@glossarist/concept-browser 0.7.114 → 0.7.115

package/src/__tests__/scripts/dataset-turtle.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { Parser, Store } from 'n3';
-import { buildDatasetTurtle } from '../../../scripts/lib/dataset-turtle.mjs';
+import { buildDatasetTurtle } from '../../../scripts/lib/dataset-turtle';
 
 const BASE = 'https://glossarist.org/dataset';
 

package/src/__tests__/scripts/migrate-v1-to-v3.test.ts

@@ -5,7 +5,7 @@ import {
   migrateRelation,
   migrateConceptData,
   isAlreadyMigrated,
-} from '../../../scripts/migrate-v1-to-v3.mjs';
+} from '../../../scripts/migrate-v1-to-v3';
 
 describe('migrate-v1-to-v3 pure conversion', () => {
   describe('isV1PartitiveRelation', () => {

package/src/__tests__/scripts/normalize-yaml.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { mkdtempSync, writeFileSync, readFileSync, rmSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { normalizeYaml } from '../../../scripts/normalize-yaml.mjs';
+import { normalizeYaml } from '../../../scripts/normalize-yaml';
 
 const NFC_STRING = 'café';
 const NON_NFC_STRING = 'café';

package/src/__tests__/scripts/turtle-escape.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { ttlLit, ttlPrefixed, ttlIri, assertValidIri } from '../../../scripts/lib/turtle-escape.mjs';
+import { ttlLit, ttlPrefixed, ttlIri, assertValidIri } from '../../../scripts/lib/turtle-escape';
 
 describe('D1/D2 — Turtle escaping hardening', () => {
   describe('ttlLit', () => {

package/src/__tests__/scripts/validate-yaml.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateYaml } from '../../../scripts/validate-yaml';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SCHEMA_PATH = resolve(__dirname, '..', '..', '..', 'data', 'concept-model', 'shapes', 'glossarist.concept.yaml.schema.json');
+const schema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8'));
+
+describe('validate-yaml', () => {
+  it('accepts a valid concept with termid and localization', () => {
+    const yaml = `
+termid: '1'
+eng:
+  terms:
+    - designation: measurement unit
+      normative_status: preferred
+  definition:
+    - content: A concept used as a basis for comparison.
+`;
+    const result = validateYaml(yaml, schema);
+    if (!result.valid) console.log('Errors:', result.errors);
+    expect(result.valid).toBe(true);
+  });
+
+  it('rejects a concept without termid', () => {
+    const yaml = `
+eng:
+  terms:
+    - designation: missing id
+`;
+    const result = validateYaml(yaml, schema);
+    expect(result.valid).toBe(false);
+    expect(result.errors.some(e => e.message.includes('termid'))).toBe(true);
+  });
+
+  it('accepts managed concept format with underscore fields', () => {
+    const yaml = `
+termid: '5'
+_domains:
+  - physics
+_status: valid
+`;
+    const result = validateYaml(yaml, schema);
+    if (!result.valid) console.log('Errors:', result.errors);
+    expect(result.valid).toBe(true);
+  });
+
+  it('accepts partitive relations with MECE axes', () => {
+    const yaml = `
+termid: '3'
+_partitiveRelations:
+  - type: hasPart
+    members:
+      - ref: part-a
+        presence: required
+        count: exactly_one
+`;
+    const result = validateYaml(yaml, schema);
+    if (!result.valid) console.log('Errors:', result.errors);
+    expect(result.valid).toBe(true);
+  });
+
+  it('rejects non-string termid', () => {
+    const yaml = `
+termid: 12345
+eng:
+  terms:
+    - designation: test
+`;
+    const result = validateYaml(yaml, schema);
+    expect(result.valid).toBe(false);
+  });
+});
+

package/src/__tests__/scripts/version-turtle.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { Parser, Store } from 'n3';
-import { buildVersionTurtle, buildVersionHistoryTurtle } from '../../../scripts/lib/version-turtle.mjs';
+import { buildVersionTurtle, buildVersionHistoryTurtle } from '../../../scripts/lib/version-turtle';
 
 function parse(turtle: string): Store {
   const parser = new Parser({ format: 'Turtle' });

package/src/__tests__/scripts/vocab-turtle.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { Parser, Store } from 'n3';
-import { buildVocabularyTurtle, listVocabSchemes } from '../../../scripts/lib/vocab-turtle.mjs';
+import { buildVocabularyTurtle, listVocabSchemes } from '../../../scripts/lib/vocab-turtle';
 
 function parse(turtle: string): Store {
   const parser = new Parser({ format: 'Turtle' });

package/src/__tests__/scripts-syntax.test.ts

@@ -9,10 +9,10 @@ const repoRoot = path.resolve(
 );
 
 describe('scripts syntax gate', () => {
-  it('`npm run check:scripts` exits 0 (every .mjs/.js/.cjs in scripts/ and cli/ parses)', () => {
+  it('`npm run check:scripts` exits 0 (every .ts/.mjs/.js/.cjs in scripts/ and cli/ parses)', () => {
     const result = spawnSync(
       process.execPath,
-      [path.join(repoRoot, 'scripts', 'check-syntax.mjs')],
+      ['--import', 'tsx', path.join(repoRoot, 'scripts', 'check-syntax.ts')],
       { encoding: 'utf8' },
     );
 

package/src/__tests__/use-rdf-document.test.ts

@@ -1,10 +1,9 @@
-// @ts-nocheck — TODO.typescript/12: remove after glossarist TS migration
 import { describe, it, expect } from 'vitest';
 import { ref } from 'vue';
 import { Concept } from 'glossarist';
 import { useRdfDocument } from '../components/use-rdf-document';
 
-function makeConcept(): Concept {
+function makeConcept(): any {
   return Concept.fromJSON({
     id: '3.1.1',
     uri: 'https://glossarist.org/test/concept/3.1.1',
@@ -24,7 +23,7 @@ function makeConcept(): Concept {
   });
 }
 
-function makeConceptWithNonVerbal(): Concept {
+function makeConceptWithNonVerbal(): any {
   return Concept.fromJSON({
     id: '3.1.2',
     uri: 'https://glossarist.org/test/concept/3.1.2',

package/src/__tests__/utils/content-renderer-xss.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest';
+import { renderContent } from '../../utils/content-renderer';
+
+describe('content-renderer XSS protection', () => {
+  it('blocks javascript: URLs in {{link:}} (no anchor tag)', () => {
+    const html = renderContent('{{link:javascript:alert(1)}}', {});
+    expect(html).not.toContain('<a');
+    expect(html).not.toContain('href=');
+  });
+
+  it('blocks javascript: URLs in {{link:}} with label (renders as text)', () => {
+    const html = renderContent('{{link:javascript:alert(1), click me}}', {});
+    expect(html).not.toContain('<a');
+    expect(html).not.toContain('href=');
+    expect(html).toContain('click me');
+  });
+
+  it('blocks data: URLs in {{link:}} (no anchor tag)', () => {
+    const html = renderContent('{{link:data:text/html,<script>alert(1)</script>}}', {});
+    expect(html).not.toContain('<a');
+    expect(html).not.toContain('href=');
+    expect(html).not.toContain('<script>');
+  });
+
+  it('allows https: URLs in {{link:}}', () => {
+    const html = renderContent('{{link:https://example.com}}', {});
+    expect(html).toContain('href="https://example.com"');
+  });
+
+  it('blocks javascript: URLs in {{image:}} (no img tag)', () => {
+    const html = renderContent('{{image:javascript:alert(1)}}', {});
+    expect(html).not.toContain('<img');
+  });
+
+  it('blocks data: URLs in {{image:}} (no img tag with executable src)', () => {
+    const html = renderContent('{{image:data:text/html,<script>}}', {});
+    expect(html).not.toContain('<img');
+    expect(html).not.toContain('data:text/html');
+  });
+
+  it('allows relative paths in {{image:}}', () => {
+    const html = renderContent('{{image:diagram.png}}', {});
+    expect(html).toContain('src="diagram.png"');
+  });
+
+  it('escapes HTML in unordered list items', () => {
+    const html = renderContent('* <script>alert(1)</script>\n* safe item', {});
+    expect(html).not.toContain('<script>');
+    expect(html).toContain('&lt;script&gt;');
+  });
+
+  it('escapes HTML in ordered list items', () => {
+    const html = renderContent('1. <img onerror=alert(1)>\n2. safe', {});
+    expect(html).not.toContain('<img onerror');
+    expect(html).toContain('&lt;img');
+  });
+});

package/src/__tests__/validate-shacl.test.ts

@@ -4,7 +4,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const SCRIPT = join(__dirname, '..', '..', 'scripts', 'validate-shacl.mjs');
+const SCRIPT = join(__dirname, '..', '..', 'scripts', 'validate-shacl.ts');
 const FIXTURES = join(__dirname, '..', '__fixtures__', 'shacl');
 const SHAPES = join(__dirname, '..', '__fixtures__', 'concept-shape.ttl');
 
@@ -31,13 +31,13 @@ function execCaught(cmd: string, args: string[], opts: Parameters<typeof execFil
 }
 
 function runValidate(dataDir: string, { env, shapes }: RunOptions = {}): RunResult {
-  return execCaught('node', [SCRIPT, '--shapes', shapes ?? SHAPES, dataDir], {
+  return execCaught('node', ['--import', 'tsx', SCRIPT, '--shapes', shapes ?? SHAPES, dataDir], {
     env: { ...process.env, ...env },
   });
 }
 
 function runValidateRaw(args: string[], { env }: RunOptions = {}): RunResult {
-  return execCaught('node', [SCRIPT, ...args], {
+  return execCaught('node', ['--import', 'tsx', SCRIPT, ...args], {
     env: { ...process.env, ...env },
     stdio: ['ignore', 'pipe', 'pipe'],
   });

package/src/adapters/wire/index.ts

@@ -0,0 +1,69 @@
+/**
+ * Wire-format types barrel — single import path for all wire types.
+ *
+ * Three MECE layers:
+ *   - YAML author format (INPUT to build pipeline)
+ *   - JSON-LD browser format (OUTPUT of build pipeline)
+ *   - Manifest / site-config metadata
+ *
+ * Usage:
+ *   import type { HarmonizedConcept, JsonLdConcept, Manifest } from '@/adapters/wire'
+ *
+ * Or layer-specific:
+ *   import type { HarmonizedConcept } from '@/adapters/wire/yaml'
+ *   import type { JsonLdConcept } from '@/adapters/wire/jsonld'
+ */
+
+// YAML author format — what dataset authors write
+export type {
+  YamlContent,
+  YamlTerm,
+  YamlOrigin,
+  YamlGrammarInfo,
+  YamlSource,
+  YamlDate,
+  YamlRelation,
+  YamlPartitiveMember,
+  YamlPartitiveRelation,
+  YamlGenericRelation,
+  YamlLocalization,
+  HarmonizedConcept,
+  YamlManagedConceptDoc,
+  YamlManifestSection,
+  YamlManifest,
+  YamlBibliographyEntry,
+  YamlNewsFrontmatter,
+  YamlContentPage,
+  ShaclConstraint,
+  PrefixMap,
+} from '../../../scripts/lib/yaml-types';
+
+// JSON-LD browser format — what the SPA reads
+export type {
+  JsonLdContent,
+  JsonLdDate,
+  JsonLdPronunciation,
+  JsonLdGrammarInfo,
+  JsonLdRef,
+  JsonLdLocality,
+  JsonLdOrigin,
+  JsonLdSource,
+  JsonLdRelated,
+  JsonLdDesignation,
+  JsonLdLocalizedConcept,
+  JsonLdPartitiveMember,
+  JsonLdPartitiveRelation,
+  JsonLdConcept,
+} from '../jsonld-types';
+
+// Manifest + summary types
+export type {
+  Manifest,
+  ManifestSection,
+  ConceptSummary,
+  CitationClassification,
+  CiteResolution,
+} from '../types';
+
+// Wire-key constants (runtime value, not just type)
+export { GL } from '../wire-keys';

package/src/utils/content-renderer.ts

@@ -26,6 +26,7 @@
  * The v-math directive upgrades the placeholders to Plurimath at runtime.
  */
 import { escapeHtml, escapeAttr } from './escape';
+import { sanitizeUrl, isSafeUrl } from './url-safety';
 import { parseMention } from 'glossarist';
 import type { NonVerbalKind } from '../adapters/non-verbal/types';
 import { entityKindFromMentionKind } from '../adapters/non-verbal/kind';
@@ -135,7 +136,7 @@ function convertLists(text: string): string {
       items.push(m[1].trim());
     }
     if (!items.length) return _;
-    const lis = items.map(item => `<li>${item}</li>`).join('');
+    const lis = items.map(item => `<li>${escapeHtml(item)}</li>`).join('');
     return `\n<ul class="concept-list">${lis}</ul>`;
   });
 
@@ -147,7 +148,7 @@ function convertLists(text: string): string {
       items.push(m[1].trim());
     }
     if (!items.length) return _;
-    const lis = items.map(item => `<li>${item}</li>`).join('');
+    const lis = items.map(item => `<li>${escapeHtml(item)}</li>`).join('');
     return `\n<ol class="concept-list concept-list-ordered">${lis}</ol>`;
   });
 
@@ -225,7 +226,9 @@ function resolveMentions(text: string, opts: RenderOptions): string {
       const url = (commaIdx > 0 ? rest.slice(0, commaIdx).trim() : rest.trim());
       const label = commaIdx > 0 ? rest.slice(commaIdx + 1).trim() : url;
       if (opts.linkResolver) return opts.linkResolver(url, label);
-      return `<a href="${escapeAttr(url)}" target="_blank" rel="noopener" class="ext-link">${escapeHtml(label)}</a>`;
+      const safeUrl = sanitizeUrl(url);
+      if (!safeUrl) return escapeHtml(label);
+      return `<a href="${escapeAttr(safeUrl)}" target="_blank" rel="noopener" class="ext-link">${escapeHtml(label)}</a>`;
     }
 
     const imageMatch = body.match(/^image:(.+)$/i);
@@ -235,6 +238,7 @@ function resolveMentions(text: string, opts: RenderOptions): string {
       const src = (commaIdx > 0 ? rest.slice(0, commaIdx).trim() : rest.trim());
       const alt = commaIdx > 0 ? rest.slice(commaIdx + 1).trim() : '';
       if (opts.imageResolver) return opts.imageResolver(src, alt);
+      if (!isSafeUrl(src)) return escapeHtml(alt || src);
       return `<img src="${escapeAttr(src)}" alt="${escapeAttr(alt)}" class="inline-image" />`;
     }
 

package/src/utils/url-safety.ts

@@ -18,11 +18,7 @@ export function isSafeUrl(url: string): boolean {
     }
   }
 
-  if (trimmed.startsWith('#') || trimmed.startsWith('/') || trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return true;
-  }
-
-  return false;
+  return true;
 }
 
 export function sanitizeUrl(url: string): string {

package/tsconfig.json

@@ -20,6 +20,6 @@
     },
     "baseUrl": "."
   },
-  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue", "cli/**/*.ts", "env.d.ts", ".astro/types.d.ts"],
-  "exclude": ["src/content.config.ts", "src/pages/**", "src/layouts/**", "src/astro-islands/**", "src/lib/site-config.ts"]
+  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue", "env.d.ts", ".astro/types.d.ts"],
+  "exclude": ["src/content.config.ts", "src/pages/**", "src/layouts/**", "src/astro-islands/**", "src/lib/site-config.ts", "src/__tests__/**", "scripts/**", "cli/**"]
 }

package/vite.config.ts

@@ -183,7 +183,7 @@ export default defineConfig({
     globals: true,
     include: [
       'src/__tests__/**/*.test.ts',
-      'scripts/__tests__/**/*.test.mjs',
+      'scripts/__tests__/**/*.test.ts',
     ],
   },
 })

package/src/__tests__/composables/use-concept-edges-v2.test.ts

@@ -1,167 +0,0 @@
-// @ts-nocheck — TODO.typescript/12: remove after glossarist TS migration
-import { describe, it, expect } from 'vitest';
-// glossarist 0.4.33 renamed PartitiveRelation → PartitiveHyperedge.
-// Import from glossarist/models (extended by our local augmentation).
-import type {
-  PartitiveHyperedge,
-  PartitiveMember,
-  ConceptRef,
-} from 'glossarist/models';
-import {
-  PartitiveHyperedge as PartitiveHyperedgeModel,
-  PartitiveMember as PartitiveMemberModel,
-  ConceptRef as ConceptRefModel,
-} from 'glossarist/models';
-
-/**
- * Verifies glossarist-js 0.4.26's MECE-native PartitiveRelation model
- * (ISO 704:2022 presence × count + is_delimiting).
- *
- * The concept-browser consumes these fields directly (no migration
- * bridge). These specs pin the runtime contract so a regression in
- * upstream is caught here.
- */
-
-function makeRef(source: string, id: string): ConceptRef {
-  return ConceptRefModel.fromJSON({ source, id }) as ConceptRef;
-}
-
-function makePartitive(
-  source: string,
-  id: string,
-  fields: { presence?: 'required' | 'optional'; count?: 'exactly_one' | 'at_least_one' | 'multiple'; isDelimiting?: boolean } = {},
-): PartitiveMember {
-  const data: {
-    ref: ConceptRef;
-    presence?: 'required' | 'optional';
-    count?: 'exactly_one' | 'at_least_one' | 'multiple';
-    is_delimiting?: boolean;
-  } = { ref: makeRef(source, id) };
-  if (fields.presence) data.presence = fields.presence;
-  if (fields.count) data.count = fields.count;
-  if (fields.isDelimiting) data.is_delimiting = fields.isDelimiting;
-  return new (PartitiveMemberModel as unknown as new (data: unknown) => PartitiveMember)(data) as PartitiveMember;
-}
-
-function makeRelation(opts: {
-  comprehensive: ConceptRef;
-  partitives: PartitiveMember[];
-  completeness?: 'complete' | 'partial';
-  criterion?: Record<string, string>;
-}): PartitiveHyperedge {
-  return new (PartitiveHyperedgeModel as unknown as new (data: unknown) => PartitiveHyperedge)(opts) as PartitiveHyperedge;
-}
-
-describe('useConceptEdges — MECE PartitiveRelation (glossarist 0.4.26)', () => {
-  describe('PartitiveMember (ISO 704:2022 presence × count + delimiting)', () => {
-    it('presence defaults to required, count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.presence).toBe('required');
-      expect(m.presence === "required").toBe(true);
-      expect(m.presence === "optional").toBe(false);
-    });
-
-    it('count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.count).toBe('exactly_one');
-    });
-
-    it('presence=optional is preserved', () => {
-      const m = makePartitive('test', '1.1', { presence: 'optional' });
-      expect(m.presence).toBe('optional');
-      expect(m.presence === "optional").toBe(true);
-      expect(m.presence === "required").toBe(false);
-    });
-
-    it('count=multiple is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'multiple' });
-      expect(m.count).toBe('multiple');
-    });
-
-    it('count=at_least_one is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'at_least_one' });
-      expect(m.count).toBe('at_least_one');
-    });
-
-    it('is_delimiting defaults to false', () => {
-      const m = makePartitive('test', '1.1');
-      expect((m as any).is_delimiting).toBe(false);
-      expect((m as any).is_delimiting).toBe(false);
-    });
-
-    it('is_delimiting is preserved when set to true', () => {
-      const m = makePartitive('test', '1.1', { isDelimiting: true });
-      expect((m as any).is_delimiting).toBe(true);
-      expect((m as any).is_delimiting).toBe(true);
-    });
-
-    it('rejects the vacuous (presence=optional, count=at_least_one)', () => {
-      expect(() =>
-        makePartitive('test', '1.1', { presence: 'optional', count: 'at_least_one' }),
-      ).toThrow(/collapses to optional \+ multiple/);
-    });
-  });
-
-  describe('PartitiveRelation', () => {
-    it('accepts 2 members with default axes', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).members).toHaveLength(2);
-      expect((r as any).completeness).toBe('complete');
-      expect((r as any).isComplete).toBe(true);
-      expect((r as any).isPartial).toBe(false);
-    });
-
-    it('completeness=partial is preserved', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-        completeness: 'partial',
-      });
-      expect((r as any).completeness).toBe('partial');
-      expect((r as any).isPartial).toBe(true);
-    });
-
-    it('isCoordinate true when ≥2 partitives', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).isCoordinate).toBe(true);
-    });
-
-    it('rejects < 2 partitives (ISO 704 requirement)', () => {
-      expect(() => makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4')],
-      })).toThrow(/≥2 partitives/);
-    });
-
-    it('round-trips through toJSON with MECE fields', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [
-          makePartitive('test', '1.4', { presence: 'required', count: 'multiple' }),
-          makePartitive('test', '1.5', { presence: 'optional', isDelimiting: true }),
-        ],
-        completeness: 'partial',
-        criterion: { eng: 'physical structure' },
-      });
-      const json = r.toJSON() as {
-        comprehensive: unknown;
-        partitives: Array<{ presence?: string; count?: string; is_delimiting?: boolean; ref: unknown }>;
-        completeness: string;
-        criterion?: Record<string, string>;
-      };
-      expect(json.comprehensive).toBeDefined();
-      expect(json.partitives).toHaveLength(2);
-      expect(json.partitives[0].count).toBe('multiple');
-      expect(json.partitives[1].presence).toBe('optional');
-      expect(json.partitives[1].is_delimiting).toBe(true);
-      expect(json.completeness).toBe('partial');
-      expect(json.criterion).toEqual({ eng: 'physical structure' });
-    });
-  });
-});