best-email-builder 0.2.0 → 0.3.0

package/dist/chunk-57CTQNTK.js

@@ -0,0 +1,56 @@
+import {
+  isAssetPath
+} from "./chunk-3M36VVXS.js";
+
+// src/validation/urls.js
+var LINK_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "action", "formaction", "xlink:href"]);
+var IMAGE_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "src",
+  "srcset",
+  "background-url",
+  "background",
+  "poster",
+  "icon-unwrapped-url",
+  "icon-wrapped-url"
+]);
+var NAMED_ENTITIES = {
+  colon: ":",
+  tab: "	",
+  newline: "\n",
+  lpar: "(",
+  rpar: ")",
+  amp: "&",
+  quot: '"',
+  apos: "'",
+  lt: "<",
+  gt: ">",
+  nbsp: " "
+};
+function decodeEntities(value) {
+  return String(value ?? "").replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);?/gi, (whole, body) => {
+    const key = String(body).toLowerCase();
+    if (key.startsWith("#x")) return String.fromCodePoint(Number.parseInt(key.slice(2), 16) || 0);
+    if (key.startsWith("#")) return String.fromCodePoint(Number.parseInt(key.slice(1), 10) || 0);
+    return NAMED_ENTITIES[key] ?? whole;
+  });
+}
+function isMergeTag(value) {
+  return /^\{\{\s*[a-zA-Z][\w.]*\s*\}\}$/.test(String(value || "").trim());
+}
+function isSafeUrl(raw, kind) {
+  const value = decodeEntities(raw).trim();
+  if (!value) return true;
+  if (isMergeTag(value)) return true;
+  const compact = value.replace(/[\s\u0000-\u001f\u007f]+/g, "").toLowerCase();
+  if (kind === "image") return compact.startsWith("https://") || isAssetPath(value);
+  if (compact.startsWith("#")) return true;
+  return /^(https?:\/\/|mailto:|tel:)/.test(compact);
+}
+
+export {
+  LINK_ATTRIBUTES,
+  IMAGE_ATTRIBUTES,
+  decodeEntities,
+  isSafeUrl
+};
+//# sourceMappingURL=chunk-57CTQNTK.js.map

package/dist/chunk-57CTQNTK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/validation/urls.js"],"sourcesContent":["// @ts-check\n/**\n * URLs accepted in an email template.\n *\n *   link   (`href`)                     https, http, mailto:, tel:, `#…` anchor,\n *                                       or a `{{ … }}` merge tag (unsubscribe,\n *                                       variable) replaced at render time;\n *   image  (`src`, `background-url`…)   https only: an http image is blocked or\n *                                       flagged by most email clients, and\n *                                       `data:` bloats the message until Gmail\n *                                       clips it. Or an UPLOADED image (asset\n *                                       path, see `isAssetPath`), made absolute\n *                                       at render time (renderer/links.js).\n *\n * Everything else (`javascript:`, `data:`, `vbscript:`, `file:`…) is rejected.\n * The scheme is read AFTER decoding entities and stripping whitespace and\n * control characters: `java&#x09;script:` and `&#106;avascript:` are classics.\n */\nimport { isAssetPath } from '../renderer/links.js';\n\n/** Attributes carrying a LINK URL. */\nexport const LINK_ATTRIBUTES = new Set(['href', 'action', 'formaction', 'xlink:href']);\n\n/** Attributes carrying an IMAGE URL (MJML and HTML). */\nexport const IMAGE_ATTRIBUTES = new Set([\n  'src',\n  'srcset',\n  'background-url',\n  'background',\n  'poster',\n  'icon-unwrapped-url',\n  'icon-wrapped-url',\n]);\n\nconst NAMED_ENTITIES = {\n  colon: ':',\n  tab: '\\t',\n  newline: '\\n',\n  lpar: '(',\n  rpar: ')',\n  amp: '&',\n  quot: '\"',\n  apos: \"'\",\n  lt: '<',\n  gt: '>',\n  nbsp: ' ',\n};\n\n/** Decodes the HTML entities of an attribute value. @param {string} value */\nexport function decodeEntities(value) {\n  return String(value ?? '').replace(/&(#x[0-9a-f]+|#\\d+|[a-z]+);?/gi, (whole, body) => {\n    const key = String(body).toLowerCase();\n    if (key.startsWith('#x')) return String.fromCodePoint(Number.parseInt(key.slice(2), 16) || 0);\n    if (key.startsWith('#')) return String.fromCodePoint(Number.parseInt(key.slice(1), 10) || 0);\n    return NAMED_ENTITIES[key] ?? whole;\n  });\n}\n\n/** A `{{ … }}` merge tag (variable, unsubscribe, web version). @param {string} value */\nexport function isMergeTag(value) {\n  return /^\\{\\{\\s*[a-zA-Z][\\w.]*\\s*\\}\\}$/.test(String(value || '').trim());\n}\n\n/**\n * @param {string} raw\n * @param {'link'|'image'} kind\n * @returns {boolean}\n */\nexport function isSafeUrl(raw, kind) {\n  const value = decodeEntities(raw).trim();\n  if (!value) return true;\n  if (isMergeTag(value)) return true;\n  // Scheme read without whitespace or control characters (\"java\\tscript:\").\n  // eslint-disable-next-line no-control-regex -- control characters are exactly what is stripped\n  const compact = value.replace(/[\\s\\u0000-\\u001f\\u007f]+/g, '').toLowerCase();\n  if (kind === 'image') return compact.startsWith('https://') || isAssetPath(value);\n  if (compact.startsWith('#')) return true;\n  return /^(https?:\\/\\/|mailto:|tel:)/.test(compact);\n}\n"],"mappings":";;;;;AAqBO,IAAM,kBAAkB,oBAAI,IAAI,CAAC,QAAQ,UAAU,cAAc,YAAY,CAAC;AAG9E,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,iBAAiB;AAAA,EACrB,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,MAAM;AACR;AAGO,SAAS,eAAe,OAAO;AACpC,SAAO,OAAO,SAAS,EAAE,EAAE,QAAQ,kCAAkC,CAAC,OAAO,SAAS;AACpF,UAAM,MAAM,OAAO,IAAI,EAAE,YAAY;AACrC,QAAI,IAAI,WAAW,IAAI,EAAG,QAAO,OAAO,cAAc,OAAO,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;AAC5F,QAAI,IAAI,WAAW,GAAG,EAAG,QAAO,OAAO,cAAc,OAAO,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;AAC3F,WAAO,eAAe,GAAG,KAAK;AAAA,EAChC,CAAC;AACH;AAGO,SAAS,WAAW,OAAO;AAChC,SAAO,iCAAiC,KAAK,OAAO,SAAS,EAAE,EAAE,KAAK,CAAC;AACzE;AAOO,SAAS,UAAU,KAAK,MAAM;AACnC,QAAM,QAAQ,eAAe,GAAG,EAAE,KAAK;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,KAAK,EAAG,QAAO;AAG9B,QAAM,UAAU,MAAM,QAAQ,6BAA6B,EAAE,EAAE,YAAY;AAC3E,MAAI,SAAS,QAAS,QAAO,QAAQ,WAAW,UAAU,KAAK,YAAY,KAAK;AAChF,MAAI,QAAQ,WAAW,GAAG,EAAG,QAAO;AACpC,SAAO,8BAA8B,KAAK,OAAO;AACnD;","names":[]}

package/dist/chunk-BVOVAEEJ.js

@@ -0,0 +1,73 @@
+import {
+  DEFAULT_VARIABLES
+} from "./chunk-3M36VVXS.js";
+
+// src/features/variables/service.js
+function escapeHtml(text) {
+  return String(text ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function decodeHtml(text) {
+  return String(text ?? "").replace(/&nbsp;/g, " ").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&");
+}
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function patternOf(key) {
+  return new RegExp(`\\{\\{\\s*${escapeRegExp(key)}\\s*(?:\\|([^{}]*))?\\}\\}`, "g");
+}
+var ANY_TAG = /\{\{\s*([A-Za-z][\w.]*)\s*(?:\|[^{}]*)?\}\}/g;
+var textVariables = (variables) => variables.filter((v) => v.kind !== "link");
+var present = (value) => value !== null && value !== void 0 && String(value) !== "";
+function replace(text, values, variables, html) {
+  let out = String(text || "");
+  for (const variable of textVariables(variables)) {
+    out = out.replace(patternOf(variable.key), (_, inline) => {
+      const value = values?.[variable.key];
+      if (present(value)) return html ? escapeHtml(value) : String(value);
+      const fallback = inline !== void 0 ? (html ? decodeHtml(inline) : inline).trim() : variable.fallback || "";
+      return html ? escapeHtml(fallback) : fallback;
+    });
+  }
+  return out;
+}
+function applyVariables(html, values, variables = DEFAULT_VARIABLES) {
+  return replace(html, values, variables, true);
+}
+function applyVariablesToText(text, values, variables = DEFAULT_VARIABLES) {
+  return replace(text, values, variables, false);
+}
+function mapVariables(html, mapping, variables = DEFAULT_VARIABLES) {
+  let out = String(html || "");
+  for (const variable of textVariables(variables)) {
+    if (!Object.prototype.hasOwnProperty.call(mapping, variable.key)) continue;
+    out = out.replace(patternOf(variable.key), () => String(mapping[variable.key]));
+  }
+  return out;
+}
+function usedVariables(text, variables = DEFAULT_VARIABLES) {
+  const source = String(text || "");
+  return variables.filter((v) => patternOf(v.key).test(source)).map((v) => v.key);
+}
+function unknownVariables(text, variables = DEFAULT_VARIABLES, ignore = ["unsubscribe", "mirror"]) {
+  const known = /* @__PURE__ */ new Set([...variables.map((v) => v.key), ...ignore]);
+  const found = /* @__PURE__ */ new Set();
+  for (const match of String(text || "").matchAll(ANY_TAG)) {
+    if (!known.has(match[1])) found.add(match[1]);
+  }
+  return [...found];
+}
+function sampleValues(variables = DEFAULT_VARIABLES, overrides = {}) {
+  const values = Object.fromEntries(textVariables(variables).map((v) => [v.key, v.sample]));
+  for (const [key, value] of Object.entries(overrides)) {
+    if (present(value)) values[key] = String(value);
+  }
+  return values;
+}
+
+export {
+  applyVariables,
+  applyVariablesToText,
+  mapVariables,
+  usedVariables,
+  unknownVariables,
+  sampleValues
+};
+//# sourceMappingURL=chunk-BVOVAEEJ.js.map

package/dist/chunk-BVOVAEEJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/features/variables/service.js"],"sourcesContent":["// @ts-check\n/**\n * Variables service — replaces merge tags in compiled HTML (or in a subject).\n *\n * Only the tags of the catalog are touched, in their `{{key}}` or\n * `{{key|fallback}}` form (spaces allowed): other tags (an email provider's own\n * merge tags, `{{ mirror }}`) are left intact.\n *\n * Values are escaped in HTML: a first name \"<b>Jo</b>\" is displayed as typed,\n * it makes nothing bold — and cannot inject anything.\n *\n * Missing value → the tag's inline fallback → the variable's `fallback` → ''.\n * A raw tag never reaches a recipient.\n *\n * The unsubscribe link is NOT replaced here: only the sending pipeline knows\n * the right link (see `applyServiceLinks`).\n */\n\nimport { DEFAULT_VARIABLES } from './catalog.js';\n\n/** @typedef {import('./catalog.js').EmailVariable} EmailVariable */\n/** @typedef {Record<string, string|number|null|undefined>} VariableValues */\n\nfunction escapeHtml(text) {\n  return String(text ?? '')\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n\n/** Undoes the escaping the editor applied to an inline fallback. */\nfunction decodeHtml(text) {\n  return String(text ?? '')\n    .replace(/&nbsp;/g, ' ')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/&amp;/g, '&');\n}\n\nconst escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/** `{{ key }}` or `{{ key | fallback }}`. @param {string} key */\nfunction patternOf(key) {\n  return new RegExp(`\\\\{\\\\{\\\\s*${escapeRegExp(key)}\\\\s*(?:\\\\|([^{}]*))?\\\\}\\\\}`, 'g');\n}\n\n/** Any `{{ … }}` tag that looks like a variable. */\nconst ANY_TAG = /\\{\\{\\s*([A-Za-z][\\w.]*)\\s*(?:\\|[^{}]*)?\\}\\}/g;\n\n/** @param {EmailVariable[]} variables */\nconst textVariables = (variables) => variables.filter((v) => v.kind !== 'link');\n\nconst present = (value) => value !== null && value !== undefined && String(value) !== '';\n\n/**\n * @param {string} text\n * @param {VariableValues} values\n * @param {EmailVariable[]} variables\n * @param {boolean} html\n */\nfunction replace(text, values, variables, html) {\n  let out = String(text || '');\n  for (const variable of textVariables(variables)) {\n    out = out.replace(patternOf(variable.key), (_, inline) => {\n      const value = values?.[variable.key];\n      if (present(value)) return html ? escapeHtml(value) : String(value);\n      const fallback = inline !== undefined ? (html ? decodeHtml(inline) : inline).trim() : variable.fallback || '';\n      return html ? escapeHtml(fallback) : fallback;\n    });\n  }\n  return out;\n}\n\n/**\n * Replaces the known tags with values (escaped) in HTML.\n *\n * @param {string} html\n * @param {VariableValues} values\n * @param {EmailVariable[]} [variables]\n */\nexport function applyVariables(html, values, variables = DEFAULT_VARIABLES) {\n  return replace(html, values, variables, true);\n}\n\n/**\n * Same as `applyVariables` for PLAIN TEXT (subject line, preview text): no\n * HTML escaping.\n *\n * @param {string} text\n * @param {VariableValues} values\n * @param {EmailVariable[]} [variables]\n */\nexport function applyVariablesToText(text, values, variables = DEFAULT_VARIABLES) {\n  return replace(text, values, variables, false);\n}\n\n/**\n * Replaces the known tags with RAW replacements — typically the merge tags of\n * an email provider (`{ 'contact.firstname': '{{ contact.FIRSTNAME }}' }`).\n * A tag without replacement is left untouched.\n *\n * @param {string} html\n * @param {Record<string, string>} mapping\n * @param {EmailVariable[]} [variables]\n */\nexport function mapVariables(html, mapping, variables = DEFAULT_VARIABLES) {\n  let out = String(html || '');\n  for (const variable of textVariables(variables)) {\n    if (!Object.prototype.hasOwnProperty.call(mapping, variable.key)) continue;\n    out = out.replace(patternOf(variable.key), () => String(mapping[variable.key]));\n  }\n  return out;\n}\n\n/**\n * Catalog keys present in a text.\n * @param {string} text\n * @param {EmailVariable[]} [variables]\n */\nexport function usedVariables(text, variables = DEFAULT_VARIABLES) {\n  const source = String(text || '');\n  return variables.filter((v) => patternOf(v.key).test(source)).map((v) => v.key);\n}\n\n/**\n * Tags that look like variables but are not in the catalog (typos such as\n * `{{contact.fistname}}`). `ignore` lists tags handled elsewhere.\n *\n * @param {string} text\n * @param {EmailVariable[]} [variables]\n * @param {string[]} [ignore]\n */\nexport function unknownVariables(text, variables = DEFAULT_VARIABLES, ignore = ['unsubscribe', 'mirror']) {\n  const known = new Set([...variables.map((v) => v.key), ...ignore]);\n  const found = new Set();\n  for (const match of String(text || '').matchAll(ANY_TAG)) {\n    if (!known.has(match[1])) found.add(match[1]);\n  }\n  return [...found];\n}\n\n/**\n * Sample values (preview, test), with optional overrides\n * (e.g. `{ 'contact.email': 'reviewer@example.com' }`).\n *\n * @param {EmailVariable[]} [variables]\n * @param {VariableValues} [overrides]\n */\nexport function sampleValues(variables = DEFAULT_VARIABLES, overrides = {}) {\n  /** @type {Record<string, string>} */\n  const values = Object.fromEntries(textVariables(variables).map((v) => [v.key, v.sample]));\n  for (const [key, value] of Object.entries(overrides)) {\n    if (present(value)) values[key] = String(value);\n  }\n  return values;\n}\n"],"mappings":";;;;;AAuBA,SAAS,WAAW,MAAM;AACxB,SAAO,OAAO,QAAQ,EAAE,EACrB,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ;AAC3B;AAGA,SAAS,WAAW,MAAM;AACxB,SAAO,OAAO,QAAQ,EAAE,EACrB,QAAQ,WAAW,GAAG,EACtB,QAAQ,SAAS,GAAG,EACpB,QAAQ,SAAS,GAAG,EACpB,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,GAAG,EACrB,QAAQ,UAAU,GAAG;AAC1B;AAEA,IAAM,eAAe,CAAC,SAAS,KAAK,QAAQ,uBAAuB,MAAM;AAGzE,SAAS,UAAU,KAAK;AACtB,SAAO,IAAI,OAAO,aAAa,aAAa,GAAG,CAAC,8BAA8B,GAAG;AACnF;AAGA,IAAM,UAAU;AAGhB,IAAM,gBAAgB,CAAC,cAAc,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AAE9E,IAAM,UAAU,CAAC,UAAU,UAAU,QAAQ,UAAU,UAAa,OAAO,KAAK,MAAM;AAQtF,SAAS,QAAQ,MAAM,QAAQ,WAAW,MAAM;AAC9C,MAAI,MAAM,OAAO,QAAQ,EAAE;AAC3B,aAAW,YAAY,cAAc,SAAS,GAAG;AAC/C,UAAM,IAAI,QAAQ,UAAU,SAAS,GAAG,GAAG,CAAC,GAAG,WAAW;AACxD,YAAM,QAAQ,SAAS,SAAS,GAAG;AACnC,UAAI,QAAQ,KAAK,EAAG,QAAO,OAAO,WAAW,KAAK,IAAI,OAAO,KAAK;AAClE,YAAM,WAAW,WAAW,UAAa,OAAO,WAAW,MAAM,IAAI,QAAQ,KAAK,IAAI,SAAS,YAAY;AAC3G,aAAO,OAAO,WAAW,QAAQ,IAAI;AAAA,IACvC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AASO,SAAS,eAAe,MAAM,QAAQ,YAAY,mBAAmB;AAC1E,SAAO,QAAQ,MAAM,QAAQ,WAAW,IAAI;AAC9C;AAUO,SAAS,qBAAqB,MAAM,QAAQ,YAAY,mBAAmB;AAChF,SAAO,QAAQ,MAAM,QAAQ,WAAW,KAAK;AAC/C;AAWO,SAAS,aAAa,MAAM,SAAS,YAAY,mBAAmB;AACzE,MAAI,MAAM,OAAO,QAAQ,EAAE;AAC3B,aAAW,YAAY,cAAc,SAAS,GAAG;AAC/C,QAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,SAAS,GAAG,EAAG;AAClE,UAAM,IAAI,QAAQ,UAAU,SAAS,GAAG,GAAG,MAAM,OAAO,QAAQ,SAAS,GAAG,CAAC,CAAC;AAAA,EAChF;AACA,SAAO;AACT;AAOO,SAAS,cAAc,MAAM,YAAY,mBAAmB;AACjE,QAAM,SAAS,OAAO,QAAQ,EAAE;AAChC,SAAO,UAAU,OAAO,CAAC,MAAM,UAAU,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAChF;AAUO,SAAS,iBAAiB,MAAM,YAAY,mBAAmB,SAAS,CAAC,eAAe,QAAQ,GAAG;AACxG,QAAM,QAAQ,oBAAI,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC;AACjE,QAAM,QAAQ,oBAAI,IAAI;AACtB,aAAW,SAAS,OAAO,QAAQ,EAAE,EAAE,SAAS,OAAO,GAAG;AACxD,QAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,EAAG,OAAM,IAAI,MAAM,CAAC,CAAC;AAAA,EAC9C;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AASO,SAAS,aAAa,YAAY,mBAAmB,YAAY,CAAC,GAAG;AAE1E,QAAM,SAAS,OAAO,YAAY,cAAc,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACxF,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,QAAI,QAAQ,KAAK,EAAG,QAAO,GAAG,IAAI,OAAO,KAAK;AAAA,EAChD;AACA,SAAO;AACT;","names":[]}