@bendyline/squisq-formats 2.1.0 → 2.2.0

package/dist/{chunk-SC67HYQJ.js → chunk-EJTNGKEA.js}

@@ -1,14 +1,12 @@
-import {
-  baseDirOf,
-  findRelByType,
-  resolveTarget
-} from "./chunk-YRT7GQ5Y.js";
 import {
   NS_DRAWINGML,
   REL_THEME,
+  baseDirOf,
+  findRelByType,
   getPartRelationships,
-  getPartXml
-} from "./chunk-7ARKUCQT.js";
+  getPartXml,
+  resolveTarget
+} from "./chunk-X2DEAXNK.js";
 
 // src/ooxml/themeReader.ts
 var HEX6_RE = /^[0-9a-fA-F]{6}$/;
@@ -128,4 +126,3 @@ export {
   parseThemeXml,
   readThemePart
 };
-//# sourceMappingURL=chunk-SC67HYQJ.js.map

package/dist/chunk-GX7RAUME.js

@@ -0,0 +1,121 @@
+import {
+  stripHtmlTags
+} from "./chunk-SBUW7NHR.js";
+
+// src/ooxml/relIds.ts
+var RelIdAllocator = class {
+  constructor() {
+    /** part path → next free numeric suffix */
+    this.next = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Allocate the next free relationship id for `part`'s rels file.
+   *
+   * @param part - Zip path of the part that owns the relationship
+   *   (e.g. `"word/document.xml"`). Use `""` for the package root.
+   *   Ids are only unique per `part`, which is exactly the OOXML rule.
+   */
+  alloc(part = "") {
+    const n = this.next.get(part) ?? 1;
+    this.next.set(part, n + 1);
+    return `rId${n}`;
+  }
+};
+
+// src/shared/ooxmlColor.ts
+var HEX3_RE = /^#?([0-9a-fA-F])([0-9a-fA-F])([0-9a-fA-F])$/;
+var HEX6_RE = /^#?([0-9a-fA-F]{6})$/;
+var HEX8_RE = /^#?([0-9a-fA-F]{6})[0-9a-fA-F]{2}$/;
+function toOoxmlHex(color, fallback = "000000") {
+  const normalized = normalizeOoxmlHex(color);
+  if (normalized) return normalized;
+  return normalizeOoxmlHex(fallback) ?? "000000";
+}
+function normalizeOoxmlHex(color) {
+  if (typeof color !== "string") return void 0;
+  const trimmed = color.trim();
+  const six = HEX6_RE.exec(trimmed);
+  if (six) return six[1].toUpperCase();
+  const eight = HEX8_RE.exec(trimmed);
+  if (eight) return eight[1].toUpperCase();
+  const three = HEX3_RE.exec(trimmed);
+  if (three) {
+    const [, r, g, b] = three;
+    return `${r}${r}${g}${g}${b}${b}`.toUpperCase();
+  }
+  return void 0;
+}
+
+// src/shared/officeHyperlinks.ts
+import { sanitizeUrl } from "@bendyline/squisq/markdown";
+function sanitizeOfficeHyperlink(input, policy = {}) {
+  if (typeof input !== "string") return null;
+  const value = input.trim();
+  if (!value || hasControls(value)) return null;
+  if (value.startsWith("#")) return /^#[^\s]*$/.test(value) ? value : null;
+  if (/^(?:\\\\|\/\/|\/|[a-z]:[\\/])/i.test(value)) return null;
+  const hasScheme = /^[a-z][a-z0-9+.-]*:/i.test(value);
+  if (hasScheme) return sanitizeUrl(value);
+  if (!policy.allowRelative || value.includes("\\")) return null;
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  if (hasControls(decoded) || decoded.includes("\\") || decoded.startsWith("//")) return null;
+  return value;
+}
+function hasControls(value) {
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+
+// src/shared/inlineRuns.ts
+function inlineNodesToRuns(nodes, handlers, format = {}) {
+  let out = "";
+  for (const node of nodes) {
+    out += inlineNodeToRuns(node, handlers, format);
+  }
+  return out;
+}
+function inlineNodeToRuns(node, handlers, format) {
+  switch (node.type) {
+    case "text":
+      return handlers.run(node.value, format);
+    case "strong":
+      return inlineNodesToRuns(node.children, handlers, { ...format, bold: true });
+    case "emphasis":
+      return inlineNodesToRuns(node.children, handlers, { ...format, italic: true });
+    case "delete":
+      return inlineNodesToRuns(node.children, handlers, { ...format, strike: true });
+    case "inlineCode":
+      return handlers.run(node.value, { ...format, code: true });
+    case "inlineMath":
+      return handlers.run(node.value, { ...format, code: true });
+    case "htmlInline":
+      return handlers.run(stripHtmlTags(node.rawHtml), format);
+    case "link":
+      return handlers.link(node, format);
+    case "image":
+      return handlers.image(node, format);
+    case "break":
+      return handlers.lineBreak();
+    case "footnoteReference":
+      return handlers.footnoteRef ? handlers.footnoteRef(node) : "";
+    default:
+      return "";
+  }
+}
+
+export {
+  RelIdAllocator,
+  toOoxmlHex,
+  normalizeOoxmlHex,
+  sanitizeOfficeHyperlink,
+  inlineNodesToRuns,
+  inlineNodeToRuns
+};

package/dist/{chunk-SSUPBUF5.js → chunk-IIQYS2YH.js}

@@ -12,4 +12,3 @@ async function buildContainer(markdown, images) {
 export {
   buildContainer
 };
-//# sourceMappingURL=chunk-SSUPBUF5.js.map

package/dist/{chunk-RLU7UFYU.js → chunk-IPN56VLW.js}

@@ -1,23 +1,21 @@
 import {
+  RelIdAllocator,
   inlineNodeToRuns,
-  inlineNodesToRuns
-} from "./chunk-6M7Z25LA.js";
+  inlineNodesToRuns,
+  sanitizeOfficeHyperlink,
+  toOoxmlHex
+} from "./chunk-GX7RAUME.js";
 import {
   extractPlainText,
   stripHtmlTags
-} from "./chunk-PN52A5AA.js";
-import {
-  attrNS,
-  baseDirOf,
-  resolveTarget
-} from "./chunk-YRT7GQ5Y.js";
+} from "./chunk-SBUW7NHR.js";
 import {
   createPackage
-} from "./chunk-KURGXM4I.js";
+} from "./chunk-4V3KCHAP.js";
 import {
   escapeXml,
   xmlDeclaration
-} from "./chunk-U4MRIFKL.js";
+} from "./chunk-JU2RHXUB.js";
 import {
   CONTENT_TYPE_PPTX_PRESENTATION,
   CONTENT_TYPE_PPTX_SLIDE,
@@ -36,20 +34,24 @@ import {
   REL_SLIDE_LAYOUT,
   REL_SLIDE_MASTER,
   REL_THEME,
+  attrNS,
+  baseDirOf,
   getPartBinary,
   getPartRelationships,
   getPartXml,
-  openPackage
-} from "./chunk-7ARKUCQT.js";
+  openPackage,
+  requireMainPartPath,
+  resolveTarget
+} from "./chunk-X2DEAXNK.js";
 import {
   buildContainer
-} from "./chunk-SSUPBUF5.js";
+} from "./chunk-IIQYS2YH.js";
 import {
   inferMimeType
-} from "./chunk-MLX2BOJC.js";
+} from "./chunk-6RQOV3B3.js";
 import {
   extToMime
-} from "./chunk-O3GVVND4.js";
+} from "./chunk-AONELFLA.js";
 
 // src/pptx/export.ts
 import { resolveFontFamily } from "@bendyline/squisq/schemas";
@@ -94,6 +96,7 @@ function buildThemeXml() {
 
 // src/pptx/export.ts
 async function markdownDocToPptx(doc, options = {}) {
+  options.signal?.throwIfAborted();
   const themeId = options.themeId ?? readFrontmatterThemeId(doc.frontmatter);
   const style = resolveSlideStyle(themeId, options, doc);
   const slides = segmentIntoSlides(doc.children, options.slideBreak ?? "h2");
@@ -103,7 +106,14 @@ async function markdownDocToPptx(doc, options = {}) {
   const slideXmls = [];
   const slideContexts = [];
   for (let i = 0; i < slides.length; i++) {
-    const ctx = new SlideContext(style, options.images, i);
+    if ((i & 31) === 0) options.signal?.throwIfAborted();
+    const ctx = new SlideContext(
+      style,
+      options.images,
+      i,
+      options.allowRelativeHyperlinks ?? false,
+      options.signal
+    );
     const xml = buildSlideXml(slides[i], ctx);
     slideXmls.push(xml);
     slideContexts.push(ctx);
@@ -134,20 +144,17 @@ function resolveSlideStyle(themeId, options, doc) {
   const theme = resolveThemeForDoc(doc, themeId, options.themeRegistry);
   const c = theme.colors;
   return {
-    background: stripHash(c.background),
-    text: stripHash(c.text),
-    titleColor: stripHash(c.highlight || c.secondary || c.text),
-    mutedColor: stripHash(c.textMuted || c.text),
+    background: toOoxmlHex(c.background, "FFFFFF"),
+    text: toOoxmlHex(c.text, "333333"),
+    titleColor: toOoxmlHex(c.highlight || c.secondary || c.text, "333333"),
+    mutedColor: toOoxmlHex(c.textMuted || c.text, "666666"),
     titleFont: resolveFontFamily(theme.typography?.titleFont, DEFAULT_TITLE_FONT),
     bodyFont: resolveFontFamily(theme.typography?.bodyFont, options.defaultFont || DEFAULT_FONT),
     codeFont: resolveFontFamily(theme.typography?.monoFont, DEFAULT_CODE_FONT),
-    codeColor: stripHash(c.textMuted || c.text),
+    codeColor: toOoxmlHex(c.textMuted || c.text, "333333"),
     hasTheme: true
   };
 }
-function stripHash(color) {
-  return color.startsWith("#") ? color.slice(1) : color;
-}
 function segmentIntoSlides(children, slideBreak) {
   const maxDepth = slideBreak === "h1" ? 1 : slideBreak === "h2" ? 2 : 6;
   const slides = [];
@@ -172,28 +179,44 @@ function segmentIntoSlides(children, slideBreak) {
   return slides;
 }
 var SlideContext = class {
-  // 1=group, 2=title, 3=body
-  constructor(style, images, slideIndex) {
-    this.nextRelId = 1;
+  constructor(style, images, slideIndex, allowRelativeHyperlinks, signal) {
+    /**
+     * One id source for this slide's rels part — see `RelIdAllocator`. There is
+     * exactly one SlideContext per `ppt/slides/slideN.xml`, and EVERY rel on
+     * that part (layout, hyperlinks, images) is allocated here, so duplicate
+     * `Id`s are impossible by construction.
+     */
+    this.relIds = new RelIdAllocator();
     this.relationships = [];
     this.embeddedImages = [];
     this.nextShapeId = 4;
     this.style = style;
     this.images = images;
     this.slideIndex = slideIndex;
+    this.allowRelativeHyperlinks = allowRelativeHyperlinks;
+    this.signal = signal;
+    this.relationships.push({
+      id: this.allocRelId(),
+      type: REL_SLIDE_LAYOUT,
+      target: "../slideLayouts/slideLayout1.xml"
+    });
   }
   allocRelId() {
-    return `rId${this.nextRelId++ + 1}`;
+    return this.relIds.alloc();
   }
   allocShapeId() {
     return this.nextShapeId++;
   }
   addHyperlink(url) {
+    const target = sanitizeOfficeHyperlink(url, {
+      allowRelative: this.allowRelativeHyperlinks
+    });
+    if (!target) return null;
     const id = this.allocRelId();
     this.relationships.push({
       id,
       type: REL_HYPERLINK,
-      target: url,
+      target,
       targetMode: "External"
     });
     return id;
@@ -556,7 +579,7 @@ function convertCodeBlock(node, ctx) {
   const parts = [];
   for (const line of lines) {
     parts.push(
-      `<a:p><a:r><a:rPr lang="en-US" sz="${DEFAULT_CODE_SIZE}" dirty="0"><a:latin typeface="${escapeXml(ctx.style.codeFont)}"/><a:solidFill><a:srgbClr val="${ctx.style.codeColor}"/></a:solidFill></a:rPr><a:t>${escapeXml(line || " ")}</a:t></a:r></a:p>`
+      `<a:p><a:r><a:rPr lang="en-US" sz="${DEFAULT_CODE_SIZE}" dirty="0"><a:solidFill><a:srgbClr val="${ctx.style.codeColor}"/></a:solidFill><a:latin typeface="${escapeXml(ctx.style.codeFont)}"/></a:rPr><a:t>${escapeXml(line || " ")}</a:t></a:r></a:p>`
     );
   }
   return parts.join("");
@@ -611,8 +634,8 @@ function makeRun(text, format, style) {
   if (format.strike) rPrParts.push(`strike="sngStrike"`);
   let innerParts = "";
   if (format.code) {
-    innerParts += `<a:latin typeface="${escapeXml(style.codeFont)}"/>`;
     innerParts += `<a:solidFill><a:srgbClr val="${style.codeColor}"/></a:solidFill>`;
+    innerParts += `<a:latin typeface="${escapeXml(style.codeFont)}"/>`;
     rPrParts.push(`sz="${DEFAULT_CODE_SIZE}"`);
   } else if (style.hasTheme) {
     innerParts += `<a:solidFill><a:srgbClr val="${style.text}"/></a:solidFill>`;
@@ -621,6 +644,7 @@ function makeRun(text, format, style) {
 }
 function convertLink(node, ctx, format) {
   const rId = ctx.addHyperlink(node.url);
+  if (!rId) return convertInlines(node.children, ctx, format);
   const parts = [];
   for (const child of node.children) {
     if (child.type === "text") {
@@ -652,12 +676,16 @@ function convertImage(node, format, ctx) {
 async function buildPptxPackage(slideXmls, slideContexts, options) {
   const pkg = createPackage();
   const slideCount = slideXmls.length;
-  const slideMasterRelId = "rId100";
-  const themeRelId = "rId101";
+  const relIds = new RelIdAllocator();
+  const PRESENTATION_PART = "ppt/presentation.xml";
+  const SLIDE_MASTER_PART = "ppt/slideMasters/slideMaster1.xml";
+  const SLIDE_LAYOUT_PART = "ppt/slideLayouts/slideLayout1.xml";
   const slideRelIds = [];
   for (let i = 0; i < slideCount; i++) {
-    slideRelIds.push(`rId${i + 1}`);
+    slideRelIds.push(relIds.alloc(PRESENTATION_PART));
   }
+  const slideMasterRelId = relIds.alloc(PRESENTATION_PART);
+  const themeRelId = relIds.alloc(PRESENTATION_PART);
   const presentationXml = buildPresentationXml(
     slideCount,
     slideRelIds,
@@ -668,11 +696,6 @@ async function buildPptxPackage(slideXmls, slideContexts, options) {
   for (let i = 0; i < slideCount; i++) {
     const slidePath = `ppt/slides/slide${i + 1}.xml`;
     pkg.addPart(slidePath, slideXmls[i], CONTENT_TYPE_PPTX_SLIDE);
-    pkg.addRelationship(slidePath, {
-      id: "rId1",
-      type: REL_SLIDE_LAYOUT,
-      target: "../slideLayouts/slideLayout1.xml"
-    });
     const ctx = slideContexts[i];
     for (const rel of ctx.relationships) {
       pkg.addRelationship(slidePath, {
@@ -686,24 +709,24 @@ async function buildPptxPackage(slideXmls, slideContexts, options) {
       pkg.addBinaryPart(img.mediaPath, img.data, img.contentType);
     }
   }
-  const layoutMasterRelId = "rId1";
+  const layoutMasterRelId = relIds.alloc(SLIDE_LAYOUT_PART);
   const slideLayoutXml = buildSlideLayoutXml(layoutMasterRelId);
-  pkg.addPart("ppt/slideLayouts/slideLayout1.xml", slideLayoutXml, CONTENT_TYPE_PPTX_SLIDE_LAYOUT);
-  pkg.addRelationship("ppt/slideLayouts/slideLayout1.xml", {
+  pkg.addPart(SLIDE_LAYOUT_PART, slideLayoutXml, CONTENT_TYPE_PPTX_SLIDE_LAYOUT);
+  pkg.addRelationship(SLIDE_LAYOUT_PART, {
     id: layoutMasterRelId,
     type: REL_SLIDE_MASTER,
     target: "../slideMasters/slideMaster1.xml"
   });
-  const masterLayoutRelId = "rId1";
-  const masterThemeRelId = "rId2";
+  const masterLayoutRelId = relIds.alloc(SLIDE_MASTER_PART);
+  const masterThemeRelId = relIds.alloc(SLIDE_MASTER_PART);
   const slideMasterXml = buildSlideMasterXml(masterLayoutRelId);
-  pkg.addPart("ppt/slideMasters/slideMaster1.xml", slideMasterXml, CONTENT_TYPE_PPTX_SLIDE_MASTER);
-  pkg.addRelationship("ppt/slideMasters/slideMaster1.xml", {
+  pkg.addPart(SLIDE_MASTER_PART, slideMasterXml, CONTENT_TYPE_PPTX_SLIDE_MASTER);
+  pkg.addRelationship(SLIDE_MASTER_PART, {
     id: masterLayoutRelId,
     type: REL_SLIDE_LAYOUT,
     target: "../slideLayouts/slideLayout1.xml"
   });
-  pkg.addRelationship("ppt/slideMasters/slideMaster1.xml", {
+  pkg.addRelationship(SLIDE_MASTER_PART, {
     id: masterThemeRelId,
     type: REL_THEME,
     target: "../theme/theme1.xml"
@@ -755,17 +778,20 @@ import { markdownToDoc } from "@bendyline/squisq/doc";
 
 // src/pptx/import.ts
 import { stringifyMarkdown } from "@bendyline/squisq/markdown";
-async function orderedSlidePaths(pkg) {
-  const pres = await getPartXml(pkg, "ppt/presentation.xml");
-  if (!pres) return [];
-  const rels = await getPartRelationships(pkg, "ppt/presentation.xml");
+var PPTX_MAIN_PART = "ppt/presentation.xml";
+async function orderedSlidePaths(pkg, mainPart) {
+  const pres = await getPartXml(pkg, mainPart);
+  if (!pres) {
+    throw new Error(`Invalid PPTX package: presentation part "${mainPart}" could not be parsed.`);
+  }
+  const rels = await getPartRelationships(pkg, mainPart);
   const relById = new Map(rels.map((r) => [r.id, r.target]));
   const out = [];
   const ids = pres.getElementsByTagNameNS(NS_PML, "sldId");
   for (let i = 0; i < ids.length; i++) {
     const rid = attrNS(ids[i], NS_R, "id", "r:id");
     const target = rid ? relById.get(rid) : void 0;
-    if (target) out.push(resolveTarget("ppt", target));
+    if (target) out.push(resolveTarget(baseDirOf(mainPart), target));
   }
   return out;
 }
@@ -959,7 +985,7 @@ async function importDocument(pkg, options) {
   let extraction = null;
   if (inferTheme || inferLayouts) {
     try {
-      const { extractPptxTheme } = await import("./extract-OJ7ZQV6P.js");
+      const { extractPptxTheme } = await import("./extract-MN7LA3NL.js");
       extraction = await extractPptxTheme(pkg);
     } catch (err) {
       warnInferenceFailure("theme extraction", err);
@@ -968,7 +994,7 @@ async function importDocument(pkg, options) {
   let theme;
   if (inferTheme && extraction) {
     try {
-      const { compileExtractedTheme } = await import("./mapTheme-IR27S6IV.js");
+      const { compileExtractedTheme } = await import("./mapTheme-4TWH25FT.js");
       theme = compileExtractedTheme(extraction).theme;
     } catch (err) {
       warnInferenceFailure("theme compilation", err);
@@ -976,8 +1002,8 @@ async function importDocument(pkg, options) {
   }
   if (inferLayouts) {
     try {
-      const { analyzePptxLayouts: analyzePptxLayouts2 } = await import("./layouts-5VDIRPIJ.js");
-      const { colorHintsFromExtraction } = await import("./mapTheme-IR27S6IV.js");
+      const { analyzePptxLayouts: analyzePptxLayouts2 } = await import("./layouts-DRWZGSPD.js");
+      const { colorHintsFromExtraction } = await import("./mapTheme-4TWH25FT.js");
       ctx.inference = await analyzePptxLayouts2(pkg, {
         colors: extraction ? colorHintsFromExtraction(extraction) : {}
       });
@@ -985,7 +1011,7 @@ async function importDocument(pkg, options) {
       warnInferenceFailure("layout inference", err);
     }
   }
-  const paths = await orderedSlidePaths(pkg);
+  const paths = await orderedSlidePaths(pkg, requireMainPartPath(pkg, PPTX_MAIN_PART, "PPTX"));
   const children = [];
   for (let i = 0; i < paths.length; i++) {
     children.push(...await convertSlide(paths[i], i, ctx));
@@ -1037,4 +1063,3 @@ export {
   pptxToContainer,
   pptxToDoc
 };
-//# sourceMappingURL=chunk-RLU7UFYU.js.map

package/dist/{chunk-DTDF6QDP.js → chunk-JE6LSIHE.js}

@@ -2,7 +2,7 @@ import {
   arrayBufferToBase64DataUrl,
   extractFilename,
   inferMimeType
-} from "./chunk-MLX2BOJC.js";
+} from "./chunk-6RQOV3B3.js";
 
 // src/html/index.ts
 import JSZip3 from "jszip";
@@ -119,7 +119,23 @@ function scanTemplateImageFields(obj, paths) {
   }
 }
 function escapeForScript(str) {
-  return str.replace(/<\/(script)/gi, "<\\/$1");
+  return str.replace(/<(?=!--|\/?script)/gi, "\\u003c");
+}
+function buildInlineImageMaps(images) {
+  const imageMap = {};
+  const imageAliases = {};
+  if (!images) return { imageMap, imageAliases };
+  const canonicalKeyFor = /* @__PURE__ */ new Map();
+  for (const [path, buffer] of images.entries()) {
+    const canonical = canonicalKeyFor.get(buffer);
+    if (canonical !== void 0) {
+      imageAliases[path] = canonical;
+      continue;
+    }
+    canonicalKeyFor.set(buffer, path);
+    imageMap[path] = arrayBufferToBase64DataUrl(buffer, inferMimeType(path));
+  }
+  return { imageMap, imageAliases };
 }
 function generateInlineHtml(doc, options) {
   const {
@@ -132,15 +148,10 @@ function generateInlineHtml(doc, options) {
     themeRegistry
   } = options;
   doc = applyThemeSelection(doc, themeId, themeRegistry);
-  const imageMap = {};
-  if (images) {
-    for (const [path, buffer] of images.entries()) {
-      const mimeType = inferMimeType(path);
-      imageMap[path] = arrayBufferToBase64DataUrl(buffer, mimeType);
-    }
-  }
+  const { imageMap, imageAliases } = buildInlineImageMaps(images);
   const docJson = escapeForScript(JSON.stringify(doc));
   const imageMapJson = escapeForScript(JSON.stringify(imageMap));
+  const imageAliasJson = escapeForScript(JSON.stringify(imageAliases));
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -161,6 +172,14 @@ ${mode === "static" ? "#squisq-root{display:block}" : ""}
 (function(){
   var doc = JSON.parse(${JSON.stringify(docJson)});
   var images = JSON.parse(${JSON.stringify(imageMapJson)});
+  // Re-expand path/basename aliases that share a payload (see
+  // buildInlineImageMaps) so \`images\` has every key the resolver may ask for.
+  var aliases = JSON.parse(${JSON.stringify(imageAliasJson)});
+  for (var alias in aliases) {
+    if (Object.prototype.hasOwnProperty.call(aliases, alias)) {
+      images[alias] = images[aliases[alias]];
+    }
+  }
   SquisqPlayer.mount(document.getElementById("squisq-root"), doc, {
     mode: ${JSON.stringify(mode)},
     images: images,
@@ -248,21 +267,31 @@ import {
 import { resolveFontFamily, buildGoogleFontsUrl } from "@bendyline/squisq/schemas";
 import { resolveThemeForDoc } from "@bendyline/squisq/doc";
 function markdownDocToPlainHtml(doc, options = {}) {
-  const { title = "Document", images, links, themeId, iconsCss, htmlPolicy = "sanitize" } = options;
+  const {
+    title = "Document",
+    images,
+    links,
+    themeId,
+    iconsCss,
+    htmlPolicy = "sanitize",
+    externalResources = "deny"
+  } = options;
   const resolveId = themeId ?? readFrontmatterThemeId2(doc.frontmatter);
   const theme = options.theme ?? (resolveId ? resolveThemeForDoc(doc, resolveId, options.themeRegistry) : void 0);
   const ctx = { images, links, htmlPolicy };
   const body = renderTopLevel(doc.children, ctx);
-  const fontsLink = theme ? renderFontsLink(theme) : "";
+  const fontsLink = theme && externalResources === "allow" ? renderFontsLink(theme) : "";
   const usesIcons = docUsesIcons(doc);
   let iconsLink = "";
   if (usesIcons) {
     iconsLink = iconsCss ? `<style data-fa-inline>
-${iconsCss}
+${escapeStyleText(iconsCss)}
 </style>
-` : FONT_AWESOME_LINK;
+` : externalResources === "allow" ? FONT_AWESOME_LINK : "";
   }
   const themedCss = theme ? renderThemedCss(theme) : DEFAULT_CSS;
+  const safeCss = escapeStyleText(`${themedCss}
+${FEATURE_CSS}`);
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -270,8 +299,7 @@ ${iconsCss}
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>${escapeHtml2(title)}</title>
 ${fontsLink}${iconsLink}<style>
-${themedCss}
-${FEATURE_CSS}
+${safeCss}
 </style>
 </head>
 <body>
@@ -279,7 +307,10 @@ ${body}
 </body>
 </html>`;
 }
-var FONT_AWESOME_LINK = `<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css" integrity="sha512-SnH5WK+bZxgPHs44uWIX+LLJAJ9/2PkPKZ5QiAj6Ta86w+fsb2TkcmfRyVX3pBnMFcV7oQPJkl9QevSCWr3W6A==" crossorigin="anonymous" referrerpolicy="no-referrer">
+function escapeStyleText(css) {
+  return css.replace(/</g, "\\3c ");
+}
+var FONT_AWESOME_LINK = `<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.2.0/css/all.min.css" crossorigin="anonymous" referrerpolicy="no-referrer">
 `;
 function docUsesIcons(doc) {
   function visit(node) {
@@ -1379,6 +1410,14 @@ function toHtmlString(data) {
   return new TextDecoder("utf-8").decode(bytes);
 }
 function htmlToMarkdownDocSync(html, options = {}) {
+  options.signal?.throwIfAborted();
+  const maxInputChars = options.maxInputChars ?? 16 * 1024 * 1024;
+  if (!Number.isSafeInteger(maxInputChars) || maxInputChars < 0) {
+    throw new RangeError("maxInputChars must be a non-negative safe integer");
+  }
+  if (html.length > maxInputChars) {
+    throw new RangeError(`HTML exceeds the ${maxInputChars}-character safety limit`);
+  }
   let nodes = parseHtmlToNodes(html);
   if (options.sanitize !== false) nodes = sanitizeHtmlNodes2(nodes);
   return { type: "document", children: blocksFromNodes(nodes) };
@@ -1387,7 +1426,7 @@ async function htmlToMarkdownDoc(data, options = {}) {
   return htmlToMarkdownDocSync(toHtmlString(data), options);
 }
 function htmlToMarkdown(html, options = {}) {
-  return stringifyMarkdown(htmlToMarkdownDocSync(html, options));
+  return stringifyMarkdown(htmlToMarkdownDocSync(html, options), { signal: options.signal });
 }
 
 // src/html/index.ts
@@ -1397,10 +1436,21 @@ function sanitizeZipPath3(path) {
   if (normalized.split("/").some((seg) => seg === "..")) return null;
   return normalized;
 }
+function uniqueFilename(filename, used) {
+  if (!used.has(filename)) return filename;
+  const dot = filename.lastIndexOf(".");
+  const base = dot > 0 ? filename.slice(0, dot) : filename;
+  const ext = dot > 0 ? filename.slice(dot) : "";
+  let suffix = 2;
+  while (used.has(`${base}-${suffix}${ext}`)) suffix++;
+  return `${base}-${suffix}${ext}`;
+}
 function docToHtml(doc, options) {
+  options.signal?.throwIfAborted();
   return generateInlineHtml(doc, options);
 }
 async function docToHtmlZip(doc, options) {
+  options.signal?.throwIfAborted();
   const {
     playerScript,
     images,
@@ -1415,18 +1465,30 @@ async function docToHtmlZip(doc, options) {
   zip.file("squisq-player.js", playerScript);
   const imagePathMap = {};
   if (images) {
+    let imageIndex = 0;
     for (const [originalPath, buffer] of images.entries()) {
+      if ((imageIndex++ & 63) === 0) options.signal?.throwIfAborted();
       const zipPath = sanitizeZipPath3(originalPath);
-      if (!zipPath) continue;
+      if (!zipPath) {
+        console.warn(
+          `[squisq] docToHtmlZip: skipped image with unsafe path "${originalPath}" \u2014 the exported document will have a broken reference to it.`
+        );
+        continue;
+      }
       zip.file(zipPath, buffer);
       imagePathMap[originalPath] = zipPath;
     }
   }
   const audioPathMap = {};
   if (audio) {
+    let audioIndex = 0;
+    const usedAudioNames = /* @__PURE__ */ new Set();
     for (const [segmentKey, buffer] of audio.entries()) {
+      if ((audioIndex++ & 63) === 0) options.signal?.throwIfAborted();
       const filename = extractFilename(segmentKey);
-      const finalName = filename.includes(".") ? filename : `${filename}.mp3`;
+      const named = filename.includes(".") ? filename : `${filename}.mp3`;
+      const finalName = uniqueFilename(named, usedAudioNames);
+      usedAudioNames.add(finalName);
       const zipPath = `audio/${finalName}`;
       zip.file(zipPath, buffer);
       audioPathMap[segmentKey] = zipPath;
@@ -1462,4 +1524,3 @@ export {
   docToHtml,
   docToHtmlZip
 };
-//# sourceMappingURL=chunk-DTDF6QDP.js.map

package/dist/{chunk-U4MRIFKL.js → chunk-JU2RHXUB.js}

@@ -40,4 +40,3 @@ export {
   xmlElement,
   textElement
 };
-//# sourceMappingURL=chunk-U4MRIFKL.js.map