mnfst 0.5.266 → 0.5.268

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.266';
+const MANIFEST_BUILD_VERSION = '0.5.268';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.266';
+const MANIFEST_BUILD_VERSION = '0.5.268';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
   "manifest.appwrite.auth.js": "sha384-gWLSeVPqCLMiUZB8MU7GqMg3x2yULFUsp8nTTZrPp/9Dlkix42rBn9yIimvwrHqZ",
-  "manifest.appwrite.data.js": "sha384-lGkmd3KHrHnHOKFu4heKsASb7Vu7F3bbr9kKLAStDKSqyHCP5nwb0zt9NlHAlfTM",
+  "manifest.appwrite.data.js": "sha384-RH/7vbH/n5AA9HcChWPgenc/CLjTw0WmXhExvd9rPvpvLTHcn7a6XnbFj7WgTvh7",
   "manifest.appwrite.presences.js": "sha384-/CagPsgWhO1sWEevCNGJmZ/ezRK9YCjLjvF7hxNSM4gVlJmEVtfSLfF7wnsRq441",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-AFbP7mQnigy7DU1s+YE30yKTeQAKfgNazhbfSNbfd9ZpLgeulZKaPi/fAq3gJHDO",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-/lJo6vaxKjgnBSRs/dzkhK1dzGk3GBw8FISoNJZB70mwAVwu1k5veZyBXjOb4keS",
   "manifest.components.js": "sha384-BUFA8h+G5Plr82sV7bKzO42pPoiRZwRQcKj1lt2ROFiKjjlkayU/vmkAFqEsdBA+",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-FYX4So6jz/1Zj9B7Dxz+B7LpuqD+JZe5rUmtSwggRQe3t113dTjvXWjpanL/NfYI",
+  "manifest.data.js": "sha384-0zOYRKpPT5mGZjqprhfxadWH+wgMRZD6EfWoSUNToxUu8khleX0Is2yF8pItoLZ5",
   "manifest.datepicker.js": "sha384-EzlMwvIxlla/0BuyhAEqxN0M8TGcWIWgEIg840V0akKQQK1uY648wPWMkobvtq/o",
   "manifest.defer.js": "sha384-5cHzFTbx+cZmGpk9FuiUtW3ciC9NvvHwJeHP7xL5yiZVp9PhMWVdQ7L9y6ju2yoo",
   "manifest.device.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
@@ -20,7 +20,7 @@
   "manifest.export.js": "sha384-C4W5LrGQFnSILRWoWOCliajUK6rAzNW+EliogRx72vD1cUOYScSdfzHNbjSWv5XU",
   "manifest.icons.js": "sha384-kKOINpX70YzNO3FvkV6umrmO3f0KIu0DNbwB+ej55a7y/lhU7v/myQtXL0bwCTbt",
   "manifest.localization.js": "sha384-EImsIw8Z3l13V5eH9ZJF/yfsOfIvR1oPRNSArANkPji7V8O3IRf6zMwsNiAGj3Hk",
-  "manifest.markdown.js": "sha384-SQqvC175/Ai3yLNjWNK1EOwrxVpoCrZVFSfzA5wg2btrQPQmNNQk3ICGeBY6f502",
+  "manifest.markdown.js": "sha384-icbpHC8dIijEJSaW3CODo4Ft7dBQz53pUh/2OYVBEFrLQbrFs370D+eMygJx5cW8",
   "manifest.native.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
   "manifest.rich.text.js": "sha384-ZBV9jXmu2nmprEHicddRE/m7nR4RPZtVc969Jte0+EJYBcVph7itkjcgN/61PyeC",
@@ -28,10 +28,10 @@
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-ofu7nBnVIGZ1U1o2R9d2H3V8aEMPUCVbl5FO3gIToXqi0oa36fTviEdh5UU7Kitw",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-pmKqe+pl5NMyIv9E96g8if5y+/wVzeNGwUt8PWPgeMpCOQui/xNqk64kezmI2qKP",
+  "manifest.sw.js": "sha384-hH5Xmqs5NY7oWLl+NYD6exIoqg9TDi8HPHB3Jg/sWnHEZUJWNJwlXlMkAvbCSfu5",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-yuP3LEvWU+QVjxjkZ0YhErtC9RrGmhOmHjjFjhS9obqZbp5/KTIEnSR0CXDvHE0B",
-  "manifest.toasts.js": "sha384-3zkWxzw693pxg3QDFsoYCA3CqYaLKmBaMArULXODD66Utolpewl0OAeTB92aWUVv",
+  "manifest.toasts.js": "sha384-UpOz9fAdGeGUhL0NamBg5iPepEfIy73p9HYdcxfOQC5b7CVsl7Our0skdZzaLNcC",
   "manifest.tooltips.js": "sha384-hXGp5j0s6p2kGZY/hqLPEbaUv68ca63kFCjYiZqK3DcC12mpHTBy1vz3kuApyf4p",
   "manifest.url.parameters.js": "sha384-J2aSVBOPsoqsbafHndrWLHEDpKb4AKJAoQnVmKA4gZh5P/8HHjFWHO/lkusmG84l",
   "manifest.utilities.js": "sha384-h17EquaRtNcEW0yfhk7R+a+2+CzTlBxPuFryO6i9NV/OiIRMihREoyzQ77QawoQ7",

package/lib/manifest.markdown.js

@@ -15,15 +15,35 @@ if (typeof window !== 'undefined') {
     });
 }
 
-// DOMPurify config for Manifest markdown: allow x-* custom elements and
-// directive attributes to survive, but reject on* event handlers.
+// .safe: HTML only (no SVG/MathML, custom elements, directives or handlers), minus page-level styling, forms and media
 const MARKDOWN_PURIFY_CONFIG = {
-    CUSTOM_ELEMENT_HANDLING: {
-        tagNameCheck: /^x-[a-z][\w-]*$/,
-        attributeNameCheck: /^(?!on)[a-z][\w\-:]*$/i,
-        allowCustomizedBuiltInElements: false
-    }
+    USE_PROFILES: { html: true },
+    FORBID_TAGS: ['style', 'form', 'template', 'dialog', 'video', 'audio'],
+    FORBID_ATTR: ['style', 'popover', 'popovertarget', 'popovertargetaction', 'formaction', 'command', 'commandfor', 'autoplay', 'background'],
+    ALLOW_DATA_ATTR: false,
+    SANITIZE_NAMED_PROPS: true
 };
+// Callout classes only; any other class could compile to a utility (fixed inset-0 …)
+const MARKDOWN_SAFE_CLASSES = new Set(['brand', 'accent', 'positive', 'negative', 'frame']);
+
+function restrictSafeClasses(html) {
+    const t = document.createElement('template');
+    t.innerHTML = html;
+    t.content.querySelectorAll('input[type="image" i]').forEach(el => el.remove());
+    t.content.querySelectorAll('[class]').forEach(el => {
+        const keep = el.tagName === 'ASIDE' ? [...el.classList].filter(c => MARKDOWN_SAFE_CLASSES.has(c)) : [];
+        if (keep.length) el.setAttribute('class', keep.join(' '));
+        else el.removeAttribute('class');
+    });
+    // Ids carry DOMPurify's user-content- prefix; follow it in in-content anchors
+    t.content.querySelectorAll('a[href^="#"]').forEach(a => {
+        const raw = a.getAttribute('href').slice(1);
+        let id;
+        try { id = decodeURIComponent(raw); } catch { id = raw; }
+        if (id && t.content.getElementById('user-content-' + id)) a.setAttribute('href', '#user-content-' + id);
+    });
+    return t.innerHTML;
+}
 
 // Shared DOMPurify loader on window (svg.js or markdown, whichever loads first).
 // A top-level `let purifyPromise` would collide with svg.js's identical one.
@@ -64,7 +84,7 @@ async function maybeSanitizeMarkdownHtml(html, safe) {
     if (!safe) return html;
     try {
         const DOMPurify = await window.ManifestDOMPurify.load();
-        return DOMPurify.sanitize(html, MARKDOWN_PURIFY_CONFIG);
+        return restrictSafeClasses(DOMPurify.sanitize(html, MARKDOWN_PURIFY_CONFIG));
     } catch {
         // Loader failure — escape rather than emit un-sanitized HTML (.safe was asked for).
         const escaped = String(html)
@@ -243,10 +263,10 @@ async function configureMarked(marked) {
 
                 const iconHtml = iconValue ? `<span x-icon="${escapeForAttribute(iconValue)}"></span>` : '';
 
-                // Count top-level elements
-                const temp = document.createElement('div');
+                // Count top-level elements (inert parse: content isn't sanitized yet)
+                const temp = document.createElement('template');
                 temp.innerHTML = parsedContent;
-                const elementCount = temp.children.length;
+                const elementCount = temp.content.children.length;
 
                 // Wrap only when there's an icon plus 2+ elements (icon needs a sibling wrapper).
                 const needsWrapper = elementCount >= 2 && iconValue;
@@ -282,10 +302,10 @@ function renderXCodeGroup(markdown) {
 
 // Enable task-list checkboxes by removing marked's disabled attribute.
 function enableCheckboxes(html) {
-    const temp = document.createElement('div');
+    const temp = document.createElement('template');
     temp.innerHTML = html;
 
-    const checkboxes = temp.querySelectorAll('input[type="checkbox"]');
+    const checkboxes = temp.content.querySelectorAll('input[type="checkbox"]');
     checkboxes.forEach(checkbox => {
         checkbox.removeAttribute('disabled');
     });

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.266';
+const BUILD_VERSION = '0.5.268';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/lib/manifest.toasts.js

@@ -81,7 +81,7 @@ function initializeToastPlugin() {
     };
 
     // Helper function to show toast
-    const showToast = (message, { type = '', duration = TOAST_DURATION, dismissible = false, fixed = false, icon = null } = {}) => {
+    const showToast = (message, { type = '', duration = TOAST_DURATION, dismissible = false, fixed = false, icon = null, html = false } = {}) => {
         const container = getContainer();
 
         // Create toast element
@@ -99,12 +99,17 @@ function initializeToastPlugin() {
         // Create content with optional icon
         const contentHtml = `
             ${icon ? '<span class="toast-icon"></span>' : ''}
-            <div class="toast-content">${message}</div>
+            <div class="toast-content"></div>
             ${dismissible || fixed ? '<button class="toast-dismiss-button" aria-label="Dismiss"></button>' : ''}
         `;
 
         toast.innerHTML = contentHtml;
 
+        // Text by default; author markup and the html opt-in render as HTML
+        const content = toast.querySelector('.toast-content');
+        if (html) content.innerHTML = message;
+        else content.textContent = message;
+
         // Add icon if specified
         if (icon) {
             const iconContainer = toast.querySelector('.toast-icon');
@@ -188,6 +193,7 @@ function initializeToastPlugin() {
             dismissible: modifiers.includes('dismiss'),
             fixed: modifiers.includes('fixed')
         };
+        const htmlOptIn = modifiers.includes('html');
 
         // Find duration modifier (any number)
         const durationModifier = modifiers.find(mod => !isNaN(mod));
@@ -198,7 +204,7 @@ function initializeToastPlugin() {
         }
 
         // Static text (author HTML included) shows as written; expressions
-        // evaluate on every click. Empty results (null, false, '') show nothing.
+        // evaluate on every click as text unless .html. Empty results (null, false, '') show nothing.
         const src = expression.trim();
         const evaluate = expressionResolver(el, src, evaluateLater);
         if (evaluate && src.startsWith('$x.')) evaluate(() => {}); // starts the source loading
@@ -211,12 +217,12 @@ function initializeToastPlugin() {
                 originalClick.call(el, e);
             }
             // Show toast after original handler
-            if (!evaluate) { showToast(expression, options); return; }
+            if (!evaluate) { showToast(expression, { ...options, html: true }); return; }
             // After the element's other click listeners, so state they change shows
             setTimeout(() => evaluate((v, asText) => {
-                if (asText) { showToast(expression, options); return; }
+                if (asText) { showToast(expression, { ...options, html: true }); return; }
                 const message = v == null || v === false ? '' : String(v);
-                if (message !== '') showToast(message, options);
+                if (message !== '') showToast(message, { ...options, html: htmlOptIn });
             }));
         };
     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.266",
+    "version": "0.5.268",
     "private": false,
     "workspaces": [
         "templates/starter",
@@ -48,6 +48,7 @@
         "test:e2e:sw": "node tests/e2e/sw.e2e.mjs",
         "test:e2e:settle": "node tests/e2e/render-settle.e2e.mjs",
         "test:e2e:magic": "node tests/e2e/magic-one-arg.e2e.mjs",
+        "test:e2e:markdown-safe": "node tests/e2e/markdown-safe.e2e.mjs",
         "test:e2e:upload": "node tests/e2e/upload-first-load.e2e.mjs",
         "lint": "echo 'No linting configured'",
         "release:docs": "node scripts/release-bump.mjs packages/docs && cd packages/docs && npm publish --auth-type=web",
@@ -60,6 +61,7 @@
         "@tailwindcss/cli": "^4.2.4",
         "alpinejs": "3.17.5",
         "cssnano": "^7.1.1",
+        "dompurify": "3.4.10",
         "entities": "4.5.0",
         "glob": "^11.0.2",
         "happy-dom": "^20.11.6",