@formicoidea/labre-core 0.46.1 → 0.47.0

package/dist/_pkgs/affine-fragment-doc-title/translations.js

@@ -11,7 +11,65 @@ export const DOC_TITLE_PLACEHOLDER = [
     'com.labre.doc-title.placeholder',
     'Title',
 ];
+/* ── The title band (ADR 0035 §11), `./title-band/title-band.ts` ───────── */
+/** The band's accessible name: the group of property chips. */
+export const TITLE_BAND_LABEL = [
+    'com.labre.title-band.label',
+    'Page properties',
+];
+/** What an empty chip says after the property's name (REQ-PR-1). */
+export const TITLE_BAND_EMPTY = [
+    'com.labre.title-band.empty',
+    'Not set',
+];
+/** The "+" (REQ-PR-4); what it does is the host's. */
+export const TITLE_BAND_ADD = [
+    'com.labre.title-band.add',
+    'Add a property',
+];
+/** The button beside the "+" that opens the host's properties panel. */
+export const TITLE_BAND_OPEN_PANEL = [
+    'com.labre.title-band.open-panel',
+    'Open the properties panel',
+];
+/** Folds the chips away. */
+export const TITLE_BAND_COLLAPSE = [
+    'com.labre.title-band.collapse',
+    'Hide properties',
+];
+/** The folded band's only button; `count` is the number of chips. */
+export const TITLE_BAND_EXPAND = [
+    'com.labre.title-band.expand',
+    'Properties ({{count}})',
+];
+/** The accessible name of the skeleton drawn while the sheet loads. */
+export const TITLE_BAND_LOADING = [
+    'com.labre.title-band.loading',
+    'Loading properties',
+];
+/** Clears a select or a date from its editor. */
+export const TITLE_BAND_CLEAR = [
+    'com.labre.title-band.clear',
+    'Clear value',
+];
+/**
+ * The note header's row of child pages the document holds but does not
+ * display (ADR 0035 §9d, canvas view only).
+ */
+export const TITLE_BAND_NOT_SHOWN = [
+    'com.labre.title-band.not-shown',
+    'Not shown in this document',
+];
 /** Every wording this package declares, in the order it renders them. */
 export const DOC_TITLE_WORDINGS = [
     DOC_TITLE_PLACEHOLDER,
+    TITLE_BAND_ADD,
+    TITLE_BAND_CLEAR,
+    TITLE_BAND_COLLAPSE,
+    TITLE_BAND_EMPTY,
+    TITLE_BAND_EXPAND,
+    TITLE_BAND_LABEL,
+    TITLE_BAND_LOADING,
+    TITLE_BAND_NOT_SHOWN,
+    TITLE_BAND_OPEN_PANEL,
 ];

package/dist/_pkgs/affine-inline-footnote/footnote-node/footnote-node.js

@@ -36,6 +36,7 @@ import { HoverController } from '../../affine-components/hover/index.js';
 import { PeekViewProvider } from '../../affine-components/peek/index.js';
 import { CitationProvider } from '../../affine-shared/services/index.js';
 import { unsafeCSSVarV2 } from '../../affine-shared/theme/index.js';
+import { isSafeLinkUrl } from '../../affine-shared/utils/index.js';
 import { WithDisposable } from '../../global/lit/index.js';
 import { BlockSelection, ShadowlessElement, TextSelection, } from '../../std/index.js';
 import { INLINE_ROOT_ATTR, ZERO_WIDTH_FOR_EMBED_NODE, ZERO_WIDTH_FOR_EMPTY_LINE, } from '../../std/inline/index.js';
@@ -203,6 +204,8 @@ let AffineFootnoteNode = (() => {
                     .catch(console.error);
             };
             this._handleUrlReference = (url) => {
+                if (!isSafeLinkUrl(url))
+                    return;
                 window.open(url, '_blank');
             };
             this._updateFootnoteAttributes = (footnote) => {

package/dist/_pkgs/affine-inline-link/adapters/markdown/markdown-inline.js

@@ -1,4 +1,5 @@
 import { MarkdownASTToDeltaExtension } from '../../../affine-shared/adapters/index.js';
+import { isSafeLinkUrl } from '../../../affine-shared/utils/index.js';
 export const markdownLinkToDeltaMatcher = MarkdownASTToDeltaExtension({
     name: 'link',
     match: ast => ast.type === 'link',
@@ -39,6 +40,10 @@ export const markdownLinkToDeltaMatcher = MarkdownASTToDeltaExtension({
                 ];
             }
         }
+        // A refused scheme (`javascript:`, `data:`…) keeps its text, loses the mark.
+        if (!isSafeLinkUrl(ast.url)) {
+            return ast.children.flatMap(child => context.toDelta(child));
+        }
         return ast.children.flatMap(child => context.toDelta(child).map(delta => {
             delta.attributes = { ...delta.attributes, link: ast.url };
             return delta;

package/dist/_pkgs/affine-inline-link/link-node/affine-link.js

@@ -36,11 +36,11 @@ import { whenHover } from '../../affine-components/hover/index.js';
 import { RefNodeSlotsProvider } from '../../affine-inline-reference/index.js';
 import { ParseDocUrlProvider, ToolbarRegistryIdentifier, } from '../../affine-shared/services/index.js';
 import { affineTextStyles } from '../../affine-shared/styles/index.js';
-import { normalizeUrl } from '../../affine-shared/utils/index.js';
+import { isSafeLinkUrl, normalizeUrl } from '../../affine-shared/utils/index.js';
 import { WithDisposable } from '../../global/lit/index.js';
 import { BLOCK_ID_ATTR, ShadowlessElement } from '../../std/index.js';
 import { INLINE_ROOT_ATTR, ZERO_WIDTH_FOR_EMPTY_LINE, } from '../../std/inline/index.js';
-import { css, html } from 'lit';
+import { css, html, nothing } from 'lit';
 import { property } from 'lit/decorators.js';
 import { styleMap } from 'lit/directives/style-map.js';
 let AffineLink = (() => {
@@ -112,8 +112,11 @@ let AffineLink = (() => {
             this._referenceInfo = { pageId, params };
         }
         _renderLink(style) {
+            const { link } = this;
+            // A stored link may come from an imported or shared document: a refused
+            // scheme keeps its text but gets no href, so a click navigates nowhere.
             return html `<a
-      href=${this.link}
+      href=${isSafeLinkUrl(link) ? link : nothing}
       rel="noopener noreferrer"
       target="_blank"
       style=${styleMap(style)}

package/dist/_pkgs/affine-shared/services/index.d.ts

@@ -30,10 +30,12 @@ export * from './page-viewport-service.js';
 export * from './parse-url-service.js';
 export * from './pivot-materiality-publisher.js';
 export * from './pivot-properties-service.js';
+export * from './properties-panel-service.js';
 export * from './quick-search-service.js';
 export * from './selection-pane-service.js';
 export * from './telemetry-service/index.js';
 export * from './theme-service.js';
+export * from './title-band-service.js';
 export * from './toolbar-service/index.js';
 export * from './translation-service/index.js';
 export * from './universe-tag-defs-service.js';

package/dist/_pkgs/affine-shared/services/index.js

@@ -30,10 +30,12 @@ export * from './page-viewport-service.js';
 export * from './parse-url-service.js';
 export * from './pivot-materiality-publisher.js';
 export * from './pivot-properties-service.js';
+export * from './properties-panel-service.js';
 export * from './quick-search-service.js';
 export * from './selection-pane-service.js';
 export * from './telemetry-service/index.js';
 export * from './theme-service.js';
+export * from './title-band-service.js';
 export * from './toolbar-service/index.js';
 export * from './translation-service/index.js';
 export * from './universe-tag-defs-service.js';

package/dist/_pkgs/affine-shared/services/properties-panel-service.d.ts

@@ -0,0 +1,50 @@
+import type { ExtensionType } from '../../store/index.js';
+/**
+ * What the properties panel is asked to show (ADR 0035 §9b): one panel with a
+ * typed request, like the artefact catalogue's `open(owner)`.
+ *
+ * - `page`: the property sheet of one document — the button beside the title
+ *   band's "+" sends it, under the page title and in the note header alike.
+ * - `source`: the properties of one data source of a database, as a view
+ *   shows them. Declared now so the host's `open` is written once against the
+ *   whole union; the library sends it from the database view bar and the view
+ *   settings when they ship (ADR 0035, issue B10), never before.
+ *
+ * The union only widens: a new scope is a new member, and an existing member
+ * never gains a required field.
+ */
+export type PropertiesPanelRequest = {
+    scope: 'page';
+    docId: string;
+} | {
+    scope: 'source';
+    docId: string;
+    blockId: string;
+    sourceId: string;
+    viewId?: string;
+};
+/**
+ * The properties panel (ADR 0035 §9b), shaped as every panel seam of
+ * ADR 0034 §1: two verbs, nothing else. The host draws the panel where it
+ * wants it (the Labre app, in its left sidebar); the library never mounts one
+ * and keeps no "is it open" state, so a second `open` with another request
+ * retargets the host's panel rather than toggling anything here.
+ *
+ * Absent or `null`, the title band draws no panel button: a button that opens
+ * nothing is a lie. A database's properties stay reachable through the
+ * data-view's own properties popover.
+ */
+export interface PropertiesPanelService {
+    /** Show the panel for `request`. */
+    open(request: PropertiesPanelRequest): void;
+    /** Put it away. Writes nothing. */
+    close(): void;
+}
+export declare const PropertiesPanelProvider: import("../../global/di/types.js").ServiceIdentifier<PropertiesPanelService> & (<U extends PropertiesPanelService = PropertiesPanelService>(variant: import("../../global/di/types.js").ServiceVariant) => import("../../global/di/types.js").ServiceIdentifier<U>);
+/**
+ * Host seam: the host's properties panel, or `null` to say there is none.
+ *
+ * `di.override`, like `OutlinePanelExtension`, so a later registration always
+ * wins and registering twice never throws at boot.
+ */
+export declare function PropertiesPanelExtension(service: PropertiesPanelService | null): ExtensionType;

package/dist/_pkgs/affine-shared/services/properties-panel-service.js

@@ -0,0 +1,17 @@
+import { createIdentifier } from '../../global/di/index.js';
+export const PropertiesPanelProvider = createIdentifier('LabrePropertiesPanel');
+/**
+ * Host seam: the host's properties panel, or `null` to say there is none.
+ *
+ * `di.override`, like `OutlinePanelExtension`, so a later registration always
+ * wins and registering twice never throws at boot.
+ */
+export function PropertiesPanelExtension(service) {
+    return {
+        setup: di => {
+            // `null` rides through the factory on purpose: `getOptional` then
+            // reports the panel as absent, which is the whole "no button" story.
+            di.override(PropertiesPanelProvider, () => service);
+        },
+    };
+}

package/dist/_pkgs/affine-shared/services/title-band-service.d.ts

@@ -0,0 +1,124 @@
+import type { ExtensionType } from '../../store/index.js';
+import type { ReadonlySignal } from '@preact/signals-core';
+/**
+ * `TitleBandProvider` — the one seam that feeds the band of property chips
+ * under the page title and at the head of the page's note on the canvas
+ * (ADR 0035 §9d and §11, REQ-PR-1 and PR-7).
+ *
+ * **No value lives in the document.** A page's property values are the
+ * host's (the Labre app keeps them in SQL, labre ADR-0047); the library reads
+ * them here, draws them, and hands every edit back through `set`. It never
+ * learns where they live, never caches them and never applies a value itself:
+ * the host's store does, and owns the rollback.
+ *
+ * Not `PivotPropertiesProvider` (ADR 0006): that seam is keyed by an element's
+ * `pivotDocId`, read-only, with its own value union; this one is keyed by a
+ * document, written, and speaks the data-view property types, so a chip and a
+ * database cell read the same `type`, `data` and value.
+ *
+ * Absent, there is no band at all: no chips, no "+", no panel button, no "Not
+ * shown in this document" row, and nothing else changes.
+ */
+/**
+ * One visible property of a page's sheet, in the order the band draws it.
+ *
+ * `type` and `data` are a data-view property type and its config (`select`
+ * with `{ options }`, `number` with `{ format }`, …); `value` is the JSON a
+ * data-view cell of that type holds (`select`: an option id, `multi-select`:
+ * option ids, `date`: epoch milliseconds, `checkbox`: a boolean, text types: a
+ * string). `null` or `undefined` is an empty value, drawn as an empty chip
+ * that can still be clicked (REQ-PR-1).
+ *
+ * Visibility is resolved by the host: what is in the list is visible, in that
+ * order, including a visible property with no value.
+ */
+export interface TitleBandProperty {
+    /** Stable, host-defined id; what `set` receives back. */
+    id: string;
+    /** Whose definition this is: the workspace's, or the database's of a row. */
+    namespace: 'workspace' | 'database';
+    /** Display name, already localized by the host. */
+    name: string;
+    /** A data-view property type (`text`, `number`, `select`, …). */
+    type: string;
+    /** That type's config, as a data-view property holds it. */
+    data: Record<string, unknown>;
+    /** The JSON a data-view cell of that type holds; nullish is empty. */
+    value: unknown;
+    /** A read-only property draws its chip and opens no editor. */
+    readonly: boolean;
+}
+/**
+ * The state of one page's sheet. Same four states as ADR 0006: the signal may
+ * start at `loading` and settle later, and the library never awaits it.
+ */
+export type TitleBandSheetState = {
+    status: 'loading';
+} | {
+    status: 'ready';
+    properties: readonly TitleBandProperty[];
+}
+/** The page has no sheet this viewer may read. The band draws nothing. */
+ | {
+    status: 'missing';
+} | {
+    status: 'error';
+    reason?: string;
+};
+/**
+ * A child page this document holds but does not display (labre ADR-0045):
+ * the host decides what belongs here, the library never computes a parent or
+ * a child.
+ */
+export interface TitleBandNotShownPage {
+    docId: string;
+    /** The page's title; an empty one is drawn as "Untitled". */
+    title: string;
+}
+export interface TitleBandService {
+    /**
+     * The sheet of document `docId`. MUST return synchronously and MUST NOT
+     * throw; the same signal for the same document is the host's business (the
+     * band asks once per mounted document).
+     */
+    sheet$(docId: string): ReadonlySignal<TitleBandSheetState>;
+    /**
+     * Write one value. The band shows the chip as pending until the promise
+     * settles and never applies the value itself: the new value arrives through
+     * `sheet$`. A rejection is the host's to report and roll back; the band only
+     * clears its pending state. `value` is `null` to clear.
+     */
+    set(docId: string, propertyId: string, value: unknown): Promise<void>;
+    /**
+     * The band's "+" (REQ-PR-4): what it does is the host's (open the
+     * workspace's property settings, or create a database property directly
+     * on a row). Absent, there is no "+".
+     */
+    add?(docId: string): void;
+    /**
+     * Whether the band is collapsed for this document. The host decides where
+     * that is remembered (the Labre app: per device, REQ-PR-6). Absent, the
+     * band opens expanded every time and a collapse lasts while it is mounted.
+     */
+    collapsed$?(docId: string): ReadonlySignal<boolean>;
+    setCollapsed?(docId: string, collapsed: boolean): void;
+    /**
+     * The child pages this document holds but does not display. Read **in the
+     * canvas view only**, drawn in the note header as a "Not shown in this
+     * document" row of page links that open through the linked-document path
+     * (`RefNodeSlotsProvider.docLinkClicked`). In the page view the host draws
+     * that row under the title itself, so a document never shows two. Absent
+     * or empty, no row.
+     */
+    notShown$?(docId: string): ReadonlySignal<readonly TitleBandNotShownPage[]>;
+}
+export declare const TitleBandProvider: import("../../global/di/types.js").ServiceIdentifier<TitleBandService> & (<U extends TitleBandService = TitleBandService>(variant: import("../../global/di/types.js").ServiceVariant) => import("../../global/di/types.js").ServiceIdentifier<U>);
+/**
+ * Host seam: the service that feeds the title band. **No default is
+ * registered**: absence is a meaningful state (the playground without a mock,
+ * a host with no properties), and the band then draws nothing.
+ *
+ * `di.override`, so a later registration always wins and registering twice
+ * never throws at boot.
+ */
+export declare function TitleBandExtension(service: TitleBandService): ExtensionType;

package/dist/_pkgs/affine-shared/services/title-band-service.js

@@ -0,0 +1,17 @@
+import { createIdentifier } from '../../global/di/index.js';
+export const TitleBandProvider = createIdentifier('LabreTitleBand');
+/**
+ * Host seam: the service that feeds the title band. **No default is
+ * registered**: absence is a meaningful state (the playground without a mock,
+ * a host with no properties), and the band then draws nothing.
+ *
+ * `di.override`, so a later registration always wins and registering twice
+ * never throws at boot.
+ */
+export function TitleBandExtension(service) {
+    return {
+        setup: di => {
+            di.override(TitleBandProvider, () => service);
+        },
+    };
+}

package/dist/_pkgs/affine-shared/utils/url.d.ts

@@ -1,4 +1,19 @@
 export declare function normalizeUrl(str: string): string;
+/**
+ * Whether a link stored in a document may become an `href` or be opened.
+ *
+ * Only `http:`, `https:` and `mailto:` pass, plus scheme-less values that
+ * {@link normalizeUrl} turns into https (`example.com`). Everything else is
+ * refused — `javascript:`, `data:`, `vbscript:`, `file:`, relative paths —
+ * because the value comes from an imported, pasted or shared document and a
+ * click on it must never run in the editor's origin. The scheme is read by
+ * `new URL` after the same cleanup the browser does, never by a prefix test,
+ * so ` JaVaScRiPt:` and `java\tscript:` are recognised for what they are.
+ *
+ * Render and open sites call this on the stored value; nothing is rewritten
+ * on load, so a refused link keeps its text and simply is not clickable.
+ */
+export declare function isSafeLinkUrl(str: string | null | undefined): str is string;
 /**
  * Assume user will input a url, we just need to check if it is valid.
  *

package/dist/_pkgs/affine-shared/utils/url.js

@@ -57,6 +57,36 @@ export function normalizeUrl(str) {
     }
     return str;
 }
+const LINK_SCHEMES = new Set(['http:', 'https:', 'mailto:']);
+// What the WHATWG URL parser drops before reading a scheme: leading and
+// trailing C0 controls and spaces, and every tab or newline anywhere.
+const URL_EDGE_JUNK = /^[\u0000-\u0020]+|[\u0000-\u0020]+$/g;
+const URL_TAB_OR_NEWLINE = /[\t\n\r]/g;
+/**
+ * Whether a link stored in a document may become an `href` or be opened.
+ *
+ * Only `http:`, `https:` and `mailto:` pass, plus scheme-less values that
+ * {@link normalizeUrl} turns into https (`example.com`). Everything else is
+ * refused — `javascript:`, `data:`, `vbscript:`, `file:`, relative paths —
+ * because the value comes from an imported, pasted or shared document and a
+ * click on it must never run in the editor's origin. The scheme is read by
+ * `new URL` after the same cleanup the browser does, never by a prefix test,
+ * so ` JaVaScRiPt:` and `java\tscript:` are recognised for what they are.
+ *
+ * Render and open sites call this on the stored value; nothing is rewritten
+ * on load, so a refused link keeps its text and simply is not clickable.
+ */
+export function isSafeLinkUrl(str) {
+    if (!str)
+        return false;
+    const cleaned = str
+        .replace(URL_TAB_OR_NEWLINE, '')
+        .replace(URL_EDGE_JUNK, '');
+    if (!cleaned)
+        return false;
+    const url = toURL(normalizeUrl(cleaned));
+    return url !== null && LINK_SCHEMES.has(url.protocol);
+}
 /**
  * Assume user will input a url, we just need to check if it is valid.
  *

package/dist/_pkgs/affine-widget-edgeless-selected-rect/edgeless-element-link.js

@@ -34,7 +34,7 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 };
 import { RefNodeSlotsProvider } from '../affine-inline-reference/index.js';
 import { translateKey } from '../affine-shared/services/index.js';
-import { overlayScale, requestThrottledConnectedFrame, toOverlayCoord, } from '../affine-shared/utils/index.js';
+import { isSafeLinkUrl, overlayScale, requestThrottledConnectedFrame, toOverlayCoord, } from '../affine-shared/utils/index.js';
 import { WidgetComponent } from '../std/index.js';
 import { GfxControllerIdentifier, GfxPrimitiveElementModel, } from '../std/gfx/index.js';
 import { OpenInNewIcon, RightSidebarIcon } from '@blocksuite/icons/lit';
@@ -94,7 +94,7 @@ let EdgelessElementLinkWidget = (() => {
                         host: this.std.host,
                     });
                 }
-                else if (el.externalLink) {
+                else if (isSafeLinkUrl(el.externalLink)) {
                     window.open(el.externalLink, '_blank', 'noopener,noreferrer');
                 }
             };

package/dist/_pkgs/affine-widget-edgeless-zoom-toolbar/index.js

@@ -52,29 +52,29 @@ let AffineEdgelessZoomToolbarWidget = (() => {
             __esDecorate(this, null, __hide_decorators, { kind: "accessor", name: "_hide", static: false, private: false, access: { has: obj => "_hide" in obj, get: obj => obj._hide, set: (obj, value) => { obj._hide = value; } }, metadata: _metadata }, __hide_initializers, __hide_extraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static { this.styles = css `
-    :host {
-      position: absolute;
-      bottom: 20px;
-      left: 12px;
-      z-index: var(--affine-z-index-popover);
-      display: flex;
-      justify-content: center;
-      -webkit-user-select: none;
-      user-select: none;
-    }
-
-    @container viewport (width <= 1200px) {
-      edgeless-zoom-toolbar {
-        display: none;
-      }
-    }
-
-    @container viewport (width > 1200px) {
-      zoom-bar-toggle-button {
-        display: none;
-      }
-    }
+        static { this.styles = css `
+    :host {
+      position: absolute;
+      bottom: 20px;
+      left: 12px;
+      z-index: var(--affine-z-index-popover);
+      display: flex;
+      justify-content: center;
+      -webkit-user-select: none;
+      user-select: none;
+    }
+
+    @container viewport (width <= 1200px) {
+      edgeless-zoom-toolbar {
+        display: none;
+      }
+    }
+
+    @container viewport (width > 1200px) {
+      zoom-bar-toggle-button {
+        display: none;
+      }
+    }
   `; }
         get edgeless() {
             return this.block;
@@ -105,9 +105,9 @@ let AffineEdgelessZoomToolbarWidget = (() => {
             if (this._hide || !this.edgeless) {
                 return nothing;
             }
-            return html `
-      <edgeless-zoom-toolbar .std=${this.std}></edgeless-zoom-toolbar>
-      <zoom-bar-toggle-button .std=${this.std}></zoom-bar-toggle-button>
+            return html `
+      <edgeless-zoom-toolbar .std=${this.std}></edgeless-zoom-toolbar>
+      <zoom-bar-toggle-button .std=${this.std}></zoom-bar-toggle-button>
     `;
         }
         #_hide_accessor_storage = __runInitializers(this, __hide_initializers, false);