mnfst 0.5.99 → 0.5.101

package/lib/manifest.integrity.json

@@ -11,7 +11,7 @@
   "manifest.export.js": "sha384-qvdGz1TiGEDOeWJ5os1z03RURdKX+ezZEQ1KyV+9iC7X0esLK83mtY87t4MQv45t",
   "manifest.icons.js": "sha384-uOkboYrovjCpl22eey3Jaxpey+pOnot5NDnRRumcRxiR7IOVaRh1i20gYnWXR5dW",
   "manifest.localization.js": "sha384-M40EWrbWs2MoJvUiYVQaPxPiOzMYBn/ywuMR02rvoSXG77eIHT/aRoYub9r6+jC+",
-  "manifest.markdown.js": "sha384-3LgPiHrftPqAIJGhxi87C0TtfJXbsH0Qj4JmfmYgV4y5UjSx7nVSP+ppsRUWT0Xs",
+  "manifest.markdown.js": "sha384-H/Zg0ANrfokWWLR0js9zKd6yasP62sG+aga5r5WnmTd+LPMb93H97JlS8OQV7Ox9",
   "manifest.resize.js": "sha384-Ak5gf44ERfh9pOSAD1qZzJSysslpwBCkevIlz7R3dszTUyzUKGKGF4pn5arOtgG0",
   "manifest.router.js": "sha384-n6xmIfWnYzd/0kkVTFuHhFzHuxiDgZ1Lg1W0yB6/w3Myw5pQ6PgE6SJBHfVsO7/D",
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
@@ -22,5 +22,5 @@
   "manifest.tooltips.js": "sha384-Hhip5ZN66xhDw3m0XBrKLKLpcVRz3Z9RszPKqo6xvFF0mrUgQBVZ+mZjZsXgOOjS",
   "manifest.url.parameters.js": "sha384-FIufiClqDx1rJpU/QUc9z/D43qClQ6Qm8rBahipbJl9BDHUvhrOsUDegmTWW7Tuf",
   "manifest.utilities.js": "sha384-x07Pfi4UxK9tbdcOZgZ5jkveseT1xBUTFtO08ORcokCH64FHsUceoiAICAsRJMle",
-  "manifest.js": "sha384-CUFN8gbtQW6+fnxiBnx0nPw6kKDA21+He0KFoDE9FabfJPR4lKRXaT2PWpOOKUS+"
+  "manifest.js": "sha384-AaKRNJvva7ik7bhCXdE5Ic/PYL4mbxJv2hStF+xNaZfBfSiETMuVPtRlPVjgury3"
 }

package/lib/manifest.js

@@ -491,6 +491,41 @@
 		];
 		const manifestUrl = (document.querySelector('link[rel="manifest"]')?.getAttribute('href')) || '/manifest.json';
 
+		// Substitute ${VAR} placeholders against window.env in every string
+		// value of the parsed manifest, in place. Called once before the
+		// manifest is cached on window so every downstream consumer
+		// (auth, data, components, etc.) sees resolved values. Inlined in
+		// the loader rather than borrowed from the data plugin because the
+		// data plugin's script may not have finished executing yet at the
+		// point we cache the manifest. window.env is populated by either
+		// the mnfst-run dev server (which reads .env at startup) or a
+		// developer-supplied <script>window.env = {…}</script> block.
+		const interpolateManifestEnv = (obj) => {
+			if (obj === null || typeof obj !== 'object') return;
+			const subst = (str) => str.replace(/\$\{([^}]+)\}/g, (m, name) => {
+				if (typeof window !== 'undefined' && window.env && window.env[name] !== undefined) {
+					return window.env[name];
+				}
+				return m;
+			});
+			const walk = (o) => {
+				if (Array.isArray(o)) {
+					for (let i = 0; i < o.length; i++) {
+						const v = o[i];
+						if (typeof v === 'string') o[i] = subst(v);
+						else if (v && typeof v === 'object') walk(v);
+					}
+				} else {
+					for (const k of Object.keys(o)) {
+						const v = o[k];
+						if (typeof v === 'string') o[k] = subst(v);
+						else if (v && typeof v === 'object') walk(v);
+					}
+				}
+			};
+			walk(obj);
+		};
+
 		const loadPlugins = async () => {
 			let manifest = null;
 			let pluginsToLoad = config.plugins;
@@ -521,6 +556,12 @@
 				manifest = await manifestPromise;
 			}
 			if (manifest && typeof window !== 'undefined') {
+				// Resolve ${VAR} placeholders once, here, before any
+				// downstream plugin reads the cached manifest. Plugins like
+				// appwrite-auth read window.__manifestLoaded directly and
+				// would otherwise see literal `${APPWRITE_DEV_KEY}` strings
+				// even when window.env is populated.
+				interpolateManifestEnv(manifest);
 				window.__manifestLoaded = manifest;
 				if (window.ManifestComponentsRegistry) {
 					window.ManifestComponentsRegistry.manifest = manifest;

package/lib/manifest.markdown.js

@@ -346,8 +346,16 @@ function applyInlineCodeAttributes(html) {
     // Be conservative: only rewrite when the brace block immediately follows
     // a `<code>` close tag (no whitespace), so prose like "foo `bar` {note}" is
     // untouched.
+    //
+    // Body capture is `[^<]*` (not `[\s\S]*?`) so the match can't span across
+    // intermediate `<` characters — without this guard, an unmatched
+    // `<code>foo</code>` followed later by `<code>bar</code>{copy}` would be
+    // captured as ONE big match with body = "foo</code><…><code>bar". That
+    // bug surfaces noticeably in tables, where multiple codespans per row mix
+    // marked and unmarked instances. Marked HTML-escapes any literal `<` in
+    // codespan content to `&lt;`, so the restriction is safe.
     return html.replace(
-        /<code>([\s\S]*?)<\/code>\{([^}\n]+)\}/g,
+        /<code>([^<]*)<\/code>\{([^}\n]+)\}/g,
         (_, body, attrString) => {
             const tokens = attrString.trim().split(/\s+/).filter(Boolean);
             let language = '';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.99",
+    "version": "0.5.101",
     "private": false,
     "workspaces": [
         "templates/starter",