@lionrapid/core 0.4.0 → 0.6.0

package/dist/content/sanitizer/HTMLSanitizer.js

@@ -0,0 +1,257 @@
+/**
+ * Shared allowlist HTML sanitizer — pure string functions, Node-safe (no DOM).
+ *
+ * One implementation for every sink that turns translation data into HTML:
+ * core's HTMLSerializer/auto-translator, the editor text sinks, the snapshot
+ * viewer, react `<Trans>`, and WordPress TS. The WordPress PHP port must
+ * mirror `SAFE_TAGS`/`SAFE_ATTRS` exactly (see improvement-plan §4 item 2).
+ *
+ * Threat model: translation values (and their `raw:` styles) come from the
+ * server/KV and may be attacker-controlled — they are NOT guaranteed to be in
+ * canonical form. Everything here is allowlist-based: unknown tags are
+ * rejected, unknown attributes dropped, URL schemes checked after entity
+ * decoding.
+ *
+ * @module content/sanitizer/HTMLSanitizer
+ */
+import { extractTagName, readRawStyle, serializeOpeningTag } from '../canonical-tag.js';
+/**
+ * Inline formatting elements allowed inside translated content. Block
+ * structure lives outside ContentUnit (block-level pipeline), so anything
+ * that isn't inline text formatting is rejected outright.
+ */
+export const SAFE_TAGS = new Set([
+    'a', 'abbr', 'b', 'bdi', 'bdo', 'br', 'cite', 'code', 'del', 'dfn',
+    'em', 'i', 'img', 'ins', 'kbd', 'mark', 'q', 's', 'samp', 'small',
+    'span', 'strong', 'sub', 'sup', 'time', 'u', 'var', 'wbr',
+]);
+/**
+ * Flat attribute allowlist (plus `data-*`/`aria-*` prefixes, handled in
+ * `sanitizeOpeningTag`). Kept flat — not per-tag — so the PHP mirror stays
+ * trivial; an allowed attribute on the wrong tag is inert.
+ */
+export const SAFE_ATTRS = new Set([
+    'alt', 'cite', 'class', 'datetime', 'dir', 'height', 'href', 'id',
+    'lang', 'loading', 'rel', 'role', 'src', 'target', 'title', 'width',
+]);
+/** Attributes whose values are URLs and must pass `sanitizeUrl`. */
+const URL_ATTRS = new Set(['href', 'src', 'cite']);
+/**
+ * CSS properties allowed through an inline `style` attribute.
+ *
+ * RISK NOTE — why `style` never passes through verbatim: with zero
+ * JavaScript, an attacker who controls a style value can render a
+ * full-viewport overlay (`position:fixed;inset:0` → pixel-perfect fake
+ * login UI on the customer's real domain), fire tracking/exfiltration
+ * beacons via `url(...)`, or hide and deface content. Translation data is
+ * attacker-writable in our threat model, so `sanitizeStyle` re-parses the
+ * declarations and keeps only the properties below: cosmetic text/font
+ * properties whose value grammar cannot fetch a URL and cannot reposition
+ * or restack the element (no `position`/`inset`/`display`/`z-index`/
+ * `opacity`/`transform`, no `background` shorthand). A smuggled `url(...)`
+ * inside an allowed property is doubly inert: the value is rejected here,
+ * and these properties ignore URL values anyway.
+ *
+ * CONTINUOUS DEVELOPMENT: this allowlist is intentionally minimal and is
+ * expected to grow deliberately as real sites surface legitimate inline
+ * styling the strict set drops (tracked as a WATCH item in
+ * IMPLEMENTATION.md). When extending it: (1) never add a property that
+ * accepts `url()`/`image()`/`element()` values or that affects layout,
+ * positioning, or stacking; (2) add both hostile and benign cases to
+ * html-sanitizer.test.ts; (3) mirror the change in the WordPress PHP port.
+ */
+export const SAFE_STYLE_PROPS = new Set([
+    'color', 'background-color', 'font-family', 'font-size', 'font-style',
+    'font-weight', 'letter-spacing', 'line-height', 'text-decoration',
+    'text-decoration-color', 'text-decoration-line', 'text-decoration-style',
+    'text-transform', 'vertical-align', 'white-space', 'word-spacing',
+]);
+/**
+ * Value-level rejections inside an otherwise-allowed declaration: URL/code
+ * carriers, and backslashes because CSS escape sequences (`\75\72\6c`)
+ * can spell `url(` past a textual check.
+ */
+const DANGEROUS_CSS_VALUE = /url\s*\(|expression\s*\(|image-set\s*\(|element\s*\(|paint\s*\(|javascript:|\\|[<>{}@]/i;
+const SAFE_SCHEMES = new Set(['http', 'https', 'mailto', 'tel']);
+/**
+ * The named entities that matter for scheme smuggling (`&colon;`, `&Tab;`)
+ * plus the basic set. Names are case-sensitive, as in HTML.
+ */
+const NAMED_ENTITIES = {
+    amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ',
+    colon: ':', semi: ';', sol: '/', bsol: '\\',
+    Tab: '\t', NewLine: '\n',
+};
+/**
+ * Decode entities exactly once — mirroring the single decode a browser does
+ * when parsing an attribute value out of HTML.
+ */
+function decodeEntities(value) {
+    return value.replace(/&(?:#[xX]([0-9a-fA-F]+);?|#(\d+);?|([a-zA-Z]+);)/g, (full, hex, dec, name) => {
+        if (hex)
+            return String.fromCodePoint(parseInt(hex, 16));
+        if (dec)
+            return String.fromCodePoint(parseInt(dec, 10));
+        return NAMED_ENTITIES[name] ?? full;
+    });
+}
+/** HTML-escape text for safe use in element content or attribute values. */
+export function escapeHtml(text) {
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Validate a URL attribute value. Returns the value unchanged when safe,
+ * or `null` when it must be dropped.
+ *
+ * Entity-decodes first, then strips the control/whitespace characters
+ * browsers ignore inside a scheme (`jav\tascript:`), then requires any
+ * explicit scheme to be on the allowlist. Scheme-less (relative) URLs pass.
+ */
+export function sanitizeUrl(value) {
+    const decoded = decodeEntities(value);
+    // eslint-disable-next-line no-control-regex -- stripping C0 controls/space/DEL is the point
+    const probe = decoded.replace(/[\u0000-\u0020\u007f]/g, '').toLowerCase();
+    const scheme = /^([a-z][a-z0-9+.-]*):/.exec(probe);
+    if (!scheme)
+        return value;
+    return SAFE_SCHEMES.has(scheme[1]) ? value : null;
+}
+/**
+ * Sanitize an inline `style` attribute value by re-parsing its declarations
+ * and keeping only `SAFE_STYLE_PROPS` with clean values (see the risk note
+ * on `SAFE_STYLE_PROPS`). Returns the rebuilt declaration list in canonical
+ * `prop: value; prop: value` form, or `null` when nothing survives — the
+ * caller then drops the attribute entirely.
+ */
+export function sanitizeStyle(value) {
+    return filterCssDeclarations(value, true);
+}
+/**
+ * Relaxed CSS profile for the snapshot viewer: keeps ANY standard property
+ * (a snapshot is a full captured page — `position:fixed` navbars and layout
+ * styles are legitimate and must render) but still rejects value-level
+ * dangers: `url(...)` beacons, `expression()`, CSS escape smuggling. The
+ * residual risk (page-authored overlay styles) is accepted for snapshots:
+ * the PM is deliberately viewing arbitrary captured pages, and the editor
+ * UI itself lives in a Shadow DOM host stacked above the snapshot root.
+ */
+export function sanitizeCssDeclarations(value) {
+    return filterCssDeclarations(value, false);
+}
+function filterCssDeclarations(value, requirePropAllowlist) {
+    const decoded = decodeEntities(value);
+    const kept = [];
+    for (const declaration of decoded.split(';')) {
+        const colon = declaration.indexOf(':');
+        if (colon === -1)
+            continue;
+        const prop = declaration.slice(0, colon).trim().toLowerCase();
+        const val = declaration.slice(colon + 1).trim();
+        if (!/^[a-z-]+$/.test(prop))
+            continue; // also blocks --custom-prop indirection
+        if (requirePropAllowlist && !SAFE_STYLE_PROPS.has(prop))
+            continue;
+        if (val === '' || DANGEROUS_CSS_VALUE.test(val))
+            continue;
+        kept.push(`${prop}: ${val}`);
+    }
+    return kept.length > 0 ? kept.join('; ') : null;
+}
+/**
+ * Attribute scanner for a (possibly hostile, non-canonical) opening tag.
+ * Handles double-quoted, single-quoted, unquoted, and bare boolean attrs.
+ */
+const ATTR_PATTERN = /([^\s=/>"']+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]*)))?/g;
+/**
+ * Sanitize a raw opening tag (`raw:` style payload). Returns the canonical
+ * rebuilt tag with only allowlisted attributes, or `null` when the element
+ * itself is not allowed — callers must then drop the tag entirely (emit the
+ * indexed marker verbatim / skip the element).
+ */
+export function sanitizeOpeningTag(rawOpen) {
+    if (!rawOpen.startsWith('<'))
+        return null;
+    const tagName = extractTagName(rawOpen);
+    if (!/^[a-z][a-z0-9-]*$/.test(tagName) || !SAFE_TAGS.has(tagName)) {
+        return null;
+    }
+    // The slice between `<tagname` and the closing `>` (or end of string —
+    // hostile input may be truncated).
+    const end = rawOpen.endsWith('/>')
+        ? rawOpen.length - 2
+        : rawOpen.endsWith('>')
+            ? rawOpen.length - 1
+            : rawOpen.length;
+    const attrSource = rawOpen.slice(1 + tagName.length, end);
+    const attrs = {};
+    for (const match of attrSource.matchAll(ATTR_PATTERN)) {
+        const name = match[1].toLowerCase();
+        const value = match[2] ?? match[3] ?? match[4] ?? '';
+        if (name in attrs)
+            continue; // first occurrence wins, as in HTML
+        if (name === 'style') {
+            // Never verbatim — re-parsed against the CSS property allowlist.
+            const cleanStyle = sanitizeStyle(value);
+            if (cleanStyle !== null)
+                attrs[name] = cleanStyle;
+            continue;
+        }
+        const allowed = SAFE_ATTRS.has(name) ||
+            /^data-[a-z0-9-]*$/.test(name) ||
+            /^aria-[a-z0-9-]*$/.test(name);
+        if (!allowed)
+            continue;
+        if (URL_ATTRS.has(name)) {
+            if (sanitizeUrl(value) === null)
+                continue;
+        }
+        attrs[name] = value;
+    }
+    return serializeOpeningTag(tagName, attrs);
+}
+/**
+ * Sanitize a ContentUnit at an ingest boundary: run every `raw:` style
+ * through {@link sanitizeOpeningTag} so no dangerous element/attribute/scheme
+ * enters the translation store. Render-time sinks (HTMLSerializer etc.)
+ * sanitize again — this is the store-side half, protecting every other
+ * consumer of stored units (server, MT/TM, exports, the WP PHP port).
+ *
+ * `text` is never modified, so `generateAutoKey(unit.text)` is unaffected —
+ * key parity across surfaces holds even for hostile input. A rejected
+ * element's `raw:` style is dropped entirely; the indexed tag left in the
+ * text is emitted by serializers as an inert marker. Returns the SAME object
+ * when nothing changed, so benign units round-trip identically.
+ */
+export function sanitizeContentUnit(unit) {
+    let changed = false;
+    const styles = {};
+    for (const [index, styleList] of Object.entries(unit.styles)) {
+        const raw = readRawStyle(styleList);
+        if (raw === null) {
+            styles[index] = styleList; // no raw tag → nothing to sanitize
+            continue;
+        }
+        const safe = sanitizeOpeningTag(raw);
+        if (safe === null) {
+            // Element rejected — drop the raw style (keep any non-raw entries).
+            changed = true;
+            const rest = styleList.filter((s) => !s.startsWith('raw:'));
+            if (rest.length > 0)
+                styles[index] = rest;
+        }
+        else if (safe === raw) {
+            styles[index] = styleList;
+        }
+        else {
+            changed = true;
+            styles[index] = styleList.map((s) => (s.startsWith('raw:') ? `raw:${safe}` : s));
+        }
+    }
+    return changed ? { text: unit.text, styles } : unit;
+}
+//# sourceMappingURL=HTMLSanitizer.js.map

package/dist/content/sanitizer/HTMLSanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HTMLSanitizer.js","sourceRoot":"","sources":["../../../src/content/sanitizer/HTMLSanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IAC/B,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;IAClE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO;IACjE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;CAC1D,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;IACjE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;CACpE,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY;IACrE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB;IACjE,uBAAuB,EAAE,sBAAsB,EAAE,uBAAuB;IACxE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc;CAClE,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,yFAAyF,CAAC;AAE5F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAC3D,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;IAC3C,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;CACzB,CAAC;AAEF;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAClB,mDAAmD,EACnD,CAAC,IAAI,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,EAAE;QAC/C,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,4FAA4F;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAa,EACb,oBAA6B;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,wCAAwC;QAC/E,IAAI,oBAAoB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,IAAI,GAAG,KAAK,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAChB,6DAA6D,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrB,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,IAAI,IAAI,KAAK;YAAE,SAAS,CAAC,oCAAoC;QACjE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,iEAAiE;YACjE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GACX,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YACpB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,SAAS;QAC5C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,mCAAmC;YAC9D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,oEAAoE;YACpE,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC"}

package/dist/content/serializer/HTMLSerializer.d.ts

@@ -2,8 +2,12 @@
  * HTML serializer — converts ContentUnit back to HTML strings (raw-only).
  *
  * Every indexed tag carries a `raw:<opening tag>` style. The serializer
- * emits the stored opening tag verbatim and derives the close tag from
- * the embedded tag name. Void elements get no close tag.
+ * routes the stored opening tag through the shared allowlist sanitizer and
+ * derives the close tag from the embedded tag name. Void elements get no
+ * close tag. Text segments are HTML-escaped (ContentUnit.text holds decoded
+ * Unicode — see MarkupParser.decodeEntities), so serializer output is inert
+ * even when the translation value is attacker-controlled. `ContentUnit.text`
+ * itself is never modified — auto_key hashing is unaffected.
  *
  * @module content/serializer/HTMLSerializer
  */

package/dist/content/serializer/HTMLSerializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HTMLSerializer.d.ts","sourceRoot":"","sources":["../../../src/content/serializer/HTMLSerializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAe,YAAW,WAAW,CAAC,MAAM,CAAC;IACxD,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM;CAsCrC"}
+{"version":3,"file":"HTMLSerializer.d.ts","sourceRoot":"","sources":["../../../src/content/serializer/HTMLSerializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAe,YAAW,WAAW,CAAC,MAAM,CAAC;IACxD,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM;CAyCrC"}

package/dist/content/serializer/HTMLSerializer.js

@@ -2,12 +2,17 @@
  * HTML serializer — converts ContentUnit back to HTML strings (raw-only).
  *
  * Every indexed tag carries a `raw:<opening tag>` style. The serializer
- * emits the stored opening tag verbatim and derives the close tag from
- * the embedded tag name. Void elements get no close tag.
+ * routes the stored opening tag through the shared allowlist sanitizer and
+ * derives the close tag from the embedded tag name. Void elements get no
+ * close tag. Text segments are HTML-escaped (ContentUnit.text holds decoded
+ * Unicode — see MarkupParser.decodeEntities), so serializer output is inert
+ * even when the translation value is attacker-controlled. `ContentUnit.text`
+ * itself is never modified — auto_key hashing is unaffected.
  *
  * @module content/serializer/HTMLSerializer
  */
 import { extractTagName, readRawStyle, VOID_TAGS } from '../canonical-tag.js';
+import { escapeHtml, sanitizeOpeningTag } from '../sanitizer/HTMLSanitizer.js';
 /**
  * Serializer that converts ContentUnit format back to HTML strings.
  *
@@ -29,11 +34,12 @@ export class HTMLSerializer {
         let lastIndex = 0;
         let match;
         while ((match = tagPattern.exec(text)) !== null) {
-            result += text.slice(lastIndex, match.index);
+            result += escapeHtml(text.slice(lastIndex, match.index));
             const [fullMatch, closingSlash, indexStr] = match;
             const styleList = styles[indexStr] ?? [];
             const rawOpen = readRawStyle(styleList);
-            if (rawOpen) {
+            const safeOpen = rawOpen === null ? null : sanitizeOpeningTag(rawOpen);
+            if (rawOpen && safeOpen !== null) {
                 const tagName = extractTagName(rawOpen);
                 const isVoid = VOID_TAGS.has(tagName);
                 if (closingSlash) {
@@ -43,17 +49,19 @@ export class HTMLSerializer {
                 else {
                     // Both <N> and <N/> emit the opening tag. For void tags that's the
                     // complete element.
-                    result += rawOpen;
+                    result += safeOpen;
                 }
             }
             else {
-                // No raw style — preserve indexed marker so the bug is visible rather
-                // than silently dropping content.
+                // No raw style, or the sanitizer rejected the element — preserve the
+                // indexed marker (parses as inert text) so the problem is visible
+                // rather than silently dropping content, and never emit a close tag
+                // for a rejected element.
                 result += fullMatch;
             }
             lastIndex = match.index + fullMatch.length;
         }
-        result += text.slice(lastIndex);
+        result += escapeHtml(text.slice(lastIndex));
         return result;
     }
 }

package/dist/content/serializer/HTMLSerializer.js.map

@@ -1 +1 @@
-{"version":3,"file":"HTMLSerializer.js","sourceRoot":"","sources":["../../../src/content/serializer/HTMLSerializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACzB,SAAS,CAAC,IAAiB;QACzB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC9B,MAAM,UAAU,GAAG,qBAAqB,CAAC;QAEzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAExC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,OAAO,GAAG,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,oBAAoB;oBACpB,MAAM,IAAI,OAAO,CAAC;gBACpB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,kCAAkC;gBAClC,MAAM,IAAI,SAAS,CAAC;YACtB,CAAC;YAED,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"HTMLSerializer.js","sourceRoot":"","sources":["../../../src/content/serializer/HTMLSerializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACzB,SAAS,CAAC,IAAiB;QACzB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC9B,MAAM,UAAU,GAAG,qBAAqB,CAAC;QAEzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAEzD,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAEvE,IAAI,OAAO,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,OAAO,GAAG,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,oBAAoB;oBACpB,MAAM,IAAI,QAAQ,CAAC;gBACrB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,kEAAkE;gBAClE,oEAAoE;gBACpE,0BAA0B;gBAC1B,MAAM,IAAI,SAAS,CAAC;YACtB,CAAC;YAED,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/content/splitter/BlockSplitter.d.ts

@@ -0,0 +1,66 @@
+/**
+ * BlockSplitter — string-level block scanner shared across surfaces.
+ *
+ * Lifted from the edge proxy's `translate-html.ts` scanner (webhook Phase 10)
+ * so non-DOM surfaces (edge Worker, webhook Worker) split HTML into the SAME
+ * block boundaries instead of hand-rolling a second parser. The browser DOM
+ * path (`browser/block-extractor.ts`) mirrors the same tag sets via
+ * `querySelectorAll`.
+ *
+ * Structural only: finds innermost block elements (p, h1–h6, li, td, …) and
+ * orphan inline `<a>` outside any block, returning each block's opening tag,
+ * raw attribute string, and byte-exact innerHTML with source offsets. No
+ * keying, no exclude filtering, no translation — callers layer their own
+ * policy (edge: data-i18n precedence + ExcludeFilter + replacement stamping;
+ * webhook P13: `toContentUnit(inner)` + `generateAutoKey` per block). Blocks
+ * inside skip tags (`<script>`/`<style>`/`<pre>`/…), HTML comments, or
+ * `data-no-translate` / `translate="no"` regions are not emitted.
+ *
+ * Pure string ops — Worker-safe and Node-safe (no DOM, no Node APIs).
+ *
+ * @module content/splitter/BlockSplitter
+ */
+export interface HtmlBlock {
+    /** Lowercased tag name (`p`, `h2`, `a`, …). */
+    tag: string;
+    /** The exact opening-tag source text, e.g. `<p class="intro">`. */
+    openTag: string;
+    /** Raw attribute string from the opening tag (verbatim, may be empty). */
+    attrs: string;
+    /** The block's innerHTML, byte-exact as it appears in the input. */
+    inner: string;
+    /** Offset of `inner` within the input html. */
+    innerStart: number;
+    /** Offset just past `inner` — the `<` of the matching closing tag. */
+    innerEnd: number;
+}
+export interface SplitBlocksResult {
+    /** Captured blocks in document order; ranges never overlap. */
+    blocks: HtmlBlock[];
+}
+/**
+ * Find the matching close tag for a given tag name starting from pos.
+ * Returns the index of the '<' of the closing tag, or -1 if not found.
+ */
+export declare function findCloseTag(html: string, pos: number, tagName: string): number;
+/**
+ * Split an HTML string into its translatable block elements.
+ *
+ * Walks the string once; each captured block is innermost (an outer block
+ * whose innerHTML contains another block tag is skipped in favor of the
+ * inner one) and non-overlapping, so replacing inners via
+ * `replaceBlockInners` is always position-safe.
+ */
+export declare function splitBlocks(html: string): SplitBlocksResult;
+/**
+ * Splice replacement innerHTML into blocks previously returned by
+ * `splitBlocks(html)` for the SAME html string. Blocks not listed keep
+ * their source content; wrapper tags and attributes are never touched.
+ *
+ * Applied end-to-start so earlier offsets stay valid.
+ */
+export declare function replaceBlockInners(html: string, replacements: ReadonlyArray<{
+    block: HtmlBlock;
+    inner: string;
+}>): string;
+//# sourceMappingURL=BlockSplitter.d.ts.map

package/dist/content/splitter/BlockSplitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BlockSplitter.d.ts","sourceRoot":"","sources":["../../../src/content/splitter/BlockSplitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AA6CD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAmB/E;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAmI3D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/D,MAAM,CAOR"}

package/dist/content/splitter/BlockSplitter.js

@@ -0,0 +1,219 @@
+/**
+ * BlockSplitter — string-level block scanner shared across surfaces.
+ *
+ * Lifted from the edge proxy's `translate-html.ts` scanner (webhook Phase 10)
+ * so non-DOM surfaces (edge Worker, webhook Worker) split HTML into the SAME
+ * block boundaries instead of hand-rolling a second parser. The browser DOM
+ * path (`browser/block-extractor.ts`) mirrors the same tag sets via
+ * `querySelectorAll`.
+ *
+ * Structural only: finds innermost block elements (p, h1–h6, li, td, …) and
+ * orphan inline `<a>` outside any block, returning each block's opening tag,
+ * raw attribute string, and byte-exact innerHTML with source offsets. No
+ * keying, no exclude filtering, no translation — callers layer their own
+ * policy (edge: data-i18n precedence + ExcludeFilter + replacement stamping;
+ * webhook P13: `toContentUnit(inner)` + `generateAutoKey` per block). Blocks
+ * inside skip tags (`<script>`/`<style>`/`<pre>`/…), HTML comments, or
+ * `data-no-translate` / `translate="no"` regions are not emitted.
+ *
+ * Pure string ops — Worker-safe and Node-safe (no DOM, no Node APIs).
+ *
+ * @module content/splitter/BlockSplitter
+ */
+const BLOCK_TAGS = new Set([
+    'title', 'p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'li', 'td', 'th', 'label', 'button', 'figcaption',
+    'dt', 'dd', 'summary', 'caption',
+]);
+// Inline elements eligible for "orphan" extraction. The scanner jumps past
+// every captured block via findCloseTag, so any <a> the main loop visits has
+// no captured-block parent (e.g. <div><a>X</a></div>). Conservative on
+// purpose: only <a> — mirrors browser INLINE_BLOCK_SELECTOR.
+const INLINE_BLOCK_TAGS = new Set(['a']);
+const SKIP_TAGS = new Set([
+    'script', 'style', 'code', 'pre', 'textarea', 'noscript', 'svg',
+]);
+/** Tag regex — matches <tag attrs>, </tag>, <tag/> with quoted attributes */
+const TAG_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9]*)((?:\s+[a-zA-Z][a-zA-Z0-9-]*(?:=(?:"[^"]*"|'[^']*'|[^\s>]*))?)*)\s*(\/?)>/g;
+/**
+ * Check if an attribute string contains data-no-translate or translate="no"
+ */
+function hasNoTranslateAttr(attrsString) {
+    if (attrsString.includes('data-no-translate'))
+        return true;
+    return /translate\s*=\s*["']no["']/.test(attrsString);
+}
+/**
+ * Check if innerHTML contains a block-level opening tag
+ */
+function containsBlockTag(innerHTML) {
+    TAG_REGEX.lastIndex = 0;
+    let match;
+    while ((match = TAG_REGEX.exec(innerHTML)) !== null) {
+        const [, closingSlash, tagName, , selfClosingSlash] = match;
+        if (!closingSlash && !selfClosingSlash && BLOCK_TAGS.has(tagName.toLowerCase())) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Find the matching close tag for a given tag name starting from pos.
+ * Returns the index of the '<' of the closing tag, or -1 if not found.
+ */
+export function findCloseTag(html, pos, tagName) {
+    const lowerTag = tagName.toLowerCase();
+    let depth = 1;
+    TAG_REGEX.lastIndex = pos;
+    let match;
+    while ((match = TAG_REGEX.exec(html)) !== null) {
+        const [, closingSlash, matchedTag, , selfClosingSlash] = match;
+        if (matchedTag.toLowerCase() !== lowerTag)
+            continue;
+        if (closingSlash) {
+            depth--;
+            if (depth === 0)
+                return match.index;
+        }
+        else if (!selfClosingSlash) {
+            depth++;
+        }
+    }
+    return -1;
+}
+/**
+ * Split an HTML string into its translatable block elements.
+ *
+ * Walks the string once; each captured block is innermost (an outer block
+ * whose innerHTML contains another block tag is skipped in favor of the
+ * inner one) and non-overlapping, so replacing inners via
+ * `replaceBlockInners` is always position-safe.
+ */
+export function splitBlocks(html) {
+    const blocks = [];
+    let pos = 0;
+    let skipDepth = 0;
+    let iter = 0;
+    const maxIter = 100_000;
+    // Stack of byte-positions where each open no-translate region ends.
+    // Pushed when we encounter `<TAG data-no-translate>` (any element);
+    // drained when `pos` reaches/passes the recorded end. While the stack
+    // is non-empty, block + orphan-inline extraction is suppressed.
+    const noTranslateEnds = [];
+    while (pos < html.length && iter < maxIter) {
+        iter++;
+        const ltPos = html.indexOf('<', pos);
+        if (ltPos === -1)
+            break;
+        // Check for HTML comment
+        if (html.startsWith('<!--', ltPos)) {
+            const commentEnd = html.indexOf('-->', ltPos + 4);
+            if (commentEnd === -1)
+                break; // unclosed comment, stop
+            pos = commentEnd + 3;
+            continue;
+        }
+        // Try to match a tag at this position
+        TAG_REGEX.lastIndex = ltPos;
+        const match = TAG_REGEX.exec(html);
+        // If no match or match isn't at ltPos, skip past this '<'
+        if (!match || match.index !== ltPos) {
+            pos = ltPos + 1;
+            continue;
+        }
+        const [fullMatch, closingSlash, tagName, attrsString, selfClosingSlash] = match;
+        const tag = tagName.toLowerCase();
+        const afterMatch = match.index + fullMatch.length;
+        // Handle skip tags
+        if (SKIP_TAGS.has(tag)) {
+            if (closingSlash) {
+                if (skipDepth > 0)
+                    skipDepth--;
+            }
+            else if (!selfClosingSlash) {
+                skipDepth++;
+            }
+            pos = afterMatch;
+            continue;
+        }
+        // Inside skip region
+        if (skipDepth > 0) {
+            pos = afterMatch;
+            continue;
+        }
+        // Drain no-translate ranges we've exited (pos beyond the recorded end).
+        while (noTranslateEnds.length &&
+            pos >= noTranslateEnds[noTranslateEnds.length - 1]) {
+            noTranslateEnds.pop();
+        }
+        // Open a new no-translate region when this tag carries the attribute
+        // and isn't self-closing. Record its END position (the `<` of `</TAG>`)
+        // so the drain loop above can pop us out cleanly.
+        if (!closingSlash && !selfClosingSlash && hasNoTranslateAttr(attrsString)) {
+            const regionEnd = findCloseTag(html, afterMatch, tagName);
+            if (regionEnd !== -1) {
+                noTranslateEnds.push(regionEnd);
+            }
+        }
+        // Inside a no-translate region (including the tag that opened it) —
+        // suppress extraction. We still advance through tags so the stack
+        // drains correctly when we exit.
+        if (noTranslateEnds.length > 0) {
+            pos = afterMatch;
+            continue;
+        }
+        // Block tags + orphan inline <a>: same capture logic. Any <a> reaching
+        // here has no captured-block ancestor — the scanner jumps past every
+        // captured block's closing tag.
+        if ((BLOCK_TAGS.has(tag) || INLINE_BLOCK_TAGS.has(tag)) &&
+            !closingSlash &&
+            !selfClosingSlash) {
+            // An unclosed no-translate tag lands here (no region was pushed);
+            // findCloseTag returns the same -1 → skipped like any malformed block.
+            const closeTagStart = findCloseTag(html, afterMatch, tagName);
+            if (closeTagStart === -1) {
+                // Malformed — skip
+                pos = afterMatch;
+                continue;
+            }
+            const innerHTML = html.slice(afterMatch, closeTagStart);
+            // If innerHTML contains nested block tags, skip this outer element
+            // and let the scanner extract the inner blocks
+            if (containsBlockTag(innerHTML)) {
+                pos = afterMatch;
+                continue;
+            }
+            blocks.push({
+                tag,
+                openTag: fullMatch,
+                attrs: attrsString,
+                inner: innerHTML,
+                innerStart: afterMatch,
+                innerEnd: closeTagStart,
+            });
+            // Skip past the closing tag
+            TAG_REGEX.lastIndex = closeTagStart;
+            const closeMatch = TAG_REGEX.exec(html);
+            pos = closeMatch ? closeMatch.index + closeMatch[0].length : closeTagStart + 1;
+            continue;
+        }
+        pos = afterMatch;
+    }
+    return { blocks };
+}
+/**
+ * Splice replacement innerHTML into blocks previously returned by
+ * `splitBlocks(html)` for the SAME html string. Blocks not listed keep
+ * their source content; wrapper tags and attributes are never touched.
+ *
+ * Applied end-to-start so earlier offsets stay valid.
+ */
+export function replaceBlockInners(html, replacements) {
+    const ordered = [...replacements].sort((a, b) => b.block.innerStart - a.block.innerStart);
+    let result = html;
+    for (const { block, inner } of ordered) {
+        result = result.slice(0, block.innerStart) + inner + result.slice(block.innerEnd);
+    }
+    return result;
+}
+//# sourceMappingURL=BlockSplitter.js.map