@formicoidea/labre-core 0.50.0 → 0.52.0

package/dist/_pkgs/affine-block-surface/extensions/interchange-import.js

@@ -1,6 +1,6 @@
 import { ConnectorElementModel } from '../../affine-model/index.js';
-import { fillPlaceholders, NotificationProvider, translateKey, } from '../../affine-shared/services/index.js';
-import { openSingleFileWithSpec } from '../../affine-shared/utils/index.js';
+import { FileSizeLimitProvider, fillPlaceholders, NotificationProvider, translateKey, } from '../../affine-shared/services/index.js';
+import { formatSize, openSingleFileWithSpec } from '../../affine-shared/utils/index.js';
 import { Bound, getCommonBound } from '../../global/gfx/index.js';
 import { GfxControllerIdentifier } from '../../std/gfx/index.js';
 import { DefaultTool } from '../tool/default-tool.js';
@@ -293,6 +293,13 @@ const IMPORT_DEFAULT_NAME_FALLBACK = 'Imported diagram';
  */
 const IMPORT_READONLY_KEY = 'com.labre.interchange.import.readonly';
 const IMPORT_READONLY_FALLBACK = 'This page became read-only while the file was being read, so nothing was imported.';
+/**
+ * The file is larger than the host's `FileSizeLimitProvider` allows — the same
+ * ceiling an attachment or an image upload obeys, refused BEFORE a byte of it
+ * is read. `{{size}}` is the formatted ceiling, never the file's own size.
+ */
+const IMPORT_TOO_LARGE_KEY = 'com.labre.interchange.import.too-large';
+const IMPORT_TOO_LARGE_FALLBACK = 'This file is larger than {{size}}, the most this editor imports.';
 const IMPORT_REMARKS_KEY = 'com.labre.interchange.import.remarks';
 const IMPORT_REMARKS_FALLBACK = 'What the import could not keep as it was';
 const IMPORT_CONSOLE_KEY = 'com.labre.interchange.import.console';
@@ -532,6 +539,21 @@ export async function importInterchangeFile(std, capability, file, options = {})
     if (!gfx.surface || std.store.readonly)
         return;
     const { format } = capability;
+    // The host's upload ceiling (`FileSizeLimitProvider`, the seam an attachment
+    // and an image already obey), checked on the SIZE before the text is read: a
+    // reader holds the whole file as a string, and the decode step may multiply
+    // it. Optional like every seam — absent, nothing is refused here.
+    const maxFileSize = std.getOptional(FileSizeLimitProvider)?.maxFileSize;
+    if (maxFileSize !== undefined && file.size > maxFileSize) {
+        notifyImport(std, {
+            title: translateKey(std, IMPORT_FAILED_KEY, IMPORT_FAILED_FALLBACK),
+            message: translateKey(std, IMPORT_TOO_LARGE_KEY, IMPORT_TOO_LARGE_FALLBACK, {
+                size: formatSize(maxFileSize) ?? String(maxFileSize),
+            }),
+            accent: 'error',
+        });
+        return;
+    }
     let result;
     try {
         const text = await file.text();

package/dist/_pkgs/affine-block-surface/extensions/interchange.d.ts

@@ -1,5 +1,5 @@
 import { type ServiceProvider } from '../../global/di/index.js';
-import type { GfxPrimitiveElementModel } from '../../std/gfx/index.js';
+import type { GfxBlockElementModel, GfxPrimitiveElementModel } from '../../std/gfx/index.js';
 import type { ExtensionType } from '../../store/index.js';
 /**
  * The interchange registry (`docs/adr/0012`, P1).
@@ -33,6 +33,11 @@ import type { ExtensionType } from '../../store/index.js';
  * beside `ValidationRuleExtension`, because offering to read a file is tooling.
  * Turning a framework's flag off removes its import and export commands; it
  * does not touch one element a past import created. See `docs/adr/0009`.
+ *
+ * One owner is not a framework: `'canvas'`, which writes what the canvas
+ * PAINTS rather than what a framework means (`canvas:drawio:export`,
+ * `docs/adr/0019` amendment of 2026-10-14). It speaks no vocabulary, so no
+ * flag gates it, and the surface registers it unconditionally.
  */
 /**
  * A format Labre can read or write, and what it PROMISES (ADR 0012, P2).
@@ -226,6 +231,15 @@ export interface InterchangeExportContext {
      * named `Order-to cash` in the XML as well as on the download.
      */
     name?: string;
+    /**
+     * The canvas BLOCKS that go with the elements — notes, frames, edgeless
+     * texts, images — in document order. Optional, and only a writer of what the
+     * canvas paints reads it (`canvas:drawio:export`): a framework's exporter
+     * speaks about its own elements and ignores it, and a caller that passes
+     * none gets exactly what it got before this field existed. Models, never
+     * DI-only types, so labre-mcp can hand over what its store holds.
+     */
+    blocks?: readonly GfxBlockElementModel[];
 }
 /** What the caller tells an importer about the source it is handing over. */
 export interface InterchangeImportContext {
@@ -273,6 +287,10 @@ export interface InterchangeImportResult {
  * speaks about itself. Document order is the caller's, and it matters: it is
  * the tie-break the audit and the validation rules already break on, so an
  * export cannot disagree with a badge the user can see.
+ *
+ * A RENDERING is the one exception, and it is the visual tier's: part of a
+ * picture is a smaller picture, so the canvas's draw.io writer is handed the
+ * selection when there is one (`canvas.export.drawio`).
  */
 export type InterchangeExporter = (elements: readonly GfxPrimitiveElementModel[], context: InterchangeExportContext) => InterchangeExportResult;
 /**
@@ -321,7 +339,10 @@ export type InterchangeImportCapability = Extract<InterchangeCapability, {
 }>;
 /** The one way to spell a capability's id. */
 export declare function interchangeCapabilityId(framework: string, formatId: string, direction: InterchangeDirection): string;
-/** A framework registers its interchange here; nothing else registers any. */
+/**
+ * A framework registers its interchange here, and so does the canvas (its
+ * generic draw.io writer); nothing else registers any.
+ */
 export declare const InterchangeIdentifier: import("../../global/di/types.js").ServiceIdentifier<InterchangeCapability> & (<U extends InterchangeCapability = InterchangeCapability>(variant: import("../../global/di/types.js").ServiceVariant) => import("../../global/di/types.js").ServiceIdentifier<U>);
 /**
  * Register a framework's interchange capabilities. Call it from the FLAG-GATED

package/dist/_pkgs/affine-block-surface/extensions/interchange.js

@@ -32,7 +32,10 @@ const ID_SEPARATOR = ':';
 export function interchangeCapabilityId(framework, formatId, direction) {
     return `${framework}${ID_SEPARATOR}${formatId}${ID_SEPARATOR}${direction}`;
 }
-/** A framework registers its interchange here; nothing else registers any. */
+/**
+ * A framework registers its interchange here, and so does the canvas (its
+ * generic draw.io writer); nothing else registers any.
+ */
 export const InterchangeIdentifier = createIdentifier('Interchange');
 /**
  * Register a framework's interchange capabilities. Call it from the FLAG-GATED

package/dist/_pkgs/affine-block-surface/extensions/legend-role.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The role the legend's GROUP carries — the one thing on a generated legend
+ * that says what it is.
+ *
+ * Its glyphs deliberately carry none (see {@link addShape}), which is what
+ * keeps a legend out of the scan and out of every validation rule. But "made of
+ * nothing in particular" is unreadable to anything that has to tell a legend
+ * from a drawing, and something does: the `.bpmn` export counts what it left
+ * behind inside a pool, and a legend's fourteen glyphs would be reported as
+ * fourteen losses. The wrapper says so instead, once, structurally — no title
+ * to match on, no framework name, no geometry.
+ *
+ * `core:` because it belongs to no framework: no `RoleDefs` declares it, so
+ * `roleIsA` matches it against nothing, no rule evaluates it and no legend row
+ * lights because of it. Nothing is backfilled, as ever — a legend drawn before
+ * this shipped carries no role and is not recognised.
+ */
+export declare const LEGEND_ROLE = "core:legend";

package/dist/_pkgs/affine-block-surface/extensions/legend-role.js

@@ -0,0 +1,20 @@
+// Its own module so the headless interchange entry (`./interchange`) can read
+// it without the legend's editor graph (ADR 0012, P3 as amended 2026-10-14).
+/**
+ * The role the legend's GROUP carries — the one thing on a generated legend
+ * that says what it is.
+ *
+ * Its glyphs deliberately carry none (see {@link addShape}), which is what
+ * keeps a legend out of the scan and out of every validation rule. But "made of
+ * nothing in particular" is unreadable to anything that has to tell a legend
+ * from a drawing, and something does: the `.bpmn` export counts what it left
+ * behind inside a pool, and a legend's fourteen glyphs would be reported as
+ * fourteen losses. The wrapper says so instead, once, structurally — no title
+ * to match on, no framework name, no geometry.
+ *
+ * `core:` because it belongs to no framework: no `RoleDefs` declares it, so
+ * `roleIsA` matches it against nothing, no rule evaluates it and no legend row
+ * lights because of it. Nothing is backfilled, as ever — a legend drawn before
+ * this shipped carries no role and is not recognised.
+ */
+export const LEGEND_ROLE = 'core:legend';

package/dist/_pkgs/affine-block-surface/extensions/legend.d.ts

@@ -1,6 +1,7 @@
 import { Bound } from '../../global/gfx/index.js';
 import { type BlockStdScope, type CommandLegendExtra, type CommandLegendRow, type CommandOwner } from '../../std/index.js';
 import { type GfxController, type RoleId } from '../../std/gfx/index.js';
+import { LEGEND_ROLE } from './legend-role.js';
 /**
  * The legend PLATFORM: one engine, one box, for every framework that documents
  * itself.
@@ -56,24 +57,7 @@ export type LegendExtra = CommandLegendExtra;
 export declare const LABEL_COLOR: string;
 export declare const LABEL_FONT = "blocksuite:surface:Inter";
 export declare const LABEL_FONT_SIZE = 14;
-/**
- * The role the legend's GROUP carries — the one thing on a generated legend
- * that says what it is.
- *
- * Its glyphs deliberately carry none (see {@link addShape}), which is what
- * keeps a legend out of the scan and out of every validation rule. But "made of
- * nothing in particular" is unreadable to anything that has to tell a legend
- * from a drawing, and something does: the `.bpmn` export counts what it left
- * behind inside a pool, and a legend's fourteen glyphs would be reported as
- * fourteen losses. The wrapper says so instead, once, structurally — no title
- * to match on, no framework name, no geometry.
- *
- * `core:` because it belongs to no framework: no `RoleDefs` declares it, so
- * `roleIsA` matches it against nothing, no rule evaluates it and no legend row
- * lights because of it. Nothing is backfilled, as ever — a legend drawn before
- * this shipped carries no role and is not recognised.
- */
-export declare const LEGEND_ROLE = "core:legend";
+export { LEGEND_ROLE };
 /**
  * How big the box {@link addLegend} would draw for these sections is — without
  * drawing it. The engine needs the height to drop the box bottom-left of a
@@ -141,4 +125,3 @@ export declare function legendFromCommands(std: BlockStdScope, owner: CommandOwn
 export declare function createBoardLegend(std: BlockStdScope, board: {
     xywh: string;
 }, owner: CommandOwner): string | undefined;
-export {};

package/dist/_pkgs/affine-block-surface/extensions/legend.js

@@ -5,6 +5,7 @@ import { Bound } from '../../global/gfx/index.js';
 import { CATALOGUE_CATEGORY_KEY_PREFIX, getRegisteredCommands, humanizeCategory, } from '../../std/index.js';
 import { GfxControllerIdentifier, roleIsA, RoleVocabularyIdentifier, } from '../../std/gfx/index.js';
 import { EdgelessCRUDIdentifier } from './crud-extension.js';
+import { LEGEND_ROLE } from './legend-role.js';
 /**
  * The ink and the type a notation writes its labels in: this box's rows, and
  * the words the DDD prefabs set beside a dot or a marker.
@@ -81,24 +82,7 @@ function addSwatchElement(surface, props) {
     const { role: _role, ...neutral } = props;
     return surface.addElement(neutral);
 }
-/**
- * The role the legend's GROUP carries — the one thing on a generated legend
- * that says what it is.
- *
- * Its glyphs deliberately carry none (see {@link addShape}), which is what
- * keeps a legend out of the scan and out of every validation rule. But "made of
- * nothing in particular" is unreadable to anything that has to tell a legend
- * from a drawing, and something does: the `.bpmn` export counts what it left
- * behind inside a pool, and a legend's fourteen glyphs would be reported as
- * fourteen losses. The wrapper says so instead, once, structurally — no title
- * to match on, no framework name, no geometry.
- *
- * `core:` because it belongs to no framework: no `RoleDefs` declares it, so
- * `roleIsA` matches it against nothing, no rule evaluates it and no legend row
- * lights because of it. Nothing is backfilled, as ever — a legend drawn before
- * this shipped carries no role and is not recognised.
- */
-export const LEGEND_ROLE = 'core:legend';
+export { LEGEND_ROLE };
 /**
  * Group the box's elements under one titled group, without
  * `@labre/affine-gfx-group`'s `createGroupCommand`: that package depends on

package/dist/_pkgs/affine-block-surface/extensions/svg-sanitize.d.ts

@@ -0,0 +1,67 @@
+import { type XmlElement } from './xml-element.js';
+import type { XmlNode } from './xml-reader.js';
+/**
+ * The SVG sanitizer: an ALLOW-LIST applied to the tree `readXml` read, which
+ * replaced DOMPurify on a DOM (ADR 0012, P3 as amended 2026-10-14).
+ *
+ * Security code, written to be read in one sitting. An `.svg` is an executable
+ * document handed over by whoever sent the file, and this is the only gate
+ * between it and every reader that walks it (the sketch, Wardley's
+ * recognisers). The rule is one sentence: **what is not on a list below does
+ * not come through.** No deny-list, no repair, no attempt to keep the harmless
+ * half of something suspicious.
+ *
+ * - An element survives only in the SVG namespace (or none, for a file that
+ *   forgot its `xmlns`) and only if its local name is in
+ *   {@link ALLOWED_ELEMENTS}. Anything else goes WITH its subtree: `<script>`,
+ *   `<foreignObject>` and its XHTML, `<use>` (which can pull in another
+ *   document), the animation elements (which can rewrite an attribute after
+ *   this gate), every vendor namespace.
+ * - An attribute survives only if it is unprefixed and in
+ *   {@link ALLOWED_ATTRIBUTES} (or `data-*` / `aria-*`), or one of the two
+ *   namespaced ones a drawing needs (`xml:space`, the `xmlns` declarations).
+ *   So no `on*` handler is ever on a list.
+ * - A surviving value is then checked: no `javascript:`, `vbscript:` or
+ *   `data:` anywhere, no `url(…)` that is not a same-document `#ref`, no
+ *   `image-set(…)` (whose bare strings are URLs), no CSS expression, binding
+ *   or import, and no backslash (a CSS escape is how the first three hide).
+ * - `href` / `xlink:href` keep only a same-document `#ref`, except on
+ *   `<image>`, which also keeps an inline PNG, JPEG, GIF or WebP. No external
+ *   resource survives, so nothing a file names is ever fetched.
+ * - A `<style>` sheet that fails the value check is removed whole.
+ * - Nothing nested deeper than {@link MAX_SVG_DEPTH} comes through, because
+ *   the walks after this one recurse. The cut happens during the walk: what
+ *   lies below it, or below a removed element, is never resolved or copied.
+ *
+ * It reports what it took, by kind, and the sketch turns that into its notes.
+ */
+export declare const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+/** Deeper than this is cut: no drawing nests 256 groups, and walks recurse. */
+export declare const MAX_SVG_DEPTH = 256;
+/**
+ * Is this value inert? Read with every whitespace and control character
+ * removed and lower-cased, because `java\tscript:` and `JaVaScRiPt:` are the
+ * same scheme to a browser.
+ */
+export declare function isSafeSvgValue(value: string): boolean;
+/** One thing the sanitizer took: an element (and its subtree) or an attribute. */
+export type SvgRemoval = {
+    element: string;
+} | {
+    attribute: string;
+};
+/** What the sanitizer took, for the sketch to say. */
+export interface SvgSanitizeReport {
+    /** In document order, names as written, repeats included. */
+    removed: SvgRemoval[];
+    /** Something sat deeper than {@link MAX_SVG_DEPTH} and was cut. */
+    tooDeep: boolean;
+}
+/**
+ * The root, sanitized: a NEW tree holding only what the lists allow, or
+ * `undefined` when the root itself is not an allowed `<svg>`.
+ */
+export declare function sanitizeSvgNode(source: XmlNode): {
+    root: XmlElement | undefined;
+    report: SvgSanitizeReport;
+};

package/dist/_pkgs/affine-block-surface/extensions/svg-sanitize.js

@@ -0,0 +1,235 @@
+import { xmlElementOf, XML_NAMESPACE, XmlNamespaceScope, XMLNS_NAMESPACE, } from './xml-element.js';
+/**
+ * The SVG sanitizer: an ALLOW-LIST applied to the tree `readXml` read, which
+ * replaced DOMPurify on a DOM (ADR 0012, P3 as amended 2026-10-14).
+ *
+ * Security code, written to be read in one sitting. An `.svg` is an executable
+ * document handed over by whoever sent the file, and this is the only gate
+ * between it and every reader that walks it (the sketch, Wardley's
+ * recognisers). The rule is one sentence: **what is not on a list below does
+ * not come through.** No deny-list, no repair, no attempt to keep the harmless
+ * half of something suspicious.
+ *
+ * - An element survives only in the SVG namespace (or none, for a file that
+ *   forgot its `xmlns`) and only if its local name is in
+ *   {@link ALLOWED_ELEMENTS}. Anything else goes WITH its subtree: `<script>`,
+ *   `<foreignObject>` and its XHTML, `<use>` (which can pull in another
+ *   document), the animation elements (which can rewrite an attribute after
+ *   this gate), every vendor namespace.
+ * - An attribute survives only if it is unprefixed and in
+ *   {@link ALLOWED_ATTRIBUTES} (or `data-*` / `aria-*`), or one of the two
+ *   namespaced ones a drawing needs (`xml:space`, the `xmlns` declarations).
+ *   So no `on*` handler is ever on a list.
+ * - A surviving value is then checked: no `javascript:`, `vbscript:` or
+ *   `data:` anywhere, no `url(…)` that is not a same-document `#ref`, no
+ *   `image-set(…)` (whose bare strings are URLs), no CSS expression, binding
+ *   or import, and no backslash (a CSS escape is how the first three hide).
+ * - `href` / `xlink:href` keep only a same-document `#ref`, except on
+ *   `<image>`, which also keeps an inline PNG, JPEG, GIF or WebP. No external
+ *   resource survives, so nothing a file names is ever fetched.
+ * - A `<style>` sheet that fails the value check is removed whole.
+ * - Nothing nested deeper than {@link MAX_SVG_DEPTH} comes through, because
+ *   the walks after this one recurse. The cut happens during the walk: what
+ *   lies below it, or below a removed element, is never resolved or copied.
+ *
+ * It reports what it took, by kind, and the sketch turns that into its notes.
+ */
+export const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+const XLINK_NAMESPACE = 'http://www.w3.org/1999/xlink';
+/** Deeper than this is cut: no drawing nests 256 groups, and walks recurse. */
+export const MAX_SVG_DEPTH = 256;
+/** Lower-cased local names, as the sketch compares them. */
+const ALLOWED_ELEMENTS = new Set([
+    'svg', 'g', 'defs', 'symbol', 'switch', 'a', 'view',
+    'title', 'desc', 'metadata', 'style',
+    'rect', 'circle', 'ellipse', 'line', 'polyline', 'polygon', 'path',
+    'text', 'tspan', 'textpath', 'image',
+    'clippath', 'mask', 'marker', 'pattern',
+    'lineargradient', 'radialgradient', 'stop',
+    'filter', 'feblend', 'fecolormatrix', 'fecomponenttransfer', 'fecomposite',
+    'feconvolvematrix', 'fediffuselighting', 'fedisplacementmap',
+    'fedistantlight', 'fedropshadow', 'feflood', 'fefunca', 'fefuncb',
+    'fefuncg', 'fefuncr', 'fegaussianblur', 'femerge', 'femergenode',
+    'femorphology', 'feoffset', 'fepointlight', 'fespecularlighting',
+    'fespotlight', 'fetile', 'feturbulence',
+]); // prettier-ignore
+/** Lower-cased, unprefixed. `href` is not here: it has its own rule. */
+const ALLOWED_ATTRIBUTES = new Set([
+    'id', 'class', 'style', 'lang', 'version', 'type', 'media',
+    'x', 'y', 'z', 'x1', 'y1', 'x2', 'y2', 'cx', 'cy', 'r', 'rx', 'ry',
+    'fx', 'fy', 'fr', 'dx', 'dy', 'width', 'height', 'd', 'points',
+    'pathlength', 'viewbox', 'preserveaspectratio', 'transform',
+    'transform-origin', 'rotate', 'textlength', 'lengthadjust',
+    'fill', 'fill-opacity', 'fill-rule', 'stroke', 'stroke-width',
+    'stroke-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap',
+    'stroke-linejoin', 'stroke-miterlimit', 'opacity', 'color', 'display',
+    'visibility', 'overflow', 'clip', 'clip-path', 'clip-rule', 'mask',
+    'mask-type', 'filter', 'paint-order', 'vector-effect', 'pointer-events',
+    'shape-rendering', 'text-rendering', 'image-rendering', 'color-rendering',
+    'color-interpolation', 'color-interpolation-filters',
+    'font-family', 'font-size', 'font-size-adjust', 'font-stretch',
+    'font-style', 'font-variant', 'font-weight', 'letter-spacing',
+    'word-spacing', 'text-anchor', 'text-decoration', 'dominant-baseline',
+    'alignment-baseline', 'baseline-shift', 'writing-mode', 'direction',
+    'unicode-bidi', 'systemlanguage',
+    'marker-start', 'marker-mid', 'marker-end', 'markerwidth', 'markerheight',
+    'markerunits', 'refx', 'refy', 'orient',
+    'clippathunits', 'maskunits', 'maskcontentunits', 'patternunits',
+    'patterncontentunits', 'patterntransform', 'gradientunits',
+    'gradienttransform', 'spreadmethod', 'offset', 'stop-color', 'stop-opacity',
+    'filterunits', 'primitiveunits', 'in', 'in2', 'result', 'mode', 'operator',
+    'values', 'k1', 'k2', 'k3', 'k4', 'stddeviation', 'flood-color',
+    'flood-opacity', 'lighting-color', 'edgemode', 'kernelmatrix', 'order',
+    'scale', 'xchannelselector', 'ychannelselector', 'basefrequency',
+    'numoctaves', 'seed', 'stitchtiles', 'surfacescale', 'specularconstant',
+    'specularexponent', 'diffuseconstant', 'azimuth', 'elevation',
+    'limitingconeangle', 'pointsatx', 'pointsaty', 'pointsatz', 'tablevalues',
+    'slope', 'intercept', 'amplitude', 'exponent', 'bias', 'divisor',
+    'targetx', 'targety', 'preservealpha', 'radius', 'kernelunitlength',
+]); // prettier-ignore
+/** An inline raster, the only `data:` that survives, and only on `<image>`. */
+const SAFE_IMAGE_DATA = /^data:image\/(?:png|jpeg|jpg|gif|webp);base64,[a-z0-9+/=\s]*$/i;
+/**
+ * Is this value inert? Read with every whitespace and control character
+ * removed and lower-cased, because `java\tscript:` and `JaVaScRiPt:` are the
+ * same scheme to a browser.
+ */
+export function isSafeSvgValue(value) {
+    const folded = value.replaceAll(/[\u0000- \u007f-\u009f]/g, '').toLowerCase();
+    if (folded.includes('\\'))
+        return false;
+    if (/javascript:|vbscript:|data:|expression\(|@import|-moz-binding|behavior:|image-set\(/.test(folded)) {
+        return false;
+    }
+    for (const match of folded.matchAll(/url\(/g)) {
+        const rest = folded.slice(match.index + 4).replace(/^['"]/, '');
+        if (!rest.startsWith('#'))
+            return false;
+    }
+    return true;
+}
+function isAllowedAttribute(attr, element) {
+    if (attr.namespaceURI === XMLNS_NAMESPACE)
+        return true;
+    if (attr.namespaceURI === XML_NAMESPACE)
+        return attr.localName === 'space';
+    const isHref = attr.localName === 'href' &&
+        (attr.prefix === null || attr.namespaceURI === XLINK_NAMESPACE);
+    if (isHref) {
+        const value = attr.value.trim();
+        return ((value.startsWith('#') && isSafeSvgValue(value)) ||
+            (element === 'image' && SAFE_IMAGE_DATA.test(value)));
+    }
+    if (attr.prefix !== null)
+        return false;
+    const name = attr.localName.toLowerCase();
+    const listed = ALLOWED_ATTRIBUTES.has(name) || /^(?:data|aria)-[\w.-]+$/.test(name);
+    return listed && isSafeSvgValue(attr.value);
+}
+/** A sheet's own character data, which is all of it a sanitized `<style>` keeps. */
+function styleEntriesOf(node) {
+    if (!node.content) {
+        return node.text === undefined ? [] : [{ kind: 'text', value: node.text }];
+    }
+    return node.content.filter(entry => 'kind' in entry && entry.kind === 'text');
+}
+function styleTextOf(node) {
+    return styleEntriesOf(node)
+        .map(entry => ('kind' in entry && entry.kind === 'text' ? entry.value : ''))
+        .join('');
+}
+/**
+ * The root, sanitized: a NEW tree holding only what the lists allow, or
+ * `undefined` when the root itself is not an allowed `<svg>`.
+ */
+export function sanitizeSvgNode(source) {
+    const report = { removed: [], tooDeep: false };
+    const scope = new XmlNamespaceScope();
+    /** Entered in `scope` by the caller; exited by the caller too. */
+    const allowed = (node) => {
+        const name = node.local.toLowerCase();
+        const namespaceURI = scope.resolve(node.prefix);
+        if (namespaceURI !== SVG_NAMESPACE && namespaceURI !== null)
+            return false;
+        if (namespaceURI === null && node.prefix !== '')
+            return false;
+        if (!ALLOWED_ELEMENTS.has(name))
+            return false;
+        return name !== 'style' || isSafeSvgValue(styleTextOf(node));
+    };
+    const copy = (node) => {
+        const name = node.local.toLowerCase();
+        const attrs = Object.create(null);
+        for (const attr of scope.attributesOf(node)) {
+            if (isAllowedAttribute(attr, name))
+                attrs[attr.name] = attr.value;
+            else
+                report.removed.push({ attribute: attr.name });
+        }
+        return {
+            name: node.name,
+            prefix: node.prefix,
+            local: node.local,
+            attrs,
+            children: [],
+            content: [],
+            range: node.range,
+        };
+    };
+    scope.enter(source);
+    if (!allowed(source) || source.local.toLowerCase() !== 'svg') {
+        return { root: undefined, report };
+    }
+    // Depth-first with an exit step, so the namespace scope and the depth are
+    // those of the element being read, and the report is in document order.
+    const frameOf = (from, to) => {
+        const name = from.local.toLowerCase();
+        // `<metadata>` is RDF and vendor bookkeeping the walk drops in silence;
+        // its content is not read, so it is not reported either. A `<style>`
+        // keeps its own character data and nothing else: that is the text the
+        // value check read, and checking a subtree per nested sheet was quadratic.
+        const entries = name === 'metadata'
+            ? []
+            : name === 'style'
+                ? styleEntriesOf(from)
+                : (from.content ?? from.children);
+        return { from, to, entries, index: 0 };
+    };
+    const clean = copy(source);
+    const stack = [frameOf(source, clean)];
+    while (stack.length > 0) {
+        const frame = stack[stack.length - 1];
+        if (frame.index >= frame.entries.length) {
+            scope.exit(frame.from);
+            stack.pop();
+            continue;
+        }
+        const entry = frame.entries[frame.index];
+        frame.index += 1;
+        if ('kind' in entry) {
+            // Character data stays (it is what a `<text>` says); a comment or an
+            // instruction renders nothing and is not carried.
+            if (entry.kind === 'text') {
+                const text = { kind: 'text', value: entry.value };
+                frame.to.content.push(text);
+            }
+            continue;
+        }
+        // `stack.length` is the depth of the element about to be entered.
+        if (stack.length > MAX_SVG_DEPTH) {
+            report.tooDeep = true;
+            continue;
+        }
+        scope.enter(entry);
+        if (!allowed(entry)) {
+            scope.exit(entry);
+            report.removed.push({ element: entry.name });
+            continue;
+        }
+        const child = copy(entry);
+        frame.to.children.push(child);
+        frame.to.content.push(child);
+        stack.push(frameOf(entry, child));
+    }
+    return { root: xmlElementOf(clean), report };
+}

package/dist/_pkgs/affine-block-surface/extensions/svg-sketch-translations.d.ts

@@ -38,6 +38,7 @@ export declare const SVG_SKETCH_SWITCH: ChromeWording;
 export declare const SVG_SKETCH_SKIPPED: ChromeWording;
 export declare const SVG_SKETCH_REMOVED: ChromeWording;
 export declare const SVG_SKETCH_REMOVED_ATTRIBUTE: ChromeWording;
+export declare const SVG_SKETCH_TOO_DEEP: ChromeWording;
 export declare const SVG_SKETCH_EMPTY: ChromeWording;
 export declare const SVG_SKETCH_ERROR_MALFORMED_XML: ChromeWording;
 export declare const SVG_SKETCH_ERROR_NOT_SVG: ChromeWording;

package/dist/_pkgs/affine-block-surface/extensions/svg-sketch-translations.js

@@ -1,3 +1,4 @@
+import { XML_READ_TOO_LARGE } from './xml-reader.js';
 /**
  * The SVG importer's own remarks (`svg-sketch.ts`) — one key per SENTENCE
  * SHAPE, not per exact string: a `{{name}}` hole is filled by
@@ -88,6 +89,10 @@ export const SVG_SKETCH_REMOVED_ATTRIBUTE = [
     'com.labre.interchange.svg.removed-attribute',
     'Attributes outside the safe SVG drawing vocabulary — event handlers, script URLs, and anything else the sanitizer does not know — were removed before the file was read.',
 ];
+export const SVG_SKETCH_TOO_DEEP = [
+    'com.labre.interchange.svg.too-deep',
+    'Elements nested more than {{depth}} levels deep were not read.',
+];
 export const SVG_SKETCH_EMPTY = [
     'com.labre.interchange.svg.empty',
     'No shape or text was recognised in this SVG, so nothing was drawn.',
@@ -136,8 +141,12 @@ export const SVG_SKETCH_WORDINGS = [
     SVG_SKETCH_SKIPPED,
     SVG_SKETCH_REMOVED,
     SVG_SKETCH_REMOVED_ATTRIBUTE,
+    SVG_SKETCH_TOO_DEEP,
     SVG_SKETCH_EMPTY,
     SVG_SKETCH_ERROR_MALFORMED_XML,
     SVG_SKETCH_ERROR_NOT_SVG,
     SVG_SKETCH_ERROR_SANITIZED_AWAY,
+    // The shared XML reader's one refusal: no package of its own to list it,
+    // and the SVG sketch is the reader every host already registers.
+    XML_READ_TOO_LARGE,
 ];

package/dist/_pkgs/affine-block-surface/extensions/svg-sketch.d.ts

@@ -1,5 +1,6 @@
 import type { TranslationParams } from '../../affine-shared/services/index.js';
 import { type InterchangeImportContext, type InterchangeImportResult, type InterchangeNote, type SerializedElementProps } from './interchange.js';
+import type { XmlElement } from './xml-element.js';
 /**
  * **SVG → a canvas sketch.** The platform's VISUAL-tier importer, shared by
  * every framework that declares it (`docs/adr/0012`, P2).
@@ -162,8 +163,8 @@ export type SvgSketchFrame = Frame;
  * A framework that claims nodes owes its own heuristics statement for what it
  * claims; this module's statement covers only what reaches this walk.
  */
-export declare function sketchSvgTree(root: Element, notes: SvgSketchNotebook, options?: {
-    skip?: ReadonlySet<Element>;
+export declare function sketchSvgTree(root: XmlElement, notes: SvgSketchNotebook, options?: {
+    skip?: ReadonlySet<XmlElement>;
     place?: SvgSketchFrame;
 }): SerializedElementProps[];
 /**
@@ -176,28 +177,31 @@ export declare function sketchSvgTree(root: Element, notes: SvgSketchNotebook, o
  * The transforms the walk ignores are ignored here too, silently: the walk
  * already says so once per kind when it meets them.
  */
-export declare function svgFrameOf(element: Element): SvgSketchFrame;
+export declare function svgFrameOf(element: XmlElement): SvgSketchFrame;
 /**
  * The document, sanitized, or an exception naming what is wrong with it.
  *
- * Well-formedness FIRST, because `DOMParser` reports a malformed document as a
- * `parsererror` element rather than by throwing — a verdict in the shape of a
- * document — and because DOMPurify's parser is the forgiving HTML one, which
- * would quietly repair the very thing the caller needs to be told about. So:
- * parse for the verdict, reading nothing out of the result but that; sanitize
- * the SOURCE; and walk only what came back from the sanitizer.
+ * Read with `readXml` in its conformant mode, then filtered by the allow-list
+ * in `svg-sanitize.ts`; the walk and every recogniser see only what came back.
+ * No DOM is involved at any step, so the same function runs in the editor, in
+ * a test and on a server (ADR 0012, P3 as amended 2026-10-14). It replaced
+ * `DOMParser` + DOMPurify, which needed a DOM installed before the library was
+ * even imported (the P0 import spike measured that trap).
+ *
+ * Well-formedness first: anything the reader had to recover from is refused,
+ * with the reader's first remark as the detail, as `DOMParser` used to refuse
+ * it. A `DOCTYPE` is not an error: it is skipped and no entity it declares is
+ * ever expanded, so a `&name;` it declares stays those characters.
  *
  * The sanitizer is not optional and it is not defensive programming. An `.svg`
  * is an executable document — `<script>`, `<foreignObject>` with markup, event
- * handler attributes — handed over by whoever sent the file. The same
- * `USE_PROFILES: { svg: true }` guard is what the edgeless clipboard already
- * puts in front of a pasted SVG.
+ * handler attributes — handed over by whoever sent the file.
  *
  * The first of the two passes {@link parseSvgSketch} is made of, exported so a
  * framework that recognises part of a picture reads the SAME sanitised tree
  * the sketch walks (ADR 0032 §2, §7) — never the source.
  */
-export declare function sanitizeSvg(source: string, notes: SvgSketchNotebook): Element;
+export declare function sanitizeSvg(source: string, notes: SvgSketchNotebook): XmlElement;
 /**
  * An SVG file as a canvas sketch — the shared VISUAL-tier importer.
  *