origam 2.2.1 → 2.5.0

package/dist/src/utils/Textarea/sanitize-html.util.cjs

@@ -0,0 +1,82 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sanitizeHtml = sanitizeHtml;
+var _consts = require("../../consts/index.cjs");
+function sanitizeHtml(input) {
+  if (input == null || input === "") return "";
+  if (typeof input !== "string") return "";
+  if (typeof DOMParser === "undefined") return input;
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(`<div id="__origam_root__">${input}</div>`, "text/html");
+  const root = doc.getElementById("__origam_root__");
+  if (!root) return "";
+  walk(root);
+  return root.innerHTML;
+}
+function walk(node) {
+  const children = Array.from(node.children);
+  for (const child of children) {
+    const tag = child.tagName.toLowerCase();
+    if (_consts.BLOCKED_TAGS.includes(tag)) {
+      child.remove();
+      continue;
+    }
+    if (!_consts.ALLOWED_TAGS.includes(tag)) {
+      walk(child);
+      unwrap(child);
+      continue;
+    }
+    sanitizeAttributes(child, tag);
+    walk(child);
+  }
+}
+function unwrap(el) {
+  const parent = el.parentNode;
+  if (!parent) {
+    el.remove();
+    return;
+  }
+  while (el.firstChild) parent.insertBefore(el.firstChild, el);
+  parent.removeChild(el);
+}
+function sanitizeAttributes(el, tag) {
+  const allowed = _consts.ALLOWED_ATTRIBUTES[tag] ?? [];
+  const attrs = Array.from(el.attributes);
+  for (const attr of attrs) {
+    const name = attr.name.toLowerCase();
+    if (name.startsWith("on")) {
+      el.removeAttribute(attr.name);
+      continue;
+    }
+    if (!allowed.includes(name)) {
+      el.removeAttribute(attr.name);
+      continue;
+    }
+    if (name === "href") {
+      if (!isSafeUrl(attr.value)) {
+        el.removeAttribute(attr.name);
+        continue;
+      }
+      ;
+      el.setAttribute("rel", "noopener noreferrer nofollow");
+      el.setAttribute("target", "_blank");
+    }
+    if (name === "class") {
+      const cleaned = filterClassList(attr.value);
+      if (cleaned === "") el.removeAttribute(attr.name);else el.setAttribute(attr.name, cleaned);
+    }
+  }
+}
+function isSafeUrl(raw) {
+  const value = String(raw).trim();
+  if (value === "") return false;
+  if (value.startsWith("/") || value.startsWith("#") || value.startsWith("?")) return true;
+  const lower = value.toLowerCase();
+  return _consts.ALLOWED_URL_SCHEMES.some(scheme => lower.startsWith(scheme));
+}
+function filterClassList(value) {
+  return String(value).split(/\s+/).filter(cls => cls.startsWith(_consts.ALLOWED_CLASS_PREFIX)).join(" ");
+}

package/dist/src/utils/Textarea/sanitize-html.util.d.ts

@@ -0,0 +1,17 @@
+/**
+ * In-house HTML sanitiser used by `OrigamTextareaField` in `mode="rich"`.
+ *
+ * It walks a `DOMParser`-built DOM, then for each element:
+ *  - drops the subtree if the tag is in `BLOCKED_TAGS`;
+ *  - keeps the tag (filtering attributes) when it's in `ALLOWED_TAGS`;
+ *  - otherwise unwraps it (children promoted to the parent).
+ *
+ * On `<a>` the href is validated against `ALLOWED_URL_SCHEMES`. Any
+ * attribute starting with `on` is dropped before per-tag filtering —
+ * defense in depth against event-handler smuggling.
+ *
+ * SSR safe: returns the raw input untouched when `DOMParser` is missing
+ * (the rich mode never runs server-side because the contenteditable
+ * surface is gated behind `onMounted`).
+ */
+export declare function sanitizeHtml(input: string): string;

package/dist/src/utils/Textarea/sanitize-html.util.js

@@ -0,0 +1,83 @@
+import {
+  ALLOWED_ATTRIBUTES,
+  ALLOWED_CLASS_PREFIX,
+  ALLOWED_TAGS,
+  ALLOWED_URL_SCHEMES,
+  BLOCKED_TAGS
+} from "../../consts/index.js";
+export function sanitizeHtml(input) {
+  if (input == null || input === "") return "";
+  if (typeof input !== "string") return "";
+  if (typeof DOMParser === "undefined") return input;
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(`<div id="__origam_root__">${input}</div>`, "text/html");
+  const root = doc.getElementById("__origam_root__");
+  if (!root) return "";
+  walk(root);
+  return root.innerHTML;
+}
+function walk(node) {
+  const children = Array.from(node.children);
+  for (const child of children) {
+    const tag = child.tagName.toLowerCase();
+    if (BLOCKED_TAGS.includes(tag)) {
+      child.remove();
+      continue;
+    }
+    if (!ALLOWED_TAGS.includes(tag)) {
+      walk(child);
+      unwrap(child);
+      continue;
+    }
+    sanitizeAttributes(child, tag);
+    walk(child);
+  }
+}
+function unwrap(el) {
+  const parent = el.parentNode;
+  if (!parent) {
+    el.remove();
+    return;
+  }
+  while (el.firstChild) parent.insertBefore(el.firstChild, el);
+  parent.removeChild(el);
+}
+function sanitizeAttributes(el, tag) {
+  const allowed = ALLOWED_ATTRIBUTES[tag] ?? [];
+  const attrs = Array.from(el.attributes);
+  for (const attr of attrs) {
+    const name = attr.name.toLowerCase();
+    if (name.startsWith("on")) {
+      el.removeAttribute(attr.name);
+      continue;
+    }
+    if (!allowed.includes(name)) {
+      el.removeAttribute(attr.name);
+      continue;
+    }
+    if (name === "href") {
+      if (!isSafeUrl(attr.value)) {
+        el.removeAttribute(attr.name);
+        continue;
+      }
+      ;
+      el.setAttribute("rel", "noopener noreferrer nofollow");
+      el.setAttribute("target", "_blank");
+    }
+    if (name === "class") {
+      const cleaned = filterClassList(attr.value);
+      if (cleaned === "") el.removeAttribute(attr.name);
+      else el.setAttribute(attr.name, cleaned);
+    }
+  }
+}
+function isSafeUrl(raw) {
+  const value = String(raw).trim();
+  if (value === "") return false;
+  if (value.startsWith("/") || value.startsWith("#") || value.startsWith("?")) return true;
+  const lower = value.toLowerCase();
+  return ALLOWED_URL_SCHEMES.some((scheme) => lower.startsWith(scheme));
+}
+function filterClassList(value) {
+  return String(value).split(/\s+/).filter((cls) => cls.startsWith(ALLOWED_CLASS_PREFIX)).join(" ");
+}

package/dist/src/utils/index.cjs

@@ -3,6 +3,17 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+var _formatTime = require("./Media/format-time.util.cjs");
+Object.keys(_formatTime).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _formatTime[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _formatTime[key];
+    }
+  });
+});
 var _anchor = require("./Commons/anchor.util.cjs");
 Object.keys(_anchor).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -36,6 +47,17 @@ Object.keys(_color).forEach(function (key) {
     }
   });
 });
+var _gradient = require("./Commons/gradient.util.cjs");
+Object.keys(_gradient).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _gradient[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _gradient[key];
+    }
+  });
+});
 var _commons = require("./Commons/commons.util.cjs");
 Object.keys(_commons).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -509,17 +531,6 @@ Object.keys(_slideGroup).forEach(function (key) {
     }
   });
 });
-var _sliderField = require("./SliderField/slider-field.util.cjs");
-Object.keys(_sliderField).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (key in exports && exports[key] === _sliderField[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _sliderField[key];
-    }
-  });
-});
 var _parallaxElement = require("./Parallax/parallax-element.util.cjs");
 Object.keys(_parallaxElement).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -575,14 +586,113 @@ Object.keys(_group2).forEach(function (key) {
     }
   });
 });
-var _chart = require("./Charts/chart.util.cjs");
-Object.keys(_chart).forEach(function (key) {
+var _fuzzyMatch = require("./CommandPalette/fuzzy-match.util.cjs");
+Object.keys(_fuzzyMatch).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _fuzzyMatch[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _fuzzyMatch[key];
+    }
+  });
+});
+var _parseHighlightLines = require("./Code/parse-highlight-lines.util.cjs");
+Object.keys(_parseHighlightLines).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _parseHighlightLines[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _parseHighlightLines[key];
+    }
+  });
+});
+var _sanitizeHtml = require("./Textarea/sanitize-html.util.cjs");
+Object.keys(_sanitizeHtml).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _sanitizeHtml[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _sanitizeHtml[key];
+    }
+  });
+});
+var _htmlToMarkdown = require("./Textarea/html-to-markdown.util.cjs");
+Object.keys(_htmlToMarkdown).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _htmlToMarkdown[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _htmlToMarkdown[key];
+    }
+  });
+});
+var _applyMask = require("./Mask/apply-mask.util.cjs");
+Object.keys(_applyMask).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _applyMask[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _applyMask[key];
+    }
+  });
+});
+var _resolveMaskConfig = require("./Mask/resolve-mask-config.util.cjs");
+Object.keys(_resolveMaskConfig).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _resolveMaskConfig[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _resolveMaskConfig[key];
+    }
+  });
+});
+var _validatePattern = require("./Mask/validate-pattern.util.cjs");
+Object.keys(_validatePattern).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _validatePattern[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _validatePattern[key];
+    }
+  });
+});
+var _qrCodeAdapters = require("./QrCode/qr-code-adapters.util.cjs");
+Object.keys(_qrCodeAdapters).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _qrCodeAdapters[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _qrCodeAdapters[key];
+    }
+  });
+});
+var _path = require("./Chart/path.util.cjs");
+Object.keys(_path).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _path[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _path[key];
+    }
+  });
+});
+var _mercator = require("./Chart/mercator.util.cjs");
+Object.keys(_mercator).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
-  if (key in exports && exports[key] === _chart[key]) return;
+  if (key in exports && exports[key] === _mercator[key]) return;
   Object.defineProperty(exports, key, {
     enumerable: true,
     get: function () {
-      return _chart[key];
+      return _mercator[key];
     }
   });
 });

package/dist/src/utils/index.d.ts

@@ -1,6 +1,8 @@
+export * from './Media/format-time.util';
 export * from './Commons/anchor.util';
 export * from './Commons/border.util';
 export * from './Commons/color.util';
+export * from './Commons/gradient.util';
 export * from './Commons/commons.util';
 export * from './Commons/console.util';
 export * from './Commons/date.util';
@@ -44,10 +46,18 @@ export * from './Input/input.util';
 export * from './List/list-item.util';
 export * from './Transition/transition.util';
 export * from './Slide/slide-group.util';
-export * from './SliderField/slider-field.util';
 export * from './Parallax/parallax-element.util';
 export * from './DataTable/headers.util';
 export * from './DataTable/items.util';
 export * from './DataTable/sort.util';
 export * from './DataTable/group.util';
-export * from './Charts/chart.util';
+export * from './CommandPalette/fuzzy-match.util';
+export * from './Code/parse-highlight-lines.util';
+export * from './Textarea/sanitize-html.util';
+export * from './Textarea/html-to-markdown.util';
+export * from './Mask/apply-mask.util';
+export * from './Mask/resolve-mask-config.util';
+export * from './Mask/validate-pattern.util';
+export * from './QrCode/qr-code-adapters.util';
+export * from './Chart/path.util';
+export * from './Chart/mercator.util';

package/dist/src/utils/index.js

@@ -1,6 +1,8 @@
+export * from "./Media/format-time.util.js";
 export * from "./Commons/anchor.util.js";
 export * from "./Commons/border.util.js";
 export * from "./Commons/color.util.js";
+export * from "./Commons/gradient.util.js";
 export * from "./Commons/commons.util.js";
 export * from "./Commons/console.util.js";
 export * from "./Commons/date.util.js";
@@ -44,10 +46,18 @@ export * from "./Input/input.util.js";
 export * from "./List/list-item.util.js";
 export * from "./Transition/transition.util.js";
 export * from "./Slide/slide-group.util.js";
-export * from "./SliderField/slider-field.util.js";
 export * from "./Parallax/parallax-element.util.js";
 export * from "./DataTable/headers.util.js";
 export * from "./DataTable/items.util.js";
 export * from "./DataTable/sort.util.js";
 export * from "./DataTable/group.util.js";
-export * from "./Charts/chart.util.js";
+export * from "./CommandPalette/fuzzy-match.util.js";
+export * from "./Code/parse-highlight-lines.util.js";
+export * from "./Textarea/sanitize-html.util.js";
+export * from "./Textarea/html-to-markdown.util.js";
+export * from "./Mask/apply-mask.util.js";
+export * from "./Mask/resolve-mask-config.util.js";
+export * from "./Mask/validate-pattern.util.js";
+export * from "./QrCode/qr-code-adapters.util.js";
+export * from "./Chart/path.util.js";
+export * from "./Chart/mercator.util.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "origam",
-  "version": "2.2.1",
+  "version": "2.5.0",
   "type": "module",
   "description": "origam — a Vue 3 design system with multi-theme design tokens, CSS-first components and TypeScript types.",
   "keywords": [
@@ -62,6 +62,12 @@
     "./tokens/scss/utilities": "./dist/src/assets/scss/tokens/_origam-utilities.scss",
     "./tokens/types": "./dist/src/types/tokens.type.d.ts",
     "./origam": "./dist/src/origam.js",
+    "./nuxt": {
+      "types": "./dist/src/nuxt/module.d.ts",
+      "import": "./dist/src/nuxt/module.js",
+      "require": "./dist/src/nuxt/module.cjs",
+      "default": "./dist/src/nuxt/module.js"
+    },
     "./components": "./dist/src/components/index.js",
     "./components/*": "./dist/src/components/*/index.js",
     "./composables": "./dist/src/composables/index.js",
@@ -85,7 +91,8 @@
     "dev": "npm run server:dev && npm run story:dev && npm run docs:dev",
     "build": "npm run server:build && npm run story:build && npm run docs:build",
     "preview": "npm run server:preview && npm run story:preview && npm run docs:preview",
-    "story:dev": "histoire dev",
+    "story:dev": "CHOKIDAR_USEPOLLING=1 CHOKIDAR_INTERVAL=600 histoire dev",
+    "story:dev:native": "histoire dev",
     "story:build": "histoire build",
     "story:preview": "histoire preview",
     "server:dev": "npm run tokens:build && vite",
@@ -94,13 +101,15 @@
     "tokens:build": "node scripts/build-tokens.mjs",
     "tokens:watch": "node scripts/build-tokens.mjs --watch",
     "tokens:lint": "node scripts/build-tokens.mjs --dry-run --strict",
-    "docs:dev": "vitepress dev docs",
+    "docs:dev": "CHOKIDAR_USEPOLLING=1 CHOKIDAR_INTERVAL=600 vitepress dev docs",
+    "docs:dev:native": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:preview": "vitepress preview docs",
     "type:build": "vue-tsc --build --force",
     "type:dev": "vue-tsc --watch --noEmit --skipLibCheck",
     "lint:fix": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix",
     "test:unit": "vitest",
+    "test:a11y": "playwright test --config=playwright.a11y.config.ts",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:debug": "playwright test --debug",
@@ -111,7 +120,9 @@
     "prepublishOnly": "npm run tokens:build && npm run server:build && npm run test:unit -- --run"
   },
   "dependencies": {
-    "@mdi/font": "^7.4.47"
+    "@mdi/font": "^7.4.47",
+    "qrcode-generator": "^2.0.4",
+    "shiki": "^3.8.1"
   },
   "peerDependencies": {
     "vue": "^3.5.0",
@@ -127,16 +138,20 @@
     }
   },
   "devDependencies": {
+    "@axe-core/playwright": "^4.11.3",
     "@histoire/plugin-vue": "^1.0.0-beta.1",
+    "@nuxt/kit": "^4.4.5",
     "@playwright/test": "^1.48.0",
     "@tokens-studio/sd-transforms": "^1.2.9",
     "@types/jest": "^30.0.0",
     "@vitejs/plugin-vue": "^6.0.0",
     "@vue/test-utils": "^2.4.6",
+    "axe-core": "^4.11.4",
     "eslint": "^9.31.0",
     "eslint-config-prettier": "^10.1.5",
     "eslint-plugin-vue": "^10.3.0",
     "globals": "^16.3.0",
+    "happy-dom": "^15.11.7",
     "histoire": "^1.0.0-beta.1",
     "husky": "^9.1.7",
     "lint-staged": "^16.1.2",
@@ -144,7 +159,6 @@
     "markdown-it-deflist": "^3.0.0",
     "markdown-it-footnote": "^4.0.0",
     "sass": "^1.89.2",
-    "shiki": "^3.8.1",
     "style-dictionary": "^4.4.0",
     "ts-transformer-keys": "^0.4.4",
     "typescript": "^5.8.3",
@@ -156,7 +170,10 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitepress": "^1.6.3",
     "vitest": "^3.2.4",
+    "vue": "^3.5.17",
     "vue-eslint-parser": "^10.4.0",
+    "vue-i18n": "^11.1.10",
+    "vue-router": "^4.5.1",
     "vue-sfc-transformer": "^0.1.16",
     "vue-tsc": "^3.0.2"
   }