@erdemtuna/doc-review 0.8.1 → 0.10.0

package/src/editing.js

@@ -1,99 +0,0 @@
-/**
- * Pure editing helpers, shared by the in-page SDK and Node tests.
- *
- * Everything here is deliberately DOM-free: the SDK feeds in strings and
- * computed-style snapshots, and gets back decisions it can apply.
- */
-
-/**
- * The list command for a marker typed at the start of a line, or null.
- * `lead` is everything between the start of the block and the caret, so a
- * marker typed mid-sentence never converts.
- */
-export function listCommandFor(lead) {
-  const marker = String(lead || "").replace(/\u00a0/g, " ").trim();
-  if (/^[-*]$/.test(marker)) return "insertUnorderedList";
-  if (/^\d{1,3}[.)]$/.test(marker)) return "insertOrderedList";
-  return null;
-}
-
-/**
- * Style properties a fresh list needs when the page's CSS reset hides it.
- * Tailwind preflight and similar resets set `list-style: none` and zero the
- * indent, so a just-created list looks like nothing happened. Returns only
- * the properties that are actually broken, so styled pages stay untouched.
- */
-export function listStyleFixup(tagName, computed) {
-  const patch = {};
-  if (computed.listStyleType === "none") {
-    patch.listStyleType = /^ol$/i.test(tagName) ? "decimal" : "disc";
-  }
-  const inset = (parseFloat(computed.paddingLeft) || 0) + (parseFloat(computed.marginLeft) || 0);
-  if (inset < 16) patch.paddingLeft = "1.5em";
-  return patch;
-}
-
-/**
- * Style a fresh link needs when the page can't distinguish it from prose.
- * Reset stylesheets (`a { color: inherit; text-decoration: inherit }`) make a
- * just-created link invisible; underline it only when neither color nor
- * decoration sets it apart.
- */
-export function linkStyleFixup(anchorComputed, parentComputed) {
-  const decorated = String(anchorComputed.textDecorationLine || "").includes("underline");
-  const recolored = !!parentComputed && anchorComputed.color !== parentComputed.color;
-  return decorated || recolored ? {} : { textDecoration: "underline" };
-}
-
-/**
- * A typed link, made openable and safe. Bare domains get https://, in-page
- * and relative references pass through, and anything with an executable or
- * unknown scheme (javascript:, data:, …) is rejected outright.
- */
-export function normalizeHref(raw) {
-  const href = String(raw || "").replace(/[\u0000-\u001f\u007f]/g, "").trim();
-  if (!href) return "";
-  let candidate = href;
-  if (!/^(https?:|mailto:|tel:|#|\/|\.)/i.test(href)) {
-    const head = href.split(/[/?#]/)[0];
-    if (/^([\w-]+\.)+[\w-]+(:\d+)?$/.test(head) || /^localhost(:\d+)?$/i.test(head)) {
-      // A bare domain — "example.com", "localhost:3000/wiki" — gets a scheme.
-      candidate = `https://${href}`;
-    } else if (/^[a-z][a-z0-9+.-]*:/i.test(href)) {
-      return "";
-    }
-  }
-  try {
-    const parsed = new URL(candidate, "https://relative.invalid");
-    if (!/^(https?:|mailto:|tel:)$/i.test(parsed.protocol)) return "";
-  } catch {
-    return "";
-  }
-  return candidate;
-}
-
-/**
- * Classify an authored navigation target. Relative references stay under
- * controlled source-relative navigation; only explicitly safe external
- * schemes leave the review.
- */
-export function classifyHref(raw) {
-  const href = String(raw || "").replace(/[\u0000-\u001f\u007f]/g, "").trim();
-  if (!href) return "invalid";
-  if (href.startsWith("#")) return "hash";
-  if (/^\/\//.test(href) || /^https?:/i.test(href) || /^(?:mailto|tel):/i.test(href)) return "external";
-  if (/^[a-z][a-z0-9+.-]*:/i.test(href)) return "invalid";
-  return "navigate";
-}
-
-export function externalHref(raw, baseHref = "https://relative.invalid/") {
-  const href = String(raw || "").replace(/[\u0000-\u001f\u007f]/g, "").trim();
-  if (classifyHref(href) !== "external") return "";
-  if (/^(?:mailto|tel):/i.test(href)) return href;
-  try {
-    const parsed = new URL(href, baseHref);
-    return /^https?:$/i.test(parsed.protocol) ? parsed.href : "";
-  } catch {
-    return "";
-  }
-}

package/src/frame-channel.js

@@ -1,44 +0,0 @@
-let channel = null;
-
-export function initializeChannel(capability, generation, pageKey) {
-  if (channel) throw new Error("Doc Review frame channel is already initialized.");
-  channel = {
-    capability: String(capability),
-    generation: Number(generation),
-    pageKey: String(pageKey),
-  };
-}
-
-export function initializeChannelFromDocument() {
-  const script = document.querySelector("script[data-eh-sdk][data-eh-bootstrap]");
-  if (!script) throw new Error("Doc Review frame bootstrap is missing.");
-  const capability = script.nonce;
-  const generation = Number(script.dataset.generation);
-  const pageKey = String(script.dataset.pageKey || "");
-  script.remove();
-  if (!capability || !Number.isSafeInteger(generation) || !pageKey) {
-    throw new Error("Doc Review frame bootstrap is invalid.");
-  }
-  initializeChannel(capability, generation, pageKey);
-}
-
-export function frameMessage(type, payload = {}) {
-  if (!channel) throw new Error("Doc Review frame channel is not initialized.");
-  return {
-    ...payload,
-    type,
-    capability: channel.capability,
-    generation: channel.generation,
-    pageKey: channel.pageKey,
-  };
-}
-
-export function matchesFrameMessage(message) {
-  return !!(
-    channel &&
-    message &&
-    message.capability === channel.capability &&
-    message.generation === channel.generation &&
-    message.pageKey === channel.pageKey
-  );
-}

package/src/frame-policy.js

@@ -1,16 +0,0 @@
-const BASE_SANDBOX = "allow-scripts allow-forms allow-modals";
-const LOCALHOST_SANDBOX = `${BASE_SANDBOX} allow-popups allow-downloads allow-same-origin`;
-
-/**
- * Localhost apps need their real origin so their routing and JavaScript work.
- * Files and rendered Markdown do not: An opaque iframe origin prevents them
- * from reading sibling files served by the artifact route.
- */
-export function framePolicy(page, artifactOrigin) {
-  const keepsOrigin = page?.kind === "url";
-  return {
-    sandbox: keepsOrigin ? LOCALHOST_SANDBOX : BASE_SANDBOX,
-    incomingOrigin: keepsOrigin ? artifactOrigin : "null",
-    targetOrigin: keepsOrigin ? artifactOrigin : "*",
-  };
-}

package/src/html-transform.js

@@ -1,62 +0,0 @@
-// Match only the tag itself: injection adds no whitespace, so stripping must
-// not eat any either, or open→save would not round-trip byte-identically.
-const SDK_TAG_RE = /<script[^>]*\bdata-eh-sdk\b[^>]*\bdata-eh-bootstrap\b[^>]*><\/script>/gi;
-const SDK_BASE_RE = /<base[^>]*\bdata-eh-sdk\b[^>]*>/gi;
-const SDK_ROUTE_RE = /<script[^>]*\bdata-eh-route\b[^>]*>[\s\S]*?<\/script>/gi;
-const ASSET_TAG_RE = /<(script|link|img|source|video|audio|iframe|embed|object)\b[^>]*>/gi;
-const ASSET_ATTR_RE = /(\s)(src|href|poster|data)=(['"])(.*?)\3/gi;
-
-function absolutizeAssets(html, baseHref) {
-  return String(html).replace(ASSET_TAG_RE, (tag) =>
-    tag.replace(ASSET_ATTR_RE, (attribute, space, name, quote, value) => {
-      if (!value || /^(?:data|blob|javascript):/i.test(value) || value.startsWith("#")) return attribute;
-      const absolute = new URL(value, baseHref).href;
-      return `${space}${name}=${quote}${absolute}${quote}`;
-    })
-  );
-}
-
-/**
- * Add the review bootstrap tags. Everything else about the artifact is left
- * byte-identical, so the saved file renders the same standalone.
- */
-export function injectSdk(
-  html,
-  key,
-  { src = "/sdk.js", baseHref = "", nonce = "", generation = 0, pageKey = key } = {}
-) {
-  const clean = stripSdk(html);
-  const escapedSrc = String(src).replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-  const escapedNonce = String(nonce).replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-  const escapedPageKey = String(pageKey).replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-  const nonceAttr = escapedNonce ? ` nonce="${escapedNonce}"` : "";
-  const tag =
-    `<script data-eh-sdk data-eh-bootstrap type="module"${nonceAttr}` +
-    ` data-generation="${Number(generation)}" data-page-key="${escapedPageKey}" src="${escapedSrc}"></script>`;
-  let prepared = clean;
-  if (baseHref) {
-    const url = new URL(baseHref);
-    const route = JSON.stringify(`${url.pathname}${url.search}${url.hash}`).replace(/</g, "\\u003c");
-    const restoreRoute = `<script data-eh-route>history.replaceState(null,"",location.origin+${route})</script>`;
-    prepared = absolutizeAssets(prepared, baseHref);
-    prepared = /<head(?:\s[^>]*)?>/i.test(prepared)
-      ? prepared.replace(/<head(\s[^>]*)?>/i, (head) => `${head}${restoreRoute}`)
-      : `${restoreRoute}${prepared}`;
-  }
-  // Put the trusted module before authored markup can enter an unclosed
-  // script/style/textarea raw-text context. Removing this exact tag restores
-  // every authored byte.
-  const doctype = /^(\uFEFF?\s*(?:<!--[\s\S]*?-->\s*)*<!doctype[^>]*>)/i.exec(prepared);
-  const at = doctype ? doctype[0].length : 0;
-  return `${prepared.slice(0, at)}${tag}${prepared.slice(at)}`;
-}
-
-/** Remove any injected tag, so a file saved with one never keeps it. */
-export function stripSdk(html) {
-  return String(html).replace(SDK_TAG_RE, "").replace(SDK_BASE_RE, "").replace(SDK_ROUTE_RE, "");
-}
-
-export function hasSdk(html) {
-  SDK_TAG_RE.lastIndex = 0;
-  return SDK_TAG_RE.test(String(html));
-}

package/src/icons.js

@@ -1,251 +0,0 @@
-// Generated by scripts/generate-icons.js from lucide-static. Do not edit.
-export const ICON_NODES = Object.freeze({
-  "eye": [
-    [
-      "path",
-      {
-        "d": "M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"
-      }
-    ],
-    [
-      "circle",
-      {
-        "cx": "12",
-        "cy": "12",
-        "r": "3"
-      }
-    ]
-  ],
-  "pencil": [
-    [
-      "path",
-      {
-        "d": "M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m15 5 4 4"
-      }
-    ]
-  ],
-  "chevronDown": [
-    [
-      "path",
-      {
-        "d": "m6 9 6 6 6-6"
-      }
-    ]
-  ],
-  "messageSquarePlus": [
-    [
-      "path",
-      {
-        "d": "M22 17a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 21.286V5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2z"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M12 8v6"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M9 11h6"
-      }
-    ]
-  ],
-  "messages": [
-    [
-      "path",
-      {
-        "d": "M16 10a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 14.286V4a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2z"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M20 9a2 2 0 0 1 2 2v10.286a.71.71 0 0 1-1.212.502l-2.202-2.202A2 2 0 0 0 17.172 19H10a2 2 0 0 1-2-2v-1"
-      }
-    ]
-  ],
-  "send": [
-    [
-      "path",
-      {
-        "d": "M14.536 21.686a.5.5 0 0 0 .937-.024l6.5-19a.496.496 0 0 0-.635-.635l-19 6.5a.5.5 0 0 0-.024.937l7.93 3.18a2 2 0 0 1 1.112 1.11z"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m21.854 2.147-10.94 10.939"
-      }
-    ]
-  ],
-  "trash": [
-    [
-      "path",
-      {
-        "d": "M10 11v6"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M14 11v6"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M3 6h18"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"
-      }
-    ]
-  ],
-  "moreHorizontal": [
-    [
-      "circle",
-      {
-        "cx": "12",
-        "cy": "12",
-        "r": "1"
-      }
-    ],
-    [
-      "circle",
-      {
-        "cx": "19",
-        "cy": "12",
-        "r": "1"
-      }
-    ],
-    [
-      "circle",
-      {
-        "cx": "5",
-        "cy": "12",
-        "r": "1"
-      }
-    ]
-  ],
-  "x": [
-    [
-      "path",
-      {
-        "d": "M18 6 6 18"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m6 6 12 12"
-      }
-    ]
-  ],
-  "check": [
-    [
-      "path",
-      {
-        "d": "M20 6 9 17l-5-5"
-      }
-    ]
-  ],
-  "sun": [
-    [
-      "circle",
-      {
-        "cx": "12",
-        "cy": "12",
-        "r": "4"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M12 2v2"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M12 20v2"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m4.93 4.93 1.41 1.41"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m17.66 17.66 1.41 1.41"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M2 12h2"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "M20 12h2"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m6.34 17.66-1.41 1.41"
-      }
-    ],
-    [
-      "path",
-      {
-        "d": "m19.07 4.93-1.41 1.41"
-      }
-    ]
-  ],
-  "moon": [
-    [
-      "path",
-      {
-        "d": "M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401"
-      }
-    ]
-  ]
-});
-
-const escape = (value) => String(value).replace(/[&<>"]/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[char]);
-
-export function iconMarkup(name, { title = "", className = "icon", size = 16 } = {}) {
-  const nodes = ICON_NODES[name];
-  if (!nodes) throw new Error(`Unknown icon: ${name}`);
-  const body = nodes.map(([tag, attrs]) => `<${tag} ${Object.entries(attrs).map(([key, value]) => `${key}="${escape(value)}"`).join(" ")}></${tag}>`).join("");
-  const label = title ? ` role="img" aria-label="${escape(title)}"` : ' aria-hidden="true"';
-  return `<svg class="${escape(className)}" width="${size}" height="${size}" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"${label}>${body}</svg>`;
-}
-
-export function createIcon(name, options = {}) {
-  const template = document.createElement("template");
-  template.innerHTML = iconMarkup(name, options);
-  return template.content.firstElementChild;
-}

package/src/paths.js

@@ -1,91 +0,0 @@
-import { createHash } from "node:crypto";
-import { homedir } from "node:os";
-import path from "node:path";
-import fs from "node:fs";
-
-// Bump this when the CLI and detached server no longer share the same request
-// contract. A new CLI must not silently reuse an older background server.
-export const SERVER_PROTOCOL = 13;
-
-export function serverProtocolMatches(protocol) {
-  return Number(protocol) === SERVER_PROTOCOL;
-}
-
-export function stateDir() {
-  const override = process.env.DOC_REVIEW_STATE_DIR;
-  return override ? path.resolve(override) : path.join(homedir(), ".doc-review");
-}
-
-export function statePath() {
-  return path.join(stateDir(), "state.json");
-}
-
-export function serverPath() {
-  return path.join(stateDir(), "server.json");
-}
-
-export function serverLockPath() {
-  return path.join(stateDir(), "server.lock");
-}
-
-export function ensureStateDir() {
-  // Comments and the server token live here; keep it private to the user.
-  fs.mkdirSync(stateDir(), { recursive: true, mode: 0o700 });
-}
-
-const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
-
-/**
- * Return a canonical loopback URL, or null when the input is a filesystem path.
- * HTTP-looking non-loopback targets fail loudly instead of becoming odd paths.
- */
-export function localUrl(target) {
-  const value = String(target || "");
-  if (!/^https?:\/\//i.test(value)) return null;
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw new Error(`Invalid localhost URL: ${value}`);
-  }
-  if (!LOOPBACK_HOSTS.has(parsed.hostname)) {
-    throw new Error("doc-review URL support is limited to localhost, 127.0.0.1, and [::1].");
-  }
-  if (parsed.username || parsed.password) {
-    throw new Error("Localhost review URLs cannot contain credentials.");
-  }
-  parsed.hash = "";
-  return parsed.href;
-}
-
-/** Canonical identity for a page: the real path of the file on disk. */
-export function pageKey(file) {
-  let real = path.resolve(file);
-  try {
-    real = fs.realpathSync(real);
-  } catch {
-    // File may not exist yet; the resolved path is still a stable identity.
-  }
-  return createHash("sha256").update(real).digest("hex").slice(0, 16);
-}
-
-/** Stable identity for either an existing file target or a localhost URL. */
-export function targetKey(target) {
-  const url = localUrl(target);
-  if (!url) return pageKey(target);
-  return createHash("sha256").update(`url:${url}`).digest("hex").slice(0, 16);
-}
-
-export function canonicalTarget(target) {
-  const url = localUrl(target);
-  return url ? { kind: "url", value: url } : { kind: "file", value: realFile(target) };
-}
-
-export function realFile(file) {
-  const resolved = path.resolve(file);
-  try {
-    return fs.realpathSync(resolved);
-  } catch {
-    return resolved;
-  }
-}