open-wysiwyg-editor 1.0.1 → 1.0.2

package/README.md

@@ -40,10 +40,16 @@ yarn add open-wysiwyg-editor
 Or with no build step, from a CDN:
 
 ```html
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1/dist/style.min.css" />
-<script src="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1/dist/open-wysiwyg-editor.global.js"></script>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1.0.1/dist/style.min.css"
+  integrity="sha384-b7LA9M5in6uI0RSJJZ206o3E6yH2YJdquLqriMF+32aOQjNUNH7uitvYh2CebAip" crossorigin="anonymous" />
+<script src="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1.0.1/dist/open-wysiwyg-editor.global.js"
+  integrity="sha384-lgMQAQkEkLamVrDDDizcj9JBoeaPc6DUKFiL+F/fj7KczjRHePrgrfCGRCnXGr7D" crossorigin="anonymous"></script>
 ```
 
+The URLs name an exact version and the `integrity` hashes make the browser refuse any other bytes, so a
+new release or a compromised CDN can't change the code your page runs. To upgrade, change the version and
+take the new hashes from the release notes, or compute them: `curl -s <url> | openssl dgst -sha384 -binary | openssl base64 -A`.
+
 ### Pick your framework
 
 The core package works everywhere. Each framework also has its own small package. It re-exports the whole core API, ships the stylesheets, and handles mounting, cleanup, server-side rendering and two-way binding for you. Install **one** of them (it brings the core with it):
@@ -76,8 +82,10 @@ The core is one function, `createEditor(options)`. It mounts the editor inside t
 The CDN script defines the `<owe-editor>` tag, so one tag is enough:
 
 ```html
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1/dist/style.min.css" />
-<script src="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1/dist/open-wysiwyg-editor.global.js"></script>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1.0.1/dist/style.min.css"
+  integrity="sha384-b7LA9M5in6uI0RSJJZ206o3E6yH2YJdquLqriMF+32aOQjNUNH7uitvYh2CebAip" crossorigin="anonymous" />
+<script src="https://cdn.jsdelivr.net/npm/open-wysiwyg-editor@1.0.1/dist/open-wysiwyg-editor.global.js"
+  integrity="sha384-lgMQAQkEkLamVrDDDizcj9JBoeaPc6DUKFiL+F/fj7KczjRHePrgrfCGRCnXGr7D" crossorigin="anonymous"></script>
 
 <owe-editor id="editor" placeholder="Write something…">
   <template><p>Hello <strong>world</strong></p></template>
@@ -712,7 +720,7 @@ Untranslated labels fall back to English, and plurals use `Intl.PluralRules`. Th
 
 Each framework package ships the same files under its own name, for example `@open-wysiwyg-editor/vue/style.css` and `@open-wysiwyg-editor/vue/content.css`, because package managers like pnpm don't expose the core package to your app.
 
-All rules are in `@layer owe`, so any of your own CSS outside a layer overrides them.
+The editor's look comes from its own API: the `brand` and `theme` options and attributes, and the design tokens below. Your page's CSS doesn't change it. Resets such as Tailwind's preflight, element rules like `button {}` or `h2 {}`, and utility classes on a wrapper don't reach into the editor, so it looks the same in any app. Inside the editor, every rule is unlayered and two classes more specific than its selector reads, so only a more specific selector or `!important` overrides one. Use tokens to theme it instead: a token you set always wins, wherever you set it.
 
 ### One color
 
@@ -751,7 +759,7 @@ The editor can't pick your colors for you. `--owe-accent` keeps 4.5:1 on white f
 
 ### Design tokens
 
-Set any token on `.owe` in your own CSS, or pass it as `ui.tokens` without the `--owe-` prefix (`tokens: { bg: "#0b0d10", radius: "8px" }`). Tokens set from JavaScript are applied through the CSSOM, so they work under a strict CSP. Unknown names are ignored, and so are values that contain `;`, `{`, `}`, `<` or `\`, or that call `url()`, `image()`, `image-set()` or `src()`. In TypeScript the names are the `ThemeToken` type.
+Set any token in your own CSS, on `.owe`, on a wrapper or on `:root`, in or out of a cascade layer, or pass it as `ui.tokens` without the `--owe-` prefix (`tokens: { bg: "#0b0d10", radius: "8px" }`). Tokens set from JavaScript are applied through the CSSOM, so they work under a strict CSP. Unknown names are ignored, and so are values that contain `;`, `{`, `}`, `<` or `\`, or that call `url()`, `image()`, `image-set()` or `src()`. In TypeScript the names are the `ThemeToken` type.
 
 | Token | Light | Dark | Styles |
 | --- | --- | --- | --- |
@@ -800,7 +808,7 @@ In dark mode the editor uses the dark column when the system prefers dark, or wh
 
 ### Button tokens
 
-These restyle the buttons, the toolbar and the card without touching any selector. They have no default value declared, so you can set them on `.owe` or on any element around it, such as `:root` or your dashboard wrapper. The default in the table is what the editor uses when you don't set them.
+These restyle the buttons, the toolbar and the card without touching any selector. Like every token, set them on `.owe` or on any element around it, such as `:root` or your dashboard wrapper. The default in the table is what the editor uses when you don't set them.
 
 | Token | Default | Styles |
 | --- | --- | --- |
@@ -838,7 +846,7 @@ Windows High Contrast (`forced-colors`) and `prefers-contrast: more` still take
 
 ### Match your dashboard
 
-Point the tokens at the variables your design system already defines. Put the CSS after the editor's stylesheet, or anywhere, because your unlayered CSS beats `@layer owe`. Because the tokens read your variables when they are used, the colors follow your light and dark themes without any script.
+Point the tokens at the variables your design system already defines. Put the CSS anywhere, in or out of a layer: the editor never declares a token itself, so yours always wins. Because the tokens read your variables when they are used, the colors follow your light and dark themes without any script.
 
 Tell the editor when your dashboard is dark as well: set `theme` to `dark` (`<owe-editor theme="dark">`, `ui.theme` or `setTheme()`). That switches the parts that are derived from the brand for dark backgrounds (links, selection), the highlight color and `color-scheme`, so scrollbars and native controls match. With `theme` left on `auto`, the editor follows the system setting.
 

package/dist/{chunk-YA2CQM23.cjs → chunk-BMUV6KRM.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkHNGUZYL2_cjs = require('./chunk-HNGUZYL2.cjs');
+var chunkGAOA25B3_cjs = require('./chunk-GAOA25B3.cjs');
 
 /*! open-wysiwyg-editor | MIT License | https://github.com/alhassan73/open-wysiwyg-editor */
 
@@ -128,7 +128,7 @@ function createHtmlFilter(options, policy = {}) {
   }
   function validValue(name, value) {
     if (value.length > 2e3 || UNSAFE_VALUE.test(value)) return null;
-    if (URL_ATTRS.has(name)) return chunkHNGUZYL2_cjs.sanitizeUrl(value, policy);
+    if (URL_ATTRS.has(name)) return chunkGAOA25B3_cjs.sanitizeUrl(value, policy);
     if (name === "id") {
       if (!ID.test(value)) return null;
       if (typeof window !== "undefined" && (value in window || value in document)) return null;
@@ -203,7 +203,7 @@ var NODE_TAG = {
   link: "a"
 };
 var tagOf = (owner) => owner.type.name === "heading" ? `h${owner.attrs.level}` : NODE_TAG[owner.type.name] ?? "div";
-var HtmlSupport = chunkHNGUZYL2_cjs.defineExtension({
+var HtmlSupport = chunkGAOA25B3_cjs.defineExtension({
   name: "htmlSupport",
   priority: 90,
   defaultOptions: { allow: "safe", disallow: [] },
@@ -280,5 +280,5 @@ exports.HTML_SAFE_RULES = HTML_SAFE_RULES;
 exports.HTML_TEXTBLOCKS = HTML_TEXTBLOCKS;
 exports.HtmlSupport = HtmlSupport;
 exports.createHtmlFilter = createHtmlFilter;
-//# sourceMappingURL=chunk-YA2CQM23.cjs.map
-//# sourceMappingURL=chunk-YA2CQM23.cjs.map
+//# sourceMappingURL=chunk-BMUV6KRM.cjs.map
+//# sourceMappingURL=chunk-BMUV6KRM.cjs.map

package/dist/{chunk-YA2CQM23.cjs.map → chunk-BMUV6KRM.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/extensions/html-support.ts"],"names":["sanitizeUrl","defineExtension"],"mappings":";;;;;;;AAgCO,IAAM,eAAA,GAAkB;AAAA,EAC7B,KAAA;AAAA,EAAO,SAAA;AAAA,EAAW,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,QAAA;AAAA,EACpF,SAAA;AAAA,EAAW,IAAA;AAAA,EAAM,IAAA;AAAA,EAAM,QAAA;AAAA,EAAU;AACnC;AAEO,IAAM,eAAA,GAAkB,CAAC,SAAA,EAAW,IAAI;AAExC,IAAM,WAAA,GAAc;AAAA,EACzB,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,GAAA;AAAA,EAAK,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,KAAA;AAAA,EAC1F,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM;AAC/B;AAGA,IAAM,WAAA,GAAc;AAAA,EAClB,WAAA;AAAA,EAAa,SAAA;AAAA,EAAW,YAAA;AAAA,EAAc,YAAA;AAAA,EAAc,aAAA;AAAA,EAAe,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAC3F,WAAA;AAAA,EAAa,gBAAA;AAAA,EAAkB,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,UAAA;AAAA,EAAY,WAAA;AAAA,EAAa,aAAA;AAAA,EAC1E,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,WAAA;AAAA,EAAa,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,WAAA;AAAA,EAAa,aAAA;AAAA,EAAe;AAC/E,CAAA;AAEO,IAAM,eAAA,GAA8B;AAAA,EACzC;AAAA,IACE,IAAA,EAAM,IAAI,MAAA,CAAO,CAAA,EAAA,EAAK,CAAC,GAAG,eAAA,EAAiB,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IAC5E,UAAA,EAAY,CAAC,QAAA,EAAU,IAAA,EAAM,SAAS,MAAA,EAAQ,YAAA,EAAc,iBAAA,EAAmB,kBAAA,EAAoB,MAAM,CAAA;AAAA,IACzG,OAAA,EAAS;AAAA,GACX;AAAA,EACA;AAAA,IACE,IAAA,EAAM,IAAI,MAAA,CAAO,CAAA,EAAA,EAAK,YAAY,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IAC/C,UAAA,EAAY,CAAC,QAAA,EAAU,OAAA,EAAS,QAAQ,KAAA,EAAO,UAAA,EAAY,OAAA,EAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,IACvF,OAAA,EAAS;AAAA,GACX;AAAA,EACA;AAAA,IACE,IAAA,EAAM,gGAAA;AAAA,IACN,UAAA,EAAY,CAAC,QAAA,EAAU,IAAA,EAAM,QAAQ,WAAW,CAAA;AAAA,IAChD,OAAA,EAAS;AAAA;AAEb;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,KAAA;AAAA,EAAO,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,SAAA;AAAA,EAAW,SAAA;AAAA,EACtF,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,WAAA;AAAA,EAAa,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC/F,CAAC,CAAA;AAED,IAAM,MAAA,GAAS,0MAAA;AACf,IAAM,4BAAY,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC9C,IAAM,KAAA,mBAAQ,IAAI,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAU,UAAA,EAAY,eAAe,SAAA,EAAW,eAAA,EAAiB,cAAA,EAAgB,cAAA,EAAgB,MAAM,CAAC,CAAA;AAC1J,IAAM,KAAA,GAAQ,0BAAA;AACd,IAAM,EAAA,GAAK,yBAAA;AACX,IAAM,IAAA,GAAO,qCAAA;AAEb,IAAM,YAAA,GAAe,iBAAA;AACrB,IAAM,UAAA,GAAa,gFAAA;AAInB,IAAM,WAAA,GAAc,CAAC,OAAA,EAA0B,IAAA,KAC7C,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,GAClB,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,GAClD,OAAA,CAAQ,WAAA,EAAY,KAAM,IAAA,GAC5B,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAEvB,IAAM,YAAY,CAAC,IAAA,EAAiD,IAAA,KAClE,IAAA,KAAS,QAAS,CAAC,CAAC,IAAA,IAAQ,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,WAAA,CAAY,CAAA,EAAG,IAAI,CAAC,CAAA;AAE5D,SAAS,gBAAA,CAAiB,OAAA,EAA6B,MAAA,GAAoB,EAAC,EAAG;AACpF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,KAAU,MAAA,GAAS,kBAAkB,OAAA,CAAQ,KAAA;AACnE,EAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AACrB,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,EAAa,KAAA,KAAsB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,WAAA,CAAY,CAAA,CAAE,IAAA,EAAM,GAAG,CAAC,CAAA;AAEjG,EAAA,MAAM,UAAA,GAAa,CAAC,GAAA,KAClB,QAAA,CAAS,GAAA,EAAK,KAAK,CAAA,CAAE,MAAA,GAAS,CAAA,IAAK,CAAC,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,UAAA,IAAc,CAAC,CAAA,CAAE,OAAA,IAAW,CAAC,CAAA,CAAE,MAAM,CAAA;AAE9G,EAAA,SAAS,OAAA,CAAQ,GAAA,EAAa,IAAA,EAA2C,IAAA,EAAuB;AAC9F,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,EAAK,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AACrE,IAAA,MAAM,EAAA,GAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AACnE,IAAA,OAAO,OAAO,CAAC,EAAA;AAAA,EACjB;AAEA,EAAA,SAAS,UAAA,CAAW,MAAc,KAAA,EAA8B;AAC9D,IAAA,IAAI,MAAM,MAAA,GAAS,GAAA,IAAQ,aAAa,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC5D,IAAA,IAAI,UAAU,GAAA,CAAI,IAAI,GAAG,OAAOA,6BAAA,CAAY,OAAO,MAAM,CAAA;AACzD,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,IAAI,CAAC,EAAA,CAAG,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAE5B,MAAA,IAAI,OAAO,MAAA,KAAW,WAAA,KAAgB,SAAS,MAAA,IAAU,KAAA,IAAS,WAAW,OAAO,IAAA;AAAA,IACtF;AACA,IAAA,IAAI,SAAS,MAAA,IAAU,CAAC,KAAK,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AACjD,IAAA,IAAI,SAAS,MAAA,IAAU,CAAC,MAAM,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACjD,IAAA,IAAI,SAAS,KAAA,IAAS,CAAC,mBAAmB,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC9D,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,SAAS,MAAA,CAAO,GAAA,EAAa,IAAA,EAAuC,KAAA,EAAiB,QAAA,EAAiC;AACpH,IAAA,MAAM,MAAa,EAAC;AACpB,IAAA,KAAA,MAAW,OAAO,KAAA,EAAO;AACvB,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,MAAA,IAAI,UAAU,IAAA,EAAM;AACpB,MAAA,IAAI,SAAS,OAAA,EAAS;AACpB,QAAA,MAAM,OAAA,GAAU,MACb,KAAA,CAAM,KAAK,EACX,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,IAAK,CAAC,sBAAsB,IAAA,CAAK,CAAC,KAAK,OAAA,CAAQ,GAAA,EAAK,SAAA,EAAW,CAAC,CAAC,CAAA;AACnG,QAAA,IAAI,QAAQ,MAAA,EAAQ,GAAA,CAAI,KAAA,GAAQ,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,SAAS,OAAA,EAAS;AACpB,QAAA,MAAM,QAAkB,EAAC;AACzB,QAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,EAAG;AACnC,UAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC1B,UAAA,IAAI,IAAI,CAAA,EAAG;AACX,UAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AACjD,UAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,GAAI,CAAC,EAAE,IAAA,EAAK;AACnC,UAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA,IAAK,CAAC,GAAA,IAAO,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,GAAA,EAAK;AACxF,UAAA,IAAI,OAAA,CAAQ,GAAA,EAAK,QAAA,EAAU,IAAI,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAAA,QAChE;AACA,QAAA,IAAI,MAAM,MAAA,EAAQ,GAAA,CAAI,KAAA,GAAQ,KAAA,CAAM,KAAK,IAAI,CAAA;AAC7C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,KAAK,IAAI,CAAA,IAAM,YAAY,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAI;AAC3D,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,YAAA,EAAc,IAAI,CAAA,EAAG;AACvC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,KAAK,CAAA;AACpC,MAAA,IAAI,KAAA,KAAU,IAAA,EAAM,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,IAClC;AACA,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,GAAA,GAAM,IAAA;AAAA,EACzC;AAEA,EAAA,MAAM,cAAc,CAAC,EAAA,EAAa,aAChC,MAAA,CAAO,EAAA,CAAG,QAAQ,WAAA,EAAY,EAAG,CAAC,CAAA,KAAM,GAAG,YAAA,CAAa,CAAC,GAAG,EAAA,CAAG,iBAAA,IAAqB,QAAQ,CAAA;AAG9F,EAAA,MAAM,UAAA,GAAa,CAAC,GAAA,EAAa,KAAA,EAAgB,QAAA,KAAoC;AACnF,IAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AACxE,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAC,CAAA;AAC/F,IAAA,OAAO,MAAA,CAAO,GAAA,EAAK,CAAC,CAAA,KAAO,OAAO,MAAA,CAAO,CAAC,CAAA,KAAM,QAAA,GAAY,MAAA,CAAO,CAAC,CAAA,GAAe,IAAA,EAAO,OAAO,QAAQ,CAAA;AAAA,EAC3G,CAAA;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,WAAA,EAAa,UAAA,EAAW;AAC/C;AAEA,IAAM,QAAA,GAAmC;AAAA,EACvC,SAAA,EAAW,GAAA;AAAA,EAAK,UAAA,EAAY,YAAA;AAAA,EAAc,UAAA,EAAY,IAAA;AAAA,EAAM,WAAA,EAAa,IAAA;AAAA,EAAM,QAAA,EAAU,IAAA;AAAA,EACzF,QAAA,EAAU,IAAA;AAAA,EAAM,QAAA,EAAU,IAAA;AAAA,EAAM,SAAA,EAAW,KAAA;AAAA,EAAO,cAAA,EAAgB,IAAA;AAAA,EAAM,KAAA,EAAO,KAAA;AAAA,EAAO,KAAA,EAAO,OAAA;AAAA,EAC7F,QAAA,EAAU,IAAA;AAAA,EAAM,SAAA,EAAW,IAAA;AAAA,EAAM,WAAA,EAAa,IAAA;AAAA,EAAM,IAAA,EAAM,QAAA;AAAA,EAAU,MAAA,EAAQ,IAAA;AAAA,EAAM,SAAA,EAAW,GAAA;AAAA,EAC7F,MAAA,EAAQ,GAAA;AAAA,EAAK,IAAA,EAAM,MAAA;AAAA,EAAQ,SAAA,EAAW,KAAA;AAAA,EAAO,WAAA,EAAa,KAAA;AAAA,EAAO,IAAA,EAAM;AACzE,CAAA;AACA,IAAM,QAAQ,CAAC,KAAA,KACb,KAAA,CAAM,IAAA,CAAK,SAAS,SAAA,GAAY,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,KAAe,CAAA,CAAA,GAAM,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,IAAK,KAAA;AAQ7F,IAAM,cAAcC,iCAAA,CAAoC;AAAA,EAC7D,IAAA,EAAM,aAAA;AAAA,EACN,QAAA,EAAU,EAAA;AAAA,EACV,gBAAgB,EAAE,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAC,EAAE;AAAA,EAC9C,KAAA,EAAO,CAAC,OAAA,EAAS,EAAE,WAAU,KAAgC;AAC3D,IAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AACtD,IAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,CAAC,IAAA,EAAgB,OAAA,MAA+B;AAAA,MAC/D,KAAA,EAAO,EAAE,GAAA,EAAK,EAAE,SAAS,IAAA,CAAK,CAAC,CAAA,IAAK,KAAA,EAAM,EAAG,UAAA,EAAY,EAAE,OAAA,EAAS,MAAK,EAAE;AAAA,MAC3E,OAAA;AAAA,MACA,KAAA,EAAO,OAAA;AAAA,MACP,QAAA,EAAU,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,QAC3B,GAAA;AAAA,QACA,QAAA,EAAU,EAAA;AAAA,QACV,QAAA,EAAU,CAAC,EAAA,MAAqB,EAAE,GAAA,EAAK,YAAY,CAAA,CAAE,WAAA,CAAY,EAAA,EAAI,KAAK,CAAA,EAAE;AAAA,OAC9E,CAAE,CAAA;AAAA,MACF,KAAA,EAAO,CAAC,IAAA,KAAiB;AACvB,QAAA,MAAM,GAAA,GAAM,KAAK,QAAA,CAAS,IAAA,CAAK,MAAM,GAAa,CAAA,GAAK,IAAA,CAAK,KAAA,CAAM,GAAA,GAAiB,KAAA;AACnF,QAAA,MAAM,KAAA,GAAe,EAAE,GAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,KAAK,CAAA,IAAK,EAAC,EAAG;AAClF,QAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,KAAA,CAAM,IAAA,GAAO,EAAA;AACpC,QAAA,OAAO,CAAC,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA;AAAA,MACvB;AAAA,KACF,CAAA;AACA,IAAA,OAAO;AAAA,MACL,GAAI,UAAA,CAAW,MAAA,GAAS,EAAE,aAAA,EAAe,SAAS,UAAA,EAAY,QAAQ,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7E,GAAI,UAAA,CAAW,MAAA,GAAS,EAAE,aAAA,EAAe,SAAS,UAAA,EAAY,SAAS,CAAA,EAAE,GAAI;AAAC,KAChF;AAAA,EACF,CAAA;AAAA,EACA,KAAA,EAAO,CAAC,OAAA,EAAS,EAAE,WAAU,KAAgC;AAC3D,IAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AAC1B,IAAA,OAAO;AAAA,MACL,UAAA,EAAY;AAAA,QACV,KAAA,EAAO,EAAE,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,EAAO,EAAG,UAAA,EAAY,EAAE,OAAA,EAAS,IAAA,EAAK,EAAE;AAAA,QACjE,QAAA,EAAU,EAAA;AAAA;AAAA,QACV,QAAA,EAAU,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,UAC3B,GAAA;AAAA,UACA,QAAA,EAAU,EAAA;AAAA,UACV,QAAA,EAAU,CAAC,EAAA,KAAoB;AAC7B,YAAA,MAAM,UAAA,GAAa,CAAA,CAAE,WAAA,CAAY,EAAA,EAAI,KAAK,CAAA;AAE1C,YAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,CAAC,UAAA,EAAY,OAAO,KAAA;AAC1C,YAAA,OAAO,EAAE,KAAK,UAAA,EAAW;AAAA,UAC3B;AAAA,SACF,CAAE,CAAA;AAAA,QACF,KAAA,EAAO,CAAC,IAAA,KAAe;AACrB,UAAA,MAAM,GAAA,GAAM,KAAK,QAAA,CAAS,IAAA,CAAK,MAAM,GAAa,CAAA,GAAK,IAAA,CAAK,KAAA,CAAM,GAAA,GAAiB,MAAA;AACnF,UAAA,OAAO,CAAC,GAAA,EAAK,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,KAAK,CAAA,IAAK,EAAC,EAAG,CAAC,CAAA;AAAA,QACvE;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EACA,gBAAA,EAAkB,CAAC,OAAA,KAAY;AAC7B,IAAA,MAAM,CAAA,GAAI,iBAAiB,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,KAAA,EAAO,WAAA;AAAA,QACP,UAAA,EAAY;AAAA,UACV,cAAA,EAAgB;AAAA,YACd,OAAA,EAAS,IAAA;AAAA,YACT,WAAW,CAAC,EAAA,KAAO,CAAA,CAAE,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,YACzC,UAAA,EAAY,CAAC,KAAA,EAAO,KAAA,KAAU,CAAA,CAAE,WAAW,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,EAAO,IAAI;AAAA;AACtE;AACF;AACF,KACF;AAAA,EACF;AACF,CAAC","file":"chunk-YA2CQM23.cjs","sourcesContent":["import type { DOMOutputSpec, Mark, MarkSpec, Node as PMNode, NodeSpec } from \"prosemirror-model\";\nimport { defineExtension } from \"../core/extension\";\nimport { sanitizeUrl, type UrlPolicy } from \"../core/url\";\n\n/**\n * One allowlist rule. Strings support a trailing \"*\" wildcard (\"data-*\", \"aria-*\").\n *\n * ```ts\n * HtmlSupport.configure({ allow: [\n *   { name: \"section\", classes: true, attributes: [\"data-*\", \"id\"] },\n *   { name: /^(span|abbr)$/, attributes: [\"title\", \"lang\"], classes: [\"highlight\", /^tag-/] },\n *   { name: \"p\", styles: [\"color\", \"background-color\"] },\n * ]})\n * ```\n */\nexport interface HtmlRule {\n  name: string | RegExp;\n  attributes?: true | Array<string | RegExp>;\n  classes?: true | Array<string | RegExp>;\n  /** CSS properties allowed in `style`. Note: inline styles in the live editor need\n   * `style-src-attr 'unsafe-inline'` under CSP; leave this out to stay strict-CSP clean. */\n  styles?: true | Array<string | RegExp>;\n}\n\nexport interface HtmlSupportOptions {\n  /** Rules for markup to keep, or \"safe\" for a sensible preset (no styles, no scripts). */\n  allow: HtmlRule[] | \"safe\";\n  /** Rules that win over `allow`. */\n  disallow: HtmlRule[];\n}\n\n/** Elements kept as generic block containers (content: blocks). */\nexport const HTML_CONTAINERS = [\n  \"div\", \"section\", \"article\", \"aside\", \"header\", \"footer\", \"nav\", \"main\", \"address\", \"hgroup\",\n  \"details\", \"dl\", \"dd\", \"center\", \"search\",\n];\n/** Elements kept as generic text blocks (content: inline). */\nexport const HTML_TEXTBLOCKS = [\"summary\", \"dt\"];\n/** Elements kept as generic inline wrappers. */\nexport const HTML_INLINE = [\n  \"span\", \"abbr\", \"cite\", \"dfn\", \"kbd\", \"mark\", \"q\", \"small\", \"time\", \"var\", \"samp\", \"bdi\", \"bdo\",\n  \"data\", \"big\", \"ruby\", \"rt\", \"rp\",\n];\n\n/** Element names of the built-in node/mark types that may receive extra attributes. */\nconst KNOWN_TYPES = [\n  \"paragraph\", \"heading\", \"blockquote\", \"bulletList\", \"orderedList\", \"listItem\", \"taskList\", \"taskItem\",\n  \"codeBlock\", \"horizontalRule\", \"image\", \"table\", \"tableRow\", \"tableCell\", \"tableHeader\",\n  \"bold\", \"italic\", \"underline\", \"strike\", \"code\", \"subscript\", \"superscript\", \"link\",\n];\n\nexport const HTML_SAFE_RULES: HtmlRule[] = [\n  {\n    name: new RegExp(`^(${[...HTML_CONTAINERS, ...HTML_TEXTBLOCKS].join(\"|\")})$`),\n    attributes: [\"data-*\", \"id\", \"title\", \"lang\", \"aria-label\", \"aria-labelledby\", \"aria-describedby\", \"role\"],\n    classes: true,\n  },\n  {\n    name: new RegExp(`^(${HTML_INLINE.join(\"|\")})$`),\n    attributes: [\"data-*\", \"title\", \"lang\", \"dir\", \"datetime\", \"value\", \"cite\", \"translate\"],\n    classes: true,\n  },\n  {\n    name: /^(p|h[1-6]|blockquote|ul|ol|li|table|tr|td|th|pre|code|figure|img|a|strong|em|u|s|sub|sup|hr)$/,\n    attributes: [\"data-*\", \"id\", \"lang\", \"translate\"],\n    classes: true,\n  },\n];\n\n/** Attributes managed by the schema itself, never through HtmlSupport. */\nconst RESERVED = new Set([\n  \"src\", \"srcset\", \"href\", \"alt\", \"width\", \"height\", \"start\", \"type\", \"dir\", \"colspan\", \"rowspan\",\n  \"colwidth\", \"scope\", \"title\", \"data-type\", \"data-checked\", \"data-colwidth\", \"data-language\", \"open\",\n]);\n/** Never kept, whatever the rules say. */\nconst DENIED = /^(on|xmlns|xlink)|^(srcdoc|formaction|action|ping|background|tabindex|accesskey|autofocus|contenteditable|draggable|hidden|inert|popover|popovertarget|is|slot|part|nonce|style|class)$|^data-(pm|owe)-/i;\nconst URL_ATTRS = new Set([\"cite\", \"longdesc\"]);\nconst ROLES = new Set([\"note\", \"region\", \"group\", \"figure\", \"doc-note\", \"doc-example\", \"doc-tip\", \"doc-pullquote\", \"doc-epigraph\", \"presentation\", \"none\"]);\nconst CLASS = /^-?[A-Za-z_][\\w-]{0,63}$/;\nconst ID = /^[A-Za-z][\\w:.-]{0,63}$/;\nconst LANG = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{1,8})*$/;\n// eslint-disable-next-line no-control-regex\nconst UNSAFE_VALUE = /[\\u0000-\\u001f]/;\nconst UNSAFE_CSS = /url\\s*\\(|expression\\s*\\(|javascript:|@import|[<>\\\\]|behavior\\s*:|-moz-binding/i;\n\ntype Attrs = Record<string, string>;\n\nconst matchesName = (pattern: string | RegExp, name: string): boolean =>\n  typeof pattern === \"string\"\n    ? pattern.endsWith(\"*\")\n      ? name.startsWith(pattern.slice(0, -1).toLowerCase())\n      : pattern.toLowerCase() === name\n    : pattern.test(name);\n\nconst allowedBy = (list: true | Array<string | RegExp> | undefined, name: string): boolean =>\n  list === true || (!!list && list.some((p) => matchesName(p, name)));\n\nexport function createHtmlFilter(options: HtmlSupportOptions, policy: UrlPolicy = {}) {\n  const allow = options.allow === \"safe\" ? HTML_SAFE_RULES : options.allow;\n  const deny = options.disallow;\n  const rulesFor = (tag: string, rules: HtmlRule[]) => rules.filter((r) => matchesName(r.name, tag));\n\n  const tagAllowed = (tag: string) =>\n    rulesFor(tag, allow).length > 0 && !rulesFor(tag, deny).some((r) => !r.attributes && !r.classes && !r.styles);\n\n  function permits(tag: string, kind: \"attributes\" | \"classes\" | \"styles\", name: string): boolean {\n    const yes = rulesFor(tag, allow).some((r) => allowedBy(r[kind], name));\n    const no = rulesFor(tag, deny).some((r) => allowedBy(r[kind], name));\n    return yes && !no;\n  }\n\n  function validValue(name: string, value: string): string | null {\n    if (value.length > 2000 || UNSAFE_VALUE.test(value)) return null;\n    if (URL_ATTRS.has(name)) return sanitizeUrl(value, policy);\n    if (name === \"id\") {\n      if (!ID.test(value)) return null;\n      // Ids that shadow window/document properties enable DOM clobbering.\n      if (typeof window !== \"undefined\" && (value in window || value in document)) return null;\n    }\n    if (name === \"lang\" && !LANG.test(value)) return null;\n    if (name === \"role\" && !ROLES.has(value)) return null;\n    if (name === \"dir\" && !/^(ltr|rtl|auto)$/.test(value)) return null;\n    return value;\n  }\n\n  /** Filters an element's attributes. `reserved` excludes attributes the schema already owns. */\n  function filter(tag: string, read: (name: string) => string | null, names: string[], reserved: boolean): Attrs | null {\n    const out: Attrs = {};\n    for (const raw of names) {\n      const name = raw.toLowerCase();\n      const value = read(raw);\n      if (value === null) continue;\n      if (name === \"class\") {\n        const classes = value\n          .split(/\\s+/)\n          .filter((c) => c && CLASS.test(c) && !/^(owe-|ProseMirror)/.test(c) && permits(tag, \"classes\", c));\n        if (classes.length) out.class = classes.join(\" \");\n        continue;\n      }\n      if (name === \"style\") {\n        const decls: string[] = [];\n        for (const decl of value.split(\";\")) {\n          const i = decl.indexOf(\":\");\n          if (i < 1) continue;\n          const prop = decl.slice(0, i).trim().toLowerCase();\n          const val = decl.slice(i + 1).trim();\n          if (!/^-?[a-z][a-z-]*$/.test(prop) || !val || UNSAFE_CSS.test(val) || val.length > 200) continue;\n          if (permits(tag, \"styles\", prop)) decls.push(`${prop}: ${val}`);\n        }\n        if (decls.length) out.style = decls.join(\"; \");\n        continue;\n      }\n      if (DENIED.test(name) || (reserved && RESERVED.has(name))) continue;\n      if (!permits(tag, \"attributes\", name)) continue;\n      const valid = validValue(name, value);\n      if (valid !== null) out[name] = valid;\n    }\n    return Object.keys(out).length ? out : null;\n  }\n\n  const fromElement = (el: Element, reserved: boolean) =>\n    filter(el.tagName.toLowerCase(), (n) => el.getAttribute(n), el.getAttributeNames(), reserved);\n\n  /** Re-validates stored attributes at render time (JSON input bypasses parsing). */\n  const revalidate = (tag: string, value: unknown, reserved: boolean): Attrs | null => {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n    const stored = value as Record<string, unknown>;\n    const names = Object.keys(stored).filter((k) => Object.prototype.hasOwnProperty.call(stored, k));\n    return filter(tag, (n) => (typeof stored[n] === \"string\" ? (stored[n] as string) : null), names, reserved);\n  };\n\n  return { tagAllowed, fromElement, revalidate };\n}\n\nconst NODE_TAG: Record<string, string> = {\n  paragraph: \"p\", blockquote: \"blockquote\", bulletList: \"ul\", orderedList: \"ol\", listItem: \"li\",\n  taskList: \"ul\", taskItem: \"li\", codeBlock: \"pre\", horizontalRule: \"hr\", image: \"img\", table: \"table\",\n  tableRow: \"tr\", tableCell: \"td\", tableHeader: \"th\", bold: \"strong\", italic: \"em\", underline: \"u\",\n  strike: \"s\", code: \"code\", subscript: \"sub\", superscript: \"sup\", link: \"a\",\n};\nconst tagOf = (owner: PMNode | Mark): string =>\n  owner.type.name === \"heading\" ? `h${owner.attrs.level as number}` : (NODE_TAG[owner.type.name] ?? \"div\");\n\n/**\n * General HTML support: keeps markup the editor doesn't model natively — wrappers like\n * <section>/<div>, inline elements like <abbr title>/<span lang>, and extra classes, data-*, ids\n * and (opt-in) styles on known elements — within an allowlist. Everything still passes the\n * sanitizer, URL policy and output validation.\n */\nexport const HtmlSupport = defineExtension<HtmlSupportOptions>({\n  name: \"htmlSupport\",\n  priority: 90,\n  defaultOptions: { allow: \"safe\", disallow: [] },\n  nodes: (options, { urlPolicy }): Record<string, NodeSpec> => {\n    const f = createHtmlFilter(options, urlPolicy);\n    const containers = HTML_CONTAINERS.filter(f.tagAllowed);\n    const textblocks = HTML_TEXTBLOCKS.filter(f.tagAllowed);\n    const nodeSpec = (tags: string[], content: string): NodeSpec => ({\n      attrs: { tag: { default: tags[0] ?? \"div\" }, attributes: { default: null } },\n      content,\n      group: \"block\",\n      parseDOM: tags.map((tag) => ({\n        tag,\n        priority: 40,\n        getAttrs: (el: HTMLElement) => ({ tag, attributes: f.fromElement(el, false) }),\n      })),\n      toDOM: (node: PMNode) => {\n        const tag = tags.includes(node.attrs.tag as string) ? (node.attrs.tag as string) : \"div\";\n        const attrs: Attrs = { ...(f.revalidate(tag, node.attrs.attributes, false) ?? {}) };\n        if (tag === \"details\") attrs.open = \"\"; // keep collapsible content editable/visible\n        return [tag, attrs, 0] as DOMOutputSpec;\n      },\n    });\n    return {\n      ...(containers.length ? { htmlContainer: nodeSpec(containers, \"block+\") } : {}),\n      ...(textblocks.length ? { htmlTextblock: nodeSpec(textblocks, \"inline*\") } : {}),\n    };\n  },\n  marks: (options, { urlPolicy }): Record<string, MarkSpec> => {\n    const f = createHtmlFilter(options, urlPolicy);\n    const tags = HTML_INLINE.filter(f.tagAllowed);\n    if (!tags.length) return {};\n    return {\n      htmlInline: {\n        attrs: { tag: { default: \"span\" }, attributes: { default: null } },\n        excludes: \"\", // different wrappers (and nested spans) can coexist\n        parseDOM: tags.map((tag) => ({\n          tag,\n          priority: 40,\n          getAttrs: (el: HTMLElement) => {\n            const attributes = f.fromElement(el, false);\n            // A bare <span> carries no meaning — let its content parse normally.\n            if (tag === \"span\" && !attributes) return false;\n            return { tag, attributes };\n          },\n        })),\n        toDOM: (mark: Mark) => {\n          const tag = tags.includes(mark.attrs.tag as string) ? (mark.attrs.tag as string) : \"span\";\n          return [tag, f.revalidate(tag, mark.attrs.attributes, false) ?? {}, 0] as DOMOutputSpec;\n        },\n      },\n    };\n  },\n  globalAttributes: (options) => {\n    const f = createHtmlFilter(options);\n    return [\n      {\n        types: KNOWN_TYPES,\n        attributes: {\n          htmlAttributes: {\n            default: null,\n            parseHTML: (el) => f.fromElement(el, true),\n            renderHTML: (value, owner) => f.revalidate(tagOf(owner), value, true),\n          },\n        },\n      },\n    ];\n  },\n});\n"]}
+{"version":3,"sources":["../src/extensions/html-support.ts"],"names":["sanitizeUrl","defineExtension"],"mappings":";;;;;;;AAgCO,IAAM,eAAA,GAAkB;AAAA,EAC7B,KAAA;AAAA,EAAO,SAAA;AAAA,EAAW,SAAA;AAAA,EAAW,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,QAAA;AAAA,EAAU,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,SAAA;AAAA,EAAW,QAAA;AAAA,EACpF,SAAA;AAAA,EAAW,IAAA;AAAA,EAAM,IAAA;AAAA,EAAM,QAAA;AAAA,EAAU;AACnC;AAEO,IAAM,eAAA,GAAkB,CAAC,SAAA,EAAW,IAAI;AAExC,IAAM,WAAA,GAAc;AAAA,EACzB,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,GAAA;AAAA,EAAK,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,KAAA;AAAA,EAC1F,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,IAAA;AAAA,EAAM;AAC/B;AAGA,IAAM,WAAA,GAAc;AAAA,EAClB,WAAA;AAAA,EAAa,SAAA;AAAA,EAAW,YAAA;AAAA,EAAc,YAAA;AAAA,EAAc,aAAA;AAAA,EAAe,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,UAAA;AAAA,EAC3F,WAAA;AAAA,EAAa,gBAAA;AAAA,EAAkB,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,UAAA;AAAA,EAAY,WAAA;AAAA,EAAa,aAAA;AAAA,EAC1E,MAAA;AAAA,EAAQ,QAAA;AAAA,EAAU,WAAA;AAAA,EAAa,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,WAAA;AAAA,EAAa,aAAA;AAAA,EAAe;AAC/E,CAAA;AAEO,IAAM,eAAA,GAA8B;AAAA,EACzC;AAAA,IACE,IAAA,EAAM,IAAI,MAAA,CAAO,CAAA,EAAA,EAAK,CAAC,GAAG,eAAA,EAAiB,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IAC5E,UAAA,EAAY,CAAC,QAAA,EAAU,IAAA,EAAM,SAAS,MAAA,EAAQ,YAAA,EAAc,iBAAA,EAAmB,kBAAA,EAAoB,MAAM,CAAA;AAAA,IACzG,OAAA,EAAS;AAAA,GACX;AAAA,EACA;AAAA,IACE,IAAA,EAAM,IAAI,MAAA,CAAO,CAAA,EAAA,EAAK,YAAY,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IAC/C,UAAA,EAAY,CAAC,QAAA,EAAU,OAAA,EAAS,QAAQ,KAAA,EAAO,UAAA,EAAY,OAAA,EAAS,MAAA,EAAQ,WAAW,CAAA;AAAA,IACvF,OAAA,EAAS;AAAA,GACX;AAAA,EACA;AAAA,IACE,IAAA,EAAM,gGAAA;AAAA,IACN,UAAA,EAAY,CAAC,QAAA,EAAU,IAAA,EAAM,QAAQ,WAAW,CAAA;AAAA,IAChD,OAAA,EAAS;AAAA;AAEb;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,KAAA;AAAA,EAAO,QAAA;AAAA,EAAU,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,OAAA;AAAA,EAAS,QAAA;AAAA,EAAU,OAAA;AAAA,EAAS,MAAA;AAAA,EAAQ,KAAA;AAAA,EAAO,SAAA;AAAA,EAAW,SAAA;AAAA,EACtF,UAAA;AAAA,EAAY,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,WAAA;AAAA,EAAa,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC/F,CAAC,CAAA;AAED,IAAM,MAAA,GAAS,0MAAA;AACf,IAAM,4BAAY,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC9C,IAAM,KAAA,mBAAQ,IAAI,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAU,UAAA,EAAY,eAAe,SAAA,EAAW,eAAA,EAAiB,cAAA,EAAgB,cAAA,EAAgB,MAAM,CAAC,CAAA;AAC1J,IAAM,KAAA,GAAQ,0BAAA;AACd,IAAM,EAAA,GAAK,yBAAA;AACX,IAAM,IAAA,GAAO,qCAAA;AAEb,IAAM,YAAA,GAAe,iBAAA;AACrB,IAAM,UAAA,GAAa,gFAAA;AAInB,IAAM,WAAA,GAAc,CAAC,OAAA,EAA0B,IAAA,KAC7C,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,GAClB,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,GAClD,OAAA,CAAQ,WAAA,EAAY,KAAM,IAAA,GAC5B,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAEvB,IAAM,YAAY,CAAC,IAAA,EAAiD,IAAA,KAClE,IAAA,KAAS,QAAS,CAAC,CAAC,IAAA,IAAQ,IAAA,CAAK,KAAK,CAAC,CAAA,KAAM,WAAA,CAAY,CAAA,EAAG,IAAI,CAAC,CAAA;AAE5D,SAAS,gBAAA,CAAiB,OAAA,EAA6B,MAAA,GAAoB,EAAC,EAAG;AACpF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,KAAU,MAAA,GAAS,kBAAkB,OAAA,CAAQ,KAAA;AACnE,EAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AACrB,EAAA,MAAM,QAAA,GAAW,CAAC,GAAA,EAAa,KAAA,KAAsB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,WAAA,CAAY,CAAA,CAAE,IAAA,EAAM,GAAG,CAAC,CAAA;AAEjG,EAAA,MAAM,UAAA,GAAa,CAAC,GAAA,KAClB,QAAA,CAAS,GAAA,EAAK,KAAK,CAAA,CAAE,MAAA,GAAS,CAAA,IAAK,CAAC,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,UAAA,IAAc,CAAC,CAAA,CAAE,OAAA,IAAW,CAAC,CAAA,CAAE,MAAM,CAAA;AAE9G,EAAA,SAAS,OAAA,CAAQ,GAAA,EAAa,IAAA,EAA2C,IAAA,EAAuB;AAC9F,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,EAAK,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AACrE,IAAA,MAAM,EAAA,GAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AACnE,IAAA,OAAO,OAAO,CAAC,EAAA;AAAA,EACjB;AAEA,EAAA,SAAS,UAAA,CAAW,MAAc,KAAA,EAA8B;AAC9D,IAAA,IAAI,MAAM,MAAA,GAAS,GAAA,IAAQ,aAAa,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC5D,IAAA,IAAI,UAAU,GAAA,CAAI,IAAI,GAAG,OAAOA,6BAAA,CAAY,OAAO,MAAM,CAAA;AACzD,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,IAAI,CAAC,EAAA,CAAG,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAE5B,MAAA,IAAI,OAAO,MAAA,KAAW,WAAA,KAAgB,SAAS,MAAA,IAAU,KAAA,IAAS,WAAW,OAAO,IAAA;AAAA,IACtF;AACA,IAAA,IAAI,SAAS,MAAA,IAAU,CAAC,KAAK,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AACjD,IAAA,IAAI,SAAS,MAAA,IAAU,CAAC,MAAM,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACjD,IAAA,IAAI,SAAS,KAAA,IAAS,CAAC,mBAAmB,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC9D,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,SAAS,MAAA,CAAO,GAAA,EAAa,IAAA,EAAuC,KAAA,EAAiB,QAAA,EAAiC;AACpH,IAAA,MAAM,MAAa,EAAC;AACpB,IAAA,KAAA,MAAW,OAAO,KAAA,EAAO;AACvB,MAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,MAAA,IAAI,UAAU,IAAA,EAAM;AACpB,MAAA,IAAI,SAAS,OAAA,EAAS;AACpB,QAAA,MAAM,OAAA,GAAU,MACb,KAAA,CAAM,KAAK,EACX,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,IAAK,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,IAAK,CAAC,sBAAsB,IAAA,CAAK,CAAC,KAAK,OAAA,CAAQ,GAAA,EAAK,SAAA,EAAW,CAAC,CAAC,CAAA;AACnG,QAAA,IAAI,QAAQ,MAAA,EAAQ,GAAA,CAAI,KAAA,GAAQ,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,SAAS,OAAA,EAAS;AACpB,QAAA,MAAM,QAAkB,EAAC;AACzB,QAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,EAAG;AACnC,UAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC1B,UAAA,IAAI,IAAI,CAAA,EAAG;AACX,UAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AACjD,UAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,GAAI,CAAC,EAAE,IAAA,EAAK;AACnC,UAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA,IAAK,CAAC,GAAA,IAAO,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,GAAA,EAAK;AACxF,UAAA,IAAI,OAAA,CAAQ,GAAA,EAAK,QAAA,EAAU,IAAI,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AAAA,QAChE;AACA,QAAA,IAAI,MAAM,MAAA,EAAQ,GAAA,CAAI,KAAA,GAAQ,KAAA,CAAM,KAAK,IAAI,CAAA;AAC7C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,KAAK,IAAI,CAAA,IAAM,YAAY,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAI;AAC3D,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,YAAA,EAAc,IAAI,CAAA,EAAG;AACvC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,EAAM,KAAK,CAAA;AACpC,MAAA,IAAI,KAAA,KAAU,IAAA,EAAM,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,IAClC;AACA,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,GAAA,GAAM,IAAA;AAAA,EACzC;AAEA,EAAA,MAAM,cAAc,CAAC,EAAA,EAAa,aAChC,MAAA,CAAO,EAAA,CAAG,QAAQ,WAAA,EAAY,EAAG,CAAC,CAAA,KAAM,GAAG,YAAA,CAAa,CAAC,GAAG,EAAA,CAAG,iBAAA,IAAqB,QAAQ,CAAA;AAG9F,EAAA,MAAM,UAAA,GAAa,CAAC,GAAA,EAAa,KAAA,EAAgB,QAAA,KAAoC;AACnF,IAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AACxE,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAC,CAAA;AAC/F,IAAA,OAAO,MAAA,CAAO,GAAA,EAAK,CAAC,CAAA,KAAO,OAAO,MAAA,CAAO,CAAC,CAAA,KAAM,QAAA,GAAY,MAAA,CAAO,CAAC,CAAA,GAAe,IAAA,EAAO,OAAO,QAAQ,CAAA;AAAA,EAC3G,CAAA;AAEA,EAAA,OAAO,EAAE,UAAA,EAAY,WAAA,EAAa,UAAA,EAAW;AAC/C;AAEA,IAAM,QAAA,GAAmC;AAAA,EACvC,SAAA,EAAW,GAAA;AAAA,EAAK,UAAA,EAAY,YAAA;AAAA,EAAc,UAAA,EAAY,IAAA;AAAA,EAAM,WAAA,EAAa,IAAA;AAAA,EAAM,QAAA,EAAU,IAAA;AAAA,EACzF,QAAA,EAAU,IAAA;AAAA,EAAM,QAAA,EAAU,IAAA;AAAA,EAAM,SAAA,EAAW,KAAA;AAAA,EAAO,cAAA,EAAgB,IAAA;AAAA,EAAM,KAAA,EAAO,KAAA;AAAA,EAAO,KAAA,EAAO,OAAA;AAAA,EAC7F,QAAA,EAAU,IAAA;AAAA,EAAM,SAAA,EAAW,IAAA;AAAA,EAAM,WAAA,EAAa,IAAA;AAAA,EAAM,IAAA,EAAM,QAAA;AAAA,EAAU,MAAA,EAAQ,IAAA;AAAA,EAAM,SAAA,EAAW,GAAA;AAAA,EAC7F,MAAA,EAAQ,GAAA;AAAA,EAAK,IAAA,EAAM,MAAA;AAAA,EAAQ,SAAA,EAAW,KAAA;AAAA,EAAO,WAAA,EAAa,KAAA;AAAA,EAAO,IAAA,EAAM;AACzE,CAAA;AACA,IAAM,QAAQ,CAAC,KAAA,KACb,KAAA,CAAM,IAAA,CAAK,SAAS,SAAA,GAAY,CAAA,CAAA,EAAI,KAAA,CAAM,KAAA,CAAM,KAAe,CAAA,CAAA,GAAM,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,IAAK,KAAA;AAQ7F,IAAM,cAAcC,iCAAA,CAAoC;AAAA,EAC7D,IAAA,EAAM,aAAA;AAAA,EACN,QAAA,EAAU,EAAA;AAAA,EACV,gBAAgB,EAAE,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,EAAC,EAAE;AAAA,EAC9C,KAAA,EAAO,CAAC,OAAA,EAAS,EAAE,WAAU,KAAgC;AAC3D,IAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AACtD,IAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,CAAC,IAAA,EAAgB,OAAA,MAA+B;AAAA,MAC/D,KAAA,EAAO,EAAE,GAAA,EAAK,EAAE,SAAS,IAAA,CAAK,CAAC,CAAA,IAAK,KAAA,EAAM,EAAG,UAAA,EAAY,EAAE,OAAA,EAAS,MAAK,EAAE;AAAA,MAC3E,OAAA;AAAA,MACA,KAAA,EAAO,OAAA;AAAA,MACP,QAAA,EAAU,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,QAC3B,GAAA;AAAA,QACA,QAAA,EAAU,EAAA;AAAA,QACV,QAAA,EAAU,CAAC,EAAA,MAAqB,EAAE,GAAA,EAAK,YAAY,CAAA,CAAE,WAAA,CAAY,EAAA,EAAI,KAAK,CAAA,EAAE;AAAA,OAC9E,CAAE,CAAA;AAAA,MACF,KAAA,EAAO,CAAC,IAAA,KAAiB;AACvB,QAAA,MAAM,GAAA,GAAM,KAAK,QAAA,CAAS,IAAA,CAAK,MAAM,GAAa,CAAA,GAAK,IAAA,CAAK,KAAA,CAAM,GAAA,GAAiB,KAAA;AACnF,QAAA,MAAM,KAAA,GAAe,EAAE,GAAI,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,KAAK,CAAA,IAAK,EAAC,EAAG;AAClF,QAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,KAAA,CAAM,IAAA,GAAO,EAAA;AACpC,QAAA,OAAO,CAAC,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA;AAAA,MACvB;AAAA,KACF,CAAA;AACA,IAAA,OAAO;AAAA,MACL,GAAI,UAAA,CAAW,MAAA,GAAS,EAAE,aAAA,EAAe,SAAS,UAAA,EAAY,QAAQ,CAAA,EAAE,GAAI,EAAC;AAAA,MAC7E,GAAI,UAAA,CAAW,MAAA,GAAS,EAAE,aAAA,EAAe,SAAS,UAAA,EAAY,SAAS,CAAA,EAAE,GAAI;AAAC,KAChF;AAAA,EACF,CAAA;AAAA,EACA,KAAA,EAAO,CAAC,OAAA,EAAS,EAAE,WAAU,KAAgC;AAC3D,IAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,OAAA,EAAS,SAAS,CAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,WAAA,CAAY,MAAA,CAAO,CAAA,CAAE,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,EAAC;AAC1B,IAAA,OAAO;AAAA,MACL,UAAA,EAAY;AAAA,QACV,KAAA,EAAO,EAAE,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,EAAO,EAAG,UAAA,EAAY,EAAE,OAAA,EAAS,IAAA,EAAK,EAAE;AAAA,QACjE,QAAA,EAAU,EAAA;AAAA;AAAA,QACV,QAAA,EAAU,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,UAC3B,GAAA;AAAA,UACA,QAAA,EAAU,EAAA;AAAA,UACV,QAAA,EAAU,CAAC,EAAA,KAAoB;AAC7B,YAAA,MAAM,UAAA,GAAa,CAAA,CAAE,WAAA,CAAY,EAAA,EAAI,KAAK,CAAA;AAE1C,YAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,CAAC,UAAA,EAAY,OAAO,KAAA;AAC1C,YAAA,OAAO,EAAE,KAAK,UAAA,EAAW;AAAA,UAC3B;AAAA,SACF,CAAE,CAAA;AAAA,QACF,KAAA,EAAO,CAAC,IAAA,KAAe;AACrB,UAAA,MAAM,GAAA,GAAM,KAAK,QAAA,CAAS,IAAA,CAAK,MAAM,GAAa,CAAA,GAAK,IAAA,CAAK,KAAA,CAAM,GAAA,GAAiB,MAAA;AACnF,UAAA,OAAO,CAAC,GAAA,EAAK,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,KAAK,CAAA,IAAK,EAAC,EAAG,CAAC,CAAA;AAAA,QACvE;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EACA,gBAAA,EAAkB,CAAC,OAAA,KAAY;AAC7B,IAAA,MAAM,CAAA,GAAI,iBAAiB,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACL;AAAA,QACE,KAAA,EAAO,WAAA;AAAA,QACP,UAAA,EAAY;AAAA,UACV,cAAA,EAAgB;AAAA,YACd,OAAA,EAAS,IAAA;AAAA,YACT,WAAW,CAAC,EAAA,KAAO,CAAA,CAAE,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,YACzC,UAAA,EAAY,CAAC,KAAA,EAAO,KAAA,KAAU,CAAA,CAAE,WAAW,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,EAAO,IAAI;AAAA;AACtE;AACF;AACF,KACF;AAAA,EACF;AACF,CAAC","file":"chunk-BMUV6KRM.cjs","sourcesContent":["import type { DOMOutputSpec, Mark, MarkSpec, Node as PMNode, NodeSpec } from \"prosemirror-model\";\nimport { defineExtension } from \"../core/extension\";\nimport { sanitizeUrl, type UrlPolicy } from \"../core/url\";\n\n/**\n * One allowlist rule. Strings support a trailing \"*\" wildcard (\"data-*\", \"aria-*\").\n *\n * ```ts\n * HtmlSupport.configure({ allow: [\n *   { name: \"section\", classes: true, attributes: [\"data-*\", \"id\"] },\n *   { name: /^(span|abbr)$/, attributes: [\"title\", \"lang\"], classes: [\"highlight\", /^tag-/] },\n *   { name: \"p\", styles: [\"color\", \"background-color\"] },\n * ]})\n * ```\n */\nexport interface HtmlRule {\n  name: string | RegExp;\n  attributes?: true | Array<string | RegExp>;\n  classes?: true | Array<string | RegExp>;\n  /** CSS properties allowed in `style`. Note: inline styles in the live editor need\n   * `style-src-attr 'unsafe-inline'` under CSP; leave this out to stay strict-CSP clean. */\n  styles?: true | Array<string | RegExp>;\n}\n\nexport interface HtmlSupportOptions {\n  /** Rules for markup to keep, or \"safe\" for a sensible preset (no styles, no scripts). */\n  allow: HtmlRule[] | \"safe\";\n  /** Rules that win over `allow`. */\n  disallow: HtmlRule[];\n}\n\n/** Elements kept as generic block containers (content: blocks). */\nexport const HTML_CONTAINERS = [\n  \"div\", \"section\", \"article\", \"aside\", \"header\", \"footer\", \"nav\", \"main\", \"address\", \"hgroup\",\n  \"details\", \"dl\", \"dd\", \"center\", \"search\",\n];\n/** Elements kept as generic text blocks (content: inline). */\nexport const HTML_TEXTBLOCKS = [\"summary\", \"dt\"];\n/** Elements kept as generic inline wrappers. */\nexport const HTML_INLINE = [\n  \"span\", \"abbr\", \"cite\", \"dfn\", \"kbd\", \"mark\", \"q\", \"small\", \"time\", \"var\", \"samp\", \"bdi\", \"bdo\",\n  \"data\", \"big\", \"ruby\", \"rt\", \"rp\",\n];\n\n/** Element names of the built-in node/mark types that may receive extra attributes. */\nconst KNOWN_TYPES = [\n  \"paragraph\", \"heading\", \"blockquote\", \"bulletList\", \"orderedList\", \"listItem\", \"taskList\", \"taskItem\",\n  \"codeBlock\", \"horizontalRule\", \"image\", \"table\", \"tableRow\", \"tableCell\", \"tableHeader\",\n  \"bold\", \"italic\", \"underline\", \"strike\", \"code\", \"subscript\", \"superscript\", \"link\",\n];\n\nexport const HTML_SAFE_RULES: HtmlRule[] = [\n  {\n    name: new RegExp(`^(${[...HTML_CONTAINERS, ...HTML_TEXTBLOCKS].join(\"|\")})$`),\n    attributes: [\"data-*\", \"id\", \"title\", \"lang\", \"aria-label\", \"aria-labelledby\", \"aria-describedby\", \"role\"],\n    classes: true,\n  },\n  {\n    name: new RegExp(`^(${HTML_INLINE.join(\"|\")})$`),\n    attributes: [\"data-*\", \"title\", \"lang\", \"dir\", \"datetime\", \"value\", \"cite\", \"translate\"],\n    classes: true,\n  },\n  {\n    name: /^(p|h[1-6]|blockquote|ul|ol|li|table|tr|td|th|pre|code|figure|img|a|strong|em|u|s|sub|sup|hr)$/,\n    attributes: [\"data-*\", \"id\", \"lang\", \"translate\"],\n    classes: true,\n  },\n];\n\n/** Attributes managed by the schema itself, never through HtmlSupport. */\nconst RESERVED = new Set([\n  \"src\", \"srcset\", \"href\", \"alt\", \"width\", \"height\", \"start\", \"type\", \"dir\", \"colspan\", \"rowspan\",\n  \"colwidth\", \"scope\", \"title\", \"data-type\", \"data-checked\", \"data-colwidth\", \"data-language\", \"open\",\n]);\n/** Never kept, whatever the rules say. */\nconst DENIED = /^(on|xmlns|xlink)|^(srcdoc|formaction|action|ping|background|tabindex|accesskey|autofocus|contenteditable|draggable|hidden|inert|popover|popovertarget|is|slot|part|nonce|style|class)$|^data-(pm|owe)-/i;\nconst URL_ATTRS = new Set([\"cite\", \"longdesc\"]);\nconst ROLES = new Set([\"note\", \"region\", \"group\", \"figure\", \"doc-note\", \"doc-example\", \"doc-tip\", \"doc-pullquote\", \"doc-epigraph\", \"presentation\", \"none\"]);\nconst CLASS = /^-?[A-Za-z_][\\w-]{0,63}$/;\nconst ID = /^[A-Za-z][\\w:.-]{0,63}$/;\nconst LANG = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{1,8})*$/;\n// eslint-disable-next-line no-control-regex\nconst UNSAFE_VALUE = /[\\u0000-\\u001f]/;\nconst UNSAFE_CSS = /url\\s*\\(|expression\\s*\\(|javascript:|@import|[<>\\\\]|behavior\\s*:|-moz-binding/i;\n\ntype Attrs = Record<string, string>;\n\nconst matchesName = (pattern: string | RegExp, name: string): boolean =>\n  typeof pattern === \"string\"\n    ? pattern.endsWith(\"*\")\n      ? name.startsWith(pattern.slice(0, -1).toLowerCase())\n      : pattern.toLowerCase() === name\n    : pattern.test(name);\n\nconst allowedBy = (list: true | Array<string | RegExp> | undefined, name: string): boolean =>\n  list === true || (!!list && list.some((p) => matchesName(p, name)));\n\nexport function createHtmlFilter(options: HtmlSupportOptions, policy: UrlPolicy = {}) {\n  const allow = options.allow === \"safe\" ? HTML_SAFE_RULES : options.allow;\n  const deny = options.disallow;\n  const rulesFor = (tag: string, rules: HtmlRule[]) => rules.filter((r) => matchesName(r.name, tag));\n\n  const tagAllowed = (tag: string) =>\n    rulesFor(tag, allow).length > 0 && !rulesFor(tag, deny).some((r) => !r.attributes && !r.classes && !r.styles);\n\n  function permits(tag: string, kind: \"attributes\" | \"classes\" | \"styles\", name: string): boolean {\n    const yes = rulesFor(tag, allow).some((r) => allowedBy(r[kind], name));\n    const no = rulesFor(tag, deny).some((r) => allowedBy(r[kind], name));\n    return yes && !no;\n  }\n\n  function validValue(name: string, value: string): string | null {\n    if (value.length > 2000 || UNSAFE_VALUE.test(value)) return null;\n    if (URL_ATTRS.has(name)) return sanitizeUrl(value, policy);\n    if (name === \"id\") {\n      if (!ID.test(value)) return null;\n      // Ids that shadow window/document properties enable DOM clobbering.\n      if (typeof window !== \"undefined\" && (value in window || value in document)) return null;\n    }\n    if (name === \"lang\" && !LANG.test(value)) return null;\n    if (name === \"role\" && !ROLES.has(value)) return null;\n    if (name === \"dir\" && !/^(ltr|rtl|auto)$/.test(value)) return null;\n    return value;\n  }\n\n  /** Filters an element's attributes. `reserved` excludes attributes the schema already owns. */\n  function filter(tag: string, read: (name: string) => string | null, names: string[], reserved: boolean): Attrs | null {\n    const out: Attrs = {};\n    for (const raw of names) {\n      const name = raw.toLowerCase();\n      const value = read(raw);\n      if (value === null) continue;\n      if (name === \"class\") {\n        const classes = value\n          .split(/\\s+/)\n          .filter((c) => c && CLASS.test(c) && !/^(owe-|ProseMirror)/.test(c) && permits(tag, \"classes\", c));\n        if (classes.length) out.class = classes.join(\" \");\n        continue;\n      }\n      if (name === \"style\") {\n        const decls: string[] = [];\n        for (const decl of value.split(\";\")) {\n          const i = decl.indexOf(\":\");\n          if (i < 1) continue;\n          const prop = decl.slice(0, i).trim().toLowerCase();\n          const val = decl.slice(i + 1).trim();\n          if (!/^-?[a-z][a-z-]*$/.test(prop) || !val || UNSAFE_CSS.test(val) || val.length > 200) continue;\n          if (permits(tag, \"styles\", prop)) decls.push(`${prop}: ${val}`);\n        }\n        if (decls.length) out.style = decls.join(\"; \");\n        continue;\n      }\n      if (DENIED.test(name) || (reserved && RESERVED.has(name))) continue;\n      if (!permits(tag, \"attributes\", name)) continue;\n      const valid = validValue(name, value);\n      if (valid !== null) out[name] = valid;\n    }\n    return Object.keys(out).length ? out : null;\n  }\n\n  const fromElement = (el: Element, reserved: boolean) =>\n    filter(el.tagName.toLowerCase(), (n) => el.getAttribute(n), el.getAttributeNames(), reserved);\n\n  /** Re-validates stored attributes at render time (JSON input bypasses parsing). */\n  const revalidate = (tag: string, value: unknown, reserved: boolean): Attrs | null => {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n    const stored = value as Record<string, unknown>;\n    const names = Object.keys(stored).filter((k) => Object.prototype.hasOwnProperty.call(stored, k));\n    return filter(tag, (n) => (typeof stored[n] === \"string\" ? (stored[n] as string) : null), names, reserved);\n  };\n\n  return { tagAllowed, fromElement, revalidate };\n}\n\nconst NODE_TAG: Record<string, string> = {\n  paragraph: \"p\", blockquote: \"blockquote\", bulletList: \"ul\", orderedList: \"ol\", listItem: \"li\",\n  taskList: \"ul\", taskItem: \"li\", codeBlock: \"pre\", horizontalRule: \"hr\", image: \"img\", table: \"table\",\n  tableRow: \"tr\", tableCell: \"td\", tableHeader: \"th\", bold: \"strong\", italic: \"em\", underline: \"u\",\n  strike: \"s\", code: \"code\", subscript: \"sub\", superscript: \"sup\", link: \"a\",\n};\nconst tagOf = (owner: PMNode | Mark): string =>\n  owner.type.name === \"heading\" ? `h${owner.attrs.level as number}` : (NODE_TAG[owner.type.name] ?? \"div\");\n\n/**\n * General HTML support: keeps markup the editor doesn't model natively — wrappers like\n * <section>/<div>, inline elements like <abbr title>/<span lang>, and extra classes, data-*, ids\n * and (opt-in) styles on known elements — within an allowlist. Everything still passes the\n * sanitizer, URL policy and output validation.\n */\nexport const HtmlSupport = defineExtension<HtmlSupportOptions>({\n  name: \"htmlSupport\",\n  priority: 90,\n  defaultOptions: { allow: \"safe\", disallow: [] },\n  nodes: (options, { urlPolicy }): Record<string, NodeSpec> => {\n    const f = createHtmlFilter(options, urlPolicy);\n    const containers = HTML_CONTAINERS.filter(f.tagAllowed);\n    const textblocks = HTML_TEXTBLOCKS.filter(f.tagAllowed);\n    const nodeSpec = (tags: string[], content: string): NodeSpec => ({\n      attrs: { tag: { default: tags[0] ?? \"div\" }, attributes: { default: null } },\n      content,\n      group: \"block\",\n      parseDOM: tags.map((tag) => ({\n        tag,\n        priority: 40,\n        getAttrs: (el: HTMLElement) => ({ tag, attributes: f.fromElement(el, false) }),\n      })),\n      toDOM: (node: PMNode) => {\n        const tag = tags.includes(node.attrs.tag as string) ? (node.attrs.tag as string) : \"div\";\n        const attrs: Attrs = { ...(f.revalidate(tag, node.attrs.attributes, false) ?? {}) };\n        if (tag === \"details\") attrs.open = \"\"; // keep collapsible content editable/visible\n        return [tag, attrs, 0] as DOMOutputSpec;\n      },\n    });\n    return {\n      ...(containers.length ? { htmlContainer: nodeSpec(containers, \"block+\") } : {}),\n      ...(textblocks.length ? { htmlTextblock: nodeSpec(textblocks, \"inline*\") } : {}),\n    };\n  },\n  marks: (options, { urlPolicy }): Record<string, MarkSpec> => {\n    const f = createHtmlFilter(options, urlPolicy);\n    const tags = HTML_INLINE.filter(f.tagAllowed);\n    if (!tags.length) return {};\n    return {\n      htmlInline: {\n        attrs: { tag: { default: \"span\" }, attributes: { default: null } },\n        excludes: \"\", // different wrappers (and nested spans) can coexist\n        parseDOM: tags.map((tag) => ({\n          tag,\n          priority: 40,\n          getAttrs: (el: HTMLElement) => {\n            const attributes = f.fromElement(el, false);\n            // A bare <span> carries no meaning — let its content parse normally.\n            if (tag === \"span\" && !attributes) return false;\n            return { tag, attributes };\n          },\n        })),\n        toDOM: (mark: Mark) => {\n          const tag = tags.includes(mark.attrs.tag as string) ? (mark.attrs.tag as string) : \"span\";\n          return [tag, f.revalidate(tag, mark.attrs.attributes, false) ?? {}, 0] as DOMOutputSpec;\n        },\n      },\n    };\n  },\n  globalAttributes: (options) => {\n    const f = createHtmlFilter(options);\n    return [\n      {\n        types: KNOWN_TYPES,\n        attributes: {\n          htmlAttributes: {\n            default: null,\n            parseHTML: (el) => f.fromElement(el, true),\n            renderHTML: (value, owner) => f.revalidate(tagOf(owner), value, true),\n          },\n        },\n      },\n    ];\n  },\n});\n"]}

package/dist/{chunk-HNGUZYL2.cjs → chunk-GAOA25B3.cjs}

@@ -149,9 +149,13 @@ var FORBIDDEN_OUTPUT = /* @__PURE__ */ new Set([
   "frameset",
   "template",
   "noscript",
-  "form"
+  "form",
+  // Foreign content: SVG animation attributes (values/to/from) can set javascript: URLs.
+  "svg",
+  "math"
 ]);
 var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "cite", "poster", "action", "background"]);
+var IMAGE_ATTRS = /* @__PURE__ */ new Set(["src", "poster"]);
 var DROP_ATTRS = /* @__PURE__ */ new Set(["srcdoc", "srcset", "formaction", "xlink:href", "ping"]);
 var NBSP = new RegExp(String.fromCharCode(160), "g");
 var escapeText = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(NBSP, "&nbsp;");
@@ -163,7 +167,7 @@ function renderAttrs(raw, policy) {
     const lower = name.toLowerCase();
     if (!ATTR_NAME.test(name) || lower.startsWith("on") || DROP_ATTRS.has(lower)) continue;
     if (URL_ATTRS.has(lower)) {
-      const safe = sanitizeUrl(String(value), { ...policy, allowDataImages: true }, lower === "src" ? "image" : "link");
+      const safe = sanitizeUrl(String(value), policy, IMAGE_ATTRS.has(lower) ? "image" : "link");
       if (safe !== null) attrs += ` ${name}="${escapeAttr(safe)}"`;
       continue;
     }
@@ -1732,6 +1736,9 @@ function setBlockAttrs(types, attrs) {
 
 // src/extensions/attributes.ts
 var ALIGNMENTS = ["start", "center", "end", "justify"];
+var DIRECTIONS = ["ltr", "rtl", "auto"];
+var alignOf = (value) => value !== "start" && ALIGNMENTS.includes(value) ? value : null;
+var dirOf = (value) => DIRECTIONS.includes(value) ? value : null;
 var TextAlign = defineExtension({
   name: "textAlign",
   defaultOptions: { types: ["paragraph", "heading"], output: "style" },
@@ -1749,8 +1756,15 @@ var TextAlign = defineExtension({
             }
             return ALIGNMENTS.includes(raw) && raw !== "start" ? raw : null;
           },
-          renderHTML: (value) => value ? output === "class" ? { class: `owe-align-${value}` } : { style: `text-align: ${value}` } : null,
-          renderDOM: (value) => value ? { class: `owe-align-${String(value)}` } : null
+          renderHTML: (value) => {
+            const align = alignOf(value);
+            if (!align) return null;
+            return output === "class" ? { class: `owe-align-${align}` } : { style: `text-align: ${align}` };
+          },
+          renderDOM: (value) => {
+            const align = alignOf(value);
+            return align ? { class: `owe-align-${align}` } : null;
+          }
         }
       }
     }
@@ -1778,12 +1792,12 @@ var TextDirection = defineExtension({
     const attr = (auto) => ({
       dir: {
         default: null,
-        parseHTML: (el) => {
-          const dir = el.getAttribute("dir")?.toLowerCase();
-          return dir === "ltr" || dir === "rtl" || dir === "auto" ? dir : null;
-        },
+        parseHTML: (el) => dirOf(el.getAttribute("dir")?.toLowerCase()),
         // Empty blocks inherit the editor direction so the caret starts on the correct side.
-        renderHTML: (value, node) => value ? { dir: String(value) } : auto && "content" in node && node.content.size > 0 ? { dir: "auto" } : null
+        renderHTML: (value, node) => {
+          const dir = dirOf(value);
+          return dir ? { dir } : auto && "content" in node && node.content.size > 0 ? { dir: "auto" } : null;
+        }
       }
     });
     return [
@@ -1985,14 +1999,19 @@ var OrderedList = defineExtension({
           }
         }
       ],
-      toDOM: (node) => [
-        "ol",
-        {
-          start: node.attrs.start === 1 ? null : String(node.attrs.start),
-          type: node.attrs.type
-        },
-        0
-      ]
+      // Re-checked here: JSON content and clipboard slice context skip getAttrs.
+      toDOM: (node) => {
+        const start = Number(node.attrs.start);
+        const type = node.attrs.type;
+        return [
+          "ol",
+          {
+            start: Number.isInteger(start) && start !== 1 ? String(start) : null,
+            type: typeof type === "string" && /^[1aAiI]$/.test(type) ? type : null
+          },
+          0
+        ];
+      }
     }
   }),
   commands: ({ schema }) => ({
@@ -3180,5 +3199,5 @@ exports.toggleList = toggleList;
 exports.toggleMarkCommand = toggleMarkCommand;
 exports.toggleWrap = toggleWrap;
 exports.uid = uid;
-//# sourceMappingURL=chunk-HNGUZYL2.cjs.map
-//# sourceMappingURL=chunk-HNGUZYL2.cjs.map
+//# sourceMappingURL=chunk-GAOA25B3.cjs.map
+//# sourceMappingURL=chunk-GAOA25B3.cjs.map