flea-qml 0.0.0-stage → 0.1.0

package/test/markdown-html.test.js

@@ -0,0 +1,105 @@
+import { test, expect, afterAll } from "bun:test";
+import { mkdtempSync, writeFileSync, mkdirSync, symlinkSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { markdownPage, cleanHtml, holdFormulas, linkAllowed, pageStyle, markdownHtml, MARKDOWN_LIMIT } from "../src/markdown-html.js";
+
+const root = mkdtempSync(join(tmpdir(), "flea-md-html-"));
+const docs = join(root, "docs");
+mkdirSync(docs);
+// A 1x1 PNG.
+const PNG = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==", "base64");
+writeFileSync(join(docs, "pic.png"), PNG);
+writeFileSync(join(root, "secret.png"), PNG);
+symlinkSync(join(root, "secret.png"), join(docs, "link.png"));
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+const body = (markdown) => markdownPage(markdown, docs).replace(/^[\s\S]*?<\/style>/, "");
+
+test("Markdown becomes headings, lists, tables, code and task boxes", () => {
+  const html = body("# Title\n\n- **bold** and *it*\n- `code`\n\n| a | b |\n|---|---|\n| 1 | 2 |\n\n```js\nlet x = 1 < 2;\n```\n\n- [x] done\n- [ ] todo\n");
+  expect(html).toContain("<h1>Title</h1>");
+  expect(html).toContain("<strong>bold</strong>");
+  expect(html).toContain("<table>");
+  expect(html).toContain("let x = 1 &lt; 2;");
+  expect(html).toContain('<input checked type="checkbox" disabled>');
+  expect(html).not.toMatch(/<script|<style(?![^]*<\/style>[^]*$)/);
+});
+
+test("TeX in $…$ and $$…$$ and raw MathML become formulas; code and prices stay text", () => {
+  const html = body("Inline $x^2$ and\n\n$$\\frac{a}{b}$$\n\n<math><mi>y</mi></math>\n\n`$not$` costs $5 and $10\n\n```\n$also not$\n```\n");
+  expect((html.match(/<math/g) ?? []).length).toBe(3);
+  expect(html).toContain('<math display="block">');
+  expect(html).toContain("<code>$not$</code>");
+  expect(html).toContain("costs $5 and $10");
+  expect(html).toContain("$also not$");
+});
+
+test("a formula that fails is shown as its source, escaped", () => {
+  const html = body("Bad $\\frac{1}{$ and <math><mi title=x>a</mi></math>");
+  expect(html).toContain('<code class="formula-source">$\\frac{1}{$</code>');
+  expect(html).toContain("&lt;math&gt;&lt;mi title=x&gt;a&lt;/mi&gt;&lt;/math&gt;");
+});
+
+test("active content, raw-text elements and foreign markup never survive", () => {
+  const attacks = [
+    "<script>alert(1)</script>", "<style>body{background:url(http://x)}</style>", "<iframe src=x></iframe>",
+    "<textarea><img src=x onerror=alert(1)></textarea>", "<title><script>alert(1)</script></title>",
+    "<svg><script>alert(1)</script></svg>", "<object data=x></object>", "<embed src=x>",
+    "<noscript><img src=x onerror=alert(1)></noscript>", "<xmp><img src=x onerror=alert(1)></xmp>",
+  ];
+  for (const attack of attacks) {
+    const html = body(`before\n\n${attack}\n\nafter`);
+    expect(html).not.toMatch(/<(script|style|iframe|object|embed|svg|img|textarea|title|xmp|noscript)[\s>]/i);
+    expect(html).toContain("after");
+  }
+});
+
+test("only the allowed attributes stay; links keep http, https, mailto and relative targets", () => {
+  const html = body('<p align="center" onclick="alert(1)" style="color:red" class="c" id="i">x</p>\n\n' +
+    '[ok](https://example.com) [mail](mailto:a@b.c) [rel](other.md) [js](javascript:alert(1)) <a href="jav&#x61;script:alert(1)">e</a> <a href="data:text/html,x">d</a>');
+  expect(html).toContain('<p align="center">x</p>');
+  expect(html).not.toMatch(/onclick|style=|class="c"|id="i"/);
+  expect(html).toContain('href="https://example.com"');
+  expect(html).toContain('href="mailto:a@b.c"');
+  expect(html).toContain('href="other.md"');
+  expect(html).not.toMatch(/javascript|jav&|data:text/i);
+  for (const [target, allowed] of [["https://x", true], ["#top", true], ["a/b.md", true], ["JaVaScRiPt:x", false],
+    ["java\tscript:x", false], ["%6Aavascript:x", false], ["vbscript:x", false], ["file:///etc/passwd", false]])
+    expect(linkAllowed(target)).toBe(allowed);
+});
+
+test("pictures: inside the folder embedded, remote ones named, escapes dropped", () => {
+  const html = body("![a](pic.png) ![r](https://img.shields.io/badge/x.svg) ![up](../secret.png) ![abs](/etc/passwd.png) ![ln](link.png) ![d](data:image/png;base64,AAAA)");
+  expect(html).toMatch(/<img alt="a" src="data:image\/png;base64,[A-Za-z0-9+/=]+">/);
+  expect(html).toContain('<span class="remote">Remote image not loaded · img.shields.io</span>');
+  // Outside the folder (by .., by absolute path or through a symbolic link) and data: are not loaded.
+  expect((html.match(/<img/g) ?? []).length).toBe(1);
+  for (const alt of ["up", "abs", "ln", "d"]) expect(html).toContain(`<span class="alt">${alt}</span>`);
+});
+
+test("the theme only accepts #rrggbb colours", () => {
+  const style = pageStyle({ foreground: "red;}</style><script>alert(1)</script>", background: "#101010", bodyPx: "99" });
+  expect(style).not.toContain("script");
+  expect(style).toContain("background:#101010");
+  expect(style).toContain("font:40px");
+});
+
+test("formula markers in the source are neutralised and text never becomes markup", () => {
+  const { text, formulas } = holdFormulas("0 and $x$");
+  expect(formulas.length).toBe(1);
+  expect(text.startsWith("�0�")).toBe(true);
+  expect(cleanHtml("<p>a &lt;b&gt; c</p>", docs)).toBe("<p>a &lt;b&gt; c</p>");
+});
+
+test("the backend answer reads the file and refuses one over the limit", async () => {
+  const path = join(docs, "note.md");
+  writeFileSync(path, "# Note\n\n$x$\n");
+  const ready = await markdownHtml({ path, slot: "look", token: 3, theme: {} });
+  expect(ready).toMatchObject({ t: "markdownhtml", slot: "look", token: 3, state: "ready" });
+  expect(ready.html.startsWith("<!doctype html>")).toBe(true);
+  expect(ready.html).toContain("<math>");
+  const big = join(docs, "big.md");
+  writeFileSync(big, "x".repeat(MARKDOWN_LIMIT + 1));
+  expect((await markdownHtml({ path: big, token: 4 })).state).toBe("failed");
+  expect((await markdownHtml({ path: join(docs, "missing.md"), token: 5 })).state).toBe("failed");
+});

package/test/mathml.test.js

@@ -0,0 +1,92 @@
+import { test, expect } from "bun:test";
+import { texToMathML, cleanMathML, cleanStyle, length, MATH_LIMIT } from "../src/mathml.js";
+
+const ELEMENT = /<\/?([a-z][a-z0-9-]*)/g;
+// Every element and attribute name in some cleaned markup.
+const names = (html) => ({
+  elements: [...new Set([...html.matchAll(ELEMENT)].map((match) => match[1]))],
+  attributes: [...new Set([...html.matchAll(/\s([a-z-]+)="/g)].map((match) => match[1]))],
+});
+const ALLOWED_ELEMENTS = new Set(("math mrow mi mn mo ms mtext mspace mfrac msqrt mroot msub msup msubsup munder mover " +
+  "munderover mmultiscripts mprescripts none mtable mtr mtd mstyle mpadded mphantom menclose merror semantics").split(" "));
+const ALLOWED_ATTRIBUTES = new Set(("display displaystyle scriptlevel mathvariant form stretchy symmetric largeop movablelimits " +
+  "fence separator accent accentunder lspace rspace width height depth voffset minsize maxsize linethickness style").split(" "));
+const onlyAllowed = (html) => {
+  const found = names(html);
+  expect(found.elements.filter((name) => !ALLOWED_ELEMENTS.has(name))).toEqual([]);
+  expect(found.attributes.filter((name) => !ALLOWED_ATTRIBUTES.has(name))).toEqual([]);
+};
+
+test("a formula becomes one math element of MathML Core elements", () => {
+  const html = texToMathML("x=\\frac{-b\\pm\\sqrt{b^2-4ac}}{2a}", true);
+  expect(html.startsWith('<math display="block">')).toBe(true);
+  expect(html.endsWith("</math>")).toBe(true);
+  expect(html).toContain("<mfrac>");
+  expect(html).toContain("<msqrt>");
+  onlyAllowed(html);
+  for (const tex of ["\\begin{pmatrix}a&b\\\\c&d\\end{pmatrix}", "\\sum_{i=1}^n i", "\\boxed{E=mc^2}", "\\overbrace{a+b}^{n}", "\\hat x\\vec v", "\\text{中文 and emoji 😀}"])
+    onlyAllowed(texToMathML(tex, true));
+});
+
+test("trust is off: links, URLs, images and HTML commands stay text", () => {
+  for (const tex of ["\\href{javascript:alert(1)}{x}", "\\url{http://example.com}", "\\includegraphics{http://example.com/a.png}",
+    "\\htmlClass{x}{y}", "\\htmlStyle{background:url(http://x)}{y}", "\\htmlData{a=b}{y}", "\\htmlId{x}{y}"]) {
+    let html;
+    try { html = texToMathML(tex); } catch { continue; } // a refused command is an error, which is also safe
+    onlyAllowed(html);
+    // The command's name and argument may show as text; no attribute carries them.
+    expect(html).not.toMatch(/\s(?:href|src)="|url\(/i);
+  }
+});
+
+test("markup typed into TeX never becomes markup", () => {
+  for (const tex of ["\\text{<script>alert(1)</script>}", "\\text{</math><img src=x onerror=alert(1)>}", "\\mathrm{<b>x</b>}", "x<y>z"]) {
+    let html;
+    try { html = texToMathML(tex); } catch { continue; }
+    onlyAllowed(html);
+    // Typed markup survives only as escaped text.
+    expect(html).not.toMatch(/<(?:script|img|b)[\s>]/i);
+  }
+});
+
+test("runaway macros, huge sizes and long sources are refused", () => {
+  expect(() => texToMathML("\\def\\a{\\a\\a}\\a")).toThrow();
+  expect(() => texToMathML("x".repeat(MATH_LIMIT + 1))).toThrow();
+  const sized = texToMathML("\\rule{1000em}{1000em}\\kern{1000em}");
+  for (const [, value] of sized.matchAll(/(?:width|height|depth|lspace|rspace)="([^"]*)"/g)) expect(length(value)).toBe(true);
+});
+
+test("a TeX error is not turned into markup: the caller shows the source instead", () => {
+  expect(() => texToMathML("\\frac{1}{")).toThrow();
+  expect(() => texToMathML("\\text{a & b}")).toThrow();
+});
+
+test("the allowlist drops foreign content, handlers, links and unknown attributes", () => {
+  const html = cleanMathML('<math><mi onclick="alert(1)" href="x" title="t" class="c">a</mi><mtext>t<img src="x" onerror="alert(1)">u</img></mtext>' +
+    '<svg><script>alert(1)</script></svg><annotation-xml encoding="text/html"><b>x</b></annotation-xml><mo stretchy="maybe" form="infix">+</mo></math>');
+  expect(html).toBe('<math><mi>a</mi><mtext>t</mtext><mo form="infix">+</mo></math>');
+});
+
+test("style keeps colours and box spacing only", () => {
+  expect(cleanStyle("color:#ff0000;padding:3pt;border:1px solid;background:url(http://x);position:fixed;margin-left:-0.1667em")).toBe(
+    "color:#ff0000;padding:3pt;border:1px solid;margin-left:-0.1667em");
+  expect(cleanStyle("color:expression(alert(1));padding:1e9em;color:red")).toBe("");
+  expect(cleanStyle("padding:-1em;border:1px solid url(x)")).toBe("");
+});
+
+test("only strict, balanced markup with exactly one math root is accepted", () => {
+  for (const bad of ["<math><mi>a<!-- x --></mi></math>", "<math><mi title=a>a</mi></math>", "<math><mi>a</mo></math>",
+    "<math><mi>a</mi>", "<math><mi>a</mi></math><math><mi>b</mi></math>", "<p><math><mi>x</mi></math></p>", "<math><![CDATA[x]]></math>"])
+    expect(() => cleanMathML(bad)).toThrow();
+});
+
+test("text keeps entities as text and escapes stray ampersands and brackets", () => {
+  expect(cleanMathML("<math><mtext>&lt;b&gt; &amp;bogus; & x > y</mtext></math>")).toBe("<math><mtext>&lt;b&gt; &amp;bogus; &amp; x &gt; y</mtext></math>");
+});
+
+test("nesting past the depth limit is dropped", () => {
+  const deep = "<math>" + "<mrow>".repeat(80) + "<mi>x</mi>" + "</mrow>".repeat(80) + "</math>";
+  const html = cleanMathML(deep);
+  expect((html.match(/<mrow>/g) ?? []).length).toBe(63);
+  expect(html).not.toContain("<mi>");
+});

package/test/menu-transfer.test.js

@@ -0,0 +1,57 @@
+import { test, expect, afterAll } from 'bun:test';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { menuaction, capturedPaths } from '../src/menu.js';
+import { collisions, transfer } from '../src/transfer.js';
+const dir=mkdtempSync(join(tmpdir(),'flea-menu-'));afterAll(()=>rmSync(dir,{recursive:true,force:true}));
+let serial=0;
+function setup() {
+ const id=++serial, root=join(dir,String(id));mkdirSync(root);
+ const src=join(root,'source'),dest=join(root,'dest');mkdirSync(src);mkdirSync(dest);
+ const path=join(src,'hello');writeFileSync(path,'original');
+ const messages=[],send=m=>messages.push(m),listing={path:src,rows:[{name:'hello'}]};
+ menuaction({id,op:'snapshot',rows:[0],cursor:0},send,listing,1);
+ return {id,path,src,dest,messages,send,listing};
+}
+async function done(s, request) {
+ transfer(request,s.send,s.listing,1);
+ for(let i=0;i<200;i++) {const result=s.messages.find(m=>m.t==='transferdone');if(result)return result; await Bun.sleep(5);}
+ throw Error('transfer did not complete: '+JSON.stringify(s.messages));
+}
+test('Copy to survives menu close',async()=>{
+ const s=setup();collisions({id:20,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ const result=await done(s,{menuId:s.id,collideId:20,dest:s.dest,op:'copy',collide:'refuse'});
+ expect(result.ok).toBe(1);expect(readFileSync(join(s.dest,'hello'),'utf8')).toBe('original');
+});
+test('reject source replaced after collision question',async()=>{
+ const s=setup();collisions({id:21,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ renameSync(s.path,s.path+'.old');writeFileSync(s.path,'replacement');
+ expect((await done(s,{menuId:s.id,collideId:21,dest:s.dest,op:'copy'})).failed).toBe(1);
+});
+test('question cannot authorize another destination or be reused',()=>{
+ const s=setup();collisions({id:22,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ transfer({menuId:s.id,collideId:22,dest:s.src},s.send,s.listing,1);
+ expect(s.messages.at(-1).t).toBe('error');
+ transfer({menuId:s.id,collideId:22,dest:s.dest},s.send,s.listing,1);
+ expect(s.messages.at(-1).t).toBe('error');
+});
+test('invalid repeated snapshot clears old identity and refuses missing rows',()=>{
+ const s=setup();menuaction({id:s.id,op:'snapshot',rows:[0,99]},s.send,s.listing,1);
+ expect(s.messages.at(-1).ok).toBe(false);expect(capturedPaths(s.id)).toBeNull();
+});
+test('cursor outside selection also retains identity',()=>{
+ const s=setup(),cursor=join(s.src,'cursor');writeFileSync(cursor,'cursor');
+ menuaction({id:s.id,op:'snapshot',paths:[s.path],cursorPath:cursor},s.send,s.listing,1);
+ renameSync(cursor,cursor+'.old');writeFileSync(cursor,'replacement');
+ menuaction({id:s.id,op:'activate',action:'sharelink'},s.send,s.listing,1);
+ expect(s.messages.at(-1).ok).toBe(false);
+});
+test('keyboard menuId zero copies without a menu snapshot',async()=>{
+ const s=setup();collisions({id:99,menuId:0,rows:[0],dest:s.dest},s.send,s.listing,1);
+ const result=await done(s,{menuId:0,collideId:99,rows:[0],dest:s.dest,op:'copy',collide:'refuse'});
+ expect(result.ok).toBe(1);expect(readFileSync(join(s.dest,'hello'),'utf8')).toBe('original');
+});

package/test/office-preview.test.js

@@ -0,0 +1,154 @@
+import { test, expect, afterAll } from 'bun:test';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { deflateRawSync } from 'node:zlib';
+import { officeKind, officePreview } from '../src/office.js';
+import { html, previewHtml } from '../src/html.js';
+import { code } from '../src/code.js';
+
+const dir = mkdtempSync(join(tmpdir(), 'flea-office-'));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+// A zip of the given members, deflated unless `store`; CRCs are zero because nothing here checks them.
+function zip(members, store = false) {
+  const locals = [], centrals = [];
+  let offset = 0;
+  for (const [name, content] of Object.entries(members)) {
+    const raw = Buffer.from(content), data = store ? raw : deflateRawSync(raw), id = Buffer.from(name);
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0); local.writeUInt16LE(20, 4); local.writeUInt16LE(store ? 0 : 8, 8);
+    local.writeUInt32LE(data.length, 18); local.writeUInt32LE(raw.length, 22); local.writeUInt16LE(id.length, 26);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0); central.writeUInt16LE(20, 4); central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(store ? 0 : 8, 10); central.writeUInt32LE(data.length, 20); central.writeUInt32LE(raw.length, 24);
+    central.writeUInt16LE(id.length, 28); central.writeUInt32LE(offset, 42);
+    locals.push(local, id, data); centrals.push(central, id);
+    offset += 30 + id.length + data.length;
+  }
+  const directory = Buffer.concat(centrals), end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0); end.writeUInt16LE(Object.keys(members).length, 8); end.writeUInt16LE(Object.keys(members).length, 10);
+  end.writeUInt32LE(directory.length, 12); end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, directory, end]);
+}
+const file = (name, bytes) => { const path = join(dir, name); writeFileSync(path, bytes); return path; };
+
+const W = 'xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"';
+const docx = {
+  'word/styles.xml': `<w:styles ${W}><w:style w:type="paragraph" w:styleId="Kop1"><w:name w:val="heading 1"/></w:style><w:style w:type="paragraph" w:styleId="T"><w:name w:val="Title"/></w:style></w:styles>`,
+  'word/numbering.xml': `<w:numbering ${W}><w:abstractNum w:abstractNumId="0"><w:lvl w:ilvl="0"><w:numFmt w:val="bullet"/></w:lvl></w:abstractNum><w:abstractNum w:abstractNumId="1"><w:lvl w:ilvl="0"><w:numFmt w:val="decimal"/></w:lvl></w:abstractNum><w:num w:numId="1"><w:abstractNumId w:val="0"/></w:num><w:num w:numId="2"><w:abstractNumId w:val="1"/></w:num></w:numbering>`,
+  'word/document.xml': `<?xml version="1.0"?><w:document ${W}><w:body>
+    <w:p><w:pPr><w:pStyle w:val="Kop1"/><w:rPr><w:b/></w:rPr></w:pPr><w:r><w:t>Report &amp; plan</w:t></w:r></w:p>
+    <w:p><w:r><w:t xml:space="preserve">Plain </w:t></w:r><w:r><w:rPr><w:b/><w:i w:val="0"/></w:rPr><w:t>bold</w:t></w:r><w:r><w:rPr><w:i/><w:u w:val="single"/></w:rPr><w:t> a&lt;b</w:t></w:r><w:r><w:rPr><w:vertAlign w:val="superscript"/></w:rPr><w:t>2</w:t></w:r></w:p>
+    <w:p><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="1"/></w:numPr></w:pPr><w:r><w:t>one</w:t></w:r></w:p>
+    <w:p><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="1"/></w:numPr></w:pPr><w:r><w:t>two</w:t></w:r></w:p>
+    <w:p><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="2"/></w:numPr></w:pPr><w:r><w:t>first</w:t></w:r></w:p>
+    <w:tbl><w:tr><w:tc><w:p><w:r><w:t>A1</w:t></w:r></w:p><w:p><w:r><w:t>line</w:t></w:r></w:p></w:tc><w:tc><w:p><w:r><w:t>B1</w:t></w:r></w:p></w:tc></w:tr></w:tbl>
+    <w:p><w:r><w:t>kept</w:t></w:r><w:del><w:r><w:delText>removed</w:delText></w:r></w:del><w:r><w:instrText>PAGE</w:instrText></w:r><w:r><w:br/><w:t>next</w:t><w:tab/><w:t>col</w:t></w:r></w:p>
+    <w:p/>
+  </w:body></w:document>`,
+};
+
+test('office names are told apart by extension', () => {
+  expect(['a.DOCX', 'b.odt', 'c.pptx', 'd.odp', 'e.xlsx', 'f.ods', 'g.doc', 'h.zip', 'docx'].map(officeKind))
+    .toEqual(['document', 'document', 'slides', 'slides', 'sheet', 'sheet', '', '', '']);
+});
+
+test('DOCX becomes headings, emphasis, lists and tables in the fixed tags', () => {
+  const preview = officePreview(file('rich.docx', zip(docx)));
+  expect(preview.listed).toBe(false);
+  expect(preview.html).toBe('<h1>Report &amp; plan</h1><p>Plain <b>bold</b><u><i> a&lt;b</i></u><sup>2</sup></p>'
+    + '<ul><li>one</li><li>two</li></ul><ol><li>first</li></ol>'
+    + '<table><tr><td>A1<br>line</td><td>B1</td></tr></table>'
+    + '<p>kept<br>next&nbsp;&nbsp;&nbsp;&nbsp;col</p>');
+  // The fragment survives the HTML preview's own rebuild unchanged, so every tag is one it keeps.
+  expect(previewHtml(preview.html)).toBe(preview.html);
+  expect(preview.text).toBe('Report & plan\nPlain bold a<b2\none\ntwo\nfirst\nA1\nline\tB1\n\nkept\nnext    col\n');
+});
+
+test('the html and code requests answer a DOCX from its text, stored or deflated', async () => {
+  const path = file('stored.docx', zip(docx, true));
+  expect(await html({ path, token: 3, slot: 'column' })).toMatchObject({ state: 'ready', token: 3, total: 9, html: officePreview(path).html });
+  const reply = await code({ path, first: 1, count: 2 });
+  expect(reply).toMatchObject({ state: 'plain', total: 10, lines: [[0, 'Report & plan'], [0, 'Plain bold a<b2']] });
+});
+
+test('PPTX slides follow the presentation order, with titles and tables', () => {
+  const slide = (title, body) => `<p:sld><p:sp><p:nvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:txBody><a:p><a:r><a:t>${title}</a:t></a:r></a:p></p:txBody></p:sp>`
+    + `<p:sp><p:nvSpPr><p:nvPr><p:ph idx="1"/></p:nvPr></p:nvSpPr><p:txBody><a:p><a:r><a:rPr b="1"/><a:t>${body}</a:t></a:r><a:br/><a:r><a:t>more</a:t></a:r></a:p></p:txBody></p:sp></p:sld>`;
+  const preview = officePreview(file('deck.pptx', zip({
+    'ppt/presentation.xml': '<p:presentation><p:sldIdLst><p:sldId id="1" r:id="rId2"/><p:sldId id="2" r:id="rId1"/></p:sldIdLst></p:presentation>',
+    'ppt/_rels/presentation.xml.rels': '<Relationships><Relationship Id="rId1" Target="slides/slide1.xml"/><Relationship Id="rId2" Target="slides/slide2.xml"/></Relationships>',
+    'ppt/slides/slide1.xml': slide('Second', 'b'),
+    'ppt/slides/slide2.xml': slide('First', 'a'),
+  })));
+  expect(preview.html).toBe('<h2>Slide 1</h2><h3>First</h3><p><b>a</b><br>more</p><h2>Slide 2</h2><h3>Second</h3><p><b>b</b><br>more</p>');
+});
+
+test('ODT reads headings, styled spans, lists and tables, without tracked changes or notes', () => {
+  const preview = officePreview(file('text.odt', zip({ 'content.xml': `<office:document-content>
+    <office:automatic-styles><style:style style:name="T1" style:family="text"><style:text-properties fo:font-weight="bold" fo:font-style="italic"/></style:style></office:automatic-styles>
+    <office:body><office:text><text:tracked-changes><text:p>gone</text:p></text:tracked-changes>
+    <text:h text:outline-level="2">Head</text:h>
+    <text:p>a<text:span text:style-name="T1">b</text:span><text:s text:c="2"/>c<text:note><text:p>foot</text:p></text:note><text:line-break/>d</text:p>
+    <text:list><text:list-item><text:p>x</text:p></text:list-item><text:list-item><text:p>y</text:p></text:list-item></text:list>
+    <table:table><table:table-row><table:table-cell><text:p>1</text:p></table:table-cell><table:table-cell><text:p>2</text:p></table:table-cell></table:table-row></table:table>
+    </office:text></office:body></office:document-content>` })));
+  expect(preview.html).toBe('<h2>Head</h2><p>a<i><b>b</b></i>&nbsp;&nbsp;c<br>d</p><ul><li>x</li><li>y</li></ul><table><tr><td>1</td><td>2</td></tr></table>');
+});
+
+test('XLSX answers its first sheet as CSV: shared strings, dates, booleans, gaps and quoting', async () => {
+  const path = file('book.xlsx', zip({
+    'xl/workbook.xml': '<workbook><sheets><sheet name="Second" sheetId="2" r:id="rId2"/><sheet name="Other" sheetId="1" r:id="rId1"/></sheets></workbook>',
+    'xl/_rels/workbook.xml.rels': '<Relationships><Relationship Id="rId1" Target="worksheets/sheet1.xml"/><Relationship Id="rId2" Target="/xl/worksheets/sheet2.xml"/></Relationships>',
+    'xl/sharedStrings.xml': '<sst><si><t>Name</t></si><si><r><t>Say </t></r><r><t>"hi", ok</t></r><rPh><t>skip</t></rPh></si></sst>',
+    'xl/styles.xml': '<styleSheet><numFmts><numFmt numFmtId="164" formatCode="yyyy\\-mm\\-dd"/></numFmts><cellStyleXfs><xf numFmtId="14"/></cellStyleXfs><cellXfs><xf numFmtId="0"/><xf numFmtId="164"/><xf numFmtId="20"/></cellXfs></styleSheet>',
+    'xl/worksheets/sheet1.xml': '<worksheet><sheetData><row r="1"><c r="A1"><v>wrong sheet</v></c></row></sheetData></worksheet>',
+    'xl/worksheets/sheet2.xml': '<worksheet><sheetData>'
+      + '<row r="1"><c r="A1" t="s"><v>0</v></c><c r="C1" t="inlineStr"><is><t>When</t></is></c></row>'
+      + '<row r="2"><c r="A2" t="s"><v>1</v></c><c r="B2"><v>1.50</v></c><c r="C2" s="1"><v>45000</v></c><c r="D2" t="b"><v>1</v></c><c r="E2" s="2"><v>0.5</v></c></row>'
+      + '<row r="4"><c r="B4" t="str"><f>A1</f><v>calc</v></c></row>'
+      + '</sheetData></worksheet>',
+  }));
+  const preview = officePreview(path);
+  expect(preview.csv).toBe('Name,,When\n"Say ""hi"", ok",1.5,2023-03-15,TRUE,12:00:00\n\n,calc\n[Sheet 1 of 2: Second. The other sheets are not shown.]\n');
+  // The table asks by record; the quoted record and the count come back whole.
+  expect(await code({ path, raw: true, csv: ',', record: 2, count: 1 })).toMatchObject({ first: 2, records: 5, firstRecord: 2, lines: [[0, '"Say ""hi"", ok",1.5,2023-03-15,TRUE,12:00:00']] });
+});
+
+test('ODS repeats filled cells and ignores the padding to the sheet edge', () => {
+  const preview = officePreview(file('sheet.ods', zip({ 'content.xml': `<office:document-content><office:body><office:spreadsheet>
+    <table:table table:name="S"><table:table-row><table:table-cell table:number-columns-repeated="2"><text:p>x</text:p></table:table-cell><table:table-cell table:number-columns-repeated="16382"/></table:table-row>
+    <table:table-row table:number-rows-repeated="2"><table:table-cell/></table:table-row>
+    <table:table-row><table:table-cell/><table:table-cell><text:p>a, b</text:p><text:p>c</text:p></table:table-cell></table:table-row>
+    <table:table-row table:number-rows-repeated="1048570"><table:table-cell table:number-columns-repeated="16384"/></table:table-row></table:table>
+    </office:spreadsheet></office:body></office:document-content>` })));
+  expect(preview.csv).toBe('x,x\n\n\n,"a, b\nc"\n');
+});
+
+test('a container with no readable content lists its members, and a non-zip is refused', async () => {
+  const empty = officePreview(file('empty.docx', zip({ '[Content_Types].xml': '<Types/>', 'word/other.xml': '<x/>' })));
+  expect(empty).toMatchObject({ listed: true, html: '<p>No readable text in this document. It contains:</p><ul><li>[Content_Types].xml</li><li>word/other.xml</li></ul>' });
+  const sheet = officePreview(file('empty.xlsx', zip({ 'a&b.bin': 'xyz' })));
+  expect(sheet).toMatchObject({ listed: true, csv: 'Member,Bytes\na&b.bin,3\n' });
+  const legacy = file('legacy.docx', Buffer.from('\xd0\xcf\x11\xe0 not a zip', 'latin1'));
+  expect(() => officePreview(legacy)).toThrow();
+  expect((await html({ path: legacy, token: 1, slot: 'x' })).state).toBe('failed');
+  expect((await code({ path: legacy })).state).toBe('failed');
+});
+
+test('hostile XML is neither expanded nor passed through', () => {
+  const bomb = officePreview(file('bomb.docx', zip({ 'word/document.xml': '<!DOCTYPE d [<!ENTITY a "aaaa">]><w:document><w:body><w:p><w:r><w:t>&a;</w:t></w:r></w:p></w:body></w:document>' })));
+  expect(bomb.listed).toBe(true);
+  const markup = officePreview(file('markup.docx', zip({ 'word/document.xml': '<w:document><w:body><w:p><w:r><w:t>&lt;script&gt;x&lt;/script&gt; &#60;img&#62; &amp;amp;</w:t></w:r></w:p></w:body></w:document>' })));
+  expect(markup.html).toBe('<p>&lt;script&gt;x&lt;/script&gt; &lt;img&gt; &amp;amp;</p>');
+  expect(previewHtml(markup.html)).toBe(markup.html);
+});
+
+test('a long document stops at the output limit with balanced tags', () => {
+  const paragraph = `<w:p><w:r><w:t>${'word '.repeat(200)}</w:t></w:r></w:p>`;
+  const preview = officePreview(file('long.docx', zip({ 'word/document.xml': `<w:document><w:body>${paragraph.repeat(2000)}</w:body></w:document>` })));
+  expect(preview.html.length).toBeLessThan(1 << 20);
+  expect(preview.html.endsWith('<p>[Preview truncated]</p>')).toBe(true);
+  expect(previewHtml(preview.html)).toBe(preview.html);
+});

package/test/pele-parity.test.js

@@ -0,0 +1,28 @@
+import {expect, test} from 'bun:test';
+import {mermaidToSvg} from '../src/pele-wrapper.js';
+import fixtures from './fixtures/pele-parity.json';
+
+// Baseline: the former Flea bundle (SHA-256
+// 6030688a4dc97db8eee282af325343a8de1ae300f862a6f5c9d9175d40c8b765).
+// Store only inputs and output hashes, not a second copy of the renderer.
+// 33 inputs come from Flea's tests/fixtures/markdown-mermaid at 5da918109:
+// Flea/Pele/Mermaid MIT examples; see THIRD-PARTY-NOTICES.md.
+for (const entry of fixtures.cases) {
+  test(`Pele preserves legacy output: ${entry.name}`, () => {
+    for (const [index, theme] of fixtures.themes.entries()) {
+      const expected = entry.results[index];
+      if (expected.error) {
+        let error;
+        try {mermaidToSvg(entry.source, theme);} catch (e) {error = e.message;}
+        expect(error).toBe(expected.error);
+      } else {
+        const svg = mermaidToSvg(entry.source, theme);
+        expect(new Bun.CryptoHasher('sha256').update(svg).digest('hex')).toBe(expected.sha256);
+      }
+    }
+  });
+}
+test('Pele is the unmodified official 1.6.0 ESM distribution', async () => {
+  const bytes = await Bun.file(new URL('../src/vendor/pele.js', import.meta.url)).arrayBuffer();
+  expect(new Bun.CryptoHasher('sha256').update(bytes).digest('hex')).toBe('d1ebc1889f3069d7759fe5db34c4ad4b4823285edbee2b537d0ef3d505a76d8d');
+});

package/test/places.test.js

@@ -0,0 +1,134 @@
+import { test, expect, beforeEach, afterEach } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, posix, win32 } from "node:path";
+import { appPackage, places, probePlaces, rootNames, userDirs } from "../src/places.js";
+
+let root, home;
+// Nothing of the machine running the tests is read: every source is named here.
+const quiet = (extra = {}) => ({ home, env: {}, android: false, temps: [], roots: [], mounts: [], ...extra });
+const folder = (...parts) => {
+  const path = join(root, ...parts);
+  mkdirSync(path, { recursive: true });
+  return path;
+};
+const file = (...parts) => {
+  folder(...parts.slice(0, -1));
+  writeFileSync(join(root, ...parts), "x");
+};
+const labels = (rows) => rows.map((row) => row.label);
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "flea-places-"));
+  home = folder("home");
+});
+afterEach(() => rmSync(root, { recursive: true, force: true }));
+
+test("user-dirs.dirs names a role's folder, the last valid line winning", () => {
+  const dirs = userDirs(
+    ['XDG_DOWNLOAD_DIR="$HOME/Old"', ' XDG_DOWNLOAD_DIR = "$HOME/下載" # inbox', 'XDG_MUSIC_DIR="/srv/music/"', 'XDG_PICTURES_DIR="relative"', 'XDG_VIDEOS_DIR="$HOME/a\\"b"', "XDG_DESKTOP_DIR=$HOME/Desktop"].join("\n"),
+    "/home/a",
+  );
+  expect(Object.fromEntries(dirs)).toEqual({ DOWNLOAD: "/home/a/下載", MUSIC: "/srv/music", VIDEOS: '/home/a/a"b' });
+});
+
+test("an Android app is read off the temporary directory inside its private folder", () => {
+  expect(appPackage("/data/data/com.termux/files/usr/tmp")).toEqual({ name: "com.termux", dir: "/data/data/com.termux" });
+  expect(appPackage("/data/user/0/org.example.app_2/cache")).toEqual({ name: "org.example.app_2", dir: "/data/user/0/org.example.app_2" });
+  expect(appPackage("/data/user/10/a.b")).toEqual({ name: "a.b", dir: "/data/user/10/a.b" });
+  for (const other of ["/tmp", "/data/local/tmp", "/data/data/nodots/tmp", "/data/user/x/com.a.b/tmp", "/data/data/com.1a/tmp", "/sdcard/data/data/com.a.b", "", undefined])
+    expect(appPackage(other)).toBeNull();
+});
+
+test("the roots are / where paths are POSIX and the drive letters where they are not", () => {
+  expect(rootNames(posix)).toEqual(["/"]);
+  const letters = rootNames(win32);
+  expect(letters).toContain("C:\\");
+  expect(letters.filter((name) => /^[A-Z]:\\$/.test(name)).length).toBe(26);
+  expect(letters).not.toContain("/");
+});
+
+test("a folder is a place only once it directly holds a regular file", async () => {
+  file("home", "Documents", "note.txt");
+  file("home", "Downloads", "setup.bin");
+  folder("home", "Music");
+  folder("home", "Pictures", "Album");
+  file("home", "Pictures", "Album", "deep.jpg");
+  folder("home", "Videos");
+  symlinkSync(join(home, "Documents", "note.txt"), join(home, "Videos", "link.txt"));
+  const found = await probePlaces(quiet());
+  expect(found.places).toEqual([
+    { path: join(home, "Downloads"), label: "Downloads", glyph: "download" },
+    { path: join(home, "Documents"), label: "Documents", glyph: "file-text" },
+  ]);
+  expect(found.volumes).toEqual([]);
+  // The first file to land makes the row, and the folder's own change is what is noticed.
+  writeFileSync(join(home, "Music", "song.ogg"), "x");
+  expect(labels((await probePlaces(quiet())).places)).toEqual(["Downloads", "Documents", "Music"]);
+});
+
+test("user-dirs.dirs is tried before the names, and one folder is one row", async () => {
+  file("home", "文件", "a.txt");
+  file("home", "Documents", "b.txt");
+  file("home", "Movies", "c.mkv");
+  file("home", "Shared", "d.txt");
+  symlinkSync(join(home, "Movies"), join(home, "Videos"));
+  folder("home", ".config");
+  writeFileSync(join(home, ".config", "user-dirs.dirs"), 'XDG_DOCUMENTS_DIR="$HOME/文件"\nXDG_PUBLICSHARE_DIR="$HOME/Shared"\nXDG_TEMPLATES_DIR="$HOME"\n');
+  const found = await probePlaces(quiet());
+  expect(found.places).toEqual([
+    { path: join(home, "文件"), label: "文件", glyph: "file-text" },
+    { path: join(home, "Videos"), label: "Videos", glyph: "film" },
+    { path: join(home, "Shared"), label: "Shared", glyph: "folder" },
+  ]);
+});
+
+test("temporary folders are probed and named once each", async () => {
+  const a = folder("tmp-a"),
+    b = folder("tmp-b");
+  symlinkSync(a, join(root, "tmp-link"));
+  const found = await probePlaces(quiet({ temps: [a, undefined, join(root, "tmp-link"), join(root, "missing"), "relative", b] }));
+  expect(found.places).toEqual([
+    { path: a, label: "Temp", glyph: "folder" },
+    { path: b, label: b, glyph: "folder" },
+  ]);
+});
+
+test("Android always has its shared storage and Download, and the app's own two folders", async () => {
+  const shared = join(root, "shared");
+  file("shared", "DCIM", "Camera", "IMG_1.jpg");
+  file("shared", "DCIM", "stray.jpg");
+  file("shared", "Pictures", "Screenshots", "s.png");
+  folder("shared", "Documents");
+  const app = folder("data", "data", "com.example.app");
+  const found = await probePlaces(quiet({ android: true, shared, temps: ["/data/user/0/com.example.app/cache"] }));
+  expect(found.places).toEqual([
+    { path: shared, label: "Internal storage", glyph: "smartphone" },
+    { path: join(shared, "Download"), label: "Download", glyph: "download" },
+    { path: join(shared, "DCIM", "Camera"), label: "Camera", glyph: "camera" },
+    { path: join(shared, "Pictures", "Screenshots"), label: "Screenshots", glyph: "image" },
+    { path: join(shared, "Android", "media", "com.example.app"), label: "App media", glyph: "folder" },
+  ]);
+  expect(existsSync(join(shared, "Android", "media", "com.example.app"))).toBe(true);
+  expect(existsSync(app)).toBe(true);
+  // Without a camera folder holding files, DCIM itself is the camera's row.
+  rmSync(join(shared, "DCIM", "Camera"), { recursive: true });
+  expect(labels((await probePlaces(quiet({ android: true, shared }))).places)).toEqual(["Internal storage", "Download", "DCIM", "Screenshots"]);
+});
+
+test("a root that can be listed is a volume with its size, and one that cannot is not", async () => {
+  const found = await probePlaces(quiet({ roots: [root, join(root, "gone"), root + "/"] }));
+  expect(found.volumes.length).toBe(1);
+  expect(found.volumes[0]).toMatchObject({ path: root, label: root, glyph: "drive" });
+  expect(found.volumes[0].size).toBeGreaterThan(0);
+});
+
+test("the places request answers when asked, and a watch is ended by its own word", async () => {
+  file("home", "Documents", "note.txt");
+  const lines = [];
+  await places({}, (line) => lines.push(line), quiet());
+  await places({ watch: true }, (line) => lines.push(line), quiet());
+  await places({ watch: false }, (line) => lines.push(line), quiet());
+  expect(lines.length).toBe(2);
+  expect(lines[0]).toEqual({ t: "places", places: [{ path: join(home, "Documents"), label: "Documents", glyph: "file-text" }], volumes: [] });
+});