mnfst 0.5.267 → 0.5.268

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.267';
+const MANIFEST_BUILD_VERSION = '0.5.268';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.267';
+const MANIFEST_BUILD_VERSION = '0.5.268';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
   "manifest.appwrite.auth.js": "sha384-gWLSeVPqCLMiUZB8MU7GqMg3x2yULFUsp8nTTZrPp/9Dlkix42rBn9yIimvwrHqZ",
-  "manifest.appwrite.data.js": "sha384-81l7vI/UteYuZxU0z7NMMOC7nUzu8nMaB4JbGLHUbIxutpjeuD81PYsL7beVKsih",
+  "manifest.appwrite.data.js": "sha384-RH/7vbH/n5AA9HcChWPgenc/CLjTw0WmXhExvd9rPvpvLTHcn7a6XnbFj7WgTvh7",
   "manifest.appwrite.presences.js": "sha384-/CagPsgWhO1sWEevCNGJmZ/ezRK9YCjLjvF7hxNSM4gVlJmEVtfSLfF7wnsRq441",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-AFbP7mQnigy7DU1s+YE30yKTeQAKfgNazhbfSNbfd9ZpLgeulZKaPi/fAq3gJHDO",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-/lJo6vaxKjgnBSRs/dzkhK1dzGk3GBw8FISoNJZB70mwAVwu1k5veZyBXjOb4keS",
   "manifest.components.js": "sha384-BUFA8h+G5Plr82sV7bKzO42pPoiRZwRQcKj1lt2ROFiKjjlkayU/vmkAFqEsdBA+",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-aEAnoRnpJZaXR0AWUZ+pGF9Cu8qlPpFzlcT58DnMkaZuKC9yL0l36LdRPGlkPIx0",
+  "manifest.data.js": "sha384-0zOYRKpPT5mGZjqprhfxadWH+wgMRZD6EfWoSUNToxUu8khleX0Is2yF8pItoLZ5",
   "manifest.datepicker.js": "sha384-EzlMwvIxlla/0BuyhAEqxN0M8TGcWIWgEIg840V0akKQQK1uY648wPWMkobvtq/o",
   "manifest.defer.js": "sha384-5cHzFTbx+cZmGpk9FuiUtW3ciC9NvvHwJeHP7xL5yiZVp9PhMWVdQ7L9y6ju2yoo",
   "manifest.device.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
@@ -20,7 +20,7 @@
   "manifest.export.js": "sha384-C4W5LrGQFnSILRWoWOCliajUK6rAzNW+EliogRx72vD1cUOYScSdfzHNbjSWv5XU",
   "manifest.icons.js": "sha384-kKOINpX70YzNO3FvkV6umrmO3f0KIu0DNbwB+ej55a7y/lhU7v/myQtXL0bwCTbt",
   "manifest.localization.js": "sha384-EImsIw8Z3l13V5eH9ZJF/yfsOfIvR1oPRNSArANkPji7V8O3IRf6zMwsNiAGj3Hk",
-  "manifest.markdown.js": "sha384-8bZCrYOZ/s0lcZIU79YmB6U7/XOS0UgdjxNvWIVc/aSdQxPTXTCuFfkbvkS0DnPG",
+  "manifest.markdown.js": "sha384-icbpHC8dIijEJSaW3CODo4Ft7dBQz53pUh/2OYVBEFrLQbrFs370D+eMygJx5cW8",
   "manifest.native.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
   "manifest.rich.text.js": "sha384-ZBV9jXmu2nmprEHicddRE/m7nR4RPZtVc969Jte0+EJYBcVph7itkjcgN/61PyeC",
@@ -28,7 +28,7 @@
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-ofu7nBnVIGZ1U1o2R9d2H3V8aEMPUCVbl5FO3gIToXqi0oa36fTviEdh5UU7Kitw",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-BWZsM4KfbumoQMhr8aGWLpUgTDfWHEW6thJ4TbBoR/hA/clJcUbXNearDmqTK5vM",
+  "manifest.sw.js": "sha384-hH5Xmqs5NY7oWLl+NYD6exIoqg9TDi8HPHB3Jg/sWnHEZUJWNJwlXlMkAvbCSfu5",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-yuP3LEvWU+QVjxjkZ0YhErtC9RrGmhOmHjjFjhS9obqZbp5/KTIEnSR0CXDvHE0B",
   "manifest.toasts.js": "sha384-UpOz9fAdGeGUhL0NamBg5iPepEfIy73p9HYdcxfOQC5b7CVsl7Our0skdZzaLNcC",

package/lib/manifest.markdown.js

@@ -15,8 +15,35 @@ if (typeof window !== 'undefined') {
     });
 }
 
-// DOMPurify defaults for .safe: no custom elements, no directive or event attributes
-const MARKDOWN_PURIFY_CONFIG = {};
+// .safe: HTML only (no SVG/MathML, custom elements, directives or handlers), minus page-level styling, forms and media
+const MARKDOWN_PURIFY_CONFIG = {
+    USE_PROFILES: { html: true },
+    FORBID_TAGS: ['style', 'form', 'template', 'dialog', 'video', 'audio'],
+    FORBID_ATTR: ['style', 'popover', 'popovertarget', 'popovertargetaction', 'formaction', 'command', 'commandfor', 'autoplay', 'background'],
+    ALLOW_DATA_ATTR: false,
+    SANITIZE_NAMED_PROPS: true
+};
+// Callout classes only; any other class could compile to a utility (fixed inset-0 …)
+const MARKDOWN_SAFE_CLASSES = new Set(['brand', 'accent', 'positive', 'negative', 'frame']);
+
+function restrictSafeClasses(html) {
+    const t = document.createElement('template');
+    t.innerHTML = html;
+    t.content.querySelectorAll('input[type="image" i]').forEach(el => el.remove());
+    t.content.querySelectorAll('[class]').forEach(el => {
+        const keep = el.tagName === 'ASIDE' ? [...el.classList].filter(c => MARKDOWN_SAFE_CLASSES.has(c)) : [];
+        if (keep.length) el.setAttribute('class', keep.join(' '));
+        else el.removeAttribute('class');
+    });
+    // Ids carry DOMPurify's user-content- prefix; follow it in in-content anchors
+    t.content.querySelectorAll('a[href^="#"]').forEach(a => {
+        const raw = a.getAttribute('href').slice(1);
+        let id;
+        try { id = decodeURIComponent(raw); } catch { id = raw; }
+        if (id && t.content.getElementById('user-content-' + id)) a.setAttribute('href', '#user-content-' + id);
+    });
+    return t.innerHTML;
+}
 
 // Shared DOMPurify loader on window (svg.js or markdown, whichever loads first).
 // A top-level `let purifyPromise` would collide with svg.js's identical one.
@@ -57,7 +84,7 @@ async function maybeSanitizeMarkdownHtml(html, safe) {
     if (!safe) return html;
     try {
         const DOMPurify = await window.ManifestDOMPurify.load();
-        return DOMPurify.sanitize(html, MARKDOWN_PURIFY_CONFIG);
+        return restrictSafeClasses(DOMPurify.sanitize(html, MARKDOWN_PURIFY_CONFIG));
     } catch {
         // Loader failure — escape rather than emit un-sanitized HTML (.safe was asked for).
         const escaped = String(html)

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.267';
+const BUILD_VERSION = '0.5.268';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.267",
+    "version": "0.5.268",
     "private": false,
     "workspaces": [
         "templates/starter",
@@ -48,6 +48,7 @@
         "test:e2e:sw": "node tests/e2e/sw.e2e.mjs",
         "test:e2e:settle": "node tests/e2e/render-settle.e2e.mjs",
         "test:e2e:magic": "node tests/e2e/magic-one-arg.e2e.mjs",
+        "test:e2e:markdown-safe": "node tests/e2e/markdown-safe.e2e.mjs",
         "test:e2e:upload": "node tests/e2e/upload-first-load.e2e.mjs",
         "lint": "echo 'No linting configured'",
         "release:docs": "node scripts/release-bump.mjs packages/docs && cd packages/docs && npm publish --auth-type=web",
@@ -60,6 +61,7 @@
         "@tailwindcss/cli": "^4.2.4",
         "alpinejs": "3.17.5",
         "cssnano": "^7.1.1",
+        "dompurify": "3.4.10",
         "entities": "4.5.0",
         "glob": "^11.0.2",
         "happy-dom": "^20.11.6",