tungsten 0.2.24 → 0.3.0

package/dist/rawHtml/parseHtml.js

@@ -0,0 +1,214 @@
+import { $props, $type } from "../contentNodeSymbols.js";
+import { htmlVoidTags } from "../render/htmlVoidTags.js";
+import { tokenizeHtml } from "./tokenizeHtml.js";
+import { htmlRawTextTags, htmlTableStructureTags, impliedEndTag } from "./htmlParsingTags.js";
+const allowEverything = {
+  tag: () => true,
+  attribute: () => true
+};
+function makeAllowCheck(allowList) {
+  if (allowList === undefined) return allowEverything;
+  const tags = new Set(allowList.tags);
+  const attributes = new Set(allowList.attributes);
+  const perTag = new Map();
+  for (const tag in allowList.tagAttributes) {
+    perTag.set(tag, new Set(allowList.tagAttributes[tag]));
+  }
+  return {
+    tag: name => tags.has(name),
+    attribute: (tag, name) => attributes.has(name) || (perTag.get(tag)?.has(name) ?? false)
+  };
+}
+// REGEX: on followed by at least one letter, e.g. onclick, onerror
+const eventAttribute = /^on[a-z]/i;
+const urlAttributes = {
+  href: true,
+  src: true,
+  action: true,
+  formaction: true,
+  srcset: true,
+  background: true
+};
+/** URL attributes that navigate, where a document-producing scheme is a risk. */
+const navigationAttributes = {
+  href: true,
+  action: true,
+  formaction: true
+};
+const executableSchemes = {
+  javascript: true,
+  vbscript: true
+};
+/**
+ * The scheme of a URL as a browser would read it, or `''` if it has none.
+ *
+ * Whitespace and control characters are skipped rather than rejected, because
+ * a browser ignores them too — `"java\tscript:alert(1)"` and `" javascript:..."`
+ * both run, so a check that did not skip them would be trivially side-stepped.
+ */
+function urlScheme(url) {
+  let scheme = '';
+  for (const character of url) {
+    const code = character.charCodeAt(0);
+    if (code <= 0x20 || code === 0x7f) continue;
+    if (character === ':') return scheme.toLowerCase();
+    scheme += character;
+  }
+  return '';
+}
+function blockedUrl(attributeName, value) {
+  const scheme = urlScheme(value);
+  if (scheme in executableSchemes) return true;
+  // data: URLs can carry a whole HTML document, so they are barred from
+  // anything that navigates. They stay allowed on src, where inline images
+  // are ordinary and useful.
+  return scheme === 'data' && attributeName in navigationAttributes;
+}
+function attributesToProps(tag, attributes, sanitize, allow) {
+  const props = {};
+  for (const name in attributes) {
+    const value = attributes[name];
+    if (value === undefined) continue;
+    // Tungsten treats on* props as event listeners, not attributes.
+    if (eventAttribute.test(name)) continue;
+    // Checked against the written HTML name, before the mapping below.
+    if (!allow.attribute(tag, name.toLowerCase())) continue;
+    if (sanitize && name.toLowerCase() in urlAttributes && typeof value === 'string' && blockedUrl(name.toLowerCase(), value)) continue;
+    // `class` is dropped by processProps, which reads `className`, and a
+    // `style` string throws in jssToCss, which expects the object form.
+    // `css` is the raw-string equivalent it accepts.
+    if (name === 'class') props.className = value;else if (name === 'style') props.css = value;else props[name] = value;
+  }
+  return props;
+}
+/**
+ * Whether an element survives, and if not, how it goes.
+ *
+ * Elements holding program text rather than prose are dropped whole — there is
+ * no reader's content inside them to preserve. Everything else is unwrapped.
+ */
+function removalFor(name, sanitize, allow) {
+  if (sanitize && name === 'script') return 'drop';
+  if (allow.tag(name)) return undefined;
+  return name in htmlRawTextTags ? 'drop' : 'unwrap';
+}
+function toContentNode({
+  name,
+  props,
+  children
+}) {
+  const nodeProps = {
+    ...props
+  };
+  // Match the shape JSX produces: one child is passed directly, not wrapped.
+  if (children.length === 1) nodeProps.children = children[0];else if (children.length > 1) nodeProps.children = children;
+  return {
+    [$type]: name,
+    [$props]: nodeProps
+  };
+}
+/**
+ * Parses raw HTML into a Tungsten content tree.
+ *
+ * Never throws, whatever it is given. Unclosed tags are closed, stray end tags
+ * are ignored, and anything that is not markup is kept as text — the result is
+ * always a renderable tree.
+ *
+ * The point of parsing rather than injecting the markup is that the result is
+ * an ordinary tree: it renders, hydrates and reconciles like any other content,
+ * with no opaque region the framework cannot see into. That means the parser
+ * has to apply the browser's own nesting rules, or the tree it produces and the
+ * DOM the browser builds from the rendered markup would disagree.
+ */
+export function parseHtml(html, options = {}) {
+  if (typeof html !== 'string' || html === '') return null;
+  const sanitize = options.sanitize !== false;
+  const allow = makeAllowCheck(options.allowList);
+  const root = {
+    name: '',
+    props: {},
+    children: []
+  };
+  const stack = [root];
+  // Always non-empty: the root is never popped.
+  const current = () => stack[stack.length - 1];
+  const close = downTo => {
+    while (stack.length > downTo) {
+      const element = stack.pop(); // eslint-disable-line no-type-assertion/no-type-assertion -- guarded by the loop
+      if (element.removal === 'drop') continue;
+      if (element.removal === 'unwrap') current().children.push(...element.children);else current().children.push(toContentNode(element));
+    }
+  };
+  for (const token of tokenizeHtml(html)) {
+    if (token.kind === 'text') {
+      // a dropped element's text goes with it
+      if (current().removal === 'drop') continue;
+      if (token.text === '') continue;
+      if (current().name in htmlTableStructureTags) {
+        // Whitespace between table tags is dropped rather than kept.
+        // HTML parsers disagree over whether it survives inside a
+        // table, and this tree has to match whichever one the browser
+        // uses. Emitting none settles it: there is then nothing in the
+        // rendered markup for a parser to have an opinion about, and
+        // between table cells it makes no visual difference anyway.
+        if (token.text.trim() === '') continue;
+        // Foster parenting: a browser relocates text with something in
+        // it to just before the enclosing table. That table is still
+        // open on the stack, and is pushed to its parent only when it
+        // closes, so appending to the parent now places the text ahead
+        // of it — exactly where the browser puts it.
+        let tableIndex = -1;
+        for (let i = stack.length - 1; i > 0; i--) {
+          if (stack[i].name === 'table') {
+            tableIndex = i;
+            break;
+          }
+        }
+        const host = tableIndex > 0 ? stack[tableIndex - 1] : current();
+        host.children.push(token.text);
+        continue;
+      }
+      current().children.push(token.text);
+      continue;
+    }
+    if (token.kind === 'open') {
+      // An element that is going away is still opened and tracked, so
+      // the markup inside it is accounted for rather than surfacing as
+      // stray text in its parent.
+      const removal = removalFor(token.name, sanitize, allow);
+      // apply the browser's implied end tags before opening
+      while (stack.length > 1 && impliedEndTag(current().name, token.name)) {
+        close(stack.length - 1);
+      }
+      const element = {
+        name: token.name,
+        props: removal === undefined ? attributesToProps(token.name, token.attributes, sanitize, allow) : {},
+        children: [],
+        ...(removal === undefined ? {} : {
+          removal
+        })
+      };
+      if (token.selfClosing || token.name in htmlVoidTags) {
+        if (removal === undefined) current().children.push(toContentNode(element));
+      } else {
+        stack.push(element);
+      }
+      continue;
+    }
+    // close token - find the nearest matching open element
+    let found = -1;
+    for (let i = stack.length - 1; i > 0; i--) {
+      if (stack[i].name === token.name) {
+        found = i;
+        break;
+      }
+    }
+    // no match: a stray end tag, which browsers ignore
+    if (found !== -1) close(found);
+  }
+  // close anything the markup left open
+  close(1);
+  if (root.children.length === 0) return null;
+  if (root.children.length === 1) return root.children[0] ?? null;
+  return root.children;
+}

package/dist/rawHtml/parseHtml.sxyt.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parseHtml.sxyt.d.ts.map

package/dist/rawHtml/parseHtml.sxyt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseHtml.sxyt.d.ts","sourceRoot":"","sources":["../../src/rawHtml/parseHtml.sxyt.ts"],"names":[],"mappings":""}

package/dist/rawHtml/parseHtml.sxyt.js

@@ -0,0 +1,239 @@
+import { describe } from 'sxy-test-runner';
+import { expect } from 'chai';
+import { parseHtml } from "./parseHtml.js";
+import { safeHtmlAllowList } from "./safeHtmlAllowList.js";
+import { decodeHtmlEntities } from "./decodeHtmlEntities.js";
+import { tokenizeHtml } from "./tokenizeHtml.js";
+import { renderingNodeToHtml } from "../render/renderingTreeToHtml.js";
+import { $props, $type } from "../contentNodeSymbols.js";
+// `found: true` short-circuits the <head> handling these tests do not need.
+// eslint-disable-next-line no-type-assertion/no-type-assertion
+const noHeadData = {
+  found: true
+};
+// Renders a parsed tree back to markup. The renderer takes a RenderingNode,
+// which for plain HTML content is structurally what parseHtml returns.
+const render = async content => renderingNodeToHtml(
+// eslint-disable-next-line no-type-assertion/no-type-assertion
+content, false, noHeadData, null);
+const roundTrip = html => render(parseHtml(html));
+describe('decodeHtmlEntities()', ({
+  it
+}) => {
+  it('decodes named, decimal and hex references', () => {
+    expect(decodeHtmlEntities('&pound;100 &amp; more')).to.equal('£100 & more');
+    expect(decodeHtmlEntities('&#65;&#66;')).to.equal('AB');
+    expect(decodeHtmlEntities('&#x41;&#X42;')).to.equal('AB');
+  });
+  it('leaves unknown and malformed references exactly as written', () => {
+    expect(decodeHtmlEntities('&notareal; &amp')).to.equal('&notareal; &amp');
+    expect(decodeHtmlEntities('a & b')).to.equal('a & b');
+  });
+  it('does not throw on out-of-range numeric references', () => {
+    expect(decodeHtmlEntities('&#xFFFFFFFF;')).to.equal('&#xFFFFFFFF;');
+    expect(decodeHtmlEntities('&#0;')).to.equal('&#0;');
+    expect(decodeHtmlEntities('&#xD800;')).to.equal('&#xD800;');
+  });
+});
+describe('tokenizeHtml()', ({
+  it
+}) => {
+  it('reads attributes in every quoting style', () => {
+    const [token] = tokenizeHtml('<a href="/x" title=\'y\' data-n=3 hidden>');
+    expect(token?.kind).to.equal('open');
+    expect(token?.kind === 'open' && token.attributes).to.deep.equal({
+      href: '/x',
+      title: 'y',
+      'data-n': '3',
+      hidden: true
+    });
+  });
+  it('drops comments and doctypes', () => {
+    expect(tokenizeHtml('<!doctype html><!-- hi --><b>x</b>').map(token => token.kind)).to.deep.equal(['open', 'text', 'close']);
+  });
+  it('treats a bare < as text', () => {
+    expect(tokenizeHtml('5 < 6 and 7 > 2')).to.deep.equal([{
+      kind: 'text',
+      text: '5 < 6 and 7 > 2'
+    }]);
+  });
+  it('takes script content as literal text, not markup', () => {
+    expect(tokenizeHtml('<script>if (a<b) x()</script>').map(token => token.kind)).to.deep.equal(['open', 'text', 'close']);
+  });
+  // scanning for the first > would cut this tag short and build a tree the
+  // browser disagrees with
+  it('does not end a tag at a > inside a quoted attribute value', () => {
+    const [token] = tokenizeHtml('<a title="a > b" href="/x">');
+    expect(token?.kind === 'open' && token.attributes).to.deep.equal({
+      title: 'a > b',
+      href: '/x'
+    });
+  });
+});
+describe('parseHtml()', ({
+  it
+}) => {
+  it('returns null for empty and non-string input', () => {
+    expect(parseHtml('')).to.equal(null);
+    // eslint-disable-next-line no-type-assertion/no-type-assertion
+    expect(parseHtml(undefined)).to.equal(null);
+  });
+  it('builds an element tree with decoded text', async () => {
+    const content = parseHtml('<p>Bonus &pound;100</p>');
+    // eslint-disable-next-line no-type-assertion/no-type-assertion
+    const node = content;
+    expect(node[$type]).to.equal('p');
+    expect(node[$props].children).to.equal('Bonus £100');
+  });
+  it('maps class to className and style to css, which the renderer expects', async () => {
+    expect(await roundTrip('<p class="a b" style="color: red">x</p>')).to.equal('<p class="a b" style="color: red">x</p>');
+  });
+  it('keeps sibling paragraphs as siblings rather than nesting them', async () => {
+    expect(await roundTrip('<p>one</p><p>two</p>')).to.equal('<p>one</p><p>two</p>');
+  });
+  // The rule that broke the dashboard: a browser closes an open <p> at the
+  // next block-level start tag, so the parser must too, or the tree and the
+  // DOM disagree and hydration walks off the end.
+  it('applies the implied end tag that closes a p at a block element', async () => {
+    expect(await roundTrip('<p>one<div>two</div>')).to.equal('<p>one</p><div>two</div>');
+  });
+  it('closes list items and table cells implicitly', async () => {
+    expect(await roundTrip('<ul><li>a<li>b</ul>')).to.equal('<ul><li>a</li><li>b</li></ul>');
+    expect(await roundTrip('<table><tbody><tr><td>a<td>b</tbody></table>')).to.equal('<table><tbody><tr><td>a</td><td>b</td></tr></tbody></table>');
+  });
+  // Parsers disagree over whether whitespace survives inside a table, so the
+  // markup carries none — the tree and the DOM then agree either way.
+  it('drops whitespace between table tags', async () => {
+    expect(await roundTrip('<table>\n<tbody>\n<tr><td>a</td></tr>\n</tbody>\n</table>')).to.equal('<table><tbody><tr><td>a</td></tr></tbody></table>');
+  });
+  it('foster-parents real text out to just before the table', async () => {
+    expect(await roundTrip('<table><tbody>stray<tr><td>a</td></tr></tbody></table>')).to.equal('stray<table><tbody><tr><td>a</td></tr></tbody></table>');
+  });
+  it('leaves stray text alone in lists and selects, which do not relocate it', async () => {
+    expect(await roundTrip('<ul>loose<li>a</li></ul>')).to.equal('<ul>loose<li>a</li></ul>');
+  });
+  it('handles void and self-closing elements', async () => {
+    expect(await roundTrip('<p>a<br>b<img src="/x" />c</p>')).to.equal('<p>a<br />b<img src="/x" />c</p>');
+  });
+});
+describe('parseHtml() resilience', ({
+  it
+}) => {
+  // "Safe" here means it always produces something renderable, whatever it
+  // is handed. None of these may throw.
+  const malformed = ['<p>unclosed', '</p>stray end tag', '<p><b>crossed</p></b>', '<<>><p>x</p>', '<p class="unterminated>x</p>', '<!-- never closed', '<p', '<>', '<p><p><p><p>deep', '&&&;&#;&#x;', '<div><span></div></span>', '<TABLE><TR><TD>caps</TD></TR></TABLE>'];
+  for (const html of malformed) {
+    it(`does not throw on ${JSON.stringify(html)}`, async () => {
+      const content = parseHtml(html);
+      const rendered = await render(content);
+      expect(rendered).to.be.a('string');
+    });
+  }
+  it('keeps the text of an unclosed element', async () => {
+    expect(await roundTrip('<p>unclosed')).to.equal('<p>unclosed</p>');
+  });
+  it('ignores a stray end tag but keeps its text', async () => {
+    expect(await roundTrip('</p>after')).to.equal('after');
+  });
+});
+describe('parseHtml() sanitizing', ({
+  it
+}) => {
+  it('drops script elements together with their contents', async () => {
+    expect(await roundTrip('<p>a</p><script>alert(1)</script><p>b</p>')).to.equal('<p>a</p><p>b</p>');
+  });
+  it('drops on* handler attributes', async () => {
+    expect(await roundTrip('<p onclick="alert(1)" onerror="x()" title="keep">a</p>')).to.equal('<p title="keep">a</p>');
+  });
+  it('drops javascript: urls, including obfuscated ones', async () => {
+    expect(await roundTrip('<a href="javascript:alert(1)">x</a>')).to.equal('<a>x</a>');
+    expect(await roundTrip('<a href="  JaVaScRiPt:alert(1)">x</a>')).to.equal('<a>x</a>');
+    // browsers ignore control characters inside the scheme, so this runs
+    expect(await roundTrip('<a href="java\tscript:alert(1)">x</a>')).to.equal('<a>x</a>');
+    expect(await roundTrip('<a href="vbscript:x">x</a>')).to.equal('<a>x</a>');
+    expect(await roundTrip('<a href="/safe">x</a>')).to.equal('<a href="/safe">x</a>');
+    expect(await roundTrip('<a href="https://x.test/">x</a>')).to.equal('<a href="https://x.test/">x</a>');
+  });
+  it('bars data: urls from navigation but allows them as image sources', async () => {
+    expect(await roundTrip('<a href="data:text/html,hello">x</a>')).to.equal('<a>x</a>');
+    expect(await roundTrip('<img src="data:image/png;base64,AAAA" />')).to.equal('<img src="data:image/png;base64,AAAA" />');
+  });
+  it('keeps handler attributes out even when sanitizing is off', async () => {
+    // Tungsten reads on* props as event listeners, so a string there is a
+    // hydration fault, not just a security question.
+    const content = parseHtml('<p onclick="alert(1)">a</p>', {
+      sanitize: false
+    });
+    expect(await render(content)).to.equal('<p>a</p>');
+  });
+  it('keeps scripts when sanitizing is turned off', async () => {
+    const content = parseHtml('<div><script>x()</script></div>', {
+      sanitize: false
+    });
+    expect(await render(content)).to.equal('<div><script>x()</script></div>');
+  });
+});
+describe('parseHtml() allow lists', ({
+  it
+}) => {
+  const withList = (html, allowList) => render(parseHtml(html, {
+    allowList
+  }));
+  const onlyEmphasis = {
+    tags: ['p', 'em'],
+    attributes: []
+  };
+  it('keeps listed tags and unwraps unlisted ones, preserving their text', async () => {
+    expect(await withList('<p>keep <em>this</em> and <b>that</b></p>', onlyEmphasis)).to.equal('<p>keep <em>this</em> and that</p>');
+  });
+  it('unwraps an unlisted element without losing its listed descendants', async () => {
+    expect(await withList('<div><p>inner</p></div>', onlyEmphasis)).to.equal('<p>inner</p>');
+  });
+  it('drops program-text elements entirely rather than unwrapping them', async () => {
+    // unwrapping <style> would put its CSS on the page as visible text
+    expect(await withList('<p>a</p><style>p { color: red }</style>', onlyEmphasis)).to.equal('<p>a</p>');
+  });
+  it('keeps only listed attributes', async () => {
+    const list = {
+      tags: ['p'],
+      attributes: ['title']
+    };
+    expect(await withList('<p title="t" id="i" data-x="1">a</p>', list)).to.equal('<p title="t">a</p>');
+  });
+  it('applies per-tag attributes only to their own tag', async () => {
+    const list = {
+      tags: ['a', 'p'],
+      attributes: [],
+      tagAttributes: {
+        a: ['href']
+      }
+    };
+    expect(await withList('<a href="/x">link</a><p href="/y">para</p>', list)).to.equal('<a href="/x">link</a><p>para</p>');
+  });
+});
+describe('safeHtmlAllowList', ({
+  it
+}) => {
+  const safely = html => render(parseHtml(html, {
+    allowList: safeHtmlAllowList
+  }));
+  it('keeps ordinary authored rich text intact', async () => {
+    const html = '<h2>Title</h2><p>Some <strong>bold</strong> and <em>italic</em>.</p>' + '<ul><li>one</li><li>two</li></ul>';
+    expect(await safely(html)).to.equal(html);
+  });
+  it('keeps tables with their layout attributes', async () => {
+    const html = '<table><tbody><tr><th align="left">H</th><td colspan="2">C</td></tr></tbody></table>';
+    expect(await safely(html)).to.equal(html);
+  });
+  it('keeps links and images with their own attributes', async () => {
+    expect(await safely('<a href="/x" target="_blank" rel="noopener">go</a>')).to.equal('<a href="/x" target="_blank" rel="noopener">go</a>');
+    expect(await safely('<img src="/a.png" alt="a" width="10" />')).to.equal('<img src="/a.png" alt="a" width="10" />');
+  });
+  it('strips style attributes, which can disguise the page without any script', async () => {
+    expect(await safely('<p style="position:fixed;top:0">a</p>')).to.equal('<p>a</p>');
+  });
+  it('removes embedding and form elements but keeps their text', async () => {
+    expect(await safely('<iframe src="//evil"></iframe><p>a</p>')).to.equal('<p>a</p>');
+    expect(await safely('<form><p>a</p></form>')).to.equal('<p>a</p>');
+  });
+});

package/dist/rawHtml/safeHtmlAllowList.d.ts

@@ -0,0 +1,18 @@
+import type { HtmlAllowList } from './HtmlAllowList.js';
+/**
+ * A conservative allow list for authored rich text — the shape a CMS or WYSIWYG
+ * field produces: headings, paragraphs, lists, tables, links, images, emphasis.
+ *
+ * Reach for this via `<RawHtml safe />`, or import it and spread it into your
+ * own list where an application needs more.
+ *
+ * Deliberately absent:
+ *
+ * - `style`, on any element. Attacker-controlled CSS can reposition and
+ *   disguise page furniture, so it is a real vector even without script.
+ * - `script`, `iframe`, `object`, `embed`, `form`, `input`, `button`.
+ * - `target` without `rel`: `target="_blank"` hands the opener window to the
+ *   linked page, so `rel` is allowed alongside it to be set to `noopener`.
+ */
+export declare const safeHtmlAllowList: HtmlAllowList;
+//# sourceMappingURL=safeHtmlAllowList.d.ts.map

package/dist/rawHtml/safeHtmlAllowList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeHtmlAllowList.d.ts","sourceRoot":"","sources":["../../src/rawHtml/safeHtmlAllowList.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAmC/B,CAAA"}

package/dist/rawHtml/safeHtmlAllowList.js

@@ -0,0 +1,47 @@
+/**
+ * A conservative allow list for authored rich text — the shape a CMS or WYSIWYG
+ * field produces: headings, paragraphs, lists, tables, links, images, emphasis.
+ *
+ * Reach for this via `<RawHtml safe />`, or import it and spread it into your
+ * own list where an application needs more.
+ *
+ * Deliberately absent:
+ *
+ * - `style`, on any element. Attacker-controlled CSS can reposition and
+ *   disguise page furniture, so it is a real vector even without script.
+ * - `script`, `iframe`, `object`, `embed`, `form`, `input`, `button`.
+ * - `target` without `rel`: `target="_blank"` hands the opener window to the
+ *   linked page, so `rel` is allowed alongside it to be set to `noopener`.
+ */
+export const safeHtmlAllowList = {
+  tags: [
+  // text flow
+  'p', 'br', 'hr', 'span', 'div', 'blockquote', 'pre', 'code',
+  // headings
+  'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+  // emphasis
+  'strong', 'b', 'em', 'i', 'u', 's', 'strike', 'sub', 'sup', 'small', 'mark',
+  // lists
+  'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+  // tables
+  'table', 'caption', 'colgroup', 'col', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td',
+  // media and links
+  'a', 'img', 'figure', 'figcaption'],
+  attributes: ['class', 'id', 'title', 'dir', 'lang'],
+  tagAttributes: {
+    a: ['href', 'target', 'rel', 'name'],
+    img: ['src', 'alt', 'width', 'height', 'loading'],
+    td: ['colspan', 'rowspan', 'align', 'valign', 'scope', 'headers'],
+    th: ['colspan', 'rowspan', 'align', 'valign', 'scope', 'headers', 'abbr'],
+    tr: ['align', 'valign'],
+    table: ['align', 'summary'],
+    thead: ['align', 'valign'],
+    tbody: ['align', 'valign'],
+    tfoot: ['align', 'valign'],
+    col: ['span', 'align', 'valign', 'width'],
+    colgroup: ['span', 'align', 'valign', 'width'],
+    ol: ['start', 'type', 'reversed'],
+    ul: ['type'],
+    li: ['value']
+  }
+};

package/dist/rawHtml/tokenizeHtml.d.ts

@@ -0,0 +1,25 @@
+export type HtmlAttributes = Record<string, string | true>;
+export type HtmlToken = {
+    kind: 'text';
+    text: string;
+} | {
+    kind: 'open';
+    name: string;
+    attributes: HtmlAttributes;
+    selfClosing: boolean;
+} | {
+    kind: 'close';
+    name: string;
+};
+/**
+ * Splits raw markup into text, start and end tokens.
+ *
+ * Never throws. Anything that is not well-formed markup — a stray `<`, an
+ * unterminated tag, a comment that is never closed — is emitted as text or
+ * skipped, matching what a browser does with the same input.
+ *
+ * Comments and doctypes are dropped: Tungsten uses comment nodes as its own
+ * component markers, so carrying authored ones through would confuse hydration.
+ */
+export declare function tokenizeHtml(html: string): HtmlToken[];
+//# sourceMappingURL=tokenizeHtml.d.ts.map

package/dist/rawHtml/tokenizeHtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenizeHtml.d.ts","sourceRoot":"","sources":["../../src/rawHtml/tokenizeHtml.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;AAE1D,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAoDrC;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CA4FtD"}