meno-core 1.1.2 → 1.1.3

package/dist/lib/client/index.js

@@ -13,7 +13,7 @@ import {
   resolveLinkMapping,
   resolveStyleMapping,
   skipEmptyTemplateAttributes
-} from "../../chunks/chunk-7ZLF4NE5.js";
+} from "../../chunks/chunk-3JXK2QFU.js";
 import {
   filterCSSProperties
 } from "../../chunks/chunk-XTKNX4FW.js";
@@ -72,7 +72,7 @@ import {
   sortClassesByPropertyOrder,
   toFriendlyError,
   validatePageData
-} from "../../chunks/chunk-J4IPTP5X.js";
+} from "../../chunks/chunk-LOZL5HOF.js";
 import {
   DEFAULT_I18N_CONFIG,
   isI18nValue,

package/dist/lib/server/index.js

@@ -33,7 +33,7 @@ import {
   processStructure,
   resolveHtmlMapping,
   skipEmptyTemplateAttributes
-} from "../../chunks/chunk-7ZLF4NE5.js";
+} from "../../chunks/chunk-3JXK2QFU.js";
 import {
   DEFAULT_BREAKPOINTS,
   DEFAULT_FLUID_RANGE,
@@ -92,7 +92,7 @@ import {
   validateCMSDraftItem,
   validateCMSItem,
   validateComponentDefinition
-} from "../../chunks/chunk-J4IPTP5X.js";
+} from "../../chunks/chunk-LOZL5HOF.js";
 import {
   DEFAULT_I18N_CONFIG,
   buildLocalizedPath,
@@ -284,7 +284,7 @@ init_constants();
 // lib/server/middleware/cors.ts
 var DEFAULT_OPTIONS = {
   origin: "*",
-  methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+  methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
   allowedHeaders: ["Content-Type", "Authorization"],
   credentials: false
 };
@@ -2950,7 +2950,7 @@ async function handleFunctionsRoute(req, url) {
     const response = await handler(context);
     const headers = new Headers(response.headers);
     headers.set("Access-Control-Allow-Origin", "*");
-    headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+    headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
     headers.set("Access-Control-Allow-Headers", "Content-Type");
     return new Response(response.body, {
       status: response.status,
@@ -2976,7 +2976,7 @@ function handleFunctionsPreflight(req, url) {
     status: 204,
     headers: {
       "Access-Control-Allow-Origin": "*",
-      "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+      "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
       "Access-Control-Allow-Headers": "Content-Type",
       "Access-Control-Max-Age": "86400"
     }
@@ -5279,7 +5279,23 @@ var formHandlerScript = `
   // Find all forms with fetch handler
   const forms = document.querySelectorAll('form[data-submit-handler="fetch"]');
 
+  // Spam protection (server-enforced at /api/send-email): inject a hidden honeypot
+  // field bots fill but humans never see, and stamp a clock-skew-free dwell time on
+  // submit. Fields named with a leading "_" are control/meta and are not emailed.
+  const loadedAt = Date.now();
+
   forms.forEach(function(form) {
+    if (!form.querySelector('input[name="_honey"]')) {
+      const hp = document.createElement('input');
+      hp.type = 'text';
+      hp.name = '_honey';
+      hp.tabIndex = -1;
+      hp.setAttribute('autocomplete', 'off');
+      hp.setAttribute('aria-hidden', 'true');
+      hp.style.cssText = 'position:absolute;left:-9999px;width:1px;height:1px;opacity:0';
+      form.appendChild(hp);
+    }
+
     form.addEventListener('submit', async function(e) {
       e.preventDefault();
 
@@ -5314,6 +5330,7 @@ var formHandlerScript = `
 
       try {
         const formData = new FormData(form);
+        formData.append('_elapsed', String(Date.now() - loadedAt));
 
         const response = await fetch(action, {
           method: method.toUpperCase(),