@markup-carve/pandoc-carve 0.1.3 → 0.1.4

package/README.md

@@ -160,6 +160,35 @@ The complete node-by-node contract lives in the test goldens. Worked
 input/output pairs in both directions - including how interactive constructs
 degrade for print formats - are in [`examples/`](examples/README.md).
 
+## Dangerous URL schemes are blanked
+
+A link or image destination whose scheme Carve's spec denies (PART 9 §25 -
+`javascript:`, `vbscript:`, `data:`, `file:`, and the OS protocol-handler class
+such as `ms-msdt:`, `search-ms:`, `shell:`, `vscode:` and `jar:`) leaves this
+bridge as an **empty target**, and an `unsafe-url-scheme` diagnostic is emitted
+naming the scheme and the destination that was refused.
+
+Carve's own HTML, Markdown and ANSI writers all blank it, and the clause binds
+every target that emits a resolvable URL. Pandoc's targets are not HTML, but
+`pandoc -f json -t html` is one command away - passing the scheme through here
+would not be a narrower policy, it would be the same sink one step removed.
+
+The diagnostic is `lossy`, so `--fail-on-loss` stops on it and a caller reading
+`diagnostics` can act on it. The scheme list and the scheme probe are mirrored
+from the engine rather than invented, and a test drives the engine's own writer
+over both to keep the mirror honest - the probe strips control characters and
+Unicode whitespace before it reads a scheme, so `<U+202F>javascript:` and
+`java<DEL>script:` are caught along with the plain spelling.
+
+Nothing else is touched. An `https:`, `mailto:`, `tel:`, `ftp:`, relative or
+fragment destination reaches pandoc exactly as written, and emits no
+diagnostic.
+
+> [!NOTE]
+> This covers link and image **destinations**. An `{onclick=…}`, `{style=…}` or
+> `{srcdoc=…}` attribute, which Carve's HTML writer also refuses, still reaches
+> pandoc - see [#163](https://github.com/markup-carve/pandoc-carve/issues/163).
+
 ## Why a bridge, not a pandoc reader?
 
 A native `Text.Pandoc.Readers.Carve` upstream would be a fourth full Carve

package/dist/attribute-sanitize.d.ts

@@ -0,0 +1,6 @@
+/** Attribute names Carve never emits, regardless of value. */
+export declare const DANGEROUS_ATTR_NAMES: readonly string[];
+/** Mirror of Carve's always-on PART 9 §25 attribute-name policy. */
+export declare function isDangerousAttrName(name: string): boolean;
+/** Mirror of Carve's always-on PART 9 §25 attribute-value policy. */
+export declare function renderedAttrValue(name: string, value: string): string;

package/dist/attribute-sanitize.js

@@ -0,0 +1,55 @@
+import { DANGEROUS_URL_SCHEMES, SCHEME_PROBE_STRIP_RE } from './url-scheme.js';
+/** Attribute names Carve never emits, regardless of value. */
+export const DANGEROUS_ATTR_NAMES = ['srcdoc', 'formaction'];
+const DANGEROUS_NAMES = new Set(DANGEROUS_ATTR_NAMES);
+const DANGEROUS_VALUE_SCHEMES = new Set(DANGEROUS_URL_SCHEMES);
+const ASCII_WHITESPACE = '\\t\\n\\f\\r ';
+const URL_LIST_SEPARATORS = new Map([
+    ['srcset', new RegExp(`[,${ASCII_WHITESPACE}]+`)],
+    ['imagesrcset', new RegExp(`[,${ASCII_WHITESPACE}]+`)],
+    ['ping', new RegExp(`[${ASCII_WHITESPACE}]+`)],
+    ['attributionsrc', new RegExp(`[${ASCII_WHITESPACE}]+`)],
+]);
+/** Mirror of Carve's always-on PART 9 §25 attribute-name policy. */
+export function isDangerousAttrName(name) {
+    const normalized = name.toLowerCase();
+    return normalized.startsWith('on') || DANGEROUS_NAMES.has(normalized);
+}
+function hasDeniedValueScheme(value) {
+    const colon = value.indexOf(':');
+    if (colon === -1)
+        return false;
+    const scheme = value.slice(0, colon).replace(SCHEME_PROBE_STRIP_RE, '').toLowerCase();
+    return DANGEROUS_VALUE_SCHEMES.has(scheme);
+}
+function decodeCssEscapes(value) {
+    return value.replace(/\\([0-9a-f]{1,6}\s?|[\s\S])/gi, (_match, escape) => {
+        if (!/^[0-9a-f]/i.test(escape))
+            return escape;
+        const codePoint = Number.parseInt(escape.trim(), 16);
+        return Number.isFinite(codePoint) && codePoint <= 0x10ffff
+            ? String.fromCodePoint(codePoint)
+            : '';
+    });
+}
+function hasDangerousCss(value) {
+    const compact = decodeCssEscapes(value.replace(/\/\*[\s\S]*?\*\//g, ''))
+        .toLowerCase()
+        .replace(/\s+/g, '');
+    return compact.includes('expression(')
+        || compact.includes('url(')
+        || compact.includes('@import')
+        || compact.includes('behavior:')
+        || compact.includes('-moz-binding');
+}
+/** Mirror of Carve's always-on PART 9 §25 attribute-value policy. */
+export function renderedAttrValue(name, value) {
+    if (hasDeniedValueScheme(value))
+        return '';
+    const separator = URL_LIST_SEPARATORS.get(name.toLowerCase());
+    if (separator && value.split(separator).some((part) => part !== '' && hasDeniedValueScheme(part)))
+        return '';
+    if (name.toLowerCase() === 'style' && hasDangerousCss(value))
+        return '';
+    return value;
+}

package/dist/convert.js

@@ -13,11 +13,34 @@ import * as P from './pandoc.js';
 import { readRowGroups } from './row-groups.js';
 import { diagnostic } from './diagnostics.js';
 import { provenanceAttr } from './provenance.js';
+import { blankDeniedDestination, probeScheme } from './url-scheme.js';
+import { isDangerousAttrName, renderedAttrValue } from './attribute-sanitize.js';
 import { SMART_PUNCTUATION_GLYPHS } from '@markup-carve/carve';
 function warn(ctx, msg, details, sourceLocation) {
     ctx.warnings.push(msg);
     ctx.diagnostics.push(diagnostic('carve-to-pandoc', msg, details, sourceLocation));
 }
+/**
+ * A destination with a PART 9 §25 scheme blanked, and said out loud.
+ *
+ * The engine's writers blank it and the AST keeps what the author wrote, so
+ * without this the scheme reaches pandoc intact and `pandoc -f json -t html`
+ * puts it straight back into an `href` (markup-carve/pandoc-carve#157). Only
+ * schemes the engine denies are touched, and it denies none that a LaTeX or
+ * Typst document has a legitimate use for.
+ *
+ * `lossy`, not `normalized`: the author's destination does not survive, and
+ * `--fail-on-loss` is the switch a caller who would rather stop than lose it
+ * already reaches for.
+ */
+function safeDestination(ctx, url, kind) {
+    const blanked = blankDeniedDestination(url);
+    if (blanked === url)
+        return url;
+    warn(ctx, `url: a denied scheme on a ${kind} destination is blanked - ` +
+        `"${truncateForWarning(url)}"`, { scheme: probeScheme(url), destination: url, construct: kind });
+    return blanked;
+}
 /**
  * A warning carries enough of the dropped content to find it in the source,
  * and not a whole fenced block.
@@ -26,9 +49,20 @@ function truncateForWarning(content) {
     const flat = content.replace(/\s+/g, ' ').trim();
     return flat.length > 80 ? `${flat.slice(0, 77)}...` : flat;
 }
-function toAttr(attrs) {
+function toAttr(ctx, attrs) {
     const a = (attrs ?? {});
-    const kvs = Object.entries(a.keyValues ?? {});
+    const kvs = [];
+    for (const [name, value] of Object.entries(a.keyValues ?? {})) {
+        if (isDangerousAttrName(name)) {
+            warn(ctx, `attribute: unsafe name "${name}" is dropped`, { attribute: name });
+            continue;
+        }
+        const safe = renderedAttrValue(name, value);
+        if (safe !== value) {
+            warn(ctx, `attribute: unsafe value for "${name}" is blanked`, { attribute: name, value });
+        }
+        kvs.push([name, safe]);
+    }
     return P.attr(a.id, a.classes, kvs);
 }
 /**
@@ -456,7 +490,7 @@ function inline(ctx, n) {
         case 'superscript':
             return [P.Superscript(kids(ctx, n))];
         case 'code':
-            return [P.Code(toAttr(n.attrs), String(n.value ?? ''))];
+            return [P.Code(toAttr(ctx, n.attrs), String(n.value ?? ''))];
         case 'literal_inline': {
             // PART 9 SS27: verbatim capture rendered as ORDINARY PROSE. The
             // `<code>` wrapper is deliberately dropped, so Pandoc `Code` would
@@ -478,7 +512,7 @@ function inline(ctx, n) {
             if (ctx.roundtrip)
                 return [P.Span(provenanceAttr('literal-inline', n), text)];
             return hasAttrs(n.attrs)
-                ? [P.Span(toAttr(n.attrs), text)]
+                ? [P.Span(toAttr(ctx, n.attrs), text)]
                 : text;
         }
         case 'link': {
@@ -486,14 +520,14 @@ function inline(ctx, n) {
             // it is tried before the missing-definition path reports one.
             const heading = String(n.href ?? '') === '' ? collapsedHeadingRef(ctx, n) : undefined;
             if (heading !== undefined) {
-                return [P.Link(toAttr(n.attrs), kids(ctx, n), ['#' + heading, ''])];
+                return [P.Link(toAttr(ctx, n.attrs), kids(ctx, n), ['#' + heading, ''])];
             }
             const unresolved = unresolvedReference(ctx, n, 'link');
             if (unresolved)
                 return unresolved;
             return [
-                P.Link(toAttr(n.attrs), kids(ctx, n), [
-                    String(n.href ?? ''),
+                P.Link(toAttr(ctx, n.attrs), kids(ctx, n), [
+                    safeDestination(ctx, String(n.href ?? ''), 'link'),
                     String(n.title ?? ''),
                 ]),
             ];
@@ -509,9 +543,12 @@ function inline(ctx, n) {
             // replace it: the class says what KIND of link this is, and a
             // consumer keying on it should not lose that because the author
             // added one of their own.
-            const [id, classes, kvs] = toAttr(n.attrs);
+            const [id, classes, kvs] = toAttr(ctx, n.attrs);
             return [
-                P.Link([id, [cls, ...classes], kvs], [P.Str(String(n.text ?? href))], [href, '']),
+                P.Link([id, [cls, ...classes], kvs], [P.Str(String(n.text ?? href))], 
+                // The autolink's TEXT is the URL and stays visible, exactly
+                // as the HTML writer leaves it: only the destination goes.
+                [safeDestination(ctx, href, 'link'), '']),
             ];
         }
         case 'image': {
@@ -519,8 +556,8 @@ function inline(ctx, n) {
             if (unresolved)
                 return unresolved;
             return [
-                P.Image(toAttr(n.attrs), textInlines(String(n.alt ?? '')), [
-                    String(n.src ?? ''),
+                P.Image(toAttr(ctx, n.attrs), textInlines(String(n.alt ?? '')), [
+                    safeDestination(ctx, String(n.src ?? ''), 'image'),
                     String(n.title ?? ''),
                 ]),
             ];
@@ -667,7 +704,7 @@ function inline(ctx, n) {
         case 'citation_group':
             return [citationGroup(ctx, n)];
         case 'span':
-            return [smallCapsOrSpan(toAttr(n.attrs), kids(ctx, n))];
+            return [smallCapsOrSpan(toAttr(ctx, n.attrs), kids(ctx, n))];
         case 'insert':
             return [P.Span(P.attr(undefined, ['insertion']), kids(ctx, n))];
         case 'delete':
@@ -794,7 +831,7 @@ function citationSuffix(ctx, item) {
  */
 function citationDefinition(ctx, n) {
     const key = String(n.key ?? '');
-    const [id, classes, kvs] = toAttr(n.attrs);
+    const [id, classes, kvs] = toAttr(ctx, n.attrs);
     const entry = inlines(ctx, n.children);
     return P.Div([id || (key ? `ref-${key}` : ''), ['csl-entry', ...classes], kvs], 
     // Section 18 allows an empty entry, and an empty `Para` is not a shape
@@ -849,7 +886,7 @@ function block(ctx, n) {
     if (!ATTR_CARRYING.has(n.type) && hasAttrs(a)) {
         // In roundtrip mode the carve-block marker lets the reverse direction
         // restore the attrs onto the inner block instead of keeping a wrapper.
-        const [id, classes, kvs] = toAttr(a);
+        const [id, classes, kvs] = toAttr(ctx, a);
         const marked = ctx.roundtrip
             ? [...kvs, ['carve-block', n.type]]
             : kvs;
@@ -890,15 +927,14 @@ function blockInner(ctx, n) {
             return [ctx.tight ? P.Plain(xs) : P.Para(xs)];
         }
         case 'heading':
-            return [P.Header(Number(n.level ?? 1), toAttr(n.attrs), kids(ctx, n))];
+            return [P.Header(Number(n.level ?? 1), toAttr(ctx, n.attrs), kids(ctx, n))];
         case 'block_quote':
             return [P.BlockQuote(untight(ctx, () => blocks(ctx, n.children)))];
         case 'code_block': {
             const lang = n.lang ? [String(n.lang)] : [];
-            const a = (n.attrs ?? {});
-            const kvs = Object.entries(a.keyValues ?? {});
+            const [id, classes, kvs] = toAttr(ctx, n.attrs);
             return [
-                P.CodeBlock(P.attr(a.id, [...lang, ...(a.classes ?? [])], kvs), String(n.content ?? '')),
+                P.CodeBlock(P.attr(id, [...lang, ...classes], kvs), String(n.content ?? '')),
             ];
         }
         case 'raw_block':
@@ -929,7 +965,7 @@ function blockInner(ctx, n) {
                 ? [P.Para([P.Strong(inlines(ctx, n.title))])]
                 : [];
             const body = untight(ctx, () => blocks(ctx, n.children));
-            const [id, classes, kvs] = toAttr(n.attrs);
+            const [id, classes, kvs] = toAttr(ctx, n.attrs);
             return [
                 P.Div([id, ['admonition', kind, ...classes], [...kvs, ...labelKv(ctx, n)]], [...title, ...labelCaption(ctx, n), ...body]),
             ];
@@ -944,7 +980,7 @@ function blockInner(ctx, n) {
         case 'line_block':
             return [lineBlock(ctx, n)];
         case 'div': {
-            const [id, classes, kvs] = toAttr(n.attrs);
+            const [id, classes, kvs] = toAttr(ctx, n.attrs);
             return [
                 P.Div([id, classes, [...kvs, ...labelKv(ctx, n)]], [
                     ...labelCaption(ctx, n),
@@ -1012,10 +1048,17 @@ function list(ctx, n) {
         if (typeof item.checked === 'boolean') {
             itemBlocks = prefixTaskMarker(itemBlocks, item.checked);
         }
-        if (hasAttrs(item.attrs)) {
-            const [id, classes, kvs] = toAttr(item.attrs);
+        const state = extendedTaskState(item);
+        if (state && !ctx.roundtrip) {
+            warn(ctx, `task state: "${state}" has no pandoc equivalent - the item is written as an ` +
+                'unchecked box; convert with roundtrip: true to carry it', { taskState: state }, item.pos);
+        }
+        const carried = state && ctx.roundtrip;
+        if (hasAttrs(item.attrs) || carried) {
+            const [id, classes, kvs] = toAttr(ctx, item.attrs);
             const marked = ctx.roundtrip
-                ? [...kvs, ['carve-list-item', 'true']]
+                ? [...kvs, ['carve-list-item', 'true'],
+                    ...(carried ? [[TASK_STATE_KEY, state]] : [])]
                 : kvs;
             itemBlocks = [P.Div([id, classes, marked], itemBlocks)];
         }
@@ -1030,6 +1073,27 @@ function list(ctx, n) {
     }
     return P.BulletList(converted);
 }
+/**
+ * The roundtrip envelope's slot for a task state pandoc cannot say.
+ *
+ * Spelled as a plain kv beside `carve-list-item` rather than through the
+ * base64 provenance envelope: a list item has no Attr of its own, so the Div
+ * that carries `carve-list-item` is already the item's only slot, and a single
+ * enum character needs no encoding to survive an attribute value.
+ * `src/reverse.ts` reads the same literal.
+ */
+const TASK_STATE_KEY = 'carve-task-state';
+/**
+ * A task state that `checked` alone cannot say, or null.
+ *
+ * PART 12 pins `taskState` to `" " x - _ > ?` and defines the first two as the
+ * defaults for `checked` - those two are already carried by the ballot box, and
+ * only the other four are Carve-only information.
+ */
+function extendedTaskState(item) {
+    const state = item.taskState;
+    return typeof state === 'string' && ['-', '_', '>', '?'].includes(state) ? state : null;
+}
 /** GFM-style task markers: pandoc renders `- [x]` as a leading ballot-box Str. */
 function prefixTaskMarker(itemBlocks, checked) {
     const marker = [P.Str(checked ? '☒' : '☐'), P.Space];
@@ -1272,7 +1336,7 @@ function table(ctx, n, caption, shortCaption = null) {
             const cellAlign = firstRowIsHead && r === 0
                 ? 'AlignDefault'
                 : ALIGN[cc.align ?? ''] ?? 'AlignDefault';
-            const pc = P.cell(cellBlocks, cellAlign, toAttr(cc.attrs));
+            const pc = P.cell(cellBlocks, cellAlign, toAttr(ctx, cc.attrs));
             origin[r][c] = { cell: pc, row: r, col: c };
             emitted[r][c] = pc;
         }
@@ -1282,7 +1346,7 @@ function table(ctx, n, caption, shortCaption = null) {
         for (let r = from; r < to; r++) {
             const cells = emitted[r].filter((x) => x !== null);
             const rowAttrs = n.rows[r]?.attrs;
-            out.push(P.row(cells, hasAttrs(rowAttrs) ? toAttr(rowAttrs) : undefined));
+            out.push(P.row(cells, hasAttrs(rowAttrs) ? toAttr(ctx, rowAttrs) : undefined));
         }
         return out;
     };
@@ -1301,7 +1365,7 @@ function table(ctx, n, caption, shortCaption = null) {
             const headTo = at + body.headRows;
             const bodyTo = headTo + body.bodyRows;
             const converted = {
-                attr: toAttr(body.attrs),
+                attr: toAttr(ctx, body.attrs),
                 headRows: toRows(at, headTo),
                 bodyRows: toRows(headTo, bodyTo),
             };
@@ -1405,7 +1469,7 @@ function table(ctx, n, caption, shortCaption = null) {
     // reached `groups` above - leaving them here would state the same fact
     // twice and put a stray attribute on the table in every pandoc writer.
     // The list-table reader already filters its own copies of both.
-    toAttrWithout(n.attrs, ['aligns', 'valigns', 'widths', 'header-rows', 'footer-rows']), caption, colAligns, toRows(0, headCount), bodies, footRows, shortCaption, Array.from({ length: width }, (_, c) => columns[c]?.width ?? null));
+    toAttrWithout(ctx, n.attrs, ['aligns', 'valigns', 'widths', 'header-rows', 'footer-rows']), caption, colAligns, toRows(0, headCount), bodies, footRows, shortCaption, Array.from({ length: width }, (_, c) => columns[c]?.width ?? null));
 }
 /**
  * The row-head column count a declared body's rows agree on, or 0.
@@ -1430,8 +1494,8 @@ function agreedLead(leadOf, rows, from, to, ctx, n) {
     }
     return first;
 }
-function toAttrWithout(attrs, omitted) {
-    const [id, classes, pairs] = toAttr(attrs);
+function toAttrWithout(ctx, attrs, omitted) {
+    const [id, classes, pairs] = toAttr(ctx, attrs);
     return [id, classes, pairs.filter(([key]) => !omitted.includes(key))];
 }
 // --- List tables (listTable extension semantics) ---
@@ -1520,7 +1584,7 @@ function listTableToTable(ctx, n) {
                 }
                 warn(ctx, `list-table: rowspan crossing the header/body boundary at row ${r + 1} - clipped`);
             }
-            const pc = P.cell(untight(ctx, () => blocks(ctx, cellBlocks)), 'AlignDefault', toAttr((cellItems[r][c].attrs ?? {})));
+            const pc = P.cell(untight(ctx, () => blocks(ctx, cellBlocks)), 'AlignDefault', toAttr(ctx, (cellItems[r][c].attrs ?? {})));
             origin[r][c] = { cell: pc, row: r, col: c };
             emitted[r][c] = pc;
         }
@@ -1533,7 +1597,7 @@ function listTableToTable(ctx, n) {
         return out;
     };
     const head = Math.min(headerRows, grid.length);
-    const [id, classes, kvs] = toAttr(a);
+    const [id, classes, kvs] = toAttr(ctx, a);
     const foot = Math.min(footerRows, Math.max(0, grid.length - head));
     const bodyEnd = grid.length - foot;
     const hasBareMarker = (item, key) => (item?.attrs ?? {}).keyValues?.[key] === '';
@@ -1620,13 +1684,13 @@ function figure(ctx, n) {
     }
     if (target.type === 'image') {
         const img = inline(ctx, target);
-        return [P.Figure(toAttr(n.attrs), caption, [P.Plain(img)], shortCaption)];
+        return [P.Figure(toAttr(ctx, n.attrs), caption, [P.Plain(img)], shortCaption)];
     }
     // Any other captionable target, a QUOTE INCLUDED - this is the arm a
     // captioned quote takes, at document level and as a §4c panel alike. It
     // used to be unreachable for a quote outside a group, because §4a rerouted
     // that case; nothing reroutes it now.
-    return [P.Figure(toAttr(n.attrs), caption, untight(ctx, () => block(ctx, target)), shortCaption)];
+    return [P.Figure(toAttr(ctx, n.attrs), caption, untight(ctx, () => block(ctx, target)), shortCaption)];
 }
 /** The §4c panels of a group: its `figure` and `table` children, in order. */
 function isPanel(n) {
@@ -1677,7 +1741,7 @@ function figureGroup(ctx, n) {
             ctx.inPanel = prev;
         }
     }));
-    return [P.Figure(toAttr(n.attrs), caption, body)];
+    return [P.Figure(toAttr(ctx, n.attrs), caption, body)];
 }
 // --- Metadata (frontmatter) ---
 /**

package/dist/diagnostics.js

@@ -21,8 +21,13 @@ const RULES = [
     { test: /^definition list: looseness/, code: 'definition-list-looseness-widened', severity: 'normalized' },
     { test: /^definition list:/, code: 'definition-entry-skipped', severity: 'lossy' },
     { test: /^ordered list:/, code: 'ordered-list-marker-normalized', severity: 'normalized' },
+    { test: /^list: an empty item/, code: 'empty-list-item-spelled', severity: 'normalized' },
+    { test: /^task state:/, code: 'task-state-dropped', severity: 'lossy' },
     { test: /^math: attributes/, code: 'math-attributes-dropped', severity: 'lossy' },
     { test: /^symbol:/, code: 'symbol-unresolved', severity: 'degraded' },
+    { test: /^url: a denied scheme/, code: 'unsafe-url-scheme', severity: 'lossy' },
+    { test: /^attribute: unsafe name/, code: 'unsafe-attribute-name', severity: 'lossy' },
+    { test: /^attribute: unsafe value/, code: 'unsafe-attribute-value', severity: 'lossy' },
     { test: /^extension:/, code: 'inline-extension-degraded', severity: 'degraded' },
     { test: /missing definition/, code: 'reference-unresolved', severity: 'degraded' },
     { test: /^crossref:/, code: 'crossref-unresolved', severity: 'degraded' },

package/dist/reverse.js

@@ -617,10 +617,12 @@ function listItems(ctx, items) {
     const converted = items.map((item) => {
         let source = item;
         let attrs;
+        let taskState = null;
         if (item.length === 1 && item[0]?.t === 'Div') {
             const [attr, inner] = item[0].c;
             if (attr[2].some(([key, value]) => key === 'carve-list-item' && value === 'true')) {
-                attrs = fromAttr([attr[0], attr[1], attr[2].filter(([key]) => key !== 'carve-list-item')]);
+                taskState = readTaskState(attr[2]);
+                attrs = fromAttr([attr[0], attr[1], attr[2].filter(([key]) => key !== 'carve-list-item' && key !== TASK_STATE_KEY)]);
                 source = inner;
             }
         }
@@ -631,10 +633,55 @@ function listItems(ctx, items) {
         if (attrs)
             node.attrs = attrs;
         stripTaskMarker(node);
+        // Only over a marker the forward direction actually wrote: the state
+        // pins `checked`, and PART 12 rejects an extended state on a checked
+        // item, so a hand-built envelope cannot make an unsatisfiable pair.
+        if (taskState && node.checked === false)
+            node.taskState = taskState;
+        if (ctx.target === 'source' && rendersEmpty(node.children))
+            spellEmptyItem(ctx, node);
         return node;
     });
     return { items: converted, tight };
 }
+/**
+ * Whether an item would reach the writer with nothing to put after the marker.
+ *
+ * `[].every` is true, so an item pandoc gave no blocks at all is empty; so is
+ * one holding only paragraphs with no inlines, which is what a `☐`-only task
+ * item leaves behind once the marker is stripped.
+ */
+function rendersEmpty(children) {
+    return (children ?? []).every((child) => child.type === 'paragraph' && !child.children?.length);
+}
+/**
+ * Give an empty item the one spelling Carve has for invisible content.
+ *
+ * A content-less marker is NOT a list item - PART 9 is stricter than
+ * CommonMark here, and `spec/resources/examples/core.md` says so - so
+ * `renderCarve` writes a `+` after the marker rather than nothing. That `+`
+ * survives an ordered item as literal text: `1. +` comes back `<li>+</li>`
+ * where the source had `<li></li>` (#159). A comment is content the reader
+ * removes before any inline run, so `1. %%` is an item whose body is empty on
+ * both engines measured, and it is the same shape the corpus reaches through a
+ * definition line that gets collected out.
+ *
+ * Source path only. `pandocToCarveAst` hands the tree on whole, and an empty
+ * item is expressible there - inventing a comment would be a field the
+ * consumer never had.
+ */
+function spellEmptyItem(ctx, node) {
+    node.children = [{ type: 'comment', block: false, content: '' }];
+    warn(ctx, 'list: an empty item has no bare spelling in Carve - written as a comment, ' +
+        'which renders as the empty item it came from');
+}
+/** The roundtrip envelope's task-state slot; `src/convert.ts` writes it. */
+const TASK_STATE_KEY = 'carve-task-state';
+/** The extended states of PART 12's `taskState` enum, or null for anything else. */
+function readTaskState(kvs) {
+    const value = kvs.find(([key]) => key === TASK_STATE_KEY)?.[1];
+    return value && ['-', '_', '>', '?'].includes(value) ? value : null;
+}
 /** Detect the ballot-box prefix convert.ts (and pandoc's gfm reader) emit. */
 function stripTaskMarker(item) {
     const first = item.children[0];

package/dist/url-scheme.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Schemes Carve blanks on a link or image destination.
+ *
+ * The script / inline-content / local-file class, then the OS protocol-handler
+ * and command-execution class (the CVE-2026-20841 group). Legitimate schemes -
+ * `http`, `https`, `mailto`, `tel`, `ftp`, `sms` - and every scheme-less
+ * destination pass.
+ */
+export declare const DANGEROUS_URL_SCHEMES: readonly string[];
+/**
+ * Characters dropped before the scheme is read: every control character plus
+ * every Unicode whitespace character.
+ *
+ * A consumer may ignore any of them when it decides what the scheme is, so
+ * `<U+202F>javascript:` and `java<DEL>script:` have to fail the check the plain
+ * spelling fails. Corpus `121-scheme-probe-strips-unicode-whitespace` pins the
+ * first of those, and a `startsWith('javascript:')` check passes that document
+ * while leaving the hole wide open.
+ */
+export declare const SCHEME_PROBE_STRIP_RE: RegExp;
+/** The scheme a consumer would read off `url`, lowercased, or undefined. */
+export declare function probeScheme(url: string): string | undefined;
+/** Whether `url` carries a scheme §25 denies. */
+export declare function hasDeniedScheme(url: string): boolean;
+/** `url`, or `''` when its scheme is denied. */
+export declare function blankDeniedDestination(url: string): string;

package/dist/url-scheme.js

@@ -0,0 +1,83 @@
+/*
+ * PART 9 §25 on the way out to pandoc.
+ *
+ * Carve's writers blank a destination whose scheme the spec denies, and §25
+ * binds "every target that emits a resolvable URL" - the engine's HTML,
+ * Markdown and ANSI writers all do it. This bridge emits resolvable URLs too,
+ * and `pandoc -f json -t html` is one command away, so a scheme passed through
+ * here is not a narrower policy, it is the same sink one step removed
+ * (markup-carve/pandoc-carve#157).
+ *
+ * THE LIST AND THE PROBE ARE MIRRORED FROM THE ENGINE, NOT INVENTED. The
+ * engine keeps them in `render-html.ts` and shares them with its non-HTML
+ * writers through `deny-listed-destination.ts`; its package export map reaches
+ * neither, so runtime code here cannot import them and the constants below are
+ * a restatement.
+ *
+ * test/url-scheme.test.mjs is what makes the restatement safe. It reads the
+ * engine's ACTUAL list and probe out of the installed package by `file:` URL -
+ * which the export map does not gate, and which a test may do where shipped
+ * code should not - and compares them as SETS, in both directions. So a scheme
+ * the engine ADDS goes red here too, which is the failure a check that iterated
+ * only these names could never see.
+ */
+/**
+ * Schemes Carve blanks on a link or image destination.
+ *
+ * The script / inline-content / local-file class, then the OS protocol-handler
+ * and command-execution class (the CVE-2026-20841 group). Legitimate schemes -
+ * `http`, `https`, `mailto`, `tel`, `ftp`, `sms` - and every scheme-less
+ * destination pass.
+ */
+export const DANGEROUS_URL_SCHEMES = [
+    'javascript',
+    'vbscript',
+    'data',
+    'file',
+    'ms-msdt',
+    'ms-office',
+    'ms-word',
+    'ms-excel',
+    'ms-powerpoint',
+    'ms-access',
+    'ms-visio',
+    'ms-project',
+    'ms-publisher',
+    'ms-infopath',
+    'ms-spd',
+    'ms-search',
+    'search-ms',
+    'ms-cxh',
+    'ms-cxh-full',
+    'shell',
+    'vscode',
+    'vscode-insiders',
+    'jar',
+];
+/**
+ * Characters dropped before the scheme is read: every control character plus
+ * every Unicode whitespace character.
+ *
+ * A consumer may ignore any of them when it decides what the scheme is, so
+ * `<U+202F>javascript:` and `java<DEL>script:` have to fail the check the plain
+ * spelling fails. Corpus `121-scheme-probe-strips-unicode-whitespace` pins the
+ * first of those, and a `startsWith('javascript:')` check passes that document
+ * while leaving the hole wide open.
+ */
+export const SCHEME_PROBE_STRIP_RE = /[\u0000-\u0008\u000e-\u001f\u007f-\u009f\s]+/gu;
+const DENIED = new Set(DANGEROUS_URL_SCHEMES.map((scheme) => scheme.toLowerCase()));
+/** The scheme a consumer would read off `url`, lowercased, or undefined. */
+export function probeScheme(url) {
+    const probe = url.replace(SCHEME_PROBE_STRIP_RE, '');
+    const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(probe);
+    return match?.[1]?.toLowerCase();
+}
+/** Whether `url` carries a scheme §25 denies. */
+export function hasDeniedScheme(url) {
+    const scheme = probeScheme(url);
+    return scheme !== undefined && DENIED.has(scheme);
+}
+/** `url`, or `''` when its scheme is denied. */
+export function blankDeniedDestination(url) {
+    return hasDeniedScheme(url) ? '' : url;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markup-carve/pandoc-carve",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Carve to Pandoc bridge: convert Carve markup to Pandoc's JSON AST and reach every pandoc output format (LaTeX, Typst, DOCX, PDF, ...)",
   "keywords": [
     "carve",