| … | … | @@ -191,3 +191,42 @@ export function render (source, opts = {}) { |
| 191 | 191 | } |
| 192 | 192 | |
| 193 | 193 | export default render |
| 194 | ||
| 195 | /** | |
| 196 | * embeds(source) -> [{ oid, alt, kind }] — every `favela://blob/<oid>` a record references. | |
| 197 | * | |
| 198 | * ⛔ Uses the SAME parse `render` does, not a regular expression. A regex would match a blob URI | |
| 199 | * inside a code fence or an escaped bracket and report a reference the renderer will never make — | |
| 200 | * and the two disagreeing about what a record references is how a surface fetches the wrong files. | |
| 201 | * | |
| 202 | * `kind` is the authoring gesture: `image` for `![…]()`, `link` for `[…]()`. Source order, because | |
| 203 | * §3.5 has the embed pipeline consuming them in it. | |
| 204 | * | |
| 205 | * TOTAL — never throws; an unparseable record has no embeds. | |
| 206 | */ | |
| 207 | const labelOf = (n) => (n.children || []).map((c) => c.value || labelOf(c)).join('') | |
| 208 | ||
| 209 | export function embeds (source) { | |
| 210 | const src = String(source == null ? '' : source).replace(/\r\n?/g, '\n') | |
| 211 | let tree | |
| 212 | try { tree = fromMarkdown(src, MICROMARK) } catch { return [] } | |
| 213 | ||
| 214 | const out = [] | |
| 215 | const walk = (node) => { | |
| 216 | if (!node || typeof node !== 'object') return | |
| 217 | if (node.type === 'image' || node.type === 'link') { | |
| 218 | const oid = blobOid(node.url || '') | |
| 219 | if (oid) { | |
| 220 | out.push({ | |
| 221 | oid, | |
| 222 | // ⛔ Not `textOf`, which only walks a paragraph — a link's label is its own children. | |
| 223 | alt: node.type === 'image' ? (node.alt || '') : labelOf(node), | |
| 224 | kind: node.type === 'image' ? 'image' : 'link' | |
| 225 | }) | |
| 226 | } | |
| 227 | } | |
| 228 | for (const c of node.children || []) walk(c) | |
| 229 | } | |
| 230 | try { walk(tree) } catch { return out } | |
| 231 | return out | |
| 232 | } |
| … | … | @@ -1,6 +1,6 @@ |
| 1 | 1 | { |
| 2 | 2 | "name": "favela-markdown", |
| 3 | "version": "0.1.1", | |
| 3 | "version": "0.1.2", | |
| 4 | 4 | "description": "The P2P-native markdown record layer for favela. A post is a markdown document; atproto and ActivityPub are projections derived from it on read.", |
| 5 | 5 | "type": "module", |
| 6 | 6 | "license": "MIT", |
| … | … | @@ -8,7 +8,7 @@ |
| 8 | 8 | // same fail-closed posture reach.js has for privacy, applied to markup. |
| 9 | 9 | |
| 10 | 10 | import test from 'brittle' |
| 11 | import { render } from '../lib/render.js' | |
| 11 | import { render, embeds } from '../lib/render.js' | |
| 12 | 12 | |
| 13 | 13 | test('basic formatting survives, unlike in strip()', (t) => { |
| 14 | 14 | t.is(render('hello **world**'), '<p>hello <strong>world</strong></p>') |
| … | … | @@ -154,3 +154,21 @@ test('⛔ the author-URL allowlist is UNCHANGED by any of this', (t) => { |
| 154 | 154 | t.absent(render('[x](javascript:alert(1))', o).includes('href'), 'and links too') |
| 155 | 155 | t.ok(render('', o).includes('<img'), 'http still works') |
| 156 | 156 | }) |
| 157 | ||
| 158 | test('★ embeds() reports every blob a record references, in source order', (t) => { | |
| 159 | const A = 'a1'.repeat(16); const B = 'b2'.repeat(16) | |
| 160 | const md = '\n\nand [the report](favela://blob/' + B + ')' | |
| 161 | const got = embeds(md) | |
| 162 | t.is(got.length, 2) | |
| 163 | t.alike(got[0], { oid: A, alt: 'a cat', kind: 'image' }) | |
| 164 | t.alike(got[1], { oid: B, alt: 'the report', kind: 'link' }, 'a link label is its own children') | |
| 165 | }) | |
| 166 | ||
| 167 | test('⛔ embeds() uses the PARSE, so a blob URI inside a code fence is not a reference', (t) => { | |
| 168 | // A regex would report this and the surface would fetch a file the renderer never shows — the | |
| 169 | // two disagreeing about what a record references is exactly the bug worth preventing. | |
| 170 | const md = '```\n + ')\n```' | |
| 171 | t.alike(embeds(md), [], 'code is not a reference') | |
| 172 | t.alike(embeds('no embeds here'), []) | |
| 173 | t.alike(embeds(null), [], 'total — never throws') | |
| 174 | }) |