@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/template-resolver/constants.d.ts

@@ -1,17 +1,26 @@
-export declare const RENDER_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot"];
+export declare const RENDER_KINDS: readonly ["mail", "document-pdf", "image-snapshot"];
 export type RenderKind = (typeof RENDER_KINDS)[number];
-export declare const NON_RENDER_KINDS: readonly ["text-block", "ai-prompt"];
+export declare const DOCUMENT_HTML_KINDS: readonly ["mail", "document-pdf"];
+export type DocumentHtmlKind = (typeof DOCUMENT_HTML_KINDS)[number];
+export declare const NON_RENDER_KINDS: readonly ["notification", "text-block", "snippet", "ai-prompt", "mail-layout", "pdf-layout"];
 export type NonRenderKind = (typeof NON_RENDER_KINDS)[number];
-export declare const TEMPLATE_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot", "text-block", "ai-prompt"];
+export declare const TEMPLATE_KINDS: readonly ["mail", "document-pdf", "image-snapshot", "notification", "text-block", "snippet", "ai-prompt", "mail-layout", "pdf-layout"];
 export type TemplateKind = (typeof TEMPLATE_KINDS)[number];
-export declare const UPSERT_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot", "ai-prompt"];
+export declare const UPSERT_KINDS: readonly ["mail", "document-pdf", "image-snapshot", "ai-prompt", "mail-layout", "pdf-layout"];
 export type UpsertKind = (typeof UPSERT_KINDS)[number];
 export declare const TEXT_BLOCK_KIND: "text-block";
+export declare const COLLECTION_REFUSED_KINDS: readonly string[];
 export declare const CONTENT_FORMATS: readonly ["markdown", "mjml", "html", "plain"];
 export type ContentFormat = (typeof CONTENT_FORMATS)[number];
 export declare const TEMPLATE_SCOPES: readonly ["system", "tenant"];
 export type TemplateScope = (typeof TEMPLATE_SCOPES)[number];
 export declare const TEMPLATE_STATUSES: readonly ["draft", "active", "archived"];
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
+export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, } from "./pdf-constants.js";
+export declare const HEX_COLOR_PATTERN: RegExp;
+export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
+export declare const MAIL_PREVIEW_MAX_BYTES: number;
+export declare const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
+export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";

package/dist/template-resolver/constants.js

@@ -6,30 +6,52 @@
 // Plugin-Renderer in `renderer-foundation` matchen auf kind; der
 // Resolver hier ist kind-agnostisch — er lädt nur, das Content-Format
 // (markdown/mjml/html) entscheidet wer's rendert.
-export const RENDER_KINDS = [
+export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"];
+// Kinds whose html body is a rich document: the server rebuilds it through the
+// document schema on every write (see document-sanitizer.ts).
+export const DOCUMENT_HTML_KINDS = ["mail", "document-pdf"];
+// Kinds without a renderer plugin: `notification` is the retired sections-JSON
+// notification kind, kept so rows stored before mails moved to `mail` stay
+// valid on replay; nothing writes or renders it any more. `text-block` is the Markdown text store
+// (ex text-content feature), `snippet` is the content of app collections such
+// as reply snippets and signatures (own kind so they stay out of the text-block
+// content tree), `ai-prompt` holds LLM prompts, `mail-layout` and
+// `pdf-layout` hold the frame a mail/pdf body is rendered into. All are read,
+// not rendered on their own — keeping them out of RENDER_KINDS is what stops
+// DEFAULT_PLUGIN_BY_KIND from demanding a plugin for them.
+export const NON_RENDER_KINDS = [
     "notification",
-    "mail-html",
-    "document-pdf",
-    "image-snapshot",
+    "text-block",
+    "snippet",
+    "ai-prompt",
+    "mail-layout",
+    "pdf-layout",
 ];
-// Kinds without a renderer plugin: `text-block` is the Markdown text store
-// (ex text-content feature), `ai-prompt` holds LLM prompts. Both are read,
-// not rendered — keeping them out of RENDER_KINDS is what stops
-// DEFAULT_PLUGIN_BY_KIND from demanding a plugin for them.
-export const NON_RENDER_KINDS = ["text-block", "ai-prompt"];
 // Full kind domain of the entity; RENDER_KINDS is the renderer-foundation subset.
 export const TEMPLATE_KINDS = [...RENDER_KINDS, ...NON_RENDER_KINDS];
 // Kinds written through upsertSystem/upsertTenant. `text-block` is absent on
 // purpose: it goes through set.write (title + folder tree); two write paths
 // onto the same row would drift apart.
-export const UPSERT_KINDS = [...RENDER_KINDS, "ai-prompt"];
+export const UPSERT_KINDS = [...RENDER_KINDS, "ai-prompt", "mail-layout", "pdf-layout"];
 // The only kind served by the anonymous-capable by-slug/by-tenant queries and
 // by set.write — mail templates and AI prompts are operational internals and
 // must not leak through the anonymous path.
 export const TEXT_BLOCK_KIND = "text-block";
+// Kinds a content collection must not write: a tenant row of these kinds would
+// shadow the system notification template or layout without the meta and
+// placeholder gates that upsertTenant applies.
+export const COLLECTION_REFUSED_KINDS = ["mail", "mail-layout", "pdf-layout"];
 export const CONTENT_FORMATS = ["markdown", "mjml", "html", "plain"];
 export const TEMPLATE_SCOPES = ["system", "tenant"];
 export const TEMPLATE_STATUSES = ["draft", "active", "archived"];
+export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.js";
+// Colors end up inside MJML attributes, so only a strict hex is ever written there.
+export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
+export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
+// The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
+export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
+export const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
+export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 // System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.
 // Re-Export aus framework — single source of truth, vermeidet Drift.
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";

package/dist/template-resolver/document-sanitizer.d.ts

@@ -0,0 +1,32 @@
+import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
+import { type Element as ScanElement } from "happy-dom";
+import type { ContentFormat } from "./constants.js";
+export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
+export type DocumentViolation = {
+    readonly code: DocumentViolationCode;
+    readonly detail: string;
+    readonly message: string;
+};
+export type SanitizeHtmlResult = {
+    readonly ok: true;
+    readonly html: string;
+} | {
+    readonly ok: false;
+    readonly violations: readonly DocumentViolation[];
+};
+export type SanitizeBodyResult = {
+    readonly ok: true;
+    readonly content: string | null;
+} | {
+    readonly ok: false;
+    readonly violations: readonly DocumentViolation[];
+};
+export declare function violation(code: DocumentViolationCode, detail: string, message: string): DocumentViolation;
+export declare function withParsedDocument<T>(html: string, read: (body: ScanElement) => T): T;
+export declare function sanitizeDocumentHtml(html: string): SanitizeHtmlResult;
+export declare function sanitizeTemplateBody(input: {
+    readonly kind: string;
+    readonly contentFormat: ContentFormat;
+    readonly content: string | null;
+}): SanitizeBodyResult;
+export declare function documentViolationsToFieldIssues(violations: readonly DocumentViolation[]): FieldIssue[];

package/dist/template-resolver/document-sanitizer.js

@@ -0,0 +1,201 @@
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { generateHTML, generateJSON } from "@tiptap/html/server";
+import { Window } from "happy-dom";
+import { DOCUMENT_HTML_KINDS } from "./constants.js";
+import { documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+export function violation(code, detail, message) {
+    return { code, detail, message };
+}
+// Same switches tiptap's generateJSON uses, plus navigation off: the scan
+// window must never fetch or navigate anything.
+function createScanWindow() {
+    return new Window({
+        settings: {
+            disableJavaScriptEvaluation: true,
+            disableJavaScriptFileLoading: true,
+            disableCSSFileLoading: true,
+            disableIframePageLoading: true,
+            disableComputedStyleRendering: true,
+            navigation: {
+                disableMainFrameNavigation: true,
+                disableChildFrameNavigation: true,
+                disableChildPageNavigation: true,
+            },
+        },
+    });
+}
+function scanScriptAndHandlers(tag, element, out) {
+    if (tag === "script") {
+        out.push(violation("script_element", "script", "<script> elements are not allowed in template bodies"));
+    }
+    for (const attribute of Array.from(element.attributes)) {
+        if (/^on/i.test(attribute.name)) {
+            out.push(violation("event_handler_attribute", attribute.name, `Inline event handler "${attribute.name}" on <${tag}> is not allowed`));
+        }
+    }
+}
+function scanAnchor(element, out) {
+    const href = element.getAttribute("href");
+    if (href !== null && !isAllowedDocumentLinkHref(href)) {
+        out.push(violation("disallowed_link_href", href, `Link target "${href}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
+    }
+    if (element.hasAttribute("data-button") && !isDocumentPlaceholderHref(href ?? "")) {
+        out.push(violation("button_href_not_placeholder", href ?? "", `Button target "${href ?? ""}" must be a {{placeholder}}`));
+    }
+}
+function scanImage(element, out) {
+    const source = element.getAttribute("src") ?? element.getAttribute("srcset");
+    if (source !== null) {
+        out.push(violation("external_image_source", source, `Images must reference an uploaded resource via data-resource; external or inline image source "${source}" is not allowed`));
+    }
+    if (!element.hasAttribute("data-resource")) {
+        out.push(violation("image_without_resource", "img", "Images must reference an uploaded resource via the data-resource attribute"));
+    }
+}
+const REFERENCE_ATTRIBUTES = [
+    ["data-variable", isDocumentReferenceName],
+    ["data-each", isDocumentReferenceName],
+    ["data-resource", isDocumentResourceKey],
+];
+function scanReferences(tag, element, out) {
+    for (const [attribute, isValid] of REFERENCE_ATTRIBUTES) {
+        const value = element.getAttribute(attribute);
+        if (value !== null && !isValid(value)) {
+            out.push(violation("invalid_reference_name", value, `Value "${value}" of ${attribute} on <${tag}> is not a valid name`));
+        }
+    }
+}
+const EMBEDDING_TAGS = new Set([
+    "iframe",
+    "frame",
+    "frameset",
+    "object",
+    "embed",
+    "applet",
+    "portal",
+]);
+const SVG_IMAGE_TAGS = new Set(["image", "feimage", "use"]);
+const URL_ATTRIBUTES = ["href", "xlink:href", "action", "formaction"];
+function scanEmbedding(tag, out) {
+    if (EMBEDDING_TAGS.has(tag)) {
+        out.push(violation("embedded_content", tag, `<${tag}> elements are not allowed in template bodies`));
+    }
+}
+// html <a href> has its own rules in scanAnchor; everywhere else (svg, base,
+// form controls) a URL attribute has no business in a template body.
+function scanUrlAttributes(tag, element, out) {
+    for (const name of URL_ATTRIBUTES) {
+        const value = element.getAttribute(name);
+        if (value === null || (tag === "a" && name === "href"))
+            continue;
+        if (SVG_IMAGE_TAGS.has(tag) && name.endsWith("href")) {
+            out.push(violation("external_image_source", value, `Images must reference an uploaded resource via data-resource; image source "${value}" is not allowed`));
+        }
+        else if (tag === "base" || !isAllowedDocumentLinkHref(value)) {
+            out.push(violation("disallowed_link_href", value, `Link target "${value}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
+        }
+    }
+}
+// happy-dom serializes < and > inside attribute values unescaped, so a later
+// parser (MJML) could read them as markup.
+function scanAltText(element, out) {
+    const alt = element.getAttribute("alt");
+    if (alt !== null && /[<>]/.test(alt)) {
+        out.push(violation("unsafe_attribute_value", alt, `Attribute alt must not contain "<" or ">": "${alt}"`));
+    }
+}
+function scanElement(element, out) {
+    const tag = element.tagName.toLowerCase();
+    scanEmbedding(tag, out);
+    scanUrlAttributes(tag, element, out);
+    scanAltText(element, out);
+    scanScriptAndHandlers(tag, element, out);
+    if (tag === "a")
+        scanAnchor(element, out);
+    if (tag === "img")
+        scanImage(element, out);
+    scanReferences(tag, element, out);
+}
+// Parses `html` in the hardened scan window and always closes it again, also
+// when `read` throws. Shared by the sanitizer and the placeholder scan so there
+// is exactly one DOM setup.
+export function withParsedDocument(html, read) {
+    const window = createScanWindow();
+    try {
+        const parsed = new window.DOMParser().parseFromString(["<!DOCTYPE html><html><body>", html, "</body></html>"].join(""), "text/html");
+        return read(parsed.body);
+    }
+    finally {
+        window.happyDOM.abort();
+        window.happyDOM.close();
+    }
+}
+function scanDocumentHtml(html) {
+    const violations = [];
+    withParsedDocument(html, (body) => {
+        // A second `<body ...>` in the input merges its attributes into this body.
+        for (const element of [body, ...Array.from(body.querySelectorAll("*"))]) {
+            scanElement(element, violations);
+        }
+    });
+    return violations;
+}
+// Rejects hostile constructs, then rebuilds the body from the document model.
+// The rebuilt HTML is always what gets returned (never the input), so anything
+// the model cannot express is dropped silently.
+export function sanitizeDocumentHtml(html) {
+    const violations = scanDocumentHtml(html);
+    if (violations.length > 0)
+        return { ok: false, violations };
+    return {
+        ok: true,
+        html: generateHTML(generateJSON(html, documentExtensions), documentExtensions),
+    };
+}
+// Snippets accept any format, but their html is as untrusted as a mail body.
+function isSanitizedHtmlKind(kind) {
+    return kind === "snippet" || isOneOf(DOCUMENT_HTML_KINDS, kind);
+}
+const HTML_ONLY_KINDS = new Set(DOCUMENT_HTML_KINDS);
+function requiredFormatViolation(kind, contentFormat) {
+    if (HTML_ONLY_KINDS.has(kind) && contentFormat !== "html") {
+        return violation("document_requires_html_format", contentFormat, `Templates of kind ${kind} require contentFormat html, got "${contentFormat}"`);
+    }
+    return null;
+}
+export function sanitizeTemplateBody(input) {
+    const formatViolation = requiredFormatViolation(input.kind, input.contentFormat);
+    if (formatViolation !== null)
+        return { ok: false, violations: [formatViolation] };
+    if (!isSanitizedHtmlKind(input.kind) ||
+        input.contentFormat !== "html" ||
+        input.content === null) {
+        return { ok: true, content: input.content };
+    }
+    const result = sanitizeDocumentHtml(input.content);
+    return result.ok ? { ok: true, content: result.html } : result;
+}
+const VIOLATION_I18N_KEYS = {
+    script_element: "templateResolver.errors.document.scriptElement",
+    event_handler_attribute: "templateResolver.errors.document.eventHandlerAttribute",
+    disallowed_link_href: "templateResolver.errors.document.disallowedLinkHref",
+    external_image_source: "templateResolver.errors.document.externalImageSource",
+    image_without_resource: "templateResolver.errors.document.imageWithoutResource",
+    invalid_reference_name: "templateResolver.errors.document.invalidReferenceName",
+    embedded_content: "templateResolver.errors.document.embeddedContent",
+    unsafe_attribute_value: "templateResolver.errors.document.unsafeAttributeValue",
+    button_href_not_placeholder: "templateResolver.errors.document.buttonHrefNotPlaceholder",
+    document_requires_html_format: "templateResolver.errors.document.documentRequiresHtmlFormat",
+    layout_requires_mjml_format: "templateResolver.errors.document.layoutRequiresMjmlFormat",
+    layout_invalid_structure: "templateResolver.errors.document.layoutInvalidStructure",
+    layout_missing_content_slot: "templateResolver.errors.document.layoutMissingContentSlot",
+    layout_source_system_only: "templateResolver.errors.document.layoutSourceSystemOnly",
+};
+export function documentViolationsToFieldIssues(violations) {
+    return violations.map((item) => ({
+        path: "content",
+        code: item.code,
+        i18nKey: VIOLATION_I18N_KEYS[item.code],
+        params: { detail: item.detail },
+    }));
+}

package/dist/template-resolver/document-schema.d.ts

@@ -0,0 +1,21 @@
+import { Extension, type Extensions, Node } from "@tiptap/core";
+export declare function isDocumentPlaceholderHref(href: string): boolean;
+export declare function isAllowedDocumentLinkHref(href: string): boolean;
+export declare function isDocumentReferenceName(value: string): boolean;
+export declare function isDocumentResourceKey(value: string): boolean;
+export declare const DOCUMENT_NODE_NAMES: readonly ["variable", "resource", "button", "divider", "pageBreak"];
+export declare const DocumentVariable: Node<any, any>;
+export declare const DocumentResource: Node<any, any>;
+export declare const DocumentButton: Node<any, any>;
+export declare const DocumentDivider: Node<any, any>;
+export declare const DocumentPageBreak: Node<any, any>;
+export declare const DocumentTableRow: Node<import("@tiptap/extension-table").TableRowOptions, any>;
+export declare const DocumentTable: Node<import("@tiptap/extension-table").TableOptions, any>;
+export declare const DocumentTableCell: Node<import("@tiptap/extension-table").TableCellOptions, any>;
+export declare const DocumentTableHeader: Node<import("@tiptap/extension-table").TableHeaderOptions, any>;
+export declare const DocumentLink: import("@tiptap/core").Mark<import("@tiptap/extension-link").LinkOptions, any>;
+export declare const DOCUMENT_TEXT_ALIGNMENTS: readonly ["left", "center", "right", "justify"];
+export type DocumentTextAlignment = (typeof DOCUMENT_TEXT_ALIGNMENTS)[number];
+export declare const DocumentTextAlign: Extension<any, any>;
+export declare const DocumentTextSize: Extension<any, any>;
+export declare const documentExtensions: Extensions;

package/dist/template-resolver/document-schema.js

@@ -0,0 +1,316 @@
+// @runtime client
+// Canonical document model for template bodies (kinds mail, document-pdf).
+// Universal on purpose: the web editor and the server sanitizer load the same
+// extension list, so what the editor can produce is exactly what the server
+// keeps. No DOM access at module level, no happy-dom here.
+import { isOneOf, isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { Extension, Node } from "@tiptap/core";
+import { Link } from "@tiptap/extension-link";
+import { Table, TableCell, TableHeader, TableRow } from "@tiptap/extension-table";
+import StarterKit from "@tiptap/starter-kit";
+const PLACEHOLDER_HREF = /^\{\{(.+)\}\}$/;
+const REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+const RESOURCE_KEY = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+const ALLOWED_LINK_SCHEMES = ["https://", "http://", "mailto:", "tel:"];
+export function isDocumentPlaceholderHref(href) {
+    const name = PLACEHOLDER_HREF.exec(href)?.[1];
+    return name !== undefined && isDocumentReferenceName(name);
+}
+const UNSAFE_URL_CHARACTERS = new Set(["<", ">", '"']);
+const FORBIDDEN_REFERENCE_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+function hasUnsafeUrlCharacter(value) {
+    return Array.from(value).some((character) => {
+        const code = character.charCodeAt(0);
+        return UNSAFE_URL_CHARACTERS.has(character) || code <= 0x1f || code === 0x7f;
+    });
+}
+function isParsableWebUrl(href, protocol) {
+    try {
+        return new URL(href).protocol === protocol;
+    }
+    catch {
+        return false;
+    }
+}
+function hasAllowedLinkScheme(href) {
+    if (href.startsWith("https://"))
+        return isParsableWebUrl(href, "https:");
+    if (href.startsWith("http://"))
+        return isParsableWebUrl(href, "http:");
+    return ALLOWED_LINK_SCHEMES.some((scheme) => href.startsWith(scheme));
+}
+// Exact lowercase prefix on the unchanged value: no trim, no case folding, so
+// "JaVaScRiPt:", "HTTPS://" or a leading tab can never slip through as a
+// scheme variant. Markup and control characters are refused outright because
+// downstream parsers (MJML, PDF renderer) re-read the serialized attribute.
+export function isAllowedDocumentLinkHref(href) {
+    if (hasUnsafeUrlCharacter(href))
+        return false;
+    return hasAllowedLinkScheme(href) || isDocumentPlaceholderHref(href);
+}
+// Segments that hit the prototype chain are refused: the renderer later walks
+// the dotted path into a data object.
+export function isDocumentReferenceName(value) {
+    return (REFERENCE_NAME.test(value) &&
+        !value.split(".").some((segment) => FORBIDDEN_REFERENCE_SEGMENTS.has(segment)));
+}
+export function isDocumentResourceKey(value) {
+    return RESOURCE_KEY.test(value);
+}
+export const DOCUMENT_NODE_NAMES = [
+    "variable",
+    "resource",
+    "button",
+    "divider",
+    "pageBreak",
+];
+export const DocumentVariable = Node.create({
+    name: "variable",
+    group: "inline",
+    inline: true,
+    atom: true,
+    addAttributes() {
+        return { name: { default: null } };
+    },
+    parseHTML() {
+        return [
+            {
+                tag: "span[data-variable]",
+                getAttrs: (element) => {
+                    const name = element.getAttribute("data-variable");
+                    return name !== null && isDocumentReferenceName(name) ? { name } : false;
+                },
+            },
+        ];
+    },
+    renderHTML({ node }) {
+        return ["span", { "data-variable": node.attrs["name"] }];
+    },
+});
+export const DocumentResource = Node.create({
+    name: "resource",
+    group: "block",
+    atom: true,
+    addAttributes() {
+        return { resource: { default: null }, alt: { default: null } };
+    },
+    parseHTML() {
+        return [
+            {
+                tag: "img[data-resource]",
+                getAttrs: (element) => {
+                    const resource = element.getAttribute("data-resource");
+                    if (resource === null || !isDocumentResourceKey(resource))
+                        return false;
+                    return { resource, alt: element.getAttribute("alt") };
+                },
+            },
+        ];
+    },
+    // Never emits src: the renderer resolves the resource key at render time.
+    renderHTML({ node }) {
+        const alt = node.attrs["alt"];
+        return [
+            "img",
+            alt === null || alt === undefined
+                ? { "data-resource": node.attrs["resource"] }
+                : { "data-resource": node.attrs["resource"], alt },
+        ];
+    },
+});
+export const DocumentButton = Node.create({
+    name: "button",
+    group: "block",
+    content: "text*",
+    marks: "",
+    defining: true,
+    addAttributes() {
+        return { href: { default: null } };
+    },
+    parseHTML() {
+        return [
+            {
+                tag: "a[data-button]",
+                // Must win against the Link mark's `a[href]` rule.
+                priority: 1000,
+                getAttrs: (element) => {
+                    const href = element.getAttribute("href");
+                    return href !== null && isDocumentPlaceholderHref(href) ? { href } : false;
+                },
+            },
+        ];
+    },
+    renderHTML({ node }) {
+        return ["a", { "data-button": "", href: node.attrs["href"] }, 0];
+    },
+});
+export const DocumentDivider = Node.create({
+    name: "divider",
+    group: "block",
+    atom: true,
+    parseHTML() {
+        return [{ tag: "hr" }];
+    },
+    renderHTML() {
+        return ["hr"];
+    },
+});
+export const DocumentPageBreak = Node.create({
+    name: "pageBreak",
+    group: "block",
+    atom: true,
+    parseHTML() {
+        return [{ tag: "div[data-page-break]" }];
+    },
+    renderHTML() {
+        return ["div", { "data-page-break": "" }];
+    },
+});
+// A repeat row is a table row carrying `each`: prosemirror-tables requires
+// the tableRow node type, so a separate node type is not an option.
+export const DocumentTableRow = TableRow.extend({
+    addAttributes() {
+        return {
+            each: {
+                default: null,
+                parseHTML: (element) => {
+                    const each = element.getAttribute("data-each");
+                    return each !== null && isDocumentReferenceName(each) ? each : null;
+                },
+                renderHTML: (attributes) => {
+                    const each = attributes["each"];
+                    return typeof each === "string" && each ? { "data-each": each } : {};
+                },
+            },
+            repeatHeader: {
+                default: false,
+                parseHTML: (element) => element.hasAttribute("data-repeat-header"),
+                renderHTML: (attributes) => attributes["repeatHeader"] ? { "data-repeat-header": "" } : {},
+            },
+        };
+    },
+});
+export const DocumentTable = Table.extend({
+    renderHTML() {
+        return ["table", ["tbody", 0]];
+    },
+});
+// Span attributes are rendered only when they differ from the default, and
+// colwidth (an editor-resize artefact) never, so `<td><p>x</p></td>` is the
+// canonical cell.
+function plainObjectOrEmpty(value) {
+    return isPlainObject(value) ? value : {};
+}
+function canonicalCellAttributes(attributes) {
+    return {
+        ...attributes,
+        colspan: {
+            ...plainObjectOrEmpty(attributes["colspan"]),
+            renderHTML: (attrs) => attrs["colspan"] && attrs["colspan"] !== 1 ? { colspan: attrs["colspan"] } : {},
+        },
+        rowspan: {
+            ...plainObjectOrEmpty(attributes["rowspan"]),
+            renderHTML: (attrs) => attrs["rowspan"] && attrs["rowspan"] !== 1 ? { rowspan: attrs["rowspan"] } : {},
+        },
+        colwidth: {
+            ...plainObjectOrEmpty(attributes["colwidth"]),
+            renderHTML: () => ({}),
+        },
+    };
+}
+export const DocumentTableCell = TableCell.extend({
+    addAttributes() {
+        return canonicalCellAttributes(this.parent?.() ?? {});
+    },
+});
+export const DocumentTableHeader = TableHeader.extend({
+    addAttributes() {
+        return canonicalCellAttributes(this.parent?.() ?? {});
+    },
+});
+// Only href survives a parse: target, rel, class and title from the input would
+// otherwise be kept verbatim, and the renderer decides those itself.
+export const DocumentLink = Link.extend({
+    addAttributes() {
+        return { href: { default: null, parseHTML: (element) => element.getAttribute("href") } };
+    },
+});
+export const DOCUMENT_TEXT_ALIGNMENTS = ["left", "center", "right", "justify"];
+// Serialized as data-align, never as a style attribute: the sanitizer keeps
+// styles out of the model, and each renderer maps the value to its own CSS.
+export const DocumentTextAlign = Extension.create({
+    name: "documentTextAlign",
+    addGlobalAttributes() {
+        return [
+            {
+                types: ["paragraph", "heading"],
+                attributes: {
+                    textAlign: {
+                        default: null,
+                        parseHTML: (element) => {
+                            const align = element.getAttribute("data-align");
+                            return isOneOf(DOCUMENT_TEXT_ALIGNMENTS, align) ? align : null;
+                        },
+                        renderHTML: (attributes) => {
+                            const align = attributes["textAlign"];
+                            return isOneOf(DOCUMENT_TEXT_ALIGNMENTS, align) ? { "data-align": align } : {};
+                        },
+                    },
+                },
+            },
+        ];
+    },
+});
+// Only "small" exists: the sender line above an address block. Serialized as data-size for the
+// same reason as data-align.
+export const DocumentTextSize = Extension.create({
+    name: "documentTextSize",
+    addGlobalAttributes() {
+        return [
+            {
+                types: ["paragraph"],
+                attributes: {
+                    textSize: {
+                        default: null,
+                        parseHTML: (element) => element.getAttribute("data-size") === "small" ? "small" : null,
+                        renderHTML: (attributes) => attributes["textSize"] === "small" ? { "data-size": "small" } : {},
+                    },
+                },
+            },
+        ];
+    },
+});
+export const documentExtensions = [
+    StarterKit.configure({
+        blockquote: false,
+        code: false,
+        codeBlock: false,
+        strike: false,
+        horizontalRule: false,
+        dropcursor: false,
+        gapcursor: false,
+        undoRedo: false,
+        trailingNode: false,
+        listKeymap: false,
+        heading: { levels: [1, 2, 3] },
+        link: false,
+    }),
+    DocumentLink.configure({
+        openOnClick: false,
+        autolink: false,
+        linkOnPaste: false,
+        HTMLAttributes: { target: null, rel: null, class: null },
+        isAllowedUri: (url) => isAllowedDocumentLinkHref(url),
+    }),
+    DocumentTable,
+    DocumentTableRow,
+    DocumentTableHeader,
+    DocumentTableCell,
+    DocumentVariable,
+    DocumentResource,
+    DocumentButton,
+    DocumentDivider,
+    DocumentPageBreak,
+    DocumentTextAlign,
+    DocumentTextSize,
+];