@aiquants/markdown-explorer 0.1.0 → 0.3.0

package/dist/sanitizeWorker.js

@@ -1,291 +1,281 @@
-import { parentPort as Z } from "node:worker_threads";
-import { defaultTreeAdapter as b, parse as ee, html as te } from "parse5";
+import { parentPort as ee } from "node:worker_threads";
+import { defaultTreeAdapter as b, parse as te, html as re } from "parse5";
+import { allowedFrameUrlOf as ne, reduceFrameFeatures as oe, EMBED_FRAME_REFERRER_POLICIES as se, EMBED_LINK_ATTRIBUTE as H, placeholderLinkOf as ae } from "@aiquants/markdown/embeds";
 import S from "isomorphic-dompurify";
-import { i as re, e as ne } from "./dataRoute-Bkfwfp1R.js";
-const B = 512, oe = 4096, F = 1024, P = /* @__PURE__ */ Symbol("placement"), G = 2, se = 3, ae = /* @__PURE__ */ new Set(["html", "head", "body"]), _ = 0, y = 1, I = 2, j = 3, D = 4, L = 5, O = 6, N = 7, V = 8, k = 9, W = 10, w = -1, ie = 0, ce = 1, le = 2, ue = 3, fe = 4, de = 5, X = 6, pe = 7, me = (t) => {
+import { i as ie, e as ce } from "./dataRoute-zUX-oR9j.js";
+const F = 512, le = 4096, G = 1024, j = /* @__PURE__ */ Symbol("placement"), V = 2, ue = 3, fe = /* @__PURE__ */ new Set(["html", "head", "body"]), w = 0, D = 1, M = 2, W = 3, z = 4, O = 5, k = 6, N = 7, Q = 8, I = 9, $ = 10, _ = -1, de = 0, pe = 1, Ee = 2, me = 3, he = 4, Te = 5, K = 6, Ae = 7, ge = (t) => {
   switch (t) {
     case 9:
     case 10:
     case 12:
     case 13:
     case 32:
-      return ie;
+      return de;
     case 47:
-      return ce;
+      return pe;
     case 62:
-      return le;
+      return Ee;
     case 61:
-      return ue;
+      return me;
     case 34:
-      return fe;
+      return he;
     case 39:
-      return de;
+      return Te;
     default:
-      return X;
+      return K;
   }
-}, Ee = Uint8Array.from({ length: 128 }, (t, n) => me(n)), U = 60, Q = 47, he = /[\t\n\f\r />="'<]/g, Ae = /["<]/g, Te = /['<]/g, A = -1 - I, ge = Int8Array.from(
+}, Se = Uint8Array.from({ length: 128 }, (t, i) => ge(i)), v = 60, X = 47, _e = /[\t\n\f\r />="'<]/g, we = /["<]/g, be = /['<]/g, A = -1 - M, Ne = Int8Array.from(
   [
-    [y, k, w, _, _, _, _],
-    [y, k, w, A, A, A, A],
-    [j, k, w, D, I, I, I],
-    [j, k, w, D, A, A, A],
-    [D, N, w, N, L, O, N],
-    [L, L, L, L, V, L, L],
-    [O, O, O, O, O, V, O],
-    [y, N, w, N, N, N, N],
-    [y, k, w, A, A, A, A],
-    [y, k, w, A, A, A, A]
+    [D, I, _, w, w, w, w],
+    [D, I, _, A, A, A, A],
+    [W, I, _, z, M, M, M],
+    [W, I, _, z, A, A, A],
+    [z, N, _, N, O, k, N],
+    [O, O, O, O, Q, O, O],
+    [k, k, k, k, k, Q, k],
+    [D, N, _, N, N, N, N],
+    [D, I, _, A, A, A, A],
+    [D, I, _, A, A, A, A]
   ].flat()
-), $ = (t) => t >= 65 && t <= 90 || t >= 97 && t <= 122, Se = (t, n) => {
-  let o = new Int32Array(W), l = new Int32Array(W), i = 0, T = 0, s = 0;
-  for (; s < t.length; ) {
-    if (i === 0) {
-      const r = t.indexOf("<", s);
-      if (r < 0) return !1;
-      s = r + 1, t.charCodeAt(s) === Q && (s += 1), $(t.charCodeAt(s)) && (o[_] = 0, i = 1 << _, s += 1);
+), J = (t) => t >= 65 && t <= 90 || t >= 97 && t <= 122, Oe = (t, i) => {
+  let u = new Int32Array($), f = new Int32Array($), c = 0, h = 0, n = 0;
+  for (; n < t.length; ) {
+    if (c === 0) {
+      const p = t.indexOf("<", n);
+      if (p < 0) return !1;
+      n = p + 1, t.charCodeAt(n) === X && (n += 1), J(t.charCodeAt(n)) && (u[w] = 0, c = 1 << w, n += 1);
       continue;
     }
-    if ((i & -230) === 0 && s >= T) {
-      const r = i === 1 << L ? Ae : i === 1 << O ? Te : he;
-      r.lastIndex = s;
-      const d = r.exec(t);
-      if (d === null) return !1;
-      s = d.index, t.charCodeAt(s) === U && (T = s + 3);
+    if ((c & -230) === 0 && n >= h) {
+      const p = c === 1 << O ? we : c === 1 << k ? be : _e;
+      p.lastIndex = n;
+      const a = p.exec(t);
+      if (a === null) return !1;
+      n = a.index, t.charCodeAt(n) === v && (h = n + 3);
     }
-    const E = t.charCodeAt(s), g = E < 128 ? Ee[E] : X;
-    let h = 0;
-    for (let r = i; r !== 0; r &= r - 1) {
-      const d = 31 - Math.clz32(r & -r);
-      let f = ge[d * pe + g], m = o[d];
-      if (f < w && (f = -1 - f, m += 1, m > n))
+    const m = t.charCodeAt(n), g = m < 128 ? Se[m] : K;
+    let T = 0;
+    for (let p = c; p !== 0; p &= p - 1) {
+      const a = 31 - Math.clz32(p & -p);
+      let r = Ne[a * Ae + g], o = u[a];
+      if (r < _ && (r = -1 - r, o += 1, o > i))
         return !0;
-      if (f === w) continue;
-      const R = 1 << f;
-      ((h & R) === 0 || m > l[f]) && (l[f] = m), h |= R;
+      if (r === _) continue;
+      const E = 1 << r;
+      ((T & E) === 0 || o > f[r]) && (f[r] = o), T |= E;
     }
-    $(E) && (t.charCodeAt(s - 1) === U || t.charCodeAt(s - 1) === Q && t.charCodeAt(s - 2) === U) && (h & 1 << _) === 0 && (l[_] = 0, h |= 1 << _);
-    const u = o;
-    o = l, l = u, i = h, s += 1;
+    J(m) && (t.charCodeAt(n - 1) === v || t.charCodeAt(n - 1) === X && t.charCodeAt(n - 2) === v) && (T & 1 << w) === 0 && (f[w] = 0, T |= 1 << w);
+    const L = u;
+    u = f, f = L, c = T, n += 1;
   }
   return !1;
 };
 class C extends Error {
   status;
-  constructor(n) {
-    super(`[markdown-explorer] the nesting guard stopped the parse: ${n}`), this.name = "ParseStop", this.status = n;
+  constructor(i) {
+    super(`[markdown-explorer] the nesting guard stopped the parse: ${i}`), this.name = "ParseStop", this.status = i;
   }
 }
-const we = (t, n, o, l) => {
-  if (!Number.isSafeInteger(n) || n <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's depth limit must be a positive safe integer; got ${String(n)}`);
-  if (!Number.isSafeInteger(o) || o <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's node budget must be a positive safe integer; got ${String(o)}`);
-  if (!Number.isSafeInteger(l) || l <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's attribute character budget must be a positive safe integer; got ${String(l)}`);
-  if (Se(t, F)) return { status: "too-many-attributes" };
-  const i = n + G, T = t.length + se;
-  let s = null, E = 0, g = 0, h = 0, u = 0;
-  const r = (e) => {
-    if (g += e, g > o) throw new C("too-many-nodes");
-  }, d = (e) => {
-    for (const a of e) u += a.name.length + a.value.length;
-    if (u > l) throw new C("too-many-attribute-characters");
-  }, f = (e, a, c, p) => {
-    const v = { node: e, above: null, levels: a, height: 0, keepsChildren: c, attributes: p, first: null, next: null, previous: null }, q = e;
-    return q[P] = v, v;
-  }, m = (e) => {
-    const c = e[P];
-    if (c === void 0) throw new Error("[markdown-explorer] the nesting guard was handed a node it did not create");
-    return c;
-  }, R = (e, a) => {
-    let c = a;
-    for (let p = e; p !== null && c > p.height; p = p.above)
-      p.height = c, c += p.levels;
-    if (s !== null && s.height > i) throw new C("too-deep");
-  }, M = (e) => {
-    const a = e.above;
-    a?.keepsChildren && (e.previous === null ? a.first = e.next : e.previous.next = e.next, e.next !== null && (e.next.previous = e.previous)), e.above = null, e.next = null, e.previous = null;
-  }, H = (e, a) => {
-    if (!b.isElementNode(a)) return;
-    const c = m(a), p = m(e);
-    M(c), c.above = p, p.keepsChildren && (c.next = p.first, p.first !== null && (p.first.previous = c), p.first = c), a.parentNode = e, R(p, c.height + c.levels);
-  }, K = {
+const ke = (t, i, u, f) => {
+  if (!Number.isSafeInteger(i) || i <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's depth limit must be a positive safe integer; got ${String(i)}`);
+  if (!Number.isSafeInteger(u) || u <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's node budget must be a positive safe integer; got ${String(u)}`);
+  if (!Number.isSafeInteger(f) || f <= 0) throw new RangeError(`[markdown-explorer] the nesting guard's attribute character budget must be a positive safe integer; got ${String(f)}`);
+  if (Oe(t, G)) return { status: "too-many-attributes" };
+  const c = i + V, h = t.length + ue;
+  let n = null, m = 0, g = 0, T = 0, L = 0;
+  const p = (e) => {
+    if (g += e, g > u) throw new C("too-many-nodes");
+  }, a = (e) => {
+    for (const s of e) L += s.name.length + s.value.length;
+    if (L > f) throw new C("too-many-attribute-characters");
+  }, r = (e, s, l, d) => {
+    const P = { node: e, above: null, levels: s, height: 0, keepsChildren: l, attributes: d, first: null, next: null, previous: null }, Z = e;
+    return Z[j] = P, P;
+  }, o = (e) => {
+    const l = e[j];
+    if (l === void 0) throw new Error("[markdown-explorer] the nesting guard was handed a node it did not create");
+    return l;
+  }, E = (e, s) => {
+    let l = s;
+    for (let d = e; d !== null && l > d.height; d = d.above)
+      d.height = l, l += d.levels;
+    if (n !== null && n.height > c) throw new C("too-deep");
+  }, y = (e) => {
+    const s = e.above;
+    s?.keepsChildren && (e.previous === null ? s.first = e.next : e.previous.next = e.next, e.next !== null && (e.next.previous = e.previous)), e.above = null, e.next = null, e.previous = null;
+  }, R = (e, s) => {
+    if (!b.isElementNode(s)) return;
+    const l = o(s), d = o(e);
+    y(l), l.above = d, d.keepsChildren && (l.next = d.first, d.first !== null && (d.first.previous = l), d.first = l), s.parentNode = e, E(d, l.height + l.levels);
+  }, x = {
     ...b,
     createDocument: () => {
       const e = b.createDocument();
-      return s = f(e, 0, !1, 0), e;
+      return n = r(e, 0, !1, 0), e;
     },
     createDocumentFragment: () => {
       const e = b.createDocumentFragment();
-      return f(e, 0, !1, 0), e;
+      return r(e, 0, !1, 0), e;
     },
-    createElement: (e, a, c) => {
-      if (E += 1, E > T) throw new C("too-many-elements");
-      r(1 + c.length), d(c);
-      const p = b.createElement(e, a, c);
-      return f(p, 1, !(a === te.NS.HTML && ae.has(e)), c.length), p;
+    createElement: (e, s, l) => {
+      if (m += 1, m > h) throw new C("too-many-elements");
+      p(1 + l.length), a(l);
+      const d = b.createElement(e, s, l);
+      return r(d, 1, !(s === re.NS.HTML && fe.has(e)), l.length), d;
     },
     createCommentNode: (e) => {
-      if (h += 1, h > oe) throw new C("too-many-comments");
-      return r(1), b.createCommentNode(e);
+      if (T += 1, T > le) throw new C("too-many-comments");
+      return p(1), b.createCommentNode(e);
     },
-    setTemplateContent: (e, a) => {
-      b.setTemplateContent(e, a);
-      const c = m(a);
-      c.above = m(e), R(c.above, c.height);
+    setTemplateContent: (e, s) => {
+      b.setTemplateContent(e, s);
+      const l = o(s);
+      l.above = o(e), E(l.above, l.height);
     },
-    appendChild: H,
-    insertBefore: (e, a) => H(e, a),
+    appendChild: R,
+    insertBefore: (e, s) => R(e, s),
     detachNode: (e) => {
-      b.isElementNode(e) && (M(m(e)), e.parentNode = null);
+      b.isElementNode(e) && (y(o(e)), e.parentNode = null);
     },
     getFirstChild: (e) => {
-      const a = m(e);
-      if (!a.keepsChildren) throw new Error("[markdown-explorer] the nesting guard was asked for the children of a node whose children it does not keep");
-      return a.first === null ? null : a.first.node;
+      const s = o(e);
+      if (!s.keepsChildren) throw new Error("[markdown-explorer] the nesting guard was asked for the children of a node whose children it does not keep");
+      return s.first === null ? null : s.first.node;
     },
     getChildNodes: () => {
       throw new Error("[markdown-explorer] the nesting guard keeps no child lists for source locations");
     },
     onItemPop: (e) => {
-      const a = m(e);
-      a.keepsChildren = !1, a.first = null;
+      const s = o(e);
+      s.keepsChildren = !1, s.first = null;
     },
     insertText: () => {
     },
     insertTextBefore: () => {
     },
-    adoptAttributes: (e, a) => {
-      r(a.length), d(a);
-      const c = m(e);
-      if (c.attributes += a.length, c.attributes > F) throw new C("too-many-attributes");
+    adoptAttributes: (e, s) => {
+      p(s.length), a(s);
+      const l = o(e);
+      if (l.attributes += s.length, l.attributes > G) throw new C("too-many-attributes");
     }
   };
-  let z;
+  let B;
   try {
-    z = ee(t, { scriptingEnabled: !1, treeAdapter: K });
+    B = te(t, { scriptingEnabled: !1, treeAdapter: x });
   } catch (e) {
     if (e instanceof C) return { status: e.status };
     throw e;
   }
-  return { status: "within", depth: m(z).height - G, elements: E, nodes: g };
+  return { status: "within", depth: o(B).height - V, elements: m, nodes: g };
 };
-class J extends RangeError {
-  constructor(n) {
-    super(`[markdown-explorer] the HTML nests deeper than ${String(n)} levels`), this.name = "HtmlNestingLimitError";
+class Y extends RangeError {
+  constructor(i) {
+    super(`[markdown-explorer] the HTML nests deeper than ${String(i)} levels`), this.name = "HtmlNestingLimitError";
   }
 }
-const _e = ["script", "style", "noscript", "template", "form", "button", "textarea", "select", "option", "object", "embed", "base", "meta", "link", "frame", "frameset"], be = ["srcdoc", "formaction"], Ne = /^(?:(?:https?|mailto|tel):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))/iu, Le = /* @__PURE__ */ new Set(["left", "right", "center", "justify", "start", "end"]), Oe = /* @__PURE__ */ new Set(["h1", "h2", "h3", "h4", "h5", "h6"]), x = 1, Y = Object.freeze({
+const Ce = ["script", "style", "noscript", "template", "form", "button", "textarea", "select", "option", "object", "embed", "base", "meta", "link", "frame", "frameset"], Le = ["srcdoc", "formaction"], Re = /^(?:(?:https?|mailto|tel):|[^a-z]|[a-z+.-]+(?:[^a-z+.:-]|$))/iu, Ie = /* @__PURE__ */ new Set(["left", "right", "center", "justify", "start", "end"]), ye = /* @__PURE__ */ new Set(["h1", "h2", "h3", "h4", "h5", "h6"]), U = 1, De = 3, Me = 7, Ue = 8, q = Object.freeze({
   a: Object.freeze(["target", "data-link-kind", "data-doc-path", "data-doc-exists", "data-footnote-ref", "data-footnote-backref"]),
   area: Object.freeze(["target"]),
   img: Object.freeze(["data-asset-src", "data-asset-exists"]),
   section: Object.freeze(["data-footnotes"]),
   iframe: Object.freeze(["allow", "allowfullscreen", "frameborder", "referrerpolicy"])
-}), Re = [...new Set(Object.values(Y).flatMap((t) => t.filter((n) => n.startsWith("data-"))))], Ce = /* @__PURE__ */ new Set(["no-referrer", "origin", "same-origin", "strict-origin", "strict-origin-when-cross-origin"]), ke = /* @__PURE__ */ new Set(["autoplay", "clipboard-write", "encrypted-media", "fullscreen", "picture-in-picture", "web-share"]), ye = /* @__PURE__ */ new Set(["src", "href", "xlink:href"]), Ie = /^data:/iu, De = Object.freeze({
-  FORBID_TAGS: _e,
-  FORBID_ATTR: be,
+}), xe = [...new Set(Object.values(q).flatMap((t) => t.filter((i) => i.startsWith("data-"))))], He = /* @__PURE__ */ new Set(["src", "href", "xlink:href"]), ze = /^data:/iu, ve = Object.freeze({
+  FORBID_TAGS: Ce,
+  FORBID_ATTR: Le,
   ADD_TAGS: ["iframe"],
-  ADD_ATTR: (t, n) => Y[n]?.includes(t) === !0,
-  ADD_URI_SAFE_ATTR: Re,
-  ALLOWED_URI_REGEXP: Ne,
+  ADD_ATTR: (t, i) => q[i]?.includes(t) === !0,
+  ADD_URI_SAFE_ATTR: xe,
+  ALLOWED_URI_REGEXP: Re,
   ALLOW_DATA_ATTR: !1
-}), Ue = (t) => {
-  let n = null;
-  for (const o of t.split(";")) {
-    const l = o.indexOf(":");
-    if (l < 0 || o.slice(0, l).trim().toLowerCase() !== "text-align") continue;
-    const i = o.slice(l + 1).trim().toLowerCase();
-    Le.has(i) && (n = i);
-  }
-  return n === null ? null : `text-align: ${n}`;
-}, xe = (t) => {
-  const n = /* @__PURE__ */ new Set();
-  for (const o of t.split(";")) {
-    const [l] = o.trim().toLowerCase().split(/\s+/u);
-    l !== void 0 && ke.has(l) && n.add(l);
-  }
-  return n.size === 0 ? null : [...n].join("; ");
-}, Me = (t, n) => {
-  if (t === null) return !1;
-  let o;
-  try {
-    o = new URL(t.trim());
-  } catch {
-    return !1;
+}), Be = (t) => {
+  let i = null;
+  for (const u of t.split(";")) {
+    const f = u.indexOf(":");
+    if (f < 0 || u.slice(0, f).trim().toLowerCase() !== "text-align") continue;
+    const c = u.slice(f + 1).trim().toLowerCase();
+    Ie.has(c) && (i = c);
   }
-  return o.protocol === "https:" && o.username === "" && o.password === "" && o.port === "" && n.has(o.hostname);
-}, He = (t) => {
-  const n = t.getAttribute("type");
-  return n !== null && n.trim().toLowerCase() === "checkbox" && t.hasAttribute("disabled");
-}, ze = (t, n, o) => {
+  return i === null ? null : `text-align: ${i}`;
+}, Pe = (t) => t.nodeType === De ? { kind: "text", text: t.nodeValue ?? "" } : t.nodeType === Ue || t.nodeType === Me ? { kind: "ignored" } : t.nodeType === U && t.nodeName.toLowerCase() === "a" ? { kind: "link", href: t.getAttribute("href") } : { kind: "element" }, Fe = (t) => {
+  const i = t.getAttribute("type");
+  return i !== null && i.trim().toLowerCase() === "checkbox" && t.hasAttribute("disabled");
+}, Ge = (t, i, u) => {
   if (S.isSupported !== !0) throw new Error("[markdown-explorer] the HTML sanitizer cannot run in this environment");
-  if (!Number.isSafeInteger(o) || o <= 0) throw new RangeError(`[markdown-explorer] the HTML sanitizer's depth limit must be a positive integer; got ${String(o)}`);
-  const l = new Set(t);
-  let i = /* @__PURE__ */ new WeakMap();
-  const T = (u) => {
-    const r = u.parentNode === null ? void 0 : i.get(u.parentNode), d = r === void 0 ? 0 : r + 1;
-    if (i.set(u, d), u.nodeType === x && d > o) throw new J(o);
-  }, s = (u, r) => {
-    if (u.nodeType !== x) return;
-    const d = u;
-    (r.tagName === "input" && !He(d) || r.tagName === "iframe" && !Me(d.getAttribute("src"), l)) && d.parentNode?.removeChild(d);
-  }, E = (u, r) => {
-    const d = u.nodeName.toLowerCase();
+  if (!Number.isSafeInteger(u) || u <= 0) throw new RangeError(`[markdown-explorer] the HTML sanitizer's depth limit must be a positive integer; got ${String(u)}`);
+  const f = Object.freeze([...t]);
+  let c = /* @__PURE__ */ new WeakMap(), h = /* @__PURE__ */ new WeakMap();
+  const n = (a) => {
+    const r = a.parentNode === null ? void 0 : c.get(a.parentNode), o = r === void 0 ? 0 : r + 1;
+    if (c.set(a, o), a.nodeType === U && o > u) throw new Y(u);
+  }, m = (a, r) => {
+    if (a.nodeType !== U) return;
+    const o = a;
+    (r.tagName === "input" && !Fe(o) || r.tagName === "iframe" && ne(o.getAttribute("src")?.trim(), f) === null) && o.parentNode?.removeChild(o);
+  }, g = (a, r) => {
+    const o = a.nodeName.toLowerCase();
     if (r.attrName === "style") {
-      const f = Ue(r.attrValue);
-      f === null ? r.keepAttr = !1 : r.attrValue = f;
-    } else if (r.attrName === "allow" && d === "iframe") {
-      const f = xe(r.attrValue);
-      f === null ? r.keepAttr = !1 : r.attrValue = f;
-    } else if (r.attrName === "referrerpolicy" && d === "iframe") {
-      const f = r.attrValue.trim().toLowerCase();
-      Ce.has(f) ? r.attrValue = f : r.keepAttr = !1;
-    } else ye.has(r.attrName) && Ie.test(r.attrValue) ? r.keepAttr = !1 : r.attrName === "id" && Oe.has(d) && (r.forceKeepAttr = !0);
-  }, g = (u) => {
-    const r = u.getAttribute("data-asset-src");
-    r !== null && (u.getAttribute("data-asset-exists") !== "false" && re(r) ? u.setAttribute("src", ne(n, r, null)) : u.removeAttribute("src"));
-  }, h = (u) => {
-    if (u.nodeType !== x) return;
-    const r = u;
-    r.nodeName.toLowerCase() === "img" && g(r);
-    const d = r.getAttribute("target");
-    if (d === null || d.trim().toLowerCase() === "_self") return;
-    const f = r.getAttribute("rel"), m = new Set(f === null ? [] : f.split(/\s+/u).filter((R) => R !== ""));
-    m.add("noopener"), m.add("noreferrer"), r.setAttribute("rel", [...m].join(" "));
+      const E = Be(r.attrValue);
+      E === null ? r.keepAttr = !1 : r.attrValue = E;
+    } else if (r.attrName === "allow" && o === "iframe") {
+      const E = oe(r.attrValue);
+      E === null ? r.keepAttr = !1 : r.attrValue = E;
+    } else if (r.attrName === "referrerpolicy" && o === "iframe") {
+      const E = r.attrValue.trim().toLowerCase();
+      se.has(E) ? r.attrValue = E : r.keepAttr = !1;
+    } else r.attrName === H && o === "p" ? h.set(a, a.getAttribute(H)) : He.has(r.attrName) && ze.test(r.attrValue) ? r.keepAttr = !1 : r.attrName === "id" && ye.has(o) && (r.forceKeepAttr = !0);
+  }, T = (a) => {
+    const r = a.getAttribute("data-asset-src");
+    r !== null && (a.getAttribute("data-asset-exists") !== "false" && ie(r) ? a.setAttribute("src", ce(i, r, null)) : a.removeAttribute("src"));
+  }, L = (a) => {
+    const r = a.parentNode;
+    if (r === null) return;
+    const o = h.get(r);
+    o != null && ae(o, [...r.childNodes].map(Pe)) !== null && r.setAttribute(H, o);
+  }, p = (a) => {
+    if (a.nodeType !== U) return;
+    const r = a, o = r.nodeName.toLowerCase();
+    o === "img" ? T(r) : o === "a" && L(r);
+    const E = r.getAttribute("target");
+    if (E === null || E.trim().toLowerCase() === "_self") return;
+    const y = r.getAttribute("rel"), R = new Set(y === null ? [] : y.split(/\s+/u).filter((x) => x !== ""));
+    R.add("noopener"), R.add("noreferrer"), r.setAttribute("rel", [...R].join(" "));
   };
-  return (u) => {
-    i = /* @__PURE__ */ new WeakMap(), S.addHook("beforeSanitizeElements", T), S.addHook("uponSanitizeElement", s), S.addHook("uponSanitizeAttribute", E), S.addHook("afterSanitizeAttributes", h);
+  return (a) => {
+    c = /* @__PURE__ */ new WeakMap(), h = /* @__PURE__ */ new WeakMap(), S.addHook("beforeSanitizeElements", n), S.addHook("uponSanitizeElement", m), S.addHook("uponSanitizeAttribute", g), S.addHook("afterSanitizeAttributes", p);
     try {
-      return S.sanitize(u, De);
+      return S.sanitize(a, ve);
     } finally {
-      S.removeHook("beforeSanitizeElements", T), S.removeHook("uponSanitizeElement", s), S.removeHook("uponSanitizeAttribute", E), S.removeHook("afterSanitizeAttributes", h);
+      S.removeHook("beforeSanitizeElements", n), S.removeHook("uponSanitizeElement", m), S.removeHook("uponSanitizeAttribute", g), S.removeHook("afterSanitizeAttributes", p);
     }
   };
-}, ve = (t) => {
+}, je = (t) => {
   if (t === null || typeof t != "object") return !1;
-  const { id: n, input: o } = t;
-  if (typeof n != "number" || o === null || typeof o != "object") return !1;
-  const { html: l, iframeHosts: i, dataPath: T, maxNodes: s, maxAttributeChars: E, maxSanitizedChars: g } = o;
-  return typeof l == "string" && Array.isArray(i) && i.every((h) => typeof h == "string") && typeof T == "string" && T !== "" && [s, E, g].every((h) => Number.isSafeInteger(h) && h > 0);
-}, Be = () => {
-  const t = Z;
+  const { id: i, input: u } = t;
+  if (typeof i != "number" || u === null || typeof u != "object") return !1;
+  const { html: f, iframeHosts: c, dataPath: h, maxNodes: n, maxAttributeChars: m, maxSanitizedChars: g } = u;
+  return typeof f == "string" && Array.isArray(c) && c.every((T) => typeof T == "string") && typeof h == "string" && h !== "" && [n, m, g].every((T) => Number.isSafeInteger(T) && T > 0);
+}, Ve = () => {
+  const t = ee;
   if (t === null) throw new Error("[markdown-explorer] the sanitizer worker must run in a worker thread");
-  const n = /* @__PURE__ */ new Map();
-  t.on("message", (o) => {
-    if (!ve(o)) throw new TypeError("[markdown-explorer] the sanitizer worker received a message that is not a job");
-    const { id: l, input: i } = o;
-    let T;
+  const i = /* @__PURE__ */ new Map();
+  t.on("message", (u) => {
+    if (!je(u)) throw new TypeError("[markdown-explorer] the sanitizer worker received a message that is not a job");
+    const { id: f, input: c } = u;
+    let h;
     try {
-      if (we(i.html, B, i.maxNodes, i.maxAttributeChars).status !== "within") {
-        t.postMessage({ id: l, output: { status: "too-large" } });
+      if (ke(c.html, F, c.maxNodes, c.maxAttributeChars).status !== "within") {
+        t.postMessage({ id: f, output: { status: "too-large" } });
         return;
       }
-      const s = JSON.stringify([i.iframeHosts, i.dataPath]);
-      let E = n.get(s);
-      E === void 0 && (E = ze(i.iframeHosts, i.dataPath, B), n.set(s, E));
-      const g = E(i.html);
-      T = g.length > i.maxSanitizedChars ? { status: "too-large" } : { status: "sanitized", html: g };
-    } catch (s) {
-      T = s instanceof J ? { status: "too-large" } : { status: "error", message: s instanceof Error ? `${s.name}: ${s.message}` : String(s) };
+      const n = JSON.stringify([c.iframeHosts, c.dataPath]);
+      let m = i.get(n);
+      m === void 0 && (m = Ge(c.iframeHosts, c.dataPath, F), i.set(n, m));
+      const g = m(c.html);
+      h = g.length > c.maxSanitizedChars ? { status: "too-large" } : { status: "sanitized", html: g };
+    } catch (n) {
+      h = n instanceof Y ? { status: "too-large" } : { status: "error", message: n instanceof Error ? `${n.name}: ${n.message}` : String(n) };
     }
-    t.postMessage({ id: l, output: T });
+    t.postMessage({ id: f, output: h });
   }), t.postMessage({ ready: !0 });
 };
-Be();
+Ve();

package/dist/server/anonymous.d.cts

@@ -1,9 +1,9 @@
-import { ExplorerAuthentication } from "./ports.cjs";
+import { ExplorerAuthentication, ExplorerAuthenticationMode } from "./ports.cjs";
 export type AnonymousPrincipal = {
     readonly kind: "anonymous";
 };
 export type AnonymousAccess = {
-    readonly authenticate: (request: Request) => Promise<ExplorerAuthentication<AnonymousPrincipal>>;
+    readonly authenticate: (request: Request, mode: ExplorerAuthenticationMode) => Promise<ExplorerAuthentication<AnonymousPrincipal>>;
     readonly principalKey: (principal: AnonymousPrincipal) => string;
     readonly signedOutPage: (request: Request, headers: Headers) => Response;
 };

package/dist/server/anonymous.d.ts

@@ -1,9 +1,9 @@
-import { ExplorerAuthentication } from "./ports.js";
+import { ExplorerAuthentication, ExplorerAuthenticationMode } from "./ports.js";
 export type AnonymousPrincipal = {
     readonly kind: "anonymous";
 };
 export type AnonymousAccess = {
-    readonly authenticate: (request: Request) => Promise<ExplorerAuthentication<AnonymousPrincipal>>;
+    readonly authenticate: (request: Request, mode: ExplorerAuthenticationMode) => Promise<ExplorerAuthentication<AnonymousPrincipal>>;
     readonly principalKey: (principal: AnonymousPrincipal) => string;
     readonly signedOutPage: (request: Request, headers: Headers) => Response;
 };

package/dist/server/ports.d.cts

@@ -15,6 +15,9 @@ export type ExplorerAuthentication<P> = {
     readonly status: "forbidden";
     readonly headers?: HeadersInit;
 };
+export type ExplorerAuthenticationMode = {
+    readonly readOnly: boolean;
+};
 export type ExplorerSourceContext<P> = {
     readonly principal: P;
     readonly request: Request;
@@ -77,7 +80,7 @@ export type ExplorerHostDocument = {
 } | ExplorerFailureDocument;
 export type MarkdownExplorerServerConfig<P> = {
     readonly config: ExplorerConfig;
-    readonly authenticate: (request: Request) => Promise<ExplorerAuthentication<P>>;
+    readonly authenticate: (request: Request, mode: ExplorerAuthenticationMode) => Promise<ExplorerAuthentication<P>>;
     readonly principalKey: (principal: P) => string;
     readonly scopeSecret: string;
     readonly sources: readonly ExplorerSource<P>[];

package/dist/server/ports.d.ts

@@ -15,6 +15,9 @@ export type ExplorerAuthentication<P> = {
     readonly status: "forbidden";
     readonly headers?: HeadersInit;
 };
+export type ExplorerAuthenticationMode = {
+    readonly readOnly: boolean;
+};
 export type ExplorerSourceContext<P> = {
     readonly principal: P;
     readonly request: Request;
@@ -77,7 +80,7 @@ export type ExplorerHostDocument = {
 } | ExplorerFailureDocument;
 export type MarkdownExplorerServerConfig<P> = {
     readonly config: ExplorerConfig;
-    readonly authenticate: (request: Request) => Promise<ExplorerAuthentication<P>>;
+    readonly authenticate: (request: Request, mode: ExplorerAuthenticationMode) => Promise<ExplorerAuthentication<P>>;
     readonly principalKey: (principal: P) => string;
     readonly scopeSecret: string;
     readonly sources: readonly ExplorerSource<P>[];