@openleaf-editor/core 0.1.0-beta.2 → 0.1.0-beta.4

package/dist/tokens.d.ts

@@ -25,4 +25,12 @@ export declare const IMAGE_ALIGN_CLASS: Readonly<Record<ImageAlign, string>>;
 /** The modelled alignment class in this list, if any. */
 export declare function imageAlignFromClass(value: string | null | undefined): ImageAlign | null;
 export declare const IMAGE_ALIGN_CLASSES: ReadonlySet<string>;
+/**
+ * True for a name that can be written back with `setAttribute` anywhere.
+ *
+ * Used where unmodelled attributes are picked up to be carried through the
+ * round trip: an attribute that cannot be written is not content, and refusing
+ * it there is what keeps `serializeHtml(parseHtml(x))` from throwing.
+ */
+export declare function isWritableAttributeName(name: string): boolean;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,8CAA8C;AAC9C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKtE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE,WAAW,CAAC,MAAM,CAAa,GACvC,MAAM,GAAG,IAAI,CAWf;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAAgC,CAAA;AAElF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAIlE,CAAA;AASD,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAOvF;AAED,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAA6C,CAAA"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH,8CAA8C;AAC9C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKtE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE,WAAW,CAAC,MAAM,CAAa,GACvC,MAAM,GAAG,IAAI,CAWf;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAAgC,CAAA;AAElF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAIlE,CAAA;AASD,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAOvF;AAED,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAA6C,CAAA;AAiCjG;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/tokens.js

@@ -8,16 +8,25 @@
  * Which class names a deployment offers in a pick list is an integrator
  * decision; which characters may appear in one is not.
  */
-/** HTML5 ids: no spaces, not empty. */
-const ID = /^[^\s]+$/;
-/** A single class token. */
-const CLASS_TOKEN = /^-?[_a-zA-Z]+[_a-zA-Z0-9-]*$/;
+/**
+ * HTML5 ids and class tokens: a non-empty run of non-whitespace.
+ *
+ * Class names are not CSS identifiers. Tailwind (`md:w-1/2`, `p-[10px]`),
+ * leading digits (`2col`), and non-ASCII (`größe-mittel`) are legal in HTML
+ * and in CSS (with escaping at selector time, which is the site's problem).
+ * Restricting tokens to ASCII identifiers silently deleted half of a mixed
+ * `class` whenever another token survived the filter -- the modelled write
+ * then overrode the residue that would have carried the original string.
+ * Policy about *which* classes a deployment stores belongs in sanitize, not
+ * here.
+ */
+const HTML_TOKEN = /^[^\s]+$/;
 /** An `id` the schema will store, or null. */
 export function safeId(value) {
     if (value === null || value === undefined)
         return null;
     const candidate = value.trim();
-    if (candidate === '' || !ID.test(candidate))
+    if (candidate === '' || !HTML_TOKEN.test(candidate))
         return null;
     return candidate;
 }
@@ -34,7 +43,7 @@ export function safeClassList(value, exclude = new Set()) {
     const kept = [];
     const seen = new Set();
     for (const token of value.trim().split(/\s+/)) {
-        if (token === '' || exclude.has(token) || !CLASS_TOKEN.test(token))
+        if (token === '' || exclude.has(token) || !HTML_TOKEN.test(token))
             continue;
         if (seen.has(token))
             continue;
@@ -65,4 +74,43 @@ export function imageAlignFromClass(value) {
     return null;
 }
 export const IMAGE_ALIGN_CLASSES = new Set(Object.values(IMAGE_ALIGN_CLASS));
+/*
+ * Attribute names the schema is willing to write back.
+ *
+ * The HTML parser accepts names `setAttribute` refuses. `<p ="v">` parses to one
+ * attribute literally named `="v"`, and every engine's `setAttribute` throws
+ * `InvalidCharacterError` on it -- so a name the parser produced through error
+ * recovery was carried in as residue and then detonated on the way out, in the
+ * middle of rendering a document. One stray `=` typed in the source box left the
+ * editor blank with no way back, and a stored document containing one could not
+ * be loaded at all.
+ *
+ * This is the XML `Name` production, which is what `setAttribute` validates
+ * against. Deliberately the spec's rule rather than the host's: browsers are
+ * laxer than the spec for HTML documents and jsdom implements it strictly, so
+ * asking the current runtime would accept names in a browser session that then
+ * throw on a jsdom server -- the cross-environment divergence this project
+ * refuses elsewhere. Being stricter than the strictest runtime is the only test
+ * that makes stored content portable.
+ *
+ * Nothing legal is lost. Every name a document could have meant -- including
+ * non-ASCII and namespaced ones -- is a `Name`; the names this rejects exist
+ * only because a parser recovered from malformed markup.
+ */
+const NAME_START = 'A-Za-z_:' +
+    '\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF' +
+    '\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF' +
+    '\\uFDF0-\\uFFFD\\u{10000}-\\u{EFFFF}';
+const NAME_REST = NAME_START + '\\-.0-9\\u00B7\\u0300-\\u036F\\u203F-\\u2040';
+const ATTRIBUTE_NAME = new RegExp(`^[${NAME_START}][${NAME_REST}]*$`, 'u');
+/**
+ * True for a name that can be written back with `setAttribute` anywhere.
+ *
+ * Used where unmodelled attributes are picked up to be carried through the
+ * round trip: an attribute that cannot be written is not content, and refusing
+ * it there is what keeps `serializeHtml(parseHtml(x))` from throwing.
+ */
+export function isWritableAttributeName(name) {
+    return ATTRIBUTE_NAME.test(name);
+}
 //# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,uCAAuC;AACvC,MAAM,EAAE,GAAG,UAAU,CAAA;AAErB,4BAA4B;AAC5B,MAAM,WAAW,GAAG,8BAA8B,CAAA;AAElD,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CAAC,KAAgC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,UAA+B,IAAI,GAAG,EAAE;IAExC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC5E,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAKD,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAyC;IACrE,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC3B,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACxF,IAAI;IACJ,KAAK;CACN,CAAC,CACH,CAAA;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GAAG,UAAU,CAAA;AAE7B,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CAAC,KAAgC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,UAA+B,IAAI,GAAG,EAAE;IAExC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAKD,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAyC;IACrE,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC3B,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACxF,IAAI;IACJ,KAAK;CACN,CAAC,CACH,CAAA;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAEjG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,GACd,UAAU;IACV,6EAA6E;IAC7E,6EAA6E;IAC7E,sCAAsC,CAAA;AACxC,MAAM,SAAS,GAAG,UAAU,GAAG,8CAA8C,CAAA;AAC7E,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,KAAK,EAAE,GAAG,CAAC,CAAA;AAE1E;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClC,CAAC"}

package/dist/url.d.ts

@@ -1,26 +1,2 @@
-/**
- * URL safety.
- *
- * A link is the cheapest XSS vector there is: `<a href="javascript:...">` needs
- * no injected element, no script tag, and no clever parsing trick -- just a user
- * who clicks. OpenLeaf's schema previously accepted any `href` at all.
- *
- * The checks here are deliberately a small allowlist of schemes rather than a
- * blocklist of dangerous ones. A blocklist is a promise to have thought of every
- * scheme, including the ones a browser will invent later.
- */
-/**
- * Is this URL safe to put in an `href` or `src`?
- *
- * Relative URLs, fragments and query-only URLs are allowed: they cannot carry a
- * scheme, so they cannot execute. Protocol-relative `//host/path` is allowed
- * because it inherits the page's scheme.
- */
-export declare function isSafeUrl(value: string | null | undefined): boolean;
-/** The safe URL, or null when it should be dropped. */
-export declare function safeUrlOrNull(value: string | null | undefined): string | null;
-/** Attributes whose values are URLs and therefore need checking. */
-export declare const URL_ATTRIBUTES: ReadonlySet<string>;
-/** True for `onclick`, `onmouseover` and every other inline event handler. */
-export declare function isEventHandlerAttribute(name: string): boolean;
+export * from '@openleaf-editor/content-policy/url';
 //# sourceMappingURL=url.d.ts.map

package/dist/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6BH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAUnE;AAED,uDAAuD;AACvD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE7E;AAED,oEAAoE;AACpE,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAa7C,CAAA;AAEF,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAA"}

package/dist/url.js

@@ -1,78 +1,2 @@
-/**
- * URL safety.
- *
- * A link is the cheapest XSS vector there is: `<a href="javascript:...">` needs
- * no injected element, no script tag, and no clever parsing trick -- just a user
- * who clicks. OpenLeaf's schema previously accepted any `href` at all.
- *
- * The checks here are deliberately a small allowlist of schemes rather than a
- * blocklist of dangerous ones. A blocklist is a promise to have thought of every
- * scheme, including the ones a browser will invent later.
- */
-/**
- * Schemes an author may link to.
- *
- * `data:` is absent on purpose. `data:text/html` is a full XSS vector, and
- * distinguishing safe data URLs from dangerous ones by sniffing the media type
- * is exactly the kind of parsing that gets defeated. Integrators who genuinely
- * need inline images can permit them in their server-side policy, where the
- * decision is explicit and reviewable.
- */
-const SAFE_SCHEMES = new Set(['http', 'https', 'mailto', 'tel', 'ftp', 'ftps']);
-/** Matches a leading URL scheme, per RFC 3986. */
-const SCHEME = /^([a-z][a-z0-9+.-]*):/i;
-/**
- * Strip the characters browsers ignore when resolving a scheme.
- *
- * `java\tscript:alert(1)` and `java\nscript:alert(1)` both navigate. Browsers
- * discard ASCII whitespace and control characters while parsing the scheme, so
- * any check that does not do the same is trivially bypassed. Attribute values
- * arrive already entity-decoded from `getAttribute`, so `&#106;avascript:` is
- * covered by the same normalization.
- */
-function normalize(value) {
-    return value.replace(/[\u0000-\u0020\u007f-\u00a0]/g, '').toLowerCase();
-}
-/**
- * Is this URL safe to put in an `href` or `src`?
- *
- * Relative URLs, fragments and query-only URLs are allowed: they cannot carry a
- * scheme, so they cannot execute. Protocol-relative `//host/path` is allowed
- * because it inherits the page's scheme.
- */
-export function isSafeUrl(value) {
-    if (value === null || value === undefined)
-        return false;
-    const candidate = normalize(value);
-    if (candidate === '')
-        return false;
-    const match = SCHEME.exec(candidate);
-    // No scheme means relative, fragment or protocol-relative. All are safe.
-    if (!match)
-        return true;
-    return SAFE_SCHEMES.has(match[1]);
-}
-/** The safe URL, or null when it should be dropped. */
-export function safeUrlOrNull(value) {
-    return isSafeUrl(value) ? value : null;
-}
-/** Attributes whose values are URLs and therefore need checking. */
-export const URL_ATTRIBUTES = new Set([
-    'href',
-    'src',
-    'action',
-    'formaction',
-    'data',
-    'poster',
-    'background',
-    'cite',
-    'longdesc',
-    'srcdoc',
-    'xlink:href',
-    'ping',
-]);
-/** True for `onclick`, `onmouseover` and every other inline event handler. */
-export function isEventHandlerAttribute(name) {
-    return /^on/i.test(name);
-}
+export * from '@openleaf-editor/content-policy/url';
 //# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpG,kDAAkD;AAClD,MAAM,MAAM,GAAG,wBAAwB,CAAA;AAEvC;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAgC;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACvD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACpC,yEAAyE;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,MAAM;CACP,CAAC,CAAA;AAEF,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAA"}

package/dist/visual-aids.d.ts

@@ -4,7 +4,17 @@
  *
  * These marks are view-only. They must never reach serialized HTML: an empty
  * paragraph is still an empty paragraph, and a ` ` is still a nbsp.
+ *
+ * The set lives in plugin state rather than being recomputed by the
+ * `decorations` prop. That prop is a *pull* prop -- ProseMirror calls it on
+ * every `updateState`, so building the set there rebuilt the whole document's
+ * decorations on every keystroke, every arrow key and every click. On
+ * Word-pasted content, which is mostly non-breaking spaces, that measured 263 ms
+ * per keystroke; mapping the existing set through the transaction instead
+ * measures under 2 ms. Only the ranges the transaction actually touched are
+ * rebuilt.
  */
 import { Plugin } from 'prosemirror-state';
-export declare function visualAidsPlugin(): Plugin;
+import { DecorationSet } from 'prosemirror-view';
+export declare function visualAidsPlugin(): Plugin<DecorationSet>;
 //# sourceMappingURL=visual-aids.d.ts.map

package/dist/visual-aids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visual-aids.d.ts","sourceRoot":"","sources":["../src/visual-aids.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,MAAM,EAAa,MAAM,mBAAmB,CAAA;AAsBrD,wBAAgB,gBAAgB,IAAI,MAAM,CAqCzC"}
+{"version":3,"file":"visual-aids.d.ts","sourceRoot":"","sources":["../src/visual-aids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAa,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAc,aAAa,EAAE,MAAM,kBAAkB,CAAA;AA0G5D,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,aAAa,CAAC,CAwBxD"}

package/dist/visual-aids.js

@@ -4,56 +4,144 @@
  *
  * These marks are view-only. They must never reach serialized HTML: an empty
  * paragraph is still an empty paragraph, and a ` ` is still a nbsp.
+ *
+ * The set lives in plugin state rather than being recomputed by the
+ * `decorations` prop. That prop is a *pull* prop -- ProseMirror calls it on
+ * every `updateState`, so building the set there rebuilt the whole document's
+ * decorations on every keystroke, every arrow key and every click. On
+ * Word-pasted content, which is mostly non-breaking spaces, that measured 263 ms
+ * per keystroke; mapping the existing set through the transaction instead
+ * measures under 2 ms. Only the ranges the transaction actually touched are
+ * rebuilt.
  */
 import { Plugin, PluginKey } from 'prosemirror-state';
 import { Decoration, DecorationSet } from 'prosemirror-view';
 const key = new PluginKey('openleaf-visual-aids');
 /**
- * True when this position is the last character of its text block.
+ * Mark every nbsp in one inline container, except a block-final one.
+ *
+ * ProseMirror renders a document space at the end of a text block as a
+ * non-breaking space itself, so the browser does not collapse it. Decorating
+ * that position wrapped the rendering artifact in a span, and the editor then
+ * read the nbsp back as the author's own character -- so every space typed at
+ * the end of a paragraph became a nbsp in the stored HTML, and the next one
+ * after it too. A genuinely stored trailing nbsp therefore goes unmarked. That
+ * is the price of the aid never changing the document it describes.
  *
- * ProseMirror renders a document space in that position as a non-breaking space
- * itself, so the browser does not collapse it. Decorating it wraps that
- * rendering artifact in a span, and the editor then reads the nbsp back as the
- * author's own character -- so every space typed at the end of a paragraph
- * became a nbsp in the stored HTML, and the next one after it too.
+ * The block-final test used to be `doc.resolve(at)` per nbsp, and
+ * `Fragment.findIndex` inside `resolve` is a linear scan of the parent's
+ * children -- O(nbsp x children) over the document. The traversal already knows
+ * the parent's `content.size` and the running offset of each child, so the same
+ * question is answered by comparing two integers.
+ */
+function markNbsp(parent, contentStart, out) {
+    const contentSize = parent.content.size;
+    let offset = 0;
+    parent.forEach((child) => {
+        if (child.isText) {
+            const text = child.text ?? '';
+            for (let i = 0; i < text.length; i += 1) {
+                if (text.charCodeAt(i) !== 0xa0)
+                    continue;
+                // `parentOffset + 1 >= parent.content.size` is the block-final test,
+                // and `offset + i` is exactly that parent offset.
+                if (offset + i + 1 >= contentSize)
+                    continue;
+                // `contentStart + offset + i` already addresses the character itself: a
+                // text node has no opening token to step over, unlike a node. Adding one
+                // marked the character after each nbsp, and ran off the end of the node
+                // when the nbsp was last -- where the decoration disappeared entirely.
+                const at = contentStart + offset + i;
+                out.push(Decoration.inline(at, at + 1, { class: 'ol-nbsp' }));
+            }
+        }
+        offset += child.nodeSize;
+    });
+}
+/** Every aid for the nodes overlapping `[from, to]`. */
+function decorationsIn(doc, from, to) {
+    const out = [];
+    doc.nodesBetween(from, to, (node, pos) => {
+        // Text is scanned from its parent, which is where the offsets are known.
+        if (node.isText)
+            return false;
+        if (node.isTextblock && node.content.size === 0) {
+            out.push(Decoration.node(pos, pos + node.nodeSize, { class: 'ol-empty-block' }));
+        }
+        if (node.type.name === 'unknown_block' || node.type.name === 'unknown_inline') {
+            out.push(Decoration.node(pos, pos + node.nodeSize, { class: 'ol-hidden-structure' }));
+        }
+        if (node.inlineContent && node.content.size > 0)
+            markNbsp(node, pos + 1, out);
+        return true;
+    });
+    return out;
+}
+/**
+ * The span of `tr.doc` the transaction touched, or null when it touched nothing.
  *
- * A genuinely stored trailing nbsp therefore goes unmarked. That is the price of
- * the aid never changing the document it describes.
+ * Each step's map reports positions in the document *that step* produced, which
+ * for every step but the last is not `tr.doc`. Rather than slicing the mapping
+ * per step -- the O(steps^2) shape this plugin exists to avoid -- the accumulated
+ * range is carried forward one step at a time, so the whole scan is O(steps).
  */
-function isBlockFinal(doc, at) {
-    const $at = doc.resolve(at);
-    return $at.parentOffset + 1 >= $at.parent.content.size;
+function changedRange(maps) {
+    let from = -1;
+    let to = -1;
+    for (const map of maps) {
+        if (from > -1) {
+            from = map.map(from, -1);
+            to = map.map(to, 1);
+        }
+        map.forEach((_oldStart, _oldEnd, newStart, newEnd) => {
+            from = from < 0 ? newStart : Math.min(from, newStart);
+            to = to < 0 ? newEnd : Math.max(to, newEnd);
+        });
+    }
+    return from < 0 ? null : { from, to };
+}
+/**
+ * Widen a range to whole top-level blocks.
+ *
+ * Every aid is contained in one top-level block, so widening to that boundary
+ * means a node overlapping the rebuilt range is *entirely* inside it. Without
+ * that, a decoration on the half of a paragraph outside the range would survive
+ * the removal and be added a second time.
+ */
+function widen(doc, from, to) {
+    const size = doc.content.size;
+    const start = Math.max(0, Math.min(from, size));
+    const end = Math.max(start, Math.min(to, size));
+    const $start = doc.resolve(start);
+    const $end = doc.resolve(end);
+    return {
+        from: $start.depth > 0 ? $start.before(1) : start,
+        to: $end.depth > 0 ? $end.after(1) : end,
+    };
 }
 export function visualAidsPlugin() {
     return new Plugin({
         key,
+        state: {
+            init(_config, state) {
+                return DecorationSet.create(state.doc, decorationsIn(state.doc, 0, state.doc.content.size));
+            },
+            apply(tr, set) {
+                if (!tr.docChanged)
+                    return set;
+                const changed = changedRange(tr.mapping.maps);
+                const mapped = set.map(tr.mapping, tr.doc);
+                if (!changed)
+                    return mapped;
+                const { from, to } = widen(tr.doc, changed.from, changed.to);
+                const stale = mapped.find(from, to);
+                const kept = stale.length > 0 ? mapped.remove(stale) : mapped;
+                return kept.add(tr.doc, decorationsIn(tr.doc, from, to));
+            },
+        },
         props: {
             decorations(state) {
-                const decorations = [];
-                state.doc.descendants((node, pos) => {
-                    if (node.isTextblock && node.content.size === 0) {
-                        decorations.push(Decoration.node(pos, pos + node.nodeSize, { class: 'ol-empty-block' }));
-                    }
-                    if (node.type.name === 'unknown_block' || node.type.name === 'unknown_inline') {
-                        decorations.push(Decoration.node(pos, pos + node.nodeSize, { class: 'ol-hidden-structure' }));
-                    }
-                    if (node.isText) {
-                        const text = node.text ?? '';
-                        for (let i = 0; i < text.length; i += 1) {
-                            if (text.charCodeAt(i) !== 0xa0)
-                                continue;
-                            // `pos` already addresses the first character: a text node has no
-                            // opening token to step over, unlike a node. Adding one marked the
-                            // character after each nbsp, and ran off the end of the node when
-                            // the nbsp was last -- where the decoration disappeared entirely.
-                            const at = pos + i;
-                            if (isBlockFinal(state.doc, at))
-                                continue;
-                            decorations.push(Decoration.inline(at, at + 1, { class: 'ol-nbsp' }));
-                        }
-                    }
-                });
-                return DecorationSet.create(state.doc, decorations);
+                return key.getState(state);
             },
         },
     });

package/dist/visual-aids.js.map

@@ -1 +1 @@
-{"version":3,"file":"visual-aids.js","sourceRoot":"","sources":["../src/visual-aids.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAE5D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,EAAU;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3B,OAAO,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,MAAM,CAAC;QAChB,GAAG;QACH,KAAK,EAAE;YACL,WAAW,CAAC,KAAK;gBACf,MAAM,WAAW,GAAiB,EAAE,CAAA;gBACpC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;oBAClC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBAChD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CACvE,CAAA;oBACH,CAAC;oBACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAC9E,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAC5E,CAAA;oBACH,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;wBAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;4BACxC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;gCAAE,SAAQ;4BACzC,kEAAkE;4BAClE,mEAAmE;4BACnE,kEAAkE;4BAClE,kEAAkE;4BAClE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAA;4BAClB,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;gCAAE,SAAQ;4BACzC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CACpD,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;YACrD,CAAC;SACF;KACF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"visual-aids.js","sourceRoot":"","sources":["../src/visual-aids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAE5D,MAAM,GAAG,GAAG,IAAI,SAAS,CAAgB,sBAAsB,CAAC,CAAA;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,QAAQ,CAAC,MAAc,EAAE,YAAoB,EAAE,GAAiB;IACvE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,SAAQ;gBACzC,qEAAqE;gBACrE,kDAAkD;gBAClD,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW;oBAAE,SAAQ;gBAC3C,wEAAwE;gBACxE,yEAAyE;gBACzE,wEAAwE;gBACxE,uEAAuE;gBACvE,MAAM,EAAE,GAAG,YAAY,GAAG,MAAM,GAAG,CAAC,CAAA;gBACpC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC1D,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvC,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC7B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,GAAG,CAAC,CAAC,CAAA;IACb,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IACX,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YACd,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACxB,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACrB,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACrD,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QACjD,EAAE,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;KACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,MAAM,CAAgB;QAC/B,GAAG;QACH,KAAK,EAAE;YACL,IAAI,CAAC,OAAO,EAAE,KAAK;gBACjB,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,KAAK,CAAC,EAAE,EAAE,GAAG;gBACX,IAAI,CAAC,EAAE,CAAC,UAAU;oBAAE,OAAO,GAAG,CAAA;gBAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;gBAC1C,IAAI,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAA;gBAC3B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;gBAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;gBAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;YAC1D,CAAC;SACF;QACD,KAAK,EAAE;YACL,WAAW,CAAC,KAAK;gBACf,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;SACF;KACF,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openleaf-editor/core",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.4",
   "description": "OpenLeaf editing core: ProseMirror schema, HTML I/O, and the content-preservation layer. No UI, no framework dependencies.",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -16,12 +16,19 @@
     "url": "https://github.com/PeytonNowlin/openleaf/issues"
   },
   "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js"
     }
   },
   "files": [
@@ -30,7 +37,11 @@
   "sideEffects": false,
   "dependencies": {
     "orderedmap": "^2.1.1",
+    "@openleaf-editor/content-policy": "0.1.0-beta.4"
+  },
+  "peerDependencies": {
     "prosemirror-commands": "^1.6.2",
+    "prosemirror-gapcursor": "^1.4.1",
     "prosemirror-history": "^1.4.1",
     "prosemirror-model": "^1.24.1",
     "prosemirror-schema-list": "^1.5.1",
@@ -38,6 +49,11 @@
     "prosemirror-transform": "^1.10.2",
     "prosemirror-view": "^1.37.0"
   },
+  "devDependencies": {
+    "prosemirror-gapcursor": "^1.4.1",
+    "prosemirror-tables": "^1.6.4",
+    "prosemirror-transform": "^1.10.2"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json"
   }