fix: support DB graphs without blocking Logseq UI

[yuanlizbyy]

Summary

• build on fix for logseq db #404 to support Logseq DB graphs
• query scalar journal fields instead of pulling full page entities
• remove cross-origin access to the host window from the plugin iframe
• keep the heatmap panel within the plugin viewport and update the dependency lockfile

Why

Logseq 2.x serves the host and plugin iframe from different origins (lsp://logseq.com and lsp://logseq.io). Accessing top.document during render throws a SecurityError. By that point Logseq has already made the full-screen plugin iframe visible, so the transparent iframe blocks input and makes the application appear frozen.

PR #404 updates the DB attribute names, but pulled entities in DB graphs still expose namespaced keys. Returning journal day and page name as scalar query results avoids that version-sensitive object shape and avoids pulling unnecessary entity data.

Theme detection now uses logseq.App.getUserConfigs() and logseq.App.onThemeModeChanged() instead of reading the host DOM.

Verification

• pnpm build
• tested with Logseq 2.0.1 and a DB graph
• clicking the toolbar icon opens a rendered heatmap with journal counts
• clicking outside closes the panel and restores normal input
• confirmed no cross-origin SecurityError is raised

This includes the commits from #404 with the original author attribution preserved.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​logseq/​libs@​0.0.6 ⏵ 0.0.17	-1

View full report