import sanitizeHtml from "sanitize-html";
const ALLOWED_TAGS = [
  "a",
  "img",
  "table",
  "thead",
  "tbody",
  "tfoot",
  "tr",
  "td",
  "th",
  "p",
  "br",
  "hr",
  "ul",
  "ol",
  "li",
  "h1",
  "h2",
  "h3",
  "h4",
  "h5",
  "h6",
  "strong",
  "em",
  "b",
  "i",
  "u",
  "s",
  "blockquote",
  "code",
  "pre",
  "span",
  "div"
];
const ALLOWED_SCHEMES = ["http", "https", "mailto", "tel"];
const ALLOWED_SCHEMES_BY_TAG = {
  img: ["http", "https", "data"]
};
const SAFE_CSS_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\(\s*[\d.,\s%]+\)$|^hsla?\(\s*[\d.,\s%]+\)$|^[a-z]+$/i;
const SANITIZE_OPTIONS = {
  allowedTags: ALLOWED_TAGS,
  allowedAttributes: {
    a: ["href", "title", "class"],
    img: ["src", "alt", "title", "class", "width", "height"],
    "*": ["class", "style", "colspan", "rowspan", "width", "height"]
  },
  allowedSchemes: ALLOWED_SCHEMES,
  allowedSchemesByTag: ALLOWED_SCHEMES_BY_TAG,
  allowedSchemesAppliedToAttributes: ["href", "src"],
  allowProtocolRelative: false,
  // disable inline scripts in style attributes
  allowedStyles: {
    "*": {
      "background-color": [SAFE_CSS_COLOR],
      color: [SAFE_CSS_COLOR],
      "text-align": [/^left$|^right$|^center$|^justify$/i],
      "font-size": [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/],
      "font-weight": [/^\d{3}$|^bold$|^normal$/],
      "font-style": [/^italic$|^normal$/],
      "text-decoration": [/^underline$|^line-through$|^none$/],
      padding: [/^[\d\s.]+(?:px|em|rem|%)?$/],
      margin: [/^[\d\s.]+(?:px|em|rem|%)?$/],
      border: [/^[\d\s\w.]+$/],
      "border-radius": [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/],
      // Permit only `display:none` so the hidden thread-token footer span
      // (`buildBodyFooter`) stays hidden when a sent email body is re-rendered.
      // Every other display value is stripped.
      display: [/^none$/]
    }
  },
  /**
   * data:image/<mime>;base64,... URLs in <img src=...> are explicitly allowed so inline
   * email images render. sanitize-html validates the base64 payload shape; if a future
   * payload tries to smuggle a non-image MIME type via data URL we strip it.
   */
  exclusiveFilter: (frame) => {
    if (frame.tag === "img" && frame.attribs?.src) {
      const src = frame.attribs.src;
      if (src.startsWith("data:") && !/^data:image\/(?:png|jpe?g|gif|webp);base64,/i.test(src)) {
        return true;
      }
    }
    return false;
  }
};
function sanitizeChannelHtml(html) {
  if (!html) return "";
  return sanitizeHtml(html, SANITIZE_OPTIONS);
}
var sanitize_channel_html_default = sanitizeChannelHtml;
export {
  sanitize_channel_html_default as default,
  sanitizeChannelHtml
};
//# sourceMappingURL=sanitize-channel-html.js.map
