prreviewbuddy 0.55.6 → 0.56.0

package/dist/{delete_review-DEvRanb6.js → delete_review-C5bz0Pts.js}

@@ -6235,7 +6235,7 @@ function sanitiseThread(value, seen) {
 	const comments = rawComments.slice(0, 100).map(sanitiseComment).filter((c) => c !== null);
 	if (comments.length === 0) return null;
 	const dropped = Math.max(0, rawComments.length - comments.length);
-	const declared = count(value.truncatedCommentCount);
+	const declared = count$1(value.truncatedCommentCount);
 	return {
 		id,
 		type: value.type,
@@ -6260,7 +6260,7 @@ function sanitiseComment(value) {
 		body,
 		timestamp: timestamp(value.timestamp),
 		replyToId: label(value.replyToId) || null,
-		url: href(value.url)
+		url: href$1(value.url)
 	};
 }
 function sanitiseLocation(value) {
@@ -6269,7 +6269,7 @@ function sanitiseLocation(value) {
 	if (!file) return null;
 	return {
 		file,
-		line: count(value.line) || null,
+		line: count$1(value.line) || null,
 		side: value.side === "LEFT" ? "LEFT" : "RIGHT",
 		lineIsOriginal: value.lineIsOriginal === true,
 		commitSha: label(value.commitSha) || null
@@ -6289,8 +6289,8 @@ function sanitiseDecision(value) {
 }
 function sanitisePullRequest(value) {
 	if (!isRecord(value)) return null;
-	const number = count(value.number);
-	const url = href(value.url);
+	const number = count$1(value.number);
+	const url = href$1(value.url);
 	if (!number || !url) return null;
 	const pr = {
 		provider: label(value.provider) || "unknown",
@@ -6306,7 +6306,7 @@ function sanitisePullRequest(value) {
 	if (headRef) pr.headRef = headRef;
 	const baseRef = label(value.baseRef);
 	if (baseRef) pr.baseRef = baseRef;
-	const filesUrl = href(value.filesUrl);
+	const filesUrl = href$1(value.filesUrl);
 	if (filesUrl) pr.filesUrl = filesUrl;
 	const template = fileUrlTemplate$1(value.fileUrlTemplate);
 	if (template) pr.fileUrlTemplate = template;
@@ -6327,7 +6327,7 @@ function pullRequestAuthor(value) {
 	if (name) author.name = name;
 	const handle = label(value.handle).replace(/^@+/, "");
 	if (handle) author.handle = handle;
-	const url = href(value.url);
+	const url = href$1(value.url);
 	if (url) author.url = url;
 	return author.name || author.handle ? author : null;
 }
@@ -6339,7 +6339,7 @@ function label(value) {
 	return typeof value === "string" ? value.trim().slice(0, 200) : "";
 }
 /** A non-negative integer, or 0. Strings are not numbers here, however numeric they look. */
-function count(value) {
+function count$1(value) {
 	return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : 0;
 }
 /** Kept only if it parses. An unparseable date sorts and renders as nothing rather than as a lie. */
@@ -6364,7 +6364,7 @@ function fileUrlTemplate$1(value) {
 	if (typeof value !== "string") return "";
 	const trimmed = value.trim();
 	if (!trimmed.includes("{")) return "";
-	return href(fillFileUrlTemplate(trimmed, "a")) ? trimmed : "";
+	return href$1(fillFileUrlTemplate(trimmed, "a")) ? trimmed : "";
 }
 /**
 * Substitute a path into a template.
@@ -6376,7 +6376,7 @@ function fileUrlTemplate$1(value) {
 function fillFileUrlTemplate(template, path) {
 	return template.replace(/\{path\}/g, path).replace(/\{pathEncoded\}/g, encodeURIComponent(path)).replace(/\{pathSha1\}/g, () => createHash("sha1").update(path).digest("hex")).replace(/\{pathSha256\}/g, () => createHash("sha256").update(path).digest("hex"));
 }
-function href(value) {
+function href$1(value) {
 	if (typeof value !== "string") return "";
 	try {
 		const url = new URL(value.trim());
@@ -9406,6 +9406,436 @@ function renderInlineText(value) {
 //#region ../../packages/review-harness/src/domain/utils/code_block.ts
 var CODE_BLOCK_CLASS = "pr-helper-code-block";
 var CODE_COPY_CLASS = "pr-helper-code-copy";
+var LINE_START_TOKEN = /^\u0002(\d+)\u0002/;
+/** Anything outside this set (javascript:, data:, vbscript:, a relative path) is not a link. */
+var SAFE_HREF = /^(?:https?:\/\/|#)/i;
+/** Media is linked only over https: a link the reader opens in their own session. */
+var MEDIA_HREF = /^https:\/\//i;
+var GENERIC_ALT = /^(?:image|img|screenshot|screen ?shot|picture|photo|pic)$/i;
+var FILE_NAME = /\.(?:png|jpe?g|gif|webp|svg|bmp|heic|avif|tiff?)$/i;
+/** An image's link text, from its alt text when that says what it shows. Takes and gives plain text. */
+function imageLabel(alt) {
+	const text = (alt ?? "").trim();
+	return !text || GENERIC_ALT.test(text) || FILE_NAME.test(text) ? "View attached image" : `View image: ${text}`;
+}
+/**
+* A link to an image, audio or video, or null when its address is not https. Both arguments are
+* already escaped: the Markdown rules hand over escaped text, and liftHtml escapes before calling.
+*/
+function mediaAnchor(href, label) {
+	return MEDIA_HREF.test(href) ? `<a href="${href}" target="_blank" rel="noopener noreferrer">${label}</a>` : null;
+}
+function mediaFromHtml(src, label) {
+	return mediaAnchor(escapeHtml((src ?? "").trim()), escapeHtml(label));
+}
+var align = (value) => /^(?:left|right|center|justify)$/i.test(value) ? value.toLowerCase() : null;
+var span = (value) => /^[1-9]\d{0,2}$/.test(value) ? value : null;
+var count = (value) => /^\d{1,9}$/.test(value) ? value : null;
+var title = (value) => value.slice(0, 300);
+var href = (value) => {
+	const url = value.trim();
+	return SAFE_HREF.test(url) ? url : null;
+};
+/** Maps, not objects, so a name every object inherits (`constructor`, `__proto__`) is in neither. */
+var ALLOWED = new Map(Object.entries({
+	a: {
+		href,
+		title
+	},
+	abbr: { title },
+	b: {},
+	blockquote: {},
+	br: {},
+	caption: { align },
+	cite: {},
+	code: {},
+	dd: {},
+	del: {},
+	details: {},
+	div: { align },
+	dl: {},
+	dt: {},
+	em: {},
+	hr: {},
+	i: {},
+	ins: {},
+	kbd: {},
+	li: {},
+	mark: {},
+	ol: { start: count },
+	p: { align },
+	q: {},
+	s: {},
+	samp: {},
+	small: {},
+	span: {},
+	strike: {},
+	strong: {},
+	sub: {},
+	summary: {},
+	sup: {},
+	table: { align },
+	tbody: {},
+	td: {
+		align,
+		colspan: span,
+		rowspan: span
+	},
+	tfoot: {},
+	th: {
+		align,
+		colspan: span,
+		rowspan: span
+	},
+	thead: {},
+	tr: { align },
+	u: {},
+	ul: {},
+	var: {},
+	h1: { align },
+	h2: { align },
+	h3: { align },
+	h4: { align },
+	h5: { align },
+	h6: { align }
+}).map(([tag, checks]) => [tag, new Map(Object.entries({
+	title,
+	...checks
+}))]));
+var VOID = /* @__PURE__ */ new Set([
+	"br",
+	"hr",
+	"img",
+	"input",
+	"source",
+	"meta",
+	"link",
+	"base",
+	"wbr",
+	"col",
+	"area",
+	"track",
+	"param",
+	"embed"
+]);
+/** Gone, with everything inside them: what they hold is code, styling or someone else's page. */
+var DROP_WITH_CONTENT = /* @__PURE__ */ new Set([
+	"script",
+	"style",
+	"iframe",
+	"object",
+	"embed",
+	"svg",
+	"math",
+	"template",
+	"noscript",
+	"textarea",
+	"frame",
+	"frameset",
+	"applet",
+	"head",
+	"title",
+	"select"
+]);
+/** Gone, keeping what they hold: the words in a form or a figure are still the author's. */
+var DROP_KEEP_CONTENT = /* @__PURE__ */ new Set([
+	"picture",
+	"pre",
+	"source",
+	"track",
+	"input",
+	"form",
+	"label",
+	"button",
+	"option",
+	"optgroup",
+	"font",
+	"center",
+	"section",
+	"article",
+	"header",
+	"footer",
+	"nav",
+	"figure",
+	"figcaption",
+	"main",
+	"aside",
+	"html",
+	"body",
+	"meta",
+	"link",
+	"base",
+	"wbr",
+	"col",
+	"colgroup",
+	"area",
+	"map",
+	"param",
+	"fieldset",
+	"legend",
+	"dialog"
+]);
+/** Tags that open an HTML block when a line begins with one (CommonMark's sixth kind). */
+var BLOCK = /* @__PURE__ */ new Set([
+	"address",
+	"article",
+	"aside",
+	"blockquote",
+	"caption",
+	"center",
+	"dd",
+	"details",
+	"dialog",
+	"div",
+	"dl",
+	"dt",
+	"fieldset",
+	"figcaption",
+	"figure",
+	"footer",
+	"form",
+	"h1",
+	"h2",
+	"h3",
+	"h4",
+	"h5",
+	"h6",
+	"header",
+	"hr",
+	"li",
+	"main",
+	"nav",
+	"ol",
+	"p",
+	"pre",
+	"section",
+	"summary",
+	"table",
+	"tbody",
+	"td",
+	"tfoot",
+	"th",
+	"thead",
+	"tr",
+	"ul"
+]);
+/**
+* The tag a raw line opens an HTML block with, as GitHub reads one: the line begins, after at most
+* three spaces, with a block tag. Until the next blank line it is HTML, with no Markdown inside.
+* The preview splits a description with this, so it agrees with the renderer on where one ends.
+*/
+function opensHtmlBlock(line) {
+	const match = line.match(/^ {0,3}<\/?([A-Za-z][A-Za-z0-9]*)(?=[\s/>]|$)/);
+	return Boolean(match && BLOCK.has(match[1].toLowerCase()));
+}
+var SCAN = new RegExp([
+	"`[^`\\n]+`",
+	"<(\\/?)([A-Za-z][A-Za-z0-9-]*)((?:\\s+[^\\s\"'<>\\/=]+(?:\\s*=\\s*(?:\"[^\"]*\"|'[^']*'|[^\\s\"'=<>`]+))?)*)\\s*(\\/?)>",
+	"&(?:#\\d{1,7}|#[xX][0-9a-fA-F]{1,6}|[A-Za-z][A-Za-z0-9]{1,31});"
+].join("|"), "g");
+var ATTRIBUTE = /([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+/** An attribute's value as the author meant it: entities in it are read, so `&amp;` is one `&`. */
+function decodeEntities(value) {
+	return value.replace(/&(#\d{1,7}|#[xX][0-9a-fA-F]{1,6}|amp|lt|gt|quot|apos|nbsp);/g, (_match, entity) => {
+		if (entity[0] === "#") {
+			const code = entity[1] === "x" || entity[1] === "X" ? parseInt(entity.slice(2), 16) : parseInt(entity.slice(1), 10);
+			return code > 0 && code <= 1114111 ? String.fromCodePoint(code) : "";
+		}
+		return {
+			amp: "&",
+			lt: "<",
+			gt: ">",
+			quot: "\"",
+			apos: "'",
+			nbsp: "\xA0"
+		}[entity] ?? "";
+	});
+}
+function attributesOf(source) {
+	const result = /* @__PURE__ */ new Map();
+	for (const match of source.matchAll(ATTRIBUTE)) {
+		const name = match[1].toLowerCase();
+		if (!result.has(name)) result.set(name, decodeEntities(match[2] ?? match[3] ?? match[4] ?? ""));
+	}
+	return result;
+}
+/** A heading is drawn three levels down, as Markdown headings are here: these sit inside a sidebar. */
+function emittedTag(name) {
+	const heading = name.match(/^h([1-6])$/);
+	return heading ? `h${Math.min(Number(heading[1]), 3) + 3}` : name;
+}
+function openingMarkup(name, attributeSource) {
+	const tag = emittedTag(name);
+	const allowed = ALLOWED.get(name);
+	const kept = [];
+	for (const [attribute, value] of attributesOf(attributeSource)) {
+		const check = allowed.get(attribute);
+		const safe = check ? check(value) : null;
+		if (safe !== null) kept.push(` ${attribute}="${escapeHtml(safe)}"`);
+	}
+	if (name === "a" && kept.some((attribute) => attribute.startsWith(" href="))) kept.push(" target=\"_blank\" rel=\"noopener noreferrer\"");
+	return `<${tag}${kept.join("")}>`;
+}
+/**
+* Every tag and entity the policy handles, replaced by a token; the rest left as text to be escaped.
+* Runs on Markdown with its code blocks already lifted out, so nothing in a code block is read here.
+*/
+function liftHtml(text) {
+	const tokens = [];
+	const token = (value) => `${tokens.push(value) - 1}`;
+	let out = "";
+	let last = 0;
+	SCAN.lastIndex = 0;
+	for (let match; match = SCAN.exec(text);) {
+		const [whole, slash, rawName, attributeSource, selfClosing] = match;
+		let replacement = null;
+		if (whole[0] === "&") replacement = token({
+			kind: "entity",
+			name: "",
+			tag: "",
+			markup: whole
+		});
+		else if (rawName) {
+			const name = rawName.toLowerCase();
+			if (name === "img") {
+				const attributes = attributesOf(attributeSource);
+				const alt = attributes.get("alt");
+				replacement = token({
+					kind: "text",
+					name,
+					tag: "",
+					markup: slash ? "" : mediaFromHtml(attributes.get("src"), imageLabel(alt)) ?? escapeHtml(alt ?? "")
+				});
+			} else if (name === "video" || name === "audio") {
+				let src = slash ? void 0 : attributesOf(attributeSource).get("src");
+				if (!slash && !selfClosing) {
+					const rest = text.slice(SCAN.lastIndex);
+					const close = rest.match(new RegExp(`</${name}\\s*>`, "i"));
+					const inner = close ? rest.slice(0, close.index) : "";
+					src ??= attributesOf(inner.match(/<source\b([^<>]*)>/i)?.[1] ?? "").get("src");
+					if (close) SCAN.lastIndex += close.index + close[0].length;
+				}
+				replacement = token({
+					kind: "text",
+					name,
+					tag: "",
+					markup: (slash ? null : mediaFromHtml(src, name === "video" ? "Open attached video" : "Open attached audio")) ?? ""
+				});
+			} else if (DROP_WITH_CONTENT.has(name)) {
+				if (!slash && !selfClosing && !VOID.has(name)) {
+					const close = new RegExp(`</${name}\\s*>`, "i");
+					const rest = text.slice(SCAN.lastIndex);
+					const end = rest.search(close);
+					if (end !== -1) SCAN.lastIndex += end + rest.slice(end).match(close)[0].length;
+				}
+				replacement = "";
+			} else if (DROP_KEEP_CONTENT.has(name)) replacement = token({
+				kind: "text",
+				name,
+				tag: "",
+				markup: ""
+			});
+			else if (ALLOWED.has(name)) {
+				const tag = emittedTag(name);
+				if (slash) replacement = token({
+					kind: "close",
+					name,
+					tag,
+					markup: ""
+				});
+				else if (VOID.has(name)) replacement = token({
+					kind: "void",
+					name,
+					tag,
+					markup: openingMarkup(name, attributeSource)
+				});
+				else replacement = token({
+					kind: "open",
+					name,
+					tag,
+					markup: openingMarkup(name, attributeSource)
+				});
+			}
+		}
+		if (replacement === null) continue;
+		out += text.slice(last, match.index) + replacement;
+		last = SCAN.lastIndex;
+	}
+	return {
+		text: out + text.slice(last),
+		tokens
+	};
+}
+/** Whether lifted text holds a token that is markup, which only text positions may take. */
+function holdsMarkup(text, lifted) {
+	for (const match of text.matchAll(/\u0002(\d+)\u0002/g)) if (lifted.tokens[Number(match[1])].kind !== "entity") return true;
+	return false;
+}
+/** Whether a lifted line begins with a block tag, so opens an HTML block. */
+function startsHtmlBlock(line, lifted) {
+	const match = line.match(LINE_START_TOKEN);
+	return Boolean(match && BLOCK.has(lifted.tokens[Number(match[1])].name));
+}
+/**
+* A link inside another unwrapped to its text, keeping the outer one: the destination the author
+* gave the whole thing. Media inside a link (a badge) is the usual case, written as Markdown or HTML
+* in any mix, and a browser handed nested links closes the outer one first, leaving the label linked
+* to the image. Run on finished output, where every `<a` and `</a>` is ours: the author's are
+* escaped or were rebuilt, so one rule covers every way the two were combined.
+*/
+function unnestLinks(html) {
+	const unwrapped = [];
+	return html.replace(/<a\b[^>]*>|<\/a>/g, (tag) => {
+		if (tag === "</a>") return unwrapped.pop() ? "" : tag;
+		const inner = unwrapped.length > 0;
+		unwrapped.push(inner);
+		return inner ? "" : tag;
+	});
+}
+/**
+* The tokens put back, in document order, balanced, and only where text goes.
+*
+* Only where text goes: a token that a Markdown rule carried into one of our own tags (a link's
+* destination is an attribute) is dropped, since markup there would end the attribute and start
+* another. An entity is the exception, being safe in both. The test is cheap and exact because every raw `<` and `>` in this string is ours: the
+* author's are escaped, or are the tokens themselves.
+*
+* Balanced: a closer for a tag that is not open is dropped; one for a tag further out closes what
+* is inside it first; whatever is still open at the end is closed there, inside the description.
+*/
+function restoreHtml(html, lifted) {
+	const open = [];
+	const put = (index) => {
+		const item = lifted.tokens[index];
+		if (item.kind === "open") {
+			open.push(item.tag);
+			return item.markup;
+		}
+		if (item.kind === "close") {
+			const at = open.lastIndexOf(item.tag);
+			if (at === -1) return "";
+			return open.splice(at).reverse().map((tag) => `</${tag}>`).join("");
+		}
+		return item.markup;
+	};
+	let out = "";
+	let last = 0;
+	let inTag = false;
+	for (let i = 0; i < html.length; i++) {
+		const char = html[i];
+		if (char === "<") inTag = true;
+		else if (char === ">") inTag = false;
+		else if (char === "") {
+			const end = html.indexOf("", i + 1);
+			if (end === -1) break;
+			const index = Number(html.slice(i + 1, end));
+			out += html.slice(last, i) + (inTag && lifted.tokens[index].kind !== "entity" ? "" : put(index));
+			i = end;
+			last = end + 1;
+		}
+	}
+	return out + html.slice(last) + open.reverse().map((tag) => `</${tag}>`).join("");
+}
 //#endregion
 //#region ../../packages/review-harness/src/domain/utils/markdown.ts
 var BLOCK_MARKER = "\0";
@@ -9413,10 +9843,20 @@ var INLINE_MARKER = "
";
 var BLOCK_TOKEN = /\u0000(\d+)\u0000/g;
 var BLOCK_TOKEN_LINE = /^\u0000\d+\u0000$/;
 var INLINE_TOKEN = /\u0001(\d+)\u0001/g;
-var SAFE_HREF = /^(?:https?:\/\/|#)/i;
+/**
+* Markdown a person wrote on GitHub: a PR description or comment. One policy for every place that
+* shows one, so the Author's context preview, its full view and a PR comment never disagree.
+*/
+var GITHUB_MARKDOWN = {
+	hideHtmlComments: true,
+	safeHtml: true,
+	mermaid: true
+};
 function renderMarkdown(value, options = {}) {
-	const { text, blocks } = extractFencedBlocks(scanMarkdownLines(value.replace(/[\u0000\u0001]/g, ""), options));
-	return restoreFencedBlocks(renderBlocks(text), blocks);
+	const { text, blocks } = extractFencedBlocks(scanMarkdownLines(value.replace(/[\u0000\u0001\u0002]/g, ""), options), options);
+	if (!options.safeHtml) return restoreFencedBlocks(renderBlocks(text), blocks);
+	const lifted = liftHtml(text);
+	return unnestLinks(restoreHtml(restoreFencedBlocks(renderBlocks(lifted.text, lifted), blocks), lifted));
 }
 /**
 * The fence character a line opens a code block with, or null when it opens none. Shared with the
@@ -9519,51 +9959,118 @@ function scanMarkdownLines(value, options = {}) {
 	}
 	return result;
 }
-function extractFencedBlocks(lines) {
+function extractFencedBlocks(lines, options = {}) {
 	const blocks = [];
 	const out = [];
 	let body = null;
+	let diagramTitle;
+	const close = () => {
+		out.push(`${BLOCK_MARKER}${blocks.length}${BLOCK_MARKER}`);
+		const code = body.join("\n");
+		blocks.push(diagramTitle === void 0 ? { code } : {
+			code,
+			diagram: { label: `Mermaid diagram: ${diagramTitle ?? diagramType(code)}` }
+		});
+		body = null;
+	};
 	for (const line of lines) {
 		if (line.absent) continue;
-		if (line.code === "open") body = [];
-		else if (line.code === "body") body.push(line.raw);
-		else if (line.code === "close") {
-			out.push(`${BLOCK_MARKER}${blocks.length}${BLOCK_MARKER}`);
-			blocks.push(body.join("\n"));
-			body = null;
-		} else out.push(line.visible);
-	}
-	if (body) {
-		out.push(`${BLOCK_MARKER}${blocks.length}${BLOCK_MARKER}`);
-		blocks.push(body.join("\n"));
-	}
+		if (line.code === "open") {
+			body = [];
+			diagramTitle = options.mermaid && fenceInfo(line.raw).toLowerCase() === "mermaid" ? titleAbove(out) : void 0;
+		} else if (line.code === "body") body.push(line.raw);
+		else if (line.code === "close") close();
+		else out.push(line.visible);
+	}
+	if (body) close();
 	return {
 		text: out.join("\n"),
 		blocks
 	};
 }
+/** The language a fence names, as written: `mermaid` in ```` ```mermaid ````. */
+function fenceInfo(line) {
+	return line.match(/^\s*(?:`{3,}|~{3,})\s*([\w+#.-]*)/)?.[1] ?? "";
+}
+/**
+* What the author called a diagram: the heading, or the line that is all bold, just above it, as
+* in `**Diagram Walkthrough**`. Null when the nearest line above says something else.
+*/
+function titleAbove(out) {
+	for (let i = out.length - 1; i >= 0; i--) {
+		const line = out[i].trim();
+		if (!line) continue;
+		const title = line.match(/^#{1,6}\s+(.+?)\s*#*$/)?.[1] ?? line.match(/^(\*\*|__)(.+)\1$/)?.[2];
+		return title ? title.replace(/[`*_]/g, "").trim() || null : null;
+	}
+	return null;
+}
+/**
+* A diagram's kind, from its first line that is not a directive or front matter: `flowchart`,
+* `sequenceDiagram`. Front matter is the `---` block a diagram may open with.
+*/
+function diagramType(code) {
+	const lines = code.split("\n").map((line) => line.trim());
+	let start = 0;
+	if (lines.find((line) => line) === "---") {
+		const open = lines.indexOf("---");
+		const close = lines.indexOf("---", open + 1);
+		start = close === -1 ? lines.length : close + 1;
+	}
+	return lines.slice(start).find((line) => line && !line.startsWith("%%"))?.split(/\s+/)[0] || "diagram";
+}
 function restoreFencedBlocks(html, blocks) {
-	return html.replace(BLOCK_TOKEN, (_match, index) => `<div class="${CODE_BLOCK_CLASS}"><pre><code>${escapeHtml(blocks[Number(index)])}</code></pre><button type="button" class="${CODE_COPY_CLASS}" aria-label="Copy code">Copy</button></div>`);
+	return html.replace(BLOCK_TOKEN, (_match, index) => {
+		const block = blocks[Number(index)];
+		return block.diagram ? diagramFigure(block.code, block.diagram.label) : codeBlock(block.code, "Copy", "Copy code");
+	});
+}
+function codeBlock(code, label, accessibleName, attributes = "") {
+	return `<div class="${CODE_BLOCK_CLASS}"${attributes}><pre><code>${escapeHtml(code)}</code></pre><button type="button" class="${CODE_COPY_CLASS}" aria-label="${accessibleName}">${label}</button></div>`;
+}
+var diagramCount = 0;
+/**
+* A Mermaid block as the workspace's client finds it: the source, visible and copyable, and the
+* empty places the drawing, its toggle and its failure note go. The client draws it when it first
+* comes into view; until then, without JavaScript, or when drawing fails, the source is what shows.
+*/
+function diagramFigure(code, label) {
+	const id = `prb-md-mermaid-source-${++diagramCount}`;
+	return `<figure class="prb-md-mermaid" data-md-mermaid data-state="source"><div class="prb-md-mermaid-canvas" data-md-mermaid-canvas role="img" aria-label="${escapeHtml(label)}" hidden></div><p class="prb-md-mermaid-error" data-md-mermaid-error hidden>This diagram couldn\u2019t be displayed.</p><button type="button" class="prb-md-mermaid-toggle" data-md-mermaid-toggle aria-expanded="true" aria-controls="${id}" hidden>Hide source</button>` + codeBlock(code, "Copy source", "Copy source", ` id="${id}" data-md-mermaid-source`) + `</figure>`;
 }
-function renderBlocks(text) {
+function renderBlocks(text, lifted) {
 	const out = [];
 	let paragraph = [];
 	let quote = [];
 	let list = null;
+	let html = null;
 	const flush = () => {
-		if (paragraph.length) out.push(`<p>${renderInline(paragraph.join(" "))}</p>`);
-		if (quote.length) out.push(`<blockquote>${renderInline(quote.join(" "))}</blockquote>`);
-		if (list) out.push(`<${list.tag}>${list.items.map((item) => `<li>${renderInline(item)}</li>`).join("")}</${list.tag}>`);
+		if (paragraph.length) out.push(`<p>${renderInline(paragraph.join(" "), lifted)}</p>`);
+		if (quote.length) out.push(`<blockquote>${renderInline(quote.join(" "), lifted)}</blockquote>`);
+		if (list) out.push(`<${list.tag}>${list.items.map((item) => `<li>${renderInline(item, lifted)}</li>`).join("")}</${list.tag}>`);
 		paragraph = [];
 		quote = [];
 		list = null;
 	};
 	for (const raw of text.split("\n")) {
 		const line = raw.trim();
+		if (html) {
+			if (line) {
+				html.push(escapeHtml(line));
+				continue;
+			}
+			out.push(html.join("\n"));
+			html = null;
+		}
 		if (!line) {
 			flush();
 			continue;
 		}
+		if (lifted && startsHtmlBlock(line, lifted)) {
+			flush();
+			html = [escapeHtml(line)];
+			continue;
+		}
 		if (BLOCK_TOKEN_LINE.test(line)) {
 			flush();
 			out.push(line);
@@ -9578,7 +10085,7 @@ function renderBlocks(text) {
 		if (heading) {
 			flush();
 			const level = Math.min(heading[1].length, 3) + 3;
-			out.push(`<h${level}>${renderInline(heading[2])}</h${level}>`);
+			out.push(`<h${level}>${renderInline(heading[2], lifted)}</h${level}>`);
 			continue;
 		}
 		const bullet = line.match(/^[-*+]\s+(.+)$/);
@@ -9622,14 +10129,15 @@ function renderBlocks(text) {
 		paragraph.push(line);
 	}
 	flush();
+	if (html) out.push(html.join("\n"));
 	return out.join("");
 }
-function renderInline(value) {
+function renderInline(value, lifted) {
 	const codeSpans = [];
 	return escapeHtml(value).replace(/`([^`\n]+)`/g, (_match, code) => {
 		codeSpans.push(code);
 		return `${INLINE_MARKER}${codeSpans.length - 1}${INLINE_MARKER}`;
-	}).replace(/(?<!!)\[([^\]\n]+)\]\(([^)\s]+)\)/g, (match, label, href) => SAFE_HREF.test(href) ? `<a href="${href}" target="_blank" rel="noopener noreferrer">${label}</a>` : match).replace(/\*\*([^*\n]+)\*\*/g, "<strong>$1</strong>").replace(/__([^_\n]+)__/g, "<strong>$1</strong>").replace(/(^|[^*\w])\*([^*\n]+)\*/g, "$1<em>$2</em>").replace(/(^|[^_\w])_([^_\n]+)_(?![\w_])/g, "$1<em>$2</em>").replace(INLINE_TOKEN, (_match, index) => `<code>${codeSpans[Number(index)]}</code>`);
+	}).replace(/!\[([^\]\n]*)\]\(([^)\s]+)\)/g, (match, alt, href) => lifted && !holdsMarkup(href, lifted) ? mediaAnchor(href, imageLabel(alt)) ?? match : match).replace(/(?<!!)\[([^\]\n]+)\]\(([^)\s]+)\)/g, (match, label, href) => SAFE_HREF.test(href) && !(lifted && holdsMarkup(href, lifted)) ? `<a href="${href}" target="_blank" rel="noopener noreferrer">${label}</a>` : match).replace(/\*\*([^*\n]+)\*\*/g, "<strong>$1</strong>").replace(/__([^_\n]+)__/g, "<strong>$1</strong>").replace(/(^|[^*\w])\*([^*\n]+)\*/g, "$1<em>$2</em>").replace(/(^|[^_\w])_([^_\n]+)_(?![\w_])/g, "$1<em>$2</em>").replace(INLINE_TOKEN, (_match, index) => `<code>${codeSpans[Number(index)]}</code>`);
 }
 //#endregion
 //#region ../../packages/review-harness/src/domain/ai_review/author_description.ts
@@ -9713,7 +10221,7 @@ var ATX_HEADING = /^#{1,6}(?:\s|$)/;
 * on what is code and what is a hidden comment.
 */
 function visibleLines(description) {
-	return scanMarkdownLines(description, { hideHtmlComments: true }).filter((line) => !line.absent);
+	return scanMarkdownLines(description, GITHUB_MARKDOWN).filter((line) => !line.absent);
 }
 /**
 * The description's Markdown blocks, with a code block kept whole and always a block of its own.
@@ -9721,16 +10229,24 @@ function visibleLines(description) {
 * Split where Markdown itself would end one: a blank line, a heading (always a block of its own)
 * and a list that starts straight after a paragraph. Descriptions are often written with no blank
 * lines at all, and on blank lines alone those would be one block. A line that is only a comment
-* ends a block like a blank one.
+* ends a block like a blank one. An HTML block runs from the line that opens it to the next blank
+* line whatever its lines look like, as the renderer reads it (`opensHtmlBlock`).
 */
 function blocks(description) {
 	const result = [];
 	let current = [];
+	let html = false;
 	const end = () => {
 		if (current.length) result.push(current);
 		current = [];
+		html = false;
 	};
-	for (const line of visibleLines(description)) if (line.code === "open") {
+	for (const line of visibleLines(description)) if (html && line.visible.trim() !== "" && !line.code) current.push(line);
+	else if (!line.code && opensHtmlBlock(line.visible)) {
+		end();
+		html = true;
+		current.push(line);
+	} else if (line.code === "open") {
 		end();
 		current.push(line);
 	} else if (line.code === "body") current.push(line);
@@ -9798,6 +10314,7 @@ function boundList(lines) {
 * The first block the author wrote decides what to show; the bounds decide how much of it. A
 * template's labels, comments and unticked items ahead of it are passed over, so "## Summary" opens
 * on the summary itself. A heading of the author's own is kept, with the block it introduces.
+* Formatted HTML is passed over too, so the preview opens on words.
 * A paragraph is cut after its first sentences or near a character limit, a list after its first
 * items, and a long code block is left out; nothing is cut mid-word or left as open Markdown.
 *
@@ -9814,6 +10331,7 @@ function authorPreview(description) {
 		const lines = all[i];
 		const first = lines.findIndex((line) => substance(line.visible) !== "");
 		if (first === -1) continue;
+		if (opensHtmlBlock(lines[0].visible)) continue;
 		const raw = lines.slice(first).map((line) => line.visible);
 		if (raw.length === 1 && ATX_HEADING.test(lines[first].visible.trim())) {
 			shown.push(raw[0]);
@@ -13818,4 +14336,4 @@ function lineageIds(id) {
 	return [.../* @__PURE__ */ new Set([id, ...lineage.map((review) => review.id)])];
 }
 //#endregion
-export { extractJsonText as $, resolveModel as $n, isClaimed as $t, createPrState as A, parseLifecycle as An, writePortPreference as At, toneOf as B, issuesOutstanding as Bn, allJobs as Bt, readEvents as C, LIFECYCLES as Cn, feedbackUrl as Ct, announceJob as D, lifecycleChip as Dn, parseWorkspacePort as Dt, telemetryUploadConsent as E, lifecycleAction as En, MIN_WORKSPACE_PORT as Et, markAllRead as F, queueStamp as Fn, fillFileUrlTemplate as Ft, authorPreview as G, describeAuthorship as Gn, saveJob as Gt, withUsageRecorded as H, reviewerDispositions as Hn, fail as Ht, markRead as I, readQueue as In, checkCodeFreshness as It, CODE_BLOCK_CLASS as J, resolveTarget as Jn, phasesFor as Jt, hasAuthorContent as K, WITHHELD_REASON as Kn, PHASES as Kt, pruneNotifications as L, doneVerb as Ln, checkReview as Lt, eventName as M, queueAdd as Mn, forgeResolver as Mt, headline as N, queueAddMany as Nn, forgeFor as Nt, branchOf as O, lifecyclePill as On, resolveWorkspacePort as Ot, listNotifications as P, queueRemove as Pn, remoteHost as Pt, asString as Q, resolveAgent as Qn, driverGone as Qt, readNotification as R, isIssueOutstanding as Rn, followedBranch as Rt, startJob as S, workspaceStamps as Sn, PACKAGE_NAME as St, recordTelemetryUploadConsent as T, isLifecycle as Tn, MAX_WORKSPACE_PORT as Tt, EXPLAIN_SIMPLY_PROMPT as U, processDiscussion as Un, isTerminal as Ut, unreadCount as V, questionsOutstanding as Vn, endedAt as Vt, UNESTABLISHED_MOTIVATION as W, recommendationsOf as Wn, loadJob as Wt, escapeHtml as X, isCommitReview as Xn, purposeOf as Xt, CODE_COPY_CLASS as Y, displayRef as Yn, progressSteps as Yt, renderInlineText as Z, git as Zn, clearClaim as Zt, agentEnvOf as _, reviewedCommit as _n, spawnServer as _t, wasBlocked as a, kissDecisionRefusal as an, AGENT_IDS as ar, relativeTime as at, reanalyseReview as b, touchWorkspace as bn, writeServerRecord as bt, RefreshUnavailableError as c, lineageKeyFor as cn, agentFor as cr, queueForReview as ct, refreshPrContext as d, matchingWorkspaceIds as dn, AgentUnavailableError as dr, bootstrapUrl as dt, decideKissRecommendation as en, clearAgentPreference as er, ReviewBeingDeletedError as et, isUnchanged as f, mutateWorkspace as fn, clearServerRecord as ft, runningJobs as g, recentWorkspaces as gn, serverEntryExists as gt, liveUpdateFor as h, previousKissResult as hn, reviewsUrl as ht, liveJobsFor as i, indexReviewGroups as in, STORE_ROOT as ir, modelHelpLines as it, createPrUpdate as j, sectionOf as jn, claimRequestUrl as jt, subjectOf as k, offersLifecycle as kn, statedWorkspacePort as kt, mergeUpdateInto as l, lineagePosition as ln, detectAgents as lr, settleQueue as lt, UpdateAlreadyRunningError as m, presentedKissRunOf as mn, readServerRecord as mt, deleteReview as n, groupByLineage as nn, writeAgentPreference as nr, readMarker as nt, discardJob as o, kissDecisionsOf as on, DEFAULT_AGENT_ID as or, activateQueued as ot, askCheckout as p, positionInLineage as pn, ensureServer as pt, renderMarkdown as q, kissOutcome as qn, isLiveJob as qt, lineageIds as r, indexKeptIds as rn, CONFIG_PATH as rr, removeWorktree as rt, FETCH_TIMEOUT_MS as s, latestKissRun as sn, agentById as sr, compactQueue as st, deleteLineage as t, followedRefName as tn, readAgentPreference as tr, MANAGED_ROOT as tt, updateReview as u, loadWorkspace as un, AgentCancelledError as ur, readIndexToken as ut, recordKissRun as v, reviewedRepositories as vn, stopServer as vt, record as w, activityLabel as wn, DEFAULT_WORKSPACE_PORT as wt, runJob as x, workspaceRevision as xn, BUILD_VERSION as xt, startKissJob as y, summarise as yn, workspaceUrl as yt, removeNotification as z, isQuestionOutstanding as zn, reviewedShaOf as zt };
+export { asString as $, resolveAgent as $n, driverGone as $t, createPrState as A, offersLifecycle as An, statedWorkspacePort as At, toneOf as B, isQuestionOutstanding as Bn, reviewedShaOf as Bt, readEvents as C, workspaceStamps as Cn, PACKAGE_NAME as Ct, announceJob as D, lifecycleAction as Dn, MIN_WORKSPACE_PORT as Dt, telemetryUploadConsent as E, isLifecycle as En, MAX_WORKSPACE_PORT as Et, markAllRead as F, queueRemove as Fn, remoteHost as Ft, authorPreview as G, recommendationsOf as Gn, loadJob as Gt, withUsageRecorded as H, questionsOutstanding as Hn, endedAt as Ht, markRead as I, queueStamp as In, fillFileUrlTemplate as It, renderMarkdown as J, kissOutcome as Jn, isLiveJob as Jt, hasAuthorContent as K, describeAuthorship as Kn, saveJob as Kt, pruneNotifications as L, readQueue as Ln, checkCodeFreshness as Lt, eventName as M, sectionOf as Mn, claimRequestUrl as Mt, headline as N, queueAdd as Nn, forgeResolver as Nt, branchOf as O, lifecycleChip as On, parseWorkspacePort as Ot, listNotifications as P, queueAddMany as Pn, forgeFor as Pt, renderInlineText as Q, git as Qn, clearClaim as Qt, readNotification as R, doneVerb as Rn, checkReview as Rt, startJob as S, workspaceRevision as Sn, BUILD_VERSION as St, recordTelemetryUploadConsent as T, activityLabel as Tn, DEFAULT_WORKSPACE_PORT as Tt, EXPLAIN_SIMPLY_PROMPT as U, reviewerDispositions as Un, fail as Ut, unreadCount as V, issuesOutstanding as Vn, allJobs as Vt, UNESTABLISHED_MOTIVATION as W, processDiscussion as Wn, isTerminal as Wt, CODE_COPY_CLASS as X, displayRef as Xn, progressSteps as Xt, CODE_BLOCK_CLASS as Y, resolveTarget as Yn, phasesFor as Yt, escapeHtml as Z, isCommitReview as Zn, purposeOf as Zt, agentEnvOf as _, recentWorkspaces as _n, serverEntryExists as _t, wasBlocked as a, indexReviewGroups as an, STORE_ROOT as ar, modelHelpLines as at, reanalyseReview as b, summarise as bn, workspaceUrl as bt, RefreshUnavailableError as c, latestKissRun as cn, agentById as cr, compactQueue as ct, refreshPrContext as d, loadWorkspace as dn, AgentCancelledError as dr, readIndexToken as dt, isClaimed as en, resolveModel as er, extractJsonText as et, isUnchanged as f, matchingWorkspaceIds as fn, AgentUnavailableError as fr, bootstrapUrl as ft, runningJobs as g, previousKissResult as gn, reviewsUrl as gt, liveUpdateFor as h, presentedKissRunOf as hn, readServerRecord as ht, liveJobsFor as i, indexKeptIds as in, CONFIG_PATH as ir, removeWorktree as it, createPrUpdate as j, parseLifecycle as jn, writePortPreference as jt, subjectOf as k, lifecyclePill as kn, resolveWorkspacePort as kt, mergeUpdateInto as l, lineageKeyFor as ln, agentFor as lr, queueForReview as lt, UpdateAlreadyRunningError as m, positionInLineage as mn, ensureServer as mt, deleteReview as n, followedRefName as nn, readAgentPreference as nr, MANAGED_ROOT as nt, discardJob as o, kissDecisionRefusal as on, AGENT_IDS as or, relativeTime as ot, askCheckout as p, mutateWorkspace as pn, clearServerRecord as pt, GITHUB_MARKDOWN as q, WITHHELD_REASON as qn, PHASES as qt, lineageIds as r, groupByLineage as rn, writeAgentPreference as rr, readMarker as rt, FETCH_TIMEOUT_MS as s, kissDecisionsOf as sn, DEFAULT_AGENT_ID as sr, activateQueued as st, deleteLineage as t, decideKissRecommendation as tn, clearAgentPreference as tr, ReviewBeingDeletedError as tt, updateReview as u, lineagePosition as un, detectAgents as ur, settleQueue as ut, recordKissRun as v, reviewedCommit as vn, spawnServer as vt, record as w, LIFECYCLES as wn, feedbackUrl as wt, runJob as x, touchWorkspace as xn, writeServerRecord as xt, startKissJob as y, reviewedRepositories as yn, stopServer as yt, removeNotification as z, isIssueOutstanding as zn, followedBranch as zt };