@pixerate/editor 0.140.0 → 0.140.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (62) hide show
  1. package/dist/agent/index.cjs +39 -31
  2. package/dist/agent/index.js +13 -5
  3. package/dist/bridge/cli.cjs +4 -3
  4. package/dist/bridge/cli.js +3 -2
  5. package/dist/bridge/index.cjs +4 -3
  6. package/dist/bridge/index.js +3 -2
  7. package/dist/chunk-2BSBFBOA.cjs +46 -0
  8. package/dist/{chunk-SWZTQWY7.js → chunk-2INPJDNY.js} +1 -1
  9. package/dist/{chunk-CCKP4XAN.cjs → chunk-34RQAGWI.cjs} +27 -7
  10. package/dist/{chunk-HXCBQ7A6.cjs → chunk-3AJMR7EG.cjs} +7 -4
  11. package/dist/{chunk-NKBUVQJW.cjs → chunk-5WOY52O6.cjs} +15 -15
  12. package/dist/{chunk-5G3KYRER.js → chunk-6GAYGQDC.js} +8 -7
  13. package/dist/{chunk-HZZXBTLB.js → chunk-6IN474P4.js} +25 -5
  14. package/dist/{chunk-HDCH35UM.cjs → chunk-AGCD3EHB.cjs} +7 -7
  15. package/dist/{chunk-6I63VZ45.js → chunk-CXXKJBQZ.js} +5 -1
  16. package/dist/{chunk-6NXVDJDR.cjs → chunk-G43MNQ4C.cjs} +5 -5
  17. package/dist/{chunk-ZAOOIJ6I.cjs → chunk-HDK3T2QS.cjs} +4 -1
  18. package/dist/chunk-HF5QZS7Z.js +46 -0
  19. package/dist/{chunk-S7I3RI5Z.cjs → chunk-HMGWFXEC.cjs} +27 -24
  20. package/dist/{chunk-RPW7YL3D.cjs → chunk-L434J57V.cjs} +8 -7
  21. package/dist/{chunk-UCRL6JEV.cjs → chunk-L5OWG2NA.cjs} +8 -3
  22. package/dist/{chunk-RWML7TWG.cjs → chunk-PUR6BZFA.cjs} +112 -111
  23. package/dist/{chunk-WBKLYLZE.js → chunk-RB62U6MS.js} +4 -1
  24. package/dist/{chunk-KIBEEN5K.js → chunk-UMS6YFA6.js} +1 -1
  25. package/dist/{chunk-4LGWAJDI.js → chunk-V5OOP74P.js} +5 -2
  26. package/dist/{chunk-UOJS6PUP.js → chunk-WBJ6BG4R.js} +23 -22
  27. package/dist/{chunk-WIYAOZZU.js → chunk-WHKNYFM2.js} +7 -2
  28. package/dist/{chunk-F652BKMS.cjs → chunk-YN6JKAUE.cjs} +6 -2
  29. package/dist/{chunk-YTGF4TJR.js → chunk-ZLZKGHSZ.js} +5 -2
  30. package/dist/{chunk-USU2FL3N.js → chunk-ZNHB5RG6.js} +1 -1
  31. package/dist/compare/index.cjs +4 -3
  32. package/dist/compare/index.js +3 -2
  33. package/dist/export/index.cjs +4 -3
  34. package/dist/export/index.js +3 -2
  35. package/dist/extensions/index.cjs +11 -8
  36. package/dist/extensions/index.d.cts +1 -0
  37. package/dist/extensions/index.d.ts +1 -0
  38. package/dist/extensions/index.js +10 -7
  39. package/dist/extensions/safe-merge-attributes.d.cts +10 -0
  40. package/dist/extensions/safe-merge-attributes.d.ts +10 -0
  41. package/dist/image-editor/index.cjs +4 -3
  42. package/dist/image-editor/index.js +2 -1
  43. package/dist/index.cjs +42 -29
  44. package/dist/index.d.cts +1 -0
  45. package/dist/index.d.ts +1 -0
  46. package/dist/index.js +22 -9
  47. package/dist/persistence/index.cjs +3 -2
  48. package/dist/persistence/index.js +2 -1
  49. package/dist/serializers/index.cjs +5 -4
  50. package/dist/serializers/index.js +4 -3
  51. package/dist/tools/index.cjs +11 -3
  52. package/dist/tools/index.d.cts +1 -0
  53. package/dist/tools/index.d.ts +1 -0
  54. package/dist/tools/index.js +10 -2
  55. package/dist/tools/safe-json.d.cts +27 -0
  56. package/dist/tools/safe-json.d.ts +27 -0
  57. package/dist/video-editor/index.cjs +2 -2
  58. package/dist/video-editor/index.js +2 -2
  59. package/package.json +28 -28
  60. package/skills/pixerate-video-editor/SKILL.md +1 -1
  61. /package/dist/{chunk-MCTQXUXR.js → chunk-K73HMKQP.js} +0 -0
  62. /package/dist/{chunk-R6DFK5OX.cjs → chunk-LACYURUW.cjs} +0 -0
@@ -1,4 +1,4 @@
1
- "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../chunk-R6DFK5OX.cjs');
1
+ "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../chunk-LACYURUW.cjs');
2
2
 
3
3
 
4
4
 
@@ -24,7 +24,7 @@
24
24
 
25
25
 
26
26
 
27
- var _chunkZAOOIJ6Icjs = require('../chunk-ZAOOIJ6I.cjs');
27
+ var _chunkHDK3T2QScjs = require('../chunk-HDK3T2QS.cjs');
28
28
 
29
29
 
30
30
 
@@ -64,6 +64,11 @@ var _chunkSVFEVKLFcjs = require('../chunk-SVFEVKLF.cjs');
64
64
  var _chunkN2FGYZ4Qcjs = require('../chunk-N2FGYZ4Q.cjs');
65
65
 
66
66
 
67
+
68
+
69
+ var _chunk2BSBFBOAcjs = require('../chunk-2BSBFBOA.cjs');
70
+
71
+
67
72
  var _chunkWOFXZ3XUcjs = require('../chunk-WOFXZ3XU.cjs');
68
73
 
69
74
 
@@ -124,4 +129,7 @@ var _chunkWOFXZ3XUcjs = require('../chunk-WOFXZ3XU.cjs');
124
129
 
125
130
 
126
131
 
127
- exports.CAPTURE_EXCLUDE_SELECTOR = _chunkSVFEVKLFcjs.CAPTURE_EXCLUDE_SELECTOR; exports.CAPTURE_OVERLAY_SELECTORS = _chunkSVFEVKLFcjs.CAPTURE_OVERLAY_SELECTORS; exports.EDITOR_CANVAS_TOOLS = _chunkSVFEVKLFcjs.EDITOR_CANVAS_TOOLS; exports.EDITOR_MCP_TOOLS = _chunkSVFEVKLFcjs.EDITOR_MCP_TOOLS; exports.EDITOR_PROMPT_TOOLS = _chunkSVFEVKLFcjs.EDITOR_PROMPT_TOOLS; exports.EDIT_OPERATION_REQUIRED_ARGUMENTS = _chunkSVFEVKLFcjs.EDIT_OPERATION_REQUIRED_ARGUMENTS; exports.EXPORT_EXCLUDED_SELECTORS = _chunkSVFEVKLFcjs.EXPORT_EXCLUDED_SELECTORS; exports.JSON_RPC_ERRORS = _chunkZAOOIJ6Icjs.JSON_RPC_ERRORS; exports.MCP_PROTOCOL_VERSIONS = _chunkZAOOIJ6Icjs.MCP_PROTOCOL_VERSIONS; exports.MCP_TOOL_CANVAS_ADD_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_ADD_NODE; exports.MCP_TOOL_CANVAS_CONNECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_CONNECT; exports.MCP_TOOL_CANVAS_HIGHLIGHT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_HIGHLIGHT; exports.MCP_TOOL_CANVAS_LAYOUT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_LAYOUT; exports.MCP_TOOL_CANVAS_REMOVE_NODES = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_REMOVE_NODES; exports.MCP_TOOL_CANVAS_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_SELECT; exports.MCP_TOOL_CANVAS_UPDATE_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_UPDATE_NODE; exports.MCP_TOOL_EDIT_CANVAS = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_CANVAS; exports.MCP_TOOL_EDIT_PROMPT = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_PROMPT; exports.MCP_TOOL_GET_EDITOR_STATE = _chunkSVFEVKLFcjs.MCP_TOOL_GET_EDITOR_STATE; exports.MCP_TOOL_PROMPT_INSERT_TEXT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_INSERT_TEXT; exports.MCP_TOOL_PROMPT_REPLACE_RANGE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_REPLACE_RANGE; exports.MCP_TOOL_PROMPT_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SELECT; exports.MCP_TOOL_PROMPT_SET_VARIABLE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SET_VARIABLE; exports.MCP_TOOL_VIEW_EDITOR = _chunkSVFEVKLFcjs.MCP_TOOL_VIEW_EDITOR; exports.TOOL_BRIDGE_DEFAULT_PORT = _chunkZAOOIJ6Icjs.TOOL_BRIDGE_DEFAULT_PORT; exports.TOOL_BRIDGE_PROTOCOL = _chunkZAOOIJ6Icjs.TOOL_BRIDGE_PROTOCOL; exports.TOOL_DISCOVERY_TOOLS = _chunkZAOOIJ6Icjs.TOOL_DISCOVERY_TOOLS; exports.TOOL_NAMESPACE_SEPARATOR = _chunkZAOOIJ6Icjs.TOOL_NAMESPACE_SEPARATOR; exports.ToolRegistry = _chunkZAOOIJ6Icjs.ToolRegistry; exports.ToolRegistryError = _chunkZAOOIJ6Icjs.ToolRegistryError; exports.ToolRegistryView = _chunkZAOOIJ6Icjs.ToolRegistryView; exports.baseToolName = _chunkZAOOIJ6Icjs.baseToolName; exports.captureInputSchema = _chunkN2FGYZ4Qcjs.captureInputSchema; exports.captureOutputSize = _chunkN2FGYZ4Qcjs.captureOutputSize; exports.cloneElementWithStyles = _chunkSVFEVKLFcjs.cloneElementWithStyles; exports.connectToolBridge = _chunkZAOOIJ6Icjs.connectToolBridge; exports.createCaptureTool = _chunkN2FGYZ4Qcjs.createCaptureTool; exports.createCaptureToolProvider = _chunkN2FGYZ4Qcjs.createCaptureToolProvider; exports.createElementCaptureSurface = _chunkSVFEVKLFcjs.createElementCaptureSurface; exports.createMcpServer = _chunkZAOOIJ6Icjs.createMcpServer; exports.createToolRegistry = _chunkZAOOIJ6Icjs.createToolRegistry; exports.elementToSvg = _chunkSVFEVKLFcjs.elementToSvg; exports.errorResult = _chunkZAOOIJ6Icjs.errorResult; exports.listSkills = _chunkZAOOIJ6Icjs.listSkills; exports.parseSkillFrontmatter = _chunkZAOOIJ6Icjs.parseSkillFrontmatter; exports.rasterizeElement = _chunkSVFEVKLFcjs.rasterizeElement; exports.readSkillFile = _chunkZAOOIJ6Icjs.readSkillFile; exports.resolveCaptureRequest = _chunkN2FGYZ4Qcjs.resolveCaptureRequest; exports.searchTokens = _chunkZAOOIJ6Icjs.searchTokens; exports.searchTools = _chunkZAOOIJ6Icjs.searchTools; exports.summarize = _chunkZAOOIJ6Icjs.summarize; exports.toCapturedImageData = _chunkN2FGYZ4Qcjs.toCapturedImageData; exports.toToolResult = _chunkZAOOIJ6Icjs.toToolResult; exports.toolsetInstructions = _chunkZAOOIJ6Icjs.toolsetInstructions; exports.toolsetName = _chunkZAOOIJ6Icjs.toolsetName; exports.unionCaptureRects = _chunkN2FGYZ4Qcjs.unionCaptureRects; exports.unknownToolMessage = _chunkZAOOIJ6Icjs.unknownToolMessage; exports.validateJsonSchema = _chunkWOFXZ3XUcjs.validateJsonSchema;
132
+
133
+
134
+
135
+ exports.CAPTURE_EXCLUDE_SELECTOR = _chunkSVFEVKLFcjs.CAPTURE_EXCLUDE_SELECTOR; exports.CAPTURE_OVERLAY_SELECTORS = _chunkSVFEVKLFcjs.CAPTURE_OVERLAY_SELECTORS; exports.EDITOR_CANVAS_TOOLS = _chunkSVFEVKLFcjs.EDITOR_CANVAS_TOOLS; exports.EDITOR_MCP_TOOLS = _chunkSVFEVKLFcjs.EDITOR_MCP_TOOLS; exports.EDITOR_PROMPT_TOOLS = _chunkSVFEVKLFcjs.EDITOR_PROMPT_TOOLS; exports.EDIT_OPERATION_REQUIRED_ARGUMENTS = _chunkSVFEVKLFcjs.EDIT_OPERATION_REQUIRED_ARGUMENTS; exports.EXPORT_EXCLUDED_SELECTORS = _chunkSVFEVKLFcjs.EXPORT_EXCLUDED_SELECTORS; exports.JSON_RPC_ERRORS = _chunkHDK3T2QScjs.JSON_RPC_ERRORS; exports.MCP_PROTOCOL_VERSIONS = _chunkHDK3T2QScjs.MCP_PROTOCOL_VERSIONS; exports.MCP_TOOL_CANVAS_ADD_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_ADD_NODE; exports.MCP_TOOL_CANVAS_CONNECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_CONNECT; exports.MCP_TOOL_CANVAS_HIGHLIGHT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_HIGHLIGHT; exports.MCP_TOOL_CANVAS_LAYOUT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_LAYOUT; exports.MCP_TOOL_CANVAS_REMOVE_NODES = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_REMOVE_NODES; exports.MCP_TOOL_CANVAS_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_SELECT; exports.MCP_TOOL_CANVAS_UPDATE_NODE = _chunkSVFEVKLFcjs.MCP_TOOL_CANVAS_UPDATE_NODE; exports.MCP_TOOL_EDIT_CANVAS = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_CANVAS; exports.MCP_TOOL_EDIT_PROMPT = _chunkSVFEVKLFcjs.MCP_TOOL_EDIT_PROMPT; exports.MCP_TOOL_GET_EDITOR_STATE = _chunkSVFEVKLFcjs.MCP_TOOL_GET_EDITOR_STATE; exports.MCP_TOOL_PROMPT_INSERT_TEXT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_INSERT_TEXT; exports.MCP_TOOL_PROMPT_REPLACE_RANGE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_REPLACE_RANGE; exports.MCP_TOOL_PROMPT_SELECT = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SELECT; exports.MCP_TOOL_PROMPT_SET_VARIABLE = _chunkSVFEVKLFcjs.MCP_TOOL_PROMPT_SET_VARIABLE; exports.MCP_TOOL_VIEW_EDITOR = _chunkSVFEVKLFcjs.MCP_TOOL_VIEW_EDITOR; exports.TOOL_BRIDGE_DEFAULT_PORT = _chunkHDK3T2QScjs.TOOL_BRIDGE_DEFAULT_PORT; exports.TOOL_BRIDGE_PROTOCOL = _chunkHDK3T2QScjs.TOOL_BRIDGE_PROTOCOL; exports.TOOL_DISCOVERY_TOOLS = _chunkHDK3T2QScjs.TOOL_DISCOVERY_TOOLS; exports.TOOL_NAMESPACE_SEPARATOR = _chunkHDK3T2QScjs.TOOL_NAMESPACE_SEPARATOR; exports.ToolRegistry = _chunkHDK3T2QScjs.ToolRegistry; exports.ToolRegistryError = _chunkHDK3T2QScjs.ToolRegistryError; exports.ToolRegistryView = _chunkHDK3T2QScjs.ToolRegistryView; exports.UNSAFE_JSON_KEYS = _chunk2BSBFBOAcjs.UNSAFE_JSON_KEYS; exports.baseToolName = _chunkHDK3T2QScjs.baseToolName; exports.captureInputSchema = _chunkN2FGYZ4Qcjs.captureInputSchema; exports.captureOutputSize = _chunkN2FGYZ4Qcjs.captureOutputSize; exports.cloneElementWithStyles = _chunkSVFEVKLFcjs.cloneElementWithStyles; exports.connectToolBridge = _chunkHDK3T2QScjs.connectToolBridge; exports.createCaptureTool = _chunkN2FGYZ4Qcjs.createCaptureTool; exports.createCaptureToolProvider = _chunkN2FGYZ4Qcjs.createCaptureToolProvider; exports.createElementCaptureSurface = _chunkSVFEVKLFcjs.createElementCaptureSurface; exports.createMcpServer = _chunkHDK3T2QScjs.createMcpServer; exports.createToolRegistry = _chunkHDK3T2QScjs.createToolRegistry; exports.elementToSvg = _chunkSVFEVKLFcjs.elementToSvg; exports.errorResult = _chunkHDK3T2QScjs.errorResult; exports.isUnsafeJsonKey = _chunk2BSBFBOAcjs.isUnsafeJsonKey; exports.listSkills = _chunkHDK3T2QScjs.listSkills; exports.parseSkillFrontmatter = _chunkHDK3T2QScjs.parseSkillFrontmatter; exports.rasterizeElement = _chunkSVFEVKLFcjs.rasterizeElement; exports.readSkillFile = _chunkHDK3T2QScjs.readSkillFile; exports.resolveCaptureRequest = _chunkN2FGYZ4Qcjs.resolveCaptureRequest; exports.searchTokens = _chunkHDK3T2QScjs.searchTokens; exports.searchTools = _chunkHDK3T2QScjs.searchTools; exports.stripPrototypeKeys = _chunk2BSBFBOAcjs.stripPrototypeKeys; exports.summarize = _chunkHDK3T2QScjs.summarize; exports.toCapturedImageData = _chunkN2FGYZ4Qcjs.toCapturedImageData; exports.toToolResult = _chunkHDK3T2QScjs.toToolResult; exports.toolsetInstructions = _chunkHDK3T2QScjs.toolsetInstructions; exports.toolsetName = _chunkHDK3T2QScjs.toolsetName; exports.unionCaptureRects = _chunkN2FGYZ4Qcjs.unionCaptureRects; exports.unknownToolMessage = _chunkHDK3T2QScjs.unknownToolMessage; exports.validateJsonSchema = _chunkWOFXZ3XUcjs.validateJsonSchema;
@@ -17,3 +17,4 @@ export * from './dom-capture.cjs';
17
17
  export * from './view.cjs';
18
18
  export * from './search.cjs';
19
19
  export * from './skills.cjs';
20
+ export * from './safe-json.cjs';
@@ -17,3 +17,4 @@ export * from './dom-capture.js';
17
17
  export * from './view.js';
18
18
  export * from './search.js';
19
19
  export * from './skills.js';
20
+ export * from './safe-json.js';
@@ -1,4 +1,4 @@
1
- import "../chunk-MCTQXUXR.js";
1
+ import "../chunk-K73HMKQP.js";
2
2
  import {
3
3
  JSON_RPC_ERRORS,
4
4
  MCP_PROTOCOL_VERSIONS,
@@ -24,7 +24,7 @@ import {
24
24
  toolsetInstructions,
25
25
  toolsetName,
26
26
  unknownToolMessage
27
- } from "../chunk-WBKLYLZE.js";
27
+ } from "../chunk-RB62U6MS.js";
28
28
  import {
29
29
  CAPTURE_EXCLUDE_SELECTOR,
30
30
  CAPTURE_OVERLAY_SELECTORS,
@@ -62,6 +62,11 @@ import {
62
62
  toCapturedImageData,
63
63
  unionCaptureRects
64
64
  } from "../chunk-5ED73EC6.js";
65
+ import {
66
+ UNSAFE_JSON_KEYS,
67
+ isUnsafeJsonKey,
68
+ stripPrototypeKeys
69
+ } from "../chunk-HF5QZS7Z.js";
65
70
  import {
66
71
  validateJsonSchema
67
72
  } from "../chunk-V2ZCJRDM.js";
@@ -97,6 +102,7 @@ export {
97
102
  ToolRegistry,
98
103
  ToolRegistryError,
99
104
  ToolRegistryView,
105
+ UNSAFE_JSON_KEYS,
100
106
  baseToolName,
101
107
  captureInputSchema,
102
108
  captureOutputSize,
@@ -109,6 +115,7 @@ export {
109
115
  createToolRegistry,
110
116
  elementToSvg,
111
117
  errorResult,
118
+ isUnsafeJsonKey,
112
119
  listSkills,
113
120
  parseSkillFrontmatter,
114
121
  rasterizeElement,
@@ -116,6 +123,7 @@ export {
116
123
  resolveCaptureRequest,
117
124
  searchTokens,
118
125
  searchTools,
126
+ stripPrototypeKeys,
119
127
  summarize,
120
128
  toCapturedImageData,
121
129
  toToolResult,
@@ -0,0 +1,27 @@
1
+ /**
2
+ * Guards against prototype pollution from untrusted JSON (GHSA-cp6q-959q-f8rh).
3
+ *
4
+ * `JSON.parse('{"__proto__": {...}}')` creates an *own* `__proto__` key. Code
5
+ * that later copies keys with bracket assignment (`out[key] = value`,
6
+ * `Object.assign`) turns it into the copy's prototype, so the copy inherits
7
+ * attacker-chosen properties that `for…in` loops (ProseMirror's
8
+ * `DOMSerializer.renderSpec`, for one) then treat as real ones. TipTap's
9
+ * `mergeAttributes()` did exactly that before `@tiptap/core` 2.27.3 / 3.30.4.
10
+ *
11
+ * This file has no dependencies so the tool layer can use it.
12
+ */
13
+ /** Keys that are dropped from untrusted JSON objects. */
14
+ export declare const UNSAFE_JSON_KEYS: ReadonlySet<string>;
15
+ /** Whether `key` is one of {@link UNSAFE_JSON_KEYS}. */
16
+ export declare const isUnsafeJsonKey: (key: string) => boolean;
17
+ /**
18
+ * Returns `value` without own `__proto__`, `constructor` and `prototype` keys
19
+ * at any depth of its plain objects and arrays. Run untrusted JSON through it
20
+ * before handing it to `setContent`, `Node.fromJSON`, `Slice.fromJSON` or any
21
+ * code that merges objects key by key.
22
+ *
23
+ * Returns `value` itself when there is nothing to strip, and a copy otherwise,
24
+ * so the input is never mutated. Non-plain objects (class instances) pass
25
+ * through untouched.
26
+ */
27
+ export declare function stripPrototypeKeys<T>(value: T): T;
@@ -0,0 +1,27 @@
1
+ /**
2
+ * Guards against prototype pollution from untrusted JSON (GHSA-cp6q-959q-f8rh).
3
+ *
4
+ * `JSON.parse('{"__proto__": {...}}')` creates an *own* `__proto__` key. Code
5
+ * that later copies keys with bracket assignment (`out[key] = value`,
6
+ * `Object.assign`) turns it into the copy's prototype, so the copy inherits
7
+ * attacker-chosen properties that `for…in` loops (ProseMirror's
8
+ * `DOMSerializer.renderSpec`, for one) then treat as real ones. TipTap's
9
+ * `mergeAttributes()` did exactly that before `@tiptap/core` 2.27.3 / 3.30.4.
10
+ *
11
+ * This file has no dependencies so the tool layer can use it.
12
+ */
13
+ /** Keys that are dropped from untrusted JSON objects. */
14
+ export declare const UNSAFE_JSON_KEYS: ReadonlySet<string>;
15
+ /** Whether `key` is one of {@link UNSAFE_JSON_KEYS}. */
16
+ export declare const isUnsafeJsonKey: (key: string) => boolean;
17
+ /**
18
+ * Returns `value` without own `__proto__`, `constructor` and `prototype` keys
19
+ * at any depth of its plain objects and arrays. Run untrusted JSON through it
20
+ * before handing it to `setContent`, `Node.fromJSON`, `Slice.fromJSON` or any
21
+ * code that merges objects key by key.
22
+ *
23
+ * Returns `value` itself when there is nothing to strip, and a copy otherwise,
24
+ * so the input is never mutated. Non-plain objects (class instances) pass
25
+ * through untouched.
26
+ */
27
+ export declare function stripPrototypeKeys<T>(value: T): T;
@@ -4362,7 +4362,7 @@ function createVideoEditorToolProvider(controller, options = {}) {
4362
4362
  const setTransition = {
4363
4363
  name: "set_video_transition",
4364
4364
  title: "Set a transition",
4365
- description: "Sets (or with null removes) the transition into a clip from the clip that ends where it starts on the same track (one undo step). Every type but dip plays half before and half after the cut, so both clips need that much media past the cut; when they do not, the error says the longest that fits. Returns the clip.",
4365
+ description: "Sets (or with null removes) a built-in transition into a clip from the clip that ends where it starts on the same track: crossfade (a cross dissolve), dip to a colour, wipe, push, slide or iris. One undo step. Use set_video_effect_transition only for a transition effect from the effects provider. Every type but dip plays half before and half after the cut, so both clips need that much media past the cut; when they do not, the error says the longest that fits. Returns the clip.",
4366
4366
  inputSchema: object({ clip: { ...CLIP_ID, description: "The incoming clip (the one after the cut)." }, transition: { anyOf: [TRANSITION, { type: "null" }], description: "The transition, or null to remove it." } }, ["clip", "transition"]),
4367
4367
  annotations: { title: "Set a transition", ...WRITE_IDEMPOTENT },
4368
4368
  handler: ({ clip, transition }) => apply({ op: "set_transition", clip, transition }, transition ? "Set transition" : "Remove transition", (r) => ({ clip: clipOut(r.project, clip) }))
@@ -4757,7 +4757,7 @@ function createVideoEffectsToolProvider(controller, options = {}) {
4757
4757
  {
4758
4758
  name: "set_video_effect_transition",
4759
4759
  title: "Set an effect transition",
4760
- description: `Sets a provider transition effect (search_effects with use transition) into a clip from the clip that ends where it starts on the same track, centred on the cut; like a crossfade it needs half its length in media past the cut on both sides. Replaces any transition there. One undo step. Returns the clip's effects. Remove it with remove_effect (effect "transition") or set_video_transition null.`,
4760
+ description: `Sets a transition effect from the effects provider (search_effects with use transition) into a clip from the clip that ends where it starts on the same track, centred on the cut. For the built-in crossfade (cross dissolve), dip, wipe, push, slide and iris use set_video_transition instead. It needs half its length in media past the cut on both sides. Replaces any transition there. One undo step. Returns the clip's effects. Remove it with remove_effect (effect "transition") or set_video_transition null.`,
4761
4761
  inputSchema: {
4762
4762
  type: "object",
4763
4763
  properties: {
@@ -4362,7 +4362,7 @@ function createVideoEditorToolProvider(controller, options = {}) {
4362
4362
  const setTransition = {
4363
4363
  name: "set_video_transition",
4364
4364
  title: "Set a transition",
4365
- description: "Sets (or with null removes) the transition into a clip from the clip that ends where it starts on the same track (one undo step). Every type but dip plays half before and half after the cut, so both clips need that much media past the cut; when they do not, the error says the longest that fits. Returns the clip.",
4365
+ description: "Sets (or with null removes) a built-in transition into a clip from the clip that ends where it starts on the same track: crossfade (a cross dissolve), dip to a colour, wipe, push, slide or iris. One undo step. Use set_video_effect_transition only for a transition effect from the effects provider. Every type but dip plays half before and half after the cut, so both clips need that much media past the cut; when they do not, the error says the longest that fits. Returns the clip.",
4366
4366
  inputSchema: object({ clip: { ...CLIP_ID, description: "The incoming clip (the one after the cut)." }, transition: { anyOf: [TRANSITION, { type: "null" }], description: "The transition, or null to remove it." } }, ["clip", "transition"]),
4367
4367
  annotations: { title: "Set a transition", ...WRITE_IDEMPOTENT },
4368
4368
  handler: ({ clip, transition }) => apply({ op: "set_transition", clip, transition }, transition ? "Set transition" : "Remove transition", (r) => ({ clip: clipOut(r.project, clip) }))
@@ -4757,7 +4757,7 @@ function createVideoEffectsToolProvider(controller, options = {}) {
4757
4757
  {
4758
4758
  name: "set_video_effect_transition",
4759
4759
  title: "Set an effect transition",
4760
- description: `Sets a provider transition effect (search_effects with use transition) into a clip from the clip that ends where it starts on the same track, centred on the cut; like a crossfade it needs half its length in media past the cut on both sides. Replaces any transition there. One undo step. Returns the clip's effects. Remove it with remove_effect (effect "transition") or set_video_transition null.`,
4760
+ description: `Sets a transition effect from the effects provider (search_effects with use transition) into a clip from the clip that ends where it starts on the same track, centred on the cut. For the built-in crossfade (cross dissolve), dip, wipe, push, slide and iris use set_video_transition instead. It needs half its length in media past the cut on both sides. Replaces any transition there. One undo step. Returns the clip's effects. Remove it with remove_effect (effect "transition") or set_video_transition null.`,
4761
4761
  inputSchema: {
4762
4762
  type: "object",
4763
4763
  properties: {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@pixerate/editor",
3
- "version": "0.140.0",
3
+ "version": "0.140.2",
4
4
  "description": "UI-agnostic rich text and media editing core library",
5
5
  "author": "Pixerate",
6
6
  "license": "MIT",
@@ -315,27 +315,27 @@
315
315
  ],
316
316
  "sideEffects": false,
317
317
  "dependencies": {
318
- "@tiptap/extension-character-count": "^2.11.5",
319
- "@tiptap/extension-color": "^2.11.5",
320
- "@tiptap/extension-highlight": "^2.11.5",
321
- "@tiptap/extension-image": "^2.11.5",
322
- "@tiptap/extension-link": "^2.11.5",
323
- "@tiptap/extension-mention": "^2.11.5",
324
- "@tiptap/extension-placeholder": "^2.11.5",
325
- "@tiptap/extension-subscript": "^2.11.5",
326
- "@tiptap/extension-superscript": "^2.11.5",
327
- "@tiptap/extension-table": "^2.11.5",
328
- "@tiptap/extension-table-cell": "^2.11.5",
329
- "@tiptap/extension-table-header": "^2.11.5",
330
- "@tiptap/extension-table-row": "^2.11.5",
331
- "@tiptap/extension-task-item": "^2.11.5",
332
- "@tiptap/extension-task-list": "^2.11.5",
333
- "@tiptap/extension-text-align": "^2.11.5",
334
- "@tiptap/extension-text-style": "^2.11.5",
335
- "@tiptap/extension-typography": "^2.11.5",
336
- "@tiptap/extension-underline": "^2.11.5",
337
- "@tiptap/starter-kit": "^2.11.5",
338
- "@tiptap/suggestion": "^2.11.5",
318
+ "@tiptap/extension-character-count": "^2.27.3",
319
+ "@tiptap/extension-color": "^2.27.3",
320
+ "@tiptap/extension-highlight": "^2.27.3",
321
+ "@tiptap/extension-image": "^2.27.3",
322
+ "@tiptap/extension-link": "^2.27.3",
323
+ "@tiptap/extension-mention": "^2.27.3",
324
+ "@tiptap/extension-placeholder": "^2.27.3",
325
+ "@tiptap/extension-subscript": "^2.27.3",
326
+ "@tiptap/extension-superscript": "^2.27.3",
327
+ "@tiptap/extension-table": "^2.27.3",
328
+ "@tiptap/extension-table-cell": "^2.27.3",
329
+ "@tiptap/extension-table-header": "^2.27.3",
330
+ "@tiptap/extension-table-row": "^2.27.3",
331
+ "@tiptap/extension-task-item": "^2.27.3",
332
+ "@tiptap/extension-task-list": "^2.27.3",
333
+ "@tiptap/extension-text-align": "^2.27.3",
334
+ "@tiptap/extension-text-style": "^2.27.3",
335
+ "@tiptap/extension-typography": "^2.27.3",
336
+ "@tiptap/extension-underline": "^2.27.3",
337
+ "@tiptap/starter-kit": "^2.27.3",
338
+ "@tiptap/suggestion": "^2.27.3",
339
339
  "markdown-it": "^15.0.3",
340
340
  "markdown-it-task-lists": "^2.1.1",
341
341
  "prosemirror-markdown": "^1.13.8"
@@ -343,23 +343,23 @@
343
343
  "devDependencies": {
344
344
  "@anthropic-ai/sdk": "0.137.0",
345
345
  "@dagrejs/dagre": "^1.1.8",
346
- "@tiptap/core": "^2.11.5",
347
- "@tiptap/pm": "^2.11.5",
346
+ "@tiptap/core": "^2.27.3",
347
+ "@tiptap/pm": "^2.27.3",
348
348
  "@types/dagre": "^0.7.54",
349
349
  "@types/markdown-it": "^14.2.0",
350
350
  "@types/node": "^26.6.5",
351
351
  "assemblyscript": "0.28.20",
352
352
  "fast-check": "^3.23.2",
353
- "mermaid": "12.0.0",
353
+ "mermaid": "12.2.0",
354
354
  "tiptap-markdown": "^0.8.10",
355
- "tsup": "^8.4.0",
355
+ "tsup": "^9.0.0",
356
356
  "typescript": "^5.7.3",
357
357
  "vitest": "^5.0.5"
358
358
  },
359
359
  "peerDependencies": {
360
360
  "@dagrejs/dagre": "^1.1.8",
361
- "@tiptap/core": "^2.11.5",
362
- "@tiptap/pm": "^2.11.5"
361
+ "@tiptap/core": "^2.27.3",
362
+ "@tiptap/pm": "^2.27.3"
363
363
  },
364
364
  "peerDependenciesMeta": {
365
365
  "@dagrejs/dagre": {
@@ -251,7 +251,7 @@ and every write tool is refused with the reason.
251
251
  | `update_effect` | Change an applied effect: `values` merged over its own (null resets a control), `enabled`, `opacity`, `index` (reorder). For `generator` and `transition` only `values`. Returns the effect now. |
252
252
  | `remove_effect` | Take an effect off a clip (`transition` removes an effect transition; an effect clip is deleted with `delete_video_clips`). Returns what was removed and what is left. |
253
253
  | `add_video_effect_clip` | Put a generator, title or overlay effect on a video `track` as a clip filling the frame (`start`, `duration` default the effect's own length, `values`, `mode`). Transparent effects show the tracks beneath. Returns the clip id. |
254
- | `set_video_effect_transition` | Use a provider transition effect into a `clip` from the one ending where it starts (`duration` centred on the cut, `values`). Needs handles like a crossfade. |
254
+ | `set_video_effect_transition` | Use a transition effect from the effects provider into a `clip` from the one ending where it starts (`duration` centred on the cut, `values`). Needs handles like a crossfade. For a cross dissolve, dip, wipe, push, slide or iris use the built-in `set_video_transition` instead. |
255
255
  | `set_video_effect_keyframes` | Animate one number `control` of a clip effect (or an effect clip's `generator`) with `keys` in clip ms, or `null` to stop animating it. |
256
256
 
257
257
  ## Pitfalls
File without changes
File without changes