sourcey 3.6.0 → 3.6.1

package/dist/client/search.js

@@ -1,10 +1,10 @@
 // Search — client-side search dialog with keyboard navigation
 (function () {
   function init() {
-    var dialog = document.getElementById('search-dialog');
-    var input = document.getElementById('search-input');
-    var results = document.getElementById('search-results');
-    var openBtn = document.getElementById('search-open');
+    var dialog = document.getElementById("search-dialog");
+    var input = document.getElementById("search-input");
+    var results = document.getElementById("search-results");
+    var openBtn = document.getElementById("search-open");
     if (!dialog || !input || !results) return;
 
     var entries = [];
@@ -16,104 +16,126 @@
     var searchMeta = document.querySelector('meta[name="sourcey-search"]');
 
     function loadJsonIndex(callback) {
-      if (indexLoaded) { callback(); return; }
-      if (!searchMeta) { indexLoaded = true; callback(); return; }
-      var url = searchMeta.getAttribute('content');
-      fetch(url).then(function (r) { return r.json(); }).then(function (data) {
-        entries = data.map(function (e) {
-          var title = e.title || '';
-          var qualifiedName = e.qualifiedName || '';
-          var owner = e.owner || '';
-          var tab = e.tab || '';
-          return {
-            url: e.url,
-            method: e.method || '',
-            path: e.path || '',
-            title: title,
-            summary: qualifiedName || title,
-            tag: owner ? owner : tab,
-            content: e.content || '',
-            category: e.category || '',
-            featured: !!e.featured,
-            symbolKind: e.symbolKind || '',
-            owner: owner,
-            ownerKind: e.ownerKind || '',
-            namespace: e.namespace || '',
-            qualifiedName: qualifiedName,
-            titleLower: title.toLowerCase(),
-            pathLower: (e.path || '').toLowerCase(),
-            qualifiedLower: qualifiedName.toLowerCase(),
-            ownerLower: owner.toLowerCase(),
-            searchText: [
-              e.method || '',
-              e.path || '',
-              title,
-              qualifiedName,
-              owner,
-              e.ownerKind || '',
-              e.namespace || '',
-              e.symbolKind || '',
-              e.content || '',
-              tab
-            ].join(' ').toLowerCase()
-          };
-        });
-        indexLoaded = true;
+      if (indexLoaded) {
         callback();
-      }).catch(function () {
+        return;
+      }
+      if (!searchMeta) {
         indexLoaded = true;
         callback();
-      });
+        return;
+      }
+      var url = searchMeta.getAttribute("content");
+      fetch(url)
+        .then(function (r) {
+          return r.json();
+        })
+        .then(function (data) {
+          entries = data.map(function (e) {
+            var title = e.title || "";
+            var qualifiedName = e.qualifiedName || "";
+            var owner = e.owner || "";
+            var tab = e.tab || "";
+            return {
+              url: e.url,
+              method: e.method || "",
+              path: e.path || "",
+              title: title,
+              summary: qualifiedName || title,
+              tag: owner ? owner : tab,
+              content: e.content || "",
+              category: e.category || "",
+              featured: !!e.featured,
+              symbolKind: e.symbolKind || "",
+              owner: owner,
+              ownerKind: e.ownerKind || "",
+              namespace: e.namespace || "",
+              qualifiedName: qualifiedName,
+              titleLower: title.toLowerCase(),
+              pathLower: (e.path || "").toLowerCase(),
+              qualifiedLower: qualifiedName.toLowerCase(),
+              ownerLower: owner.toLowerCase(),
+              searchText: [
+                e.method || "",
+                e.path || "",
+                title,
+                qualifiedName,
+                owner,
+                e.ownerKind || "",
+                e.namespace || "",
+                e.symbolKind || "",
+                e.content || "",
+                tab,
+              ]
+                .join(" ")
+                .toLowerCase(),
+            };
+          });
+          indexLoaded = true;
+          callback();
+        })
+        .catch(function () {
+          indexLoaded = true;
+          callback();
+        });
     }
 
-    var dialogInner = dialog.querySelector('.search-dialog-inner');
+    var dialogInner = dialog.querySelector(".search-dialog-inner");
 
     function positionDialog() {
       if (!openBtn || !dialogInner) return;
       var rect = openBtn.getBoundingClientRect();
-      dialogInner.style.position = 'absolute';
-      dialogInner.style.top = (rect.top - 4) + 'px';
+      dialogInner.style.position = "absolute";
+      dialogInner.style.top = rect.top - 4 + "px";
       var extraWidth = Math.min(rect.width * 0.5, 200);
-      dialogInner.style.left = (rect.left - extraWidth / 2) + 'px';
-      dialogInner.style.width = (rect.width + extraWidth) + 'px';
-      dialogInner.style.maxWidth = 'none';
-      dialogInner.style.transform = 'none';
-      dialogInner.style.margin = '0';
+      dialogInner.style.left = rect.left - extraWidth / 2 + "px";
+      dialogInner.style.width = rect.width + extraWidth + "px";
+      dialogInner.style.maxWidth = "none";
+      dialogInner.style.transform = "none";
+      dialogInner.style.margin = "0";
     }
 
     function open() {
       positionDialog();
-      dialog.classList.add('open');
-      input.value = '';
+      dialog.classList.add("open");
+      input.value = "";
       input.focus();
       if (!indexLoaded) {
         results.innerHTML = '<div class="search-loading">Loading…</div>';
-        loadJsonIndex(function () { showResults(''); });
+        loadJsonIndex(function () {
+          showResults("");
+        });
       } else {
-        showResults('');
+        showResults("");
       }
-      document.addEventListener('keydown', onDialogKey);
+      document.addEventListener("keydown", onDialogKey);
     }
 
     function close() {
-      dialog.classList.remove('open');
-      document.removeEventListener('keydown', onDialogKey);
+      dialog.classList.remove("open");
+      document.removeEventListener("keydown", onDialogKey);
     }
 
     function showResults(query) {
       var q = query.toLowerCase().trim();
       if (!q) {
         // Show featured pages first, then endpoints
-        var featured = entries.filter(function (e) { return e.featured; });
-        var rest = entries.filter(function (e) { return !e.featured && e.category !== 'Sections'; });
+        var featured = entries.filter(function (e) {
+          return e.featured;
+        });
+        var rest = entries.filter(function (e) {
+          return !e.featured && e.category !== "Sections";
+        });
         filtered = featured.concat(rest).slice(0, 30);
       } else {
         var terms = q.split(/\s+/);
-        filtered = entries.map(function (e) {
-          return { entry: e, score: scoreEntry(e, q, terms) };
-        }).filter(function (result) {
-          return result.score > 0;
-        });
+        filtered = entries
+          .map(function (e) {
+            return { entry: e, score: scoreEntry(e, q, terms) };
+          })
+          .filter(function (result) {
+            return result.score > 0;
+          });
         var categoryOrder = {
           Pages: 0,
           Endpoints: 1,
@@ -121,18 +143,22 @@
           Functions: 3,
           Types: 4,
           Enums: 5,
-          'Enum Values': 6,
+          "Enum Values": 6,
           Variables: 7,
           Friends: 8,
           Properties: 9,
           Members: 10,
-          Sections: 20
+          Sections: 20,
         };
         filtered.sort(function (a, b) {
           if (b.score !== a.score) return b.score - a.score;
           return (categoryOrder[a.entry.category] || 19) - (categoryOrder[b.entry.category] || 19);
         });
-        filtered = filtered.map(function (result) { return result.entry; }).slice(0, 50);
+        filtered = filtered
+          .map(function (result) {
+            return result.entry;
+          })
+          .slice(0, 50);
       }
 
       activeIndex = filtered.length ? 0 : -1;
@@ -140,72 +166,104 @@
     }
 
     function scoreEntry(e, q, terms) {
-      if (!terms.every(function (t) { return e.searchText.indexOf(t) !== -1; })) return 0;
+      if (
+        !terms.every(function (t) {
+          return e.searchText.indexOf(t) !== -1;
+        })
+      )
+        return 0;
 
-      var compactQuery = q.replace(/\s+/g, '');
-      var qualified = e.qualifiedLower || '';
-      var title = e.titleLower || '';
-      var path = e.pathLower || '';
-      var owner = e.ownerLower || '';
+      var compactQuery = q.replace(/\s+/g, "");
+      var qualified = e.qualifiedLower || "";
+      var title = e.titleLower || "";
+      var path = e.pathLower || "";
+      var owner = e.ownerLower || "";
       var score = 1;
 
       if (qualified && qualified === compactQuery) score += 1200;
       if (title && title === q) score += 900;
       if (path && path === q) score += 850;
-      if (qualified && qualified.endsWith('::' + compactQuery)) score += 780;
-      if (owner && compactQuery === owner + '::' + title) score += 760;
-      if (qualified && compactQuery.indexOf('::') !== -1 && qualified.indexOf(compactQuery) !== -1) score += 700;
+      if (qualified && qualified.endsWith("::" + compactQuery)) score += 780;
+      if (owner && compactQuery === owner + "::" + title) score += 760;
+      if (qualified && compactQuery.indexOf("::") !== -1 && qualified.indexOf(compactQuery) !== -1)
+        score += 700;
       if (title && title.indexOf(q) === 0) score += 500;
       if (qualified && qualified.indexOf(compactQuery) !== -1) score += 420;
       if (owner && owner.indexOf(compactQuery) !== -1) score += 240;
       if (path && path.indexOf(q) !== -1) score += 180;
       if (e.content.toLowerCase().indexOf(q) !== -1) score += 80;
 
-      if (e.category === 'Sections') score -= 70;
+      if (e.category === "Sections") score -= 70;
       if (e.symbolKind) score += 35;
       if (e.featured) score += 20;
       return score;
     }
 
     function render() {
-      var html = '';
-      var lastCategory = '';
+      var html = "";
+      var lastCategory = "";
 
       for (var i = 0; i < filtered.length; i++) {
         var e = filtered[i];
-        var cat = e.category || 'Results';
+        var cat = e.category || "Results";
 
         if (cat !== lastCategory) {
-          html += '<div class="search-category">' + escapeHtml(cat) + '</div>';
+          html += '<div class="search-category">' + escapeHtml(cat) + "</div>";
           lastCategory = cat;
         }
 
-        var cls = 'search-result' + (i === activeIndex ? ' active' : '');
+        var cls = "search-result" + (i === activeIndex ? " active" : "");
         var label = e.method
-          ? '<span class="search-result-method method-' + e.method.toLowerCase() + '">' + e.method + '</span> ' +
-            '<span class="search-result-path">' + escapeHtml(e.path) + '</span>'
-          : '<span class="search-result-path">' + escapeHtml(e.summary) + '</span>';
-        var tagLine = e.tag ? '<span class="search-result-tag">' + escapeHtml(e.tag) + '</span>' : '';
-        var summaryLine = e.method && e.summary ? '<span class="search-result-summary">' + escapeHtml(e.summary) + '</span>' : '';
-
-        html += '<a href="' + e.url + '" class="' + cls + '" data-index="' + i + '">' +
-          '<div class="search-result-main">' + label + summaryLine + '</div>' +
-          tagLine + '</a>';
+          ? '<span class="search-result-method method-' +
+            e.method.toLowerCase() +
+            '">' +
+            e.method +
+            "</span> " +
+            '<span class="search-result-path">' +
+            escapeHtml(e.path) +
+            "</span>"
+          : '<span class="search-result-path">' + escapeHtml(e.summary) + "</span>";
+        var tagLine = e.tag
+          ? '<span class="search-result-tag">' + escapeHtml(e.tag) + "</span>"
+          : "";
+        var summaryLine =
+          e.method && e.summary
+            ? '<span class="search-result-summary">' + escapeHtml(e.summary) + "</span>"
+            : "";
+
+        html +=
+          '<a href="' +
+          escapeAttr(e.url) +
+          '" class="' +
+          cls +
+          '" data-index="' +
+          i +
+          '">' +
+          '<div class="search-result-main">' +
+          label +
+          summaryLine +
+          "</div>" +
+          tagLine +
+          "</a>";
       }
 
       results.innerHTML = html;
 
       // Scroll active result into view
-      var activeEl = results.querySelector('.search-result.active');
-      if (activeEl) activeEl.scrollIntoView({ block: 'nearest' });
+      var activeEl = results.querySelector(".search-result.active");
+      if (activeEl) activeEl.scrollIntoView({ block: "nearest" });
     }
 
     function escapeHtml(s) {
-      var el = document.createElement('span');
+      var el = document.createElement("span");
       el.textContent = s;
       return el.innerHTML;
     }
 
+    function escapeAttr(s) {
+      return escapeHtml(s).replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+    }
+
     function navigate(index) {
       if (index < 0 || index >= filtered.length) return;
       var entry = filtered[index];
@@ -214,71 +272,75 @@
     }
 
     function onDialogKey(e) {
-      if (e.key === 'Escape') { close(); e.preventDefault(); return; }
-      if (e.key === 'ArrowDown') {
+      if (e.key === "Escape") {
+        close();
+        e.preventDefault();
+        return;
+      }
+      if (e.key === "ArrowDown") {
         e.preventDefault();
         activeIndex = Math.min(activeIndex + 1, filtered.length - 1);
         render();
         return;
       }
-      if (e.key === 'ArrowUp') {
+      if (e.key === "ArrowUp") {
         e.preventDefault();
         activeIndex = Math.max(activeIndex - 1, 0);
         render();
         return;
       }
-      if (e.key === 'Enter') {
+      if (e.key === "Enter") {
         e.preventDefault();
         if (activeIndex >= 0) navigate(activeIndex);
         return;
       }
     }
 
-    input.addEventListener('input', function () {
+    input.addEventListener("input", function () {
       showResults(input.value);
     });
 
-    results.addEventListener('click', function (e) {
-      var result = e.target.closest('.search-result');
+    results.addEventListener("click", function (e) {
+      var result = e.target.closest(".search-result");
       if (result) {
         e.preventDefault();
-        navigate(parseInt(result.getAttribute('data-index'), 10));
+        navigate(parseInt(result.getAttribute("data-index"), 10));
       }
     });
 
     // Open search
-    if (openBtn) openBtn.addEventListener('click', open);
+    if (openBtn) openBtn.addEventListener("click", open);
 
     // Also bind mobile search button
-    var mobileBtn = document.getElementById('search-open-mobile');
-    if (mobileBtn) mobileBtn.addEventListener('click', open);
+    var mobileBtn = document.getElementById("search-open-mobile");
+    if (mobileBtn) mobileBtn.addEventListener("click", open);
 
     // Keyboard shortcut: Ctrl+K or /
-    document.addEventListener('keydown', function (e) {
-      if ((e.ctrlKey || e.metaKey) && e.key === 'k') {
+    document.addEventListener("keydown", function (e) {
+      if ((e.ctrlKey || e.metaKey) && e.key === "k") {
         e.preventDefault();
         open();
       }
-      if (e.key === '/' && !isEditable(e.target)) {
+      if (e.key === "/" && !isEditable(e.target)) {
         e.preventDefault();
         open();
       }
     });
 
     // Close on backdrop click
-    dialog.addEventListener('click', function (e) {
+    dialog.addEventListener("click", function (e) {
       if (e.target === dialog) close();
     });
 
     function isEditable(el) {
       var tag = el.tagName;
-      return tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT' || el.isContentEditable;
+      return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || el.isContentEditable;
     }
   }
 
-  if ('requestIdleCallback' in window) {
+  if ("requestIdleCallback" in window) {
     window.requestIdleCallback(init, { timeout: 250 });
   } else {
-    window.addEventListener('load', init, { once: true });
+    window.addEventListener("load", init, { once: true });
   }
 })();

package/dist/client/tabs.js

@@ -156,6 +156,29 @@
       });
     });
 
+    // ── Rust Doctest Hidden-Line Toggle ──────────────────────────────
+    // (Copy is handled by the shared .copy-btn inside each code block.)
+
+    document.addEventListener('click', function (e) {
+      var toggleBtn = e.target.closest('.rust-doctest-toggle-hidden');
+      if (!toggleBtn) return;
+      var fullSel = toggleBtn.getAttribute('data-target');
+      var displaySel = toggleBtn.getAttribute('data-display');
+      var fullEl = fullSel ? document.getElementById(fullSel.replace(/^#/, '')) : null;
+      var displayEl = displaySel ? document.getElementById(displaySel.replace(/^#/, '')) : null;
+      if (!fullEl || !displayEl) return;
+      var fullHidden = fullEl.hasAttribute('hidden');
+      if (fullHidden) {
+        fullEl.removeAttribute('hidden');
+        displayEl.setAttribute('hidden', '');
+        toggleBtn.textContent = 'Hide hidden lines';
+      } else {
+        fullEl.setAttribute('hidden', '');
+        displayEl.removeAttribute('hidden');
+        toggleBtn.textContent = 'Show hidden lines';
+      }
+    });
+
     // Close dropdowns on Escape
     document.addEventListener('keydown', function (e) {
       if (e.key === 'Escape') {

package/dist/components/layout/Head.js

@@ -17,7 +17,7 @@ export function Head() {
         : page.kind === "changelog"
             ? (() => {
                 const baseTitle = changelogVersion
-                    ? `${changelogVersion.version ?? "Unreleased"} — ${page.changelog.title}`
+                    ? `${changelogVersion.version ?? "Unreleased"} - ${page.changelog.title}`
                     : page.changelog.title;
                 return composePageTitle(baseTitle, siteName);
             })()
@@ -63,7 +63,7 @@ function composePageTitle(title, siteName) {
         return title;
     if (!title)
         return siteName;
-    return sameTitle(title, siteName) ? title : `${title} — ${siteName}`;
+    return sameTitle(title, siteName) ? title : `${title} - ${siteName}`;
 }
 function sameTitle(left, right) {
     return normalizeTitle(left) === normalizeTitle(right);

package/dist/components/openapi/Introduction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Introduction.d.ts","sourceRoot":"","sources":["../../../src/components/openapi/Introduction.tsx"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAgB,YAAY,iCAqC3B"}
+{"version":3,"file":"Introduction.d.ts","sourceRoot":"","sources":["../../../src/components/openapi/Introduction.tsx"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,YAAY,iCAmE3B"}

package/dist/components/openapi/Introduction.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "preact/jsx-runtime";
 import { useContext } from "preact/hooks";
 import { SpecContext } from "../../renderer/context.js";
+import { safeUrl } from "../../utils/html.js";
 import { Markdown } from "../ui/Markdown.js";
 /**
  * API introduction: description, contact info, server URLs.
@@ -9,5 +10,19 @@ import { Markdown } from "../ui/Markdown.js";
 export function Introduction() {
     const spec = useContext(SpecContext);
     const { info, servers } = spec;
-    return (_jsxs("div", { id: "introduction", "data-traverse-target": "introduction", class: "mb-8", children: [info.termsOfService && (_jsx("p", { class: "mt-4 text-sm text-[rgb(var(--color-gray-500))]", children: _jsx("a", { href: info.termsOfService, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: "Terms of Service" }) })), info.contact?.email && (_jsxs("p", { class: "mt-2 text-sm text-[rgb(var(--color-gray-500))]", children: ["Contact: ", _jsx("a", { href: `mailto:${info.contact.email}`, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: info.contact.email })] })), servers.length > 0 && (_jsxs("div", { class: "mt-6 rounded-[var(--radius)] border border-[rgb(var(--color-gray-200)/0.7)] dark:border-[rgb(var(--color-border-dark-subtle)/0.1)] overflow-x-auto", children: [_jsxs("div", { class: "px-4 py-2.5 text-xs font-semibold text-[rgb(var(--color-gray-600))] dark:text-[rgb(var(--color-gray-300))] border-b border-[rgb(var(--color-gray-200)/0.7)] dark:border-[rgb(var(--color-border-dark-subtle)/0.1)]", children: ["Base URL", servers.length > 1 ? "s" : ""] }), servers.map((s, i) => (_jsxs("div", { class: `flex items-baseline gap-3 px-4 py-2 ${i > 0 ? "border-t border-[rgb(var(--color-gray-100))] dark:border-[rgb(var(--color-gray-800))]" : ""}`, children: [_jsx("code", { class: "font-mono text-sm text-[rgb(var(--color-gray-800))] dark:text-[rgb(var(--color-gray-200))]", children: s.url }), s.description && (_jsx("span", { class: "text-xs text-[rgb(var(--color-gray-500))]", children: s.description }))] }, i)))] })), info.description && _jsx(Markdown, { content: info.description, class: "max-w-none mt-8" })] }));
+    const termsUrl = info.termsOfService
+        ? safeUrl(info.termsOfService, {
+            allowedProtocols: ["http:", "https:"],
+            allowRelative: false,
+            allowAnchor: false,
+        })
+        : null;
+    const contactEmailUrl = info.contact?.email
+        ? safeUrl(`mailto:${info.contact.email}`, {
+            allowedProtocols: ["mailto:"],
+            allowRelative: false,
+            allowAnchor: false,
+        })
+        : null;
+    return (_jsxs("div", { id: "introduction", "data-traverse-target": "introduction", class: "mb-8", children: [termsUrl && (_jsx("p", { class: "mt-4 text-sm text-[rgb(var(--color-gray-500))]", children: _jsx("a", { href: termsUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: "Terms of Service" }) })), info.contact?.email && contactEmailUrl && (_jsxs("p", { class: "mt-2 text-sm text-[rgb(var(--color-gray-500))]", children: ["Contact:", " ", _jsx("a", { href: contactEmailUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: info.contact.email })] })), servers.length > 0 && (_jsxs("div", { class: "mt-6 rounded-[var(--radius)] border border-[rgb(var(--color-gray-200)/0.7)] dark:border-[rgb(var(--color-border-dark-subtle)/0.1)] overflow-x-auto", children: [_jsxs("div", { class: "px-4 py-2.5 text-xs font-semibold text-[rgb(var(--color-gray-600))] dark:text-[rgb(var(--color-gray-300))] border-b border-[rgb(var(--color-gray-200)/0.7)] dark:border-[rgb(var(--color-border-dark-subtle)/0.1)]", children: ["Base URL", servers.length > 1 ? "s" : ""] }), servers.map((s, i) => (_jsxs("div", { class: `flex items-baseline gap-3 px-4 py-2 ${i > 0 ? "border-t border-[rgb(var(--color-gray-100))] dark:border-[rgb(var(--color-gray-800))]" : ""}`, children: [_jsx("code", { class: "font-mono text-sm text-[rgb(var(--color-gray-800))] dark:text-[rgb(var(--color-gray-200))]", children: s.url }), s.description && (_jsx("span", { class: "text-xs text-[rgb(var(--color-gray-500))]", children: s.description }))] }, i)))] })), info.description && _jsx(Markdown, { content: info.description, class: "max-w-none mt-8" })] }));
 }

package/dist/components/openapi/Security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../src/components/openapi/Security.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,UAAU,aAAa;IACrB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,uCA+CvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,wCA8FlC"}
+{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../src/components/openapi/Security.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM/D,UAAU,aAAa;IACrB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,uCAmDvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,wCAoIlC"}

package/dist/components/openapi/Security.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "preact/jsx-runtime";
 import { useContext } from "preact/hooks";
 import { SpecContext } from "../../renderer/context.js";
+import { safeUrl } from "../../utils/html.js";
 import { SectionLabel } from "../ui/SectionLabel.js";
 import { Markdown } from "../ui/Markdown.js";
 import { DeprecatedBadge } from "../ui/Badge.js";
@@ -16,7 +17,7 @@ export function SecurityCopy({ security }) {
         return null;
     return (_jsxs("div", { class: "mt-6", children: [_jsx(SectionLabel, { children: "Authorization" }), _jsx("div", { children: security.map((req, i) => (_jsx("div", { class: "params-list", children: Object.entries(req).map(([name, scopes]) => {
                         const scheme = spec.securitySchemes[name];
-                        return (_jsxs("div", { class: "param-item", children: [_jsxs("div", { class: "param-header", children: [_jsx("code", { class: "param-name", children: name }), scheme && (_jsx("span", { class: "param-type", children: _jsxs("span", { class: "json-property-type", children: [scheme.type, scheme.scheme && ` (${scheme.scheme})`, scheme.in && ` in ${scheme.in}`] }) })), scheme?.deprecated && _jsx(DeprecatedBadge, {})] }), (scheme?.description || scopes.length > 0) && (_jsxs("div", { class: "param-description", children: [scheme?.description && _jsx(Markdown, { content: scheme.description, class: "prose-sm" }), scopes.length > 0 && (_jsxs("p", { class: "mt-1", children: ["Scopes: ", _jsx("code", { class: "text-xs font-medium", children: scopes.join(", ") })] }))] }))] }, name));
+                        return (_jsxs("div", { class: "param-item", children: [_jsxs("div", { class: "param-header", children: [_jsx("code", { class: "param-name", children: name }), scheme && (_jsx("span", { class: "param-type", children: _jsxs("span", { class: "json-property-type", children: [scheme.type, scheme.scheme && ` (${scheme.scheme})`, scheme.in && ` in ${scheme.in}`] }) })), scheme?.deprecated && _jsx(DeprecatedBadge, {})] }), (scheme?.description || scopes.length > 0) && (_jsxs("div", { class: "param-description", children: [scheme?.description && (_jsx(Markdown, { content: scheme.description, class: "prose-sm" })), scopes.length > 0 && (_jsxs("p", { class: "mt-1", children: ["Scopes: ", _jsx("code", { class: "text-xs font-medium", children: scopes.join(", ") })] }))] }))] }, name));
                     }) }, i))) })] }));
 }
 /**
@@ -27,5 +28,20 @@ export function SecurityDefinitions() {
     const schemes = Object.entries(spec.securitySchemes);
     if (!schemes.length)
         return null;
-    return (_jsxs("div", { id: "authentication", class: "py-8 border-t border-[rgb(var(--color-gray-100))] dark:border-[rgb(var(--color-gray-800))]", "data-traverse-target": "authentication", children: [_jsx("h2", { class: "text-xl font-bold text-[rgb(var(--color-gray-900))] dark:text-[rgb(var(--color-gray-200))] mb-4", children: "Authentication" }), _jsx("div", { class: "params-list", children: schemes.map(([name, scheme]) => (_jsxs("div", { class: "param-item", children: [_jsxs("div", { class: "param-header", children: [_jsx("code", { class: "param-name", children: name }), _jsx("span", { class: "param-type", children: _jsx("span", { class: "json-property-type", children: scheme.type }) }), scheme.deprecated && _jsx(DeprecatedBadge, {})] }), _jsxs("div", { class: "param-description", children: [scheme.description && _jsx(Markdown, { content: scheme.description, class: "prose-sm" }), scheme.type === "apiKey" && (_jsxs("p", { class: "mt-1", children: ["API Key: ", _jsx("code", { class: "text-xs font-medium", children: scheme.name }), " in ", scheme.in] })), scheme.type === "http" && (_jsxs("p", { class: "mt-1", children: ["Scheme: ", scheme.scheme, scheme.bearerFormat && ` (${scheme.bearerFormat})`] })), scheme.type === "oauth2" && scheme.oauth2MetadataUrl && (_jsxs("p", { class: "mt-1", children: ["OAuth2 Metadata:", " ", _jsx("a", { href: scheme.oauth2MetadataUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: scheme.oauth2MetadataUrl })] })), scheme.type === "oauth2" && scheme.flows && (_jsx("div", { class: "mt-2 space-y-4", children: Object.entries(scheme.flows).map(([flowType, flow]) => (_jsxs("div", { children: [_jsx("strong", { class: "text-[rgb(var(--color-gray-900))] dark:text-[rgb(var(--color-gray-200))]", children: flowType }), _jsxs("dl", { class: "mt-2 text-sm", children: [flow?.authorizationUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Authorization URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.authorizationUrl }) })] })), flow?.deviceAuthorizationUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Device Authorization URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.deviceAuthorizationUrl }) })] })), flow?.tokenUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Token URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.tokenUrl }) })] }))] }), flow?.scopes && Object.keys(flow.scopes).length > 0 && (_jsxs("div", { class: "mt-3", children: [_jsx("span", { class: "text-sm text-[rgb(var(--color-gray-500))]", children: "Scopes" }), _jsx("ul", { class: "mt-1 space-y-1", children: Object.entries(flow.scopes).map(([s, desc]) => (_jsxs("li", { class: "text-sm", children: [_jsx("code", { class: "text-xs font-medium text-[rgb(var(--color-gray-800))] dark:text-[rgb(var(--color-gray-200))]", children: s }), _jsxs("span", { class: "text-[rgb(var(--color-gray-500))] ml-2", children: ["\u2014 ", desc] })] }, s))) })] }))] }, flowType))) })), scheme.type === "openIdConnect" && scheme.openIdConnectUrl && (_jsxs("p", { class: "mt-1", children: ["OpenID Connect:", " ", _jsx("a", { href: scheme.openIdConnectUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: scheme.openIdConnectUrl })] }))] })] }, name))) })] }));
+    return (_jsxs("div", { id: "authentication", class: "py-8 border-t border-[rgb(var(--color-gray-100))] dark:border-[rgb(var(--color-gray-800))]", "data-traverse-target": "authentication", children: [_jsx("h2", { class: "text-xl font-bold text-[rgb(var(--color-gray-900))] dark:text-[rgb(var(--color-gray-200))] mb-4", children: "Authentication" }), _jsx("div", { class: "params-list", children: schemes.map(([name, scheme]) => {
+                    const oauth2MetadataUrl = scheme.oauth2MetadataUrl
+                        ? safeExternalSpecUrl(scheme.oauth2MetadataUrl)
+                        : null;
+                    const openIdConnectUrl = scheme.openIdConnectUrl
+                        ? safeExternalSpecUrl(scheme.openIdConnectUrl)
+                        : null;
+                    return (_jsxs("div", { class: "param-item", children: [_jsxs("div", { class: "param-header", children: [_jsx("code", { class: "param-name", children: name }), _jsx("span", { class: "param-type", children: _jsx("span", { class: "json-property-type", children: scheme.type }) }), scheme.deprecated && _jsx(DeprecatedBadge, {})] }), _jsxs("div", { class: "param-description", children: [scheme.description && _jsx(Markdown, { content: scheme.description, class: "prose-sm" }), scheme.type === "apiKey" && (_jsxs("p", { class: "mt-1", children: ["API Key: ", _jsx("code", { class: "text-xs font-medium", children: scheme.name }), " in ", scheme.in] })), scheme.type === "http" && (_jsxs("p", { class: "mt-1", children: ["Scheme: ", scheme.scheme, scheme.bearerFormat && ` (${scheme.bearerFormat})`] })), scheme.type === "oauth2" && oauth2MetadataUrl && (_jsxs("p", { class: "mt-1", children: ["OAuth2 Metadata:", " ", _jsx("a", { href: oauth2MetadataUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: scheme.oauth2MetadataUrl })] })), scheme.type === "oauth2" && scheme.flows && (_jsx("div", { class: "mt-2 space-y-4", children: Object.entries(scheme.flows).map(([flowType, flow]) => (_jsxs("div", { children: [_jsx("strong", { class: "text-[rgb(var(--color-gray-900))] dark:text-[rgb(var(--color-gray-200))]", children: flowType }), _jsxs("dl", { class: "mt-2 text-sm", children: [flow?.authorizationUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Authorization URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.authorizationUrl }) })] })), flow?.deviceAuthorizationUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Device Authorization URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.deviceAuthorizationUrl }) })] })), flow?.tokenUrl && (_jsxs(_Fragment, { children: [_jsx("dt", { class: "text-[rgb(var(--color-gray-500))] mt-2", children: "Token URL" }), _jsx("dd", { children: _jsx("code", { class: "text-xs", children: flow.tokenUrl }) })] }))] }), flow?.scopes && Object.keys(flow.scopes).length > 0 && (_jsxs("div", { class: "mt-3", children: [_jsx("span", { class: "text-sm text-[rgb(var(--color-gray-500))]", children: "Scopes" }), _jsx("ul", { class: "mt-1 space-y-1", children: Object.entries(flow.scopes).map(([s, desc]) => (_jsxs("li", { class: "text-sm", children: [_jsx("code", { class: "text-xs font-medium text-[rgb(var(--color-gray-800))] dark:text-[rgb(var(--color-gray-200))]", children: s }), _jsxs("span", { class: "text-[rgb(var(--color-gray-500))] ml-2", children: ["- ", desc] })] }, s))) })] }))] }, flowType))) })), scheme.type === "openIdConnect" && openIdConnectUrl && (_jsxs("p", { class: "mt-1", children: ["OpenID Connect:", " ", _jsx("a", { href: openIdConnectUrl, class: "text-[rgb(var(--color-primary-ink))] dark:text-[rgb(var(--color-primary-light))]", children: scheme.openIdConnectUrl })] }))] })] }, name));
+                }) })] }));
+}
+function safeExternalSpecUrl(value) {
+    return safeUrl(value, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: false,
+        allowAnchor: false,
+    });
 }