themekit-js 1.2604.404 → 1.2604.419

package/dist/node/cli.js

@@ -1,4 +1,4 @@
-import { a as getDefaultExportFromCjs, q as c, t as clearCache, j as init, b as build, p as serve, d as createServer, v as version } from './serve-pETCpTUr.js';
+import { a as getDefaultExportFromCjs, q as c, t as clearCache, j as init, b as build, p as serve, d as createServer, v as version } from './serve-DnazDMeO.js';
 import { createLogger } from 'vite';
 import 'path';
 import 'markdown-it';

package/dist/node/index.js

@@ -1,7 +1,7 @@
 import { normalizePath } from 'vite';
 export { loadEnv } from 'vite';
-import { g as glob, c as createMarkdownRenderer, f as fs, m as matter, a as getDefaultExportFromCjs } from './serve-pETCpTUr.js';
-export { S as ScaffoldThemeType, b as build, d as createServer, e as defineConfig, h as defineConfigWithTheme, i as defineLoader, j as init, k as mergeConfig, r as resolveConfig, l as resolvePages, n as resolveSiteData, o as resolveUserConfig, s as scaffold, p as serve } from './serve-pETCpTUr.js';
+import { g as glob, c as createMarkdownRenderer, f as fs, m as matter, a as getDefaultExportFromCjs } from './serve-DnazDMeO.js';
+export { S as ScaffoldThemeType, b as build, d as createServer, e as defineConfig, h as defineConfigWithTheme, i as defineLoader, j as init, k as mergeConfig, r as resolveConfig, l as resolvePages, n as resolveSiteData, o as resolveUserConfig, s as scaffold, p as serve } from './serve-DnazDMeO.js';
 import path from 'path';
 import 'crypto';
 import 'module';

package/dist/node/{serve-pETCpTUr.js → serve-DnazDMeO.js}

@@ -2176,11 +2176,22 @@ async function createSymlink$1 (srcpath, dstpath, type) {
   } catch { }
 
   if (stats && stats.isSymbolicLink()) {
-    const [srcStat, dstStat] = await Promise.all([
-      fs$e.stat(srcpath),
-      fs$e.stat(dstpath)
-    ]);
+    // When srcpath is relative, resolve it relative to dstpath's directory
+    // (standard symlink behavior) or fall back to cwd if that doesn't exist
+    let srcStat;
+    if (path$h.isAbsolute(srcpath)) {
+      srcStat = await fs$e.stat(srcpath);
+    } else {
+      const dstdir = path$h.dirname(dstpath);
+      const relativeToDst = path$h.join(dstdir, srcpath);
+      try {
+        srcStat = await fs$e.stat(relativeToDst);
+      } catch {
+        srcStat = await fs$e.stat(srcpath);
+      }
+    }
 
+    const dstStat = await fs$e.stat(dstpath);
     if (areIdentical(srcStat, dstStat)) return
   }
 
@@ -2202,7 +2213,21 @@ function createSymlinkSync$1 (srcpath, dstpath, type) {
     stats = fs$e.lstatSync(dstpath);
   } catch { }
   if (stats && stats.isSymbolicLink()) {
-    const srcStat = fs$e.statSync(srcpath);
+    // When srcpath is relative, resolve it relative to dstpath's directory
+    // (standard symlink behavior) or fall back to cwd if that doesn't exist
+    let srcStat;
+    if (path$h.isAbsolute(srcpath)) {
+      srcStat = fs$e.statSync(srcpath);
+    } else {
+      const dstdir = path$h.dirname(dstpath);
+      const relativeToDst = path$h.join(dstdir, srcpath);
+      try {
+        srcStat = fs$e.statSync(relativeToDst);
+      } catch {
+        srcStat = fs$e.statSync(srcpath);
+      }
+    }
+
     const dstStat = fs$e.statSync(dstpath);
     if (areIdentical(srcStat, dstStat)) return
   }
@@ -2985,7 +3010,7 @@ function expand$2(str, isTop) {
       var y = numeric(n[1]);
       var width = Math.max(n[0].length, n[1].length);
       var incr = n.length == 3
-        ? Math.abs(numeric(n[2]))
+        ? Math.max(Math.abs(numeric(n[2])), 1)
         : 1;
       var test = lte;
       var reverse = y < x;
@@ -14624,6 +14649,8 @@ const path$a = path$q;
 const WIN_SLASH = '\\\\/';
 const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
 
+const DEFAULT_MAX_EXTGLOB_RECURSION = 0;
+
 /**
  * Posix glob regex
  */
@@ -14687,6 +14714,7 @@ const WINDOWS_CHARS = {
  */
 
 const POSIX_REGEX_SOURCE$1 = {
+  __proto__: null,
   alnum: 'a-zA-Z0-9',
   alpha: 'a-zA-Z',
   ascii: '\\x00-\\x7F',
@@ -14704,6 +14732,7 @@ const POSIX_REGEX_SOURCE$1 = {
 };
 
 var constants$3 = {
+  DEFAULT_MAX_EXTGLOB_RECURSION,
   MAX_LENGTH: 1024 * 64,
   POSIX_REGEX_SOURCE: POSIX_REGEX_SOURCE$1,
 
@@ -14717,6 +14746,7 @@ var constants$3 = {
 
   // Replace globs with equivalent patterns to reduce parsing time.
   REPLACEMENTS: {
+    __proto__: null,
     '***': '*',
     '**/**': '**',
     '**/**/**': '**'
@@ -15299,6 +15329,277 @@ const syntaxError = (type, char) => {
   return `Missing ${type}: "${char}" - use "\\\\${char}" to match literal characters`;
 };
 
+const splitTopLevel = input => {
+  const parts = [];
+  let bracket = 0;
+  let paren = 0;
+  let quote = 0;
+  let value = '';
+  let escaped = false;
+
+  for (const ch of input) {
+    if (escaped === true) {
+      value += ch;
+      escaped = false;
+      continue;
+    }
+
+    if (ch === '\\') {
+      value += ch;
+      escaped = true;
+      continue;
+    }
+
+    if (ch === '"') {
+      quote = quote === 1 ? 0 : 1;
+      value += ch;
+      continue;
+    }
+
+    if (quote === 0) {
+      if (ch === '[') {
+        bracket++;
+      } else if (ch === ']' && bracket > 0) {
+        bracket--;
+      } else if (bracket === 0) {
+        if (ch === '(') {
+          paren++;
+        } else if (ch === ')' && paren > 0) {
+          paren--;
+        } else if (ch === '|' && paren === 0) {
+          parts.push(value);
+          value = '';
+          continue;
+        }
+      }
+    }
+
+    value += ch;
+  }
+
+  parts.push(value);
+  return parts;
+};
+
+const isPlainBranch = branch => {
+  let escaped = false;
+
+  for (const ch of branch) {
+    if (escaped === true) {
+      escaped = false;
+      continue;
+    }
+
+    if (ch === '\\') {
+      escaped = true;
+      continue;
+    }
+
+    if (/[?*+@!()[\]{}]/.test(ch)) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
+const normalizeSimpleBranch = branch => {
+  let value = branch.trim();
+  let changed = true;
+
+  while (changed === true) {
+    changed = false;
+
+    if (/^@\([^\\()[\]{}|]+\)$/.test(value)) {
+      value = value.slice(2, -1);
+      changed = true;
+    }
+  }
+
+  if (!isPlainBranch(value)) {
+    return;
+  }
+
+  return value.replace(/\\(.)/g, '$1');
+};
+
+const hasRepeatedCharPrefixOverlap = branches => {
+  const values = branches.map(normalizeSimpleBranch).filter(Boolean);
+
+  for (let i = 0; i < values.length; i++) {
+    for (let j = i + 1; j < values.length; j++) {
+      const a = values[i];
+      const b = values[j];
+      const char = a[0];
+
+      if (!char || a !== char.repeat(a.length) || b !== char.repeat(b.length)) {
+        continue;
+      }
+
+      if (a === b || a.startsWith(b) || b.startsWith(a)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+};
+
+const parseRepeatedExtglob = (pattern, requireEnd = true) => {
+  if ((pattern[0] !== '+' && pattern[0] !== '*') || pattern[1] !== '(') {
+    return;
+  }
+
+  let bracket = 0;
+  let paren = 0;
+  let quote = 0;
+  let escaped = false;
+
+  for (let i = 1; i < pattern.length; i++) {
+    const ch = pattern[i];
+
+    if (escaped === true) {
+      escaped = false;
+      continue;
+    }
+
+    if (ch === '\\') {
+      escaped = true;
+      continue;
+    }
+
+    if (ch === '"') {
+      quote = quote === 1 ? 0 : 1;
+      continue;
+    }
+
+    if (quote === 1) {
+      continue;
+    }
+
+    if (ch === '[') {
+      bracket++;
+      continue;
+    }
+
+    if (ch === ']' && bracket > 0) {
+      bracket--;
+      continue;
+    }
+
+    if (bracket > 0) {
+      continue;
+    }
+
+    if (ch === '(') {
+      paren++;
+      continue;
+    }
+
+    if (ch === ')') {
+      paren--;
+
+      if (paren === 0) {
+        if (requireEnd === true && i !== pattern.length - 1) {
+          return;
+        }
+
+        return {
+          type: pattern[0],
+          body: pattern.slice(2, i),
+          end: i
+        };
+      }
+    }
+  }
+};
+
+const getStarExtglobSequenceOutput = pattern => {
+  let index = 0;
+  const chars = [];
+
+  while (index < pattern.length) {
+    const match = parseRepeatedExtglob(pattern.slice(index), false);
+
+    if (!match || match.type !== '*') {
+      return;
+    }
+
+    const branches = splitTopLevel(match.body).map(branch => branch.trim());
+    if (branches.length !== 1) {
+      return;
+    }
+
+    const branch = normalizeSimpleBranch(branches[0]);
+    if (!branch || branch.length !== 1) {
+      return;
+    }
+
+    chars.push(branch);
+    index += match.end + 1;
+  }
+
+  if (chars.length < 1) {
+    return;
+  }
+
+  const source = chars.length === 1
+    ? utils$k.escapeRegex(chars[0])
+    : `[${chars.map(ch => utils$k.escapeRegex(ch)).join('')}]`;
+
+  return `${source}*`;
+};
+
+const repeatedExtglobRecursion = pattern => {
+  let depth = 0;
+  let value = pattern.trim();
+  let match = parseRepeatedExtglob(value);
+
+  while (match) {
+    depth++;
+    value = match.body.trim();
+    match = parseRepeatedExtglob(value);
+  }
+
+  return depth;
+};
+
+const analyzeRepeatedExtglob = (body, options) => {
+  if (options.maxExtglobRecursion === false) {
+    return { risky: false };
+  }
+
+  const max =
+    typeof options.maxExtglobRecursion === 'number'
+      ? options.maxExtglobRecursion
+      : constants$2.DEFAULT_MAX_EXTGLOB_RECURSION;
+
+  const branches = splitTopLevel(body).map(branch => branch.trim());
+
+  if (branches.length > 1) {
+    if (
+      branches.some(branch => branch === '') ||
+      branches.some(branch => /^[*?]+$/.test(branch)) ||
+      hasRepeatedCharPrefixOverlap(branches)
+    ) {
+      return { risky: true };
+    }
+  }
+
+  for (const branch of branches) {
+    const safeOutput = getStarExtglobSequenceOutput(branch);
+    if (safeOutput) {
+      return { risky: true, safeOutput };
+    }
+
+    if (repeatedExtglobRecursion(branch) > max) {
+      return { risky: true };
+    }
+  }
+
+  return { risky: false };
+};
+
 /**
  * Parse the given input string.
  * @param {String} input
@@ -15480,6 +15781,8 @@ const parse$8 = (input, options) => {
     token.prev = prev;
     token.parens = state.parens;
     token.output = state.output;
+    token.startIndex = state.index;
+    token.tokensIndex = tokens.length;
     const output = (opts.capture ? '(' : '') + token.open;
 
     increment('parens');
@@ -15489,6 +15792,34 @@ const parse$8 = (input, options) => {
   };
 
   const extglobClose = token => {
+    const literal = input.slice(token.startIndex, state.index + 1);
+    const body = input.slice(token.startIndex + 2, state.index);
+    const analysis = analyzeRepeatedExtglob(body, opts);
+
+    if ((token.type === 'plus' || token.type === 'star') && analysis.risky) {
+      const safeOutput = analysis.safeOutput
+        ? (token.output ? '' : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput)
+        : undefined;
+      const open = tokens[token.tokensIndex];
+
+      open.type = 'text';
+      open.value = literal;
+      open.output = safeOutput || utils$k.escapeRegex(literal);
+
+      for (let i = token.tokensIndex + 1; i < tokens.length; i++) {
+        tokens[i].value = '';
+        tokens[i].output = '';
+        delete tokens[i].suffix;
+      }
+
+      state.output = token.output + open.output;
+      state.backtrack = true;
+
+      push({ type: 'paren', extglob: true, value, output: '' });
+      decrement('parens');
+      return;
+    }
+
     let output = token.close + (opts.capture ? ')' : '');
     let rest;
 
@@ -29255,7 +29586,7 @@ function container_plugin (md, name, options) {
   md.renderer.rules['container_' + name + '_close'] = render;
 }
 
-const urlAlphabet =
+let urlAlphabet =
   'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict';
 
 const POOL_SIZE_MULTIPLIER = 128;
@@ -30896,7 +31227,7 @@ async function createMarkdownToVueRenderFn(srcDir, options = {}, pages, isBuild
               let src2 = token.attrGet("src") == null ? "" : token.attrGet("src");
               if (src2 != null && isBuild) {
                 siteConfig?.logger.info("raw:" + src2);
-                src2 = src2.replace("../.themekit/dist", "..");
+                src2 = src2.replace("../.themekit/dist/", "../");
                 if (siteConfig != null) {
                   src2 = src2.replace(".themekit/dist/", siteConfig?.site.base);
                 }
@@ -36757,6 +37088,7 @@ var sax = {};
 	    clearBuffers(parser);
 	    parser.q = parser.c = '';
 	    parser.bufferCheckPosition = sax.MAX_BUFFER_LENGTH;
+	    parser.encoding = null;
 	    parser.opt = opt || {};
 	    parser.opt.lowercase = parser.opt.lowercase || parser.opt.lowercasetags;
 	    parser.looseCase = parser.opt.lowercase ? 'toLowerCase' : 'toUpperCase';
@@ -36901,6 +37233,39 @@ var sax = {};
 	    return new SAXStream(strict, opt)
 	  }
 
+	  function determineBufferEncoding(data, isEnd) {
+	    // BOM-based detection is the most reliable signal when present.
+	    if (data.length >= 2) {
+	      if (data[0] === 0xff && data[1] === 0xfe) {
+	        return 'utf-16le'
+	      }
+
+	      if (data[0] === 0xfe && data[1] === 0xff) {
+	        return 'utf-16be'
+	      }
+	    }
+
+	    if (data.length >= 3 && data[0] === 0xef && data[1] === 0xbb && data[2] === 0xbf) {
+	      return 'utf8'
+	    }
+
+	    if (data.length >= 4) {
+	      // XML documents without a BOM still start with "<?xml", which is enough
+	      // to distinguish UTF-16LE/BE from UTF-8 by looking at the zero bytes.
+	      if (data[0] === 0x3c && data[1] === 0x00 && data[2] === 0x3f && data[3] === 0x00) {
+	        return 'utf-16le'
+	      }
+
+	      if (data[0] === 0x00 && data[1] === 0x3c && data[2] === 0x00 && data[3] === 0x3f) {
+	        return 'utf-16be'
+	      }
+
+	      return 'utf8'
+	    }
+
+	    return isEnd ? 'utf8' : null
+	  }
+
 	  function SAXStream(strict, opt) {
 	    if (!(this instanceof SAXStream)) {
 	      return new SAXStream(strict, opt)
@@ -36927,7 +37292,7 @@ var sax = {};
 	    };
 
 	    this._decoder = null;
-
+	    this._decoderBuffer = null;
 	    streamWraps.forEach(function (ev) {
 	      Object.defineProperty(me, 'on' + ev, {
 	        get: function () {
@@ -36953,16 +37318,47 @@ var sax = {};
 	    },
 	  });
 
+	  SAXStream.prototype._decodeBuffer = function (data, isEnd) {
+	    if (this._decoderBuffer) {
+	      // Keep incomplete leading bytes until we have enough data to infer the
+	      // stream encoding, then decode the buffered prefix together with the next chunk.
+	      data = Buffer.concat([this._decoderBuffer, data]);
+	      this._decoderBuffer = null;
+	    }
+
+	    if (!this._decoder) {
+	      var encoding = determineBufferEncoding(data, isEnd);
+	      if (!encoding) {
+	        // A very short first chunk may not contain enough bytes to detect the
+	        // encoding yet, so defer decoding until the next write/end call.
+	        this._decoderBuffer = data;
+	        return ''
+	      }
+
+	      // Store the detected transport encoding so strict mode can compare it
+	      // with the optional encoding declared in the XML prolog later on.
+	      this._parser.encoding = encoding;
+	      this._decoder = new TextDecoder(encoding);
+	    }
+
+	    return this._decoder.decode(data, { stream: !isEnd })
+	  };
+
 	  SAXStream.prototype.write = function (data) {
 	    if (
 	      typeof Buffer === 'function' &&
 	      typeof Buffer.isBuffer === 'function' &&
 	      Buffer.isBuffer(data)
 	    ) {
-	      if (!this._decoder) {
-	        this._decoder = new TextDecoder('utf8');
+	      data = this._decodeBuffer(data, false);
+	    } else if (this._decoderBuffer) {
+	      // Flush any buffered binary prefix before handling a string chunk.
+	      // This only matters if the caller mixes Buffer and string writes (used in test).
+	      var remaining = this._decodeBuffer(Buffer.alloc(0), true);
+	      if (remaining) {
+	        this._parser.write(remaining);
+	        this.emit('data', remaining);
 	      }
-	      data = this._decoder.decode(data, { stream: true });
 	    }
 
 	    this._parser.write(data.toString());
@@ -36975,7 +37371,13 @@ var sax = {};
 	      this.write(chunk);
 	    }
 	    // Flush any remaining decoded data from the TextDecoder
-	    if (this._decoder) {
+	    if (this._decoderBuffer) {
+	      var finalChunk = this._decodeBuffer(Buffer.alloc(0), true);
+	      if (finalChunk) {
+	        this._parser.write(finalChunk);
+	        this.emit('data', finalChunk);
+	      }
+	    } else if (this._decoder) {
 	      var remaining = this._decoder.decode();
 	      if (remaining) {
 	        this._parser.write(remaining);
@@ -37368,6 +37770,59 @@ var sax = {};
 	    parser[event] && parser[event](data);
 	  }
 
+	  function getDeclaredEncoding(body) {
+	    var match = body && body.match(/(?:^|\s)encoding\s*=\s*(['"])([^'"]+)\1/i);
+	    return match ? match[2] : null
+	  }
+
+	  function normalizeEncodingName(encoding) {
+	    if (!encoding) {
+	      return null
+	    }
+
+	    return encoding.toLowerCase().replace(/[^a-z0-9]/g, '')
+	  }
+
+	  function encodingsMatch(detectedEncoding, declaredEncoding) {
+	    const detected = normalizeEncodingName(detectedEncoding);
+	    const declared = normalizeEncodingName(declaredEncoding);
+
+	    if (!detected || !declared) {
+	      return true
+	    }
+
+	    if (declared === 'utf16') {
+	      return detected === 'utf16le' || detected === 'utf16be'
+	    }
+
+	    return detected === declared
+	  }
+
+	  function validateXmlDeclarationEncoding(parser, data) {
+	    if (
+	      !parser.strict ||
+	      !parser.encoding ||
+	      !data ||
+	      data.name !== 'xml'
+	    ) {
+	      return
+	    }
+
+	    var declaredEncoding = getDeclaredEncoding(data.body);
+	    if (
+	      declaredEncoding &&
+	      !encodingsMatch(parser.encoding, declaredEncoding)
+	    ) {
+	      strictFail(
+	        parser,
+	        'XML declaration encoding ' +
+	          declaredEncoding +
+	          ' does not match detected stream encoding ' +
+	          parser.encoding.toUpperCase()
+	      );
+	    }
+	  }
+
 	  function emitNode(parser, nodeType, data) {
 	    if (parser.textNode) closeText(parser);
 	    emit(parser, nodeType, data);
@@ -38071,10 +38526,12 @@ var sax = {};
 
 	        case S.PROC_INST_ENDING:
 	          if (c === '>') {
-	            emitNode(parser, 'onprocessinginstruction', {
+	            const procInstEndData = {
 	              name: parser.procInstName,
 	              body: parser.procInstBody,
-	            });
+	            };
+	            validateXmlDeclarationEncoding(parser, procInstEndData);
+	            emitNode(parser, 'onprocessinginstruction', procInstEndData);
 	            parser.procInstName = parser.procInstBody = '';
 	            parser.state = S.TEXT;
 	          } else {
@@ -39343,7 +39800,7 @@ async function generateSitemap(siteConfig) {
 }
 
 /**
-* @vue/shared v3.5.29
+* @vue/shared v3.5.32
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/
@@ -39441,7 +39898,7 @@ function escapeHtml(string) {
 
 var escape$1 = /*@__PURE__*/getDefaultExportFromCjs(escapeHtml_1);
 
-var version = "1.2604.0404";
+var version = "1.2604.0419";
 
 async function renderPage(render, config, page, result, appChunk, cssChunk, assets, pageToHashMap, metadataScript, additionalHeadTags) {
   const routePath = `/${page.replace(/\.md$/, "")}`;
@@ -40313,7 +40770,7 @@ var lodash_templatesettings = templateSettings;
 
 /**
  * Lodash (Custom Build) <https://lodash.com/>
- * Build: `lodash modularize exports="npm" -o ./`
+ * Build: `lodash modularize exports="npm" --repo lodash/lodash#4.18.1 -o ./`
  * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
  * Released under MIT license <https://lodash.com/license>
  * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
@@ -40325,6 +40782,10 @@ lodash_template.exports;
 	var reInterpolate = lodash__reinterpolate,
 	    templateSettings = lodash_templatesettings;
 
+	/** Error message constants. */
+	var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`',
+	    INVALID_TEMPL_IMPORTS_ERROR_TEXT = 'Invalid `imports` option passed into `_.template`';
+
 	/** Used to detect hot functions by number of calls within a span of milliseconds. */
 	var HOT_COUNT = 800,
 	    HOT_SPAN = 16;
@@ -40377,6 +40838,18 @@ lodash_template.exports;
 	 */
 	var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
 
+	/**
+	 * Used to validate the `validate` option in `_.template` variable.
+	 *
+	 * Forbids characters which could potentially change the meaning of the function argument definition:
+	 * - "()," (modification of function parameters)
+	 * - "=" (default value)
+	 * - "[]{}" (destructuring of function parameters)
+	 * - "/" (beginning of a comment)
+	 * - whitespace
+	 */
+	var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
+
 	/**
 	 * Used to match
 	 * [ES template delimiters](http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components).
@@ -40480,6 +40953,27 @@ lodash_template.exports;
 	  return func.apply(thisArg, args);
 	}
 
+	/**
+	 * A specialized version of `_.forEach` for arrays without support for
+	 * iteratee shorthands.
+	 *
+	 * @private
+	 * @param {Array} [array] The array to iterate over.
+	 * @param {Function} iteratee The function invoked per iteration.
+	 * @returns {Array} Returns `array`.
+	 */
+	function arrayEach(array, iteratee) {
+	  var index = -1,
+	      length = array == null ? 0 : array.length;
+
+	  while (++index < length) {
+	    if (iteratee(array[index], index, array) === false) {
+	      break;
+	    }
+	  }
+	  return array;
+	}
+
 	/**
 	 * A specialized version of `_.map` for arrays without support for iteratee
 	 * shorthands.
@@ -40663,7 +41157,7 @@ lodash_template.exports;
 	      length = result.length;
 
 	  for (var key in value) {
-	    if ((inherited || hasOwnProperty.call(value, key)) &&
+	    if ((hasOwnProperty.call(value, key)) &&
 	        !(skipIndexes && (
 	           // Safari 9 has enumerable `arguments.length` in strict mode.
 	           key == 'length' ||
@@ -40795,28 +41289,6 @@ lodash_template.exports;
 	  return result;
 	}
 
-	/**
-	 * The base implementation of `_.keysIn` which doesn't treat sparse arrays as dense.
-	 *
-	 * @private
-	 * @param {Object} object The object to query.
-	 * @returns {Array} Returns the array of property names.
-	 */
-	function baseKeysIn(object) {
-	  if (!isObject(object)) {
-	    return nativeKeysIn(object);
-	  }
-	  var isProto = isPrototype(object),
-	      result = [];
-
-	  for (var key in object) {
-	    if (!(key == 'constructor' && (isProto || !hasOwnProperty.call(object, key)))) {
-	      result.push(key);
-	    }
-	  }
-	  return result;
-	}
-
 	/**
 	 * The base implementation of `_.rest` which doesn't validate or coerce arguments.
 	 *
@@ -41066,25 +41538,6 @@ lodash_template.exports;
 	  return value === proto;
 	}
 
-	/**
-	 * This function is like
-	 * [`Object.keys`](http://ecma-international.org/ecma-262/7.0/#sec-object.keys)
-	 * except that it includes inherited enumerable properties.
-	 *
-	 * @private
-	 * @param {Object} object The object to query.
-	 * @returns {Array} Returns the array of property names.
-	 */
-	function nativeKeysIn(object) {
-	  var result = [];
-	  if (object != null) {
-	    for (var key in Object(object)) {
-	      result.push(key);
-	    }
-	  }
-	  return result;
-	}
-
 	/**
 	 * Converts `value` to a string using `Object.prototype.toString`.
 	 *
@@ -41567,7 +42020,7 @@ lodash_template.exports;
 	}
 
 	/**
-	 * This method is like `_.assignIn` except that it accepts `customizer`
+	 * This method is like `_.assign` except that it accepts `customizer`
 	 * which is invoked to produce the assigned values. If `customizer` returns
 	 * `undefined`, assignment is handled by the method instead. The `customizer`
 	 * is invoked with five arguments: (objValue, srcValue, key, object, source).
@@ -41577,26 +42030,25 @@ lodash_template.exports;
 	 * @static
 	 * @memberOf _
 	 * @since 4.0.0
-	 * @alias extendWith
 	 * @category Object
 	 * @param {Object} object The destination object.
 	 * @param {...Object} sources The source objects.
 	 * @param {Function} [customizer] The function to customize assigned values.
 	 * @returns {Object} Returns `object`.
-	 * @see _.assignWith
+	 * @see _.assignInWith
 	 * @example
 	 *
 	 * function customizer(objValue, srcValue) {
 	 *   return _.isUndefined(objValue) ? srcValue : objValue;
 	 * }
 	 *
-	 * var defaults = _.partialRight(_.assignInWith, customizer);
+	 * var defaults = _.partialRight(_.assignWith, customizer);
 	 *
 	 * defaults({ 'a': 1 }, { 'b': 2 }, { 'a': 3 });
 	 * // => { 'a': 1, 'b': 2 }
 	 */
-	var assignInWith = createAssigner(function(object, source, srcIndex, customizer) {
-	  copyObject(source, keysIn(source), object, customizer);
+	var assignWith = createAssigner(function(object, source, srcIndex, customizer) {
+	  copyObject(source, keys(source), object, customizer);
 	});
 
 	/**
@@ -41631,33 +42083,6 @@ lodash_template.exports;
 	  return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
 	}
 
-	/**
-	 * Creates an array of the own and inherited enumerable property names of `object`.
-	 *
-	 * **Note:** Non-object values are coerced to objects.
-	 *
-	 * @static
-	 * @memberOf _
-	 * @since 3.0.0
-	 * @category Object
-	 * @param {Object} object The object to query.
-	 * @returns {Array} Returns the array of property names.
-	 * @example
-	 *
-	 * function Foo() {
-	 *   this.a = 1;
-	 *   this.b = 2;
-	 * }
-	 *
-	 * Foo.prototype.c = 3;
-	 *
-	 * _.keysIn(new Foo);
-	 * // => ['a', 'b', 'c'] (iteration order is not guaranteed)
-	 */
-	function keysIn(object) {
-	  return isArrayLike(object) ? arrayLikeKeys(object, true) : baseKeysIn(object);
-	}
-
 	/**
 	 * Creates a compiled template function that can interpolate data properties
 	 * in "interpolate" delimiters, HTML-escape interpolated data properties in
@@ -41665,6 +42090,10 @@ lodash_template.exports;
 	 * properties may be accessed as free variables in the template. If a setting
 	 * object is given, it takes precedence over `_.templateSettings` values.
 	 *
+	 * **Security:** `_.template` is insecure and should not be used. It will be
+	 * removed in Lodash v5. Avoid untrusted input. See
+	 * [threat model](https://github.com/lodash/lodash/blob/main/threat-model.md).
+	 *
 	 * **Note:** In the development build `_.template` utilizes
 	 * [sourceURLs](http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)
 	 * for easier debugging.
@@ -41772,12 +42201,18 @@ lodash_template.exports;
 	    options = undefined;
 	  }
 	  string = toString(string);
-	  options = assignInWith({}, options, settings, customDefaultsAssignIn);
+	  options = assignWith({}, options, settings, customDefaultsAssignIn);
 
-	  var imports = assignInWith({}, options.imports, settings.imports, customDefaultsAssignIn),
+	  var imports = assignWith({}, options.imports, settings.imports, customDefaultsAssignIn),
 	      importsKeys = keys(imports),
 	      importsValues = baseValues(imports, importsKeys);
 
+	  arrayEach(importsKeys, function(key) {
+	    if (reForbiddenIdentifierChars.test(key)) {
+	      throw new Error(INVALID_TEMPL_IMPORTS_ERROR_TEXT);
+	    }
+	  });
+
 	  var isEscaping,
 	      isEvaluating,
 	      index = 0,
@@ -41794,11 +42229,11 @@ lodash_template.exports;
 
 	  // Use a sourceURL for easier debugging.
 	  // The sourceURL gets injected into the source that's eval-ed, so be careful
-	  // with lookup (in case of e.g. prototype pollution), and strip newlines if any.
-	  // A newline wouldn't be a valid sourceURL anyway, and it'd enable code injection.
+	  // to normalize all kinds of whitespace, so e.g. newlines (and unicode versions of it) can't sneak in
+	  // and escape the comment, thus injecting code that gets evaled.
 	  var sourceURL = hasOwnProperty.call(options, 'sourceURL')
 	    ? ('//# sourceURL=' +
-	       (options.sourceURL + '').replace(/[\r\n]/g, ' ') +
+	       (options.sourceURL + '').replace(/\s/g, ' ') +
 	       '\n')
 	    : '';
 
@@ -41831,12 +42266,16 @@ lodash_template.exports;
 
 	  // If `variable` is not specified wrap a with-statement around the generated
 	  // code to add the data object to the top of the scope chain.
-	  // Like with sourceURL, we take care to not check the option's prototype,
-	  // as this configuration is a code injection vector.
 	  var variable = hasOwnProperty.call(options, 'variable') && options.variable;
 	  if (!variable) {
 	    source = 'with (obj) {\n' + source + '\n}\n';
 	  }
+	  // Throw an error if a forbidden character was found in `variable`, to prevent
+	  // potential command injection attacks.
+	  else if (reForbiddenIdentifierChars.test(variable)) {
+	    throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
+	  }
+
 	  // Cleanup code by stripping empty strings.
 	  source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
 	    .replace(reEmptyStringMiddle, '$1')

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "themekit-js",
-    "version": "1.2604.0404",  
+    "version": "1.2604.0419",  
     "description": "基于VitePress开发的Markdown静态网站生成器",
      "type": "module",
      "packageManager": "pnpm@8.15.6", 
@@ -110,9 +110,9 @@
         "js-base64": "^3.7.7",
         "mark.js": "8.11.1",
         "minisearch": "^6.3.0",
-        "shiki": "^1.2.4",
-        "vite": "^5.2.8",
-        "vue": "^3.4.21",    
+        "vite": "^6.2.5",
+        "shiki": "^1.2.4", 
+         "vue": "^3.4.21",    
         "markdown-it": "^14.1.0"
     },
     "peerDependencies": {