@pantoken/utils 0.2.4 → 0.2.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Danny Wahl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.mts

@@ -63,6 +63,13 @@ declare function focusOutlineRules(selector?: string): string;
 //#region src/index.d.ts
 /** The colour mode to collapse `light-dark()` to. */
 type Mode = "light" | "dark";
+/**
+ * Strip `<script>` elements and event-handler attributes from SVG markup.
+ *
+ * Defense-in-depth for SVG decoded from vendored data URIs or contributed by plugins.
+ * Not a full HTML parser — relies on the upstream source being trusted and pinned.
+ */
+declare function sanitizeSvg(svg: string): string;
 /** A `var(--custom-prop)` reference (optional fallback); capture group 1 is the property name. */
 declare const VAR_RE: RegExp;
 /** A `light-dark(<light>, <dark>)` value; capture groups 1 and 2 are the two branches. */
@@ -304,4 +311,4 @@ interface TokenUtilityGroup {
  */
 declare function tokenUtilitiesCss(groups: readonly TokenUtilityGroup[], options?: UtilityOptions): string;
 //#endregion
-export { ColorUtilityNames, ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, Mode, ResolveOptions, Rgba, TokenUtilityGroup, UtilityOptions, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, tokenNames, tokenUtilitiesCss, unknownReferences };
+export { ColorUtilityNames, ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, Mode, ResolveOptions, Rgba, TokenUtilityGroup, UtilityOptions, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, sanitizeSvg, tokenNames, tokenUtilitiesCss, unknownReferences };

package/dist/index.mjs

@@ -130,6 +130,25 @@ function focusOutlineRules(selector = FOCUSABLE_SELECTOR) {
 * @module
 * @beta
 */
+/**
+* Strip `<script>` elements and event-handler attributes from SVG markup.
+*
+* Defense-in-depth for SVG decoded from vendored data URIs or contributed by plugins.
+* Not a full HTML parser — relies on the upstream source being trusted and pinned.
+*/
+function sanitizeSvg(svg) {
+	let sanitized = svg;
+	let previous;
+	do {
+		previous = sanitized;
+		sanitized = sanitized.replace(/<script\b[^>]*>[\s\S]*?<\/script\b[^>]*>/gi, "");
+	} while (sanitized !== previous);
+	do {
+		previous = sanitized;
+		sanitized = sanitized.replace(/\son\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "");
+	} while (sanitized !== previous);
+	return sanitized;
+}
 const VAR_SOURCE = "var\\(\\s*(--[\\w-]+)[^)]*\\)";
 const LIGHT_DARK_SOURCE = "^light-dark\\(\\s*(.+?)\\s*,\\s*(.+?)\\s*\\)$";
 /** A `var(--custom-prop)` reference (optional fallback); capture group 1 is the property name. */
@@ -401,4 +420,4 @@ function tokenUtilitiesCss(groups, options = {}) {
 	})).join("\n")}\n`;
 }
 //#endregion
-export { ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, tokenNames, tokenUtilitiesCss, unknownReferences };
+export { ELEVATION_NAMES, FOCUSABLE_SELECTOR, LIGHT_DARK_RE, VAR_RE, camelCase, colorUtilitiesCss, danglingReferences, elevationDeclarations, extractInstuiRefs, focusOutlineDeclarations, focusOutlineRules, makeResolver, parseHexColor, resolveTokens, sanitizeSvg, tokenNames, tokenUtilitiesCss, unknownReferences };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pantoken/utils",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Shared pantoken helpers: token reference resolver, typed regexes (arkregex), name-case, and hex-colour parsing.",
   "homepage": "https://pantoken.iywahl.com",
   "bugs": "https://github.com/thedannywahl/pantoken/issues",
@@ -23,22 +23,22 @@
     "access": "public",
     "provenance": true
   },
-  "scripts": {
-    "dev": "vp pack --watch",
-    "test": "vp test",
-    "check": "vp check"
-  },
   "dependencies": {
-    "@pantoken/model": "workspace:*",
-    "arkregex": "catalog:"
+    "arkregex": "^0.0.8",
+    "@pantoken/model": "0.3.0"
   },
   "devDependencies": {
-    "@types/node": "catalog:",
-    "typescript": "catalog:",
-    "vite": "catalog:",
-    "vite-plus": "catalog:"
+    "@types/node": "^24.13.3",
+    "typescript": "^7.0.2",
+    "vite": "npm:@voidzero-dev/vite-plus-core@0.2.9",
+    "vite-plus": "0.2.9"
   },
   "engines": {
     "node": ">=22.18.0"
+  },
+  "scripts": {
+    "dev": "vp pack --watch",
+    "test": "vp test",
+    "check": "vp check"
   }
-}
+}