tungsten 0.2.25 → 0.3.0

package/dist/innerHtmlFromProps.sxyt.js

@@ -0,0 +1,99 @@
+import { describe } from 'sxy-test-runner';
+import { expect } from 'chai';
+import { innerHtmlFromProps } from "./innerHtmlFromProps.js";
+import { renderingNodeToHtml } from "./render/renderingTreeToHtml.js";
+import { $props, $type } from "./contentNodeSymbols.js";
+const props = value => value;
+// `found: true` short-circuits the <head> handling, which is all these
+// element-level tests need from HeadData.
+// eslint-disable-next-line no-type-assertion/no-type-assertion
+const noHeadData = {
+  found: true
+};
+const renderHtml = (type, nodeProps) => renderingNodeToHtml(
+// eslint-disable-next-line no-type-assertion/no-type-assertion
+{
+  [$type]: type,
+  [$props]: nodeProps
+}, false, noHeadData, null);
+describe('innerHtmlFromProps()', ({
+  it
+}) => {
+  it('returns null when the element does not use dangerouslySetInnerHTML', () => {
+    expect(innerHtmlFromProps('div', props({
+      children: 'hello'
+    }), true)).to.equal(null);
+  });
+  it('returns the raw markup', () => {
+    expect(innerHtmlFromProps('div', props({
+      dangerouslySetInnerHTML: {
+        __html: '<b>hi</b>'
+      }
+    }), false)).to.equal('<b>hi</b>');
+  });
+  it('rejects an element carrying both raw markup and children', () => {
+    expect(() => innerHtmlFromProps('div', props({
+      dangerouslySetInnerHTML: {
+        __html: '<b>hi</b>'
+      },
+      children: 'hello'
+    }), true)).to.throw(/both dangerouslySetInnerHTML and children/);
+  });
+  it('rejects a prop that is not of the form { __html }', () => {
+    // eslint-disable-next-line no-type-assertion/no-type-assertion
+    const bad = {
+      dangerouslySetInnerHTML: '<b>hi</b>'
+    };
+    expect(() => innerHtmlFromProps('div', bad, false)).to.throw(/{ __html: '...' }/);
+  });
+  it('rejects a null or undefined __html', () => {
+    // eslint-disable-next-line no-type-assertion/no-type-assertion
+    const nulled = {
+      dangerouslySetInnerHTML: {
+        __html: null
+      }
+    };
+    expect(() => innerHtmlFromProps('div', nulled, false)).to.throw(/__html is null/);
+  });
+});
+describe('dangerouslySetInnerHTML rendering', ({
+  it
+}) => {
+  it('writes the markup into the element unescaped', async () => {
+    expect(await renderHtml('div', {
+      dangerouslySetInnerHTML: {
+        __html: '<p>Bonuses.</p>'
+      }
+    })).to.equal('<div><p>Bonuses.</p></div>');
+  });
+  it('does not leak the prop into the markup as an attribute', async () => {
+    const html = await renderHtml('div', {
+      id: 'tip',
+      dangerouslySetInnerHTML: {
+        __html: '<b>hi</b>'
+      }
+    });
+    expect(html).to.not.include('dangerouslySetInnerHTML');
+    expect(html).to.not.include('[object Object]');
+    expect(html).to.equal('<div id="tip"><b>hi</b></div>');
+  });
+  it('escapes ordinary children, so the switch is per element', async () => {
+    expect(await renderHtml('div', {
+      children: '<p>Bonuses.</p>'
+    })).to.equal('<div>&lt;p&gt;Bonuses.&lt;/p&gt;</div>');
+  });
+  it('rejects raw markup on a void element', async () => {
+    let thrown = null;
+    try {
+      await renderHtml('br', {
+        dangerouslySetInnerHTML: {
+          __html: '<b>hi</b>'
+        }
+      });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).to.be.an('error');
+    expect(thrown.message).to.include('void type');
+  });
+});

package/dist/rawHtml/HtmlAllowList.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What raw markup is permitted to contain.
+ *
+ * Anything outside the list is dropped. A disallowed *element* is unwrapped
+ * rather than deleted — its children take its place — so filtering never
+ * silently loses someone's words. The exception is elements whose content is
+ * program text rather than prose (`script`, `style`), which go entirely.
+ */
+export type HtmlAllowList = {
+    /** Tag names that may be rendered. */
+    tags: readonly string[];
+    /** Attributes allowed on any allowed tag. */
+    attributes: readonly string[];
+    /** Further attributes allowed only on the named tags. */
+    tagAttributes?: Readonly<Record<string, readonly string[]>> | undefined;
+};
+//# sourceMappingURL=HtmlAllowList.d.ts.map

package/dist/rawHtml/HtmlAllowList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HtmlAllowList.d.ts","sourceRoot":"","sources":["../../src/rawHtml/HtmlAllowList.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,sCAAsC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,6CAA6C;IAC7C,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,yDAAyD;IACzD,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,CAAA;CAC1E,CAAA"}

package/dist/rawHtml/HtmlAllowList.js

@@ -0,0 +1 @@
+export {};

package/dist/rawHtml/decodeHtmlEntities.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Decodes HTML character references in text taken from raw markup.
+ *
+ * Never throws. An entity this does not recognise is left as written rather
+ * than dropped, so no content is ever silently lost.
+ */
+export declare function decodeHtmlEntities(text: string): string;
+//# sourceMappingURL=decodeHtmlEntities.d.ts.map

package/dist/rawHtml/decodeHtmlEntities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decodeHtmlEntities.d.ts","sourceRoot":"","sources":["../../src/rawHtml/decodeHtmlEntities.ts"],"names":[],"mappings":"AA0CA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOvD"}

package/dist/rawHtml/decodeHtmlEntities.js

@@ -0,0 +1,105 @@
+// The named entities that turn up in real authored content. This is not the
+// full HTML5 table — that is thousands of entries — and it does not need to be:
+// anything unrecognised is left exactly as written, which is what a reader
+// sees today anyway.
+const namedEntities = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: '\'',
+  nbsp: '\u00a0',
+  ensp: '\u2002',
+  emsp: '\u2003',
+  thinsp: '\u2009',
+  shy: '\u00ad',
+  pound: '£',
+  euro: '€',
+  yen: '¥',
+  cent: '¢',
+  curren: '¤',
+  copy: '©',
+  reg: '®',
+  trade: '™',
+  sect: '§',
+  para: '¶',
+  dagger: '†',
+  Dagger: '‡',
+  deg: '°',
+  plusmn: '±',
+  micro: 'µ',
+  middot: '·',
+  bull: '•',
+  hellip: '…',
+  mdash: '—',
+  ndash: '–',
+  lsquo: '‘',
+  rsquo: '’',
+  sbquo: '‚',
+  ldquo: '“',
+  rdquo: '”',
+  bdquo: '„',
+  laquo: '«',
+  raquo: '»',
+  times: '×',
+  divide: '÷',
+  minus: '−',
+  frac12: '½',
+  frac14: '¼',
+  frac34: '¾',
+  sup1: '¹',
+  sup2: '²',
+  sup3: '³',
+  ordm: 'º',
+  ordf: 'ª',
+  larr: '←',
+  uarr: '↑',
+  rarr: '→',
+  darr: '↓',
+  harr: '↔',
+  ne: '≠',
+  le: '≤',
+  ge: '≥',
+  infin: '∞',
+  asymp: '≈',
+  prime: '′',
+  Prime: '″',
+  alpha: 'α',
+  beta: 'β',
+  gamma: 'γ',
+  delta: 'δ',
+  pi: 'π',
+  mu: 'μ',
+  omega: 'ω'
+};
+// REGEX:
+// &
+// then one of
+//   #  followed by digits                     -- decimal numeric reference
+//   #x followed by hex digits (either case)   -- hex numeric reference
+//   a letter followed by letters/digits       -- named reference
+// then ;
+const entityPattern = /&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*);/g;
+function decodeNumeric(body) {
+  const hex = body[1] === 'x' || body[1] === 'X';
+  const codePoint = parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
+  if (Number.isNaN(codePoint)) return null;
+  // Surrogates and out-of-range values make fromCodePoint throw, and a
+  // malformed entity must never take the page down.
+  if (codePoint <= 0 || codePoint > 0x10ffff) return null;
+  if (codePoint >= 0xd800 && codePoint <= 0xdfff) return null;
+  return String.fromCodePoint(codePoint);
+}
+/**
+ * Decodes HTML character references in text taken from raw markup.
+ *
+ * Never throws. An entity this does not recognise is left as written rather
+ * than dropped, so no content is ever silently lost.
+ */
+export function decodeHtmlEntities(text) {
+  if (!text.includes('&')) return text;
+  return text.replace(entityPattern, (match, body) => {
+    if (body.startsWith('#')) return decodeNumeric(body) ?? match;
+    return namedEntities[body] ?? match;
+  });
+}

package/dist/rawHtml/htmlParsingTags.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Elements whose content is text, not markup, up to their closing tag.
+ *
+ * `escapable` ones hold ordinary text, so their character references are
+ * decoded; `literal` ones hold program text, which is taken exactly as written.
+ */
+export declare const htmlRawTextTags: Record<string, 'literal' | 'escapable'>;
+/**
+ * Table-structural elements, which may not hold text directly.
+ *
+ * A browser moves text out of these to just before the table it is in — the
+ * spec calls it foster parenting — so the parser has to do the same, or the
+ * tree and the DOM built from the rendered markup disagree. Whitespace alone
+ * is left where it is, which is also what a browser does.
+ *
+ * Only tables behave this way. `ul`, `ol`, `dl` and `select` keep stray text
+ * exactly where it was written.
+ */
+export declare const htmlTableStructureTags: Record<string, true>;
+export declare const htmlImpliedEndTags: Record<string, string[]>;
+/** Whether an open `openTag` is implicitly closed by a start tag `startTag`. */
+export declare function impliedEndTag(openTag: string, startTag: string): boolean;
+//# sourceMappingURL=htmlParsingTags.d.ts.map

package/dist/rawHtml/htmlParsingTags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"htmlParsingTags.d.ts","sourceRoot":"","sources":["../../src/rawHtml/htmlParsingTags.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,CAKnE,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAMvD,CAAA;AAYD,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAcvD,CAAA;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExE"}

package/dist/rawHtml/htmlParsingTags.js

@@ -0,0 +1,55 @@
+// Tag data the raw-HTML parser needs, kept together because the rules only
+// make sense as a set.
+/**
+ * Elements whose content is text, not markup, up to their closing tag.
+ *
+ * `escapable` ones hold ordinary text, so their character references are
+ * decoded; `literal` ones hold program text, which is taken exactly as written.
+ */
+export const htmlRawTextTags = {
+  script: 'literal',
+  style: 'literal',
+  textarea: 'escapable',
+  title: 'escapable'
+};
+/**
+ * Table-structural elements, which may not hold text directly.
+ *
+ * A browser moves text out of these to just before the table it is in — the
+ * spec calls it foster parenting — so the parser has to do the same, or the
+ * tree and the DOM built from the rendered markup disagree. Whitespace alone
+ * is left where it is, which is also what a browser does.
+ *
+ * Only tables behave this way. `ul`, `ol`, `dl` and `select` keep stray text
+ * exactly where it was written.
+ */
+export const htmlTableStructureTags = {
+  table: true,
+  thead: true,
+  tbody: true,
+  tfoot: true,
+  tr: true
+};
+// Elements a start tag implicitly closes. The browser applies these rules
+// whatever the markup says, so the parser has to as well — otherwise the tree
+// nests where the DOM does not, which is the mismatch that breaks hydration.
+const closedByBlock = ['address', 'article', 'aside', 'blockquote', 'details', 'div', 'dl', 'fieldset', 'figcaption', 'figure', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup', 'hr', 'main', 'menu', 'nav', 'ol', 'p', 'pre', 'section', 'table', 'ul'];
+export const htmlImpliedEndTags = {
+  p: closedByBlock,
+  li: ['li'],
+  dt: ['dt', 'dd'],
+  dd: ['dt', 'dd'],
+  option: ['option', 'optgroup'],
+  optgroup: ['optgroup'],
+  tr: ['tr', 'tbody', 'tfoot', 'thead'],
+  td: ['td', 'th', 'tr', 'tbody', 'tfoot', 'thead'],
+  th: ['td', 'th', 'tr', 'tbody', 'tfoot', 'thead'],
+  thead: ['tbody', 'tfoot'],
+  tbody: ['tbody', 'tfoot'],
+  tfoot: ['tbody'],
+  a: ['a']
+};
+/** Whether an open `openTag` is implicitly closed by a start tag `startTag`. */
+export function impliedEndTag(openTag, startTag) {
+  return htmlImpliedEndTags[openTag]?.includes(startTag) ?? false;
+}

package/dist/rawHtml/parseHtml.d.ts

@@ -0,0 +1,35 @@
+import type { ContentNode } from '../ContentNode.js';
+import type { HtmlAllowList } from './HtmlAllowList.js';
+export type ParseHtmlOptions = {
+    /**
+     * Drop `<script>` elements and `javascript:` URLs. On by default, because
+     * raw markup usually comes from outside the application.
+     *
+     * `on*` handler attributes are always dropped, sanitizing or not: Tungsten
+     * reads those props as event listeners, and a string where a function is
+     * expected breaks hydration.
+     */
+    sanitize?: boolean | undefined;
+    /**
+     * Keep only the tags and attributes on this list. Off by default — without
+     * one, everything parsed is kept, subject to `sanitize`.
+     *
+     * See `safeHtmlAllowList` for a ready-made list for authored rich text.
+     */
+    allowList?: HtmlAllowList | undefined;
+};
+/**
+ * Parses raw HTML into a Tungsten content tree.
+ *
+ * Never throws, whatever it is given. Unclosed tags are closed, stray end tags
+ * are ignored, and anything that is not markup is kept as text — the result is
+ * always a renderable tree.
+ *
+ * The point of parsing rather than injecting the markup is that the result is
+ * an ordinary tree: it renders, hydrates and reconciles like any other content,
+ * with no opaque region the framework cannot see into. That means the parser
+ * has to apply the browser's own nesting rules, or the tree it produces and the
+ * DOM the browser builds from the rendered markup would disagree.
+ */
+export declare function parseHtml(html: string, options?: ParseHtmlOptions): ContentNode;
+//# sourceMappingURL=parseHtml.d.ts.map

package/dist/rawHtml/parseHtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseHtml.d.ts","sourceRoot":"","sources":["../../src/rawHtml/parseHtml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAA8B,MAAM,mBAAmB,CAAA;AAKhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,MAAM,gBAAgB,GAAG;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CACxC,CAAA;AAsID;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,WAAW,CAqGnF"}

package/dist/rawHtml/parseHtml.js

@@ -0,0 +1,214 @@
+import { $props, $type } from "../contentNodeSymbols.js";
+import { htmlVoidTags } from "../render/htmlVoidTags.js";
+import { tokenizeHtml } from "./tokenizeHtml.js";
+import { htmlRawTextTags, htmlTableStructureTags, impliedEndTag } from "./htmlParsingTags.js";
+const allowEverything = {
+  tag: () => true,
+  attribute: () => true
+};
+function makeAllowCheck(allowList) {
+  if (allowList === undefined) return allowEverything;
+  const tags = new Set(allowList.tags);
+  const attributes = new Set(allowList.attributes);
+  const perTag = new Map();
+  for (const tag in allowList.tagAttributes) {
+    perTag.set(tag, new Set(allowList.tagAttributes[tag]));
+  }
+  return {
+    tag: name => tags.has(name),
+    attribute: (tag, name) => attributes.has(name) || (perTag.get(tag)?.has(name) ?? false)
+  };
+}
+// REGEX: on followed by at least one letter, e.g. onclick, onerror
+const eventAttribute = /^on[a-z]/i;
+const urlAttributes = {
+  href: true,
+  src: true,
+  action: true,
+  formaction: true,
+  srcset: true,
+  background: true
+};
+/** URL attributes that navigate, where a document-producing scheme is a risk. */
+const navigationAttributes = {
+  href: true,
+  action: true,
+  formaction: true
+};
+const executableSchemes = {
+  javascript: true,
+  vbscript: true
+};
+/**
+ * The scheme of a URL as a browser would read it, or `''` if it has none.
+ *
+ * Whitespace and control characters are skipped rather than rejected, because
+ * a browser ignores them too — `"java\tscript:alert(1)"` and `" javascript:..."`
+ * both run, so a check that did not skip them would be trivially side-stepped.
+ */
+function urlScheme(url) {
+  let scheme = '';
+  for (const character of url) {
+    const code = character.charCodeAt(0);
+    if (code <= 0x20 || code === 0x7f) continue;
+    if (character === ':') return scheme.toLowerCase();
+    scheme += character;
+  }
+  return '';
+}
+function blockedUrl(attributeName, value) {
+  const scheme = urlScheme(value);
+  if (scheme in executableSchemes) return true;
+  // data: URLs can carry a whole HTML document, so they are barred from
+  // anything that navigates. They stay allowed on src, where inline images
+  // are ordinary and useful.
+  return scheme === 'data' && attributeName in navigationAttributes;
+}
+function attributesToProps(tag, attributes, sanitize, allow) {
+  const props = {};
+  for (const name in attributes) {
+    const value = attributes[name];
+    if (value === undefined) continue;
+    // Tungsten treats on* props as event listeners, not attributes.
+    if (eventAttribute.test(name)) continue;
+    // Checked against the written HTML name, before the mapping below.
+    if (!allow.attribute(tag, name.toLowerCase())) continue;
+    if (sanitize && name.toLowerCase() in urlAttributes && typeof value === 'string' && blockedUrl(name.toLowerCase(), value)) continue;
+    // `class` is dropped by processProps, which reads `className`, and a
+    // `style` string throws in jssToCss, which expects the object form.
+    // `css` is the raw-string equivalent it accepts.
+    if (name === 'class') props.className = value;else if (name === 'style') props.css = value;else props[name] = value;
+  }
+  return props;
+}
+/**
+ * Whether an element survives, and if not, how it goes.
+ *
+ * Elements holding program text rather than prose are dropped whole — there is
+ * no reader's content inside them to preserve. Everything else is unwrapped.
+ */
+function removalFor(name, sanitize, allow) {
+  if (sanitize && name === 'script') return 'drop';
+  if (allow.tag(name)) return undefined;
+  return name in htmlRawTextTags ? 'drop' : 'unwrap';
+}
+function toContentNode({
+  name,
+  props,
+  children
+}) {
+  const nodeProps = {
+    ...props
+  };
+  // Match the shape JSX produces: one child is passed directly, not wrapped.
+  if (children.length === 1) nodeProps.children = children[0];else if (children.length > 1) nodeProps.children = children;
+  return {
+    [$type]: name,
+    [$props]: nodeProps
+  };
+}
+/**
+ * Parses raw HTML into a Tungsten content tree.
+ *
+ * Never throws, whatever it is given. Unclosed tags are closed, stray end tags
+ * are ignored, and anything that is not markup is kept as text — the result is
+ * always a renderable tree.
+ *
+ * The point of parsing rather than injecting the markup is that the result is
+ * an ordinary tree: it renders, hydrates and reconciles like any other content,
+ * with no opaque region the framework cannot see into. That means the parser
+ * has to apply the browser's own nesting rules, or the tree it produces and the
+ * DOM the browser builds from the rendered markup would disagree.
+ */
+export function parseHtml(html, options = {}) {
+  if (typeof html !== 'string' || html === '') return null;
+  const sanitize = options.sanitize !== false;
+  const allow = makeAllowCheck(options.allowList);
+  const root = {
+    name: '',
+    props: {},
+    children: []
+  };
+  const stack = [root];
+  // Always non-empty: the root is never popped.
+  const current = () => stack[stack.length - 1];
+  const close = downTo => {
+    while (stack.length > downTo) {
+      const element = stack.pop(); // eslint-disable-line no-type-assertion/no-type-assertion -- guarded by the loop
+      if (element.removal === 'drop') continue;
+      if (element.removal === 'unwrap') current().children.push(...element.children);else current().children.push(toContentNode(element));
+    }
+  };
+  for (const token of tokenizeHtml(html)) {
+    if (token.kind === 'text') {
+      // a dropped element's text goes with it
+      if (current().removal === 'drop') continue;
+      if (token.text === '') continue;
+      if (current().name in htmlTableStructureTags) {
+        // Whitespace between table tags is dropped rather than kept.
+        // HTML parsers disagree over whether it survives inside a
+        // table, and this tree has to match whichever one the browser
+        // uses. Emitting none settles it: there is then nothing in the
+        // rendered markup for a parser to have an opinion about, and
+        // between table cells it makes no visual difference anyway.
+        if (token.text.trim() === '') continue;
+        // Foster parenting: a browser relocates text with something in
+        // it to just before the enclosing table. That table is still
+        // open on the stack, and is pushed to its parent only when it
+        // closes, so appending to the parent now places the text ahead
+        // of it — exactly where the browser puts it.
+        let tableIndex = -1;
+        for (let i = stack.length - 1; i > 0; i--) {
+          if (stack[i].name === 'table') {
+            tableIndex = i;
+            break;
+          }
+        }
+        const host = tableIndex > 0 ? stack[tableIndex - 1] : current();
+        host.children.push(token.text);
+        continue;
+      }
+      current().children.push(token.text);
+      continue;
+    }
+    if (token.kind === 'open') {
+      // An element that is going away is still opened and tracked, so
+      // the markup inside it is accounted for rather than surfacing as
+      // stray text in its parent.
+      const removal = removalFor(token.name, sanitize, allow);
+      // apply the browser's implied end tags before opening
+      while (stack.length > 1 && impliedEndTag(current().name, token.name)) {
+        close(stack.length - 1);
+      }
+      const element = {
+        name: token.name,
+        props: removal === undefined ? attributesToProps(token.name, token.attributes, sanitize, allow) : {},
+        children: [],
+        ...(removal === undefined ? {} : {
+          removal
+        })
+      };
+      if (token.selfClosing || token.name in htmlVoidTags) {
+        if (removal === undefined) current().children.push(toContentNode(element));
+      } else {
+        stack.push(element);
+      }
+      continue;
+    }
+    // close token - find the nearest matching open element
+    let found = -1;
+    for (let i = stack.length - 1; i > 0; i--) {
+      if (stack[i].name === token.name) {
+        found = i;
+        break;
+      }
+    }
+    // no match: a stray end tag, which browsers ignore
+    if (found !== -1) close(found);
+  }
+  // close anything the markup left open
+  close(1);
+  if (root.children.length === 0) return null;
+  if (root.children.length === 1) return root.children[0] ?? null;
+  return root.children;
+}

package/dist/rawHtml/parseHtml.sxyt.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parseHtml.sxyt.d.ts.map

package/dist/rawHtml/parseHtml.sxyt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseHtml.sxyt.d.ts","sourceRoot":"","sources":["../../src/rawHtml/parseHtml.sxyt.ts"],"names":[],"mappings":""}