@underverse-ui/underverse 1.0.184 → 1.0.185

package/dist/index.js

@@ -891,6 +891,11 @@ var en_default = {
       borderColor: "Border Color",
       clearBorder: "Clear Border",
       formula: "Formula",
+      formulaBar: "Formula bar",
+      formulaError: "Formula error",
+      editFormula: "Edit formula",
+      clearCell: "Clear cell",
+      convertToValue: "Convert to value",
       numberFormat: "Number Format",
       formatText: "Text",
       formatDate: "Date",
@@ -1313,6 +1318,11 @@ var vi_default = {
       borderColor: "M\xE0u vi\u1EC1n",
       clearBorder: "X\xF3a vi\u1EC1n",
       formula: "C\xF4ng th\u1EE9c",
+      formulaBar: "Thanh c\xF4ng th\u1EE9c",
+      formulaError: "L\u1ED7i c\xF4ng th\u1EE9c",
+      editFormula: "S\u1EEDa c\xF4ng th\u1EE9c",
+      clearCell: "X\xF3a n\u1ED9i dung \xF4",
+      convertToValue: "Chuy\u1EC3n th\xE0nh gi\xE1 tr\u1ECB",
       numberFormat: "\u0110\u1ECBnh d\u1EA1ng s\u1ED1",
       formatText: "Ch\u1EEF",
       formatDate: "Ng\xE0y",
@@ -1735,6 +1745,11 @@ var ko_default = {
       borderColor: "\uD14C\uB450\uB9AC \uC0C9\uC0C1",
       clearBorder: "\uD14C\uB450\uB9AC \uC9C0\uC6B0\uAE30",
       formula: "\uC218\uC2DD",
+      formulaBar: "\uC218\uC2DD \uC785\uB825\uC904",
+      formulaError: "\uC218\uC2DD \uC624\uB958",
+      editFormula: "\uC218\uC2DD \uD3B8\uC9D1",
+      clearCell: "\uC140 \uB0B4\uC6A9 \uC0AD\uC81C",
+      convertToValue: "\uAC12\uC73C\uB85C \uBCC0\uD658",
       numberFormat: "\uD45C\uC2DC \uD615\uC2DD",
       formatText: "\uD14D\uC2A4\uD2B8",
       formatDate: "\uB0A0\uC9DC",
@@ -2157,6 +2172,11 @@ var ja_default = {
       borderColor: "\u67A0\u7DDA\u306E\u8272",
       clearBorder: "\u67A0\u7DDA\u3092\u30AF\u30EA\u30A2",
       formula: "\u6570\u5F0F",
+      formulaBar: "\u6570\u5F0F\u30D0\u30FC",
+      formulaError: "\u6570\u5F0F\u30A8\u30E9\u30FC",
+      editFormula: "\u6570\u5F0F\u3092\u7DE8\u96C6",
+      clearCell: "\u30BB\u30EB\u3092\u30AF\u30EA\u30A2",
+      convertToValue: "\u5024\u306B\u5909\u63DB",
       numberFormat: "\u8868\u793A\u5F62\u5F0F",
       formatText: "\u30C6\u30AD\u30B9\u30C8",
       formatDate: "\u65E5\u4ED8",
@@ -27369,7 +27389,7 @@ function useLocale2() {
 }
 
 // src/components/UEditor/UEditor.tsx
-import React87, { useEffect as useEffect40, useImperativeHandle as useImperativeHandle4, useMemo as useMemo27, useRef as useRef39 } from "react";
+import React88, { useEffect as useEffect41, useImperativeHandle as useImperativeHandle4, useMemo as useMemo27, useRef as useRef40 } from "react";
 import { useEditor, EditorContent } from "@tiptap/react";
 
 // src/components/UEditor/extensions.ts
@@ -27532,6 +27552,54 @@ import { ReactNodeViewRenderer as ReactNodeViewRenderer2 } from "@tiptap/react";
 import React72, { useEffect as useEffect32, useState as useState44 } from "react";
 import { NodeViewWrapper as NodeViewWrapper2 } from "@tiptap/react";
 import { AlertCircle as AlertCircle4, ExternalLink as ExternalLink2, Globe as Globe2, RefreshCw } from "lucide-react";
+
+// src/components/UEditor/url-safety.ts
+var LINK_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var IMAGE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var FILE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "blob:"]);
+function normalizeUrlInput(raw) {
+  return raw.trim().replace(/[\u0000-\u001F\u007F\s]+/g, "");
+}
+function isProtocolRelativeUrl(value) {
+  return value.startsWith("//");
+}
+function isRelativeUrl(value) {
+  return value.startsWith("/") || value.startsWith("./") || value.startsWith("../") || value.startsWith("#");
+}
+function isDataImageUrl(value) {
+  return /^data:image\/(?:png|jpe?g|gif|webp|svg\+xml|bmp|x-icon|avif);base64,/i.test(value);
+}
+function isDataFileUrl(value) {
+  return /^data:[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*(?:;[a-z0-9!#$&^_.+-]+=[^;,]*)*;base64,[a-z0-9+/]*={0,2}$/i.test(value);
+}
+function isSafeUEditorUrl(raw, kind) {
+  const value = normalizeUrlInput(raw);
+  if (!value) return false;
+  if (kind === "image" && isDataImageUrl(value)) return true;
+  if (kind === "file" && isDataFileUrl(value)) return true;
+  if (isProtocolRelativeUrl(value)) return false;
+  if (isRelativeUrl(value)) return true;
+  try {
+    const parsed = new URL(value);
+    if (kind === "image") return IMAGE_PROTOCOLS.has(parsed.protocol);
+    if (kind === "file") return FILE_PROTOCOLS.has(parsed.protocol);
+    return LINK_PROTOCOLS.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+function sanitizeUEditorUrl(raw, kind) {
+  const value = raw.trim();
+  if (!value) return "";
+  if (isSafeUEditorUrl(value, kind)) return normalizeUrlInput(value);
+  if (kind === "link" && !isProtocolRelativeUrl(value) && !/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(value)) {
+    const withProtocol = `https://${value}`;
+    return isSafeUEditorUrl(withProtocol, kind) ? withProtocol : "";
+  }
+  return "";
+}
+
+// src/components/UEditor/BookmarkView.tsx
 import { jsx as jsx80, jsxs as jsxs65 } from "react/jsx-runtime";
 var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
   const t = useSmartTranslations("UEditor");
@@ -27539,17 +27607,25 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
   const [loading2, setLoading] = useState44(false);
   const [error, setError] = useState44(false);
   const [retryToken, setRetryToken] = useState44(0);
-  const fetchedRetryTokenRef = React72.useRef(-1);
+  const lastFetchKeyRef = React72.useRef("");
   const fetchRequestIdRef = React72.useRef(0);
+  const safeUrl = sanitizeUEditorUrl(String(url ?? ""), "link");
+  const safeImage = sanitizeUEditorUrl(String(image ?? ""), "image");
+  const clickToOpenNewTabMessage = t("bookmark.clickToOpenNewTab");
+  const clickToOpenLinkMessage = t("bookmark.clickToOpenLink");
+  const noDescriptionMessage = t("bookmark.noDescription");
   useEffect32(() => {
     if (title && retryToken === 0) return;
-    if (fetchedRetryTokenRef.current === retryToken) return;
-    fetchedRetryTokenRef.current = retryToken;
+    if (!safeUrl) return;
+    const fetchKey = `${safeUrl}\0${retryToken}`;
+    if (lastFetchKeyRef.current === fetchKey) return;
+    lastFetchKeyRef.current = fetchKey;
     const requestId = fetchRequestIdRef.current + 1;
     fetchRequestIdRef.current = requestId;
+    let active = true;
     const safeUpdateAttributes = (attrs) => {
       Promise.resolve().then(() => {
-        if (fetchRequestIdRef.current === requestId && editor && !editor.isDestroyed) {
+        if (active && fetchRequestIdRef.current === requestId && editor && !editor.isDestroyed) {
           updateAttributes(attrs);
         }
       });
@@ -27558,43 +27634,75 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
     const fetchMetadata = extension?.options?.fetchMetadata;
     if (!fetchMetadata) {
       try {
-        const hostname = new URL(url).hostname;
+        const hostname = new URL(safeUrl).hostname;
         safeUpdateAttributes({
-          title: hostname || url,
-          description: t("bookmark.clickToOpenNewTab"),
+          title: hostname || safeUrl,
+          description: clickToOpenNewTabMessage,
           publisher: hostname
         });
       } catch {
         safeUpdateAttributes({
-          title: url,
-          description: t("bookmark.clickToOpenLink"),
+          title: safeUrl,
+          description: clickToOpenLinkMessage,
           publisher: ""
         });
       }
-      return;
+      return () => {
+        active = false;
+      };
     }
-    setLoading(true);
-    setError(false);
-    fetchMetadata(url).then((meta) => {
-      if (fetchRequestIdRef.current !== requestId) return;
+    queueMicrotask(() => {
+      if (!active) return;
+      setLoading(true);
+      setError(false);
+    });
+    fetchMetadata(safeUrl).then((meta) => {
+      if (!active || fetchRequestIdRef.current !== requestId) return;
+      const hostname = (() => {
+        try {
+          return new URL(safeUrl).hostname;
+        } catch {
+          return "";
+        }
+      })();
       safeUpdateAttributes({
-        title: meta.title || new URL(url).hostname || url,
-        description: meta.description || t("bookmark.noDescription"),
-        image: meta.image || "",
-        publisher: meta.publisher || new URL(url).hostname || ""
+        title: meta.title || hostname || safeUrl,
+        description: meta.description || noDescriptionMessage,
+        image: meta.image ? sanitizeUEditorUrl(meta.image, "image") : "",
+        publisher: meta.publisher || hostname
       });
       setLoading(false);
     }).catch(() => {
-      if (fetchRequestIdRef.current !== requestId) return;
+      if (!active || fetchRequestIdRef.current !== requestId) return;
       setError(true);
       setLoading(false);
     });
-    return void 0;
-  }, [url, title, editor, updateAttributes, t, retryToken]);
-  const handleOpenLink = (e) => {
-    e.preventDefault();
-    e.stopPropagation();
-    window.open(url, "_blank", "noopener,noreferrer");
+    return () => {
+      active = false;
+    };
+  }, [
+    safeUrl,
+    title,
+    editor,
+    updateAttributes,
+    retryToken,
+    clickToOpenNewTabMessage,
+    clickToOpenLinkMessage,
+    noDescriptionMessage
+  ]);
+  const openLink = () => {
+    if (safeUrl) window.open(safeUrl, "_blank", "noopener,noreferrer");
+  };
+  const handleOpenLink = (event) => {
+    event.preventDefault();
+    event.stopPropagation();
+    openLink();
+  };
+  const handleKeyDown2 = (event) => {
+    if (event.key !== "Enter") return;
+    event.preventDefault();
+    event.stopPropagation();
+    openLink();
   };
   const handleRetryPreview = (event) => {
     event.preventDefault();
@@ -27603,7 +27711,7 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
   };
   const displayPublisher = publisher || (() => {
     try {
-      return new URL(url).hostname;
+      return safeUrl ? new URL(safeUrl).hostname : "";
     } catch {
       return "";
     }
@@ -27616,6 +27724,10 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
         selected && "ring-2 ring-primary/45 border-primary/20 shadow-sm"
       ),
       onClick: handleOpenLink,
+      onKeyDown: handleKeyDown2,
+      role: "link",
+      tabIndex: safeUrl ? 0 : -1,
+      "aria-disabled": !safeUrl,
       children: loading2 ? /* @__PURE__ */ jsxs65("div", { className: "flex items-center justify-between p-4 gap-4 animate-pulse", children: [
         /* @__PURE__ */ jsxs65("div", { className: "flex-1 flex flex-col gap-2", children: [
           /* @__PURE__ */ jsx80("div", { className: "h-4 w-1/3 bg-muted-foreground/20 rounded" }),
@@ -27630,11 +27742,11 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
               /* @__PURE__ */ jsx80(Globe2, { className: "h-3 w-3 flex-shrink-0" }),
               displayPublisher
             ] }),
-            /* @__PURE__ */ jsx80("h4", { className: "text-sm font-semibold text-foreground line-clamp-1 break-all", children: title || url }),
+            /* @__PURE__ */ jsx80("h4", { className: "text-sm font-semibold text-foreground line-clamp-1 break-all", children: title || safeUrl || String(url ?? "") }),
             /* @__PURE__ */ jsx80("p", { className: "text-xs text-muted-foreground line-clamp-2 leading-relaxed", children: description })
           ] }),
           /* @__PURE__ */ jsxs65("span", { className: "text-[11px] text-primary/80 font-mono mt-2 truncate flex items-center gap-1", children: [
-            url,
+            safeUrl || String(url ?? ""),
             /* @__PURE__ */ jsx80(ExternalLink2, { className: "h-3 w-3 flex-shrink-0" })
           ] }),
           error && /* @__PURE__ */ jsxs65("div", { className: "mt-2 flex flex-wrap items-center gap-2 text-xs text-destructive", children: [
@@ -27656,10 +27768,10 @@ var BookmarkView = ({ node, updateAttributes, selected, editor }) => {
             )
           ] })
         ] }),
-        image && /* @__PURE__ */ jsx80("div", { className: "relative w-full sm:w-44 h-32 sm:h-auto flex-shrink-0 bg-muted overflow-hidden border-t sm:border-t-0 sm:border-l border-border/50", children: /* @__PURE__ */ jsx80(
+        safeImage && /* @__PURE__ */ jsx80("div", { className: "relative w-full sm:w-44 h-32 sm:h-auto flex-shrink-0 bg-muted overflow-hidden border-t sm:border-t-0 sm:border-l border-border/50", children: /* @__PURE__ */ jsx80(
           "img",
           {
-            src: image,
+            src: safeImage,
             alt: title || "Link preview image",
             className: "absolute inset-0 w-full h-full object-cover transition-opacity duration-300",
             onError: (e) => {
@@ -27689,11 +27801,11 @@ var Bookmark = Node3.create({
     return {
       url: {
         default: "",
-        parseHTML: (element) => element.getAttribute("href") || element.getAttribute("data-url") || "",
-        renderHTML: (attributes) => ({
-          href: attributes.url,
-          "data-url": attributes.url
-        })
+        parseHTML: (element) => sanitizeUEditorUrl(element.getAttribute("href") || element.getAttribute("data-url") || "", "link"),
+        renderHTML: (attributes) => {
+          const url = sanitizeUEditorUrl(String(attributes.url ?? ""), "link");
+          return url ? { href: url, "data-url": url } : {};
+        }
       },
       title: {
         default: "",
@@ -27711,10 +27823,11 @@ var Bookmark = Node3.create({
       },
       image: {
         default: "",
-        parseHTML: (element) => element.getAttribute("data-image") || "",
-        renderHTML: (attributes) => ({
-          "data-image": attributes.image
-        })
+        parseHTML: (element) => sanitizeUEditorUrl(element.getAttribute("data-image") || "", "image"),
+        renderHTML: (attributes) => {
+          const image = sanitizeUEditorUrl(String(attributes.image ?? ""), "image");
+          return image ? { "data-image": image } : {};
+        }
       },
       publisher: {
         default: "",
@@ -27747,9 +27860,12 @@ var Bookmark = Node3.create({
   addCommands() {
     return {
       setBookmark: (attributes) => ({ commands }) => {
+        const url = sanitizeUEditorUrl(attributes.url, "link");
+        if (!url) return false;
+        const image = attributes.image ? sanitizeUEditorUrl(attributes.image, "image") : "";
         return commands.insertContent({
           type: this.name,
-          attrs: attributes
+          attrs: { ...attributes, url, image }
         });
       }
     };
@@ -27766,7 +27882,6 @@ var Bookmark = Node3.create({
             if (!text || !URL_REGEX.test(text)) return false;
             const { selection } = view.state;
             const parent = selection.$from.parent;
-            console.log("DEBUG handlePaste name:", parent.type.name, "size:", parent.content.size);
             const isEmptyParagraph = parent.type.name === "paragraph" && parent.content.size === 0;
             if (isEmptyParagraph) {
               event.preventDefault();
@@ -27794,15 +27909,15 @@ import { NodeViewWrapper as NodeViewWrapper3 } from "@tiptap/react";
 import { Download as Download2, File as LucideFile, FileText as FileText2, Image as Image3, Music, RefreshCw as RefreshCw2, Video } from "lucide-react";
 import { jsx as jsx81, jsxs as jsxs66 } from "react/jsx-runtime";
 function formatBytes(bytes, decimals = 1) {
-  if (!bytes || bytes <= 0) return "0 Bytes";
+  if (!Number.isFinite(bytes) || bytes <= 0) return "0 Bytes";
   const k = 1024;
   const dm = decimals < 0 ? 0 : decimals;
-  const sizes = ["Bytes", "KB", "MB", "GB"];
-  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  const sizes = ["Bytes", "KB", "MB", "GB", "TB", "PB"];
+  const i = Math.min(Math.floor(Math.log(bytes) / Math.log(k)), sizes.length - 1);
   return `${parseFloat((bytes / Math.pow(k, i)).toFixed(dm))} ${sizes[i]}`;
 }
 function getFileIcon2(type) {
-  const mime = (type || "").toLowerCase();
+  const mime = String(type || "").toLowerCase();
   if (mime.includes("pdf")) return FileText2;
   if (mime.startsWith("image/")) return Image3;
   if (mime.startsWith("audio/")) return Music;
@@ -27828,11 +27943,13 @@ function dataURLtoFile(dataurl, filename, mimeType) {
       }
     }
     return new File([bytes], filename, { type: mime });
-  } catch (e) {
-    console.error("Error converting data URI to file:", e);
+  } catch {
     return null;
   }
 }
+function getErrorMessage(error) {
+  return error instanceof Error && error.message ? error.message : "Upload failed";
+}
 var FileCardView = ({ node, selected, editor, updateAttributes }) => {
   const t = useSmartTranslations("UEditor");
   const { src, fileName, fileSize, fileType } = node.attrs;
@@ -27840,49 +27957,64 @@ var FileCardView = ({ node, selected, editor, updateAttributes }) => {
   const [uploadError, setUploadError] = useState45(null);
   const [retryToken, setRetryToken] = useState45(0);
   const uploadAttemptedRef = useRef28(false);
+  const lastUploadSrcRef = useRef28("");
+  const uploadRequestIdRef = useRef28(0);
+  const safeSrc = sanitizeUEditorUrl(String(src ?? ""), "file");
+  const extension = editor?.extensionManager?.extensions?.find((item) => item.name === "fileCard");
+  const uploadFn = extension?.options?.upload;
   useEffect33(() => {
-    if (!src || !src.startsWith("data:")) {
+    if (lastUploadSrcRef.current !== safeSrc) {
+      lastUploadSrcRef.current = safeSrc;
+      uploadAttemptedRef.current = false;
+    }
+    if (!safeSrc || !safeSrc.startsWith("data:") || !uploadFn) {
       return;
     }
-    const extension = editor?.extensionManager?.extensions?.find((e) => e.name === "fileCard");
-    const uploadFn = extension?.options?.upload;
-    if (!uploadFn || uploadAttemptedRef.current || !updateAttributes) {
+    if (uploadAttemptedRef.current || !updateAttributes) {
       return;
     }
     uploadAttemptedRef.current = true;
     setUploadError(null);
+    const requestId = uploadRequestIdRef.current + 1;
+    uploadRequestIdRef.current = requestId;
+    let active = true;
     const runUpload = async () => {
       try {
-        const file = dataURLtoFile(src, fileName || "file", fileType);
+        const file = dataURLtoFile(safeSrc, fileName || "file", fileType);
         if (!file) {
           throw new Error("Failed to parse file data");
         }
         const resolvedUrl = await uploadFn(file);
+        const nextSrc = sanitizeUEditorUrl(String(resolvedUrl ?? ""), "file");
+        if (!nextSrc) throw new Error("Upload handler returned an unsafe URL");
         Promise.resolve().then(() => {
-          if (editor && !editor.isDestroyed) {
-            updateAttributes({ src: resolvedUrl });
+          if (active && uploadRequestIdRef.current === requestId && editor && !editor.isDestroyed) {
+            updateAttributes({ src: nextSrc });
           }
         });
-      } catch (err) {
-        console.error("File upload failed:", err);
-        setUploadError(err?.message || "Upload failed");
+      } catch (error) {
+        if (!active || uploadRequestIdRef.current !== requestId) return;
+        setUploadError(getErrorMessage(error));
         uploadAttemptedRef.current = false;
       }
     };
     void runUpload();
-  }, [src, fileName, fileType, editor, updateAttributes, retryToken]);
+    return () => {
+      active = false;
+    };
+  }, [safeSrc, fileName, fileType, editor, updateAttributes, uploadFn, retryToken]);
   const handleDownload = (e) => {
     e.preventDefault();
     e.stopPropagation();
-    if (!src) return;
+    if (!safeSrc) return;
     const link = document.createElement("a");
-    link.href = src;
+    link.href = safeSrc;
     link.download = fileName || "download";
     document.body.appendChild(link);
     link.click();
     document.body.removeChild(link);
   };
-  const isUploading = (src || "").startsWith("data:");
+  const hasInlineUpload = safeSrc.startsWith("data:") && Boolean(uploadFn);
   const handleRetryUpload = (event) => {
     event.preventDefault();
     event.stopPropagation();
@@ -27905,11 +28037,11 @@ var FileCardView = ({ node, selected, editor, updateAttributes }) => {
             /* @__PURE__ */ jsx81("div", { className: "text-sm font-semibold text-foreground truncate break-all", children: fileName || t("fileCard.unnamed") }),
             /* @__PURE__ */ jsxs66("div", { className: "text-xs text-muted-foreground flex items-center gap-2 mt-0.5", children: [
               fileSize ? /* @__PURE__ */ jsx81("span", { children: formatBytes(fileSize) }) : null,
-              isUploading && /* @__PURE__ */ jsx81("span", { className: cn(
+              hasInlineUpload && /* @__PURE__ */ jsx81("span", { className: cn(
                 "font-medium truncate max-w-50",
                 uploadError ? "text-destructive" : "text-primary animate-pulse"
               ), children: uploadError ? `${t("fileCard.uploadFailed") || "T\u1EA3i l\xEAn th\u1EA5t b\u1EA1i"}: ${uploadError}` : t("fileCard.uploading") }),
-              isUploading && uploadError && /* @__PURE__ */ jsxs66(
+              hasInlineUpload && uploadError && /* @__PURE__ */ jsxs66(
                 "button",
                 {
                   type: "button",
@@ -27924,7 +28056,7 @@ var FileCardView = ({ node, selected, editor, updateAttributes }) => {
             ] })
           ] })
         ] }),
-        src && /* @__PURE__ */ jsx81(
+        safeSrc && /* @__PURE__ */ jsx81(
           "button",
           {
             type: "button",
@@ -27953,11 +28085,11 @@ var FileCard = Node4.create({
     return {
       src: {
         default: "",
-        parseHTML: (element) => element.getAttribute("href") || element.getAttribute("data-src") || "",
-        renderHTML: (attributes) => ({
-          href: attributes.src,
-          "data-src": attributes.src
-        })
+        parseHTML: (element) => sanitizeUEditorUrl(element.getAttribute("href") || element.getAttribute("data-src") || "", "file"),
+        renderHTML: (attributes) => {
+          const src = sanitizeUEditorUrl(String(attributes.src ?? ""), "file");
+          return src ? { href: src, "data-src": src } : {};
+        }
       },
       fileName: {
         default: "",
@@ -27969,13 +28101,15 @@ var FileCard = Node4.create({
       fileSize: {
         default: null,
         parseHTML: (element) => {
-          const val = element.getAttribute("data-file-size");
-          return val ? Number(val) : null;
+          const rawValue = element.getAttribute("data-file-size");
+          const value = rawValue ? Number(rawValue) : Number.NaN;
+          return Number.isFinite(value) && value >= 0 ? value : null;
         },
         renderHTML: (attributes) => {
-          if (attributes.fileSize === null || attributes.fileSize === void 0) return {};
+          const fileSize = Number(attributes.fileSize);
+          if (!Number.isFinite(fileSize) || fileSize < 0) return {};
           return {
-            "data-file-size": attributes.fileSize
+            "data-file-size": fileSize
           };
         }
       },
@@ -28010,9 +28144,16 @@ var FileCard = Node4.create({
   addCommands() {
     return {
       setFileCard: (attributes) => ({ commands }) => {
+        const src = sanitizeUEditorUrl(attributes.src, "file");
+        if (!src) return false;
+        const fileSize = Number(attributes.fileSize);
         return commands.insertContent({
           type: this.name,
-          attrs: attributes
+          attrs: {
+            ...attributes,
+            src,
+            fileSize: Number.isFinite(fileSize) && fileSize >= 0 ? fileSize : null
+          }
         });
       }
     };
@@ -28443,6 +28584,10 @@ function destroyTippyInstance(instance) {
   if (!instance || instance.state.isDestroyed) return;
   instance.destroy();
 }
+function setTippyReferenceClientRect(instance, clientRect) {
+  if (!instance || instance.state.isDestroyed) return;
+  instance.setProps({ getReferenceClientRect: clientRect });
+}
 
 // src/components/UEditor/slash-command.tsx
 import { jsx as jsx84, jsxs as jsxs68 } from "react/jsx-runtime";
@@ -28815,9 +28960,7 @@ var SlashCommand = Extension.create({
               if (!props.clientRect) {
                 return;
               }
-              popup?.[0]?.setProps({
-                getReferenceClientRect: props.clientRect
-              });
+              setTippyReferenceClientRect(getFirstTippyInstance(popup), props.clientRect);
             },
             onKeyDown(props) {
               if (!props || !props.event) return false;
@@ -29554,45 +29697,6 @@ function getClipboardTsvTableContent(dataTransfer) {
   );
 }
 
-// src/components/UEditor/url-safety.ts
-var LINK_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
-var IMAGE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
-function normalizeUrlInput(raw) {
-  return raw.trim().replace(/[\u0000-\u001F\u007F\s]+/g, "");
-}
-function isProtocolRelativeUrl(value) {
-  return value.startsWith("//");
-}
-function isRelativeUrl(value) {
-  return value.startsWith("/") || value.startsWith("./") || value.startsWith("../") || value.startsWith("#");
-}
-function isDataImageUrl(value) {
-  return /^data:image\/(?:png|jpe?g|gif|webp|svg\+xml|bmp|x-icon|avif);base64,/i.test(value);
-}
-function isSafeUEditorUrl(raw, kind) {
-  const value = normalizeUrlInput(raw);
-  if (!value) return false;
-  if (kind === "image" && isDataImageUrl(value)) return true;
-  if (isRelativeUrl(value)) return true;
-  if (isProtocolRelativeUrl(value)) return false;
-  try {
-    const parsed = new URL(value);
-    return kind === "image" ? IMAGE_PROTOCOLS.has(parsed.protocol) : LINK_PROTOCOLS.has(parsed.protocol);
-  } catch {
-    return false;
-  }
-}
-function sanitizeUEditorUrl(raw, kind) {
-  const value = raw.trim();
-  if (!value) return "";
-  if (isSafeUEditorUrl(value, kind)) return normalizeUrlInput(value);
-  if (kind === "link" && !isProtocolRelativeUrl(value) && !/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(value)) {
-    const withProtocol = `https://${value}`;
-    return isSafeUEditorUrl(withProtocol, kind) ? withProtocol : "";
-  }
-  return "";
-}
-
 // src/components/UEditor/clipboard-images.ts
 var DEFAULT_UEDITOR_IMAGE_MAX_FILE_SIZE = 10 * 1024 * 1024;
 var DEFAULT_UEDITOR_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml"];
@@ -29834,9 +29938,7 @@ var EmojiSuggestion = Extension3.create({
               if (!props.clientRect) {
                 return;
               }
-              popup?.[0]?.setProps({
-                getReferenceClientRect: props.clientRect
-              });
+              setTippyReferenceClientRect(getFirstTippyInstance(popup), props.clientRect);
             },
             onKeyDown(props) {
               if (!props || !props.event) return false;
@@ -29933,7 +30035,7 @@ var FormulaSuggestionList = forwardRef16((props, ref) => {
         setSelectedIndex((prev) => (prev + 1) % props.items.length);
         return true;
       }
-      if (event.key === "Enter" || event.key === "Tab") {
+      if (event.key === "Tab") {
         const item = props.items[selectedIndex];
         if (item) {
           props.command(item);
@@ -30023,9 +30125,7 @@ var FormulaSuggestion = Extension4.create({
               if (!props.clientRect) {
                 return;
               }
-              popup?.[0]?.setProps({
-                getReferenceClientRect: props.clientRect
-              });
+              setTippyReferenceClientRect(getFirstTippyInstance(popup), props.clientRect);
             },
             onKeyDown(props) {
               const popupInstance = getFirstTippyInstance(popup);
@@ -31776,7 +31876,6 @@ function buildUEditorExtensions({
     Gapcursor,
     Link.configure({
       openOnClick: false,
-      protocols: ["http", "https", "mailto", "tel"],
       isAllowedUri: (url) => isSafeUEditorUrl(url ?? "", "link"),
       HTMLAttributes: {
         class: "text-primary underline underline-offset-2 hover:text-primary/80 cursor-pointer"
@@ -32868,7 +32967,7 @@ var EditorToolbar = ({
   const [showImageInput, setShowImageInput] = useState49(false);
   const [showLinkInput, setShowLinkInput] = useState49(false);
   const [isTableMenuOpen, setIsTableMenuOpen] = useState49(false);
-  const tableCommandAnchorPosRef = useRef33(null);
+  const [preservedTableAnchorPos, setPreservedTableAnchorPos] = useState49(null);
   const fileInputRef = useRef33(null);
   const [isUploadingImage, setIsUploadingImage] = useState49(false);
   const [imageUploadError, setImageUploadError] = useState49(null);
@@ -32883,7 +32982,7 @@ var EditorToolbar = ({
   const tableAlignAttr = tableAttrs.tableAlign ?? tableAttrs.textAlign;
   const currentTableAlign = tableAlignAttr === "center" || tableAlignAttr === "right" ? tableAlignAttr : "left";
   const isTableSelected = tableInfo !== null;
-  const hasTableContext = isTableSelected || tableCommandAnchorPosRef.current !== null;
+  const hasTableContext = isTableSelected || preservedTableAnchorPos !== null;
   const canMergeCells = hasTableContext && editor.can().mergeCells();
   const canSplitCell = hasTableContext && editor.can().splitCell();
   const currentCellVerticalAlign = normalizeStyleValue(editor.getAttributes("tableCell").verticalAlign || editor.getAttributes("tableHeader").verticalAlign) || "";
@@ -32908,7 +33007,7 @@ var EditorToolbar = ({
   const displayedFontFamilyValue = currentFontFamily || defaultFontFamilyValue;
   const displayedFontSizeLabel = currentFontSize ? currentFontSizeLabel : "13";
   const activeFontSize = currentFontSize || "13px";
-  const tableCommandAnchorPos = tableCommandAnchorPosRef.current ?? tableAnchorPos ?? void 0;
+  const tableCommandAnchorPos = preservedTableAnchorPos ?? tableAnchorPos ?? void 0;
   const isMedium = variant === "medium";
   const isMediumFull = variant === "medium-full";
   const isFull = variant === "default" || variant === "full" || variant === "notion" || !variant;
@@ -33584,7 +33683,7 @@ var EditorToolbar = ({
         isOpen: isTableMenuOpen,
         onOpenChange: (open) => {
           setIsTableMenuOpen(open);
-          tableCommandAnchorPosRef.current = open ? getTableAnchorPos(editor) : null;
+          setPreservedTableAnchorPos(open ? getTableAnchorPos(editor) : null);
         },
         trigger: /* @__PURE__ */ jsxs75(ToolbarButton, { onClick: () => {
         }, title: t("toolbar.table"), children: [
@@ -33601,6 +33700,7 @@ var EditorToolbar = ({
               onInsert: (rows, cols) => {
                 editor.chain().focus().insertTable({ rows, cols, withHeaderRow: true }).run();
                 setIsTableMenuOpen(false);
+                setPreservedTableAnchorPos(null);
               }
             }
           ),
@@ -33816,6 +33916,7 @@ import {
 } from "lucide-react";
 
 // src/components/UEditor/table-formula-commands.ts
+import { TextSelection as TextSelection3 } from "@tiptap/pm/state";
 import { selectedRect as selectedRect2, setCellAttr as setCellAttr2, TableMap as TableMap3 } from "@tiptap/pm/tables";
 
 // src/components/UEditor/table-formula.ts
@@ -34379,6 +34480,75 @@ function getSelectionTableCellNode(editor) {
   }
   return null;
 }
+function getSelectionTableCellPos(editor) {
+  const cellSelection = editor.state.selection;
+  const anchorCellPos = cellSelection.$anchorCell?.pos;
+  if (typeof anchorCellPos === "number") {
+    const node = editor.state.doc.nodeAt(anchorCellPos);
+    if (node?.type.name === "tableCell" || node?.type.name === "tableHeader") {
+      return anchorCellPos;
+    }
+  }
+  const { $from } = editor.state.selection;
+  for (let depth = $from.depth; depth > 0; depth -= 1) {
+    const node = $from.node(depth);
+    if (node.type.name === "tableCell" || node.type.name === "tableHeader") {
+      return $from.before(depth);
+    }
+  }
+  return null;
+}
+function getSelectionTableCellAnchor(editor) {
+  const cellPos = getSelectionTableCellPos(editor);
+  if (cellPos == null) return null;
+  const node = editor.state.doc.nodeAt(cellPos);
+  if (!node || node.type.name !== "tableCell" && node.type.name !== "tableHeader") return null;
+  const $cell = editor.state.doc.resolve(Math.min(cellPos + 1, editor.state.doc.content.size));
+  for (let depth = $cell.depth; depth > 0; depth -= 1) {
+    const tableNode = $cell.node(depth);
+    if (tableNode.type.name !== "table") continue;
+    const tableStart = $cell.start(depth);
+    const rect = safeFindCell2(TableMap3.get(tableNode), cellPos - tableStart);
+    if (!rect) return null;
+    return {
+      cellPos,
+      column: rect.left,
+      label: `${indexToColumnName(rect.left)}${rect.top + 1}`,
+      node,
+      row: rect.top,
+      tablePos: tableStart - 1
+    };
+  }
+  return null;
+}
+function restoreSelectionAtTableCell(editor, anchor) {
+  const tableNode = editor.state.doc.nodeAt(anchor.tablePos);
+  if (!tableNode || tableNode.type.name !== "table") return false;
+  const map = TableMap3.get(tableNode);
+  if (anchor.row >= map.height || anchor.column >= map.width) return false;
+  const relativeCellPos = map.positionAt(anchor.row, anchor.column, tableNode);
+  const cellPos = anchor.tablePos + 1 + relativeCellPos;
+  const cellNode = editor.state.doc.nodeAt(cellPos);
+  if (!cellNode || cellNode.type.name !== "tableCell" && cellNode.type.name !== "tableHeader") return false;
+  const selectionPos = Math.min(cellPos + 2, editor.state.doc.content.size);
+  editor.view.dispatch(
+    editor.state.tr.setSelection(TextSelection3.near(editor.state.doc.resolve(selectionPos))).setMeta("addToHistory", false)
+  );
+  return true;
+}
+function getSelectedTableFormulaCell(editor) {
+  const selectedCell = getSelectionTableCellAnchor(editor);
+  if (!selectedCell) return null;
+  const formula = typeof selectedCell.node.attrs.formula === "string" ? selectedCell.node.attrs.formula.trim() : "";
+  if (!formula) return null;
+  const computedValue = typeof selectedCell.node.attrs.computedValue === "string" ? selectedCell.node.attrs.computedValue : "";
+  return {
+    ...selectedCell,
+    computedValue,
+    formula,
+    formulaState: computedValue.startsWith("#") ? "error" : "computed"
+  };
+}
 function getSelectionTableInfo(editor) {
   const { $from } = editor.state.selection;
   for (let depth = $from.depth; depth > 0; depth -= 1) {
@@ -34425,6 +34595,28 @@ function createCellDisplayContent(cellNode, displayValue) {
   }
   return [paragraphType.create(null, cellNode.type.schema.text(displayValue))];
 }
+function removeSelectedTableCellFormula(editor, clearContent) {
+  const selectedCell = getSelectedTableFormulaCell(editor);
+  if (!selectedCell) return false;
+  const nextCell2 = selectedCell.node.type.create(
+    {
+      ...selectedCell.node.attrs,
+      formula: null,
+      computedValue: null
+    },
+    clearContent ? createCellDisplayContent(selectedCell.node, "") : selectedCell.node.content,
+    selectedCell.node.marks
+  );
+  let transaction = editor.state.tr.replaceWith(selectedCell.cellPos, selectedCell.cellPos + selectedCell.node.nodeSize, nextCell2).setMeta(UEDITOR_TABLE_FORMULA_RECALCULATE_META, true);
+  const selectionPos = Math.min(selectedCell.cellPos + 2, transaction.doc.content.size);
+  transaction = transaction.setSelection(TextSelection3.near(transaction.doc.resolve(selectionPos)));
+  editor.view.dispatch(transaction);
+  recalculateActiveTableFormulas(editor);
+  restoreSelectionAtTableCell(editor, selectedCell);
+  editor.view.focus();
+  dispatchTableLayoutChange(editor);
+  return true;
+}
 function buildTableValueMap(tableNode) {
   const map = TableMap3.get(tableNode);
   const values = /* @__PURE__ */ new Map();
@@ -34447,21 +34639,15 @@ function normalizeFormulaInput(formula) {
 function setSelectedTableCellFormula(editor, formula) {
   const normalized = normalizeFormulaInput(formula);
   const { state, view } = editor;
+  const selectionAnchor = getSelectionTableCellAnchor(editor);
   if (!normalized) {
-    const clearedFormula = setCellAttr2("formula", null)(state, view.dispatch.bind(view));
-    const clearedValue2 = setCellAttr2("computedValue", null)(editor.state, view.dispatch.bind(view));
-    if (clearedFormula || clearedValue2) {
-      recalculateActiveTableFormulas(editor);
-      view.focus();
-      dispatchTableLayoutChange(editor);
-      return true;
-    }
-    return false;
+    return clearSelectedTableCellFormula(editor);
   }
   const appliedFormula = setCellAttr2("formula", normalized)(state, view.dispatch.bind(view));
   const clearedValue = setCellAttr2("computedValue", null)(editor.state, view.dispatch.bind(view));
   if (appliedFormula || clearedValue) {
     recalculateActiveTableFormulas(editor);
+    if (selectionAnchor) restoreSelectionAtTableCell(editor, selectionAnchor);
     view.focus();
     dispatchTableLayoutChange(editor);
     return true;
@@ -34469,7 +34655,10 @@ function setSelectedTableCellFormula(editor, formula) {
   return false;
 }
 function clearSelectedTableCellFormula(editor) {
-  return setSelectedTableCellFormula(editor, "");
+  return removeSelectedTableCellFormula(editor, true);
+}
+function convertSelectedTableCellFormulaToValue(editor) {
+  return removeSelectedTableCellFormula(editor, false);
 }
 function setSelectedTableCellNumberFormat(editor, numberFormat) {
   const value = numberFormat && numberFormat !== "text" ? numberFormat : null;
@@ -34669,6 +34858,58 @@ function recalculateAllTableFormulas(editor) {
 
 // src/components/UEditor/menus.tsx
 import { Fragment as Fragment30, jsx as jsx92, jsxs as jsxs76 } from "react/jsx-runtime";
+var FloatingSlashCommandMenu = ({ editor, onClose }) => {
+  const t = useSmartTranslations("UEditor");
+  const messages = useMemo25(() => buildSlashCommandMessages(t), [t]);
+  const items = useMemo25(() => buildSlashCommandItems({ query: "", messages }), [messages]);
+  const listRef = useRef34(null);
+  useEffect37(() => {
+    const handleKeyDown2 = (event) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        onClose();
+        return;
+      }
+      const handled = listRef.current?.onKeyDown({ event }) ?? false;
+      if (handled) {
+        event.preventDefault();
+      }
+    };
+    document.addEventListener("keydown", handleKeyDown2);
+    return () => document.removeEventListener("keydown", handleKeyDown2);
+  }, [onClose]);
+  return /* @__PURE__ */ jsx92(
+    SlashCommandList,
+    {
+      ref: listRef,
+      items,
+      messages,
+      command: (item) => {
+        item.command({ editor });
+        onClose();
+      }
+    }
+  );
+};
+var FloatingMenuContent = ({ editor }) => {
+  const t = useSmartTranslations("UEditor");
+  const [showCommands, setShowCommands] = useState50(false);
+  if (showCommands) {
+    return /* @__PURE__ */ jsx92(FloatingSlashCommandMenu, { editor, onClose: () => setShowCommands(false) });
+  }
+  return /* @__PURE__ */ jsxs76(
+    "button",
+    {
+      type: "button",
+      onClick: () => setShowCommands(true),
+      className: "flex items-center gap-1 px-2 py-1.5 rounded-lg hover:bg-accent transition-all group",
+      children: [
+        /* @__PURE__ */ jsx92(Plus3, { className: "w-4 h-4 text-muted-foreground group-hover:text-foreground" }),
+        /* @__PURE__ */ jsx92("span", { className: "text-sm text-muted-foreground group-hover:text-foreground", children: t("floatingMenu.addBlock") })
+      ]
+    }
+  );
+};
 function applyTableCellBackground(editor, color) {
   const value = color || null;
   const { state, view } = editor;
@@ -35407,7 +35648,8 @@ var LinkPreviewContent = ({ editor, onEdit }) => {
   const url = editor.getAttributes("link").href || "";
   const t = useSmartTranslations("UEditor");
   const handleOpen = () => {
-    window.open(url, "_blank", "noopener,noreferrer");
+    const safeUrl = sanitizeUEditorUrl(url, "link");
+    if (safeUrl) window.open(safeUrl, "_blank", "noopener,noreferrer");
   };
   const handleUnlink = () => {
     editor.chain().focus().unsetLink().run();
@@ -35437,16 +35679,19 @@ var CustomBubbleMenu = ({
   });
   const menuRef = useRef34(null);
   const keepOpenRef = useRef34(false);
+  const [keepOpen, setKeepOpenState] = useState50(false);
   const showTimeoutRef = useRef34(null);
   const suppressShowUntilRef = useRef34(0);
   const setKeepOpen = useCallback23((next) => {
     keepOpenRef.current = next;
+    setKeepOpenState(next);
     if (!next) setLinkInputOpen(false);
     if (next) setIsVisible(true);
   }, []);
   const closeBubbleMenu = useCallback23(() => {
     suppressShowUntilRef.current = Date.now() + 1e3;
     keepOpenRef.current = false;
+    setKeepOpenState(false);
     setLinkInputOpen(false);
     setIsVisible(false);
     if (showTimeoutRef.current) {
@@ -35552,13 +35797,13 @@ var CustomBubbleMenu = ({
         onMouseDown: (e) => {
           const target = e.target;
           if (target?.closest?.("[data-ueditor-close-on-select]")) {
-            keepOpenRef.current = false;
+            setKeepOpen(false);
           } else if (target?.closest?.("[data-ueditor-keep-open]")) {
-            keepOpenRef.current = true;
+            setKeepOpen(true);
           }
           e.preventDefault();
         },
-        children: editor.isActive("link") && !keepOpenRef.current && !linkInputOpen ? /* @__PURE__ */ jsx92(
+        children: editor.isActive("link") && !keepOpen && !linkInputOpen ? /* @__PURE__ */ jsx92(
           LinkPreviewContent,
           {
             editor,
@@ -35584,6 +35829,54 @@ var CustomBubbleMenu = ({
     document.body
   );
 };
+var CustomFloatingMenu = ({ editor }) => {
+  const FLOATING_MENU_OFFSET = 16;
+  const [isVisible, setIsVisible] = useState50(false);
+  const [position, setPosition2] = useState50({ top: 0, left: 0 });
+  useEffect37(() => {
+    const updatePosition = () => {
+      const { state, view } = editor;
+      const { $from, empty } = state.selection;
+      const isEmptyTextBlock = $from.parent.isTextblock && $from.parent.type.name === "paragraph" && $from.parent.textContent === "" && empty;
+      if (!isEmptyTextBlock || !view.hasFocus()) {
+        setIsVisible(false);
+        return;
+      }
+      const coords = view.coordsAtPos($from.pos);
+      setPosition2({ top: coords.top - FLOATING_MENU_OFFSET, left: coords.left });
+      setIsVisible(true);
+    };
+    const handleBlur = () => setIsVisible(false);
+    editor.on("selectionUpdate", updatePosition);
+    editor.on("focus", updatePosition);
+    editor.on("blur", handleBlur);
+    editor.on("update", updatePosition);
+    return () => {
+      editor.off("selectionUpdate", updatePosition);
+      editor.off("focus", updatePosition);
+      editor.off("blur", handleBlur);
+      editor.off("update", updatePosition);
+    };
+  }, [editor]);
+  if (!isVisible) return null;
+  return createPortal8(
+    /* @__PURE__ */ jsx92(
+      "div",
+      {
+        "data-popover": true,
+        className: "fixed z-99999 rounded-2xl border border-border/50 bg-card text-card-foreground shadow-lg backdrop-blur-sm overflow-hidden animate-in fade-in-0 slide-in-from-bottom-2",
+        style: {
+          top: `${position.top}px`,
+          left: `${position.left}px`,
+          transform: "translate(-50%, -100%)"
+        },
+        onMouseDown: (e) => e.preventDefault(),
+        children: /* @__PURE__ */ jsx92(FloatingMenuContent, { editor })
+      }
+    ),
+    document.body
+  );
+};
 
 // src/components/UEditor/CharacterCount.tsx
 import { jsxs as jsxs77 } from "react/jsx-runtime";
@@ -38659,7 +38952,7 @@ var Selection = class {
   found.
   */
   static findFrom($pos, dir, textOnly = false) {
-    let inner = $pos.parent.inlineContent ? new TextSelection3($pos) : findSelectionIn($pos.node(0), $pos.parent, $pos.pos, $pos.index(), dir, textOnly);
+    let inner = $pos.parent.inlineContent ? new TextSelection4($pos) : findSelectionIn($pos.node(0), $pos.parent, $pos.pos, $pos.index(), dir, textOnly);
     if (inner)
       return inner;
     for (let depth = $pos.depth - 1; depth >= 0; depth--) {
@@ -38728,7 +39021,7 @@ var Selection = class {
   returns the bookmark for that.
   */
   getBookmark() {
-    return TextSelection3.between(this.$anchor, this.$head).getBookmark();
+    return TextSelection4.between(this.$anchor, this.$head).getBookmark();
   }
 };
 Selection.prototype.visible = true;
@@ -38748,7 +39041,7 @@ function checkTextSelection($pos) {
     console["warn"]("TextSelection endpoint not pointing into a node with inline content (" + $pos.parent.type.name + ")");
   }
 }
-var TextSelection3 = class _TextSelection extends Selection {
+var TextSelection4 = class _TextSelection extends Selection {
   /**
   Construct a text selection between the given points.
   */
@@ -38834,7 +39127,7 @@ var TextSelection3 = class _TextSelection extends Selection {
     return new _TextSelection($anchor, $head);
   }
 };
-Selection.jsonID("text", TextSelection3);
+Selection.jsonID("text", TextSelection4);
 var TextBookmark = class _TextBookmark {
   constructor(anchor, head) {
     this.anchor = anchor;
@@ -38844,7 +39137,7 @@ var TextBookmark = class _TextBookmark {
     return new _TextBookmark(mapping.map(this.anchor), mapping.map(this.head));
   }
   resolve(doc) {
-    return TextSelection3.between(doc.resolve(this.anchor), doc.resolve(this.head));
+    return TextSelection4.between(doc.resolve(this.anchor), doc.resolve(this.head));
   }
 };
 var NodeSelection2 = class _NodeSelection extends Selection {
@@ -38963,7 +39256,7 @@ var AllBookmark = {
 };
 function findSelectionIn(doc, node, pos, index, dir, text = false) {
   if (node.inlineContent)
-    return TextSelection3.create(doc, pos);
+    return TextSelection4.create(doc, pos);
   for (let i = index - (dir > 0 ? 0 : 1); dir > 0 ? i < node.childCount : i >= 0; i += dir) {
     let child = node.child(i);
     if (!child.isAtom) {
@@ -39555,7 +39848,7 @@ var CellSelection = class CellSelection2 extends Selection {
       else if (tableChanged && this.isColSelection()) return CellSelection2.colSelection($anchorCell, $headCell);
       else return new CellSelection2($anchorCell, $headCell);
     }
-    return TextSelection3.between($anchorCell, $headCell);
+    return TextSelection4.between($anchorCell, $headCell);
   }
   content() {
     const table = this.$anchorCell.node(-1);
@@ -40170,7 +40463,7 @@ function shiftArrow(axis, dir) {
   };
 }
 function atEndOfCell(view, axis, dir) {
-  if (!(view.state.selection instanceof TextSelection3)) return null;
+  if (!(view.state.selection instanceof TextSelection4)) return null;
   const { $head } = view.state.selection;
   for (let d = $head.depth - 1; d >= 0; d--) {
     const parent = $head.node(d);
@@ -41301,7 +41594,7 @@ function TableControls({ editor, containerRef }) {
         destructive: true
       }
     ];
-  }, [layout, runAtActiveCell, t]);
+  }, [editor, layout, runAtActiveCell, t]);
   const getRowHandleMenuItems = React83.useCallback((rowHandle) => [
     {
       label: t("tableMenu.addRowBefore"),
@@ -41517,6 +41810,42 @@ var UEDITOR_PROSEMIRROR_CLASS_NAME = cn(
   "[&_th]:px-2",
   "[&_th]:py-0",
   "[&_th_p]:my-0",
+  "[&_td[data-formula]]:pr-7",
+  "[&_th[data-formula]]:pr-7",
+  "[&_td[data-formula]]:before:pointer-events-none",
+  "[&_th[data-formula]]:before:pointer-events-none",
+  "[&_td[data-formula]]:before:absolute",
+  "[&_th[data-formula]]:before:absolute",
+  "[&_td[data-formula]]:before:right-1",
+  "[&_th[data-formula]]:before:right-1",
+  "[&_td[data-formula]]:before:top-1",
+  "[&_th[data-formula]]:before:top-1",
+  "[&_td[data-formula]]:before:z-[1]",
+  "[&_th[data-formula]]:before:z-[1]",
+  "[&_td[data-formula]]:before:rounded-sm",
+  "[&_th[data-formula]]:before:rounded-sm",
+  "[&_td[data-formula]]:before:bg-primary/10",
+  "[&_th[data-formula]]:before:bg-primary/10",
+  "[&_td[data-formula]]:before:px-1",
+  "[&_th[data-formula]]:before:px-1",
+  "[&_td[data-formula]]:before:font-mono",
+  "[&_th[data-formula]]:before:font-mono",
+  "[&_td[data-formula]]:before:text-[9px]",
+  "[&_th[data-formula]]:before:text-[9px]",
+  "[&_td[data-formula]]:before:font-semibold",
+  "[&_th[data-formula]]:before:font-semibold",
+  "[&_td[data-formula]]:before:leading-4",
+  "[&_th[data-formula]]:before:leading-4",
+  "[&_td[data-formula]]:before:text-primary",
+  "[&_th[data-formula]]:before:text-primary",
+  "[&_td[data-formula]]:before:content-['fx']",
+  "[&_th[data-formula]]:before:content-['fx']",
+  "[&_td[data-formula-state='error']]:bg-destructive/5",
+  "[&_th[data-formula-state='error']]:bg-destructive/5",
+  "[&_td[data-formula-state='error']]:before:bg-destructive/10",
+  "[&_th[data-formula-state='error']]:before:bg-destructive/10",
+  "[&_td[data-formula-state='error']]:before:text-destructive",
+  "[&_th[data-formula-state='error']]:before:text-destructive",
   "[&_td[colwidth]]:min-w-0",
   "[&_th[colwidth]]:min-w-0",
   "[&_td[data-colwidth]]:min-w-0",
@@ -42022,7 +42351,7 @@ function useUEditorTableInteractions(editor, editable = true) {
       clearHoveredTableCell();
       clearAllTableResizeHover();
     };
-  }, [beginResize, cancelResize, cleanupRowResize, clearActiveTableCell, clearAllTableResizeHover, clearHoveredTableCell, editable, editor, handleRowResizePointerMove, handleRowResizePointerUp, hideColumnGuide, hideRowGuide, isRowResizing, scheduleTableLayoutSync, showColumnGuide, showRowGuide, syncActiveRowResizeGuide, syncActiveTableCellFromSelection, updateActiveCellHighlight]);
+  }, [beginResize, cancelResize, cleanupRowResize, clearActiveTableCell, clearAllTableResizeHover, clearHoveredTableCell, editable, editor, handleRowResizePointerMove, handleRowResizePointerUp, hideColumnGuide, hideRowGuide, isRowResizing, scheduleTableLayoutSync, setActiveTableCell, setHoveredTableCell, showColumnGuide, showRowGuide, syncActiveRowResizeGuide, syncActiveTableCellFromSelection, updateActiveCellHighlight]);
   return {
     editorContentRef,
     tableColumnGuideRef,
@@ -42036,7 +42365,7 @@ import { useEffect as useEffect39, useRef as useRef37 } from "react";
 import { TableMap as TableMap6 } from "@tiptap/pm/tables";
 
 // src/components/UEditor/table-formula-range-picker.ts
-import { TextSelection as TextSelection4 } from "@tiptap/pm/state";
+import { TextSelection as TextSelection5 } from "@tiptap/pm/state";
 import { TableMap as TableMap5 } from "@tiptap/pm/tables";
 function getCellText2(cellNode) {
   return cellNode.textBetween(0, cellNode.content.size, "\n").trim();
@@ -42072,7 +42401,7 @@ function cancelFormulaEditing(view) {
   if (!context) return false;
   let tr = view.state.tr.delete(context.cellContentStart, context.cellContentEnd);
   const selectionPos = Math.min(context.cellContentStart, tr.doc.content.size);
-  tr = tr.setSelection(TextSelection4.near(tr.doc.resolve(selectionPos)));
+  tr = tr.setSelection(TextSelection5.near(tr.doc.resolve(selectionPos)));
   view.dispatch(tr);
   view.focus();
   return true;
@@ -42139,7 +42468,7 @@ function replacePickedLabel(view, pickState, nextLabel, currentCell) {
   }
   let tr = view.state.tr.insertText(nextLabel, pickState.insertedFrom, pickState.insertedTo);
   const nextTo = pickState.insertedFrom + nextLabel.length;
-  tr = tr.setSelection(TextSelection4.create(tr.doc, nextTo));
+  tr = tr.setSelection(TextSelection5.create(tr.doc, nextTo));
   view.dispatch(tr);
   return {
     ...pickState,
@@ -42159,7 +42488,7 @@ function beginFormulaRangePick(view, event) {
   const insertedText = `${prefix}${picked.label}`;
   const insertedFrom = from + prefix.length;
   let tr = view.state.tr.insertText(insertedText, from, to);
-  tr = tr.setSelection(TextSelection4.create(tr.doc, from + insertedText.length));
+  tr = tr.setSelection(TextSelection5.create(tr.doc, from + insertedText.length));
   view.dispatch(tr);
   view.focus();
   event.preventDefault();
@@ -43338,9 +43667,156 @@ var MenuBar = ({
   ] });
 };
 
-// src/components/UEditor/UEditor.tsx
+// src/components/UEditor/table-formula-bar.tsx
+import { useEffect as useEffect40, useRef as useRef39, useState as useState52 } from "react";
+import { useEditorState as useEditorState4 } from "@tiptap/react";
+import { AlertCircle as AlertCircle5, Check as Check14, Hash as Hash2, Sigma as Sigma3, Trash2 as Trash26 } from "lucide-react";
 import { jsx as jsx99, jsxs as jsxs82 } from "react/jsx-runtime";
-var UEditor = React87.forwardRef(({
+function TableFormulaBar({ editor }) {
+  const t = useSmartTranslations("UEditor");
+  const inputRef = useRef39(null);
+  const [draftState, setDraftState] = useState52(null);
+  useEditorState4({
+    editor,
+    selector: ({ transactionNumber }) => transactionNumber
+  });
+  const selectedCell = getSelectedTableFormulaCell(editor);
+  useEffect40(() => {
+    const focusFormulaInput = () => {
+      inputRef.current?.focus();
+    };
+    const handleDoubleClick = (event) => {
+      const target = resolveEventElement(event.target);
+      if (!target?.closest?.("td[data-formula],th[data-formula]")) return;
+      event.preventDefault();
+      focusFormulaInput();
+    };
+    editor.view.dom.addEventListener("dblclick", handleDoubleClick);
+    return () => {
+      editor.view.dom.removeEventListener("dblclick", handleDoubleClick);
+    };
+  }, [editor]);
+  if (!selectedCell) return null;
+  const selectedCellKey = `${selectedCell.tablePos}:${selectedCell.row}:${selectedCell.column}`;
+  const draft = draftState?.cellKey === selectedCellKey && draftState.sourceFormula === selectedCell.formula ? draftState.value : selectedCell.formula;
+  const setDraft = (value) => {
+    setDraftState({
+      cellKey: selectedCellKey,
+      sourceFormula: selectedCell.formula,
+      value
+    });
+  };
+  const applyDraft = () => {
+    const normalized = normalizeFormulaInput(draft);
+    if (normalized) {
+      setSelectedTableCellFormula(editor, normalized);
+    } else {
+      clearSelectedTableCellFormula(editor);
+    }
+    setDraftState(null);
+  };
+  const cancelDraft = () => {
+    setDraftState(null);
+    window.setTimeout(() => {
+      if (!editor.isDestroyed) editor.commands.focus();
+    }, 0);
+  };
+  return /* @__PURE__ */ jsxs82(
+    "div",
+    {
+      "data-ueditor-formula-bar": "",
+      role: "toolbar",
+      "aria-label": t("tableMenu.formulaBar"),
+      className: "flex min-h-10 items-center gap-2 border-b border-border/60 bg-muted/25 px-2 py-1.5",
+      children: [
+        /* @__PURE__ */ jsx99(
+          "span",
+          {
+            "data-ueditor-formula-cell-label": "",
+            className: "flex h-7 min-w-12 items-center justify-center rounded-md border border-border/60 bg-background px-2 font-mono text-xs font-semibold text-foreground",
+            children: selectedCell.label
+          }
+        ),
+        /* @__PURE__ */ jsx99(Sigma3, { "aria-hidden": "true", className: "h-4 w-4 shrink-0 text-primary" }),
+        /* @__PURE__ */ jsx99(
+          "input",
+          {
+            ref: inputRef,
+            "data-ueditor-formula-input": "",
+            value: draft,
+            onChange: (event) => setDraft(event.target.value),
+            onKeyDown: (event) => {
+              event.stopPropagation();
+              if (event.key === "Enter") {
+                event.preventDefault();
+                applyDraft();
+              } else if (event.key === "Escape") {
+                event.preventDefault();
+                cancelDraft();
+              }
+            },
+            "aria-label": t("tableMenu.editFormula"),
+            className: "h-7 min-w-0 flex-1 rounded-md border border-border/60 bg-background px-2 font-mono text-sm text-foreground outline-none focus:border-primary/40 focus:ring-2 focus:ring-primary/15"
+          }
+        ),
+        selectedCell.formulaState === "error" && /* @__PURE__ */ jsxs82(
+          "span",
+          {
+            role: "status",
+            className: "hidden shrink-0 items-center gap-1 text-xs font-medium text-destructive sm:inline-flex",
+            children: [
+              /* @__PURE__ */ jsx99(AlertCircle5, { "aria-hidden": "true", className: "h-3.5 w-3.5" }),
+              t("tableMenu.formulaError")
+            ]
+          }
+        ),
+        /* @__PURE__ */ jsx99(
+          "button",
+          {
+            type: "button",
+            onClick: applyDraft,
+            "aria-label": t("tableMenu.apply"),
+            title: t("tableMenu.apply"),
+            className: "flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-primary text-primary-foreground transition-colors hover:bg-primary/90",
+            children: /* @__PURE__ */ jsx99(Check14, { "aria-hidden": "true", className: "h-4 w-4" })
+          }
+        ),
+        /* @__PURE__ */ jsx99(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              convertSelectedTableCellFormulaToValue(editor);
+              setDraftState(null);
+            },
+            "aria-label": t("tableMenu.convertToValue"),
+            title: t("tableMenu.convertToValue"),
+            className: "flex h-7 w-7 shrink-0 items-center justify-center rounded-md border border-border/60 bg-background text-muted-foreground transition-colors hover:bg-muted hover:text-foreground",
+            children: /* @__PURE__ */ jsx99(Hash2, { "aria-hidden": "true", className: "h-4 w-4" })
+          }
+        ),
+        /* @__PURE__ */ jsx99(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              clearSelectedTableCellFormula(editor);
+              setDraftState(null);
+            },
+            "aria-label": t("tableMenu.clearCell"),
+            title: t("tableMenu.clearCell"),
+            className: "flex h-7 w-7 shrink-0 items-center justify-center rounded-md border border-destructive/30 bg-background text-destructive transition-colors hover:bg-destructive/10",
+            children: /* @__PURE__ */ jsx99(Trash26, { "aria-hidden": "true", className: "h-4 w-4" })
+          }
+        )
+      ]
+    }
+  );
+}
+
+// src/components/UEditor/UEditor.tsx
+import { jsx as jsx100, jsxs as jsxs83 } from "react/jsx-runtime";
+var UEditor = React88.forwardRef(({
   content = "",
   onChange,
   onHtmlChange,
@@ -43358,6 +43834,7 @@ var UEditor = React87.forwardRef(({
   autofocus = false,
   showToolbar = true,
   showBubbleMenu = true,
+  showFloatingMenu = false,
   showCharacterCount = true,
   showFooter = true,
   maxCharacters,
@@ -43381,14 +43858,14 @@ var UEditor = React87.forwardRef(({
 }, ref) => {
   const t = useSmartTranslations("UEditor");
   const effectivePlaceholder = placeholder ?? t("placeholder");
-  const inFlightPrepareRef = useRef39(null);
-  const lastAppliedContentRef = useRef39(content ?? "");
-  const scheduledFormulaRecalculateRef = useRef39(false);
-  const editorInstanceRef = useRef39(null);
-  const formulaRangePickRef = useRef39(null);
-  const formulaRangeSurfaceRef = useRef39(null);
-  const [formulaRangeHighlight, setFormulaRangeHighlight] = React87.useState(null);
-  const scheduleFormulaRecalculate = React87.useCallback((editor2, options) => {
+  const inFlightPrepareRef = useRef40(null);
+  const lastAppliedContentRef = useRef40(content ?? "");
+  const scheduledFormulaRecalculateRef = useRef40(false);
+  const editorInstanceRef = useRef40(null);
+  const formulaRangePickRef = useRef40(null);
+  const formulaRangeSurfaceRef = useRef40(null);
+  const [formulaRangeHighlight, setFormulaRangeHighlight] = React88.useState(null);
+  const scheduleFormulaRecalculate = React88.useCallback((editor2, options) => {
     if (editor2.isDestroyed || scheduledFormulaRecalculateRef.current) return;
     if (!options?.force && isEditingTableFormulaText(editor2)) return;
     scheduledFormulaRecalculateRef.current = true;
@@ -43428,7 +43905,7 @@ var UEditor = React87.forwardRef(({
     ],
     [effectivePlaceholder, t, maxCharacters, uploadImage, resolvedUploadFile, imageInsertMode, maxImageFileSize, allowedImageMimeTypes, fallbackToDataUrl, editable, fetchMetadata, extraExtensions]
   );
-  const syncFormulaRangeHighlight = React87.useCallback((pickState) => {
+  const syncFormulaRangeHighlight = React88.useCallback((pickState) => {
     const container = formulaRangeSurfaceRef.current;
     setFormulaRangeHighlight(container && pickState ? getFormulaRangePickHighlight(container, pickState) : null);
   }, []);
@@ -43477,9 +43954,9 @@ var UEditor = React87.forwardRef(({
           if (formulaContext && event.key === "Enter") {
             event.preventDefault();
             event.stopPropagation();
-            const activeEditor = editorInstanceRef.current;
-            if (activeEditor && !isDraftTableFormula(formulaContext.formula)) {
-              recalculateActiveTableFormulas(activeEditor);
+            const activeEditor2 = editorInstanceRef.current;
+            if (activeEditor2 && !isDraftTableFormula(formulaContext.formula)) {
+              recalculateActiveTableFormulas(activeEditor2);
             }
             return true;
           }
@@ -43489,6 +43966,13 @@ var UEditor = React87.forwardRef(({
             cancelFormulaEditing(_view);
             return true;
           }
+          const activeEditor = editorInstanceRef.current;
+          if (activeEditor && (event.key === "Backspace" || event.key === "Delete") && getSelectedTableFormulaCell(activeEditor)) {
+            event.preventDefault();
+            event.stopPropagation();
+            clearSelectedTableCellFormula(activeEditor);
+            return true;
+          }
           if (event.key === "ArrowLeft" || event.key === "ArrowRight" || event.key === "ArrowUp" || event.key === "ArrowDown") {
             event.stopPropagation();
           }
@@ -43499,7 +43983,7 @@ var UEditor = React87.forwardRef(({
           if (event.button !== 0) return false;
           const target = resolveEventElement(event.target);
           const anchor = target?.closest?.("a[href]");
-          const href = anchor?.getAttribute("href") ?? "";
+          const href = sanitizeUEditorUrl(anchor?.getAttribute("href") ?? "", "link");
           if (!href) return false;
           if (editable) return false;
           if (!view.state.selection.empty) return false;
@@ -43525,11 +44009,13 @@ var UEditor = React87.forwardRef(({
     onSelectionUpdate: ({ editor: editor2 }) => {
       scheduleFormulaRecalculate(editor2);
     },
-    onBlur: ({ editor: editor2 }) => {
+    onBlur: ({ editor: editor2, event }) => {
+      const nextTarget = event.relatedTarget;
+      if (nextTarget instanceof Element && nextTarget.closest("[data-ueditor-formula-bar]")) return;
       scheduleFormulaRecalculate(editor2, { force: true });
     }
   });
-  useEffect40(() => {
+  useEffect41(() => {
     editorInstanceRef.current = editor;
     return () => {
       if (editorInstanceRef.current === editor) editorInstanceRef.current = null;
@@ -43570,7 +44056,7 @@ var UEditor = React87.forwardRef(({
     }),
     [content, editor, uploadImageForSave, uploadFileForSave, uploadImageConcurrency]
   );
-  useEffect40(() => {
+  useEffect41(() => {
     if (!editor) return;
     queueMicrotask(() => {
       if (!editor.isDestroyed) {
@@ -43578,7 +44064,7 @@ var UEditor = React87.forwardRef(({
       }
     });
   }, [editor]);
-  useEffect40(() => {
+  useEffect41(() => {
     if (!editor) return;
     const nextContent = content ?? "";
     if (lastAppliedContentRef.current === nextContent) return;
@@ -43597,7 +44083,7 @@ var UEditor = React87.forwardRef(({
     }
   }, [content, editor]);
   if (!editor) {
-    return /* @__PURE__ */ jsx99(
+    return /* @__PURE__ */ jsx100(
       "div",
       {
         className: cn("w-full border bg-background flex items-center justify-center text-muted-foreground", className),
@@ -43606,7 +44092,7 @@ var UEditor = React87.forwardRef(({
       }
     );
   }
-  return /* @__PURE__ */ jsxs82(
+  return /* @__PURE__ */ jsxs83(
     "div",
     {
       className: cn(
@@ -43622,7 +44108,7 @@ var UEditor = React87.forwardRef(({
         className
       ),
       children: [
-        editable && showMenuBar && /* @__PURE__ */ jsx99(
+        editable && showMenuBar && /* @__PURE__ */ jsx100(
           MenuBar,
           {
             editor,
@@ -43637,7 +44123,7 @@ var UEditor = React87.forwardRef(({
             onPreview
           }
         ),
-        editable && showToolbar && /* @__PURE__ */ jsx99(
+        editable && showToolbar && /* @__PURE__ */ jsx100(
           EditorToolbar,
           {
             editor,
@@ -43652,7 +44138,8 @@ var UEditor = React87.forwardRef(({
             letterSpacings
           }
         ),
-        editable && showBubbleMenu && /* @__PURE__ */ jsx99(
+        editable && /* @__PURE__ */ jsx100(TableFormulaBar, { editor }),
+        editable && showBubbleMenu && /* @__PURE__ */ jsx100(
           CustomBubbleMenu,
           {
             editor,
@@ -43660,7 +44147,8 @@ var UEditor = React87.forwardRef(({
             lineHeights
           }
         ),
-        /* @__PURE__ */ jsxs82(
+        editable && showFloatingMenu && /* @__PURE__ */ jsx100(CustomFloatingMenu, { editor }),
+        /* @__PURE__ */ jsxs83(
           "div",
           {
             ref: (node) => {
@@ -43673,7 +44161,7 @@ var UEditor = React87.forwardRef(({
               maxHeight
             },
             children: [
-              /* @__PURE__ */ jsx99(
+              /* @__PURE__ */ jsx100(
                 "span",
                 {
                   ref: tableColumnGuideRef,
@@ -43681,7 +44169,7 @@ var UEditor = React87.forwardRef(({
                   className: "pointer-events-none absolute z-20 bg-primary opacity-0 transition-opacity duration-100"
                 }
               ),
-              /* @__PURE__ */ jsx99(
+              /* @__PURE__ */ jsx100(
                 "span",
                 {
                   ref: tableRowGuideRef,
@@ -43689,7 +44177,7 @@ var UEditor = React87.forwardRef(({
                   className: "pointer-events-none absolute z-20 bg-primary opacity-0 transition-opacity duration-100"
                 }
               ),
-              /* @__PURE__ */ jsx99(
+              /* @__PURE__ */ jsx100(
                 "span",
                 {
                   ref: activeTableCellHighlightRef,
@@ -43698,7 +44186,7 @@ var UEditor = React87.forwardRef(({
                   className: "pointer-events-none hidden absolute z-20 rounded-[2px] border-2 border-primary bg-primary/10"
                 }
               ),
-              /* @__PURE__ */ jsx99(
+              /* @__PURE__ */ jsx100(
                 "div",
                 {
                   ref: formulaCoordinateOverlayRef,
@@ -43706,7 +44194,7 @@ var UEditor = React87.forwardRef(({
                   className: "pointer-events-none absolute inset-0 z-[21] hidden overflow-visible"
                 }
               ),
-              formulaRangeHighlight && /* @__PURE__ */ jsx99(
+              formulaRangeHighlight && /* @__PURE__ */ jsx100(
                 "span",
                 {
                   "aria-hidden": "true",
@@ -43720,8 +44208,8 @@ var UEditor = React87.forwardRef(({
                   }
                 }
               ),
-              editable && /* @__PURE__ */ jsx99(TableControls, { editor, containerRef: editorContentRef }),
-              /* @__PURE__ */ jsx99(
+              editable && /* @__PURE__ */ jsx100(TableControls, { editor, containerRef: editorContentRef }),
+              /* @__PURE__ */ jsx100(
                 EditorContent,
                 {
                   editor,
@@ -43731,7 +44219,7 @@ var UEditor = React87.forwardRef(({
             ]
           }
         ),
-        showFooter && showCharacterCount && /* @__PURE__ */ jsx99(CharacterCountDisplay, { editor, maxCharacters })
+        showFooter && showCharacterCount && /* @__PURE__ */ jsx100(CharacterCountDisplay, { editor, maxCharacters })
       ]
     }
   );