@bikdotai/bik-component-library 0.0.839-beta.2 → 0.0.839-beta.4

package/dist/esm/editor/extensions/htmlTagStrip/HtmlTagStripExtension.d.ts

@@ -1,13 +0,0 @@
-import { Extension } from '@tiptap/core';
-/**
- * Strips HTML tags from typed text in real time.
- *
- * Two modes controlled by `stripAll`:
- * - `true`  (non-email): strip ALL complete tags — `<h1>Hello</h1>` → `Hello`
- * - `false` (email):     strip only DANGEROUS tags — `<script>`, `<iframe>`,
- *   `<form>`, etc. — while preserving legitimate email tags like `<h1>`, `<table>`
- *
- * Incomplete tags like `<h` are preserved (the regex requires a closing `>`).
- * Non-tag angle brackets like `2 < 3` are also preserved.
- */
-export declare const HtmlTagStripExtension: Extension<any, any>;

package/dist/esm/editor/extensions/htmlTagStrip/HtmlTagStripExtension.js

@@ -1,64 +0,0 @@
-import { Extension as u } from "../../../node_modules/@tiptap/core/dist/index.js";
-import { Plugin as d } from "@tiptap/pm/state";
-const n = /<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s[^>]*)?\/?>/g, f = /* @__PURE__ */ new Set([
-  "script",
-  "iframe",
-  "object",
-  "embed",
-  "applet",
-  "form",
-  "input",
-  "button",
-  "select",
-  "option",
-  "textarea",
-  "style",
-  "link",
-  "meta",
-  "base",
-  "svg",
-  "math",
-  "noscript",
-  "template"
-]), g = /<\/?([a-zA-Z][a-zA-Z0-9]*)/;
-function x(a) {
-  const r = a.match(g);
-  return r ? f.has(r[1].toLowerCase()) : !1;
-}
-const E = u.create({
-  name: "htmlTagStrip",
-  addOptions() {
-    return { stripAll: !0 };
-  },
-  addProseMirrorPlugins() {
-    const { stripAll: a } = this.options, r = a ? () => !0 : (s) => x(s);
-    return [
-      new d({
-        appendTransaction(s, A, i) {
-          if (!s.some((t) => t.docChanged)) return null;
-          const { tr: e } = i;
-          let l = !1;
-          return i.doc.descendants((t, o) => {
-            if (!t.isText || !t.text || (n.lastIndex = 0, !n.test(t.text))) return;
-            n.lastIndex = 0;
-            const p = t.text.replace(
-              n,
-              (c) => r(c) ? "" : c
-            );
-            if (p === t.text) return;
-            const m = o + t.nodeSize;
-            p ? e.replaceWith(
-              e.mapping.map(o),
-              e.mapping.map(m),
-              i.schema.text(p, t.marks)
-            ) : e.delete(e.mapping.map(o), e.mapping.map(m)), l = !0;
-          }), l ? (e.setMeta("addToHistory", !1), e) : null;
-        }
-      })
-    ];
-  }
-});
-export {
-  E as HtmlTagStripExtension
-};
-//# sourceMappingURL=HtmlTagStripExtension.js.map

package/dist/esm/editor/extensions/htmlTagStrip/HtmlTagStripExtension.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"HtmlTagStripExtension.js","sources":["../../../../../src/editor/extensions/htmlTagStrip/HtmlTagStripExtension.ts"],"sourcesContent":["import { Extension } from '@tiptap/core';\nimport { Plugin } from '@tiptap/pm/state';\n\nconst COMPLETE_TAG = /<\\/?[a-zA-Z][a-zA-Z0-9]*(?:\\s[^>]*)?\\/?>/g;\n\n// Tags that have no business in an email — stripped even in rich-paste mode.\nconst DANGEROUS_TAG_NAMES = new Set([\n\t'script',\n\t'iframe',\n\t'object',\n\t'embed',\n\t'applet',\n\t'form',\n\t'input',\n\t'button',\n\t'select',\n\t'option',\n\t'textarea',\n\t'style',\n\t'link',\n\t'meta',\n\t'base',\n\t'svg',\n\t'math',\n\t'noscript',\n\t'template',\n]);\n\nconst TAG_NAME_RE = /<\\/?([a-zA-Z][a-zA-Z0-9]*)/;\n\nfunction isDangerousTag(tag: string): boolean {\n\tconst m = tag.match(TAG_NAME_RE);\n\treturn m ? DANGEROUS_TAG_NAMES.has(m[1].toLowerCase()) : false;\n}\n\n/**\n * Strips HTML tags from typed text in real time.\n *\n * Two modes controlled by `stripAll`:\n * - `true`  (non-email): strip ALL complete tags — `<h1>Hello</h1>` → `Hello`\n * - `false` (email):     strip only DANGEROUS tags — `<script>`, `<iframe>`,\n *   `<form>`, etc. — while preserving legitimate email tags like `<h1>`, `<table>`\n *\n * Incomplete tags like `<h` are preserved (the regex requires a closing `>`).\n * Non-tag angle brackets like `2 < 3` are also preserved.\n */\nexport const HtmlTagStripExtension = Extension.create({\n\tname: 'htmlTagStrip',\n\taddOptions() {\n\t\treturn { stripAll: true };\n\t},\n\taddProseMirrorPlugins() {\n\t\tconst { stripAll } = this.options;\n\t\tconst shouldStrip = stripAll\n\t\t\t? () => true\n\t\t\t: (tag: string) => isDangerousTag(tag);\n\n\t\treturn [\n\t\t\tnew Plugin({\n\t\t\t\tappendTransaction(transactions, _oldState, newState) {\n\t\t\t\t\tif (!transactions.some((t) => t.docChanged)) return null;\n\n\t\t\t\t\tconst { tr } = newState;\n\t\t\t\t\tlet changed = false;\n\n\t\t\t\t\tnewState.doc.descendants((node, pos) => {\n\t\t\t\t\t\tif (!node.isText || !node.text) return;\n\t\t\t\t\t\tCOMPLETE_TAG.lastIndex = 0;\n\t\t\t\t\t\tif (!COMPLETE_TAG.test(node.text)) return;\n\n\t\t\t\t\t\tCOMPLETE_TAG.lastIndex = 0;\n\t\t\t\t\t\tconst stripped = node.text.replace(COMPLETE_TAG, (match) =>\n\t\t\t\t\t\t\tshouldStrip(match) ? '' : match,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (stripped === node.text) return;\n\n\t\t\t\t\t\tconst end = pos + node.nodeSize;\n\t\t\t\t\t\tif (stripped) {\n\t\t\t\t\t\t\ttr.replaceWith(\n\t\t\t\t\t\t\t\ttr.mapping.map(pos),\n\t\t\t\t\t\t\t\ttr.mapping.map(end),\n\t\t\t\t\t\t\t\tnewState.schema.text(stripped, node.marks),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\ttr.delete(tr.mapping.map(pos), tr.mapping.map(end));\n\t\t\t\t\t\t}\n\t\t\t\t\t\tchanged = true;\n\t\t\t\t\t});\n\n\t\t\t\t\tif (!changed) return null;\n\t\t\t\t\ttr.setMeta('addToHistory', false);\n\t\t\t\t\treturn tr;\n\t\t\t\t},\n\t\t\t}),\n\t\t];\n\t},\n});\n"],"names":["COMPLETE_TAG","DANGEROUS_TAG_NAMES","TAG_NAME_RE","isDangerousTag","tag","m","HtmlTagStripExtension","Extension","stripAll","shouldStrip","Plugin","transactions","_oldState","newState","tr","changed","node","pos","stripped","match","end"],"mappings":";;AAGA,MAAMA,IAAe,6CAGfC,wBAA0B,IAAI;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC,GAEKC,IAAc;AAEpB,SAASC,EAAeC,GAAsB;AAC7C,QAAMC,IAAID,EAAI,MAAMF,CAAW;AAC/B,SAAOG,IAAIJ,EAAoB,IAAII,EAAE,CAAC,EAAE,YAAA,CAAa,IAAI;AAC1D;AAaO,MAAMC,IAAwBC,EAAU,OAAO;AAAA,EACrD,MAAM;AAAA,EACN,aAAa;AACZ,WAAO,EAAE,UAAU,GAAA;AAAA,EACpB;AAAA,EACA,wBAAwB;AACvB,UAAM,EAAE,UAAAC,MAAa,KAAK,SACpBC,IAAcD,IACjB,MAAM,KACN,CAACJ,MAAgBD,EAAeC,CAAG;AAEtC,WAAO;AAAA,MACN,IAAIM,EAAO;AAAA,QACV,kBAAkBC,GAAcC,GAAWC,GAAU;AACpD,cAAI,CAACF,EAAa,KAAK,CAAC,MAAM,EAAE,UAAU,EAAG,QAAO;AAEpD,gBAAM,EAAE,IAAAG,MAAOD;AACf,cAAIE,IAAU;AA0Bd,iBAxBAF,EAAS,IAAI,YAAY,CAACG,GAAMC,MAAQ;AAGvC,gBAFI,CAACD,EAAK,UAAU,CAACA,EAAK,SAC1BhB,EAAa,YAAY,GACrB,CAACA,EAAa,KAAKgB,EAAK,IAAI,GAAG;AAEnC,YAAAhB,EAAa,YAAY;AACzB,kBAAMkB,IAAWF,EAAK,KAAK;AAAA,cAAQhB;AAAA,cAAc,CAACmB,MACjDV,EAAYU,CAAK,IAAI,KAAKA;AAAA,YAAA;AAE3B,gBAAID,MAAaF,EAAK,KAAM;AAE5B,kBAAMI,IAAMH,IAAMD,EAAK;AACvB,YAAIE,IACHJ,EAAG;AAAA,cACFA,EAAG,QAAQ,IAAIG,CAAG;AAAA,cAClBH,EAAG,QAAQ,IAAIM,CAAG;AAAA,cAClBP,EAAS,OAAO,KAAKK,GAAUF,EAAK,KAAK;AAAA,YAAA,IAG1CF,EAAG,OAAOA,EAAG,QAAQ,IAAIG,CAAG,GAAGH,EAAG,QAAQ,IAAIM,CAAG,CAAC,GAEnDL,IAAU;AAAA,UACX,CAAC,GAEIA,KACLD,EAAG,QAAQ,gBAAgB,EAAK,GACzBA,KAFc;AAAA,QAGtB;AAAA,MAAA,CACA;AAAA,IAAA;AAAA,EAEH;AACD,CAAC;"}

package/dist/esm/helpers/sanitize.d.ts

@@ -1,32 +0,0 @@
-export declare const isAllowedUrl: (url: string | null | undefined, allowed: Set<string>) => string | null;
-export declare const isAllowedLinkUrl: (url?: string | null) => boolean;
-export declare const isAllowedImageUrl: (url?: string | null) => boolean;
-export declare const stripHtmlTags: (input: string | null | undefined) => string;
-/**
- * Escape CSV/Excel formula injection. Prefixes values starting with a
- * formula-triggering character (=, +, -, @, tab, CR) with a single quote
- * so spreadsheet software treats them as literal text.
- */
-export declare const escapeFormulaInjection: (input: string | null | undefined) => string;
-/**
- * Render-safe plain text. Strips every tag and returns safe HTML (with
- * entities). Use at render sinks that must show plain text via innerHTML.
- * For input onChange, use stripHtmlTags instead.
- */
-export declare const sanitizePlainText: (input: string | null | undefined) => string;
-/**
- * Basic rich text. A small formatting allowlist; no style tag/attr, links
- * restricted to safe protocols.
- */
-export declare const sanitizeBasicHtml: (input: string | null | undefined) => string;
-/**
- * Filter an inline style string to only safe CSS properties with safe values.
- * Returns the cleaned style string (empty string if nothing survives).
- */
-export declare const sanitizeCssProperties: (style: string) => string;
-/**
- * Full rich text / inbound email HTML. Allowlist of tags and attributes an
- * email needs to render; everything else is stripped. Inline style attributes
- * are filtered to a safe CSS property allowlist.
- */
-export declare const sanitizeEmailHtml: (input: string | null | undefined) => string;

package/dist/esm/helpers/sanitize.js

@@ -1,204 +0,0 @@
-import i from "dompurify";
-const n = () => typeof window < "u", l = /<\/?[^>]+(>|$)/g, d = /* @__PURE__ */ new Set(["https:", "mailto:", "tel:"]), p = /* @__PURE__ */ new Set(["https:", "data:"]), c = (t, e) => {
-  if (!t) return null;
-  try {
-    const r = new URL(t, "https://bik.local");
-    return e.has(r.protocol) ? t : null;
-  } catch {
-    return null;
-  }
-}, A = (t) => c(t, d) !== null, L = (t) => c(t, p) !== null, f = /<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s[^>]*)?\/?>/g, O = (t) => t ? t.replace(f, "") : "", g = /^[=+\-@\t\r]/, w = (t) => t ? g.test(t) ? `'${t}` : t : "", _ = (t) => t ? n() ? i.sanitize(t, {
-  ALLOWED_TAGS: [],
-  ALLOWED_ATTR: [],
-  KEEP_CONTENT: !0
-}) : t.replace(l, "") : "", E = (t) => t ? n() ? i.sanitize(t, {
-  ALLOWED_TAGS: [
-    "p",
-    "br",
-    "b",
-    "strong",
-    "i",
-    "em",
-    "u",
-    "s",
-    "span",
-    "a",
-    "ul",
-    "ol",
-    "li",
-    "blockquote"
-  ],
-  ALLOWED_ATTR: ["href", "target", "rel", "class"],
-  FORBID_TAGS: ["style"],
-  FORBID_ATTR: ["style"],
-  ALLOWED_URI_REGEXP: /^(?:https|mailto|tel):/i
-}) : t.replace(l, "") : "", h = /* @__PURE__ */ new Set([
-  "color",
-  "background-color",
-  "background",
-  "font-family",
-  "font-size",
-  "font-weight",
-  "font-style",
-  "font-variant",
-  "font",
-  "line-height",
-  "letter-spacing",
-  "word-spacing",
-  "text-align",
-  "text-decoration",
-  "text-transform",
-  "text-indent",
-  "vertical-align",
-  "white-space",
-  "word-wrap",
-  "word-break",
-  "overflow-wrap",
-  "direction",
-  "margin",
-  "margin-top",
-  "margin-right",
-  "margin-bottom",
-  "margin-left",
-  "padding",
-  "padding-top",
-  "padding-right",
-  "padding-bottom",
-  "padding-left",
-  "border",
-  "border-top",
-  "border-right",
-  "border-bottom",
-  "border-left",
-  "border-width",
-  "border-style",
-  "border-color",
-  "border-collapse",
-  "border-spacing",
-  "border-radius",
-  "width",
-  "min-width",
-  "max-width",
-  "height",
-  "min-height",
-  "max-height",
-  "display",
-  "visibility",
-  "opacity",
-  "float",
-  "clear",
-  "overflow",
-  "overflow-x",
-  "overflow-y",
-  "table-layout",
-  "list-style",
-  "list-style-type",
-  "list-style-position",
-  "box-sizing"
-]), u = /url\s*\(|expression\s*\(|-moz-binding|behavior\s*:|@import|javascript:|data:/i, b = (t) => t.split(";").map((e) => e.trim()).filter((e) => {
-  if (!e) return !1;
-  const r = e.indexOf(":");
-  if (r < 0) return !1;
-  const s = e.slice(0, r).trim().toLowerCase(), o = e.slice(r + 1).trim();
-  return h.has(s) && !u.test(o);
-}).join("; "), T = (t) => {
-  if (!t) return "";
-  if (!n()) return t.replace(l, "");
-  const e = (s, o) => {
-    if (o.attrName !== "style") return;
-    const a = b(o.attrValue);
-    a ? o.attrValue = a : o.keepAttr = !1;
-  };
-  i.addHook("uponSanitizeAttribute", e);
-  const r = i.sanitize(t, {
-    ALLOWED_TAGS: [
-      "p",
-      "br",
-      "div",
-      "span",
-      "strong",
-      "b",
-      "em",
-      "i",
-      "u",
-      "s",
-      "ul",
-      "ol",
-      "li",
-      "blockquote",
-      "h1",
-      "h2",
-      "h3",
-      "h4",
-      "h5",
-      "h6",
-      "a",
-      "img",
-      "table",
-      "thead",
-      "tbody",
-      "tfoot",
-      "tr",
-      "th",
-      "td",
-      "caption",
-      "colgroup",
-      "col",
-      "center",
-      "font",
-      "hr",
-      "pre",
-      "code",
-      "sub",
-      "sup",
-      "small",
-      "big",
-      "figure",
-      "figcaption",
-      "section",
-      "article",
-      "header",
-      "footer",
-      "abbr",
-      "cite",
-      "mark",
-      "del",
-      "ins"
-    ],
-    ALLOWED_ATTR: [
-      "href",
-      "target",
-      "rel",
-      "src",
-      "alt",
-      "title",
-      "width",
-      "height",
-      "style",
-      "class",
-      "align",
-      "valign",
-      "colspan",
-      "rowspan",
-      "cellpadding",
-      "cellspacing",
-      "border",
-      "color",
-      "bgcolor"
-    ],
-    ALLOW_UNKNOWN_PROTOCOLS: !1
-  });
-  return i.removeHook("uponSanitizeAttribute"), r;
-};
-export {
-  w as escapeFormulaInjection,
-  L as isAllowedImageUrl,
-  A as isAllowedLinkUrl,
-  c as isAllowedUrl,
-  E as sanitizeBasicHtml,
-  b as sanitizeCssProperties,
-  T as sanitizeEmailHtml,
-  _ as sanitizePlainText,
-  O as stripHtmlTags
-};
-//# sourceMappingURL=sanitize.js.map

package/dist/esm/helpers/sanitize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.js","sources":["../../../src/helpers/sanitize.ts"],"sourcesContent":["import DOMPurify from 'dompurify';\n\n/**\n * Central HTML/CSS-injection sanitisation for the component library.\n *\n * Two categories:\n *\n * INPUT layer (onChange) — strips tags, keeps plain text:\n *   - stripHtmlTags:          remove every HTML tag, return raw text\n *   - escapeFormulaInjection: prefix CSV-dangerous leading chars with '\n *\n * RENDER layer (dangerouslySetInnerHTML / innerHTML) — DOMPurify-based:\n *   - sanitizePlainText:  ALLOWED_TAGS: [] (for sinks that must show plain text)\n *   - sanitizeBasicHtml:  formatting allowlist (chat bubbles, rich previews)\n *   - sanitizeEmailHtml:  full email allowlist (tables, images, inline style)\n */\n\nconst hasDOM = (): boolean => typeof window !== 'undefined';\n\nconst REGEX_TAG_STRIP = /<\\/?[^>]+(>|$)/g;\n\nconst ALLOWED_LINK_PROTOCOLS = new Set(['https:', 'mailto:', 'tel:']);\nconst ALLOWED_IMG_PROTOCOLS = new Set(['https:', 'data:']);\n\nexport const isAllowedUrl = (\n\turl: string | null | undefined,\n\tallowed: Set<string>,\n): string | null => {\n\tif (!url) return null;\n\ttry {\n\t\tconst parsed = new URL(url, 'https://bik.local');\n\t\treturn allowed.has(parsed.protocol) ? url : null;\n\t} catch {\n\t\treturn null;\n\t}\n};\n\nexport const isAllowedLinkUrl = (url?: string | null): boolean =>\n\tisAllowedUrl(url, ALLOWED_LINK_PROTOCOLS) !== null;\n\nexport const isAllowedImageUrl = (url?: string | null): boolean =>\n\tisAllowedUrl(url, ALLOWED_IMG_PROTOCOLS) !== null;\n\n// ---------------------------------------------------------------------------\n// INPUT layer — for onChange handlers on plain-text inputs\n// ---------------------------------------------------------------------------\n\n/**\n * Strip complete HTML tags from the input, return the raw text content.\n * Uses a regex that only matches tags with both < and >, so partial input\n * like \"<h\" while typing is preserved (no closing >, not a tag yet).\n *\n * \"<h1>Hello</h1>\"  → \"Hello\"\n * \"<h\"              → \"<h\"      (incomplete, kept)\n * \"2 < 3\"           → \"2 < 3\"\n * \"<script>x</script>\" → \"x\"\n */\nconst COMPLETE_TAG = /<\\/?[a-zA-Z][a-zA-Z0-9]*(?:\\s[^>]*)?\\/?>/g;\n\nexport const stripHtmlTags = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\treturn input.replace(COMPLETE_TAG, '');\n};\n\nconst CSV_FORMULA_PREFIX = /^[=+\\-@\\t\\r]/;\n\n/**\n * Escape CSV/Excel formula injection. Prefixes values starting with a\n * formula-triggering character (=, +, -, @, tab, CR) with a single quote\n * so spreadsheet software treats them as literal text.\n */\nexport const escapeFormulaInjection = (\n\tinput: string | null | undefined,\n): string => {\n\tif (!input) return '';\n\treturn CSV_FORMULA_PREFIX.test(input) ? `'${input}` : input;\n};\n\n// ---------------------------------------------------------------------------\n// RENDER layer — for dangerouslySetInnerHTML / innerHTML sinks\n// ---------------------------------------------------------------------------\n\n/**\n * Render-safe plain text. Strips every tag and returns safe HTML (with\n * entities). Use at render sinks that must show plain text via innerHTML.\n * For input onChange, use stripHtmlTags instead.\n */\nexport const sanitizePlainText = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\treturn DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [],\n\t\tALLOWED_ATTR: [],\n\t\tKEEP_CONTENT: true,\n\t});\n};\n\n/**\n * Basic rich text. A small formatting allowlist; no style tag/attr, links\n * restricted to safe protocols.\n */\nexport const sanitizeBasicHtml = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\treturn DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [\n\t\t\t'p',\n\t\t\t'br',\n\t\t\t'b',\n\t\t\t'strong',\n\t\t\t'i',\n\t\t\t'em',\n\t\t\t'u',\n\t\t\t's',\n\t\t\t'span',\n\t\t\t'a',\n\t\t\t'ul',\n\t\t\t'ol',\n\t\t\t'li',\n\t\t\t'blockquote',\n\t\t],\n\t\tALLOWED_ATTR: ['href', 'target', 'rel', 'class'],\n\t\tFORBID_TAGS: ['style'],\n\t\tFORBID_ATTR: ['style'],\n\t\tALLOWED_URI_REGEXP: /^(?:https|mailto|tel):/i,\n\t});\n};\n\n// CSS properties safe for email rendering. Everything else is stripped from\n// inline style attributes to block position-overlay, url()-exfiltration,\n// expression(), and -moz-binding attacks.\nconst SAFE_CSS_PROPERTIES = new Set([\n\t'color',\n\t'background-color',\n\t'background',\n\t'font-family',\n\t'font-size',\n\t'font-weight',\n\t'font-style',\n\t'font-variant',\n\t'font',\n\t'line-height',\n\t'letter-spacing',\n\t'word-spacing',\n\t'text-align',\n\t'text-decoration',\n\t'text-transform',\n\t'text-indent',\n\t'vertical-align',\n\t'white-space',\n\t'word-wrap',\n\t'word-break',\n\t'overflow-wrap',\n\t'direction',\n\t'margin',\n\t'margin-top',\n\t'margin-right',\n\t'margin-bottom',\n\t'margin-left',\n\t'padding',\n\t'padding-top',\n\t'padding-right',\n\t'padding-bottom',\n\t'padding-left',\n\t'border',\n\t'border-top',\n\t'border-right',\n\t'border-bottom',\n\t'border-left',\n\t'border-width',\n\t'border-style',\n\t'border-color',\n\t'border-collapse',\n\t'border-spacing',\n\t'border-radius',\n\t'width',\n\t'min-width',\n\t'max-width',\n\t'height',\n\t'min-height',\n\t'max-height',\n\t'display',\n\t'visibility',\n\t'opacity',\n\t'float',\n\t'clear',\n\t'overflow',\n\t'overflow-x',\n\t'overflow-y',\n\t'table-layout',\n\t'list-style',\n\t'list-style-type',\n\t'list-style-position',\n\t'box-sizing',\n]);\n\n// Values that indicate CSS injection attempts regardless of property.\nconst DANGEROUS_CSS_VALUE =\n\t/url\\s*\\(|expression\\s*\\(|-moz-binding|behavior\\s*:|@import|javascript:|data:/i;\n\n/**\n * Filter an inline style string to only safe CSS properties with safe values.\n * Returns the cleaned style string (empty string if nothing survives).\n */\nexport const sanitizeCssProperties = (style: string): string => {\n\treturn style\n\t\t.split(';')\n\t\t.map((decl) => decl.trim())\n\t\t.filter((decl) => {\n\t\t\tif (!decl) return false;\n\t\t\tconst colonIdx = decl.indexOf(':');\n\t\t\tif (colonIdx < 0) return false;\n\t\t\tconst prop = decl.slice(0, colonIdx).trim().toLowerCase();\n\t\t\tconst value = decl.slice(colonIdx + 1).trim();\n\t\t\treturn SAFE_CSS_PROPERTIES.has(prop) && !DANGEROUS_CSS_VALUE.test(value);\n\t\t})\n\t\t.join('; ');\n};\n\n/**\n * Full rich text / inbound email HTML. Allowlist of tags and attributes an\n * email needs to render; everything else is stripped. Inline style attributes\n * are filtered to a safe CSS property allowlist.\n */\nexport const sanitizeEmailHtml = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\n\tconst hook = (\n\t\t_node: Element,\n\t\tdata: { attrName: string; attrValue: string; keepAttr: boolean },\n\t) => {\n\t\tif (data.attrName !== 'style') return;\n\t\tconst clean = sanitizeCssProperties(data.attrValue);\n\t\tif (clean) {\n\t\t\tdata.attrValue = clean;\n\t\t} else {\n\t\t\tdata.keepAttr = false;\n\t\t}\n\t};\n\tDOMPurify.addHook('uponSanitizeAttribute', hook);\n\n\tconst result = DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [\n\t\t\t'p',\n\t\t\t'br',\n\t\t\t'div',\n\t\t\t'span',\n\t\t\t'strong',\n\t\t\t'b',\n\t\t\t'em',\n\t\t\t'i',\n\t\t\t'u',\n\t\t\t's',\n\t\t\t'ul',\n\t\t\t'ol',\n\t\t\t'li',\n\t\t\t'blockquote',\n\t\t\t'h1',\n\t\t\t'h2',\n\t\t\t'h3',\n\t\t\t'h4',\n\t\t\t'h5',\n\t\t\t'h6',\n\t\t\t'a',\n\t\t\t'img',\n\t\t\t'table',\n\t\t\t'thead',\n\t\t\t'tbody',\n\t\t\t'tfoot',\n\t\t\t'tr',\n\t\t\t'th',\n\t\t\t'td',\n\t\t\t'caption',\n\t\t\t'colgroup',\n\t\t\t'col',\n\t\t\t'center',\n\t\t\t'font',\n\t\t\t'hr',\n\t\t\t'pre',\n\t\t\t'code',\n\t\t\t'sub',\n\t\t\t'sup',\n\t\t\t'small',\n\t\t\t'big',\n\t\t\t'figure',\n\t\t\t'figcaption',\n\t\t\t'section',\n\t\t\t'article',\n\t\t\t'header',\n\t\t\t'footer',\n\t\t\t'abbr',\n\t\t\t'cite',\n\t\t\t'mark',\n\t\t\t'del',\n\t\t\t'ins',\n\t\t],\n\t\tALLOWED_ATTR: [\n\t\t\t'href',\n\t\t\t'target',\n\t\t\t'rel',\n\t\t\t'src',\n\t\t\t'alt',\n\t\t\t'title',\n\t\t\t'width',\n\t\t\t'height',\n\t\t\t'style',\n\t\t\t'class',\n\t\t\t'align',\n\t\t\t'valign',\n\t\t\t'colspan',\n\t\t\t'rowspan',\n\t\t\t'cellpadding',\n\t\t\t'cellspacing',\n\t\t\t'border',\n\t\t\t'color',\n\t\t\t'bgcolor',\n\t\t],\n\t\tALLOW_UNKNOWN_PROTOCOLS: false,\n\t});\n\n\tDOMPurify.removeHook('uponSanitizeAttribute');\n\treturn result;\n};\n"],"names":["hasDOM","REGEX_TAG_STRIP","ALLOWED_LINK_PROTOCOLS","ALLOWED_IMG_PROTOCOLS","isAllowedUrl","url","allowed","parsed","isAllowedLinkUrl","isAllowedImageUrl","COMPLETE_TAG","stripHtmlTags","input","CSV_FORMULA_PREFIX","escapeFormulaInjection","sanitizePlainText","DOMPurify","sanitizeBasicHtml","SAFE_CSS_PROPERTIES","DANGEROUS_CSS_VALUE","sanitizeCssProperties","style","decl","colonIdx","prop","value","sanitizeEmailHtml","hook","_node","data","clean","result"],"mappings":";AAiBA,MAAMA,IAAS,MAAe,OAAO,SAAW,KAE1CC,IAAkB,mBAElBC,IAAyB,oBAAI,IAAI,CAAC,UAAU,WAAW,MAAM,CAAC,GAC9DC,IAAwB,oBAAI,IAAI,CAAC,UAAU,OAAO,CAAC,GAE5CC,IAAe,CAC3BC,GACAC,MACmB;AACnB,MAAI,CAACD,EAAK,QAAO;AACjB,MAAI;AACH,UAAME,IAAS,IAAI,IAAIF,GAAK,mBAAmB;AAC/C,WAAOC,EAAQ,IAAIC,EAAO,QAAQ,IAAIF,IAAM;AAAA,EAC7C,QAAQ;AACP,WAAO;AAAA,EACR;AACD,GAEaG,IAAmB,CAACH,MAChCD,EAAaC,GAAKH,CAAsB,MAAM,MAElCO,IAAoB,CAACJ,MACjCD,EAAaC,GAAKF,CAAqB,MAAM,MAgBxCO,IAAe,6CAERC,IAAgB,CAACC,MACxBA,IACEA,EAAM,QAAQF,GAAc,EAAE,IADlB,IAIdG,IAAqB,gBAOdC,IAAyB,CACrCF,MAEKA,IACEC,EAAmB,KAAKD,CAAK,IAAI,IAAIA,CAAK,KAAKA,IADnC,IAaPG,IAAoB,CAACH,MAC5BA,IACAZ,EAAA,IACEgB,EAAU,SAASJ,GAAO;AAAA,EAChC,cAAc,CAAA;AAAA,EACd,cAAc,CAAA;AAAA,EACd,cAAc;AAAA,CACd,IALqBA,EAAM,QAAQX,GAAiB,EAAE,IADpC,IAaPgB,IAAoB,CAACL,MAC5BA,IACAZ,EAAA,IACEgB,EAAU,SAASJ,GAAO;AAAA,EAChC,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,cAAc,CAAC,QAAQ,UAAU,OAAO,OAAO;AAAA,EAC/C,aAAa,CAAC,OAAO;AAAA,EACrB,aAAa,CAAC,OAAO;AAAA,EACrB,oBAAoB;AAAA,CACpB,IAtBqBA,EAAM,QAAQX,GAAiB,EAAE,IADpC,IA6BdiB,wBAA0B,IAAI;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC,GAGKC,IACL,iFAMYC,IAAwB,CAACC,MAC9BA,EACL,MAAM,GAAG,EACT,IAAI,CAACC,MAASA,EAAK,KAAA,CAAM,EACzB,OAAO,CAACA,MAAS;AACjB,MAAI,CAACA,EAAM,QAAO;AAClB,QAAMC,IAAWD,EAAK,QAAQ,GAAG;AACjC,MAAIC,IAAW,EAAG,QAAO;AACzB,QAAMC,IAAOF,EAAK,MAAM,GAAGC,CAAQ,EAAE,KAAA,EAAO,YAAA,GACtCE,IAAQH,EAAK,MAAMC,IAAW,CAAC,EAAE,KAAA;AACvC,SAAOL,EAAoB,IAAIM,CAAI,KAAK,CAACL,EAAoB,KAAKM,CAAK;AACxE,CAAC,EACA,KAAK,IAAI,GAQCC,IAAoB,CAACd,MAA6C;AAC9E,MAAI,CAACA,EAAO,QAAO;AACnB,MAAI,CAACZ,EAAA,UAAiBY,EAAM,QAAQX,GAAiB,EAAE;AAEvD,QAAM0B,IAAO,CACZC,GACAC,MACI;AACJ,QAAIA,EAAK,aAAa,QAAS;AAC/B,UAAMC,IAAQV,EAAsBS,EAAK,SAAS;AAClD,IAAIC,IACHD,EAAK,YAAYC,IAEjBD,EAAK,WAAW;AAAA,EAElB;AACA,EAAAb,EAAU,QAAQ,yBAAyBW,CAAI;AAE/C,QAAMI,IAASf,EAAU,SAASJ,GAAO;AAAA,IACxC,cAAc;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAED,cAAc;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAED,yBAAyB;AAAA,EAAA,CACzB;AAED,SAAAI,EAAU,WAAW,uBAAuB,GACrCe;AACR;"}