@viax.io/uxm 4.38.0 → 4.40.0

package/dist/studio/persistence/css-sanitizers.cjs

@@ -0,0 +1,75 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var css_sanitizers_exports = {};
+__export(css_sanitizers_exports, {
+  safeFontFamily: () => safeFontFamily,
+  safeFontWeight: () => safeFontWeight,
+  safeLineHeight: () => safeLineHeight,
+  safeTokenKey: () => safeTokenKey,
+  safeTokenValue: () => safeTokenValue,
+  safeTypeScale: () => safeTypeScale,
+  safeUrl: () => safeUrl
+});
+module.exports = __toCommonJS(css_sanitizers_exports);
+function safeUrl(v) {
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  if (!/^(https?:\/\/|\/)/.test(trimmed)) return void 0;
+  if (/[")\n\r]/.test(trimmed)) return void 0;
+  return trimmed;
+}
+function safeFontFamily(v) {
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return /^[A-Za-z0-9 _-]+$/.test(trimmed) ? trimmed : void 0;
+}
+function safeFontWeight(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  return s !== void 0 && /^(500|600|700)$/.test(s) ? s : void 0;
+}
+function safeTypeScale(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  if (s === void 0 || !/^(?:0|[1-9]\d?)(?:\.\d{1,3})?$/.test(s)) return void 0;
+  const n = Number(s);
+  return n >= 0.5 && n <= 2 ? s : void 0;
+}
+function safeLineHeight(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  if (s === void 0 || !/^[1-9](?:\.\d{1,2})?$/.test(s)) return void 0;
+  const n = Number(s);
+  return n >= 1 && n <= 2.5 ? s : void 0;
+}
+function safeTokenKey(v) {
+  return /^--[A-Za-z0-9-]+$/.test(v);
+}
+function safeTokenValue(v) {
+  if (typeof v !== "string") return void 0;
+  return /[{};\n\r]/.test(v) ? void 0 : v;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  safeFontFamily,
+  safeFontWeight,
+  safeLineHeight,
+  safeTokenKey,
+  safeTokenValue,
+  safeTypeScale,
+  safeUrl
+});
+//# sourceMappingURL=css-sanitizers.cjs.map

package/dist/studio/persistence/css-sanitizers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/studio/persistence/css-sanitizers.ts"],"sourcesContent":["/**\n * CSS sanitizers — applied to every brand and override value before it is\n * interpolated into the generated stylesheet. The output is persisted and\n * served to every browser session, so an attacker-controlled value must not\n * be able to break out of the declaration it belongs to. Each returns\n * `undefined` for a rejected value; callers drop the declaration rather than\n * throw, so one bad value can never blank the whole sheet.\n */\n\nexport function safeUrl(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  const trimmed = v.trim();\n  if (!/^(https?:\\/\\/|\\/)/.test(trimmed)) return undefined;\n  if (/[\")\\n\\r]/.test(trimmed)) return undefined;\n  return trimmed;\n}\nexport function safeFontFamily(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  const trimmed = v.trim();\n  return /^[A-Za-z0-9 _-]+$/.test(trimmed) ? trimmed : undefined;\n}\n// Heading weight is a closed set (the editor offers exactly these three), so a\n// strict whitelist is both the sanitizer and the contract. Numbers are accepted\n// defensively — a persisted config may carry the JSON number rather than the\n// string the <select> yields.\nexport function safeFontWeight(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  return s !== undefined && /^(500|600|700)$/.test(s) ? s : undefined;\n}\n// Scales multiply a length inside calc(), which makes a bad value far worse\n// than a dropped declaration: `abc` or `1.2px` (length × length) is invalid at\n// computed-value time, so `font-size` resolves to `unset` and INHERITS — one\n// poisoned value on :root collapses the whole app to the parent's size. A\n// plain-number whitelist plus a sane range is the only safe gate; note\n// `safeTokenValue` is NOT sufficient (it passes `abc`, `-1` and unbalanced\n// parens). Range mirrors the editor's slider bounds.\nexport function safeTypeScale(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  if (s === undefined || !/^(?:0|[1-9]\\d?)(?:\\.\\d{1,3})?$/.test(s)) return undefined;\n  const n = Number(s);\n  return n >= 0.5 && n <= 2 ? s : undefined;\n}\n// Line height is a unitless ratio; same invalid-at-computed-value-time risk as\n// the scales, but it only affects the declarations that read it.\nexport function safeLineHeight(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  if (s === undefined || !/^[1-9](?:\\.\\d{1,2})?$/.test(s)) return undefined;\n  const n = Number(s);\n  return n >= 1 && n <= 2.5 ? s : undefined;\n}\nexport function safeTokenKey(v: string): boolean {\n  return /^--[A-Za-z0-9-]+$/.test(v);\n}\nexport function safeTokenValue(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  return /[{};\\n\\r]/.test(v) ? undefined : v;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASO,SAAS,QAAQ,GAAgC;AACtD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,WAAW,KAAK,OAAO,EAAG,QAAO;AACrC,SAAO;AACT;AACO,SAAS,eAAe,GAAgC;AAC7D,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,UAAU,EAAE,KAAK;AACvB,SAAO,oBAAoB,KAAK,OAAO,IAAI,UAAU;AACvD;AAKO,SAAS,eAAe,GAAgC;AAC7D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,SAAO,MAAM,UAAa,kBAAkB,KAAK,CAAC,IAAI,IAAI;AAC5D;AAQO,SAAS,cAAc,GAAgC;AAC5D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,MAAI,MAAM,UAAa,CAAC,iCAAiC,KAAK,CAAC,EAAG,QAAO;AACzE,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO,KAAK,OAAO,KAAK,IAAI,IAAI;AAClC;AAGO,SAAS,eAAe,GAAgC;AAC7D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,MAAI,MAAM,UAAa,CAAC,wBAAwB,KAAK,CAAC,EAAG,QAAO;AAChE,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO,KAAK,KAAK,KAAK,MAAM,IAAI;AAClC;AACO,SAAS,aAAa,GAAoB;AAC/C,SAAO,oBAAoB,KAAK,CAAC;AACnC;AACO,SAAS,eAAe,GAAgC;AAC7D,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,YAAY,KAAK,CAAC,IAAI,SAAY;AAC3C;","names":[]}

package/dist/studio/persistence/css-sanitizers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * CSS sanitizers — applied to every brand and override value before it is
+ * interpolated into the generated stylesheet. The output is persisted and
+ * served to every browser session, so an attacker-controlled value must not
+ * be able to break out of the declaration it belongs to. Each returns
+ * `undefined` for a rejected value; callers drop the declaration rather than
+ * throw, so one bad value can never blank the whole sheet.
+ */
+export declare function safeUrl(v: unknown): string | undefined;
+export declare function safeFontFamily(v: unknown): string | undefined;
+export declare function safeFontWeight(v: unknown): string | undefined;
+export declare function safeTypeScale(v: unknown): string | undefined;
+export declare function safeLineHeight(v: unknown): string | undefined;
+export declare function safeTokenKey(v: string): boolean;
+export declare function safeTokenValue(v: unknown): string | undefined;
+//# sourceMappingURL=css-sanitizers.d.ts.map

package/dist/studio/persistence/css-sanitizers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"css-sanitizers.d.ts","sourceRoot":"","sources":["../../../src/studio/persistence/css-sanitizers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMtD;AACD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI7D;AAKD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG7D;AAQD,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK5D;AAGD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK7D;AACD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C;AACD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG7D"}

package/dist/studio/persistence/css-sanitizers.js

@@ -0,0 +1,45 @@
+function safeUrl(v) {
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  if (!/^(https?:\/\/|\/)/.test(trimmed)) return void 0;
+  if (/[")\n\r]/.test(trimmed)) return void 0;
+  return trimmed;
+}
+function safeFontFamily(v) {
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return /^[A-Za-z0-9 _-]+$/.test(trimmed) ? trimmed : void 0;
+}
+function safeFontWeight(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  return s !== void 0 && /^(500|600|700)$/.test(s) ? s : void 0;
+}
+function safeTypeScale(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  if (s === void 0 || !/^(?:0|[1-9]\d?)(?:\.\d{1,3})?$/.test(s)) return void 0;
+  const n = Number(s);
+  return n >= 0.5 && n <= 2 ? s : void 0;
+}
+function safeLineHeight(v) {
+  const s = typeof v === "number" ? String(v) : typeof v === "string" ? v.trim() : void 0;
+  if (s === void 0 || !/^[1-9](?:\.\d{1,2})?$/.test(s)) return void 0;
+  const n = Number(s);
+  return n >= 1 && n <= 2.5 ? s : void 0;
+}
+function safeTokenKey(v) {
+  return /^--[A-Za-z0-9-]+$/.test(v);
+}
+function safeTokenValue(v) {
+  if (typeof v !== "string") return void 0;
+  return /[{};\n\r]/.test(v) ? void 0 : v;
+}
+export {
+  safeFontFamily,
+  safeFontWeight,
+  safeLineHeight,
+  safeTokenKey,
+  safeTokenValue,
+  safeTypeScale,
+  safeUrl
+};
+//# sourceMappingURL=css-sanitizers.js.map

package/dist/studio/persistence/css-sanitizers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/studio/persistence/css-sanitizers.ts"],"sourcesContent":["/**\n * CSS sanitizers — applied to every brand and override value before it is\n * interpolated into the generated stylesheet. The output is persisted and\n * served to every browser session, so an attacker-controlled value must not\n * be able to break out of the declaration it belongs to. Each returns\n * `undefined` for a rejected value; callers drop the declaration rather than\n * throw, so one bad value can never blank the whole sheet.\n */\n\nexport function safeUrl(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  const trimmed = v.trim();\n  if (!/^(https?:\\/\\/|\\/)/.test(trimmed)) return undefined;\n  if (/[\")\\n\\r]/.test(trimmed)) return undefined;\n  return trimmed;\n}\nexport function safeFontFamily(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  const trimmed = v.trim();\n  return /^[A-Za-z0-9 _-]+$/.test(trimmed) ? trimmed : undefined;\n}\n// Heading weight is a closed set (the editor offers exactly these three), so a\n// strict whitelist is both the sanitizer and the contract. Numbers are accepted\n// defensively — a persisted config may carry the JSON number rather than the\n// string the <select> yields.\nexport function safeFontWeight(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  return s !== undefined && /^(500|600|700)$/.test(s) ? s : undefined;\n}\n// Scales multiply a length inside calc(), which makes a bad value far worse\n// than a dropped declaration: `abc` or `1.2px` (length × length) is invalid at\n// computed-value time, so `font-size` resolves to `unset` and INHERITS — one\n// poisoned value on :root collapses the whole app to the parent's size. A\n// plain-number whitelist plus a sane range is the only safe gate; note\n// `safeTokenValue` is NOT sufficient (it passes `abc`, `-1` and unbalanced\n// parens). Range mirrors the editor's slider bounds.\nexport function safeTypeScale(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  if (s === undefined || !/^(?:0|[1-9]\\d?)(?:\\.\\d{1,3})?$/.test(s)) return undefined;\n  const n = Number(s);\n  return n >= 0.5 && n <= 2 ? s : undefined;\n}\n// Line height is a unitless ratio; same invalid-at-computed-value-time risk as\n// the scales, but it only affects the declarations that read it.\nexport function safeLineHeight(v: unknown): string | undefined {\n  const s = typeof v === 'number' ? String(v) : typeof v === 'string' ? v.trim() : undefined;\n  if (s === undefined || !/^[1-9](?:\\.\\d{1,2})?$/.test(s)) return undefined;\n  const n = Number(s);\n  return n >= 1 && n <= 2.5 ? s : undefined;\n}\nexport function safeTokenKey(v: string): boolean {\n  return /^--[A-Za-z0-9-]+$/.test(v);\n}\nexport function safeTokenValue(v: unknown): string | undefined {\n  if (typeof v !== 'string') return undefined;\n  return /[{};\\n\\r]/.test(v) ? undefined : v;\n}\n"],"mappings":"AASO,SAAS,QAAQ,GAAgC;AACtD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,UAAU,EAAE,KAAK;AACvB,MAAI,CAAC,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,WAAW,KAAK,OAAO,EAAG,QAAO;AACrC,SAAO;AACT;AACO,SAAS,eAAe,GAAgC;AAC7D,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,UAAU,EAAE,KAAK;AACvB,SAAO,oBAAoB,KAAK,OAAO,IAAI,UAAU;AACvD;AAKO,SAAS,eAAe,GAAgC;AAC7D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,SAAO,MAAM,UAAa,kBAAkB,KAAK,CAAC,IAAI,IAAI;AAC5D;AAQO,SAAS,cAAc,GAAgC;AAC5D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,MAAI,MAAM,UAAa,CAAC,iCAAiC,KAAK,CAAC,EAAG,QAAO;AACzE,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO,KAAK,OAAO,KAAK,IAAI,IAAI;AAClC;AAGO,SAAS,eAAe,GAAgC;AAC7D,QAAM,IAAI,OAAO,MAAM,WAAW,OAAO,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;AACjF,MAAI,MAAM,UAAa,CAAC,wBAAwB,KAAK,CAAC,EAAG,QAAO;AAChE,QAAM,IAAI,OAAO,CAAC;AAClB,SAAO,KAAK,KAAK,KAAK,MAAM,IAAI;AAClC;AACO,SAAS,aAAa,GAAoB;AAC/C,SAAO,oBAAoB,KAAK,CAAC;AACnC;AACO,SAAS,eAAe,GAAgC;AAC7D,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,YAAY,KAAK,CAAC,IAAI,SAAY;AAC3C;","names":[]}