@rathkit/rte-core 0.1.0-alpha.4 → 0.1.0-alpha.5

package/dist/import.js

@@ -1,24 +1,16 @@
 import { decodeEntities } from "./html/entities.js";
 import { parseHtml } from "./html/parse.js";
+import { CONTENT_PROFILES, DATA_IMAGE_SIGNATURES, DEFAULT_LINK_SCHEMES, DROPPED_ELEMENTS, GROUPING_ELEMENTS, IMAGE_SCHEMES } from "./policy.js";
 import { parseLine, SIDES, withSides } from "./cellborder.js";
 import { COLOR_VALUE, COLUMN_WIDTH, MAX_INDENT, NOTE_ID, ROW_HEIGHT, inlineText, normalizeInline, } from "./model.js";
 import { asChildren } from "./path.js";
 import { DEFAULT_MARKER } from "./model.js";
-const DROP = new Set([
-    "script", "style", "link", "meta", "base", "object", "embed", "iframe", "frame", "frameset", "noscript", "template",
-    "head", "textarea", "input", "select", "option", "button", "canvas", "audio", "video", "applet", "xml",
-]);
-const CONTAINERS = new Set([
-    "div", "section", "article", "header", "footer", "aside", "nav", "figure", "figcaption", "address", "main", "form",
-    "body", "html", "center", "details", "summary", "dd", "dt", "fieldset", "hgroup",
-]);
+const DROP = DROPPED_ELEMENTS;
+const CONTAINERS = GROUPING_ELEMENTS;
 const MARK_TAGS = {
     strong: "bold", b: "bold", em: "italic", i: "italic", cite: "italic", dfn: "italic", var: "italic", u: "underline", ins: "underline",
     s: "strike", strike: "strike", del: "strike", code: "code", tt: "code", kbd: "code", samp: "code", sup: "sup", sub: "sub",
 };
-const RASTER = [
-    ["image/png", "iVBORw0KGgo"], ["image/jpeg", "/9j/"], ["image/gif", "R0lGOD"], ["image/webp", "UklGR"], ["image/bmp", "Qk"],
-];
 const COLOR = COLOR_VALUE;
 export function parseStyle(style) {
     const out = new Map();
@@ -78,9 +70,11 @@ function safeImageSrc(raw, settings) {
         if (!match)
             return undefined;
         const body = match[2];
-        return RASTER.some(([, magic]) => body.startsWith(magic)) ? value : undefined;
+        return DATA_IMAGE_SIGNATURES.some(([, magic]) => body.startsWith(magic)) ? value : undefined;
     }
-    return safeUrl(value, new Set(["http", "https"]));
+    if (!settings.relative && !/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(value.replace(INVISIBLE, "")))
+        return undefined;
+    return safeUrl(value, new Set(IMAGE_SCHEMES));
 }
 class Sink {
     blocks = [];
@@ -508,7 +502,7 @@ function convertList(el, ctx, settings, notes = false) {
             continue;
         if (child.tag === "ul" || child.tag === "ol") {
             const nested = convertList(child, ctx, settings);
-            const last = list.items[list.items.length - 1] ?? list.items[list.items.push({ content: [], children: [] }) - 1];
+            const last = list.items[list.items.length - 1] ?? list.items[list.items.push({ content: [], children: [], bare: true }) - 1];
             last.children.push(nested);
             continue;
         }
@@ -548,6 +542,8 @@ function convertList(el, ctx, settings, notes = false) {
             if (id !== undefined)
                 item.id = id;
         }
+        if (item.content.length === 0 && !task && item.children.length > 0 && /list-style(-type)?\s*:\s*none/i.test(child.attrs.style ?? ""))
+            item.bare = true;
         const level = levelOf(child.attrs["data-aria-level"] ?? child.attrs["aria-level"]);
         if (level !== undefined)
             item.level = level;
@@ -675,7 +671,7 @@ function rowHeights(rowEls, kept) {
     return heights.some((h) => h !== null) ? heights : undefined;
 }
 function columnWidths(table, rows) {
-    const cols = Math.max(0, ...rows.map((row) => row.reduce((sum, cell) => sum + cell.colspan, 0)));
+    const cols = rows.reduce((most, row) => Math.max(most, row.reduce((sum, cell) => sum + cell.colspan, 0)), 0);
     const widths = [];
     const visit = (nodes) => {
         for (const n of nodes) {
@@ -696,7 +692,7 @@ function columnWidths(table, rows) {
         if (firstRow)
             for (const cell of firstRow.children)
                 if (cell.type === "el" && (cell.tag === "td" || cell.tag === "th")) {
-                    const span = Math.max(Number.parseInt(cell.attrs.colspan ?? "1", 10) || 1, 1);
+                    const span = Math.min(Math.max(Number.parseInt(cell.attrs.colspan ?? "1", 10) || 1, 1), 100);
                     if (span === 1)
                         widths.push(widthOf(cell));
                     else
@@ -731,7 +727,7 @@ function padRows(rows) {
                 reach[k] = reach[k] - 1;
         return used;
     });
-    const widest = Math.max(0, ...widths);
+    const widest = widths.reduce((most, w) => Math.max(most, w), 0);
     return rows.map((cells, i) => {
         const missing = widest - widths[i];
         return missing > 0 ? [...cells, ...Array.from({ length: missing }, () => ({ header: false, colspan: 1, rowspan: 1, blocks: [{ type: "p", content: [] }] }))] : cells;
@@ -781,7 +777,7 @@ function nestByLevel(lists) {
                 const fresh = { type: list.type, items: [] };
                 const parent = stack[stack.length - 1];
                 if (parent) {
-                    const host = parent.items[parent.items.length - 1] ?? parent.items[parent.items.push({ content: [], children: [] }) - 1];
+                    const host = parent.items[parent.items.length - 1] ?? parent.items[parent.items.push({ content: [], children: [], bare: true }) - 1];
                     host.children.push(fresh);
                 }
                 else {
@@ -800,7 +796,7 @@ function nestByLevel(lists) {
     return result.map((l) => freezeList(l, 0));
 }
 function freezeList(list, depth) {
-    const items = list.items.map((item) => ({ content: item.content, children: item.children.map((child) => (child.type === "ul" || child.type === "ol" ? freezeList(child, depth + 1) : child)), ...(item.checked !== undefined ? { checked: item.checked } : {}), ...(item.id !== undefined ? { id: item.id } : {}) }));
+    const items = list.items.map((item) => ({ content: item.content, children: item.children.map((child) => (child.type === "ul" || child.type === "ol" ? freezeList(child, depth + 1) : child)), ...(item.checked !== undefined ? { checked: item.checked } : {}), ...(item.id !== undefined ? { id: item.id } : {}), ...(item.bare ? { bare: true } : {}) }));
     const style = list.style !== undefined && list.style !== DEFAULT_MARKER(list.type, depth) ? list.style : undefined;
     return { type: list.type, ...(list.notes ? { notes: true } : {}), ...(list.start !== undefined ? { start: list.start } : {}), ...(style !== undefined ? { style } : {}), items };
 }
@@ -821,17 +817,29 @@ function repairRewrittenSpaces(nodes) {
 export function importBlocks(html, options = {}) {
     const settings = {
         allowStyles: (options.styles ?? "allowlist") === "allowlist",
-        schemes: new Set(options.linkSchemes ?? ["http", "https", "mailto", "tel"]),
+        schemes: new Set(options.linkSchemes ?? DEFAULT_LINK_SCHEMES),
         keepEmpty: options.keepEmptyBlocks ?? false,
-        maxData: options.maxDataImageLength ?? 12_000_000,
+        maxData: options.maxDataImageLength ?? CONTENT_PROFILES.standard.maxDataImageLength,
+        relative: options.relativeImages ?? true,
         svg: options.sanitizeSvg,
         recognizers: options.recognizers ?? [],
     };
-    const sink = new Sink(settings);
-    const tree = parseHtml(html);
-    convertNodes(/-webkit-text-stroke-width/.test(html) ? repairRewrittenSpaces(tree) : tree, sink, { marks: [], inLink: false, pre: false }, settings);
-    sink.flush();
-    return finishBlocks(sink.blocks);
+    const maxInput = options.maxInputLength ?? CONTENT_PROFILES.standard.maxInputLength;
+    if (html.length > maxInput) {
+        options.onLimit?.({ limit: "maxInputLength", max: maxInput, length: html.length });
+        return [];
+    }
+    try {
+        const sink = new Sink(settings);
+        const tree = parseHtml(html, options.maxDepth ?? CONTENT_PROFILES.standard.maxDepth);
+        convertNodes(/-webkit-text-stroke-width/.test(html) ? repairRewrittenSpaces(tree) : tree, sink, { marks: [], inLink: false, pre: false }, settings);
+        sink.flush();
+        return finishBlocks(sink.blocks);
+    }
+    catch (error) {
+        options.onError?.(error);
+        return [];
+    }
 }
 export function importHtml(html, options = {}) {
     const blocks = importBlocks(html, { keepEmptyBlocks: true, ...options });
@@ -854,4 +862,4 @@ export function importText(value) {
 }
 const decodeLineBreaks = (value) => value.replace(/\r\n?|\u2028|\u2029/g, "\n").replace(/^\n+|\n+$/g, "");
 export { decodeEntities };
-export const checkImageSrc = (src, maxDataLength = 12_000_000, sanitizeSvg) => safeImageSrc(src, { maxData: maxDataLength, svg: sanitizeSvg });
+export const checkImageSrc = (src, maxDataLength = 12_000_000, sanitizeSvg, relative = true) => safeImageSrc(src, { maxData: maxDataLength, svg: sanitizeSvg, relative });

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-export declare const PACKAGE_NAME: "@rathkit/rte-core";
 export * from "./model.ts";
 export { checkImageSrc, importBlocks, importHtml, importText, safeUrl, parseStyle, type ImportOptions } from "./import.ts";
+export { WARNING_CODES, type Warning, type WarningCode } from "./warning.ts";
+export { CONTENT_PROFILES, contentPolicy, type ContentLimits, type ContentOptions, type ContentPolicy, type ContentProfile } from "./policy.ts";
 export { exportBlock, exportHtml, exportInline } from "./export.ts";
 export * from "./path.ts";
 export * from "./edit.ts";

package/dist/index.js

@@ -1,6 +1,7 @@
-export const PACKAGE_NAME = "@rathkit/rte-core";
 export * from "./model.js";
 export { checkImageSrc, importBlocks, importHtml, importText, safeUrl, parseStyle } from "./import.js";
+export { WARNING_CODES } from "./warning.js";
+export { CONTENT_PROFILES, contentPolicy } from "./policy.js";
 export { exportBlock, exportHtml, exportInline } from "./export.js";
 export * from "./path.js";
 export * from "./edit.js";

package/dist/lists/lists.js

@@ -68,7 +68,7 @@ function splitList(list, path, liftChildren) {
     const item = list.items[i];
     const numbering = (count) => (list.type === "ol" ? { start: (list.start ?? 1) + count } : {});
     if (k === undefined) {
-        const placeholder = item.children.length > 0 && !liftChildren ? [{ content: [], children: item.children }] : [];
+        const placeholder = item.children.length > 0 && !liftChildren ? [{ content: [], children: item.children, bare: true }] : [];
         const rest = [...placeholder, ...list.items.slice(i + 1)];
         return {
             before: i > 0 ? { ...list, items: list.items.slice(0, i) } : undefined,
@@ -80,7 +80,7 @@ function splitList(list, path, liftChildren) {
     const inner = splitList(item.children[k], path.slice(2), liftChildren);
     const keptSublists = [...item.children.slice(0, k), ...(inner.before ? [inner.before] : [])];
     const afterSublists = [...(inner.after ? [inner.after] : []), ...item.children.slice(k + 1)];
-    const rest = [...(afterSublists.length > 0 ? [{ content: [], children: afterSublists }] : []), ...list.items.slice(i + 1)];
+    const rest = [...(afterSublists.length > 0 ? [{ content: [], children: afterSublists, bare: true }] : []), ...list.items.slice(i + 1)];
     return {
         before: { ...list, items: [...list.items.slice(0, i), { content: item.content, children: keptSublists }] },
         content: inner.content,
@@ -271,7 +271,7 @@ export function indentItems(doc, sel, maxDepth = Number.POSITIVE_INFINITY) {
             const rest = list.items.slice(index + group.length);
             if (previous)
                 return { ...list, items: [...list.items.slice(0, index - 1), nested(previous), ...rest] };
-            return { ...list, items: [nested({ content: [], children: [] }), ...rest] };
+            return { ...list, items: [nested({ content: [], children: [], bare: true }), ...rest] };
         });
     }
     return { doc: next, selection: carry(doc, next, sel) };
@@ -286,6 +286,10 @@ export function outdentItems(doc, sel) {
         if (!loc)
             continue;
         if (loc.item.length === 1) {
+            const here = listOfItem(next, path);
+            const held = here?.list.items[here.index];
+            if (held && held.content.length === 0 && held.children.length > 0)
+                continue;
             next = takeOutOfList(next, path, true);
             continue;
         }
@@ -300,6 +304,7 @@ export function outdentItems(doc, sel) {
             const keptSub = itemIndex > 0 ? [{ ...sub, items: sub.items.slice(0, itemIndex) }] : [];
             const lifted = {
                 content: moved.content,
+                ...(moved.bare ? { bare: true } : {}),
                 children: [...moved.children, ...(followers.length > 0 ? [{ type: sub.type, ...(sub.style !== undefined ? { style: sub.style } : {}), items: followers }] : [])],
             };
             const children = [...parent.children.slice(0, sublistIndex), ...keptSub, ...parent.children.slice(sublistIndex + 1)];
@@ -355,6 +360,11 @@ export function backspaceAtItemStart(doc, pos) {
     const held = listOfItem(doc, pos.path);
     if (held?.list.items[held.index]?.checked !== undefined)
         return { doc: setChecked(doc, pos.path, undefined), selection: caret(pos) };
+    const only = held?.list.items[held.index];
+    if (only && only.content.length === 0 && only.bare !== true && (only.children[0]?.type === "ul" || only.children[0]?.type === "ol")) {
+        const next = mapListAt(doc, pos.path, (list, index) => ({ ...list, items: list.items.map((item, i) => (i === index ? { ...item, bare: true } : item)) }));
+        return { doc: next, selection: caret(pos) };
+    }
     if (!held || held.index !== 0)
         return undefined;
     return leaveListItem(doc, pos);
@@ -375,7 +385,7 @@ export function splitListItem(doc, pos) {
         ...list,
         items: list.items.flatMap((candidate, i) => (i !== index ? [candidate] : [
             { content: before, children: [], ...(item.checked !== undefined ? { checked: item.checked } : {}), ...(item.id !== undefined ? { id: item.id } : {}) },
-            { content: after, children: item.children, ...(item.checked !== undefined ? { checked: false } : {}) },
+            { content: after, children: item.children, ...(item.checked !== undefined ? { checked: false } : {}), ...(item.bare && after.length === 0 ? { bare: true } : {}) },
         ])),
     }));
     return { doc: next, selection: caret({ path: containerPaths(next)[ordinal + 1] ?? pos.path, offset: 0 }) };

package/dist/markdown/export.js

@@ -66,7 +66,7 @@ function inline(content, flat, table) {
             return;
         }
         const lead = /^\s*/.exec(text)?.[0] ?? "";
-        const trail = lead.length === text.length ? "" : /\s*$/.exec(text)?.[0] ?? "";
+        const trail = lead.length === text.length ? "" : text.slice(text.trimEnd().length);
         const core = text.slice(lead.length, text.length - trail.length);
         const prev = runs[r - 1];
         const next = runs[r + 1];

package/dist/markdown/inline.d.ts

@@ -6,6 +6,8 @@ export interface MarkdownOptions {
     readonly sanitizeSvg?: ((dataUrl: string) => string | undefined) | undefined;
     /** Largest `data:` image address, in characters. */
     readonly maxDataImageLength?: number;
+    /** Keep an image whose address is relative. Default true. */
+    readonly relativeImages?: boolean;
 }
 /** Link reference definitions found in the document: `[label]: address "title"`. Keys come from `refLabel`. */
 export type Refs = ReadonlyMap<string, {

package/dist/markdown/inline.js

@@ -331,7 +331,7 @@ export function parseInline(src, options = {}) {
                     }
                     p.dead = true;
                 }
-                const safe = checkImageSrc(decodeEntities(tailInfo.dest), options.maxDataImageLength, options.sanitizeSvg);
+                const safe = checkImageSrc(decodeEntities(tailInfo.dest), options.maxDataImageLength, options.sanitizeSvg, options.relativeImages ?? true);
                 const img = top;
                 if (safe) {
                     Object.assign(img, { k: "img", src: safe, alt });

package/dist/markdown/plugin.js

@@ -23,7 +23,7 @@ export function markdown(options = {}) {
                         return false;
                     const { doc, selection } = ctx.snapshot;
                     const blocks = host.ops.isCollapsed(selection) ? doc.blocks : host.ops.extractSelection(doc, selection);
-                    clipboard.writeText(exportMarkdown({ blocks }, { inlineHtml: options.inlineHtml === true })).catch((error) => host.editor.warn(`Copy as Markdown failed: ${String(error)}`));
+                    clipboard.writeText(exportMarkdown({ blocks }, { inlineHtml: options.inlineHtml === true })).catch((error) => host.editor.report({ code: "copy-failed", plugin: "rathkit.markdown", message: `Copy as Markdown failed: ${error instanceof Error ? error.message : String(error)}`, error }));
                     return true;
                 },
             });
@@ -39,12 +39,15 @@ export function markdown(options = {}) {
                 const path = selection.focus.path;
                 if (kindAt(doc, path) === "pre" || getBlock(doc, path)?.type === "pre")
                     return undefined;
+                if (text.length > (host.editor.importOptions.maxInputLength ?? Infinity))
+                    return undefined;
                 if (mode === "detect" && !looksLikeMarkdown(text))
                     return undefined;
                 const blocks = parseMarkdown(text, {
                     ...(options.linkSchemes ? { linkSchemes: options.linkSchemes } : {}),
                     ...(options.maxDataImageLength !== undefined ? { maxDataImageLength: options.maxDataImageLength } : {}),
                     sanitizeSvg: host.editor.importOptions.sanitizeSvg,
+                    relativeImages: host.editor.importOptions.pasteRelativeImages ?? false,
                 });
                 return blocks.length > 0 ? blocks : undefined;
             });

package/dist/model.d.ts

@@ -76,6 +76,11 @@ export interface ListItem {
     readonly checked?: boolean;
     /** In a notes list: the id of the reference this note belongs to. */
     readonly id?: string;
+    /**
+     * Set on an item that has no text and holds only a nested list, and shows no marker of its own: the nested list sits under it
+     * without a bullet or number above it. Without this an item with no text still shows its marker. Ignored once the item has text.
+     */
+    readonly bare?: true;
 }
 /** What a list item may hold besides its own text. Tables and definition lists are not allowed in an item. */
 export type ItemChild = List | Paragraph | Heading | CodeBlock | Quote | Rule;

package/dist/paste.js

@@ -1,4 +1,5 @@
 import { importBlocks, importText } from "./import.js";
+import { CONTENT_PROFILES } from "./policy.js";
 const START = "<!--StartFragment-->";
 const END = "<!--EndFragment-->";
 export function extractFragment(html) {
@@ -17,11 +18,17 @@ function unwrapSingleCell(blocks) {
 }
 export function defaultPaste(data, importOptions = {}) {
     if (data.html && data.html.trim() !== "") {
-        const blocks = importBlocks(data.html, { ...importOptions, styles: "semantic" });
+        const blocks = importBlocks(data.html, { ...importOptions, styles: "semantic", relativeImages: importOptions.pasteRelativeImages ?? false });
         if (blocks.length > 0)
             return unwrapSingleCell(blocks);
     }
-    return importText(data.text ?? "");
+    const text = data.text ?? "";
+    const max = importOptions.maxInputLength ?? CONTENT_PROFILES.standard.maxInputLength;
+    if (text.length > max) {
+        importOptions.onLimit?.({ limit: "maxInputLength", max, length: text.length });
+        return [];
+    }
+    return importText(text);
 }
 export function pasteBlocks(data, handlers = [], importOptions = {}) {
     for (const handler of handlers) {

package/dist/path.d.ts

@@ -21,11 +21,18 @@ export declare const pathKey: (path: Path) => string;
  * nested under it, rows run left to right then top to bottom, and so on. Negative when `a` comes first.
  */
 export declare function comparePath(a: Path, b: Path): number;
+/** A horizontal rule: where it is, and how many containers come before it in reading order. */
+export interface RuleAt {
+    readonly path: Path;
+    readonly before: number;
+}
 /**
  * Every container in the document, in reading order. Documents are never changed once made, so the answer is remembered
  * per document. The array is shared: do not change it.
  */
 export declare function containerPaths(doc: Doc): Path[];
+/** Every horizontal rule, in reading order, with the number of containers before it. A rule between container n-1 and n has `before` n. The array is shared. */
+export declare function rulePaths(doc: Doc): RuleAt[];
 export declare function blockContainers(block: Block, prefix: readonly number[]): Path[];
 /** True when the path leads to a container that exists. Cheap: it follows the path instead of listing every container. */
 export declare function hasContainer(doc: Doc, path: Path): boolean;

package/dist/path.js

@@ -11,13 +11,13 @@ export function comparePath(a, b) {
     }
     return a.length - b.length;
 }
-function listPaths(list, prefix, out) {
+function listPaths(list, prefix, out, rules) {
     list.items.forEach((item, i) => {
         out.push([...prefix, i]);
-        item.children.forEach((child, k) => blockPaths(child, [...prefix, i, k], out));
+        item.children.forEach((child, k) => blockPaths(child, [...prefix, i, k], out, rules));
     });
 }
-function blockPaths(block, prefix, out) {
+function blockPaths(block, prefix, out, rules) {
     switch (block.type) {
         case "p":
         case "h":
@@ -26,18 +26,20 @@ function blockPaths(block, prefix, out) {
             break;
         case "ul":
         case "ol":
-            listPaths(block, prefix, out);
+            listPaths(block, prefix, out, rules);
             break;
         case "dl":
             block.entries.forEach((_, i) => out.push([...prefix, i]));
             break;
         case "table":
-            block.rows.forEach((row, r) => row.forEach((cell, c) => cell.blocks.forEach((inner, n) => blockPaths(inner, [...prefix, r, c, n], out))));
+            block.rows.forEach((row, r) => row.forEach((cell, c) => cell.blocks.forEach((inner, n) => blockPaths(inner, [...prefix, r, c, n], out, rules))));
             break;
         case "quote":
-            block.blocks.forEach((inner, n) => blockPaths(inner, [...prefix, n], out));
+            block.blocks.forEach((inner, n) => blockPaths(inner, [...prefix, n], out, rules));
+            break;
+        case "hr":
+            rules?.push({ path: prefix, before: out.length });
             break;
-        case "hr": break;
     }
 }
 const containerCache = new WeakMap();
@@ -50,6 +52,17 @@ export function containerPaths(doc) {
     containerCache.set(doc, out);
     return out;
 }
+const ruleCache = new WeakMap();
+export function rulePaths(doc) {
+    const hit = ruleCache.get(doc);
+    if (hit)
+        return hit;
+    const out = [];
+    const containers = [];
+    doc.blocks.forEach((block, b) => blockPaths(block, [b], containers, out));
+    ruleCache.set(doc, out);
+    return out;
+}
 export function blockContainers(block, prefix) {
     const out = [];
     blockPaths(block, prefix, out);

package/dist/plugin.d.ts

@@ -69,7 +69,7 @@ export interface FileLike extends BlobLike {
 /** Turns pasted or dropped files into blocks, or returns undefined if it does not handle them. */
 export type FileHandler = (files: readonly FileLike[]) => readonly Block[] | undefined | Promise<readonly Block[] | undefined>;
 /** What a plugin sees of the editor: the same object a host gets, nothing more. */
-export type EditorHandle = Pick<Engine, "snapshot" | "apply" | "commands" | "subscribe" | "select" | "keymap" | "warn" | "importOptions" | "ui">;
+export type EditorHandle = Pick<Engine, "snapshot" | "apply" | "commands" | "subscribe" | "select" | "keymap" | "warn" | "report" | "importOptions" | "ui">;
 export interface PluginHost {
     readonly editor: EditorHandle;
     /** The editing operations, so a plugin does not import the editor to use them. */

package/dist/policy.d.ts

@@ -0,0 +1,41 @@
+/** Elements that are dropped together with everything inside them. */
+export declare const DROPPED_ELEMENTS: ReadonlySet<string>;
+/** Elements that only group blocks: they end the paragraph before and after, and what is inside is kept. */
+export declare const GROUPING_ELEMENTS: ReadonlySet<string>;
+export declare const DEFAULT_LINK_SCHEMES: readonly string[];
+/** Schemes an image address may use. Not configurable: a `data:` address is checked separately. */
+export declare const IMAGE_SCHEMES: readonly string[];
+/** The `data:` image types kept, with the first bytes (base64) their data must start with: the bytes are trusted, not the declared type. */
+export declare const DATA_IMAGE_SIGNATURES: readonly (readonly [string, string])[];
+/** The limits on what is read. */
+export interface ContentLimits {
+    /** Longest markup read, in characters. Longer is refused whole: nothing is read and `onLimit` is told. */
+    readonly maxInputLength: number;
+    /** Deepest nesting of elements. An element nested deeper is dropped and what is inside it stays at the deepest allowed level. */
+    readonly maxDepth: number;
+    /** Longest `data:` image address, in characters. 0 refuses every `data:` image. */
+    readonly maxDataImageLength: number;
+}
+/** A profile: the limits and the choices a host makes. */
+export interface ContentPolicy extends ContentLimits {
+    /** URL schemes a link may use besides relative and fragment addresses. */
+    readonly linkSchemes: readonly string[];
+    /** `semantic` keeps meaning only; `allowlist` also keeps text color, background and alignment. (Pasting is always `semantic`.) */
+    readonly styles: "semantic" | "allowlist";
+    /** Keep relative image addresses (`a.png`, `/a.png`) when pasting. Loading always keeps them. Default false in every profile. */
+    readonly pasteRelativeImages: boolean;
+}
+/** The name of a profile in `CONTENT_PROFILES`. */
+export type ContentProfile = "strict" | "standard" | "loose";
+/** The three profiles. `standard` is the default; `strict` is for hosts that take content from people they do not trust; `loose` for hosts that trust theirs. */
+export declare const CONTENT_PROFILES: Readonly<Record<ContentProfile, ContentPolicy>>;
+/** What a host may say: a profile to start from, then single choices on top of it. */
+export type ContentOptions = {
+    readonly profile?: ContentProfile;
+} & Partial<ContentPolicy>;
+/**
+ * The policy for the options: the profile (`standard` when none is named), with each given choice laid over it. A choice that
+ * cannot be used (an unknown profile, a limit that is not a whole number of at least 0, a list that is not strings) is left out, the
+ * profile's value is used, and `complain` is told.
+ */
+export declare function contentPolicy(options?: ContentOptions, complain?: (message: string) => void): ContentPolicy;

package/dist/policy.js

@@ -0,0 +1,40 @@
+export const DROPPED_ELEMENTS = new Set([
+    "script", "style", "link", "meta", "base", "object", "embed", "iframe", "frame", "frameset", "noscript", "template",
+    "head", "textarea", "input", "select", "option", "button", "canvas", "audio", "video", "applet", "xml",
+]);
+export const GROUPING_ELEMENTS = new Set([
+    "div", "section", "article", "header", "footer", "aside", "nav", "figure", "figcaption", "address", "main", "form",
+    "body", "html", "center", "details", "summary", "dd", "dt", "fieldset", "hgroup",
+]);
+export const DEFAULT_LINK_SCHEMES = ["http", "https", "mailto", "tel"];
+export const IMAGE_SCHEMES = ["http", "https"];
+export const DATA_IMAGE_SIGNATURES = [
+    ["image/png", "iVBORw0KGgo"], ["image/jpeg", "/9j/"], ["image/gif", "R0lGOD"], ["image/webp", "UklGR"], ["image/bmp", "Qk"],
+];
+export const CONTENT_PROFILES = {
+    strict: { pasteRelativeImages: false, linkSchemes: ["http", "https", "mailto"], styles: "semantic", maxDataImageLength: 0, maxDepth: 32, maxInputLength: 1_000_000 },
+    standard: { pasteRelativeImages: false, linkSchemes: DEFAULT_LINK_SCHEMES, styles: "allowlist", maxDataImageLength: 12_000_000, maxDepth: 100, maxInputLength: 50_000_000 },
+    loose: { pasteRelativeImages: false, linkSchemes: ["http", "https", "mailto", "tel", "sms", "ftp", "ftps"], styles: "allowlist", maxDataImageLength: 25_000_000, maxDepth: 200, maxInputLength: 200_000_000 },
+};
+export function contentPolicy(options = {}, complain = () => undefined) {
+    const { profile = "standard", ...rest } = options;
+    if (!Object.hasOwn(CONTENT_PROFILES, profile))
+        complain(`content.profile "${String(profile)}" is not a profile: using standard (strict, standard or loose).`);
+    const base = Object.hasOwn(CONTENT_PROFILES, profile) ? CONTENT_PROFILES[profile] : CONTENT_PROFILES.standard;
+    const given = {};
+    for (const [key, value] of Object.entries(rest)) {
+        if (value === undefined)
+            continue;
+        const ok = key === "linkSchemes" ? Array.isArray(value) && value.every((v) => typeof v === "string" && /^[a-z][a-z0-9+.-]*$/i.test(v))
+            : key === "styles" ? value === "semantic" || value === "allowlist"
+                : key === "pasteRelativeImages" ? typeof value === "boolean"
+                    : key === "maxDepth" ? Number.isInteger(value) && value >= 1
+                        : (key === "maxInputLength" || key === "maxDataImageLength") ? Number.isInteger(value) && value >= 0
+                            : false;
+        if (ok)
+            given[key] = value;
+        else
+            complain(`content.${key} cannot be ${JSON.stringify(value)}: using the ${profile in CONTENT_PROFILES ? profile : "standard"} profile's value.`);
+    }
+    return { ...base, ...given };
+}

package/dist/standard/index.d.ts

@@ -25,4 +25,3 @@ export interface StandardOptions extends Omit<EditorOptions, "plugins">, Standar
 /** The standard plugins, for hosts that build their own editor but want the usual parts. */
 export declare function standardPlugins(options?: StandardPluginOptions): Plugin[];
 export declare function createEditor(options: StandardOptions): Editor;
-export { Editor, type EditorOptions };

package/dist/standard/index.js

@@ -31,4 +31,3 @@ export function createEditor(options) {
     void [_lists, _tables, _find, _autoformat, _footnotes, _plugins, _u, _m, _f, _r];
     return new Editor({ ...editorOptions, plugins: standardPlugins(options) });
 }
-export { Editor };

package/dist/stats.js

@@ -4,7 +4,7 @@ import { selectedText } from "./edit.js";
 const WORD = /[\p{L}\p{M}\p{N}]+(?:['’\-‑][\p{L}\p{M}\p{N}]+)*/gu;
 export function countText(text) {
     const clean = text.replace(//g, "").replace(/\n/g, " ");
-    return { words: (clean.match(WORD) ?? []).length, characters: [...clean.replace(/\s+$/g, "").replace(/^\s+/g, "")].length };
+    return { words: (clean.match(WORD) ?? []).length, characters: [...clean.trim()].length };
 }
 export function countDocument(doc) {
     let words = 0;

package/dist/svg/svg.js

@@ -44,7 +44,15 @@ const decodeXml = (value) => value.replace(ENTITY, (_, dec, hex, name) => {
 function parseXml(source, limits) {
     if (/<!ENTITY|<!ATTLIST|<!NOTATION/i.test(source) || /<!\[CDATA\[/i.test(source))
         return undefined;
-    const stripped = source.replace(/^/, "").replace(/<\?xml[^>]*\?>/i, "").replace(/<!DOCTYPE[^>[]*(?:\[[^\]]*\])?[^>]*>/gi, "").replace(/<!--[\s\S]*?-->/g, "");
+    let stripped = source.replace(/^/, "").replace(/<\?xml[^>]*\?>/i, "").replace(/<!DOCTYPE[^>[]*(?:\[[^\]]*\])?[^>]*>/gi, "");
+    for (let pass = 0; pass < 4; pass++) {
+        const next = stripped.replace(/<!--[\s\S]*?-->/g, "");
+        if (next === stripped)
+            break;
+        stripped = next;
+    }
+    if (stripped.includes("<!--"))
+        return undefined;
     const stack = [];
     let root;
     let count = 0;

package/dist/tables/cells.d.ts

@@ -1,6 +1,6 @@
 import type { ViewHost } from "../plugin.ts";
 /** The attribute on a cell that a selection covers, for styling. */
-export declare const SELECTED_CELL = "data-rk-cell-selected";
+export declare const SELECTED_CELL = "data-rte-cell-selected";
 /**
  * Marks the cells of the rectangle a selection runs across (when it starts and ends in different cells of one table). The marks are
  * attributes on the drawn cells, not part of the model, and they are put on again after every change.

package/dist/tables/cells.js

@@ -1,6 +1,6 @@
 import { pathKey } from "../path.js";
 import { inRow, locateCell, selectedCells } from "../tablegrid.js";
-export const SELECTED_CELL = "data-rk-cell-selected";
+export const SELECTED_CELL = "data-rte-cell-selected";
 const GRAB = 5;
 const MIN_WIDTH = 24;
 const MIN_HEIGHT = 16;
@@ -96,7 +96,7 @@ export function installColumnResize(host) {
             const rowBox = row.getBoundingClientRect();
             const rowTable = rowCell.closest("table")?.getBoundingClientRect() ?? rowBox;
             const rowLine = document.createElement("div");
-            rowLine.setAttribute("data-rk-resize-line", "");
+            rowLine.setAttribute("data-rte-resize-line", "");
             rowLine.style.cssText = `position:fixed;z-index:2147483647;pointer-events:none;height:2px;background:#17408b;top:${rowBox.bottom - 1}px;left:${rowTable.left}px;width:${rowTable.width}px`;
             document.body.appendChild(rowLine);
             rowDrag = { path: rowPath, startY: event.clientY, startHeight: rowBox.height, top: rowBox.top, line: rowLine, height: rowBox.height };
@@ -106,7 +106,7 @@ export function installColumnResize(host) {
         const box = cell.getBoundingClientRect();
         const table = cell.closest("table")?.getBoundingClientRect() ?? box;
         const line = document.createElement("div");
-        line.setAttribute("data-rk-resize-line", "");
+        line.setAttribute("data-rte-resize-line", "");
         line.style.cssText = `position:fixed;z-index:2147483647;pointer-events:none;width:2px;background:#17408b;left:${box.right - 1}px;top:${table.top}px;height:${table.height}px`;
         document.body.appendChild(line);
         drag = { cell, path, startX: event.clientX, startWidth: box.width, line, width: box.width };

package/dist/tables/grips.js

@@ -82,7 +82,7 @@ export class TableGrips {
     }
     make(kind) {
         const el = document.createElement("div");
-        el.setAttribute("data-rk-grip", kind);
+        el.setAttribute("data-rte-grip", kind);
         el.setAttribute("role", "presentation");
         const cursor = kind === "row" ? "ns-resize" : kind === "column" ? "ew-resize" : kind === "width" ? "col-resize" : "row-resize";
         el.style.cssText = `position:fixed;z-index:2147483646;width:${SIZE}px;height:${SIZE}px;box-sizing:border-box;background:${COLOR};border:2px solid #fff;border-radius:${kind === "row" || kind === "column" ? "4px" : "50%"};cursor:${cursor};touch-action:none;opacity:0.9`;
@@ -120,7 +120,7 @@ export class TableGrips {
         const t = table.getBoundingClientRect();
         const horizontal = kind === "column" || kind === "width";
         const line = document.createElement("div");
-        line.setAttribute("data-rk-resize-line", "");
+        line.setAttribute("data-rte-resize-line", "");
         line.style.cssText = `position:fixed;z-index:2147483645;pointer-events:none;background:${COLOR};${horizontal ? `width:2px;top:${t.top}px;height:${t.height}px` : `height:2px;left:${t.left}px;width:${t.width}px`}`;
         document.body.appendChild(line);
         this.guide = line;

package/dist/warning.d.ts

@@ -0,0 +1,16 @@
+/** Why a warning was made. The codes are stable: a host can switch on them. */
+export declare const WARNING_CODES: readonly ["plugin-failed", "plugin-rejected", "plugin-message", "key-conflict", "content-too-long", "content-unreadable", "copy-failed", "upload-failed", "bad-option", "missing-label", "late-options", "listener-failed"];
+/** One of the codes in `WARNING_CODES`. */
+export type WarningCode = (typeof WARNING_CODES)[number];
+/** A problem the editor carried on from, reported to `onWarning`. Never thrown. */
+export interface Warning {
+    readonly code: WarningCode;
+    /** For a person: what happened and what was done about it. */
+    readonly message: string;
+    /** The plugin it concerns, when there is one. */
+    readonly plugin?: string;
+    /** The error that was caught, when one was. */
+    readonly error?: unknown;
+}
+/** What an error says, whatever was thrown. */
+export declare const describeError: (error: unknown) => string;

package/dist/warning.js

@@ -0,0 +1,5 @@
+export const WARNING_CODES = [
+    "plugin-failed", "plugin-rejected", "plugin-message", "key-conflict", "content-too-long", "content-unreadable",
+    "copy-failed", "upload-failed", "bad-option", "missing-label", "late-options", "listener-failed",
+];
+export const describeError = (error) => (error instanceof Error ? error.message : String(error));