@drawbridge/drawbridge-utils 0.0.160 → 0.0.162

package/dist/html.cjs

@@ -0,0 +1,29 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/html.js
+var html_exports = {};
+__export(html_exports, {
+  escapeHtml: () => escapeHtml
+});
+module.exports = __toCommonJS(html_exports);
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  escapeHtml
+});

package/dist/html.d.cts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.d.ts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.js

@@ -0,0 +1,5 @@
+// lib/html.js
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+export {
+  escapeHtml
+};

package/dist/notification.cjs

@@ -77,16 +77,12 @@ var messageWarnings = ({ message }) => {
 };
 var notificationWarnings = ({
   brand,
-  channel = "email",
   message,
   subject
-} = {}) => {
-  if (channel !== "email") return { message: [], subject: [] };
-  return {
-    message: messageWarnings({ message }),
-    subject: subjectWarnings({ brand, subject })
-  };
-};
+} = {}) => ({
+  message: messageWarnings({ message }),
+  subject: subjectWarnings({ brand, subject })
+});
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   notificationWarnings

package/dist/notification.d.cts

@@ -131,25 +131,32 @@ const messageWarnings = ({ message }) => {
 // ONE ENTRY POINT, answering per field so each warning renders against the
 // input it is about rather than as a pile at the bottom of the form.
 //
-// `channel` is accepted and only 'email' is implemented. SMS is a genuinely
-// different problem — carriers filter on SHAFT categories, link shorteners and
-// opt-out wording, none of which these rules look at — and returning email
-// advice for an SMS would be confidently wrong. It returns nothing instead,
-// until someone writes the carrier rules properly.
+// NO CHANNEL ARGUMENT, deliberately, and it is worth saying why since one was
+// tried twice.
+//
+// First it gated SMS to silence, on the grounds that carriers filter on things
+// these rules do not look at. That much is true, and it does not follow:
+// shouting, repeated punctuation, currency amounts and scam-shaped phrasing
+// matter at least as much on a phone, and an unbranded text is the exact shape
+// of a smishing attempt. Then a hedge value was added for copy that could go
+// either way, a caller passed it to a build that did not have it, and a whole
+// form went quiet with nothing to show for the caution.
+//
+// Every rule here is one a person would want to hear wherever the words end up.
+// Sorting them by channel bought accuracy on a single warning — the subject
+// display limit, which is really an email idea — and cost the other six.
+//
+// SMS still has no rules of its OWN: SHAFT categories, link shorteners, opt-out
+// wording, and the segment mechanics where one emoji drops the limit from 160
+// characters to 70. Those belong with the SMS connection work rather than here,
+// and their absence is a reason to write them, not to stay quiet meanwhile.
 const notificationWarnings = ({
 	brand,
-	channel = 'email',
 	message,
 	subject
-} = {}) => {
-
-	if( channel !== 'email' ) return { message : [], subject : [] };
-
-	return {
-		message : messageWarnings({ message }),
-		subject : subjectWarnings({ brand, subject })
-	};
-
-};
+} = {}) => ({
+	message : messageWarnings({ message }),
+	subject : subjectWarnings({ brand, subject })
+});
 
 export { notificationWarnings };

package/dist/notification.d.ts

@@ -131,25 +131,32 @@ const messageWarnings = ({ message }) => {
 // ONE ENTRY POINT, answering per field so each warning renders against the
 // input it is about rather than as a pile at the bottom of the form.
 //
-// `channel` is accepted and only 'email' is implemented. SMS is a genuinely
-// different problem — carriers filter on SHAFT categories, link shorteners and
-// opt-out wording, none of which these rules look at — and returning email
-// advice for an SMS would be confidently wrong. It returns nothing instead,
-// until someone writes the carrier rules properly.
+// NO CHANNEL ARGUMENT, deliberately, and it is worth saying why since one was
+// tried twice.
+//
+// First it gated SMS to silence, on the grounds that carriers filter on things
+// these rules do not look at. That much is true, and it does not follow:
+// shouting, repeated punctuation, currency amounts and scam-shaped phrasing
+// matter at least as much on a phone, and an unbranded text is the exact shape
+// of a smishing attempt. Then a hedge value was added for copy that could go
+// either way, a caller passed it to a build that did not have it, and a whole
+// form went quiet with nothing to show for the caution.
+//
+// Every rule here is one a person would want to hear wherever the words end up.
+// Sorting them by channel bought accuracy on a single warning — the subject
+// display limit, which is really an email idea — and cost the other six.
+//
+// SMS still has no rules of its OWN: SHAFT categories, link shorteners, opt-out
+// wording, and the segment mechanics where one emoji drops the limit from 160
+// characters to 70. Those belong with the SMS connection work rather than here,
+// and their absence is a reason to write them, not to stay quiet meanwhile.
 const notificationWarnings = ({
 	brand,
-	channel = 'email',
 	message,
 	subject
-} = {}) => {
-
-	if( channel !== 'email' ) return { message : [], subject : [] };
-
-	return {
-		message : messageWarnings({ message }),
-		subject : subjectWarnings({ brand, subject })
-	};
-
-};
+} = {}) => ({
+	message : messageWarnings({ message }),
+	subject : subjectWarnings({ brand, subject })
+});
 
 export { notificationWarnings };

package/dist/notification.js

@@ -54,16 +54,12 @@ var messageWarnings = ({ message }) => {
 };
 var notificationWarnings = ({
   brand,
-  channel = "email",
   message,
   subject
-} = {}) => {
-  if (channel !== "email") return { message: [], subject: [] };
-  return {
-    message: messageWarnings({ message }),
-    subject: subjectWarnings({ brand, subject })
-  };
-};
+} = {}) => ({
+  message: messageWarnings({ message }),
+  subject: subjectWarnings({ brand, subject })
+});
 export {
   notificationWarnings
 };

package/package.json

@@ -148,6 +148,11 @@
       "import": "./dist/twilio.js",
       "require": "./dist/twilio.cjs"
     },
+    "./html": {
+      "types": "./dist/html.d.ts",
+      "import": "./dist/html.js",
+      "require": "./dist/html.cjs"
+    },
     "./http": {
       "types": "./dist/http.d.ts",
       "import": "./dist/http.js",
@@ -221,5 +226,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.160"
+  "version": "0.0.162"
 }