@glossarist/concept-browser 0.7.114 → 0.7.116

package/src/utils/content-renderer.ts

@@ -26,6 +26,7 @@
  * The v-math directive upgrades the placeholders to Plurimath at runtime.
  */
 import { escapeHtml, escapeAttr } from './escape';
+import { sanitizeUrl, isSafeUrl } from './url-safety';
 import { parseMention } from 'glossarist';
 import type { NonVerbalKind } from '../adapters/non-verbal/types';
 import { entityKindFromMentionKind } from '../adapters/non-verbal/kind';
@@ -135,7 +136,7 @@ function convertLists(text: string): string {
       items.push(m[1].trim());
     }
     if (!items.length) return _;
-    const lis = items.map(item => `<li>${item}</li>`).join('');
+    const lis = items.map(item => `<li>${escapeHtml(item)}</li>`).join('');
     return `\n<ul class="concept-list">${lis}</ul>`;
   });
 
@@ -147,7 +148,7 @@ function convertLists(text: string): string {
       items.push(m[1].trim());
     }
     if (!items.length) return _;
-    const lis = items.map(item => `<li>${item}</li>`).join('');
+    const lis = items.map(item => `<li>${escapeHtml(item)}</li>`).join('');
     return `\n<ol class="concept-list concept-list-ordered">${lis}</ol>`;
   });
 
@@ -225,7 +226,9 @@ function resolveMentions(text: string, opts: RenderOptions): string {
       const url = (commaIdx > 0 ? rest.slice(0, commaIdx).trim() : rest.trim());
       const label = commaIdx > 0 ? rest.slice(commaIdx + 1).trim() : url;
       if (opts.linkResolver) return opts.linkResolver(url, label);
-      return `<a href="${escapeAttr(url)}" target="_blank" rel="noopener" class="ext-link">${escapeHtml(label)}</a>`;
+      const safeUrl = sanitizeUrl(url);
+      if (!safeUrl) return escapeHtml(label);
+      return `<a href="${escapeAttr(safeUrl)}" target="_blank" rel="noopener" class="ext-link">${escapeHtml(label)}</a>`;
     }
 
     const imageMatch = body.match(/^image:(.+)$/i);
@@ -235,6 +238,7 @@ function resolveMentions(text: string, opts: RenderOptions): string {
       const src = (commaIdx > 0 ? rest.slice(0, commaIdx).trim() : rest.trim());
       const alt = commaIdx > 0 ? rest.slice(commaIdx + 1).trim() : '';
       if (opts.imageResolver) return opts.imageResolver(src, alt);
+      if (!isSafeUrl(src)) return escapeHtml(alt || src);
       return `<img src="${escapeAttr(src)}" alt="${escapeAttr(alt)}" class="inline-image" />`;
     }
 

package/src/utils/url-safety.ts

@@ -18,11 +18,7 @@ export function isSafeUrl(url: string): boolean {
     }
   }
 
-  if (trimmed.startsWith('#') || trimmed.startsWith('/') || trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return true;
-  }
-
-  return false;
+  return true;
 }
 
 export function sanitizeUrl(url: string): string {

package/tsconfig.json

@@ -20,6 +20,6 @@
     },
     "baseUrl": "."
   },
-  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue", "cli/**/*.ts", "env.d.ts", ".astro/types.d.ts"],
-  "exclude": ["src/content.config.ts", "src/pages/**", "src/layouts/**", "src/astro-islands/**", "src/lib/site-config.ts"]
+  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue", "env.d.ts", ".astro/types.d.ts"],
+  "exclude": ["src/content.config.ts", "src/pages/**", "src/layouts/**", "src/astro-islands/**", "src/lib/site-config.ts", "src/__tests__/**", "scripts/**", "cli/**"]
 }

package/vite.config.ts

@@ -183,7 +183,7 @@ export default defineConfig({
     globals: true,
     include: [
       'src/__tests__/**/*.test.ts',
-      'scripts/__tests__/**/*.test.mjs',
+      'scripts/__tests__/**/*.test.ts',
     ],
   },
 })

package/src/__tests__/composables/use-concept-edges-v2.test.ts

@@ -1,167 +0,0 @@
-// @ts-nocheck — TODO.typescript/12: remove after glossarist TS migration
-import { describe, it, expect } from 'vitest';
-// glossarist 0.4.33 renamed PartitiveRelation → PartitiveHyperedge.
-// Import from glossarist/models (extended by our local augmentation).
-import type {
-  PartitiveHyperedge,
-  PartitiveMember,
-  ConceptRef,
-} from 'glossarist/models';
-import {
-  PartitiveHyperedge as PartitiveHyperedgeModel,
-  PartitiveMember as PartitiveMemberModel,
-  ConceptRef as ConceptRefModel,
-} from 'glossarist/models';
-
-/**
- * Verifies glossarist-js 0.4.26's MECE-native PartitiveRelation model
- * (ISO 704:2022 presence × count + is_delimiting).
- *
- * The concept-browser consumes these fields directly (no migration
- * bridge). These specs pin the runtime contract so a regression in
- * upstream is caught here.
- */
-
-function makeRef(source: string, id: string): ConceptRef {
-  return ConceptRefModel.fromJSON({ source, id }) as ConceptRef;
-}
-
-function makePartitive(
-  source: string,
-  id: string,
-  fields: { presence?: 'required' | 'optional'; count?: 'exactly_one' | 'at_least_one' | 'multiple'; isDelimiting?: boolean } = {},
-): PartitiveMember {
-  const data: {
-    ref: ConceptRef;
-    presence?: 'required' | 'optional';
-    count?: 'exactly_one' | 'at_least_one' | 'multiple';
-    is_delimiting?: boolean;
-  } = { ref: makeRef(source, id) };
-  if (fields.presence) data.presence = fields.presence;
-  if (fields.count) data.count = fields.count;
-  if (fields.isDelimiting) data.is_delimiting = fields.isDelimiting;
-  return new (PartitiveMemberModel as unknown as new (data: unknown) => PartitiveMember)(data) as PartitiveMember;
-}
-
-function makeRelation(opts: {
-  comprehensive: ConceptRef;
-  partitives: PartitiveMember[];
-  completeness?: 'complete' | 'partial';
-  criterion?: Record<string, string>;
-}): PartitiveHyperedge {
-  return new (PartitiveHyperedgeModel as unknown as new (data: unknown) => PartitiveHyperedge)(opts) as PartitiveHyperedge;
-}
-
-describe('useConceptEdges — MECE PartitiveRelation (glossarist 0.4.26)', () => {
-  describe('PartitiveMember (ISO 704:2022 presence × count + delimiting)', () => {
-    it('presence defaults to required, count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.presence).toBe('required');
-      expect(m.presence === "required").toBe(true);
-      expect(m.presence === "optional").toBe(false);
-    });
-
-    it('count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.count).toBe('exactly_one');
-    });
-
-    it('presence=optional is preserved', () => {
-      const m = makePartitive('test', '1.1', { presence: 'optional' });
-      expect(m.presence).toBe('optional');
-      expect(m.presence === "optional").toBe(true);
-      expect(m.presence === "required").toBe(false);
-    });
-
-    it('count=multiple is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'multiple' });
-      expect(m.count).toBe('multiple');
-    });
-
-    it('count=at_least_one is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'at_least_one' });
-      expect(m.count).toBe('at_least_one');
-    });
-
-    it('is_delimiting defaults to false', () => {
-      const m = makePartitive('test', '1.1');
-      expect((m as any).is_delimiting).toBe(false);
-      expect((m as any).is_delimiting).toBe(false);
-    });
-
-    it('is_delimiting is preserved when set to true', () => {
-      const m = makePartitive('test', '1.1', { isDelimiting: true });
-      expect((m as any).is_delimiting).toBe(true);
-      expect((m as any).is_delimiting).toBe(true);
-    });
-
-    it('rejects the vacuous (presence=optional, count=at_least_one)', () => {
-      expect(() =>
-        makePartitive('test', '1.1', { presence: 'optional', count: 'at_least_one' }),
-      ).toThrow(/collapses to optional \+ multiple/);
-    });
-  });
-
-  describe('PartitiveRelation', () => {
-    it('accepts 2 members with default axes', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).members).toHaveLength(2);
-      expect((r as any).completeness).toBe('complete');
-      expect((r as any).isComplete).toBe(true);
-      expect((r as any).isPartial).toBe(false);
-    });
-
-    it('completeness=partial is preserved', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-        completeness: 'partial',
-      });
-      expect((r as any).completeness).toBe('partial');
-      expect((r as any).isPartial).toBe(true);
-    });
-
-    it('isCoordinate true when ≥2 partitives', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).isCoordinate).toBe(true);
-    });
-
-    it('rejects < 2 partitives (ISO 704 requirement)', () => {
-      expect(() => makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4')],
-      })).toThrow(/≥2 partitives/);
-    });
-
-    it('round-trips through toJSON with MECE fields', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [
-          makePartitive('test', '1.4', { presence: 'required', count: 'multiple' }),
-          makePartitive('test', '1.5', { presence: 'optional', isDelimiting: true }),
-        ],
-        completeness: 'partial',
-        criterion: { eng: 'physical structure' },
-      });
-      const json = r.toJSON() as {
-        comprehensive: unknown;
-        partitives: Array<{ presence?: string; count?: string; is_delimiting?: boolean; ref: unknown }>;
-        completeness: string;
-        criterion?: Record<string, string>;
-      };
-      expect(json.comprehensive).toBeDefined();
-      expect(json.partitives).toHaveLength(2);
-      expect(json.partitives[0].count).toBe('multiple');
-      expect(json.partitives[1].presence).toBe('optional');
-      expect(json.partitives[1].is_delimiting).toBe(true);
-      expect(json.completeness).toBe('partial');
-      expect(json.criterion).toEqual({ eng: 'physical structure' });
-    });
-  });
-});

package/src/__tests__/composables/use-concept-edges-v2.test.ts.bak

@@ -1,166 +0,0 @@
-import { describe, it, expect } from 'vitest';
-// glossarist 0.4.33 renamed PartitiveRelation → PartitiveHyperedge.
-// Import from glossarist/models (extended by our local augmentation).
-import type {
-  PartitiveHyperedge,
-  PartitiveMember,
-  ConceptRef,
-} from 'glossarist/models';
-import {
-  PartitiveHyperedge as PartitiveHyperedgeModel,
-  PartitiveMember as PartitiveMemberModel,
-  ConceptRef as ConceptRefModel,
-} from 'glossarist/models';
-
-/**
- * Verifies glossarist-js 0.4.26's MECE-native PartitiveRelation model
- * (ISO 704:2022 presence × count + is_delimiting).
- *
- * The concept-browser consumes these fields directly (no migration
- * bridge). These specs pin the runtime contract so a regression in
- * upstream is caught here.
- */
-
-function makeRef(source: string, id: string): ConceptRef {
-  return ConceptRefModel.fromJSON({ source, id }) as ConceptRef;
-}
-
-function makePartitive(
-  source: string,
-  id: string,
-  fields: { presence?: 'required' | 'optional'; count?: 'exactly_one' | 'at_least_one' | 'multiple'; isDelimiting?: boolean } = {},
-): PartitiveMember {
-  const data: {
-    ref: ConceptRef;
-    presence?: 'required' | 'optional';
-    count?: 'exactly_one' | 'at_least_one' | 'multiple';
-    is_delimiting?: boolean;
-  } = { ref: makeRef(source, id) };
-  if (fields.presence) data.presence = fields.presence;
-  if (fields.count) data.count = fields.count;
-  if (fields.isDelimiting) data.is_delimiting = fields.isDelimiting;
-  return PartitiveMemberModel.fromJSON(data as unknown as Record<string, unknown>) as PartitiveMember;
-}
-
-function makeRelation(opts: {
-  comprehensive: ConceptRef;
-  partitives: PartitiveMember[];
-  completeness?: 'complete' | 'partial';
-  criterion?: Record<string, string>;
-}): PartitiveHyperedge {
-  return PartitiveHyperedgeModel.fromJSON(opts as unknown as Record<string, unknown>) as PartitiveHyperedge;
-}
-
-describe('useConceptEdges — MECE PartitiveRelation (glossarist 0.4.26)', () => {
-  describe('PartitiveMember (ISO 704:2022 presence × count + delimiting)', () => {
-    it('presence defaults to required, count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.presence).toBe('required');
-      expect(m.presence === "required").toBe(true);
-      expect(m.presence === "optional").toBe(false);
-    });
-
-    it('count defaults to exactly_one', () => {
-      const m = makePartitive('test', '1.1');
-      expect(m.count).toBe('exactly_one');
-    });
-
-    it('presence=optional is preserved', () => {
-      const m = makePartitive('test', '1.1', { presence: 'optional' });
-      expect(m.presence).toBe('optional');
-      expect(m.presence === "optional").toBe(true);
-      expect(m.presence === "required").toBe(false);
-    });
-
-    it('count=multiple is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'multiple' });
-      expect(m.count).toBe('multiple');
-    });
-
-    it('count=at_least_one is preserved', () => {
-      const m = makePartitive('test', '1.1', { count: 'at_least_one' });
-      expect(m.count).toBe('at_least_one');
-    });
-
-    it('is_delimiting defaults to false', () => {
-      const m = makePartitive('test', '1.1');
-      expect((m as any).is_delimiting).toBe(false);
-      expect((m as any).is_delimiting).toBe(false);
-    });
-
-    it('is_delimiting is preserved when set to true', () => {
-      const m = makePartitive('test', '1.1', { isDelimiting: true });
-      expect((m as any).is_delimiting).toBe(true);
-      expect((m as any).is_delimiting).toBe(true);
-    });
-
-    it('rejects the vacuous (presence=optional, count=at_least_one)', () => {
-      expect(() =>
-        makePartitive('test', '1.1', { presence: 'optional', count: 'at_least_one' }),
-      ).toThrow(/collapses to optional \+ multiple/);
-    });
-  });
-
-  describe('PartitiveRelation', () => {
-    it('accepts 2 members with default axes', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).members).toHaveLength(2);
-      expect((r as any).completeness).toBe('complete');
-      expect((r as any).isComplete).toBe(true);
-      expect((r as any).isPartial).toBe(false);
-    });
-
-    it('completeness=partial is preserved', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-        completeness: 'partial',
-      });
-      expect((r as any).completeness).toBe('partial');
-      expect((r as any).isPartial).toBe(true);
-    });
-
-    it('isCoordinate true when ≥2 partitives', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4'), makePartitive('test', '1.5')],
-      });
-      expect((r as any).isCoordinate).toBe(true);
-    });
-
-    it('rejects < 2 partitives (ISO 704 requirement)', () => {
-      expect(() => makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [makePartitive('test', '1.4')],
-      })).toThrow(/≥2 partitives/);
-    });
-
-    it('round-trips through toJSON with MECE fields', () => {
-      const r = makeRelation({
-        comprehensive: makeRef('test', '1.3'),
-        partitives: [
-          makePartitive('test', '1.4', { presence: 'required', count: 'multiple' }),
-          makePartitive('test', '1.5', { presence: 'optional', isDelimiting: true }),
-        ],
-        completeness: 'partial',
-        criterion: { eng: 'physical structure' },
-      });
-      const json = r.toJSON() as {
-        comprehensive: unknown;
-        partitives: Array<{ presence?: string; count?: string; is_delimiting?: boolean; ref: unknown }>;
-        completeness: string;
-        criterion?: Record<string, string>;
-      };
-      expect(json.comprehensive).toBeDefined();
-      expect(json.partitives).toHaveLength(2);
-      expect(json.partitives[0].count).toBe('multiple');
-      expect(json.partitives[1].presence).toBe('optional');
-      expect(json.partitives[1].is_delimiting).toBe(true);
-      expect(json.completeness).toBe('partial');
-      expect(json.criterion).toEqual({ eng: 'physical structure' });
-    });
-  });
-});

package/src/types/agents-version-turtle.d.ts

@@ -1,27 +0,0 @@
-declare module '*/scripts/lib/agents-turtle.mjs' {
-  export function buildAgentsTurtle(
-    contributors: readonly { name: string; role?: string; organization?: string; url?: string; email?: string }[],
-    agentBase?: string,
-  ): string;
-}
-
-declare module '*/scripts/lib/version-turtle.mjs' {
-  export interface VersionInput {
-    readonly registerId: string;
-    readonly version: string;
-    readonly versionIri: string;
-    readonly datasetIri: string;
-    readonly generatedAt: string;
-    readonly previousVersionIri?: string;
-    readonly changeSummary?: string;
-    readonly associatedAgentIri?: string;
-  }
-  export interface VersionHistoryInput {
-    readonly registerId: string;
-    readonly datasetIri: string;
-    readonly versions: readonly { version: string; generatedAt: string; changeSummary?: string }[];
-    readonly associatedAgentIri?: string;
-  }
-  export function buildVersionTurtle(input: VersionInput): string;
-  export function buildVersionHistoryTurtle(input: VersionHistoryInput): string;
-}

package/src/types/bibliography-turtle.d.ts

@@ -1,12 +0,0 @@
-declare module '*/scripts/lib/bibliography-turtle.mjs' {
-  export interface BibliographyEntryJson {
-    readonly reference?: string;
-    readonly title?: string;
-    readonly link?: string;
-  }
-  export function buildBibliographyTurtle(
-    register: string,
-    bibliographyJson: Record<string, BibliographyEntryJson>,
-    baseUri?: string,
-  ): string;
-}

package/src/types/build-activity-turtle.d.ts

@@ -1,16 +0,0 @@
-declare module '*/scripts/lib/build-activity-turtle.mjs' {
-  export interface BuildActivityTurtleInput {
-    readonly runId: string;
-    readonly startedAt: string;
-    readonly endedAt: string;
-    readonly gitSha?: string | null;
-    readonly gitBranch?: string | null;
-    readonly toolId: string;
-    readonly toolVersion: string;
-    readonly datasetRegisters: readonly string[];
-    readonly conceptCount: number;
-    readonly associatedAgentIri?: string | null;
-  }
-
-  export function buildActivityTurtle(input: BuildActivityTurtleInput): string;
-}

package/src/types/build-cache.d.ts

@@ -1,20 +0,0 @@
-declare module '*/scripts/lib/build-cache.mjs' {
-  export interface BuildCacheEntry<T = unknown> {
-    hash: string;
-    value: T;
-    storedAt: string;
-  }
-
-  export class BuildCache {
-    constructor(cacheDir: string);
-    get<T = unknown>(key: string): Promise<BuildCacheEntry<T> | null>;
-    set<T = unknown>(key: string, value: T, hash: string): Promise<void>;
-    readThrough<T>(
-      key: string,
-      hash: string,
-      producer: () => Promise<T>,
-    ): Promise<{ value: T; hit: boolean }>;
-    pathFor(key: string): string;
-    static hash(input: string): string;
-  }
-}

package/src/types/dataset-turtle.d.ts

@@ -1,32 +0,0 @@
-declare module '*/scripts/lib/dataset-turtle.mjs' {
-  export interface DatasetDistribution {
-    readonly id: string;
-    readonly title: string;
-    readonly mediaType: string;
-    readonly downloadUrl: string;
-    readonly byteSize?: number;
-  }
-
-  export interface DatasetSection {
-    readonly collectionIri: string;
-    readonly title: string;
-    readonly memberUris: readonly string[];
-  }
-
-  export interface DatasetTurtleInput {
-    readonly datasetIri: string;
-    readonly registerId: string;
-    readonly title: string;
-    readonly description?: string;
-    readonly modified: string;
-    readonly languages: readonly string[];
-    readonly distributions: readonly DatasetDistribution[];
-    readonly topConceptUris: readonly string[];
-    readonly sections: readonly DatasetSection[];
-    readonly sourceRepoUrl?: string;
-    readonly publisherIri?: string;
-    readonly contactIri?: string;
-  }
-
-  export function buildDatasetTurtle(input: DatasetTurtleInput): string;
-}

package/src/types/normalize-yaml.d.ts

@@ -1,16 +0,0 @@
-declare module '*/scripts/normalize-yaml.mjs' {
-  export interface NormalizeResult {
-    checked: number;
-    nonNfc: number;
-    fixed: string[];
-    check: boolean;
-  }
-
-  export interface NormalizeOptions {
-    root?: string;
-    check?: boolean;
-    paths?: string[];
-  }
-
-  export function normalizeYaml(options?: NormalizeOptions): NormalizeResult;
-}

package/src/types/turtle-escape.d.ts

@@ -1,6 +0,0 @@
-declare module '*/scripts/lib/turtle-escape.mjs' {
-  export function ttlLit(s: unknown): string;
-  export function ttlPrefixed(qname: string): string;
-  export function ttlIri(iri: string): string;
-  export function assertValidIri(iri: unknown, context?: string): string;
-}

package/src/types/vocab-turtle.d.ts

@@ -1,13 +0,0 @@
-declare module '*/scripts/lib/vocab-turtle.mjs' {
-  export interface VocabTerm {
-    readonly iri: string;
-    readonly label: string;
-  }
-  export interface VocabScheme {
-    readonly schemeIri: string;
-    readonly label: string;
-    readonly terms: readonly VocabTerm[];
-  }
-  export function buildVocabularyTurtle(): string;
-  export function listVocabSchemes(): readonly VocabScheme[];
-}