wendang-react 0.6.3 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendang-react",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Wendang 原生 React 文档、工作表和思维导图编辑与展示组件。",
   "type": "module",
   "license": "MIT",
@@ -74,6 +74,14 @@
     "./export": {
       "types": "./dist/types/export.d.ts",
       "import": "./dist/export.js"
+    },
+    "./i18n": {
+      "types": "./dist/types/i18n.d.ts",
+      "import": "./dist/i18n.js"
+    },
+    "./locales/*": {
+      "types": "./dist/types/locales/*.d.ts",
+      "import": "./dist/locales/*.js"
     }
   },
   "files": [
@@ -81,6 +89,8 @@
     "README.md",
     "LICENSE",
     "NOTICE.md",
+    "integrity.json",
+    "verify-integrity.mjs",
     "third-party-notices"
   ],
   "sideEffects": [
@@ -120,8 +130,8 @@
     "lowlight": "3.3.0",
     "numfmt": "4.0.1",
     "tiny-pinyin": "1.3.2",
-    "wendang": "0.6.1",
-    "wendang-export": "0.6.2"
+    "wendang": "0.6.3",
+    "wendang-export": "0.6.4"
   },
   "devDependencies": {
     "react": "19.3.1",
@@ -144,7 +154,7 @@
   "scripts": {
     "sync:engine": "node ../../scripts/sync-react-engine.mjs",
     "typecheck": "pnpm sync:engine && tsc --noEmit",
-    "build": "pnpm sync:engine && tsc --noEmit && vite build && tsc --emitDeclarationOnly && node ../../scripts/copy-react-styles.mjs",
-    "dev": "pnpm sync:engine && vite build --watch"
+    "build": "pnpm sync:engine && tsc --noEmit && vite build && tsc --emitDeclarationOnly && node ../../scripts/copy-react-styles.mjs && node ../../scripts/minify-output.mjs react && node ../../scripts/generate-notices.mjs react && node ../../scripts/package-integrity.mjs generate react",
+    "dev": "node ../../scripts/watch-react.mjs"
   }
 }

package/verify-integrity.mjs

@@ -0,0 +1,138 @@
+/**
+ * Standalone package verifier, copied into the npm payload by the build.
+ * SHA-256 detects changes against a baseline; it is not a publisher signature.
+ */
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const integrityName = 'integrity.json';
+export const verifierName = 'verify-integrity.mjs';
+export const payloadRoots = ['dist', 'README.md', 'LICENSE', 'NOTICE.md', 'third-party-notices', 'package.json', verifierName];
+export const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+export function canonicalJson(value) {
+  if (Array.isArray(value)) return '[' + value.map(canonicalJson).join(',') + ']';
+  if (value && typeof value === 'object')
+    return '{' + Object.keys(value).sort().map(key => JSON.stringify(key) + ':' + canonicalJson(value[key])).join(',') + '}';
+  return JSON.stringify(value);
+}
+export function safePayloadPath(value) {
+  if (typeof value !== 'string' || !value || /[\x00-\x1f\x7f\\:]/.test(value) ||
+      path.posix.isAbsolute(value) || value.split('/').some(part => !part || part === '.' || part === '..'))
+    throw new Error(`Unsafe package path: ${JSON.stringify(value)}`);
+  if (!payloadRoots.some(root => value === root || value.startsWith(root + '/')))
+    throw new Error(`Unexpected package path: ${value}`);
+  return value;
+}
+export function packageMetadataBytes(bytes, workspaceVersions = {}, allowWorkspace = false) {
+  const metadata = JSON.parse(bytes.toString('utf8'));
+  for (const section of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+    for (const [name, spec] of Object.entries(metadata[section] ?? {})) {
+      if (typeof spec !== 'string' || !spec.startsWith('workspace:')) continue;
+      if (!allowWorkspace) throw new Error(`Unresolved workspace dependency in package: ${name}`);
+      const version = workspaceVersions[name], range = spec.slice(10);
+      if (!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(version ?? '') || !['*', '^', '~'].includes(range))
+        throw new Error(`Unsupported workspace dependency: ${name} ${spec}`);
+      metadata[section][name] = (range === '*' ? '' : range) + version;
+    }
+  }
+  // Registry/installer annotations do not change the executable package contract.
+  for (const key of ['gitHead', 'readme', 'readmeFilename', '_id', '_from', '_resolved', '_integrity', '_where']) delete metadata[key];
+  for (const hook of ['preinstall', 'install', 'postinstall', 'prepare'])
+    if (metadata.scripts?.[hook]) throw new Error(`Unexpected install lifecycle script: ${hook}`);
+  // pnpm removes publish lifecycle hooks from its packed manifest. Accept only
+  // our fixed, side-effect-free verifier hook, and normalize its known omission.
+  if (metadata.scripts?.prepack !== undefined) {
+    if (metadata.scripts.prepack !== 'node verify-integrity.mjs --workspace') throw new Error('Unexpected prepack script');
+    delete metadata.scripts.prepack;
+  }
+  for (const hook of ['postpack', 'prepublish', 'prepublishOnly', 'publish', 'postpublish'])
+    if (metadata.scripts?.[hook]) throw new Error(`Unexpected publish lifecycle script: ${hook}`);
+  if (metadata.scripts && !Object.keys(metadata.scripts).length) delete metadata.scripts;
+  return Buffer.from(canonicalJson(metadata));
+}
+function checkPublishFile(relative, bytes) {
+  if (/(?:^|\/)(?:src|__tests__|node_modules)(?:\/|$)|(?:^|\/)\.env(?:\.|$)|(?:^|\/)\.npmrc$|\.map$|\.spec\.|\.test\.|\.(?:vue|tsx)$/.test(relative) ||
+      relative.endsWith('.ts') && !relative.endsWith('.d.ts'))
+    throw new Error(`Source, test, map or private file in package: ${relative}`);
+  if (/\.(?:[cm]?js|css)$/.test(relative) && /[#@]\s*sourceMappingURL\s*=/.test(bytes.toString('utf8')))
+    throw new Error(`Source map reference in package: ${relative}`);
+}
+export function collectPayload(packageRoot, { workspaceVersions = {}, allowWorkspace = false, strict = true } = {}) {
+  const root = realpathSync(packageRoot), result = [];
+  function visit(relative) {
+    safePayloadPath(relative);
+    const file = path.join(root, relative), stat = lstatSync(file);
+    if (stat.isSymbolicLink()) throw new Error(`Symbolic link in package: ${relative}`);
+    if (stat.isDirectory()) {
+      for (const entry of readdirSync(file).sort()) visit(relative + '/' + entry);
+    } else if (stat.isFile()) {
+      const raw = readFileSync(file);
+      checkPublishFile(relative, raw);
+      const bytes = relative === 'package.json' ? packageMetadataBytes(raw, workspaceVersions, allowWorkspace) : raw;
+      result.push({ path: relative, bytes: bytes.length, sha256: sha256(bytes) });
+    } else throw new Error(`Unsupported file in package: ${relative}`);
+  }
+  const required = ['dist', 'README.md', 'LICENSE', 'NOTICE.md', 'third-party-notices', 'package.json', verifierName];
+  for (const relative of required) visit(relative);
+  if (strict) {
+    for (const entry of readdirSync(root)) {
+      if ([...payloadRoots, integrityName, 'node_modules'].includes(entry)) continue;
+      throw new Error(`Unexpected file in package: ${entry}`);
+    }
+  }
+  return result.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+export function integrityDigest(manifest) {
+  return sha256(canonicalJson({
+    formatVersion: manifest.formatVersion, algorithm: manifest.algorithm,
+    package: manifest.package, workspaceVersions: manifest.workspaceVersions, files: manifest.files,
+  }));
+}
+export function verifyPackage(packageRoot, { expectedDigest, allowWorkspace = false } = {}) {
+  const root = realpathSync(packageRoot), manifestFile = path.join(root, integrityName);
+  if (!lstatSync(manifestFile).isFile() || lstatSync(manifestFile).isSymbolicLink()) throw new Error('Invalid integrity manifest file');
+  const manifest = JSON.parse(readFileSync(manifestFile, 'utf8'));
+  if (manifest.formatVersion !== 1 || manifest.algorithm !== 'sha256' || !Array.isArray(manifest.files) ||
+      !manifest.files.length || !manifest.package?.name || !manifest.package?.version ||
+      !manifest.workspaceVersions || typeof manifest.workspaceVersions !== 'object')
+    throw new Error('Invalid integrity manifest');
+  const digest = integrityDigest(manifest);
+  if (manifest.digest !== digest) throw new Error('Integrity manifest digest mismatch');
+  if (expectedDigest !== undefined && (!/^[a-f0-9]{64}$/.test(expectedDigest) || expectedDigest !== digest))
+    throw new Error('Trusted package digest mismatch');
+  const paths = new Set();
+  for (const entry of manifest.files) {
+    safePayloadPath(entry.path);
+    if (paths.has(entry.path) || !/^[a-f0-9]{64}$/.test(entry.sha256) || !Number.isSafeInteger(entry.bytes) || entry.bytes < 0)
+      throw new Error(`Invalid or duplicate integrity entry: ${entry.path}`);
+    paths.add(entry.path);
+  }
+  const metadata = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
+  if (metadata.name !== manifest.package.name || metadata.version !== manifest.package.version) throw new Error('Package identity mismatch');
+  const actual = collectPayload(root, { workspaceVersions: manifest.workspaceVersions, allowWorkspace, strict: !allowWorkspace });
+  const expected = new Map(manifest.files.map(entry => [entry.path, entry]));
+  const changed = actual.filter(entry => {
+    const baseline = expected.get(entry.path);
+    expected.delete(entry.path);
+    return !baseline || baseline.sha256 !== entry.sha256 || baseline.bytes !== entry.bytes;
+  }).map(entry => entry.path);
+  changed.push(...expected.keys());
+  if (changed.length) throw new Error(`Package integrity mismatch: ${changed.join(', ')}`);
+  return { name: manifest.package.name, version: manifest.package.version, files: actual.length, digest };
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    let directory = path.dirname(fileURLToPath(import.meta.url)), expectedDigest, allowWorkspace = false;
+    for (let i = 2; i < process.argv.length; i++) {
+      const arg = process.argv[i];
+      if (arg === '--workspace') allowWorkspace = true;
+      else if (arg === '--directory' && process.argv[i + 1]) directory = path.resolve(process.argv[++i]);
+      else if (arg === '--expected' && process.argv[i + 1]) expectedDigest = process.argv[++i];
+      else throw new Error(`Unknown or incomplete argument: ${arg}`);
+    }
+    console.log(JSON.stringify(verifyPackage(directory, { expectedDigest, allowWorkspace }), null, 2));
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/dist/chunks/AnchoredPanel-Cv4RURwF.js

@@ -1,68 +0,0 @@
-"use client";
-import { jsx } from "react/jsx-runtime";
-import { useRef, useState, useLayoutEffect } from "react";
-import { createPortal } from "react-dom";
-import { a as useContentContext } from "./host-C-V688Rq.js";
-import { p as placeAnchoredPopover } from "./popover-placement-D3xVYdkt.js";
-import { u as useLayer, L as LayerProvider, p as placePanel } from "./index-DdfMnva8.js";
-function AnchoredPanel({ anchor, onClose, align = "start", prefer = "below", gap = 8, label, role = "dialog", className = "", portal: portalOverride, children, onKeyDown }) {
-  const context = useContentContext();
-  const portal = typeof portalOverride === "function" ? portalOverride() : portalOverride !== void 0 ? portalOverride : context.portal;
-  const panel = useRef(null);
-  const trigger = useRef(anchor);
-  trigger.current = anchor;
-  const layer = useLayer(trigger, panel, true, onClose);
-  const [position, setPosition] = useState(null);
-  useLayoutEffect(() => {
-    const measure = () => {
-      var _a;
-      const rect = anchor == null ? void 0 : anchor.getBoundingClientRect(), card = (_a = panel.current) == null ? void 0 : _a.getBoundingClientRect();
-      if (!rect || !card) return;
-      const placed = align === "end" ? placePanel({
-        trigger: rect,
-        panel: card,
-        position: prefer === "above" ? "tr" : "br",
-        gap,
-        viewport: { width: innerWidth, height: innerHeight }
-      }) : placeAnchoredPopover({
-        align,
-        prefer,
-        anchor: { left: rect.left, top: rect.top, width: rect.width, height: rect.height },
-        host: { left: 0, top: 0 },
-        card: { width: card.width, height: card.height },
-        bounds: { left: 0, top: 0, width: window.innerWidth, height: window.innerHeight },
-        gap
-      });
-      setPosition({ left: placed.left, top: placed.top });
-    };
-    measure();
-    const observer = typeof ResizeObserver === "undefined" ? null : new ResizeObserver(measure);
-    if (panel.current) observer == null ? void 0 : observer.observe(panel.current);
-    window.addEventListener("resize", measure);
-    window.addEventListener("scroll", measure, true);
-    return () => {
-      observer == null ? void 0 : observer.disconnect();
-      window.removeEventListener("resize", measure);
-      window.removeEventListener("scroll", measure, true);
-    };
-  }, [anchor, align, prefer, gap]);
-  if (!portal) return null;
-  return /* @__PURE__ */ jsx(LayerProvider, { layer, children: createPortal(/* @__PURE__ */ jsx(
-    "div",
-    {
-      ref: panel,
-      className: `w-popover w-popover--flush${className ? ` ${className}` : ""}`,
-      role,
-      "aria-label": label,
-      onKeyDown,
-      onPointerDown: (event) => event.stopPropagation(),
-      onWheel: (event) => event.stopPropagation(),
-      onContextMenu: (event) => event.stopPropagation(),
-      style: { position: "fixed", left: (position == null ? void 0 : position.left) ?? -9999, top: (position == null ? void 0 : position.top) ?? -9999 },
-      children
-    }
-  ), portal) });
-}
-export {
-  AnchoredPanel as A
-};

package/dist/chunks/DocumentExportMenu-BrGipZ59.js

@@ -1,75 +0,0 @@
-"use client";
-import { jsxs, jsx } from "react/jsx-runtime";
-import { useRef, useState, useEffect } from "react";
-import { b as useContentHost } from "./host-C-V688Rq.js";
-import { W as WSelect } from "./index-DdfMnva8.js";
-const options = [
-  { value: "pdf", label: "PDF (.pdf)" },
-  { value: "docx", label: "Word (.docx)" },
-  { value: "markdown", label: "Markdown (.md)" },
-  { value: "json", label: "JSON (.json)" }
-];
-function DocumentExportMenu(props) {
-  const host = useContentHost(), controller = useRef(void 0);
-  const [busy, setBusy] = useState(false), [error, setError] = useState("");
-  useEffect(() => {
-    setBusy(false);
-    setError("");
-    return () => {
-      var _a;
-      (_a = controller.current) == null ? void 0 : _a.abort();
-      controller.current = void 0;
-    };
-  }, [props.resourceId, props.allowExport, host.scope, host.exports]);
-  async function execute(value) {
-    var _a;
-    if (controller.current || props.disabled || !props.allowExport || !host.exports) return;
-    if (!options.some((option) => option.value === value)) return;
-    const task = new AbortController();
-    controller.current = task;
-    setBusy(true);
-    setError("");
-    try {
-      await host.exports.request({ kind: "document", format: value, resourceId: props.resourceId, signal: task.signal });
-    } catch (cause) {
-      if (!task.signal.aborted) {
-        const failure = cause instanceof Error ? cause : new Error(String(cause));
-        setError(failure.message);
-        (_a = props.onError) == null ? void 0 : _a.call(props, failure);
-      }
-    } finally {
-      if (controller.current === task) {
-        controller.current = void 0;
-        setBusy(false);
-      }
-    }
-  }
-  if (!props.allowExport || !host.exports) return null;
-  return /* @__PURE__ */ jsxs(
-    "div",
-    {
-      className: "document-export-menu",
-      "aria-busy": busy || void 0,
-      style: { display: "flex", alignItems: "center", flexWrap: "wrap", gap: 8, fontSize: 12 },
-      children: [
-        /* @__PURE__ */ jsx(
-          WSelect,
-          {
-            value: "",
-            label: busy ? "正在导出…" : "导出",
-            ariaLabel: "导出文档",
-            width: 112,
-            options,
-            disabled: props.disabled || busy,
-            onChange: (value) => void execute(value)
-          }
-        ),
-        busy && /* @__PURE__ */ jsx("span", { role: "status", style: { color: "var(--color-text-muted)" }, children: "正在生成文件…" }),
-        error && /* @__PURE__ */ jsx("span", { role: "alert", style: { color: "var(--color-danger, #cf3d48)", overflowWrap: "anywhere" }, children: error })
-      ]
-    }
-  );
-}
-export {
-  DocumentExportMenu as D
-};