mnfst 0.5.266 → 0.5.267

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.266';
+const MANIFEST_BUILD_VERSION = '0.5.267';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.266';
+const MANIFEST_BUILD_VERSION = '0.5.267';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
   "manifest.appwrite.auth.js": "sha384-gWLSeVPqCLMiUZB8MU7GqMg3x2yULFUsp8nTTZrPp/9Dlkix42rBn9yIimvwrHqZ",
-  "manifest.appwrite.data.js": "sha384-lGkmd3KHrHnHOKFu4heKsASb7Vu7F3bbr9kKLAStDKSqyHCP5nwb0zt9NlHAlfTM",
+  "manifest.appwrite.data.js": "sha384-81l7vI/UteYuZxU0z7NMMOC7nUzu8nMaB4JbGLHUbIxutpjeuD81PYsL7beVKsih",
   "manifest.appwrite.presences.js": "sha384-/CagPsgWhO1sWEevCNGJmZ/ezRK9YCjLjvF7hxNSM4gVlJmEVtfSLfF7wnsRq441",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-AFbP7mQnigy7DU1s+YE30yKTeQAKfgNazhbfSNbfd9ZpLgeulZKaPi/fAq3gJHDO",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-/lJo6vaxKjgnBSRs/dzkhK1dzGk3GBw8FISoNJZB70mwAVwu1k5veZyBXjOb4keS",
   "manifest.components.js": "sha384-BUFA8h+G5Plr82sV7bKzO42pPoiRZwRQcKj1lt2ROFiKjjlkayU/vmkAFqEsdBA+",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-FYX4So6jz/1Zj9B7Dxz+B7LpuqD+JZe5rUmtSwggRQe3t113dTjvXWjpanL/NfYI",
+  "manifest.data.js": "sha384-aEAnoRnpJZaXR0AWUZ+pGF9Cu8qlPpFzlcT58DnMkaZuKC9yL0l36LdRPGlkPIx0",
   "manifest.datepicker.js": "sha384-EzlMwvIxlla/0BuyhAEqxN0M8TGcWIWgEIg840V0akKQQK1uY648wPWMkobvtq/o",
   "manifest.defer.js": "sha384-5cHzFTbx+cZmGpk9FuiUtW3ciC9NvvHwJeHP7xL5yiZVp9PhMWVdQ7L9y6ju2yoo",
   "manifest.device.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
@@ -20,7 +20,7 @@
   "manifest.export.js": "sha384-C4W5LrGQFnSILRWoWOCliajUK6rAzNW+EliogRx72vD1cUOYScSdfzHNbjSWv5XU",
   "manifest.icons.js": "sha384-kKOINpX70YzNO3FvkV6umrmO3f0KIu0DNbwB+ej55a7y/lhU7v/myQtXL0bwCTbt",
   "manifest.localization.js": "sha384-EImsIw8Z3l13V5eH9ZJF/yfsOfIvR1oPRNSArANkPji7V8O3IRf6zMwsNiAGj3Hk",
-  "manifest.markdown.js": "sha384-SQqvC175/Ai3yLNjWNK1EOwrxVpoCrZVFSfzA5wg2btrQPQmNNQk3ICGeBY6f502",
+  "manifest.markdown.js": "sha384-8bZCrYOZ/s0lcZIU79YmB6U7/XOS0UgdjxNvWIVc/aSdQxPTXTCuFfkbvkS0DnPG",
   "manifest.native.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
   "manifest.rich.text.js": "sha384-ZBV9jXmu2nmprEHicddRE/m7nR4RPZtVc969Jte0+EJYBcVph7itkjcgN/61PyeC",
@@ -28,10 +28,10 @@
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-ofu7nBnVIGZ1U1o2R9d2H3V8aEMPUCVbl5FO3gIToXqi0oa36fTviEdh5UU7Kitw",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-pmKqe+pl5NMyIv9E96g8if5y+/wVzeNGwUt8PWPgeMpCOQui/xNqk64kezmI2qKP",
+  "manifest.sw.js": "sha384-BWZsM4KfbumoQMhr8aGWLpUgTDfWHEW6thJ4TbBoR/hA/clJcUbXNearDmqTK5vM",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-yuP3LEvWU+QVjxjkZ0YhErtC9RrGmhOmHjjFjhS9obqZbp5/KTIEnSR0CXDvHE0B",
-  "manifest.toasts.js": "sha384-3zkWxzw693pxg3QDFsoYCA3CqYaLKmBaMArULXODD66Utolpewl0OAeTB92aWUVv",
+  "manifest.toasts.js": "sha384-UpOz9fAdGeGUhL0NamBg5iPepEfIy73p9HYdcxfOQC5b7CVsl7Our0skdZzaLNcC",
   "manifest.tooltips.js": "sha384-hXGp5j0s6p2kGZY/hqLPEbaUv68ca63kFCjYiZqK3DcC12mpHTBy1vz3kuApyf4p",
   "manifest.url.parameters.js": "sha384-J2aSVBOPsoqsbafHndrWLHEDpKb4AKJAoQnVmKA4gZh5P/8HHjFWHO/lkusmG84l",
   "manifest.utilities.js": "sha384-h17EquaRtNcEW0yfhk7R+a+2+CzTlBxPuFryO6i9NV/OiIRMihREoyzQ77QawoQ7",

package/lib/manifest.markdown.js

@@ -15,15 +15,8 @@ if (typeof window !== 'undefined') {
     });
 }
 
-// DOMPurify config for Manifest markdown: allow x-* custom elements and
-// directive attributes to survive, but reject on* event handlers.
-const MARKDOWN_PURIFY_CONFIG = {
-    CUSTOM_ELEMENT_HANDLING: {
-        tagNameCheck: /^x-[a-z][\w-]*$/,
-        attributeNameCheck: /^(?!on)[a-z][\w\-:]*$/i,
-        allowCustomizedBuiltInElements: false
-    }
-};
+// DOMPurify defaults for .safe: no custom elements, no directive or event attributes
+const MARKDOWN_PURIFY_CONFIG = {};
 
 // Shared DOMPurify loader on window (svg.js or markdown, whichever loads first).
 // A top-level `let purifyPromise` would collide with svg.js's identical one.
@@ -243,10 +236,10 @@ async function configureMarked(marked) {
 
                 const iconHtml = iconValue ? `<span x-icon="${escapeForAttribute(iconValue)}"></span>` : '';
 
-                // Count top-level elements
-                const temp = document.createElement('div');
+                // Count top-level elements (inert parse: content isn't sanitized yet)
+                const temp = document.createElement('template');
                 temp.innerHTML = parsedContent;
-                const elementCount = temp.children.length;
+                const elementCount = temp.content.children.length;
 
                 // Wrap only when there's an icon plus 2+ elements (icon needs a sibling wrapper).
                 const needsWrapper = elementCount >= 2 && iconValue;
@@ -282,10 +275,10 @@ function renderXCodeGroup(markdown) {
 
 // Enable task-list checkboxes by removing marked's disabled attribute.
 function enableCheckboxes(html) {
-    const temp = document.createElement('div');
+    const temp = document.createElement('template');
     temp.innerHTML = html;
 
-    const checkboxes = temp.querySelectorAll('input[type="checkbox"]');
+    const checkboxes = temp.content.querySelectorAll('input[type="checkbox"]');
     checkboxes.forEach(checkbox => {
         checkbox.removeAttribute('disabled');
     });

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.266';
+const BUILD_VERSION = '0.5.267';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/lib/manifest.toasts.js

@@ -81,7 +81,7 @@ function initializeToastPlugin() {
     };
 
     // Helper function to show toast
-    const showToast = (message, { type = '', duration = TOAST_DURATION, dismissible = false, fixed = false, icon = null } = {}) => {
+    const showToast = (message, { type = '', duration = TOAST_DURATION, dismissible = false, fixed = false, icon = null, html = false } = {}) => {
         const container = getContainer();
 
         // Create toast element
@@ -99,12 +99,17 @@ function initializeToastPlugin() {
         // Create content with optional icon
         const contentHtml = `
             ${icon ? '<span class="toast-icon"></span>' : ''}
-            <div class="toast-content">${message}</div>
+            <div class="toast-content"></div>
             ${dismissible || fixed ? '<button class="toast-dismiss-button" aria-label="Dismiss"></button>' : ''}
         `;
 
         toast.innerHTML = contentHtml;
 
+        // Text by default; author markup and the html opt-in render as HTML
+        const content = toast.querySelector('.toast-content');
+        if (html) content.innerHTML = message;
+        else content.textContent = message;
+
         // Add icon if specified
         if (icon) {
             const iconContainer = toast.querySelector('.toast-icon');
@@ -188,6 +193,7 @@ function initializeToastPlugin() {
             dismissible: modifiers.includes('dismiss'),
             fixed: modifiers.includes('fixed')
         };
+        const htmlOptIn = modifiers.includes('html');
 
         // Find duration modifier (any number)
         const durationModifier = modifiers.find(mod => !isNaN(mod));
@@ -198,7 +204,7 @@ function initializeToastPlugin() {
         }
 
         // Static text (author HTML included) shows as written; expressions
-        // evaluate on every click. Empty results (null, false, '') show nothing.
+        // evaluate on every click as text unless .html. Empty results (null, false, '') show nothing.
         const src = expression.trim();
         const evaluate = expressionResolver(el, src, evaluateLater);
         if (evaluate && src.startsWith('$x.')) evaluate(() => {}); // starts the source loading
@@ -211,12 +217,12 @@ function initializeToastPlugin() {
                 originalClick.call(el, e);
             }
             // Show toast after original handler
-            if (!evaluate) { showToast(expression, options); return; }
+            if (!evaluate) { showToast(expression, { ...options, html: true }); return; }
             // After the element's other click listeners, so state they change shows
             setTimeout(() => evaluate((v, asText) => {
-                if (asText) { showToast(expression, options); return; }
+                if (asText) { showToast(expression, { ...options, html: true }); return; }
                 const message = v == null || v === false ? '' : String(v);
-                if (message !== '') showToast(message, options);
+                if (message !== '') showToast(message, { ...options, html: htmlOptIn });
             }));
         };
     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.266",
+    "version": "0.5.267",
     "private": false,
     "workspaces": [
         "templates/starter",