@particle-academy/react-fancy 5.48.0 → 5.48.1

package/dist/json-editor.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkS5ZYG5MG_cjs = require('./chunk-S5ZYG5MG.cjs');
+var chunkRLC2BE3D_cjs = require('./chunk-RLC2BE3D.cjs');
 require('./chunk-2QIGXSSZ.cjs');
 require('./chunk-AR3JOPGT.cjs');
 require('./chunk-Y52NXM73.cjs');
@@ -14,8 +14,8 @@ require('./chunk-BVRPDMB7.cjs');
 require('./chunk-MSRYJETY.cjs');
 require('./chunk-X7H75WVP.cjs');
 require('./chunk-MOU6O324.cjs');
-require('./chunk-ICQJ6475.cjs');
-require('./chunk-BFKCVSNK.cjs');
+require('./chunk-3XJKJQSY.cjs');
+require('./chunk-LRNWD26Z.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-QKFOJKVE.cjs');
 require('./chunk-LCNHEYIM.cjs');
@@ -33,47 +33,47 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "JsonEditor", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.JsonEditor; }
+  get: function () { return chunkRLC2BE3D_cjs.JsonEditor; }
 });
 Object.defineProperty(exports, "applyJsonEdit", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.applyJsonEdit; }
+  get: function () { return chunkRLC2BE3D_cjs.applyJsonEdit; }
 });
 Object.defineProperty(exports, "describeEdit", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.describeEdit; }
+  get: function () { return chunkRLC2BE3D_cjs.describeEdit; }
 });
 Object.defineProperty(exports, "findJsonConflicts", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.findJsonConflicts; }
+  get: function () { return chunkRLC2BE3D_cjs.findJsonConflicts; }
 });
 Object.defineProperty(exports, "getAtPath", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.getAtPath; }
+  get: function () { return chunkRLC2BE3D_cjs.getAtPath; }
 });
 Object.defineProperty(exports, "inferType", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.inferType; }
+  get: function () { return chunkRLC2BE3D_cjs.inferType; }
 });
 Object.defineProperty(exports, "parseKeyMap", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.parseKeyMap; }
+  get: function () { return chunkRLC2BE3D_cjs.parseKeyMap; }
 });
 Object.defineProperty(exports, "parsePath", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.parsePath; }
+  get: function () { return chunkRLC2BE3D_cjs.parsePath; }
 });
 Object.defineProperty(exports, "pathToString", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.pathToString; }
+  get: function () { return chunkRLC2BE3D_cjs.pathToString; }
 });
 Object.defineProperty(exports, "resolveKeyRule", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.resolveKeyRule; }
+  get: function () { return chunkRLC2BE3D_cjs.resolveKeyRule; }
 });
 Object.defineProperty(exports, "typeMatches", {
   enumerable: true,
-  get: function () { return chunkS5ZYG5MG_cjs.typeMatches; }
+  get: function () { return chunkRLC2BE3D_cjs.typeMatches; }
 });
 //# sourceMappingURL=json-editor.cjs.map
 //# sourceMappingURL=json-editor.cjs.map

package/dist/json-editor.js

@@ -1,4 +1,4 @@
-export { JsonEditor, applyJsonEdit, describeEdit, findJsonConflicts, getAtPath, inferType, parseKeyMap, parsePath, pathToString, resolveKeyRule, typeMatches } from './chunk-DMFJJ73P.js';
+export { JsonEditor, applyJsonEdit, describeEdit, findJsonConflicts, getAtPath, inferType, parseKeyMap, parsePath, pathToString, resolveKeyRule, typeMatches } from './chunk-VM5BNL4L.js';
 import './chunk-EEWRLFTI.js';
 import './chunk-IECPLOSZ.js';
 import './chunk-NBAHXZHJ.js';
@@ -12,8 +12,8 @@ import './chunk-F2GAZZVS.js';
 import './chunk-KYZNCVRD.js';
 import './chunk-CF5KRDN4.js';
 import './chunk-6FCQD2KQ.js';
-import './chunk-JJRD3WX3.js';
-import './chunk-XJXQG34J.js';
+import './chunk-ZLYOMQ2J.js';
+import './chunk-QXYO76NZ.js';
 import './chunk-45BBNJQD.js';
 import './chunk-IVRYSSM7.js';
 import './chunk-ZXZJYVWP.js';

package/dist/magic-wand.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkMRARASNZ_cjs = require('./chunk-MRARASNZ.cjs');
+var chunkI6XHZ3S2_cjs = require('./chunk-I6XHZ3S2.cjs');
 require('./chunk-V6VFSX6V.cjs');
 require('./chunk-7EZBMGEE.cjs');
 require('./chunk-XKDW6B7X.cjs');
@@ -9,8 +9,8 @@ require('./chunk-YLGTDBB2.cjs');
 require('./chunk-VBWRH4UW.cjs');
 require('./chunk-MOU6O324.cjs');
 require('./chunk-M5MUGSON.cjs');
-require('./chunk-ICQJ6475.cjs');
-require('./chunk-BFKCVSNK.cjs');
+require('./chunk-3XJKJQSY.cjs');
+require('./chunk-LRNWD26Z.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-QKFOJKVE.cjs');
 require('./chunk-KJ22KE56.cjs');
@@ -21,7 +21,7 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "MagicWand", {
   enumerable: true,
-  get: function () { return chunkMRARASNZ_cjs.MagicWand; }
+  get: function () { return chunkI6XHZ3S2_cjs.MagicWand; }
 });
 //# sourceMappingURL=magic-wand.cjs.map
 //# sourceMappingURL=magic-wand.cjs.map

package/dist/magic-wand.js

@@ -1,4 +1,4 @@
-export { MagicWand } from './chunk-P7WMYJ5I.js';
+export { MagicWand } from './chunk-JHDO6CRT.js';
 import './chunk-DEFGT75G.js';
 import './chunk-PWEZCMIY.js';
 import './chunk-KKWNKBKR.js';
@@ -7,8 +7,8 @@ import './chunk-GFYSELJF.js';
 import './chunk-IQ4KQJAO.js';
 import './chunk-6FCQD2KQ.js';
 import './chunk-LQ4ICCN2.js';
-import './chunk-JJRD3WX3.js';
-import './chunk-XJXQG34J.js';
+import './chunk-ZLYOMQ2J.js';
+import './chunk-QXYO76NZ.js';
 import './chunk-45BBNJQD.js';
 import './chunk-IVRYSSM7.js';
 import './chunk-OL53XYHF.js';

package/dist/prompt-input.cjs

@@ -1,12 +1,12 @@
 'use strict';
 
-var chunkRBEQLBKI_cjs = require('./chunk-RBEQLBKI.cjs');
+var chunkTKDUT7ZA_cjs = require('./chunk-TKDUT7ZA.cjs');
 require('./chunk-AIA5UNQ5.cjs');
 require('./chunk-MSRYJETY.cjs');
 require('./chunk-X7H75WVP.cjs');
 require('./chunk-M5MUGSON.cjs');
-require('./chunk-ICQJ6475.cjs');
-require('./chunk-BFKCVSNK.cjs');
+require('./chunk-3XJKJQSY.cjs');
+require('./chunk-LRNWD26Z.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-QKFOJKVE.cjs');
 require('./chunk-J2DI6RMR.cjs');
@@ -18,7 +18,7 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "PromptInput", {
   enumerable: true,
-  get: function () { return chunkRBEQLBKI_cjs.PromptInput; }
+  get: function () { return chunkTKDUT7ZA_cjs.PromptInput; }
 });
 //# sourceMappingURL=prompt-input.cjs.map
 //# sourceMappingURL=prompt-input.cjs.map

package/dist/prompt-input.js

@@ -1,10 +1,10 @@
-export { PromptInput } from './chunk-QSAYIYEB.js';
+export { PromptInput } from './chunk-SK4AEUO4.js';
 import './chunk-TJ66S5K6.js';
 import './chunk-KYZNCVRD.js';
 import './chunk-CF5KRDN4.js';
 import './chunk-LQ4ICCN2.js';
-import './chunk-JJRD3WX3.js';
-import './chunk-XJXQG34J.js';
+import './chunk-ZLYOMQ2J.js';
+import './chunk-QXYO76NZ.js';
 import './chunk-45BBNJQD.js';
 import './chunk-IVRYSSM7.js';
 import './chunk-MQ6VGG62.js';

package/dist/reason-tag.cjs

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunkMQ4ULIOU_cjs = require('./chunk-MQ4ULIOU.cjs');
+var chunkEEKXWXYO_cjs = require('./chunk-EEKXWXYO.cjs');
 require('./chunk-WKNVZUWZ.cjs');
 require('./chunk-M5MUGSON.cjs');
-require('./chunk-ICQJ6475.cjs');
-require('./chunk-BFKCVSNK.cjs');
+require('./chunk-3XJKJQSY.cjs');
+require('./chunk-LRNWD26Z.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-QKFOJKVE.cjs');
 require('./chunk-J2DI6RMR.cjs');
@@ -17,7 +17,7 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "ReasonTag", {
   enumerable: true,
-  get: function () { return chunkMQ4ULIOU_cjs.ReasonTag; }
+  get: function () { return chunkEEKXWXYO_cjs.ReasonTag; }
 });
 //# sourceMappingURL=reason-tag.cjs.map
 //# sourceMappingURL=reason-tag.cjs.map

package/dist/reason-tag.js

@@ -1,8 +1,8 @@
-export { ReasonTag } from './chunk-JVGJHIIQ.js';
+export { ReasonTag } from './chunk-62WPAKFS.js';
 import './chunk-6KXAFP2T.js';
 import './chunk-LQ4ICCN2.js';
-import './chunk-JJRD3WX3.js';
-import './chunk-XJXQG34J.js';
+import './chunk-ZLYOMQ2J.js';
+import './chunk-QXYO76NZ.js';
 import './chunk-45BBNJQD.js';
 import './chunk-IVRYSSM7.js';
 import './chunk-MQ6VGG62.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@particle-academy/react-fancy",
-  "version": "5.48.0",
+  "version": "5.48.1",
   "description": "React UI component library for Human+ UX — controlled, agent-bridgeable primitives",
   "repository": {
     "type": "git",

package/dist/chunk-BFKCVSNK.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/sanitize.ts"],"names":[],"mappings":";;;AAaA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,QAAQ,KAAA,EAAO,QAAA,EAAU,YAAA,EAAc,YAAY,CAAC,CAAA;AAE/E,IAAM,aAAA,GAAgB,8DAAA;AAQf,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,IAAI,IAAA,IAAQ,MAAM,OAAO,MAAA;AACzB,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AACjD;AAEA,SAAS,oBAAoB,EAAA,EAAmB;AAE9C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,UAAA,CAAW,CAAC,EAAE,IAAI,CAAA;AAAA,EAClC;AAEA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,KAAK,WAAA,EAAY;AAG/B,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1B,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AACvB,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA,EAAG;AACxB,MAAA,MAAM,SAAA,GAAY,YAAA,CAAa,EAAA,CAAG,YAAA,CAAa,IAAI,CAAC,CAAA;AACpD,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,EAAA,CAAG,YAAA,CAAa,MAAM,SAAS,CAAA;AAAA,MACjC;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,UAAU,QAAA,EAAU;AACtB,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,IACzB;AAAA,EACF;AACF;AAEA,SAAS,IAAA,CAAK,IAAa,WAAA,EAA8B;AACvD,EAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,WAAA,EAAY;AAEnC,EAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,IAAA,WAAA,CAAY,KAAK,EAAE,CAAA;AACnB,IAAA;AAAA,EACF;AAEA,EAAA,mBAAA,CAAoB,EAAE,CAAA;AAEtB,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,QAAQ,CAAA;AACvC,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AACF;AAUO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,cAAc,WAAA,EAAa;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,SAAA,EAAU,CAAE,gBAAgB,CAAA,MAAA,EAAS,IAAI,WAAW,WAAW,CAAA;AAC/E,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,cAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AAEA,EAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,IAAA,EAAA,CAAG,UAAA,EAAY,YAAY,EAAE,CAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA,CAAK,SAAA;AACd","file":"chunk-BFKCVSNK.cjs","sourcesContent":["/**\n * HTML and URL sanitization utilities.\n *\n * Hand-rolled (no third-party deps) using browser-native `DOMParser`. Designed\n * for the trust model \"consumer passes user-generated markdown/HTML to a\n * react-fancy component\" — strips script tags, event handlers, and dangerous\n * URI schemes from `href`/`src` attributes.\n *\n * For server-side rendering (no `window`), `sanitizeHtml` returns the input\n * unchanged. Consumers SSR-rendering untrusted content should sanitize on the\n * server with their own pipeline.\n */\n\nconst DANGEROUS_TAGS = new Set([\n  \"script\",\n  \"style\",\n  \"iframe\",\n  \"object\",\n  \"embed\",\n  \"link\",\n  \"meta\",\n  \"base\",\n  \"form\",\n]);\n\nconst URL_ATTRS = new Set([\"href\", \"src\", \"action\", \"formaction\", \"xlink:href\"]);\n\nconst SAFE_PROTOCOL = /^(?:https?:|mailto:|tel:|sms:|ftp:|#|\\/|\\.\\/|\\.\\.\\/|[^:]*$)/i;\n\n/**\n * Validate a URL/href against an allow-list of safe protocols. Returns the\n * input if safe, or `undefined` if it begins with a dangerous scheme like\n * `javascript:`, `data:`, or `vbscript:`. Relative URLs and fragment links\n * are allowed.\n */\nexport function sanitizeHref(href: string | undefined | null): string | undefined {\n  if (href == null) return undefined;\n  const trimmed = href.trim();\n  if (!trimmed) return undefined;\n  return SAFE_PROTOCOL.test(trimmed) ? trimmed : undefined;\n}\n\nfunction stripDangerousAttrs(el: Element): void {\n  // Collect names first; mutating during iteration is awkward with NamedNodeMap.\n  const names: string[] = [];\n  for (let i = 0; i < el.attributes.length; i++) {\n    names.push(el.attributes[i].name);\n  }\n\n  for (const name of names) {\n    const lower = name.toLowerCase();\n\n    // All on* event handlers\n    if (lower.startsWith(\"on\")) {\n      el.removeAttribute(name);\n      continue;\n    }\n\n    // URL attributes — protocol-filter\n    if (URL_ATTRS.has(lower)) {\n      const sanitized = sanitizeHref(el.getAttribute(name));\n      if (sanitized === undefined) {\n        el.removeAttribute(name);\n      } else {\n        el.setAttribute(name, sanitized);\n      }\n      continue;\n    }\n\n    // srcdoc executes JS in the iframe — drop wholesale\n    if (lower === \"srcdoc\") {\n      el.removeAttribute(name);\n    }\n  }\n}\n\nfunction walk(el: Element, removeQueue: Element[]): void {\n  const tag = el.tagName.toLowerCase();\n\n  if (DANGEROUS_TAGS.has(tag)) {\n    removeQueue.push(el);\n    return;\n  }\n\n  stripDangerousAttrs(el);\n\n  const children = Array.from(el.children);\n  for (const child of children) {\n    walk(child, removeQueue);\n  }\n}\n\n/**\n * Sanitize an HTML string by removing dangerous tags (script, iframe, etc.),\n * event-handler attributes (`onclick`, `onerror`, ...), and dangerous URI\n * schemes in `href`/`src` attributes.\n *\n * Uses the browser's `DOMParser`. In non-browser environments returns the\n * input unchanged — sanitize on the server in those cases.\n */\nexport function sanitizeHtml(html: string): string {\n  if (typeof window === \"undefined\" || typeof DOMParser === \"undefined\") {\n    return html;\n  }\n\n  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, \"text/html\");\n  const body = doc.body;\n  if (!body) return html;\n\n  const removeQueue: Element[] = [];\n  for (const child of Array.from(body.children)) {\n    walk(child, removeQueue);\n  }\n\n  for (const el of removeQueue) {\n    el.parentNode?.removeChild(el);\n  }\n\n  return body.innerHTML;\n}\n"]}

package/dist/chunk-XJXQG34J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/sanitize.ts"],"names":[],"mappings":";AAaA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,QAAQ,KAAA,EAAO,QAAA,EAAU,YAAA,EAAc,YAAY,CAAC,CAAA;AAE/E,IAAM,aAAA,GAAgB,8DAAA;AAQf,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,IAAI,IAAA,IAAQ,MAAM,OAAO,MAAA;AACzB,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AACjD;AAEA,SAAS,oBAAoB,EAAA,EAAmB;AAE9C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,UAAA,CAAW,CAAC,EAAE,IAAI,CAAA;AAAA,EAClC;AAEA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,KAAK,WAAA,EAAY;AAG/B,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1B,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AACvB,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA,EAAG;AACxB,MAAA,MAAM,SAAA,GAAY,YAAA,CAAa,EAAA,CAAG,YAAA,CAAa,IAAI,CAAC,CAAA;AACpD,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,EAAA,CAAG,YAAA,CAAa,MAAM,SAAS,CAAA;AAAA,MACjC;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,UAAU,QAAA,EAAU;AACtB,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,IACzB;AAAA,EACF;AACF;AAEA,SAAS,IAAA,CAAK,IAAa,WAAA,EAA8B;AACvD,EAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,WAAA,EAAY;AAEnC,EAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,IAAA,WAAA,CAAY,KAAK,EAAE,CAAA;AACnB,IAAA;AAAA,EACF;AAEA,EAAA,mBAAA,CAAoB,EAAE,CAAA;AAEtB,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,QAAQ,CAAA;AACvC,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AACF;AAUO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,cAAc,WAAA,EAAa;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,SAAA,EAAU,CAAE,gBAAgB,CAAA,MAAA,EAAS,IAAI,WAAW,WAAW,CAAA;AAC/E,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,cAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AAEA,EAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,IAAA,EAAA,CAAG,UAAA,EAAY,YAAY,EAAE,CAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA,CAAK,SAAA;AACd","file":"chunk-XJXQG34J.js","sourcesContent":["/**\n * HTML and URL sanitization utilities.\n *\n * Hand-rolled (no third-party deps) using browser-native `DOMParser`. Designed\n * for the trust model \"consumer passes user-generated markdown/HTML to a\n * react-fancy component\" — strips script tags, event handlers, and dangerous\n * URI schemes from `href`/`src` attributes.\n *\n * For server-side rendering (no `window`), `sanitizeHtml` returns the input\n * unchanged. Consumers SSR-rendering untrusted content should sanitize on the\n * server with their own pipeline.\n */\n\nconst DANGEROUS_TAGS = new Set([\n  \"script\",\n  \"style\",\n  \"iframe\",\n  \"object\",\n  \"embed\",\n  \"link\",\n  \"meta\",\n  \"base\",\n  \"form\",\n]);\n\nconst URL_ATTRS = new Set([\"href\", \"src\", \"action\", \"formaction\", \"xlink:href\"]);\n\nconst SAFE_PROTOCOL = /^(?:https?:|mailto:|tel:|sms:|ftp:|#|\\/|\\.\\/|\\.\\.\\/|[^:]*$)/i;\n\n/**\n * Validate a URL/href against an allow-list of safe protocols. Returns the\n * input if safe, or `undefined` if it begins with a dangerous scheme like\n * `javascript:`, `data:`, or `vbscript:`. Relative URLs and fragment links\n * are allowed.\n */\nexport function sanitizeHref(href: string | undefined | null): string | undefined {\n  if (href == null) return undefined;\n  const trimmed = href.trim();\n  if (!trimmed) return undefined;\n  return SAFE_PROTOCOL.test(trimmed) ? trimmed : undefined;\n}\n\nfunction stripDangerousAttrs(el: Element): void {\n  // Collect names first; mutating during iteration is awkward with NamedNodeMap.\n  const names: string[] = [];\n  for (let i = 0; i < el.attributes.length; i++) {\n    names.push(el.attributes[i].name);\n  }\n\n  for (const name of names) {\n    const lower = name.toLowerCase();\n\n    // All on* event handlers\n    if (lower.startsWith(\"on\")) {\n      el.removeAttribute(name);\n      continue;\n    }\n\n    // URL attributes — protocol-filter\n    if (URL_ATTRS.has(lower)) {\n      const sanitized = sanitizeHref(el.getAttribute(name));\n      if (sanitized === undefined) {\n        el.removeAttribute(name);\n      } else {\n        el.setAttribute(name, sanitized);\n      }\n      continue;\n    }\n\n    // srcdoc executes JS in the iframe — drop wholesale\n    if (lower === \"srcdoc\") {\n      el.removeAttribute(name);\n    }\n  }\n}\n\nfunction walk(el: Element, removeQueue: Element[]): void {\n  const tag = el.tagName.toLowerCase();\n\n  if (DANGEROUS_TAGS.has(tag)) {\n    removeQueue.push(el);\n    return;\n  }\n\n  stripDangerousAttrs(el);\n\n  const children = Array.from(el.children);\n  for (const child of children) {\n    walk(child, removeQueue);\n  }\n}\n\n/**\n * Sanitize an HTML string by removing dangerous tags (script, iframe, etc.),\n * event-handler attributes (`onclick`, `onerror`, ...), and dangerous URI\n * schemes in `href`/`src` attributes.\n *\n * Uses the browser's `DOMParser`. In non-browser environments returns the\n * input unchanged — sanitize on the server in those cases.\n */\nexport function sanitizeHtml(html: string): string {\n  if (typeof window === \"undefined\" || typeof DOMParser === \"undefined\") {\n    return html;\n  }\n\n  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, \"text/html\");\n  const body = doc.body;\n  if (!body) return html;\n\n  const removeQueue: Element[] = [];\n  for (const child of Array.from(body.children)) {\n    walk(child, removeQueue);\n  }\n\n  for (const el of removeQueue) {\n    el.parentNode?.removeChild(el);\n  }\n\n  return body.innerHTML;\n}\n"]}