specra 0.2.10 → 0.2.12

package/dist/components/docs/Header.svelte

@@ -21,7 +21,8 @@
     hidden?: boolean;
   }
 
-  interface ProductItem {
+  /** Flat shape (from page components) */
+  interface ProductItemFlat {
     slug: string;
     label: string;
     icon?: string;
@@ -30,13 +31,27 @@
     isDefault: boolean;
   }
 
+  /** Nested shape (from SDK getProducts()) */
+  interface ProductItemNested {
+    slug: string;
+    config: {
+      label: string;
+      icon?: string;
+      badge?: string;
+      activeVersion?: string;
+    };
+    isDefault: boolean;
+  }
+
+  type ProductInput = ProductItemFlat | ProductItemNested;
+
   interface Props {
     currentVersion: string;
     versions: string[];
     versionsMeta?: VersionMeta[];
     versionBanner?: BannerConfig;
     config?: SpecraConfig;
-    products?: ProductItem[];
+    products?: ProductInput[];
     currentProduct?: string;
     subheader?: Snippet;
   }

package/dist/components/docs/Header.svelte.d.ts

@@ -7,7 +7,8 @@ interface VersionMeta {
     badge?: string;
     hidden?: boolean;
 }
-interface ProductItem {
+/** Flat shape (from page components) */
+interface ProductItemFlat {
     slug: string;
     label: string;
     icon?: string;
@@ -15,13 +16,25 @@ interface ProductItem {
     activeVersion?: string;
     isDefault: boolean;
 }
+/** Nested shape (from SDK getProducts()) */
+interface ProductItemNested {
+    slug: string;
+    config: {
+        label: string;
+        icon?: string;
+        badge?: string;
+        activeVersion?: string;
+    };
+    isDefault: boolean;
+}
+type ProductInput = ProductItemFlat | ProductItemNested;
 interface Props {
     currentVersion: string;
     versions: string[];
     versionsMeta?: VersionMeta[];
     versionBanner?: BannerConfig;
     config?: SpecraConfig;
-    products?: ProductItem[];
+    products?: ProductInput[];
     currentProduct?: string;
     subheader?: Snippet;
 }

package/dist/mdx-security.js

@@ -44,22 +44,23 @@ export function validatePathWithinDirectory(filePath, allowedDir) {
  * These patterns can execute arbitrary code during SSR
  */
 const DANGEROUS_PATTERNS = [
-    // JavaScript execution
-    /eval\s*\(/gi,
-    /Function\s*\(/gi,
-    /import\s*\(/gi,
-    /require\s*\(/gi,
+    // JavaScript execution — require expression context (after { ; = or line start)
+    // to avoid false positives on prose like "bulk import (CSV...)" or "fetch (data)"
+    /(?:^|[{;=,])\s*eval\s*\(/gim,
+    /(?:^|[{;=,])\s*Function\s*\(/gim,
+    /(?:^|[{;=,])\s*import\s*\(/gim,
+    /(?:^|[{;=,])\s*require\s*\(/gim,
     // File system access
     /fs\.[a-z]+/gi,
-    /readFile/gi,
-    /writeFile/gi,
+    /(?:^|[{;=,])\s*readFile/gim,
+    /(?:^|[{;=,])\s*writeFile/gim,
     /process\.env/gi,
-    // Network requests during SSR (legitimate client-side usage should use components)
-    /fetch\s*\(/gi,
+    // Network requests during SSR — require expression context
+    /(?:^|[{;=,])\s*fetch\s*\(/gim,
     // Dangerous Node.js modules
     /child_process/gi,
-    /exec\s*\(/gi,
-    /spawn\s*\(/gi,
+    /(?:^|[{;=,])\s*exec\s*\(/gim,
+    /(?:^|[{;=,])\s*spawn\s*\(/gim,
     // Script tag injection
     /<script[>\s]/gi,
     /javascript:/gi,

package/dist/mdx.js

@@ -1,6 +1,7 @@
 import fs from "fs";
 import path from "path";
 import matter from "gray-matter";
+import yaml from "js-yaml";
 import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
@@ -1135,7 +1136,14 @@ function readDocFromFile(filePath, originalSlug) {
             return null;
         }
         const fileContents = fs.readFileSync(filePath, "utf8");
-        const { data, content } = matter(fileContents);
+        const { data, content } = matter(fileContents, {
+            engines: {
+                yaml: {
+                    parse: (str) => yaml.load(str),
+                    stringify: (obj) => yaml.dump(obj),
+                },
+            },
+        });
         // Security: Validate MDX content for dangerous patterns
         const securityCheck = validateMDXSecurity(content, {
             strictMode: process.env.NODE_ENV === 'production',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specra",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "A modern documentation library for SvelteKit with built-in versioning, API reference generation, full-text search, and MDX support",
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -78,13 +78,14 @@
     "date-fns": "^4.1.0",
     "embla-carousel-svelte": "^8.5.1",
     "gray-matter": "^4.0.3",
+    "hast-util-to-html": "^9.0.0",
+    "js-yaml": "^4.1.1",
     "katex": "^0.16.27",
     "lucide-svelte": "^0.454.0",
     "mdsvex": "^0.12.0",
     "meilisearch": "^0.54.0",
     "mermaid": "^11.12.2",
     "mode-watcher": "^0.5.0",
-    "hast-util-to-html": "^9.0.0",
     "rehype-katex": "^7.0.1",
     "rehype-raw": "^7.0.0",
     "rehype-slug": "^6.0.0",
@@ -103,6 +104,7 @@
     "@sveltejs/kit": "^2.0.0",
     "@sveltejs/package": "^2.0.0",
     "@sveltejs/vite-plugin-svelte": "^6.0.0",
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22",
     "svelte": "^5.0.0",
     "svelte-check": "^4.0.0",