@broberg/cms-inline-edit 0.6.2 → 0.7.0

package/dist/index.d.cts

@@ -12,6 +12,75 @@
  */
 declare function applyFieldSlice(current: string, original: string, next: string): string;
 
+/**
+ * What kind of address did the editor actually type?
+ *
+ * The reason this is a module and not three lines inside the dialog: the
+ * content scanner (`scripts/scan-schemeless-links.mjs`) has to agree with the
+ * editor about what counts as a doubtful address. Two copies of the rule drift,
+ * and then the scanner reports a clean site the editor is still producing dead
+ * links on.
+ */
+/**
+ * True when the browser will read this address as a path on the CURRENT page.
+ *
+ * `<a href="www.trailmem.com">` is valid HTML: it renders, it is styled, it
+ * lights up on hover. The browser just resolves it relative to the page it sits
+ * on, so it lands on /some/article/www.trailmem.com. Nothing about the markup
+ * looks wrong — only following the link reveals it.
+ *
+ * This DELIBERATELY does not try to decide whether the author meant an external
+ * host. `trailmem.com` and `index.html` are syntactically identical, and a rule
+ * that "fixes" the first breaks the second. It reports doubt; it never rewrites.
+ */
+declare function isSchemeless(raw: string): boolean;
+/**
+ * A bare email address — `name@host.tld`, no scheme, no path.
+ *
+ * Kept deliberately narrow: anything with a slash, a space or a second @ is
+ * not one, so an ordinary URL that happens to contain an @ (userinfo, a query)
+ * is untouched.
+ */
+declare function isBareEmail(raw: string): boolean;
+/** The one-click repair the dialog offers. Never applied on its own. */
+declare function withHttps(raw: string): string;
+/**
+ * Does this address leave the site the editor is standing on?
+ *
+ * Used ONLY to decide how the "open in a new tab" box starts out — and that
+ * starting state is visible in the box itself, so a wrong guess is something
+ * the editor can see and change, not a silent rewrite.
+ */
+declare function isExternalHost(raw: string, currentHost: string): boolean;
+/**
+ * Every link address inside a stored string — HTML anchors and Markdown links.
+ *
+ * Markdown IMAGE syntax is excluded on purpose: a relative image path
+ * (`![foto](uploads/x.jpg)`) is normal and correct, and flagging it would bury
+ * the real findings in noise.
+ */
+declare function extractLinkTargets(text: string): Array<{
+    syntax: "html" | "markdown";
+    value: string;
+}>;
+/**
+ * Schemes that must never reach an `href`.
+ *
+ * `javascript:` in a link is script execution on click, in the SITE's own
+ * origin — which is where the editor's own edit-session token lives in
+ * localStorage. So one editor planting such a link, and any colleague clicking
+ * it, is a token handover. `data:` and `vbscript:` are the same class.
+ *
+ * The package ALREADY refuses these on every other attribute
+ * (preservedLinkAttrs drops `javascript:` values and every `on*` handler) —
+ * href was the one that escaped, because it is emitted separately from the
+ * attributes it sits beside.
+ *
+ * Whitespace and control characters are stripped first: browsers ignore them
+ * inside a scheme, so `java\tscript:` and ` javascript:` both run.
+ */
+declare function isDangerousUrl(raw: string): boolean;
+
 /**
  * Labels for the in-editor UI — the rich-text toolbar (bold/italic/underline
  * tooltips, the visible "colour" + "done" buttons, the emoji tooltip) and the
@@ -184,4 +253,4 @@ declare function setLinkTarget(el: HTMLElement, newTab: boolean): void;
  */
 declare function htmlToMarkdown(html: string): string;
 
-export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, getConnectedToken, htmlToMarkdown, initInlineEdit, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget };
+export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, extractLinkTargets, getConnectedToken, htmlToMarkdown, initInlineEdit, isBareEmail, isDangerousUrl, isExternalHost, isSchemeless, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget, withHttps };

package/dist/index.d.ts

@@ -12,6 +12,75 @@
  */
 declare function applyFieldSlice(current: string, original: string, next: string): string;
 
+/**
+ * What kind of address did the editor actually type?
+ *
+ * The reason this is a module and not three lines inside the dialog: the
+ * content scanner (`scripts/scan-schemeless-links.mjs`) has to agree with the
+ * editor about what counts as a doubtful address. Two copies of the rule drift,
+ * and then the scanner reports a clean site the editor is still producing dead
+ * links on.
+ */
+/**
+ * True when the browser will read this address as a path on the CURRENT page.
+ *
+ * `<a href="www.trailmem.com">` is valid HTML: it renders, it is styled, it
+ * lights up on hover. The browser just resolves it relative to the page it sits
+ * on, so it lands on /some/article/www.trailmem.com. Nothing about the markup
+ * looks wrong — only following the link reveals it.
+ *
+ * This DELIBERATELY does not try to decide whether the author meant an external
+ * host. `trailmem.com` and `index.html` are syntactically identical, and a rule
+ * that "fixes" the first breaks the second. It reports doubt; it never rewrites.
+ */
+declare function isSchemeless(raw: string): boolean;
+/**
+ * A bare email address — `name@host.tld`, no scheme, no path.
+ *
+ * Kept deliberately narrow: anything with a slash, a space or a second @ is
+ * not one, so an ordinary URL that happens to contain an @ (userinfo, a query)
+ * is untouched.
+ */
+declare function isBareEmail(raw: string): boolean;
+/** The one-click repair the dialog offers. Never applied on its own. */
+declare function withHttps(raw: string): string;
+/**
+ * Does this address leave the site the editor is standing on?
+ *
+ * Used ONLY to decide how the "open in a new tab" box starts out — and that
+ * starting state is visible in the box itself, so a wrong guess is something
+ * the editor can see and change, not a silent rewrite.
+ */
+declare function isExternalHost(raw: string, currentHost: string): boolean;
+/**
+ * Every link address inside a stored string — HTML anchors and Markdown links.
+ *
+ * Markdown IMAGE syntax is excluded on purpose: a relative image path
+ * (`![foto](uploads/x.jpg)`) is normal and correct, and flagging it would bury
+ * the real findings in noise.
+ */
+declare function extractLinkTargets(text: string): Array<{
+    syntax: "html" | "markdown";
+    value: string;
+}>;
+/**
+ * Schemes that must never reach an `href`.
+ *
+ * `javascript:` in a link is script execution on click, in the SITE's own
+ * origin — which is where the editor's own edit-session token lives in
+ * localStorage. So one editor planting such a link, and any colleague clicking
+ * it, is a token handover. `data:` and `vbscript:` are the same class.
+ *
+ * The package ALREADY refuses these on every other attribute
+ * (preservedLinkAttrs drops `javascript:` values and every `on*` handler) —
+ * href was the one that escaped, because it is emitted separately from the
+ * attributes it sits beside.
+ *
+ * Whitespace and control characters are stripped first: browsers ignore them
+ * inside a scheme, so `java\tscript:` and ` javascript:` both run.
+ */
+declare function isDangerousUrl(raw: string): boolean;
+
 /**
  * Labels for the in-editor UI — the rich-text toolbar (bold/italic/underline
  * tooltips, the visible "colour" + "done" buttons, the emoji tooltip) and the
@@ -184,4 +253,4 @@ declare function setLinkTarget(el: HTMLElement, newTab: boolean): void;
  */
 declare function htmlToMarkdown(html: string): string;
 
-export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, getConnectedToken, htmlToMarkdown, initInlineEdit, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget };
+export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, extractLinkTargets, getConnectedToken, htmlToMarkdown, initInlineEdit, isBareEmail, isDangerousUrl, isExternalHost, isSchemeless, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget, withHttps };

package/dist/index.js

@@ -1,3 +1,44 @@
+// src/page-tools.ts
+function parseTags(input) {
+  const set = /* @__PURE__ */ new Set();
+  const ud = [];
+  for (const raa of input.split(",")) {
+    const t = raa.trim();
+    if (!t) continue;
+    const noegle = t.toLowerCase();
+    if (set.has(noegle)) continue;
+    set.add(noegle);
+    ud.push(t);
+  }
+  return ud;
+}
+function mergeTags(eksisterende, nye) {
+  const basis = Array.isArray(eksisterende) ? eksisterende.filter((t) => typeof t === "string") : [];
+  const kendte = new Set(basis.map((t) => t.toLowerCase()));
+  const ud = [...basis];
+  for (const t of nye) {
+    if (kendte.has(t.toLowerCase())) continue;
+    kendte.add(t.toLowerCase());
+    ud.push(t);
+  }
+  return ud;
+}
+function primaryDocRef(ankre) {
+  const taeller = /* @__PURE__ */ new Map();
+  for (const a of ankre) {
+    if (!a.collection || !a.slug || a.collection === "globals") continue;
+    const noegle = `${a.collection} ${a.slug}`;
+    const post = taeller.get(noegle) ?? { collection: a.collection, slug: a.slug, n: 0 };
+    post.n++;
+    taeller.set(noegle, post);
+  }
+  let bedst = null;
+  for (const post of taeller.values()) {
+    if (!bedst || post.n > bedst.n) bedst = post;
+  }
+  return bedst ? { collection: bedst.collection, slug: bedst.slug } : null;
+}
+
 // src/field-slice.ts
 function applyFieldSlice(current, original, next) {
   const first = current.indexOf(original);
@@ -12,6 +53,7 @@ function applyFieldSlice(current, original, next) {
 function isSchemeless(raw) {
   const v = (raw || "").trim();
   if (!v) return false;
+  if (isBareEmail(v)) return false;
   if (/^[a-z][a-z0-9+.-]*:/i.test(v)) return false;
   if (v.startsWith("//")) return false;
   if (v.startsWith("/")) return false;
@@ -19,6 +61,9 @@ function isSchemeless(raw) {
   if (v.startsWith("?")) return false;
   return true;
 }
+function isBareEmail(raw) {
+  return /^[^\s@/:?#]+@[^\s@/:?#]+\.[a-z]{2,}$/i.test((raw || "").trim());
+}
 function withHttps(raw) {
   return `https://${(raw || "").trim().replace(/^\/+/, "")}`;
 }
@@ -31,6 +76,18 @@ function isExternalHost(raw, currentHost) {
     return false;
   }
 }
+function extractLinkTargets(text) {
+  const out = [];
+  if (typeof text !== "string") return out;
+  for (const m of text.matchAll(/<a\b[^>]*?\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>]+))/gi)) {
+    out.push({ syntax: "html", value: m[2] ?? m[3] ?? m[4] ?? "" });
+  }
+  for (const m of text.matchAll(/(!)?\[(?:[^\]\[]|\[[^\]]*\])*\]\(([^)\s]+)/g)) {
+    if (m[1]) continue;
+    out.push({ syntax: "markdown", value: m[2] ?? "" });
+  }
+  return out;
+}
 function isDangerousUrl(raw) {
   const v = (raw || "").replace(/[\u0000-\u0020]/g, "");
   return /^(?:javascript|data|vbscript):/i.test(v);
@@ -212,6 +269,7 @@ var SQUARE_PEN_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="15" height=
 var UL_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="8" x2="21" y1="6" y2="6"/><line x1="8" x2="21" y1="12" y2="12"/><line x1="8" x2="21" y1="18" y2="18"/><line x1="3" x2="3.01" y1="6" y2="6"/><line x1="3" x2="3.01" y1="12" y2="12"/><line x1="3" x2="3.01" y1="18" y2="18"/></svg>';
 var OL_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="10" x2="21" y1="6" y2="6"/><line x1="10" x2="21" y1="12" y2="12"/><line x1="10" x2="21" y1="18" y2="18"/><path d="M4 6h1v4"/><path d="M4 10h2"/><path d="M6 18H4c0-1 2-2 2-3s-1-1.5-2-1"/></svg>';
 var LINK_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M10 13a5 5 0 0 0 7.5.5l3-3a5 5 0 0 0-7-7l-1.7 1.7"/><path d="M14 11a5 5 0 0 0-7.5-.5l-3 3a5 5 0 0 0 7 7l1.7-1.7"/></svg>';
+var WRENCH_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/></svg>';
 function makeIcon() {
   const icon = document.createElement("span");
   icon.style.cssText = "display:inline-flex;line-height:0;flex:0 0 auto";
@@ -563,7 +621,7 @@ function renderLinkDialog() {
   }
   const existingRef = linkEditing?.getAttribute("data-cms-ref") ?? "";
   const onPageTab = !editing || !!existingRef;
-  d.innerHTML = `<div style="display:flex;gap:4px;padding:8px 8px 0"><button type="button" data-testid="inline-link-tab-page" data-tab="page" style="${tabCss(onPageTab)}">${L.linkTabPage}</button><button type="button" data-testid="inline-link-tab-url" data-tab="url" style="${tabCss(!onPageTab)}">${L.linkTabUrl}</button></div><div style="padding:10px 12px 12px"><div data-pane="page" style="display:${onPageTab ? "block" : "none"}"><input data-testid="inline-link-search" data-role="search" placeholder="${L.linkSearch}" style="${fieldCss()}"><div data-role="current" data-testid="inline-link-current" style="display:none;margin-top:8px;padding:7px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px;font-size:11.5px;color:#c9d1dd;line-height:1.45"></div><div data-role="list" data-testid="inline-link-list" style="margin-top:8px;max-height:196px;overflow-y:auto;border:1px solid #3a3f4a;border-radius:8px;background:#141821"></div></div><div data-pane="url" style="display:${onPageTab ? "none" : "block"}"><label style="${labelCss()}">${L.linkUrl}</label><input data-testid="inline-link-url" data-role="url" placeholder="https://\u2026" style="${fieldCss()}"><div data-role="schemeless" data-testid="inline-link-schemeless" style="${noticeCss("schemeless")}"><p data-role="schemeless-text" style="margin:0;font-size:11.5px;line-height:1.5"></p><button type="button" data-testid="inline-link-add-scheme" data-role="add-scheme" style="${btnCss(false)};margin-top:7px;height:26px;font-size:12px">${L.linkSchemelessFix}</button></div></div><label style="${labelCss()}">${L.linkText}</label><input data-testid="inline-link-text" data-role="text" placeholder="${L.linkTextAuto}" style="${fieldCss()}"><p data-role="hint" style="font-size:11.5px;color:#9aa3b2;margin:6px 0 0;line-height:1.5"></p><button type="button" data-role="newtab" data-testid="inline-link-newtab" aria-pressed="false" style="display:flex;align-items:center;gap:8px;margin-top:12px;background:none;border:none;padding:0;cursor:pointer;font-family:inherit;font-size:12.5px;color:#c9d1dd"><span data-role="newtab-box" style="${checkboxCss(false)}"></span><span>${L.linkNewTab}</span></button><div data-role="live" style="display:flex;gap:8px;margin-top:12px;padding:9px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px"><p style="margin:0;font-size:11.5px;color:#c9d1dd;line-height:1.55">${L.linkLiveHint}</p></div><div style="display:flex;gap:8px;align-items:center;margin-top:14px"><div data-role="remove"></div><div style="flex:1"></div><button type="button" data-testid="inline-link-cancel" data-role="cancel" style="${btnCss(false)}">${L.linkCancel}</button><button type="button" data-testid="inline-link-submit" data-role="submit" style="${btnCss(true)}" disabled>${editing ? L.linkSave : L.linkInsert}</button></div></div>`;
+  d.innerHTML = `<div style="display:flex;gap:4px;padding:8px 8px 0"><button type="button" data-testid="inline-link-tab-page" data-tab="page" style="${tabCss(onPageTab)}">${L.linkTabPage}</button><button type="button" data-testid="inline-link-tab-url" data-tab="url" style="${tabCss(!onPageTab)}">${L.linkTabUrl}</button></div><div style="padding:10px 12px 12px"><div data-pane="page" style="display:${onPageTab ? "block" : "none"}"><input data-testid="inline-link-search" data-role="search" placeholder="${L.linkSearch}" style="${fieldCss()}"><div data-role="current" data-testid="inline-link-current" style="display:none;margin-top:8px;padding:7px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px;font-size:11.5px;color:#c9d1dd;line-height:1.45"></div><div data-role="list" data-testid="inline-link-list" style="margin-top:8px;max-height:196px;overflow-y:auto;border:1px solid #3a3f4a;border-radius:8px;background:#141821"></div></div><div data-pane="url" style="display:${onPageTab ? "none" : "block"}"><label style="${labelCss()}">${L.linkUrl}</label><input data-testid="inline-link-url" data-role="url" placeholder="https://\u2026" style="${fieldCss()}"><div data-role="schemeless" style="${noticeCss("schemeless")}"><p data-role="schemeless-text" style="margin:0;font-size:11.5px;line-height:1.5"></p><button type="button" data-testid="inline-link-add-scheme" data-role="add-scheme" style="${btnCss(false)};margin-top:7px;height:26px;font-size:12px">${L.linkSchemelessFix}</button></div></div><label style="${labelCss()}">${L.linkText}</label><input data-testid="inline-link-text" data-role="text" placeholder="${L.linkTextAuto}" style="${fieldCss()}"><p data-role="hint" style="font-size:11.5px;color:#9aa3b2;margin:6px 0 0;line-height:1.5"></p><button type="button" data-role="newtab" data-testid="inline-link-newtab" aria-pressed="false" style="display:flex;align-items:center;gap:8px;margin-top:12px;background:none;border:none;padding:0;cursor:pointer;font-family:inherit;font-size:12.5px;color:#c9d1dd"><span data-role="newtab-box" style="${checkboxCss(false)}"></span><span>${L.linkNewTab}</span></button><div data-role="live" style="display:flex;gap:8px;margin-top:12px;padding:9px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px"><p style="margin:0;font-size:11.5px;color:#c9d1dd;line-height:1.55">${L.linkLiveHint}</p></div><div style="display:flex;gap:8px;align-items:center;margin-top:14px"><div data-role="remove"></div><div style="flex:1"></div><button type="button" data-testid="inline-link-cancel" data-role="cancel" style="${btnCss(false)}">${L.linkCancel}</button><button type="button" data-testid="inline-link-submit" data-role="submit" style="${btnCss(true, true)}" disabled>${editing ? L.linkSave : L.linkInsert}</button></div></div>`;
   const q = (role) => d.querySelector(`[data-role="${role}"]`);
   const text = q("text");
   const urlIn = q("url");
@@ -571,7 +629,7 @@ function renderLinkDialog() {
   if (editing) {
     text.value = linkEditing?.getAttribute("data-cms-ref-label") === "auto" ? "" : linkEditing?.textContent ?? "";
     if (!existingRef) urlIn.value = linkEditing?.getAttribute("href") ?? "";
-    linkNewTab = linkEditing?.getAttribute("target") === "_blank";
+    linkNewTab = (linkEditing?.getAttribute("target") ?? "").trim().toLowerCase() === "_blank";
     linkNewTabTouched = true;
     q("remove").appendChild(buildRemoveLink());
   }
@@ -706,7 +764,8 @@ function syncLinkDialog() {
   const own = q("text").value.trim();
   q("hint").innerHTML = own ? uiLabels.linkTextOwnHint : onPage ? uiLabels.linkTextAutoHint : uiLabels.linkUrlHint;
   q("live").style.display = onPage ? "flex" : "none";
-  q("submit").disabled = onPage ? !linkPicked : !q("url").value.trim();
+  const submit = q("submit");
+  submit.disabled = onPage ? !linkPicked : !q("url").value.trim();
   const raw = q("url").value;
   const dangerous = !onPage && isDangerousUrl(raw);
   const doubtful = !onPage && !dangerous && isSchemeless(raw);
@@ -717,34 +776,45 @@ function syncLinkDialog() {
     notice.setAttribute("data-variant", "blocked");
     q("schemeless-text").innerHTML = uiLabels.linkBlocked.replace(
       "{v}",
-      escapeHtml(raw.trim())
+      () => escapeHtml(raw.trim())
     );
-    q("submit").disabled = true;
+    submit.disabled = true;
   } else if (doubtful) {
     notice.setAttribute("style", noticeCss("schemeless"));
     notice.setAttribute("data-variant", "schemeless");
     q("schemeless-text").innerHTML = uiLabels.linkSchemeless.replace(
       "{v}",
-      escapeHtml(raw.trim())
+      () => escapeHtml(raw.trim())
     );
   }
+  submit.setAttribute("style", btnCss(true, submit.disabled));
+  if (!show) {
+    notice.removeAttribute("data-variant");
+    notice.removeAttribute("data-testid");
+    q("schemeless-text").innerHTML = "";
+  } else {
+    notice.setAttribute("data-testid", dangerous ? "inline-link-blocked" : "inline-link-schemeless");
+  }
   notice.style.display = show ? "block" : "none";
   q("schemeless-text").style.color = dangerous ? "#f5c6c6" : "#e8d6b0";
   q("add-scheme").style.display = doubtful ? "" : "none";
-  if (!onPage && !linkNewTabTouched) {
-    linkNewTab = isExternalHost(raw, typeof location !== "undefined" ? location.host : "");
+  if (!linkNewTabTouched) {
+    linkNewTab = onPage ? false : isExternalHost(raw, typeof location !== "undefined" ? location.host : "");
   }
   const box = q("newtab-box");
   if (box) box.setAttribute("style", checkboxCss(linkNewTab));
   q("newtab").setAttribute("aria-pressed", String(linkNewTab));
 }
 function setLinkTarget(el, newTab) {
+  const tokens = (el.getAttribute("rel") ?? "").split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((t) => t.toLowerCase() !== "noopener");
   if (newTab) {
     el.setAttribute("target", "_blank");
-    el.setAttribute("rel", "noopener");
+    el.setAttribute("rel", ["noopener", ...kept].join(" "));
   } else {
     el.removeAttribute("target");
-    el.removeAttribute("rel");
+    if (kept.length) el.setAttribute("rel", kept.join(" "));
+    else el.removeAttribute("rel");
   }
 }
 function applyLink() {
@@ -801,7 +871,11 @@ var noticeCss = (variant) => "display:none;margin-top:8px;padding:8px 10px;borde
 var checkboxCss = (on) => "width:16px;height:16px;flex:0 0 16px;border-radius:4px;box-sizing:border-box;display:inline-block;" + (on ? `background:#00b2ff;border:1px solid #00b2ff;background-image:url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'><path d='M4 8.5l2.6 2.6L12 5.8' fill='none' stroke='white' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>");background-size:100% 100%;` : "background:#141821;border:1px solid #3a3f4a;");
 var fieldCss = () => "width:100%;background:#141821;border:1px solid #3a3f4a;color:#fff;height:34px;border-radius:7px;padding:0 10px;font-size:13.5px;outline:none;font-family:inherit;box-sizing:border-box;";
 var labelCss = () => "font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:#9aa3b2;margin:12px 0 5px;display:block;";
-var btnCss = (primary) => "height:33px;border-radius:7px;font-size:13px;cursor:pointer;padding:0 14px;font-weight:600;font-family:inherit;" + (primary ? "background:#00b2ff;color:#04121b;border:none;" : "background:none;border:1px solid #3a3f4a;color:#fff;font-weight:500;");
+var btnCss = (primary, disabled = false) => "height:33px;border-radius:7px;font-size:13px;padding:0 14px;font-weight:600;font-family:inherit;" + // A disabled button that still looks clickable is the silent state this whole
+// card exists to remove: the editor clicks, nothing happens, and the dialog
+// reads as broken rather than as refusing. It matters more now that `disabled`
+// is what stops a javascript: address being inserted.
+(disabled ? "cursor:not-allowed;opacity:.42;" : "cursor:pointer;") + (primary ? "background:#00b2ff;color:#04121b;border:none;" : "background:none;border:1px solid #3a3f4a;color:#fff;font-weight:500;");
 function toggleEmojiPicker(anchor) {
   if (!emojiPicker) emojiPicker = buildEmojiPicker();
   if (emojiPicker.style.display === "block") {
@@ -1030,7 +1104,7 @@ function preservedLinkAttrs(el) {
     const name = attr.name.toLowerCase();
     if (name === "href") continue;
     if (name.startsWith("on")) continue;
-    if (/^javascript:/i.test(attr.value.trim())) continue;
+    if (isDangerousUrl(attr.value)) continue;
     out.push(`${name}="${escapeAttr(attr.value)}"`);
   }
   return out;
@@ -1202,7 +1276,172 @@ function showActiveBadge(options) {
   badge.addEventListener("mouseenter", () => badge.style.opacity = "1");
   badge.addEventListener("mouseleave", () => badge.style.opacity = ".9");
   badge.addEventListener("click", exitEditMode);
-  document.body.appendChild(badge);
+  badge.style.position = "static";
+  badge.style.borderRadius = "999px 0 0 999px";
+  const raekke = document.createElement("div");
+  raekke.setAttribute("data-cms-inline-edit-toolsrow", "");
+  raekke.style.cssText = "position:fixed;bottom:16px;left:16px;display:inline-flex;align-items:stretch;z-index:2147483647;box-shadow:0 4px 16px rgba(0,0,0,.3);border-radius:999px;overflow:visible;";
+  const tools = document.createElement("button");
+  tools.type = "button";
+  tools.setAttribute("data-cms-inline-edit-tools", "");
+  tools.setAttribute("data-testid", "inline-edit-tools");
+  tools.setAttribute("aria-label", "Tools");
+  tools.title = "Tools";
+  tools.style.cssText = "display:inline-flex;align-items:center;background:#1c2027;color:#8b93a3;padding:8px 12px;border:none;border-left:1px solid rgba(255,255,255,.12);border-radius:0 999px 999px 0;cursor:pointer;font:600 12px system-ui,sans-serif;";
+  tools.innerHTML = WRENCH_SVG;
+  tools.addEventListener("mouseenter", () => tools.style.color = "#fff");
+  tools.addEventListener("mouseleave", () => tools.style.color = "#8b93a3");
+  tools.addEventListener("click", () => togglePageTools(options, raekke));
+  raekke.append(badge, tools);
+  document.body.appendChild(raekke);
+}
+async function hentDoc(collection, slug, token, options) {
+  const res = await fetch(`${options.cmsBaseUrl}/api/cms/${collection}/${slug}?site=${options.siteId}`, {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) throw new Error(`GET failed: ${res.status}`);
+  const doc = await res.json();
+  return JSON.parse(JSON.stringify(doc.data ?? {}));
+}
+async function gemDoc(collection, slug, data, token, options) {
+  const res = await fetch(`${options.cmsBaseUrl}/api/cms/${collection}/${slug}?site=${options.siteId}`, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ data })
+  });
+  if (!res.ok) throw new Error(`PATCH failed: ${res.status}`);
+}
+function togglePageTools(options, forankring) {
+  const \u00E5ben = document.querySelector("[data-cms-inline-edit-tools-popup]");
+  if (\u00E5ben) {
+    \u00E5ben.remove();
+    return;
+  }
+  const token = getConnectedToken(options);
+  if (!token) return;
+  const ankre = Array.from(
+    document.querySelectorAll("[data-cms-field]")
+  ).map((el) => {
+    const a = {};
+    if (el.dataset.cmsCollection) a.collection = el.dataset.cmsCollection;
+    if (el.dataset.cmsSlug) a.slug = el.dataset.cmsSlug;
+    return a;
+  });
+  const ref = primaryDocRef(ankre);
+  if (!ref) return;
+  const popup = document.createElement("div");
+  popup.setAttribute("data-cms-inline-edit-tools-popup", "");
+  popup.setAttribute("data-testid", "page-tools-popup");
+  popup.style.cssText = "position:fixed;bottom:56px;left:16px;z-index:2147483647;background:#1c2027;border:1px solid #3a3f4a;border-radius:12px;padding:10px;min-width:230px;box-shadow:0 8px 32px rgba(0,0,0,.5);font-family:system-ui,sans-serif;color:#fff;display:flex;flex-direction:column;gap:8px;";
+  const featRow = document.createElement("button");
+  featRow.type = "button";
+  featRow.setAttribute("data-testid", "page-tools-featured");
+  featRow.style.cssText = "display:flex;align-items:center;gap:8px;background:rgba(255,255,255,.04);border:1px solid #3a3f4a;border-radius:9px;padding:8px 10px;font:600 12px system-ui,sans-serif;color:#fff;cursor:pointer;text-align:left;";
+  featRow.textContent = "\u2605 Featured";
+  featRow.disabled = true;
+  popup.appendChild(featRow);
+  const visFeatured = (til) => {
+    featRow.style.borderColor = til ? "#00b2ff" : "#3a3f4a";
+    featRow.style.color = til ? "#40c8ff" : "#fff";
+    featRow.style.background = til ? "rgba(0,178,255,.13)" : "rgba(255,255,255,.04)";
+  };
+  let featured = false;
+  void hentDoc(ref.collection, ref.slug, token, options).then((data) => {
+    featured = data.featured === true;
+    visFeatured(featured);
+    featRow.disabled = false;
+  }).catch(() => {
+    featRow.textContent = "\u2605 Featured \u2014 kunne ikke l\xE6ses";
+  });
+  featRow.addEventListener("click", async () => {
+    featRow.disabled = true;
+    try {
+      const data = await hentDoc(ref.collection, ref.slug, token, options);
+      data.featured = !(data.featured === true);
+      await gemDoc(ref.collection, ref.slug, data, token, options);
+      const frisk = await hentDoc(ref.collection, ref.slug, token, options);
+      featured = frisk.featured === true;
+      visFeatured(featured);
+    } catch {
+      featRow.style.borderColor = "#f3522c";
+    } finally {
+      featRow.disabled = false;
+    }
+  });
+  const tagRow = document.createElement("div");
+  tagRow.style.cssText = "display:flex;align-items:center;gap:6px;";
+  const plus = document.createElement("button");
+  plus.type = "button";
+  plus.setAttribute("data-testid", "page-tools-tags-plus");
+  plus.style.cssText = "background:rgba(255,255,255,.04);border:1px solid #3a3f4a;border-radius:9px;padding:8px 12px;color:#fff;font:600 12px system-ui,sans-serif;cursor:pointer;";
+  plus.textContent = "# Tags +";
+  const felt = document.createElement("input");
+  felt.type = "text";
+  felt.placeholder = "tag1, tag2, tag3";
+  felt.setAttribute("data-testid", "page-tools-tags-input");
+  felt.style.cssText = "flex:1;min-width:0;display:none;background:#12151a;border:1px solid #3a3f4a;border-radius:8px;padding:7px 9px;color:#fff;font:12px system-ui,sans-serif;outline:none;";
+  const gem = document.createElement("button");
+  gem.type = "button";
+  gem.setAttribute("data-testid", "page-tools-tags-gem");
+  gem.style.cssText = "display:none;background:#00b2ff;border:none;border-radius:8px;padding:7px 11px;color:#04222f;font:700 12px system-ui,sans-serif;cursor:pointer;";
+  gem.textContent = "Gem";
+  plus.addEventListener("click", () => {
+    plus.style.display = "none";
+    felt.style.display = "block";
+    gem.style.display = "inline-block";
+    felt.focus();
+  });
+  const gemTags = async () => {
+    const nye = parseTags(felt.value);
+    if (!nye.length) return;
+    gem.disabled = true;
+    gem.textContent = "\u2026";
+    try {
+      const data = await hentDoc(ref.collection, ref.slug, token, options);
+      data.tags = mergeTags(data.tags, nye);
+      await gemDoc(ref.collection, ref.slug, data, token, options);
+      const frisk = await hentDoc(ref.collection, ref.slug, token, options);
+      const holdt = Array.isArray(frisk.tags) && nye.every((t) => frisk.tags.some((e) => String(e).toLowerCase() === t.toLowerCase()));
+      gem.textContent = holdt ? "Gemt \u2713" : "Fejl";
+      if (holdt) {
+        felt.value = "";
+        setTimeout(() => {
+          gem.textContent = "Gem";
+          gem.disabled = false;
+        }, 1200);
+      } else {
+        gem.disabled = false;
+      }
+    } catch {
+      gem.textContent = "Fejl";
+      gem.disabled = false;
+    }
+  };
+  gem.addEventListener("click", () => void gemTags());
+  felt.addEventListener("keydown", (e) => {
+    if (e.key === "Enter") {
+      e.preventDefault();
+      void gemTags();
+    }
+  });
+  tagRow.append(plus, felt, gem);
+  popup.appendChild(tagRow);
+  const lukP\u00E5Klik = (e) => {
+    if (!popup.contains(e.target) && !forankring.contains(e.target)) luk();
+  };
+  const lukP\u00E5Esc = (e) => {
+    if (e.key === "Escape") luk();
+  };
+  const luk = () => {
+    popup.remove();
+    document.removeEventListener("mousedown", lukP\u00E5Klik);
+    document.removeEventListener("keydown", lukP\u00E5Esc);
+  };
+  setTimeout(() => {
+    document.addEventListener("mousedown", lukP\u00E5Klik);
+    document.addEventListener("keydown", lukP\u00E5Esc);
+  }, 0);
+  document.body.appendChild(popup);
 }
 function decodeJwtPayload(token) {
   try {
@@ -1228,13 +1467,19 @@ export {
   applyFieldSlice,
   buildConnectUrl,
   disconnect,
+  extractLinkTargets,
   getConnectedToken,
   htmlToMarkdown,
   initInlineEdit,
+  isBareEmail,
+  isDangerousUrl,
+  isExternalHost,
+  isSchemeless,
   positionPopover,
   renderCurrentRefLine,
   rescanFields,
   resolveExistingRef,
-  setLinkTarget
+  setLinkTarget,
+  withHttps
 };
 //# sourceMappingURL=index.js.map