superdoc 2.23.1-next.6 → 2.23.1-next.7

package/dist/superdoc.es.js

@@ -302,7 +302,7 @@ var awarenessStatesToArray = (context, states) => {
 var DEFAULT_ENDPOINT = "https://ingest.superdoc.dev/v1/collect";
 function getSuperdocVersion() {
 	try {
-		return "2.23.1-next.6";
+		return "2.23.1-next.7";
 	} catch {
 		return "unknown";
 	}
@@ -13159,6 +13159,114 @@ var CommentInput_default = /*#__PURE__*/ _plugin_vue_export_helper_default({
 	}
 }, [["__scopeId", "data-v-0720a671"]]);
 //#endregion
+//#region src/internal/toolbar/built-in/url-safety.js
+/**
+* Minimal href sanitizer for the built-in link popover.
+*
+* The v1 toolbar used the shared `@superdoc/url-validation` package, which is not
+* a resolvable runtime dependency of the published `superdoc` ES build. This
+* keeps the same fail-closed posture (only known-safe schemes pass) without
+* pulling in that package: dangerous schemes (`javascript:`, `data:`,
+* `vbscript:`) return `null`, mirroring the v1 contract that callers treat a
+* `null` result as an invalid URL.
+*/
+var SAFE_SCHEME = /^(https?|mailto|tel):/i;
+var DANGEROUS_SCHEME = /^(javascript|data|vbscript):/i;
+var HAS_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+/**
+* Validate and normalize an href. Returns `{ href }` for safe values, or `null`.
+* @param {string} value
+* @returns {{ href: string }|null}
+*/
+function sanitizeHref(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	if (trimmed.startsWith("#")) return { href: trimmed };
+	if (DANGEROUS_SCHEME.test(trimmed)) return null;
+	if (HAS_SCHEME.test(trimmed)) return SAFE_SCHEME.test(trimmed) ? { href: trimmed } : null;
+	return { href: trimmed };
+}
+//#endregion
+//#region src/components/CommentsLayer/comment-urls.js
+function isAbsoluteWebUrl(value) {
+	if (!/^https?:\/\/[^\s/?#\\]+/i.test(value) || /[\s\\]/u.test(value)) return false;
+	try {
+		const url = new URL(value);
+		return (url.protocol === "https:" || url.protocol === "http:") && Boolean(url.hostname);
+	} catch {
+		return false;
+	}
+}
+function trimUrlPunctuation(value) {
+	const closingDelimiter = {
+		"(": ")",
+		"[": "]",
+		"{": "}"
+	};
+	const balance = {
+		")": 0,
+		"]": 0,
+		"}": 0
+	};
+	for (const character of value) {
+		const close = closingDelimiter[character];
+		if (close) balance[close] += 1;
+		else if (Object.hasOwn(balance, character)) balance[character] -= 1;
+	}
+	let end = value.length;
+	while (end > 0) {
+		const character = value[end - 1];
+		if (".,!?;:".includes(character)) end -= 1;
+		else if (balance[character] < 0) {
+			balance[character] += 1;
+			end -= 1;
+		} else break;
+	}
+	return value.slice(0, end);
+}
+function configureLink(link, href) {
+	link.setAttribute("href", href);
+	link.setAttribute("target", "_blank");
+	link.setAttribute("rel", "noopener noreferrer");
+}
+/** Render links without rewriting stored comment HTML or its rich-text structure. */
+function renderCommentHtml(value) {
+	if (typeof value !== "string") return "";
+	if (typeof document === "undefined") return value;
+	const template = document.createElement("template");
+	template.innerHTML = value;
+	for (const link of template.content.querySelectorAll("a")) {
+		const safe = sanitizeHref(link.getAttribute("href"));
+		if (safe && (isAbsoluteWebUrl(safe.href) || /^(mailto|tel):\S+$/i.test(safe.href))) configureLink(link, safe.href);
+		else link.replaceWith(...link.childNodes);
+	}
+	const walker = document.createTreeWalker(template.content, NodeFilter.SHOW_TEXT);
+	const textNodes = [];
+	while (walker.nextNode()) textNodes.push(walker.currentNode);
+	for (const node of textNodes) {
+		if (node.parentElement?.closest("a, script, style, textarea, code, pre")) continue;
+		const text = node.textContent;
+		const fragment = document.createDocumentFragment();
+		let end = 0;
+		for (const match of text.matchAll(/(^|[\s([{])(https?:\/\/[^\s<>"']+)/gi)) {
+			const href = trimUrlPunctuation(match[2]);
+			if (!isAbsoluteWebUrl(href)) continue;
+			const start = match.index + match[1].length;
+			fragment.append(document.createTextNode(text.slice(end, start)));
+			const link = document.createElement("a");
+			configureLink(link, href);
+			link.textContent = href;
+			fragment.append(link);
+			end = start + href.length;
+		}
+		if (end === 0) continue;
+		fragment.append(document.createTextNode(text.slice(end)));
+		node.replaceWith(fragment);
+	}
+	return template.innerHTML;
+}
+//#endregion
 //#region src/components/CommentsLayer/CommentDialog.vue
 var _hoisted_1$27 = [
 	"aria-label",
@@ -13540,6 +13648,12 @@ var CommentDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default({
 				return a.createdTime - b.createdTime;
 			});
 		});
+		const renderedCommentTexts = computed$1(() => new Map(comments.value.map((comment) => [comment.commentId, renderCommentHtml(comment.commentText)])));
+		const handleDialogClick = (event) => {
+			if (event.target instanceof Element && event.target.closest(".comment a[href]")) return;
+			event.preventDefault();
+			return setFocus();
+		};
 		const dialogAccessibleLabel = computed$1(() => {
 			if (props.comment.trackedChangeLabel) return props.comment.trackedChangeLabel;
 			if (props.comment.trackedChange) return "Tracked change discussion";
@@ -14168,7 +14282,7 @@ var CommentDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default({
 					"is-active": isDialogActive.value || isPendingNewComment.value,
 					"is-resolved": props.comment.resolvedTime
 				}]),
-				onClick: withModifiers(setFocus, ["stop", "prevent"]),
+				onClick: withModifiers(handleDialogClick, ["stop"]),
 				style: normalizeStyle(getSidebarCommentStyle.value),
 				ref_key: "commentDialogElement",
 				ref: commentDialogElement,
@@ -14305,7 +14419,7 @@ var CommentDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default({
 								class: normalizeClass(["comment", index === 0 ? bodyOverflowClass.value : void 0]),
 								ref_for: true,
 								ref: index === 0 ? setParentBodyRef : void 0,
-								innerHTML: comment.commentText
+								innerHTML: renderedCommentTexts.value.get(comment.commentId)
 							}, null, 10, _hoisted_38)) : unref(isDebugging) && !isEditingThisComment.value(comment) ? (openBlock(), createElementBlock("div", _hoisted_39, toDisplayString(unref(editorCommentPositions)[comment.importedId !== void 0 ? comment.importedId : comment.commentId]?.bounds), 1)) : (openBlock(), createElementBlock("div", _hoisted_40, [createElementVNode("div", _hoisted_41, [createVNode(CommentInput_default, {
 								ref_for: true,
 								ref: setEditCommentInputRef(comment.commentId),
@@ -14381,7 +14495,7 @@ var CommentDialog_default = /*#__PURE__*/ _plugin_vue_export_helper_default({
 			], 64))], 14, _hoisted_1$27)), [[_directive_click_outside, handleClickOutside]]);
 		};
 	}
-}, [["__scopeId", "data-v-dcbcc0d4"]]);
+}, [["__scopeId", "data-v-c189ab35"]]);
 //#endregion
 //#region src/components/CommentsLayer/commentsList/ReviewDirectoryListItem.vue
 var _hoisted_1$26 = [
@@ -18607,35 +18721,6 @@ function shouldHandleFindShortcut(event, { focusInside, owner }) {
 	return (!active || active === document.body || active === document.documentElement) && ownsAmbientFindShortcut(owner);
 }
 //#endregion
-//#region src/internal/toolbar/built-in/url-safety.js
-/**
-* Minimal href sanitizer for the built-in link popover.
-*
-* The v1 toolbar used the shared `@superdoc/url-validation` package, which is not
-* a resolvable runtime dependency of the published `superdoc` ES build. This
-* keeps the same fail-closed posture (only known-safe schemes pass) without
-* pulling in that package: dangerous schemes (`javascript:`, `data:`,
-* `vbscript:`) return `null`, mirroring the v1 contract that callers treat a
-* `null` result as an invalid URL.
-*/
-var SAFE_SCHEME = /^(https?|mailto|tel):/i;
-var DANGEROUS_SCHEME = /^(javascript|data|vbscript):/i;
-var HAS_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
-/**
-* Validate and normalize an href. Returns `{ href }` for safe values, or `null`.
-* @param {string} value
-* @returns {{ href: string }|null}
-*/
-function sanitizeHref(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	if (trimmed.startsWith("#")) return { href: trimmed };
-	if (DANGEROUS_SCHEME.test(trimmed)) return null;
-	if (HAS_SCHEME.test(trimmed)) return SAFE_SCHEME.test(trimmed) ? { href: trimmed } : null;
-	return { href: trimmed };
-}
-//#endregion
 //#region ../../shared/common/icons/bold-solid.svg?raw
 var bold_solid_default = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 384 512\"><!--!Font Awesome Free 6.7.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free Copyright 2025 Fonticons, Inc.--><path d=\"M0 64C0 46.3 14.3 32 32 32l48 0 16 0 128 0c70.7 0 128 57.3 128 128c0 31.3-11.3 60.1-30 82.3c37.1 22.4 62 63.1 62 109.7c0 70.7-57.3 128-128 128L96 480l-16 0-48 0c-17.7 0-32-14.3-32-32s14.3-32 32-32l16 0 0-160L48 96 32 96C14.3 96 0 81.7 0 64zM224 224c35.3 0 64-28.7 64-64s-28.7-64-64-64L112 96l0 128 112 0zM112 288l0 128 144 0c35.3 0 64-28.7 64-64s-28.7-64-64-64l-32 0-112 0z\"/></svg>";
 //#endregion
@@ -46401,7 +46486,7 @@ var SuperDoc = class extends import_eventemitter3.default {
 		}
 		this.userColorMap = /* @__PURE__ */ new Map();
 		this.colorIndex = 0;
-		this.version = "2.23.1-next.6";
+		this.version = "2.23.1-next.7";
 		this.#log("🦋 [superdoc] Using SuperDoc version:", this.version);
 		this.superdocId = config.superdocId || v4();
 		this.colors = this.config.colors ?? [];