@marianmeres/stuic 3.134.0 → 3.136.0

package/dist/components/Input/README.md

@@ -475,9 +475,29 @@ on submit (and round-trips on reopen). Single-select fields ignore the prop.
 ## FieldAssets
 
 Asset/image upload field with an inline thumbnail grid and a built-in lightbox preview
-(`AssetsPreview`). Files are added via the picker button or by dragging them onto the
-field; each shows as a thumbnail with its filename (and an upload progress indicator while
-processing).
+(`AssetsPreview`). Files are added via the picker button, by dragging them onto the field,
+or (opt-in) by pasting from the clipboard; each shows as a thumbnail with its filename (and
+an upload progress indicator while processing).
+
+### Paste from the clipboard (`pasteable`)
+
+Opt in with `pasteable` to let users paste image/file data from the clipboard (Ctrl/Cmd-V) —
+a screenshot, a copied image, etc. It is **focus-scoped**: a paste is consumed only while the
+field (or a control inside it) holds focus. Clicking anywhere in the field focuses it, so no
+Tab is needed, and a `:focus-within` ring on the input box signals the paste-ready state.
+Pasted files go through the same path as the picker and drag-and-drop, so `accept`,
+`cardinality` and `processAssets` all apply. No-op unless `processAssets` is provided.
+
+```svelte
+<FieldAssets
+	label="Screenshots"
+	name="screenshots"
+	bind:value
+	{processAssets}
+	accept="image/*"
+	pasteable
+/>
+```
 
 ### Ordering the assets (`ordered`)
 

package/dist/components/MarkdownEditor/MarkdownEditor.svelte

@@ -529,6 +529,16 @@
 	export function toggleMode(): void {
 		toggleModeInternal();
 	}
+	/**
+	 * Imperatively run a toolbar command — same effect as clicking the matching
+	 * toolbar button. Useful for wiring keyboard shortcuts (e.g. ⌘/Ctrl+B) from a
+	 * host component. No-op while the backend is (re)loading. The `"|"` separator
+	 * is not a command.
+	 */
+	export function command(item: Exclude<ToolbarItem, "|">): void {
+		const btn = TOOLBAR_REGISTRY[item];
+		if (btn && activeHandle) btn.run(activeHandle.commands);
+	}
 </script>
 
 <InputWrap

package/dist/components/MarkdownEditor/MarkdownEditor.svelte.d.ts

@@ -99,6 +99,7 @@ declare const MarkdownEditor: import("svelte").Component<Props, {
     scrollIntoView: (opts?: ScrollIntoViewOptions) => void;
     getMarkdown: () => string;
     toggleMode: () => void;
+    command: (item: Exclude<ToolbarItem, "|">) => void;
 }, "value" | "input" | "mode">;
 type MarkdownEditor = ReturnType<typeof MarkdownEditor>;
 export default MarkdownEditor;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@marianmeres/stuic",
-	"version": "3.134.0",
+	"version": "3.136.0",
 	"packageManager": "pnpm@11.5.0",
 	"scripts": {
 		"dev": "vite dev",

package/dist/components/CommentInput/_internal/render.d.ts

@@ -1,24 +0,0 @@
-/**
- * Default Preview renderer for {@link CommentInput}: turns a markdown string into
- * **sanitized** HTML.
- *
- * `marked` and `dompurify` are declared as *optional* peer dependencies and are
- * imported dynamically the first time a Preview tab is opened — consumers who
- * never preview (or who pass their own `renderMarkdown`) don't pay for them, and
- * a consumer who hasn't installed them gets a caught error (handled by the
- * component) rather than a hard build failure. Mirrors the lazy-load convention
- * used by `MarkdownEditor` for its Milkdown/CodeMirror backends.
- *
- * Sanitization is non-negotiable here: comment text is untrusted user content and
- * `marked` emits raw HTML embedded in markdown verbatim (an XSS vector). Every
- * code path that returns HTML runs it through DOMPurify first.
- */
-/** A markdown-to-HTML renderer. Return value may be sync or async. */
-export type MarkdownRenderer = (markdown: string) => string | Promise<string>;
-/**
- * Render markdown to sanitized HTML using the bundled (lazy) marked + DOMPurify
- * pipeline. Throws if the optional peers aren't installed (the caller catches
- * this and shows a fallback). SSR-safe: returns an empty string off the DOM,
- * since DOMPurify needs a `window` to sanitize against.
- */
-export declare function renderMarkdownSafe(markdown: string): Promise<string>;

package/dist/components/CommentInput/_internal/render.js

@@ -1,47 +0,0 @@
-/**
- * Default Preview renderer for {@link CommentInput}: turns a markdown string into
- * **sanitized** HTML.
- *
- * `marked` and `dompurify` are declared as *optional* peer dependencies and are
- * imported dynamically the first time a Preview tab is opened — consumers who
- * never preview (or who pass their own `renderMarkdown`) don't pay for them, and
- * a consumer who hasn't installed them gets a caught error (handled by the
- * component) rather than a hard build failure. Mirrors the lazy-load convention
- * used by `MarkdownEditor` for its Milkdown/CodeMirror backends.
- *
- * Sanitization is non-negotiable here: comment text is untrusted user content and
- * `marked` emits raw HTML embedded in markdown verbatim (an XSS vector). Every
- * code path that returns HTML runs it through DOMPurify first.
- */
-// Cache the resolved (marked + DOMPurify) pipeline so the dynamic imports and
-// DOMPurify instance creation happen at most once per page.
-let cached = null;
-async function load() {
-    if (cached)
-        return cached;
-    const [{ marked }, dompurify] = await Promise.all([
-        import("marked"),
-        import("dompurify"),
-    ]);
-    // DOMPurify's default export is the instance in a browser/DOM context.
-    const DOMPurify = dompurify.default ?? dompurify;
-    cached = async (markdown) => {
-        // GitHub-flavored markdown + soft line breaks → <br>, matching how comment
-        // boxes (incl. GitHub's) treat single newlines.
-        const html = await marked.parse(markdown ?? "", { gfm: true, breaks: true });
-        return DOMPurify.sanitize(html);
-    };
-    return cached;
-}
-/**
- * Render markdown to sanitized HTML using the bundled (lazy) marked + DOMPurify
- * pipeline. Throws if the optional peers aren't installed (the caller catches
- * this and shows a fallback). SSR-safe: returns an empty string off the DOM,
- * since DOMPurify needs a `window` to sanitize against.
- */
-export async function renderMarkdownSafe(markdown) {
-    if (typeof window === "undefined")
-        return "";
-    const render = await load();
-    return render(markdown);
-}