collavre 0.22.0 → 0.23.0

data/app/javascript/lib/lexical/markdown_serialize.js

@@ -0,0 +1,320 @@
+import {
+  $isTextNode,
+  $isParagraphNode,
+  $isLineBreakNode,
+  $createParagraphNode
+} from "lexical"
+import { $convertToMarkdownString, TRANSFORMERS } from "@lexical/markdown"
+import { TABLE, setCellTransformers } from "./table_transformer"
+
+// Serializes the Lexical editor state to Markdown as the canonical storage
+// format. Standard block/inline features (headings, lists, quotes, code,
+// bold/italic/strikethrough, inline code, links) round-trip through Markdown
+// via the upstream TRANSFORMERS. Features Markdown can't express are emitted as
+// a SMALL, FIXED set of normalized inline HTML fragments:
+//
+//   - text color / background-color  -> <span style="...">
+//   - images / videos / attachments  -> raw <img>/<video>/<a download> tags
+//
+// The HTML shape is normalized (one canonical form per feature) and the CSS
+// values are validated, so the server-side sanitizer can safelist exactly these
+// and the import path (markdown -> HTML -> Lexical) reconstructs them losslessly.
+
+// Only these CSS color values are allowed inside an emitted <span>. Anything
+// else (url(), expression(), javascript:, <, >) is dropped so a crafted inline
+// style can't smuggle script or external requests into stored Markdown.
+const SAFE_COLOR_VALUE =
+  /^(#[0-9a-fA-F]{3,8}|rgba?\([0-9.,%\s]+\)|hsla?\([0-9.,%\s]+\)|var\(--[a-zA-Z0-9-_]+\)|[a-zA-Z]+)$/
+
+function safeColorValue(value) {
+  if (!value) return null
+  const v = value.trim().replace(/;+$/, "").trim()
+  if (!v) return null
+  if (/url\(|expression|javascript:|@import|[<>]/i.test(v)) return null
+  return SAFE_COLOR_VALUE.test(v) ? v : null
+}
+
+function colorBgFromStyle(styleText) {
+  let color = null
+  let background = null
+  ;(styleText || "").split(";").forEach((decl) => {
+    const idx = decl.indexOf(":")
+    if (idx === -1) return
+    const key = decl.slice(0, idx).trim().toLowerCase()
+    const value = decl.slice(idx + 1)
+    if (key === "color") color = safeColorValue(value)
+    else if (key === "background-color") background = safeColorValue(value)
+  })
+  return { color, background }
+}
+
+function escapeHtmlAttr(value) {
+  return String(value == null ? "" : value)
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+}
+
+function escapeHtmlText(value) {
+  return String(value == null ? "" : value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+}
+
+// Wrap already-formatted inner Markdown text in a normalized colored <span>, or
+// return null when the style carries no (safe) color/background. The declaration
+// order is fixed (color first) so the same selection always serializes to the
+// same bytes — line-diff/snapshot stability depends on this.
+export function colorSpanMarkup(styleText, inner) {
+  const { color, background } = colorBgFromStyle(styleText)
+  if (!color && !background) return null
+  const decls = []
+  if (color) decls.push(`color: ${color}`)
+  if (background) decls.push(`background-color: ${background}`)
+  // `inner` is the Markdown-formatted text of a colored node. Lexical's export
+  // escapes Markdown punctuation but NOT HTML metacharacters, so colored text
+  // like `<foo>` would become raw markup inside the <span> and get reinterpreted
+  // (and stripped) by the Markdown renderer/sanitizer. Escape <, >, & so user
+  // text stays text. Markdown syntax chars (*, _, `, ~) are left untouched.
+  return `<span style="${decls.join("; ")}">${escapeHtmlText(inner)}</span>`
+}
+
+// Canonical inline HTML for the decorator nodes, matching the shapes the import
+// path (markdown_to_html -> $generateNodesFromDOM) and the server sanitizer
+// expect. Numeric width/height only — Lexical's "inherit" sentinel is dropped.
+export function imageMarkup({ src, altText, width, height }) {
+  let html = `<img src="${escapeHtmlAttr(src)}" alt="${escapeHtmlAttr(altText)}"`
+  if (Number.isFinite(Number(width)) && Number(width) > 0) {
+    html += ` width="${escapeHtmlAttr(width)}"`
+  }
+  if (Number.isFinite(Number(height)) && Number(height) > 0) {
+    html += ` height="${escapeHtmlAttr(height)}"`
+  }
+  return `${html}>`
+}
+
+export function videoMarkup({ src }) {
+  return `<video controls src="${escapeHtmlAttr(src)}"></video>`
+}
+
+export function attachmentMarkup({ src, filename, filesize }) {
+  let html = `<a href="${escapeHtmlAttr(src)}" download="${escapeHtmlAttr(filename)}"`
+  if (filesize != null && filesize !== "") {
+    html += ` data-filesize="${escapeHtmlAttr(filesize)}"`
+  }
+  return `${html}>${escapeHtmlText(filename)}</a>`
+}
+
+// Boilerplate so a transformer can be export-only: import never fires.
+const NEVER = /(?!)/
+
+function exportOnlyTransformer(exportFn, { dependencies = [], type = "text-match" } = {}) {
+  return {
+    dependencies,
+    export: exportFn,
+    importRegExp: NEVER,
+    regExp: NEVER,
+    replace: () => false,
+    trigger: "",
+    type
+  }
+}
+
+// Decorator nodes -> raw HTML. Duck-typed via getType() so this module stays
+// free of the .jsx node classes (kept importable under native-ESM Jest).
+function decoratorMarkup(node) {
+  const type = node.getType ? node.getType() : null
+  if (type === "image") {
+    return imageMarkup({
+      src: node.getSrc?.(),
+      altText: node.getAltText?.(),
+      width: node.__width,
+      height: node.__height
+    })
+  }
+  if (type === "video") {
+    return videoMarkup({ src: node.getSrc?.() })
+  }
+  if (type === "attachment") {
+    return attachmentMarkup({
+      src: node.getSrc?.(),
+      filename: node.getFilename?.(),
+      filesize: node.__filesize
+    })
+  }
+  return null
+}
+
+// A paragraph the user left blank: it carries no real text, only empty text
+// nodes and/or line breaks. (Decorator- or text-bearing paragraphs are NOT
+// blank, so media and real content keep their normal export.) An empty
+// paragraph from pressing Enter has zero children; a run of blank lines that
+// was reopened comes back as ONE paragraph holding N LineBreakNodes (the
+// importer groups consecutive <br> markers together).
+function isBlankParagraph(node) {
+  if (!$isParagraphNode(node)) return false
+  // A blank paragraph inside a table cell is just an empty cell — it must stay
+  // empty (`|  |`), not become a `<br>`. The cell serializer reuses this
+  // transformer set, so exclude paragraphs nested in a cell (duck-typed by type
+  // to keep this module free of the @lexical/table import).
+  const parent = node.getParent ? node.getParent() : null
+  if (parent && parent.getType && parent.getType() === "tablecell") return false
+  return node
+    .getChildren()
+    .every((child) => $isLineBreakNode(child) || ($isTextNode(child) && !child.getTextContent().trim()))
+}
+
+// How many blank lines a blank paragraph represents: one per LineBreakNode, but
+// at least one (a freshly-typed empty paragraph has no line breaks yet still
+// stands for a single blank line). This exact count is what keeps multiple
+// blank lines from multiplying on every save — the reopened paragraph holds N
+// line breaks and must re-emit N markers, not N+1.
+function blankParagraphBreakCount(node) {
+  const breaks = node.getChildren().filter($isLineBreakNode).length
+  return Math.max(1, breaks)
+}
+
+// Blank paragraphs -> one `<br>` per blank line. A `<br>` is a semantic empty
+// line (not a stray space or NBSP): the hard-break renderers keep it as a
+// visible blank line, and because each marker sits in its own block separated
+// by the standard `\n\n`, a blank line after a list no longer gets pulled into
+// the last <li> via lazy continuation. Round-trips: the importer regroups the
+// rendered <br> elements into a blank paragraph that re-exports identically.
+const BLANK_PARAGRAPH_TRANSFORMER = exportOnlyTransformer(
+  (node) =>
+    isBlankParagraph(node) ? Array(blankParagraphBreakCount(node)).fill("<br>").join("\n\n") : null,
+  { type: "element" }
+)
+
+// Colored / highlighted text -> normalized <span>. Falls through (returns null)
+// for uncolored text so the default text-format export still applies.
+const COLOR_TRANSFORMER = exportOnlyTransformer((node, _exportChildren, exportFormat) => {
+  if (!$isTextNode(node)) return null
+  const style = node.getStyle ? node.getStyle() : ""
+  if (!style) return null
+  return colorSpanMarkup(style, exportFormat(node, node.getTextContent()))
+})
+
+// Decorator handler registered as a TEXT-MATCH transformer for media that lives
+// INLINE inside a paragraph (claimed during exportChildren).
+const DECORATOR_TEXT_TRANSFORMER = exportOnlyTransformer((node) => decoratorMarkup(node))
+
+// The SAME handler registered as an ELEMENT transformer for media that is a
+// direct child of the root (the upload plugin's no-selection append path, and
+// imported block-level <img> nodes). $convertToMarkdownString only runs element
+// transformers on top-level nodes — a top-level decorator that matches no element
+// transformer falls back to DecoratorNode#getTextContent() (empty for media),
+// silently dropping it from markdown_source. Without this, the first rich save
+// loses every top-level image/video/file.
+const DECORATOR_ELEMENT_TRANSFORMER = exportOnlyTransformer((node) => decoratorMarkup(node), {
+  type: "element"
+})
+
+// Our custom transformers run first so colored text and decorator nodes are
+// claimed before the upstream defaults (which would drop their style/content).
+export const MARKDOWN_TRANSFORMERS = [
+  TABLE,
+  DECORATOR_ELEMENT_TRANSFORMER,
+  BLANK_PARAGRAPH_TRANSFORMER,
+  DECORATOR_TEXT_TRANSFORMER,
+  COLOR_TRANSFORMER,
+  ...TRANSFORMERS
+]
+
+// Tables serialize their cell content with the same transformer set. Injected
+// here (rather than imported into table_transformer.js) to break the cycle.
+setCellTransformers(MARKDOWN_TRANSFORMERS)
+
+// Fenced code blocks may legitimately contain consecutive blank lines; guard
+// them so the blank-line normalization below never touches a code sample.
+const FENCE_BLOCK = /(`{3,}|~{3,})[^\n]*\n[\s\S]*?\n\1[ \t]*(?=\n|$)/g
+
+// Inline code spans (`...`) may legitimately contain the literal text `<br>` or
+// a lone NBSP; guard them too so the blank-line normalization never rewrites the
+// span (which would break it on save). Matched after fences are stashed, so the
+// remaining backtick runs are genuine inline code.
+const INLINE_CODE = /(`+)[^\n]*?\1/g
+
+// Normalize the canonical Markdown projection. Enter produces a real paragraph
+// break (standard `\n\n` separation); a blank line the user typed is preserved
+// as a `<br>` marker (see BLANK_PARAGRAPH_TRANSFORMER). This pass only:
+//   - returns "" for a document with no real content (only whitespace and/or
+//     `<br>` markers), keeping the empty-state placeholder/presence contract,
+//   - migrates legacy NBSP-only blank-line markers (pre-`<br>` content) to a
+//     real `<br>` marker so they stop acting as a CommonMark lazy continuation,
+//   - isolates every `<br>` marker as its own block,
+//   - collapses runs of 3+ newlines to one blank line so block separation stays
+//     canonical and the very first save is round-trip stable,
+//   - trims trailing whitespace.
+// Blank lines and literal `<br>`/NBSP inside code (fenced or inline) are
+// preserved verbatim.
+export function normalizeMarkdownBlankLines(markdown) {
+  // A document of only blank lines (each now a `<br>`) carries no real content,
+  // so strip the markers before the emptiness check.
+  if (!String(markdown).replace(/<br\s*\/?>/gi, "").trim()) return ""
+
+  const guards = []
+  const stash = (match) => `\x00MDGUARD${guards.push(match) - 1}\x00`
+  const guarded = String(markdown)
+    .replace(FENCE_BLOCK, stash)
+    .replace(INLINE_CODE, stash)
+
+  const normalized = guarded
+    // Legacy blank-line markers stored a line of only NBSP (U+00A0). CommonMark
+    // treats NBSP as content — a lazy list continuation — re-introducing the
+    // list-indent bug, so migrate such lines to a real `<br>` marker on save.
+    // (A regular whitespace-only line is already a CommonMark blank line.)
+    .replace(/^[ \t]*\u00A0[ \t\u00A0]*$/gm, "<br>")
+    // Each blank-line marker is its own block: isolate every `<br>` with a blank
+    // line on both sides. Lexical's exporter joins a freshly-typed empty
+    // paragraph to its neighbours with a single `\n`, while a reopened (grouped)
+    // blank paragraph gets `\n\n`; canonicalizing here makes the very first save
+    // byte-identical to the reopen fixpoint regardless of which path produced it.
+    // BLANK_PARAGRAPH_TRANSFORMER always emits a marker alone on its line, so we
+    // only match a `<br>` that is the WHOLE line (anchored ^…$ under /m). A
+    // `<br>` embedded in other content (an in-paragraph hard break or raw inline
+    // HTML such as `<span>foo<br>bar</span>`) is not a marker and is left
+    // untouched — isolating it would rewrite user HTML on save.
+    .replace(/\n*^[ \t]*<br>[ \t]*$\n*/gm, "\n\n<br>\n\n")
+    .replace(/\n{3,}/g, "\n\n")
+    .replace(/^\n+/, "")
+    .replace(/\s+$/, "")
+
+  return normalized.replace(/\x00MDGUARD(\d+)\x00/g, (_, n) => guards[Number(n)])
+}
+
+// On reopen, a run of blank-line markers (<br>) comes back grouped into ONE
+// paragraph holding N LineBreakNodes. Lexical renders such a paragraph as N+1
+// visual lines — each break starts a new line on top of the paragraph's own
+// line — so a single typed blank line reopens as TWO, growing by one on every
+// reopen (the "blank lines keep multiplying" bug). Freshly typed blank lines are EMPTY
+// paragraphs instead (zero children, one visual line each). Re-create that
+// structure: replace every all-LineBreakNode paragraph with N empty paragraphs
+// so reopened blank lines match typed ones. Export is unaffected — each empty
+// paragraph still emits exactly one <br> (blankParagraphBreakCount), so the
+// canonical Markdown round-trips byte-for-byte. Paragraphs that mix text with a
+// break (real soft breaks) are left untouched.
+export function splitBlankLineParagraphs(root) {
+  if (!root || !root.getChildren) return
+  root.getChildren().forEach((node) => {
+    if (!$isParagraphNode(node)) return
+    const children = node.getChildren()
+    if (children.length === 0) return
+    if (!children.every($isLineBreakNode)) return
+    for (let i = 0; i < children.length; i++) {
+      node.insertBefore($createParagraphNode())
+    }
+    node.remove()
+  })
+}
+
+// Read the editor state and return canonical Markdown.
+export function lexicalToMarkdown(editor) {
+  let markdown = ""
+  editor.getEditorState().read(() => {
+    markdown = $convertToMarkdownString(MARKDOWN_TRANSFORMERS)
+  })
+  return normalizeMarkdownBlankLines(markdown)
+}

data/app/javascript/lib/lexical/selection_boundary.js

@@ -0,0 +1,58 @@
+import {
+  $isRangeSelection,
+  $isTextNode,
+  $isRootOrShadowRoot
+} from "lexical"
+
+// True when a collapsed selection sits at the very start of the whole document
+// (offset 0 of the first leaf, with no previous siblings up the tree).
+//
+// NOTE: checking `$getCharacterOffsets() === [0, 0]` is NOT enough — that only
+// reports the offset within the current node, so the start of the *second*
+// paragraph (e.g. right after pressing Enter) also reads as [0, 0]. We must walk
+// up the tree confirming there is no earlier content, mirroring
+// isSelectionAtDocumentEnd.
+export function isSelectionAtDocumentStart(selection) {
+  if (!$isRangeSelection(selection) || !selection.isCollapsed()) return false
+
+  const anchor = selection.anchor
+  let node = anchor.getNode()
+  if (!node) return false
+
+  if (anchor.offset !== 0) return false
+
+  while (node && !$isRootOrShadowRoot(node)) {
+    if (node.getPreviousSibling()) return false
+    node = node.getParent()
+  }
+
+  return !!node && $isRootOrShadowRoot(node)
+}
+
+// True when a collapsed selection sits at the very end of the whole document
+// (end of the last leaf, with no following siblings up the tree).
+export function isSelectionAtDocumentEnd(selection) {
+  if (!$isRangeSelection(selection) || !selection.isCollapsed()) return false
+
+  const focus = selection.focus
+  let node = focus.getNode()
+  if (!node) return false
+
+  const offset = focus.offset
+  if ($isTextNode(node)) {
+    if (offset !== node.getTextContentSize()) return false
+  } else if (typeof node.getChildrenSize === "function") {
+    if (offset !== node.getChildrenSize()) return false
+  } else {
+    // Fallback for nodes without children size (e.g., line breaks)
+    const textSize = node.getTextContentSize?.() ?? 0
+    if (offset !== textSize) return false
+  }
+
+  while (node && !$isRootOrShadowRoot(node)) {
+    if (node.getNextSibling()) return false
+    node = node.getParent()
+  }
+
+  return !!node && $isRootOrShadowRoot(node)
+}

data/app/javascript/lib/lexical/table_transformer.js

@@ -0,0 +1,182 @@
+import {
+  $createTableCellNode,
+  $createTableNode,
+  $createTableRowNode,
+  $isTableCellNode,
+  $isTableNode,
+  $isTableRowNode,
+  TableCellHeaderStates
+} from "@lexical/table"
+import { $convertFromMarkdownString, $convertToMarkdownString } from "@lexical/markdown"
+import { $isParagraphNode, $isTextNode } from "lexical"
+
+// GFM pipe-table support for the markdown-canonical editor. Ported from the
+// Lexical playground's MarkdownTransformers TABLE ElementTransformer, adapted to
+// .js and to a lazily-injected cell transformer list. Unlike the color/decorator
+// transformers (export-only), this one is bidirectional: it exports Lexical
+// tables to GFM and reconstructs them when markdown is parsed back.
+
+const TABLE_ROW_REG_EXP = /^(?:\|)(.+)(?:\|)\s?$/
+// -+ (not -*) is required per cell: a GFM divider must have at least one dash,
+// and the mandatory dash run anchors the surrounding :? colons so they can't both
+// compete for the same character — which would cause exponential backtracking.
+const TABLE_ROW_DIVIDER_REG_EXP = /^(\| ?:?-+:? ?)+\|\s?$/
+
+// Each table cell is (de)serialized with the full transformer list (which
+// includes this TABLE transformer). markdown_serialize.js injects the list once
+// at load via setCellTransformers to avoid a circular import. Cells never nest
+// tables, so the self-reference stays bounded.
+let cellTransformers = []
+export function setCellTransformers(list) {
+  cellTransformers = list
+}
+
+function getTableColumnsSize(table) {
+  const row = table.getFirstChild()
+  return $isTableRowNode(row) ? row.getChildrenSize() : 0
+}
+
+function $createTableCell(textContent) {
+  // Backslashes are governed by CommonMark and round-trip through the per-cell
+  // $convertFromMarkdownString below; we must NOT pre-decode them here. An earlier
+  // ".replace(/\\n/g, \"\\n\")" mis-fired on literal "a\nb" (backslash + n typed by
+  // the user, e.g. a regex or Windows path), corrupting it into a real newline
+  // that breaks the single-line row (CodeQL alert #42). Cells are single-line, so
+  // no newline decoding is needed at all.
+  const cell = $createTableCellNode(TableCellHeaderStates.NO_STATUS)
+  $convertFromMarkdownString(textContent, cellTransformers, cell)
+  return cell
+}
+
+// Split a row's inner text on cell boundaries and reverse the export escaping in
+// one left-to-right pass. Export escapes (in order) backslash -> "\\" then pipe
+// -> "\|", so here every backslash starts a 2-char escape: it consumes the next
+// char ("\\" -> "\", "\|" -> a literal in-cell pipe). Only a *bare* pipe is a
+// column boundary. The result still carries CommonMark's own backslash escapes,
+// which $convertFromMarkdownString decodes per cell. Undoing the backslash escape
+// here (not just "\|") is what keeps the escaping complete and unambiguous
+// (CodeQL js/incomplete-sanitization #43). Each cell is trimmed because GFM treats
+// the spaces around "| cell |" as insignificant padding (export re-adds them).
+function splitRowCells(inner) {
+  const cells = []
+  let current = ""
+  for (let i = 0; i < inner.length; i++) {
+    if (inner[i] === "\\" && i + 1 < inner.length) {
+      current += inner[i + 1] // "\\" -> "\", "\|" -> "|" (any other "\x" -> "x")
+      i++
+    } else if (inner[i] === "|") {
+      cells.push(current.trim())
+      current = ""
+    } else {
+      current += inner[i]
+    }
+  }
+  cells.push(current.trim())
+  return cells
+}
+
+function mapToTableCells(textContent) {
+  const match = textContent.match(TABLE_ROW_REG_EXP)
+  if (!match || !match[1]) return null
+  return splitRowCells(match[1]).map((text) => $createTableCell(text))
+}
+
+export const TABLE = {
+  dependencies: [],
+  export: (node) => {
+    if (!$isTableNode(node)) return null
+    const output = []
+    for (const row of node.getChildren()) {
+      if (!$isTableRowNode(row)) continue
+      const rowOutput = []
+      let isHeaderRow = false
+      for (const cell of row.getChildren()) {
+        if ($isTableCellNode(cell)) {
+          rowOutput.push(
+            $convertToMarkdownString(cellTransformers, cell)
+              // A GFM row is one line, so collapse any real newline to a space
+              // (multi-line cells aren't representable in GFM anyway). NOT "\\n":
+              // that re-imported as a literal backslash-n and then mis-decoded
+              // back to a newline, corrupting genuine "a\nb" text (CodeQL #42).
+              .replace(/\n+/g, " ")
+              // Escape the escape char FIRST, then pipes, so the escaping is
+              // complete and unambiguous (CodeQL js/incomplete-sanitization #43).
+              // splitRowCells reverses both ("\\"->"\", "\|"->"|") on import,
+              // restoring exactly what CommonMark emitted before re-decoding it.
+              .replace(/\\/g, "\\\\")
+              .replace(/\|/g, "\\|")
+              .trim()
+          )
+          if (cell.__headerState === TableCellHeaderStates.ROW) {
+            isHeaderRow = true
+          }
+        }
+      }
+      output.push(`| ${rowOutput.join(" | ")} |`)
+      if (isHeaderRow) {
+        output.push(`| ${rowOutput.map(() => "---").join(" | ")} |`)
+      }
+    }
+    return output.join("\n")
+  },
+  regExp: TABLE_ROW_REG_EXP,
+  replace: (parentNode, _children, match) => {
+    // A divider row ("| --- | --- |") promotes the previous table's last row to
+    // a header row, then removes itself.
+    if (TABLE_ROW_DIVIDER_REG_EXP.test(match[0])) {
+      const table = parentNode.getPreviousSibling()
+      if (!table || !$isTableNode(table)) return
+      const rows = table.getChildren()
+      const lastRow = rows[rows.length - 1]
+      if (!lastRow || !$isTableRowNode(lastRow)) return
+      lastRow.getChildren().forEach((cell) => {
+        if (!$isTableCellNode(cell)) return
+        cell.setHeaderStyles(TableCellHeaderStates.ROW, TableCellHeaderStates.ROW)
+      })
+      parentNode.remove()
+      return
+    }
+
+    const matchCells = mapToTableCells(match[0])
+    if (matchCells == null) return
+
+    // Walk backwards over preceding single-text paragraphs that are also table
+    // rows, accumulating them so a multi-line table is parsed as one node.
+    const rows = [matchCells]
+    let sibling = parentNode.getPreviousSibling()
+    let maxCells = matchCells.length
+    while (sibling) {
+      if (!$isParagraphNode(sibling) || sibling.getChildrenSize() !== 1) break
+      const firstChild = sibling.getFirstChild()
+      if (!$isTextNode(firstChild)) break
+      const cells = mapToTableCells(firstChild.getTextContent())
+      if (cells == null) break
+      maxCells = Math.max(maxCells, cells.length)
+      rows.unshift(cells)
+      const previousSibling = sibling.getPreviousSibling()
+      sibling.remove()
+      sibling = previousSibling
+    }
+
+    const table = $createTableNode()
+    for (const cells of rows) {
+      const tableRow = $createTableRowNode()
+      table.append(tableRow)
+      for (let i = 0; i < maxCells; i++) {
+        tableRow.append(i < cells.length ? cells[i] : $createTableCell(""))
+      }
+    }
+
+    // Merge with an adjacent table of the same width (the divider row already
+    // removed itself, leaving the header table directly before this body row).
+    const previousSibling = parentNode.getPreviousSibling()
+    if ($isTableNode(previousSibling) && getTableColumnsSize(previousSibling) === maxCells) {
+      previousSibling.append(...table.getChildren())
+      parentNode.remove()
+    } else {
+      parentNode.replace(table)
+    }
+    table.selectEnd()
+  },
+  type: "element"
+}

data/app/javascript/lib/lexical/trailing_paragraph.js

@@ -0,0 +1,29 @@
+import { $createParagraphNode, $isDecoratorNode, RootNode } from "lexical"
+
+// A top-level DecoratorNode (image / video / attachment) renders as
+// non-editable content. When one is the last child of the root there is no
+// text position after it, so the caret can't land below it and the whole
+// document becomes uneditable — the reported "an image steals focus / can't
+// edit" bug, worst when the image is the only block. Guarantee the root always
+// ends in a paragraph so there is always an editable landing spot after a
+// trailing decorator.
+//
+// Must run inside an editor.update()/transform.
+export function ensureTrailingParagraph(root) {
+  const last = root.getLastChild()
+  if (last !== null && $isDecoratorNode(last)) {
+    last.insertAfter($createParagraphNode())
+    return true
+  }
+  return false
+}
+
+// Keep the guarantee while editing too: deleting the text below an image, or
+// pasting an image as the last block, would otherwise re-trap the caret.
+// Appending leaves the root dirty, so the transform re-runs once more and then
+// no-ops (last child is now the paragraph) — it terminates.
+export function registerTrailingParagraph(editor) {
+  return editor.registerNodeTransform(RootNode, (root) => {
+    ensureTrailingParagraph(root)
+  })
+}

data/app/javascript/lib/turbo_confirm.js

@@ -0,0 +1,46 @@
+// turbo_confirm — route Turbo's declarative `data-turbo-confirm` prompts through
+// the in-app confirm dialog instead of the native window.confirm().
+//
+// Why: Rails/Turbo forms gate destructive submits with `data-turbo-confirm`.
+// Turbo's default confirm method calls window.confirm(), which in the packaged
+// desktop app (Tauri WKWebView) returns false with no UI — so the submit
+// silently no-ops (e.g. token revoke, user delete, share removal) and looks
+// like the button is broken. Converting hand-written confirm() calls does not
+// cover these, because Turbo intercepts them before any of our code runs. The
+// fix is a single global override of Turbo's confirm method.
+//
+// Returns a Promise<boolean>; Turbo awaits it before submitting (Turbo 8
+// `config.forms.confirm`, with a fallback to the deprecated setConfirmMethod).
+
+import { Turbo } from "@hotwired/turbo-rails"
+import { confirmDialog } from "./utils/dialog"
+
+// Turbo invokes this with (message, formElement, submitter). Style the confirm
+// button as destructive when the submit deletes (the common case for
+// data-turbo-confirm), so it matches the danger styling used elsewhere.
+function turboConfirm(message, formElement, submitter) {
+    const method = (
+        submitter?.getAttribute?.("data-turbo-method") ||
+        formElement?.getAttribute?.("data-turbo-method") ||
+        formElement?.querySelector?.("input[name='_method']")?.value ||
+        formElement?.getAttribute?.("method") ||
+        ""
+    ).toLowerCase()
+    const danger = method === "delete" || method === "destroy"
+    return confirmDialog(message, { danger })
+}
+
+// Install on both the bundled Turbo and any pre-existing global window.Turbo,
+// mirroring turbo_stream_actions.js — the two can be distinct instances.
+function installTurboConfirm(turbo) {
+    if (!turbo) return
+    if (turbo.config && turbo.config.forms) {
+        turbo.config.forms.confirm = turboConfirm
+    } else if (typeof turbo.setConfirmMethod === "function") {
+        // Turbo < 8 fallback.
+        turbo.setConfirmMethod(turboConfirm)
+    }
+}
+
+installTurboConfirm(Turbo)
+if (window.Turbo && window.Turbo !== Turbo) installTurboConfirm(window.Turbo)