@bendyline/squisq-formats 1.3.1 → 1.4.1

package/dist/{chunk-33YRFXZZ.js → chunk-46FMDOWZ.js}

@@ -2,7 +2,7 @@ import {
   arrayBufferToBase64DataUrl,
   extractFilename,
   inferMimeType
-} from "./chunk-A3FHLTY5.js";
+} from "./chunk-MJGRI6XR.js";
 
 // src/html/index.ts
 import JSZip3 from "jszip";
@@ -222,11 +222,18 @@ function escapeHtml(str) {
 }
 
 // src/html/plainHtml.ts
-import { resolveFontFamily, buildGoogleFontsUrl, resolveTheme } from "@bendyline/squisq/schemas";
+import {
+  sanitizeHtmlNodes,
+  sanitizeUrl,
+  readFrontmatterThemeId
+} from "@bendyline/squisq/markdown";
+import { resolveFontFamily, buildGoogleFontsUrl } from "@bendyline/squisq/schemas";
+import { resolveThemeForDoc } from "@bendyline/squisq/doc";
 function markdownDocToPlainHtml(doc, options = {}) {
-  const { title = "Document", images, links, themeId, iconsCss } = options;
-  const theme = options.theme ?? (themeId ? resolveTheme(themeId) : void 0) ?? (typeof doc.frontmatter?.themeId === "string" ? resolveTheme(doc.frontmatter.themeId) : void 0);
-  const ctx = { images, links };
+  const { title = "Document", images, links, themeId, iconsCss, htmlPolicy = "sanitize" } = options;
+  const resolveId = themeId ?? readFrontmatterThemeId(doc.frontmatter);
+  const theme = options.theme ?? (resolveId ? resolveThemeForDoc(doc, resolveId) : void 0);
+  const ctx = { images, links, htmlPolicy };
   const body = renderTopLevel(doc.children, ctx);
   const fontsLink = theme ? renderFontsLink(theme) : "";
   const usesIcons = docUsesIcons(doc);
@@ -310,7 +317,9 @@ ${textHtml}
 }
 function renderFeatureImage(img, ctx) {
   const resolved = ctx?.images?.get(img.src) ?? img.src;
-  const attrs = [`src="${escapeAttr(resolved)}"`, `alt="${escapeAttr(img.alt)}"`];
+  const safeSrc = sanitizeUrl(resolved, "media");
+  if (!safeSrc) return '<div class="squisq-feature__media squisq-feature__media--empty"></div>';
+  const attrs = [`src="${escapeAttr(safeSrc)}"`, `alt="${escapeAttr(img.alt)}"`];
   if (typeof img.width === "number") attrs.push(`width="${img.width}"`);
   if (typeof img.height === "number") attrs.push(`height="${img.height}"`);
   const sizedClass = typeof img.width === "number" || typeof img.height === "number" ? " squisq-feature__media--sized" : "";
@@ -593,12 +602,16 @@ function nodeToHtml(node, ctx) {
     case "link": {
       const original = node.url ?? "";
       const rewritten = ctx?.links?.get(original) ?? original;
-      return `<a href="${escapeAttr(rewritten)}">${childrenToHtml(node, ctx)}</a>`;
+      const safeHref = sanitizeUrl(rewritten, "link");
+      if (!safeHref) return childrenToHtml(node, ctx);
+      return `<a href="${escapeAttr(safeHref)}">${childrenToHtml(node, ctx)}</a>`;
     }
     case "image": {
       const original = node.url ?? "";
       const resolved = ctx?.images?.get(original) ?? original;
-      return `<img src="${escapeAttr(resolved)}" alt="${escapeAttr(node.alt ?? "")}" />`;
+      const safeSrc = sanitizeUrl(resolved, "media");
+      if (!safeSrc) return escapeHtml2(node.alt ?? "");
+      return `<img src="${escapeAttr(safeSrc)}" alt="${escapeAttr(node.alt ?? "")}" />`;
     }
     case "thematicBreak":
       return "<hr />";
@@ -612,7 +625,8 @@ function nodeToHtml(node, ctx) {
     }
     case "htmlBlock":
     case "htmlInline":
-      return htmlChildrenToHtml(node.htmlChildren, ctx);
+      if (resolveHtmlPolicy(ctx) === "strip") return "";
+      return htmlChildrenToHtml(resolveHtmlNodes(node.htmlChildren, ctx), ctx);
     default: {
       const withChildren = node;
       if (Array.isArray(withChildren.children)) {
@@ -653,16 +667,24 @@ function tableToHtml(node, ctx) {
   parts.push("</table>");
   return parts.join("");
 }
+function resolveHtmlPolicy(ctx) {
+  return ctx?.htmlPolicy ?? "sanitize";
+}
+function resolveHtmlNodes(nodes, ctx) {
+  if (!nodes || nodes.length === 0) return [];
+  return resolveHtmlPolicy(ctx) === "trusted" ? nodes : sanitizeHtmlNodes(nodes);
+}
 function htmlChildrenToHtml(nodes, ctx) {
   if (!nodes || nodes.length === 0) return "";
+  const trusted = resolveHtmlPolicy(ctx) === "trusted";
   const out = [];
   for (const node of nodes) {
     if (node.type === "htmlText") {
-      out.push(node.value);
+      out.push(trusted ? node.value : escapeHtml2(node.value));
       continue;
     }
     if (node.type === "htmlComment") {
-      out.push(`<!--${node.value}-->`);
+      if (trusted) out.push(`<!--${node.value}-->`);
       continue;
     }
     const tag = node.tagName.toLowerCase();
@@ -673,6 +695,23 @@ function htmlChildrenToHtml(nodes, ctx) {
     if ((tag === "video" || tag === "audio") && typeof attrs.poster === "string") {
       attrs.poster = ctx?.images?.get(attrs.poster) ?? attrs.poster;
     }
+    if (!trusted) {
+      if (typeof attrs.src === "string") {
+        const safeSrc = sanitizeUrl(attrs.src, "media");
+        if (!safeSrc) delete attrs.src;
+        else attrs.src = safeSrc;
+      }
+      if (typeof attrs.poster === "string") {
+        const safePoster = sanitizeUrl(attrs.poster, "media");
+        if (!safePoster) delete attrs.poster;
+        else attrs.poster = safePoster;
+      }
+      if (typeof attrs.href === "string") {
+        const safeHref = sanitizeUrl(attrs.href, "link");
+        if (!safeHref) delete attrs.href;
+        else attrs.href = safeHref;
+      }
+    }
     const attrStr = Object.entries(attrs).map(([k, v]) => ` ${k}="${escapeAttr(v)}"`).join("");
     if (node.selfClosing) {
       out.push(`<${tag}${attrStr} />`);
@@ -692,7 +731,7 @@ function escapeAttr(s) {
 // src/html/plainHtmlBundle.ts
 import JSZip from "jszip";
 import { parseMarkdown, inferDocumentTitle } from "@bendyline/squisq/markdown";
-import { resolveTheme as resolveTheme2 } from "@bendyline/squisq/schemas";
+import { resolveTheme } from "@bendyline/squisq/schemas";
 async function markdownDocsToPlainHtmlBundle(options) {
   const {
     entryPath,
@@ -704,7 +743,7 @@ async function markdownDocsToPlainHtmlBundle(options) {
     maxDepth = Infinity,
     entryAsIndex = false
   } = options;
-  const resolvedTheme = theme ?? (themeId ? resolveTheme2(themeId) : void 0);
+  const resolvedTheme = theme ?? (themeId ? resolveTheme(themeId) : void 0);
   const entry = normalizePath(entryPath);
   if (!entry) {
     throw new Error("markdownDocsToPlainHtmlBundle: entryPath is required");
@@ -1126,6 +1165,210 @@ function titleForDoc(path, mdDoc) {
   return base.replace(/\.md$/i, "");
 }
 
+// src/html/import.ts
+import {
+  parseHtmlToNodes,
+  sanitizeHtmlNodes as sanitizeHtmlNodes2,
+  stringifyMarkdown
+} from "@bendyline/squisq/markdown";
+var HEADINGS = {
+  h1: 1,
+  h2: 2,
+  h3: 3,
+  h4: 4,
+  h5: 5,
+  h6: 6
+};
+var TRANSPARENT_BLOCK = /* @__PURE__ */ new Set([
+  "div",
+  "section",
+  "article",
+  "header",
+  "footer",
+  "main",
+  "aside",
+  "nav",
+  "figure",
+  "figcaption",
+  "form",
+  "fieldset",
+  "body",
+  "html",
+  "center"
+]);
+var DROP = /* @__PURE__ */ new Set(["script", "style", "head", "title", "noscript", "template", "svg"]);
+var INLINE_STRONG = /* @__PURE__ */ new Set(["strong", "b"]);
+var INLINE_EM = /* @__PURE__ */ new Set(["em", "i"]);
+var INLINE_DEL = /* @__PURE__ */ new Set(["del", "s", "strike"]);
+var INLINE_TRANSPARENT = /* @__PURE__ */ new Set(["span", "font", "abbr", "mark", "small", "sub", "sup", "u"]);
+var isElement = (n) => n.type === "htmlElement";
+var isText = (n) => n.type === "htmlText";
+var collapseWs = (s) => s.replace(/\s+/g, " ");
+function inlinesFromNodes(nodes) {
+  const out = [];
+  for (const node of nodes) {
+    if (isText(node)) {
+      const value = collapseWs(node.value);
+      if (value) out.push({ type: "text", value });
+      continue;
+    }
+    if (!isElement(node)) continue;
+    const tag = node.tagName.toLowerCase();
+    if (DROP.has(tag)) continue;
+    if (tag === "br") {
+      out.push({ type: "break" });
+    } else if (INLINE_STRONG.has(tag)) {
+      out.push({ type: "strong", children: inlinesFromNodes(node.children) });
+    } else if (INLINE_EM.has(tag)) {
+      out.push({ type: "emphasis", children: inlinesFromNodes(node.children) });
+    } else if (INLINE_DEL.has(tag)) {
+      out.push({ type: "delete", children: inlinesFromNodes(node.children) });
+    } else if (tag === "code" || tag === "kbd" || tag === "samp" || tag === "tt") {
+      out.push({ type: "inlineCode", value: textContent(node) });
+    } else if (tag === "a") {
+      const url = node.attributes.href ?? "";
+      const children = inlinesFromNodes(node.children);
+      out.push({
+        type: "link",
+        url,
+        children: children.length > 0 ? children : [{ type: "text", value: url }]
+      });
+    } else if (tag === "img") {
+      const url = node.attributes.src ?? "";
+      const alt = node.attributes.alt;
+      if (url) out.push({ type: "image", url, ...alt ? { alt } : {} });
+    } else {
+      out.push(...inlinesFromNodes(node.children));
+    }
+  }
+  return out;
+}
+function textContent(node) {
+  if (isText(node)) return node.value;
+  if (isElement(node)) return node.children.map(textContent).join("");
+  return "";
+}
+var onlyWhitespace = (inlines) => inlines.every((n) => n.type === "text" && n.value.trim() === "");
+function blocksFromNodes(nodes) {
+  const out = [];
+  let inlineBuffer = [];
+  const flush = () => {
+    if (inlineBuffer.length === 0) return;
+    const inlines = inlinesFromNodes(inlineBuffer);
+    inlineBuffer = [];
+    if (inlines.length > 0 && !onlyWhitespace(inlines)) {
+      out.push({ type: "paragraph", children: inlines });
+    }
+  };
+  for (const node of nodes) {
+    if (isText(node)) {
+      inlineBuffer.push(node);
+      continue;
+    }
+    if (!isElement(node)) continue;
+    const tag = node.tagName.toLowerCase();
+    if (DROP.has(tag)) continue;
+    const block = blockForElement(node, tag);
+    if (block === "inline") {
+      inlineBuffer.push(node);
+    } else if (block) {
+      flush();
+      out.push(...block);
+    }
+  }
+  flush();
+  return out;
+}
+function blockForElement(node, tag) {
+  if (tag in HEADINGS) {
+    const children = inlinesFromNodes(node.children);
+    return [{ type: "heading", depth: HEADINGS[tag], children }];
+  }
+  if (tag === "p") {
+    const children = inlinesFromNodes(node.children);
+    return children.length > 0 && !onlyWhitespace(children) ? [{ type: "paragraph", children }] : [];
+  }
+  if (tag === "br") return "inline";
+  if (tag === "hr") return [{ type: "thematicBreak" }];
+  if (tag === "blockquote") {
+    return [{ type: "blockquote", children: blocksFromNodes(node.children) }];
+  }
+  if (tag === "pre") {
+    return [{ type: "code", value: stripTrailingNewline(textContent(node)) }];
+  }
+  if (tag === "ul" || tag === "ol") {
+    return [listFromElement(node, tag === "ol")];
+  }
+  if (tag === "table") {
+    const table = tableFromElement(node);
+    return table ? [table] : [];
+  }
+  if (TRANSPARENT_BLOCK.has(tag)) {
+    return blocksFromNodes(node.children);
+  }
+  if (INLINE_STRONG.has(tag) || INLINE_EM.has(tag) || INLINE_DEL.has(tag) || INLINE_TRANSPARENT.has(tag) || tag === "a" || tag === "img" || tag === "code" || tag === "kbd" || tag === "samp") {
+    return "inline";
+  }
+  return blocksFromNodes(node.children);
+}
+function listFromElement(node, ordered) {
+  const items = [];
+  for (const child of node.children) {
+    if (isElement(child) && child.tagName.toLowerCase() === "li") {
+      const blocks = blocksFromNodes(child.children);
+      items.push({ type: "listItem", children: blocks });
+    }
+  }
+  const startAttr = node.attributes.start;
+  const start = ordered && startAttr ? Number.parseInt(startAttr, 10) : void 0;
+  return {
+    type: "list",
+    ordered,
+    ...start !== void 0 && Number.isFinite(start) ? { start } : {},
+    children: items
+  };
+}
+function tableFromElement(node) {
+  const rows = [];
+  const collectRows = (n) => {
+    for (const child of n.children) {
+      if (!isElement(child)) continue;
+      const t = child.tagName.toLowerCase();
+      if (t === "tr") {
+        const cells = [];
+        for (const cell of child.children) {
+          if (isElement(cell) && (cell.tagName.toLowerCase() === "td" || cell.tagName.toLowerCase() === "th")) {
+            cells.push({ type: "tableCell", children: inlinesFromNodes(cell.children) });
+          }
+        }
+        if (cells.length > 0) rows.push({ type: "tableRow", children: cells });
+      } else if (t === "thead" || t === "tbody" || t === "tfoot") {
+        collectRows(child);
+      }
+    }
+  };
+  collectRows(node);
+  if (rows.length === 0) return null;
+  return { type: "table", children: rows };
+}
+var stripTrailingNewline = (s) => s.replace(/\n+$/, "");
+function toHtmlString(data) {
+  if (typeof data === "string") return data;
+  const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
+  return new TextDecoder("utf-8").decode(bytes);
+}
+function htmlToMarkdownDocSync(html, options = {}) {
+  let nodes = parseHtmlToNodes(html);
+  if (options.sanitize !== false) nodes = sanitizeHtmlNodes2(nodes);
+  return { type: "document", children: blocksFromNodes(nodes) };
+}
+async function htmlToMarkdownDoc(data, options = {}) {
+  return htmlToMarkdownDocSync(toHtmlString(data), options);
+}
+function htmlToMarkdown(html, options = {}) {
+  return stringifyMarkdown(htmlToMarkdownDocSync(html, options));
+}
+
 // src/html/index.ts
 function sanitizeZipPath3(path) {
   const normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
@@ -1181,7 +1424,10 @@ export {
   markdownDocsToPlainHtmlBundle,
   collectLinkRefs,
   markdownDocsToHtmlBundle,
+  htmlToMarkdownDocSync,
+  htmlToMarkdownDoc,
+  htmlToMarkdown,
   docToHtml,
   docToHtmlZip
 };
-//# sourceMappingURL=chunk-33YRFXZZ.js.map
+//# sourceMappingURL=chunk-46FMDOWZ.js.map