domma-cms 1.7.0 → 1.7.2

package/server/services/wpImport/convert.js

@@ -0,0 +1,491 @@
+/**
+ * WordPress content -> a Domma page body.
+ *
+ *  1. Gutenberg block comments (and every other HTML comment) go.
+ *  2. Shortcodes with a Domma equivalent are converted - [caption] to a
+ *     figure, [gallery] to a [grid] of images, [embed] / bare YouTube and Vimeo
+ *     addresses / embed blocks / <video> to [embed], [audio] to a link (the
+ *     site's sanitiser has no audio player). Every other shortcode is left as
+ *     visible text - with its brackets escaped, so Domma never mistakes a
+ *     WordPress [button] for its own - and listed as "needs rebuilding".
+ *  3. Classic-editor text gets its paragraphs (a small wpautop).
+ *  4. The HTML is sanitised against a short allow-list: no scripts, styles,
+ *     forms, event handlers, iframes (other than the [embed]s made above).
+ *  5. Media addresses become /media/<file>, and links to the old site's
+ *     pages and posts become their new addresses.
+ *  6. Clean HTML (paragraphs, headings, simple lists, links, images, quotes,
+ *     code) is written as Markdown; anything richer (tables, nested lists,
+ *     figures) stays as HTML in the Markdown body - the page renderer
+ *     sanitises it again when the page is shown.
+ *
+ * Pure - the context supplies every lookup.
+ *
+ * @module services/wpImport/convert
+ */
+import sanitizeHtml from 'sanitize-html';
+
+/** Shortcodes this importer converts. */
+export const CONVERTED_SHORTCODES = ['caption', 'wp_caption', 'gallery', 'embed', 'video', 'audio', 'playlist'];
+
+/** Commonly seen WordPress shortcode names, recognised even with no attributes. */
+const KNOWN_WP = /^(contact-form-7|contact-form|gravityform|wpforms|ninja_form|formidable|mc4wp_form|woocommerce_\w+|products?|product_\w+|add_to_cart|recent_products|shop_messages|et_pb_\w+|vc_\w+|fl_builder_insert_layout|elementor-template|rev_slider|layerslider|smartslider3|soliloquy|envira-gallery|foogallery|metaslider|tabs?|accordion|toggle|button|row|column|col|one_half\w*|one_third\w*|two_third\w*|one_fourth\w*|spacer|divider|icon|map|google_?map|instagram-feed|custom-twitter-feeds|wpdatatable|table|tablepress|ultimate_\w+|av_\w+|fusion_\w+|x_\w+|cs_\w+|su_\w+|pdf-embedder|fluentform|forminator_form|wp_ulike|social_\w+)$/i;
+
+const PH_OPEN = '';
+const PH_CLOSE = '';
+const PH_RE = /(\d+)/g;
+
+const VIDEO_HOST = /^(?:www\.|m\.)?(?:youtube\.com|youtu\.be|youtube-nocookie\.com|vimeo\.com|player\.vimeo\.com)$/i;
+
+export const escapeAttr = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\[/g, '&#91;').replace(/\]/g, '&#93;');
+export const escapeText = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\[/g, '&#91;').replace(/\]/g, '&#93;');
+
+/** Attributes of a shortcode, as WordPress's shortcode_parse_atts() reads them. */
+export function shortcodeAttrs(text) {
+    const out = {};
+    const re = /([\w-]+)\s*=\s*"([^"]*)"(?:\s|$)|([\w-]+)\s*=\s*'([^']*)'(?:\s|$)|([\w-]+)\s*=\s*([^\s'"]+)(?:\s|$)|"([^"]*)"(?:\s|$)|'([^']*)'(?:\s|$)|(\S+)(?:\s|$)/g;
+    const s = String(text || '').replace(/[ ​]/g, ' ').replace(/[“”″]/g, '"').replace(/[‘’′]/g, "'");
+    let m;
+    let n = 0;
+    while ((m = re.exec(s)) && n++ < 50) {
+        if (m[1]) out[m[1].toLowerCase()] = m[2];
+        else if (m[3]) out[m[3].toLowerCase()] = m[4];
+        else if (m[5]) out[m[5].toLowerCase()] = m[6];
+        else if (m[7] !== undefined) out[n] = m[7];
+        else if (m[8] !== undefined) out[n] = m[8];
+        else if (m[9]) out[n] = m[9];
+    }
+    return out;
+}
+
+/** Which page builder made this item, if any - its content will need rebuilding. */
+export function detectBuilder(item) {
+    const meta = item?.meta || {};
+    const c = String(item?.content || '');
+    if (meta._elementor_data || meta._elementor_edit_mode === 'builder') return 'Elementor';
+    if (/\[et_pb_/.test(c) || meta._et_pb_use_builder === 'on') return 'Divi';
+    if (/\[vc_row/.test(c) || meta._wpb_vc_js_status === 'true') return 'WPBakery';
+    if (meta._fl_builder_enabled === '1') return 'Beaver Builder';
+    if (/\[fusion_builder/.test(c)) return 'Avada';
+    if (meta.panels_data) return 'SiteOrigin';
+    if (/<!-- wp:kadence\/|<!-- wp:generateblocks\//.test(c)) return '';
+    return '';
+}
+
+/**
+ * Shortcodes in a body that will NOT be converted - the "needs rebuilding" list.
+ *
+ * A bare word in brackets ("[sic]", "[1]") is not counted: only names with
+ * attributes, a closing tag, a "_" or "-", or a commonly seen shortcode name.
+ *
+ * @param {string} content
+ * @returns {string[]} names, sorted, without duplicates
+ */
+export function findShortcodes(content) {
+    const s = stripComments(String(content || '')).replace(/\[\[[^\]]*\]\]/g, '');
+    const found = new Set();
+    const re = /\[([A-Za-z][\w-]{0,60})(\s[^\[\]]*)?\/?\]/g;
+    let m;
+    while ((m = re.exec(s))) {
+        const name = m[1];
+        if (CONVERTED_SHORTCODES.includes(name.toLowerCase())) continue;
+        const hasAttrs = Boolean(m[2] && m[2].trim() && m[2].trim() !== '/');
+        const closes = s.includes(`[/${name}]`);
+        if (hasAttrs || closes || /[_-]/.test(name) || KNOWN_WP.test(name)) found.add(name);
+    }
+    return [...found].sort();
+}
+
+/** <!-- ... --> out, Gutenberg's block delimiters among them. */
+export function stripComments(html) {
+    return String(html || '').replace(/<!--[\s\S]*?-->/g, '');
+}
+
+const BLOCK_START = /^<(?:p|div|h[1-6]|ul|ol|li|dl|blockquote|pre|table|thead|tbody|tr|figure|hr|section|article|aside|header|footer|address|details|form|fieldset|nav|style|script|iframe|video|audio)\b/i;
+
+/** WordPress's wpautop, simplified: blank-line-separated text becomes <p>, single newlines <br>. */
+export function autop(html) {
+    const s = String(html || '').replace(/\r\n?/g, '\n');
+    if (!s.trim()) return '';
+    // Inside <pre> nothing changes.
+    const pres = [];
+    const held = s.replace(/<pre[\s\S]*?<\/pre>/gi, (m) => { pres.push(m); return `${pres.length - 1}`; });
+    const out = held.split(/\n\s*\n/).map(chunk => {
+        const t = chunk.trim();
+        if (!t) return '';
+        if (/^\d+$/.test(t) || BLOCK_START.test(t) || /^\d+$/.test(t)) return t;
+        return `<p>${t.replace(/\n/g, '<br>\n')}</p>`;
+    }).filter(Boolean).join('\n\n');
+    return out.replace(/(\d+)/g, (_m, n) => pres[Number(n)]);
+}
+
+const SANITISE = {
+    allowedTags: ['p', 'br', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'strong', 'b', 'em', 'i', 'u', 's', 'del', 'ins', 'sub', 'sup',
+        'mark', 'small', 'blockquote', 'q', 'cite', 'code', 'pre', 'kbd', 'ul', 'ol', 'li', 'dl', 'dt', 'dd', 'a', 'img',
+        'figure', 'figcaption', 'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td', 'caption', 'hr', 'span', 'div', 'abbr'],
+    allowedAttributes: {
+        a: ['href', 'title', 'target', 'rel'],
+        img: ['src', 'alt', 'title', 'width', 'height'],
+        th: ['colspan', 'rowspan', 'scope'],
+        td: ['colspan', 'rowspan'],
+        ol: ['start'],
+        abbr: ['title']
+    },
+    allowedSchemes: ['http', 'https', 'mailto', 'tel'],
+    allowedSchemesAppliedToAttributes: ['href', 'src'],
+    allowProtocolRelative: false,
+    disallowedTagsMode: 'discard',
+    nonTextTags: ['script', 'style', 'textarea', 'option', 'noscript', 'iframe', 'object', 'embed', 'svg', 'math', 'form', 'button', 'select'],
+    transformTags: {
+        a: (tagName, attribs) => {
+            const out = {...attribs};
+            if (out.target === '_blank') out.rel = 'noopener';
+            else delete out.target;
+            return {tagName, attribs: out};
+        },
+        b: 'strong',
+        i: 'em'
+    }
+};
+
+/** The imported HTML through the allow-list. */
+export function sanitise(html) {
+    return sanitizeHtml(String(html || ''), SANITISE);
+}
+
+/**
+ * Convert one item's content.
+ *
+ * @param {string} content - the post's content:encoded
+ * @param {object} ctx
+ * @param {(url: string) => string|null} ctx.mediaFor   - an old media address -> /media/<file>, or null
+ * @param {(id: number) => {url: string, alt?: string, title?: string, mime?: string}|null} ctx.mediaById
+ * @param {(url: string) => string|null} ctx.linkFor    - an old address -> the new one (or a local path), or null to leave it
+ * @param {(postId: number) => number[]} [ctx.attachmentsOf] - images attached to a post (a [gallery] without ids)
+ * @param {number} [ctx.postId]
+ * @returns {{body: string, format: 'markdown'|'html', shortcodes: string[], notes: string[]}}
+ */
+export function convertContent(content, ctx = {}) {
+    const notes = [];
+    const note = (n) => { if (!notes.includes(n)) notes.push(n); };
+    const snippets = [];
+    const hold = (snippet) => { snippets.push(snippet); return `${PH_OPEN}${snippets.length - 1}${PH_CLOSE}`; };
+    const mediaFor = ctx.mediaFor || (() => null);
+    const linkFor = ctx.linkFor || (() => null);
+
+    const raw = String(content || '').replace(/\r\n?/g, '\n').replace(/[-]/g, '');
+    const gutenberg = /<!--\s*wp:/.test(raw);
+    let s = stripComments(raw);
+    const shortcodes = findShortcodes(s);
+
+    // [[name]] is WordPress's way of writing a literal [name].
+    s = s.replace(/\[\[([^\[\]]*)\]\]/g, (_m, inner) => hold(`&#91;${escapeText(inner)}&#93;`));
+
+    const embedFor = (url) => {
+        const u = String(url || '').trim().replace(/&amp;/g, '&');
+        if (!/^https?:\/\//i.test(u)) return '';
+        let host = '';
+        try { host = new URL(u).hostname; } catch { return ''; }
+        if (VIDEO_HOST.test(host)) return hold(`[embed url="${escapeAttr(u)}" /]`);
+        const local = mediaFor(u);
+        if (local && /\.(mp4|webm|ogv|ogg)$/i.test(local)) return hold(`[embed url="${escapeAttr(local)}" /]`);
+        note(`An embed from ${host} became a link - Domma embeds YouTube, Vimeo and the site's own videos.`);
+        return hold(`<p><a href="${escapeAttr(local || u)}">${escapeText(u)}</a></p>`);
+    };
+
+    // Gutenberg embed blocks: the address sits alone inside the wrapper.
+    s = s.replace(/<figure[^>]*class="[^"]*wp-block-embed[^"]*"[^>]*>\s*<div[^>]*>\s*(https?:\/\/[^\s<]+)\s*<\/div>([\s\S]*?)<\/figure>/gi,
+        (_m, url) => embedFor(url) || '');
+    // <iframe> pasted in: video hosts become [embed]; anything else goes (reported).
+    s = s.replace(/<iframe\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>[\s\S]*?<\/iframe>/gi, (_m, src) => {
+        let host = '';
+        try { host = new URL(src.replace(/&amp;/g, '&'), 'https://x.invalid').hostname; } catch { /* not a URL */ }
+        if (VIDEO_HOST.test(host)) return hold(`[embed url="${escapeAttr(src.replace(/&amp;/g, '&'))}" /]`);
+        note(`An embedded frame from ${host || 'another site'} was removed.`);
+        return '';
+    });
+    // <video> and <audio> tags (the block editor writes these).
+    s = s.replace(/<video\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*>[\s\S]*?<\/video>/gi, (_m, src) => videoSnippet(src));
+    s = s.replace(/<audio\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*>[\s\S]*?<\/audio>/gi, (_m, src) => audioSnippet(src));
+
+    function videoSnippet(src) {
+        const local = mediaFor(src);
+        if (local) return hold(`[embed url="${escapeAttr(local)}" /]`);
+        return embedFor(src) || '';
+    }
+    function audioSnippet(src) {
+        const local = mediaFor(src) || src;
+        if (!/^(https?:\/\/|\/)/i.test(local)) return '';
+        note('Audio players became links to the file - Domma pages have no audio player.');
+        const name = decodeURIComponent(String(local).split('/').pop() || 'audio');
+        return hold(`<p><a href="${escapeAttr(local)}">Listen: ${escapeText(name)}</a></p>`);
+    }
+
+    // [caption]<img ...> Text[/caption]
+    s = s.replace(/\[(caption|wp_caption)([^\]]*)\]([\s\S]*?)\[\/\1\]/gi, (_m, _n, attrText, inner) => {
+        const attrs = shortcodeAttrs(attrText);
+        const img = /<img\b[^>]*>/i.exec(inner);
+        if (!img) return inner;
+        const link = /<a\b[^>]*href\s*=\s*["']([^"']+)["'][^>]*>\s*<img/i.exec(inner);
+        const text = (attrs.caption || inner.replace(/<a\b[^>]*>[\s\S]*?<\/a>/i, '').replace(/<img\b[^>]*>/i, '').replace(/<[^>]+>/g, '')).trim();
+        const src = attrOf(img[0], 'src');
+        const alt = attrOf(img[0], 'alt');
+        const local = mediaFor(src) || src;
+        if (!/^(https?:\/\/|\/)/i.test(local)) return '';
+        let pic = `<img src="${escapeAttr(local)}" alt="${escapeAttr(alt)}">`;
+        if (link) {
+            const href = mediaFor(link[1]) || linkFor(link[1]) || link[1];
+            if (/^(https?:\/\/|\/)/i.test(href)) pic = `<a href="${escapeAttr(href)}">${pic}</a>`;
+        }
+        return hold(`<figure>${pic}${text ? `<figcaption>${escapeText(decodeBasic(text))}</figcaption>` : ''}</figure>`);
+    });
+
+    // [gallery ids="1,2,3" columns="3"]
+    s = s.replace(/\[gallery([^\]]*)\]/gi, (_m, attrText) => {
+        const attrs = shortcodeAttrs(attrText);
+        let ids = String(attrs.ids || attrs.include || '').split(',').map(x => Number.parseInt(x, 10)).filter(Number.isFinite);
+        if (!ids.length && ctx.attachmentsOf) ids = ctx.attachmentsOf(Number(attrs.id) || ctx.postId || 0);
+        const pics = ids.map(id => ctx.mediaById?.(id)).filter(Boolean).filter(m => /\.(jpe?g|png|gif|webp|avif|bmp)$/i.test(m.url));
+        if (!pics.length) { note('A gallery had no images that were imported.'); return ''; }
+        const cols = Math.min(6, Math.max(1, Number.parseInt(attrs.columns, 10) || 3));
+        const cells = pics.map(m => `[col]<img src="${escapeAttr(m.url)}" alt="${escapeAttr(m.alt || m.title || '')}">[/col]`).join('\n');
+        return hold(`[grid cols="${cols}" gap="2"]\n${cells}\n[/grid]`);
+    });
+
+    // [embed]url[/embed]
+    s = s.replace(/\[embed([^\]]*)\]([\s\S]*?)\[\/embed\]/gi, (_m, _a, url) => embedFor(url.replace(/<[^>]+>/g, '')) || '');
+    // [video mp4="..."][/video] / [video src="..."]
+    s = s.replace(/\[video([^\]]*)\](?:[\s\S]*?\[\/video\])?/gi, (_m, attrText) => {
+        const a = shortcodeAttrs(attrText);
+        const src = a.src || a.mp4 || a.webm || a.ogv || a.m4v || '';
+        return src ? videoSnippet(src) : '';
+    });
+    // [audio mp3="..."][/audio]
+    s = s.replace(/\[audio([^\]]*)\](?:[\s\S]*?\[\/audio\])?/gi, (_m, attrText) => {
+        const a = shortcodeAttrs(attrText);
+        const src = a.src || a.mp3 || a.ogg || a.wav || a.m4a || '';
+        return src ? audioSnippet(src) : '';
+    });
+    s = s.replace(/\[playlist[^\]]*\]/gi, () => { note('A media playlist was removed - rebuild it with [embed] or links.'); return ''; });
+    // A web address alone on a line - WordPress auto-embeds those.
+    s = s.replace(/^[ \t]*(https?:\/\/[^\s<>"]+)[ \t]*$/gm, (m, url) => {
+        try { if (VIDEO_HOST.test(new URL(url).hostname)) return embedFor(url); } catch { /* not a URL */ }
+        return m;
+    });
+
+    // A converted snippet alone on its line is a block of its own.
+    s = s.replace(/^[ \t]*(\uE000\d+\uE001)[ \t]*$/gm, '\n\n<p>$1</p>\n\n');
+    if (!gutenberg) s = autop(s);
+    s = sanitise(s);
+    s = rewriteAddresses(s, {mediaFor, linkFor});
+    // Every bracket left is text: escaped so no Domma shortcode can match it.
+    s = s.replace(/\[/g, '&#91;').replace(/\]/g, '&#93;');
+
+    const md = toMarkdown(s);
+    let body;
+    let format;
+    if (md !== null) {
+        body = md;
+        format = 'markdown';
+    } else {
+        body = htmlForMarkdown(s);
+        format = 'html';
+    }
+    body = body.replace(PH_RE, (_m, n) => snippets[Number(n)] ?? '').replace(/\n{3,}/g, '\n\n').trim();
+    return {body: body ? `${body}\n` : '', format, shortcodes, notes};
+}
+
+function attrOf(tag, name) {
+    const m = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, 'i').exec(tag);
+    return m ? decodeBasic(m[2] ?? m[3] ?? '') : '';
+}
+
+function decodeBasic(s) {
+    return String(s ?? '').replace(/&#0*39;|&apos;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+        .replace(/&#8217;/g, '’').replace(/&#8216;/g, '‘').replace(/&#8220;/g, '“').replace(/&#8221;/g, '”')
+        .replace(/&#8211;/g, '–').replace(/&#8212;/g, '—').replace(/&nbsp;/g, ' ').replace(/&amp;/g, '&');
+}
+
+/** href/src in sanitised HTML -> the new addresses. */
+export function rewriteAddresses(html, {mediaFor, linkFor}) {
+    return String(html).replace(/\s(href|src)="([^"]*)"/g, (m, attr, value) => {
+        const url = value.replace(/&amp;/g, '&');
+        const next = (attr === 'src' ? mediaFor(url) : (mediaFor(url) || linkFor(url)));
+        if (!next || next === url) return m;
+        return ` ${attr}="${next.replace(/&/g, '&amp;').replace(/"/g, '&quot;')}"`;
+    });
+}
+
+// ---- Clean HTML -> Markdown ----------------------------------------------
+
+const VOID = new Set(['br', 'img', 'hr']);
+const INLINE_OK = new Set(['strong', 'em', 'a', 'img', 'br', 'code', 'span']);
+
+/** Tokenise sanitised HTML (well-formed, double-quoted attributes) into a tree. */
+function tree(html) {
+    const root = {tag: '#root', attrs: {}, kids: []};
+    const stack = [root];
+    const re = /<(\/?)([a-z][a-z0-9]*)((?:\s+[a-z-]+="[^"]*")*)\s*\/?>/gi;
+    let at = 0;
+    let m;
+    while ((m = re.exec(html))) {
+        if (m.index > at) stack[stack.length - 1].kids.push({text: html.slice(at, m.index)});
+        at = re.lastIndex;
+        const tag = m[2].toLowerCase();
+        if (m[1]) {
+            // close: pop to the matching tag
+            for (let k = stack.length - 1; k > 0; k--) {
+                if (stack[k].tag === tag) { stack.length = k; break; }
+            }
+            continue;
+        }
+        const attrs = {};
+        for (const a of m[3].matchAll(/([a-z-]+)="([^"]*)"/gi)) attrs[a[1].toLowerCase()] = a[2];
+        const node = {tag, attrs, kids: []};
+        stack[stack.length - 1].kids.push(node);
+        if (!VOID.has(tag)) stack.push(node);
+    }
+    if (at < html.length) stack[stack.length - 1].kids.push({text: html.slice(at)});
+    return root;
+}
+
+const decodeHtml = (s) => String(s).replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#0*39;/g, "'")
+    .replace(/&#91;/g, '[').replace(/&#93;/g, ']').replace(/&nbsp;/g, ' ').replace(/&amp;/g, '&');
+
+/** Plain text -> Markdown text: specials escaped; brackets and angle brackets as entities. */
+function mdText(s) {
+    return decodeHtml(s).replace(/\s+/g, ' ')
+        .replace(/\\/g, '\\\\').replace(/([*_`])/g, '\\$1')
+        .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+        .replace(/\[/g, '&#91;').replace(/\]/g, '&#93;');
+}
+
+function mdUrl(u) {
+    // An encoded character in an address (&#106;avascript:) is left to the HTML path and its sanitiser.
+    if (/&#/.test(u)) throw new NotClean('encoded address');
+    const s = decodeHtml(u);
+    if (/^\s*[a-z][a-z0-9+.-]*:/i.test(s) && !/^\s*(https?|mailto|tel):/i.test(s)) throw new NotClean('scheme');
+    return s.replace(/ /g, '%20').replace(/\(/g, '%28').replace(/\)/g, '%29');
+}
+
+class NotClean extends Error {}
+
+function inline(nodes) {
+    let out = '';
+    for (const n of nodes) {
+        if ('text' in n) { out += mdText(n.text); continue; }
+        if (!INLINE_OK.has(n.tag)) throw new NotClean(n.tag);
+        if (n.tag === 'br') { out += '  \n'; continue; }
+        if (n.tag === 'img') {
+            const src = n.attrs.src || '';
+            if (!src) continue;
+            out += `![${mdText(n.attrs.alt || '').trim()}](${mdUrl(src)})`;
+            continue;
+        }
+        const inner = inline(n.kids);
+        if (n.tag === 'span') out += inner;
+        else if (n.tag === 'strong') out += inner.trim() ? `**${inner.trim()}**` : inner;
+        else if (n.tag === 'em') out += inner.trim() ? `*${inner.trim()}*` : inner;
+        else if (n.tag === 'code') {
+            const t = decodeHtml(n.kids.map(k => ('text' in k ? k.text : '')).join(''));
+            if (t.includes('`') || n.kids.some(k => !('text' in k))) throw new NotClean('code');
+            out += `\`${t}\``;
+        } else if (n.tag === 'a') {
+            if (!n.attrs.href) { out += inner; continue; }
+            out += `[${inner.trim() || mdText(n.attrs.href)}](${mdUrl(n.attrs.href)})`;
+        }
+    }
+    return out;
+}
+
+/** A line that would read as Markdown syntax at its start is escaped. */
+const guardLine = (line) => line.replace(/^(\s*)([#>+-]|=+|\d+\.)(\s|$)/, (_m, sp, mark, after) => `${sp}\\${mark}${after}`);
+
+function blocks(nodes, depth = 0) {
+    const out = [];
+    let loose = [];
+    const flush = () => {
+        if (!loose.length) return;
+        const text = inline(loose).trim();
+        if (text) out.push(guardLine(text));
+        loose = [];
+    };
+    for (const n of nodes) {
+        if ('text' in n || INLINE_OK.has(n.tag)) { loose.push(n); continue; }
+        flush();
+        const t = n.tag;
+        if (t === 'p') {
+            const text = inline(n.kids).trim().split('\n').map(l => l.replace(/^\s+/, '')).join('\n');
+            if (text) out.push(text.split('\n').map((l, k) => (k ? l : guardLine(l))).join('\n'));
+        } else if (/^h[1-6]$/.test(t)) {
+            const text = inline(n.kids).replace(/\s*\n\s*/g, ' ').trim();
+            if (text) out.push(`${'#'.repeat(Number(t[1]))} ${text}`);
+        } else if (t === 'ul' || t === 'ol') {
+            if (depth > 0) throw new NotClean('nested list');
+            let k = Number(n.attrs.start) || 1;
+            const lines = [];
+            for (const li of n.kids) {
+                if ('text' in li) { if (li.text.trim()) throw new NotClean('text in list'); continue; }
+                if (li.tag !== 'li') throw new NotClean('list child');
+                const text = inline(li.kids).replace(/\s*\n\s*/g, ' ').trim();
+                lines.push(`${t === 'ol' ? `${k++}.` : '-'} ${text}`);
+            }
+            if (lines.length) out.push(lines.join('\n'));
+        } else if (t === 'blockquote') {
+            if (depth > 0) throw new NotClean('nested quote');
+            const inner = blocks(n.kids, depth + 1);
+            if (inner.trim()) out.push(inner.split('\n').map(l => (l ? `> ${l}` : '>')).join('\n'));
+        } else if (t === 'div') {
+            // Attribute-less after sanitising: only a wrapper (Gutenberg's groups and columns).
+            const inner = blocks(n.kids, depth);
+            if (inner.trim()) out.push(inner);
+        } else if (t === 'figure') {
+            const img = n.kids.find(k => k.tag === 'img') || n.kids.find(k => k.tag === 'a' && k.kids.some(x => x.tag === 'img'));
+            const cap = n.kids.find(k => k.tag === 'figcaption');
+            if (!img || n.kids.some(k => k !== img && k !== cap && !('text' in k && !k.text.trim()))) throw new NotClean('figure');
+            const pic = inline([img]).trim();
+            const text = cap ? inline(cap.kids).replace(/\s*\n\s*/g, ' ').trim() : '';
+            out.push(text ? `${pic}  \n*${text}*` : pic);
+        } else if (t === 'hr') {
+            out.push('---');
+        } else if (t === 'pre') {
+            const kids = n.kids.length === 1 && n.kids[0].tag === 'code' ? n.kids[0].kids : n.kids;
+            if (kids.some(k => !('text' in k))) throw new NotClean('pre');
+            const code = decodeHtml(kids.map(k => k.text).join('')).replace(/^\n/, '').replace(/\s+$/, '');
+            if (code.includes('```')) throw new NotClean('pre');
+            out.push(`\`\`\`\n${code}\n\`\`\``);
+        } else {
+            throw new NotClean(t);
+        }
+    }
+    flush();
+    return out.join('\n\n');
+}
+
+/**
+ * Sanitised HTML as Markdown, or null when it is richer than Markdown can say
+ * (tables, figures, nested lists, spans, divs, …).
+ *
+ * @param {string} html
+ * @returns {string|null}
+ */
+export function toMarkdown(html) {
+    try {
+        return blocks(tree(String(html || '')).kids);
+    } catch (err) {
+        if (err instanceof NotClean) return null;
+        throw err;
+    }
+}
+
+/**
+ * HTML kept in a Markdown body: no blank lines inside it (a blank line ends an
+ * HTML block in Markdown and turns what follows into Markdown - indented lines
+ * into code), newlines in <pre> kept as character references. Snippets held
+ * as placeholders go on lines of their own.
+ */
+export function htmlForMarkdown(html) {
+    const s = String(html || '')
+        .replace(/<pre\b[\s\S]*?<\/pre>/gi, (m) => m.replace(/\n/g, '&#10;'))
+        .replace(/<p>\s*(\d+)\s*<\/p>/g, '\n\n$1\n\n');
+    return s.split(/\n\n/).map(part => part.split('\n').map(l => l.trim()).filter(Boolean).join('\n')).filter(Boolean).join('\n\n');
+}