@jini-ai/platform 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.23
+
+- Security hardening.
+
 # @jini-ai/platform
 
 ## 0.6.22

package/dist/web/index.d.ts

@@ -3,4 +3,5 @@
 export * from "./web-page.js";
 export * from "./html-document.js";
 export { htmlToMarkdown } from "./html-to-markdown.js";
+export { stripHtmlPresentation } from "./strip-html-presentation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/web/index.js

@@ -3,4 +3,5 @@
 export * from "./web-page.js";
 export * from "./html-document.js";
 export { htmlToMarkdown } from "./html-to-markdown.js";
+export { stripHtmlPresentation } from "./strip-html-presentation.js";
 //# sourceMappingURL=index.js.map

package/dist/web/strip-html-presentation.d.ts

@@ -0,0 +1,15 @@
+/** Remove presentation using source ranges; untouched bytes (including comments) stay exact.
+ * Scripts, classes and functional attributes are preserved. This is not an HTML sanitizer.
+ * @param required.html - Document or fragment to transform; never mutated.
+ * @param optional.preservedStylesheetHrefs - Exact hrefs retained for host sentinels/vendor CSS.
+ * @returns HTML without style elements/attributes or unretained stylesheet links; no I/O.
+ * @complexity O(n + p + r log r) time and O(n + p + r) space for HTML bytes n,
+ * preserved href bytes p and removal ranges r.
+ * @example stripHtmlPresentation({ html: '<p style="color:red">Hi</p>' })
+ */
+export declare function stripHtmlPresentation({ html }: {
+    html: string;
+}, { preservedStylesheetHrefs }?: {
+    preservedStylesheetHrefs?: readonly string[];
+}): string;
+//# sourceMappingURL=strip-html-presentation.d.ts.map

package/dist/web/strip-html-presentation.js

@@ -0,0 +1,60 @@
+import { parse } from "parse5";
+import { attr } from "./html-document.js";
+/** Select whole elements before attributes; the ordered edit pass skips overlapping ranges. */
+function presentationRange(node, preserved) {
+    const location = node.sourceCodeLocation;
+    if (!location)
+        return undefined;
+    const rel = (attr({ element: node, name: "rel" }) ?? "").toLowerCase().split(/\s+/);
+    const href = attr({ element: node, name: "href" }) ?? "";
+    if (node.tagName === "style")
+        return location;
+    if (node.tagName === "link" && rel.includes("stylesheet") && !preserved.has(href))
+        return location;
+    return location.attrs?.style;
+}
+/** Iterative traversal includes inert template content without recursion or argument spreading. */
+function* walk(root) {
+    const pending = [root];
+    while (pending.length) {
+        const node = pending.pop();
+        yield node;
+        if ("childNodes" in node)
+            for (const child of node.childNodes)
+                pending.push(child);
+        if ("content" in node)
+            pending.push(node.content);
+    }
+}
+/** Remove presentation using source ranges; untouched bytes (including comments) stay exact.
+ * Scripts, classes and functional attributes are preserved. This is not an HTML sanitizer.
+ * @param required.html - Document or fragment to transform; never mutated.
+ * @param optional.preservedStylesheetHrefs - Exact hrefs retained for host sentinels/vendor CSS.
+ * @returns HTML without style elements/attributes or unretained stylesheet links; no I/O.
+ * @complexity O(n + p + r log r) time and O(n + p + r) space for HTML bytes n,
+ * preserved href bytes p and removal ranges r.
+ * @example stripHtmlPresentation({ html: '<p style="color:red">Hi</p>' })
+ */
+export function stripHtmlPresentation({ html }, { preservedStylesheetHrefs = [] } = {}) {
+    const preserved = new Set(preservedStylesheetHrefs);
+    const ranges = [];
+    for (const node of walk(parse(html, { sourceCodeLocationInfo: true, scriptingEnabled: false }))) {
+        if (!("tagName" in node))
+            continue;
+        const range = presentationRange(node, preserved);
+        if (range)
+            ranges.push(range);
+    }
+    ranges.sort((a, b) => a.startOffset - b.startOffset);
+    const parts = [];
+    let end = 0;
+    for (const range of ranges) {
+        if (range.startOffset < end)
+            continue;
+        parts.push(html.slice(end, range.startOffset));
+        end = range.endOffset;
+    }
+    parts.push(html.slice(end));
+    return parts.join("");
+}
+//# sourceMappingURL=strip-html-presentation.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {