@prenta/admin 1.17.3 → 1.17.5

package/dist/views/page-editor/sections/admin-renderers.d.ts

@@ -1,35 +1,3 @@
-/**
- * Pluggable canvas renderers for the editor canvas and the eye preview.
- *
- * RESOLUTION ORDER — supplied renderer → built-in → placeholder.
- *
- * A renderer passed to `<AdminRoot sectionRenderers>` wins for EVERY section
- * type, including the built-ins. Before v0.93 the map was consulted only for
- * types the canvas did not already know, so a consumer passing the public
- * renderer map had their hero, text, feature, stats and cta silently ignored
- * while the canvas rendered the admin's own approximations — different font
- * size, weight and breakpoints — and presented itself as a preview.
- *
- * With nothing supplied, built-in types fall back to those approximations and
- * custom (config-declared) or unmanaged types render as a structural
- * placeholder.
- *
- * The renderer signature is a structural mirror of `SectionRenderer` from
- * `@prenta/sections-react` (cms-admin depends on cms-core only, so the type is
- * duplicated rather than imported). `admin-renderer-compat.test.ts` performs
- * the assignment that keeps the two shapes compatible.
- *
- * ```tsx
- * import { DEFAULT_SECTION_RENDERERS } from '@prenta/sections-react'
- * import { OPAL_RENDERERS } from './sections'
- * <AdminRoot sectionRenderers={{ ...DEFAULT_SECTION_RENDERERS, ...OPAL_RENDERERS }} />
- * ```
- *
- * Renderers run inside the admin bundle, so they must be client-safe (no
- * server-only imports). Each is wrapped in an error boundary — a throwing
- * renderer falls back to the built-in for that type, or to the placeholder if
- * the type has no built-in, instead of taking down the editor.
- */
 import { type ReactNode } from 'react';
 /** Structural mirror of `RenderImageProps` from `@prenta/sections-react`. */
 export interface AdminRenderImageProps {
@@ -107,10 +75,9 @@ export type AdminSectionRenderer = (props: AdminSectionRendererProps) => ReactNo
 /** Section-type id → canvas renderer. */
 export type AdminSectionRendererMap = Record<string, AdminSectionRenderer>;
 /**
- * Render options passed to every admin renderer. Rich text is sanitized on
- * write by cms-core, so the canvas (same trust domain as the public default)
- * uses the identity sanitizer; images render as plain lazy `<img>` since the
- * editor canvas has no next/image pipeline.
+ * Render options passed to every admin renderer. Draft HTML is sanitized
+ * with the cms-core allow-list before any renderer injects it. Images render
+ * as plain lazy `<img>` since the editor canvas has no next/image pipeline.
  */
 export declare const ADMIN_RENDER_OPTIONS: AdminSectionRendererProps['options'];
 export declare const AdminSectionRenderersProvider: import("react").Provider<AdminSectionRendererMap>;

package/dist/views/page-editor/sections/admin-renderers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-renderers.d.ts","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjE,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxE;AAED;;;;GAIG;AACH,UAAU,kBAAkB;IAC1B,KAAK,IAAI,OAAO,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;IACD,GAAG,CAAC,EAAE,uBAAuB,CAAA;IAC7B,OAAO,EAAE;QACP,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;QACtC,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,SAAS,CAAA;QACxD,2CAA2C;QAC3C,GAAG,EAAE,kBAAkB,CAAA;QACvB;;;;;;;;;;;;WAYG;QAEH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KACrC,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,yBAAyB,KAAK,SAAS,CAAA;AAElF,yCAAyC;AACzC,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,yBAAyB,CAAC,SAAS,CAkBrE,CAAA;AAID,eAAO,MAAM,6BAA6B,mDAAwC,CAAA;AAElF,oFAAoF;AACpF,wBAAgB,wBAAwB,IAAI,uBAAuB,CAElE"}
+{"version":3,"file":"admin-renderers.d.ts","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAmCA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjE,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxE;AAED;;;;GAIG;AACH,UAAU,kBAAkB;IAC1B,KAAK,IAAI,OAAO,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;IACD,GAAG,CAAC,EAAE,uBAAuB,CAAA;IAC7B,OAAO,EAAE;QACP,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;QACtC,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,SAAS,CAAA;QACxD,2CAA2C;QAC3C,GAAG,EAAE,kBAAkB,CAAA;QACvB;;;;;;;;;;;;WAYG;QAEH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KACrC,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,yBAAyB,KAAK,SAAS,CAAA;AAElF,yCAAyC;AACzC,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAE1E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,yBAAyB,CAAC,SAAS,CAkBrE,CAAA;AAID,eAAO,MAAM,6BAA6B,mDAAwC,CAAA;AAElF,oFAAoF;AACpF,wBAAgB,wBAAwB,IAAI,uBAAuB,CAElE"}

package/dist/views/page-editor/sections/admin-renderers.js

@@ -32,15 +32,15 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * renderer falls back to the built-in for that type, or to the placeholder if
  * the type has no built-in, instead of taking down the editor.
  */
+import { sanitizeHtml } from '@prenta/core/sanitize';
 import { createContext, useContext } from 'react';
 /**
- * Render options passed to every admin renderer. Rich text is sanitized on
- * write by cms-core, so the canvas (same trust domain as the public default)
- * uses the identity sanitizer; images render as plain lazy `<img>` since the
- * editor canvas has no next/image pipeline.
+ * Render options passed to every admin renderer. Draft HTML is sanitized
+ * with the cms-core allow-list before any renderer injects it. Images render
+ * as plain lazy `<img>` since the editor canvas has no next/image pipeline.
  */
 export const ADMIN_RENDER_OPTIONS = {
-    sanitizeHtml: (html) => html,
+    sanitizeHtml,
     baseUrl: '',
     // Never grants the priority slot. On a public page exactly one image may
     // load eagerly; in the canvas nothing competes for bandwidth and every

package/dist/views/page-editor/sections/admin-renderers.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-renderers.js","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAkB,MAAM,OAAO,CAAA;AA4EjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE;IACX,yEAAyE;IACzE,uEAAuE;IACvE,wDAAwD;IACxD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACjE,cACE,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,KAAK,IAAI,SAAS,EACzB,MAAM,EAAE,MAAM,IAAI,SAAS,EAC3B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GACtC,CACH;CACF,CAAA;AAED,MAAM,4BAA4B,GAAG,aAAa,CAA0B,EAAE,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,QAAQ,CAAA;AAElF,oFAAoF;AACpF,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"admin-renderers.js","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAkB,MAAM,OAAO,CAAA;AA4EjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,YAAY;IACZ,OAAO,EAAE,EAAE;IACX,yEAAyE;IACzE,uEAAuE;IACvE,wDAAwD;IACxD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACjE,cACE,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,KAAK,IAAI,SAAS,EACzB,MAAM,EAAE,MAAM,IAAI,SAAS,EAC3B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GACtC,CACH;CACF,CAAA;AAED,MAAM,4BAA4B,GAAG,aAAa,CAA0B,EAAE,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,QAAQ,CAAA;AAElF,oFAAoF;AACpF,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAA;AACjD,CAAC"}

package/dist/views/settings/useUpdates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUpdates.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,KAAK,GACL,aAAa,GACb,UAAU,GACV,UAAU,GACV,aAAa,CAAA;AAEjB,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAA;IACjC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,CAAA;IACjD,MAAM,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IAChC,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAUD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;eAMF,MAAM;kBAAY,MAAM;;;;oBAqCvC,MAAM,UAAU,SAAS,MAAM;;;;;;;;;EA0EnE"}
+{"version":3,"file":"useUpdates.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,KAAK,GACL,aAAa,GACb,UAAU,GACV,UAAU,GACV,aAAa,CAAA;AAEjB,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAA;IACjC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,CAAA;IACjD,MAAM,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IAChC,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAUD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;eAMF,MAAM;kBAAY,MAAM;;;;oBAgDvC,MAAM,UAAU,SAAS,MAAM;;;;;;;;;EA0EnE"}

package/dist/views/settings/useUpdates.js

@@ -1,5 +1,5 @@
 'use client';
-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 import { toast } from 'sonner';
 import { cmsApi } from '../../lib/api.js';
 const REPO_PATTERN = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
@@ -24,21 +24,31 @@ export function useUpdates({ role }) {
     const [form, setForm] = useState({ githubRepo: '', githubToken: '' });
     const [baseline, setBaseline] = useState({ githubRepo: '', githubToken: '' });
     const [saveState, setSaveState] = useState('idle');
+    // The check request is in flight across renders. Read the baseline from the
+    // render that started it, not from a later save or keystroke.
+    const baselineRef = useRef(baseline);
+    baselineRef.current = baseline;
     // Optimistic until the check response confirms the server-side permission.
     const canManage = info?.canManage ?? canManageUpdates(role);
     const check = useCallback(async () => {
         setChecking(true);
         setError('');
         setPrResult(null);
+        const baselineAtStart = baselineRef.current;
         const res = await cmsApi('/updates/check');
         if (res.error) {
             setError(res.error);
         }
         else if (res.data) {
             setInfo(res.data);
-            const repo = res.data.githubRepo ?? '';
-            setForm({ githubRepo: repo, githubToken: '' });
-            setBaseline({ githubRepo: repo, githubToken: '' });
+            const next = { githubRepo: res.data.githubRepo ?? '', githubToken: '' };
+            // A mount-time check can take seconds. Only replace the fields when the
+            // user has not typed since this request started (#929).
+            setForm((current) => {
+                const untouched = current.githubRepo === baselineAtStart.githubRepo && current.githubToken.trim() === '';
+                return untouched ? next : current;
+            });
+            setBaseline(next);
         }
         setChecking(false);
         setHasChecked(true);

package/dist/views/settings/useUpdates.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUpdates.js","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AA8CzC,MAAM,YAAY,GAAG,oCAAoC,CAAA;AAEzD,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,IAA+B;IACvD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,IAAI,EAAqB;IACpD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA6C,IAAI,CAAC,CAAA;IAE1F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACjF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACzF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA0C,MAAM,CAAC,CAAA;IAE3F,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAa,gBAAgB,CAAC,CAAA;QACtD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAA;YACtC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9C,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACpD,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,aAAa,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,EAAE,CAAA;IACT,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAEX,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IAEvF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,GAAqB,EAAE,KAAa,EAAE,EAAE;QACpE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACxC,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC/B,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,MAAM,IAAI,GAA2B,EAAE,CAAA;QACvC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QAEpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,YAAY,CAAC,SAAS,CAAC,CAAA;QACvB,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACxC,WAAW,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI;YACF,CAAC,CAAC;gBACE,GAAG,IAAI;gBACP,UAAU,EAAE,SAAS;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aACjE;YACH,CAAC,CAAC,IAAI,CACT,CAAA;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACxB,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS;YAAE,OAAM;QACvC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsC,gBAAgB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACrC,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;IAErB,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAA;AACH,CAAC"}
+{"version":3,"file":"useUpdates.js","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AA8CzC,MAAM,YAAY,GAAG,oCAAoC,CAAA;AAEzD,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,IAA+B;IACvD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,IAAI,EAAqB;IACpD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA6C,IAAI,CAAC,CAAA;IAE1F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACjF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACzF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA0C,MAAM,CAAC,CAAA;IAC3F,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IACpC,WAAW,CAAC,OAAO,GAAG,QAAQ,CAAA;IAE9B,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAa,gBAAgB,CAAC,CAAA;QACtD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;YACvE,wEAAwE;YACxE,wDAAwD;YACxD,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAClB,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;gBACxF,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YACnC,CAAC,CAAC,CAAA;YACF,WAAW,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,aAAa,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,EAAE,CAAA;IACT,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAEX,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IAEvF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,GAAqB,EAAE,KAAa,EAAE,EAAE;QACpE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACxC,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC/B,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,MAAM,IAAI,GAA2B,EAAE,CAAA;QACvC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QAEpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,YAAY,CAAC,SAAS,CAAC,CAAA;QACvB,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACxC,WAAW,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI;YACF,CAAC,CAAC;gBACE,GAAG,IAAI;gBACP,UAAU,EAAE,SAAS;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aACjE;YACH,CAAC,CAAC,IAAI,CACT,CAAA;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACxB,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS;YAAE,OAAM;QACvC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsC,gBAAgB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACrC,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;IAErB,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prenta/admin",
-  "version": "1.17.3",
+  "version": "1.17.5",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -99,15 +99,15 @@
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
     "@prenta/component-blocks": "0.3.1",
-    "@prenta/core": "7.1.0",
     "@prenta/plugin-ai": "3.0.0",
     "@prenta/plugin-blocks": "0.2.0",
+    "@prenta/core": "7.2.1",
     "@prenta/plugin-commerce": "0.2.1",
     "@prenta/plugin-forms": "0.1.0",
-    "@prenta/plugin-media": "0.2.0",
-    "@prenta/plugin-navigation": "0.3.0",
     "@prenta/plugin-seo": "1.0.0",
-    "@prenta/sections-react": "0.17.43"
+    "@prenta/plugin-navigation": "0.3.0",
+    "@prenta/plugin-media": "0.2.0",
+    "@prenta/sections-react": "0.17.46"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && npx @tailwindcss/cli -i src/styles/build-input.css -o dist/prenta-admin.css --minify",

package/src/__tests__/views/admin-section-renderers.test.tsx

@@ -56,6 +56,7 @@ describe('pluggable admin section renderers', () => {
     )
     const options = seen[0] as { sanitizeHtml: (h: string) => string; baseUrl: string }
     expect(options.sanitizeHtml('<b>x</b>')).toBe('<b>x</b>')
+    expect(options.sanitizeHtml('<p>ok</p><script>alert(1)</script>')).not.toContain('script')
     expect(options.baseUrl).toBe('')
     expect(screen.getByAltText('x')).toBeTruthy()
   })

package/src/__tests__/views/article-body-section.render.test.tsx

@@ -29,4 +29,18 @@ describe('ArticleBodySection', () => {
     expect(container.querySelector('.prenta-rich-text')).toBeTruthy()
     expect(container.querySelector('.prose')).toBeNull()
   })
+
+  it('strips script tags from draft HTML before rendering (#396)', () => {
+    const { container } = render(
+      <ArticleBodySection
+        section={section({ source: 'field' })}
+        context={{ body: '<p>Safe copy</p><script>alert(1)</script>' }}
+      />,
+    )
+
+    const preview = container.querySelector('.prenta-rich-text')
+    expect(preview?.querySelector('script')).toBeNull()
+    expect(preview?.innerHTML).toContain('Safe copy')
+    expect(preview?.innerHTML).not.toContain('alert')
+  })
 })

package/src/__tests__/views/seo-autopilot-card.render.test.tsx

@@ -137,8 +137,7 @@ describe('SeoAutopilotCard', () => {
 
   it('a blur-commit followed immediately by a checkbox click lands two PUTs, in order', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const brand = screen.getByLabelText(/minimum brand alignment/i)
+    const brand = await screen.findByLabelText(/minimum brand alignment/i)
     const checkbox = screen.getByLabelText('Missing meta title') as HTMLInputElement
     fireEvent.change(brand, { target: { value: '90' } })
     // mousedown on the checkbox blurs the input (commit → PUT #1) and the click
@@ -161,9 +160,9 @@ describe('SeoAutopilotCard', () => {
     const gate = deferred()
     putGate = gate.promise
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
+    // The card region also wraps the loading skeleton; wait on a loaded control.
+    const checkbox = (await screen.findByLabelText('Missing meta title')) as HTMLInputElement
     const card = screen.getByRole('region', { name: 'SEO Autopilot' })
-    const checkbox = screen.getByLabelText('Missing meta title') as HTMLInputElement
     checkbox.focus()
     fireEvent.click(checkbox)
     await waitFor(() => expect(card.getAttribute('aria-busy')).toBe('true'))
@@ -184,8 +183,7 @@ describe('SeoAutopilotCard', () => {
     runGate = gate.promise
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByRole('button', { name: /run now/i }))
+    fireEvent.click(await screen.findByRole('button', { name: /run now/i }))
     await waitFor(() =>
       expect(cmsApi).toHaveBeenCalledWith('/seo/autopilot/run', expect.anything()),
     )
@@ -199,8 +197,7 @@ describe('SeoAutopilotCard', () => {
 
   it('toggling a type PUTs a types patch', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByLabelText('Missing meta title'))
+    fireEvent.click(await screen.findByLabelText('Missing meta title'))
     await waitFor(() =>
       expect(cmsApi).toHaveBeenCalledWith(
         '/seo/autopilot/settings',
@@ -218,8 +215,7 @@ describe('SeoAutopilotCard', () => {
 
   it('toggling the master switch PUTs { enabled }', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByRole('switch', { name: /enable autopilot/i }))
+    fireEvent.click(await screen.findByRole('switch', { name: /enable autopilot/i }))
     await waitFor(() => expect(putBodies()).toEqual([{ enabled: true }]))
     await waitFor(() =>
       expect(
@@ -230,8 +226,7 @@ describe('SeoAutopilotCard', () => {
 
   it('commits a clamped threshold on blur and sends the outcome-watch ratio as a fraction', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const brand = screen.getByLabelText(/minimum brand alignment/i)
+    const brand = await screen.findByLabelText(/minimum brand alignment/i)
     fireEvent.change(brand, { target: { value: '140' } })
     fireEvent.blur(brand)
     await waitFor(() => expect(putBodies()).toEqual([{ minBrandAlignment: 100 }]))
@@ -244,8 +239,7 @@ describe('SeoAutopilotCard', () => {
 
   it('does not PUT when a number field is blurred unchanged or with garbage', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const perRun = screen.getByLabelText(/max changes per run/i)
+    const perRun = await screen.findByLabelText(/max changes per run/i)
     fireEvent.blur(perRun)
     fireEvent.change(perRun, { target: { value: '' } })
     fireEvent.blur(perRun)
@@ -256,8 +250,7 @@ describe('SeoAutopilotCard', () => {
   it('surfaces a PUT validation error verbatim and keeps the previous state', async () => {
     putResponse = { error: 'maxPerRun must be an integer between 1 and 25', status: 400 }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByLabelText('Missing meta title'))
+    fireEvent.click(await screen.findByLabelText('Missing meta title'))
     await waitFor(() =>
       expect(toastError).toHaveBeenCalledWith('maxPerRun must be an integer between 1 and 25'),
     )
@@ -268,8 +261,7 @@ describe('SeoAutopilotCard', () => {
   it('resets a number field to the last saved value when its PUT fails', async () => {
     putResponse = { error: 'maxPerRun must be an integer between 1 and 25', status: 400 }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const perRun = screen.getByLabelText(/max changes per run/i) as HTMLInputElement
+    const perRun = (await screen.findByLabelText(/max changes per run/i)) as HTMLInputElement
     fireEvent.change(perRun, { target: { value: '9' } })
     fireEvent.blur(perRun)
     await waitFor(() =>
@@ -368,8 +360,7 @@ describe('SeoAutopilotCard', () => {
       pausedTypes: { 'missing-meta-title': reason },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const list = screen.getByRole('list', { name: /paused fix types/i })
+    const list = await screen.findByRole('list', { name: /paused fix types/i })
     expect(list.textContent ?? '').toContain(`Missing meta title — ${reason}`)
     fireEvent.click(within(list).getByRole('button', { name: /resume/i }))
     await waitFor(() => expect(putBodies()).toEqual([{ resumeTypes: ['missing-meta-title'] }]))
@@ -377,8 +368,7 @@ describe('SeoAutopilotCard', () => {
 
   it('Run now is disabled while the policy is disabled and explains why', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(true)
     expect(run.getAttribute('title')).toMatch(/enable autopilot to run it now/i)
     const hintId = run.getAttribute('aria-describedby')
@@ -397,8 +387,7 @@ describe('SeoAutopilotCard', () => {
       pausedReason: 'manual',
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(true)
     expect(run.getAttribute('title')).toMatch(/resume autopilot to run it now/i)
     const hintId = run.getAttribute('aria-describedby')
@@ -410,8 +399,7 @@ describe('SeoAutopilotCard', () => {
   it('Run now carries no hint once it is runnable', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(false)
     expect(run.getAttribute('title')).toBeNull()
     expect(run.getAttribute('aria-describedby')).toBeNull()
@@ -420,8 +408,7 @@ describe('SeoAutopilotCard', () => {
   it('Run now POSTs /seo/autopilot/run and reloads', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i })
+    const run = await screen.findByRole('button', { name: /run now/i })
     expect((run as HTMLButtonElement).disabled).toBe(false)
     fireEvent.click(run)
     // Second click while in flight must not queue a second run.
@@ -457,8 +444,7 @@ describe('SeoAutopilotCard', () => {
       },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const summary = screen.getByRole('status', { name: /last run/i })
+    const summary = await screen.findByRole('status', { name: /last run/i })
     expect(summary.textContent ?? '').toMatch(/4 applied/)
     expect(summary.textContent ?? '').toMatch(/1 verify-failed/)
     expect(summary.textContent ?? '').toMatch(/2 reverted/)
@@ -475,8 +461,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: 'verify_failures' },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(/verification failures/i)
     expect(halted.className).toContain('text-warning')
   })
@@ -491,8 +476,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: 'budget_exhausted' },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(/ran out of time/i)
     expect(halted.textContent ?? '').not.toMatch(/daily/i)
   })
@@ -510,8 +494,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: reason },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(copy)
     expect(halted.textContent ?? '').not.toMatch(/stopped with an error/i)
     expect(halted.className).toContain('text-warning')
@@ -524,10 +507,8 @@ describe('SeoAutopilotCard', () => {
       lastRunAt: new Date(Date.now() - 5 * 60_000).toISOString(),
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    expect(screen.getByRole('status', { name: /last run/i }).textContent ?? '').toMatch(
-      /last run 5m ago/i,
-    )
+    const summary = await screen.findByRole('status', { name: /last run/i })
+    expect(summary.textContent ?? '').toMatch(/last run 5m ago/i)
   })
 
   it('offers every autopilot issue type exactly once (mirror of SEO_AUTOPILOT_ISSUE_TYPES)', () => {
@@ -539,10 +520,8 @@ describe('SeoAutopilotCard', () => {
   it('read-only for non-admins', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit={false} onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    expect(
-      (screen.getByRole('switch', { name: /enable autopilot/i }) as HTMLInputElement).disabled,
-    ).toBe(true)
+    const toggle = await screen.findByRole('switch', { name: /enable autopilot/i })
+    expect((toggle as HTMLInputElement).disabled).toBe(true)
     expect((screen.getByLabelText('Missing meta title') as HTMLInputElement).disabled).toBe(true)
     expect((screen.getByLabelText(/minimum brand alignment/i) as HTMLInputElement).disabled).toBe(
       true,
@@ -561,8 +540,7 @@ describe('SeoAutopilotCard', () => {
     }
     const onNavigate = vi.fn()
     render(<SeoAutopilotCard canEdit onNavigate={onNavigate} />)
-    await screen.findByText('SEO Autopilot')
-    const notice = screen.getByRole('region', { name: /governance/i })
+    const notice = await screen.findByRole('region', { name: /governance/i })
     expect(notice.getAttribute('role')).not.toBe('status')
     expect(notice.textContent ?? '').toMatch(/requires approval/i)
     fireEvent.click(within(notice).getByRole('button', { name: /settings → ai/i }))
@@ -577,7 +555,9 @@ describe('SeoAutopilotCard', () => {
       governance: { issueFixApprovalRequired: true, redirectApprovalRequired: false },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
+    // Wait on a loaded control: against the skeleton the negative check below
+    // would pass vacuously.
+    await screen.findByRole('switch', { name: /enable autopilot/i })
     expect(screen.queryByRole('region', { name: /governance/i })).toBeNull()
   })
 
@@ -593,8 +573,7 @@ describe('SeoAutopilotCard', () => {
       governance: { issueFixApprovalRequired: true, redirectApprovalRequired: false },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const live = screen.getAllByRole('status').map((el) => el.getAttribute('aria-label'))
+    const live = (await screen.findAllByRole('status')).map((el) => el.getAttribute('aria-label'))
     expect(live.sort()).toEqual(['Last run', 'Run stopped'])
   })
 

package/src/__tests__/views/updates-tab.render.test.tsx

@@ -5,10 +5,15 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 // The Updates tab reads `/updates/check`, saves GitHub config via
 // PUT `/updates/config`, and opens an upgrade PR via POST `/updates/apply`.
 let checkData: any
+/** When set, `/updates/check` waits so a test can type before the response lands. */
+let checkGate: Promise<void> | null = null
 
 const cmsApi = vi.fn(async (endpoint: string, options?: { method?: string; body?: unknown }) => {
   const method = options?.method ?? 'GET'
-  if (endpoint === '/updates/check' && method === 'GET') return { data: checkData, status: 200 }
+  if (endpoint === '/updates/check' && method === 'GET') {
+    if (checkGate) await checkGate
+    return { data: checkData, status: 200 }
+  }
   if (endpoint === '/updates/config' && method === 'PUT')
     return { data: { success: true }, status: 200 }
   if (endpoint === '/updates/apply' && method === 'POST')
@@ -65,6 +70,7 @@ function updateAvailable(overrides: Record<string, unknown> = {}) {
 beforeEach(() => {
   cmsApi.mockClear()
   checkData = upToDate()
+  checkGate = null
 })
 
 describe('UpdatesTab', () => {
@@ -108,9 +114,50 @@ describe('UpdatesTab', () => {
     expect(screen.getByText(/Ask an administrator/i)).toBeTruthy()
   })
 
+  it('keeps a repo and token typed before the check response lands (#929)', async () => {
+    let release: () => void = () => {}
+    checkGate = new Promise((resolve) => {
+      release = resolve
+    })
+    checkData = upToDate({ githubRepo: 'saved/repo' })
+    render(<UpdatesTab role="ADMIN" />)
+
+    const repo = screen.getByLabelText('Repository') as HTMLInputElement
+    const token = screen.getByLabelText(/GitHub token/i) as HTMLInputElement
+    fireEvent.change(repo, { target: { value: 'typed/repo' } })
+    fireEvent.change(token, { target: { value: 'ghp_secret' } })
+
+    release()
+    await screen.findByText("You're up to date!")
+    expect(repo.value).toBe('typed/repo')
+    expect(token.value).toBe('ghp_secret')
+  })
+
+  it('fills the repository from the check when the form is untouched', async () => {
+    checkData = upToDate({ githubRepo: 'saved/repo' })
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText("You're up to date!")
+    expect((screen.getByLabelText('Repository') as HTMLInputElement).value).toBe('saved/repo')
+  })
+
+  it('does not clear edits when Check for Updates is clicked again', async () => {
+    checkData = upToDate({ githubRepo: 'saved/repo' })
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText("You're up to date!")
+
+    const repo = screen.getByLabelText('Repository') as HTMLInputElement
+    fireEvent.change(repo, { target: { value: 'typed/repo' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Check for Updates' }))
+    await waitFor(() => expect(cmsApi.mock.calls.length).toBeGreaterThan(1))
+    expect(repo.value).toBe('typed/repo')
+  })
+
   it('enables Save when the repo changes and persists via PUT /updates/config', async () => {
     render(<UpdatesTab role="ADMIN" />)
-    await screen.findByText('GitHub Integration')
+    // The GitHub card renders optimistically for admins before /updates/check
+    // resolves, and that response resets the form — wait for the check to land
+    // before typing so the typed value cannot be wiped mid-test.
+    await screen.findByText("You're up to date!")
 
     const save = screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement
     expect(save.disabled).toBe(true)
@@ -133,7 +180,8 @@ describe('UpdatesTab', () => {
 
   it('blocks Save on an invalid repository format', async () => {
     render(<UpdatesTab role="ADMIN" />)
-    await screen.findByText('GitHub Integration')
+    // See above: wait for the check response, not the optimistic card heading.
+    await screen.findByText("You're up to date!")
 
     const repo = screen.getByLabelText('Repository') as HTMLInputElement
     fireEvent.change(repo, { target: { value: 'not a repo' } })

package/src/views/page-editor/sections/ArticleBodySection.tsx

@@ -1,3 +1,5 @@
+import { sanitizeHtml } from '@prenta/core/sanitize'
+
 import type { PageSection } from '../../../lib/page-editor-service.js'
 import { bool, str, type PostRenderContext } from './parts.js'
 
@@ -6,10 +8,9 @@ import { bool, str, type PostRenderContext } from './parts.js'
  * post's own Body field (passed via context); otherwise it renders the
  * section's own `body` copy.
  *
- * The Body field is a `richText` field (sanitized HTML on write), so this
- * canvas preview renders it as HTML — exactly like the public site's
- * article-body renderer — to stay WYSIWYG. It previews the author's own
- * in-progress draft; the server sanitizes (sanitize-html) on save.
+ * The canvas previews the author's in-progress draft, which has not been
+ * through the write-time sanitizer yet. Strip disallowed tags here with the
+ * cms-core allow-list before injecting HTML.
  */
 export function ArticleBodySection({
   section,
@@ -20,7 +21,8 @@ export function ArticleBodySection({
 }) {
   const c = section.content
   const source = str(c, 'source', 'field')
-  const html = source === 'field' ? (context?.body ?? '') : str(c, 'body')
+  const rawHtml = source === 'field' ? (context?.body ?? '') : str(c, 'body')
+  const html = sanitizeHtml(rawHtml)
   const wide = str(c, 'width', 'normal') === 'wide'
   const showToc = bool(c, 'showToc')
 

package/src/views/page-editor/sections/admin-renderers.tsx

@@ -32,6 +32,7 @@
  * renderer falls back to the built-in for that type, or to the placeholder if
  * the type has no built-in, instead of taking down the editor.
  */
+import { sanitizeHtml } from '@prenta/core/sanitize'
 import { createContext, useContext, type ReactNode } from 'react'
 
 /** Structural mirror of `RenderImageProps` from `@prenta/sections-react`. */
@@ -109,13 +110,12 @@ export type AdminSectionRenderer = (props: AdminSectionRendererProps) => ReactNo
 export type AdminSectionRendererMap = Record<string, AdminSectionRenderer>
 
 /**
- * Render options passed to every admin renderer. Rich text is sanitized on
- * write by cms-core, so the canvas (same trust domain as the public default)
- * uses the identity sanitizer; images render as plain lazy `<img>` since the
- * editor canvas has no next/image pipeline.
+ * Render options passed to every admin renderer. Draft HTML is sanitized
+ * with the cms-core allow-list before any renderer injects it. Images render
+ * as plain lazy `<img>` since the editor canvas has no next/image pipeline.
  */
 export const ADMIN_RENDER_OPTIONS: AdminSectionRendererProps['options'] = {
-  sanitizeHtml: (html) => html,
+  sanitizeHtml,
   baseUrl: '',
   // Never grants the priority slot. On a public page exactly one image may
   // load eagerly; in the canvas nothing competes for bandwidth and every