mnfst 0.5.130 → 0.5.133

package/lib/manifest.css

@@ -2142,16 +2142,17 @@
             border-radius: 6px;
             cursor: pointer;
             user-select: none;
+            transition: none;
 
             &:hover {
                 color: var(--color-field-inverse, oklch(43.9% 0 0));
                 text-decoration: inherit;
-                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent));
+                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent))
             }
 
             &:active {
                 color: var(--color-field-inverse, oklch(43.9% 0 0));
-                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent));
+                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent))
             }
 
             & span,
@@ -2168,7 +2169,7 @@
         /* Titles */
         & small {
             padding: 0.25rem 0.5rem;
-            color: var(--color-content-neutral, oklch(43.9% 0 0));
+            color: var(--color-content-neutral, oklch(43.9% 0 0))
         }
 
         /* Horizontal rules (offset to ignore menu padding) */
@@ -2178,7 +2179,7 @@
             margin-inline-start: calc(0.25rem * -1);
             margin-top: 0.25rem;
             margin-bottom: 0.25rem;
-            background-color: var(--color-line, color-mix(oklch(20.5% 0 0) 10%, transparent));
+            background-color: var(--color-line, color-mix(oklch(20.5% 0 0) 10%, transparent))
         }
 
         /* Labels */
@@ -2226,7 +2227,7 @@
 
     /* Dark theme */
     :where(.dark menu[popover]) :where(li, a, button, label):hover {
-        background-color: var(--color-field-surface-hover, color-mix(oklch(20.5% 0 0) 15%, transparent));
+        background-color: var(--color-field-surface-hover, color-mix(oklch(20.5% 0 0) 15%, transparent))
     }
 
     /* Nested menu alignment */
@@ -2237,7 +2238,7 @@
 
     /* Center alignment */
     :where(menu.center) {
-        position-area: center;
+        position-area: center
     }
 
     /* Top alignment */
@@ -2374,6 +2375,7 @@
             z-index: 1
         }
 
+        /* Equal-width children (give the wrapper a width if children need more room) */
         &.even>* {
             flex-shrink: initial;
             width: 100%
@@ -2415,21 +2417,24 @@
             /* Concentric corners */
             &>* {
                 flex-grow: 1;
+                width: fit-content;
                 min-height: 0;
                 height: 100%;
+                color: var(--color-content-neutral, oklch(43.9% 0 0));
                 background-color: transparent;
                 border-radius: max(calc(var(--radius, 0.5rem) - var(--spacing, 0.25rem) / 2), 0px);
 
                 &:hover:not(.selected, [aria-selected=true], [aria-current]) {
-                    background-color: color-mix(in oklch, var(--color-field-surface-hover, oklch(37.1% 0 0)) 40%, transparent)
+                    color: var(--color-field-inverse, oklch(20.5% 0 0));
+                    background-color: color-mix(in oklch, var(--color-field-surface-hover, oklch(70.8% 0 0)) 40%, transparent)
                 }
             }
 
             /* Selected tab */
             &>:is(.selected, [aria-selected=true], [aria-current]) {
-                color: var(--color-page, oklch(98.5% 0 0));
-                background-color: var(--color-content-stark, oklch(20.5% 0 0));
-                box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+                color: var(--color-field-inverse, oklch(20.5% 0 0));
+                background-color: var(--color-field-surface, oklch(87% 0 0));
+                box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1)
             }
 
             /* Background slider for selected tab) */
@@ -2440,7 +2445,7 @@
                     anchor-name: --selected-tab;
                     --co-anchor: --selected-tab;
                     background-color: transparent;
-                    box-shadow: none;
+                    box-shadow: none
                 }
 
                 &:has(>:is(.selected, [aria-selected=true], [aria-current]))::before {
@@ -2452,10 +2457,14 @@
                     left: anchor(left);
                     width: anchor-size(width);
                     height: anchor-size(height);
-                    background-color: var(--color-content-stark, oklch(20.5% 0 0));
+                    background-color: var(--color-page, oklch(98.5% 0 0));
                     border-radius: max(calc(var(--radius, 0.5rem) - var(--spacing, 0.25rem) / 2), 0px);
                     box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-                    transition: var(--tab-slide-transition, all 0.15s ease-in-out);
+                    transition: var(--tab-slide-transition, all 0.15s ease-in-out)
+                }
+
+                .dark &:has(>:is(.selected, [aria-selected=true], [aria-current]))::before {
+                    background-color: var(--color-field-surface, oklch(87% 0 0))
                 }
 
                 /* Track the tab rigidly during continuous reflow (drag-to-resize, window resize) */
@@ -2482,7 +2491,7 @@
         width: 100%;
 
         &:has([type=radio], [type=checkbox]) {
-            gap: calc(var(--spacing, 0.25rem) * 2);
+            gap: calc(var(--spacing, 0.25rem) * 2)
         }
     }
 
@@ -2496,7 +2505,7 @@
         & :where(legend) {
             padding: 0 1.5ch;
             font-size: 0.875rem;
-            color: var(--color-content-subtle, oklch(55.6% 0 0));
+            color: var(--color-content-subtle, oklch(55.6% 0 0))
         }
     }
 
@@ -3550,7 +3559,7 @@
     /* Entry animation */
     :where(.toast-entry) {
         opacity: 1;
-        transform: translateY(0);
+        transform: translateY(0)
     }
 
     /* Exit animation */

package/lib/manifest.data.js

@@ -27,19 +27,38 @@ async function ensureManifest() {
     }
 }
 
-// Helper to interpolate environment variables
+// Interpolate ${VAR} placeholders in a string against window.env. Only
+// PUBLIC_-prefixed vars reach window.env (the mnfst-run dev server filters
+// .env by that prefix to keep server-side secrets like MANIFEST_API_KEY out
+// of the browser). Misses warn once per name so a missing var doesn't fail
+// silently downstream as an empty URL / endpoint.
+const _warnedMissingEnv = new Set();
 function interpolateEnvVars(str) {
     if (typeof str !== 'string') return str;
     return str.replace(/\$\{([^}]+)\}/g, (match, varName) => {
-        // Check for environment variables (in browser, these would be set by build process)
         if (typeof process !== 'undefined' && process.env && process.env[varName]) {
             return process.env[varName];
         }
-        // Check for window.env (common pattern for client-side env vars)
         if (typeof window !== 'undefined' && window.env && window.env[varName]) {
             return window.env[varName];
         }
-        // Return original if not found
+        if (!_warnedMissingEnv.has(varName)) {
+            _warnedMissingEnv.add(varName);
+            if (!varName.startsWith('PUBLIC_')) {
+                console.warn(
+                    `[Manifest Data] data source references \${${varName}}, but only ` +
+                    `PUBLIC_-prefixed env vars are injected into window.env by mnfst-run. ` +
+                    `Rename to PUBLIC_${varName}, hardcode the value, or supply it via ` +
+                    `<script>window.env = {…}</script>. Leaving placeholder literal.`
+                );
+            } else {
+                console.warn(
+                    `[Manifest Data] data source references \${${varName}}, but it is not ` +
+                    `present in window.env. Add ${varName}=… to .env (read by mnfst-run) ` +
+                    `or set it via <script>window.env = {…}</script>. Leaving placeholder literal.`
+                );
+            }
+        }
         return match;
     });
 }
@@ -1297,7 +1316,11 @@ async function loadYamlLibrary() {
 
     yamlLoadingPromise = new Promise((resolve, reject) => {
         const script = document.createElement('script');
-        script.src = 'https://cdn.jsdelivr.net/npm/js-yaml/dist/js-yaml.min.js';
+        // Pinned + Subresource Integrity — a floating version or tampered CDN
+        // file can't inject arbitrary JS into the user's page.
+        script.src = 'https://cdn.jsdelivr.net/npm/js-yaml@4.2.0/dist/js-yaml.min.js';
+        script.integrity = 'sha384-hyhT0yrWXjngXhDa5wpJTU0pt/Djmlx4KtZECqqS6ZHf3ah4fWkFeW/2eWX9cX5J';
+        script.crossOrigin = 'anonymous';
         script.onload = () => {
             if (typeof window.jsyaml !== 'undefined') {
                 jsyaml = window.jsyaml;
@@ -1332,7 +1355,11 @@ async function loadCSVParser() {
 
     csvLoadingPromise = new Promise((resolve, reject) => {
         const script = document.createElement('script');
-        script.src = 'https://cdn.jsdelivr.net/npm/papaparse@latest/papaparse.min.js';
+        // Pinned + Subresource Integrity — a floating version or tampered CDN
+        // file can't inject arbitrary JS into the user's page.
+        script.src = 'https://cdn.jsdelivr.net/npm/papaparse@5.5.3/papaparse.min.js';
+        script.integrity = 'sha384-Jd2/X5FXVKahwaY2nivvw4LfSTg9idSj8yNXWtT4qef0fHSYr6M7M8bJAfbFYoMc';
+        script.crossOrigin = 'anonymous';
         script.onload = () => {
             if (typeof window.Papa !== 'undefined') {
                 papaparse = window.Papa;

package/lib/manifest.dropdown.css

@@ -6,19 +6,19 @@
 
 @layer base {
 
-    @keyframes mnfst-popover-in {
+    @keyframes popover-in {
         from {
-            transform: scale(.9);
+            transform: scale(.9)
         }
 
         to {
-            transform: none;
+            transform: none
         }
     }
 
     :where([popover]):not(.unstyle):popover-open {
         display: flex;
-        animation: mnfst-popover-in .15s ease-in both;
+        animation: popover-in .15s ease-in both
     }
 }
 
@@ -66,16 +66,17 @@
             border-radius: 6px;
             cursor: pointer;
             user-select: none;
+            transition: none;
 
             &:hover {
                 color: var(--color-field-inverse, oklch(43.9% 0 0));
                 text-decoration: inherit;
-                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent));
+                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent))
             }
 
             &:active {
                 color: var(--color-field-inverse, oklch(43.9% 0 0));
-                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent));
+                background-color: var(--color-field-surface, color-mix(oklch(20.5% 0 0) 10%, transparent))
             }
 
             & span,
@@ -92,7 +93,7 @@
         /* Titles */
         & small {
             padding: 0.25rem 0.5rem;
-            color: var(--color-content-neutral, oklch(43.9% 0 0));
+            color: var(--color-content-neutral, oklch(43.9% 0 0))
         }
 
         /* Horizontal rules (offset to ignore menu padding) */
@@ -102,7 +103,7 @@
             margin-inline-start: calc(0.25rem * -1);
             margin-top: 0.25rem;
             margin-bottom: 0.25rem;
-            background-color: var(--color-line, color-mix(oklch(20.5% 0 0) 10%, transparent));
+            background-color: var(--color-line, color-mix(oklch(20.5% 0 0) 10%, transparent))
         }
 
         /* Labels */
@@ -150,7 +151,7 @@
 
     /* Dark theme */
     :where(.dark menu[popover]) :where(li, a, button, label):hover {
-        background-color: var(--color-field-surface-hover, color-mix(oklch(20.5% 0 0) 15%, transparent));
+        background-color: var(--color-field-surface-hover, color-mix(oklch(20.5% 0 0) 15%, transparent))
     }
 
     /* Nested menu alignment */
@@ -161,7 +162,7 @@
 
     /* Center alignment */
     :where(menu.center) {
-        position-area: center;
+        position-area: center
     }
 
     /* Top alignment */

package/lib/manifest.dropdowns.js

@@ -175,6 +175,17 @@ function initializeDropdownPlugin() {
                     el.style.setProperty('--trigger-anchor', anchorName);
                     menu.style.setProperty('position-anchor', anchorName);
 
+                    // Re-point the shared menu at whichever trigger opens it (multi-trigger)
+                    const pointMenuHere = () => {
+                        const a = el.style.getPropertyValue('--trigger-anchor');
+                        if (a) menu.style.setProperty('position-anchor', a);
+                    };
+                    if (!modifiers.includes('context') && !el.__mnfstAnchorSwapBound) {
+                        el.__mnfstAnchorSwapBound = true;
+                        el.addEventListener('pointerdown', pointMenuHere);
+                        el.addEventListener('keydown', (e) => { if (e.key === 'Enter' || e.key === ' ') pointMenuHere(); });
+                    }
+
                     // ----- A11y wiring (WAI-ARIA Menu Button pattern) -----
                     // The trigger needs `aria-haspopup="menu"`, `aria-controls`, and a
                     // dynamic `aria-expanded` that follows the popover's open state.
@@ -192,11 +203,12 @@ function initializeDropdownPlugin() {
                         menu.querySelectorAll('li').forEach((li) => {
                             if (!li.hasAttribute('role')) li.setAttribute('role', 'menuitem');
                         });
-                        // Keep aria-expanded in sync with the popover's state.
+                        // Keep aria-expanded in sync across every trigger of this menu.
                         if (!menu.__mnfstAriaToggleBound) {
                             menu.__mnfstAriaToggleBound = true;
                             menu.addEventListener('toggle', (e) => {
-                                el.setAttribute('aria-expanded', e.newState === 'open' ? 'true' : 'false');
+                                const expanded = e.newState === 'open' ? 'true' : 'false';
+                                document.querySelectorAll(`[aria-controls="${menu.id}"]`).forEach(t => t.setAttribute('aria-expanded', expanded));
                             });
                         }
                     }
@@ -208,6 +220,7 @@ function initializeDropdownPlugin() {
                                 clearTimeout(hoverTimeout);
                                 clearTimeout(autoCloseTimeout);
 
+                                pointMenuHere();
                                 menu.showPopover();
                             }
                         };
@@ -244,46 +257,63 @@ function initializeDropdownPlugin() {
                             if (menu.matches(':popover-open')) menu.hidePopover();
                         };
 
-                        el.addEventListener('contextmenu', (e) => {
-                            e.preventDefault();
-                            e.stopPropagation();
-
-                            // Stash the actual right-clicked element so menu items can act on it.
-                            // (e.target is the deepest hit; el is the directive-bearing ancestor.)
-                            menu._triggerEl = e.target.closest('[data-cp-value], [x-data]') || el;
-                            menu._triggerHost = el;
-
-                            // Position at cursor, overriding anchor positioning
-                            menu.style.position = 'fixed';
-                            menu.style.positionAnchor = 'unset';
-                            menu.style.positionArea = 'unset';
-                            menu.style.inset = 'auto';
-                            menu.style.left = e.clientX + 'px';
-                            menu.style.top = e.clientY + 'px';
-                            menu.style.margin = '0';
-
-                            if (!menu.matches(':popover-open')) menu.showPopover();
-
-                            // Adjust if menu overflows viewport
-                            requestAnimationFrame(() => {
-                                const rect = menu.getBoundingClientRect();
-                                if (rect.right > window.innerWidth) menu.style.left = (window.innerWidth - rect.width) + 'px';
-                                if (rect.bottom > window.innerHeight) menu.style.top = (window.innerHeight - rect.height) + 'px';
+                        // Bind the right-click trigger once per element. Without
+                        // the guard, reprocessing (router re-walks, re-init) would
+                        // stack duplicate handlers.
+                        if (!el.__mnfstContextTriggerBound) {
+                            el.__mnfstContextTriggerBound = true;
+                            el.addEventListener('contextmenu', (e) => {
+                                e.preventDefault();
+                                e.stopPropagation();
+
+                                // Stash the actual right-clicked element so menu items can act on it.
+                                // (e.target is the deepest hit; el is the directive-bearing ancestor.)
+                                menu._triggerEl = e.target.closest('[data-cp-value], [x-data]') || el;
+                                menu._triggerHost = el;
+
+                                // Position at cursor, overriding anchor positioning
+                                menu.style.position = 'fixed';
+                                menu.style.positionAnchor = 'unset';
+                                menu.style.positionArea = 'unset';
+                                menu.style.inset = 'auto';
+                                menu.style.left = e.clientX + 'px';
+                                menu.style.top = e.clientY + 'px';
+                                menu.style.margin = '0';
+
+                                if (!menu.matches(':popover-open')) menu.showPopover();
+
+                                // Adjust if menu overflows viewport
+                                requestAnimationFrame(() => {
+                                    const rect = menu.getBoundingClientRect();
+                                    if (rect.right > window.innerWidth) menu.style.left = (window.innerWidth - rect.width) + 'px';
+                                    if (rect.bottom > window.innerHeight) menu.style.top = (window.innerHeight - rect.height) + 'px';
+                                });
                             });
-                        });
-
-                        // Manual dismiss: click outside or Escape
-                        document.addEventListener('pointerdown', (e) => {
-                            if (menu.matches(':popover-open') && !menu.contains(e.target)) closeContext();
-                        });
-                        document.addEventListener('keydown', (e) => {
-                            if (e.key === 'Escape' && menu.matches(':popover-open')) { closeContext(); el.focus(); }
-                        });
+                        }
 
-                        // Close after clicking a menu item
-                        menu.addEventListener('click', (e) => {
-                            if (e.target.closest('li, a, button')) closeContext();
-                        });
+                        // Document-level dismiss listeners are GLOBAL — re-binding
+                        // them on every reprocess leaks listeners on `document`.
+                        // Bind once per menu, tied to an AbortController so they
+                        // share one removable signal.
+                        if (!menu.__mnfstContextDismissBound) {
+                            menu.__mnfstContextDismissBound = true;
+                            const ctxAbort = new AbortController();
+                            menu.__mnfstContextAbort = ctxAbort;
+                            const { signal } = ctxAbort;
+
+                            // Manual dismiss: click outside or Escape
+                            document.addEventListener('pointerdown', (e) => {
+                                if (menu.matches(':popover-open') && !menu.contains(e.target)) closeContext();
+                            }, { signal });
+                            document.addEventListener('keydown', (e) => {
+                                if (e.key === 'Escape' && menu.matches(':popover-open')) { closeContext(); el.focus(); }
+                            }, { signal });
+
+                            // Close after clicking a menu item
+                            menu.addEventListener('click', (e) => {
+                                if (e.target.closest('li, a, button')) closeContext();
+                            }, { signal });
+                        }
                     }
 
                     // Add keyboard navigation handling

package/lib/manifest.form.css

@@ -16,6 +16,7 @@
             z-index: 1
         }
 
+        /* Equal-width children (give the wrapper a width if children need more room) */
         &.even>* {
             flex-shrink: initial;
             width: 100%
@@ -57,21 +58,24 @@
             /* Concentric corners */
             &>* {
                 flex-grow: 1;
+                width: fit-content;
                 min-height: 0;
                 height: 100%;
+                color: var(--color-content-neutral, oklch(43.9% 0 0));
                 background-color: transparent;
                 border-radius: max(calc(var(--radius, 0.5rem) - var(--spacing, 0.25rem) / 2), 0px);
 
                 &:hover:not(.selected, [aria-selected=true], [aria-current]) {
-                    background-color: color-mix(in oklch, var(--color-field-surface-hover, oklch(37.1% 0 0)) 40%, transparent)
+                    color: var(--color-field-inverse, oklch(20.5% 0 0));
+                    background-color: color-mix(in oklch, var(--color-field-surface-hover, oklch(70.8% 0 0)) 40%, transparent)
                 }
             }
 
             /* Selected tab */
             &>:is(.selected, [aria-selected=true], [aria-current]) {
-                color: var(--color-page, oklch(98.5% 0 0));
-                background-color: var(--color-content-stark, oklch(20.5% 0 0));
-                box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+                color: var(--color-field-inverse, oklch(20.5% 0 0));
+                background-color: var(--color-field-surface, oklch(87% 0 0));
+                box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1)
             }
 
             /* Background slider for selected tab) */
@@ -82,7 +86,7 @@
                     anchor-name: --selected-tab;
                     --co-anchor: --selected-tab;
                     background-color: transparent;
-                    box-shadow: none;
+                    box-shadow: none
                 }
 
                 &:has(>:is(.selected, [aria-selected=true], [aria-current]))::before {
@@ -94,10 +98,14 @@
                     left: anchor(left);
                     width: anchor-size(width);
                     height: anchor-size(height);
-                    background-color: var(--color-content-stark, oklch(20.5% 0 0));
+                    background-color: var(--color-page, oklch(98.5% 0 0));
                     border-radius: max(calc(var(--radius, 0.5rem) - var(--spacing, 0.25rem) / 2), 0px);
                     box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-                    transition: var(--tab-slide-transition, all 0.15s ease-in-out);
+                    transition: var(--tab-slide-transition, all 0.15s ease-in-out)
+                }
+
+                .dark &:has(>:is(.selected, [aria-selected=true], [aria-current]))::before {
+                    background-color: var(--color-field-surface, oklch(87% 0 0))
                 }
 
                 /* Track the tab rigidly during continuous reflow (drag-to-resize, window resize) */
@@ -124,7 +132,7 @@
         width: 100%;
 
         &:has([type=radio], [type=checkbox]) {
-            gap: calc(var(--spacing, 0.25rem) * 2);
+            gap: calc(var(--spacing, 0.25rem) * 2)
         }
     }
 
@@ -138,7 +146,7 @@
         & :where(legend) {
             padding: 0 1.5ch;
             font-size: 0.875rem;
-            color: var(--color-content-subtle, oklch(55.6% 0 0));
+            color: var(--color-content-subtle, oklch(55.6% 0 0))
         }
     }
 

package/lib/manifest.integrity.json

@@ -7,24 +7,24 @@
   "manifest.color.js": "sha384-6Rv3LxyTcZNjrhtayQfqRdCx0uSZ4BiEbgEI98I62eTvp8Aw7LBIoNJ0Je1oktwL",
   "manifest.colorpicker.js": "sha384-Wqz0ZIbeIi7KarqqqSLsQk+7E/fMaKhb32hrq5/eWzX1yjqMrpPZKH8y+jZ3mfg+",
   "manifest.components.js": "sha384-73CB1A+LAGfNexkd7aT69APFSHMzix8irse9uzOkYehHHio4px3oR8JHJeaMH+jI",
-  "manifest.data.js": "sha384-PZiaRsDV4nnRGvmT8y2jEZV+BolcEZGJXbMJU75YqWGXI8b3y/L93zhhllovf4Go",
+  "manifest.data.js": "sha384-XDL6cgiej9q+11HT8cp/feCcq1ir0rq3FZYgWngW627DPQOSdmMQVy4sDK+j1qAm",
   "manifest.datepicker.js": "sha384-NEb/H4vuR3CFtRcodHsm3jJjrcYW2JMpDlQKlgwTrzpMMTcDkFKYXzAYJD0gZ7Ov",
-  "manifest.dropdowns.js": "sha384-9vRdtkgheqvl/2PEaAFJhQ/NCqrRO8NFOjCBNKSu1CDA+RXkIbUNBIZRST96asLe",
+  "manifest.dropdowns.js": "sha384-a2j9Z1LWolyZANlfeBc1aIFQ0kf0UDeOZ8TetulYbpRS6T/zaD/OWSMGvz+gRehX",
   "manifest.export.js": "sha384-RsTGzsPCBw3yO4+TdAGd4F+o3FnzUNlqnMBqtnn/kUfv7axpzRdPc2AnsExV/93c",
   "manifest.icons.js": "sha384-uOkboYrovjCpl22eey3Jaxpey+pOnot5NDnRRumcRxiR7IOVaRh1i20gYnWXR5dW",
   "manifest.localization.js": "sha384-M3HRb2Ma8PemfFeqq9rgWgw/+Vdb/8d5LGW2MFbVsXaWUPqr/mPuxWtl5Pv8wolL",
-  "manifest.markdown.js": "sha384-I3fa8r0OU1eHaD/1EmlzRd31HaezxisSABApJohZ74o9MrO4EA286WQChvmGUw0c",
+  "manifest.markdown.js": "sha384-IrtsTsNgCsKmrNQgnvrh5ETHdnrrsJeOg8r6zD5zfxEgXVUu+HZ6ai7e2iM9fXIM",
   "manifest.payments.js": "sha384-Ng5y5hZfMqrSLo1AbQ8ucOni/BaaYsbEj16WW7rwsgRKEaflE+6lQRoZSlLA4PMd",
   "manifest.resize.js": "sha384-S3v4RAJoA77LUH6MddYG9bx//dZX//up7XWeH69Ql2ge3bVHgC6mR/CJBe6y4nQI",
   "manifest.router.js": "sha384-Kpl5k/pWOrMJhkgFZ9UAtGXuH7FDEv24WGMACpNqV8DW5ZjcbC67SnVY42qUSn3X",
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-7cEl+Nh729ncqy5GtRYMqo5R4d257QPsoFm/hx9Znp9uV/D85pjxVzQ1fhiD+sO6",
-  "manifest.svg.js": "sha384-wPfasscODIO6pyMFNIqZ7/C12cR4QYDnVl/wYNhwBO7gFNBGrhimNzL18VTpMPIL",
+  "manifest.svg.js": "sha384-yAUSl5sTwyMSerR0zyuimuRNzySvKaGN9KuEBgu81MOjF1n5Y8PMtDfxUO6uHMHu",
   "manifest.tabs.js": "sha384-7Kb1EHIbqh1NOl8J1NMp087lcF1gVmwm55QNM3s7JamV6sYiH/WZbdnknAZFtsfW",
   "manifest.tailwind.js": "sha384-aHLvl2oSuUgy06VaBqhhByn5wWxqvnqxw6KCwehakKUS00F/s/Nb62umeASS6Y4P",
   "manifest.toasts.js": "sha384-ytd5rDbax/Ou9z23uedFXPZbxDPsk2E/pxCTq4WLvfv+os1qTI6kELp0kPp07g24",
-  "manifest.tooltips.js": "sha384-GaBa+oORH0y6LC0NyLy+RjAyh1pRglud0U5oZKZAQEaYSsrm/G0ir+RUNSnW0Geb",
+  "manifest.tooltips.js": "sha384-ADzAx9D0HWq2b46mvNG05iOwPmEWdiFZNpEOXONSbBxs4xj1B/bzNL7S3x2R9cS1",
   "manifest.url.parameters.js": "sha384-FIufiClqDx1rJpU/QUc9z/D43qClQ6Qm8rBahipbJl9BDHUvhrOsUDegmTWW7Tuf",
-  "manifest.utilities.js": "sha384-o6LAk/jJGclXUpC6nzReSRCaAVxaMrgAMhCNYCLz/H4HNdITpmmWk25Fzag4GSHI",
-  "manifest.js": "sha384-LosPV9wWLItaJan0+SjFzLGe3W2kVRORdy+gpr6YkQ7AKJkasmtAf6rbbvk3G37O"
+  "manifest.utilities.js": "sha384-Hl2tlhHgIJLEr3CFiEq79nlWCgx6nSVJCyThPCZi3wOFBLv/KXm/VrIZ0vRZqBi7",
+  "manifest.js": "sha384-vc0GN2LMS0zDdT2Oj4a7NwyR498zKDgyiLiBl4VjDFJB+XDMcrdBRBBY5yn7ixXK"
 }

package/lib/manifest.js

@@ -586,14 +586,38 @@
 		// the loader rather than borrowed from the data plugin because the
 		// data plugin's script may not have finished executing yet at the
 		// point we cache the manifest. window.env is populated by either
-		// the mnfst-run dev server (which reads .env at startup) or a
-		// developer-supplied <script>window.env = {…}</script> block.
+		// the mnfst-run dev server (which reads PUBLIC_-prefixed vars from
+		// .env at startup) or a developer-supplied
+		// <script>window.env = {…}</script> block.
+		//
+		// Misses are warned, not silently dropped: a missing var almost
+		// always means the dev forgot the PUBLIC_ prefix or hasn't set the
+		// var at all, and an empty substitution downstream (e.g. an empty
+		// API URL) tends to fail far from the cause.
+		const warnedMissingEnv = new Set();
 		const interpolateManifestEnv = (obj) => {
 			if (obj === null || typeof obj !== 'object') return;
 			const subst = (str) => str.replace(/\$\{([^}]+)\}/g, (m, name) => {
 				if (typeof window !== 'undefined' && window.env && window.env[name] !== undefined) {
 					return window.env[name];
 				}
+				if (!warnedMissingEnv.has(name)) {
+					warnedMissingEnv.add(name);
+					if (!name.startsWith('PUBLIC_')) {
+						console.warn(
+							`[Manifest] manifest.json references \${${name}}, but only PUBLIC_-prefixed ` +
+							`env vars are injected into window.env by mnfst-run. Rename to ` +
+							`PUBLIC_${name}, hardcode the value, or supply it via ` +
+							`<script>window.env = {…}</script>. Leaving placeholder literal.`
+						);
+					} else {
+						console.warn(
+							`[Manifest] manifest.json references \${${name}}, but it is not present ` +
+							`in window.env. Add ${name}=… to .env (read by mnfst-run) or ` +
+							`set it via <script>window.env = {…}</script>. Leaving placeholder literal.`
+						);
+					}
+				}
 				return m;
 			});
 			const walk = (o) => {

package/lib/manifest.markdown.js

@@ -43,7 +43,13 @@ if (!window.ManifestDOMPurify) {
             if (this._promise) return this._promise;
             this._promise = new Promise((resolve, reject) => {
                 const script = document.createElement('script');
-                script.src = 'https://cdn.jsdelivr.net/npm/dompurify@latest/dist/purify.min.js';
+                // Pinned + Subresource Integrity: a moving `@latest` (or a
+                // tampered CDN file) would otherwise run arbitrary JS in the
+                // user's page. The browser rejects the script if the bytes don't
+                // match the hash. Bump version AND integrity together.
+                script.src = 'https://cdn.jsdelivr.net/npm/dompurify@3.4.10/dist/purify.min.js';
+                script.integrity = 'sha384-eguRoJERj8ghOpzO//Rl7+ScQsQIR1cH+ajll7+fG+IpbNPlkZsQn9h8ccr+wPXx';
+                script.crossOrigin = 'anonymous';
                 script.onload = () => {
                     if (typeof window.DOMPurify !== 'undefined') {
                         resolve(window.DOMPurify);
@@ -96,7 +102,11 @@ async function loadMarkedJS() {
 
     markedPromise = new Promise((resolve, reject) => {
         const script = document.createElement('script');
-        script.src = 'https://cdn.jsdelivr.net/npm/marked/marked.min.js';
+        // Pinned + Subresource Integrity (see DOMPurify loader above) — a
+        // floating version or tampered CDN file can't inject arbitrary JS.
+        script.src = 'https://cdn.jsdelivr.net/npm/marked@15.0.12/marked.min.js';
+        script.integrity = 'sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+';
+        script.crossOrigin = 'anonymous';
         script.onload = () => {
             // Initialize marked.js
             if (typeof marked !== 'undefined') {