@segnavia/html 0.37.0 → 0.39.0

package/dist/index.js

@@ -1,11 +1,14 @@
-import { REFUSED_ELEMENTS, elements, findActiveContent, parse, sanitize } from "./sanitize.js";
+import { REFUSED_ELEMENTS, elements, findActiveContent, parse, safeImageSource, sanitize } from "./sanitize.js";
 import { BINDINGS, bindingNames, bindingRoot, fill, hasBindings } from "./bindings.js";
 import { base64ToBytes, bytesToBase64 } from "./base64.js";
 import { BOOK_COLUMN_MAX, BOOK_COLUMN_MIN, BOOK_FLOW_COLUMN_MIN_PX, parseBookPositionKey } from "./book/book-flow.js";
+import { ABSOLUTE_PX, ABSOLUTE_UNITS, fitRegionSize, lengthPx, parseCssLength } from "./book/region-fit.js";
+import { PAGE_REFERENCE_ATTRIBUTE, PAGE_REFERENCE_SELECTOR, PAGE_REFERENCE_VALUE, pageReferenceTarget } from "./book/book-page-reference.js";
 import { bookPrintPart } from "./book/types.js";
 import { bookDocument } from "./book/book-document.js";
 import { bookView, bookViewFromHtml } from "./book/book-view.js";
 import { embedFunction, fillBookFurniture, furnitureScript } from "./book/furniture.js";
+import { planBookPages, planPrintedPages, printedPageAt, selectBookParent } from "./printed-pages.js";
 import { PAGINATE_FUNCTIONS, paginateBook, paginateScript } from "./book/paginate-book.js";
 import { heldPageNumber, openerPageIndex, pageIndexForTarget, windowPageIndex } from "./book/paginate-target.js";
 import { bookStylesheet, sanitizeBookCss } from "./book-css.js";
@@ -13,8 +16,8 @@ import { UNICODE_RANGE_CLEARANCE, parseUnicodeRange } from "./unicode-range.js";
 import { FontCssRefusedError, fontCss, fontFaceCss } from "./font-css.js";
 import { fontFormat } from "./font-format.js";
 import { fontReferenceRefusals } from "./font-references.js";
-import { MOTIF_DEPTH_LIMIT, MotifRefusedError, documentLanguage, expandMotifs, hasMotifPlacement, libraryMotifPlacementRefusal, motifPlacementRefusals, renderMotifPlacements } from "./motifs.js";
-import { planBookPages, planPrintedPages, printedPageAt, selectBookParent } from "./printed-pages.js";
+import { MOTIF_DEPTH_LIMIT, MotifRefusedError, documentLanguage, expandMotifs, hasHostMotifPlacement, hasMotifPlacement, libraryMotifPlacementRefusal, motifPlacementRefusals, renderMotifPlacements } from "./motifs.js";
+import { PLACEMENT_ATTRIBUTES, classifyMediaAnswer, placementCropEdges, placementPlaceholderSource, placementPlan, resolvePlacements } from "./placements.js";
 import { RequiredSlotsRefusedError, UnmeasuredSlotsRefusedError, mergeSlotFitResults, requiredSlotRefusal, unmeasuredSlotRefusal } from "./slot-policy.js";
 import { MAX_SLOT_DECLARATIONS, SlotFillRefusedError, hasSlotWork, prepareSlotCollection, prepareSlots, slotFillRefusal } from "./slots.js";
 import { SlotFillsConflictError, SlotFillsRefusedError, assertSingleSlotCopy, assertSlotPrintOptions, collectSlotPrintCopies, isSlotCopyRefusal, slotFillCopyId, slotFillsConflict } from "./slot-print.js";
@@ -30,4 +33,4 @@ function searchText(html) {
 	return html.replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, " ").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/\s+/g, " ").trim();
 }
 //#endregion
-export { BINDINGS, BOOK_COLUMN_MAX, BOOK_COLUMN_MIN, BOOK_FLOW_COLUMN_MIN_PX, FontCssRefusedError, MAX_SLOT_DECLARATIONS, MOTIF_DEPTH_LIMIT, MotifRefusedError, PAGINATE_FUNCTIONS, REFUSED_ELEMENTS, RequiredSlotsRefusedError, SlotFillRefusedError, SlotFillsConflictError, SlotFillsRefusedError, UNICODE_RANGE_CLEARANCE, UnmeasuredSlotsRefusedError, assertSingleSlotCopy, assertSlotPrintOptions, base64ToBytes, bindingNames, bindingRoot, bookDocument, bookPrintPart, bookStylesheet, bookView, bookViewFromHtml, bytesToBase64, classify, collectSlotPrintCopies, documentLanguage, embedFunction, expandMotifs, fill, fillBookFurniture, findActiveContent, fontCss, fontFaceCss, fontFormat, fontReferenceRefusals, furnitureScript, hasBindings, hasMotifPlacement, hasSlotWork, heldPageNumber, isSlotCopyRefusal, libraryMotifPlacementRefusal, mergeSlotFitResults, motifPlacementRefusals, openerPageIndex, pageIndexForTarget, paginateBook, paginateScript, parseBookPositionKey, parseUnicodeRange, planBookPages, planPrintedPages, prepareSlotCollection, prepareSlots, printedPageAt, renderMotifPlacements, requiredSlotRefusal, sanitize, sanitizeBookCss, searchText, selectBookParent, slotFillCopyId, slotFillRefusal, slotFillsConflict, unmeasuredSlotRefusal, windowPageIndex };
+export { ABSOLUTE_PX, ABSOLUTE_UNITS, BINDINGS, BOOK_COLUMN_MAX, BOOK_COLUMN_MIN, BOOK_FLOW_COLUMN_MIN_PX, FontCssRefusedError, MAX_SLOT_DECLARATIONS, MOTIF_DEPTH_LIMIT, MotifRefusedError, PAGE_REFERENCE_ATTRIBUTE, PAGE_REFERENCE_SELECTOR, PAGE_REFERENCE_VALUE, PAGINATE_FUNCTIONS, PLACEMENT_ATTRIBUTES, REFUSED_ELEMENTS, RequiredSlotsRefusedError, SlotFillRefusedError, SlotFillsConflictError, SlotFillsRefusedError, UNICODE_RANGE_CLEARANCE, UnmeasuredSlotsRefusedError, assertSingleSlotCopy, assertSlotPrintOptions, base64ToBytes, bindingNames, bindingRoot, bookDocument, bookPrintPart, bookStylesheet, bookView, bookViewFromHtml, bytesToBase64, classify, classifyMediaAnswer, collectSlotPrintCopies, documentLanguage, embedFunction, expandMotifs, fill, fillBookFurniture, findActiveContent, fitRegionSize, fontCss, fontFaceCss, fontFormat, fontReferenceRefusals, furnitureScript, hasBindings, hasHostMotifPlacement, hasMotifPlacement, hasSlotWork, heldPageNumber, isSlotCopyRefusal, lengthPx, libraryMotifPlacementRefusal, mergeSlotFitResults, motifPlacementRefusals, openerPageIndex, pageIndexForTarget, pageReferenceTarget, paginateBook, paginateScript, parseBookPositionKey, parseCssLength, parseUnicodeRange, placementCropEdges, placementPlaceholderSource, placementPlan, planBookPages, planPrintedPages, prepareSlotCollection, prepareSlots, printedPageAt, renderMotifPlacements, requiredSlotRefusal, resolvePlacements, safeImageSource, sanitize, sanitizeBookCss, searchText, selectBookParent, slotFillCopyId, slotFillRefusal, slotFillsConflict, unmeasuredSlotRefusal, windowPageIndex };

package/dist/motifs.d.ts

@@ -11,6 +11,7 @@ export interface ExpandMotifsOptions {
   dataFonts?: boolean;
   signal: AbortSignal;
   deferPaths?: Iterable<string>;
+  deferLibrary?: boolean;
 }
 export interface PlacedMotif extends MotifPlacement {
   version: number;
@@ -26,6 +27,7 @@ export declare class MotifRefusedError extends Error {
 }
 export declare function libraryMotifPlacementRefusal(html: string): string | undefined;
 export declare function hasMotifPlacement(html: string): boolean;
+export declare function hasHostMotifPlacement(html: string): boolean;
 export declare function renderMotifPlacements(html: string, replacement: (key: string) => string | undefined): string;
 export declare function documentLanguage(html: string): string | undefined;
 export declare function expandMotifs(html: string, options: ExpandMotifsOptions): Promise<ExpandedMotifs>;

package/dist/motifs.js

@@ -26,6 +26,9 @@ function libraryMotifPlacementRefusal(html) {
 function hasMotifPlacement(html) {
 	return motifElements(html).length > 0;
 }
+function hasHostMotifPlacement(html) {
+	return motifElements(html).some((element) => !(element.attribs[MOTIF_ATTRIBUTE] ?? "").startsWith(LIBRARY_MOTIF_PREFIX));
+}
 function renderMotifPlacements(html, replacement) {
 	const document = parse(html);
 	const visit = (nodes) => {
@@ -207,7 +210,7 @@ async function expandNodes(nodes, inheritedLang, stack, state) {
 	for (const node of [...nodes]) {
 		state.options.signal.throwIfAborted();
 		if (!isTag(node)) continue;
-		if (Object.hasOwn(node.attribs, MOTIF_ATTRIBUTE)) await expandPlacement(node, inheritedLang, stack, state);
+		if (Object.hasOwn(node.attribs, MOTIF_ATTRIBUTE) && !(state.options.deferLibrary && (node.attribs[MOTIF_ATTRIBUTE] ?? "").startsWith(LIBRARY_MOTIF_PREFIX))) await expandPlacement(node, inheritedLang, stack, state);
 		else await expandNodes(node.children, inheritedLang, stack, state);
 	}
 }
@@ -246,4 +249,4 @@ async function motifPlacementRefusals(html, options) {
 	return (await run(html, options, true)).state.refusals;
 }
 //#endregion
-export { MOTIF_DEPTH_LIMIT, MotifRefusedError, documentLanguage, expandMotifs, hasMotifPlacement, libraryMotifPlacementRefusal, motifPlacementRefusals, renderMotifPlacements };
+export { MOTIF_DEPTH_LIMIT, MotifRefusedError, documentLanguage, expandMotifs, hasHostMotifPlacement, hasMotifPlacement, libraryMotifPlacementRefusal, motifPlacementRefusals, renderMotifPlacements };

package/dist/placements.d.ts

@@ -0,0 +1,89 @@
+import { Media, Page, Placement } from "@segnavia/format";
+//#region src/placements.d.ts
+export declare const PLACEMENT_ATTRIBUTES: readonly ["data-segnavia-media", "data-segnavia-page", "data-segnavia-box", "data-segnavia-crop"];
+export type ResolvedPlacement = {
+  kind: 'media';
+  media: Media;
+  src: string;
+} | {
+  kind: 'page';
+  page: Page;
+};
+export type ResolvePlacement<R extends {
+  kind: string;
+} = ResolvedPlacement> = (placement: Placement, context: {
+  purpose: 'screen' | 'print';
+  width?: number;
+  signal: AbortSignal;
+}) => Promise<R | undefined>;
+export interface PlacementPlanEntry {
+  index: number;
+  placement: Placement;
+  alt?: string;
+  lang?: string;
+  dir?: string;
+  width?: number;
+}
+export interface PlacementRefusal {
+  index: number;
+  address?: string;
+  page?: string | number;
+  message: string;
+}
+export interface PlacementPlan {
+  entries: PlacementPlanEntry[];
+  refusals: PlacementRefusal[];
+}
+export type PlacementReport = (entry: {
+  address: string | undefined;
+  page: string | number | undefined;
+  reason: 'missing' | 'refused-src' | 'invalid' | 'failed';
+  message?: string;
+}) => void;
+export interface PlacementsOptions<R extends {
+  kind: string;
+} = ResolvedPlacement> {
+  resolve: ResolvePlacement<R>;
+  report?: PlacementReport;
+}
+type ResolvedMedia = Extract<ResolvedPlacement, {
+  kind: 'media';
+}>;
+export type MediaAnswer = {
+  status: 'ok';
+  value: ResolvedMedia;
+} | {
+  status: 'missing' | 'refused-src';
+  message?: undefined;
+} | {
+  status: 'invalid';
+  message: string;
+} | {
+  status: 'failed';
+  message: string;
+};
+export declare function classifyMediaAnswer(input: {
+  answer: {
+    kind: string;
+  } | undefined;
+}): Exclude<MediaAnswer, {
+  status: 'failed';
+}>;
+export declare function classifyMediaAnswer(input: {
+  error: unknown;
+}): Extract<MediaAnswer, {
+  status: 'failed';
+}>;
+export declare function placementCropEdges(crop: Placement['crop']): string | undefined;
+export declare function placementPlan(html: string): PlacementPlan;
+export declare function placementPlaceholderSource(width?: number, height?: number): string;
+export declare function resolvePlacements<R extends {
+  kind: string;
+}>(html: string, options: {
+  resolvePlacement: ResolvePlacement<R>;
+  purpose: 'screen' | 'print';
+  width: number;
+  signal: AbortSignal;
+  report?: PlacementReport;
+}): Promise<string>;
+//#endregion

package/dist/placements.js

@@ -0,0 +1,189 @@
+import { elements, parse, safeImageSource, serialize } from "./sanitize.js";
+import { Placement, mediaTextDirection } from "@segnavia/format";
+//#region src/placements.ts
+const PLACEMENT_ATTRIBUTES = [
+	"data-segnavia-media",
+	"data-segnavia-page",
+	"data-segnavia-box",
+	"data-segnavia-crop"
+];
+const [MEDIA_ATTRIBUTE, PAGE_ATTRIBUTE, BOX_ATTRIBUTE, CROP_ATTRIBUTE] = PLACEMENT_ATTRIBUTES;
+function classifyMediaAnswer(input) {
+	if ("error" in input) return {
+		status: "failed",
+		message: input.error instanceof Error ? input.error.message : String(input.error)
+	};
+	const answer = input.answer;
+	if (!answer) return { status: "missing" };
+	if (answer.kind !== "media" || !("src" in answer) || !("media" in answer)) return {
+		status: "invalid",
+		message: `resolved ${answer.kind}, not media`
+	};
+	const media = answer;
+	return safeImageSource(media.src) ? {
+		status: "ok",
+		value: media
+	} : { status: "refused-src" };
+}
+function placementCropEdges(crop) {
+	if (!crop) return void 0;
+	return `${crop.top ?? 0} ${crop.right ?? 0} ${crop.bottom ?? 0} ${crop.left ?? 0}`;
+}
+function positiveInteger(value) {
+	return value !== void 0 && /^[1-9][0-9]*$/.test(value) ? Number(value) : void 0;
+}
+function pageSelector(value) {
+	if (value === void 0) return void 0;
+	return /^[1-9][0-9]*$/.test(value) ? Number(value) : value;
+}
+function cropValue(value) {
+	if (value === void 0) return void 0;
+	const edges = value.trim().split(/\s+/);
+	if (edges.length < 1 || edges.length > 4) return { top: value };
+	const [top, second, third, fourth] = edges;
+	return {
+		top,
+		right: second ?? top,
+		bottom: third ?? top,
+		left: fourth ?? second ?? top
+	};
+}
+function plannedElement(element, index) {
+	const address = element.attribs[MEDIA_ATTRIBUTE];
+	const page = pageSelector(element.attribs[PAGE_ATTRIBUTE]);
+	try {
+		return {
+			index,
+			placement: Placement.parse({
+				kind: "media",
+				address,
+				...page === void 0 ? {} : { page },
+				...element.attribs[BOX_ATTRIBUTE] === void 0 ? {} : { box: element.attribs[BOX_ATTRIBUTE] },
+				...element.attribs[CROP_ATTRIBUTE] === void 0 ? {} : { crop: cropValue(element.attribs[CROP_ATTRIBUTE]) }
+			}, "page"),
+			..."alt" in element.attribs ? { alt: element.attribs.alt } : {},
+			..."lang" in element.attribs ? { lang: element.attribs.lang } : {},
+			..."dir" in element.attribs ? { dir: element.attribs.dir } : {},
+			...positiveInteger(element.attribs.width) === void 0 ? {} : { width: positiveInteger(element.attribs.width) }
+		};
+	} catch (error) {
+		return {
+			index,
+			address,
+			page,
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function planElements(found) {
+	const planned = found.flatMap((element, index) => element.name.toLowerCase() === "img" && MEDIA_ATTRIBUTE in element.attribs ? [plannedElement(element, index)] : []);
+	return {
+		entries: planned.filter((entry) => "placement" in entry),
+		refusals: planned.filter((entry) => !("placement" in entry))
+	};
+}
+function placementPlan(html) {
+	return planElements(elements(parse(html).children));
+}
+function placementPlaceholderSource(width = 400, height = 300) {
+	const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}"><rect width="100%" height="100%" fill="#eee"/><rect x="0.5" y="0.5" width="${width - 1}" height="${height - 1}" fill="none" stroke="#aaa"/></svg>`;
+	return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
+function placeholder(element) {
+	const authoredWidth = positiveInteger(element.attribs.width);
+	const authoredHeight = positiveInteger(element.attribs.height);
+	const width = authoredWidth ?? (authoredHeight === void 0 ? 400 : Math.round(authoredHeight * 4 / 3));
+	const height = authoredHeight ?? (authoredWidth === void 0 ? 300 : Math.round(authoredWidth * 3 / 4));
+	element.attribs.src = placementPlaceholderSource(width, height);
+	element.attribs["data-segnavia-placement"] = "missing";
+	if (!("alt" in element.attribs)) element.attribs.alt = "";
+	for (const attribute of PLACEMENT_ATTRIBUTES) delete element.attribs[attribute];
+}
+function applyResolved(element, entry, resolved) {
+	element.attribs.src = resolved.src;
+	if (entry.alt === void 0 && resolved.media.alt) {
+		element.attribs.alt = resolved.media.alt.text;
+		if (entry.lang === void 0 && entry.dir === void 0) {
+			if (resolved.media.alt.lang) element.attribs.lang = resolved.media.alt.lang;
+			element.attribs.dir = mediaTextDirection(resolved.media.alt);
+		}
+	}
+	const crop = placementCropEdges(entry.placement.crop);
+	if (crop) {
+		const declaration = `object-view-box: inset(${crop})`;
+		const authored = element.attribs.style?.trim();
+		element.attribs.style = authored ? `${authored.replace(/;?$/, ";")} ${declaration}` : declaration;
+	}
+	for (const attribute of PLACEMENT_ATTRIBUTES) delete element.attribs[attribute];
+}
+function abortable(work, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const aborted = () => reject(signal.reason);
+		signal.addEventListener("abort", aborted, { once: true });
+		work().then((value) => {
+			signal.removeEventListener("abort", aborted);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", aborted);
+			reject(error);
+		});
+	});
+}
+async function resolvePlacements(html, options) {
+	const document = parse(html);
+	const found = elements(document.children);
+	const plan = planElements(found);
+	if (plan.entries.length === 0 && plan.refusals.length === 0) return html;
+	options.signal.throwIfAborted();
+	for (const refusal of plan.refusals) {
+		const element = found[refusal.index];
+		if (element) placeholder(element);
+		options.report?.({
+			address: refusal.address,
+			page: refusal.page,
+			reason: "invalid",
+			message: refusal.message
+		});
+	}
+	await Promise.all(plan.entries.map(async (entry) => {
+		const element = found[entry.index];
+		if (!element) return;
+		try {
+			const resolved = await abortable(() => options.resolvePlacement(entry.placement, {
+				purpose: options.purpose,
+				width: entry.width ?? options.width,
+				signal: options.signal
+			}), options.signal);
+			options.signal.throwIfAborted();
+			const classified = classifyMediaAnswer({ answer: resolved });
+			if (classified.status === "ok") applyResolved(element, entry, classified.value);
+			else {
+				placeholder(element);
+				options.report?.({
+					address: entry.placement.address,
+					page: entry.placement.page,
+					reason: classified.status,
+					...classified.message === void 0 ? {} : { message: classified.message }
+				});
+			}
+		} catch (error) {
+			if (options.signal.aborted) throw options.signal.reason;
+			const classified = classifyMediaAnswer({ error });
+			placeholder(element);
+			options.report?.({
+				address: entry.placement.address,
+				page: entry.placement.page,
+				reason: classified.status,
+				message: classified.message
+			});
+		}
+	}));
+	options.signal.throwIfAborted();
+	return serialize(document);
+}
+//#endregion
+export { PLACEMENT_ATTRIBUTES, classifyMediaAnswer, placementCropEdges, placementPlaceholderSource, placementPlan, resolvePlacements };

package/dist/printed-pages.d.ts

@@ -1,4 +1,4 @@
-import { BookSectionParents as BookSectionParents$1, NumberSystem, PrintedPageRole, PrintedPageRules } from "@segnavia/format";
+import { BOOK_PARENT_NAMES, BookSectionParents as BookSectionParents$1, NumberSystem, PrintedPageRole, PrintedPageRules } from "@segnavia/format";
 //#region src/printed-pages.d.ts
 export type PrintedPageSide = 'left' | 'right';
 export interface PrintedPagePlan {
@@ -26,12 +26,7 @@ export interface BookPrintedPagePlan extends Omit<BookPageFacts, 'blank' | 'sect
 }
 export declare function printedPageAt(rules: PrintedPageRules, index: number, count: number, direction: 'ltr' | 'rtl'): Pick<PrintedPagePlan, 'role' | 'parent' | 'side'>;
 export declare function planPrintedPages(rules: PrintedPageRules, count: number, direction: 'ltr' | 'rtl', numbering?: NumberSystem): PrintedPagePlan[];
-export declare function selectBookParent(fact: BookPageFacts, index: number, count: number, direction: 'ltr' | 'rtl', names?: {
-  readonly recto: "segnavia:recto";
-  readonly verso: "segnavia:verso";
-  readonly opener: "segnavia:opener";
-  readonly blank: "segnavia:blank";
-}): Pick<BookPrintedPagePlan, 'role' | 'parent' | 'side'>;
+export declare function selectBookParent(fact: BookPageFacts, index: number, count: number, direction: 'ltr' | 'rtl', names: typeof BOOK_PARENT_NAMES): Pick<BookPrintedPagePlan, 'role' | 'parent' | 'side'>;
 export declare function planBookPages(facts: BookPageFacts[], direction: 'ltr' | 'rtl', names?: {
   readonly recto: "segnavia:recto";
   readonly verso: "segnavia:verso";

package/dist/printed-pages.js

@@ -39,7 +39,7 @@ function planPrintedPages(rules, count, direction, numbering = "arabic") {
 		};
 	});
 }
-function selectBookParent(fact, index, count, direction, names = BOOK_PARENT_NAMES) {
+function selectBookParent(fact, index, count, direction, names) {
 	const physical = printedPageAt({
 		every: names.recto,
 		recto: names.recto,

package/dist/sanitize.d.ts

@@ -4,9 +4,11 @@ export declare const REFUSED_ELEMENTS: Set<string>;
 export interface SanitizeOptions {
   linkOrigins?: Iterable<string>;
   keepScripts?: boolean;
+  dependencyOrigins?: Iterable<string>;
   dataFonts?: boolean;
   refuseElements?: Iterable<string>;
 }
+export declare function safeImageSource(value: string): boolean;
 export declare function findActiveContent(html: string, options?: SanitizeOptions): string[];
 export declare function sanitize(html: string, options?: SanitizeOptions): string;
 //#endregion

package/dist/sanitize.js

@@ -1,25 +1,27 @@
 import { sanitizeCss } from "./sanitize-css.js";
 import { isTag } from "domhandler";
+import { dependencyDecision, dependencyOriginSet, originSet } from "@segnavia/format";
 import render from "dom-serializer";
 import { parseDocument } from "htmlparser2";
 //#region src/sanitize.ts
-const REFUSED_ELEMENTS = /* @__PURE__ */ new Set([
-	"script",
-	"iframe",
-	"frame",
-	"frameset",
-	"object",
-	"embed",
-	"applet",
-	"base",
-	"portal",
-	"link",
-	"form",
-	"input",
-	"button",
-	"select",
-	"textarea"
-]);
+const REFUSED = {
+	script: "always",
+	iframe: "always",
+	frame: "always",
+	frameset: "always",
+	object: "always",
+	embed: "always",
+	applet: "always",
+	base: "always",
+	portal: "always",
+	link: "always",
+	form: "unless-scripts",
+	input: "unless-scripts",
+	button: "unless-scripts",
+	select: "unless-scripts",
+	textarea: "unless-scripts"
+};
+const REFUSED_ELEMENTS = new Set(Object.keys(REFUSED));
 const REFUSED_SVG_ELEMENTS = /* @__PURE__ */ new Set([
 	"script",
 	"animate",
@@ -78,13 +80,8 @@ function insideSvg(element) {
 function normalizeUrl(value) {
 	return [...value].filter((c) => c.charCodeAt(0) > 32 && c.charCodeAt(0) !== 127).join("").toLowerCase();
 }
-function origins(values) {
-	const set = /* @__PURE__ */ new Set();
-	for (const value of values ?? []) try {
-		const url = new URL(value);
-		if (url.protocol === "https:") set.add(url.origin.toLowerCase());
-	} catch {}
-	return set;
+function safeImageSource(value) {
+	return DATA_IMAGE.test(normalizeUrl(value));
 }
 function safeUrl(attribute, value, allowed) {
 	const url = normalizeUrl(value);
@@ -98,74 +95,115 @@ function safeUrl(attribute, value, allowed) {
 		}
 	}
 	if (attribute === "srcset") return DATA_IMAGE_SRCSET.test(url);
-	if (attribute === "src" || attribute === "poster") return DATA_IMAGE.test(url);
+	if (attribute === "src" || attribute === "poster") return safeImageSource(value);
 	return false;
 }
 function refusedElement(element, refused, keepScripts) {
 	const name = element.name.toLowerCase();
 	if (name === "script") return !keepScripts;
+	if (name === "link" && keepScripts && element.attribs.rel?.toLowerCase() === "stylesheet") return false;
 	if (refused.has(name)) return true;
 	if (insideSvg(element) && REFUSED_SVG_ELEMENTS.has(name)) return true;
 	return name === "meta" && Object.keys(element.attribs).some((attribute) => attribute.toLowerCase() === "http-equiv");
 }
-function refusedAttribute(name, value, allowed, keepScripts) {
+function dependencyAttribute(element, attribute, value, options, dependencies) {
+	if (!options.keepScripts) return void 0;
+	const tag = element.name.toLowerCase();
+	if (!(tag === "script" && attribute === "src" || tag === "link" && element.attribs.rel?.toLowerCase() === "stylesheet" && attribute === "href")) return void 0;
+	const decision = dependencyDecision(value, dependencies);
+	return decision.allowed ? "" : decision.reason;
+}
+function refusedAttribute(element, name, value, allowed, options, dependencies) {
 	const attribute = name.toLowerCase();
-	if (attribute.startsWith("on")) return !keepScripts;
-	return REFUSED_ATTRIBUTES.has(attribute) || URL_ATTRIBUTES.has(attribute) && !safeUrl(attribute, value, allowed);
+	if (attribute.startsWith("on")) return options.keepScripts ? void 0 : "";
+	const dependency = dependencyAttribute(element, attribute, value, options, dependencies);
+	if (dependency !== void 0) return dependency || void 0;
+	return REFUSED_ATTRIBUTES.has(attribute) || URL_ATTRIBUTES.has(attribute) && !safeUrl(attribute, value, allowed) ? "" : void 0;
 }
 function refusedSet(options) {
-	return new Set([...REFUSED_ELEMENTS, ...options.refuseElements ?? []].map((name) => name.toLowerCase()));
+	const defaults = options.keepScripts ? Object.entries(REFUSED).filter(([, rule]) => rule === "always").map(([name]) => name) : REFUSED_ELEMENTS;
+	return new Set([...defaults, ...options.refuseElements ?? []].map((name) => name.toLowerCase()));
 }
 function styleText(element) {
 	return element.children.map((child) => "data" in child ? child.data : "").join("");
 }
-function styleFindings(element, dataFonts) {
+function dependencyCss(source, declarations, options, dependencies) {
+	if (!options.keepScripts) return sanitizeCss(source, declarations, options.dataFonts ?? false);
+	const restores = [];
+	const hold = (url) => {
+		if (!dependencyDecision(url, dependencies).allowed) return url;
+		return `data:image/segnavia-dependency-${restores.push(url) - 1},x`;
+	};
+	let marker = "segnavia-held-import";
+	while (source.includes(marker)) marker += "-x";
+	const imports = [];
+	let protectedCss = source.replace(/@import\s+(?:url\(\s*)?["']?(https:\/\/[^\s"')]+)["']?\s*\)?[^;]*;/gi, (rule, url) => {
+		if (hold(url) === url) return rule;
+		const index = imports.push(rule) - 1;
+		return `.${marker}-${index}{}`;
+	});
+	protectedCss = protectedCss.replace(/@font-face\s*\{[^}]*\}/gi, (block) => block.replace(/https:\/\/[^\s"')]+/gi, hold));
+	const result = sanitizeCss(protectedCss, declarations, options.dataFonts ?? false);
+	const restore = (value) => value.replace(/data:image\/segnavia-dependency-(\d+),x/g, (_, index) => restores[Number(index)] ?? "");
+	let css = restore(result.css);
+	for (const [index, rule] of imports.entries()) css = css.replace(`.${marker}-${index}{}`, rule);
+	return {
+		css,
+		removed: result.removed.map(restore)
+	};
+}
+function styleFindings(element, options, dependencies) {
 	const found = [];
-	if (element.name.toLowerCase() === "style") for (const construct of sanitizeCss(styleText(element), false, dataFonts).removed) found.push(`<style> ${construct}`);
+	if (element.name.toLowerCase() === "style") for (const construct of dependencyCss(styleText(element), false, options, dependencies).removed) found.push(`<style> ${construct}`);
 	for (const [name, value] of Object.entries(element.attribs)) {
 		if (name.toLowerCase() !== "style") continue;
-		for (const construct of sanitizeCss(value, true, dataFonts).removed) found.push(`${element.name}[${name}] ${construct}`);
+		for (const construct of dependencyCss(value, true, options, dependencies).removed) found.push(`${element.name}[${name}] ${construct}`);
 	}
 	return found;
 }
 function findActiveContent(html, options = {}) {
-	const allowed = origins(options.linkOrigins);
+	const allowed = originSet(options.linkOrigins);
+	const dependencies = dependencyOriginSet(options.dependencyOrigins);
 	const refused = refusedSet(options);
 	const keepScripts = options.keepScripts ?? false;
 	const found = [];
 	for (const element of elements(parse(html).children)) {
 		if (refusedElement(element, refused, keepScripts)) found.push(`<${element.name}>`);
-		found.push(...styleFindings(element, options.dataFonts ?? false));
-		for (const [name, value] of Object.entries(element.attribs)) if (refusedAttribute(name, value, allowed, keepScripts)) found.push(`${element.name}[${name}]`);
+		found.push(...styleFindings(element, options, dependencies));
+		for (const [name, value] of Object.entries(element.attribs)) {
+			const reason = refusedAttribute(element, name, value, allowed, options, dependencies);
+			if (reason !== void 0) found.push(`${element.name}[${name}]${reason ? ` ${reason}` : ""}`);
+		}
 	}
 	return found;
 }
-function cleanStyleElement(element, dataFonts) {
+function cleanStyleElement(element, options, dependencies) {
 	if (element.name.toLowerCase() !== "style") return;
 	const children = element.children.filter((candidate) => "data" in candidate);
 	const child = children[0];
 	if (!child || !("data" in child)) return;
-	child.data = sanitizeCss(styleText(element), false, dataFonts).css;
+	child.data = dependencyCss(styleText(element), false, options, dependencies).css;
 	for (const extra of children.slice(1)) if ("data" in extra) extra.data = "";
 }
-function cleanAttributes(element, allowed, keepScripts, dataFonts) {
-	for (const [name, value] of Object.entries(element.attribs)) if (refusedAttribute(name, value, allowed, keepScripts)) delete element.attribs[name];
+function cleanAttributes(element, allowed, options, dependencies) {
+	for (const [name, value] of Object.entries(element.attribs)) if (refusedAttribute(element, name, value, allowed, options, dependencies) !== void 0) delete element.attribs[name];
 	else if (name.toLowerCase() === "style") {
-		const css = sanitizeCss(value, true, dataFonts).css.trim();
+		const css = dependencyCss(value, true, options, dependencies).css.trim();
 		if (css) element.attribs[name] = css;
 		else delete element.attribs[name];
 	}
 }
 function sanitize(html, options = {}) {
-	const allowed = origins(options.linkOrigins);
+	const allowed = originSet(options.linkOrigins);
+	const dependencies = dependencyOriginSet(options.dependencyOrigins);
 	const refused = refusedSet(options);
 	const keepScripts = options.keepScripts ?? false;
 	const document = parse(html);
 	const prune = (nodes) => nodes.filter((node) => {
 		if (!isTag(node)) return true;
 		if (refusedElement(node, refused, keepScripts)) return false;
-		cleanStyleElement(node, options.dataFonts ?? false);
-		cleanAttributes(node, allowed, keepScripts, options.dataFonts ?? false);
+		cleanStyleElement(node, options, dependencies);
+		cleanAttributes(node, allowed, options, dependencies);
 		node.children = prune(node.children);
 		return true;
 	});
@@ -173,4 +211,4 @@ function sanitize(html, options = {}) {
 	return serialize(document);
 }
 //#endregion
-export { REFUSED_ELEMENTS, elements, findActiveContent, parse, sanitize, serialize };
+export { REFUSED_ELEMENTS, elements, findActiveContent, parse, safeImageSource, sanitize, serialize };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segnavia/html",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -26,7 +26,7 @@
     }
   },
   "dependencies": {
-    "@segnavia/format": "0.37.0",
+    "@segnavia/format": "0.39.0",
     "dom-serializer": "^2.0.0",
     "domhandler": "^5.0.3",
     "htmlparser2": "^10.0.0",