@meith/markdown 0.16.0

package/src/mentions.ts

@@ -0,0 +1,66 @@
+import { attributedAuthor } from './attribution'
+import { type ParseOptions, parse } from './blocks'
+import type { Block, Inline } from './nodes'
+
+function mentionsIn(nodes: readonly Inline[], out: Set<string>): void {
+  for (const node of nodes) {
+    if (node.kind === 'mention') out.add(node.name)
+    else if ('children' in node) mentionsIn(node.children, out)
+  }
+}
+
+function mentionBlocks(blocks: readonly Block[], out: Set<string>): void {
+  for (const block of blocks) {
+    switch (block.kind) {
+      case 'paragraph':
+      case 'heading':
+        mentionsIn(block.inline, out)
+        break
+      case 'list':
+        for (const item of block.items) mentionBlocks(item.children, out)
+        break
+      case 'table':
+        for (const cell of block.head) mentionsIn(cell.inline, out)
+        for (const row of block.rows) for (const cell of row) mentionsIn(cell.inline, out)
+        break
+      case 'directive':
+        mentionBlocks(block.children, out)
+        break
+      case 'quote':
+      case 'code':
+      case 'rule':
+        break
+    }
+  }
+}
+
+export function extractMentions(source: string, options: ParseOptions = {}): readonly string[] {
+  const out = new Set<string>()
+  mentionBlocks(parse(source, options).blocks, out)
+  return [...out]
+}
+
+function attributionsIn(nodes: readonly Inline[], out: Set<string>): void {
+  let atLineStart = true
+  for (const node of nodes) {
+    if (atLineStart) {
+      const author = attributedAuthor(node)
+      if (author !== null) out.add(author.name)
+    }
+    atLineStart = node.kind === 'break'
+  }
+}
+
+export function extractQuotedAuthors(
+  source: string,
+  options: ParseOptions = {},
+): readonly string[] {
+  const out = new Set<string>()
+  for (const block of parse(source, options).blocks) {
+    if (block.kind !== 'quote') continue
+    for (const child of block.children) {
+      if (child.kind === 'paragraph') attributionsIn(child.inline, out)
+    }
+  }
+  return [...out]
+}

package/src/nodes.ts

@@ -0,0 +1,71 @@
+export type Alignment = 'left' | 'center' | 'right' | null
+
+export type Inline =
+  | { readonly kind: 'text'; readonly value: string }
+  | { readonly kind: 'code'; readonly value: string }
+  | { readonly kind: 'emphasis'; readonly children: readonly Inline[] }
+  | { readonly kind: 'strong'; readonly children: readonly Inline[] }
+  | { readonly kind: 'strike'; readonly children: readonly Inline[] }
+  | {
+      readonly kind: 'link'
+      readonly href: string
+      readonly title: string | null
+      readonly children: readonly Inline[]
+    }
+  | { readonly kind: 'image'; readonly src: string; readonly alt: string }
+  | { readonly kind: 'break' }
+  | { readonly kind: 'directive'; readonly name: string; readonly children: readonly Inline[] }
+  | { readonly kind: 'mention'; readonly name: string }
+  | { readonly kind: 'attachment'; readonly id: number }
+
+export interface TableCell {
+  readonly inline: readonly Inline[]
+}
+
+export type Block =
+  | { readonly kind: 'paragraph'; readonly inline: readonly Inline[] }
+  | {
+      readonly kind: 'heading'
+      readonly level: 1 | 2 | 3 | 4 | 5 | 6
+      readonly inline: readonly Inline[]
+    }
+  | { readonly kind: 'quote'; readonly children: readonly Block[] }
+  | {
+      readonly kind: 'list'
+      readonly ordered: boolean
+      readonly start: number
+      readonly tight: boolean
+      readonly items: readonly ListItem[]
+    }
+  | { readonly kind: 'code'; readonly language: string | null; readonly value: string }
+  | { readonly kind: 'rule' }
+  | {
+      readonly kind: 'table'
+      readonly head: readonly TableCell[]
+      readonly align: readonly Alignment[]
+      readonly rows: readonly (readonly TableCell[])[]
+    }
+  | { readonly kind: 'directive'; readonly name: string; readonly children: readonly Block[] }
+
+export interface ListItem {
+  readonly checked: boolean | null
+  readonly children: readonly Block[]
+}
+
+export interface MarkdownDocument {
+  readonly blocks: readonly Block[]
+  readonly truncated: boolean
+}
+
+export function textOf(nodes: readonly Inline[]): string {
+  let out = ''
+  for (const node of nodes) {
+    if (node.kind === 'text' || node.kind === 'code') out += node.value
+    else if (node.kind === 'image') out += node.alt
+    else if (node.kind === 'break') out += '\n'
+    else if (node.kind === 'mention') out += `@${node.name}`
+    else if (node.kind === 'attachment') out += ''
+    else out += textOf(node.children)
+  }
+  return out
+}

package/src/pipeline.ts

@@ -0,0 +1,47 @@
+import { type MarkdownRenderOptions, type RenderedBody, renderMarkdown } from './body'
+import type { VocabularySource } from './vocabulary'
+
+export type MarkdownSourceKind = 'post' | 'signature' | 'pm'
+
+export interface MarkdownAuthorRef {
+  readonly userId: number | null
+  readonly isGuest: boolean
+}
+
+export interface MarkdownRenderContext {
+  readonly source: MarkdownSourceKind
+  readonly viewer: MarkdownAuthorRef
+  readonly postId?: number | null
+}
+
+export interface MarkdownPipeline {
+  readonly text: (text: string, context: MarkdownRenderContext) => Promise<string>
+  readonly html: (html: string, context: MarkdownRenderContext) => Promise<string>
+  readonly vocabulary: (source: VocabularySource) => Promise<VocabularySource>
+}
+
+export const CORE_RENDERING: MarkdownPipeline = {
+  text: async (text) => text,
+  html: async (html) => html,
+  vocabulary: async (source) => source,
+}
+
+export const NO_VOCABULARY_SOURCE: VocabularySource = {
+  revision: 0,
+  smilies: [],
+  directives: [],
+}
+
+export function authorRef(userId: number | null): MarkdownAuthorRef {
+  return { userId, isGuest: userId === null }
+}
+
+export async function renderThrough(
+  pipeline: MarkdownPipeline,
+  text: string,
+  context: MarkdownRenderContext,
+  options: MarkdownRenderOptions = {},
+): Promise<RenderedBody> {
+  const rendered = renderMarkdown(await pipeline.text(text, context), options)
+  return { ...rendered, html: await pipeline.html(rendered.html, context) }
+}

package/src/plain.ts

@@ -0,0 +1,78 @@
+import { quoteAttribution } from './attribution'
+import { type ParseOptions, parse } from './blocks'
+import type { Block, Inline } from './nodes'
+
+function fromInline(nodes: readonly Inline[]): string {
+  let out = ''
+  for (const node of nodes) {
+    switch (node.kind) {
+      case 'text':
+      case 'code':
+        out += node.value
+        break
+      case 'image':
+        out += node.alt
+        break
+      case 'break':
+        out += ' '
+        break
+      case 'mention':
+        out += `@${node.name}`
+        break
+      case 'attachment':
+        break
+      default:
+        out += fromInline(node.children)
+    }
+  }
+  return out
+}
+
+function fromBlocks(blocks: readonly Block[]): string[] {
+  const parts: string[] = []
+  for (const block of blocks) {
+    switch (block.kind) {
+      case 'paragraph':
+      case 'heading':
+        parts.push(fromInline(block.inline))
+        break
+      case 'code':
+        parts.push(block.value)
+        break
+      case 'quote': {
+        const attribution = quoteAttribution(block.children[0])
+        if (attribution !== null) parts.push(`${attribution.name} wrote:`)
+        parts.push(...fromBlocks(attribution === null ? block.children : block.children.slice(1)))
+        break
+      }
+      case 'directive':
+        parts.push(...fromBlocks(block.children))
+        break
+      case 'list':
+        for (const item of block.items) parts.push(...fromBlocks(item.children))
+        break
+      case 'table':
+        parts.push(block.head.map((cell) => fromInline(cell.inline)).join(' '))
+        for (const row of block.rows)
+          parts.push(row.map((cell) => fromInline(cell.inline)).join(' '))
+        break
+      case 'rule':
+        break
+    }
+  }
+  return parts
+}
+
+export function plainText(source: string, options: ParseOptions = {}): string {
+  return fromBlocks(parse(source, options).blocks).join(' ').replace(/\s+/g, ' ').trim()
+}
+
+export function summarise(source: string | null, limit = 300): string {
+  if (source === null) return ''
+  const flat = plainText(source)
+  if (flat.length <= limit) return flat
+
+  const cut = flat.slice(0, limit)
+  const lastSpace = cut.lastIndexOf(' ')
+  return `${lastSpace > limit / 2 ? cut.slice(0, lastSpace) : cut}…`
+}

package/src/quote.ts

@@ -0,0 +1,47 @@
+import { memberByNameHref } from './attribution'
+import { plainAuthorName } from './escape-source'
+
+export interface QuoteInput {
+  readonly author?: string | null
+  /** Defaults to the author's profile; `null` leaves the name as plain text. */
+  readonly authorHref?: string | null
+  /** The post being quoted, written into the quote as a link back to it. */
+  readonly sourceHref?: string | null
+  readonly sourceLabel?: string
+  readonly markdown: string
+}
+
+const DEFAULT_SOURCE_LABEL = 'View post'
+
+function plainLabel(value: string): string {
+  return value.replace(/[[\]()*`\\]/g, '').trim()
+}
+
+export function quoteBlock(input: QuoteInput): string {
+  const author = input.author == null ? '' : plainAuthorName(input.author)
+  const body = input.markdown.replace(/\r\n?/g, '\n').replace(/\s+$/, '')
+
+  const quoted = body
+    .split('\n')
+    .map((line) => `> ${line}`.trimEnd())
+    .join('\n')
+
+  if (author === '') return quoted
+
+  return `> **${named(author, input)} wrote:**${source(input)}\n>\n${quoted}`
+}
+
+function named(author: string, input: QuoteInput): string {
+  const href =
+    input.authorHref === undefined ? memberByNameHref(input.author ?? author) : input.authorHref
+  if (href === null || href.trim() === '') return author
+  return `[${author}](${href.trim()})`
+}
+
+function source(input: QuoteInput): string {
+  const href = input.sourceHref
+  if (href == null || href.trim() === '') return ''
+
+  const label = plainLabel(input.sourceLabel ?? DEFAULT_SOURCE_LABEL)
+  return label === '' ? '' : ` [${label}](${href.trim()})`
+}

package/src/render.ts

@@ -0,0 +1,194 @@
+import { memberByNameHref, type QuoteAttribution, quoteAttribution } from './attribution'
+import { escapeAttribute, escapeHtml, unescapeHtml } from './escape'
+import { type CompiledSmilies, renderSmilies } from './extensions'
+import type { Alignment, Block, Inline, ListItem, MarkdownDocument } from './nodes'
+import { safeImageUrl, safeUrl } from './url'
+
+export interface RenderContext {
+  readonly smilies?: CompiledSmilies | undefined
+  readonly headingOffset?: number
+  readonly quoteAttribution?: ((author: string) => string) | undefined
+  readonly spoilerLabel?: string | undefined
+}
+
+const LANGUAGE = /^[a-z0-9][a-z0-9+#._-]{0,23}$/i
+
+function alignmentClass(alignment: Alignment): string {
+  if (alignment === null) return ''
+  return ` class="md-align-${alignment}"`
+}
+
+function anchor(href: string, title: string | null, inner: string, className?: string): string {
+  const titleAttribute = title === null || title === '' ? '' : ` title="${escapeAttribute(title)}"`
+  const classAttribute = className === undefined ? '' : ` class="${className}"`
+  return `<a${classAttribute} href="${escapeAttribute(href)}" rel="nofollow ugc noopener noreferrer"${titleAttribute}>${inner}</a>`
+}
+
+export function renderInline(nodes: readonly Inline[], context: RenderContext = {}): string {
+  let html = ''
+  for (const node of nodes) {
+    switch (node.kind) {
+      case 'text':
+        html += renderSmilies(node.value, context.smilies)
+        break
+      case 'code':
+        html += `<code class="md-code-span">${escapeHtml(node.value)}</code>`
+        break
+      case 'emphasis':
+        html += `<em>${renderInline(node.children, context)}</em>`
+        break
+      case 'strong':
+        html += `<strong>${renderInline(node.children, context)}</strong>`
+        break
+      case 'strike':
+        html += `<s>${renderInline(node.children, context)}</s>`
+        break
+      case 'break':
+        html += '<br>\n'
+        break
+      case 'link': {
+        const href = safeUrl(node.href, { allowMailto: true })
+        const inner = renderInline(node.children, context)
+        html += href === null ? inner : anchor(href, node.title, inner)
+        break
+      }
+      case 'image': {
+        const src = safeImageUrl(node.src)
+        html +=
+          src === null
+            ? escapeHtml(node.alt)
+            : `<img src="${escapeAttribute(src)}" alt="${escapeAttribute(node.alt)}" loading="lazy" class="md-image">`
+        break
+      }
+      case 'directive':
+        html += `<span class="md-directive md-directive-${escapeAttribute(node.name)}">${renderInline(node.children, context)}</span>`
+        break
+      case 'mention': {
+        const href = memberByNameHref(node.name)
+        html += `<a class="md-mention" href="${escapeAttribute(href)}">@${escapeHtml(node.name)}</a>`
+        break
+      }
+      case 'attachment':
+        html += `<span class="md-attachment" data-attachment-id="${node.id}"></span>`
+        break
+    }
+  }
+  return html
+}
+
+function renderSpoiler(children: readonly Block[], context: RenderContext): string {
+  const label = escapeHtml(context.spoilerLabel ?? 'Spoiler')
+  return `<details class="md-spoiler"><summary>${label}</summary>${renderBlocks(children, context)}</details>\n`
+}
+
+function renderAttribution(attribution: QuoteAttribution, context: RenderContext): string {
+  const name = escapeHtml(attribution.name)
+  const profile = attribution.href === null ? null : safeUrl(attribution.href)
+  const author = profile === null ? name : anchor(profile, null, name, 'md-quote-author')
+
+  const source = attribution.sourceHref === null ? null : safeUrl(attribution.sourceHref)
+  const citation =
+    source === null
+      ? ''
+      : anchor(source, null, escapeHtml(attribution.sourceLabel), 'md-quote-source')
+
+  const label = context.quoteAttribution?.(author) ?? `${author} wrote:`
+  return `<p class="md-quote-attribution"><strong data-quote-author="${escapeAttribute(author)}">${label}</strong>${citation}</p>\n`
+}
+
+const QUOTE_ATTRIBUTION_STRONG = /<strong data-quote-author="([^"]*)">[\s\S]*?<\/strong>/g
+
+export function localizeQuoteAttribution(
+  html: string,
+  quoteAttribution: (author: string) => string,
+): string {
+  if (!html.includes('data-quote-author')) return html
+  return html.replace(
+    QUOTE_ATTRIBUTION_STRONG,
+    (_whole, escapedAuthor: string) =>
+      `<strong>${quoteAttribution(unescapeHtml(escapedAuthor))}</strong>`,
+  )
+}
+
+function renderItem(item: ListItem, tight: boolean, context: RenderContext): string {
+  const inner = renderBlocks(item.children, context, tight)
+  if (item.checked === null) return `<li>${inner}</li>`
+  const checked = item.checked ? ' checked' : ''
+  return `<li class="md-task"><input type="checkbox" disabled${checked}> ${inner}</li>`
+}
+
+function renderBlocks(blocks: readonly Block[], context: RenderContext, tight = false): string {
+  let html = ''
+  for (const block of blocks) {
+    switch (block.kind) {
+      case 'paragraph':
+        html += tight
+          ? renderInline(block.inline, context)
+          : `<p>${renderInline(block.inline, context)}</p>\n`
+        break
+      case 'heading': {
+        const level = Math.min(6, block.level + (context.headingOffset ?? 1))
+        html += `<h${level}>${renderInline(block.inline, context)}</h${level}>\n`
+        break
+      }
+      case 'quote': {
+        const attribution = quoteAttribution(block.children[0])
+        const body = attribution === null ? block.children : block.children.slice(1)
+        html += `<blockquote class="md-quote">${attribution === null ? '' : renderAttribution(attribution, context)}${renderBlocks(body, context)}</blockquote>\n`
+        break
+      }
+      case 'list': {
+        const items = block.items.map((item) => renderItem(item, block.tight, context)).join('')
+        html += block.ordered
+          ? `<ol class="md-list"${block.start === 1 ? '' : ` start="${block.start}"`}>${items}</ol>\n`
+          : `<ul class="md-list">${items}</ul>\n`
+        break
+      }
+      case 'code': {
+        const language =
+          block.language !== null && LANGUAGE.test(block.language) ? block.language : null
+        const languageClass =
+          language === null
+            ? ''
+            : ` class="md-code-lang-${escapeAttribute(language.toLowerCase())}"`
+        html += `<pre class="md-code"><code${languageClass}>${escapeHtml(block.value)}\n</code></pre>\n`
+        break
+      }
+      case 'rule':
+        html += '<hr class="md-rule">\n'
+        break
+      case 'table': {
+        const head = block.head
+          .map(
+            (cell, column) =>
+              `<th${alignmentClass(block.align[column] ?? null)}>${renderInline(cell.inline, context)}</th>`,
+          )
+          .join('')
+        const rows = block.rows
+          .map(
+            (row) =>
+              `<tr>${row
+                .map(
+                  (cell, column) =>
+                    `<td${alignmentClass(block.align[column] ?? null)}>${renderInline(cell.inline, context)}</td>`,
+                )
+                .join('')}</tr>`,
+          )
+          .join('')
+        html += `<div class="md-table-scroll"><table class="md-table"><thead><tr>${head}</tr></thead><tbody>${rows}</tbody></table></div>\n`
+        break
+      }
+      case 'directive':
+        html +=
+          block.name === 'spoiler'
+            ? renderSpoiler(block.children, context)
+            : `<div class="md-directive md-directive-${escapeAttribute(block.name)}">${renderBlocks(block.children, context)}</div>\n`
+        break
+    }
+  }
+  return html
+}
+
+export function renderDocument(document: MarkdownDocument, context: RenderContext = {}): string {
+  return renderBlocks(document.blocks, context).trimEnd()
+}

package/src/url.ts

@@ -0,0 +1,31 @@
+import { DEFAULT_LIMITS } from './limits'
+
+// biome-ignore lint/suspicious/noControlCharactersInRegex: URL smuggling relies on exactly these
+const FORBIDDEN = /[\u0000-\u0020\u007f"'<>`\\{}|^]/
+
+const ABSOLUTE = /^https?:\/\/[^/]/i
+const MAILTO = /^mailto:[^\s@]+@[^\s@]+\.[^\s@]+$/i
+
+export interface UrlPolicy {
+  readonly maxLength?: number
+  readonly allowMailto?: boolean
+}
+
+export function safeUrl(value: string, policy: UrlPolicy = {}): string | null {
+  const url = value.trim()
+  const maxLength = policy.maxLength ?? DEFAULT_LIMITS.maxUrlLength
+
+  if (url.length === 0 || url.length > maxLength) return null
+  if (FORBIDDEN.test(url)) return null
+
+  if (ABSOLUTE.test(url)) return url
+  if (policy.allowMailto === true && MAILTO.test(url)) return url
+
+  if (url.startsWith('/') && !url.startsWith('//')) return url
+
+  return null
+}
+
+export function safeImageUrl(value: string): string | null {
+  return safeUrl(value)
+}

package/src/vocabulary.ts

@@ -0,0 +1,68 @@
+import {
+  type CompiledSmilies,
+  compileSmilies,
+  createDirectiveRegistry,
+  type DirectiveDefinition,
+  type DirectiveRegistry,
+  NO_DIRECTIVES,
+  type SmileyDefinition,
+} from './extensions'
+
+export interface VocabularySource {
+  readonly revision: number
+  readonly smilies: readonly SmileyDefinition[]
+  readonly directives: readonly DirectiveDefinition[]
+}
+
+export interface BoardVocabulary {
+  readonly revision: number
+  readonly directives: DirectiveRegistry
+  readonly smilies: CompiledSmilies | undefined
+  readonly rejected: readonly {
+    readonly kind: 'smiley' | 'directive'
+    readonly name: string
+    readonly reason: string
+  }[]
+}
+
+export const EMPTY_VOCABULARY: BoardVocabulary = {
+  revision: 0,
+  directives: NO_DIRECTIVES,
+  smilies: undefined,
+  rejected: [],
+}
+
+function reasonOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+export function compileVocabulary(source: VocabularySource): BoardVocabulary {
+  const rejected: { kind: 'smiley' | 'directive'; name: string; reason: string }[] = []
+
+  const accepted: DirectiveDefinition[] = []
+  for (const directive of source.directives) {
+    try {
+      createDirectiveRegistry([...accepted, directive])
+      accepted.push(directive)
+    } catch (error) {
+      rejected.push({ kind: 'directive', name: directive.name, reason: reasonOf(error) })
+    }
+  }
+
+  const smilies: SmileyDefinition[] = []
+  for (const smiley of source.smilies) {
+    try {
+      compileSmilies([...smilies, smiley])
+      smilies.push(smiley)
+    } catch (error) {
+      rejected.push({ kind: 'smiley', name: smiley.code, reason: reasonOf(error) })
+    }
+  }
+
+  return {
+    revision: source.revision,
+    directives: createDirectiveRegistry(accepted),
+    smilies: smilies.length === 0 ? undefined : compileSmilies(smilies),
+    rejected,
+  }
+}

package/src/word-filter.ts

@@ -0,0 +1,64 @@
+export interface WordFilterRule {
+  readonly pattern: string
+  readonly replacement: string
+  readonly wholeWord: boolean
+}
+
+export interface CompiledWordFilter {
+  readonly rules: readonly { readonly matcher: RegExp; readonly replacement: string }[]
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+export function compileWordFilter(rules: readonly WordFilterRule[]): CompiledWordFilter {
+  return {
+    rules: rules
+      .filter((rule) => rule.pattern !== '')
+      .map((rule) => ({
+        matcher: new RegExp(
+          rule.wholeWord ? `\\b${escapeRegExp(rule.pattern)}\\b` : escapeRegExp(rule.pattern),
+          'gi',
+        ),
+        replacement: rule.replacement,
+      })),
+  }
+}
+
+export function applyWordFilter(html: string, filter: CompiledWordFilter): string {
+  if (filter.rules.length === 0 || html === '') return html
+
+  let output = ''
+  let index = 0
+
+  while (index < html.length) {
+    const tagStart = html.indexOf('<', index)
+
+    if (tagStart === -1) {
+      output += substitute(html.slice(index), filter)
+      break
+    }
+
+    output += substitute(html.slice(index, tagStart), filter)
+
+    const tagEnd = html.indexOf('>', tagStart)
+    if (tagEnd === -1) {
+      output += html.slice(tagStart)
+      break
+    }
+
+    output += html.slice(tagStart, tagEnd + 1)
+    index = tagEnd + 1
+  }
+
+  return output
+}
+
+function substitute(text: string, filter: CompiledWordFilter): string {
+  let result = text
+  for (const rule of filter.rules) {
+    result = result.replace(rule.matcher, rule.replacement)
+  }
+  return result
+}