@bendyline/squisq-formats 1.3.1 → 1.4.0

package/src/html/plainHtml.ts

@@ -14,9 +14,18 @@
  * blob URLs (live preview) or data URIs (single-file export).
  */
 
-import type { MarkdownDocument, MarkdownNode, HtmlNode } from '@bendyline/squisq/markdown';
+import {
+  sanitizeHtmlNodes,
+  sanitizeUrl,
+  type HtmlPolicy,
+  type MarkdownDocument,
+  type MarkdownNode,
+  type HtmlNode,
+  readFrontmatterThemeId,
+} from '@bendyline/squisq/markdown';
 import type { Theme } from '@bendyline/squisq/schemas';
-import { resolveFontFamily, buildGoogleFontsUrl, resolveTheme } from '@bendyline/squisq/schemas';
+import { resolveFontFamily, buildGoogleFontsUrl } from '@bendyline/squisq/schemas';
+import { resolveThemeForDoc } from '@bendyline/squisq/doc';
 
 // ── Public Types ───────────────────────────────────────────────────
 
@@ -71,6 +80,11 @@ export interface PlainHtmlExportOptions {
    * option is not provided.
    */
   iconsCss?: string;
+  /**
+   * Raw HTML policy. Defaults to `sanitize`, which removes unsafe tags,
+   * event handlers, and executable URL schemes before emitting HTML.
+   */
+  htmlPolicy?: HtmlPolicy;
 }
 
 /**
@@ -81,6 +95,7 @@ export interface PlainHtmlExportOptions {
 interface RenderCtx {
   images?: Map<string, string>;
   links?: Map<string, string>;
+  htmlPolicy: HtmlPolicy;
 }
 
 // ── Public API ─────────────────────────────────────────────────────
@@ -97,19 +112,20 @@ export function markdownDocToPlainHtml(
   doc: MarkdownDocument,
   options: PlainHtmlExportOptions = {},
 ): string {
-  const { title = 'Document', images, links, themeId, iconsCss } = options;
+  const { title = 'Document', images, links, themeId, iconsCss, htmlPolicy = 'sanitize' } = options;
   // Fall back chain for theme: explicit `theme` → explicit `themeId`
   // option → doc frontmatter `themeId`. Hosts whose export dialog
   // tracks themes by id can pass `themeId` straight through; authored
   // docs with `themeId: warm-earth` in frontmatter get styled
   // automatically when neither is supplied.
-  const theme =
-    options.theme ??
-    (themeId ? resolveTheme(themeId) : undefined) ??
-    (typeof doc.frontmatter?.themeId === 'string'
-      ? resolveTheme(doc.frontmatter.themeId)
-      : undefined);
-  const ctx: RenderCtx = { images, links };
+  // Resolution is doc-scoped via `resolveThemeForDoc`, so an inline
+  // `squisq-custom-themes` id resolves here with no global registration —
+  // and `readFrontmatterThemeId` picks up the editor's canonical
+  // `squisq-theme` key. Stays undefined when nothing selects a theme so
+  // un-themed exports render unstyled (unchanged behavior).
+  const resolveId = themeId ?? readFrontmatterThemeId(doc.frontmatter);
+  const theme = options.theme ?? (resolveId ? resolveThemeForDoc(doc, resolveId) : undefined);
+  const ctx: RenderCtx = { images, links, htmlPolicy };
   const body = renderTopLevel(doc.children, ctx);
   const fontsLink = theme ? renderFontsLink(theme) : '';
   // Resolve how to load FontAwesome — only when the doc actually uses
@@ -258,7 +274,9 @@ interface FeaturedImage {
 
 function renderFeatureImage(img: FeaturedImage, ctx: RenderCtx | undefined): string {
   const resolved = ctx?.images?.get(img.src) ?? img.src;
-  const attrs = [`src="${escapeAttr(resolved)}"`, `alt="${escapeAttr(img.alt)}"`];
+  const safeSrc = sanitizeUrl(resolved, 'media');
+  if (!safeSrc) return '<div class="squisq-feature__media squisq-feature__media--empty"></div>';
+  const attrs = [`src="${escapeAttr(safeSrc)}"`, `alt="${escapeAttr(img.alt)}"`];
   // Emit `width` / `height` attributes only when the source HTML had
   // them. The CSS rules then know to honor those values rather than
   // stretching the image to fill the column.
@@ -604,12 +622,16 @@ function nodeToHtml(node: MarkdownNode | undefined | null, ctx?: RenderCtx): str
     case 'link': {
       const original = node.url ?? '';
       const rewritten = ctx?.links?.get(original) ?? original;
-      return `<a href="${escapeAttr(rewritten)}">${childrenToHtml(node, ctx)}</a>`;
+      const safeHref = sanitizeUrl(rewritten, 'link');
+      if (!safeHref) return childrenToHtml(node, ctx);
+      return `<a href="${escapeAttr(safeHref)}">${childrenToHtml(node, ctx)}</a>`;
     }
     case 'image': {
       const original = node.url ?? '';
       const resolved = ctx?.images?.get(original) ?? original;
-      return `<img src="${escapeAttr(resolved)}" alt="${escapeAttr(node.alt ?? '')}" />`;
+      const safeSrc = sanitizeUrl(resolved, 'media');
+      if (!safeSrc) return escapeHtml(node.alt ?? '');
+      return `<img src="${escapeAttr(safeSrc)}" alt="${escapeAttr(node.alt ?? '')}" />`;
     }
     case 'thematicBreak':
       return '<hr />';
@@ -626,11 +648,12 @@ function nodeToHtml(node: MarkdownNode | undefined | null, ctx?: RenderCtx): str
     }
     case 'htmlBlock':
     case 'htmlInline':
+      if (resolveHtmlPolicy(ctx) === 'strip') return '';
       // Resized images and other authored HTML survive the round-trip
       // as parsed `htmlChildren` — rewriting `<img src>` through the
       // image map keeps the preview consistent with the markdown-image
       // path. Other tags pass through unmodified.
-      return htmlChildrenToHtml(node.htmlChildren, ctx);
+      return htmlChildrenToHtml(resolveHtmlNodes(node.htmlChildren, ctx), ctx);
     default: {
       // Unknown / unhandled node — recurse into children if any so we
       // don't drop content (e.g. directives, footnotes).
@@ -682,18 +705,28 @@ function tableToHtml(
   return parts.join('');
 }
 
+function resolveHtmlPolicy(ctx: RenderCtx | undefined): HtmlPolicy {
+  return ctx?.htmlPolicy ?? 'sanitize';
+}
+
+function resolveHtmlNodes(nodes: HtmlNode[] | undefined, ctx: RenderCtx | undefined): HtmlNode[] {
+  if (!nodes || nodes.length === 0) return [];
+  return resolveHtmlPolicy(ctx) === 'trusted' ? nodes : sanitizeHtmlNodes(nodes);
+}
+
 function htmlChildrenToHtml(nodes: HtmlNode[] | undefined, ctx?: RenderCtx): string {
   if (!nodes || nodes.length === 0) return '';
+  const trusted = resolveHtmlPolicy(ctx) === 'trusted';
   const out: string[] = [];
   for (const node of nodes) {
     if (node.type === 'htmlText') {
       // HtmlText already represents authored HTML — emit verbatim so
       // entity references the user wrote (e.g. `&amp;`) survive.
-      out.push(node.value);
+      out.push(trusted ? node.value : escapeHtml(node.value));
       continue;
     }
     if (node.type === 'htmlComment') {
-      out.push(`<!--${node.value}-->`);
+      if (trusted) out.push(`<!--${node.value}-->`);
       continue;
     }
     // htmlElement
@@ -713,6 +746,23 @@ function htmlChildrenToHtml(nodes: HtmlNode[] | undefined, ctx?: RenderCtx): str
     if ((tag === 'video' || tag === 'audio') && typeof attrs.poster === 'string') {
       attrs.poster = ctx?.images?.get(attrs.poster) ?? attrs.poster;
     }
+    if (!trusted) {
+      if (typeof attrs.src === 'string') {
+        const safeSrc = sanitizeUrl(attrs.src, 'media');
+        if (!safeSrc) delete attrs.src;
+        else attrs.src = safeSrc;
+      }
+      if (typeof attrs.poster === 'string') {
+        const safePoster = sanitizeUrl(attrs.poster, 'media');
+        if (!safePoster) delete attrs.poster;
+        else attrs.poster = safePoster;
+      }
+      if (typeof attrs.href === 'string') {
+        const safeHref = sanitizeUrl(attrs.href, 'link');
+        if (!safeHref) delete attrs.href;
+        else attrs.href = safeHref;
+      }
+    }
     const attrStr = Object.entries(attrs)
       .map(([k, v]) => ` ${k}="${escapeAttr(v)}"`)
       .join('');

package/src/index.ts

@@ -7,8 +7,9 @@
  * Supported formats:
  * - **DOCX** — Microsoft Word (import + export) ✅
  * - **PDF**  — Portable Document Format (import + export) ✅
- * - **PPTX** — Microsoft PowerPoint (export ✅, import planned)
- * - **XLSX** — Microsoft Excel (planned)
+ * - **PPTX** — Microsoft PowerPoint (export ✅, import ✅)
+ * - **XLSX** — Microsoft Excel (import ✅, export planned)
+ * - **CSV**  — Comma-separated values (import ✅, export ✅)
  *
  * All converters run in the browser — no server or native binaries required.
  * The shared `ooxml/` subpath export provides reusable OOXML infrastructure.
@@ -32,10 +33,14 @@ export type { DocxExportOptions, DocxImportOptions } from './docx/index.js';
 export { markdownDocToPptx, docToPptx, pptxToMarkdownDoc, pptxToDoc } from './pptx/index.js';
 export type { PptxExportOptions, PptxImportOptions } from './pptx/index.js';
 
-// XLSX (stub)
+// XLSX (import implemented, export stub)
 export { markdownDocToXlsx, docToXlsx, xlsxToMarkdownDoc, xlsxToDoc } from './xlsx/index.js';
 export type { XlsxExportOptions, XlsxImportOptions } from './xlsx/index.js';
 
+// CSV (import + export)
+export { csvToMarkdownDoc, csvToDoc, markdownDocToCsv, parseCsv } from './csv/index.js';
+export type { CsvImportOptions, CsvExportOptions } from './csv/index.js';
+
 // PDF (fully implemented)
 export {
   markdownDocToPdf,
@@ -49,6 +54,8 @@ export type { PdfExportOptions, PdfImportOptions } from './pdf/index.js';
 // HTML (fully implemented)
 export { docToHtml, docToHtmlZip, collectImagePaths } from './html/index.js';
 export type { HtmlExportOptions, HtmlZipExportOptions } from './html/index.js';
+export { htmlToMarkdown, htmlToMarkdownDoc, htmlToMarkdownDocSync } from './html/index.js';
+export type { HtmlImportOptions } from './html/index.js';
 
 // EPUB (export)
 export { markdownDocToEpub, docToEpub } from './epub/index.js';

package/src/ooxml/namespaces.ts

@@ -77,6 +77,9 @@ export const NS_WML = 'http://schemas.openxmlformats.org/wordprocessingml/2006/m
 /** PresentationML main namespace (p:) */
 export const NS_PML = 'http://schemas.openxmlformats.org/presentationml/2006/main';
 
+/** PowerPoint 2010 extension namespace (p14:) */
+export const NS_PML_2010 = 'http://schemas.microsoft.com/office/powerpoint/2010/main';
+
 // ============================================
 // SpreadsheetML (XLSX)
 // ============================================

package/src/pdf/export.ts

@@ -22,8 +22,7 @@
 import { PDFDocument, StandardFonts, rgb, PDFFont, PDFPage } from 'pdf-lib';
 
 import type { Doc } from '@bendyline/squisq/schemas';
-import { resolveTheme } from '@bendyline/squisq/schemas';
-import { docToMarkdown } from '@bendyline/squisq/doc';
+import { docToMarkdown, resolveThemeForDoc } from '@bendyline/squisq/doc';
 import type {
   MarkdownDocument,
   MarkdownBlockNode,
@@ -51,6 +50,7 @@ import type {
   MarkdownInlineMath,
   MarkdownFootnoteReference,
 } from '@bendyline/squisq/markdown';
+import { readFrontmatterThemeId } from '@bendyline/squisq/markdown';
 
 import {
   PAGE_WIDTH_LETTER,
@@ -127,7 +127,7 @@ export async function markdownDocToPdf(
   pdfDoc.setCreationDate(new Date());
   pdfDoc.setModificationDate(new Date());
 
-  const ctx = await createExportContext(pdfDoc, options);
+  const ctx = await createExportContext(pdfDoc, options, doc);
 
   renderBlocks(doc.children, ctx, 0);
 
@@ -190,6 +190,7 @@ interface ExportContext {
 async function createExportContext(
   pdfDoc: PDFDocument,
   options: PdfExportOptions,
+  doc: MarkdownDocument,
 ): Promise<ExportContext> {
   const [regular, bold, italic, boldItalic, mono, monoBold] = await Promise.all([
     pdfDoc.embedFont(StandardFonts.Helvetica),
@@ -213,8 +214,12 @@ async function createExportContext(
   let colorHeading = COLOR_HEADING;
   let colorLink = COLOR_LINK;
 
-  if (options.themeId) {
-    const theme = resolveTheme(options.themeId);
+  // Honor an explicit themeId, else the doc's frontmatter theme (`squisq-theme`
+  // / legacy) — mirroring PPTX/DOCX/HTML so every format themes consistently,
+  // including inline custom themes (resolved doc-scoped).
+  const themeId = options.themeId ?? readFrontmatterThemeId(doc.frontmatter);
+  if (themeId) {
+    const theme = resolveThemeForDoc(doc, themeId);
     if (theme.colors) {
       colorText = hexToRgb(theme.colors.text) ?? COLOR_TEXT;
       colorHeading = hexToRgb(theme.colors.primary) ?? COLOR_HEADING;

package/src/pdf/import.ts

@@ -22,6 +22,7 @@
 
 import type { Doc } from '@bendyline/squisq/schemas';
 import { markdownToDoc } from '@bendyline/squisq/doc';
+import { stringifyMarkdown } from '@bendyline/squisq/markdown';
 import type {
   MarkdownDocument,
   MarkdownBlockNode,
@@ -169,7 +170,6 @@ export async function pdfToContainer(
 
   const markdownDoc: MarkdownDocument = { type: 'document', children: blocks };
 
-  const { stringifyMarkdown } = await import('@bendyline/squisq/markdown');
   const markdown = stringifyMarkdown(markdownDoc);
 
   const container = new MemoryContentContainer();