespaces those with `user-content-`, and a second prefix here would
+        // desync the id (`user-content-user-content-fn-1`) from its link
+        // (`#user-content-fn-1`).
+        //
+        // Set here, in the shared schema, so that both `markdownToHTML` and
+        // `sanitizeHTML` behave identically — the same content must not be
+        // prefixed on one path and left unprefixed on the other.
+        //
+        // Safe to disable here because every current consumer renders this
+        // output inside a shadow root (`limel-markdown` and `limel-text-editor`
+        // are both `shadow: true`). Unprefixed `id`/`name` attributes inside a
+        // shadow root cannot clobber document-level globals
+        // (`document.getElementById`, `window.<name>`, `document.forms`), which
+        // is what the prefix guards against. If a future consumer renders this
+        // output into the light DOM — or these functions become public exports
+        // — reinstate the prefix or scope its removal to whitelisted custom
+        // elements only.
+        clobberPrefix: '', strip: [...((_b = index$2.defaultSchema.strip) !== null && _b !== void 0 ? _b : []), 'style'], tagNames: [
             ...(index$2.defaultSchema.tagNames || []),
             ...allowedComponents.map((component) => component.tagName),
         ], attributes: Object.assign(Object.assign({}, index$2.defaultSchema.attributes), { p: [
                 ...((_c = index$2.defaultSchema.attributes.p) !== null && _c !== void 0 ? _c : []),
                 ['className', 'MsoNormal'],
-            ], a: [...((_d = index$2.defaultSchema.attributes.a) !== null && _d !== void 0 ? _d : []), 'referrerpolicy'], '*': asteriskAttributeWhitelist }) });
+            ], a: [...((_d = index$2.defaultSchema.attributes.a) !== null && _d !== void 0 ? _d : []), 'referrerpolicy'], '*': asteriskAttributeWhitelist })
+    });
     for (const component of allowedComponents) {
         whitelist.attributes[component.tagName] = component.attributes;
     }

package/dist/collection/components/markdown/markdown-parser.js

@@ -36,7 +36,7 @@ export async function markdownToHTML(text, options) {
         .use(remarkRehype, { allowDangerousHtml: true })
         .use(rehypeRaw)
         .use(createLinksPlugin())
-        .use(rehypeSanitize, Object.assign({}, getWhiteList((_a = options === null || options === void 0 ? void 0 : options.whitelist) !== null && _a !== void 0 ? _a : [])))
+        .use(rehypeSanitize, getWhiteList((_a = options === null || options === void 0 ? void 0 : options.whitelist) !== null && _a !== void 0 ? _a : []))
         .use(() => {
         return (tree) => {
             // Run the sanitizeStyle function on all elements, to sanitize
@@ -60,7 +60,7 @@ export async function markdownToHTML(text, options) {
 export async function sanitizeHTML(html, whitelist) {
     const file = await unified()
         .use(rehypeParse)
-        .use(rehypeSanitize, Object.assign({}, getWhiteList(whitelist !== null && whitelist !== void 0 ? whitelist : [])))
+        .use(rehypeSanitize, getWhiteList(whitelist !== null && whitelist !== void 0 ? whitelist : []))
         .use(() => {
         return (tree) => {
             // Run the sanitizeStyle function on all elements, to sanitize
@@ -79,13 +79,40 @@ function getWhiteList(allowedComponents) {
         return attr !== 'height';
     });
     asteriskAttributeWhitelist.push('style');
-    const whitelist = Object.assign(Object.assign({}, defaultSchema), { strip: [...((_b = defaultSchema.strip) !== null && _b !== void 0 ? _b : []), 'style'], tagNames: [
+    const whitelist = Object.assign(Object.assign({}, defaultSchema), {
+        // Disable rehype-sanitize's default `user-content-` prefix, which it
+        // otherwise prepends to the DOM-clobber attributes (`id`, `name`,
+        // `aria-describedby`, `aria-labelledby`).
+        //
+        // Without this, whitelisted custom elements break: e.g.
+        // `<limel-icon name="globe">` becomes `name="user-content-globe"` and
+        // the icon no longer resolves. It also keeps GFM footnote ids
+        // consistent with the links that reference them — remark-rehype already
+        // namespaces those with `user-content-`, and a second prefix here would
+        // desync the id (`user-content-user-content-fn-1`) from its link
+        // (`#user-content-fn-1`).
+        //
+        // Set here, in the shared schema, so that both `markdownToHTML` and
+        // `sanitizeHTML` behave identically — the same content must not be
+        // prefixed on one path and left unprefixed on the other.
+        //
+        // Safe to disable here because every current consumer renders this
+        // output inside a shadow root (`limel-markdown` and `limel-text-editor`
+        // are both `shadow: true`). Unprefixed `id`/`name` attributes inside a
+        // shadow root cannot clobber document-level globals
+        // (`document.getElementById`, `window.<name>`, `document.forms`), which
+        // is what the prefix guards against. If a future consumer renders this
+        // output into the light DOM — or these functions become public exports
+        // — reinstate the prefix or scope its removal to whitelisted custom
+        // elements only.
+        clobberPrefix: '', strip: [...((_b = defaultSchema.strip) !== null && _b !== void 0 ? _b : []), 'style'], tagNames: [
             ...(defaultSchema.tagNames || []),
             ...allowedComponents.map((component) => component.tagName),
         ], attributes: Object.assign(Object.assign({}, defaultSchema.attributes), { p: [
                 ...((_c = defaultSchema.attributes.p) !== null && _c !== void 0 ? _c : []),
                 ['className', 'MsoNormal'],
-            ], a: [...((_d = defaultSchema.attributes.a) !== null && _d !== void 0 ? _d : []), 'referrerpolicy'], '*': asteriskAttributeWhitelist }) });
+            ], a: [...((_d = defaultSchema.attributes.a) !== null && _d !== void 0 ? _d : []), 'referrerpolicy'], '*': asteriskAttributeWhitelist })
+    });
     for (const component of allowedComponents) {
         whitelist.attributes[component.tagName] = component.attributes;
     }

package/dist/collection/components/markdown/markdown.js

@@ -32,6 +32,7 @@ import { adaptColorContrast } from "../../util/adapt-color-contrast";
  * @exampleComponent limel-example-markdown-keys
  * @exampleComponent limel-example-markdown-blockquotes
  * @exampleComponent limel-example-markdown-horizontal-rule
+ * @exampleComponent limel-example-markdown-built-in-component
  * @exampleComponent limel-example-markdown-custom-component
  * @exampleComponent limel-example-markdown-custom-component-with-json-props
  * @exampleComponent limel-example-markdown-remove-empty-paragraphs
@@ -142,7 +143,7 @@ export class Markdown {
         this.cleanupImageIntersectionObserver();
     }
     render() {
-        return (h(Host, { key: '9f4f25470aad4f8db1133231f40e7a388f2146bb' }, h("div", { key: '64378c77ef6c71a3ee3733d430f8d33999c315e0', id: "markdown", ref: (el) => (this.rootElement = el) })));
+        return (h(Host, { key: '79583ca7783472254c84899b2709d20e21bb442f' }, h("div", { key: 'd06c81a4098a25b97a6ed56d2830205228933c6e', id: "markdown", ref: (el) => (this.rootElement = el) })));
     }
     setupImageIntersectionObserver() {
         if (this.lazyLoadImages) {

package/dist/esm/{index-t4DgGbWS.js → index-CbciMfiU.js}

@@ -5891,6 +5891,15 @@ const htmlDecoder = getDecoder(htmlDecodeTree);
 function decodeHTML(str, mode = DecodingMode.Legacy) {
     return htmlDecoder(str, mode);
 }
+/**
+ * Decodes an HTML string, requiring all entities to be terminated by a semicolon.
+ *
+ * @param str The string to decode.
+ * @returns The decoded string.
+ */
+function decodeHTMLStrict(str) {
+    return htmlDecoder(str, DecodingMode.Strict);
+}
 
 /** All valid namespaces in HTML. */
 var NS;
@@ -20337,4 +20346,4 @@ function visit(tree, testOrVisitor, visitorOrReverse, maybeReverse) {
   }
 }
 
-export { BinTrieFlags as B, EXIT as E, rehypeSanitize as a, rehypeStringify as b, decodeHTML as c, defaultSchema as d, convert as e, visitParents as f, ccount as g, determineBranch as h, htmlDecodeTree as i, rehypeParse as r, structuredClone$1 as s, unified as u, visit as v, zwitch as z };
+export { BinTrieFlags as B, EXIT as E, rehypeSanitize as a, rehypeStringify as b, decodeHTML as c, defaultSchema as d, decodeHTMLStrict as e, convert as f, visitParents as g, ccount as h, determineBranch as i, htmlDecodeTree as j, rehypeParse as r, structuredClone$1 as s, unified as u, visit as v, zwitch as z };

package/dist/esm/limel-file-viewer.entry.js

@@ -1,6 +1,6 @@
 import { r as registerInstance, c as createEvent, h, a as getElement } from './index-VCOjLfyP.js';
 import { t as translate } from './translations-EPnIW0K5.js';
-import { d as defaultSchema, u as unified, r as rehypeParse, a as rehypeSanitize, v as visit, b as rehypeStringify } from './index-t4DgGbWS.js';
+import { d as defaultSchema, u as unified, r as rehypeParse, a as rehypeSanitize, v as visit, b as rehypeStringify } from './index-CbciMfiU.js';
 import './_commonjsHelpers-B85MJLTf.js';
 
 /**

package/dist/esm/limel-markdown.entry.js

@@ -1,7 +1,7 @@
 import { r as registerInstance, h, H as Host } from './index-VCOjLfyP.js';
-import { m as markdownToHTML } from './markdown-parser-nW7FzScN.js';
+import { m as markdownToHTML } from './markdown-parser-Blt6ZFY0.js';
 import { g as globalConfig } from './config-Dnt5w_Bp.js';
-import { d as defaultSchema } from './index-t4DgGbWS.js';
+import { d as defaultSchema } from './index-CbciMfiU.js';
 import { a as adaptColorContrast } from './adapt-color-contrast-Dgcw_h7C.js';
 import './_commonjsHelpers-B85MJLTf.js';
 
@@ -1165,7 +1165,7 @@ const Markdown = class {
         this.cleanupImageIntersectionObserver();
     }
     render() {
-        return (h(Host, { key: '9f4f25470aad4f8db1133231f40e7a388f2146bb' }, h("div", { key: '64378c77ef6c71a3ee3733d430f8d33999c315e0', id: "markdown", ref: (el) => (this.rootElement = el) })));
+        return (h(Host, { key: '79583ca7783472254c84899b2709d20e21bb442f' }, h("div", { key: 'd06c81a4098a25b97a6ed56d2830205228933c6e', id: "markdown", ref: (el) => (this.rootElement = el) })));
     }
     setupImageIntersectionObserver() {
         if (this.lazyLoadImages) {