npm - @pie-players/pie-players-shared - Versions diffs - 0.3.60 → 0.3.62 - Mend

@pie-players/pie-players-shared 0.3.60 → 0.3.62

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (147) hide show

package/dist/config/profile.js +0 -1
package/dist/i18n/index.js +0 -1
package/dist/i18n/loader.js +0 -1
package/dist/i18n/simple-i18n.js +0 -1
package/dist/i18n/types.js +0 -1
package/dist/index.d.ts +2 -0
package/dist/index.js +2 -1
package/dist/instrumentation/debug-panel-stream.js +0 -1
package/dist/instrumentation/index.js +0 -1
package/dist/instrumentation/provider-guards.js +0 -1
package/dist/instrumentation/providers/BaseInstrumentationProvider.js +0 -1
package/dist/instrumentation/providers/CompositeInstrumentationProvider.js +0 -1
package/dist/instrumentation/providers/ConsoleInstrumentationProvider.js +0 -1
package/dist/instrumentation/providers/DebugPanelInstrumentationProvider.js +0 -1
package/dist/instrumentation/providers/NewRelicInstrumentationProvider.js +0 -1
package/dist/instrumentation/providers/index.js +0 -1
package/dist/instrumentation/types.js +0 -1
package/dist/loader-config.js +0 -1
package/dist/loaders/ElementLoader.js +0 -1
package/dist/loaders/element-loader-types.js +0 -1
package/dist/loaders/element-loader.js +0 -1
package/dist/loaders/element-package-policy.js +0 -1
package/dist/loaders/esm-adapter.js +0 -1
package/dist/loaders/iife-adapter.js +0 -1
package/dist/loaders/index.js +0 -1
package/dist/object/index.js +0 -1
package/dist/pie/asset-handler.js +0 -1
package/dist/pie/authoring-tag.js +0 -1
package/dist/pie/authoring.js +0 -1
package/dist/pie/component-context.js +0 -1
package/dist/pie/config.js +0 -1
package/dist/pie/configure-initialization.js +0 -1
package/dist/pie/correct-response-env.js +0 -1
package/dist/pie/custom-element-define.js +0 -1
package/dist/pie/index.js +0 -1
package/dist/pie/initialization.js +0 -1
package/dist/pie/instrumentation-event-bridge.js +0 -1
package/dist/pie/instrumentation-event-map.js +0 -1
package/dist/pie/instrumentation-provider-resolution.js +0 -1
package/dist/pie/item-controller-storage.js +0 -1
package/dist/pie/item-controller.js +0 -1
package/dist/pie/item-session-contract.js +0 -1
package/dist/pie/logger.js +0 -1
package/dist/pie/math-rendering.js +0 -1
package/dist/pie/overrides.js +0 -1
package/dist/pie/player-initializer.js +0 -1
package/dist/pie/registry.js +0 -1
package/dist/pie/resource-monitor.js +0 -1
package/dist/pie/scoring.js +0 -1
package/dist/pie/stage-tracker.js +0 -1
package/dist/pie/stages.js +0 -1
package/dist/pie/tag-names.js +0 -1
package/dist/pie/types.js +0 -1
package/dist/pie/updates.js +0 -1
package/dist/pie/utils.js +0 -1
package/dist/pie/versioned-tag.js +0 -1
package/dist/player-strategy.js +0 -1
package/dist/security/index.js +0 -1
package/dist/security/sanitize-item-markup.d.ts +11 -0
package/dist/security/sanitize-item-markup.js +5 -3
package/dist/security/sanitize-svg-icon.js +0 -1
package/dist/security/validate-style-url.js +0 -1
package/dist/security/wrap-model-rich-content.js +0 -1
package/dist/security/wrap-overwide-images.js +0 -1
package/dist/security/wrap-overwide-tables.js +0 -1
package/dist/server/npm-registry.js +0 -1
package/dist/types/index.js +0 -1
package/dist/ui/content-styles.d.ts +73 -0
package/dist/ui/content-styles.js +204 -0
package/dist/ui/debug-panel-persistence.js +0 -1
package/dist/ui/first-focusable.js +0 -1
package/dist/ui/focus-trap.js +0 -1
package/dist/ui/safe-storage.js +0 -1
package/dist/ui/scope-css.d.ts +56 -0
package/dist/ui/scope-css.js +310 -0
package/dist/ui/zoom-compensation.js +0 -1
package/package.json +9 -5
package/dist/config/profile.js.map +0 -1
package/dist/i18n/index.js.map +0 -1
package/dist/i18n/loader.js.map +0 -1
package/dist/i18n/simple-i18n.js.map +0 -1
package/dist/i18n/types.js.map +0 -1
package/dist/index.js.map +0 -1
package/dist/instrumentation/debug-panel-stream.js.map +0 -1
package/dist/instrumentation/index.js.map +0 -1
package/dist/instrumentation/provider-guards.js.map +0 -1
package/dist/instrumentation/providers/BaseInstrumentationProvider.js.map +0 -1
package/dist/instrumentation/providers/CompositeInstrumentationProvider.js.map +0 -1
package/dist/instrumentation/providers/ConsoleInstrumentationProvider.js.map +0 -1
package/dist/instrumentation/providers/DebugPanelInstrumentationProvider.js.map +0 -1
package/dist/instrumentation/providers/NewRelicInstrumentationProvider.js.map +0 -1
package/dist/instrumentation/providers/index.js.map +0 -1
package/dist/instrumentation/types.js.map +0 -1
package/dist/loader-config.js.map +0 -1
package/dist/loaders/ElementLoader.js.map +0 -1
package/dist/loaders/element-loader-types.js.map +0 -1
package/dist/loaders/element-loader.js.map +0 -1
package/dist/loaders/element-package-policy.js.map +0 -1
package/dist/loaders/esm-adapter.js.map +0 -1
package/dist/loaders/iife-adapter.js.map +0 -1
package/dist/loaders/index.js.map +0 -1
package/dist/object/index.js.map +0 -1
package/dist/pie/asset-handler.js.map +0 -1
package/dist/pie/authoring-tag.js.map +0 -1
package/dist/pie/authoring.js.map +0 -1
package/dist/pie/component-context.js.map +0 -1
package/dist/pie/config.js.map +0 -1
package/dist/pie/configure-initialization.js.map +0 -1
package/dist/pie/correct-response-env.js.map +0 -1
package/dist/pie/custom-element-define.js.map +0 -1
package/dist/pie/index.js.map +0 -1
package/dist/pie/initialization.js.map +0 -1
package/dist/pie/instrumentation-event-bridge.js.map +0 -1
package/dist/pie/instrumentation-event-map.js.map +0 -1
package/dist/pie/instrumentation-provider-resolution.js.map +0 -1
package/dist/pie/item-controller-storage.js.map +0 -1
package/dist/pie/item-controller.js.map +0 -1
package/dist/pie/item-session-contract.js.map +0 -1
package/dist/pie/logger.js.map +0 -1
package/dist/pie/math-rendering.js.map +0 -1
package/dist/pie/overrides.js.map +0 -1
package/dist/pie/player-initializer.js.map +0 -1
package/dist/pie/registry.js.map +0 -1
package/dist/pie/resource-monitor.js.map +0 -1
package/dist/pie/scoring.js.map +0 -1
package/dist/pie/stage-tracker.js.map +0 -1
package/dist/pie/stages.js.map +0 -1
package/dist/pie/tag-names.js.map +0 -1
package/dist/pie/types.js.map +0 -1
package/dist/pie/updates.js.map +0 -1
package/dist/pie/utils.js.map +0 -1
package/dist/pie/versioned-tag.js.map +0 -1
package/dist/player-strategy.js.map +0 -1
package/dist/security/index.js.map +0 -1
package/dist/security/sanitize-item-markup.js.map +0 -1
package/dist/security/sanitize-svg-icon.js.map +0 -1
package/dist/security/validate-style-url.js.map +0 -1
package/dist/security/wrap-model-rich-content.js.map +0 -1
package/dist/security/wrap-overwide-images.js.map +0 -1
package/dist/security/wrap-overwide-tables.js.map +0 -1
package/dist/server/npm-registry.js.map +0 -1
package/dist/types/index.js.map +0 -1
package/dist/ui/debug-panel-persistence.js.map +0 -1
package/dist/ui/first-focusable.js.map +0 -1
package/dist/ui/focus-trap.js.map +0 -1
package/dist/ui/safe-storage.js.map +0 -1
package/dist/ui/zoom-compensation.js.map +0 -1

package/dist/ui/content-styles.js ADDED Viewed

@@ -0,0 +1,204 @@
+/**
+ * Installs the shared PIE content stylesheet
+ * (`@pie-players/pie-theme/components.css`) into the host document.
+ *
+ * Authored assessment content depends on classes that belong to no single
+ * component: passage markup (`.numbered-paragraph`, `.p-number`,
+ * `div.passage-title`), the legacy `kds-*` families, the `@media print`
+ * `.noprint` rules, and the answer-eliminator classes. Players render into
+ * light DOM, so those rules have to exist as a document-level stylesheet —
+ * there is no shadow root to scope them to.
+ *
+ * Hosts used to be required to import that stylesheet themselves. Nothing
+ * enforced it and nothing failed loudly when they didn't: the item rendered,
+ * the passage was simply unstyled, and it surfaced as a visual bug reported by
+ * hand days later. Players install the stylesheet themselves instead, which
+ * keeps the host contract at "import the player".
+ *
+ * The CSS text is passed in rather than imported here: this package builds with
+ * plain `tsc`, so it cannot inline a stylesheet. Bundler-built player packages
+ * import it with Vite's `?inline` and hand the text over.
+ */
+/** Marks a `<style>` element this module owns, and keeps installs idempotent. */
+const MARKER_ATTRIBUTE = "data-pie-content-styles";
+/**
+ * Declared by `components.css` itself, so it is observable no matter how the
+ * stylesheet arrived — our injection or a host import. Used only to tell a host
+ * that opted out but then shipped nothing.
+ */
+const SENTINEL_PROPERTY = "--pie-content-styles";
+/** `<html data-pie-content-styles="host">` opts a host out of installation. */
+const OPT_OUT_ATTRIBUTE = "data-pie-content-styles";
+const OPT_OUT_VALUE = "host";
+const isBrowser = () => typeof document !== "undefined" && !!document.head;
+/**
+ * True when the host declared `<html data-pie-content-styles="host">`, i.e. it
+ * takes ownership of loading the stylesheet.
+ */
+export function contentStylesOptedOut() {
+    if (!isBrowser())
+        return false;
+    return (document.documentElement.getAttribute(OPT_OUT_ATTRIBUTE) === OPT_OUT_VALUE);
+}
+/**
+ * True when `components.css` is applied to the document, by any route. Reads the
+ * sentinel custom property the stylesheet declares on `:root`.
+ *
+ * Only meaningful once the document's stylesheets have been applied — a host
+ * that loads CSS via an async `<link>` reads as missing until it lands.
+ */
+export function contentStylesPresent() {
+    if (!isBrowser())
+        return false;
+    const value = getComputedStyle(document.documentElement)
+        .getPropertyValue(SENTINEL_PROPERTY)
+        .trim();
+    return value !== "";
+}
+/**
+ * Installs `cssText` as a document-level stylesheet, once per document.
+ *
+ * The stylesheet is **prepended** to `<head>` and deliberately left out of a
+ * cascade layer. Prepending reproduces the placement hosts were told to use by
+ * hand — first in the entry, before app CSS — so an app rule and a content rule
+ * of equal specificity resolve in the host's favour, exactly as before.
+ *
+ * A cascade layer looks tempting here and is the wrong tool: unlayered author
+ * declarations beat *all* layered ones regardless of specificity, so a host
+ * reset as broad as `p { margin: 0 }` would silently outrank
+ * `.numbered-paragraph { margin-left: 36px }`. That trades a visible missing
+ * stylesheet for a subtler override bug, so ordinary specificity wins instead.
+ *
+ * @param cssText Contents of `@pie-players/pie-theme/components.css`.
+ * @param source Package installing the styles, for diagnostics.
+ */
+export function installContentStyles(cssText, source) {
+    if (!isBrowser())
+        return "no-document";
+    if (contentStylesOptedOut())
+        return "opted-out";
+    if (document.querySelector(`style[${MARKER_ATTRIBUTE}]`)) {
+        // Another player package, or a second copy of this one, already installed
+        // the same stylesheet. Duplicating it would be harmless but pointless.
+        return "already-installed";
+    }
+    if (!cssText)
+        return "no-document";
+    const style = document.createElement("style");
+    style.setAttribute(MARKER_ATTRIBUTE, source);
+    style.textContent = cssText;
+    document.head.prepend(style);
+    return "installed";
+}
+/**
+ * Counts content stylesheets in the document that this module did not install —
+ * i.e. copies the host loaded itself. Detected by the sentinel property rather
+ * than by URL, so a copy arriving as a `<link>`, a bundler-injected `<style>`, or
+ * anything else all count the same.
+ *
+ * Cross-origin sheets throw on `cssRules` access and are skipped; a host copy
+ * served from another origin therefore reads as absent. That only costs a
+ * diagnostic, never correctness.
+ */
+const countHostContentStyleSheets = () => {
+    // Walks the owning elements rather than document.styleSheets: the marker
+    // attribute lives on the element, and CSSStyleSheet.ownerNode is not
+    // universally implemented (happy-dom omits it), which would make our own
+    // installed copy look like a host copy.
+    const nodes = document.querySelectorAll(`style:not([${MARKER_ATTRIBUTE}]), link[rel~="stylesheet"]:not([${MARKER_ATTRIBUTE}])`);
+    let count = 0;
+    for (const node of Array.from(nodes)) {
+        let rules;
+        try {
+            rules = node.sheet?.cssRules;
+        }
+        catch {
+            continue;
+        }
+        if (!rules)
+            continue;
+        for (const rule of Array.from(rules)) {
+            if (rule.style?.getPropertyValue(SENTINEL_PROPERTY)) {
+                count += 1;
+                break;
+            }
+        }
+    }
+    return count;
+};
+let auditWarningIssued = false;
+const pendingChecks = [];
+/**
+ * Reports, once per page, the two ways content styling can go wrong. Neither is
+ * detectable synchronously — a host copy may still be in flight as an async
+ * `<link>` — so the check is deferred.
+ *
+ * - **Missing**: the host opted out and then loaded nothing, so authored content
+ *   renders unstyled. This is the failure the old host-import contract produced
+ *   silently.
+ * - **Duplicated**: the host still imports `components.css` itself *and* the
+ *   player installed a copy. Rendering is correct while the two agree, but the
+ *   host's copy loads later and therefore wins ties at equal specificity — so a
+ *   host copy pinned to an older `@pie-players/pie-theme` silently overrides the
+ *   player's newer rules. Harmless today, a confusing override tomorrow.
+ */
+export function auditContentStyles(source) {
+    if (!isBrowser() || auditWarningIssued)
+        return;
+    const check = () => {
+        if (auditWarningIssued)
+            return;
+        if (contentStylesOptedOut()) {
+            if (contentStylesPresent())
+                return;
+            auditWarningIssued = true;
+            console.warn(`[${source}] No PIE content stylesheet found. This document sets ` +
+                `${OPT_OUT_ATTRIBUTE}="${OPT_OUT_VALUE}", so ${source} did not install ` +
+                `one. Authored content that relies on shared classes ` +
+                `(.numbered-paragraph, .p-number, div.passage-title, the kds-* ` +
+                `families, answer-eliminator styles) will render unstyled. Either ` +
+                `import "@pie-players/pie-theme/components.css" in the host app, or ` +
+                `drop the ${OPT_OUT_ATTRIBUTE} attribute to let the player install it.`);
+            return;
+        }
+        if (countHostContentStyleSheets() > 0) {
+            auditWarningIssued = true;
+            console.warn(`[${source}] The PIE content stylesheet is loaded twice: ${source} ` +
+                `installs it, and this host also imports ` +
+                `"@pie-players/pie-theme/components.css". Rendering is unaffected ` +
+                `while both copies match, but the host copy loads later and wins ` +
+                `ties at equal specificity, so a copy pinned to an older ` +
+                `@pie-players/pie-theme will silently override newer player styles. ` +
+                `Remove the host import, or set ` +
+                `${OPT_OUT_ATTRIBUTE}="${OPT_OUT_VALUE}" on <html> to own the ` +
+                `stylesheet deliberately.`);
+        }
+    };
+    // A host stylesheet can land well after the module graph evaluates, and a
+    // bundler-injected <link> is not necessarily parsed by the time `load` fires.
+    // This is advisory output, so it is checked at a few widening points rather
+    // than raced: whichever one first sees a settled document wins, and the latch
+    // keeps the rest quiet. Missing the window costs a diagnostic, not
+    // correctness.
+    if (typeof requestAnimationFrame !== "function") {
+        check();
+        return;
+    }
+    requestAnimationFrame(() => requestAnimationFrame(check));
+    if (typeof window !== "undefined" && document.readyState !== "complete") {
+        window.addEventListener("load", () => check(), { once: true });
+    }
+    if (typeof setTimeout === "function") {
+        pendingChecks.push(setTimeout(check, 1000));
+    }
+}
+/**
+ * Test-only: clears the once-per-page warning latch and cancels any pending
+ * deferred check, so a timer scheduled by one test cannot warn during the next.
+ */
+export function resetContentStylesWarningForTesting() {
+    auditWarningIssued = false;
+    for (const handle of pendingChecks)
+        clearTimeout(handle);
+    pendingChecks.length = 0;
+}

package/dist/ui/debug-panel-persistence.js CHANGED Viewed

@@ -35,4 +35,3 @@ export function clearDebugPanelState(key) {
         // ignore
     }
 }
-//# sourceMappingURL=debug-panel-persistence.js.map

package/dist/ui/first-focusable.js CHANGED Viewed

@@ -24,4 +24,3 @@ export function isProgrammaticFocusTarget(el) {
         return false;
     return el.offsetParent !== null || el.getClientRects().length > 0;
 }
-//# sourceMappingURL=first-focusable.js.map

package/dist/ui/focus-trap.js CHANGED Viewed

@@ -81,4 +81,3 @@ export function createFocusTrap(container, options = {}) {
         }
     };
 }
-//# sourceMappingURL=focus-trap.js.map

package/dist/ui/safe-storage.js CHANGED Viewed

@@ -18,4 +18,3 @@ export function safeLocalStorageSet(key, value) {
         // ignore
     }
 }
-//# sourceMappingURL=safe-storage.js.map

package/dist/ui/scope-css.d.ts ADDED Viewed

@@ -0,0 +1,56 @@
+/**
+ * Scope an external stylesheet's rules to a single player instance, so a
+ * partner-authored stylesheet loaded via `<pie-item-player
+ * external-style-urls="...">` or `itemConfig.resources.stylesheets[*].url`
+ * styles that player's subtree instead of the whole host document.
+ *
+ * This replaces a single-regex implementation that prefixed every
+ * selector-like fragment. That is correct for flat selector rules and wrong for
+ * everything else: `@media screen { ... }` became
+ * `.scope @media screen { ... }`, an invalid selector, so the browser dropped
+ * the whole block and every rule inside it; `@font-face` and `@keyframes` were
+ * corrupted the same way; and `:root` became `.scope :root`, which can never
+ * match, because `:root` is `<html>` and is not a descendant of the player.
+ * At-rules and `:root` custom properties therefore never applied at all.
+ *
+ * The QTI player's `scopeCssRules` (`pie-qti` -
+ * `packages/item-player/src/components/utils/stylesheetRender.ts`) is not a
+ * drop-in either. Its `:root` handling is the behaviour we want and is adopted
+ * here, but it excludes `@` from its selector pattern rather than understanding
+ * at-rules, so `@media` and `@supports` lose their condition and their inner
+ * rules are hoisted and applied unconditionally — a mobile-only rule then
+ * applies at every viewport width, which is a subtler failure than dropping it.
+ *
+ * So this walks the stylesheet brace-by-brace instead of pattern-matching it.
+ * A real CSS parser would be the textbook answer and is deliberately not used:
+ * `@pie-players/pie-item-player` ships with two workspace dependencies, this
+ * runs in the delivery path, and scoping needs to know about rule boundaries
+ * only — not about property grammar.
+ *
+ * Known limits, all preserving existing behaviour rather than adding policy:
+ *
+ * - `@import` is passed through untouched, exactly as the old regex left it. It
+ *   pulls in an unscoped stylesheet, so it defeats scoping, but blocking it is
+ *   a security policy decision and not this function's job. Callers gate
+ *   stylesheet URLs with `validateExternalStyleUrl` before fetching.
+ * - Declaration blocks are emitted verbatim, so `url(...)` references are left
+ *   as authored and resolve against the stylesheet's own URL as before.
+ * - A style rule's block is never rewritten, which is also what native CSS
+ *   nesting needs: nested selectors are relative to a parent that has already
+ *   been scoped.
+ */
+/**
+ * Rewrite `cssText` so every selector it contains is confined to
+ * `scopeSelector`.
+ *
+ * Returns `cssText` unchanged when there is no scope selector to apply, and
+ * `""` for empty or non-string input.
+ */
+export declare function scopeStylesheetCss(cssText: unknown, scopeSelector: string): string;
+/**
+ * Confine a single selector to `scopeSelector`.
+ *
+ * Exported for tests and for callers that scope a selector they built
+ * themselves; `scopeStylesheetCss` is the entry point for stylesheet text.
+ */
+export declare function scopeSelector(selector: string, scopeSelector: string): string;

package/dist/ui/scope-css.js ADDED Viewed

@@ -0,0 +1,310 @@
+/**
+ * Scope an external stylesheet's rules to a single player instance, so a
+ * partner-authored stylesheet loaded via `<pie-item-player
+ * external-style-urls="...">` or `itemConfig.resources.stylesheets[*].url`
+ * styles that player's subtree instead of the whole host document.
+ *
+ * This replaces a single-regex implementation that prefixed every
+ * selector-like fragment. That is correct for flat selector rules and wrong for
+ * everything else: `@media screen { ... }` became
+ * `.scope @media screen { ... }`, an invalid selector, so the browser dropped
+ * the whole block and every rule inside it; `@font-face` and `@keyframes` were
+ * corrupted the same way; and `:root` became `.scope :root`, which can never
+ * match, because `:root` is `<html>` and is not a descendant of the player.
+ * At-rules and `:root` custom properties therefore never applied at all.
+ *
+ * The QTI player's `scopeCssRules` (`pie-qti` -
+ * `packages/item-player/src/components/utils/stylesheetRender.ts`) is not a
+ * drop-in either. Its `:root` handling is the behaviour we want and is adopted
+ * here, but it excludes `@` from its selector pattern rather than understanding
+ * at-rules, so `@media` and `@supports` lose their condition and their inner
+ * rules are hoisted and applied unconditionally — a mobile-only rule then
+ * applies at every viewport width, which is a subtler failure than dropping it.
+ *
+ * So this walks the stylesheet brace-by-brace instead of pattern-matching it.
+ * A real CSS parser would be the textbook answer and is deliberately not used:
+ * `@pie-players/pie-item-player` ships with two workspace dependencies, this
+ * runs in the delivery path, and scoping needs to know about rule boundaries
+ * only — not about property grammar.
+ *
+ * Known limits, all preserving existing behaviour rather than adding policy:
+ *
+ * - `@import` is passed through untouched, exactly as the old regex left it. It
+ *   pulls in an unscoped stylesheet, so it defeats scoping, but blocking it is
+ *   a security policy decision and not this function's job. Callers gate
+ *   stylesheet URLs with `validateExternalStyleUrl` before fetching.
+ * - Declaration blocks are emitted verbatim, so `url(...)` references are left
+ *   as authored and resolve against the stylesheet's own URL as before.
+ * - A style rule's block is never rewritten, which is also what native CSS
+ *   nesting needs: nested selectors are relative to a parent that has already
+ *   been scoped.
+ */
+/**
+ * At-rules whose block contains nested *rules*, so scoping has to recurse into
+ * the block while the prelude is preserved verbatim.
+ *
+ * Everything not listed here is passed through untouched. That is the safe
+ * default in both directions: at-rules whose block holds declarations rather
+ * than rules (`@font-face`, `@page`, `@property`, `@counter-style`) or
+ * non-selector keys (`@keyframes` percentages) must not be scoped, and an
+ * at-rule this list has never heard of is more safely left alone than guessed
+ * at.
+ */
+const NESTED_RULE_AT_RULES = new Set([
+    "media",
+    "supports",
+    "container",
+    "layer",
+    "scope",
+]);
+/** Matches a leading `:root`, `html` or `body` not followed by more name characters. */
+const DOCUMENT_ROOT_PREFIX = /^(?::root|html|body)(?![\w-])/;
+/** Matches an at-rule name, with any vendor prefix, at the start of a prelude. */
+const AT_RULE_NAME = /^@(?:-[a-z]+-)?([\w-]+)/i;
+/**
+ * Rewrite `cssText` so every selector it contains is confined to
+ * `scopeSelector`.
+ *
+ * Returns `cssText` unchanged when there is no scope selector to apply, and
+ * `""` for empty or non-string input.
+ */
+export function scopeStylesheetCss(cssText, scopeSelector) {
+    if (typeof cssText !== "string" || cssText.length === 0)
+        return "";
+    const scope = scopeSelector?.trim();
+    if (!scope)
+        return cssText;
+    return scopeRuleList(stripComments(cssText), scope);
+}
+/**
+ * Confine a single selector to `scopeSelector`.
+ *
+ * Exported for tests and for callers that scope a selector they built
+ * themselves; `scopeStylesheetCss` is the entry point for stylesheet text.
+ */
+export function scopeSelector(selector, scopeSelector) {
+    const sel = selector.trim();
+    const scope = scopeSelector.trim();
+    if (!sel || !scope)
+        return "";
+    // Idempotent: re-scoping already-scoped CSS must not nest the scope twice.
+    // Deliberately narrow — a bare `startsWith` would also skip an authored
+    // selector that merely shares the scope's leading characters.
+    if (sel === scope || sel.startsWith(`${scope} `))
+        return sel;
+    // `:root`/`html`/`body` are replaced rather than prefixed. Prefixing yields
+    // `.scope :root`, a selector that cannot match, which is how external
+    // `:root { --var: ... }` custom properties used to disappear. Any compound
+    // or combinator that followed is preserved: `html.dark .a` -> `.scope.dark .a`.
+    const rootPrefix = DOCUMENT_ROOT_PREFIX.exec(sel);
+    if (rootPrefix)
+        return `${scope}${sel.slice(rootPrefix[0].length)}`;
+    // Everything else becomes a descendant, including a leading pseudo-class or
+    // pseudo-element. `pie-qti`'s scoper attaches those to the scope instead,
+    // which is not the same selector: `:is(.a, .b) .c` authored at stylesheet
+    // level means "some element matching .a or .b", so attaching it demands that
+    // the *player root* carry the partner's class, and it never does. The same
+    // holds for `:hover` and `::selection` — the author meant an element in the
+    // content, not the player's own box. Root selectors are the one case where
+    // attaching is right, and they are handled above.
+    return `${scope} ${sel}`;
+}
+function scopeRuleList(css, scope) {
+    let out = "";
+    let index = 0;
+    while (index < css.length) {
+        const node = readNode(css, index);
+        if (node.end <= index)
+            break;
+        out += renderNode(node, scope);
+        index = node.end;
+    }
+    return out;
+}
+function renderNode(node, scope) {
+    if (node.kind === "statement") {
+        const text = node.text.trim();
+        // A stray `;` at rule-list level carries nothing worth re-emitting.
+        return text === ";" ? "" : `${text}\n`;
+    }
+    if (node.kind === "trailing") {
+        // Only whitespace is expected here; anything else is malformed CSS that
+        // is better passed through than dropped.
+        return node.text.trim() ? `${node.text.trim()}\n` : "";
+    }
+    const prelude = node.prelude.trim();
+    if (!prelude)
+        return "";
+    if (prelude.startsWith("@")) {
+        const name = AT_RULE_NAME.exec(prelude)?.[1]?.toLowerCase();
+        if (name && NESTED_RULE_AT_RULES.has(name)) {
+            const inner = scopeRuleList(node.block, scope);
+            if (!inner.trim())
+                return "";
+            return `${prelude} {\n${inner}}\n`;
+        }
+        return `${prelude} {${node.block}}\n`;
+    }
+    const selectors = splitTopLevel(prelude, ",")
+        .map((selector) => scopeSelector(selector, scope))
+        .filter(Boolean);
+    if (selectors.length === 0)
+        return "";
+    return `${selectors.join(", ")} {${node.block}}\n`;
+}
+/**
+ * Read one node starting at `start`, tracking strings and parentheses so a `{`
+ * inside `content: "{"` or a `,` inside `:is(a, b)` is not mistaken for
+ * structure.
+ */
+function readNode(css, start) {
+    let index = start;
+    let quote = null;
+    let parenDepth = 0;
+    while (index < css.length) {
+        const char = css[index];
+        if (quote) {
+            if (char === "\\")
+                index += 1;
+            else if (char === quote)
+                quote = null;
+        }
+        else if (char === '"' || char === "'") {
+            quote = char;
+        }
+        else if (char === "(") {
+            parenDepth += 1;
+        }
+        else if (char === ")") {
+            if (parenDepth > 0)
+                parenDepth -= 1;
+        }
+        else if (parenDepth === 0 && char === ";") {
+            return {
+                kind: "statement",
+                text: css.slice(start, index + 1),
+                end: index + 1,
+            };
+        }
+        else if (parenDepth === 0 && char === "{") {
+            const blockEnd = findBlockEnd(css, index);
+            return {
+                kind: "rule",
+                prelude: css.slice(start, index),
+                block: css.slice(index + 1, blockEnd.contentEnd),
+                end: blockEnd.end,
+            };
+        }
+        index += 1;
+    }
+    return { kind: "trailing", text: css.slice(start), end: css.length };
+}
+/**
+ * Find the `}` matching the `{` at `openIndex`. Unbalanced input (a truncated
+ * stylesheet) is treated as running to the end rather than throwing.
+ */
+function findBlockEnd(css, openIndex) {
+    let depth = 0;
+    let quote = null;
+    for (let index = openIndex; index < css.length; index += 1) {
+        const char = css[index];
+        if (quote) {
+            if (char === "\\")
+                index += 1;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            continue;
+        }
+        if (char === "{")
+            depth += 1;
+        else if (char === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return { contentEnd: index, end: index + 1 };
+        }
+    }
+    return { contentEnd: css.length, end: css.length };
+}
+/** Split on `separator` at paren depth zero and outside strings. */
+function splitTopLevel(value, separator) {
+    const parts = [];
+    let current = "";
+    let quote = null;
+    let parenDepth = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const char = value[index];
+        if (quote) {
+            current += char;
+            if (char === "\\" && index + 1 < value.length) {
+                current += value[index + 1];
+                index += 1;
+            }
+            else if (char === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (char === "(")
+            parenDepth += 1;
+        else if (char === ")" && parenDepth > 0)
+            parenDepth -= 1;
+        if (char === separator && parenDepth === 0) {
+            parts.push(current);
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    parts.push(current);
+    return parts;
+}
+/**
+ * Remove comments before walking, so a comment sitting between two rules is not
+ * absorbed into the next rule's selector list. String-aware, so a literal
+ * `content: "/*"` survives.
+ */
+function stripComments(css) {
+    let out = "";
+    let quote = null;
+    let index = 0;
+    while (index < css.length) {
+        const char = css[index];
+        if (quote) {
+            out += char;
+            if (char === "\\" && index + 1 < css.length) {
+                out += css[index + 1];
+                index += 2;
+                continue;
+            }
+            if (char === quote)
+                quote = null;
+            index += 1;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            out += char;
+            index += 1;
+            continue;
+        }
+        if (char === "/" && css[index + 1] === "*") {
+            const close = css.indexOf("*/", index + 2);
+            index = close === -1 ? css.length : close + 2;
+            // Keep a space so `a/**/b` does not become the single token `ab`.
+            out += " ";
+            continue;
+        }
+        out += char;
+        index += 1;
+    }
+    return out;
+}

package/dist/ui/zoom-compensation.js CHANGED Viewed

@@ -41,4 +41,3 @@ export function approximateZoomFromWidths(outerWidth, innerWidth) {
 export function computeZoomCompensation(zoom, maxZoom, minCompensation) {
     return Math.max(minCompensation, Math.min(1, maxZoom / zoom));
 }
-//# sourceMappingURL=zoom-compensation.js.map

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "@pie-players/pie-players-shared",
-	"version": "0.3.60",
+	"version": "0.3.62",
 	"type": "module",
 	"description": "Shared runtime + UI utilities for PIE players",
 	"license": "MIT",
@@ -64,6 +64,10 @@
 		"./ui/zoom-compensation": {
 			"types": "./dist/ui/zoom-compensation.d.ts",
 			"import": "./dist/ui/zoom-compensation.js"
+		},
+		"./ui/content-styles": {
+			"types": "./dist/ui/content-styles.d.ts",
+			"import": "./dist/ui/content-styles.js"
 		}
 	},
 	"files": [
@@ -72,7 +76,7 @@
 	"dependencies": {
 		"@pie-lib/math-rendering-module": "5.1.0",
 		"dompurify": "^3.4.0",
-		"semver": "^7.7.4"
+		"semver": "^7.8.5"
 	},
 	"scripts": {
 		"build": "rm -rf dist tsconfig.tsbuildinfo && tsc -p tsconfig.json && mkdir -p dist/components && cp -R src/components/vendor dist/components/vendor",
@@ -85,11 +89,11 @@
 		"scan-hardcoded": "bun run src/i18n/scripts/scan-hardcoded.ts"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.4.12",
-		"@happy-dom/global-registrator": "^20.9.0",
+		"@biomejs/biome": "^2.5.6",
+		"@happy-dom/global-registrator": "^20.11.1",
 		"@types/semver": "^7.7.1",
 		"glob": "^13.0.0",
-		"svelte": "^5.55.4",
+		"svelte": "^5.56.8",
 		"typescript": "^5.9.3"
 	},
 	"homepage": "https://github.com/pie-framework/pie-players/tree/master/packages/players-shared#readme",

package/dist/config/profile.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/config/profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAC/D,MAAM,0BAA0B,GAAG,GAAG,0BAA0B,WAAW,CAAC;AAS5E,SAAS,aAAa,CAAC,GAAW;IACjC,IAAI,CAAC;QACJ,sBAAsB;QACtB,MAAM,CAAC,GAAI,MAAM,CAAC,IAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAC9B,CAAC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,sBAAsB,CAAC;IAChE,aAAa,CAAC,2BAA2B,CAAC;IAC1C,0BAA0B,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAC9B,CAAC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,sBAAsB,CAAC;IAChE,aAAa,CAAC,2BAA2B,CAAC;IAC1C,0BAA0B,CAAC","sourcesContent":["/**\n * Minimal, frontend-safe defaults for PIE build service URLs.\n *\n * In PIEOneer, these come from `$env/dynamic/public`. In `pie-players` we avoid\n * SvelteKit env dependencies so this can be consumed by any bundler.\n */\n\n// Default public bundle host. Keep this aligned with the IIFE loader default.\n// (We prefer the proxy endpoint, which is stable/cached for browser usage.)\nconst DEFAULT_BUILDER_ORIGIN_URL = \"https://proxy.pie-api.com\";\nconst DEFAULT_BUILDER_BUNDLE_URL = `${DEFAULT_BUILDER_ORIGIN_URL}/bundles/`;\n\ndeclare global {\n\tinterface Window {\n\t\tPIE_BUILDER_ORIGIN_URL?: string;\n\t\tPIE_BUILDER_BUNDLE_URL?: string;\n\t}\n}\n\nfunction readPublicEnv(key: string): string | undefined {\n\ttry {\n\t\t// Vite/SvelteKit-like\n\t\tconst v = (import.meta as any)?.env?.[key];\n\t\tif (typeof v === \"string\" && v.length > 0) return v;\n\t} catch {}\n\treturn undefined;\n}\n\nexport const BUILDER_ORIGIN_URL =\n\t(typeof window !== \"undefined\" && window.PIE_BUILDER_ORIGIN_URL) ||\n\treadPublicEnv(\"PUBLIC_BUILDER_ORIGIN_URL\") ||\n\tDEFAULT_BUILDER_ORIGIN_URL;\n\nexport const BUILDER_BUNDLE_URL =\n\t(typeof window !== \"undefined\" && window.PIE_BUILDER_BUNDLE_URL) ||\n\treadPublicEnv(\"PUBLIC_BUILDER_BUNDLE_URL\") ||\n\tDEFAULT_BUILDER_BUNDLE_URL;\n"]}

package/dist/i18n/index.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/i18n/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["/**\n * I18n Module\n *\n * Internationalization system for PIE Players.\n *\n * @module @pie-players/pie-players-shared/i18n\n */\n\nexport {\n\tBUNDLED_TRANSLATIONS,\n\tgetAvailableLocales,\n\tisRTLLocale,\n\tloadTranslations,\n} from \"./loader.js\";\nexport { SimpleI18n } from \"./simple-i18n.js\";\nexport type {\n\tI18nConfig,\n\tI18nServiceApi,\n\tPluralTranslation,\n\tTranslationBundle,\n} from \"./types.js\";\n"]}