@gmickel/gno 1.46.0 → 2.1.0

package/vendor/converters/upstream-manifest.json

@@ -0,0 +1,124 @@
+{
+  "packages": [
+    {
+      "bytes": 19307,
+      "files": {
+        "LICENSE": "0a239bab80dbea3f193a52baaebb69b5f7c213128a4d75a2d8e204b58bd59d62",
+        "dist/index.cjs": "009b3c3855ecd1440aad679d3023b093f5baf36545c580ff1815ba806c0c05d9",
+        "dist/index.d.cts": "582cee2d06d9e148e54edcfa07ed9366f53cfb0dbec8b7c92f0045ff6459ac8f",
+        "dist/index.d.mts": "582cee2d06d9e148e54edcfa07ed9366f53cfb0dbec8b7c92f0045ff6459ac8f",
+        "dist/index.d.ts": "582cee2d06d9e148e54edcfa07ed9366f53cfb0dbec8b7c92f0045ff6459ac8f",
+        "dist/index.mjs": "c132387a246ba2a3ece1e09b55ccdadba13b4a39d3b4bc90d2dea6b9bc78129e",
+        "package.json": "b7288fb0dccecb56b0046066b1279548bdc10b16121b697faac47c7ef09fb575"
+      },
+      "integrity": "sha512-QcGD+ilrtgBli+XH7YoEURfE345SYsOmxlB40HYGCccbkJb1DTf09iW7rMFcsQQ7mpEVEyYsvgDWVFC1sTp+4w==",
+      "name": "markitdown-ts",
+      "sha256": "4777de6ddad0156e1e7d6178bbc617aaa6d6b206eaf202421f927f89b020b71e",
+      "url": "https://registry.npmjs.org/markitdown-ts/-/markitdown-ts-0.0.10.tgz",
+      "version": "0.0.10"
+    },
+    {
+      "bytes": 3822894,
+      "files": {
+        "LICENSE": "f7b176a1baf2fc244f24078764a89919d1a01208fa98507997c041e7f6062649",
+        "dist/OfficeConverter.d.ts": "30cb1267b20be01cfb91107e5fc734bbc3d2978e239ca93c717b5e2b1ec0a7f2",
+        "dist/OfficeConverter.js": "896f1893d2670859945915dc3c989f1bdfbf9fbcedab68b4099dedf8e867dcfe",
+        "dist/OfficeGenerator.d.ts": "c70170200d46876072f9a3a019c23cc106ba0041f61b236bf6292c6a26c9f9a6",
+        "dist/OfficeGenerator.js": "9d5fee46cd4b8607eb6e796d5357bf35f5801fd363217b682531debc77b8ae50",
+        "dist/OfficeParser.d.ts": "20194cb889852e22d26081147d788bab632fb4c3382d6e581a5e2573adcd633f",
+        "dist/OfficeParser.js": "bba408140d48f1912127fb29065fbf837deecdd4e729b97c9e64a576a37676f7",
+        "dist/cli.d.ts": "885642ba4f766acd810a07991b784c1897995c56a4badd0ce9e03a0962ed77c9",
+        "dist/cli.js": "5858ee373993dcaea2655e8f26fbf710cd65af81999fb0bd1b16aa4eb7bd8960",
+        "dist/defaults.d.ts": "a4ed847559f5bff4cca08d10ac0f28d8357ef616bd9870cad0624c2cd8337458",
+        "dist/defaults.js": "c02e664e5cd5ad45e474de844994b57ed1d2afe0ae3689a92f06c2118a855c2e",
+        "dist/generators/BaseGenerator.d.ts": "92e420e2e88218fd333c31330c0e836aa5e93124a8263f38c21c6b70435fc2c9",
+        "dist/generators/BaseGenerator.js": "72e55a8c1fda39444f200b6fee3a00c084e9104f9c9890072fc512d537c2a26f",
+        "dist/generators/ChunkingGenerator.d.ts": "7cb6a2bf1d6c2338fa4538d0d007b6664782f260d104d8a7458d212a0b3d1330",
+        "dist/generators/ChunkingGenerator.js": "c0c44e58d556d5c299b3cc281b6d84ac34951807fbeb6ab194f9599888fecb75",
+        "dist/generators/CsvGenerator.d.ts": "bb6dbb622b68d0d2621c2f44989030ae1440b64fcab237a2d00d9d5b4f036044",
+        "dist/generators/CsvGenerator.js": "59d68ea89ee660b3bdbf2cd11c083df5138bb74933e29d24a21c1dd3d21e6b3f",
+        "dist/generators/EpubGenerator.d.ts": "84df1eecdc8e16b97b10364e27648fd8253ddba893aa3f871d015476368f856e",
+        "dist/generators/EpubGenerator.js": "f369b004d941b3595a59ac3b533ab1881d48293f2a0b9fb8493da11e99a89c38",
+        "dist/generators/HtmlGenerator.d.ts": "ba8d8fafcdbd4e7a6c29cd3aa7101964a7db7b15b5ddcc1099464cfca227fdd2",
+        "dist/generators/HtmlGenerator.js": "7a7a071d63916d3b0bd589a200f143d0d65d37fac0c3b9a0985c3215d53e3a47",
+        "dist/generators/MarkdownGenerator.d.ts": "0901892e34823b93cd32dc50dc27abcb20f2533f5194a74452bdf1cd31decfb4",
+        "dist/generators/MarkdownGenerator.js": "f0416c633d166dc7556943c40a7d4a575f18ff2e006ffce0ae27cccb8794daad",
+        "dist/generators/PdfGenerator.d.ts": "d26043e8c1a42326a8ded664b7617f12f551e9827174d8a6282cc1b2bc9fa558",
+        "dist/generators/PdfGenerator.js": "0c96c60745515774fb2d1418e47256960592c422b8e468b9d2b5069854c0710d",
+        "dist/generators/RtfGenerator.d.ts": "09846bddf291531505d71ce293408a72a23b829a3b9676b091f223a22566358c",
+        "dist/generators/RtfGenerator.js": "bf2dc4b9833af5282c50c4833dceabc9dc394400d7582f6f11b44b49176ad06f",
+        "dist/generators/TextGenerator.d.ts": "ec2fbdae38bb4b13509b9b4411d29ee48433ad22d21838fb367724ce19d8ff7e",
+        "dist/generators/TextGenerator.js": "db1462ba8b6982948fb624a87dc423ab2f69cbc8a716ca58a1e6f21f171e0ad5",
+        "dist/index.d.ts": "157cf7e9f3ca61e96936a1ce86cdf31c4bd31eba9ad30554f0ccd5aaf0f9b1a5",
+        "dist/index.js": "ec89a8a2e33f8509056280b2c07af16950d6fc6a38b7802b908a1bd8ef3720b7",
+        "dist/index.mjs": "026f427bfb975016bc8c3b5148112fba9ba684d8040f1bcbd77ec74d3270d47d",
+        "dist/officeparser.browser.d.ts": "96e4e215677dbc2a3e1749eb0a90983c16f8fac1de44eab6fb542c29417019ae",
+        "dist/officeparser.browser.iife.js": "1b5cb1bd77ec2624bbcdefd1ed92f79d24930a6286a8c1e776578aee50790604",
+        "dist/officeparser.browser.mjs": "456942d7cb7b378eb29b2bfe1cf09721ee673c6a1ffbeac6fec8e12196e6794f",
+        "dist/officeparser.browser.slim.d.ts": "96e4e215677dbc2a3e1749eb0a90983c16f8fac1de44eab6fb542c29417019ae",
+        "dist/officeparser.browser.slim.iife.js": "afca5a1a5508dc59ad420ad5c12439e6c339a034228a034913e86f1637820c4c",
+        "dist/officeparser.browser.slim.mjs": "dfa3745c1514249a1c8706ccbf0c32d5d8a8370926efe1ee9a38c34a4fa4b841",
+        "dist/parsers/CsvParser.d.ts": "0d4b3e19d8c9afd717e2525b9a395c33b0fae9099ddc58d6bfcfb031cbe630b9",
+        "dist/parsers/CsvParser.js": "4d560185cd67cc66a413bd6894872df8b5ff06d510f2220a186da8dc06c335b8",
+        "dist/parsers/EpubParser.d.ts": "1ef277c50347b566c106291c72916e4f4ce0df0b01ace2794a449b3faad4afbb",
+        "dist/parsers/EpubParser.js": "77f1a0ffa3686c8c4d6a322b1d6fd0271ccc064a20510c423beaf959b03644a2",
+        "dist/parsers/ExcelParser.d.ts": "983f733954ee31f67c3499d024d70688a45aae19842d243367ef61cec41d53dd",
+        "dist/parsers/ExcelParser.js": "c094455c6a7de0d5d6fcbee8fad89320e810ca06799d68ff394fc103f5ecd14e",
+        "dist/parsers/HtmlParser.d.ts": "1c6d7d97fd134627c2771c43f6eb61ec0a2324d527f57c6962bc534047e0db4a",
+        "dist/parsers/HtmlParser.js": "41748f1a199700d09528be0df7cd6785647b613327926c65ea2fa9014818b46c",
+        "dist/parsers/MarkdownParser.d.ts": "e184337be6ac41b81ce57710210b69be7c2033dd2942286090e6e8615fe5da91",
+        "dist/parsers/MarkdownParser.js": "2ad4632e246f1cdd60be5ed90ba1307a1231a0d1413694d5b84217c8837ca097",
+        "dist/parsers/OpenOfficeParser.d.ts": "e1135e1287e701a73c8ef77fa31be296d1b7915fccd4c2b3abdcecc62f8eeef2",
+        "dist/parsers/OpenOfficeParser.js": "7f9b846e0d460fde8611d4fe9ef503ce46db9d5a3db3dceaa3084e64d6356d0c",
+        "dist/parsers/PdfParser.d.ts": "2dbe5d3d0a5f627c007ee54bf58d8273e76f241c5ed4e0fac54cfcbe142d1640",
+        "dist/parsers/PdfParser.js": "eb4efd9ff4102f372e4769ad97a116df2394410574d2d89fabc7c363f9c83288",
+        "dist/parsers/PowerPointParser.d.ts": "973ce1300923beec814edeaca8b7ded449213d04243f66d69f55d269873516ee",
+        "dist/parsers/PowerPointParser.js": "93bb2860a5f700eee5c8c5596b216ef7ea6a854a1aad0a1400cdeced27eae5e7",
+        "dist/parsers/RtfParser.d.ts": "cb4b7c35695589d57d9334a0c9c3e940aa2a287dac19bf6675cdeb56ec6b1524",
+        "dist/parsers/RtfParser.js": "3b8d6a527039ee6c91f6bfdbeca4925ab1bf4bc5316dcda44922045fbde6ab92",
+        "dist/parsers/WordParser.d.ts": "a1b1ae0c50b027731006fed1a906566b1e11fec454bc177ce502a95140c0ea52",
+        "dist/parsers/WordParser.js": "287507e8327516d21a928f47019df4aa982b3fa8992974c6e34f3a8e12b4e25e",
+        "dist/sbom.cdx.json": "ff31cb7dcfbabf38cc395e543b889e10c74f5700b168f0ca18e33059943bf99f",
+        "dist/types.d.ts": "24874c9dafd26270e0548e410ba3c2cccf9d824d7f75db892f1c44877690e15b",
+        "dist/types.js": "57757ebf1a4a339dcb80b02ccffa63aac0d88e090a0e50457a0411b39bb9bafa",
+        "dist/utils/astUtils.d.ts": "1d214edace0a9243048ec22e1ac954550973226156b442e674a64e499e55e851",
+        "dist/utils/astUtils.js": "802fc6940607d4c81254e0e73bee9aeca83cba9f005c1856ff7477861649d47c",
+        "dist/utils/chartUtils.d.ts": "fb572932f73223dbdc3a243225eb042a960a32f4d656815afaa00f154c5d7d94",
+        "dist/utils/chartUtils.js": "b79dfb8c9e25eee8f42c95aa4ba5638f9eaac1808dca36a6d4e8348df0c9a2ec",
+        "dist/utils/configUtils.d.ts": "a20d9c34f1fbbbc8c976df77df8aafbd0c7041425dcc8723648638ce489c69cf",
+        "dist/utils/configUtils.js": "3c0ce78cf27d29d28dcf0f2d4c01ecf2117ec87bbe969beddc851554164c4228",
+        "dist/utils/dateUtils.d.ts": "64fba783e2b50d536476a6719512554a60c983e74a991ac5f8d41670d96d8841",
+        "dist/utils/dateUtils.js": "3d9c4fb8c66749d16bbcab8e569f6ef4708e930b768ca4360c20b60381c38868",
+        "dist/utils/envUtils.d.ts": "6028404c4f8eb884816471828a1e163c30d0b86b0f510ca113e696ba38c41270",
+        "dist/utils/envUtils.js": "b16c1a8a2b5fdc2c6412f068ee74b3be16f073bd85081994d660df6ab379baf4",
+        "dist/utils/errorUtils.d.ts": "45ad30f2f8ab66fb8316711fe7407d54b1bdc2608802fe00d197b3eff01181a3",
+        "dist/utils/errorUtils.js": "abd7409a4386b22e8cc1c729c2e3542ebaeb0d42ffb9acbc875ce250bffade3c",
+        "dist/utils/imageUtils.d.ts": "1caf3808039758f9c561754c83b530e7316bbbedae51f135185c23bad3cf2432",
+        "dist/utils/imageUtils.js": "4221642375f7c056927c7d9e623f87415029aa7ceda185341c96a2cfa123fab5",
+        "dist/utils/mathUtils.d.ts": "51bbf1b9f543ab4ef14efffc7447a0f95bad09a7b5162829686b447a9fabbc40",
+        "dist/utils/mathUtils.js": "333aa518254adda6ceb2b112ea5ca6d421b0de26c79099df19098bbc1f32d038",
+        "dist/utils/moduleLoader.d.ts": "97119ce26f095a7139d8f18f9f3e6bb8dbe6f871090a17ea3bb46b374c951d51",
+        "dist/utils/moduleLoader.js": "6baf5ddafb6a6630835d9561fe83d7701976725e46402ce9d4a36b2062cfa806",
+        "dist/utils/ocrUtils.d.ts": "3f237ec9728dac6b9b07a2469ad67f31cc08c2014ca5a923b3e1f0eaeb0c0084",
+        "dist/utils/ocrUtils.js": "388f163d4eb766014de95335e9524ee05d99ff7feaf4a05fefa269df356224ed",
+        "dist/utils/sanitize.d.ts": "647c217e9f9d3a16d71adf30b415382c149850b0b9c4712e95af93a9d5eaa14a",
+        "dist/utils/sanitize.js": "8f76f363d6cf73e2db58ac6fbe0b999711e485560bb43ddbacc69ecca45d57e9",
+        "dist/utils/sheetUtils.d.ts": "e4104ee85adc240755bd1257c0854ceaafdf369c6431385c43cb3039e148455f",
+        "dist/utils/sheetUtils.js": "abbf7b2e23f554bd4eb75e8a28eb6f072e0589d44f791a3ad2144979dc065489",
+        "dist/utils/styleMapper.d.ts": "10aefac83b1e37763de68e3fa674d514ede9d852b3e4a7d48a79b0c49d63c84e",
+        "dist/utils/styleMapper.js": "ac1118edc6460500079e9397395f81fb6e91f8899a8d0a580f5d293c9f0d447e",
+        "dist/utils/xmlUtils.d.ts": "317c62f6ae3326925cbcf9330c737696d809a66876eaf3a5d937cddc8ce00d93",
+        "dist/utils/xmlUtils.js": "46cc42922bc88b4344c2150b2a3b7b81dfdc85f33454a7b4b2533f5789e2d12e",
+        "dist/utils/zipUtils.d.ts": "986617903a88ed97adc77f57ca76dfc867bd9a241823a93e4be4397b5be045bc",
+        "dist/utils/zipUtils.js": "971bbc39e7c54ec2aa0e0c37cd0c7c05e5d5384109a7a31decb20a690f8da447",
+        "package.json": "027203373c6f05784a6d87c72a47c412340201046dc6a84c1cc7259185bbdbde"
+      },
+      "integrity": "sha512-z3stbbcwTA4HsGuUz2XJEBbl6WV1X2qCvuiokc2D0593wnu8H7kaD9UY5YAHc8uMjMhH07FxXikzP0BFLSna4A==",
+      "name": "officeparser",
+      "sha256": "a49dc7370938e62523b02f43b3d690f41a0229162d9ff292c60e9cbeedc6e779",
+      "url": "https://registry.npmjs.org/officeparser/-/officeparser-7.8.0.tgz",
+      "version": "7.8.0"
+    }
+  ],
+  "schemaVersion": 1
+}

package/vendor/dependency-fixes/README.md

@@ -0,0 +1,77 @@
+# Converter dependency repair
+
+GNO imports the unchanged upstream distributions under `vendor/converters`.
+These are ordinary source files in GNO's package, not installed npm dependency
+packages. Their original manifests and licenses are retained verbatim for
+provenance. No upstream manifest was patched. GNO's root dependencies supply
+their external imports, including these corrected parser edges:
+
+| Distribution         | Upstream dependency | GNO dependency                  |
+| -------------------- | ------------------- | ------------------------------- |
+| markitdown-ts 0.0.10 | xlsx ^0.18.5        | official SheetJS 0.20.3 tarball |
+| officeparser 7.8.0   | pdfjs-dist 6.1.200  | pdfjs-dist 6.3.289              |
+
+The official SheetJS URL is
+`https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz`.
+Its 2,409,319 bytes have integrity
+`sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==`.
+It has no install lifecycle scripts. MarkItDown uses the retained `read` and
+`utils.sheet_to_html` APIs for GNO's buffer conversion path. PDF-parse retains
+its independent PDF.js 5.4.296 dependency; do not globally override it to 6.
+
+## Reproduce upstream files
+
+Run from the repository root, with a destination that does not exist:
+
+```sh
+python3 vendor/dependency-fixes/vendor-converters.py /path/to/new/converters
+```
+
+The script verifies pinned upstream tarball SHA512 values before copying any
+distribution files. It copies every upstream `dist` file, original package
+manifest, and license/notice unchanged. `upstream-manifest.json` records original
+tarball SHA256, SHA512, byte counts, and each retained file's SHA256. MarkItDown
+contributes 7 files; Officeparser contributes 92. The receipt is the 100th file.
+No repacked upstream tarball is shipped. Never format the upstream files.
+
+GNO's root manifest must retain the external dependencies required by these
+distributions. The tested dependency set was @joplin/turndown-plugin-gfm 1.0.67,
+@xmldom/xmldom 0.9.12, ai 6.0.277, jsdom 25.0.1, mammoth 1.12.2,
+mime-types 2.1.35, pdf-parse 2.4.5, turndown 7.2.4, the SheetJS URL above,
+fflate 0.8.3, file-type 22.0.2, pdfjs-dist 6.3.289, tesseract.js 7.0.0,
+and zod 4.4.3. Existing GNO dependencies may advance under their own gates.
+
+## Consumer feasibility evidence
+
+An isolated parent tarball containing these distributions and normal root
+dependencies was installed into fresh npm 11.17.0 and Bun 1.4.2 consumers with
+installation scripts disabled. Both consumers resolved XLSX 0.20.3 from the
+vendored MarkItDown location and PDF.js 6.3.289 from the vendored Officeparser
+location. Both converted the real XLSX fixture (Widget/Gadget) and PPTX fixture
+(presentation title/speaker notes). Native dependencies were installed normally
+by each consumer; no platform-specific dependency tree was bundled.
+
+Rejected approaches: nested `file:vendor/child.tgz` dependencies failed ENOENT in
+both package managers; full dependency bundling added over 100 MB compressed
+and captured platform-specific native dependencies; omitting the bundled
+transitive closure left imports unresolved. Root overrides alone do not control
+downstream npm consumers.
+
+Focused repository verification:
+
+```sh
+bun test test/converters/vendored-dependencies.test.ts test/converters/integration.test.ts test/converters/protected-files.test.ts test/converters/pipeline.test.ts
+```
+
+The provenance/resolution regression checks every retained upstream file and the
+two corrected parser versions. Integration coverage exercises PDF, DOCX, XLSX,
+PPTX and protected-file behavior. Full GNO packed-consumer validation remains
+part of the release gate; the isolated feasibility probe does not replace it.
+
+Primary sources:
+
+- https://docs.sheetjs.com/docs/getting-started/installation/nodejs/
+- https://github.com/advisories/GHSA-5pgg-2g8v-p4x9
+- https://registry.npmjs.org/markitdown-ts/0.0.10
+- https://registry.npmjs.org/officeparser/7.8.0
+- https://docs.npmjs.com/cli/v11/configuring-npm/package-json/#overrides

package/vendor/dependency-fixes/vendor-converters.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Copy pinned upstream converter distributions verbatim into a NEW output root.
+
+Usage: python3 vendor/dependency-fixes/vendor-converters.py OUTPUT_DIRECTORY
+No installation, lifecycle scripts, package manifest edits, or Git operations.
+The caller promotes external dependencies into GNO's root manifest and imports
+these distributions directly; their upstream package manifests stay unchanged.
+"""
+
+import base64
+import hashlib
+import io
+import json
+from pathlib import Path, PurePosixPath
+import sys
+import tarfile
+import urllib.request
+
+PACKAGES = (
+    (
+        "markitdown-ts",
+        "0.0.10",
+        "sha512-QcGD+ilrtgBli+XH7YoEURfE345SYsOmxlB40HYGCccbkJb1DTf09iW7rMFcsQQ7mpEVEyYsvgDWVFC1sTp+4w==",
+    ),
+    (
+        "officeparser",
+        "7.8.0",
+        "sha512-z3stbbcwTA4HsGuUz2XJEBbl6WV1X2qCvuiokc2D0593wnu8H7kaD9UY5YAHc8uMjMhH07FxXikzP0BFLSna4A==",
+    ),
+)
+
+
+def main():
+    if len(sys.argv) != 2:
+        raise SystemExit(__doc__)
+    output = Path(sys.argv[1])
+    output.mkdir(parents=True, exist_ok=False)
+    receipt = {"schemaVersion": 1, "packages": []}
+    for name, version, integrity in PACKAGES:
+        url = f"https://registry.npmjs.org/{name}/-/{name}-{version}.tgz"
+        with urllib.request.urlopen(url, timeout=60) as response:
+            data = response.read()
+        actual = "sha512-" + base64.b64encode(hashlib.sha512(data).digest()).decode()
+        if actual != integrity:
+            raise RuntimeError(f"Upstream integrity mismatch: {name}")
+        record = {
+            "name": name,
+            "version": version,
+            "url": url,
+            "integrity": actual,
+            "sha256": hashlib.sha256(data).hexdigest(),
+            "bytes": len(data),
+            "files": {},
+        }
+        with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
+            for member in archive:
+                path = PurePosixPath(member.name)
+                if path.is_absolute() or ".." in path.parts or path.parts[0] != "package":
+                    raise RuntimeError(f"Unsafe archive entry: {member.name}")
+                relative = PurePosixPath(*path.parts[1:])
+                selected = (
+                    relative.parts and relative.parts[0] == "dist"
+                    or str(relative) == "package.json"
+                    or relative.name.upper().startswith(("LICENSE", "NOTICE"))
+                )
+                if not selected or member.isdir():
+                    continue
+                if not member.isfile():
+                    raise RuntimeError(f"Nonregular distribution entry: {member.name}")
+                payload = archive.extractfile(member).read()
+                destination = output / name / str(relative)
+                destination.parent.mkdir(parents=True, exist_ok=True)
+                destination.write_bytes(payload)
+                record["files"][str(relative)] = hashlib.sha256(payload).hexdigest()
+        receipt["packages"].append(record)
+    (output / "upstream-manifest.json").write_text(
+        json.dumps(receipt, indent=2, sort_keys=True) + "\n"
+    )
+    print(json.dumps({"output": str(output), "packages": len(PACKAGES)}))
+
+
+if __name__ == "__main__":
+    main()

package/browser-extension/artifacts/gno-browser-clipper-v1.46.0.zip.sha256

@@ -1 +0,0 @@
-303bbadcb92766b35c3b21aaf66ac959b36679159e90014a06499ff6a84e5708  gno-browser-clipper-v1.46.0.zip