@pixerate/editor 0.140.0 → 0.140.1

package/dist/tools/index.cjs

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../chunk-R6DFK5OX.cjs');
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../chunk-LACYURUW.cjs');
 
 
 
@@ -24,7 +24,7 @@
 
 
 
-var _chunkZAOOIJ6Icjs = require('../chunk-ZAOOIJ6I.cjs');
+var _chunkHDK3T2QScjs = require('../chunk-HDK3T2QS.cjs');
 
 
 
@@ -64,6 +64,11 @@ var _chunkSVFEVKLFcjs = require('../chunk-SVFEVKLF.cjs');
 var _chunkN2FGYZ4Qcjs = require('../chunk-N2FGYZ4Q.cjs');
 
 
+
+
+var _chunk2BSBFBOAcjs = require('../chunk-2BSBFBOA.cjs');
+
+
 var _chunkWOFXZ3XUcjs = require('../chunk-WOFXZ3XU.cjs');
 
 
@@ -124,4 +129,7 @@ var _chunkWOFXZ3XUcjs = require('../chunk-WOFXZ3XU.cjs');
 
 
 
-exports.CAPTURE_EXCLUDE_SELECTOR = _chunkSVFEVKLFcjs.CAPTURE_EXCLUDE_SELECTOR; exports.CAPTURE_OVERLAY_SELECTORS = _chunkSVFEVKLFcjs.CAPTURE_OVERLAY_SELECTORS; exports.EDITOR_CANVAS_TOOLS = _chunkSVFEVKLFcjs.EDITOR_CANVAS_TOOLS; exports.EDITOR_MCP_TOOLS = _chunkSVFEVKLFcjs.EDITOR_MCP_TOOLS; exports.EDITOR_PROMPT_TOOLS = _chunkSVFEVKLFcjs.EDITOR_PROMPT_TOOLS; exports.EDIT_OPERATION_REQUIRED_ARGUMENTS = _chunkSVFEVKLFcjs.EDIT_OPERATION_REQUIRED_ARGUMENTS; exports.EXPORT_EXCLUDED_SELECTORS = _chunkSVFEVKLFcjs.EXPORT_EXCLUDED_SELECTORS; exports.JSON_RPC_ERRORS = _chunkZAOOIJ6Icjs.JSON_RPC_ERRORS; exports.MCP_PROTOCOL_VERSIONS = _chunkZAOOIJ6Icjs.MCP_PROTOCOL_VERSIONS; exports.MCP_TOOL_CANVAS_ADD_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_ADD_NODE; exports.MCP_TOOL_CANVAS_CONNECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_CONNECT; exports.MCP_TOOL_CANVAS_HIGHLIGHT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_HIGHLIGHT; exports.MCP_TOOL_CANVAS_LAYOUT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_LAYOUT; exports.MCP_TOOL_CANVAS_REMOVE_NODES = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_REMOVE_NODES; exports.MCP_TOOL_CANVAS_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_SELECT; exports.MCP_TOOL_CANVAS_UPDATE_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_UPDATE_NODE; exports.MCP_TOOL_EDIT_CANVAS = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_CANVAS; exports.MCP_TOOL_EDIT_PROMPT = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_PROMPT; exports.MCP_TOOL_GET_EDITOR_STATE = _chunkSVFEVKLFcjs.MCP_TOOL_GET_EDITOR_STATE; exports.MCP_TOOL_PROMPT_INSERT_TEXT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_INSERT_TEXT; exports.MCP_TOOL_PROMPT_REPLACE_RANGE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_REPLACE_RANGE; exports.MCP_TOOL_PROMPT_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SELECT; exports.MCP_TOOL_PROMPT_SET_VARIABLE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SET_VARIABLE; exports.MCP_TOOL_VIEW_EDITOR = _chunkSVFEVKLFcjs.MCP_TOOL_VIEW_EDITOR; exports.TOOL_BRIDGE_DEFAULT_PORT = _chunkZAOOIJ6Icjs.TOOL_BRIDGE_DEFAULT_PORT; exports.TOOL_BRIDGE_PROTOCOL = _chunkZAOOIJ6Icjs.TOOL_BRIDGE_PROTOCOL; exports.TOOL_DISCOVERY_TOOLS = _chunkZAOOIJ6Icjs.TOOL_DISCOVERY_TOOLS; exports.TOOL_NAMESPACE_SEPARATOR = _chunkZAOOIJ6Icjs.TOOL_NAMESPACE_SEPARATOR; exports.ToolRegistry = _chunkZAOOIJ6Icjs.ToolRegistry; exports.ToolRegistryError = _chunkZAOOIJ6Icjs.ToolRegistryError; exports.ToolRegistryView = _chunkZAOOIJ6Icjs.ToolRegistryView; exports.baseToolName = _chunkZAOOIJ6Icjs.baseToolName; exports.captureInputSchema = _chunkN2FGYZ4Qcjs.captureInputSchema; exports.captureOutputSize = _chunkN2FGYZ4Qcjs.captureOutputSize; exports.cloneElementWithStyles = _chunkSVFEVKLFcjs.cloneElementWithStyles; exports.connectToolBridge = _chunkZAOOIJ6Icjs.connectToolBridge; exports.createCaptureTool = _chunkN2FGYZ4Qcjs.createCaptureTool; exports.createCaptureToolProvider = _chunkN2FGYZ4Qcjs.createCaptureToolProvider; exports.createElementCaptureSurface = _chunkSVFEVKLFcjs.createElementCaptureSurface; exports.createMcpServer = _chunkZAOOIJ6Icjs.createMcpServer; exports.createToolRegistry = _chunkZAOOIJ6Icjs.createToolRegistry; exports.elementToSvg = _chunkSVFEVKLFcjs.elementToSvg; exports.errorResult = _chunkZAOOIJ6Icjs.errorResult; exports.listSkills = _chunkZAOOIJ6Icjs.listSkills; exports.parseSkillFrontmatter = _chunkZAOOIJ6Icjs.parseSkillFrontmatter; exports.rasterizeElement = _chunkSVFEVKLFcjs.rasterizeElement; exports.readSkillFile = _chunkZAOOIJ6Icjs.readSkillFile; exports.resolveCaptureRequest = _chunkN2FGYZ4Qcjs.resolveCaptureRequest; exports.searchTokens = _chunkZAOOIJ6Icjs.searchTokens; exports.searchTools = _chunkZAOOIJ6Icjs.searchTools; exports.summarize = _chunkZAOOIJ6Icjs.summarize; exports.toCapturedImageData = _chunkN2FGYZ4Qcjs.toCapturedImageData; exports.toToolResult = _chunkZAOOIJ6Icjs.toToolResult; exports.toolsetInstructions = _chunkZAOOIJ6Icjs.toolsetInstructions; exports.toolsetName = _chunkZAOOIJ6Icjs.toolsetName; exports.unionCaptureRects = _chunkN2FGYZ4Qcjs.unionCaptureRects; exports.unknownToolMessage = _chunkZAOOIJ6Icjs.unknownToolMessage; exports.validateJsonSchema = _chunkWOFXZ3XUcjs.validateJsonSchema;
+
+
+
+exports.CAPTURE_EXCLUDE_SELECTOR = _chunkSVFEVKLFcjs.CAPTURE_EXCLUDE_SELECTOR; exports.CAPTURE_OVERLAY_SELECTORS = _chunkSVFEVKLFcjs.CAPTURE_OVERLAY_SELECTORS; exports.EDITOR_CANVAS_TOOLS = _chunkSVFEVKLFcjs.EDITOR_CANVAS_TOOLS; exports.EDITOR_MCP_TOOLS = _chunkSVFEVKLFcjs.EDITOR_MCP_TOOLS; exports.EDITOR_PROMPT_TOOLS = _chunkSVFEVKLFcjs.EDITOR_PROMPT_TOOLS; exports.EDIT_OPERATION_REQUIRED_ARGUMENTS = _chunkSVFEVKLFcjs.EDIT_OPERATION_REQUIRED_ARGUMENTS; exports.EXPORT_EXCLUDED_SELECTORS = _chunkSVFEVKLFcjs.EXPORT_EXCLUDED_SELECTORS; exports.JSON_RPC_ERRORS = _chunkHDK3T2QScjs.JSON_RPC_ERRORS; exports.MCP_PROTOCOL_VERSIONS = _chunkHDK3T2QScjs.MCP_PROTOCOL_VERSIONS; exports.MCP_TOOL_CANVAS_ADD_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_ADD_NODE; exports.MCP_TOOL_CANVAS_CONNECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_CONNECT; exports.MCP_TOOL_CANVAS_HIGHLIGHT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_HIGHLIGHT; exports.MCP_TOOL_CANVAS_LAYOUT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_LAYOUT; exports.MCP_TOOL_CANVAS_REMOVE_NODES = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_REMOVE_NODES; exports.MCP_TOOL_CANVAS_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_SELECT; exports.MCP_TOOL_CANVAS_UPDATE_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_UPDATE_NODE; exports.MCP_TOOL_EDIT_CANVAS = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_CANVAS; exports.MCP_TOOL_EDIT_PROMPT = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_PROMPT; exports.MCP_TOOL_GET_EDITOR_STATE = _chunkSVFEVKLFcjs.MCP_TOOL_GET_EDITOR_STATE; exports.MCP_TOOL_PROMPT_INSERT_TEXT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_INSERT_TEXT; exports.MCP_TOOL_PROMPT_REPLACE_RANGE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_REPLACE_RANGE; exports.MCP_TOOL_PROMPT_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SELECT; exports.MCP_TOOL_PROMPT_SET_VARIABLE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SET_VARIABLE; exports.MCP_TOOL_VIEW_EDITOR = _chunkSVFEVKLFcjs.MCP_TOOL_VIEW_EDITOR; exports.TOOL_BRIDGE_DEFAULT_PORT = _chunkHDK3T2QScjs.TOOL_BRIDGE_DEFAULT_PORT; exports.TOOL_BRIDGE_PROTOCOL = _chunkHDK3T2QScjs.TOOL_BRIDGE_PROTOCOL; exports.TOOL_DISCOVERY_TOOLS = _chunkHDK3T2QScjs.TOOL_DISCOVERY_TOOLS; exports.TOOL_NAMESPACE_SEPARATOR = _chunkHDK3T2QScjs.TOOL_NAMESPACE_SEPARATOR; exports.ToolRegistry = _chunkHDK3T2QScjs.ToolRegistry; exports.ToolRegistryError = _chunkHDK3T2QScjs.ToolRegistryError; exports.ToolRegistryView = _chunkHDK3T2QScjs.ToolRegistryView; exports.UNSAFE_JSON_KEYS = _chunk2BSBFBOAcjs.UNSAFE_JSON_KEYS; exports.baseToolName = _chunkHDK3T2QScjs.baseToolName; exports.captureInputSchema = _chunkN2FGYZ4Qcjs.captureInputSchema; exports.captureOutputSize = _chunkN2FGYZ4Qcjs.captureOutputSize; exports.cloneElementWithStyles = _chunkSVFEVKLFcjs.cloneElementWithStyles; exports.connectToolBridge = _chunkHDK3T2QScjs.connectToolBridge; exports.createCaptureTool = _chunkN2FGYZ4Qcjs.createCaptureTool; exports.createCaptureToolProvider = _chunkN2FGYZ4Qcjs.createCaptureToolProvider; exports.createElementCaptureSurface = _chunkSVFEVKLFcjs.createElementCaptureSurface; exports.createMcpServer = _chunkHDK3T2QScjs.createMcpServer; exports.createToolRegistry = _chunkHDK3T2QScjs.createToolRegistry; exports.elementToSvg = _chunkSVFEVKLFcjs.elementToSvg; exports.errorResult = _chunkHDK3T2QScjs.errorResult; exports.isUnsafeJsonKey = _chunk2BSBFBOAcjs.isUnsafeJsonKey; exports.listSkills = _chunkHDK3T2QScjs.listSkills; exports.parseSkillFrontmatter = _chunkHDK3T2QScjs.parseSkillFrontmatter; exports.rasterizeElement = _chunkSVFEVKLFcjs.rasterizeElement; exports.readSkillFile = _chunkHDK3T2QScjs.readSkillFile; exports.resolveCaptureRequest = _chunkN2FGYZ4Qcjs.resolveCaptureRequest; exports.searchTokens = _chunkHDK3T2QScjs.searchTokens; exports.searchTools = _chunkHDK3T2QScjs.searchTools; exports.stripPrototypeKeys = _chunk2BSBFBOAcjs.stripPrototypeKeys; exports.summarize = _chunkHDK3T2QScjs.summarize; exports.toCapturedImageData = _chunkN2FGYZ4Qcjs.toCapturedImageData; exports.toToolResult = _chunkHDK3T2QScjs.toToolResult; exports.toolsetInstructions = _chunkHDK3T2QScjs.toolsetInstructions; exports.toolsetName = _chunkHDK3T2QScjs.toolsetName; exports.unionCaptureRects = _chunkN2FGYZ4Qcjs.unionCaptureRects; exports.unknownToolMessage = _chunkHDK3T2QScjs.unknownToolMessage; exports.validateJsonSchema = _chunkWOFXZ3XUcjs.validateJsonSchema;

package/dist/tools/index.d.cts

@@ -17,3 +17,4 @@ export * from './dom-capture.cjs';
 export * from './view.cjs';
 export * from './search.cjs';
 export * from './skills.cjs';
+export * from './safe-json.cjs';

package/dist/tools/index.d.ts

@@ -17,3 +17,4 @@ export * from './dom-capture.js';
 export * from './view.js';
 export * from './search.js';
 export * from './skills.js';
+export * from './safe-json.js';

package/dist/tools/index.js

@@ -1,4 +1,4 @@
-import "../chunk-MCTQXUXR.js";
+import "../chunk-K73HMKQP.js";
 import {
   JSON_RPC_ERRORS,
   MCP_PROTOCOL_VERSIONS,
@@ -24,7 +24,7 @@ import {
   toolsetInstructions,
   toolsetName,
   unknownToolMessage
-} from "../chunk-WBKLYLZE.js";
+} from "../chunk-RB62U6MS.js";
 import {
   CAPTURE_EXCLUDE_SELECTOR,
   CAPTURE_OVERLAY_SELECTORS,
@@ -62,6 +62,11 @@ import {
   toCapturedImageData,
   unionCaptureRects
 } from "../chunk-5ED73EC6.js";
+import {
+  UNSAFE_JSON_KEYS,
+  isUnsafeJsonKey,
+  stripPrototypeKeys
+} from "../chunk-HF5QZS7Z.js";
 import {
   validateJsonSchema
 } from "../chunk-V2ZCJRDM.js";
@@ -97,6 +102,7 @@ export {
   ToolRegistry,
   ToolRegistryError,
   ToolRegistryView,
+  UNSAFE_JSON_KEYS,
   baseToolName,
   captureInputSchema,
   captureOutputSize,
@@ -109,6 +115,7 @@ export {
   createToolRegistry,
   elementToSvg,
   errorResult,
+  isUnsafeJsonKey,
   listSkills,
   parseSkillFrontmatter,
   rasterizeElement,
@@ -116,6 +123,7 @@ export {
   resolveCaptureRequest,
   searchTokens,
   searchTools,
+  stripPrototypeKeys,
   summarize,
   toCapturedImageData,
   toToolResult,

package/dist/tools/safe-json.d.cts

@@ -0,0 +1,27 @@
+/**
+ * Guards against prototype pollution from untrusted JSON (GHSA-cp6q-959q-f8rh).
+ *
+ * `JSON.parse('{"__proto__": {...}}')` creates an *own* `__proto__` key. Code
+ * that later copies keys with bracket assignment (`out[key] = value`,
+ * `Object.assign`) turns it into the copy's prototype, so the copy inherits
+ * attacker-chosen properties that `for…in` loops (ProseMirror's
+ * `DOMSerializer.renderSpec`, for one) then treat as real ones. TipTap's
+ * `mergeAttributes()` did exactly that before `@tiptap/core` 2.27.3 / 3.30.4.
+ *
+ * This file has no dependencies so the tool layer can use it.
+ */
+/** Keys that are dropped from untrusted JSON objects. */
+export declare const UNSAFE_JSON_KEYS: ReadonlySet<string>;
+/** Whether `key` is one of {@link UNSAFE_JSON_KEYS}. */
+export declare const isUnsafeJsonKey: (key: string) => boolean;
+/**
+ * Returns `value` without own `__proto__`, `constructor` and `prototype` keys
+ * at any depth of its plain objects and arrays. Run untrusted JSON through it
+ * before handing it to `setContent`, `Node.fromJSON`, `Slice.fromJSON` or any
+ * code that merges objects key by key.
+ *
+ * Returns `value` itself when there is nothing to strip, and a copy otherwise,
+ * so the input is never mutated. Non-plain objects (class instances) pass
+ * through untouched.
+ */
+export declare function stripPrototypeKeys<T>(value: T): T;

package/dist/tools/safe-json.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Guards against prototype pollution from untrusted JSON (GHSA-cp6q-959q-f8rh).
+ *
+ * `JSON.parse('{"__proto__": {...}}')` creates an *own* `__proto__` key. Code
+ * that later copies keys with bracket assignment (`out[key] = value`,
+ * `Object.assign`) turns it into the copy's prototype, so the copy inherits
+ * attacker-chosen properties that `for…in` loops (ProseMirror's
+ * `DOMSerializer.renderSpec`, for one) then treat as real ones. TipTap's
+ * `mergeAttributes()` did exactly that before `@tiptap/core` 2.27.3 / 3.30.4.
+ *
+ * This file has no dependencies so the tool layer can use it.
+ */
+/** Keys that are dropped from untrusted JSON objects. */
+export declare const UNSAFE_JSON_KEYS: ReadonlySet<string>;
+/** Whether `key` is one of {@link UNSAFE_JSON_KEYS}. */
+export declare const isUnsafeJsonKey: (key: string) => boolean;
+/**
+ * Returns `value` without own `__proto__`, `constructor` and `prototype` keys
+ * at any depth of its plain objects and arrays. Run untrusted JSON through it
+ * before handing it to `setContent`, `Node.fromJSON`, `Slice.fromJSON` or any
+ * code that merges objects key by key.
+ *
+ * Returns `value` itself when there is nothing to strip, and a copy otherwise,
+ * so the input is never mutated. Non-plain objects (class instances) pass
+ * through untouched.
+ */
+export declare function stripPrototypeKeys<T>(value: T): T;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pixerate/editor",
-  "version": "0.140.0",
+  "version": "0.140.1",
   "description": "UI-agnostic rich text and media editing core library",
   "author": "Pixerate",
   "license": "MIT",
@@ -315,27 +315,27 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@tiptap/extension-character-count": "^2.11.5",
-    "@tiptap/extension-color": "^2.11.5",
-    "@tiptap/extension-highlight": "^2.11.5",
-    "@tiptap/extension-image": "^2.11.5",
-    "@tiptap/extension-link": "^2.11.5",
-    "@tiptap/extension-mention": "^2.11.5",
-    "@tiptap/extension-placeholder": "^2.11.5",
-    "@tiptap/extension-subscript": "^2.11.5",
-    "@tiptap/extension-superscript": "^2.11.5",
-    "@tiptap/extension-table": "^2.11.5",
-    "@tiptap/extension-table-cell": "^2.11.5",
-    "@tiptap/extension-table-header": "^2.11.5",
-    "@tiptap/extension-table-row": "^2.11.5",
-    "@tiptap/extension-task-item": "^2.11.5",
-    "@tiptap/extension-task-list": "^2.11.5",
-    "@tiptap/extension-text-align": "^2.11.5",
-    "@tiptap/extension-text-style": "^2.11.5",
-    "@tiptap/extension-typography": "^2.11.5",
-    "@tiptap/extension-underline": "^2.11.5",
-    "@tiptap/starter-kit": "^2.11.5",
-    "@tiptap/suggestion": "^2.11.5",
+    "@tiptap/extension-character-count": "^2.27.3",
+    "@tiptap/extension-color": "^2.27.3",
+    "@tiptap/extension-highlight": "^2.27.3",
+    "@tiptap/extension-image": "^2.27.3",
+    "@tiptap/extension-link": "^2.27.3",
+    "@tiptap/extension-mention": "^2.27.3",
+    "@tiptap/extension-placeholder": "^2.27.3",
+    "@tiptap/extension-subscript": "^2.27.3",
+    "@tiptap/extension-superscript": "^2.27.3",
+    "@tiptap/extension-table": "^2.27.3",
+    "@tiptap/extension-table-cell": "^2.27.3",
+    "@tiptap/extension-table-header": "^2.27.3",
+    "@tiptap/extension-table-row": "^2.27.3",
+    "@tiptap/extension-task-item": "^2.27.3",
+    "@tiptap/extension-task-list": "^2.27.3",
+    "@tiptap/extension-text-align": "^2.27.3",
+    "@tiptap/extension-text-style": "^2.27.3",
+    "@tiptap/extension-typography": "^2.27.3",
+    "@tiptap/extension-underline": "^2.27.3",
+    "@tiptap/starter-kit": "^2.27.3",
+    "@tiptap/suggestion": "^2.27.3",
     "markdown-it": "^15.0.3",
     "markdown-it-task-lists": "^2.1.1",
     "prosemirror-markdown": "^1.13.8"
@@ -343,23 +343,23 @@
   "devDependencies": {
     "@anthropic-ai/sdk": "0.137.0",
     "@dagrejs/dagre": "^1.1.8",
-    "@tiptap/core": "^2.11.5",
-    "@tiptap/pm": "^2.11.5",
+    "@tiptap/core": "^2.27.3",
+    "@tiptap/pm": "^2.27.3",
     "@types/dagre": "^0.7.54",
     "@types/markdown-it": "^14.2.0",
     "@types/node": "^26.6.5",
     "assemblyscript": "0.28.20",
     "fast-check": "^3.23.2",
-    "mermaid": "12.0.0",
+    "mermaid": "12.2.0",
     "tiptap-markdown": "^0.8.10",
-    "tsup": "^8.4.0",
+    "tsup": "^9.0.0",
     "typescript": "^5.7.3",
     "vitest": "^5.0.5"
   },
   "peerDependencies": {
     "@dagrejs/dagre": "^1.1.8",
-    "@tiptap/core": "^2.11.5",
-    "@tiptap/pm": "^2.11.5"
+    "@tiptap/core": "^2.27.3",
+    "@tiptap/pm": "^2.27.3"
   },
   "peerDependenciesMeta": {
     "@dagrejs/dagre": {