@urbicon-ui/blocks 6.34.0 → 6.36.0

package/dist/components/Chat/markdown/url-policy.js

@@ -0,0 +1,109 @@
+/**
+ * URL policy enforcement (decision A4 — strict by default).
+ *
+ * LLM output is untrusted input: prompt-injected markdown links/images are a
+ * proven data-exfiltration channel (query-param payloads to attacker hosts)
+ * even without any script execution. Policy therefore runs on every URL the
+ * parser emits, and blocked URLs never reach the produced node tree — a
+ * blocked link/image carries `blocked: true` and an empty href/src.
+ *
+ * Checks run against the *normalized* absolute URL (WHATWG `URL`), so scheme
+ * tricks (`JaVaScRiPt:`, embedded tabs/newlines, `https:\\host`, `/../`
+ * path escapes against a prefix) are neutralized before matching.
+ */
+export const DEFAULT_LINK_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:'];
+/** Placeholder base — only used to detect whether a URL is relative. */
+const RELATIVE_PROBE_BASE = 'https://relative-probe.invalid/';
+/**
+ * Strip ASCII tab/newline/CR and C0 controls anywhere in the string (the URL
+ * standard removes tab/NL/CR during parsing, so leaving them in would let
+ * `java\tscript:` sneak past a naive scheme check while browsers still
+ * execute it) and trim outer whitespace.
+ */
+function cleanRawUrl(raw) {
+    let out = '';
+    for (const ch of raw.trim()) {
+        const code = ch.charCodeAt(0);
+        if (code > 0x1f)
+            out += ch;
+    }
+    return out;
+}
+function resolve(raw) {
+    const cleaned = cleanRawUrl(raw);
+    if (cleaned.length === 0)
+        return { invalid: true };
+    // Protocol-relative URLs (`//host/…`) are absolute in effect; resolving
+    // them against the probe base would otherwise mislabel them as relative.
+    const protocolRelative = cleaned.startsWith('//');
+    try {
+        const url = new URL(protocolRelative ? `https:${cleaned}` : cleaned);
+        return { absolute: true, url };
+    }
+    catch {
+        // Not parseable standalone → candidate for a relative reference.
+    }
+    try {
+        new URL(cleaned, RELATIVE_PROBE_BASE);
+        return { absolute: false, cleaned };
+    }
+    catch {
+        return { invalid: true };
+    }
+}
+const BLOCKED = { ok: false };
+/**
+ * Check a link destination. Relative references are always allowed; absolute
+ * URLs must carry an allowed protocol.
+ */
+export function checkLinkUrl(raw, policy) {
+    const resolved = resolve(raw);
+    if ('invalid' in resolved && resolved.invalid)
+        return blocked('link', raw, policy);
+    if (!resolved.absolute)
+        return { ok: true, href: resolved.cleaned };
+    const allowed = (policy?.allowedLinkProtocols ?? DEFAULT_LINK_PROTOCOLS).map((p) => p.toLowerCase());
+    if (allowed.includes(resolved.url.protocol))
+        return { ok: true, href: resolved.url.href };
+    return blocked('link', raw, policy);
+}
+/**
+ * Check an image source. Relative references are allowed (same-origin is not
+ * an exfiltration sink); absolute URLs must match an allowlisted prefix on
+ * the normalized href. The default empty allowlist blocks every external
+ * image — the CamoLeak lesson, and the posture ChatGPT/Copilot converged on.
+ */
+export function checkImageUrl(raw, policy) {
+    const resolved = resolve(raw);
+    if ('invalid' in resolved && resolved.invalid)
+        return blocked('image', raw, policy);
+    if (!resolved.absolute)
+        return { ok: true, href: resolved.cleaned };
+    const prefixes = policy?.allowedImagePrefixes ?? [];
+    const href = resolved.url.href;
+    for (const prefix of prefixes) {
+        if (href.startsWith(normalizePrefix(prefix)))
+            return { ok: true, href };
+    }
+    return blocked('image', raw, policy);
+}
+/**
+ * Normalize an allowlist prefix the same way hrefs are normalized (lowercased
+ * scheme/host, resolved path) so `HTTPS://Example.com/img/` still matches.
+ * A bare-origin prefix gains its trailing slash (`https://cdn.example.com` →
+ * `…com/`), which pins it to that origin — without it, `startsWith` would
+ * also match `https://cdn.example.com.evil.com/…`. Prefixes that are not
+ * full URLs (e.g. `data:`) are kept verbatim.
+ */
+function normalizePrefix(prefix) {
+    try {
+        return new URL(prefix).href;
+    }
+    catch {
+        return prefix;
+    }
+}
+function blocked(kind, raw, policy) {
+    policy?.onBlocked?.(kind, raw);
+    return BLOCKED;
+}

package/dist/components/FileUpload/FileUpload.svelte

@@ -1,12 +1,6 @@
 <script lang="ts">
   import { useBlocksI18n } from '../..';
-  import type {
-    FileUploadProps,
-    FileUploadFile,
-    FileRejection,
-    FileUploadError,
-    FileUploadSlotName
-  } from './index';
+  import type { FileUploadProps, FileUploadFile, FileUploadSlotName } from './index';
   import { fileUploadVariants, type FileUploadVariants } from './fileUpload.variants';
   import { getBlocksConfig, resolveSlotClasses } from '../../provider';
   import { resolveIcon } from '../../icons';
@@ -17,10 +11,20 @@
   import DangerCircleIconDefault from '../../icons/DangerCircleIcon.svelte';
   import { mintRegistry } from '../../mint';
   import { Progress } from '../../primitives/Progress';
-  import { Spinner } from '../../primitives/Spinner';
+  // internal core, not the public component — keeps the public-to-public import graph clean (see internal/core/)
+  import CoreSpinner from '../../internal/core/CoreSpinner.svelte';
   import { fly } from 'svelte/transition';
   import { quintOut } from 'svelte/easing';
   import { onDestroy } from 'svelte';
+  import {
+    createIntakeEntry,
+    dragItemsMatchAccept,
+    formatFileSize,
+    partitionIntake,
+    revokeIntakePreviews,
+    type FileIntakeConstraints,
+    type FileIntakeMessages
+  } from '../../utils/file-intake';
 
   const bt = useBlocksI18n();
 
@@ -115,54 +119,27 @@
 
   // ── Validation ─────────────────────────────────────────────────────────────
 
-  function validateFile(file: File): FileUploadError[] {
-    const errors: FileUploadError[] = [];
-
-    if (accept) {
-      const types = Array.isArray(accept) ? accept : accept.split(',').map((t) => t.trim());
-      const matches = types.some((type) => {
-        if (type.startsWith('.')) return file.name.toLowerCase().endsWith(type.toLowerCase());
-        if (type.endsWith('/*')) return file.type.startsWith(type.replace('/*', '/'));
-        return file.type === type;
-      });
-      if (!matches) {
-        errors.push({
-          code: 'FILE_INVALID_TYPE',
-          message: bt('fileUpload.invalidType', { type: file.type || 'unknown' })
-        });
-      }
-    }
-
-    if (file.size > maxFileSize) {
-      errors.push({
-        code: 'FILE_TOO_LARGE',
-        message: bt('fileUpload.tooLarge', { size: formatFileSize(maxFileSize) })
-      });
-    }
-
-    if (file.size < minFileSize) {
-      errors.push({
-        code: 'FILE_TOO_SMALL',
-        message: bt('fileUpload.tooSmall', { size: formatFileSize(minFileSize) })
-      });
-    }
-
-    if (files.some((f) => f.file.name === file.name && f.file.size === file.size)) {
-      errors.push({ code: 'FILE_EXISTS', message: bt('fileUpload.exists') });
-    }
-
-    if (validate) {
-      const custom = validate(file);
-      if (custom) errors.push(...custom);
-    }
-
-    return errors;
-  }
+  // Error texts wired from the component's i18n source; injected into the
+  // shared file-intake core so its pure functions stay label-agnostic. Texts
+  // are identical to the pre-refactor inline `bt('fileUpload.*')` calls.
+  const messages: FileIntakeMessages = {
+    invalidType: (type) => bt('fileUpload.invalidType', { type }),
+    tooLarge: (size) => bt('fileUpload.tooLarge', { size }),
+    tooSmall: (size) => bt('fileUpload.tooSmall', { size }),
+    exists: () => bt('fileUpload.exists'),
+    tooMany: (count) => bt('fileUpload.tooMany', { count: String(count) })
+  };
+
+  const constraints = $derived<FileIntakeConstraints>({
+    accept,
+    maxFiles,
+    maxFileSize,
+    minFileSize,
+    validate
+  });
 
   // ── File Processing ────────────────────────────────────────────────────────
 
-  let idCounter = 0;
-
   // Two-way sync between `files[0]` and the convenience `file` binding.
   // `lastSyncedFile` is the snapshot we last wrote to `file` — comparing
   // against it lets us tell whether the change came from `files` (internal,
@@ -193,9 +170,7 @@
     if (file === lastSyncedFile) return;
 
     if (file === null) {
-      for (const entry of files) {
-        if (entry.preview) URL.revokeObjectURL(entry.preview);
-      }
+      revokeIntakePreviews(files);
       files = [];
       lastSyncedFile = null;
       onFilesChange?.(files);
@@ -203,15 +178,8 @@
     }
 
     const old = files[0];
-    if (old?.preview) URL.revokeObjectURL(old.preview);
-    const replacement: FileUploadFile = {
-      id: `file-${Date.now()}-${++idCounter}`,
-      file,
-      status: 'pending',
-      errors: [],
-      preview: isImageFile(file) ? URL.createObjectURL(file) : undefined
-    };
-    files = [replacement];
+    if (old) revokeIntakePreviews([old]);
+    files = [createIntakeEntry(file)];
     lastSyncedFile = file;
     onFilesChange?.(files);
   });
@@ -219,36 +187,7 @@
   function processFiles(incoming: File[]) {
     if (disabled) return;
 
-    const accepted: FileUploadFile[] = [];
-    const rejected: FileRejection[] = [];
-
-    const remaining = maxFiles - files.length;
-    const toProcess = incoming.slice(0, remaining);
-    const excess = incoming.slice(remaining);
-
-    for (const file of excess) {
-      rejected.push({
-        file,
-        errors: [
-          { code: 'TOO_MANY_FILES', message: bt('fileUpload.tooMany', { count: String(maxFiles) }) }
-        ]
-      });
-    }
-
-    for (const file of toProcess) {
-      const errors = validateFile(file);
-      if (errors.length > 0) {
-        rejected.push({ file, errors });
-      } else {
-        accepted.push({
-          id: `file-${Date.now()}-${++idCounter}`,
-          file,
-          status: 'pending',
-          errors: [],
-          preview: isImageFile(file) ? URL.createObjectURL(file) : undefined
-        });
-      }
-    }
+    const { accepted, rejected } = partitionIntake(incoming, files, constraints, messages);
 
     if (accepted.length > 0) {
       files = [...files, ...accepted];
@@ -262,16 +201,14 @@
   }
 
   function removeFile(entry: FileUploadFile) {
-    if (entry.preview) URL.revokeObjectURL(entry.preview);
+    revokeIntakePreviews([entry]);
     files = files.filter((f) => f.id !== entry.id);
     onFileRemove?.(entry);
     onFilesChange?.(files);
   }
 
   onDestroy(() => {
-    for (const entry of files) {
-      if (entry.preview) URL.revokeObjectURL(entry.preview);
-    }
+    revokeIntakePreviews(files);
   });
 
   // ── Drag Handlers ──────────────────────────────────────────────────────────
@@ -284,16 +221,7 @@
     dragging = true;
 
     if (accept && e.dataTransfer?.items?.length) {
-      const types = Array.isArray(accept) ? accept : accept.split(',').map((t) => t.trim());
-      const hasInvalid = Array.from(e.dataTransfer.items).some((item) => {
-        if (item.kind !== 'file') return true;
-        return !types.some((type) => {
-          if (type.endsWith('/*')) return item.type.startsWith(type.replace('/*', '/'));
-          if (type.startsWith('.')) return true;
-          return item.type === type;
-        });
-      });
-      dragInvalid = hasInvalid;
+      dragInvalid = !dragItemsMatchAccept(e.dataTransfer.items, accept);
     }
   }
 
@@ -369,21 +297,6 @@
     };
   });
 
-  // ── Helpers ────────────────────────────────────────────────────────────────
-
-  function formatFileSize(bytes: number): string {
-    if (bytes === 0) return '0 B';
-    if (!isFinite(bytes)) return '';
-    const k = 1024;
-    const sizes = ['B', 'KB', 'MB', 'GB'];
-    const i = Math.floor(Math.log(bytes) / Math.log(k));
-    return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
-  }
-
-  function isImageFile(file: File): boolean {
-    return file.type.startsWith('image/');
-  }
-
   // ── Mint ─────────────────────────────────────────────────────────────────
 
   $effect(() => {
@@ -520,7 +433,21 @@
             <!-- Status indicator -->
             <div class={slot('fileItemStatusIcon')}>
               {#if entry.status === 'uploading'}
-                <Spinner size="xs" visible />
+                <!--
+                  CoreSpinner instead of the public Spinner (see internal/core/).
+                  The old call was `visible` (explicitly true) with no label
+                  override, and this branch already gates rendering on the
+                  uploading status — so the core needs no {#if} of its own.
+                  Deliberate a11y delta: the old Spinner emitted role="status" +
+                  aria-live + an sr-only "Loading..." inside the file list's own
+                  aria-live="polite" region (nested live regions); the core emits
+                  no semantics — the list region owns announcements. `text-primary`
+                  pins the old default color (the public Spinner's intent default),
+                  matching the explicit text-success/text-danger on the sibling
+                  status icons; it wins the duel against the core's `text-current`
+                  by stylesheet order (theme colors sort after keyword colors).
+                -->
+                <CoreSpinner size="xs" class="text-primary" />
               {:else if entry.status === 'complete'}
                 <CheckCircleIcon size={itemIconSize} class="text-success" />
               {:else if entry.status === 'error'}

package/dist/components/FileUpload/FileUpload.svelte.d.ts

@@ -1,4 +1,4 @@
 import type { FileUploadProps } from './index.js';
-declare const FileUpload: import("svelte").Component<FileUploadProps, {}, "files" | "file">;
+declare const FileUpload: import("svelte").Component<FileUploadProps, {}, "file" | "files">;
 type FileUpload = ReturnType<typeof FileUpload>;
 export default FileUpload;

package/dist/components/FileUpload/index.d.ts

@@ -2,34 +2,8 @@ import type { Snippet } from 'svelte';
 import type { HTMLAttributes } from 'svelte/elements';
 import type { MintProp } from '../../mint/index.js';
 import type { FileUploadSlots, FileUploadVariants } from './fileUpload.variants.js';
-export type FileUploadErrorCode = 'FILE_INVALID_TYPE' | 'FILE_TOO_LARGE' | 'FILE_TOO_SMALL' | 'TOO_MANY_FILES' | 'FILE_EXISTS' | 'CUSTOM';
-export interface FileUploadError {
-    /** Machine-readable error code. */
-    code: FileUploadErrorCode;
-    /** Human-readable error message. */
-    message: string;
-}
-export type FileUploadStatus = 'pending' | 'uploading' | 'complete' | 'error';
-export interface FileUploadFile {
-    /** Unique identifier for this file entry. */
-    id: string;
-    /** The native File object. */
-    file: File;
-    /** Object URL for image previews (auto-generated, auto-revoked). */
-    preview?: string;
-    /** Upload progress 0–100. Undefined when not tracking. */
-    progress?: number;
-    /** Current lifecycle status. */
-    status: FileUploadStatus;
-    /** Validation or upload errors. */
-    errors: FileUploadError[];
-}
-export interface FileRejection {
-    /** The rejected file. */
-    file: File;
-    /** Why it was rejected. */
-    errors: FileUploadError[];
-}
+import type { FileIntakeRejection as FileRejection, FileIntakeError as FileUploadError, FileIntakeErrorCode as FileUploadErrorCode, FileIntakeEntry as FileUploadFile, FileIntakeStatus as FileUploadStatus } from '../../utils/file-intake.js';
+export type { FileRejection, FileUploadError, FileUploadErrorCode, FileUploadFile, FileUploadStatus };
 export declare const IMAGE_MIME_TYPES: string[];
 export declare const PDF_MIME_TYPE: string[];
 export declare const VIDEO_MIME_TYPES: string[];

package/dist/components/Planner/PlannerHeader.svelte

@@ -6,7 +6,8 @@
 -->
 <script lang="ts">
   import { useBlocksI18n } from '../..';
-  import { Button } from '../../primitives/Button';
+  // internal core, not the public component — keeps the public-to-public import graph clean (see internal/core/)
+  import CoreIconButton from '../../internal/core/CoreIconButton.svelte';
   import { Tooltip } from '../../primitives/Tooltip';
   import { resolveIcon } from '../../icons';
   import ChevronLeftIconDefault from '../../icons/ChevronLeftIcon.svelte';
@@ -37,44 +38,46 @@
   );
 </script>
 
+<!--
+  Nav buttons render on the internal CoreIconButton (was `<Button unstyled
+  mint="none">`, which emitted only the call-site classes). The core's plumbing
+  overlaps the navButton slot's old baseline (inline-flex centring, focus-visible
+  reset, disabled opacity/cursor — now supplied by the core, stripped from the
+  slot); the deliberate deltas it introduces are documented on the slot in
+  planner.variants.ts.
+-->
 <div class={ctx.slot('header')}>
   <div class={ctx.slot('nav')}>
-    <Button
-      unstyled
-      mint="none"
+    <CoreIconButton
       class={ctx.slot('navButton')}
       onclick={() => ctx.navigate(-1)}
       disabled={!ctx.canGoBack || ctx.disabled}
       aria-label={prevLabel}
     >
       <ChevronLeftIcon size={16} />
-    </Button>
+    </CoreIconButton>
   </div>
 
   <span class={ctx.slot('headerTitle')}>{ctx.title}</span>
 
   <div class={ctx.slot('nav')}>
     <Tooltip label={bt('planner.today')}>
-      <Button
-        unstyled
-        mint="none"
+      <CoreIconButton
         class={ctx.slot('navButton')}
         onclick={() => ctx.goToToday()}
         disabled={!ctx.canGoToToday || ctx.disabled}
         aria-label={bt('planner.today')}
       >
         <CalendarDaysIcon size={16} />
-      </Button>
+      </CoreIconButton>
     </Tooltip>
-    <Button
-      unstyled
-      mint="none"
+    <CoreIconButton
       class={ctx.slot('navButton')}
       onclick={() => ctx.navigate(1)}
       disabled={!ctx.canGoForward || ctx.disabled}
       aria-label={nextLabel}
     >
       <ChevronRightIcon size={16} />
-    </Button>
+    </CoreIconButton>
   </div>
 </div>

package/dist/components/Planner/planner.variants.js

@@ -14,12 +14,23 @@ export const plannerVariants = tv({
         header: ['flex items-center justify-between gap-2', 'border-b border-border-hairline'],
         headerTitle: 'font-semibold text-text-primary select-none tabular-nums',
         nav: 'flex items-center gap-1',
+        // Rendered on the internal CoreIconButton (behaviour-only base: inline-flex
+        // centring, cursor/select affordance, focus-visible reset, disabled
+        // opacity/cursor/inertness), so this slot carries only the visual identity
+        // on top — the classes the core already supplies (inline-flex items-center
+        // justify-center, focus-visible:outline-none, disabled:opacity-50,
+        // disabled:cursor-not-allowed) are not repeated here. Deliberate deltas vs.
+        // the old `<Button unstyled mint="none">` render (which had NO plumbing):
+        // `cursor-pointer` (was the UA arrow — Tailwind 4 preflight doesn't set it;
+        // now consistent with every styled Button) and `disabled:pointer-events-none`
+        // (a disabled nav button is fully inert: no more hover-bg feedback or
+        // not-allowed cursor while disabled — matching the styled Button base).
+        // Mirrors calendar.variants navButton. See internal/core/.
         navButton: [
-            'inline-flex items-center justify-center rounded-md',
+            'rounded-md',
             'text-text-secondary hover:bg-surface-hover hover:text-text-primary',
             'transition-colors duration-[var(--blocks-duration-fast)]',
-            'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary/50 focus-visible:ring-offset-2',
-            'disabled:opacity-50 disabled:cursor-not-allowed'
+            'focus-visible:ring-2 focus-visible:ring-primary/50 focus-visible:ring-offset-2'
         ],
         // Grid scaffolding
         grid: 'w-full',

package/dist/components/index.d.ts

@@ -6,6 +6,7 @@ export * from './BarChart/index.js';
 export type { CalendarContext, CalendarEvent, CalendarEventCategory, CalendarHeaderProps, CalendarProps, CalendarSelection, CalendarSlotName, CalendarViewMode, DateRange, DayCellContext, EventItemContext, HeaderContext } from './Calendar/index.js';
 export * from './Calendar/index.js';
 export * from './ChartFrame/index.js';
+export * from './Chat/index.js';
 export * from './CommandPalette/index.js';
 export type { CompositionBarIntent, CompositionBarProps, CompositionItem } from './CompositionBar/index.js';
 export * from './CompositionBar/index.js';

package/dist/components/index.js

@@ -5,6 +5,7 @@ export * from './AreaChart/index.js';
 export * from './BarChart/index.js';
 export * from './Calendar/index.js';
 export * from './ChartFrame/index.js';
+export * from './Chat/index.js';
 export * from './CommandPalette/index.js';
 export * from './CompositionBar/index.js';
 export * from './CurrencyInput/index.js';