@magland/mochi 0.3.1

package/dist/logo.js

@@ -0,0 +1,61 @@
+"use strict";
+// The Mochi Forge logo.
+//
+// The mark is a strike at the anvil: the workpiece square resting on the
+// anvil's face, with three sparks flying off the point of the blow. The
+// logotype sets the short name in letters built from the same two parts, a
+// monoline stroke and a piece of a circle, so mark and word read as one
+// drawing. The letters are strokes rather than outlines, so there is no font
+// dependency and no text-to-path step.
+//
+// The mark sits on a 64 x 64 box, stroke 6, round caps. The workpiece is a
+// 14 x 14 square with corner radius 3, resting half a stroke above the anvil
+// face, a 36-unit horizontal at the bottom. The sparks are stroke segments
+// radiating from the square's top centre at -140, -90, and -40 degrees, from
+// radius 11 out to radius 19, so they cannot help but point back at where the
+// hammer lands. The square's height is solved so the ink margins above and
+// below come out equal: ink runs 9.5 to 54.5 vertically and 11 to 53 across
+// the anvil, which centres the glyph with about 10 units of clear space.
+//
+// The logotype sits on a 232 x 60 box: ascender at 0, x-height top at 20,
+// baseline at 60, stroke 10, round caps and joins. Radius 15 is the only
+// curve in the word, centred on y = 40 throughout: o is a full circle of it,
+// c is the same circle cut open 50 degrees either side of due east, and the
+// arches of m and h are its top half, springing from one stem and landing on
+// the next. Letters carry 8 units of air between outer edges. h's stem and
+// i's tittle are the only ink above the x-height, and no letter descends, so
+// the box stops half a stroke below the baseline. Scaling is uniform only,
+// since the stroke weight is constant by construction and stretching one
+// axis would break it.
+//
+// Both carry stroke="currentColor" so they take the surrounding text colour
+// and need no per-theme variants. The favicon is the exception: nothing there
+// inherits a colour, so it is filled from the active theme (see faviconSvg).
+//
+// The same drawings are checked in as standalone files under logo/assets, for
+// use outside the server; they are inline here because the server ships no static
+// files. Both come from scripts/make-logo.sh, which computes the coordinates
+// from the construction rather than taking them by hand, and which fails if
+// the geometry below has drifted from the files there. Edit the script.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MARK = exports.WORDMARK = void 0;
+exports.faviconSvg = faviconSvg;
+const themes_1 = require("./themes");
+/** The logotype: five letters as monoline strokes and radius-15 curves. 232 x 60. */
+exports.WORDMARK = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 232 60" fill="none" role="img" aria-label="mochi"><g stroke="currentColor" stroke-width="10" stroke-linecap="round" stroke-linejoin="round"><path d="M5 25V55"/><path d="M5 40A15 15 0 0 1 35 40"/><path d="M35 40V55"/><path d="M35 40A15 15 0 0 1 65 40"/><path d="M65 40V55"/><circle cx="98" cy="40" r="15"/><path d="M155.64 28.51A15 15 0 1 0 155.64 51.49"/><path d="M179 5V55"/><path d="M179 40A15 15 0 0 1 209 40"/><path d="M209 40V55"/><path d="M227 25V55"/><circle cx="227" cy="5" r="5" stroke="none" fill="currentColor"/></g></svg>`;
+/** The mark: three sparks over the workpiece square on the anvil face. 64 x 64. */
+exports.MARK = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none" role="img" aria-label="mochi"><path d="M23.57 24.43L17.45 19.29" stroke="currentColor" stroke-width="6" stroke-linecap="round"/><path d="M32 20.5L32 12.5" stroke="currentColor" stroke-width="6" stroke-linecap="round"/><path d="M40.43 24.43L46.55 19.29" stroke="currentColor" stroke-width="6" stroke-linecap="round"/><rect x="25" y="31.5" width="14" height="14" rx="3" fill="currentColor"/><path d="M14 51.5H50" stroke="currentColor" stroke-width="6" stroke-linecap="round"/></svg>`;
+/**
+ * The mark on a rounded tile, for the favicon and any other icon slot. This
+ * is logo/assets/mochi-icon.svg with its two fixed colours replaced: a
+ * favicon inherits nothing from the page, so they are taken from the vault's
+ * theme instead, the tile in the accent and the glyph in the page background.
+ * Every shipped theme pairs those with enough contrast. The glyph is scaled to
+ * 0.7 about the tile's centre, which is what holds its shape down at favicon
+ * sizes, where the sparks close up against the square.
+ */
+function faviconSvg(theme = (0, themes_1.activeTheme)()) {
+    const bg = theme.vars.accent;
+    const fg = theme.vars.bg;
+    return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="mochi"><rect width="64" height="64" rx="14" fill="${bg}"/><g transform="translate(9.6 9.6) scale(0.7)" fill="none"><path d="M23.57 24.43L17.45 19.29" stroke="${fg}" stroke-width="6" stroke-linecap="round"/><path d="M32 20.5L32 12.5" stroke="${fg}" stroke-width="6" stroke-linecap="round"/><path d="M40.43 24.43L46.55 19.29" stroke="${fg}" stroke-width="6" stroke-linecap="round"/><rect x="25" y="31.5" width="14" height="14" rx="3" fill="${fg}"/><path d="M14 51.5H50" stroke="${fg}" stroke-width="6" stroke-linecap="round"/></g></svg>`;
+}

package/dist/markdown.js

@@ -0,0 +1,382 @@
+"use strict";
+// Markdown rendering for repository documents.
+//
+// The target is what GitHub renders, since that is what people write their
+// READMEs against: fenced code with syntax highlighting, LaTeX math, tables,
+// task lists, footnotes, alert callouts, emoji shortcodes, autolinks, heading
+// anchors, and a conservative subset of inline HTML.
+//
+// Two properties are load-bearing and should survive any later rewrite. First,
+// nothing a document author writes may become active markup on this origin: the
+// rendered output passes through an allowlist sanitizer, and the allowlist has
+// no `style` attribute, no scripts, no frames. Second, everything is rendered
+// on the server; no page needs client-side JavaScript to read.
+//
+// Trusted fragments we generate ourselves (highlighted code, KaTeX output)
+// would not survive that allowlist intact, so they are parked in slots: the
+// renderer emits an opaque marker, the sanitizer sees plain text, and the
+// fragments are substituted back afterwards. The marker is random per render,
+// so a document cannot forge one.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMarkdownFile = isMarkdownFile;
+exports.renderMarkdown = renderMarkdown;
+const crypto = __importStar(require("crypto"));
+const highlight_js_1 = __importDefault(require("highlight.js"));
+const katex_1 = __importDefault(require("katex"));
+const markdown_it_1 = __importDefault(require("markdown-it"));
+const markdown_it_katex_1 = __importDefault(require("@vscode/markdown-it-katex"));
+const markdown_it_emoji_1 = require("markdown-it-emoji");
+const markdown_it_footnote_1 = __importDefault(require("markdown-it-footnote"));
+const sanitize_html_1 = __importDefault(require("sanitize-html"));
+const render_1 = require("./render");
+const views_1 = require("./views");
+// GitHub's cross-references: `#12` is that issue, and a hex string of seven
+// or more characters is that commit. The pattern refuses a run that is part
+// of a longer word, and a commit id must contain at least one letter, so that
+// a plain number written in passing is not mistaken for one.
+const CROSS_REF = /(?<![\w#/-])(?:#(\d{1,9})|([0-9a-f]{7,40}))(?![\w-])/g;
+function isMarkdownFile(filename) {
+    const base = filename.split('/').pop() ?? filename;
+    return /\.(md|markdown)$/i.test(base);
+}
+const ALERTS = {
+    note: 'Note',
+    tip: 'Tip',
+    important: 'Important',
+    warning: 'Warning',
+    caution: 'Caution',
+};
+// GitHub-style heading anchors: lowercase, punctuation dropped, spaces to hyphens.
+function slugify(text) {
+    return text
+        .trim()
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N} _-]/gu, '')
+        .replace(/[\s_]+/g, '-');
+}
+function isRelative(url) {
+    return !/^([a-z][a-z0-9+.-]*:|\/|#)/i.test(url);
+}
+// Resolve a relative reference against the file's directory, collapsing the
+// dot segments ourselves so the emitted URL is the path a reader would type.
+function resolveRef(url, base) {
+    const cut = url.search(/[#?]/);
+    const rel = cut === -1 ? url : url.slice(0, cut);
+    const suffix = cut === -1 ? '' : url.slice(cut);
+    const out = [];
+    for (const seg of `${base}/${rel}`.split('/')) {
+        if (seg === '.')
+            continue;
+        if (seg === '..') {
+            if (out.length > 1)
+                out.pop();
+            continue;
+        }
+        out.push(seg);
+    }
+    return out.join('/') + suffix;
+}
+const ALLOWED_TAGS = [
+    'p', 'br', 'hr', 'div', 'span', 'section',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+    'blockquote', 'pre', 'code', 'samp', 'kbd', 'var',
+    'em', 'strong', 'b', 'i', 'u', 's', 'del', 'ins', 'mark', 'small', 'sub', 'sup',
+    'a', 'img', 'picture',
+    'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td', 'caption', 'colgroup', 'col',
+    'details', 'summary', 'figure', 'figcaption',
+    'abbr', 'cite', 'q', 'input',
+];
+// No `style` anywhere: an inline style on document content could cover the
+// rest of the page, which is a phishing surface even without scripting.
+const ALLOWED_ATTRS = {
+    '*': ['id', 'class', 'title', 'align', 'dir', 'lang', 'role', 'aria-label', 'aria-hidden'],
+    a: ['href', 'name', 'target', 'rel'],
+    img: ['src', 'alt', 'width', 'height', 'loading'],
+    th: ['colspan', 'rowspan', 'scope', 'valign'],
+    td: ['colspan', 'rowspan', 'valign'],
+    col: ['span', 'width'],
+    colgroup: ['span'],
+    ol: ['start', 'type', 'reversed'],
+    li: ['value'],
+    details: ['open'],
+    input: ['type', 'checked', 'disabled'],
+};
+function sanitizeOptions(opts) {
+    return {
+        allowedTags: ALLOWED_TAGS,
+        allowedAttributes: ALLOWED_ATTRS,
+        allowedSchemes: ['http', 'https', 'mailto', 'ftp'],
+        allowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],
+        allowProtocolRelative: false,
+        transformTags: {
+            // Rewriting here rather than in a renderer rule covers links written as
+            // markdown and links written as HTML with one implementation.
+            a: (tagName, attribs) => {
+                const href = attribs.href;
+                if (href && isRelative(href)) {
+                    attribs.href = resolveRef(href, opts.blobBase);
+                }
+                else if (href && /^https?:/i.test(href)) {
+                    attribs.rel = 'nofollow noopener noreferrer';
+                }
+                return { tagName, attribs };
+            },
+            img: (tagName, attribs) => {
+                const src = attribs.src;
+                if (src && isRelative(src))
+                    attribs.src = resolveRef(src, opts.rawBase);
+                attribs.loading = 'lazy';
+                return { tagName, attribs };
+            },
+        },
+    };
+}
+function highlight(code, lang) {
+    if (lang && highlight_js_1.default.getLanguage(lang)) {
+        try {
+            return highlight_js_1.default.highlight(code, { language: lang, ignoreIllegals: true }).value;
+        }
+        catch {
+            // fall through to plain escaping
+        }
+    }
+    return (0, render_1.esc)(code);
+}
+function mathHtml(src, display) {
+    try {
+        return katex_1.default.renderToString(src, {
+            displayMode: display,
+            throwOnError: false,
+            // trust:false keeps \href, \htmlClass and friends from emitting markup;
+            // maxSize bounds \rule and similar from blowing up the page.
+            trust: false,
+            maxSize: 500,
+            strict: false,
+        });
+    }
+    catch {
+        return `<code class="math-error">${(0, render_1.esc)(src)}</code>`;
+    }
+}
+function slot(env, html) {
+    env.slots.push(html);
+    return `${env.marker}_${env.slots.length - 1}_`;
+}
+function codeBlock(env, code, lang) {
+    const cls = lang ? ` class="language-${(0, render_1.esc)(lang)}"` : '';
+    // The button sits after the <pre> because the page's copyCmd() copies its
+    // previous sibling.
+    return `${slot(env, `<div class="code-block"><pre><code${cls}>${highlight(code, lang)}</code></pre>${(0, views_1.copyButton)()}</div>`)}\n`;
+}
+function mathBlock(env, src) {
+    return `<div class="math-block">${slot(env, mathHtml(src, true))}</div>\n`;
+}
+function buildMarkdownIt() {
+    const md = new markdown_it_1.default({ html: true, linkify: true });
+    md.use(markdown_it_footnote_1.default);
+    md.use(markdown_it_emoji_1.full);
+    // Cross-references are resolved over the inline token stream in a core
+    // rule, not in an inline rule: by the time inline rules run, markdown-it's
+    // text rule has already swallowed these characters, which is the same
+    // reason its own linkify works this way. Text inside a link is left alone,
+    // so a reference written inside one does not try to nest a second.
+    md.core.ruler.push('mochi_refs', (state) => {
+        const opts = state.env.opts;
+        if (!opts.issueBase && !opts.commitBase)
+            return;
+        for (const block of state.tokens) {
+            if (block.type !== 'inline' || !block.children)
+                continue;
+            const out = [];
+            let inLink = 0;
+            let changed = false;
+            for (const token of block.children) {
+                if (token.type === 'link_open')
+                    inLink++;
+                else if (token.type === 'link_close')
+                    inLink--;
+                if (token.type !== 'text' || inLink > 0) {
+                    out.push(token);
+                    continue;
+                }
+                let last = 0;
+                CROSS_REF.lastIndex = 0;
+                for (let m = CROSS_REF.exec(token.content); m; m = CROSS_REF.exec(token.content)) {
+                    const [whole, issue, sha] = m;
+                    const href = issue
+                        ? opts.issueBase && `${opts.issueBase}/${issue}`
+                        : sha && /[a-f]/.test(sha) && opts.commitBase
+                            ? `${opts.commitBase}/${sha}`
+                            : undefined;
+                    if (!href)
+                        continue;
+                    if (m.index > last) {
+                        const before = new state.Token('text', '', 0);
+                        before.content = token.content.slice(last, m.index);
+                        out.push(before);
+                    }
+                    const open = new state.Token('link_open', 'a', 1);
+                    open.attrSet('href', href);
+                    const label = new state.Token('text', '', 0);
+                    // A full commit id is shown abbreviated, the way it is written
+                    // everywhere else in the interface.
+                    label.content = sha && sha.length > 7 ? sha.slice(0, 7) : whole;
+                    const close = new state.Token('link_close', 'a', -1);
+                    out.push(open, label, close);
+                    last = m.index + whole.length;
+                    changed = true;
+                }
+                if (last === 0) {
+                    out.push(token);
+                }
+                else if (last < token.content.length) {
+                    const rest = new state.Token('text', '', 0);
+                    rest.content = token.content.slice(last);
+                    out.push(rest);
+                }
+            }
+            if (changed)
+                block.children = out;
+        }
+    });
+    md.renderer.rules.fence = (tokens, idx, _options, env) => {
+        const token = tokens[idx];
+        const info = token.info.trim().split(/\s+/)[0].toLowerCase();
+        if (info === 'math')
+            return mathBlock(env, token.content);
+        return codeBlock(env, token.content, info || null);
+    };
+    md.renderer.rules.code_block = (tokens, idx, _options, env) => codeBlock(env, tokens[idx].content, null);
+    // The plugin renders math itself; we route it through a slot instead so the
+    // sanitizer never has to allow KaTeX's own markup.
+    md.use(markdown_it_katex_1.default, {});
+    md.renderer.rules.math_inline = (tokens, idx, _options, env) => slot(env, mathHtml(tokens[idx].content, false));
+    md.renderer.rules.math_block = (tokens, idx, _options, env) => mathBlock(env, tokens[idx].content);
+    md.renderer.rules.math_inline_block = (tokens, idx, _options, env) => mathBlock(env, tokens[idx].content);
+    // markdown-it expresses column alignment as an inline style, which the
+    // sanitizer strips; carry it in the align attribute instead, as GitHub does.
+    const alignRule = (tokens, idx, options, _env, self) => {
+        const token = tokens[idx];
+        const style = token.attrGet('style');
+        const m = style ? /text-align:\s*(left|center|right)/.exec(style) : null;
+        if (m && token.attrs) {
+            token.attrs = token.attrs.filter((a) => a[0] !== 'style');
+            token.attrSet('align', m[1]);
+        }
+        return self.renderToken(tokens, idx, options);
+    };
+    md.renderer.rules.th_open = alignRule;
+    md.renderer.rules.td_open = alignRule;
+    md.renderer.rules.heading_open = (tokens, idx, options, env, self) => {
+        const e = env;
+        const inline = tokens[idx + 1];
+        const slug = slugify(inline && inline.type === 'inline' ? inline.content : '');
+        e.pendingSlug = '';
+        if (slug) {
+            const seen = e.used.get(slug) ?? 0;
+            e.used.set(slug, seen + 1);
+            e.pendingSlug = seen === 0 ? slug : `${slug}-${seen}`;
+            tokens[idx].attrSet('id', e.pendingSlug);
+        }
+        return self.renderToken(tokens, idx, options);
+    };
+    md.renderer.rules.heading_close = (tokens, idx, options, env, self) => {
+        const e = env;
+        const anchor = e.pendingSlug
+            ? `<a class="heading-anchor" href="#${e.pendingSlug}" aria-label="Permalink to this heading">#</a>`
+            : '';
+        e.pendingSlug = '';
+        return anchor + self.renderToken(tokens, idx, options);
+    };
+    // Alert callouts and task lists are both a marker at the head of a
+    // paragraph, so both are handled before inline parsing turns that paragraph
+    // into children: rewriting `content` here is all it takes.
+    md.core.ruler.before('inline', 'github_extras', (state) => {
+        const tokens = state.tokens;
+        for (let i = 0; i < tokens.length; i++) {
+            const token = tokens[i];
+            if (token.type === 'blockquote_open' &&
+                tokens[i + 1]?.type === 'paragraph_open' &&
+                tokens[i + 2]?.type === 'inline') {
+                const m = /^\[!(note|tip|important|warning|caution)\][ \t]*(\r?\n|$)/i.exec(tokens[i + 2].content);
+                if (m) {
+                    const kind = m[1].toLowerCase();
+                    token.attrJoin('class', `alert alert-${kind}`);
+                    const rest = tokens[i + 2].content.slice(m[0].length);
+                    tokens[i + 2].content = rest;
+                    if (rest.trim() === '') {
+                        tokens[i + 1].hidden = true;
+                        tokens[i + 3].hidden = true;
+                    }
+                    const title = new state.Token('html_block', '', 0);
+                    title.content = `<p class="alert-title">${ALERTS[kind]}</p>\n`;
+                    tokens.splice(i + 1, 0, title);
+                    i += 1;
+                }
+                continue;
+            }
+            if (token.type === 'inline' &&
+                tokens[i - 1]?.type === 'paragraph_open' &&
+                tokens[i - 2]?.type === 'list_item_open') {
+                const m = /^\[([ xX])\][ \t]+/.exec(token.content);
+                if (m) {
+                    const checked = m[1].toLowerCase() === 'x' ? ' checked' : '';
+                    token.content = `<input type="checkbox" disabled${checked}> ${token.content.slice(m[0].length)}`;
+                    tokens[i - 2].attrJoin('class', 'task-item');
+                }
+            }
+        }
+    });
+    return md;
+}
+// Built once, at load. Every render's state rides in the env instead.
+const MD = buildMarkdownIt();
+function renderMarkdown(text, opts) {
+    const env = {
+        opts,
+        slots: [],
+        // Random per render, so a document cannot forge a slot marker.
+        marker: `md${crypto.randomBytes(9).toString('hex')}`,
+        used: new Map(),
+        pendingSlug: '',
+    };
+    const html = (0, sanitize_html_1.default)(MD.render(text, env), sanitizeOptions(opts));
+    return html.replace(new RegExp(`${env.marker}_(\\d+)_`, 'g'), (_all, n) => env.slots[Number(n)] ?? '');
+}