@openleaf-editor/core 0.1.0-beta.0

package/dist/schema.js

@@ -0,0 +1,268 @@
+/**
+ * The OpenLeaf document schema.
+ *
+ * Scope note: table NODES are here, in the base schema, so that every
+ * deployment reads and writes tables faithfully. Table EDITING -- cell
+ * selection, column resizing, the row and column commands and toolbar -- is
+ * the opt-in @openleaf-editor/plugins-table. See tables.ts for why the split falls
+ * there rather than at the package boundary.
+ */
+import { Schema } from 'prosemirror-model';
+import { unknownBlock, unknownInline } from './preserve.js';
+import { table, table_cell, table_header, table_row } from './tables.js';
+import { isSafeUrl } from './url.js';
+/** The base node specs. Extensions are appended to these. */
+export const coreNodes = {
+    doc: { content: 'block+' },
+    paragraph: {
+        // `dir` is bidirectional text direction, not styling. Dropping it
+        // silently breaks Arabic, Hebrew and Persian content, so it is a
+        // first-class schema attribute rather than something the preservation
+        // layer has to rescue.
+        attrs: { dir: { default: null } },
+        content: 'inline*',
+        group: 'block',
+        parseDOM: [
+            {
+                tag: 'p',
+                getAttrs: (dom) => ({ dir: dom.getAttribute('dir') }),
+            },
+        ],
+        toDOM(node) {
+            const dir = node.attrs['dir'];
+            return dir ? ['p', { dir }, 0] : ['p', 0];
+        },
+    },
+    heading: {
+        attrs: { level: { default: 1 }, dir: { default: null } },
+        content: 'inline*',
+        group: 'block',
+        defining: true,
+        parseDOM: [1, 2, 3, 4, 5, 6].map((level) => ({
+            tag: `h${level}`,
+            getAttrs: (dom) => ({ level, dir: dom.getAttribute('dir') }),
+        })),
+        toDOM(node) {
+            const tag = `h${node.attrs['level']}`;
+            const dir = node.attrs['dir'];
+            return dir ? [tag, { dir }, 0] : [tag, 0];
+        },
+    },
+    blockquote: {
+        content: 'block+',
+        group: 'block',
+        defining: true,
+        parseDOM: [{ tag: 'blockquote' }],
+        toDOM: () => ['blockquote', 0],
+    },
+    code_block: {
+        // `language` is content, not decoration. Without it a fenced block loses
+        // `class="language-js"` on the first save -- which is both an attribute-loss
+        // bug and the reason a highlighter has nothing to work from.
+        attrs: { language: { default: null } },
+        content: 'text*',
+        marks: '',
+        group: 'block',
+        code: true,
+        defining: true,
+        parseDOM: [
+            {
+                tag: 'pre',
+                preserveWhitespace: 'full',
+                getAttrs(dom) {
+                    const pre = dom;
+                    // The class may sit on either element in the wild. CommonMark, Prism
+                    // and highlight.js all put it on <code>; older CMS output often puts
+                    // it on <pre>. Read both, write one.
+                    const code = pre.querySelector('code');
+                    const source = `${pre.getAttribute('class') ?? ''} ${code?.getAttribute('class') ?? ''}`;
+                    const match = /(?:^|\s)(?:language|lang)-([a-z0-9+#.-]+)/i.exec(source);
+                    return { language: match ? match[1].toLowerCase() : null };
+                },
+            },
+        ],
+        toDOM(node) {
+            const language = node.attrs['language'];
+            // Normalized onto <code>, which is where every downstream highlighter
+            // looks. A block authored with the class on <pre> moves it; that is a
+            // one-time normalization and it is stable thereafter.
+            return language ? ['pre', ['code', { class: `language-${language}` }, 0]] : ['pre', ['code', 0]];
+        },
+    },
+    horizontal_rule: {
+        group: 'block',
+        parseDOM: [{ tag: 'hr' }],
+        toDOM: () => ['hr'],
+    },
+    bullet_list: {
+        content: 'list_item+',
+        group: 'block',
+        parseDOM: [{ tag: 'ul' }],
+        toDOM: () => ['ul', 0],
+    },
+    ordered_list: {
+        attrs: { start: { default: 1 } },
+        content: 'list_item+',
+        group: 'block',
+        parseDOM: [
+            {
+                tag: 'ol',
+                getAttrs(dom) {
+                    const start = dom.getAttribute('start');
+                    return { start: start ? Number(start) : 1 };
+                },
+            },
+        ],
+        toDOM(node) {
+            const start = node.attrs['start'];
+            return start === 1 ? ['ol', 0] : ['ol', { start: String(start) }, 0];
+        },
+    },
+    list_item: {
+        content: 'paragraph block*',
+        defining: true,
+        parseDOM: [{ tag: 'li' }],
+        toDOM: () => ['li', 0],
+    },
+    image: {
+        inline: true,
+        group: 'inline',
+        draggable: true,
+        attrs: {
+            src: {},
+            alt: { default: null },
+            title: { default: null },
+            width: { default: null },
+            height: { default: null },
+        },
+        parseDOM: [
+            {
+                tag: 'img[src]',
+                getAttrs(dom) {
+                    const el = dom;
+                    // Returning false declines the rule, so an image with a
+                    // `javascript:` src is dropped rather than carried through.
+                    if (!isSafeUrl(el.getAttribute('src')))
+                        return false;
+                    return {
+                        src: el.getAttribute('src'),
+                        // An absent alt and alt="" mean different things to a screen
+                        // reader: "undescribed" versus "decorative". Never conflate them.
+                        alt: el.getAttribute('alt'),
+                        title: el.getAttribute('title'),
+                        width: el.getAttribute('width'),
+                        height: el.getAttribute('height'),
+                    };
+                },
+            },
+        ],
+        toDOM(node) {
+            const { src, alt, title, width, height } = node.attrs;
+            const attrs = { src: src };
+            if (alt !== null)
+                attrs['alt'] = alt;
+            if (title !== null)
+                attrs['title'] = title;
+            if (width !== null)
+                attrs['width'] = width;
+            if (height !== null)
+                attrs['height'] = height;
+            return ['img', attrs];
+        },
+    },
+    hard_break: {
+        inline: true,
+        group: 'inline',
+        selectable: false,
+        parseDOM: [{ tag: 'br' }],
+        toDOM: () => ['br'],
+    },
+    text: { group: 'inline' },
+    // Tables are in the BASE schema deliberately. Without them a <table> in
+    // stored content becomes an opaque preserved atom -- faithful but uneditable,
+    // which is not something you can tell a CMS. The heavy part (cell selection,
+    // column resizing, the row and column commands) is the opt-in
+    // @openleaf-editor/plugins-table.
+    table,
+    table_row,
+    table_cell,
+    table_header,
+    unknown_block: unknownBlock,
+    unknown_inline: unknownInline,
+};
+/** The base mark specs. */
+export const coreMarks = {
+    strong: {
+        parseDOM: [
+            { tag: 'strong' },
+            { tag: 'b' },
+            { style: 'font-weight=bold' },
+            { style: 'font-weight=700' },
+        ],
+        toDOM: () => ['strong', 0],
+    },
+    em: {
+        parseDOM: [{ tag: 'em' }, { tag: 'i' }, { style: 'font-style=italic' }],
+        toDOM: () => ['em', 0],
+    },
+    underline: {
+        parseDOM: [{ tag: 'u' }, { style: 'text-decoration=underline' }],
+        toDOM: () => ['u', 0],
+    },
+    strike: {
+        parseDOM: [{ tag: 's' }, { tag: 'del' }, { style: 'text-decoration=line-through' }],
+        toDOM: () => ['s', 0],
+    },
+    code: {
+        parseDOM: [{ tag: 'code' }],
+        toDOM: () => ['code', 0],
+    },
+    link: {
+        attrs: {
+            href: {},
+            title: { default: null },
+            target: { default: null },
+            rel: { default: null },
+        },
+        inclusive: false,
+        parseDOM: [
+            {
+                tag: 'a[href]',
+                getAttrs(dom) {
+                    const el = dom;
+                    // A `javascript:` href is the cheapest XSS vector there is: no
+                    // injected element, no script tag, just a reader who clicks.
+                    // Declining the rule keeps the link TEXT and drops the mark.
+                    if (!isSafeUrl(el.getAttribute('href')))
+                        return false;
+                    return {
+                        href: el.getAttribute('href'),
+                        title: el.getAttribute('title'),
+                        target: el.getAttribute('target'),
+                        rel: el.getAttribute('rel'),
+                    };
+                },
+            },
+        ],
+        toDOM(node) {
+            const { href, title, target, rel } = node.attrs;
+            const attrs = { href: href };
+            if (title !== null)
+                attrs['title'] = title;
+            if (target !== null)
+                attrs['target'] = target;
+            if (rel !== null)
+                attrs['rel'] = rel;
+            return ['a', attrs, 0];
+        },
+    },
+};
+/**
+ * The base schema, with no extensions.
+ *
+ * Kept for the many places that only ever need the built-in types. Anything that
+ * must honour plugin-contributed node types uses `createSchema` or reads
+ * `state.schema` instead -- see extensions.ts.
+ */
+export const baseSchema = new Schema({ nodes: coreNodes, marks: coreMarks });
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAgC,MAAM,mBAAmB,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEpC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;IAE1B,SAAS,EAAE;QACT,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,uBAAuB;QACvB,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACjC,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAG,GAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;aACnE;SACF;QACD,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkB,CAAA;YAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;KACF;IAED,OAAO,EAAE;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACxD,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,GAAG,EAAE,IAAI,KAAK,EAAE;YAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAG,GAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkB,CAAA;YAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;KACF;IAED,UAAU,EAAE;QACV,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;QACjC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;KAC/B;IAED,UAAU,EAAE;QACV,yEAAyE;QACzE,6EAA6E;QAC7E,6DAA6D;QAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACtC,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,KAAK;gBACV,kBAAkB,EAAE,MAAM;gBAC1B,QAAQ,CAAC,GAAG;oBACV,MAAM,GAAG,GAAG,GAAc,CAAA;oBAC1B,qEAAqE;oBACrE,qEAAqE;oBACrE,qCAAqC;oBACrC,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;oBACtC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAA;oBACxF,MAAM,KAAK,GAAG,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACxE,CAAC;aACF;SACF;QACD,KAAK,CAAC,IAAI;YACR,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAkB,CAAA;YACxD,sEAAsE;YACtE,sEAAsE;YACtE,sDAAsD;YACtD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;QAClG,CAAC;KACF;IAED,eAAe,EAAE;QACf,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;KACpB;IAED,WAAW,EAAE;QACX,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KACvB;IAED,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;QAChC,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,IAAI;gBACT,QAAQ,CAAC,GAAG;oBACV,MAAM,KAAK,GAAI,GAAe,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;oBACpD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC7C,CAAC;aACF;SACF;QACD,KAAK,CAAC,IAAI;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAW,CAAA;YAC3C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACtE,CAAC;KACF;IAED,SAAS,EAAE;QACT,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KACvB;IAED,KAAK,EAAE;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE;YACL,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACtB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1B;QACD,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,UAAU;gBACf,QAAQ,CAAC,GAAG;oBACV,MAAM,EAAE,GAAG,GAAc,CAAA;oBACzB,wDAAwD;oBACxD,4DAA4D;oBAC5D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAA;oBACpD,OAAO;wBACL,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;wBAC3B,6DAA6D;wBAC7D,kEAAkE;wBAClE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;wBAC3B,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;wBAC/B,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;wBAC/B,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;qBAClC,CAAA;gBACH,CAAC;aACF;SACF;QACD,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAA;YACrD,MAAM,KAAK,GAA2B,EAAE,GAAG,EAAE,GAAa,EAAE,CAAA;YAC5D,IAAI,GAAG,KAAK,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAa,CAAA;YAC9C,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAe,CAAA;YACpD,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAe,CAAA;YACpD,IAAI,MAAM,KAAK,IAAI;gBAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAgB,CAAA;YACvD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;KACF;IAED,UAAU,EAAE;QACV,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;KACpB;IAED,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;IAEzB,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,8DAA8D;IAC9D,kCAAkC;IAClC,KAAK;IACL,SAAS;IACT,UAAU;IACV,YAAY;IAEZ,aAAa,EAAE,YAAY;IAC3B,cAAc,EAAE,aAAa;CAC9B,CAAA;AAED,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,MAAM,EAAE;QACN,QAAQ,EAAE;YACR,EAAE,GAAG,EAAE,QAAQ,EAAE;YACjB,EAAE,GAAG,EAAE,GAAG,EAAE;YACZ,EAAE,KAAK,EAAE,kBAAkB,EAAE;YAC7B,EAAE,KAAK,EAAE,iBAAiB,EAAE;SAC7B;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC3B;IAED,EAAE,EAAE;QACF,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACvE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KACvB;IAED,SAAS,EAAE;QACT,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;KACtB;IAED,MAAM,EAAE;QACN,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnF,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;KACtB;IAED,IAAI,EAAE;QACJ,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACzB;IAED,IAAI,EAAE;QACJ,KAAK,EAAE;YACL,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACzB,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACvB;QACD,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,SAAS;gBACd,QAAQ,CAAC,GAAG;oBACV,MAAM,EAAE,GAAG,GAAc,CAAA;oBACzB,+DAA+D;oBAC/D,6DAA6D;oBAC7D,6DAA6D;oBAC7D,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAA;oBACrD,OAAO;wBACL,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC7B,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;wBAC/B,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;wBACjC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;qBAC5B,CAAA;gBACH,CAAC;aACF;SACF;QACD,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAA;YAC/C,MAAM,KAAK,GAA2B,EAAE,IAAI,EAAE,IAAc,EAAE,CAAA;YAC9D,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAe,CAAA;YACpD,IAAI,MAAM,KAAK,IAAI;gBAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAgB,CAAA;YACvD,IAAI,GAAG,KAAK,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAa,CAAA;YAC9C,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACxB,CAAC;KACF;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA"}

package/dist/tables.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Table node specifications.
+ *
+ * ## Why these live in core rather than in the opt-in plugin
+ *
+ * The obvious design is to put tables entirely in `@openleaf-editor/plugins-table`, so
+ * a CMS that forbids tables ships none of the code. That is wrong, and the
+ * fidelity harness is what shows why: without these node types, a `<table>` in
+ * stored content is claimed by the preservation layer and becomes a single
+ * opaque atom. It round-trips faithfully -- but it is *uneditable*. An author
+ * opening a decade-old post finds a grey card where their table used to be.
+ *
+ * "We read your tables but you may not touch them" is not a thing you can tell a
+ * CMS. So the schema is always present, costing about a kilobyte, and what is
+ * genuinely opt-in is the *editing machinery*: cell selection, column resizing,
+ * the row and column commands, the toolbar controls. That is the part with real
+ * weight, and it lives in the plugin.
+ *
+ * ## Compatibility with prosemirror-tables
+ *
+ * Each spec carries a `tableRole`, which is how `prosemirror-tables` recognises
+ * these nodes. Cell attributes are named `colspan`, `rowspan` and `colwidth`
+ * exactly because that library requires those names. Deviating would mean
+ * forking it.
+ *
+ * ## Legacy presentational attributes
+ *
+ * `border`, `cellpadding`, `cellspacing`, `align` and friends are kept, which a
+ * clean-slate schema would not do. They are how HTML expressed table styling for
+ * fifteen years, they are all over the content this editor is meant to inherit,
+ * and dropping them changes how a page renders. Preserving them is the same
+ * decision the preservation layer makes, applied to attributes.
+ *
+ * `scope` on a header cell is kept for a different and more important reason: it
+ * is what tells a screen reader which cells a header governs. Dropping it turns
+ * a navigable table into a grid of unrelated values.
+ */
+import type { NodeSpec } from 'prosemirror-model';
+export declare const table: NodeSpec;
+export declare const table_row: NodeSpec;
+export declare const table_cell: NodeSpec;
+export declare const table_header: NodeSpec;
+//# sourceMappingURL=tables.d.ts.map

package/dist/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AA2EjD,eAAO,MAAM,KAAK,EAAE,QA0CnB,CAAA;AAED,eAAO,MAAM,SAAS,EAAE,QAQvB,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,QAOxB,CAAA;AAED,eAAO,MAAM,YAAY,EAAE,QAO1B,CAAA"}

package/dist/tables.js

@@ -0,0 +1,172 @@
+/**
+ * Table node specifications.
+ *
+ * ## Why these live in core rather than in the opt-in plugin
+ *
+ * The obvious design is to put tables entirely in `@openleaf-editor/plugins-table`, so
+ * a CMS that forbids tables ships none of the code. That is wrong, and the
+ * fidelity harness is what shows why: without these node types, a `<table>` in
+ * stored content is claimed by the preservation layer and becomes a single
+ * opaque atom. It round-trips faithfully -- but it is *uneditable*. An author
+ * opening a decade-old post finds a grey card where their table used to be.
+ *
+ * "We read your tables but you may not touch them" is not a thing you can tell a
+ * CMS. So the schema is always present, costing about a kilobyte, and what is
+ * genuinely opt-in is the *editing machinery*: cell selection, column resizing,
+ * the row and column commands, the toolbar controls. That is the part with real
+ * weight, and it lives in the plugin.
+ *
+ * ## Compatibility with prosemirror-tables
+ *
+ * Each spec carries a `tableRole`, which is how `prosemirror-tables` recognises
+ * these nodes. Cell attributes are named `colspan`, `rowspan` and `colwidth`
+ * exactly because that library requires those names. Deviating would mean
+ * forking it.
+ *
+ * ## Legacy presentational attributes
+ *
+ * `border`, `cellpadding`, `cellspacing`, `align` and friends are kept, which a
+ * clean-slate schema would not do. They are how HTML expressed table styling for
+ * fifteen years, they are all over the content this editor is meant to inherit,
+ * and dropping them changes how a page renders. Preserving them is the same
+ * decision the preservation layer makes, applied to attributes.
+ *
+ * `scope` on a header cell is kept for a different and more important reason: it
+ * is what tells a screen reader which cells a header governs. Dropping it turns
+ * a navigable table into a grid of unrelated values.
+ */
+/** Presentational attributes legacy CMS content puts on `<table>`. */
+const TABLE_LEGACY_ATTRS = ['border', 'cellpadding', 'cellspacing', 'width', 'align', 'summary', 'class'];
+/** Attributes legacy content puts on cells, plus the accessibility-critical ones. */
+const CELL_LEGACY_ATTRS = ['align', 'valign', 'width', 'height', 'class', 'scope', 'headers', 'abbr'];
+function readAttrs(el, names) {
+    const out = {};
+    for (const name of names)
+        out[name] = el.getAttribute(name);
+    return out;
+}
+function writeAttrs(attrs, names) {
+    const out = {};
+    for (const name of names) {
+        const value = attrs[name];
+        if (value !== null && value !== undefined && value !== '')
+            out[name] = String(value);
+    }
+    return out;
+}
+const legacyDefaults = (names) => Object.fromEntries(names.map((name) => [name, { default: null }]));
+/**
+ * Parse `colwidth` from an inline width style or attribute.
+ *
+ * `prosemirror-tables` stores column widths as an array of numbers on the cell
+ * that starts the column, which is how its resizing plugin reads them.
+ */
+function readColwidth(el) {
+    const widthAttr = el.getAttribute('data-colwidth');
+    if (widthAttr) {
+        const parsed = widthAttr.split(',').map((n) => Number.parseInt(n, 10));
+        if (parsed.every((n) => Number.isFinite(n)))
+            return parsed;
+    }
+    return null;
+}
+const cellAttrs = {
+    // These three names are required by prosemirror-tables.
+    colspan: { default: 1 },
+    rowspan: { default: 1 },
+    colwidth: { default: null },
+    ...legacyDefaults(CELL_LEGACY_ATTRS),
+};
+function cellGetAttrs(dom) {
+    const el = dom;
+    return {
+        colspan: Number.parseInt(el.getAttribute('colspan') ?? '1', 10) || 1,
+        rowspan: Number.parseInt(el.getAttribute('rowspan') ?? '1', 10) || 1,
+        colwidth: readColwidth(el),
+        ...readAttrs(el, CELL_LEGACY_ATTRS),
+    };
+}
+function cellToDOM(tag) {
+    return (node) => {
+        const attrs = writeAttrs(node.attrs, CELL_LEGACY_ATTRS);
+        const colspan = node.attrs['colspan'];
+        const rowspan = node.attrs['rowspan'];
+        if (colspan !== 1)
+            attrs['colspan'] = String(colspan);
+        if (rowspan !== 1)
+            attrs['rowspan'] = String(rowspan);
+        const colwidth = node.attrs['colwidth'];
+        if (colwidth)
+            attrs['data-colwidth'] = colwidth.join(',');
+        return [tag, attrs, 0];
+    };
+}
+export const table = {
+    content: 'table_row+',
+    tableRole: 'table',
+    isolating: true,
+    group: 'block',
+    attrs: legacyDefaults(TABLE_LEGACY_ATTRS),
+    parseDOM: [
+        { tag: 'table', getAttrs: (dom) => readAttrs(dom, TABLE_LEGACY_ATTRS) },
+        /*
+         * `tbody`, `thead` and `tfoot` are SKIPPED rather than ignored: the wrapper
+         * itself carries nothing, but its rows are the entire content. `ignore`
+         * would delete the table's contents along with the wrapper.
+         *
+         * These rules also have to exist because the preservation layer's catch-all
+         * would otherwise claim a `<tbody>` as unrecognised markup and produce an
+         * opaque atom that `table_row+` refuses to accept.
+         */
+        { tag: 'tbody', skip: true },
+        { tag: 'thead', skip: true },
+        { tag: 'tfoot', skip: true },
+        /*
+         * KNOWN LIMITATION, declared rather than hidden.
+         *
+         * `<colgroup>`/`<col>` are dropped, and `<caption>` is dropped with its
+         * text. Both should be preserved and neither can be today: a caption node
+         * would have to be the table's first child, and `prosemirror-tables`
+         * computes its cell map by treating every child of a table as a row, so a
+         * leading caption breaks its indexing.
+         *
+         * Dropping a caption is a real accessibility regression -- a caption is a
+         * table's accessible name -- so this is tracked as a bug to fix by adding a
+         * caption node and contributing the indexing fix upstream, not as a design
+         * decision. There is a fixture asserting the current behaviour so it cannot
+         * regress further without someone noticing.
+         */
+        { tag: 'colgroup', ignore: true },
+        { tag: 'col', ignore: true },
+        { tag: 'caption', ignore: true },
+    ],
+    toDOM(node) {
+        return ['table', writeAttrs(node.attrs, TABLE_LEGACY_ATTRS), ['tbody', 0]];
+    },
+};
+export const table_row = {
+    content: '(table_cell | table_header)*',
+    tableRole: 'row',
+    attrs: { class: { default: null }, align: { default: null } },
+    parseDOM: [{ tag: 'tr', getAttrs: (dom) => readAttrs(dom, ['class', 'align']) }],
+    toDOM(node) {
+        return ['tr', writeAttrs(node.attrs, ['class', 'align']), 0];
+    },
+};
+export const table_cell = {
+    content: 'block+',
+    attrs: cellAttrs,
+    tableRole: 'cell',
+    isolating: true,
+    parseDOM: [{ tag: 'td', getAttrs: cellGetAttrs }],
+    toDOM: cellToDOM('td'),
+};
+export const table_header = {
+    content: 'block+',
+    attrs: cellAttrs,
+    tableRole: 'header_cell',
+    isolating: true,
+    parseDOM: [{ tag: 'th', getAttrs: cellGetAttrs }],
+    toDOM: cellToDOM('th'),
+};
+//# sourceMappingURL=tables.js.map

package/dist/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAA;AAElH,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAE9G,SAAS,SAAS,CAAC,EAAW,EAAE,KAAwB;IACtD,MAAM,GAAG,GAAkC,EAAE,CAAA;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CACjB,KAA8B,EAC9B,KAAwB;IAExB,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,KAAwB,EAAqC,EAAE,CACrF,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAEpE;;;;;GAKG;AACH,SAAS,YAAY,CAAC,EAAW;IAC/B,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACtE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,SAAS,GAAG;IAChB,wDAAwD;IACxD,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;IACvB,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;IACvB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IAC3B,GAAG,cAAc,CAAC,iBAAiB,CAAC;CACrC,CAAA;AAED,SAAS,YAAY,CAAC,GAAS;IAC7B,MAAM,EAAE,GAAG,GAAc,CAAA;IACzB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QACpE,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1B,GAAG,SAAS,CAAC,EAAE,EAAE,iBAAiB,CAAC;KACpC,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB;IACjC,OAAO,CAAC,IAAwC,EAAuC,EAAE;QACvF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAW,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAW,CAAA;QAC/C,IAAI,OAAO,KAAK,CAAC;YAAE,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,CAAC;YAAE,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAoB,CAAA;QAC1D,IAAI,QAAQ;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACzD,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACxB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAa;IAC7B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,cAAc,CAAC,kBAAkB,CAAC;IACzC,QAAQ,EAAE;QACR,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAc,EAAE,kBAAkB,CAAC,EAAE;QAClF;;;;;;;;WAQG;QACH,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5B;;;;;;;;;;;;;;WAcG;QACH,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;QACjC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;QAC5B,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KACjC;IACD,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAa;IACjC,OAAO,EAAE,8BAA8B;IACvC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAc,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC3F,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACjD,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACjD,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;CACvB,CAAA"}

package/dist/url.d.ts

@@ -0,0 +1,26 @@
+/**
+ * URL safety.
+ *
+ * A link is the cheapest XSS vector there is: `<a href="javascript:...">` needs
+ * no injected element, no script tag, and no clever parsing trick -- just a user
+ * who clicks. OpenLeaf's schema previously accepted any `href` at all.
+ *
+ * The checks here are deliberately a small allowlist of schemes rather than a
+ * blocklist of dangerous ones. A blocklist is a promise to have thought of every
+ * scheme, including the ones a browser will invent later.
+ */
+/**
+ * Is this URL safe to put in an `href` or `src`?
+ *
+ * Relative URLs, fragments and query-only URLs are allowed: they cannot carry a
+ * scheme, so they cannot execute. Protocol-relative `//host/path` is allowed
+ * because it inherits the page's scheme.
+ */
+export declare function isSafeUrl(value: string | null | undefined): boolean;
+/** The safe URL, or null when it should be dropped. */
+export declare function safeUrlOrNull(value: string | null | undefined): string | null;
+/** Attributes whose values are URLs and therefore need checking. */
+export declare const URL_ATTRIBUTES: ReadonlySet<string>;
+/** True for `onclick`, `onmouseover` and every other inline event handler. */
+export declare function isEventHandlerAttribute(name: string): boolean;
+//# sourceMappingURL=url.d.ts.map

package/dist/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6BH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAUnE;AAED,uDAAuD;AACvD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE7E;AAED,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAEF,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/url.js

@@ -0,0 +1,78 @@
+/**
+ * URL safety.
+ *
+ * A link is the cheapest XSS vector there is: `<a href="javascript:...">` needs
+ * no injected element, no script tag, and no clever parsing trick -- just a user
+ * who clicks. OpenLeaf's schema previously accepted any `href` at all.
+ *
+ * The checks here are deliberately a small allowlist of schemes rather than a
+ * blocklist of dangerous ones. A blocklist is a promise to have thought of every
+ * scheme, including the ones a browser will invent later.
+ */
+/**
+ * Schemes an author may link to.
+ *
+ * `data:` is absent on purpose. `data:text/html` is a full XSS vector, and
+ * distinguishing safe data URLs from dangerous ones by sniffing the media type
+ * is exactly the kind of parsing that gets defeated. Integrators who genuinely
+ * need inline images can permit them in their server-side policy, where the
+ * decision is explicit and reviewable.
+ */
+const SAFE_SCHEMES = new Set(['http', 'https', 'mailto', 'tel', 'ftp', 'ftps']);
+/** Matches a leading URL scheme, per RFC 3986. */
+const SCHEME = /^([a-z][a-z0-9+.-]*):/i;
+/**
+ * Strip the characters browsers ignore when resolving a scheme.
+ *
+ * `java\tscript:alert(1)` and `java\nscript:alert(1)` both navigate. Browsers
+ * discard ASCII whitespace and control characters while parsing the scheme, so
+ * any check that does not do the same is trivially bypassed. Attribute values
+ * arrive already entity-decoded from `getAttribute`, so `&#106;avascript:` is
+ * covered by the same normalization.
+ */
+function normalize(value) {
+    return value.replace(/[\u0000-\u0020\u007f-\u00a0]/g, '').toLowerCase();
+}
+/**
+ * Is this URL safe to put in an `href` or `src`?
+ *
+ * Relative URLs, fragments and query-only URLs are allowed: they cannot carry a
+ * scheme, so they cannot execute. Protocol-relative `//host/path` is allowed
+ * because it inherits the page's scheme.
+ */
+export function isSafeUrl(value) {
+    if (value === null || value === undefined)
+        return false;
+    const candidate = normalize(value);
+    if (candidate === '')
+        return false;
+    const match = SCHEME.exec(candidate);
+    // No scheme means relative, fragment or protocol-relative. All are safe.
+    if (!match)
+        return true;
+    return SAFE_SCHEMES.has(match[1]);
+}
+/** The safe URL, or null when it should be dropped. */
+export function safeUrlOrNull(value) {
+    return isSafeUrl(value) ? value : null;
+}
+/** Attributes whose values are URLs and therefore need checking. */
+export const URL_ATTRIBUTES = new Set([
+    'href',
+    'src',
+    'action',
+    'formaction',
+    'data',
+    'poster',
+    'background',
+    'cite',
+    'longdesc',
+    'srcdoc',
+    'xlink:href',
+    'ping',
+]);
+/** True for `onclick`, `onmouseover` and every other inline event handler. */
+export function isEventHandlerAttribute(name) {
+    return /^on/i.test(name);
+}
+//# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpG,kDAAkD;AAClD,MAAM,MAAM,GAAG,wBAAwB,CAAA;AAEvC;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAgC;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACvD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpC,yEAAyE;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,MAAM;CACP,CAAC,CAAA;AAEF,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@openleaf-editor/core",
+  "version": "0.1.0-beta.0",
+  "description": "OpenLeaf editing core: ProseMirror schema, HTML I/O, and the content-preservation layer. No UI, no framework dependencies.",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PeytonNowlin/openleaf.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://peytonnowlin.github.io/openleaf/",
+  "bugs": {
+    "url": "https://github.com/PeytonNowlin/openleaf/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "orderedmap": "^2.1.1",
+    "prosemirror-commands": "^1.6.2",
+    "prosemirror-history": "^1.4.1",
+    "prosemirror-model": "^1.24.1",
+    "prosemirror-schema-list": "^1.5.1",
+    "prosemirror-state": "^1.4.3",
+    "prosemirror-transform": "^1.10.2"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}