@pixerate/editor 0.140.0 → 0.140.1

package/dist/{chunk-NKBUVQJW.cjs → chunk-5WOY52O6.cjs}

@@ -5,7 +5,7 @@ var _chunkJLWLX52Lcjs = require('./chunk-JLWLX52L.cjs');
 
 
 
-var _chunkF652BKMScjs = require('./chunk-F652BKMS.cjs');
+var _chunkYN6JKAUEcjs = require('./chunk-YN6JKAUE.cjs');
 
 
 
@@ -316,7 +316,7 @@ function threadsOf(source) {
   return Array.isArray(value.threads) ? [...value.threads] : [];
 }
 function stylesOf(source) {
-  if (!source) return { styles: _chunkF652BKMScjs.DEFAULT_STYLES.map((s) => ({ ...s })), defaults: {} };
+  if (!source) return { styles: _chunkYN6JKAUEcjs.DEFAULT_STYLES.map((s) => ({ ...s })), defaults: {} };
   if (Array.isArray(source)) return { styles: [...source], defaults: {} };
   const value = source;
   const json = typeof value.toJSON === "function" ? value.toJSON() : value;
@@ -384,7 +384,7 @@ function runFormatOf(marks) {
         break;
       }
       case "characterStyle":
-        if (_chunkF652BKMScjs.isValidStyleId.call(void 0, attrs2.styleId)) format.charStyle = attrs2.styleId;
+        if (_chunkYN6JKAUEcjs.isValidStyleId.call(void 0, attrs2.styleId)) format.charStyle = attrs2.styleId;
         break;
       case "link":
         format.charStyle ??= "Hyperlink";
@@ -522,7 +522,7 @@ var DocxBuilder = (_class2 = class {
     this.styles = styles;
     this.anonymous = options.privacy === "strip-authors";
     this.defaultAuthor = authorOf(options.author);
-    this.styleIds = new Set(styles.styles.filter((s) => _chunkF652BKMScjs.isValidStyleId.call(void 0, s.id)).map((s) => s.id));
+    this.styleIds = new Set(styles.styles.filter((s) => _chunkYN6JKAUEcjs.isValidStyleId.call(void 0, s.id)).map((s) => s.id));
   }
   
   
@@ -713,7 +713,7 @@ var DocxBuilder = (_class2 = class {
   styleFor(node, ctx, opts) {
     const own = _optionalChain([node, 'access', _37 => _37.attrs, 'optionalAccess', _38 => _38.styleId]);
     if (own) {
-      if (_chunkF652BKMScjs.isValidStyleId.call(void 0, own) && this.styleIds.has(own)) return own;
+      if (_chunkYN6JKAUEcjs.isValidStyleId.call(void 0, own) && this.styleIds.has(own)) return own;
       this.drop("style", String(own), "style is not in the registry");
     }
     if (opts.heading) return this.needStyle(`Heading${opts.heading}`);
@@ -730,7 +730,7 @@ var DocxBuilder = (_class2 = class {
   previousStyle(previous) {
     if (!previous) return void 0;
     const id = _optionalChain([previous, 'access', _39 => _39.attrs, 'optionalAccess', _40 => _40.styleId]);
-    if (_chunkF652BKMScjs.isValidStyleId.call(void 0, id) && this.styleIds.has(id)) return id;
+    if (_chunkYN6JKAUEcjs.isValidStyleId.call(void 0, id) && this.styleIds.has(id)) return id;
     if (previous.type === "heading") return this.needStyle(`Heading${Math.max(1, Math.min(6, Number(_optionalChain([previous, 'access', _41 => _41.attrs, 'optionalAccess', _42 => _42.level])) || 1))}`);
     if (previous.type === "codeBlock") return this.needStyle("Code");
     return void 0;
@@ -1200,7 +1200,7 @@ var DocxBuilder = (_class2 = class {
     if (defaults.paragraph && Object.keys(defaults.paragraph).length) writeParagraphFormat(w, defaults.paragraph);
     else w.empty("w:spacing", { "w:after": 160, "w:line": 259, "w:lineRule": "auto" });
     w.close("w:pPr").close("w:pPrDefault").close("w:docDefaults");
-    const byId = new Map(this.styles.styles.filter((s) => _chunkF652BKMScjs.isValidStyleId.call(void 0, s.id)).map((s) => [s.id, s]));
+    const byId = new Map(this.styles.styles.filter((s) => _chunkYN6JKAUEcjs.isValidStyleId.call(void 0, s.id)).map((s) => [s.id, s]));
     const written = /* @__PURE__ */ new Set();
     const blockOf = (style) => {
       let current = style;
@@ -1213,7 +1213,7 @@ var DocxBuilder = (_class2 = class {
     const writeStyle = (style) => {
       if (written.has(style.id)) return;
       written.add(style.id);
-      const isNormal = style.kind === "paragraph" && style.id === _chunkF652BKMScjs.NORMAL_STYLE_ID;
+      const isNormal = style.kind === "paragraph" && style.id === _chunkYN6JKAUEcjs.NORMAL_STYLE_ID;
       w.open("w:style", {
         "w:type": style.kind === "character" ? "character" : "paragraph",
         "w:default": isNormal ? 1 : void 0,
@@ -1255,7 +1255,7 @@ var DocxBuilder = (_class2 = class {
     byId.forEach((style) => visit(style));
     for (const id of this.extraStyles) {
       if (written.has(id)) continue;
-      const extra = _nullishCoalesce(EXTRA_STYLES[id], () => ( { id, name: id, kind: "paragraph", basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID }));
+      const extra = _nullishCoalesce(EXTRA_STYLES[id], () => ( { id, name: id, kind: "paragraph", basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID }));
       byId.set(id, extra);
       writeStyle(extra);
     }
@@ -1425,7 +1425,7 @@ var EXTRA_STYLES = {
     id: "BlockText",
     name: "Block Text",
     kind: "paragraph",
-    basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID,
+    basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
     paragraph: { indentLeft: "0.5in", indentRight: "0.5in" },
     character: { italic: true },
     priority: 99,
@@ -1435,7 +1435,7 @@ var EXTRA_STYLES = {
     id: "ListParagraph",
     name: "List Paragraph",
     kind: "paragraph",
-    basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID,
+    basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
     paragraph: { indentLeft: "0.5in" },
     priority: 34,
     quick: true,
@@ -1445,7 +1445,7 @@ var EXTRA_STYLES = {
     id: "Code",
     name: "Code",
     kind: "paragraph",
-    basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID,
+    basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
     block: { type: "codeBlock" },
     character: { fontFamily: "Consolas", fontSize: "10pt" },
     paragraph: { spaceAfter: "0pt", lineHeight: "1" },
@@ -1473,7 +1473,7 @@ var EXTRA_STYLES = {
     id: "CommentText",
     name: "annotation text",
     kind: "paragraph",
-    basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID,
+    basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
     character: { fontSize: "10pt" },
     priority: 99,
     hidden: true,
@@ -1485,8 +1485,8 @@ for (let level = 1; level <= 6; level++) {
     id: `Heading${level}`,
     name: `Heading ${level}`,
     kind: "paragraph",
-    basedOn: _chunkF652BKMScjs.NORMAL_STYLE_ID,
-    next: _chunkF652BKMScjs.NORMAL_STYLE_ID,
+    basedOn: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
+    next: _chunkYN6JKAUEcjs.NORMAL_STYLE_ID,
     block: { type: "heading", attrs: { level } },
     character: { bold: true },
     priority: 9,

package/dist/{chunk-5G3KYRER.js → chunk-6GAYGQDC.js}

@@ -15,11 +15,12 @@ import {
 } from "./chunk-RN767PO6.js";
 import {
   plainTextToSlice
-} from "./chunk-SWZTQWY7.js";
+} from "./chunk-2INPJDNY.js";
 import {
   TRACK_CHANGES_SKIP_META,
-  isTrackChangesEnabled
-} from "./chunk-HZZXBTLB.js";
+  isTrackChangesEnabled,
+  safeMergeAttributes
+} from "./chunk-6IN474P4.js";
 
 // src/extensions/table/nesting.ts
 import { Fragment, Slice } from "@tiptap/pm/model";
@@ -1332,7 +1333,7 @@ function createChartNodeView(mount, renderStatic) {
 }
 
 // src/extensions/chart/chart-node.ts
-import { Node, mergeAttributes } from "@tiptap/core";
+import { Node } from "@tiptap/core";
 import { Plugin as Plugin2, PluginKey as PluginKey2 } from "@tiptap/pm/state";
 
 // src/extensions/document-structure/utils.ts
@@ -1550,7 +1551,7 @@ var Chart = Node.create({
     const svg = staticChartSvg(node, this.options);
     return [
       "div",
-      mergeAttributes(this.options.HTMLAttributes, HTMLAttributes, {
+      safeMergeAttributes(this.options.HTMLAttributes, HTMLAttributes, {
         "data-type": "chart",
         class: "pixerate-chart"
       }),
@@ -1630,7 +1631,7 @@ var Chart = Node.create({
 });
 
 // src/extensions/chart/sparkline-node.ts
-import { Node as Node2, mergeAttributes as mergeAttributes2 } from "@tiptap/core";
+import { Node as Node2 } from "@tiptap/core";
 var SPARKLINE_KINDS = ["line", "column", "win-loss"];
 var MAX_SPARKLINE_VALUES = 1e3;
 function normalizeSparklineValues(values) {
@@ -1717,7 +1718,7 @@ var Sparkline = Node2.create({
     });
     return [
       "span",
-      mergeAttributes2(this.options.HTMLAttributes, HTMLAttributes, {
+      safeMergeAttributes(this.options.HTMLAttributes, HTMLAttributes, {
         "data-type": "sparkline",
         class: "pixerate-sparkline"
       }),

package/dist/{chunk-HZZXBTLB.js → chunk-6IN474P4.js}

@@ -1,3 +1,22 @@
+import {
+  isUnsafeJsonKey,
+  stripPrototypeKeys
+} from "./chunk-HF5QZS7Z.js";
+
+// src/extensions/safe-merge-attributes.ts
+import { mergeAttributes } from "@tiptap/core";
+function safeMergeAttributes(...objects) {
+  return mergeAttributes(
+    ...objects.filter((item) => !!item).map((item) => {
+      const keys = Object.keys(item);
+      if (!keys.some(isUnsafeJsonKey)) return item;
+      const copy = {};
+      for (const key of keys) if (!isUnsafeJsonKey(key)) copy[key] = item[key];
+      return copy;
+    })
+  );
+}
+
 // src/extensions/comment-store.ts
 var idCounter = 0;
 function createReviewId(prefix = "c") {
@@ -44,7 +63,7 @@ var CommentStore = class _CommentStore {
   }
   /** Parses `toJSON()` output (or a plain thread array). */
   static parse(json) {
-    const value = typeof json === "string" ? JSON.parse(json) : json;
+    const value = stripPrototypeKeys(typeof json === "string" ? JSON.parse(json) : json);
     const list = Array.isArray(value) ? value : value?.threads;
     if (!Array.isArray(list)) return [];
     return list.filter((t) => t && t.id != null).map(normalizeThread);
@@ -237,7 +256,7 @@ function formatReviewTime(timestamp, now = Date.now()) {
 }
 
 // src/extensions/track-changes.ts
-import { Extension, Mark, mergeAttributes } from "@tiptap/core";
+import { Extension, Mark } from "@tiptap/core";
 import {
   Plugin,
   PluginKey,
@@ -369,7 +388,7 @@ var TrackedInsertion = Mark.create({
     const base = mark.attrs[MOVE_ID_ATTRIBUTE] ? this.options.moveHTMLAttributes : this.options.HTMLAttributes;
     return [
       "ins",
-      mergeAttributes(base, HTMLAttributes, {
+      safeMergeAttributes(base, HTMLAttributes, {
         "data-change-type": "insertion"
       }),
       0
@@ -403,7 +422,7 @@ var TrackedDeletion = Mark.create({
     const base = mark.attrs[MOVE_ID_ATTRIBUTE] ? this.options.moveHTMLAttributes : this.options.HTMLAttributes;
     return [
       "del",
-      mergeAttributes(base, HTMLAttributes, {
+      safeMergeAttributes(base, HTMLAttributes, {
         "data-change-type": "deletion"
       }),
       0
@@ -444,7 +463,7 @@ var TrackedFormatChange = Mark.create({
   renderHTML({ HTMLAttributes }) {
     return [
       "span",
-      mergeAttributes(this.options.HTMLAttributes, HTMLAttributes, {
+      safeMergeAttributes(this.options.HTMLAttributes, HTMLAttributes, {
         "data-change-type": "format"
       }),
       0
@@ -1931,6 +1950,7 @@ var TrackChanges = Extension.create({
 });
 
 export {
+  safeMergeAttributes,
   createReviewId,
   CommentStore,
   createCommentStore,

package/dist/{chunk-HDCH35UM.cjs → chunk-AGCD3EHB.cjs}

@@ -3,7 +3,7 @@
 
 
 
-var _chunkZAOOIJ6Icjs = require('./chunk-ZAOOIJ6I.cjs');
+var _chunkHDK3T2QScjs = require('./chunk-HDK3T2QS.cjs');
 
 // src/bridge/index.ts
 var _http = require('http');
@@ -197,7 +197,7 @@ var SKILL_INSTRUCTIONS = "Each editor's tools are documented by an agent skill (
 async function createToolBridge(options) {
   const log = _nullishCoalesce(options.log, () => ( ((message) => process.stderr.write(`[${options.name}] ${message}
 `))));
-  const port = _nullishCoalesce(options.port, () => ( _chunkZAOOIJ6Icjs.TOOL_BRIDGE_DEFAULT_PORT));
+  const port = _nullishCoalesce(options.port, () => ( _chunkHDK3T2QScjs.TOOL_BRIDGE_DEFAULT_PORT));
   const retryMs = _nullishCoalesce(options.retryMs, () => ( 2e3));
   const timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( 6e4));
   const extraOrigins = new Set(_nullishCoalesce(options.origins, () => ( [])));
@@ -211,7 +211,7 @@ async function createToolBridge(options) {
   let closed = false;
   let retry;
   const send = (editor, message) => editor.socket.send(JSON.stringify(message));
-  const registry = new (0, _chunkZAOOIJ6Icjs.ToolRegistry)();
+  const registry = new (0, _chunkHDK3T2QScjs.ToolRegistry)();
   const listeners = /* @__PURE__ */ new Set();
   const toolsChanged = () => listeners.forEach((l) => l());
   const describeEditors = () => [...editors.values()].map((e) => `${e.id} (${e.name})`).join(", ");
@@ -319,13 +319,13 @@ async function createToolBridge(options) {
         return;
       }
       if (message.t === "hello") {
-        if (message.v !== _chunkZAOOIJ6Icjs.TOOL_BRIDGE_PROTOCOL) {
+        if (message.v !== _chunkHDK3T2QScjs.TOOL_BRIDGE_PROTOCOL) {
           log(`refused an editor speaking protocol v${String(message.v)}`);
-          return ws.close(1008, `This bridge speaks protocol v${_chunkZAOOIJ6Icjs.TOOL_BRIDGE_PROTOCOL}; update @pixerate/editor.`);
+          return ws.close(1008, `This bridge speaks protocol v${_chunkHDK3T2QScjs.TOOL_BRIDGE_PROTOCOL}; update @pixerate/editor.`);
         }
         editor = { id: `e${++editorCounter}`, name: String(message.name || "Editor"), ...message.kind ? { kind: message.kind } : {}, socket: ws, tools: Array.isArray(message.tools) ? message.tools : [], activeAt: Date.now(), activeSeq: ++activity };
         editors.set(editor.id, editor);
-        ws.send(JSON.stringify({ t: "welcome", v: _chunkZAOOIJ6Icjs.TOOL_BRIDGE_PROTOCOL, id: editor.id }));
+        ws.send(JSON.stringify({ t: "welcome", v: _chunkHDK3T2QScjs.TOOL_BRIDGE_PROTOCOL, id: editor.id }));
         log(`editor ${editor.id} connected: ${editor.name} (${editor.tools.length} tools)`);
         toolsChanged();
       } else if (message.t === "tools" && editor) {
@@ -381,7 +381,7 @@ async function createToolBridge(options) {
 `)]);
   const skills = options.skills === false ? {} : _nullishCoalesce(options.skills, () => ( loadSkillFiles()));
   const hasSkills = Object.keys(skills).length > 0;
-  const mcp = _chunkZAOOIJ6Icjs.createMcpServer.call(void 0, registry, {
+  const mcp = _chunkHDK3T2QScjs.createMcpServer.call(void 0, registry, {
     name: options.name,
     version: _nullishCoalesce(options.version, () => ( "0.1.0")),
     instructions: [options.instructions, BRIDGE_INSTRUCTIONS, hasSkills ? SKILL_INSTRUCTIONS : ""].filter(Boolean).join("\n\n"),

package/dist/{chunk-6I63VZ45.js → chunk-CXXKJBQZ.js}

@@ -1,3 +1,7 @@
+import {
+  isUnsafeJsonKey
+} from "./chunk-HF5QZS7Z.js";
+
 // src/extensions/paragraph-styles/registry.ts
 var MAX_CHAIN = 32;
 var STYLE_ID = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
@@ -154,7 +158,7 @@ function overlay(base, patch) {
   if (!patch) return base;
   const out = { ...base };
   Object.entries(patch).forEach(([key, value]) => {
-    if (value !== void 0 && value !== null) out[key] = value;
+    if (value !== void 0 && value !== null && !isUnsafeJsonKey(key)) out[key] = value;
   });
   return out;
 }

package/dist/{chunk-6NXVDJDR.cjs → chunk-G43MNQ4C.cjs}

@@ -8,7 +8,7 @@ var _chunkJG5VGCKPcjs = require('./chunk-JG5VGCKP.cjs');
 
 
 
-var _chunkCCKP4XANcjs = require('./chunk-CCKP4XAN.cjs');
+var _chunk34RQAGWIcjs = require('./chunk-34RQAGWI.cjs');
 
 // src/serializers/plain-text.ts
 var _model = require('@tiptap/pm/model');
@@ -261,16 +261,16 @@ function resolvedBlockOperationsHtml(editor, view) {
   doc.descendants((node) => {
     if (found) return false;
     if (node.isTextblock) {
-      if (_optionalChain([node, 'access', _3 => _3.attrs, 'optionalAccess', _4 => _4[_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE], 'optionalAccess', _5 => _5.operation])) found = true;
+      if (_optionalChain([node, 'access', _3 => _3.attrs, 'optionalAccess', _4 => _4[_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE], 'optionalAccess', _5 => _5.operation])) found = true;
       else node.forEach((child) => {
-        if (child.marks.some((mark) => _optionalChain([mark, 'access', _6 => _6.attrs, 'optionalAccess', _7 => _7[_chunkCCKP4XANcjs.MOVE_ID_ATTRIBUTE]]))) found = true;
+        if (child.marks.some((mark) => _optionalChain([mark, 'access', _6 => _6.attrs, 'optionalAccess', _7 => _7[_chunk34RQAGWIcjs.MOVE_ID_ATTRIBUTE]]))) found = true;
       });
       return false;
     }
     return true;
   });
   if (!found) return null;
-  const resolved = _chunkCCKP4XANcjs.resolveTrackedChanges.call(void 0, doc, view);
+  const resolved = _chunk34RQAGWIcjs.resolveTrackedChanges.call(void 0, doc, view);
   const container = document.createElement("div");
   container.appendChild(_model.DOMSerializer.fromSchema(doc.type.schema).serializeFragment(resolved.content));
   return container.innerHTML;
@@ -818,7 +818,7 @@ function getEditorMarkdown(editor, options = {}) {
   if (typeof _optionalChain([markdown, 'optionalAccess', _50 => _50.getMarkdown]) === "function") {
     const doc = _optionalChain([editor, 'access', _51 => _51.state, 'optionalAccess', _52 => _52.doc]);
     if (doc && typeof _optionalChain([markdown, 'access', _53 => _53.serializer, 'optionalAccess', _54 => _54.serialize]) === "function") {
-      const resolved = _chunkCCKP4XANcjs.resolveTrackedChanges.call(void 0, doc, _nullishCoalesce(options.trackedChanges, () => ( "accepted")));
+      const resolved = _chunk34RQAGWIcjs.resolveTrackedChanges.call(void 0, doc, _nullishCoalesce(options.trackedChanges, () => ( "accepted")));
       if (resolved !== doc) return markdown.serializer.serialize(resolved);
     }
     return markdown.getMarkdown();

package/dist/{chunk-ZAOOIJ6I.cjs → chunk-HDK3T2QS.cjs}

@@ -1,5 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2;
 
+var _chunk2BSBFBOAcjs = require('./chunk-2BSBFBOA.cjs');
+
+
 var _chunkWOFXZ3XUcjs = require('./chunk-WOFXZ3XU.cjs');
 
 // src/tools/skills.ts
@@ -593,7 +596,7 @@ var ToolRegistry = (_class2 = class {
       return errorResult({ code: "unknown_tool", message: unknownToolMessage(name, match.candidates), tool: name });
     }
     name = found.name;
-    const input = _nullishCoalesce(args, () => ( {}));
+    const input = _chunk2BSBFBOAcjs.stripPrototypeKeys.call(void 0, _nullishCoalesce(args, () => ( {})));
     if (this.options.validateArguments) {
       const details = _chunkWOFXZ3XUcjs.validateJsonSchema.call(void 0, input, found.tool.inputSchema);
       if (details.length > 0) {

package/dist/chunk-HF5QZS7Z.js

@@ -0,0 +1,46 @@
+// src/tools/safe-json.ts
+var UNSAFE_JSON_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var isUnsafeJsonKey = (key) => UNSAFE_JSON_KEYS.has(key);
+var isPlainObject = (value) => {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+function hasUnsafeKeys(value, seen) {
+  if (value === null || typeof value !== "object" || seen.has(value)) return false;
+  seen.add(value);
+  if (Array.isArray(value)) return value.some((item) => hasUnsafeKeys(item, seen));
+  if (!isPlainObject(value)) return false;
+  for (const key of Object.keys(value)) {
+    if (isUnsafeJsonKey(key) || hasUnsafeKeys(value[key], seen)) return true;
+  }
+  return false;
+}
+function strip(value, seen) {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return seen.get(value);
+  if (Array.isArray(value)) {
+    const out2 = [];
+    seen.set(value, out2);
+    for (const item of value) out2.push(strip(item, seen));
+    return out2;
+  }
+  if (!isPlainObject(value)) return value;
+  const out = {};
+  seen.set(value, out);
+  for (const key of Object.keys(value)) {
+    if (isUnsafeJsonKey(key)) continue;
+    out[key] = strip(value[key], seen);
+  }
+  return out;
+}
+function stripPrototypeKeys(value) {
+  if (!hasUnsafeKeys(value, /* @__PURE__ */ new Set())) return value;
+  return strip(value, /* @__PURE__ */ new Map());
+}
+
+export {
+  UNSAFE_JSON_KEYS,
+  isUnsafeJsonKey,
+  stripPrototypeKeys
+};

package/dist/{chunk-S7I3RI5Z.cjs → chunk-HMGWFXEC.cjs}

@@ -7,7 +7,10 @@
 
 
 
-var _chunkCCKP4XANcjs = require('./chunk-CCKP4XAN.cjs');
+var _chunk34RQAGWIcjs = require('./chunk-34RQAGWI.cjs');
+
+
+var _chunk2BSBFBOAcjs = require('./chunk-2BSBFBOA.cjs');
 
 // src/compare/diff.ts
 var EQUAL = 0;
@@ -257,9 +260,9 @@ var _core = require('@tiptap/core');
 
 var _model = require('@tiptap/pm/model');
 var REVIEW_MARK_NAMES = /* @__PURE__ */ new Set([
-  _chunkCCKP4XANcjs.INSERTION_MARK_NAME,
-  _chunkCCKP4XANcjs.DELETION_MARK_NAME,
-  _chunkCCKP4XANcjs.FORMAT_CHANGE_MARK_NAME,
+  _chunk34RQAGWIcjs.INSERTION_MARK_NAME,
+  _chunk34RQAGWIcjs.DELETION_MARK_NAME,
+  _chunk34RQAGWIcjs.FORMAT_CHANGE_MARK_NAME,
   "comment",
   "bookmark"
 ]);
@@ -286,7 +289,7 @@ function toNode(source, schema) {
     const node = source;
     return node.type.schema === schema ? node : schema.nodeFromJSON(node.toJSON());
   }
-  return schema.nodeFromJSON(source);
+  return schema.nodeFromJSON(_chunk2BSBFBOAcjs.stripPrototypeKeys.call(void 0, source));
 }
 function newAttributes(ctx) {
   return {
@@ -303,7 +306,7 @@ function lazyAttributes(ctx) {
 }
 function stripBlockChange(attrs) {
   const copy = { ...attrs };
-  delete copy[_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE];
+  delete copy[_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE];
   return copy;
 }
 function wrapperOf(node) {
@@ -316,7 +319,7 @@ function filteredAttributes(attrs, ctx) {
   return stableStringify(
     Object.fromEntries(
       Object.entries(_nullishCoalesce(attrs, () => ( {}))).filter(
-        ([key]) => key !== _chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE && !ctx.ignoredAttributes.has(key)
+        ([key]) => key !== _chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE && !ctx.ignoredAttributes.has(key)
       )
     )
   );
@@ -327,7 +330,7 @@ function sameBlock(a, b, ctx) {
   if (a.wrappers.length !== b.wrappers.length) return false;
   return a.wrappers.every((w, i) => w.type === b.wrappers[i].type);
 }
-var hasBlockChange = (node) => !!node.type.spec.attrs && _chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE in node.type.spec.attrs;
+var hasBlockChange = (node) => !!node.type.spec.attrs && _chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE in node.type.spec.attrs;
 var label = (node) => node.type.name;
 function normalize(text, ctx) {
   let result = ctx.ignoreWhitespace ? text.replace(/\s+/g, " ") : text;
@@ -380,12 +383,12 @@ function wholeBlock(node, operation, wrappers, attrs, ctx) {
         previous: snapshot(node, wrappers),
         operation
       };
-      return [node.type.create({ ...node.attrs, [_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE]: record }, node.content, node.marks)];
+      return [node.type.create({ ...node.attrs, [_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE]: record }, node.content, node.marks)];
     }
     const markType = operation === "insert" ? ctx.insertion : ctx.deletion;
     if (markType && node.type.allowsMarkType(markType) && node.content.size > 0) {
       ctx.notes.add(
-        `${verb} ${label(node)} blocks have no "${_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE}" attribute: only their text is tracked, so an empty block remains when the change is ${operation === "insert" ? "rejected" : "accepted"}.`
+        `${verb} ${label(node)} blocks have no "${_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE}" attribute: only their text is tracked, so an empty block remains when the change is ${operation === "insert" ? "rejected" : "accepted"}.`
       );
       return [node.type.create(node.attrs, markInline(node.content, markType.create(attrs())), node.marks)];
     }
@@ -484,7 +487,7 @@ function formattingOf(marks, ctx) {
 }
 function withoutReviewMarks(marks) {
   return marks.filter(
-    (mark) => mark.type.name !== _chunkCCKP4XANcjs.INSERTION_MARK_NAME && mark.type.name !== _chunkCCKP4XANcjs.DELETION_MARK_NAME && mark.type.name !== _chunkCCKP4XANcjs.FORMAT_CHANGE_MARK_NAME
+    (mark) => mark.type.name !== _chunk34RQAGWIcjs.INSERTION_MARK_NAME && mark.type.name !== _chunk34RQAGWIcjs.DELETION_MARK_NAME && mark.type.name !== _chunk34RQAGWIcjs.FORMAT_CHANGE_MARK_NAME
   );
 }
 function mergeInline(original, revised, parentType, ctx) {
@@ -580,12 +583,12 @@ function mergeTextblocks(original, revised, oPath, rPath, ctx) {
     if (hasBlockChange(revised)) {
       const onlyWrappers = ctx.wrapperChange && sameBlock(previous, { ...snapshot(revised, rPath), wrappers: previous.wrappers }, ctx);
       const base = onlyWrappers ? ctx.wrapperChange() : newAttributes(ctx);
-      attrs = { ...attrs, [_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE]: { ...base, previous } };
+      attrs = { ...attrs, [_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE]: { ...base, previous } };
     } else {
       ctx.notes.add(`Block changes to ${label(revised)} blocks cannot be tracked.`);
     }
-  } else if (_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE in attrs) {
-    attrs[_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE] = null;
+  } else if (_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE in attrs) {
+    attrs[_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE] = null;
   }
   const type = revised.type;
   const inlineTracking = !!ctx.insertion && !!ctx.deletion && type.allowsMarkType(ctx.insertion) && type.allowsMarkType(ctx.deletion);
@@ -679,7 +682,7 @@ function detectMovedBlocks(children, ctx) {
   const keyOf = (node) => `${node.type.name}\0${filteredAttributes(node.attrs, ctx)}\0${stableStringify(node.content.toJSON())}`;
   const candidates = /* @__PURE__ */ new Map();
   children.forEach((node, index) => {
-    const operation = _optionalChain([node, 'access', _2 => _2.attrs, 'optionalAccess', _3 => _3[_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE], 'optionalAccess', _4 => _4.operation]);
+    const operation = _optionalChain([node, 'access', _2 => _2.attrs, 'optionalAccess', _3 => _3[_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE], 'optionalAccess', _4 => _4.operation]);
     if (!operation || !node.isTextblock || !node.textContent.trim()) return;
     if (!node.type.allowsMarkType(ctx.insertion) || !node.type.allowsMarkType(ctx.deletion)) return;
     const key = keyOf(node);
@@ -691,11 +694,11 @@ function detectMovedBlocks(children, ctx) {
   candidates.forEach(({ del, ins }) => {
     if (del.length !== 1 || ins.length !== 1) return;
     const attrs = newAttributes(ctx);
-    const moved = { ...attrs, [_chunkCCKP4XANcjs.MOVE_ID_ATTRIBUTE]: attrs.changeId };
+    const moved = { ...attrs, [_chunk34RQAGWIcjs.MOVE_ID_ATTRIBUTE]: attrs.changeId };
     const relink = (index, markType) => {
       const node = out[index];
       out[index] = node.type.create(
-        { ...node.attrs, [_chunkCCKP4XANcjs.BLOCK_CHANGE_ATTRIBUTE]: null },
+        { ...node.attrs, [_chunk34RQAGWIcjs.BLOCK_CHANGE_ATTRIBUTE]: null },
         markInline(node.content, markType.create(moved)),
         node.marks
       );
@@ -714,7 +717,7 @@ function summarize(doc, notes) {
     moves: 0,
     notHonoured: [...notes]
   };
-  _chunkCCKP4XANcjs.getTrackedChanges.call(void 0, doc).forEach((change) => {
+  _chunk34RQAGWIcjs.getTrackedChanges.call(void 0, doc).forEach((change) => {
     if (change.type === "move") summary.moves++;
     else if (change.type === "insertion" || _optionalChain([change, 'access', _5 => _5.block, 'optionalAccess', _6 => _6.operation]) === "insert") summary.insertions++;
     else if (change.type === "deletion" || _optionalChain([change, 'access', _7 => _7.block, 'optionalAccess', _8 => _8.operation]) === "delete") summary.deletions++;
@@ -730,7 +733,7 @@ function compareDocuments(original, revised, options = {}) {
     schema,
     author: _nullishCoalesce(options.author, () => ( { id: "compare", name: "Compare" })),
     createdAt: toTime(options.date),
-    generateId: _nullishCoalesce(options.generateId, () => ( (() => _chunkCCKP4XANcjs.createReviewId.call(void 0, "change")))),
+    generateId: _nullishCoalesce(options.generateId, () => ( (() => _chunk34RQAGWIcjs.createReviewId.call(void 0, "change")))),
     granularity: _nullishCoalesce(options.granularity, () => ( "word")),
     ignoreCase: !!options.ignoreCase,
     ignoreWhitespace: !!options.ignoreWhitespace,
@@ -738,9 +741,9 @@ function compareDocuments(original, revised, options = {}) {
     maxCharDiff: _nullishCoalesce(options.maxCharDiff, () => ( 2e3)),
     ignoredMarks: new Set(_nullishCoalesce(options.ignoredMarks, () => ( []))),
     ignoredAttributes: new Set(_nullishCoalesce(options.ignoredBlockAttributes, () => ( ["id"]))),
-    insertion: schema.marks[_chunkCCKP4XANcjs.INSERTION_MARK_NAME],
-    deletion: schema.marks[_chunkCCKP4XANcjs.DELETION_MARK_NAME],
-    format: schema.marks[_chunkCCKP4XANcjs.FORMAT_CHANGE_MARK_NAME],
+    insertion: schema.marks[_chunk34RQAGWIcjs.INSERTION_MARK_NAME],
+    deletion: schema.marks[_chunk34RQAGWIcjs.DELETION_MARK_NAME],
+    format: schema.marks[_chunk34RQAGWIcjs.FORMAT_CHANGE_MARK_NAME],
     notes: /* @__PURE__ */ new Set(),
     keys: /* @__PURE__ */ new Map(),
     wrapperChange: null
@@ -753,9 +756,9 @@ function compareDocuments(original, revised, options = {}) {
   }
   const prepare = (source) => {
     const doc2 = toNode(source, schema);
-    if (_chunkCCKP4XANcjs.getTrackedChanges.call(void 0, doc2).length === 0) return doc2;
+    if (_chunk34RQAGWIcjs.getTrackedChanges.call(void 0, doc2).length === 0) return doc2;
     ctx.notes.add("Tracked changes already in the documents were accepted before comparing.");
-    return _chunkCCKP4XANcjs.resolveTrackedChanges.call(void 0, doc2, "accepted");
+    return _chunk34RQAGWIcjs.resolveTrackedChanges.call(void 0, doc2, "accepted");
   };
   const a = prepare(original);
   const b = prepare(revised);

package/dist/{chunk-RPW7YL3D.cjs → chunk-L434J57V.cjs}

@@ -15,11 +15,12 @@ var _chunk6HMEHNWWcjs = require('./chunk-6HMEHNWW.cjs');
 var _chunkUR37VCIRcjs = require('./chunk-UR37VCIR.cjs');
 
 
-var _chunk6NXVDJDRcjs = require('./chunk-6NXVDJDR.cjs');
+var _chunkG43MNQ4Ccjs = require('./chunk-G43MNQ4C.cjs');
 
 
 
-var _chunkCCKP4XANcjs = require('./chunk-CCKP4XAN.cjs');
+
+var _chunk34RQAGWIcjs = require('./chunk-34RQAGWI.cjs');
 
 // src/extensions/table/nesting.ts
 var _model = require('@tiptap/pm/model');
@@ -1550,7 +1551,7 @@ var Chart = _core.Node.create({
     const svg = staticChartSvg(node, this.options);
     return [
       "div",
-      _core.mergeAttributes.call(void 0, this.options.HTMLAttributes, HTMLAttributes, {
+      _chunk34RQAGWIcjs.safeMergeAttributes.call(void 0, this.options.HTMLAttributes, HTMLAttributes, {
         "data-type": "chart",
         class: "pixerate-chart"
       }),
@@ -1717,7 +1718,7 @@ var Sparkline = _core.Node.create({
     });
     return [
       "span",
-      _core.mergeAttributes.call(void 0, this.options.HTMLAttributes, HTMLAttributes, {
+      _chunk34RQAGWIcjs.safeMergeAttributes.call(void 0, this.options.HTMLAttributes, HTMLAttributes, {
         "data-type": "sparkline",
         class: "pixerate-sparkline"
       }),
@@ -1836,7 +1837,7 @@ function getTableActionState(editor, action, params = {}) {
   switch (action) {
     case "mergeCells":
     case "splitCell": {
-      if (_chunkCCKP4XANcjs.isTrackChangesEnabled.call(void 0, editor)) {
+      if (_chunk34RQAGWIcjs.isTrackChangesEnabled.call(void 0, editor)) {
         return `${action === "mergeCells" ? "Merging" : "Splitting"} cells cannot be tracked: turn off Track Changes first.`;
       }
       if (action === "mergeCells") {
@@ -2154,9 +2155,9 @@ function getAgentCarets(state) {
   return _nullishCoalesce(_optionalChain([agentCaretPluginKey, 'access', _77 => _77.getState, 'call', _78 => _78(state), 'optionalAccess', _79 => _79.carets]), () => ( []));
 }
 function replaceWithTextTransaction(state, from, to, text) {
-  return /[\r\n]/.test(text) ? state.tr.replace(from, to, _chunk6NXVDJDRcjs.plainTextToSlice.call(void 0, text, state.schema)) : text ? state.tr.insertText(text, from, to) : state.tr.delete(from, to);
+  return /[\r\n]/.test(text) ? state.tr.replace(from, to, _chunkG43MNQ4Ccjs.plainTextToSlice.call(void 0, text, state.schema)) : text ? state.tr.insertText(text, from, to) : state.tr.delete(from, to);
 }
-var NO_HISTORY = (tr) => tr.setMeta("addToHistory", false).setMeta(_chunkCCKP4XANcjs.TRACK_CHANGES_SKIP_META, true);
+var NO_HISTORY = (tr) => tr.setMeta("addToHistory", false).setMeta(_chunk34RQAGWIcjs.TRACK_CHANGES_SKIP_META, true);
 var cannotAnimate = () => typeof document === "undefined" || document.hidden === true;
 async function typeAgentText(editor, options) {
   const { from, to, text, caret, signal } = options;