@daoyi/nmtl-ui 2.0.1-beta.14 → 2.0.1-beta.140

package/lib/utils/chunkArray.js

@@ -1 +1,15 @@
-var u=function(u,e){return u.reduce((function(u,n,r){return r%e?u[u.length-1].push(n):u.push([n]),u}),[])};export{u as default};
+// Examples
+// chunkArray([1, 2, 3, 4, 5, 6, 7, 8], 3);     // [[1, 2, 3], [4, 5, 6], [7, 8]]
+// chunkArray([1, 2, 3, 4, 5, 6, 7, 8], 4);     // [[1, 2, 3, 4], [5, 6, 7, 8]]
+var chunkArray = function chunkArray(arr, size) {
+  return arr.reduce(function (acc, e, i) {
+    if (i % size) {
+      acc[acc.length - 1].push(e);
+    } else {
+      acc.push([e]);
+    }
+    return acc;
+  }, []);
+};
+
+export { chunkArray as default };

package/lib/utils/convert2HtmlEntities.js

@@ -1 +1,57 @@
-var r=new(0,require("html-to-react").Parser),e=require("markdown-it")({html:!1,xhtmlOut:!0,breaks:!0,langPrefix:"language-",linkify:!1,typographer:!1,quotes:"“”‘’",highlight:function(){return""}}),t=function(t){return void 0===t?"":r.parse(e.render(t))};export{t as default};
+import { a as addNewWindowHint } from './newWindowHint-72ebfe3b.js';
+import '../components/globalConfig';
+
+var HtmlToReactParser = require('html-to-react').Parser;
+var DOMPurify = require('dompurify');
+var htmlToReactParser = new HtmlToReactParser();
+
+/* 後台文稿以 markdown-it（html: true）轉換，原始 HTML 會直接放行；轉成 React 之前必須先消毒，
+   擋掉 <script>、onerror、javascript: 等 XSS 向量（內容雖來自後台，仍做縱深防禦；比照主站 nmtl-web htmlEntities.js）。
+   用獨立實例：@daoyi/timeline 在全域 DOMPurify 掛了 hook，會把所有沒寫 target 的連結強制改成另開新視窗 */
+var purify = DOMPurify(typeof window !== 'undefined' ? window : undefined);
+var sanitize = function sanitize(html) {
+  return purify.isSupported ? purify.sanitize(html, {
+    ADD_ATTR: ['target']
+  }) : html;
+};
+
+// full options list (defaults)
+var md = require('markdown-it')({
+  html: true,
+  // Enable HTML tags in source
+  xhtmlOut: true,
+  // Use '/' to close single tags (<br />).
+  // This is only for full CommonMark compatibility.
+  breaks: true,
+  // Convert '\n' in paragraphs into <br>
+  langPrefix: 'language-',
+  // CSS language prefix for fenced blocks. Can be
+  // useful for external highlighters.
+  linkify: false,
+  // Autoconvert URL-like text to links
+
+  // Enable some language-neutral replacement + quotes beautification
+  // For the full list of replacements, see https://github.com/markdown-it/markdown-it/blob/master/lib/rules_core/replacements.js
+  typographer: false,
+  // Double + single quotes replacement pairs, when typographer enabled,
+  // and smartquotes on. Could be either a String or an Array.
+  //
+  // For example, you can use '«»„“' for Russian, '„“‚‘' for German,
+  // and ['«\xA0', '\xA0»', '‹\xA0', '\xA0›'] for French (including nbsp).
+  quotes: '“”‘’',
+  // Highlighter function. Should return escaped HTML,
+  // or '' if the source string is not changed and should be escaped externally.
+  // If result starts with <pre... internal wrapper is skipped.
+  highlight: function highlight() {
+    return '';
+  } /* str, lang */
+});
+
+// eslint-disable-next-line import/prefer-default-export
+var convert2HtmlEntities = function convert2HtmlEntities(text) {
+  if (text === undefined) return '';
+  /* 先消毒，再替 target="_blank" 的連結文字補「（另開新視窗）」（HM1240404E，2026-10-07） */
+  return htmlToReactParser.parse(addNewWindowHint(sanitize(md.render(text))));
+};
+
+export { convert2HtmlEntities as default };