funkycommerce-headless: sync changes from monorepo

.monorepo-source.json

@@ -1,7 +1,7 @@
 {
   "productId": "funkycommerce-headless",
   "repository": "coded-letter/superfunky-theme",
-  "source": "coded-letter/coded-letter-monorepo@72869cdcaddca084be981b28722da7dd6b9e733f",
+  "source": "coded-letter/coded-letter-monorepo@4d30981f3726872e6d6f8f82f6ab2cdc80ad9000",
   "sourcePath": "workspace/backend/wordpress/themes/free/funkycommerce-headless",
   "installSlug": "funkycommerce-headless",
   "kind": "theme",

functions.php

@@ -9,7 +9,7 @@
 	exit;
 }
 
-define( 'FUNKYCOMMERCE_HEADLESS_VERSION', '1.2.27' );
+define( 'FUNKYCOMMERCE_HEADLESS_VERSION', '1.2.28' );
 
 /**
  * Whether Superfunky Pro is active and licensed.

inc/security-hardening.php

@@ -233,9 +233,32 @@ function funkycommerce_security_mark_content_scripts( $content, $post_type = ''
 		return $content;
 	}
 
-	$marked = preg_replace(
-		'/<script\b(?![^>]*\bdata-wp-block-html\s*=)([^>]*)>/i',
-		'<script data-wp-block-html="js"$1>',
+	$marked = preg_replace_callback(
+		'/<script\b([^>]*)>/i',
+		static function ( $matches ) {
+			$attributes    = $matches[1];
+			$inert_type    = 'text/funkycommerce-cms';
+			$original_type = '';
+
+			if ( preg_match( '/\s+type\s*=\s*(["\'])(.*?)\1/i', $attributes, $type_match ) ) {
+				$original_type = html_entity_decode( $type_match[2], ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+				$attributes    = preg_replace( '/\s+type\s*=\s*(["\'])(.*?)\1/i', '', $attributes, 1 );
+				$attributes    = is_string( $attributes ) ? $attributes : $matches[1];
+			}
+
+			if ( ! preg_match( '/\bdata-wp-block-html\s*=/i', $attributes ) ) {
+				$attributes = ' data-wp-block-html="js"' . $attributes;
+			}
+			if (
+				$original_type
+				&& $inert_type !== strtolower( trim( $original_type ) )
+				&& ! preg_match( '/\bdata-wp-block-html-type\s*=/i', $attributes )
+			) {
+				$attributes .= ' data-wp-block-html-type="' . esc_attr( $original_type ) . '"';
+			}
+
+			return '<script type="' . $inert_type . '"' . $attributes . '>';
+		},
 		$content
 	);
 	return is_string( $marked ) ? $marked : $content;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "funkycommerce-headless-theme",
   "private": true,
-  "version": "1.2.27",
+  "version": "1.2.28",
   "description": "Tailwind/build tooling for the FunkyCommerce Headless WordPress theme's native frontend assets (block templates, template parts, loader, and Spotify slot).",
   "scripts": {
     "build:css": "tailwindcss -i ./assets/css/theme-source.css -o ./assets/dist/theme.css --minify",

readme.txt

@@ -4,7 +4,7 @@ Tags: headless, woocommerce, wpgraphql, full-site-editing
 Requires at least: 6.7
 Tested up to: 6.8
 Requires PHP: 7.4
-Stable tag: 1.2.27
+Stable tag: 1.2.28
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -15,6 +15,11 @@ Control Center, the theme also ships a complete native WordPress rendering path
 "Native frontend theme" below) with accessible header/footer/navigation templates and
 core front/home/singular/archive/search/404 routes styled to match the storefront.
 
+== 1.2.28 highlights ==
+
+* Keeps trusted CMS scripts inert in server-rendered HTML until the storefront safely decodes and executes them.
+* Preserves explicit JavaScript types while preventing HTML entities from corrupting operators during artifact delivery.
+
 == 1.2.27 highlights ==
 
 * Discards queued regeneration work for obsolete storefront shells during atomic shell activation.

style.css

@@ -7,7 +7,7 @@ Description: A minimal, content-first block theme for polished WordPress preview
 Requires at least: 6.7
 Tested up to: 6.8
 Requires PHP: 7.4
-Version: 1.2.27
+Version: 1.2.28
 Update URI: https://github.com/coded-letter/superfunky-theme
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html