@bendyline/squisq 2.1.0 → 2.3.0

package/dist/{chunk-5DKBFXPY.js → chunk-6ECMNUIP.js}

@@ -6,11 +6,12 @@ import {
   pruneSnapshots,
   readTextSnapshot,
   saveTextSnapshot
-} from "./chunk-S7A5D7ZJ.js";
+} from "./chunk-OPO5K4DZ.js";
 import {
+  bytesToBase64,
   markerPath,
   shapePath
-} from "./chunk-TUWMK62B.js";
+} from "./chunk-PUS54YU6.js";
 
 // src/imageEdit/state.ts
 var IMAGE_EDIT_STATE_FILENAME = "state.json";
@@ -99,21 +100,21 @@ async function writeImageEditDoc(container, doc, filename = IMAGE_EDIT_STATE_FIL
   const text = JSON.stringify(doc, null, 2);
   await container.writeFile(filename, encoder.encode(text), "application/json");
 }
-function assertImageEditDoc(value, filename) {
+function assertImageEditDoc(value, filename, context = "readImageEditDoc") {
   if (!value || typeof value !== "object") {
-    throw new Error(`readImageEditDoc: ${filename} root must be an object`);
+    throw new Error(`${context}: ${filename} root must be an object`);
   }
   const v = value;
   if (v.version !== 1) {
     throw new Error(
-      `readImageEditDoc: ${filename} has unsupported schema version ${String(v.version)} (expected 1)`
+      `${context}: ${filename} has unsupported schema version ${String(v.version)} (expected 1)`
     );
   }
   if (!v.canvas || typeof v.canvas.width !== "number" || typeof v.canvas.height !== "number") {
-    throw new Error(`readImageEditDoc: ${filename} canvas.width/height must be numbers`);
+    throw new Error(`${context}: ${filename} canvas.width/height must be numbers`);
   }
   if (!Array.isArray(v.layers)) {
-    throw new Error(`readImageEditDoc: ${filename} layers must be an array`);
+    throw new Error(`${context}: ${filename} layers must be an array`);
   }
   v.layers.forEach((layer, i) => assertLayer(layer, i, filename));
 }
@@ -179,7 +180,16 @@ async function readImageEditVersionText(container, version) {
 async function readImageEditVersion(container, version) {
   const text = await readImageEditVersionText(container, version);
   if (text === null) return null;
-  return JSON.parse(text);
+  const path = typeof version === "string" ? version : version.path;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`readImageEditVersion: ${path} is not valid JSON: ${msg}`);
+  }
+  assertImageEditDoc(parsed, path, "readImageEditVersion");
+  return parsed;
 }
 async function saveImageEditVersion(container, options = {}) {
   const stateFilename = options.stateFilename ?? IMAGE_EDIT_STATE_FILENAME;
@@ -200,11 +210,16 @@ async function saveImageEditVersion(container, options = {}) {
 async function revertToImageEditVersion(container, version, options = {}) {
   const doc = await readImageEditVersion(container, version);
   if (!doc) {
-    return { reverted: false, snapshotted: null };
+    return { reverted: false, snapshotted: null, reason: "missing-snapshot" };
   }
   let snapshotted = null;
   if (options.snapshotCurrent !== false) {
-    const result = await saveImageEditVersion(container, { stateFilename: options.stateFilename });
+    const saveOptions = { stateFilename: options.stateFilename };
+    if (options.doc !== void 0) saveOptions.doc = options.doc;
+    const result = await saveImageEditVersion(container, saveOptions);
+    if (!result.saved && result.reason !== "unchanged") {
+      return { reverted: false, snapshotted: null, reason: "snapshot-failed" };
+    }
     snapshotted = result.version;
   }
   await writeImageEditDoc(container, doc, options.stateFilename);
@@ -401,13 +416,7 @@ async function loadAssetAsDataUrl(container, src) {
 }
 function arrayBufferToDataUrl(data, mime) {
   const bytes = new Uint8Array(data);
-  let binary = "";
-  const CHUNK = 32768;
-  for (let i = 0; i < bytes.length; i += CHUNK) {
-    binary += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + CHUNK)));
-  }
-  const b64 = typeof btoa === "function" ? btoa(binary) : Buffer.from(bytes).toString("base64");
-  return `data:${mime};base64,${b64}`;
+  return `data:${mime};base64,${bytesToBase64(bytes)}`;
 }
 function guessMime(path) {
   const dot = path.lastIndexOf(".");
@@ -500,4 +509,3 @@ export {
   exportImageEditDoc,
   buildSvgString
 };
-//# sourceMappingURL=chunk-5DKBFXPY.js.map

package/dist/{chunk-DBS6RIFL.js → chunk-7N4G32LG.js}

@@ -78,4 +78,3 @@ export {
   iconGlyph,
   suggestIcons
 };
-//# sourceMappingURL=chunk-DBS6RIFL.js.map

package/dist/{chunk-JOQYPRDZ.js → chunk-7YEZFHLS.js}

@@ -6,7 +6,7 @@ import {
   pruneSnapshots,
   readTextSnapshot,
   saveTextSnapshot
-} from "./chunk-S7A5D7ZJ.js";
+} from "./chunk-OPO5K4DZ.js";
 
 // src/versions/paths.ts
 var VERSIONS_PREFIX = ".versions/";
@@ -49,9 +49,6 @@ async function saveVersion(container, options = {}) {
   if (content === null || content === void 0) {
     return { saved: false, version: null, reason: "no-document" };
   }
-  if (content.length === 0) {
-    return { saved: false, version: null, reason: "empty" };
-  }
   const basename = await resolveBasename(container, options.basename);
   if (!basename) {
     return { saved: false, version: null, reason: "no-document" };
@@ -67,11 +64,17 @@ async function saveVersion(container, options = {}) {
 async function revertToVersion(container, version, options = {}) {
   const content = await readVersion(container, version);
   if (content === null) {
-    return { reverted: false, snapshotted: null };
+    return { reverted: false, snapshotted: null, reason: "missing-snapshot" };
   }
   let snapshotted = null;
   if (options.snapshotCurrent !== false) {
-    const result = await saveVersion(container);
+    const saveOptions = {};
+    if (options.content !== void 0) saveOptions.content = options.content;
+    if (options.basename !== void 0) saveOptions.basename = options.basename;
+    const result = await saveVersion(container, saveOptions);
+    if (!result.saved && result.reason !== "unchanged") {
+      return { reverted: false, snapshotted: null, reason: "snapshot-failed" };
+    }
     snapshotted = result.version;
   }
   const docPath = await resolveDocPath(container);
@@ -101,7 +104,7 @@ var DocumentVersionManager = class {
     return readVersion(this.container, version);
   }
   revertToVersion(version, options) {
-    return revertToVersion(this.container, version, options);
+    return revertToVersion(this.container, version, { basename: this.basename, ...options });
   }
   pruneVersions(policy) {
     return pruneVersions(this.container, policy, this.basename);
@@ -124,4 +127,3 @@ export {
   coalesceVersions,
   DocumentVersionManager
 };
-//# sourceMappingURL=chunk-JOQYPRDZ.js.map

package/dist/{chunk-2UQOHYE2.js → chunk-7ZAAICW4.js}

@@ -42,4 +42,3 @@ export {
   splitIconMarkers,
   iconClass
 };
-//# sourceMappingURL=chunk-2UQOHYE2.js.map

package/dist/{chunk-66QO7XFB.js → chunk-ACZOVWX3.js}

@@ -5,14 +5,14 @@ import {
   quoteAttrValue,
   splitKeyValueToken,
   tokenizeAttrTokens
-} from "./chunk-R2YZTCLO.js";
+} from "./chunk-ZQKZSJAX.js";
 import {
   resolveIcon
-} from "./chunk-DBS6RIFL.js";
+} from "./chunk-7N4G32LG.js";
 import {
   parseFrontmatter,
   parseHtmlToNodes
-} from "./chunk-AMIR72JP.js";
+} from "./chunk-BCCXTMN5.js";
 
 // src/markdown/convert.ts
 function convertPosition(pos) {
@@ -923,15 +923,26 @@ function inlineToMdast(node) {
       return { type: "text", value: "" };
   }
 }
+function escapeHtmlText(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function nodeTreeText(node) {
+  if (!node || typeof node !== "object") return "";
+  const candidate = node;
+  if (typeof candidate.value === "string") return candidate.value;
+  if (Array.isArray(candidate.children)) return candidate.children.map(nodeTreeText).join("");
+  return "";
+}
 function definitionListToHtml(list) {
   let html = "<dl>\n";
   for (const child of list.children) {
     if (child.type === "definitionTerm") {
-      const text = child.children.map((c) => c.value ?? "").join("");
-      html += `  <dt>${text}</dt>
+      const text = (child.children ?? []).map(nodeTreeText).join("");
+      html += `  <dt>${escapeHtmlText(text)}</dt>
 `;
     } else if (child.type === "definitionDescription") {
-      html += `  <dd>...</dd>
+      const text = (child.children ?? []).map(nodeTreeText).join(" ").trim();
+      html += `  <dd>${escapeHtmlText(text)}</dd>
 `;
     }
   }
@@ -939,6 +950,98 @@ function definitionListToHtml(list) {
   return html;
 }
 
+// src/markdown/limits.ts
+var DEFAULT_MARKDOWN_SAFETY_LIMITS = Object.freeze({
+  maxSourceBytes: 16 * 1024 * 1024,
+  maxNodes: 25e4,
+  maxDepth: 128,
+  maxTableCells: 1e5
+});
+var MarkdownLimitError = class extends RangeError {
+  constructor(code, message) {
+    super(message);
+    this.name = "MarkdownLimitError";
+    this.code = code;
+  }
+};
+function assertMarkdownSourceWithinLimits(source, limits) {
+  if (limits === false) return;
+  const resolved = resolveMarkdownSafetyLimits(limits);
+  if (utf8ByteLength(source, resolved.maxSourceBytes) > resolved.maxSourceBytes) {
+    throw new MarkdownLimitError(
+      "SOURCE_BYTES",
+      `Markdown source exceeds the ${resolved.maxSourceBytes}-byte safety limit`
+    );
+  }
+}
+function assertMarkdownDocumentWithinLimits(document, limits, signal) {
+  if (limits === false) return;
+  const resolved = resolveMarkdownSafetyLimits(limits);
+  const stack = [{ value: document, depth: 0 }];
+  let nodes = 0;
+  let tableCells = 0;
+  while (stack.length > 0) {
+    if ((nodes & 1023) === 0) signal?.throwIfAborted();
+    const current = stack.pop();
+    if (!current.value || typeof current.value !== "object") continue;
+    const node = current.value;
+    if (typeof node.type !== "string") continue;
+    nodes += 1;
+    if (nodes > resolved.maxNodes) {
+      throw new MarkdownLimitError(
+        "NODES",
+        `Markdown document exceeds the ${resolved.maxNodes}-node safety limit`
+      );
+    }
+    if (current.depth > resolved.maxDepth) {
+      throw new MarkdownLimitError(
+        "DEPTH",
+        `Markdown document exceeds the ${resolved.maxDepth}-level nesting safety limit`
+      );
+    }
+    if (node.type === "tableCell" && ++tableCells > resolved.maxTableCells) {
+      throw new MarkdownLimitError(
+        "TABLE_CELLS",
+        `Markdown document exceeds the ${resolved.maxTableCells}-table-cell safety limit`
+      );
+    }
+    pushChildren(stack, node.children, current.depth + 1);
+    pushChildren(stack, node.htmlChildren, current.depth + 1);
+  }
+}
+function resolveMarkdownSafetyLimits(limits) {
+  const resolved = { ...DEFAULT_MARKDOWN_SAFETY_LIMITS, ...limits };
+  for (const [name, value] of Object.entries(resolved)) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+      throw new RangeError(`${name} must be a non-negative safe integer`);
+    }
+  }
+  return resolved;
+}
+function pushChildren(stack, children, depth) {
+  if (!Array.isArray(children)) return;
+  for (let index = children.length - 1; index >= 0; index--) {
+    stack.push({ value: children[index], depth });
+  }
+}
+function utf8ByteLength(value, stopAfter) {
+  let bytes = 0;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319 && index + 1 < value.length) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else bytes += 3;
+    } else bytes += 3;
+    if (bytes > stopAfter) return bytes;
+  }
+  return bytes;
+}
+
 // src/markdown/parse.ts
 import { unified } from "unified";
 import remarkParse from "remark-parse";
@@ -948,6 +1051,8 @@ import remarkDirective from "remark-directive";
 import remarkFrontmatter from "remark-frontmatter";
 var defaultProcessor;
 function parseMarkdown(markdown, options) {
+  options?.signal?.throwIfAborted();
+  assertMarkdownSourceWithinLimits(markdown, options?.limits);
   const useDefaults = !options || options.gfm !== false && options.math !== false && options.directive !== false && options.frontmatter !== false;
   let processor;
   if (useDefaults) {
@@ -974,6 +1079,7 @@ function parseMarkdown(markdown, options) {
   const doc = fromMdast(mdastTree, {
     parseHtml: options?.parseHtml
   });
+  assertMarkdownDocumentWithinLimits(doc, options?.limits, options?.signal);
   if (options?.frontmatter !== false) {
     const yamlNode = mdastTree.children?.find((n) => n.type === "yaml");
     if (yamlNode?.value) {
@@ -991,6 +1097,10 @@ export {
   serializePandocAttributes,
   fromMdast,
   toMdast,
+  DEFAULT_MARKDOWN_SAFETY_LIMITS,
+  MarkdownLimitError,
+  assertMarkdownSourceWithinLimits,
+  assertMarkdownDocumentWithinLimits,
+  resolveMarkdownSafetyLimits,
   parseMarkdown
 };
-//# sourceMappingURL=chunk-66QO7XFB.js.map

package/dist/{chunk-5J4HKRJF.js → chunk-BAOV476U.js}

@@ -212,4 +212,3 @@ export {
   cloneData,
   cloneAndFreezeData
 };
-//# sourceMappingURL=chunk-5J4HKRJF.js.map