@particle-academy/react-fancy 5.65.0 → 5.67.0

package/docs/ContentRenderer.md

@@ -24,6 +24,98 @@ import { ContentRenderer } from "@particle-academy/react-fancy";
 | extensions | `RenderExtension[]` | - | Per-instance render extensions (merged with global) |
 | className | `string` | - | Additional CSS classes |
 | unsafe | `boolean` | `false` | Skip HTML sanitization. See **Sanitization** below. |
+| copyButtons | `boolean \| { code?: boolean; table?: boolean }` | `true` | Copy buttons on code blocks and tables. See **Copy buttons**. |
+| onCopy | `(event: ContentCopyEvent) => void` | - | Called after every copy attempt, successful or not |
+| clipboardWriter | `ContentClipboardWriter` | - | Host-supplied clipboard writer. See **Clipboard writer**. |
+| streaming | `boolean` | `false` | The value is still arriving: hold back an unfinished trailing tag or fence. See **Streaming**. |
+
+## Copy buttons
+
+Every code block and table gets a react-fancy `Button` (icon `copy`, then
+`check` for two seconds after a copy, `x` after a failure). What is copied:
+
+- **Code**: exactly the code between the fences. No language label, no
+  trailing newline added. (Marked itself drops trailing blank lines inside a
+  fence, so they are not in the copy either; indentation, inner blank lines and
+  characters like `<` and `&` are.)
+- **Table**: TSV. A tab between cells, a newline between rows, no trailing
+  newline. Tabs and line breaks inside a cell become spaces, so the shape
+  survives a paste into a spreadsheet.
+
+Each copy is announced as `Copied` or `Copy failed` through a polite
+`aria-live` region (`[data-react-fancy-content-renderer-live]`).
+
+```tsx
+<ContentRenderer value={reply} copyButtons={false} />          // none
+<ContentRenderer value={reply} copyButtons={{ table: false }} /> // code only
+```
+
+The button sits beside the block, never inside it, so its own text never ends
+up in the copy. Buttons are added after mount, so server-rendered HTML has none
+until hydration.
+
+### Clipboard writer
+
+The default writer puts **text/html and text/plain** on the clipboard with a
+`ClipboardItem`, so a table pastes as a table into a rich editor and as cells
+into a spreadsheet. If `ClipboardItem` is missing or that write is refused, it
+falls back to `navigator.clipboard.writeText`.
+
+`navigator.clipboard` can fail silently in some hosts (Genie found it does in a
+sandboxed Electron window). Pass your own writer there:
+
+```tsx
+import { clipboard } from "electron";
+
+<ContentRenderer
+  value={reply}
+  clipboardWriter={({ text, html }) => clipboard.write({ text, html })}
+/>
+```
+
+A writer receives `{ kind, text, html }`. **Throwing, rejecting, or returning
+`false` means the copy failed**, and so does a write that has not settled after
+5 seconds. A failure is never silent: the button shows `x`, the live region says
+`Copy failed`, and `onCopy` reports `ok: false`.
+
+### Observing copies (Human+)
+
+ContentRenderer is a read-only surface: it exposes stable DOM handles rather
+than state. Copy follows that:
+
+| Handle | On |
+|--------|----|
+| `data-react-fancy-content-copy="code" \| "table"` | the copy button |
+| `data-copy-state="idle" \| "copied" \| "failed"` | the copy button |
+| `data-react-fancy-content-copy-block="code" \| "table"` | the wrapper around the block |
+| `data-react-fancy-content-renderer-live` | the live region |
+| `data-streaming="true"` | the root, while `streaming` |
+
+`onCopy` receives `{ kind, index, text, html, ok }`, where `index` is the
+button's position among this renderer's copy buttons in document order. Wire it
+to your activity feed if agents should see copies.
+
+## Streaming
+
+While a reply is still arriving, pass `streaming`:
+
+```tsx
+<ContentRenderer value={partial} streaming={!done} extensions={[resultTag]} />
+```
+
+Held back until it is complete:
+
+- an opened tag of a **registered extension** with no closing tag yet, from its
+  opening tag onwards (`<result>` + half a body, or `<result>body</res`);
+- a partial tag at the very end that could still become one: `<`, `</`,
+  `<res`, `<result title="Do`;
+- an open code fence, from its fence line, and a fence marker still arriving
+  (` `` `).
+
+A `<` that cannot become a registered tag is prose and always renders
+(`a < b`, `a<b`, `3 <= 4`), as do unknown tags and anything in inline code.
+A lone `<` at the very end is held for one chunk, because it may be the start of
+a tag. When `streaming` goes back to `false`, everything renders.
 
 ## Sanitization
 
@@ -45,7 +137,7 @@ The helpers are also exported for use elsewhere:
 import { sanitizeHtml, sanitizeHref } from "@particle-academy/react-fancy";
 ```
 
-> **Render extensions still need to sanitize their own input.** The `content` prop passed to your extension component is the raw text inside the matched tag — treat it as untrusted and call `sanitizeHtml(content)` if you render it as HTML.
+> **Render extensions still need to sanitize their own input.** The `content` prop passed to your extension component is the raw text inside the matched tag — treat it as untrusted and call `sanitizeHtml(content)` if you render it as HTML. A `markdown` extension gets an already-sanitised `children` instead; use that.
 
 ## Render Extensions
 
@@ -78,13 +170,56 @@ registerExtension({
 | tag | `string` | - | Tag name to match (case-insensitive) |
 | component | `ComponentType<RenderExtensionProps>` | - | React component to render the tag |
 | block | `boolean` | `true` | Block-level (`<div>`) vs inline (`<span>`) wrapping |
+| markdown | `boolean` | `false` | The body is markdown. See **Tags with a markdown body**. |
 
 ### RenderExtensionProps
 
 | Prop | Type | Description |
 |------|------|-------------|
-| content | `string` | Inner content of the custom tag |
-| attributes | `Record<string, string>` | Parsed HTML attributes from the opening tag |
+| content | `string` | Inner content of the custom tag. Raw markdown for a `markdown` extension in markdown content. Untrusted. |
+| attributes | `Record<string, string>` | Parsed attributes from the opening tag, with `on*`, `srcdoc` and unsafe URLs removed |
+| children | `ReactNode` | `markdown` extensions only: the body, rendered and sanitised |
+
+### Tags with a markdown body
+
+Custom tags are normally found after the markdown has become HTML, and a
+CommonMark HTML block keeps the markdown inside it as literal text, so
+`<result>**done**</result>` would show its asterisks. Mark the extension
+`markdown: true` and the tag is lifted out of the markdown **source** first:
+
+```tsx
+const resultTag: RenderExtension = {
+  tag: "result",
+  markdown: true,
+  component: ({ attributes, children }) => (
+    <Card>
+      <Card.Header>{attributes.title}</Card.Header>
+      <Card.Body>{children}</Card.Body>
+    </Card>
+  ),
+};
+
+<ContentRenderer
+  value={'Here it is:\n\n<result title="Build">\n**Passed**, `12/12`\n\n- lint\n- test\n</result>'}
+  extensions={[resultTag]}
+/>
+```
+
+- `content` is the raw markdown body; `children` is that body rendered through
+  the same pipeline as everything else: sanitised, with nested extensions and
+  copy buttons. **Render `children`, not `content`.**
+- A tag is lifted when its opening tag starts a line and it has a matching
+  closing tag. Same-name nesting is balanced, other markdown tags nest inside
+  it, and a tag inside a code fence or inline code is left alone.
+- Anywhere else (mid-line, unclosed, or in HTML content) it is matched in the
+  HTML as before, and `children` renders that HTML body.
+- Nesting stops at depth 8: deeper bodies render as plain sanitised content.
+
+Sanitisation is unchanged by lifting. Every piece of markdown, including each
+body, is converted and then run through `sanitizeHtml` before it is injected,
+and the tag's attributes lose `on*`, `srcdoc` and unsafe URLs before the
+component sees them. Unknown tags stay in the markdown and are sanitised like
+any HTML. `unsafe` turns all of this off, as it always has.
 
 ## Markdown Rendering
 

package/docs/PromptInput.md

@@ -86,6 +86,29 @@ if (saved) composer.current!.setDraft(JSON.parse(saved));
 - `setDraft` does not call `onChange` / `onDraftChange`. You set the draft yourself, so you already have it.
 - A draft with an unknown `v` is refused with a console warning.
 
+### Labelled text pills
+
+A text pill normally reads `Pasted text · N characters`. Give it a `label` and
+the pill shows that instead. Use this when the host puts the pill there itself,
+for example a plan step sent into the chat:
+
+```tsx
+composer.current!.setDraft({
+  v: 1,
+  text: `Do this next: ${pasteMarker("step-3")}`,
+  pills: [{ kind: "text", id: "step-3", text: fullStep, label: "Step 3: migrate the billing tables" }],
+  attachments: [],
+});
+```
+
+- The label is for display only. Sending still expands the pill to the full `text`.
+- Its accessible name is `Insert this pasted text: <label>, N characters`.
+- It is plain text and is never parsed as HTML. Line breaks, control characters
+  and U+FFFC become single spaces, and anything past 80 characters is cut with
+  `…`. If the label is blank or not a string, the generic text is shown.
+- `label` round-trips through `getDraft`, `setDraft`, `defaultDraft`, `draft`
+  and `onDraftChange`.
+
 ### Attachments: where the bytes go
 
 A `File` cannot be stored as JSON, and by default a draft does not carry the
@@ -122,7 +145,7 @@ type PromptAttachment = { id: string; name: string; bytes: number; file?: File;
 
 interface PromptDraftFile { id: string; name: string; type: string; bytes: number; ref?: string }
 type PromptDraftPill =
-  | { kind: "text"; id: string; text: string }
+  | { kind: "text"; id: string; text: string; label?: string }
   | { kind: "image"; id: string; label: string; file: PromptDraftFile };
 interface PromptDraft { v: 1; text: string; pills: PromptDraftPill[]; attachments: PromptDraftFile[] }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@particle-academy/react-fancy",
-  "version": "5.65.0",
+  "version": "5.67.0",
   "description": "React UI component library for Human+ UX — controlled, agent-bridgeable primitives",
   "repository": {
     "type": "git",

package/dist/chunk-6TBRBN7H.js

@@ -1,212 +0,0 @@
-// src/utils/sanitize.ts
-var DANGEROUS_TAGS = /* @__PURE__ */ new Set([
-  "script",
-  "style",
-  "iframe",
-  "object",
-  "embed",
-  "link",
-  "meta",
-  "base",
-  "form",
-  // A <title> anywhere in the document retitles the host's tab.
-  "title"
-]);
-var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href"]);
-var SAFE_PROTOCOL = /^(?:https?:|mailto:|tel:|sms:|ftp:|#|\/|\.\/|\.\.\/|[^:]*$)/i;
-function sanitizeHref(href) {
-  if (href == null) return void 0;
-  const trimmed = href.trim();
-  if (!trimmed) return void 0;
-  return SAFE_PROTOCOL.test(trimmed) ? trimmed : void 0;
-}
-function stripDangerousAttrs(el) {
-  const names = [];
-  for (let i = 0; i < el.attributes.length; i++) {
-    names.push(el.attributes[i].name);
-  }
-  for (const name of names) {
-    const lower = name.toLowerCase();
-    if (lower.startsWith("on")) {
-      el.removeAttribute(name);
-      continue;
-    }
-    if (URL_ATTRS.has(lower)) {
-      const sanitized = sanitizeHref(el.getAttribute(name));
-      if (sanitized === void 0) {
-        el.removeAttribute(name);
-      } else {
-        el.setAttribute(name, sanitized);
-      }
-      continue;
-    }
-    if (lower === "srcdoc") {
-      el.removeAttribute(name);
-    }
-  }
-}
-function walk(el, removeQueue) {
-  const tag = el.tagName.toLowerCase();
-  if (DANGEROUS_TAGS.has(tag)) {
-    removeQueue.push(el);
-    return;
-  }
-  stripDangerousAttrs(el);
-  const children = Array.from(el.children);
-  for (const child of children) {
-    walk(child, removeQueue);
-  }
-}
-var ALWAYS_REMOVED_TAGS = /* @__PURE__ */ new Set([
-  ...DANGEROUS_TAGS,
-  "frame",
-  "frameset",
-  "applet",
-  "template",
-  "noscript",
-  "noembed",
-  "noframes",
-  "xmp",
-  "plaintext",
-  // Foreign content: namespace confusion is how mutation XSS gets past
-  // sanitisers that re-serialise, as this one does.
-  "svg",
-  "math"
-]);
-var ALLOWLIST_URL_ATTRS = /* @__PURE__ */ new Set([
-  "href",
-  "src",
-  "action",
-  "formaction",
-  "cite",
-  "poster",
-  "background",
-  "ping",
-  "xlink:href"
-]);
-var NEVER_ALLOWED_ATTRS = /* @__PURE__ */ new Set(["srcdoc", "srcset"]);
-var NEVER_ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["javascript:", "vbscript:"]);
-var DEFAULT_SCHEMES = ["http:", "https:", "mailto:"];
-var SCHEME = /^([a-z][a-z0-9+.-]*:)/i;
-var SLASH = 47;
-var BACKSLASH = 92;
-function lowerAll(list) {
-  return (list ?? []).map((s) => s.toLowerCase());
-}
-function toPolicy(options) {
-  const tagAttrs = /* @__PURE__ */ new Map();
-  let globalAttrs = [];
-  const attrs = options.allowedAttributes;
-  if (Array.isArray(attrs)) {
-    globalAttrs = lowerAll(attrs);
-  } else if (attrs) {
-    for (const [tag, list] of Object.entries(attrs)) {
-      if (tag === "*") globalAttrs = lowerAll(list);
-      else tagAttrs.set(tag.toLowerCase(), lowerAll(list));
-    }
-  }
-  return {
-    tags: new Set(lowerAll(options.allowedTags)),
-    globalAttrs,
-    tagAttrs,
-    schemes: new Set(lowerAll(options.allowedSchemes ?? DEFAULT_SCHEMES)),
-    allowRelative: options.allowRelative === true
-  };
-}
-function attrListed(name, list) {
-  if (!list) return false;
-  for (const entry of list) {
-    if (entry === name) return true;
-    if (entry.endsWith("*") && name.startsWith(entry.slice(0, -1))) return true;
-  }
-  return false;
-}
-function stripControlAndSpace(value) {
-  let out = "";
-  for (let i = 0; i < value.length; i++) {
-    if (value.charCodeAt(i) > 32) out += value[i];
-  }
-  return out;
-}
-function urlAllowed(value, policy) {
-  const url = stripControlAndSpace(value);
-  const match = SCHEME.exec(url);
-  if (match) {
-    const scheme = match[1].toLowerCase();
-    return !NEVER_ALLOWED_SCHEMES.has(scheme) && policy.schemes.has(scheme);
-  }
-  if (!policy.allowRelative) return false;
-  const a = url.charCodeAt(0);
-  const b = url.charCodeAt(1);
-  const isSlash = (c) => c === SLASH || c === BACKSLASH;
-  return !(isSlash(a) && isSlash(b));
-}
-function cleanAttributes(el, tag, policy) {
-  const names = [];
-  for (let i = 0; i < el.attributes.length; i++) {
-    names.push(el.attributes[i].name);
-  }
-  for (const name of names) {
-    const lower = name.toLowerCase();
-    const keep = !lower.startsWith("on") && !NEVER_ALLOWED_ATTRS.has(lower) && (attrListed(lower, policy.globalAttrs) || attrListed(lower, policy.tagAttrs.get(tag))) && (!ALLOWLIST_URL_ATTRS.has(lower) || urlAllowed(el.getAttribute(name) ?? "", policy));
-    if (!keep) el.removeAttribute(name);
-  }
-}
-function cleanChildren(parent, policy) {
-  for (const node of Array.from(parent.childNodes)) {
-    if (node.nodeType === 3) continue;
-    if (node.nodeType !== 1) {
-      parent.removeChild(node);
-      continue;
-    }
-    const el = node;
-    const tag = el.tagName.toLowerCase();
-    if (ALWAYS_REMOVED_TAGS.has(tag)) {
-      parent.removeChild(el);
-      continue;
-    }
-    cleanChildren(el, policy);
-    if (!policy.tags.has(tag)) {
-      while (el.firstChild) parent.insertBefore(el.firstChild, el);
-      parent.removeChild(el);
-      continue;
-    }
-    cleanAttributes(el, tag, policy);
-  }
-}
-function escapeText(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function sanitizeAllowlist(html, options) {
-  if (typeof window === "undefined" || typeof DOMParser === "undefined") {
-    return escapeText(html);
-  }
-  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, "text/html");
-  const body = doc.body;
-  if (!body) return "";
-  cleanChildren(body, toPolicy(options));
-  return body.innerHTML;
-}
-function sanitizeHtml(html, options) {
-  if (options !== void 0 && options !== null) {
-    return sanitizeAllowlist(html, options);
-  }
-  if (typeof window === "undefined" || typeof DOMParser === "undefined") {
-    return html;
-  }
-  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, "text/html");
-  const body = doc.body;
-  if (!body) return html;
-  const removeQueue = [];
-  for (const child of Array.from(body.children)) {
-    walk(child, removeQueue);
-  }
-  for (const el of removeQueue) {
-    el.parentNode?.removeChild(el);
-  }
-  return body.innerHTML;
-}
-
-export { sanitizeHref, sanitizeHtml };
-//# sourceMappingURL=chunk-6TBRBN7H.js.map
-//# sourceMappingURL=chunk-6TBRBN7H.js.map

package/dist/chunk-6TBRBN7H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/sanitize.ts"],"names":[],"mappings":";AAaA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA;AAAA,EAEA;AACF,CAAC,CAAA;AAED,IAAM,SAAA,uBAAgB,GAAA,CAAI,CAAC,QAAQ,KAAA,EAAO,QAAA,EAAU,YAAA,EAAc,YAAY,CAAC,CAAA;AAE/E,IAAM,aAAA,GAAgB,8DAAA;AAQf,SAAS,aAAa,IAAA,EAAqD;AAChF,EAAA,IAAI,IAAA,IAAQ,MAAM,OAAO,MAAA;AACzB,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AACjD;AAEA,SAAS,oBAAoB,EAAA,EAAmB;AAE9C,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,UAAA,CAAW,CAAC,EAAE,IAAI,CAAA;AAAA,EAClC;AAEA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,KAAK,WAAA,EAAY;AAG/B,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1B,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AACvB,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA,EAAG;AACxB,MAAA,MAAM,SAAA,GAAY,YAAA,CAAa,EAAA,CAAG,YAAA,CAAa,IAAI,CAAC,CAAA;AACpD,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,MACzB,CAAA,MAAO;AACL,QAAA,EAAA,CAAG,YAAA,CAAa,MAAM,SAAS,CAAA;AAAA,MACjC;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,UAAU,QAAA,EAAU;AACtB,MAAA,EAAA,CAAG,gBAAgB,IAAI,CAAA;AAAA,IACzB;AAAA,EACF;AACF;AAEA,SAAS,IAAA,CAAK,IAAa,WAAA,EAA8B;AACvD,EAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,WAAA,EAAY;AAEnC,EAAA,IAAI,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,IAAA,WAAA,CAAY,KAAK,EAAE,CAAA;AACnB,IAAA;AAAA,EACF;AAEA,EAAA,mBAAA,CAAoB,EAAE,CAAA;AAEtB,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,QAAQ,CAAA;AACvC,EAAA,KAAA,MAAW,SAAS,QAAA,EAAU;AAC5B,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AACF;AAgDA,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,GAAG,cAAA;AAAA,EACH,OAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA;AAAA,EACA,WAAA;AAAA;AAAA;AAAA,EAGA,KAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,sCAAsB,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,QAAQ,CAAC,CAAA;AAExD,IAAM,wCAAwB,IAAI,GAAA,CAAI,CAAC,aAAA,EAAe,WAAW,CAAC,CAAA;AAElE,IAAM,eAAA,GAAkB,CAAC,OAAA,EAAS,QAAA,EAAU,SAAS,CAAA;AAErD,IAAM,MAAA,GAAS,wBAAA;AAEf,IAAM,KAAA,GAAQ,EAAA;AACd,IAAM,SAAA,GAAY,EAAA;AAUlB,SAAS,SAAS,IAAA,EAA+C;AAC/D,EAAA,OAAA,CAAQ,IAAA,IAAQ,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAChD;AAEA,SAAS,SAAS,OAAA,EAAsC;AACtD,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAsB;AAC3C,EAAA,IAAI,cAAwB,EAAC;AAC7B,EAAA,MAAM,QAAQ,OAAA,CAAQ,iBAAA;AACtB,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,WAAA,GAAc,SAAS,KAAK,CAAA;AAAA,EAC9B,WAAW,KAAA,EAAO;AAChB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,KAA0C,CAAA,EAAG;AACpF,MAAA,IAAI,GAAA,KAAQ,GAAA,EAAK,WAAA,GAAc,QAAA,CAAS,IAAI,CAAA;AAAA,oBAC9B,GAAA,CAAI,GAAA,CAAI,aAAY,EAAG,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,IACrD;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,MAAM,IAAI,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,WAAW,CAAC,CAAA;AAAA,IAC3C,WAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAS,IAAI,GAAA,CAAI,SAAS,OAAA,CAAQ,cAAA,IAAkB,eAAe,CAAC,CAAA;AAAA,IACpE,aAAA,EAAe,QAAQ,aAAA,KAAkB;AAAA,GAC3C;AACF;AAEA,SAAS,UAAA,CAAW,MAAc,IAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,EAAA,KAAA,MAAW,SAAS,IAAA,EAAM;AACxB,IAAA,IAAI,KAAA,KAAU,MAAM,OAAO,IAAA;AAC3B,IAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,EACzE;AACA,EAAA,OAAO,KAAA;AACT;AAMA,SAAS,qBAAqB,KAAA,EAAuB;AACnD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,IAAI,MAAM,UAAA,CAAW,CAAC,IAAI,EAAA,EAAI,GAAA,IAAO,MAAM,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,UAAA,CAAW,OAAe,MAAA,EAAyB;AAC1D,EAAA,MAAM,GAAA,GAAM,qBAAqB,KAAK,CAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,CAAC,CAAA,CAAE,WAAA,EAAY;AACpC,IAAA,OAAO,CAAC,sBAAsB,GAAA,CAAI,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,MAAM,CAAA;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,EAAe,OAAO,KAAA;AAClC,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC1B,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC1B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,KAAc,CAAA,KAAM,SAAS,CAAA,KAAM,SAAA;AAEpD,EAAA,OAAO,EAAE,OAAA,CAAQ,CAAC,CAAA,IAAK,QAAQ,CAAC,CAAA,CAAA;AAClC;AAEA,SAAS,eAAA,CAAgB,EAAA,EAAa,GAAA,EAAa,MAAA,EAAsB;AACvE,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC7C,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,CAAG,UAAA,CAAW,CAAC,EAAE,IAAI,CAAA;AAAA,EAClC;AACA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,KAAK,WAAA,EAAY;AAC/B,IAAA,MAAM,IAAA,GACJ,CAAC,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,IACtB,CAAC,mBAAA,CAAoB,GAAA,CAAI,KAAK,CAAA,KAC7B,UAAA,CAAW,KAAA,EAAO,MAAA,CAAO,WAAW,CAAA,IAAK,UAAA,CAAW,KAAA,EAAO,MAAA,CAAO,SAAS,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA,KACnF,CAAC,mBAAA,CAAoB,GAAA,CAAI,KAAK,CAAA,IAAK,WAAW,EAAA,CAAG,YAAA,CAAa,IAAI,CAAA,IAAK,IAAI,MAAM,CAAA,CAAA;AACpF,IAAA,IAAI,CAAC,IAAA,EAAM,EAAA,CAAG,eAAA,CAAgB,IAAI,CAAA;AAAA,EACpC;AACF;AAEA,SAAS,aAAA,CAAc,QAAc,MAAA,EAAsB;AACzD,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,EAAG;AAChD,IAAA,IAAI,IAAA,CAAK,aAAa,CAAA,EAAG;AACzB,IAAA,IAAI,IAAA,CAAK,aAAa,CAAA,EAAG;AAEvB,MAAA,MAAA,CAAO,YAAY,IAAI,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,EAAA,GAAK,IAAA;AACX,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,WAAA,EAAY;AACnC,IAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,GAAG,CAAA,EAAG;AAChC,MAAA,MAAA,CAAO,YAAY,EAAE,CAAA;AACrB,MAAA;AAAA,IACF;AACA,IAAA,aAAA,CAAc,IAAI,MAAM,CAAA;AACxB,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACzB,MAAA,OAAO,GAAG,UAAA,EAAY,MAAA,CAAO,YAAA,CAAa,EAAA,CAAG,YAAY,EAAE,CAAA;AAC3D,MAAA,MAAA,CAAO,YAAY,EAAE,CAAA;AACrB,MAAA;AAAA,IACF;AACA,IAAA,eAAA,CAAgB,EAAA,EAAI,KAAK,MAAM,CAAA;AAAA,EACjC;AACF;AAEA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAO,KACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,CACrB,OAAA,CAAQ,MAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,EACpB,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA,CACtB,OAAA,CAAQ,MAAM,OAAO,CAAA;AAC1B;AAEA,SAAS,iBAAA,CAAkB,MAAc,OAAA,EAAsC;AAC7E,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,cAAc,WAAA,EAAa;AAGrE,IAAA,OAAO,WAAW,IAAI,CAAA;AAAA,EACxB;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,SAAA,EAAU,CAAE,gBAAgB,CAAA,MAAA,EAAS,IAAI,WAAW,WAAW,CAAA;AAC/E,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,EAAA;AAClB,EAAA,aAAA,CAAc,IAAA,EAAM,QAAA,CAAS,OAAO,CAAC,CAAA;AACrC,EAAA,OAAO,IAAA,CAAK,SAAA;AACd;AAmBO,SAAS,YAAA,CAAa,MAAc,OAAA,EAAuC;AAChF,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,KAAY,IAAA,EAAM;AAC7C,IAAA,OAAO,iBAAA,CAAkB,MAAM,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,cAAc,WAAA,EAAa;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,SAAA,EAAU,CAAE,gBAAgB,CAAA,MAAA,EAAS,IAAI,WAAW,WAAW,CAAA;AAC/E,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,cAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,OAAO,WAAW,CAAA;AAAA,EACzB;AAEA,EAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,IAAA,EAAA,CAAG,UAAA,EAAY,YAAY,EAAE,CAAA;AAAA,EAC/B;AAEA,EAAA,OAAO,IAAA,CAAK,SAAA;AACd","file":"chunk-6TBRBN7H.js","sourcesContent":["/**\n * HTML and URL sanitization utilities.\n *\n * Hand-rolled (no third-party deps) using browser-native `DOMParser`. Designed\n * for the trust model \"consumer passes user-generated markdown/HTML to a\n * react-fancy component\" — strips script tags, event handlers, and dangerous\n * URI schemes from `href`/`src` attributes.\n *\n * For server-side rendering (no `window`), `sanitizeHtml` returns the input\n * unchanged. Consumers SSR-rendering untrusted content should sanitize on the\n * server with their own pipeline.\n */\n\nconst DANGEROUS_TAGS = new Set([\n  \"script\",\n  \"style\",\n  \"iframe\",\n  \"object\",\n  \"embed\",\n  \"link\",\n  \"meta\",\n  \"base\",\n  \"form\",\n  // A <title> anywhere in the document retitles the host's tab.\n  \"title\",\n]);\n\nconst URL_ATTRS = new Set([\"href\", \"src\", \"action\", \"formaction\", \"xlink:href\"]);\n\nconst SAFE_PROTOCOL = /^(?:https?:|mailto:|tel:|sms:|ftp:|#|\\/|\\.\\/|\\.\\.\\/|[^:]*$)/i;\n\n/**\n * Validate a URL/href against an allow-list of safe protocols. Returns the\n * input if safe, or `undefined` if it begins with a dangerous scheme like\n * `javascript:`, `data:`, or `vbscript:`. Relative URLs and fragment links\n * are allowed.\n */\nexport function sanitizeHref(href: string | undefined | null): string | undefined {\n  if (href == null) return undefined;\n  const trimmed = href.trim();\n  if (!trimmed) return undefined;\n  return SAFE_PROTOCOL.test(trimmed) ? trimmed : undefined;\n}\n\nfunction stripDangerousAttrs(el: Element): void {\n  // Collect names first; mutating during iteration is awkward with NamedNodeMap.\n  const names: string[] = [];\n  for (let i = 0; i < el.attributes.length; i++) {\n    names.push(el.attributes[i].name);\n  }\n\n  for (const name of names) {\n    const lower = name.toLowerCase();\n\n    // All on* event handlers\n    if (lower.startsWith(\"on\")) {\n      el.removeAttribute(name);\n      continue;\n    }\n\n    // URL attributes — protocol-filter\n    if (URL_ATTRS.has(lower)) {\n      const sanitized = sanitizeHref(el.getAttribute(name));\n      if (sanitized === undefined) {\n        el.removeAttribute(name);\n      } else {\n        el.setAttribute(name, sanitized);\n      }\n      continue;\n    }\n\n    // srcdoc executes JS in the iframe — drop wholesale\n    if (lower === \"srcdoc\") {\n      el.removeAttribute(name);\n    }\n  }\n}\n\nfunction walk(el: Element, removeQueue: Element[]): void {\n  const tag = el.tagName.toLowerCase();\n\n  if (DANGEROUS_TAGS.has(tag)) {\n    removeQueue.push(el);\n    return;\n  }\n\n  stripDangerousAttrs(el);\n\n  const children = Array.from(el.children);\n  for (const child of children) {\n    walk(child, removeQueue);\n  }\n}\n\n/**\n * Allowlist options for {@link sanitizeHtml}. Passing ANY options object\n * (even `{}`) switches from the default blocklist to allowlist mode, where\n * everything not listed is removed.\n */\nexport interface SanitizeHtmlOptions {\n  /**\n   * Tags to keep, e.g. `[\"p\", \"a\", \"strong\"]`. A tag that is not listed is\n   * removed but its text and (cleaned) children are kept. Default: none, so\n   * only text survives.\n   *\n   * Some tags are removed WITH their content even when listed, because no\n   * attribute filtering makes them safe: `script`, `style`, `iframe`, `frame`,\n   * `frameset`, `object`, `embed`, `applet`, `link`, `meta`, `base`, `form`,\n   * `title`, `template`, `noscript`, `noembed`, `noframes`, `xmp`,\n   * `plaintext`, `svg` and `math`.\n   */\n  allowedTags?: readonly string[];\n  /**\n   * Attributes to keep. Either one list for every allowed tag, or a map from\n   * tag name to its list, where the key `\"*\"` applies to every tag. A trailing\n   * `*` matches a prefix (`\"data-*\"`, `\"aria-*\"`). Default: none.\n   *\n   * Never kept, even when listed: event handlers (`on*`), `srcdoc` and\n   * `srcset`.\n   */\n  allowedAttributes?: readonly string[] | Readonly<Record<string, readonly string[]>>;\n  /**\n   * URL schemes allowed in URL attributes (`href`, `src`, `action`,\n   * `formaction`, `cite`, `poster`, `background`, `ping`, `xlink:href`), with\n   * the colon: `[\"https:\", \"mailto:\"]`. A URL attribute whose scheme is not\n   * listed is removed. Default: `[\"http:\", \"https:\", \"mailto:\"]`.\n   *\n   * `javascript:` and `vbscript:` are never kept, even when listed.\n   */\n  allowedSchemes?: readonly string[];\n  /**\n   * Keep URLs with no scheme that stay on this site: `/x`, `x/y`, `../x`,\n   * `?q`, `#frag`. Protocol-relative URLs (`//host/x`, and the backslash\n   * spellings a browser treats the same way) leave the site and are always\n   * removed. Default: `false`.\n   */\n  allowRelative?: boolean;\n}\n\n/** Removed with their content in allowlist mode, whatever the options say. */\nconst ALWAYS_REMOVED_TAGS = new Set([\n  ...DANGEROUS_TAGS,\n  \"frame\",\n  \"frameset\",\n  \"applet\",\n  \"template\",\n  \"noscript\",\n  \"noembed\",\n  \"noframes\",\n  \"xmp\",\n  \"plaintext\",\n  // Foreign content: namespace confusion is how mutation XSS gets past\n  // sanitisers that re-serialise, as this one does.\n  \"svg\",\n  \"math\",\n]);\n\nconst ALLOWLIST_URL_ATTRS = new Set([\n  \"href\",\n  \"src\",\n  \"action\",\n  \"formaction\",\n  \"cite\",\n  \"poster\",\n  \"background\",\n  \"ping\",\n  \"xlink:href\",\n]);\n\nconst NEVER_ALLOWED_ATTRS = new Set([\"srcdoc\", \"srcset\"]);\n\nconst NEVER_ALLOWED_SCHEMES = new Set([\"javascript:\", \"vbscript:\"]);\n\nconst DEFAULT_SCHEMES = [\"http:\", \"https:\", \"mailto:\"];\n\nconst SCHEME = /^([a-z][a-z0-9+.-]*:)/i;\n\nconst SLASH = 47;\nconst BACKSLASH = 92;\n\ninterface Policy {\n  tags: Set<string>;\n  globalAttrs: string[];\n  tagAttrs: Map<string, string[]>;\n  schemes: Set<string>;\n  allowRelative: boolean;\n}\n\nfunction lowerAll(list: readonly string[] | undefined): string[] {\n  return (list ?? []).map((s) => s.toLowerCase());\n}\n\nfunction toPolicy(options: SanitizeHtmlOptions): Policy {\n  const tagAttrs = new Map<string, string[]>();\n  let globalAttrs: string[] = [];\n  const attrs = options.allowedAttributes;\n  if (Array.isArray(attrs)) {\n    globalAttrs = lowerAll(attrs);\n  } else if (attrs) {\n    for (const [tag, list] of Object.entries(attrs as Record<string, readonly string[]>)) {\n      if (tag === \"*\") globalAttrs = lowerAll(list);\n      else tagAttrs.set(tag.toLowerCase(), lowerAll(list));\n    }\n  }\n  return {\n    tags: new Set(lowerAll(options.allowedTags)),\n    globalAttrs,\n    tagAttrs,\n    schemes: new Set(lowerAll(options.allowedSchemes ?? DEFAULT_SCHEMES)),\n    allowRelative: options.allowRelative === true,\n  };\n}\n\nfunction attrListed(name: string, list: string[] | undefined): boolean {\n  if (!list) return false;\n  for (const entry of list) {\n    if (entry === name) return true;\n    if (entry.endsWith(\"*\") && name.startsWith(entry.slice(0, -1))) return true;\n  }\n  return false;\n}\n\n/**\n * Browsers ignore ASCII whitespace and control characters inside a URL's\n * scheme (`java<TAB>script:` runs), so judge the URL with them removed.\n */\nfunction stripControlAndSpace(value: string): string {\n  let out = \"\";\n  for (let i = 0; i < value.length; i++) {\n    if (value.charCodeAt(i) > 32) out += value[i];\n  }\n  return out;\n}\n\nfunction urlAllowed(value: string, policy: Policy): boolean {\n  const url = stripControlAndSpace(value);\n  const match = SCHEME.exec(url);\n  if (match) {\n    const scheme = match[1].toLowerCase();\n    return !NEVER_ALLOWED_SCHEMES.has(scheme) && policy.schemes.has(scheme);\n  }\n  if (!policy.allowRelative) return false;\n  const a = url.charCodeAt(0);\n  const b = url.charCodeAt(1);\n  const isSlash = (c: number) => c === SLASH || c === BACKSLASH;\n  // `//host`, and its backslash spellings, is another site.\n  return !(isSlash(a) && isSlash(b));\n}\n\nfunction cleanAttributes(el: Element, tag: string, policy: Policy): void {\n  const names: string[] = [];\n  for (let i = 0; i < el.attributes.length; i++) {\n    names.push(el.attributes[i].name);\n  }\n  for (const name of names) {\n    const lower = name.toLowerCase();\n    const keep =\n      !lower.startsWith(\"on\") &&\n      !NEVER_ALLOWED_ATTRS.has(lower) &&\n      (attrListed(lower, policy.globalAttrs) || attrListed(lower, policy.tagAttrs.get(tag))) &&\n      (!ALLOWLIST_URL_ATTRS.has(lower) || urlAllowed(el.getAttribute(name) ?? \"\", policy));\n    if (!keep) el.removeAttribute(name);\n  }\n}\n\nfunction cleanChildren(parent: Node, policy: Policy): void {\n  for (const node of Array.from(parent.childNodes)) {\n    if (node.nodeType === 3) continue; // text\n    if (node.nodeType !== 1) {\n      // comments, processing instructions, CDATA\n      parent.removeChild(node);\n      continue;\n    }\n    const el = node as Element;\n    const tag = el.tagName.toLowerCase();\n    if (ALWAYS_REMOVED_TAGS.has(tag)) {\n      parent.removeChild(el);\n      continue;\n    }\n    cleanChildren(el, policy);\n    if (!policy.tags.has(tag)) {\n      while (el.firstChild) parent.insertBefore(el.firstChild, el);\n      parent.removeChild(el);\n      continue;\n    }\n    cleanAttributes(el, tag, policy);\n  }\n}\n\nfunction escapeText(text: string): string {\n  return text\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\nfunction sanitizeAllowlist(html: string, options: SanitizeHtmlOptions): string {\n  if (typeof window === \"undefined\" || typeof DOMParser === \"undefined\") {\n    // Fail closed: with no parser we cannot tell markup from text, so the\n    // whole input is returned as escaped text rather than passed through.\n    return escapeText(html);\n  }\n  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, \"text/html\");\n  const body = doc.body;\n  if (!body) return \"\";\n  cleanChildren(body, toPolicy(options));\n  return body.innerHTML;\n}\n\n/**\n * Sanitize an HTML string.\n *\n * **With no options** (the default blocklist): removes dangerous tags (script,\n * iframe, etc.), event-handler attributes (`onclick`, `onerror`, ...), and\n * dangerous URI schemes in `href`/`src` attributes. Everything else is kept.\n * In non-browser environments returns the input unchanged — sanitize on the\n * server in those cases.\n *\n * **With options** (allowlist mode): keeps ONLY the listed tags, attributes and\n * URL schemes; see {@link SanitizeHtmlOptions}. The allowlist can only narrow:\n * event handlers, `javascript:` URLs and script-capable tags never survive,\n * even when listed. In non-browser environments the input is returned as\n * escaped text (fail closed).\n *\n * Uses the browser's `DOMParser`.\n */\nexport function sanitizeHtml(html: string, options?: SanitizeHtmlOptions): string {\n  if (options !== undefined && options !== null) {\n    return sanitizeAllowlist(html, options);\n  }\n  if (typeof window === \"undefined\" || typeof DOMParser === \"undefined\") {\n    return html;\n  }\n\n  const doc = new DOMParser().parseFromString(`<body>${html}</body>`, \"text/html\");\n  const body = doc.body;\n  if (!body) return html;\n\n  const removeQueue: Element[] = [];\n  for (const child of Array.from(body.children)) {\n    walk(child, removeQueue);\n  }\n\n  for (const el of removeQueue) {\n    el.parentNode?.removeChild(el);\n  }\n\n  return body.innerHTML;\n}\n"]}